diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2025-01-13 14:29:53 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2025-01-24 10:20:30 +0000 |
| commit | ca0e69345320832c505ef6762b725391b3c41f50 (patch) | |
| tree | 6c3c282a537d4857eb4d7542e31f88ce019fbc64 /sbin | |
| parent | 0972294ef034d92f59857b8312dd2e1e3a7adc9c (diff) | |
pf: cope with route-to on af-to rules
af-to uses pf_route() and pf_route6(), which caused issues when af-to and
route-to were combined in a single rule.
Extend the relevant functions to cope with this and add test cases.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Diffstat (limited to 'sbin')
| -rw-r--r-- | sbin/pfctl/parse.y | 10 | ||||
| -rw-r--r-- | sbin/pfctl/pfctl_parser.c | 3 | ||||
| -rw-r--r-- | sbin/pfctl/tests/files/pf1026.in | 1 | ||||
| -rw-r--r-- | sbin/pfctl/tests/files/pf1026.ok | 1 | ||||
| -rw-r--r-- | sbin/pfctl/tests/pfctl_test_list.inc | 1 |
5 files changed, 14 insertions, 2 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 830581c57f9c..7da200c91c22 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -2735,7 +2735,8 @@ pfrule : action dir logquick interface route af proto fromto } if (r.rt) { decide_address_family($5.host, &r.af); - remove_invalid_hosts(&$5.host, &r.af); + if (!(r.rule_flag & PFRULE_AFTO)) + remove_invalid_hosts(&$5.host, &r.af); if ($5.host == NULL) { yyerror("no routing address with " "matching address family found."); @@ -5503,6 +5504,13 @@ filter_consistent(struct pfctl_rule *r, int anchor_call) "synproxy state or modulate state"); problems++; } + if (r->rule_flag & PFRULE_AFTO && r->rt) { + if (r->rt != PF_ROUTETO) { + yyerror("reply-to and dup-to " + "must not be used on af-to rules"); + problems++; + } + } /* match rules rules */ if (r->action == PF_MATCH) { if (r->divert.port) { diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c index df76f8312cf3..8e88a2794e45 100644 --- a/sbin/pfctl/pfctl_parser.c +++ b/sbin/pfctl/pfctl_parser.c @@ -943,7 +943,8 @@ print_rule(struct pfctl_rule *r, const char *anchor_call, int verbose, int numer printf(" dup-to"); printf(" "); print_pool(&r->rdr, 0, 0, r->af, PF_PASS); - print_pool(&r->route, 0, 0, r->af, PF_PASS); + print_pool(&r->route, 0, 0, + r->rule_flag & PFRULE_AFTO ? r->naf : r->af, PF_PASS); } if (r->af) { if (r->af == AF_INET) diff --git a/sbin/pfctl/tests/files/pf1026.in b/sbin/pfctl/tests/files/pf1026.in new file mode 100644 index 000000000000..3691d0947b39 --- /dev/null +++ b/sbin/pfctl/tests/files/pf1026.in @@ -0,0 +1 @@ +pass in on epair2b route-to (epair0a 192.0.2.2) inet6 from any to 64:ff9b::/96 af-to inet from (epair0a) diff --git a/sbin/pfctl/tests/files/pf1026.ok b/sbin/pfctl/tests/files/pf1026.ok new file mode 100644 index 000000000000..5b849fe80bd3 --- /dev/null +++ b/sbin/pfctl/tests/files/pf1026.ok @@ -0,0 +1 @@ +pass in on epair2b route-to (epair0a 192.0.2.2) inet6 from any to 64:ff9b::/96 flags S/SA keep state af-to inet from (epair0a) diff --git a/sbin/pfctl/tests/pfctl_test_list.inc b/sbin/pfctl/tests/pfctl_test_list.inc index 0a523386c16c..95f26b18b8d6 100644 --- a/sbin/pfctl/tests/pfctl_test_list.inc +++ b/sbin/pfctl/tests/pfctl_test_list.inc @@ -134,3 +134,4 @@ PFCTL_TEST(1022, "Test received-on") PFCTL_TEST(1023, "Test match log(matches)") PFCTL_TEST(1024, "nat64") PFCTL_TEST(1025, "nat64 with implicit address family") +PFCTL_TEST(1026, "nat64 with route-to") |