Commit Graph

199 Commits

Author SHA1 Message Date
Kristof Provost
88e858e57c pf: drop support for fragment crop|drop-ovl
We removed the code for these modes back in 2015, but converted such
configurations to 'scrub fragment reassemble'. It's been long enough,
drop the backwards compatibility glue too.

Reviewed by:	mjg
MFC after:	never
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D37460
2022-11-28 20:19:12 +01:00
Kristof Provost
57e047e51c pf: allow scrub rules without fragment reassemble
scrub rules have defaulted to handling fragments for a long time, but
since we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611
this has become less obvious and more expensive ("reassemble" being the
more expensive option, even if it's the one the vast majority of users
should be using).

Extend the 'scrub' syntax to allow fragment reassembly to be disabled,
while retaining the other scrub behaviour (e.g. TTL changes, random-id,
..) using 'scrub fragment no reassemble'.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D37459
2022-11-28 20:19:05 +01:00
Kristof Provost
8a8af94240 pf: bridge-to
Allow pf (l2) to be used to redirect ethernet packets to a different
interface.

The intended use case is to send 802.1x challenges out to a side
interface, to enable AT&T links to function with pfSense as a gateway,
rather than the AT&T provided hardware.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D37193
2022-11-02 15:45:23 +01:00
Kristof Provost
444a77ca85 pf: expose syncookie active/inactive status
When syncookies are in adaptive mode they may be active or inactive.
Expose this status to users.

Suggested by:	Guido van Rooij
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-10-31 18:14:09 +01:00
Kristof Provost
1d090028d3 pf: use time_to for timestamps
Use time_t rather than uint32_t to represent the timestamps. That means
we have 64 bits rather than 32 on all platforms except i386, avoiding
the Y2K38 issues on most platforms.

Reviewed by:	Zhenlei Huang
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D36837
2022-10-05 17:52:27 +02:00
John Baldwin
d74024a490 pfctl: Fix mismatch in array bounds for pfr_next_token().
Reviewed by:	kp, emaste
Differential Revision:	https://reviews.freebsd.org/D36806
2022-10-03 16:10:41 -07:00
Kristof Provost
cfa1a13087 pfctl: fix recrusive printing of ethernet anchors
Similar to the preceding fix for layer three rules, ensure that we
recursively list wildcard anchors for ethernet rules.

MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D36417
2022-09-06 13:19:10 +02:00
Kristof Provost
585a5ed0be pfctl: fix recrusive printing of anchors
Fix a couple of problems with printing of anchors, in particular recursive
printing, both of inline anchors and when requested explicitly with a '*'
in the anchor.
- Correct recursive printing of wildcard anchors (recurse into child anchors
rather than rules, which don't exist)
- Print multi-part anchor paths correctly (pr6065)
- Fix comments and prevent users from specifying multi-component names for
inline anchors.

tested by phessler
ok henning

Also fix the relevant pfctl test case to reflect the new (and now
correct) behaviour).

MFC after:	3 weeks
Obtained from:	OpenBSD (mcbride, f9a568a27c740528301ca3419316c85a9fc7f1de)
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D36416
2022-09-06 10:42:10 +02:00
Kristof Provost
ed5eb77e18 pfctl: fix printing anchors
Ensure that we pass the (base) anchorname to the kernel, not the '/*'
suffix.

MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D36415
2022-09-06 10:42:09 +02:00
Franco Fichtner
28b64169ea pf: stop resolving hosts as dns that use ":" modifier
When the interface does not exist avoid passing host with special pf
modifiers to DNS resolution as they come up empty anyway.

Reviewed by:	kp
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D35429
2022-08-08 18:31:52 +02:00
Kristof Provost
63167eb48c pfctl tests: test case for the POM_STICKYADDRESS fix
In 1e73fbd8b we fixed an issue with POM_STICKYADDRESS being checked in
the wrong struct.
Add a basic test case for this fix.

MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-08-08 09:30:42 +02:00
Franco Fichtner
1e73fbd8b2 pfctl: fix FOM_ICMP/POM_STICKYADDRESS clash
pass inet proto icmp icmp-type {unreach}
	pass route-to (if0 127.0.0.1/8) sticky-address inet

The wrong struct was being tested. The parser tries to prevent
"sticky-address sticky-address" syntax but was actually cross-rule
enforcing that ICMP filter cannot be before the use of "sticky-address"
in next rule.

MFC after:	2 weeks
Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D36050
2022-08-06 14:22:42 +02:00
Gordon Bergling
c9856c4ffb pfctl(8): Fix a typo in a source code comment
- s/bufer/buffer/

MFC after:	3 days
2022-07-16 13:48:30 +02:00
Kristof Provost
1f61367f8d pf: support matching on tags for Ethernet rules
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D35362
2022-06-20 10:16:20 +02:00
Jessica Clarke
2986638550 pfctl: fix out-of-bounds access
If pfctl is called with "pfctl -a ''" we read outside of the anchoropt
buffer. Check that the buffer is sufficiently long to avoid that.

