From nobody Wed Oct 28 20:41:37 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFK5t2pYzz6x76N for ; Wed, 28 Oct 2026 20:41:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFK5t0bL4z4b1Y for ; Wed, 28 Oct 2026 20:41:38 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793220098; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iktbNLruTumyyP8vYuXV2y5cY8moPzS7eg8iE5ZTiT8=; b=dDtmuwhX78gfuuW/Dqhu64Jh3af22viOIca+z5WWuis3+tbCaaI6qqXUtOTySQdPHtBykh 4+bZ4wmusngerDIPUpVi7Di3G7r159UQOTuEHzmw2ezfAbhbvE3Eh5BWp9jpCkCCBVxdmS nfvrTt75Oobz0anQ77FadRMp5Zdpta/006I5bQZTuwi3hgSU16FWjd8Uw8HNnJ9qLZH9K/ URwU3SnpKA3pdwF5noEZbRpyKU4wdDXo5lKxmH0EUL4HyDPxKNeyRN5T3JaVWUqvNoihUd c3bseVejd5jFZX67UuGxtinkhUunYa3ojWVZwOENx0Bpi4hVIzZ9xgXk/hxL+w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793220098; b=g3F5H9c7ZxkryccpBsHIKQu/de81ZwfPeGWPqIxg9LVccqm0OK7HQIWMH8Y4JsQusRevi1 KBzWlx4BlocrbmRtMxuVawYyc65tEaOZaz52Gs1mMQg4uk4SHA4xfvmaDFEcxptEkPCDpu u+Efaf+HfBfdEqQa04WWJ1aHs/HvedS9syCQAQqV4F2JL8jGsUTfloI+khD/dQfFREknyz Bxhb0rMaiBVrtk+AHjSrzm/CEWTipOQHPFfzZdunszJpWiNo4eckcBRHzAAn873UdvX8vS n2S5Qn7lBVBafeH8g7oD+kvAV8NMbAKS9VyEYNmcxLNHTUxJN5jxsDVr19QAdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793220098; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iktbNLruTumyyP8vYuXV2y5cY8moPzS7eg8iE5ZTiT8=; b=iUDFCWCpuJ4+4wqLQJiqyZKuWSHVi/qit8GmTCCG71ncSecstmJMHg8aLxxCnbA7VDhk/X uiBSh+/pX4zyL/5BjxGa8xh8w2syX2o811MskerYfU4Y8b2vhoKkCRE9jFHdQHQZ9coWxV UdOdDI7nxLlRahtQvMZLi6Xu43IMKEDwTgxBKRCnRKMVqRaI5URlRY5APbybLHjbJoy5SJ 9tGUi/uCoEWF6oB+CIcVOOBDknYNpjdzvxvKPU+VPbvpkZJxbKyT79fWGT8MAZaeh2fmSZ P5TulnSDFqFtuAFm4pAaQigv1UMn7Dc7YqajWMGA9nyLbTFgrWrBMM5l1td+oA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFK5t01FDz1MFr for ; Wed, 28 Oct 2026 20:41:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1d65d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Oct 2026 20:41:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: R. Christian McDonald Subject: git: af83288e24f0 - stable/14 - pf: Do not hash pool address pointers into rule hashes List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: af83288e24f0f199eb43ac31e800831980a085cd Auto-Submitted: auto-generated Date: Wed, 28 Oct 2026 20:41:37 +0000 Message-Id: <6ae25e01.1d65d.328784ec@gitrepo.freebsd.org> The branch stable/14 has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=af83288e24f0f199eb43ac31e800831980a085cd commit af83288e24f0f199eb43ac31e800831980a085cd Author: R. Christian McDonald AuthorDate: 2026-10-13 19:17:48 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-28 20:38:09 +0000 pf: Do not hash pool address pointers into rule hashes pf_hash_pool() hashes the first address of a pool as a whole struct pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr or pfr_ktable pointer. An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on every load, so with "set keepcounters" the rule never matches its predecessor and loses its counters on every reload. The pointers also differ between hosts: once a filter rule in the main ruleset has an interface or table pool, pfsync peers disagree on the ruleset checksum and bind every synced state to the default rule. Hash the address with that union cleared. The rest of the address, including the prefix length of an interface address, is hashed as before, and the hash of a rule with a plain address pool does not change. Reviewed by: kp Fixes: c6bcf6e6fd50 ("pf: include all elements when hashing rules") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60370 (cherry picked from commit e6dc001d7a387100125718322fa741444a9025fc) --- sys/netpfil/pf/pf_ioctl.c | 6 +++- tests/sys/netpfil/pf/rules_counter.sh | 53 +++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 619e8e18c900..37827068c909 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -1286,11 +1286,15 @@ pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) static void pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool) { + struct pf_addr_wrap addr; uint16_t x; int y; if (pool->cur) { - PF_MD5_UPD(pool, cur->addr); + /* Leave out the pointer to the kernel's dynaddr or table. */ + bcopy(&pool->cur->addr, &addr, sizeof(addr)); + bzero(&addr.p, sizeof(addr.p)); + MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr)); PF_MD5_UPD_STR(pool, cur->ifname); } PF_MD5_UPD(pool, key); diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh index 962e7c93ba93..60878c2bd99c 100644 --- a/tests/sys/netpfil/pf/rules_counter.sh +++ b/tests/sys/netpfil/pf/rules_counter.sh @@ -148,6 +148,58 @@ keepcounters_body() jexec alcatraz pfctl -s r -v } +atf_test_case "keepcounters_pool" "cleanup" +keepcounters_pool_head() +{ + atf_set descr 'Test keepcounters for a rule with an interface pool' + atf_set require.user root +} + +keepcounters_pool_body() +{ + pft_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1 + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # The same rule again keeps its counters + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # Another prefix length makes it a different rule + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)/24" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: 0[[:space:]]' \ + jexec alcatraz pfctl -s nat -v +} + +keepcounters_pool_cleanup() +{ + pft_cleanup +} + keepcounters_cleanup() { pft_cleanup @@ -157,4 +209,5 @@ atf_init_test_cases() { atf_add_test_case "get_clear" atf_add_test_case "keepcounters" + atf_add_test_case "keepcounters_pool" }