When we route-to the state should be bound to the route-to interface,
not the default route interface.
Explicitly check for this in BOUND_IFACE().
Sponsored by: Rubicon Communications, LLC ("Netgate")
Details
Details
- Reviewers
- None
- Group Reviewers
network pfsense - Commits
- rG31828075e456: pf: bind route-to states to their route-to interface
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
This is wrong, as I'd have seen immediately if I'd had the test send more than 1 ping.
When the second outbound ping arrives pf looks for the state on epair_one, but we've created it for epair_two, so we don't find the state and reject the packet (or more accurately, try to create a new state for it and fail because such a state already exists).
Comment Actions
- improve test (ping 3x, to ensure that subsequent packets make it)
- when matching states also look at the original interface This is required because the expected outbound interface before we match the state is the original interface, but for inbound packets it will be the route-to'd interface (which we've now bound the state to)