Maintain the existing (and desired, because it's used as such in
/etc/periodic/security/520.pfdenied) behaviour of treating "-a ''" as a
request for the root anchor (or no anchor specified).

PR:		264128
Reviewed by:	kp
2022-05-22 10:31:42 +02:00
Reid Linnemann
0abcc1d2d3 pf: Add per-rule timestamps for rule and eth_rule
Similar to ipfw rule timestamps, these timestamps internally are
uint32_t snaps of the system time in seconds. The timestamp is CPU local
and updated each time a rule or a state associated with a rule or state
is matched.

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34970
2022-04-22 19:53:20 +02:00
Kristof Provost
c90f8cb899 pfctl tests: fix Ethernet output expectations
Since a16732d670 we always print the l3 src/destination for Ethernet
rules. Update the tests to account for this.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-04-21 10:26:00 +02:00
Kristof Provost
a16732d670 pfctl: always print 'l3' source/destination
While the kernel only performs the L3 check for
ETHERTYPE_IP/ETHERTYPE_IP6 we should always print the source and
destination addresses.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34918
2022-04-20 13:01:12 +02:00
Kristof Provost
812839e5aa pf: allow the use of tables in ethernet rules
Allow tables to be used for the l3 source/destination matching.
This requires taking the PF_RULES read lock.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34917
2022-04-20 13:01:12 +02:00
Matteo Riondato
d86cf44350 pfctl: fix recursive printing of rules
When asked to print rules recursively, correctly recurse for anchors
included in pf.conf with "anchorname/*".

PR:		262590
Reviewed by:	kp
MFC after:	3 weeks
2022-04-14 17:25:41 +02:00
Reid Linnemann
4823489ab6 libpfctl: relocate implementations of pfr_add/get/set_addrs
Reviewed by:	kp
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D34740
2022-04-04 19:14:23 +02:00
Mateusz Guzik
c4a08ef2af pf: handle duplicate rules gracefully
Reviewed by:	kp
Reported by:	dch
PR:		262971
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-04-01 18:01:48 +00:00
Kristof Provost
d27c9f5bc3 pf: fixup match rules
Ensure that we can set and print match rules in ethernet rules.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-30 10:28:19 +02:00
Kristof Provost
9bb06778f8 pf: support listing ethernet anchors
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-30 10:28:19 +02:00
Gordon Bergling
2fa6223aaa pfctl(8): Fix a typo in a comment
- s/steping/stepping/

MFC after:	3 days
2022-03-28 19:35:55 +02:00
Kristof Provost
3468cd95ca pf: ether l3 rules can only use addresses
Disallow the use of tables in ethernet rules. Using tables requires
taking the PF_RULES lock. Moreover, the current table code isn't ready
to deal with ethernet rules.

Disallow their use for now.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-25 11:13:47 +01:00
Kristof Provost
a632d9e360 pfctl: fix retrieving nested nat-anchors
When retrieving nat rules in anchors we need to set the path just like
we do for regular rules.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-17 22:37:06 +01:00
Matteo Riondato
cd8438e5a3 pfctl: fix retrieving nested anchors
PR:		262622
MFC after:	1 week
Reviewed by:	kp
2022-03-17 22:37:05 +01:00
Kristof Provost
8a42005d1e pf: support basic L3 filtering in the Ethernet rules
Allow filtering based on the source or destination IP/IPv6 address in
the Ethernet layer rules.

Reviewed by:	pauamma_gundo.com (man), debdrup (man)
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34482
2022-03-14 22:42:37 +01:00
Kristof Provost
c4e49c3a65 pfctl: remove unused variable
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-08 13:57:46 +01:00
Kristof Provost
8c1400b0a1 libpfct: factor out pfctl_get_rules_info()
Introduce pfctl_get_rules_info(), similar to pfctl_get_eth_rules_info()
to retrieve rules information (ticket and total number of rules).

Use the new function in pfctl.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34443
2022-03-08 13:57:45 +01:00
Kristof Provost
f0c334e4de libpfctl: support flushing rules/nat/eth
Move the code to flush regular rules, nat rules and Ethernet rules into
libpfctl for easier re-use.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34442
2022-03-08 13:57:45 +01:00
Kristof Provost
a20773c810 pfctl: support recursive printing of nat rules
PR:		252617
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D34455
2022-03-08 10:51:09 +01:00
Kristof Provost
5bed7d2fa1 pfctl.8: Use the serial comma
Pointed out by:	Pau Amma.
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-03 18:32:27 +01:00
Kristof Provost
e5349a2909 pfctl tests: Ethernet rule parsing tests
A few basic test cases for Ethernet rule parsing.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
c32cd18055 pfctl: print ethernet rules when called with '-n'
Just as pfctl already does for other rules we print the ethernet rules
we would have loaded if '-n' is specified.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
b590f17a11 pf: support masking mac addresses
When filtering Ethernet packets allow rules to specify a mac address
with a mask. This indicates which bits of the specified address are
significant. This allows users to do things like filter based on device
manufacturer.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
6ea1c3cfc8 pfctl: support flushing ethernet rules
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:07 +01:00
Kristof Provost
c5131afee3 pf: add anchor support for ether rules
Support anchors in ether rules.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32482
2022-03-02 17:00:07 +01:00
Kristof Provost
87a89d6e14 pfctl: support lists of mac addresses
Teach the 'ether' rules to accept { mac1, mac2, ... } lists, similar to
the lists of interfaces or IP addresses we already supported for layer 3
filtering.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32481
2022-03-02 17:00:07 +01:00
Kristof Provost
fb330f3931 pf: support dummynet on L2 rules
Allow packets to be tagged with dummynet information. Note that we do
not apply dummynet shaping on the L2 traffic, but instead mark it for
dummynet processing in the L3 code. This is the same approach as we take
for ALTQ.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32222
2022-03-02 17:00:06 +01:00
Kristof Provost
77207b6022 pfctl: Document displaying Ethernet rules
Document the new 'pfctl -s ether' functionality.

