From nobody Sun May 17 10:15:19 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gJGyw1jMyz6f6HW for ; Sun, 17 May 2026 10:15:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gJGyv6fF0z42PY for ; Sun, 17 May 2026 10:15:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779012920; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ivD/FE0IAQTMscIKNPSJGEWOjgLbvNIvJXRX1WU6S6Q=; b=yZlNYXPKDomMArj/F6Y/4bpVLiui3aV4fHF9G51DF20OWNlSP0zFgzXdk9bsYzoN9gsWX+ fsJ+BDHmwfxAstQvUHuuihTPgveK5SPCErH1JS9D5Syc/ruvneklYXgCHl9WUxVeGCVD5a jdq6pLX2mc4wjNiJ6gMfh+tgFGZkCud2Z5Ogjf3MjyHegdzuwVyymywUw/EYZ5ysvV8QWQ yhc8d/7PX55Hty6JXiBeyxBIMIw+4irUGcWRUvhe2bLCDQFwuvSK75xWX/NAYFcYZOjHoz fiR5MFeEFP9jCPaY6G2+cfSYfWDFXfpW3yvmEsRv33Tk4uW83vhVFYkzhvUDMg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779012920; a=rsa-sha256; cv=none; b=w7yLEzj/I7w8cQRRhzYLWJ5TJY2BjPFGQQXgjJtfgw4OPPtfFwB3S5exxL1wAGb0Gjr3C+ OMP3oawgjXphzIAnqLXlIUkLe6RoBIwGd/DLXpwDrFsrjWziXNQ99O6A6efPcevZGGN+IE CaDRtCDG70tocnTaZcqMl+EB76pOUOcmmIXAcjUeMrGgSDzdiU1w2u0ozE9uxUlppF2VEO YSmyep9N6AdziM7Vi19P5ZlW1q4B/O4rFN1RGkU5zDjy+Ik2NgIJq9ybmEwE9y1yNxxvNG 3fhHFCzzidQaJK+xYj1hMuNzICWkCm/1UPPEvQOb6KZz6HdCG/V3v5AzJU20mw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779012920; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ivD/FE0IAQTMscIKNPSJGEWOjgLbvNIvJXRX1WU6S6Q=; b=eGg8QiAPhZzapwgQ6ojkB9gE5LbbbPh9h4o0h1K8uYyHw5h6YSzxj5mgKAc+DTynRbYe2J Wr3gA6pTreD1T8DiP18M+eOaXmAnX80ID3Av9Ck95zMc+gy0CIjnwT6jCiCyDREWxIEg/C P+POL+ptD2bUEqEPD0OuewyDSOVz4y18wH0s9VbQskUJporxH8w0tij1sSZvwDz29hvaxO Ki8gJ81m7TwDL/e9/Fw/beXcUlBkaoXrcfkmvd9ZMM7cdpqxjpDaRfbFY5sFzywB45wq+C 8RQnIkVpD3JjPpz1Ecus8ZQu4PLWzHGKXeQzaJo4bP1GiGRytG+dibcTmv2JEw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gJGyv5kSvzdJF for ; Sun, 17 May 2026 10:15:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ffad by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 17 May 2026 10:15:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Andrey V. Elsukov Subject: git: 2872268c7f6d - main - ipfw: treat ipv6 address with zero mask as 'any' List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ae X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 Auto-Submitted: auto-generated Date: Sun, 17 May 2026 10:15:19 +0000 Message-Id: <6a099537.3ffad.40d890d5@gitrepo.freebsd.org> The branch main has been updated by ae: URL: https://cgit.FreeBSD.org/src/commit/?id=2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 Author: Andrey V. Elsukov AuthorDate: 2026-05-17 10:12:20 +0000 Commit: Andrey V. Elsukov CommitDate: 2026-05-17 10:12:20 +0000 ipfw: treat ipv6 address with zero mask as 'any' Make the behaviour similar for both IPv4 and IPv6. Also add the corresponding tests. PR: 294733 MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D56618 --- sbin/ipfw/ipfw2.c | 7 ++++--- sbin/ipfw/ipv6.c | 11 +++++++---- sbin/ipfw/tests/test_add_rule.py | 24 ++++++++++++++++++++++++ tests/atf_python/sys/netpfil/ipfw/insns.py | 2 ++ 4 files changed, 37 insertions(+), 7 deletions(-) diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index 06a1ee937cd7..c67eb6618c59 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -3595,12 +3595,13 @@ fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT) { /* "not any" never matches */ - if (av == NULL && len == 0) /* only this entry */ + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) /* "not any" never matches */ errx(EX_DATAERR, "not any never matches"); + return; } /* else do nothing and skip this entry */ - return; + continue; } /* A single IP can be stored in an optimized format */ if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index e6eb07af26dc..f34a08bb6f52 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -396,8 +396,6 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) n2mask(&d[1], masklen); } - APPLY_MASK(d, &d[1]); /* mask base address with mask */ - av = q; /* Check this entry */ @@ -408,11 +406,16 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT && av == NULL && len == 0) - errx(EX_DATAERR, "not any never matches"); + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) + errx(EX_DATAERR, "not any never matches"); + return (1); + } continue; } + APPLY_MASK(d, &d[1]); /* mask base address with mask */ + /* * A single IP can be stored alone */ diff --git a/sbin/ipfw/tests/test_add_rule.py b/sbin/ipfw/tests/test_add_rule.py index 4360c5f87c15..ed565f0e7c68 100755 --- a/sbin/ipfw/tests/test_add_rule.py +++ b/sbin/ipfw/tests/test_add_rule.py @@ -135,6 +135,30 @@ class TestAddRule(BaseTest): }, id="test_rulenum", ), + pytest.param( + { + "in": "add allow ip4 from 0.0.0.0/0 to 192.0.2.1/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP4), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask4", + ), + pytest.param( + { + "in": "add allow ip6 from ::/0 to 2001:DB8::/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP6), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask6", + ), pytest.param( { "in": "add allow ip from { 1.2.3.4 or 2.3.4.5 } to any", diff --git a/tests/atf_python/sys/netpfil/ipfw/insns.py b/tests/atf_python/sys/netpfil/ipfw/insns.py index dbb9af659794..c5f729ac4d63 100644 --- a/tests/atf_python/sys/netpfil/ipfw/insns.py +++ b/tests/atf_python/sys/netpfil/ipfw/insns.py @@ -682,6 +682,8 @@ insn_attrs = prepare_attrs_map( AttrDescr(IpFwOpcode.O_NOP, InsnComment), + AttrDescr(IpFwOpcode.O_IP4, InsnEmpty), + AttrDescr(IpFwOpcode.O_IP6, InsnEmpty), AttrDescr(IpFwOpcode.O_PROTO, InsnProto), AttrDescr(IpFwOpcode.O_PROB, InsnProb), AttrDescr(IpFwOpcode.O_IP_DST_ME, InsnEmpty),