upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-25 11:00:15 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pfctl: fix FOM_ICMP/POM_STICKYADDRESS clash

Browse source 
pass inet proto icmp icmp-type {unreach}
	pass route-to (if0 127.0.0.1/8) sticky-address inet

The wrong struct was being tested. The parser tries to prevent
"sticky-address sticky-address" syntax but was actually cross-rule
enforcing that ICMP filter cannot be before the use of "sticky-address"
in next rule.

MFC after:	2 weeks
Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D36050
This commit is contained in:
Franco Fichtner 2022-08-06 10:59:56 +02:00 committed by Kristof Provost
parent 93dd3adac7
commit 1e73fbd8b2
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sbin/pfctl/parse.y
View file

@ -4466,7 +4466,7 @@ pool_opt : BITMASK {
pool_opts.staticport = 1;
}
| STICKYADDRESS {
if (filter_opts.marker & POM_STICKYADDRESS) {
if (pool_opts.marker & POM_STICKYADDRESS) {
yyerror("sticky-address cannot be redefined");
YYERROR;
}