Reviewed by:	bcr
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31750
2022-03-02 17:00:06 +01:00
Kristof Provost
c696d5c72f pfctl: Don't print (ether) to / from if they're not set
If we're not filtering on a specific MAC address don't print it at all,
rather than showing an all-zero address.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31749
2022-03-02 17:00:05 +01:00
Kristof Provost
30087aa2e0 pf: Support clearing ether counters
Allow the evaluations/packets/bytes counters on Ethernet rules to be
cleared.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31748
2022-03-02 17:00:05 +01:00
Kristof Provost
2b29ceb86f pfctl: Print Ethernet rules
Extent pfctl to be able to read configured Ethernet filtering rules from
the kernel and print them.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31738
2022-03-02 17:00:03 +01:00
Kristof Provost
735748f30a libpfctl: fix creatorid endianness
We provide the hostid (which is the state creatorid) to the kernel as a
big endian number (see pfctl/pfctl.c pfctl_set_hostid()), so convert it
back to system endianness when we get it from the kernel.

This avoids a confusing mismatch between the value the user configures
and the value displayed in the state.

MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D33989
2022-01-27 09:07:27 +01:00
Kristof Provost
e68de66943 pfctl: improve error reporting for routehost
If an invalid (i.e. overly long) interface name is specified error out
immediately, rather than in expand_rule() so we point at the incorrect
line.

PR:		260958
MFC after:	3 weeks
Differential Revision:	https://reviews.freebsd.org/D34008
2022-01-27 07:36:26 +01:00
Stefan Eßer
5e04571cf3 sys/bitset.h: reduce visibility of BIT_* macros
Add two underscore characters "__" to names of BIT_* and BITSET_*
macros to move them to the implementation name space and to prevent
a name space pollution due to BIT_* macros in 3rd party programs with
conflicting parameter signatures.

These prefixed macro names are used in kernel header files to define
macros in e.g. sched.h, sys/cpuset.h and sys/domainset.h.

If C programs are built with either -D_KERNEL (automatically passed
when building a kernel or kernel modules) or -D_WANT_FREENBSD_BITSET
(or this macros is defined in the source code before including the
bitset macros), then all macros are made visible with their previous
names, too. E.g., both __BIT_SET() and BIT_SET() are visible with
either of _KERNEL or _WANT_FREEBSD_BITSET defined.

The main reason for this change is that some 3rd party sources
including sched.h have been found to contain conflicting BIT_*
macros.

As a work-around, parts of shed.h have been made conditional and
depend on _WITH_CPU_SET_T being set when sched.h is included.
Ports that expect the full functionality provided by sched.h need
to be built with -D_WITH_CPU_SET_T. But this leads to conflicts if
BIT_* macros are defined in that program, too.

This patch set makes all of sched.h visible again without this
parameter being passed and without any name space pollution due
to BIT_* macros becoming visible when sched.h is included.

This patch set will be backported to the STABLE branches, but ports
will need to use -D_WITH_CPU_SET_T as long as there are supported
releases that do not contain these patches.

Reviewed by:	kib, markj
MFC after:	1 month
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D33235
2021-12-05 23:00:25 +01:00
Kristof Provost
76c5eecc34 pf: Introduce ridentifier
Allow users to set a number on rules which will be exposed as part of
the pflog header.
The intent behind this is to allow users to correlate rules across
updates (remember that pf rules continue to exist and match existing
states, even if they're removed from the active ruleset) and pflog.

Obtained from:	pfSense
MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32750
2021-11-05 09:39:56 +01:00
Kristof Provost
09c7f23869 pfctl: delay label macro expansion until after rule optimisation
We used to expand the $nr macro in labels into the rule number prior to
the optimisation step. This would occasionally produce incorrect rule
numbers in the labels.

Delay all macro expansion until after the optimisation step to ensure
that we expand the correct values.

MFC after:	1 week
Reported by:	Özkan KIRIK <ozkan.kirik@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D32488
2021-10-15 22:19:45 +02:00