pf: don't reject route-to'd too-large packetsHEADmain

If we're sending a packet via pf_route()/pf_route6() we check for packet
size and potentially generate ICMP(6) packet too big messages. If we do,
don't consider this a rejected packet. That is, return PF_PASS and set
the mbuf to NULL rather than returning PF_DROP.

This matters for locally generated packets, because with PF_DROP we
can end up returning EACCES to userspace, causing the connection to
terminate. Instead, with PF_PASS and a NULL mbuf this is translated to
PFIL_CONSUMED, which does not return an error to userspace.

MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")

0 files changed, 0 insertions, 0 deletions