diff options
| author | Reyk Floeter <reyk@cvs.openbsd.org> | 2012-10-18 15:18:58 +0000 |
|---|---|---|
| committer | Reyk Floeter <reyk@cvs.openbsd.org> | 2012-10-18 15:18:58 +0000 |
| commit | 2a3459992748c304fff0e64a062c25797482fec5 (patch) | |
| tree | f3f589e0f1b46d65eb161cfaad7ff136502582b1 /sbin | |
| parent | 814a8549472749080b04fc1a4c291134ef69728f (diff) | |
Disallow tables and interface address pools for rdr-to, nat-to and
route-to with any other scheduling algorithms than round-robin or
least-states. Before this change, pfctl accepted and loaded invalid
address pools, eg. "rdr-to <table> source-hash", but it is not
supported by the kernel and was silently ignored in operation.
Also clarify the manpage a bit by mentioning that tables are only
valid with round-robin or least-states.
ok zinke@
Diffstat (limited to 'sbin')
| -rw-r--r-- | sbin/pfctl/parse.y | 28 |
1 files changed, 9 insertions, 19 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 32ef212819b..bf2e7923f2c 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -1,4 +1,4 @@ -/* $OpenBSD: parse.y,v 1.619 2012/09/18 10:11:52 henning Exp $ */ +/* $OpenBSD: parse.y,v 1.620 2012/10/18 15:18:57 reyk Exp $ */ /* * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -2020,24 +2020,6 @@ pfrule : action dir logquick interface af proto fromto $8.route.host->addr.type == PF_ADDR_TABLE || DYNIF_MULTIADDR($8.route.host->addr))) r.route.opts |= PF_POOL_ROUNDROBIN; - if (((r.route.opts & PF_POOL_TYPEMASK) != - PF_POOL_ROUNDROBIN) && - ((r.route.opts & PF_POOL_TYPEMASK) != - PF_POOL_LEASTSTATES) && - disallow_table($8.route.host, - "tables are only " - "supported in round-robin or " - "least-states routing pools")) - YYERROR; - if (((r.route.opts & PF_POOL_TYPEMASK) != - PF_POOL_ROUNDROBIN) && - ((r.route.opts & PF_POOL_TYPEMASK) != - PF_POOL_LEASTSTATES) && - disallow_alias($8.route.host, - "interface (%s) " - "is only supported in round-robin or " - "least-states routing pools")) - YYERROR; if ($8.route.host->next != NULL) { if (((r.route.opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) && @@ -4829,6 +4811,14 @@ apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, DYNIF_MULTIADDR(rpool->addr)) rpool->opts |= PF_POOL_ROUNDROBIN; + if (((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) && + ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_LEASTSTATES) && + (disallow_table(rs->rdr->host, "tables are only supported " + "in round-robin or least-states address pools") || + disallow_alias(rs->rdr->host, "interface (%s) is only supported " + "in round-robin or least-states address pools"))) + return (1); + if (rs->pool_opts.key != NULL) memcpy(&rpool->key, rs->pool_opts.key, sizeof(struct pf_poolhashkey)); |