d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: Improve route-to handling of pfsync'd states

Browse Source 
When a state if pfsync’d to a different host it doesn’t get all of the
expected pointers, including the pointer to the struct pfi_kif / struct
ifnet rt_kif pointer. (I.e. the interface to route out on).

That in turn means that pf_route() ends up dropping the packet.

Use the rule's struct pfi_kif pointer so we can still route out of the
expected interface.

MFC after:	2 weeks
Sponsored by:	Orange Business Services
This commit is contained in:
Kristof Provost 2022-06-04 12:38:40 +02:00
parent bbb0ca45f8
commit 81ef217ad4
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netpfil/pf/pf.c
View File

@ -6344,6 +6344,10 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
r->rpool.cur->kif->pfik_ifp : NULL;
} else {
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
/* If pfsync'd */
if (ifp == NULL)
ifp = r->rpool.cur->kif ?
r->rpool.cur->kif->pfik_ifp : NULL;
PF_STATE_UNLOCK(s);
}
if (ifp == oifp) {
@ -6400,6 +6404,9 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
PF_STATE_UNLOCK(s);
}
/* If pfsync'd */
if (ifp == NULL)
ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
if (ifp == NULL)
goto bad;
@ -6539,6 +6546,10 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
r->rpool.cur->kif->pfik_ifp : NULL;
} else {
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
/* If pfsync'd */
if (ifp == NULL)
ifp = r->rpool.cur->kif ?
r->rpool.cur->kif->pfik_ifp : NULL;
PF_STATE_UNLOCK(s);
}
if (ifp == oifp) {
@ -6598,6 +6609,9 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
if (s)
PF_STATE_UNLOCK(s);
/* If pfsync'd */
if (ifp == NULL)
ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
if (ifp == NULL)
goto bad;