The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=71594e3235f21746fbc6c0b12ad70409db18a46b
commit 71594e3235f21746fbc6c0b12ad70409db18a46b
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-02-10 16:33:57 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-02-13 12:38:44 +0000
pf: support "!received-on <interface>"
ok dlg benno
Obtained from: OpenBSD, henning <henn...@openbsd.org>, 7d0482a910
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
lib/libpfctl/libpfctl.c | 2 ++
lib/libpfctl/libpfctl.h | 1 +
sbin/pfctl/parse.y | 6 ++++--
sbin/pfctl/pfctl_parser.c | 3 ++-
4 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 8569d691773c..fe63c91c1174 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -1255,6 +1255,7 @@ snl_add_msg_attr_pf_rule(struct snl_writer *nw, uint32_t
type, const struct pfct
snl_add_msg_attr_uid(nw, PF_RT_UID, &r->uid);
snl_add_msg_attr_uid(nw, PF_RT_GID, (const struct pf_rule_uid
*)&r->gid);
snl_add_msg_attr_string(nw, PF_RT_RCV_IFNAME, r->rcv_ifname);
+ snl_add_msg_attr_bool(nw, PF_RT_RCV_IFNOT, r->rcvifnot);
snl_add_msg_attr_u32(nw, PF_RT_RULE_FLAG, r->rule_flag);
snl_add_msg_attr_u8(nw, PF_RT_ACTION, r->action);
@@ -1663,6 +1664,7 @@ static struct snl_attr_parser ap_getrule[] = {
{ .type = PF_RT_RPOOL_NAT, .off = _OUT(r.nat), .arg = &pool_parser, .cb
= snl_attr_get_nested },
{ .type = PF_RT_NAF, .off = _OUT(r.naf), .cb = snl_attr_get_uint8 },
{ .type = PF_RT_RPOOL_RT, .off = _OUT(r.route), .arg = &pool_parser,
.cb = snl_attr_get_nested },
+ { .type = PF_RT_RCV_IFNOT, .off = _OUT(r.rcvifnot),.cb =
snl_attr_get_bool },
};
#undef _OUT
SNL_DECLARE_PARSER(getrule_parser, struct genlmsghdr, snl_f_p_empty,
ap_getrule);
diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h
index d5d0a43f90a3..e1af4b5e97ff 100644
--- a/lib/libpfctl/libpfctl.h
+++ b/lib/libpfctl/libpfctl.h
@@ -227,6 +227,7 @@ struct pfctl_rule {
struct pf_rule_uid uid;
struct pf_rule_gid gid;
char rcv_ifname[IFNAMSIZ];
+ bool rcvifnot;
uint32_t rule_flag;
uint8_t action;
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index 40d116fe1a50..981039f4124c 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -2974,12 +2974,13 @@ filter_opt : USER uids {
filter_opts.match_tag = $3;
filter_opts.match_tag_not = $1;
}
- | RECEIVEDON if_item {
+ | not RECEIVEDON if_item {
if (filter_opts.rcv) {
yyerror("cannot respecify received-on");
YYERROR;
}
- filter_opts.rcv = $2;
+ filter_opts.rcv = $3;
+ filter_opts.rcv->not = $1;
}
| PROBABILITY probability {
double p;
@@ -6279,6 +6280,7 @@ expand_rule(struct pfctl_rule *r,
if (rcv) {
strlcpy(r->rcv_ifname, rcv->ifname,
sizeof(r->rcv_ifname));
+ r->rcvifnot = rcv->not;
}
r->type = icmp_type->type;
r->code = icmp_type->code;
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index d1e0b4e99940..7a6d2fc8eed5 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -961,7 +961,8 @@ print_rule(struct pfctl_rule *r, const char *anchor_call,
int verbose, int numer
print_fromto(&r->src, r->os_fingerprint, &r->dst, r->af, r->proto,
verbose, numeric);
if (r->rcv_ifname[0])
- printf(" received-on %s", r->rcv_ifname);
+ printf(" %sreceived-on %s", r->rcvifnot ? "!" : "",
+ r->rcv_ifname);
if (r->uid.op)
print_ugid(r->uid.op, r->uid.uid[0], r->uid.uid[1], "user",
UID_MAX);
