Bug #13068
Updated by Marcos M over 1 year ago
If the firewall is unable to fetch the contents of a @URL Table (IPs)@ alias that did not previously exist, PF will fail to load the ruleset. This behavior differs from other alias types, and can make restoring configuration backups troublesome. Steps to reproduce: # Disconnect pfSense from the internet. # Restore a config with an URL Table IP (IPs) which does not exist on the firewall. # Error appears after the restore reboot. Test config with a rule that references a non-existent IP alias, along with an existent URL alias (e.g. when restoring a config which includes aliases managed by pfBlockerNG): alias: <pre> <filter> <rule> <id></id> <tracker>1673392343</tracker> <type>pass</type> <interface>wan</interface> <ipprotocol>inet</ipprotocol> <tag></tag> <tagged></tagged> <max></max> <max-src-nodes></max-src-nodes> <max-src-conn></max-src-conn> <max-src-states></max-src-states> <statetimeout></statetimeout> <statetype><![CDATA[keep state]]></statetype> <os></os> <source> <address>testipalias</address> </source> <destination> <any></any> </destination> <descr><![CDATA[testiprule]]></descr> <created> <time>1673392343</time> <username><![CDATA[admin@10.0.5.50 (Local Database)]]></username> </created> <updated> <time>1673395091</time> <username><![CDATA[admin@10.0.5.50 (Local Database)]]></username> </updated> </rule> <rule> <id></id> <tracker>1673395080</tracker> <type>pass</type> <interface>wan</interface> <ipprotocol>inet</ipprotocol> <tag></tag> <tagged></tagged> <max></max> <max-src-nodes></max-src-nodes> <max-src-conn></max-src-conn> <max-src-states></max-src-states> <statetimeout></statetimeout> <statetype><![CDATA[keep state]]></statetype> <os></os> <source> <address>testurlalias</address> </source> <destination> <any></any> </destination> <descr><![CDATA[testurlrule]]></descr> <updated> <time>1673395080</time> <username><![CDATA[admin@10.0.5.50 (Local Database)]]></username> </updated> <created> <time>1673395080</time> <username><![CDATA[admin@10.0.5.50 (Local Database)]]></username> </created> </rule> </filter> [...] <aliases> <alias> <name>testurlalias</name> <type>urltable</type> <url>https://files.netgate.com/lists/fullbogons-ipv4.txt</url> <updatefreq>128</updatefreq> <address>https://files.netgate.com/lists/fullbogons-ipv4.txt</address> <descr></descr> <detail><![CDATA[Entry added Tue, 10 Jan 2023 23:09:35 +0000]]></detail> </alias> </aliases> </pre> Restoring this produces the following alerts: <pre> General Unresolvable source alias 'testipalias' for rule 'testiprule' @ 2023-01-10 23:59:42 Unresolvable source alias 'testipalias' for rule 'testiprule' @ 2023-01-11 00:00:14 Filter Reload There were error(s) loading the rules: /tmp/rules.debug:106: macro 'testurlalias' not defined - The line in question reads [106]: pass in quick on $WAN reply-to ( vmx0 10.0.5.1 ) inet from $testurlalias to any ridentifier 1673395080 keep state label "USER_RULE: testurlrule" label "id:1673395080" @ 2023-01-10 23:59:43 There were error(s) loading the rules: /tmp/rules.debug:106: macro 'testurlalias' not defined - The line in question reads [106]: pass in quick on $WAN reply-to ( vmx0 10.0.5.1 ) inet from $testurlalias to any ridentifier 1673395080 keep state label "USER_RULE: testurlrule" label "id:1673395080" @ 2023-01-11 00:00:15 </pre> The @testipalias@ rule in this example does not prevent pf from loading the ruleset which contains the following: <pre> set hostid 0x98e1e24e set limit table-entries 400000 set optimization normal set limit states 95000 set limit src-nodes 95000 #System aliases loopback = "{ lo0 }" WAN = "{ vmx0 }" #SSH Lockout Table table <sshguard> persist #Snort tables table <snort2c> table <virusprot> table <bogons> persist file "/etc/bogons" # User Aliases # Gateways GWWAN_DHCP = " route-to ( vmx0 10.0.5.1 ) " set loginterface vmx0 set skip on pfsync0 set keepcounters scrub on $WAN inet all fragment reassemble scrub on $WAN inet6 all fragment reassemble no nat proto carp no rdr proto carp nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules (automatic) # Subnets