Page MenuHomeFreeBSD
Files F175516038

D60545.id189281.diff
No OneTemporary
Actions

D60545.id189281.diff
View Options

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -1345,22 +1345,24 @@
} while (0)
static void
-pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
+pf_hash_addr(MD5_CTX *ctx, struct pf_addr_wrap *addr)
{
- PF_MD5_UPD(pfr, addr.type);
- switch (pfr->addr.type) {
+ PF_MD5_UPD(addr, type);
+ switch (addr->type) {
case PF_ADDR_DYNIFTL:
- PF_MD5_UPD(pfr, addr.v.ifname);
- PF_MD5_UPD(pfr, addr.iflags);
+ PF_MD5_UPD(addr, v.ifname);
+ PF_MD5_UPD(addr, iflags);
+ /* The prefix length of the interface's addresses. */
+ PF_MD5_UPD(addr, v.a.mask.addr32);
break;
case PF_ADDR_TABLE:
- PF_MD5_UPD(pfr, addr.v.tblname);
+ PF_MD5_UPD(addr, v.tblname);
break;
case PF_ADDR_ADDRMASK:
case PF_ADDR_RANGE:
/* XXX ignore af? */
- PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
- PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
+ PF_MD5_UPD(addr, v.a.addr.addr32);
+ PF_MD5_UPD(addr, v.a.mask.addr32);
break;
case PF_ADDR_NONE:
case PF_ADDR_NOROUTE:
@@ -1368,8 +1370,14 @@
/* These do not use any address data. */
break;
default:
- panic("Unknown address type %d", pfr->addr.type);
+ panic("Unknown address type %d", addr->type);
}
+}
+
+static void
+pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
+{
+ pf_hash_addr(ctx, &pfr->addr);
PF_MD5_UPD(pfr, port[0]);
PF_MD5_UPD(pfr, port[1]);
@@ -1380,15 +1388,11 @@
static void
pf_hash_pool(MD5_CTX *ctx, struct pf_kpool *pool)
{
- struct pf_addr_wrap addr;
uint16_t x;
int y;
if (pool->cur) {
- /* Leave out the pointer to the kernel's dynaddr or table. */
- bcopy(&pool->cur->addr, &addr, sizeof(addr));
- bzero(&addr.p, sizeof(addr.p));
- MD5Update(ctx, (u_int8_t *)&addr, sizeof(addr));
+ pf_hash_addr(ctx, &pool->cur->addr);
PF_MD5_UPD_STR(pool, cur->ifname);
PF_MD5_UPD(pool, cur->af);
}
diff --git a/tests/sys/netpfil/pf/rules_counter.sh b/tests/sys/netpfil/pf/rules_counter.sh
--- a/tests/sys/netpfil/pf/rules_counter.sh
+++ b/tests/sys/netpfil/pf/rules_counter.sh
@@ -200,6 +200,58 @@
pft_cleanup
}
+atf_test_case "keepcounters_dynaddr" "cleanup"
+keepcounters_dynaddr_head()
+{
+ atf_set descr 'Test keepcounters for rules with interface addresses'
+ atf_set require.user root
+}
+
+keepcounters_dynaddr_body()
+{
+ pft_init
+
+ epair=$(vnet_mkepair)
+ ifconfig ${epair}a 192.0.2.1/24 up
+
+ vnet_mkjail alcatraz ${epair}b
+ jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
+ jexec alcatraz pfctl -e
+
+ pft_set_rules alcatraz \
+ "set keepcounters" \
+ "pass in on ${epair}b from (${epair}b)/24"
+
+ atf_check -s exit:0 -o ignore jexec alcatraz ping -c 1 192.0.2.1
+
+ atf_check -s exit:0 -e ignore \
+ -o match:'Evaluations: [1-9]' \
+ jexec alcatraz pfctl -s r -v
+
+ # The same rule again keeps its counters
+ pft_set_rules noflush alcatraz \
+ "set keepcounters" \
+ "pass in on ${epair}b from (${epair}b)/24"
+
+ atf_check -s exit:0 -e ignore \
+ -o match:'Evaluations: [1-9]' \
+ jexec alcatraz pfctl -s r -v
+
+ # Another prefix length makes it a different rule
+ pft_set_rules noflush alcatraz \
+ "set keepcounters" \
+ "pass in on ${epair}b from (${epair}b)/25"
+
+ atf_check -s exit:0 -e ignore \
+ -o match:'Evaluations: 0[[:space:]]' \
+ jexec alcatraz pfctl -s r -v
+}
+
+keepcounters_dynaddr_cleanup()
+{
+ pft_cleanup
+}
+
atf_test_case "4G" "cleanup"
4G_head()
{
@@ -259,5 +311,6 @@
atf_add_test_case "get_clear"
atf_add_test_case "keepcounters"
atf_add_test_case "keepcounters_pool"
+ atf_add_test_case "keepcounters_dynaddr"
atf_add_test_case "4G"
}

File Metadata

Mime Type
text/plain
Expires
Mon, Oct 12, 9:29 AM (23 m, 15 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
40571902
Default Alt Text
D60545.id189281.diff (3 KB)

Event Timeline