Date: Mon, 04 Mar 2019 15:11:16 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 236221] pf: ruleset optimizaton doesn't create autotables for rules into anchors Message-ID: <bug-236221-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236221 Bug ID: 236221 Summary: pf: ruleset optimizaton doesn't create autotables for rules into anchors Product: Base System Version: 12.0-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Some People Priority: --- Component: conf Assignee: bugs@FreeBSD.org Reporter: a.krasotin@yahoo.com I found out PF's ruleset optimization spoils rule into anchor. It replaces list of addresses with autotable but doesn't create this one, so rule doesn't work. I tested with the following configs: # uname -a FreeBSD test 12.0-RELEASE FreeBSD 12.0-RELEASE r341666 GENERIC amd64 # cat /etc/pf.conf table <User2> persist { 10.10.12.49 } table <NatFrom> persist { 10.10.12.49/24 } nat on em0 from <NatFrom> to any -> { 192.168.170.199 } anchor user_profiles in on { em1 } { anchor User2 from <User2> { block quick log from <User2> to {87.250.250.242, 74.125.131.94, 4.2.2.2, 8.8.8.8, 217.69.139.202, 81.19.82.10} } } # cat /etc/rc.conf hostname="test" ifconfig_em0="inet 192.168.170.199 netmask 255.255.255.0" defaultrouter="192.168.170.254" ifconfig_em1="inet 10.10.12.1 netmask 255.255.255.0" sshd_enable="YES" dumpdev="NO" zfs_enable="YES" pf_enable="YES" gateway_enable="YES" You can see there is an autotable into the rule: # pfctl -a 'user_profiles/*' -sr anchor "User2" from <User2> to any { block drop log quick inet from <User2> to <__automatic_c789788_0> } But there isn't autotable at all: # pfctl -sTables NatFrom User2 -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-236221-227>