From nobody Thu Dec 02 03:53:21 2021 X-Original-To: freebsd-pf@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id E53DD18B19AB for ; Thu, 2 Dec 2021 03:53:33 +0000 (UTC) (envelope-from ozkan.kirik@gmail.com) Received: from mail-vk1-xa36.google.com (mail-vk1-xa36.google.com [IPv6:2607:f8b0:4864:20::a36]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4J4MWK3Jv0z3jNf; Thu, 2 Dec 2021 03:53:33 +0000 (UTC) (envelope-from ozkan.kirik@gmail.com) Received: by mail-vk1-xa36.google.com with SMTP id 84so17575264vkc.6; Wed, 01 Dec 2021 19:53:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=hAQ8MxZucSAet7UfsTFH3pRTXq5KU9efMxYPLbIgjZY=; b=mLVwBVbGHYyfoHMk3O/p6n9fwjVBAWvIScerMATdSa8O1izAkDzcWfytHV87gnGGoD sEy4QEH3twdAYWB2RcRO/vQP0p0eJVOWi6F3rApyEFwBw1g5MCRGaCKrG9hbfAu2IH+Q NokCMVkyNRadMqFkWaKfIteJLXYQbEZnn8ZfoUu+KdoQOVNmF3oXbjn3njnM7MgXbwlp 8gFr6ahwEXniorOmiZfCEmPJt5CCt2J6ZZr0hJanyp5HJ2ktN23FA1Wqag03JujN2QNb lzS9qWO3GxCHxkmJ89D4lHou8O/R+SwxsbrLl+yS6F7knvvOsAy3ESx3exiEFAoByNFR 4AfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=hAQ8MxZucSAet7UfsTFH3pRTXq5KU9efMxYPLbIgjZY=; b=l0I/pDcfzJbu5Mggn3/RGKPa2E08mBGH/0oXPsWXc2WifSollwqPdK0TUW3Swy7o9g E7R2CMQ5x2XImWlxZXWbNwDXFT7hYHqfeuy2H7Sh/2YziLJcgMFLwixln8gFkCXRsTv7 WbmhOuJ194v8+JR9oS1RPe9mUUy1sSnIOCbYJbqf9X0Ia9XbKlyJearqRLM6zFX67/1l pQWiyg/X72f0b57TbFBa04CsPK5AOdE+vTPB80aKsRqkFPFQINVZhYINHHN7wO1JXP4R yYKNyr+QEIgfprq2havHGmO1PaxXd1JYWE1xJhtHdjecaSCysRseyMuj79zRCLOTpfQs v9Bw== X-Gm-Message-State: AOAM531+F2cj5RWuU8n85EHotiC4tAa0GfDG1t1HV00CSgFgT/b5UxWy ORYKylVq83kiQeLHtmt9FLTijAb2xfqXArfZx3vHyb9w/48= X-Google-Smtp-Source: ABdhPJzGAOi3uumrBSrtWcQ6HiouoZ+rYZhu68hoQXkrUfmFq37jPWUlzrmq9chaGv2AQv8F4nolGH9AA2ie92Govzw= X-Received: by 2002:a05:6122:b64:: with SMTP id h4mr14252678vkf.21.1638417212327; Wed, 01 Dec 2021 19:53:32 -0800 (PST) List-Id: Technical discussion and general questions about packet filter (pf) List-Archive: https://lists.freebsd.org/archives/freebsd-pf List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-pf@freebsd.org X-BeenThere: freebsd-pf@freebsd.org MIME-Version: 1.0 References: <202111261940.1AQJeGLZ022802@gitrepo.freebsd.org> <52E4AB7A-6D27-4B11-ABCD-94BB12D389F4@FreeBSD.org> In-Reply-To: <52E4AB7A-6D27-4B11-ABCD-94BB12D389F4@FreeBSD.org> From: =?UTF-8?B?w5Z6a2FuIEtJUklL?= Date: Thu, 2 Dec 2021 06:53:21 +0300 Message-ID: Subject: Re: git: 7f944794868f - stable/12 - pf: Introduce ridentifier To: Kristof Provost Cc: freebsd-pf@freebsd.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 4J4MWK3Jv0z3jNf X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[] X-ThisMailContainsUnwantedMimeParts: N Thanks, I'll try. On Wed, Dec 1, 2021 at 11:58 PM Kristof Provost wrote: > > On 1 Dec 2021, at 5:59, =C3=96zkan KIRIK wrote: > > Because tshark/wireshark don't know this header change yet. > > I=E2=80=99ve looked at the Wireshark parser code, and .. well, it=E2=80= =99s wrong. It arbitrarily adds 3 bytes to the header length, and that=E2= =80=99s not the correct solution. I=E2=80=99m not going to implement kernel= workarounds for application bugs. > > And even though tcpdump has been patched by this commit, it still > cannot parse the packet properly also. > > Try this patch: > > diff --git a/sys/net/if_pflog.h b/sys/net/if_pflog.h > index c77d8da1440a..93a69a2bb3a5 100644 > --- a/sys/net/if_pflog.h > +++ b/sys/net/if_pflog.h > @@ -31,6 +31,8 @@ > #ifndef _NET_IF_PFLOG_H_ > #define _NET_IF_PFLOG_H_ > > +#include > + > #define PFLOGIFS_MAX 16 > > #define PFLOG_RULESET_NAME_SIZE 16 > @@ -51,11 +53,13 @@ struct pfloghdr { > u_int8_t dir; > u_int8_t pad[3]; > u_int32_t ridentifier; > + u_int8_t reserve; /* Appease broken software like W= ireshark. */ > + u_int8_t pad2[3]; > }; > > -#define PFLOG_HDRLEN sizeof(struct pfloghdr) > +#define PFLOG_HDRLEN BPF_WORDALIGN(offsetof(struct pfl= oghdr, pad2)) > /* minus pad, also used as a signature */ > -#define PFLOG_REAL_HDRLEN offsetof(struct pfloghdr, pad) > +#define PFLOG_REAL_HDRLEN offsetof(struct pfloghdr, pad2) > > #ifdef _KERNEL > struct pf_rule; > diff --git a/sys/netpfil/pf/if_pflog.c b/sys/netpfil/pf/if_pflog.c > index 4853c1301d6f..5ccdf3a7dd45 100644 > --- a/sys/netpfil/pf/if_pflog.c > +++ b/sys/netpfil/pf/if_pflog.c > @@ -215,7 +215,8 @@ pflog_packet(struct pfi_kkif *kif, struct mbuf *m, sa= _family_t af, u_int8_t dir, > return (0); > > bzero(&hdr, sizeof(hdr)); > - hdr.length =3D PFLOG_HDRLEN; > + hdr.length =3D PFLOG_REAL_HDRLEN; > hdr.af =3D af; > hdr.action =3D rm->action; > hdr.reason =3D reason; > > It looks like I had assumed that the header was expected to be aligned to= 4 bytes, but it=E2=80=99s actually expected to be aligned to sizeof(long).= This should fix that. > > I=E2=80=99ve gone one further and added a dummy field to arrange the upda= ted struct so that Wireshark will work, essentially retaining its incorrect= assumption. It really should be fixed as well though. > > Kristof