[Bug 236221] pf: ruleset optimizaton doesn't create autotables for rules into anchors

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236221

            Bug ID: 236221
           Summary: pf: ruleset optimizaton doesn't create autotables for
                    rules into anchors
           Product: Base System
           Version: 12.0-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: conf
          Assignee: bugs at FreeBSD.org
          Reporter: a.krasotin at yahoo.com

I found out PF's ruleset optimization spoils rule into anchor. It replaces list
of addresses with autotable but doesn't create this one, so rule doesn't work.

I tested with the following configs:

# uname -a
FreeBSD test 12.0-RELEASE FreeBSD 12.0-RELEASE r341666 GENERIC  amd64

# cat /etc/pf.conf
table <User2> persist { 10.10.12.49 }
table <NatFrom> persist { 10.10.12.49/24 }

nat on em0 from <NatFrom> to any -> { 192.168.170.199 }

anchor user_profiles in on { em1 } {
  anchor User2 from <User2> {
    block quick log from <User2> to {87.250.250.242, 74.125.131.94, 4.2.2.2,
8.8.8.8, 217.69.139.202, 81.19.82.10}
  }
}

# cat /etc/rc.conf
hostname="test"
ifconfig_em0="inet 192.168.170.199 netmask 255.255.255.0"
defaultrouter="192.168.170.254"
ifconfig_em1="inet 10.10.12.1 netmask 255.255.255.0"
sshd_enable="YES"
dumpdev="NO"
zfs_enable="YES"

pf_enable="YES"
gateway_enable="YES"



You can see there is an autotable into the rule:

# pfctl -a 'user_profiles/*' -sr
anchor "User2" from <User2> to any {
  block drop log quick inet from <User2> to <__automatic_c789788_0>
}

But there isn't autotable at all:

# pfctl -sTables
NatFrom
User2

-- 
You are receiving this mail because:
You are the assignee for the bug.