Add a dedicated pf pool for route options as suggested by henning,

which unbreaks ie route-to after the recent pf changes.

With much help debugging and pointing out of missing bits from claudio@

ok claudio@ "looks good" henning@

4 files changed, 43 insertions, 18 deletions

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index 1c5c38ba37c..72e1033f656 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.572 2009/10/28 12:53:11 claudio Exp $	*/
+/*	$OpenBSD: parse.y,v 1.573 2009/10/28 20:11:01 jsg Exp $	*/
 
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -269,6 +269,7 @@ struct filter_opts {
 	}			 divert, divert_packet;
 	struct redirspec	 nat;
 	struct redirspec	 rdr;
+	struct redirspec	 rroute;
 
 	/* scrub opts */
 	int			 nodf;
@@ -344,7 +345,8 @@ void		 expand_label(char *, size_t, const char *, u_int8_t,
 int		 apply_redirspec(struct pf_pool *, struct pf_rule *,
 		    struct redirspec *, int, struct node_port *);
 void		 expand_rule(struct pf_rule *, int, struct node_if *,
-		    struct redirspec *, struct redirspec *, struct node_proto *,
+		    struct redirspec *, struct redirspec *, struct redirspec *,
+		    struct node_proto *,
 		    struct node_os *, struct node_host *, struct node_port *,
 		    struct node_host *, struct node_port *, struct node_uid *,
 		    struct node_gid *, struct node_icmp *, const char *);
@@ -902,7 +904,7 @@ anchorrule	: ANCHOR anchorname dir quick interface af proto fromto
 			decide_address_family($8.src.host, &r.af);
 			decide_address_family($8.dst.host, &r.af);
 
-			expand_rule(&r, 0, $5, NULL, NULL, $7, $8.src_os,
+			expand_rule(&r, 0, $5, NULL, NULL, NULL, $7, $8.src_os,
 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
 			    $9.uid, $9.gid, $9.icmpspec,
 			    pf->astack[pf->asd + 1] ? pf->alast->name : $2);
@@ -1072,8 +1074,8 @@ antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
 
 				if (h != NULL)
 					expand_rule(&r, 0, j, NULL, NULL, NULL,
-					    NULL, h, NULL, NULL, NULL, NULL,
-					    NULL, NULL, "");
+					    NULL, NULL, h, NULL, NULL, NULL,
+					    NULL, NULL, NULL, "");
 
 				if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
 					bzero(&r, sizeof(r));
@@ -1093,9 +1095,9 @@ antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
 						h = ifa_lookup(i->ifname, 0);
 					if (h != NULL)
 						expand_rule(&r, 0, NULL, NULL,
-						    NULL, NULL, NULL, h, NULL,
+						    NULL, NULL, NULL, NULL, h,
 						    NULL, NULL, NULL, NULL,
-						    NULL, "");
+						    NULL, NULL, "");
 				} else
 					free(hh);
 			}
@@ -2047,10 +2049,10 @@ pfrule		: action dir logquick interface af proto fromto
 					}
 				}
 				/* fake redirspec */
-				if (($8.rdr.rdr = calloc(1,
-				    sizeof(*$8.rdr.rdr))) == NULL)
-					err(1, "$8.rdr.rdr");
-				$8.rdr.rdr->host = $8.route.host;	
+				if (($8.rroute.rdr = calloc(1,
+				    sizeof(*$8.rroute.rdr))) == NULL)
+					err(1, "$8.rroute.rdr");
+				$8.rroute.rdr->host = $8.route.host;	
 			}
 			if ($8.queues.qname != NULL) {
 				if (strlcpy(r.qname, $8.queues.qname,
@@ -2096,7 +2098,8 @@ pfrule		: action dir logquick interface af proto fromto
 			}	
 			r.divert_packet.port = $8.divert_packet.port;
 
-			expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, $6, $7.src_os,
+			expand_rule(&r, 0, $4, &$8.nat, &$8.rdr, &$8.rroute, $6,
+			    $7.src_os,
 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
 			    $8.uid, $8.gid, $8.icmpspec, "");
 		}
@@ -4539,7 +4542,7 @@ apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs,
 
 void
 expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces,
-    struct redirspec *nat, struct redirspec *rdr,
+    struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute,
     struct node_proto *protos, struct node_os *src_oses,
     struct node_host *src_hosts, struct node_port *src_ports,
     struct node_host *dst_hosts, struct node_port *dst_ports,
@@ -4712,6 +4715,7 @@ expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces,
 
 		error += apply_redirspec(&r->nat, r, nat, 0, dst_port);
 		error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port);
+		error += apply_redirspec(&r->route, r, rroute, 2, dst_port);
 
 		if (rule_consistent(r, anchor_call[0]) < 0 || error)
 			yyerror("skipping rule due to errors");
@@ -4752,7 +4756,8 @@ expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces,
 			binat.pool_opts.staticport = 0;
 			binat.rdr->host = srch;
 
