Commit Graph

186 Commits

Author SHA1 Message Date
Kristof Provost
1f61367f8d pf: support matching on tags for Ethernet rules
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D35362
2022-06-20 10:16:20 +02:00
Jessica Clarke
2986638550 pfctl: fix out-of-bounds access
If pfctl is called with "pfctl -a ''" we read outside of the anchoropt
buffer. Check that the buffer is sufficiently long to avoid that.

Maintain the existing (and desired, because it's used as such in
/etc/periodic/security/520.pfdenied) behaviour of treating "-a ''" as a
request for the root anchor (or no anchor specified).

PR:		264128
Reviewed by:	kp
2022-05-22 10:31:42 +02:00
Reid Linnemann
0abcc1d2d3 pf: Add per-rule timestamps for rule and eth_rule
Similar to ipfw rule timestamps, these timestamps internally are
uint32_t snaps of the system time in seconds. The timestamp is CPU local
and updated each time a rule or a state associated with a rule or state
is matched.

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34970
2022-04-22 19:53:20 +02:00
Kristof Provost
c90f8cb899 pfctl tests: fix Ethernet output expectations
Since a16732d670 we always print the l3 src/destination for Ethernet
rules. Update the tests to account for this.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-04-21 10:26:00 +02:00
Kristof Provost
a16732d670 pfctl: always print 'l3' source/destination
While the kernel only performs the L3 check for
ETHERTYPE_IP/ETHERTYPE_IP6 we should always print the source and
destination addresses.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34918
2022-04-20 13:01:12 +02:00
Kristof Provost
812839e5aa pf: allow the use of tables in ethernet rules
Allow tables to be used for the l3 source/destination matching.
This requires taking the PF_RULES read lock.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34917
2022-04-20 13:01:12 +02:00
Matteo Riondato
d86cf44350 pfctl: fix recursive printing of rules
When asked to print rules recursively, correctly recurse for anchors
included in pf.conf with "anchorname/*".

PR:		262590
Reviewed by:	kp
MFC after:	3 weeks
2022-04-14 17:25:41 +02:00
Reid Linnemann
4823489ab6 libpfctl: relocate implementations of pfr_add/get/set_addrs
Reviewed by:	kp
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D34740
2022-04-04 19:14:23 +02:00
Mateusz Guzik
c4a08ef2af pf: handle duplicate rules gracefully
Reviewed by:	kp
Reported by:	dch
PR:		262971
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-04-01 18:01:48 +00:00
Kristof Provost
d27c9f5bc3 pf: fixup match rules
Ensure that we can set and print match rules in ethernet rules.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-30 10:28:19 +02:00
Kristof Provost
9bb06778f8 pf: support listing ethernet anchors
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-30 10:28:19 +02:00
Gordon Bergling
2fa6223aaa pfctl(8): Fix a typo in a comment
- s/steping/stepping/

MFC after:	3 days
2022-03-28 19:35:55 +02:00
Kristof Provost
3468cd95ca pf: ether l3 rules can only use addresses
Disallow the use of tables in ethernet rules. Using tables requires
taking the PF_RULES lock. Moreover, the current table code isn't ready
to deal with ethernet rules.

Disallow their use for now.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-25 11:13:47 +01:00
Kristof Provost
a632d9e360 pfctl: fix retrieving nested nat-anchors
When retrieving nat rules in anchors we need to set the path just like
we do for regular rules.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-17 22:37:06 +01:00
Matteo Riondato
cd8438e5a3 pfctl: fix retrieving nested anchors
PR:		262622
MFC after:	1 week
Reviewed by:	kp
2022-03-17 22:37:05 +01:00
Kristof Provost
8a42005d1e pf: support basic L3 filtering in the Ethernet rules
Allow filtering based on the source or destination IP/IPv6 address in
the Ethernet layer rules.

Reviewed by:	pauamma_gundo.com (man), debdrup (man)
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34482
2022-03-14 22:42:37 +01:00
Kristof Provost
c4e49c3a65 pfctl: remove unused variable
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-08 13:57:46 +01:00
Kristof Provost
8c1400b0a1 libpfct: factor out pfctl_get_rules_info()
Introduce pfctl_get_rules_info(), similar to pfctl_get_eth_rules_info()
to retrieve rules information (ticket and total number of rules).

