Next: Miscellaneous Tags
Up: Using mbuf_tags
Previous: Loop-Detection Tags
These tags are used exclusively by PF, the OpenBSD packet filtering
engine [4]. Unless indicated otherwise, these tags do
not carry any additional data.
- PF_GENERATED is used to mark packets that are
generated by PF itself, e.g., ICMP messages indicating a
dropped packet, or firewall-generated TCP RST packets. Such packets
should not be subjected to the PF filtering rules, thus PF
unconditionally accepts packets that carry this tag.
- PF_ROUTED is used to mark packets that are
routed by the packet filtering engine, e.g., using the
rdr rule. Such packets are not tested by PF more than once, to
prevent loops caused by subsequent matching routing rules.
- PF_FRAGCACHE is used to mark fragmented packets cached
by PF. PF may cache such fragments as directed by its configuration,
for traffic normalization purposes, e.g., to avoid
overlapping-fragment attacks. Packets with this tag have been cached
by the fragment cache already and will short-circuit it if processed
again. If they were to re-enter the fragment cache, they would be
indistinguishable from a duplicate packet, and would be dropped.
- PF_QID is used by PF to indicate to the network
traffic-shaping discipline, ALTQ, which queue the packet should go
to. The tag contains the identifier of the queue.
- PF_TAG is used by PF to tag packets with user-defined
information, and filter on those later on. Effectively, the tag is an
internal marker that can be used to identify these packets. For
example, such tags can be used to propagate information between input
and output filtering rules on different interfaces, or to determine if
packets have been processed by address-translation rules. These tags
are sticky, meaning that the packet will be tagged even if the
rule that attaches the tag is not the last matching rule. Further
matching PF rules can replace that tag with a new one, but will not
remove a previously-applied tag. A packet is only ever assigned one
tag at a time.
Next: Miscellaneous Tags
Up: Using mbuf_tags
Previous: Loop-Detection Tags
Angelos D. Keromytis
7/7/2003