pf: Check if source nodes use a valid redirection address

[vegeta_tuxpowered.net]

Summary

Source nodes redirect (nat-to, rdr-to, route-to) all further connections
matching the rule which has created the source node. The source node is
valid as long as there are states resulting from the rule or until the
source node lifetime expires. When the rule's redirection pool is
modified (e.g. table contents are changed) the source node is still
valid and it will redirect new connections to invalid target (e.g. a
dead next-hop).

When performing source tracking after finding a source node check if the
redirection address still exists in pool of the rule which has created
this node. If not, delete the source node. This will result in finding a
new redirection address and creation of a new source node.

Obtained from: OpenBSD
Sponsored by: InnoGames GmbH

[vegeta_tuxpowered.net]

sys/netpfil/pf/pf_lb.c

586

The test I wrote only tests the case for PF_ADDR_TABLE because that can easily be modified with pfctl without changing the ruleset (which would invalidate all SNs). Any idea how I can modify the redirection pool of an existing rule for other cases? The logic here is copied from OpenBSD with addition of comments and redirection AF.

[vegeta_tuxpowered.net]

Assert the rpool.

[kp]

Do you have a specific OpenBSD patch you obtained this from?

sys/netpfil/pf/pf_lb.c

586

We can probably do PF_ADDR_DYNIFTL and change the addresses assigned to that interface. I don't think we can for the other cases.

Testing them all would be good, obviously, but just having one scenario that exercises this code path already gets us 80-90% of the utility of the test case, so I wouldn't worry too much about it.