pf: allow pflow to be activated per rule

[kp]

Summary

Only generate ipfix/netflow reports (through pflow) for the rules where
this is enabled. Reports can also be enabled globally through 'set
state-default pflow'.

Obtained from: OpenBSD
Sponsored by: Rubicon Communications, LLC ("Netgate")

sbin/pfctl/parse.y

struct node_icmp {
         struct node_icmp        *next;
         struct node_icmp        *tail;
 };
 
 enum    { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
             PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
             PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
             PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
-            PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
+            PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY,
+            PF_STATE_OPT_PFLOW };
 
 enum    { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
 
 struct node_state_opt {
         int                      type;
         union {
                 u_int32_t        max_states;
                 u_int32_t        max_src_states;

 %token  ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES L3
 %token  ETHER
 %token  BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET
 %token  ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME
 %token  UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL
 %token  DNPIPE DNQUEUE RIDENTIFIER
 %token  LOAD RULESET_OPTIMIZATION PRIO
 %token  STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
-%token  MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
+%token  MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW
 %token  TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
 %token  DIVERTTO DIVERTREPLY BRIDGE_TO
 %token  <v.string>                STRING
 %token  <v.number>                NUMBER
 %token  <v.i>                     PORTBINARY
 %type   <v.interface>             interface if_list if_item_not if_item
 %type   <v.number>                number icmptype icmp6type uid gid
 %type   <v.number>                tos not yesno optnodf
#endif
                                 case PF_STATE_OPT_SLOPPY:
                                         if (r.rule_flag & PFRULE_STATESLOPPY) {
                                                 yyerror("state sloppy option: "
                                                     "multiple definitions");
                                                 YYERROR;
                                         }
                                         r.rule_flag |= PFRULE_STATESLOPPY;
                                         break;
+                                case PF_STATE_OPT_PFLOW:
+                                        if (r.rule_flag & PFRULE_PFLOW) {
+                                                yyerror("state pflow option: "
+                                                    "multiple definitions");
+                                                YYERROR;
+                                        }
+                                        r.rule_flag |= PFRULE_PFLOW;
+                                        break;
                                 case PF_STATE_OPT_TIMEOUT:
                                         if (o->data.timeout.number ==
                                             PFTM_ADAPTIVE_START ||
                                             o->data.timeout.number ==
                                             PFTM_ADAPTIVE_END)
                                                 adaptive = 1;
                                         if (r.timeout[o->data.timeout.number]) {
                                                 yyerror("state timeout %s "
state_opt_item  : MAXIMUM NUMBER                {
                 | SLOPPY {
                         $$ = calloc(1, sizeof(struct node_state_opt));
                         if ($$ == NULL)
                                 err(1, "state_opt_item: calloc");
                         $$->type = PF_STATE_OPT_SLOPPY;
                         $$->next = NULL;
                         $$->tail = $$;
                 }
+                | PFLOW {
+                        $$ = calloc(1, sizeof(struct node_state_opt));
+                        if ($$ == NULL)
+                                err(1, "state_opt_item: calloc");
+                        $$->type = PF_STATE_OPT_PFLOW;
+                        $$->next = NULL;
+                        $$->tail = $$;
+                }
                 | STRING NUMBER                 {
                         int     i;
 
                         if ($2 < 0 || $2 > UINT_MAX) {
                                 yyerror("only positive values permitted");
                                 YYERROR;
                         }
                         for (i = 0; pf_timeouts[i].name &&
static const struct keywords keywords[] = {
                 { "no-route",         NOROUTE},
                 { "no-sync",          NOSYNC},
                 { "on",                       ON},
                 { "optimization",     OPTIMIZATION},
                 { "os",                       OS},
                 { "out",              OUT},
                 { "overload",         OVERLOAD},
                 { "pass",             PASS},
+                { "pflow",            PFLOW},
                 { "port",             PORT},
                 { "prio",             PRIO},
                 { "priority",         PRIORITY},
                 { "priq",             PRIQ},
                 { "probability",      PROBABILITY},
                 { "proto",            PROTO},
                 { "qlimit",           QLIMIT},
                 { "queue",            QUEUE},

sbin/pfctl/pf_print_state.c

if (opts & PF_OPT_VERBOSE) {
                 if (s->rule != -1)
                         printf(", rule %u", s->rule);
                 if (s->state_flags & PFSTATE_ALLOWOPTS)
                         printf(", allow-opts");
                 if (s->state_flags & PFSTATE_SLOPPY)
                         printf(", sloppy");
                 if (s->state_flags & PFSTATE_NOSYNC)
                         printf(", no-sync");
+                if (s->state_flags & PFSTATE_PFLOW)
+                        printf(", pflow");
                 if (s->state_flags & PFSTATE_ACK)
                         printf(", psync-ack");
                 if (s->state_flags & PFSTATE_NODF)
                         printf(", no-df");
                 if (s->state_flags & PFSTATE_SETTOS)
                         printf(", set-tos 0x%2.2x", s->set_tos);
                 if (s->state_flags & PFSTATE_RANDOMID)
                         printf(", random-id");