Bug 145727 - [pf.conf] pf rules not applied on boot if using inet6 :network modifier
Summary: [pf.conf] pf rules not applied on boot if using inet6 :network modifier
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: conf (show other bugs)
Version: 7.2-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-rc mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-15 17:30 UTC by james
Modified: 2018-05-28 19:49 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description james 2010-04-15 17:30:04 UTC
	After reboot, no pf rules are applied if the :network interface
	modifier is used in any inet6 rules.  The net result is no firewall!
	The following is logged to syslog:
	
	Apr 10 17:23:11 a kernel: /etc/pf.conf:52: 
	Apr 10 17:23:11 a kernel: rule expands to no valid combination
	Apr 10 17:23:11 a kernel: 
	Apr 10 17:23:11 a kernel: /etc/pf.conf:70: 
	Apr 10 17:23:11 a kernel: rule expands to no valid combination
	Apr 10 17:23:11 a kernel: 
	Apr 10 17:23:11 a kernel: /etc/pf.conf:71: 
	Apr 10 17:23:11 a kernel: rule expands to no valid combination
	Apr 10 17:23:11 a kernel: 
	Apr 10 17:23:11 a kernel: /etc/pf.conf:72: 
	Apr 10 17:23:11 a kernel: rule expands to no valid combination
	Apr 10 17:23:11 a kernel: 
	Apr 10 17:23:11 a kernel: pfctl: 
	Apr 10 17:23:11 a kernel: Syntax error in config file: pf rules not loaded

	pf rules are applied before the IPv6 network config is applied, so pf
	is unable to expand the :network modifier in the inet6 rule statements.

	The relevant lines from pf.conf are:

	52: pass in log on fxp0 inet6 proto tcp from fxp0:network to fxp0 port ssh
	70: pass in on fxp0 inet6 proto icmp6 from fxp0:network to fxp0 icmp6-type $ipv6_nbr_icmp
	71: pass in on fxp0 inet6 proto icmp6 from fxp0:network to ff02::/8 icmp6-type $ipv6_nbr_icmp
	72: pass in on fxp0 inet6 proto icmp6 from fe80::/10 to fxp0:network icmp6-type $ipv6_nbr_icmp

Fix: 

Re-order rc start-up to apply the IPv6 network config. before pf
	rules are applied. That's in theory, obviously. I don't have enough
	knowledge of boot ordering to say with any confidence that there
	won't be some nasty side-effects of such a change.
How-To-Repeat: 
	Add inet6 rule statements which include the :network modifier to
	pf.conf. Ensure there are no active IPv6 addresses on the relevant
	network interfaces. Run `/etc/rc.d/pf start' (with pf_enable=YES in
	rc.conf).
Comment 1 Eitan Adler freebsd_committer freebsd_triage 2018-05-28 19:49:52 UTC
batch change:

For bugs that match the following
-  Status Is In progress 
AND
- Untouched since 2018-01-01.
AND
- Affects Base System OR Documentation

DO:

Reset to open status.


Note:
I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed.