[Bug 294863] pfctl: rules with distinct __automatic* tables are incorrectly deduplicated

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294863

            Bug ID: 294863
           Summary: pfctl: rules with distinct __automatic* tables are
                    incorrectly deduplicated
           Product: Base System
           Version: 15.0-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: andy@codeedog.com

OS: 15.0-RELEASE-p6 FreeBSD 15.0-RELEASE-p6 GENERIC amd64

Expected behavior:

pf.conf containing two groups of rules differing only in IPs are collapsed into
two automatic tables and those automatic tables and their rules are retained.

Observed behavior:

The optimizer constructs two automatic tables and drops the rule using the
second automatic table. As a consequence, the second automatic table is also
dropped.

Details:
# Example: pf-dedup-auto-table.conf
block in

# Collapses into first automatic table
pass in from 10.0.0.1
pass in from 10.0.0.2
pass in from 10.0.0.3
pass in from 10.0.0.4
pass in from 10.0.0.5
pass in from 10.0.0.6
match in
# Collapses into second automatic table
pass in from 10.0.0.7
pass in from 10.0.0.8
pass in from 10.0.0.9
pass in from 10.0.0.10
pass in from 10.0.0.11
pass in from 10.0.0.12

> pfctl -vf pf-dedup-auto-table.conf
No ALTQ support in kernel
ALTQ related functions disabled
table <__automatic_a31f8c51_0> const { 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4
10.0.0.5 10.0.0.6 }
table <__automatic_a31f8c51_1> const { 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10
10.0.0.11 10.0.0.12 }
block drop in all
pass in inet from <__automatic_a31f8c51_0> to any flags S/SA keep state
match in all
pass in inet from <__automatic_a31f8c51_1> to any flags S/SA keep state -- rule
was already present

> pfctl -s Tables
__automatic_a31f8c51_0

> pfctl -t __automatic_a31f8c51_0 -T show
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   10.0.0.6

> pfctl -t __automatic_a31f8c51_1 -T show
pfctl: Table does not exist.

Discussion

First and Second automatic tables are correctly built. Once collapsed, the
optimizer sees the rules generated with these automatic tables as duplicates
and drops the second rule, even though that second table contains different IPs
than the first table.

Precisely where the bug lies is unclear. Tracing through the code on pass 2, it
appears that combine_rules correctly builds two automatic tables. From Bug
294860, it's possible that on pass 1 the optimizer sees these folded rules as
the same rule. However, I am unsure if pass 1's remove_identical_rules fails to
distinguish between the unique automatic tables or if pass 2's combine_rules
fails to properly prepare the automatic tables in a manner allowing pass 1 to
see them as unique.

Also, note there is another bug 282863 filed that is related but probably not
the same as this bug.

-- 
You are receiving this mail because:
You are the assignee for the bug.