git: e6dc001d7a38 - main - pf: Do not hash pool address pointers into rule hashes

The branch main has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=e6dc001d7a387100125718322fa741444a9025fc

commit e6dc001d7a387100125718322fa741444a9025fc
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-10-13 19:17:48 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-13 19:17:48 +0000

    pf: Do not hash pool address pointers into rule hashes
    
    pf_hash_pool() hashes the first address of a pool as a whole struct
    pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr
    or pfr_ktable pointer.
    
    An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on
    every load, so with "set keepcounters" the rule never matches its
    predecessor and loses its counters on every reload.  The pointers also
    differ between hosts: once a filter rule in the main ruleset has an
    interface or table pool, pfsync peers disagree on the ruleset checksum
    and bind every synced state to the default rule.
    
    Hash the address with that union cleared.  The rest of the address,
    including the prefix length of an interface address, is hashed as
    before, and the hash of a rule with a plain address pool does not
    change.
    
    Reviewed by:            kp
    Fixes:                  c6bcf6e6fd50 ("pf: include all elements when hashing rules")
    MFC after:              1 week
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60370
---
 sys/netpfil/pf/pf_ioctl.c             |  6 +++-
 tests/sys/netpfil/pf/rules_counter.sh | 53 +++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index f673d3b4cf1e..45712f80cad7 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -1380,11 +1380,15 @@ pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
 static void
 pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool)
 {
+	struct pf_addr_wrap addr;
 	uint16_t x;
 	int y;
 
 	if (pool->cur) {
-		PF_MD5_UPD(pool, cur->addr);
+		/* Leave out the pointer to the kernel's dynaddr or table. */
+		bcopy(&pool->cur->addr, &addr, sizeof(addr));
+		bzero(&addr.p, sizeof(addr.p));
+		MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr));
 		PF_MD5_UPD_STR(pool, cur->ifname);
 		PF_MD5_UPD(pool, cur->af);
 	}
diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh
index 54a65a907b4f..9a5b03506ed5 100644
--- a/tests/sys/netpfil/pf/rules_counter.sh
+++ b/tests/sys/netpfil/pf/rules_counter.sh
@@ -148,6 +148,58 @@ keepcounters_body()
 	    jexec alcatraz pfctl -s r -v
 }
 
+atf_test_case "keepcounters_pool" "cleanup"
+keepcounters_pool_head()
+{
+	atf_set descr 'Test keepcounters for a rule with an interface pool'
+	atf_set require.user root
+}
+
+keepcounters_pool_body()
+{
+	pft_init
+
+	epair=$(vnet_mkepair)
+	ifconfig ${epair}a 192.0.2.1/24 up
+
+	vnet_mkjail alcatraz ${epair}b
+	jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
+	jexec alcatraz pfctl -e
+
+	pft_set_rules alcatraz \
+		"set keepcounters" \
+		"nat on ${epair}b inet from any to any -> (${epair}b)"
+
+	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1
+
+	atf_check -s exit:0 -e ignore \
+	    -o match:'Evaluations: [1-9]' \
+	    jexec alcatraz pfctl -s nat -v
+
+	# The same rule again keeps its counters
+	pft_set_rules noflush alcatraz \
+		"set keepcounters" \
+		"nat on ${epair}b inet from any to any -> (${epair}b)"
+
+	atf_check -s exit:0 -e ignore \
+	    -o match:'Evaluations: [1-9]' \
+	    jexec alcatraz pfctl -s nat -v
+
+	# Another prefix length makes it a different rule
+	pft_set_rules noflush alcatraz \
+		"set keepcounters" \
+		"nat on ${epair}b inet from any to any -> (${epair}b)/24"
+
+	atf_check -s exit:0 -e ignore \
+	    -o match:'Evaluations: 0[[:space:]]' \
+	    jexec alcatraz pfctl -s nat -v
+}
+
+keepcounters_pool_cleanup()
+{
+	pft_cleanup
+}
+
 atf_test_case "4G" "cleanup"
 4G_head()
 {
@@ -206,5 +258,6 @@ atf_init_test_cases()
 {
 	atf_add_test_case "get_clear"
 	atf_add_test_case "keepcounters"
+	atf_add_test_case "keepcounters_pool"
 	atf_add_test_case "4G"
 }