to NAT tonatsubnets = "{ 127.0.0.0/8 ::1/128 }" nat on $WAN inet from $tonatsubnets to any port 500 -> 10.0.5.219/32 static-port nat on $WAN inet6 from $tonatsubnets to any port 500 -> (vmx0) static-port nat on $WAN inet from $tonatsubnets to any -> 10.0.5.219/32 port 1024:65535 nat on $WAN inet6 from $tonatsubnets to any -> (vmx0) port 1024:65535 # TFTP proxy rdr-anchor "tftp-proxy/*" # NAT Inbound Redirects anchor "openvpn/*" anchor "ipsec/*" # Allow IPv6 on loopback pass in quick on $loopback inet6 all ridentifier 1000000001 label "pass IPv6 loopback" pass out quick on $loopback inet6 all ridentifier 1000000002 label "pass IPv6 loopback" # Block all IPv6 block in log quick inet6 all ridentifier 1000000003 label "Block all IPv6" block out log quick inet6 all ridentifier 1000000004 label "Block all IPv6" # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in log quick from 169.254.0.0/16 to any ridentifier 1000000101 label "Block IPv4 link-local" block in log quick from any to 169.254.0.0/16 ridentifier 1000000102 label "Block IPv4 link-local" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in log inet all ridentifier 1000000103 label "Default deny rule IPv4" block out log inet all ridentifier 1000000104 label "Default deny rule IPv4" block in log inet6 all ridentifier 1000000105 label "Default deny rule IPv6" block out log inet6 all ridentifier 1000000106 label "Default deny rule IPv6" # We use the mighty pf, we cannot be fooled. block log quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000107 label "Block traffic from port 0" block log quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000108 label "Block traffic to port 0" # Snort package block log quick from <snort2c> to any ridentifier 1000000109 label "Block snort2c hosts" block log quick from any to <snort2c> ridentifier 1000000110 label "Block snort2c hosts" # SSH lockout block in log quick proto tcp from <sshguard> to (self) port 22 ridentifier 1000000301 label "sshguard" # webConfigurator lockout block in log quick proto tcp from <sshguard> to (self) port 443 ridentifier 1000000351 label "GUI Lockout" block in log quick from <virusprot> to any ridentifier 1000000400 label "virusprot overload table" # allow our DHCP client out to the WAN pass in quick on $WAN proto udp from any port = 67 to any port = 68 ridentifier 1000000461 label "allow dhcp replies in WAN" pass out quick on $WAN proto udp from any port = 68 to any port = 67 ridentifier 1000000462 label "allow dhcp client out WAN" # Not installing DHCP server firewall rules for WAN which is configured for DHCP. antispoof log for $WAN ridentifier 1000001470 # loopback pass in on $loopback inet all ridentifier 1000001511 label "pass IPv4 loopback" pass out on $loopback inet all ridentifier 1000001512 label "pass IPv4 loopback" # let out anything from the firewall host itself and decrypted IPsec traffic pass out inet all keep state allow-opts ridentifier 1000001513 label "let out anything IPv4 from firewall host itself" pass out route-to ( vmx0 10.0.5.1 ) from 10.0.5.219 to !10.0.5.0/24 ridentifier 1000001611 keep state allow-opts label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webConfigurator or SSH pass in quick on vmx0 proto tcp from any to (vmx0) port { 443 80 22 } ridentifier 10002 keep state label "anti-lockout rule" # User-defined rules follow anchor "userrules/*" # Unresolvable source alias 'testipalias' for rule 'testiprule' label "USER_RULE: testiprule" pass in quick on $WAN reply-to ( vmx0 10.0.5.1 ) inet from $testurlalias to any ridentifier 1673395080 keep state label "USER_RULE: testurlrule" label "id:1673395080" pass in quick on $WAN reply-to ( vmx0 10.0.5.1 ) inet from any to any ridentifier 1672689732 keep state label "USER_RULE: allow all" label "id:1672689732" # array key "lan" does not exist for "Default allow LAN to any rule" in array: {WAN } label "USER_RULE: Default allow LAN to any rule" # array key "lan" does not exist for "Default allow LAN IPv6 to any rule" in array: {WAN } label "USER_RULE: Default allow LAN IPv6 to any rule" # VPN Rules anchor "tftp-proxy/*" </pre>