From nobody Wed Oct 28 20:35:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFJzM6Tm0z6x6K0 for ; Wed, 28 Oct 2026 20:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFJzM3nhkz4RJx for ; Wed, 28 Oct 2026 20:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793219759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DKM4/KoK/9pguqcGQxBaorYmmH9kBAdq3tNMtNDr8ds=; b=xDDydQn0W4pRnfSNWyjha7jkq1V2sJmoIrFyicFRZ63pwJ4KOe1OfcEHGYfVw4jrZgmp07 XoRGGE0MOGp5aI8mWxgrLDIP8lgm8u1hnNgEv0AWntyh0oc/le32WQsgnDBhRiNiReO0R5 LrBH0LjJjkfvsBCCn47yJvu20EszJkIOvrDNWb+lcE+TL+TcnX/mtuZqk1taONUhsALXgV cFjY8lVNPVOmMj8ylyF2GvWLAmlCMbHP9ChS4T94Cuq+QqIbTTc3gbV5I9aygXcehhALby a8615BJVscTNmwlHrVxv5eJTfyfkA5jjCPMz+osmjJQNHnCLMDD0XkGSiisbGQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793219759; b=r5oqcctcrmxKoLhhq6GLXTF9SQ0vGQ9hKQaxFN5Tw6tSo1WKf5PsrxkxVXkoLdxBF7Zqve gssLqNYLPyeVc16EZ8eWOC1Y6uH3QEynY5BrV9Sa9BAdc0VZDL/SJXjlj1X9QXpKB4Ylp6 XTL4lsOwQXMwEL0rboLSBQvsZxH8IXrDIM7IgM55h2oVO/kBoZYQxQ/+EmnV+PiFtuxlj2 pUWo3sEnppYvQCIYsEHYV0UBf66/X1we7r9+wzu719Y17iAXeV+ui23db4oe5XOiXgJ5oH asJXJcD9G910zrIZuIdAmlsbzEJ88nk4tfaacco6eAgC9k3ANK8+Cr2rCO7HHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793219759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DKM4/KoK/9pguqcGQxBaorYmmH9kBAdq3tNMtNDr8ds=; b=HZpnK8fxrgtUaloYUWbotN3GIk4+lsRqSlxr2YBGWn8aE/abOSpJwPOOHil/Q5Jrpl//yv PiJ1GZz6oTwR+5+FxSb3lKPNKt1e0lwV9sz72rYy0/q0004Q/mhsWOiTdthi4DMK3hDNck /5P75/XnktPsob0VUojISu90JxwtTAjhatWdbKU+dRnmscSZRnIINEOEUxDFcodiQZ8MRM lOChT9Om8ndWJIIOwocKAqI5J+nJPmBqhcCmuMM7hck5MIaoESpVuojW3Sqp9yOts/HlKq VJbREgPTjgChbeEi6IiAHr0eriXzvcM9u4F+aIPTWZ8xg5XB0373XgZw76vyag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFJzM3DQtz1MpS for ; Wed, 28 Oct 2026 20:35:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1d10f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Oct 2026 20:35:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: R. Christian McDonald Subject: git: b1ccba78a2fb - stable/15 - pf: Do not hash pool address pointers into rule hashes List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b1ccba78a2fb644560aa81812425a4c2631b56cb Auto-Submitted: auto-generated Date: Wed, 28 Oct 2026 20:35:59 +0000 Message-Id: <6ae25caf.1d10f.4ff1a19d@gitrepo.freebsd.org> The branch stable/15 has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=b1ccba78a2fb644560aa81812425a4c2631b56cb commit b1ccba78a2fb644560aa81812425a4c2631b56cb Author: R. Christian McDonald AuthorDate: 2026-10-13 19:17:48 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-28 20:34:16 +0000 pf: Do not hash pool address pointers into rule hashes pf_hash_pool() hashes the first address of a pool as a whole struct pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr or pfr_ktable pointer. An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on every load, so with "set keepcounters" the rule never matches its predecessor and loses its counters on every reload. The pointers also differ between hosts: once a filter rule in the main ruleset has an interface or table pool, pfsync peers disagree on the ruleset checksum and bind every synced state to the default rule. Hash the address with that union cleared. The rest of the address, including the prefix length of an interface address, is hashed as before, and the hash of a rule with a plain address pool does not change. Reviewed by: kp Fixes: c6bcf6e6fd50 ("pf: include all elements when hashing rules") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60370 (cherry picked from commit e6dc001d7a387100125718322fa741444a9025fc) --- sys/netpfil/pf/pf_ioctl.c | 6 +++- tests/sys/netpfil/pf/rules_counter.sh | 53 +++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 8986a6a20222..0ba1f910bf2a 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -1371,11 +1371,15 @@ pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) static void pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool) { + struct pf_addr_wrap addr; uint16_t x; int y; if (pool->cur) { - PF_MD5_UPD(pool, cur->addr); + /* Leave out the pointer to the kernel's dynaddr or table. */ + bcopy(&pool->cur->addr, &addr, sizeof(addr)); + bzero(&addr.p, sizeof(addr.p)); + MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr)); PF_MD5_UPD_STR(pool, cur->ifname); PF_MD5_UPD(pool, cur->af); } diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh index 54a65a907b4f..9a5b03506ed5 100644 --- a/tests/sys/netpfil/pf/rules_counter.sh +++ b/tests/sys/netpfil/pf/rules_counter.sh @@ -148,6 +148,58 @@ keepcounters_body() jexec alcatraz pfctl -s r -v } +atf_test_case "keepcounters_pool" "cleanup" +keepcounters_pool_head() +{ + atf_set descr 'Test keepcounters for a rule with an interface pool' + atf_set require.user root +} + +keepcounters_pool_body() +{ + pft_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1 + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # The same rule again keeps its counters + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # Another prefix length makes it a different rule + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)/24" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: 0[[:space:]]' \ + jexec alcatraz pfctl -s nat -v +} + +keepcounters_pool_cleanup() +{ + pft_cleanup +} + atf_test_case "4G" "cleanup" 4G_head() { @@ -206,5 +258,6 @@ atf_init_test_cases() { atf_add_test_case "get_clear" atf_add_test_case "keepcounters" + atf_add_test_case "keepcounters_pool" atf_add_test_case "4G" }