-			expand_rule(&rb, 1, interface, NULL, &binat, proto,
+			expand_rule(&rb, 1, interface, NULL, &binat, NULL,
+			    proto,
 			    src_os, dst_host, dst_port, dsth, src_port,
 			    uid, gid, icmp_type, anchor_call);
 		}
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index 39d37f3a787..ea1b1592ff4 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl.c,v 1.288 2009/09/29 12:54:14 jmc Exp $ */
+/*	$OpenBSD: pfctl.c,v 1.289 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -847,6 +847,9 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
 		if (pfctl_get_pool(dev, &pr.rule.nat,
 		    nr, pr.ticket, PF_PASS, path, PF_NAT) != 0)
 			goto error;
+		if (pfctl_get_pool(dev, &pr.rule.route,
+		    nr, pr.ticket, PF_PASS, path, PF_RT) != 0)
+			goto error;
 
 		switch (format) {
 		case PFCTL_SHOW_LABELS:
@@ -902,6 +905,7 @@ pfctl_show_rules(int dev, char *path, int opts, enum pfctl_show format,
 		}
 		pfctl_clear_pool(&pr.rule.rdr);
 		pfctl_clear_pool(&pr.rule.nat);
+		pfctl_clear_pool(&pr.rule.route);
 	}
 	path[len] = '\0';
 	return (0);
@@ -1127,6 +1131,8 @@ pfctl_add_rule(struct pfctl *pf, struct pf_rule *r, const char *anchor_call)
 	pfctl_move_pool(&r->rdr, &rule->rdr);
 	TAILQ_INIT(&rule->nat.list);
 	pfctl_move_pool(&r->nat, &rule->nat);
+	TAILQ_INIT(&rule->route.list);
+	pfctl_move_pool(&r->route, &rule->route);
 
 	TAILQ_INSERT_TAIL(rs->rules[rs_num].active.ptr, rule, entries);
 	return (0);
@@ -1251,6 +1257,8 @@ pfctl_load_rule(struct pfctl *pf, char *path, struct pf_rule *r, int depth)
 			return (1);
 		if (pfctl_add_pool(pf, &r->nat, r->af, PF_NAT))
 			return (1);
+		if (pfctl_add_pool(pf, &r->route, r->af, PF_RT))
+			return (1);
 		pr.pool_ticket = pf->paddr.ticket;
 		memcpy(&pr.rule, r, sizeof(pr.rule));
 		if (r->anchor && strlcpy(pr.anchor_call, name,
diff --git a/sbin/pfctl/pfctl_optimize.c b/sbin/pfctl/pfctl_optimize.c
index 88d44115331..666e69f8b30 100644
--- a/sbin/pfctl/pfctl_optimize.c
+++ b/sbin/pfctl/pfctl_optimize.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_optimize.c,v 1.19 2009/09/01 13:42:00 henning Exp $ */
+/*	$OpenBSD: pfctl_optimize.c,v 1.20 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2004 Mike Frantzen <frantzen@openbsd.org>
@@ -137,6 +137,7 @@ struct pf_rule_field {
     PF_RULE_FIELD(rdr,			BREAK),
     PF_RULE_FIELD(nat,			BREAK),
     PF_RULE_FIELD(logif,		BREAK),
+    PF_RULE_FIELD(route,		BREAK),
 
     /*
      * Any fields not listed in this structure act as BREAK fields
@@ -300,6 +301,12 @@ pfctl_optimize_ruleset(struct pfctl *pf, struct pf_ruleset *rs)
 		} else
 			bzero(&por->por_rule.nat,
 			    sizeof(por->por_rule.nat));
+		if (TAILQ_FIRST(&r->route.list) != NULL) {
+			TAILQ_INIT(&por->por_rule.route.list);
+			pfctl_move_pool(&r->route, &por->por_rule.route);
+		} else
+			bzero(&por->por_rule.route,
+			    sizeof(por->por_rule.route));
 
 
 		TAILQ_INSERT_TAIL(&opt_queue, por, por_entry);
@@ -331,8 +338,10 @@ pfctl_optimize_ruleset(struct pfctl *pf, struct pf_ruleset *rs)
 			memcpy(r, &por->por_rule, sizeof(*r));
 			TAILQ_INIT(&r->rdr.list);
 			TAILQ_INIT(&r->nat.list);
+			TAILQ_INIT(&r->route.list);
 			pfctl_move_pool(&por->por_rule.rdr, &r->rdr);
 			pfctl_move_pool(&por->por_rule.nat, &r->nat);
+			pfctl_move_pool(&por->por_rule.route, &r->route);
 			TAILQ_INSERT_TAIL(
 			    rs->rules[PF_RULESET_FILTER].active.ptr,
 			    r, entries);
@@ -923,6 +932,9 @@ load_feedback_profile(struct pfctl *pf, struct superblocks *superblocks)
 		if (TAILQ_EMPTY(&por->por_rule.nat.list))
 			memset(&por->por_rule.nat, 0,
 			    sizeof(por->por_rule.nat));
+		if (TAILQ_EMPTY(&por->por_rule.route.list))
+			memset(&por->por_rule.route, 0,
+			    sizeof(por->por_rule.route));
 		TAILQ_INSERT_TAIL(&queue, por, por_entry);
 
 		/* XXX pfctl_get_pool(pf->dev, &pr.rule.rpool, nr, pr.ticket,
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 72e3739cd0e..72906cb2f31 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_parser.c,v 1.249 2009/10/04 16:08:37 michele Exp $ */
+/*	$OpenBSD: pfctl_parser.c,v 1.250 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -1038,7 +1038,7 @@ print_rule(struct pf_rule *r, const char *anchor_call, int verbose)
 			printf(" fastroute");
 		if (r->rt != PF_FASTROUTE) {
 			printf(" ");
-			print_pool(&r->rdr, 0, 0, r->af, PF_PASS);
+			print_pool(&r->route, 0, 0, r->af, PF_PASS);
 		}
 	}
 }