From nobody Mon May 25 07:05:25 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gP6NC2YqZz6dm9d for ; Mon, 25 May 2026 07:05:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gP6NC0n9mz3bTM for ; Mon, 25 May 2026 07:05:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779692731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cfYc+hzYWSimWyYqKufh44hEJBiFsqYdiN35BmqgXHg=; b=EORBM0XQMSJPZjBp7skdSXld9o1IbJ3rrzte0PEivzi7tu+S3XMB8CCIAYung5mkBkps6u 12iYkYpTkX+nPgA8+wT7JhEKauhML1rS8J1GnXIqNnTA2XlCiDjpk4zAfyp6bZtq5c05q7 /QvdWI+RP3JgVMHFMrLULn7BKchF3/GSKpg878h23ZwW0QmnQyft2C1TBYeaLA3cNvFKE9 DHuQ9T1aRACd1XJc3Df6Q+Qqh9XtzTYWbp+tTqiy5gqVPex0bjQMIjHSslxG9LsDbxybJe OPU2lSHkXV1mm75Zq2YZD+kn7+FnkSEHqDVqzvqnQq2STwg1dX4qavyKClYoeA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779692731; a=rsa-sha256; cv=none; b=syncQvo8BAQ+F7/KK14a6MbE7rsVvB8aZbdvcBSatYg+OWuwfCeUwmDq5cqNnTjpMKSW4K WYZxwTe9Jq5z07cisoukuerg+sIMh6iZZoLwPVts0uRETJ21TACkWnErwddI2u+e+zdZeV rMpQSrE0y2jc4F0yCAhPpKJo6HhJfmYQShiaebpCJ5jXnhqTmgU45MpUoLGyMOtsu6jNAH BnwsX6XZJmsFyP8N+Y4efK3W/cblJ4Gx/Wc7esG6PumsSAXkayXwv4DTlrHZEczNy8exk/ xeixUpg6T1Nv9x/yepsFQG+Gq1dnqFSi4Nu4uRRmOKC/vFqrMU5rUNZ1nG39cw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779692731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cfYc+hzYWSimWyYqKufh44hEJBiFsqYdiN35BmqgXHg=; b=am+wYVui1bTtzSpZ3rg4sP7H5UmJ7hNrvLgL7CcVjnEBrFIy9shus4RTB3lrEfWythlR8M 6KdDVhjvnw7wGiRpF6t5UWM2zRs3UTTIsprbV4tGPURNJeof6T2sw+HBES5CDZpwxVNM1h e7pnU3q/+zonvlayvAiDJOTMJ1s8LeVEqXxCHjURVEWHCIqA2YBn74sRhMQ7VZSpoMcxb6 mNv+C+o+iFpmNOqR6NuQsRH2ZzzEDWA/KqD+LENkKmS1AcKTSbCfT0AqXIucVXMPrc0LE5 iCBQ1E2DZqguRhxFMoKMsJG3+42Sr2NJEcSH0PJ034a1o6Em0mJGhdNlMjlfmA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gP6NB6VRYzWkb for ; Mon, 25 May 2026 07:05:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3fc5b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 25 May 2026 07:05:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Andrey V. Elsukov Subject: git: 9acea8aa36e9 - stable/15 - ipfw: treat ipv6 address with zero mask as 'any' List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ae X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9acea8aa36e98d636f8d183ac06ec5d2d25de0e1 Auto-Submitted: auto-generated Date: Mon, 25 May 2026 07:05:25 +0000 Message-Id: <6a13f4b5.3fc5b.7a8ac2b3@gitrepo.freebsd.org> The branch stable/15 has been updated by ae: URL: https://cgit.FreeBSD.org/src/commit/?id=9acea8aa36e98d636f8d183ac06ec5d2d25de0e1 commit 9acea8aa36e98d636f8d183ac06ec5d2d25de0e1 Author: Andrey V. Elsukov AuthorDate: 2026-05-17 10:12:20 +0000 Commit: Andrey V. Elsukov CommitDate: 2026-05-25 07:03:05 +0000 ipfw: treat ipv6 address with zero mask as 'any' Make the behaviour similar for both IPv4 and IPv6. Also add the corresponding tests. PR: 294733 Differential Revision: https://reviews.freebsd.org/D56618 (cherry picked from commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1) --- sbin/ipfw/ipfw2.c | 7 ++++--- sbin/ipfw/ipv6.c | 11 +++++++---- sbin/ipfw/tests/test_add_rule.py | 24 ++++++++++++++++++++++++ tests/atf_python/sys/netpfil/ipfw/insns.py | 2 ++ 4 files changed, 37 insertions(+), 7 deletions(-) diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index a2bfd63c6002..19b74c6592d3 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -3595,12 +3595,13 @@ fill_ip(ipfw_insn_ip *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT) { /* "not any" never matches */ - if (av == NULL && len == 0) /* only this entry */ + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) /* "not any" never matches */ errx(EX_DATAERR, "not any never matches"); + return; } /* else do nothing and skip this entry */ - return; + continue; } /* A single IP can be stored in an optimized format */ if (d[1] == (uint32_t)~0 && av == NULL && len == 0) { diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index e6eb07af26dc..f34a08bb6f52 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -396,8 +396,6 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) n2mask(&d[1], masklen); } - APPLY_MASK(d, &d[1]); /* mask base address with mask */ - av = q; /* Check this entry */ @@ -408,11 +406,16 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate) * list unless it is the only item, in which case we * report an error. */ - if (cmd->o.len & F_NOT && av == NULL && len == 0) - errx(EX_DATAERR, "not any never matches"); + if (av == NULL && len == 0) { + if (cmd->o.len & F_NOT) + errx(EX_DATAERR, "not any never matches"); + return (1); + } continue; } + APPLY_MASK(d, &d[1]); /* mask base address with mask */ + /* * A single IP can be stored alone */ diff --git a/sbin/ipfw/tests/test_add_rule.py b/sbin/ipfw/tests/test_add_rule.py index 4360c5f87c15..ed565f0e7c68 100755 --- a/sbin/ipfw/tests/test_add_rule.py +++ b/sbin/ipfw/tests/test_add_rule.py @@ -135,6 +135,30 @@ class TestAddRule(BaseTest): }, id="test_rulenum", ), + pytest.param( + { + "in": "add allow ip4 from 0.0.0.0/0 to 192.0.2.1/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP4), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask4", + ), + pytest.param( + { + "in": "add allow ip6 from ::/0 to 2001:DB8::/0", + "out": { + "insns": [ + InsnEmpty(IpFwOpcode.O_IP6), + InsnEmpty(IpFwOpcode.O_ACCEPT), + ], + }, + }, + id="test_zero_addrmask6", + ), pytest.param( { "in": "add allow ip from { 1.2.3.4 or 2.3.4.5 } to any", diff --git a/tests/atf_python/sys/netpfil/ipfw/insns.py b/tests/atf_python/sys/netpfil/ipfw/insns.py index dbb9af659794..c5f729ac4d63 100644 --- a/tests/atf_python/sys/netpfil/ipfw/insns.py +++ b/tests/atf_python/sys/netpfil/ipfw/insns.py @@ -682,6 +682,8 @@ insn_attrs = prepare_attrs_map( AttrDescr(IpFwOpcode.O_NOP, InsnComment), + AttrDescr(IpFwOpcode.O_IP4, InsnEmpty), + AttrDescr(IpFwOpcode.O_IP6, InsnEmpty), AttrDescr(IpFwOpcode.O_PROTO, InsnProto), AttrDescr(IpFwOpcode.O_PROB, InsnProb), AttrDescr(IpFwOpcode.O_IP_DST_ME, InsnEmpty),