From nobody Tue Jul 15 10:07:57 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bhFHf0sztz62DRX; Tue, 15 Jul 2025 10:07:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bhFHd4QpMz3fTN; Tue, 15 Jul 2025 10:07:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574077; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vNWgkLkQ61RcQEZihkXXK7vsfc6eCkx+0phaIlCnOcs=; b=iSOF6Vi7k+iAso/nY2b6Pn5G/fAtmu1/jaBX3l38M4NmBDkrwPBdJcgwUAoZcCVl4G7Xaw IWj9huryr4RRqZR7B6TgB+SgcZ5nS+mL9TnaJ3H+f8X++aH//Jl7PHiFJF8PNyJXqkq3mw lLjIhCBq8vuoWrhM11+SEBAOQ2Zz39aJiGHAotJxtFIWeQXexcx0HqnGsSXGZMFLH5o4iA NxfyrvTqXPu3KjrClqhCCTZlVj/Tjz5fA2Cl5wyH/ghBMjK09FsN0ZxzUa3J1exly96qIP e8koUhH7NTRvT+rI2EYw8lx/eCZ6k8yB6B4YLPFR64ly1vB0mZOj5DVtvn2whg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574077; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vNWgkLkQ61RcQEZihkXXK7vsfc6eCkx+0phaIlCnOcs=; b=myCZ71cFvyFZ2/wTcE3Tlg5S5kXnAOQdl3ea/xkfVUx+DN6qv4+2Lw2DkQhajjVMD7U3QQ LvDCbyIq/t0mr/6jvaq2WjetOhoKg3v3qba3oTRvjuQBstY1gXwpaWN87zLdcW+stOz7QK mE6Vb4rFlodWI+aDODLWTJDh9ZZs9a33AO7IS2+IjPX4OMhlvO3zVAynpsfCbemJGeszaw OKUMpeqCf5TKRUi/jn9KALsLueeqynwwrBEP82JFKa6IQHmnlOZ7v2HOSZmY2PCIcnpdUA zHLUFLiaNjCrpex+7oewFkyaHXXvUJC5WgCs7Hjkn0VAs7NdedZlgnCY70Zkkg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1752574077; a=rsa-sha256; cv=none; b=Oec27zPeXtNg8OI4HFkr/Ut96G5nG/k6kmOiSsdi60e4RwzfJXRMyKevVHnR/n0aA9faCI YHt73b2FQA26icP3L/Hd7/5jouMHxbWQghneXX6zt/Ls7G0RtTfDjUWpwJ6YVTt24u4n5E YnCjlC1n69AeJfEJQUhfSd5jIhXSx13pMY6dr7lFr0f9ASJROlyDTFsub6rRfaNJjfFFf7 2ioYqQhtFJp00W561aGuJaDar9j4jAxx2S4Dz47F90AwCeZBzJdY73kfQnodWrflIej8AI sjUy6W1x9xEm+WSdZhmAomdNm4jyxLRqfFh2doZtHA4SjyPezhAL04SBFglAqA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bhFHd3npkzbT8; Tue, 15 Jul 2025 10:07:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56FA7vGn028027; Tue, 15 Jul 2025 10:07:57 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56FA7vT8028024; Tue, 15 Jul 2025 10:07:57 GMT (envelope-from git) Date: Tue, 15 Jul 2025 10:07:57 GMT Message-Id: <202507151007.56FA7vT8028024@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 7250fc4eb5d0 - main - pflog: improve uid logging List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7250fc4eb5d0effdc285a2e7bc5c6b17d2fb1b9f Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7250fc4eb5d0effdc285a2e7bc5c6b17d2fb1b9f commit 7250fc4eb5d0effdc285a2e7bc5c6b17d2fb1b9f Author: Kristof Provost AuthorDate: 2025-07-08 15:04:12 +0000 Commit: Kristof Provost CommitDate: 2025-07-15 07:55:30 +0000 pflog: improve uid logging Sometimes a user ID was logged in pflog(4) although the logopt of the rule did not specify it. Check the option again for the log rule in case another rule has triggered a socket lookup. Remove logopt group, it is not documented and cannot work as struct pfloghdr does not contain a gid. Rename PF_LOG_SOCKET_LOOKUP to PF_LOG_USER to express what it does. The lookup involved is only an implemntation detail. OK kn@ sashan@ mvs@ Obtained from: OpenBSD, bluhm , f6d3bf21b2 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 3 +-- sbin/pfctl/pfctl_parser.c | 2 +- sys/netpfil/pf/if_pflog.c | 4 ++-- sys/netpfil/pf/pf.h | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index a8a165d336fa..358fa909fc50 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -3232,8 +3232,7 @@ logopts : logopt { $$ = $1; } logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } | MATCHES { $$.log = PF_LOG_MATCHES; $$.logif = 0; } - | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } - | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } + | USER { $$.log = PF_LOG_USER; $$.logif = 0; } | TO string { const char *errstr; u_int i; diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c index cc2b03ec211f..f2eb75135609 100644 --- a/sbin/pfctl/pfctl_parser.c +++ b/sbin/pfctl/pfctl_parser.c @@ -928,7 +928,7 @@ print_rule(struct pfctl_rule *r, const char *anchor_call, int verbose, int numer printf("%sall", count++ ? ", " : ""); if (r->log & PF_LOG_MATCHES) printf("%smatches", count++ ? ", " : ""); - if (r->log & PF_LOG_SOCKET_LOOKUP) + if (r->log & PF_LOG_USER) printf("%suser", count++ ? ", " : ""); if (r->logif) printf("%sto pflog%u", count++ ? ", " : "", diff --git a/sys/netpfil/pf/if_pflog.c b/sys/netpfil/pf/if_pflog.c index 0a84f9d680ac..cb96d2fcc44c 100644 --- a/sys/netpfil/pf/if_pflog.c +++ b/sys/netpfil/pf/if_pflog.c @@ -284,9 +284,9 @@ pflog_packet(uint8_t action, u_int8_t reason, * state lock, since this leads to unsafe LOR. * These conditions are very very rare, however. */ - if (trigger->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done && lookupsafe) + if (trigger->log & PF_LOG_USER && !pd->lookup.done && lookupsafe) pd->lookup.done = pf_socket_lookup(pd); - if (pd->lookup.done > 0) + if (trigger->log & PF_LOG_USER && pd->lookup.done > 0) hdr.uid = pd->lookup.uid; else hdr.uid = -1; diff --git a/sys/netpfil/pf/pf.h b/sys/netpfil/pf/pf.h index db353d185368..cfff58064922 100644 --- a/sys/netpfil/pf/pf.h +++ b/sys/netpfil/pf/pf.h @@ -140,7 +140,7 @@ enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL, #define PF_LOG 0x01 #define PF_LOG_ALL 0x02 -#define PF_LOG_SOCKET_LOOKUP 0x04 +#define PF_LOG_USER 0x04 #define PF_LOG_FORCE 0x08 #define PF_LOG_MATCHES 0x10