Bug 259183
| Summary: | pf_route drops packets for traffic not matching a rule | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Kajetan Staszkiewicz <vegeta> | ||||
| Component: | kern | Assignee: | Kristof Provost <kp> | ||||
| Status: | Closed FIXED | ||||||
| Severity: | Affects Only Me | ||||||
| Priority: | --- | ||||||
| Version: | 13.0-STABLE | ||||||
| Hardware: | Any | ||||||
| OS: | Any | ||||||
| Attachments: |
|
||||||
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=076b3a50fd71d84f47bca71758e7fff3c02582e9 commit 076b3a50fd71d84f47bca71758e7fff3c02582e9 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-10-16 16:53:39 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-10-16 21:02:26 +0000 pf: don't drop packets when redirection information comes from a state For some traffic there might be no matching rule in the current ruleset, for example when a state was imported via pfsync from a sytem with a different ruleset checksum. In this case pf_route uses s->rt_addr for routing target instead of r->rpool.cur but r->rpool is checked anyway, resulting in dropped packets. PR: 259183 Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH sys/netpfil/pf/pf.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) ^Triage: assign to committer for 2021 commit. |
Created attachment 228719 [details] Don't drop packets when redirection information comes from a state For some traffic there might be no matching rule in the current ruleset, for example when a state was imported via pfsync from a sytem with a different ruleset checksum. In this case pf_route uses s->rt_addr for routing target instead of r->rpool.cur but r->rpool is checked anyway, resulting in dropped packets. If the patch gets accepted, please add the usual footer to commit: Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH