aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2024-12-10 11:00:06 +0000
committerKristof Provost <kp@FreeBSD.org>2024-12-17 10:07:17 +0000
commite0dcc51ddb43201e58f15645f000e27f061df081 (patch)
tree68fe77e29d176bb97af8e82eb0bc23e4d3766541
parentb0e3fb7e65c3a745177e52ec2f20a773b4d59c1e (diff)
pfctl: do not allow af-to tables without round-robin
Tables can only be used as a redirspec (i.e. in pf_map_addr()) in round-robin mode. Enforce this for af-to tables as well. Add a test case to verify. Sponsored by: Rubicon Communications, LLC ("Netgate")
-rw-r--r--sbin/pfctl/parse.y14
-rw-r--r--tests/sys/netpfil/pf/nat64.sh23
2 files changed, 34 insertions, 3 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index fc24cbc238ba..fc9cf86081f6 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -2827,11 +2827,19 @@ pfrule : action dir logquick interface route af proto fromto
r.free_flags |= PFRULE_DN_IS_QUEUE;
}
- if ($9.marker & FOM_AFTO)
+ if ($9.marker & FOM_AFTO) {
r.naf = $9.nat.af;
- r.nat.opts = $9.nat.pool_opts.type;
- r.nat.opts |= $9.nat.pool_opts.opts;
+ r.nat.opts = $9.nat.pool_opts.type;
+ r.nat.opts |= $9.nat.pool_opts.opts;
+
+ if ((r.nat.opts & PF_POOL_TYPEMASK) !=
+ PF_POOL_ROUNDROBIN &&
+ disallow_table($9.nat.rdr->host, "tables are only "
+ "supported in round-robin pools"))
+ YYERROR;
+ }
+
expand_rule(&r, $4, $5.host, $9.nat.rdr ? $9.nat.rdr->host : NULL,
$7, $8.src_os, $8.src.host, $8.src.port, $8.dst.host,
$8.dst.port, $9.uid, $9.gid, $9.rcv, $9.icmpspec, "");
diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh
index 827891373903..b0559ac1f98c 100644
--- a/tests/sys/netpfil/pf/nat64.sh
+++ b/tests/sys/netpfil/pf/nat64.sh
@@ -341,6 +341,28 @@ pool_cleanup()
pft_cleanup
}
+
+atf_test_case "table"
+table_head()
+{
+ atf_set descr 'Tables require round-robin'
+ atf_set require.user root
+}
+
+table_body()
+{
+ pft_init
+
+ echo "pass in on epair inet6 from any to 64:ff9b::/96 af-to inet from <wanaddr>" | \
+ atf_check -s exit:1 \
+ -e match:"tables are only supported in round-robin pools" \
+ pfctl -f -
+}
+
+table_cleanup()
+{
+ pft_cleanup
+}
atf_test_case "table_round_robin" "cleanup"
table_round_robin_head()
{
@@ -417,5 +439,6 @@ atf_init_test_cases()
atf_add_test_case "tos"
atf_add_test_case "no_v4"
atf_add_test_case "pool"
+ atf_add_test_case "table"
atf_add_test_case "table_round_robin"
}