divert: issues on 15.1

[swhite2]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/src/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/src/issues?q=is%3Aissue

Describe the bug

Last tested working version:

FreeBSD OPNsense.localdomain 14.3-RELEASE-p16 FreeBSD 14.3-RELEASE-p16 stable/26.1-n272152-9b6eef552f24 SMP amd64

After the FreeBSD upgrade to 15.1, when configuring a rdr in combination with a stateful divert-to rule (DNAT + pass rule), traffic is passed to the divert socket, but handing the packet back to the kernel will cause a block with reason state-insert.

To Reproduce

A jail setup and a python forward script have been attached to this issue. The script sets up 3 jails, client, firewall and server.

Topology:

Client (10.1.1.2) --> (10.1.1.1) Firewall (10.2.2.1) --> Server (10.2.2.2)

1. jexec server sh -c 'python3 -m http.server 8080'
2. jexec firewall divert_forward.py
3. jexec client curl http://10.1.1.1:8080
4. Observe the SYN passing through the python script, but blackholed once sent back to the kernel

pf.conf is as follows:

rdr on firewall0 inet proto tcp from {any} to {10.1.1.1} port {8080} -> 10.2.2.2 port 8080
pass in
pass out
pass in quick on firewall0 inet proto tcp from any to 10.2.2.2 port 8080 keep state divert-to 8000

Expected behavior

GET request goes through.

Describe alternatives you considered

Defining the divert-to on an outbound rule on the "internal" side.

Screenshots

Reproducing the issue on my development box shows the state-insert reason block:

Relevant log files

N/A

Additional context

N/A

Environment

OPNsense 27.1.a_13 (amd64)

FreeBSD OPNsense.development 15.1-RELEASE-p1 FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64

Scripts

jail_divert_dnat.setup.txt

divert_forward.py

[swhite2]

route-to is also ignored, though this passes through the divert socket just fine. Reproduce with:

jail_divert_routeto.setup.txt

And the same divert_forward.py script

Topology:

# client0    <-> firewall0     10.1.1.0/24
#
# firewall1  <-> gateway0      10.2.2.0/30   WAN path 1 (default route)
# firewall2  <-> gateway1      10.3.3.0/30   WAN path 2 (route-to)
#
# gateway2   <-> server0       10.4.4.0/24

1. jexec server sh -c 'python3 -m http.server 8080'
2. jexec firewall divert_forward.py
3. jexec gateway tcpdump -ni gateway0
4. jexec client curl http://10.4.4.2:8080

Observe traffic on the gateway0 interface, the traffic should be routed over gateway1. Removing the divert-to from the rule will show traffic on the gateway1 interface.