UnivNautes

diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c

index 1e957f6..2903e32 100644

--- a/sbin/pfctl/pfctl.c

+++ b/sbin/pfctl/pfctl.c

@@ -124,6 +124,8 @@ int		 src_node_killers;

 char		*src_node_kill[2];

 int		 state_killers;

 char		*state_kill[2];

+int		 if_kill;

+char		*if_gw_kill;

 int		 loadopt;

 int		 altqsupport;

@@ -389,10 +391,46 @@ pfctl_clear_states(int dev, const char *iface, int opts)

 	    sizeof(psk.psk_ifname)) >= sizeof(psk.psk_ifname))

 		errx(1, "invalid interface: %s", iface);

-	if (ioctl(dev, DIOCCLRSTATES, &psk))

-		err(1, "DIOCCLRSTATES");

-	if ((opts & PF_OPT_QUIET) == 0)

-		fprintf(stderr, "%d states cleared\n", psk.psk_killed);

+	if (if_kill) {

+		struct addrinfo *res, *resp;

+		u_int killed;

+		int ret_ga;

+

+		if ((ret_ga = getaddrinfo(if_gw_kill, NULL, NULL, &res))) {

+			errx(1, "getaddrinfo: %s", gai_strerror(ret_ga));

+			/* NOTREACHED */

+		}

+		killed = 0;

+		for (resp = res; resp; resp = resp->ai_next) {

+			if (resp->ai_addr == NULL)

+				continue;

+

+			psk.psk_af = resp->ai_family;

+

+			if (psk.psk_af == AF_INET)

+				psk.psk_src.addr.v.a.addr.v4 =

+					((struct sockaddr_in *)resp->ai_addr)->sin_addr;

+			else if (psk.psk_af == AF_INET6)

+				psk.psk_src.addr.v.a.addr.v6 =

+					((struct sockaddr_in6 *)resp->ai_addr)->

+					sin6_addr;

+			else

+				errx(1, "Unknown address family %d", psk.psk_af);

+

+			if (ioctl(dev, DIOCCLRSTATES, &psk))

+				err(1, "DIOCCLRSTATES");

+			if ((opts & PF_OPT_QUIET) == 0)

+				killed += psk.psk_af;

+		}

+		if ((opts & PF_OPT_QUIET) == 0)

+			fprintf(stderr, "%d states cleared\n", killed);

+	} else {

+		if (ioctl(dev, DIOCCLRSTATES, &psk))

+			err(1, "DIOCCLRSTATES");

+		if ((opts & PF_OPT_QUIET) == 0)

+			fprintf(stderr, "%d states cleared\n", psk.psk_af);

+	}

+

 	return (0);

 }

@@ -2024,7 +2062,7 @@ main(int argc, char *argv[])

 		usage();

 	while ((ch = getopt(argc, argv,

-	    "a:AdD:eqf:F:ghi:k:K:mnNOo:Pp:rRs:t:T:vx:y:z")) != -1) {

+	    "a:AdD:eqf:F:gG:hi:k:K:mnNOo:Pp:rRs:t:T:vx:y:z")) != -1) {

 		switch (ch) {

 		case 'a':

 			anchoropt = optarg;

@@ -2093,6 +2131,16 @@ main(int argc, char *argv[])

 		case 'g':

 			opts |= PF_OPT_DEBUG;

 			break;

+		case 'G':

+			if (if_kill) {

+				warnx("can only specify -b twice");

+				usage();

+				/* NOTREACHED */

+			}

+			if_gw_kill = optarg;

+			if_kill++;

+			mode = O_RDWR;

+			break;

 		case 'A':

 			loadopt |= PFCTL_FLAG_ALTQ;

 			break;

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c

index a4134ca..cb38fcb 100644

--- a/sys/netpfil/pf/pf.c

+++ b/sys/netpfil/pf/pf.c

@@ -337,8 +337,8 @@ VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]);

 			return (PF_PASS);				\

 	} while (0)

-#define	BOUND_IFACE(r, k) \

-	((r)->rule_flag & PFRULE_IFBOUND) ? (k) : V_pfi_all

+#define	BOUND_IFACE(r, k) 	k

+	/* ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : V_pfi_all */

 #define	STATE_INC_COUNTERS(s)						\

 	do {								\

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c

index 4c0f1f5..1b94992 100644

--- a/sys/netpfil/pf/pf_ioctl.c

+++ b/sys/netpfil/pf/pf_ioctl.c

@@ -66,6 +66,8 @@ __FBSDID("$FreeBSD$");

 #include <net/route.h>

 #include <net/pfil.h>

 #include <net/pfvar.h>

+#define TCPSTATES

+#include <netinet/tcp_fsm.h>

 #include <net/if_pfsync.h>

 #include <net/if_pflog.h>

@@ -1598,6 +1600,7 @@ DIOCCHANGERULE_error:

 	case DIOCCLRSTATES: {

 		struct pf_state		*s;

+		struct pf_state_key	*sk;

 		struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;

 		u_int			 i, killed = 0;

@@ -1607,6 +1610,7 @@ DIOCCHANGERULE_error:

 relock_DIOCCLRSTATES:

 			PF_HASHROW_LOCK(ih);

 			LIST_FOREACH(s, &ih->states, entry)

+				sk = s->key[PF_SK_WIRE];

 				if (!psk->psk_ifname[0] ||

 				    !strcmp(psk->psk_ifname,

 				    s->kif->pfik_name)) {

@@ -1618,6 +1622,20 @@ relock_DIOCCLRSTATES:

 					pf_unlink_state(s, PF_ENTER_LOCKED);

 					killed++;

 					goto relock_DIOCCLRSTATES;

+				} else if (sk->af == psk->psk_af &&

+				    !PF_AZERO(&psk->psk_src.addr.v.a.addr, psk->psk_af) &&

+			    	    !PF_AZERO(&s->rt_addr, sk->af) &&

+				    PF_AEQ(&psk->psk_src.addr.v.a.addr, &s->rt_addr, sk->af)) {

+					if (sk->proto == IPPROTO_TCP)

+						s->src.state = PF_TCPS_PROXY_DST; /* XXX: Hack to send a RST back to the host */

+					/*

+					 * Don't send out individual

+					 * delete messages.

+					 */

+					s->state_flags |= PFSTATE_NOSYNC;

+					pf_unlink_state(s, PF_ENTER_LOCKED);

+					killed++;

+					goto relock_DIOCCLRSTATES;

 				}

 			PF_HASHROW_UNLOCK(ih);

 		}