--- b/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -504,34 +504,46 @@ pfsync_state_import(struct pfsync_state *sp, u_int8_t flags) uint32_t timeout; timeout = r->timeout[sp->timeout]; if (!timeout) timeout = V_pf_default_rule.timeout[sp->timeout]; /* sp->expire may have been adaptively scaled by export. */ st->expire -= timeout - ntohl(sp->expire); } + /* reconstruct rt_kif from rule for round-robin redirection */ + st->rt_kif = NULL; + if (r != &V_pf_default_rule && + (r->rpool.opts & PF_POOL_TYPEMASK ) == PF_POOL_ROUNDROBIN) { + struct pf_pooladdr *acur; + TAILQ_FOREACH(acur, &(r->rpool.list), entries) { + if (acur->addr.type == PF_ADDR_TABLE && + pfr_match_addr(acur->addr.p.tbl, &st->rt_addr, + skw->af)) + st->rt_kif = acur->kif; + }; + }; + st->direction = sp->direction; st->log = sp->log; st->timeout = sp->timeout; st->state_flags = sp->state_flags; st->id = sp->id; st->creatorid = sp->creatorid; pf_state_peer_ntoh(&sp->src, &st->src); pf_state_peer_ntoh(&sp->dst, &st->dst); st->rule.ptr = r; st->nat_rule.ptr = NULL; st->anchor.ptr = NULL; - st->rt_kif = NULL; st->pfsync_time = time_uptime; st->sync_state = PFSYNC_S_NONE; if (!(flags & PFSYNC_SI_IOCTL)) st->state_flags |= PFSTATE_NOSYNC; if ((error = pf_state_insert(kif, skw, sks, st)) != 0) goto cleanup_state;