diff options
| author | Franco Fichtner <franco@opnsense.org> | 2022-08-06 08:59:56 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2022-08-20 07:14:31 +0000 |
| commit | c9554c4df51481a5826111c9ca15a1e28b3d5ba5 (patch) | |
| tree | 98f61cc9e0bdfce7a700b5ed3aeacec0fa9668dc | |
| parent | e1d8b0f49a9eb9d7c23591e70f6077f59fbb25c5 (diff) | |
| download | src-c9554c4df51481a5826111c9ca15a1e28b3d5ba5.tar.gz src-c9554c4df51481a5826111c9ca15a1e28b3d5ba5.zip | |
pfctl: fix FOM_ICMP/POM_STICKYADDRESS clash
pass inet proto icmp icmp-type {unreach}
pass route-to (if0 127.0.0.1/8) sticky-address inet
The wrong struct was being tested. The parser tries to prevent
"sticky-address sticky-address" syntax but was actually cross-rule
enforcing that ICMP filter cannot be before the use of "sticky-address"
in next rule.
MFC after: 2 weeks
Reviewed by: kp
Differential Revision: https://reviews.freebsd.org/D36050
(cherry picked from commit 1e73fbd8b28946cb1341b51292082864943f0a89)
| -rw-r--r-- | sbin/pfctl/parse.y | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 09bda751d356..1e65bcb6a9b3 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -4075,7 +4075,7 @@ pool_opt : BITMASK { pool_opts.staticport = 1; } | STICKYADDRESS { - if (filter_opts.marker & POM_STICKYADDRESS) { + if (pool_opts.marker & POM_STICKYADDRESS) { yyerror("sticky-address cannot be redefined"); YYERROR; } |