From: Avinash Duduskar <avinash.duduskar@gmail.com>
Subject: Re: authpf: kill states in the session's routing domain
To: tech@openbsd.org
Cc: sashan@fastmail.net
Date: Mon, 26 Oct 2026 16:44:52 +0530

On Fri, Jul 24, 2026 at 05:11:07PM +0530, Avinash H. Duduskar wrote:
> Updated diff below, thanks for the review.

Bump. Same diff with the exit(1) change sashan asked for, re-rolled
against -current.

diff --git a/usr.sbin/authpf/authpf.c b/usr.sbin/authpf/authpf.c
index fb8619d93dd..b8cb60fa58f 100644
--- a/usr.sbin/authpf/authpf.c
+++ b/usr.sbin/authpf/authpf.c
@@ -20,12 +20,14 @@
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/sysctl.h>
 #include <sys/wait.h>
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <net/if.h>
 #include <net/pfvar.h>
+#include <net/route.h>
 
 #include <err.h>
 #include <errno.h>
@@ -51,6 +53,7 @@ static int	remove_stale_rulesets(void);
 static int	recursive_ruleset_purge(char *, char *);
 static int	change_filter(int, const char *, const char *);
 static int	change_table(int, const char *);
+static u_int	authpf_rdomain(void);
 static void	authpf_kill_states(void);
 
 int	dev;			/* pf device */
@@ -889,6 +892,32 @@ change_table(int add, const char *ipsrc)
 	return (0);
 }
 
+/*
+ * Map the process routing table to its routing domain; a policy-routing
+ * rtable lives in rdomain 0.
+ */
+static u_int
+authpf_rdomain(void)
+{
+	struct rt_tableinfo	info;
+	int			mib[6];
+	size_t			len = sizeof(info);
+	int			rtable = getrtable();
+
+	mib[0] = CTL_NET;
+	mib[1] = PF_ROUTE;
+	mib[2] = 0;
+	mib[3] = 0;
+	mib[4] = NET_RT_TABLE;
+	mib[5] = rtable;
+
+	if (sysctl(mib, 6, &info, &len, NULL, 0) == -1) {
+		syslog(LOG_ERR, "sysctl NET_RT_TABLE: %m");
+		exit(1);
+	}
+	return (info.rti_domainid);
+}
+
 /*
  * This is to kill off states that would otherwise be left behind stateful
  * rules. This means we don't need to allow in more traffic than we really
@@ -905,6 +934,12 @@ authpf_kill_states(void)
 	memset(&psk, 0, sizeof(psk));
 	memset(&target, 0, sizeof(target));
 
+	/*
+	 * DIOCKILLSTATES matches psk_rdomain exactly, so kill in the
+	 * routing domain the session runs in, not just rdomain 0.
+	 */
+	psk.psk_rdomain = authpf_rdomain();
+
 	if (inet_pton(AF_INET, ipsrc, &target.v4) == 1)
 		psk.psk_af = AF_INET;
 	else if (inet_pton(AF_INET6, ipsrc, &target.v6) == 1)