Date: Thu, 27 May 2021 10:20:25 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 7c15871eff23 - stable/12 - pf: Track the original kif for floating states Message-ID: <202105271020.14RAKP63055279@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7c15871eff2341da68fa5c88fe64d1f386f13c89 commit 7c15871eff2341da68fa5c88fe64d1f386f13c89 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-05-12 11:24:57 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-05-27 07:06:17 +0000 pf: Track the original kif for floating states Track (and display) the interface that created a state, even if it's a floating state (and thus uses virtual interface 'all'). MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30245 (cherry picked from commit d0fdf2b28f9b981d2cb98e9da8a715e046ef1e92) --- lib/libpfctl/libpfctl.c | 2 ++ lib/libpfctl/libpfctl.h | 1 + sbin/pfctl/pf_print_state.c | 5 ++++- sys/net/pfvar.h | 2 ++ sys/netpfil/pf/if_pfsync.c | 2 +- sys/netpfil/pf/pf.c | 7 ++++--- sys/netpfil/pf/pf_ioctl.c | 1 + 7 files changed, 15 insertions(+), 5 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index 6a6ecd8fb136..e207a55a8673 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -699,6 +699,8 @@ pf_nvstate_to_state(const nvlist_t *nvl, struct pfctl_state *s) strlcpy(s->ifname, nvlist_get_string(nvl, "ifname"), sizeof(s->ifname)); + strlcpy(s->orig_ifname, nvlist_get_string(nvl, "orig_ifname"), + sizeof(s->orig_ifname)); pf_nvaddr_to_addr(nvlist_get_nvlist(nvl, "rt_addr"), &s->rt_addr); s->rule = nvlist_get_number(nvl, "rule"); diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 05447b5d8673..a54ee9db6ec7 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -237,6 +237,7 @@ struct pfctl_state { struct pf_addr rt_addr; struct pfctl_state_key key[2]; /* addresses stack and wire */ char ifname[IFNAMSIZ]; + char orig_ifname[IFNAMSIZ]; uint64_t packets[2]; uint64_t bytes[2]; uint32_t creation; diff --git a/sbin/pfctl/pf_print_state.c b/sbin/pfctl/pf_print_state.c index 7119308d195b..b1f0079154cf 100644 --- a/sbin/pfctl/pf_print_state.c +++ b/sbin/pfctl/pf_print_state.c @@ -352,9 +352,12 @@ print_state(struct pfctl_state *s, int opts) bcopy(&s->id, &id, sizeof(u_int64_t)); printf(" id: %016jx creatorid: %08x", id, s->creatorid); - printf(" gateway: "); + printf(" gateway: "); print_host(&s->rt_addr, 0, af, opts); printf("\n"); + + if (strcmp(s->ifname, s->orig_ifname) != 0) + printf(" origif: %s\n", s->orig_ifname); } } diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 41aba842e480..c7890b99e05a 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -522,6 +522,7 @@ struct pf_state { struct pf_addr rt_addr; struct pf_state_key *key[2]; /* addresses stack and wire */ struct pfi_kkif *kif; + struct pfi_kkif *orig_kif; /* The real kif, even if we're a floating state (i.e. if == V_pfi_all). */ struct pfi_kkif *rt_kif; struct pf_ksrc_node *src_node; struct pf_ksrc_node *nat_src_node; @@ -1474,6 +1475,7 @@ extern int pf_unlink_state(struct pf_state *, u_int); #define PF_ENTER_LOCKED 0x00000001 #define PF_RETURN_LOCKED 0x00000002 extern int pf_state_insert(struct pfi_kkif *, + struct pfi_kkif *, struct pf_state_key *, struct pf_state_key *, struct pf_state *); diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index bc1dcd02f36c..528195bddec1 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -594,7 +594,7 @@ pfsync_state_import(struct pfsync_state *sp, u_int8_t flags) if (!(flags & PFSYNC_SI_IOCTL)) st->state_flags |= PFSTATE_NOSYNC; - if ((error = pf_state_insert(kif, skw, sks, st)) != 0) + if ((error = pf_state_insert(kif, kif, skw, sks, st)) != 0) goto cleanup_state; /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */ diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 736d41203874..9eb8c2f54c42 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1263,8 +1263,8 @@ pf_state_key_clone(struct pf_state_key *orig) } int -pf_state_insert(struct pfi_kkif *kif, struct pf_state_key *skw, - struct pf_state_key *sks, struct pf_state *s) +pf_state_insert(struct pfi_kkif *kif, struct pfi_kkif *orig_kif, + struct pf_state_key *skw, struct pf_state_key *sks, struct pf_state *s) { struct pf_idhash *ih; struct pf_state *cur; @@ -1277,6 +1277,7 @@ pf_state_insert(struct pfi_kkif *kif, struct pf_state_key *skw, KASSERT(s->refs == 0, ("%s: state not pristine", __func__)); s->kif = kif; + s->orig_kif = orig_kif; if (s->id == 0 && s->creatorid == 0) { /* XXX: should be atomic, but probability of collision low */ @@ -3877,7 +3878,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, __func__, nr, sk, nk)); /* Swap sk/nk for PF_OUT. */ - if (pf_state_insert(BOUND_IFACE(r, kif), + if (pf_state_insert(BOUND_IFACE(r, kif), kif, (pd->dir == PF_IN) ? sk : nk, (pd->dir == PF_IN) ? nk : sk, s)) { if (pd->proto == IPPROTO_TCP) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 53423fb75202..4f7767773037 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2697,6 +2697,7 @@ pf_state_to_nvstate(const struct pf_state *s) nvlist_add_number(nvl, "id", s->id); nvlist_add_string(nvl, "ifname", s->kif->pfik_name); + nvlist_add_string(nvl, "orig_ifname", s->orig_kif->pfik_name); tmp = pf_state_key_to_nvstate_key(s->key[PF_SK_STACK]); if (tmp == NULL)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202105271020.14RAKP63055279>