The branch main has been updated by kp:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=97a74f46162139e360d58c924586b615828b471b

commit 97a74f46162139e360d58c924586b615828b471b
Author:     Kristof Provost <k...@freebsd.org>
AuthorDate: 2025-04-04 16:11:27 +0000
Commit:     Kristof Provost <k...@freebsd.org>
CommitDate: 2025-04-09 08:18:20 +0000

    pfctl: fix no nat / no rdr rules
    
    In aeddee83341 the nat rule parsing was significantly reworked, 
unintentionally
    breaking no nat / no rdr rules. The option to not have a -> ... redirspec 
was
    omitted.
    
    Add trivial test cases to catch such issues in the future.
    
    Reported by:    Thomas Pasqualini <thomas.pasqual...@orange.com>
    Sponsored by:   Orange Business Services
    Differential Revision:  https://reviews.freebsd.org/D49665
---
 sbin/pfctl/parse.y                   | 3 ++-
 sbin/pfctl/tests/files/pf1065.in     | 1 +
 sbin/pfctl/tests/files/pf1065.ok     | 1 +
 sbin/pfctl/tests/files/pf1066.in     | 1 +
 sbin/pfctl/tests/files/pf1066.ok     | 1 +
 sbin/pfctl/tests/pfctl_test_list.inc | 2 ++
 6 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index 1362ae43428c..8c01da9e6220 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -4559,7 +4559,8 @@ port_redirspec    : no_port_redirspec;
                }
 
 /* Redirection with an arrow and an optional port: FreeBSD NAT rules */
-nat_redirspec  : ARROW port_redirspec {
+nat_redirspec  : /* empty */           { $$ = NULL; }
+               | ARROW port_redirspec {
                        $$ = $2;
                }
                ;
diff --git a/sbin/pfctl/tests/files/pf1065.in b/sbin/pfctl/tests/files/pf1065.in
new file mode 100644
index 000000000000..690045befee6
--- /dev/null
+++ b/sbin/pfctl/tests/files/pf1065.in
@@ -0,0 +1 @@
+no nat on vtnet0 proto tcp from 2001:db8::1 to 2001:db8::2
diff --git a/sbin/pfctl/tests/files/pf1065.ok b/sbin/pfctl/tests/files/pf1065.ok
new file mode 100644
index 000000000000..651a2fa0ae09
--- /dev/null
+++ b/sbin/pfctl/tests/files/pf1065.ok
@@ -0,0 +1 @@
+no nat on vtnet0 inet6 proto tcp from 2001:db8::1 to 2001:db8::2
diff --git a/sbin/pfctl/tests/files/pf1066.in b/sbin/pfctl/tests/files/pf1066.in
new file mode 100644
index 000000000000..e81461c470ab
--- /dev/null
+++ b/sbin/pfctl/tests/files/pf1066.in
@@ -0,0 +1 @@
+no rdr on vtnet0 proto tcp from 2001:db8::1 to 2001:db8::2
diff --git a/sbin/pfctl/tests/files/pf1066.ok b/sbin/pfctl/tests/files/pf1066.ok
new file mode 100644
index 000000000000..5ff596fa0158
--- /dev/null
+++ b/sbin/pfctl/tests/files/pf1066.ok
@@ -0,0 +1 @@
+no rdr on vtnet0 inet6 proto tcp from 2001:db8::1 to 2001:db8::2
diff --git a/sbin/pfctl/tests/pfctl_test_list.inc 
b/sbin/pfctl/tests/pfctl_test_list.inc
index c6329b978a21..6a8d76390bd6 100644
--- a/sbin/pfctl/tests/pfctl_test_list.inc
+++ b/sbin/pfctl/tests/pfctl_test_list.inc
@@ -173,3 +173,5 @@ PFCTL_TEST_IFACE(1061, "Interface translation: IPv6 rule, 
interface without brac
 PFCTL_TEST_IFACE(1062, "Interface translation: IPv6 rule, interface without 
brackets is translated, extra host, round-robin is applied")
 PFCTL_TEST_IFACE(1063, "Interface translation: IPv6 rule, interface with 
brackets is not translated, round-robin is applied")
 PFCTL_TEST_IFACE(1064, "Interface translation: IPv6 rule, interface with 
brackets is not translated, extra host, round robin is applied")
+PFCTL_TEST(1065, "no nat")
+PFCTL_TEST(1066, "no rdr")

Reply via email to