Use the new function in pfctl.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34443
2022-03-08 13:57:45 +01:00
Kristof Provost
f0c334e4de libpfctl: support flushing rules/nat/eth
Move the code to flush regular rules, nat rules and Ethernet rules into
libpfctl for easier re-use.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D34442
2022-03-08 13:57:45 +01:00
Kristof Provost
a20773c810 pfctl: support recursive printing of nat rules
PR:		252617
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D34455
2022-03-08 10:51:09 +01:00
Kristof Provost
5bed7d2fa1 pfctl.8: Use the serial comma
Pointed out by:	Pau Amma.
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-03 18:32:27 +01:00
Kristof Provost
e5349a2909 pfctl tests: Ethernet rule parsing tests
A few basic test cases for Ethernet rule parsing.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
c32cd18055 pfctl: print ethernet rules when called with '-n'
Just as pfctl already does for other rules we print the ethernet rules
we would have loaded if '-n' is specified.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
b590f17a11 pf: support masking mac addresses
When filtering Ethernet packets allow rules to specify a mac address
with a mask. This indicates which bits of the specified address are
significant. This allows users to do things like filter based on device
manufacturer.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:08 +01:00
Kristof Provost
6ea1c3cfc8 pfctl: support flushing ethernet rules
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2022-03-02 17:00:07 +01:00
Kristof Provost
c5131afee3 pf: add anchor support for ether rules
Support anchors in ether rules.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32482
2022-03-02 17:00:07 +01:00
Kristof Provost
87a89d6e14 pfctl: support lists of mac addresses
Teach the 'ether' rules to accept { mac1, mac2, ... } lists, similar to
the lists of interfaces or IP addresses we already supported for layer 3
filtering.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32481
2022-03-02 17:00:07 +01:00
Kristof Provost
fb330f3931 pf: support dummynet on L2 rules
Allow packets to be tagged with dummynet information. Note that we do
not apply dummynet shaping on the L2 traffic, but instead mark it for
dummynet processing in the L3 code. This is the same approach as we take
for ALTQ.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32222
2022-03-02 17:00:06 +01:00
Kristof Provost
77207b6022 pfctl: Document displaying Ethernet rules
Document the new 'pfctl -s ether' functionality.

Reviewed by:	bcr
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31750
2022-03-02 17:00:06 +01:00
Kristof Provost
c696d5c72f pfctl: Don't print (ether) to / from if they're not set
If we're not filtering on a specific MAC address don't print it at all,
rather than showing an all-zero address.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31749
2022-03-02 17:00:05 +01:00
Kristof Provost
30087aa2e0 pf: Support clearing ether counters
Allow the evaluations/packets/bytes counters on Ethernet rules to be
cleared.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31748
2022-03-02 17:00:05 +01:00
Kristof Provost
2b29ceb86f pfctl: Print Ethernet rules
Extent pfctl to be able to read configured Ethernet filtering rules from
the kernel and print them.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31738
2022-03-02 17:00:03 +01:00
Kristof Provost
735748f30a libpfctl: fix creatorid endianness
We provide the hostid (which is the state creatorid) to the kernel as a
big endian number (see pfctl/pfctl.c pfctl_set_hostid()), so convert it
back to system endianness when we get it from the kernel.

This avoids a confusing mismatch between the value the user configures
and the value displayed in the state.

MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D33989
2022-01-27 09:07:27 +01:00
Kristof Provost
e68de66943 pfctl: improve error reporting for routehost
If an invalid (i.e. overly long) interface name is specified error out
immediately, rather than in expand_rule() so we point at the incorrect
line.

PR:		260958
MFC after:	3 weeks
Differential Revision:	https://reviews.freebsd.org/D34008
2022-01-27 07:36:26 +01:00
Stefan Eßer
5e04571cf3 sys/bitset.h: reduce visibility of BIT_* macros
Add two underscore characters "__" to names of BIT_* and BITSET_*
macros to move them to the implementation name space and to prevent
a name space pollution due to BIT_* macros in 3rd party programs with
conflicting parameter signatures.

These prefixed macro names are used in kernel header files to define
macros in e.g. sched.h, sys/cpuset.h and sys/domainset.h.

If C programs are built with either -D_KERNEL (automatically passed
when building a kernel or kernel modules) or -D_WANT_FREENBSD_BITSET
(or this macros is defined in the source code before including the
bitset macros), then all macros are made visible with their previous
names, too. E.g., both __BIT_SET() and BIT_SET() are visible with
either of _KERNEL or _WANT_FREEBSD_BITSET defined.

The main reason for this change is that some 3rd party sources
including sched.h have been found to contain conflicting BIT_*
macros.

As a work-around, parts of shed.h have been made conditional and
depend on _WITH_CPU_SET_T being set when sched.h is included.
Ports that expect the full functionality provided by sched.h need
to be built with -D_WITH_CPU_SET_T. But this leads to conflicts if
BIT_* macros are defined in that program, too.

This patch set makes all of sched.h visible again without this
parameter being passed and without any name space pollution due
to BIT_* macros becoming visible when sched.h is included.

This patch set will be backported to the STABLE branches, but ports
will need to use -D_WITH_CPU_SET_T as long as there are supported
releases that do not contain these patches.

Reviewed by:	kib, markj
MFC after:	1 month
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D33235
2021-12-05 23:00:25 +01:00
Kristof Provost
76c5eecc34 pf: Introduce ridentifier
Allow users to set a number on rules which will be exposed as part of
the pflog header.
The intent behind this is to allow users to correlate rules across
updates (remember that pf rules continue to exist and match existing
states, even if they're removed from the active ruleset) and pflog.

