diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2022-06-04 10:38:40 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2022-06-04 12:23:17 +0000 |
| commit | 81ef217ad428c29be669aac2166d194db31817a7 (patch) | |
| tree | c6776dbab225b5f9f8eeaaca7ff7e2e828a590d2 | |
| parent | bbb0ca45f8189911a35ba76000783b05188153af (diff) | |
| download | src-81ef217ad428c29be669aac2166d194db31817a7.tar.gz src-81ef217ad428c29be669aac2166d194db31817a7.zip | |
pf: Improve route-to handling of pfsync'd states
When a state if pfsync’d to a different host it doesn’t get all of the
expected pointers, including the pointer to the struct pfi_kif / struct
ifnet rt_kif pointer. (I.e. the interface to route out on).
That in turn means that pf_route() ends up dropping the packet.
Use the rule's struct pfi_kif pointer so we can still route out of the
expected interface.
MFC after: 2 weeks
Sponsored by: Orange Business Services
| -rw-r--r-- | sys/netpfil/pf/pf.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 56dab43a2810..8e3cd98879a6 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -6344,6 +6344,10 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, r->rpool.cur->kif->pfik_ifp : NULL; } else { ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; + /* If pfsync'd */ + if (ifp == NULL) + ifp = r->rpool.cur->kif ? + r->rpool.cur->kif->pfik_ifp : NULL; PF_STATE_UNLOCK(s); } if (ifp == oifp) { @@ -6400,6 +6404,9 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; PF_STATE_UNLOCK(s); } + /* If pfsync'd */ + if (ifp == NULL) + ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; if (ifp == NULL) goto bad; @@ -6539,6 +6546,10 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, r->rpool.cur->kif->pfik_ifp : NULL; } else { ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; + /* If pfsync'd */ + if (ifp == NULL) + ifp = r->rpool.cur->kif ? + r->rpool.cur->kif->pfik_ifp : NULL; PF_STATE_UNLOCK(s); } if (ifp == oifp) { @@ -6598,6 +6609,9 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp, if (s) PF_STATE_UNLOCK(s); + /* If pfsync'd */ + if (ifp == NULL) + ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; if (ifp == NULL) goto bad; |