diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c --- a/sys/netpfil/pf/pf_lb.c +++ b/sys/netpfil/pf/pf_lb.c @@ -442,7 +442,7 @@ struct pf_addr *naddr, struct pfi_kkif **nkif, struct pf_addr *init_addr, struct pf_ksrc_node **sn) { - u_short reason = 0; + u_short reason = PFRES_MATCH; struct pf_kpool *rpool = &r->rpool; struct pf_addr *raddr = NULL, *rmask = NULL; struct pf_srchash *sh = NULL; @@ -908,10 +908,15 @@ } } + /* + * We failed to find a match. Push on ahead anyway, let + * pf_state_insert() be the arbiter of whether the state + * conflict is tolerable. In particular, with TCP connections + * the state may be reused if the TCP state is terminal. + */ DPFPRINTF(PF_DEBUG_MISC, ("pf: RDR source port allocation failed\n")); - reason = PFRES_MAPFAILED; - goto notrans; + break; out: DPFPRINTF(PF_DEBUG_MISC,