HomeFreeBSD

pf: don't drop packets when redirection information comes from a state

Description

pf: don't drop packets when redirection information comes from a state

For some traffic there might be no matching rule in the current ruleset,
for example when a state was imported via pfsync from a sytem with a
different ruleset checksum. In this case pf_route uses s->rt_addr for
routing target instead of r->rpool.cur but r->rpool is checked anyway,
resulting in dropped packets.

PR: 259183
Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net>
Sponsored by: InnoGames GmbH

Details

Provenance
kpAuthored on Oct 16 2021, 4:53 PM
Parents
rGe2aab5e2d734: nfscl: Move release of the clientID lock into nfscl_doclose()
Branches
Unknown
Tags
Unknown