The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=5c0eb439cfadac1e59ff96abbf26fe6bb15ec58d
commit 5c0eb439cfadac1e59ff96abbf26fe6bb15ec58d
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-06-27 12:27:28 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2025-06-30 15:00:28 +0000
pfctl: Move AF-specific mask logic from callers into set_ipmask()
Instead of doing the same dance with every caller, check for user provided
mask or address familiy specific maximum inside the function itself.
Feedback and OK claudio
Obtained from: OpenBSD, kn <k...@openbsd.org>, c04427dd30
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sbin/pfctl/pfctl_parser.c | 35 +++++++++++++++++++----------------
sbin/pfctl/pfctl_parser.h | 2 +-
2 files changed, 20 insertions(+), 17 deletions(-)
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index d903b592b1ac..439c75b7c98f 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -1323,14 +1323,20 @@ parse_flags(char *s)
}
void
-set_ipmask(struct node_host *h, u_int8_t b)
+set_ipmask(struct node_host *h, int bb)
{
struct pf_addr *m, *n;
int i, j = 0;
+ uint8_t b;
m = &h->addr.v.a.mask;
memset(m, 0, sizeof(*m));
+ if (bb == -1)
+ b = h->af == AF_INET ? 32 : 128;
+ else
+ b = bb;
+
while (b >= 32) {
m->addr32[j++] = 0xffffffff;
b -= 32;
@@ -1751,16 +1757,13 @@ ifa_lookup(char *ifa_name, int flags)
if (flags & PFI_AFLAG_NETWORK)
set_ipmask(n, unmask(&p->addr.v.a.mask, n->af));
else {
- if (n->af == AF_INET) {
- if (p->ifa_flags & IFF_LOOPBACK &&
- p->ifa_flags & IFF_LINK1)
- memcpy(&n->addr.v.a.mask,
- &p->addr.v.a.mask,
- sizeof(struct pf_addr));
- else
- set_ipmask(n, 32);
- } else
- set_ipmask(n, 128);
+ if (n->af == AF_INET &&
+ p->ifa_flags & IFF_LOOPBACK &&
+ p->ifa_flags & IFF_LINK1)
+ memcpy(&n->addr.v.a.mask, &p->addr.v.a.mask,
+ sizeof(struct pf_addr));
+ else
+ set_ipmask(n, -1);
}
n->ifindex = p->ifindex;
n->ifname = strdup(p->ifname);
@@ -1868,8 +1871,9 @@ host_if(const char *s, int mask)
if (ifa_exists(ps) || !strncmp(ps, "self", IFNAMSIZ)) {
/* interface with this name exists */
h = ifa_lookup(ps, flags);
- for (n = h; n != NULL && mask > -1; n = n->next)
- set_ipmask(n, mask > -1 ? mask : 128);
+ if (mask > -1)
+ for (n = h; n != NULL; n = n->next)
+ set_ipmask(n, mask);
}
error:
@@ -1898,7 +1902,7 @@ host_v4(const char *s, int mask)
h->ifname = NULL;
h->af = AF_INET;
h->addr.v.a.addr.addr32[0] = ina.s_addr;
- set_ipmask(h, mask > -1 ? mask : 32);
+ set_ipmask(h, mask);
h->next = NULL;
h->tail = h;
@@ -1982,7 +1986,6 @@ host_dns(const char *s, int mask, int numeric)
&((struct sockaddr_in *)
res->ai_addr)->sin_addr.s_addr,
sizeof(struct in_addr));
- set_ipmask(n, mask > -1 ? mask : 32);
} else {
memcpy(&n->addr.v.a.addr,
&((struct sockaddr_in6 *)
@@ -1991,8 +1994,8 @@ host_dns(const char *s, int mask, int numeric)
n->ifindex =
((struct sockaddr_in6 *)
res->ai_addr)->sin6_scope_id;
- set_ipmask(n, mask > -1 ? mask : 128);
}
+ set_ipmask(n, mask);
n->next = NULL;
n->tail = n;
if (h == NULL)
diff --git a/sbin/pfctl/pfctl_parser.h b/sbin/pfctl/pfctl_parser.h
index 45d9ebc45bc9..8ab331561c7d 100644
--- a/sbin/pfctl/pfctl_parser.h
+++ b/sbin/pfctl/pfctl_parser.h
@@ -361,7 +361,7 @@ struct pf_timeout {
extern const struct pf_timeout pf_timeouts[];
-void set_ipmask(struct node_host *, u_int8_t);
+void set_ipmask(struct node_host *, int);
int check_netmask(struct node_host *, sa_family_t);
int unmask(struct pf_addr *, sa_family_t);
struct node_host *gen_dynnode(struct node_host *, sa_family_t);
