From: dlg <dlg@openbsd.org>
Date: Wed, 3 Feb 2021 07:41:12 +0000 (+0000)
Subject: change pf_route so pf only runs when packets enter and leave the stack.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=251649164bf66ee51a475847245386750d55d5c3;p=openbsd

change pf_route so pf only runs when packets enter and leave the stack.

before this change pf_route operated on the semantic that pf runs
when packets go over an interface, so when pf_route changed which
interface the packet was on it would run pf_test again. this change
changes (restores) the semantic that pf is only supposed to run
when packets go in or out of the network stack, even if route-to
is responsibly for short circuiting past the network stack.

just to be clear, for normal packets (ie, those not touched by
route-to/reply-to/dup-to), there isn't a difference between running
pf when packets enter or leave the stack, or having pf run when a
packet goes over an interface.

the main reason for this change is that running the same packet
through pf multiple times creates confusion for the state table.
by default, pf states are floating, meaning that packets are matched
to states regardless of which interface they're going over. if a
packet leaving on em0 is rerouted out em1, both traversals will end
up using the same state, which at best will make the accounting
look weird, or at worst fail some checks in the state and get
dropped.

another reason for this commit is is to make handling of the changes
that route-to makes consistent with other changes that are made to
packet. eg, when nat is applied to a packet, we don't run pf_test
again with the new addresses.

the main caveat with this diff is you can't have one rule that
pushes a packet out a different interface, and then have a rule on
that second interface that NATs the packet. i'm not convinced this
ever worked reliably or was used much anyway, so we don't think
it's a big concern.

discussed with many, with special thanks to bluhm@, sashan@ and
sthen@ for weathering most of that pain.
ok claudio@ sashan@ jmatthew@
---

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 9c25d420d21..44e0e17f757 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.1106 2021/02/01 00:31:05 dlg Exp $ */
+/*	$OpenBSD: pf.c,v 1.1107 2021/02/03 07:41:12 dlg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -6033,7 +6033,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *s)
 	    (ifp->if_flags & IFF_LOOPBACK) == 0)
 		ip->ip_src = ifatoia(rt->rt_ifa)->ia_addr.sin_addr;
 
-	if (s->rt != PF_DUPTO && pd->kif->pfik_ifp != ifp) {
+	if (s->rt != PF_DUPTO && pd->dir == PF_IN) {
 		if (pf_test(AF_INET, PF_OUT, ifp, &m0) != PF_PASS)
 			goto bad;
 		else if (m0 == NULL)
@@ -6178,7 +6178,7 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *s)
 	    (ifp->if_flags & IFF_LOOPBACK) == 0)
 		ip6->ip6_src = ifatoia6(rt->rt_ifa)->ia_addr.sin6_addr;
 
-	if (s->rt != PF_DUPTO && pd->kif->pfik_ifp != ifp) {
+	if (s->rt != PF_DUPTO && pd->dir == PF_IN) {
 		if (pf_test(AF_INET6, PF_OUT, ifp, &m0) != PF_PASS)
 			goto bad;
 		else if (m0 == NULL)