diff options
| -rw-r--r-- | sys/contrib/pf/net/pf.c | 11 | ||||
| -rw-r--r-- | sys/contrib/pf/net/pfvar.h | 7 |
2 files changed, 14 insertions, 4 deletions
diff --git a/sys/contrib/pf/net/pf.c b/sys/contrib/pf/net/pf.c index c552d820f99d..50c377cc4531 100644 --- a/sys/contrib/pf/net/pf.c +++ b/sys/contrib/pf/net/pf.c @@ -726,6 +726,9 @@ pf_src_connlimit(struct pf_state **state) int bad = 0; (*state)->src_node->conn++; +#ifdef __FreeBSD__ + (*state)->local_flags |= PFSTATE_SRC_CONN; +#endif pf_add_threshold(&(*state)->src_node->conn_rate); if ((*state)->rule.ptr->max_src_conn && @@ -1058,8 +1061,12 @@ pf_src_tree_remove_state(struct pf_state *s) if (s->src_node != NULL) { if (s->proto == IPPROTO_TCP) { +#ifdef __FreeBSD__ + if (s->local_flags & PFSTATE_SRC_CONN) +#else if (s->src.state == PF_TCPS_PROXY_DST || s->timeout >= PFTM_TCP_ESTABLISHED) +#endif --s->src_node->conn; } if (--s->src_node->states <= 0) { @@ -1086,9 +1093,9 @@ void pf_purge_expired_state(struct pf_state *cur) { #ifdef __FreeBSD__ - if (cur->sync_flags & PFSTATE_EXPIRING) + if (cur->local_flags & PFSTATE_EXPIRING) return; - cur->sync_flags |= PFSTATE_EXPIRING; + cur->local_flags |= PFSTATE_EXPIRING; #endif if (cur->src.state == PF_TCPS_PROXY_DST) pf_send_tcp(cur->rule.ptr, cur->af, diff --git a/sys/contrib/pf/net/pfvar.h b/sys/contrib/pf/net/pfvar.h index 5fdef85413bd..f741130be615 100644 --- a/sys/contrib/pf/net/pfvar.h +++ b/sys/contrib/pf/net/pfvar.h @@ -791,9 +791,12 @@ struct pf_state { #define PFSTATE_FROMSYNC 0x02 #define PFSTATE_STALE 0x04 #ifdef __FreeBSD__ -#define PFSTATE_EXPIRING 0x10 -#endif + u_int8_t local_flags; +#define PFSTATE_EXPIRING 0x01 +#define PFSTATE_SRC_CONN 0x02 +#else u_int8_t pad; +#endif }; TAILQ_HEAD(pf_rulequeue, pf_rule); |