From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: relayd: remove dead backup flag and token
To: tech@openbsd.org
Date: Sun, 9 Aug 2026 16:10:25 +0200

If you've read my latest diffs, you'll know I wanted to bring some
transparency to this "backup" THING, but I've realised that this flag
isn't actually being used (I'd already been wondering how it was
supposed to work anyway). We can delete this (unfinished) concept.

OK?

diff --git a/agentx_control.c b/agentx_control.c
index 0f3c098..0146195 100644
--- a/agentx_control.c
+++ b/agentx_control.c
@@ -562,8 +562,6 @@ agentxctl_redirect(struct agentx_varbind *sav)
 			agentx_varbind_integer(sav, 1);
 		else if (rdr->conf.flags & F_DOWN)
 			agentx_varbind_integer(sav, 2);
-		else if (rdr->conf.flags & F_BACKUP)
-			agentx_varbind_integer(sav, 3);
 		else
 			agentx_varbind_integer(sav, 0);
 	} else if (agentx_varbind_get_object(sav) == relaydRedirectName)
diff --git a/parse.y b/parse.y
index 77e9ba1..ed222fc 100644
--- a/parse.y
+++ b/parse.y
@@ -173,7 +173,7 @@ typedef struct {
 %}
 
 %token	AGENTX APPEND
-%token	BACKLOG BACKUP BINARY BLOCK BUFFER BRIEF
+%token	BACKLOG BINARY BLOCK BUFFER BRIEF
 %token	CA CACHE CERTIFICATE CHANGES CHECK CHECKS CIPHERS CLIENT CODE CONNECTION
 %token	CONNECTIONS CONTEXT COOKIE
 %token	DEMOTE DESTINATION DIGEST DISABLE
@@ -2172,8 +2172,6 @@ forwardspec	: STRING port retry	{
 			rlt->rlt_table->conf.flags |= F_USED;
 			rlt->rlt_mode = dstmode;
 			rlt->rlt_flags = F_USED;
-			if (!TAILQ_EMPTY(&rlay->rl_tables))
-				rlt->rlt_flags |= F_BACKUP;
 
 			if (hashkey != NULL &&
 			    (rlay->rl_conf.flags & F_HASHKEY) == 0) {
@@ -2539,7 +2537,6 @@ lookup(char *s)
 		{ "agentx",		AGENTX },
 		{ "append",		APPEND },
 		{ "backlog",		BACKLOG },
-		{ "backup",		BACKUP },
 		{ "binary",		BINARY },
 		{ "block",		BLOCK },
 		{ "brief",		BRIEF },
diff --git a/pfe.c b/pfe.c
index 3911d66..9f44b3f 100644
--- a/pfe.c
+++ b/pfe.c
@@ -720,7 +720,6 @@ pfe_sync(void)
 
 	bzero(&id, sizeof(id));
 	TAILQ_FOREACH(rdr, env->sc_rdrs, entry) {
-		rdr->conf.flags &= ~(F_BACKUP);
 		rdr->conf.flags &= ~(F_DOWN);
 
 		if (rdr->conf.flags & F_DISABLE ||
@@ -728,7 +727,6 @@ pfe_sync(void)
 			rdr->conf.flags |= F_DOWN;
 			active = NULL;
 		} else if (rdr->table->up == 0 && rdr->backup->up > 0) {
-			rdr->conf.flags |= F_BACKUP;
 			active = rdr->backup;
 			active->conf.flags |=
 			    rdr->table->conf.flags & F_CHANGED;
@@ -765,7 +763,6 @@ pfe_sync(void)
 	}
 
 	TAILQ_FOREACH(rt, env->sc_rts, rt_entry) {
-		rt->rt_conf.flags &= ~(F_BACKUP);
 		rt->rt_conf.flags &= ~(F_DOWN);
 
 		if ((rt->rt_gwtable->conf.flags & F_CHANGED))
diff --git a/relayd.c b/relayd.c
index 612538c..7d135f6 100644
--- a/relayd.c
+++ b/relayd.c
@@ -1188,12 +1188,12 @@ table_findbyconf(struct relayd *env, struct table *tb)
 
 	bcopy(&tb->conf, &a, sizeof(a));
 	a.id = a.rdrid = 0;
-	a.flags &= ~(F_USED|F_BACKUP);
+	a.flags &= ~F_USED;
 
 	TAILQ_FOREACH(table, env->sc_tables, entry) {
 		bcopy(&table->conf, &b, sizeof(b));
 		b.id = b.rdrid = 0;
-		b.flags &= ~(F_USED|F_BACKUP);
+		b.flags &= ~F_USED;
 
 		/*
 		 * Compare two tables and return the existing table if
diff --git a/relayd.conf.5 b/relayd.conf.5
index b0e2210..a70f610 100644
--- a/relayd.conf.5
+++ b/relayd.conf.5
@@ -526,8 +526,6 @@ If the
 option is not specified, the first port from the
 .Ic listen on
 directive will be used.
-This directive can be specified twice \(en the second entry will be used
-as the backup table if all hosts in the main table are down.
 At least one entry for the main table is mandatory.
 .It Xo
 .Ic listen on Ar address
@@ -543,7 +541,7 @@ and a
 to listen on.
 .Xr pf 4
 will redirect incoming connections for the specified target to the
-hosts in the main or backup table.
+hosts in the main table.
 The
 .Ar port
 argument can optionally specify a port range instead of a single port;
@@ -703,9 +701,7 @@ Like the previous directive, but connect to a host from the specified
 table; see the
 .Sx Tables
 section above for information about table options.
-This directive can be specified multiple times \(en subsequent entries
-will be used as the backup table if all hosts in the previous table
-are down.
+This directive can be specified multiple times.
 At least one entry for the main table is mandatory.
 As above, use the
 .Ic with tls
@@ -720,10 +716,6 @@ When redirecting connections with a divert-to rule in
 to a relay listening on localhost, this directive will
 look up the real destination address of the intended target host,
 allowing the relay to be run as a transparent proxy.
-If an additional
-.Ic forward to
-directive to a specified address or table is present,
-it will be used as a backup if the lookup failed.
 As above, use the
 .Ic with tls
 directive to enable client-side TLS mode when connecting to the remote host.
diff --git a/relayd.h b/relayd.h
index 199c76f..98ffc2b 100644
--- a/relayd.h
+++ b/relayd.h
@@ -373,7 +373,7 @@ union hashkey {
 };
 
 #define F_DISABLE		0x00000001
-#define F_BACKUP		0x00000002
+#define F_BACKUP		0x00000002 /* unused */
 #define F_USED			0x00000004
 #define F_DOWN			0x00000008
 #define F_ADD			0x00000010