Bug 259183 - pf_route drops packets for traffic not matching a rule
Summary: pf_route drops packets for traffic not matching a rule
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 13.0-STABLE
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-15 11:17 UTC by Kajetan Staszkiewicz
Modified: 2021-10-16 23:06 UTC (History)
0 users

See Also:


Attachments
Don't drop packets when redirection information comes from a state (2.42 KB, application/mbox)
2021-10-15 11:17 UTC, Kajetan Staszkiewicz
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kajetan Staszkiewicz 2021-10-15 11:17:07 UTC
Created attachment 228719 [details]
Don't drop packets when redirection information comes from a state

For some traffic there might be no matching rule in the current ruleset, for example when a state was imported via pfsync from a sytem with a different ruleset checksum. In this case pf_route uses s->rt_addr for routing target instead of r->rpool.cur but r->rpool is checked anyway, resulting in dropped packets.

If the patch gets accepted, please add the usual footer to commit:

Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net>
Sponsored by: InnoGames GmbH
Comment 1 commit-hook freebsd_committer 2021-10-16 23:06:53 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=076b3a50fd71d84f47bca71758e7fff3c02582e9

commit 076b3a50fd71d84f47bca71758e7fff3c02582e9
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2021-10-16 16:53:39 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2021-10-16 21:02:26 +0000

    pf: don't drop packets when redirection information comes from a state

    For some traffic there might be no matching rule in the current ruleset,
    for example when a state was imported via pfsync from a sytem with a
    different ruleset checksum. In this case pf_route uses s->rt_addr for
    routing target instead of r->rpool.cur but r->rpool is checked anyway,
    resulting in dropped packets.

    PR:             259183
    Submitted by:   Kajetan Staszkiewicz <vegeta tuxpowered.net>
    Sponsored by:   InnoGames GmbH

 sys/netpfil/pf/pf.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)