diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2021-10-16 16:53:39 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2021-10-16 21:02:26 +0000 |
| commit | 076b3a50fd71d84f47bca71758e7fff3c02582e9 (patch) | |
| tree | f028995a05ac5f8c68a1aa3504f18ab37d643c34 | |
| parent | e2aab5e2d73486aa76bb861d583bbce021661601 (diff) | |
| download | src-076b3a50fd71d84f47bca71758e7fff3c02582e9.tar.gz src-076b3a50fd71d84f47bca71758e7fff3c02582e9.zip | |
pf: don't drop packets when redirection information comes from a state
For some traffic there might be no matching rule in the current ruleset,
for example when a state was imported via pfsync from a sytem with a
different ruleset checksum. In this case pf_route uses s->rt_addr for
routing target instead of r->rpool.cur but r->rpool is checked anyway,
resulting in dropped packets.
PR: 259183
Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net>
Sponsored by: InnoGames GmbH
| -rw-r--r-- | sys/netpfil/pf/pf.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index b67f688c3f3f..2c625703c5d9 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -5856,12 +5856,12 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, bzero(&naddr, sizeof(naddr)); - if (TAILQ_EMPTY(&r->rpool.list)) { - DPFPRINTF(PF_DEBUG_URGENT, - ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__)); - goto bad_locked; - } if (s == NULL) { + if (TAILQ_EMPTY(&r->rpool.list)) { + DPFPRINTF(PF_DEBUG_URGENT, + ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__)); + goto bad_locked; + } pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src, &naddr, NULL, &sn); if (!PF_AZERO(&naddr, AF_INET)) @@ -6042,12 +6042,12 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, bzero(&naddr, sizeof(naddr)); - if (TAILQ_EMPTY(&r->rpool.list)) { - DPFPRINTF(PF_DEBUG_URGENT, - ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__)); - goto bad_locked; - } if (s == NULL) { + if (TAILQ_EMPTY(&r->rpool.list)) { + DPFPRINTF(PF_DEBUG_URGENT, + ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__)); + goto bad_locked; + } pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, &naddr, NULL, &sn); if (!PF_AZERO(&naddr, AF_INET6)) |