pf: Improve pf_rule input validation

[kp]

Summary

Move the validation checks to pf_rule_to_krule() to reduce duplication.
This also makes the checks consistent across different ioctls.

MFC after: 1 week

[donner]

sys/netpfil/pf/pf_ioctl.c

1564–1574

I'd reverse this logic.

#ifdef INET
     if (rule->af == AF_INET)     ;
     else
#endif
#ifdef INET6
     if (rule->af == AF_INET6)    ;
     else
#endif
      return (EAFNOSUPPORT);

So each family only tests it's own positive case. And all other families fail automatically.
But your approach has the charm, that it does not generate any code, if all families are supported.

[donner]

sys/netpfil/pf/pf_ioctl.c

1564–1574

Even more clever approach

switch (rule->af) {
#ifdef INET
    case AF_INET: break;
#endif
#ifdef INET6
    case AF_INET6: break;
#endif
    default: return (EAFNOSUPPORT);
}

[tuexen]

I tested the patch. It fixes: panic: pfi_dynaddr_setup: non-NULL dyn (2).

[kp]

sys/netpfil/pf/pf_ioctl.c

1564–1574

I like the suggestion, but it turns out not to work. We don't always specify an address family (i.e. rule->af can be 0)

[donner]

Okay.