Re: PF synproxy should act on inbound packets only

[Alexandr Nedvedicky]

Hello,

</snip>
> 
> Just a style nit.  Other errors do not put stdin:1 in brackes.  One
> line per error.  In pf.conf the rule direction matters.  What about
> 
> stdin:1 warning: synproxy used for inbound rules only, ignored for outbound
> 

    thanks, I like your suggestion.

below is updated diff. The new diff also updates pf.conf(5) manpage.

thanks and
regards
sashan

--------8<---------------8<---------------8<------------------8<--------
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index f06171158cb..6c4dde1261f 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -4042,6 +4042,12 @@ rule_consistent(struct pf_rule *r)
                    "synproxy state or modulate state");
                problems++;
        }
+
+       if ((r->keep_state == PF_STATE_SYNPROXY) && (r->direction != PF_IN))
+               fprintf(stderr, "%s:%d: warning: "
+                   "synproxy used for inbound rules only, "
+                   "ignored for outbound\n", file->name, yylval.lineno);
+
        if ((r->nat.addr.type != PF_ADDR_NONE ||
            r->rdr.addr.type != PF_ADDR_NONE) &&
            r->action != PF_MATCH && !r->keep_state) {
diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index e81198370c9..b77ba5d326c 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -2126,6 +2126,9 @@ will not work if
 .Xr pf 4
 operates on a
 .Xr bridge 4 .
+Also
+.Cm synproxy state
+option acts on inbound packets only.
 .Pp
 Example:
 .Bd -literal -offset indent
diff --git a/sys/net/pf.c b/sys/net/pf.c
index 823fdc22133..986ee57bff9 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -4161,7 +4161,7 @@ pf_create_state(struct pf_pdesc *pd, struct pf_rule *r, 
struct pf_rule *a,
                s->tag = tag;
        }
        if (pd->proto == IPPROTO_TCP && (th->th_flags & (TH_SYN|TH_ACK)) ==
-           TH_SYN && r->keep_state == PF_STATE_SYNPROXY) {
+           TH_SYN && r->keep_state == PF_STATE_SYNPROXY && pd->dir == PF_IN) {
                int rtid = pd->rdomain;
                if (act->rtableid >= 0)
                        rtid = act->rtableid;