git: 147f278d7d4b - stable/13 - pf: always create multihomed states as floating

The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=147f278d7d4b0e9550d6a8e47082251c6ce7d136

commit 147f278d7d4b0e9550d6a8e47082251c6ce7d136
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-11-16 16:06:29 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-11-24 09:20:22 +0000

    pf: always create multihomed states as floating
    
    When we create a new state for multihomed sctp connections (i.e.
    based on INIT/INIT_ACK or ASCONF parameters) we cannot know what
    interfaces we'll be seeing that traffic on. Make those states floating,
    irrespective of state policy.
    
    MFC after:      1 week
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit 0fe663b2a815dcb41431543940ec51408f418392)
---
 sys/netpfil/pf/pf.c          | 8 ++++++--
 tests/sys/netpfil/pf/sctp.py | 5 +++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 1323a1003af8..84ff1fea7731 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -5540,8 +5540,12 @@ again:
 			j->pd.sctp_flags |= PFDESC_SCTP_ADD_IP;
 			PF_RULES_RLOCK();
 			sm = NULL;
-			/* XXX: May generated unwanted abort if we try to insert a duplicate state. */
-			ret = pf_test_rule(&r, &sm, pd->dir, kif,
+			/*
+			 * New connections need to be floating, because
+			 * we cannot know what interfaces it will use.
+			 * That's why we pass V_pfi_all rather than kif.
+			 */
+			ret = pf_test_rule(&r, &sm, pd->dir, V_pfi_all,
 			    j->m, off, &j->pd, &ra, &rs, NULL);
 			PF_RULES_RUNLOCK();
 			SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->m, ret);
diff --git a/tests/sys/netpfil/pf/sctp.py b/tests/sys/netpfil/pf/sctp.py
index 5db52dd993f2..6042badffb64 100644
--- a/tests/sys/netpfil/pf/sctp.py
+++ b/tests/sys/netpfil/pf/sctp.py
@@ -372,6 +372,7 @@ class TestSCTP(VnetTestTemplate):
 
         ToolsHelper.print_output("/sbin/pfctl -e")
         ToolsHelper.pf_rules([
+            "set state-policy if-bound",
             "block proto sctp",
             "pass inet proto sctp to 192.0.2.0/24"])
 
@@ -386,9 +387,9 @@ class TestSCTP(VnetTestTemplate):
         # Check that we have a state for 192.0.2.3 and 192.0.2.2 to 192.0.2.1, but also to 192.0.2.4
         states = ToolsHelper.get_output("/sbin/pfctl -ss")
         print(states)
-        assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234", states)
+        assert re.search(r".*sctp 192.0.2.1:.*192.0.2.3:1234", states)
         assert re.search(r"all sctp 192.0.2.1:.*192.0.2.2:1234", states)
-        assert re.search(r"all sctp 192.0.2.4:.*192.0.2.3:1234", states)
+        assert re.search(r".*sctp 192.0.2.4:.*192.0.2.3:1234", states)
         assert re.search(r"all sctp 192.0.2.4:.*192.0.2.2:1234", states)
 
 class TestSCTPv6(VnetTestTemplate):