From c7e67c6752ec79a4a059686ed5a08f3f0d01153c Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Thu, 30 Jun 2022 08:43:41 +0200
Subject: [PATCH] firewall: append missing link-local to inet6 :network
 selector #5528

---
 .../mvc/app/library/OPNsense/Firewall/Rule.php       | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php b/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
index 121c1137c..fd9b54a10 100644
--- a/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+++ b/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2017 Deciso B.V.
+ * Copyright (C) 2017-2022 Deciso B.V.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -246,15 +246,19 @@ abstract class Rule
                     $rule[$target] = 'any';
                 } elseif (!empty($rule[$tag]['network'])) {
                     $network_name = $rule[$tag]['network'];
-                    $matches = "";
+                    $matches = '';
                     if ($network_name == '(self)') {
-                        $rule[$target] = "(self)";
+                        $rule[$target] = $network_name;
                     } elseif (preg_match("/^(wan|lan|opt[0-9]+)ip$/", $network_name, $matches)) {
                         if (!empty($interfaces[$matches[1]]['if'])) {
-                            $rule[$target] = "({$interfaces["{$matches[1]}"]['if']})";
+                            $rule[$target] = "({$interfaces[$matches[1]]['if']})";
                         }
                     } elseif (!empty($interfaces[$network_name]['if'])) {
                         $rule[$target] = "({$interfaces[$network_name]['if']}:network)";
+                        if ($rule['ipprotocol'] == 'inet6') {
+                            /* historically pf(4) excludes link-local on :network to avoid anti-spoof overlap */
+                            $rule[$target] .= ',fe80::/10';
+                        }
                     } elseif (Util::isIpAddress($rule[$tag]['network']) || Util::isSubnet($rule[$tag]['network'])) {
                         $rule[$target] = $rule[$tag]['network'];
                     } elseif (Util::isAlias($rule[$tag]['network'])) {