From owner-svn-src-all@freebsd.org Sun Oct 28 05:32:52 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D83E110E3F71; Sun, 28 Oct 2018 05:32:51 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 8008F708F5; Sun, 28 Oct 2018 05:32:51 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 44CDD1B1F1; Sun, 28 Oct 2018 05:32:51 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w9S5WpAu010443; Sun, 28 Oct 2018 05:32:51 GMT (envelope-from kp@FreeBSD.org) Received: (from kp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w9S5WoV4010440; Sun, 28 Oct 2018 05:32:50 GMT (envelope-from kp@FreeBSD.org) Message-Id: <201810280532.w9S5WoV4010440@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kp set sender to kp@FreeBSD.org using -f From: Kristof Provost Date: Sun, 28 Oct 2018 05:32:50 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r339835 - in head: sbin/pfctl share/man/man5 sys/netpfil/pf X-SVN-Group: head X-SVN-Commit-Author: kp X-SVN-Commit-Paths: in head: sbin/pfctl share/man/man5 sys/netpfil/pf X-SVN-Commit-Revision: 339835 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Oct 2018 05:32:52 -0000 Author: kp Date: Sun Oct 28 05:32:50 2018 New Revision: 339835 URL: https://svnweb.freebsd.org/changeset/base/339835 Log: pf: Make ':0' ignore link-local v6 addresses too When users mark an interface to not use aliases they likely also don't want to use the link-local v6 address there. PR: 201695 Submitted by: Russell Yount Differential Revision: https://reviews.freebsd.org/D17633 Modified: head/sbin/pfctl/pfctl_parser.c head/share/man/man5/pf.conf.5 head/sys/netpfil/pf/pf_if.c Modified: head/sbin/pfctl/pfctl_parser.c ============================================================================== --- head/sbin/pfctl/pfctl_parser.c Sun Oct 28 03:02:09 2018 (r339834) +++ head/sbin/pfctl/pfctl_parser.c Sun Oct 28 05:32:50 2018 (r339835) @@ -1366,6 +1366,9 @@ ifa_lookup(const char *ifa_name, int flags) last_if = p->ifname; if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) continue; + if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && + IN6_IS_ADDR_LINKLOCAL(&p->addr.v.a.addr.v6)) + continue; if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) continue; if (p->af == AF_INET) Modified: head/share/man/man5/pf.conf.5 ============================================================================== --- head/share/man/man5/pf.conf.5 Sun Oct 28 03:02:09 2018 (r339834) +++ head/share/man/man5/pf.conf.5 Sun Oct 28 05:32:50 2018 (r339835) @@ -28,7 +28,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd October 6, 2016 +.Dd October 27, 2018 .Dt PF.CONF 5 .Os .Sh NAME @@ -1511,7 +1511,7 @@ Do not include interface aliases. Host names may also have the .Ar :0 option appended to restrict the name resolution to the first of each -v4 and v6 address found. +v4 and non-link-local v6 address found. .Pp Host name resolution and interface to address translation are done at ruleset load-time. Modified: head/sys/netpfil/pf/pf_if.c ============================================================================== --- head/sys/netpfil/pf/pf_if.c Sun Oct 28 03:02:09 2018 (r339834) +++ head/sys/netpfil/pf/pf_if.c Sun Oct 28 05:32:50 2018 (r339835) @@ -553,7 +553,8 @@ pfi_instance_add(struct ifnet *ifp, int net, int flags if ((flags & PFI_AFLAG_PEER) && !(ifp->if_flags & IFF_POINTOPOINT)) continue; - if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && + if ((flags & (PFI_AFLAG_NETWORK | PFI_AFLAG_NOALIAS)) && + af == AF_INET6 && IN6_IS_ADDR_LINKLOCAL( &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) continue;