git: e0dcc51ddb43 - main - pfctl: do not allow af-to tables without round-robin

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=e0dcc51ddb43201e58f15645f000e27f061df081

commit e0dcc51ddb43201e58f15645f000e27f061df081
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-12-10 11:00:06 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-12-17 10:07:17 +0000

    pfctl: do not allow af-to tables without round-robin
    
    Tables can only be used as a redirspec (i.e. in pf_map_addr()) in round-robin mode.
    Enforce this for af-to tables as well.
    
    Add a test case to verify.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sbin/pfctl/parse.y            | 14 +++++++++++---
 tests/sys/netpfil/pf/nat64.sh | 23 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index fc24cbc238ba..fc9cf86081f6 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -2827,11 +2827,19 @@ pfrule		: action dir logquick interface route af proto fromto
 					r.free_flags |= PFRULE_DN_IS_QUEUE;
 			}
 
-			if ($9.marker & FOM_AFTO)
+			if ($9.marker & FOM_AFTO) {
 				r.naf = $9.nat.af;
 
-			r.nat.opts = $9.nat.pool_opts.type;
-			r.nat.opts |= $9.nat.pool_opts.opts;
+				r.nat.opts = $9.nat.pool_opts.type;
+				r.nat.opts |= $9.nat.pool_opts.opts;
+
+				if ((r.nat.opts & PF_POOL_TYPEMASK) !=
+				    PF_POOL_ROUNDROBIN &&
+				    disallow_table($9.nat.rdr->host, "tables are only "
+				    "supported in round-robin pools"))
+					YYERROR;
+			}
+
 			expand_rule(&r, $4, $5.host, $9.nat.rdr ? $9.nat.rdr->host : NULL,
 			    $7, $8.src_os, $8.src.host, $8.src.port, $8.dst.host,
 			    $8.dst.port, $9.uid, $9.gid, $9.rcv, $9.icmpspec, "");
diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh
index 827891373903..b0559ac1f98c 100644
--- a/tests/sys/netpfil/pf/nat64.sh
+++ b/tests/sys/netpfil/pf/nat64.sh
@@ -341,6 +341,28 @@ pool_cleanup()
 	pft_cleanup
 }
 
+
+atf_test_case "table"
+table_head()
+{
+	atf_set descr 'Tables require round-robin'
+	atf_set require.user root
+}
+
+table_body()
+{
+	pft_init
+
+	echo "pass in on epair inet6 from any to 64:ff9b::/96 af-to inet from <wanaddr>" | \
+	    atf_check -s exit:1 \
+	    -e match:"tables are only supported in round-robin pools" \
+	    pfctl -f -
+}
+
+table_cleanup()
+{
+	pft_cleanup
+}
 atf_test_case "table_round_robin" "cleanup"
 table_round_robin_head()
 {
@@ -417,5 +439,6 @@ atf_init_test_cases()
 	atf_add_test_case "tos"
 	atf_add_test_case "no_v4"
 	atf_add_test_case "pool"
+	atf_add_test_case "table"
 	atf_add_test_case "table_round_robin"
 }