From nobody Sun May 17 10:15:19 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gJGyv6zvBz6f6HV for ; Sun, 17 May 2026 10:15:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gJGyv6L45z42M9 for ; Sun, 17 May 2026 10:15:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779012919; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ivD/FE0IAQTMscIKNPSJGEWOjgLbvNIvJXRX1WU6S6Q=; b=dVvmbxaea4kfRyw8yZL/xvr3Wmdv5+BUme4mNy/N8G663QPQhrCG2vMvxlOg5AFFaSbOLj Ot8b5cCFbGEFZNwEaSvB9T7wSwJqS1OEE0rjzALEQaMyAjeZbEeL8A1xykkGgBIn0qEXkb irmQCyrCIo9pd+dIAYQD0ZfsGZxGx5//KM8GCQCQzbVctrjlLESC1usxnzgShX7CSMfRxv sIPbz4vKT9Eu/NN5QIhi+XqUqX4pJXR2Vlwn12cJSQKkfPL0SSRBJEEEtzm5aAaelRSFYU +VGf/bKAjuoY1paqbFQ/c80v4lAch0jmrJePP9ib6iQeodpEYklCcUiFEpuPjA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779012919; a=rsa-sha256; cv=none; b=iZz9qGtkYP1Vz19x+t7xCYEnL0nWqrX3j4zuXPx3bktgdGTBmYRWHZcHTFHAu+ZrOoDf5R uZQI0UMK+lPJucfdLQ6oc6fNZ9HcfqAMZd7HcU4dp7A6Urn30jnKsh12ZdKETaTv287irE UOZV29fPte7gGP3PRVHVFaWCOSNlp7PYX/bfkQvxM3p4MmJLYpldbJs7zKZ6i9RlqBEi/I bo2gW82JB+bTyEA80kRMTBvLVNhNv34GvkfkbuvaBJ42h9uLcBKI4VQvILsnrqhb2FPkf7 7TVI5rTatJ2TUCVzB9czDNjDcX+2XamH7s1+9XX3Bh1iMwr41VwEAjQN7LdxOQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779012919; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ivD/FE0IAQTMscIKNPSJGEWOjgLbvNIvJXRX1WU6S6Q=; b=HRlwWDou02L+0wu1zX8+ZKdb3wwgqxP2ST8rjnSdGu20JMY52fw92OCEV4Qg9yos0Cyuwl PFhZF0m6JKk+rmCGAOTnYS5AOZa/p+wKeQFZHznJEYMpZeviKtXm+xQDbsXWdjljT7ydvC Jm2WcrE9YXS7qcM8Kq9wVFKP85jcwiXlJiaf6MBlJi30cXuSoVZXCaeZ9T3Dlcdye5AysH Hx6CieldJ8NRfNYypiQ+tRW0sKVTC1/wFaxzf9/fWKvlazmo2g0125oXxbriXfcRw2OkdG FT/rtN5cRq6p4T11k6//3RNfVqDNahj2rTPZV2jWYJxy9PeL3xma4cRJuccs/Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gJGyv5jPbzd3H for ; Sun, 17 May 2026 10:15:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ffad by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 17 May 2026 10:15:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Andrey V. Elsukov Subject: git: 2872268c7f6d - main - ipfw: treat ipv6 address with zero mask as 'any' List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ae X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 Auto-Submitted: auto-generated Date: Sun, 17 May 2026 10:15:19 +0000 Message-Id: <6a099537.3ffad.40d890d5@gitrepo.freebsd.org> The branch main has been updated by ae: URL: https://cgit.FreeBSD.org/src/commit/?id=2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1 Author: Andrey V. Elsukov AuthorDate: 2026-05-17 10:12:20 +0000 Commit: Andrey V. Elsukov CommitDate: 2026-05-17 10:12:20 +0000 ipfw: treat ipv6 address with zero mask as 'any' Make the behaviour similar for both IPv4 and IPv6. Also add the corresponding tests. PR: 294733 MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D56618 --- sbin/ipfw/ipfw2.c | 7 ++++--- sbin/ipfw/ipv6.c | 11 +++++++---- sbin/ipfw/tests/test_add_rule.py | 24 ++++++++++++++++++++++++ tests/atf_python/sys/netpfil/ipfw/insns.py | 2 ++ 4 files changed, 37 insertions(+), 7 deletions(-) diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index 06a1ee937cd7..c67eb6618c59 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -3595,12 +3595,13 @@ fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT) { /* "not any" never matches */ - if (av == NULL && len == 0) /* only this entry */ + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) /* "not any" never matches */ errx(EX_DATAERR, "not any never matches"); + return; } /* else do nothing and skip this entry */ - return; + continue; } /* A single IP can be stored in an optimized format */ if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index e6eb07af26dc..f34a08bb6f52 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -396,8 +396,6 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) n2mask(&d[1], masklen); } - APPLY_MASK(d, &d[1]); /* mask base address with mask */ - av = q; /* Check this entry */ @@ -408,11 +406,16 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT && av == NULL && len == 0) - errx(EX_DATAERR, "not any never matches"); + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) + errx(EX_DATAERR, "not any never matches"); + return (1); + } continue; } + APPLY_MASK(d, &d[1]); /* mask base address with mask */ + /* * A single IP can be stored alone */ diff --git a/sbin/ipfw/tests/test_add_rule.py b/sbin/ipfw/tests/test_add_rule.py index 4360c5f87c15..ed565f0e7c68 100755 --- a/sbin/ipfw/tests/test_add_rule.py +++ b/sbin/ipfw/tests/test_add_rule.py @@ -135,6 +135,30 @@ class TestAddRule(BaseTest): }, id="test_rulenum", ), + pytest.param( + { + "in": "add allow ip4 from 0.0.0.0/0 to 192.0.2.1/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP4), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask4", + ), + pytest.param( + { + "in": "add allow ip6 from ::/0 to 2001:DB8::/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP6), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask6", + ), pytest.param( { "in": "add allow ip from { 1.2.3.4 or 2.3.4.5 } to any", diff --git a/tests/atf_python/sys/netpfil/ipfw/insns.py b/tests/atf_python/sys/netpfil/ipfw/insns.py index dbb9af659794..c5f729ac4d63 100644 --- a/tests/atf_python/sys/netpfil/ipfw/insns.py +++ b/tests/atf_python/sys/netpfil/ipfw/insns.py @@ -682,6 +682,8 @@ insn_attrs = prepare_attrs_map( AttrDescr(IpFwOpcode.O_NOP, InsnComment), + AttrDescr(IpFwOpcode.O_IP4, InsnEmpty), + AttrDescr(IpFwOpcode.O_IP6, InsnEmpty), AttrDescr(IpFwOpcode.O_PROTO, InsnProto), AttrDescr(IpFwOpcode.O_PROB, InsnProb), AttrDescr(IpFwOpcode.O_IP_DST_ME, InsnEmpty),