CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/09 04:33:54
Modified files:
sys/net : pf.c
Log message:
pf(4): source tracking option flush does not work for NAT states
The flush option for source tracking rule also removes all states
created by offending source address. This does not work when
rule comes with nat-to option and creates NAT states. Those
states are not matched by pf_src_connlimit() when it attempts
to remove those states.
pf_src_connlimit() when removing the states must also chose correct state key
using packet direction to match the state to remove. The state keys differ
when NAT happens. For states created by nat-to rule one needs to use the
stack-side key that contains original address before packet got translated.
The issue was kindly reported and the fix submitted by Acts-1631.
OK bluhm@
