d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: Make ':0' ignore link-local v6 addresses too

Browse Source 
When users mark an interface to not use aliases they likely also don't
want to use the link-local v6 address there.

PR:		201695
Submitted by:	Russell Yount <Russell.Yount AT gmail.com>
Differential Revision:	https://reviews.freebsd.org/D17633
This commit is contained in:
Kristof Provost 2018-10-28 05:32:50 +00:00
parent f64bccc6d9
commit 99eb00558a
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sbin/pfctl/pfctl_parser.c
View File

@ -1366,6 +1366,9 @@ ifa_lookup(const char *ifa_name, int flags)
last_if = p->ifname;
if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4)
continue;
if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 &&
IN6_IS_ADDR_LINKLOCAL(&p->addr.v.a.addr.v6))
continue;
if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6)
continue;
if (p->af == AF_INET)

4
share/man/man5/pf.conf.5
View File

@ -28,7 +28,7 @@
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd October 6, 2016
.Dd October 27, 2018
.Dt PF.CONF 5
.Os
.Sh NAME
@ -1511,7 +1511,7 @@ Do not include interface aliases.
Host names may also have the
.Ar :0
option appended to restrict the name resolution to the first of each
v4 and v6 address found.
v4 and non-link-local v6 address found.
.Pp
Host name resolution and interface to address translation are done at
ruleset load-time.

3
sys/netpfil/pf/pf_if.c
View File

@ -553,7 +553,8 @@ pfi_instance_add(struct ifnet *ifp, int net, int flags)
if ((flags & PFI_AFLAG_PEER) &&
!(ifp->if_flags & IFF_POINTOPOINT))
continue;
if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
if ((flags & (PFI_AFLAG_NETWORK | PFI_AFLAG_NOALIAS)) &&
af == AF_INET6 &&
IN6_IS_ADDR_LINKLOCAL(
&((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
continue;