[Bug 252617] pfctl -a '*' -sn does not recursively print nat-anchors

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252617

            Bug ID: 252617
           Summary: pfctl -a '*' -sn does not recursively print
                    nat-anchors
           Product: Base System
           Version: 12.2-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs at FreeBSD.org
          Reporter: guido at kollerie.com

According to "man pfctl" one should use "-a '*'" to recursively print the
main ruleset. That does work for filter anchors (eg 'anchor') but not for
NAT anchors (eg 'nat-anchor').

Given the loaded ruleset:

    ext_if="lagg0"

    set skip on lo0
    scrub in

    nat-anchor vm 

    block in
    pass out

    pass in on $ext_if proto tcp from any to ($ext_if) port { ssh, domain,
http, https }
    pass in on $ext_if proto udp to ($ext_if) port domain
    pass in on $ext_if inet proto icmp to ($ext_if) icmp-type { unreach, redir,
timex, echoreq }

    anchor vm 

Running:

    pfctl -a vm -f - <<EOT
    nat on lagg0 from vm-public:network to any -> (lagg0)
    pass in on vm-public
    EOT

should load the new NAT and filter rules into the appropriate anchor
positions. When we run:

    pfctl -a '*' -sr

The filter ruleset is properly recursively printed:

    scrub in all fragment reassemble
    block drop in all
    pass in on lagg0 proto tcp from any to (lagg0) port = ssh flags S/SA keep
state
    pass in on lagg0 proto tcp from any to (lagg0) port = domain flags S/SA
keep state
    pass in on lagg0 proto tcp from any to (lagg0) port = http flags S/SA keep
state
    pass in on lagg0 proto tcp from any to (lagg0) port = https flags S/SA keep
state
    pass in on lagg0 proto udp from any to (lagg0) port = domain keep state
    pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type unreach keep
state
    pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type redir keep
state
    pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type timex keep
state
    pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type echoreq keep
state
    pass out all flags S/SA keep state
    anchor "vm" all {
      pass in on vm-public all flags S/SA keep state
    }

But the NAT ruleset however is not:

    pfctl -a '*' -sn

prints:

    nat-anchor "vm" all

Only when we explicitly name the anchor, will the NAT ruleset be printed:

    pfctl -a vm -sn

prints:

    nat on lagg0 inet from 10.0.128.0/24 to any -> (lagg0) round-robin

I would have expected both "-a '*'" and "-a vm" to produce the same
output.

-- 
You are receiving this mail because:
You are the assignee for the bug.