pf: Fix synproxy
Synproxy was accidentally broken by r335569. The 'return (action)' must be executed for every non-PF_PASS result, but the error packet (TCP RST or ICMP error) should only be sent if the packet was dropped (i.e. PF_DROP) and the return flag is set. PR: 229477 Submitted by: Andre Albsmeier <mail AT fbsd.e4m.org> MFC after: 1 week
This commit is contained in:
parent
307546ec52
commit
32ece669c2
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=336275
@ -3558,9 +3558,11 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
|
||||
action = pf_create_state(r, nr, a, pd, nsn, nk, sk, m, off,
|
||||
sport, dport, &rewrite, kif, sm, tag, bproto_sum, bip_sum,
|
||||
hdrlen);
|
||||
if (action != PF_PASS && r->rule_flag & PFRULE_RETURN) {
|
||||
pf_return(r, nr, pd, sk, off, m, th, kif,
|
||||
bproto_sum, bip_sum, hdrlen, &reason);
|
||||
if (action != PF_PASS) {
|
||||
if (action == PF_DROP &&
|
||||
(r->rule_flag & PFRULE_RETURN))
|
||||
pf_return(r, nr, pd, sk, off, m, th, kif,
|
||||
bproto_sum, bip_sum, hdrlen, &reason);
|
||||
return (action);
|
||||
}
|
||||
} else {
|
||||
|
Loading…
Reference in New Issue
Block a user