git: 71ac7ff5d6f9 - stable/14 - pf: attempt to handle overlapping group and interface names

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=71ac7ff5d6f97d0f49b72922bcaca191ff7677d2

commit 71ac7ff5d6f97d0f49b72922bcaca191ff7677d2
Author:     Kristof Provost <[email protected]>
AuthorDate: 2026-08-03 14:05:28 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2026-08-11 08:34:13 +0000

    pf: attempt to handle overlapping group and interface names
    
    pf assumes that network groups and network interfaces share a namespace
    (that is, a name is unused, a group or an interface, never both a the
    same time). Unfortunately this assumption was broken when interface
    renaming was introduced.
    Attempt to cope with this rather than panicking. Note that this is a
    band-aid, not a full solution. The correct fix is for the network stack
    to go back to enforcing a single namespace for groups and interfaces.
    
    PR:             297220
    Reported by:    Robert Morris
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)
---
 sys/netpfil/pf/pf_if.c        | 19 +++++++++++++------
 tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/sys/netpfil/pf/pf_if.c b/sys/netpfil/pf/pf_if.c
index 3c5bcc95f7cf..a5f26b5624bd 100644
--- a/sys/netpfil/pf/pf_if.c
+++ b/sys/netpfil/pf/pf_if.c
@@ -608,12 +608,19 @@ pfi_kkif_update(struct pfi_kkif *kif)
 	}
 
 	/* again for all groups kif is member of */
-	if (kif->pfik_ifp != NULL) {
-		CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
-			if (ifgl->ifgl_group->ifg_pf_kif) {
-				pfi_kkif_update((struct pfi_kkif *)
-				    ifgl->ifgl_group->ifg_pf_kif);
-			}
+	if (kif->pfik_ifp == NULL)
+		return;
+
+	CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) {
+		if (strcmp(ifgl->ifgl_group->ifg_group, kif->pfik_name) == 0) {
+			printf("pf: WARNING conflicting group / interface name %s\n",
+			    kif->pfik_name);
+			continue;
+		}
+		if (ifgl->ifgl_group->ifg_pf_kif) {
+			pfi_kkif_update((struct pfi_kkif *)
+			    ifgl->ifgl_group->ifg_pf_kif);
+		}
 	}
 }
 
diff --git a/tests/sys/netpfil/pf/names.sh b/tests/sys/netpfil/pf/names.sh
index c6f2a06c15f9..eb5c9a2a6ac5 100644
--- a/tests/sys/netpfil/pf/names.sh
+++ b/tests/sys/netpfil/pf/names.sh
@@ -134,9 +134,32 @@ start_number_cleanup()
 	pft_cleanup
 }
 
+atf_test_case "overlap" "cleanup"
+overlap_head()
+{
+	atf_set descr 'Create a group and an interface with the same name'
+	atf_set require.user root
+}
+
+overlap_body()
+{
+	pft_init
+
+	epair=$(vnet_mkepair)
+	# Overlap with the implicit 'epair' group.
+	# See PR 297220, this can panic.
+	ifconfig ${epair}a name epair
+}
+
+overlap_cleanup()
+{
+	pft_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "names"
 	atf_add_test_case "group"
 	atf_add_test_case "start_number"
+	atf_add_test_case "overlap"
 }