Obtained from:	pfSense
MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D32750
2021-11-05 09:39:56 +01:00
Kristof Provost
09c7f23869 pfctl: delay label macro expansion until after rule optimisation
We used to expand the $nr macro in labels into the rule number prior to
the optimisation step. This would occasionally produce incorrect rule
numbers in the labels.

Delay all macro expansion until after the optimisation step to ensure
that we expand the correct values.

MFC after:	1 week
Reported by:	Özkan KIRIK <ozkan.kirik@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D32488
2021-10-15 22:19:45 +02:00
Kristof Provost
90dedf0fef pfctl: Remove unused variable
MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-10-07 19:50:01 +02:00
Kristof Provost
5062afff9d pfctl: userspace adaptive syncookies configration
Hook up the userspace bits to configure syncookies in adaptive mode.

MFC after:	1 week
Sponsored by:	Modirum MDPay
Differential Revision:	https://reviews.freebsd.org/D32136
2021-09-29 15:11:54 +02:00
Kristof Provost
63b3c1c770 pf: support dummynet
Allow pf to use dummynet pipes and queues.

We re-use the currently unused IPFW_IS_DUMMYNET flag to allow dummynet
to tell us that a packet is being re-injected after being delayed. This
is needed to avoid endlessly looping the packet between pf and dummynet.

MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31904
2021-09-24 11:41:25 +02:00
Kristof Provost
846a6e8f9a pfctl: print counters in decimal
795d78a467 pfctl: Don't use PRIu64 mistakenly changed these to be
printed as hexadecimal numbers.

Reported by:	Florian Smeets
MFC after:	4 days
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-09-04 16:07:59 +02:00
Kristof Provost
795d78a467 pfctl: Don't use PRIu64
Rather than PRIu64 we can just treat the data as uintmax_t, and use %jx
instead.

MFC after:	1 week
Suggested by:	kib
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-09-02 09:35:36 +02:00
Dimitry Andric
5b8f07b12f Fix -Wformat errors in pfctl on 32-bit architectures
Use PRIu64 to printf(3) uint64_t quantities, otherwise this will result
in "error: format specifies type 'unsigned long' but the argument has
type 'uint64_t' (aka 'unsigned long long') [-Werror,-Wformat]" on 32-bit
architectures.

Fixes:		80078d9d38
MFC after:	1 week
2021-08-29 17:31:28 +02:00
Kristof Provost
80078d9d38 pfctl: use libpfctl to retrieve pf status
Rather than call DIOCGETSTATUS ourselves use the new libpfctl functions.

MFC after:	1 week
Sponsored by:	Modirum MDPay
Differential Revision:	https://reviews.freebsd.org/D31697
2021-08-29 14:59:38 +02:00
Kristof Provost
9ce320820e pfctl: build fix
Fix the build issue introduced in e59eff9ad3 (pfctl: fix killing states by ID)

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-08-24 13:21:05 +02:00
Kristof Provost
e59eff9ad3 pfctl: fix killing states by ID
Since the conversion to the new DIOCKILLSTATESNV the kernel no longer
exists the id and creatorid to be big-endian.
As a result killing states by id (i.e. `pfctl -k id -k 12345`) no longer
worked.

Reported by:	Özkan KIRIK
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-08-24 12:54:13 +02:00
Kristof Provost
c69121c473 pfctl: syncookie configuration
pfctl and libpfctl code required to enable/disable the syncookie
feature.

MFC after:	1 week
Sponsored by:	Modirum MDPay
Differential Revision:	https://reviews.freebsd.org/D31140
2021-07-20 10:36:14 +02:00
Kristof Provost
ef950daa35 pf: match keyword support
Support the 'match' keyword.
Note that support is limited to adding queuing information, so without
ALTQ support in the kernel setting match rules is pointless.

For the avoidance of doubt: this is NOT full support for the match
keyword as found in OpenBSD's pf. That could potentially be built on top
of this, but this commit is NOT that.

MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D31115
2021-07-17 12:01:08 +02:00
Mateusz Guzik
858937bea4 pfctl: cache getprotobynumber results
As for example pfctl -ss keeps calling it, it saves a lot of overhead
from elided parsing of /etc/nsswitch.conf and /etc/protocols.

Sample result when running a pre-nvlist binary with nfs root and dumping
7 mln states:
before: 24.817u 62.993s 1:28.52 99.1%
after:	8.064u 1.117s 0:18.87 48.5%

Idea by Jim Thompson

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-07-01 21:31:45 +00:00
Kristof Provost
9938fcaa65 pfctl tests: Test fairq configuration
We used to have a bug where pfctl could crash setting fairq queues. Test
this case and ensure it does not crash pfctl.

Reviewed by:	donner
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30348
2021-05-20 14:06:23 +02:00