d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: stop resolving hosts as dns that use ":" modifier

Browse Source 
When the interface does not exist avoid passing host with special pf
modifiers to DNS resolution as they come up empty anyway.

Reviewed by:	kp
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D35429
This commit is contained in:
Franco Fichtner 2022-08-08 18:31:02 +02:00 committed by Kristof Provost
parent 45add40717
commit 28b64169ea
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sbin/pfctl/pfctl_parser.c
View File

@ -74,7 +74,7 @@ void print_fromto(struct pf_rule_addr *, pf_osfp_t,
struct pf_rule_addr *, u_int8_t, u_int8_t, int, int);
int ifa_skip_if(const char *filter, struct node_host *p);
struct node_host *host_if(const char *, int);
struct node_host *host_if(const char *, int, int *);
struct node_host *host_v4(const char *, int);
struct node_host *host_v6(const char *, int);
struct node_host *host_dns(const char *, int, int);
@ -1695,7 +1695,7 @@ host(const char *s)
/* interface with this name exists? */
/* expensive with thousands of interfaces - prioritze IPv4/6 check */
if (cont && (h = host_if(ps, mask)) != NULL)
if (cont && (h = host_if(ps, mask, &cont)) != NULL)
cont = 0;
/* dns lookup */
@ -1711,7 +1711,7 @@ host(const char *s)
}
struct node_host *
host_if(const char *s, int mask)
host_if(const char *s, int mask, int *cont)
{
struct node_host *n, *h = NULL;
char *p, *ps;
@ -1733,6 +1733,7 @@ host_if(const char *s, int mask)
return (NULL);
}
*p = '\0';
*cont = 0;
}
if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { /* Yep! */
fprintf(stderr, "illegal combination of interface modifiers\n");