git: 076b3a50fd71 - main - pf: don't drop packets when redirection information comes from a state

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=076b3a50fd71d84f47bca71758e7fff3c02582e9

commit 076b3a50fd71d84f47bca71758e7fff3c02582e9
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2021-10-16 16:53:39 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2021-10-16 21:02:26 +0000

    pf: don't drop packets when redirection information comes from a state
    
    For some traffic there might be no matching rule in the current ruleset,
    for example when a state was imported via pfsync from a sytem with a
    different ruleset checksum. In this case pf_route uses s->rt_addr for
    routing target instead of r->rpool.cur but r->rpool is checked anyway,
    resulting in dropped packets.
    
    PR:             259183
    Submitted by:   Kajetan Staszkiewicz <vegeta tuxpowered.net>
    Sponsored by:   InnoGames GmbH
---
 sys/netpfil/pf/pf.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index b67f688c3f3f..2c625703c5d9 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -5856,12 +5856,12 @@ pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
 
 	bzero(&naddr, sizeof(naddr));
 
-	if (TAILQ_EMPTY(&r->rpool.list)) {
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
-		goto bad_locked;
-	}
 	if (s == NULL) {
+		if (TAILQ_EMPTY(&r->rpool.list)) {
+			DPFPRINTF(PF_DEBUG_URGENT,
+			    ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
+			goto bad_locked;
+		}
 		pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
 		    &naddr, NULL, &sn);
 		if (!PF_AZERO(&naddr, AF_INET))
@@ -6042,12 +6042,12 @@ pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
 
 	bzero(&naddr, sizeof(naddr));
 
-	if (TAILQ_EMPTY(&r->rpool.list)) {
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
-		goto bad_locked;
-	}
 	if (s == NULL) {
+		if (TAILQ_EMPTY(&r->rpool.list)) {
+			DPFPRINTF(PF_DEBUG_URGENT,
+			    ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
+			goto bad_locked;
+		}
 		pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
 		    &naddr, NULL, &sn);
 		if (!PF_AZERO(&naddr, AF_INET6))