Project

General

Profile

Actions

Bug #14007

closed

Using PF reserved keywords for interface descriptions results in an invalid ruleset

Added by Marcos M almost 2 years ago. Updated almost 2 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Aliases / Tables
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
23.05
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Interface descriptions are used to generate system aliases placed in /tmp/rules.debug. Interface descriptions are checked against the reserved aliases list leading to firewall rules failing to be generated.

Example:
user = "{ lagg0.66 }"

        <opt9>
            <descr><![CDATA[user]]></descr>
            <if>lagg0.66</if>
            <enable></enable>
            <ipaddr>10.60.6.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt9>

There were error(s) loading the rules: /tmp/rules.debug:19: syntax error - The line in question reads [19]: user = "{ lagg0.66 }"

Reserved list: https://github.com/pfsense/pfsense/blob/master/src/etc/inc/globals.inc#L223

Actions #1

Updated by Marcos M almost 2 years ago

  • Description updated (diff)
Actions #2

Updated by Jim Pingle almost 2 years ago

  • Subject changed from Using reserved alias names for interface descriptions causes filter reloads to fail to Using PF reserved keywords for interface descriptions results in an invalid ruleset
  • Target version set to 2.7.0
  • Plus Target Version set to 23.05
Actions #3

Updated by Jim Pingle almost 2 years ago

  • Assignee set to Jim Pingle
Actions #4

Updated by Jim Pingle almost 2 years ago

  • Status changed from New to In Progress

The fix for #14057 likely also solved this as a byproduct but we should still reject these names just in case.

I can't reproduce the problem on a current snap because the ruleset gets the name in uppercase now, so it's:

USER = "{ vtnet2 }" 

Since it's uppercase it doesn't directly match the reserved keyword.

Still better to be safe, some other future intentional change could break it again one way or another.

Actions #5

Updated by Jim Pingle almost 2 years ago

  • Status changed from In Progress to Feedback
  • % Done changed from 0 to 100
Actions #6

Updated by Georgiy Tyutyunnik almost 2 years ago

patch fixes the issue, prohibiting the reserved pf keywords from being configured as interface names
Tested on:
Version 23.01-RELEASE (amd64)
built on Fri Feb 10 20:06:33 UTC 2023
FreeBSD 14.0-CURRENT

Actions #7

Updated by Jim Pingle almost 2 years ago

  • Status changed from Feedback to Resolved
Actions

Also available in: Atom PDF