pf: attempt to handle overlapping group and interface names

pf assumes that network groups and network interfaces share a namespace
(that is, a name is unused, a group or an interface, never both a the
same time). Unfortunately this assumption was broken when interface
renaming was introduced.
Attempt to cope with this rather than panicking. Note that this is a
band-aid, not a full solution. The correct fix is for the network stack
to go back to enforcing a single namespace for groups and interfaces.

PR:		297220
Reported by:	Robert Morris
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")

2 files changed, 36 insertions, 6 deletions

diff --git a/sys/netpfil/pf/pf_if.c b/sys/netpfil/pf/pf_if.c
index 507879004b17..3993a3ee4c13 100644
--- a/sys/netpfil/pf/pf_if.c
+++ b/sys/netpfil/pf/pf_if.c
@@ -664,12 +664,19 @@ pfi_kkif_update(struct pfi_kkif *kif)
 	}
 
 	/* again for all groups kif is member of */
-	if (kif->pfik_ifp != NULL) {
-		CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
-			if (ifgl->ifgl_group->ifg_pf_kif) {
-				pfi_kkif_update((struct pfi_kkif *)
-				    ifgl->ifgl_group->ifg_pf_kif);
-			}
+	if (kif->pfik_ifp == NULL)
+		return;
+
+	CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) {
+		if (strcmp(ifgl->ifgl_group->ifg_group, kif->pfik_name) == 0) {
+			printf("pf: WARNING conflicting group / interface name %s\n",
+			    kif->pfik_name);
+			continue;
+		}
+		if (ifgl->ifgl_group->ifg_pf_kif) {
+			pfi_kkif_update((struct pfi_kkif *)
+			    ifgl->ifgl_group->ifg_pf_kif);
+		}
 	}
 }
 
diff --git a/tests/sys/netpfil/pf/names.sh b/tests/sys/netpfil/pf/names.sh
index c6f2a06c15f9..eb5c9a2a6ac5 100644
--- a/tests/sys/netpfil/pf/names.sh
+++ b/tests/sys/netpfil/pf/names.sh
@@ -134,9 +134,32 @@ start_number_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "overlap" "cleanup"
+overlap_head()
+{
+	atf_set descr 'Create a group and an interface with the same name'
+	atf_set require.user root
+}
+
+overlap_body()
+{
+	pft_init
+
+	epair=$(vnet_mkepair)
+	# Overlap with the implicit 'epair' group.
+	# See PR 297220, this can panic.
+	ifconfig ${epair}a name epair
+}
+
+overlap_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "names"
 	atf_add_test_case "group"
 	atf_add_test_case "start_number"
+	atf_add_test_case "overlap"
 }