From nobody Fri Oct 30 14:14:46 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGNQZ45mMz6wwnQ for ; Fri, 30 Oct 2026 14:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGNQZ1Vmfz3C83 for ; Fri, 30 Oct 2026 14:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369686; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2tbWngvBP0WqowZzamO2XV8sZaMJIEfdufmoSTBC2vc=; b=ZxIOL0drjtnrOM2FqRMhocwyZrlQtWIeqbFHx4R0QnDAbg52Mv6OuTht4meIv0lGqUnGZW Mm3plxW1gH1GoikPpcOr6uoGdg991/ZyESB6SXgPrkftbbnBkcwbBdCTplPlCBDkoeAMAe 7UJlUtQKFNlP2tNct7gWM0bj5dPT+Epc5Xz6hem3TKwrLhodDrVXva5lemnN/9Tb3I1247 4cE281Nux/4jGS3nxJoVCbGCud7IVcIC/eoJk9eeP49hqmPSAdznzKvIQlouetfZS7NQug e4AfN5VOM8UksM1qSWVfvwge1RlFaN7SOSHQ9PKr39NitcV1qG+ZdvYUw/55YQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793369686; b=AvQt4Xjsqz0sRrH5VDpjcxYS9LeudU3TCJVxBeTuD9Wsw1Ps4/M86bQqxlg1VHyEcxpC7P xMx+dyot7fRtuB9krJU/YOKes01l8RU3t3VrrNjefuDv9OYnuHn+9UBi8Thu/8ceOO28Hp r07UbIu+e0iwPCInaHtZyo44U9N4edvJWvEp/58KGIWZTgT59K9w+ILECyXPGW6bpQrZhV lU4tijtK5zQOnyBf2TrvfPXhY0NFB8KPr37QRVnBNerj1tnQvpmRgbsKVB/WGPy1KgVuvq U1Sry1TGdtJI3NpxVXwiBaXUpeETSpNbNXbu+8tt1L0MqLOOWJWpytAGQ6EAfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793369686; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2tbWngvBP0WqowZzamO2XV8sZaMJIEfdufmoSTBC2vc=; b=gVwoueZbDSqGcUyjkf28P5FRbTNgO0Iuzc531jU3j8SxbirDRMB8E1BTMLZ8n6FyWv5DP0 xV8DraHSk6HhVuXC0FpkGTDFBP9goVvu89yJUUiYrOrKTt13lkK5Gcl0DPZJS6sF/Dl+E6 msZO3Z1WJ7U9MdRzOl6dUMRX533nkZNVsQ/7StoNLTWGw/ugV6rVHruLrd3rcpgrhbggXd nkmlFPjbEpCaExV5Xshjp9yVRUUpTCr3mpufNxiyE32hbNe13VGaHLtUOrYiCyuL7WCSFB nuV9pA63in0Uj9XCdsuIJS9u1BkA85/d8sABxFCML9vMCwKX3fOtdi7+iYBo1A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGNQZ19VQzVjc for ; Fri, 30 Oct 2026 14:14:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22661 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 14:14:46 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 78b620b781b0 - main - pfsync: avoid underflow on different timeouts List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 78b620b781b0cdc85378e439ad2974e6aae771ff Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 14:14:46 +0000 Message-Id: <6ae4a656.22661.4085e14@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=78b620b781b0cdc85378e439ad2974e6aae771ff commit 78b620b781b0cdc85378e439ad2974e6aae771ff Author: Kristof Provost AuthorDate: 2026-10-21 15:18:59 +0000 Commit: Kristof Provost CommitDate: 2026-10-30 14:14:12 +0000 pfsync: avoid underflow on different timeouts If two pfsync hosts have different timeout values set it's possible for an underflow to occor when importing a state. If the destination host has a shorter timeout set than the exporting host it's possible for the state to be older than the importing host's timeout value, which results in an underflow and a state with an unreasonable expiry time. Check for this, and avoid the underflow. While here also account for the timeout being longer than our uptime. