git: e0dcc51ddb43 - main - pfctl: do not allow af-to tables without round-robin

[Kristof Provost]

The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=e0dcc51ddb43201e58f15645f000e27f061df081

commit e0dcc51ddb43201e58f15645f000e27f061df081
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2024-12-10 11:00:06 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2024-12-17 10:07:17 +0000

    pfctl: do not allow af-to tables without round-robin
    
    Tables can only be used as a redirspec (i.e. in pf_map_addr()) in 
round-robin mode.
    Enforce this for af-to tables as well.
    
    Add a test case to verify.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sbin/pfctl/parse.y            | 14 +++++++++++---
 tests/sys/netpfil/pf/nat64.sh | 23 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index fc24cbc238ba..fc9cf86081f6 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -2827,11 +2827,19 @@ pfrule          : action dir logquick interface route 
af proto fromto
                                        r.free_flags |= PFRULE_DN_IS_QUEUE;
                        }
 
-                       if ($9.marker & FOM_AFTO)
+                       if ($9.marker & FOM_AFTO) {
                                r.naf = $9.nat.af;
 
-                       r.nat.opts = $9.nat.pool_opts.type;
-                       r.nat.opts |= $9.nat.pool_opts.opts;
+                               r.nat.opts = $9.nat.pool_opts.type;
+                               r.nat.opts |= $9.nat.pool_opts.opts;
+
+                               if ((r.nat.opts & PF_POOL_TYPEMASK) !=
+                                   PF_POOL_ROUNDROBIN &&
+                                   disallow_table($9.nat.rdr->host, "tables 
are only "
+                                   "supported in round-robin pools"))
+                                       YYERROR;
+                       }
+
                        expand_rule(&r, $4, $5.host, $9.nat.rdr ? 
$9.nat.rdr->host : NULL,
                            $7, $8.src_os, $8.src.host, $8.src.port, 
$8.dst.host,
                            $8.dst.port, $9.uid, $9.gid, $9.rcv, $9.icmpspec, 
"");
diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh
index 827891373903..b0559ac1f98c 100644
--- a/tests/sys/netpfil/pf/nat64.sh
+++ b/tests/sys/netpfil/pf/nat64.sh
@@ -341,6 +341,28 @@ pool_cleanup()
        pft_cleanup
 }
 
+
+atf_test_case "table"
+table_head()
+{
+       atf_set descr 'Tables require round-robin'
+       atf_set require.user root
+}
+
+table_body()
+{
+       pft_init
+
+       echo "pass in on epair inet6 from any to 64:ff9b::/96 af-to inet from 
<wanaddr>" | \
+           atf_check -s exit:1 \
+           -e match:"tables are only supported in round-robin pools" \
+           pfctl -f -
+}
+
+table_cleanup()
+{
+       pft_cleanup
+}
 atf_test_case "table_round_robin" "cleanup"
 table_round_robin_head()
 {
@@ -417,5 +439,6 @@ atf_init_test_cases()
        atf_add_test_case "tos"
        atf_add_test_case "no_v4"
        atf_add_test_case "pool"
+       atf_add_test_case "table"
        atf_add_test_case "table_round_robin"
 }