From nobody Tue Oct 13 19:18:51 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j43zH5gpRz6w1gX for ; Tue, 13 Oct 2026 19:18:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j43zH4sKQz3L9V for ; Tue, 13 Oct 2026 19:18:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791919131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vdKdgXMFP7GHll8/L72sFb3ZKN52UqKg2DSQdcXyX80=; b=eNBelCIhPwdfW3FCQSv8GzzEQpjkQnFibOBfQK+s5bdidZJqjxzGHRIIlDzAIQnXA2NWay ZBaYQrEUx29OQ00S1VrjwpgHNGTHIvpYn4Kot/bE37Lla+dTigyxcJk953Vcw2G7Hidz1u nUn+LDaohxvQIrgxJczD/SCY82RbMqmJnXZw0WFYafMvV9cwiLtRfyBCBVtu15xpeICblx ghjk5NlkCIRWgdAAuLCZuMRo/10SPB57M+lNU1P2Z9yAm2cE0TLVj9UBA8t3oEB8qGfUNo wK8isIxzPLeqmt0oT8GeZgVDKPz9Z9Xi3JV+5afrkqVkrOVeo9xufYM8XAQnFw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791919131; b=GW9GNDAwKM4kUWMXrSlHhQx58HCvvnjxId2LVBf24bbzXpffP+TV/gY8g1AKrtiMHAxopy lFsMQ66esmF/FjBlDAt8zWIfdDw2aKjG+OP98wnnq5D0rgn0W4nC/J6Unv67vFghUWgU6K 7pSlrSkEXy8VH8vIy7QQ7PIOACaiPSdnWHspaAtqoOIynaQEWBitRCLvezVuVY568+0/GF 9+CuiSWsOV0K3SUTzNqgF+B5TCMQflou3X6fiItbvDBwXRyRGj+eDtaUY0cAyLeQruIDuA VsOKcbfOdOu0F33mA37dxahRTuo+ZIgZPkT5/UV1GOZnGE3WQ0it2BAbsH/ZIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791919131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vdKdgXMFP7GHll8/L72sFb3ZKN52UqKg2DSQdcXyX80=; b=KtZI3iHMrsquozUFGntuTtOGdFDgJHcZjIKHrlTViynP9CbqACVdyEyITLI73R/XHLb2+P va9lxd8Wi7yA9HPu6M84l6esbkXuU/wG8Rpg0pxMHmUmkbNOu8basfoZVYaUFLm0ALUCIF v1HuX2jtb+G3fTmDFKI0apMf8FxnTVzwFuLkZUOvCUYV97aP9ZbP7G9dG/koAQc+NFtApP I4FQjaT9aMqs6IoEzGB1A0osBvlr8/yUA4+KlG3OfOVid72qgqtxqmRE0wlEQHWivVJH2Q JqFO7KAZW5KKosKF0AcEAtpVDYVkpvi3hebuW1NtYjybWG3M/5Kw+oldDn1ong== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j43zH3fSrzRvk for ; Tue, 13 Oct 2026 19:18:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f6dd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 13 Oct 2026 19:18:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: e6dc001d7a38 - main - pf: Do not hash pool address pointers into rule hashes List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e6dc001d7a387100125718322fa741444a9025fc Auto-Submitted: auto-generated Date: Tue, 13 Oct 2026 19:18:51 +0000 Message-Id: <6ace841b.3f6dd.59f82131@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=e6dc001d7a387100125718322fa741444a9025fc commit e6dc001d7a387100125718322fa741444a9025fc Author: R. Christian McDonald AuthorDate: 2026-10-13 19:17:48 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-13 19:17:48 +0000 pf: Do not hash pool address pointers into rule hashes pf_hash_pool() hashes the first address of a pool as a whole struct pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr or pfr_ktable pointer. An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on every load, so with "set keepcounters" the rule never matches its predecessor and loses its counters on every reload. The pointers also differ between hosts: once a filter rule in the main ruleset has an interface or table pool, pfsync peers disagree on the ruleset checksum and bind every synced state to the default rule. Hash the address with that union cleared. The rest of the address, including the prefix length of an interface address, is hashed as before, and the hash of a rule with a plain address pool does not change. Reviewed by: kp Fixes: c6bcf6e6fd50 ("pf: include all elements when hashing rules") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60370 --- sys/netpfil/pf/pf_ioctl.c | 6 +++- tests/sys/netpfil/pf/rules_counter.sh | 53 +++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index f673d3b4cf1e..45712f80cad7 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -1380,11 +1380,15 @@ pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) static void pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool) { + struct pf_addr_wrap addr; uint16_t x; int y; if (pool->cur) { - PF_MD5_UPD(pool, cur->addr); + /* Leave out the pointer to the kernel's dynaddr or table. */ + bcopy(&pool->cur->addr, &addr, sizeof(addr)); + bzero(&addr.p, sizeof(addr.p)); + MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr)); PF_MD5_UPD_STR(pool, cur->ifname); PF_MD5_UPD(pool, cur->af); } diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh index 54a65a907b4f..9a5b03506ed5 100644 --- a/tests/sys/netpfil/pf/rules_counter.sh +++ b/tests/sys/netpfil/pf/rules_counter.sh @@ -148,6 +148,58 @@ keepcounters_body() jexec alcatraz pfctl -s r -v } +atf_test_case "keepcounters_pool" "cleanup" +keepcounters_pool_head() +{ + atf_set descr 'Test keepcounters for a rule with an interface pool' + atf_set require.user root +} + +keepcounters_pool_body() +{ + pft_init + + epair=$(vnet_mkepair) + ifconfig ${epair}a 192.0.2.1/24 up + + vnet_mkjail alcatraz ${epair}b + jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1 + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # The same rule again keeps its counters + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: [1-9]' \ + jexec alcatraz pfctl -s nat -v + + # Another prefix length makes it a different rule + pft_set_rules noflush alcatraz \ + "set keepcounters" \ + "nat on ${epair}b inet from any to any -> (${epair}b)/24" + + atf_check -s exit:0 -e ignore \ + -o match:'Evaluations: 0[[:space:]]' \ + jexec alcatraz pfctl -s nat -v +} + +keepcounters_pool_cleanup() +{ + pft_cleanup +} + atf_test_case "4G" "cleanup" 4G_head() { @@ -206,5 +258,6 @@ atf_init_test_cases() { atf_add_test_case "get_clear" atf_add_test_case "keepcounters" + atf_add_test_case "keepcounters_pool" atf_add_test_case "4G" }