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60950 --- sys/netpfil/pf/if_pfsync.c | 12 +++++- tests/sys/netpfil/pf/pfsync.sh | 90 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 100 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index 523a71846215..fa72958788da 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -861,12 +861,20 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version) st->expire = pf_get_uptime(); if (sp->pfs_1301.expire) { uint32_t timeout; + uint32_t expire; + timeout = r->timeout[st->timeout]; if (!timeout) timeout = V_pf_default_rule.timeout[st->timeout]; - /* sp->expire may have been adaptively scaled by export. */ - st->expire -= (timeout - ntohl(sp->pfs_1301.expire)) * 1000; + expire = ntohl(sp->pfs_1301.expire); + /* + * Ensure we don't over/under flow if our local timeout or + * uptime is lower than the remote timeout. + */ + if (timeout > expire && st->expire > (timeout - expire)) + st->expire -= (timeout - expire) + * 1000; } if (! (st->act.rtableid == -1 || diff --git a/tests/sys/netpfil/pf/pfsync.sh b/tests/sys/netpfil/pf/pfsync.sh index 0e1d83d21823..1b07a6a3c620 100644 --- a/tests/sys/netpfil/pf/pfsync.sh +++ b/tests/sys/netpfil/pf/pfsync.sh @@ -1882,6 +1882,95 @@ stack_key_collision_cleanup() pfsynct_cleanup } +atf_test_case "expire_underflow" "cleanup" +expire_underflow_head() +{ + atf_set descr 'pfsync test for expiration underflow' + atf_set require.user root +} + +expire_underflow_body() +{ + pfsynct_init + + epair_sync=$(vnet_mkepair) + epair_one=$(vnet_mkepair) + epair_two=$(vnet_mkepair) + + vnet_mkjail one ${epair_one}a ${epair_sync}a + vnet_mkjail two ${epair_two}a ${epair_sync}b + + # pfsync interface + jexec one ifconfig ${epair_sync}a 192.0.2.1/24 up + jexec one ifconfig ${epair_one}a 198.51.100.1/24 up + jexec one ifconfig pfsync0 \ + syncdev ${epair_sync}a \ + maxupd 1 \ + up + jexec two ifconfig ${epair_two}a 198.51.100.2/24 up + + # Enable pf! + jexec one pfctl -e + pft_set_rules one \ + "set timeout tcp.closed 5000" \ + "set skip on ${epair_sync}a" \ + "pass out keep state" + jexec two pfctl -e + pft_set_rules two \ + "set timeout tcp.closed 5" \ + "set skip on ${epair_sync}b" \ + "pass out keep state (tcp.closed 5)" + + hostid_one=$(jexec one pfctl -si -v | awk '/Hostid:/ { gsub(/0x/, "", $2); printf($2); }') + + ifconfig ${epair_one}b 198.51.100.254/24 up + /usr/sbin/inetd -p ${PWD}/inetd.pid \ + $(atf_get_srcdir)/echo_inetd.conf + + echo one | jexec one nc -N 198.51.100.254 7 + + sleep 15 + + # Allow for a bulk update + jexec two ifconfig ${epair_sync}b 192.0.2.2/24 up + jexec two ifconfig pfsync0 \ + syncdev ${epair_sync}b \ + maxupd 1 \ + up + + # Give pfsync time to do its thing + sleep 2 + + echo "One" + jexec one pfctl -s states -vv + echo "Two" + jexec two pfctl -s states -vv + + if ! jexec two pfctl -s states | grep tcp | grep 198.51.100.1 | \ + grep 198.51.100.254 ; then + atf_fail "state not found on synced host" + fi + + if ! jexec two pfctl -sc | grep ""${hostid_one}""; + then + jexec two pfctl -sc + atf_fail "HostID for host one not found on two" + fi + + sleep 10 + + jexec two pfctl -s states -vv + if jexec two pfctl -s states | grep tcp | grep 198.51.100.1 | \ + grep 198.51.100.254 ; then + atf_fail "state failed to expire on two" + fi +} + +expire_underflow_cleanup() +{ + pfsynct_cleanup +} + atf_init_test_cases() { atf_add_test_case "basic" @@ -1908,4 +1997,5 @@ atf_init_test_cases() atf_add_test_case "rt_af" atf_add_test_case "flush_by_intf" atf_add_test_case "stack_key_collision" + atf_add_test_case "expire_underflow" }