git: 3468cd95ca12 - main - pf: ether l3 rules can only use addresses

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=3468cd95ca1249946bace931f2035e76b070711e

commit 3468cd95ca1249946bace931f2035e76b070711e
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2022-03-25 10:13:47 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2022-03-25 10:13:47 +0000

    pf: ether l3 rules can only use addresses
    
    Disallow the use of tables in ethernet rules. Using tables requires
    taking the PF_RULES lock. Moreover, the current table code isn't ready
    to deal with ethernet rules.
    
    Disallow their use for now.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sbin/pfctl/parse.y            | 10 ++++++++++
 sys/netpfil/pf/pf_nv.c        |  6 ++++++
 tests/sys/netpfil/pf/ether.sh |  5 +++++
 3 files changed, 21 insertions(+)

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index bcbbfe872c6c..b3690fd22009 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -3261,6 +3261,16 @@ l3fromto	: /* empty */			{
 			bzero(&$$, sizeof($$));
 		}
 		| L3 fromto			{
+			if ($2.src.host != NULL &&
+			    $2.src.host->addr.type != PF_ADDR_ADDRMASK) {
+				yyerror("from must be an address");
+				YYERROR;
+			}
+			if ($2.dst.host != NULL &&
+			    $2.dst.host->addr.type != PF_ADDR_ADDRMASK) {
+				yyerror("to must be an address");
+				YYERROR;
+			}
 			$$ = $2;
 		}
 		;
diff --git a/sys/netpfil/pf/pf_nv.c b/sys/netpfil/pf/pf_nv.c
index 3b0d92cc5d20..0a79dfb0de7a 100644
--- a/sys/netpfil/pf/pf_nv.c
+++ b/sys/netpfil/pf/pf_nv.c
@@ -1146,6 +1146,9 @@ pf_nveth_rule_to_keth_rule(const nvlist_t *nvl,
 		    nvlist_get_nvlist(nvl, "ipsrc"), &krule->ipsrc);
 		if (error != 0)
 			return (error);
+
+		if (krule->ipsrc.addr.type != PF_ADDR_ADDRMASK)
+			return (EINVAL);
 	}
 
 	if (nvlist_exists_nvlist(nvl, "ipdst")) {
@@ -1153,6 +1156,9 @@ pf_nveth_rule_to_keth_rule(const nvlist_t *nvl,
 		    nvlist_get_nvlist(nvl, "ipdst"), &krule->ipdst);
 		if (error != 0)
 			return (error);
+
+		if (krule->ipdst.addr.type != PF_ADDR_ADDRMASK)
+			return (EINVAL);
 	}
 
 	PFNV_CHK(pf_nvstring(nvl, "qname", krule->qname, sizeof(krule->qname)));
diff --git a/tests/sys/netpfil/pf/ether.sh b/tests/sys/netpfil/pf/ether.sh
index 319956219fe4..6e81f07ca26e 100644
--- a/tests/sys/netpfil/pf/ether.sh
+++ b/tests/sys/netpfil/pf/ether.sh
@@ -534,6 +534,11 @@ ip_body()
 		"ether pass" \
 		"ether block out l3 to 192.0.2.3"
 	atf_check -s exit:2 -o ignore ping -c 1 192.0.2.2
+
+	# We can't use tables in these rules
+	echo "ether pass out l3 from <test>" | \
+	    atf_check -s exit:1 -o ignore -e ignore \
+	    jexec alcatraz pfctl -g -f -
 }
 
 ip_cleanup()