upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: fix reply-to after rdr and dummynet

Browse source 
If we redirect a packet to localhost and it gets dummynet'd it may be
re-injected later (e.g. when delayed) which means it will be passed
through ip_input() again. ip_input() will then reject the packet because
it's directed to the loopback address, but did not arrive on a loopback
interface.

Fix this by having pf set the rcvif to V_iflo if we redirect to
loopback.

See also:	https://redmine.pfsense.org/issues/15363
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2024-03-27 15:47:21 +01:00 committed by Franco Fichtner
parent a802844bd6
commit 42f47cc05f
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
sys/netpfil/pf/pf.c
View file

@ -8484,6 +8484,18 @@ pf_dummynet_route(struct pf_pdesc *pd, struct pf_kstate *s,
sizeof(struct sockaddr_in6));
}
if (s != NULL && s->nat_rule.ptr != NULL &&
s->nat_rule.ptr->action == PF_RDR &&
((pd->af == AF_INET && IN_LOOPBACK(ntohl(pd->dst->v4.s_addr))) ||
(pd->af == AF_INET6 && IN6_IS_ADDR_LOOPBACK(&pd->dst->v6)))) {
/*
* If we're redirecting to loopback mark this packet
* as being local. Otherwise it might get dropped
* if dummynet re-injects.
*/
(*m0)->m_pkthdr.rcvif = V_loif;
}
if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
ip_dn_io_ptr(m0, &dnflow);