Project

General

Profile

Actions
Copy link

Bug #5872

closed

Creating a network alias with both IPv6 subnets and FQDNs results in a table with only the FQDN entries.

Added by Steve Wheeler almost 9 years ago. Updated almost 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Luiz Souza
Category:
Rules / NAT
Target version:
2.3
Start date:
02/10/2016
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

It looks like filter DNS is choking on the IPv6 entries.
To test I created a network alias containing:
2607:f8b0:4000::/36
2a00:1450:4000::/36
chaos.pfmechanics.com
forum.pfsense.org

The /36 subnets are not added to the table.
I tested in 2.2.6 and 2.3. Problem appears identically.

The resolver log shows:
Feb 10 13:10:56 filterdns invalid netmask '/36' for hostname 2607:f8b0:4000::/36
Feb 10 13:10:56 filterdns invalid netmask '/36' for hostname 2a00:1450:4000::/36
Feb 10 13:10:56 filterdns failed to resolve host chaos.pfmechanics.com will retry later again.
Feb 10 13:10:57 filterdns adding entry 208.123.73.18 to table Test_V6subnet_with_hosts on host forum.pfsense.org
Feb 10 13:10:57 filterdns adding entry 2610:160:11:1000::18 to table Test_V6subnet_with_hosts on host forum.pfsense.org

Files

Download all files
filterdns.conf (192 Bytes) filterdns.conf Steve Wheeler, 02/10/2016 07:25 AM
rules(12).debug (9.28 KB) rules(12).debug Steve Wheeler, 02/10/2016 07:25 AM
Actions
Copy link
 #1

Updated by Chris Buechler almost 9 years ago

  • Category set to Rules / NAT
  • Status changed from New to Confirmed

confirmed, it adds IPv6 subnets to filterdns.conf rather than directly into the table. IPv4 subnets are handled correctly.

Actions
Copy link
 #2

Updated by Luiz Souza almost 9 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

Fixed the filterdns v6 netmask parsing. (filterdns-1.0_8)

Actions
Copy link
 #3

Updated by Chris Buechler almost 9 years ago

  • Status changed from Feedback to Confirmed

Still doesn't work. To match the behavior of IPv4, it'd just omit the v6 subnets from filterdns.conf and add them in filter.inc.

Actions
Copy link
 #4

Updated by Luiz Souza almost 9 years ago

Chris, it seems to work for me:

cat /var/etc/filterdns.cong
pf www.google.com net_host_v6
pf 2001:1291:2001:1::/64 net_host_v6
pf 2001:1291::/32 net_host_v6

creates the following table:

pfctl -t net_host_v6 -Ts
74.125.141.99
74.125.141.103
74.125.141.104
74.125.141.105
74.125.141.106
74.125.141.147
2001:1291:2001:1::/64
2001:1291::/32
2607:f8f0:400c:c06::67

Can you re-check this one, please ?

Actions
Copy link
 #5

Updated by Chris Buechler almost 9 years ago

  • Status changed from Confirmed to Resolved

this does work now. The last test I was getting same as in original report, is correct now on a variety of cases that were an issue previously.

Actions
Copy link

Also available in: Atom PDF