CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/09 03:56:59
Modified files:
sys/net : pf_lb.c
Log message:
pf(4): depleted source port pool for NAT starves other packets
The function pf_get_sport() in current selects the source port
number for network address translation (a.k.a. NAT). It basically
chooses a random source port and uses pf_find_state_all()
to check if the chosen port number is already in use for a particular NAT
address. If the port is already in use, pf_get_sport() selects
another port number and retries. This process continues as long
as the chosen port number collides with an existing address:port tuple.
The problem is that all this happens under the protection of
PF_LOCK(). This effectively stops pf(4) rule evaluation
for other packets that enter the firewall and have no state.
The fix introduces a limit on retries. The limit is set to 128.
If no free port number is found within 128 attempts, the function
gives up. The packet is dropped and PF_LOCK() is released so other
packets waiting for a rule check can be inspected by pf_test().
The issue was kindly reported and the fix submitted by Acts-1631.
OK bluhm@
