From nobody Tue Oct 13 19:18:51 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j43zP0b14z6w1kY for ; Tue, 13 Oct 2026 19:18:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j43zN4KCQz3LDb for ; Tue, 13 Oct 2026 19:18:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791919136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vdKdgXMFP7GHll8/L72sFb3ZKN52UqKg2DSQdcXyX80=; b=vxc9mhMauSZkvUsmq43f84xpO7a0k7y/uyWyiy5eDZSUxLnZhhe8TFizvheKNxJFEzEKvV DuyxoynGbiUOLebubhh6au/bvnufkGkd3i00p1YiSgalvSuwwRXJtbm+cWvIhgg5wDQ599 vvDzOWdfY3yVGw3YLeXCNoCEQkQRcki4ilbxWK7vpMMWLoi/VDA7RTZUptj40+oaiBlPNl 0S0JA0KGjvNshFWK6ikNTqTpOffvhZxlb2HLPaqBKYBhEuvtYuKuGMT/edhyG8tG9UOrc3 oO84t1nIiZLyycQdkCXtHWbCIehCaPq+ZSl2NYaf8sjFqODWn/0pcVtpHvfB1A== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791919136; b=LWU/dXD8qgMg6wDUn72YLDuPWLfse/uyUAobNVnV8e8bOVl8VkHSOKtVkRZsKI3Xigx++F jP2d6fs7VlpzflIEs2qFK2Eet/RiEcC5s/y8vwqkCqe/G1SDpaTTfb4shF6I6kBkLA6TPj reDKXwXse3r1hS6hWqsjy62eRPzsa0hNFQd+xDdJNttu2xwYJOd5CTe1qzSAoDM1EuIcCy qb63s07y9WeNAaCulbE0d4RSHxjmSx561Sy/2gyYOceHdXuQiJiDlcxL/Ue9pD4U2+g6cF 0bAhWr6I4apMSBPduMIRA2IjJsPsuGNMztjvU0EIfLg62O4/f+u+rTb2FS93AA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791919136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vdKdgXMFP7GHll8/L72sFb3ZKN52UqKg2DSQdcXyX80=; b=pegzacYYfD8U2R3f+AzBg4md3ee7ce5W6BinuhHMWOyaU5WRSow2x04bRZiTQy0D61DOJO 9KnJqMU6KI/V7siclIUBtx/xqD7ivcQSoyHDRc0Z36PpXX4B6wuoyV7hJxBPVVRSiA6ZpB Ttp5mX3V4q+9gm68NHWsTOnpRqEv0+wELuRdPpHb2V2GkSZWNPf51i/D9ni3Stp6py7sYB HW4jcbqK8LgWtLakW/z3AVJOcYRCpb5VphFTjEsvzNJdMqqqKU8p5YWkQh6cSClbxrBkDX KdxOo9R7fH8lXOHz3D6cKcMwPz76StO2qZtOqIcWJoHG3gBARh7obkCElWqsMA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j43zN3Q5tzSCC for ; Tue, 13 Oct 2026 19:18:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f6dd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 13 Oct 2026 19:18:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: e6dc001d7a38 - main - pf: Do not hash pool address pointers into rule hashes List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e6dc001d7a387100125718322fa741444a9025fc Auto-Submitted: auto-generated Date: Tue, 13 Oct 2026 19:18:51 +0000 Message-Id: <6ace841b.3f6dd.59f82131@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=e6dc001d7a387100125718322fa741444a9025fc commit e6dc001d7a387100125718322fa741444a9025fc Author: R. Christian McDonald AuthorDate: 2026-10-13 19:17:48 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-13 19:17:48 +0000 pf: Do not hash pool address pointers into rule hashes pf_hash_pool() hashes the first address of a pool as a whole struct pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr or pfr_ktable pointer. An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on every load, so with "set keepcounters" the rule never matches its predecessor and loses its counters on every reload. The pointers also differ between hosts: once a filter rule in the main ruleset has an interface or table pool, pfsync peers disagree on the ruleset checksum and bind every synced state to the default rule. Hash the address with that union cleared. The rest of the address, including the prefix length of an interface address, is hashed as before, and the hash of a rule with a plain address pool does not change. Reviewed by: kp Fixes: c6bcf6e6fd50 ("pf: include all elements when hashing rules") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60370 --- sys/netpfil/pf/pf_ioctl.c | 6 +++- tests/sys/netpfil/pf/rules_counter.sh | 53 +++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index f673d3b4cf1e..45712f80cad7 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -1380,11 +1380,15 @@ pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) static void pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool) { + struct pf_addr_wrap addr; uint16_t x; int y; if (pool->cur) { - PF_MD5_UPD(pool, cur->addr); + /* Leave out the pointer to the kernel's dynaddr or table. */ + bcopy(&pool->cur->addr, &addr, sizeof(addr)); + bzero(&addr.p, sizeof(addr.p)); + MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr)); PF_MD5_UPD_STR(pool, cur->ifname); PF_MD5_UPD(pool, cur->af); } diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh index 54a65a907b4f..9a5b03506ed5 100644 --- a/tests/sys/netpfil/pf/rules_counter.sh +++ b/tests/sys/netpfil/pf/rules_counter.sh @@ -148,6 +148,58 @@ keepcounters_body() jexec alcatraz pfctl -s r -v } +atf_test_case "keepcounters_pool" "cleanup" +keepcounters_pool_head() +{ + atf_set descr 'Test keepcounters for a rule with an interface pool' + atf_set require.user root +} + +keepcounters_pool_body() +{ + pft_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1 + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # The same rule again keeps its counters + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # Another prefix length makes it a different rule + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)/24" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: 0[[:space:]]' \ + jexec alcatraz pfctl -s nat -v +} + +keepcounters_pool_cleanup() +{ + pft_cleanup +} + atf_test_case "4G" "cleanup" 4G_head() { @@ -206,5 +258,6 @@ atf_init_test_cases() { atf_add_test_case "get_clear" atf_add_test_case "keepcounters" + atf_add_test_case "keepcounters_pool" atf_add_test_case "4G" }