pf: Improve route-to handling of pfsync'd states
When a state if pfsync’d to a different host it doesn’t get all of the expected pointers, including the pointer to the struct pfi_kif / struct ifnet rt_kif pointer. (I.e. the interface to route out on). That in turn means that pf_route() ends up dropping the packet. Use the rule's struct pfi_kif pointer so we can still route out of the expected interface. MFC after: 2 weeks Sponsored by: Orange Business Services
This commit is contained in:
parent
bbb0ca45f8
commit
81ef217ad4
@ -6344,6 +6344,10 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
|
||||
r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
} else {
|
||||
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
|
||||
/* If pfsync'd */
|
||||
if (ifp == NULL)
|
||||
ifp = r->rpool.cur->kif ?
|
||||
r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
PF_STATE_UNLOCK(s);
|
||||
}
|
||||
if (ifp == oifp) {
|
||||
@ -6400,6 +6404,9 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
|
||||
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
|
||||
PF_STATE_UNLOCK(s);
|
||||
}
|
||||
/* If pfsync'd */
|
||||
if (ifp == NULL)
|
||||
ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
if (ifp == NULL)
|
||||
goto bad;
|
||||
|
||||
@ -6539,6 +6546,10 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
|
||||
r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
} else {
|
||||
ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
|
||||
/* If pfsync'd */
|
||||
if (ifp == NULL)
|
||||
ifp = r->rpool.cur->kif ?
|
||||
r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
PF_STATE_UNLOCK(s);
|
||||
}
|
||||
if (ifp == oifp) {
|
||||
@ -6598,6 +6609,9 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
|
||||
if (s)
|
||||
PF_STATE_UNLOCK(s);
|
||||
|
||||
/* If pfsync'd */
|
||||
if (ifp == NULL)
|
||||
ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
|
||||
if (ifp == NULL)
|
||||
goto bad;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user