[Bug 237477] kernel option PF_DEFAULT_TO_DROP breaks rdr rules with pass keyword.

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237477

Kristof Provost <kp at freebsd.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kp at freebsd.org

--- Comment #1 from Kristof Provost <kp at freebsd.org> ---
I think I see what's going on there.
PF_DEFAULT_TO_DROP sets V_pf_default_rule.action = PF_DROP;

A 'rdr pass' sets the 'natpass' flag on a rule (I think, not 100% sure), which
causes us to do:
if (nr->natpass)
    r = NULL;

in pf_test_rule().
That's intended to just select the default rule, which usually passes traffic.
With 'PF_DEFAULT_TO_DROP' that doesn't work as expected.

Note that I'm not picking this bug up right now. It's on my todo list with many
dozens of others. I make no promises about when I'll come back to this.

-- 
You are receiving this mail because:
You are the assignee for the bug.