d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: ether l3 rules can only use addresses

Browse Source 
Disallow the use of tables in ethernet rules. Using tables requires
taking the PF_RULES lock. Moreover, the current table code isn't ready
to deal with ethernet rules.

Disallow their use for now.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2022-03-25 11:13:47 +01:00
parent 231f211240
commit 3468cd95ca
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sbin/pfctl/parse.y
View File

@ -3261,6 +3261,16 @@ l3fromto : /* empty */ {
bzero(&$$, sizeof($$));
}
| L3 fromto {
if ($2.src.host != NULL &&
$2.src.host->addr.type != PF_ADDR_ADDRMASK) {
yyerror("from must be an address");
YYERROR;
}
if ($2.dst.host != NULL &&
$2.dst.host->addr.type != PF_ADDR_ADDRMASK) {
yyerror("to must be an address");
YYERROR;
}
$$ = $2;
}
;

6
sys/netpfil/pf/pf_nv.c
View File

@ -1146,6 +1146,9 @@ pf_nveth_rule_to_keth_rule(const nvlist_t *nvl,
nvlist_get_nvlist(nvl, "ipsrc"), &krule->ipsrc);
if (error != 0)
return (error);
if (krule->ipsrc.addr.type != PF_ADDR_ADDRMASK)
return (EINVAL);
}
if (nvlist_exists_nvlist(nvl, "ipdst")) {
@ -1153,6 +1156,9 @@ pf_nveth_rule_to_keth_rule(const nvlist_t *nvl,
nvlist_get_nvlist(nvl, "ipdst"), &krule->ipdst);
if (error != 0)
return (error);
if (krule->ipdst.addr.type != PF_ADDR_ADDRMASK)
return (EINVAL);
}
PFNV_CHK(pf_nvstring(nvl, "qname", krule->qname, sizeof(krule->qname)));

5
tests/sys/netpfil/pf/ether.sh
View File

@ -534,6 +534,11 @@ ip_body()
"ether pass" \
"ether block out l3 to 192.0.2.3"
atf_check -s exit:2 -o ignore ping -c 1 192.0.2.2
# We can't use tables in these rules
echo "ether pass out l3 from <test>" | \
atf_check -s exit:1 -o ignore -e ignore \
jexec alcatraz pfctl -g -f -
}
ip_cleanup()