Date: Mon, 04 Mar 2019 15:11:16 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 236221] pf: ruleset optimizaton doesn't create autotables for rules into anchors Message-ID: <bug-236221-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D236221 Bug ID: 236221 Summary: pf: ruleset optimizaton doesn't create autotables for rules into anchors Product: Base System Version: 12.0-RELEASE Hardware: amd64 OS: Any Status: New Severity: Affects Some People Priority: --- Component: conf Assignee: bugs@FreeBSD.org Reporter: a.krasotin@yahoo.com I found out PF's ruleset optimization spoils rule into anchor. It replaces = list of addresses with autotable but doesn't create this one, so rule doesn't wo= rk. I tested with the following configs: # uname -a FreeBSD test 12.0-RELEASE FreeBSD 12.0-RELEASE r341666 GENERIC amd64 # cat /etc/pf.conf table <User2> persist { 10.10.12.49 } table <NatFrom> persist { 10.10.12.49/24 } nat on em0 from <NatFrom> to any -> { 192.168.170.199 } anchor user_profiles in on { em1 } { anchor User2 from <User2> { block quick log from <User2> to {87.250.250.242, 74.125.131.94, 4.2.2.2, 8.8.8.8, 217.69.139.202, 81.19.82.10} } } # cat /etc/rc.conf hostname=3D"test" ifconfig_em0=3D"inet 192.168.170.199 netmask 255.255.255.0" defaultrouter=3D"192.168.170.254" ifconfig_em1=3D"inet 10.10.12.1 netmask 255.255.255.0" sshd_enable=3D"YES" dumpdev=3D"NO" zfs_enable=3D"YES" pf_enable=3D"YES" gateway_enable=3D"YES" You can see there is an autotable into the rule: # pfctl -a 'user_profiles/*' -sr anchor "User2" from <User2> to any { block drop log quick inet from <User2> to <__automatic_c789788_0> } But there isn't autotable at all: # pfctl -sTables NatFrom User2 --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-236221-227>