The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=dbbcbaae1d7bb4d05ebadba95cddbde25c0d1f5c
commit dbbcbaae1d7bb4d05ebadba95cddbde25c0d1f5c
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-02-21 10:52:26 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-02-21 10:52:26 +0000
pf: Cut down on if statements around pf_icmp_state_lookup
Checked with blambert@, OK millert, henning
Obtained from: OpenBSD, mikeb <mi...@openbsd.org>, 12e5d1443d
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sys/netpfil/pf/pf.c | 39 +++++++++++++++++----------------------
1 file changed, 17 insertions(+), 22 deletions(-)
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 610e65026c28..15d9697c0040 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -7659,19 +7659,16 @@ pf_test_state_icmp(struct pf_kstate **state, struct
pf_pdesc *pd,
*/
ret = pf_icmp_state_lookup(&key, pd, state, virtual_id,
virtual_type, icmp_dir, &iidx, 0, 0);
+ /* IPv6? try matching a multicast address */
+ if (ret == PF_DROP && pd->af == AF_INET6 && icmp_dir == PF_OUT)
{
+ MPASS(*state == NULL);
+ ret = pf_icmp_state_lookup(&key, pd, state,
+ virtual_id, virtual_type,
+ icmp_dir, &iidx, 1, 0);
+ }
if (ret >= 0) {
MPASS(*state == NULL);
- if (ret == PF_DROP && pd->af == AF_INET6 &&
- icmp_dir == PF_OUT) {
- ret = pf_icmp_state_lookup(&key, pd, state,
- virtual_id, virtual_type,
- icmp_dir, &iidx, 1, 0);
- if (ret >= 0) {
- MPASS(*state == NULL);
- return (ret);
- }
- } else
- return (ret);
+ return (ret);
}
(*state)->expire = pf_get_uptime();
@@ -8422,19 +8419,17 @@ pf_test_state_icmp(struct pf_kstate **state, struct
pf_pdesc *pd,
ret = pf_icmp_state_lookup(&key, &pd2, state,
virtual_id, virtual_type, icmp_dir, &iidx, 0, 1);
+ /* IPv6? try matching a multicast address */
+ if (ret == PF_DROP && pd2.af == AF_INET6 &&
+ icmp_dir == PF_OUT) {
+ MPASS(*state == NULL);
+ ret = pf_icmp_state_lookup(&key, &pd2,
+ state, virtual_id, virtual_type,
+ icmp_dir, &iidx, 1, 1);
+ }
if (ret >= 0) {
MPASS(*state == NULL);
- if (ret == PF_DROP && pd2.af == AF_INET6 &&
- icmp_dir == PF_OUT) {
- ret = pf_icmp_state_lookup(&key, &pd2,
- state, virtual_id, virtual_type,
- icmp_dir, &iidx, 1, 1);
- if (ret >= 0) {
- MPASS(*state == NULL);
- return (ret);
- }
- } else
- return (ret);
+ return (ret);
}
/* translate source/destination address, if necessary */
