From nobody Fri Jan 17 12:06:16 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YZJNn1452z5ksZS; Fri, 17 Jan 2025 12:06:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YZJNm3M7yz3QTG; Fri, 17 Jan 2025 12:06:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737115576; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wNyAKwwcQRVjoIWzoTQ0foTrVqPVY0YFK79bqD0/noM=; b=vjRFXpCbCUOYCZMHbc86dadhkZ0+Q6sBSfbM1udqKqGG+yMd/uuf26EAf6C/CQaWjAut0j ruXx53VMnErktk42PA6hRxYLAGQ++RGzs+6koutR67hsgQlo+7cHRtLV88+sTp/Sb/ru9P BZJu035RAFEMXocJR4XbYkV3U/8CmB8oLLgIPoCyV5KZd37dpuoBPuWkrKm4qX9RlLRn3L YV5LU3lTZG82+dqAOuyQMx4KR0RVK5wdodIvaQQe+6tEMUuGEugYBVuiYz+H3ytInB1TXz YP3CBtoQxDuvQvEGlJYq28lJMGT2BoaV/ny+f91vl+nZwV/bLd+TEgZKYXg89w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737115576; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=wNyAKwwcQRVjoIWzoTQ0foTrVqPVY0YFK79bqD0/noM=; b=Z/RWfKwmGEI8vEhyAvy8QbvhXr1oKQZuzKp5iBk1QQnU/+WpfhxfnNFD1IZo6tdyxd23rO u205HqcYNcnCL/yOjPiO6TkDKEzcz1M0RVEt1LqmYl2byanawKwfaF6sEUzFBVhbwXAyFv +wDbxdBLTez1pLtQVshaB5A7GcXcxjSw/5Qc5V/0PKlVkSTu545iDFJA9q+mBppVjTvwCf R5T9E+0p1Vi0yTgoZQe9lzC2WHipVk3f73EOuvWUuFgflLsYACVs+uTtWW0JpjnHaTtyka WZ5FhbxXBBofLPNcU2Rq+T6Z+22iS/+DklIXFXvnvv56iG+rbTJGpRyQqRH9Ww== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1737115576; a=rsa-sha256; cv=none; b=ZAOKG7jp0q4aFFwuiR1GXAdjAxVBdWbeoSZ/xPiayKdr5dNQ1zZNmjdfgWzuEF/zg5HMid ttx5yrK8QWUKaJibRprhhDeyj+SonB2M7Kzaq0Tt4mUZuPwri5alFeGRNm1+lAf4dy6k2C L/sriaeQw6pTSyLjbOGEvS3oOUwGS0ysxcggz0xzGa2rYciqLlH0QjWselPUsW4RExDT5f LyjqYSWNL4K2uKCzvxvhu8dHD/C8NRqLnUjsQ0JKqg6V8/zna3YhZEKNvJgEL7VpEXjace VP2WKTulwJZWHovukWcxnBPn25nValUEHs3Wd8+8ltPoBrbDvtlLsFURGQqrNQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YZJNm1knBz2Vj; Fri, 17 Jan 2025 12:06:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50HC6GdA015421; Fri, 17 Jan 2025 12:06:16 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50HC6GoX015418; Fri, 17 Jan 2025 12:06:16 GMT (envelope-from git) Date: Fri, 17 Jan 2025 12:06:16 GMT Message-Id: <202501171206.50HC6GoX015418@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: e4f2733df8c9 - main - pf: add 'allow-related' to always allow SCTP multihome extra connections List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e4f2733df8c9d2fd0c5e8fdc8bec002bf39811f3 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=e4f2733df8c9d2fd0c5e8fdc8bec002bf39811f3 commit e4f2733df8c9d2fd0c5e8fdc8bec002bf39811f3 Author: Kristof Provost AuthorDate: 2025-01-09 20:28:46 +0000 Commit: Kristof Provost CommitDate: 2025-01-17 08:41:25 +0000 pf: add 'allow-related' to always allow SCTP multihome extra connections Allow users to choose to allow permitted SCTP connections to set up additional multihomed connections regardless of the ruleset. That is, allow an already established connection to set up flows that would otherwise be disallowed. In case of if-bound connections we initially set the extra associations to be floating, because we don't know what path they'll be taking when they're created. Once we see the first traffic we can bind them. MFC after: 2 weeks Sponsored by: Orange Business Services Differential Revision: https://reviews.freebsd.org/D48453 --- sbin/pfctl/parse.y | 21 ++++++++++-- share/man/man5/pf.conf.5 | 6 +++- sys/net/pfvar.h | 1 + sys/netpfil/pf/pf.c | 24 ++++++++++++++ sys/netpfil/pf/pf.h | 1 + tests/sys/netpfil/pf/sctp.py | 76 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 126 insertions(+), 3 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index ff2e2d2c93b7..4a7bd3125372 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -173,7 +173,7 @@ enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, - PF_STATE_OPT_PFLOW }; + PF_STATE_OPT_PFLOW, PF_STATE_OPT_ALLOW_RELATED }; enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; @@ -526,7 +526,7 @@ int parseport(char *, struct range *r, int); %token DNPIPE DNQUEUE RIDENTIFIER %token LOAD RULESET_OPTIMIZATION PRIO %token STICKYADDRESS ENDPI MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE -%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW +%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW ALLOW_RELATED %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS %token DIVERTTO DIVERTREPLY BRIDGE_TO RECEIVEDON NE LE GE AFTO %token STRING @@ -2648,6 +2648,14 @@ pfrule : action dir logquick interface route af proto fromto } r.rule_flag |= PFRULE_PFLOW; break; + case PF_STATE_OPT_ALLOW_RELATED: + if (r.rule_flag & PFRULE_ALLOW_RELATED) { + yyerror("state allow-related option: " + "multiple definitions"); + YYERROR; + } + r.rule_flag |= PFRULE_ALLOW_RELATED; + break; case PF_STATE_OPT_TIMEOUT: if (o->data.timeout.number == PFTM_ADAPTIVE_START || @@ -4490,6 +4498,14 @@ state_opt_item : MAXIMUM NUMBER { $$->next = NULL; $$->tail = $$; } + | ALLOW_RELATED { + $$ = calloc(1, sizeof(struct node_state_opt)); + if ($$ == NULL) + err(1, "state_opt_item: calloc"); + $$->type = PF_STATE_OPT_ALLOW_RELATED; + $$->next = NULL; + $$->tail = $$; + } | STRING NUMBER { int i; @@ -6432,6 +6448,7 @@ lookup(char *s) { "af-to", AFTO}, { "all", ALL}, { "allow-opts", ALLOWOPTS}, + { "allow-related", ALLOW_RELATED}, { "altq", ALTQ}, { "anchor", ANCHOR}, { "antispoof", ANTISPOOF}, diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index 7e2c96c07473..a517015b5ff8 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -27,7 +27,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd January 9, 2025 +.Dd January 10, 2025 .Dt PF.CONF 5 .Os .Sh NAME @@ -2513,6 +2513,10 @@ Cannot be used with modulate or synproxy state. States created by this rule are exported on the .Xr pflow 4 interface. +.It Ar allow-related +Automatically allow connections related to this one, regardless of rules that +might otherwise affect them. +This currently only applies to SCTP multihomed connection. .El .Pp Multiple options can be specified, separated by commas: diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 3f109d31ccde..6c9d75bb1365 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1660,6 +1660,7 @@ struct pf_pdesc { #define PFDESC_SCTP_ADD_IP 0x1000 u_int16_t sctp_flags; u_int32_t sctp_initiate_tag; + struct pf_krule *related_rule; struct pf_sctp_multihome_jobs sctp_multihome_jobs; }; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 7b0ee24965b9..07b7aa543dbd 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -464,6 +464,14 @@ BOUND_IFACE(struct pf_kstate *st, struct pf_pdesc *pd) if (st->rule->rt == PF_REPLYTO || (pd->af != pd->naf)) return (V_pfi_all); + /* + * If this state is created based on another state (e.g. SCTP + * multihome) always set it floating initially. We can't know for sure + * what interface the actual traffic for this state will come in on. + */ + if (pd->related_rule) + return (V_pfi_all); + /* Don't overrule the interface for states created on incoming packets. */ if (st->direction == PF_IN) return (k); @@ -5702,6 +5710,10 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, } while (r != NULL) { + if (pd->related_rule) { + *rm = pd->related_rule; + break; + } pf_counter_u64_add(&r->evaluations, 1); PF_TEST_ATTRIB(pfi_kkif_match(r->kif, pd->kif) == r->ifnot, r->skip[PF_SKIP_IFP]); @@ -7165,6 +7177,15 @@ pf_test_state_sctp(struct pf_kstate **state, struct pf_pdesc *pd, dst->scrub->pfss_v_tag = pd->sctp_initiate_tag; } + /* + * Bind to the correct interface if we're if-bound. For multihomed + * extra associations we don't know which interface that will be until + * here, so we've inserted the state on V_pf_all. Fix that now. + */ + if ((*state)->kif == V_pfi_all && + (*state)->rule->rule_flag & PFRULE_IFBOUND) + (*state)->kif = pd->kif; + if (pd->sctp_flags & (PFDESC_SCTP_COOKIE | PFDESC_SCTP_HEARTBEAT_ACK)) { if (src->state < SCTP_ESTABLISHED) { pf_set_protostate(*state, psrc, SCTP_ESTABLISHED); @@ -7378,6 +7399,9 @@ again: j->pd.sctp_flags |= PFDESC_SCTP_ADD_IP; PF_RULES_RLOCK(); sm = NULL; + if (s->rule->rule_flag & PFRULE_ALLOW_RELATED) { + j->pd.related_rule = s->rule; + } ret = pf_test_rule(&r, &sm, &j->pd, &ra, &rs, NULL); PF_RULES_RUNLOCK(); diff --git a/sys/netpfil/pf/pf.h b/sys/netpfil/pf/pf.h index 10431d9b77d9..5de85c1fe7ef 100644 --- a/sys/netpfil/pf/pf.h +++ b/sys/netpfil/pf/pf.h @@ -617,6 +617,7 @@ struct pf_rule { #define PFRULE_IFBOUND 0x00010000 /* if-bound */ #define PFRULE_STATESLOPPY 0x00020000 /* sloppy state tracking */ #define PFRULE_PFLOW 0x00040000 +#define PFRULE_ALLOW_RELATED 0x00080000 #define PFRULE_AFTO 0x00200000 /* af-to rule */ #ifdef _KERNEL diff --git a/tests/sys/netpfil/pf/sctp.py b/tests/sys/netpfil/pf/sctp.py index 38bb9f2dff74..230dbae0d327 100644 --- a/tests/sys/netpfil/pf/sctp.py +++ b/tests/sys/netpfil/pf/sctp.py @@ -426,6 +426,82 @@ class TestSCTP(VnetTestTemplate): assert re.search(r"all sctp 192.0.2.4:.*192.0.2.3:1234", states) assert re.search(r"all sctp 192.0.2.4:.*192.0.2.2:1234", states) + @pytest.mark.require_user("root") + def test_disallow_related(self): + srv_vnet = self.vnet_map["vnet2"] + + ToolsHelper.print_output("/sbin/pfctl -e") + ToolsHelper.pf_rules([ + "block proto sctp", + "pass inet proto sctp to 192.0.2.3", + "pass on lo"]) + + # Sanity check, we can communicate with the primary address. + client = SCTPClient("192.0.2.3", 1234) + client.send(b"hello", 0) + rcvd = self.wait_object(srv_vnet.pipe) + print(rcvd) + assert rcvd['ppid'] == 0 + assert rcvd['data'] == "hello" + + # This shouldn't work + success=False + try: + client.newpeer("192.0.2.2") + client.send(b"world", 0) + rcvd = self.wait_object(srv_vnet.pipe) + print(rcvd) + assert rcvd['ppid'] == 0 + assert rcvd['data'] == "world" + success=True + except: + success=False + assert not success + + # Check that we have a state for 192.0.2.3, but not 192.0.2.2 to 192.0.2.1 + states = ToolsHelper.get_output("/sbin/pfctl -ss") + assert re.search(r"all sctp 192.0.2.1:.*192.0.2.3:1234", states) + assert not re.search(r"all sctp 192.0.2.1:.*192.0.2.2:1234", states) + + @pytest.mark.require_user("root") + def test_allow_related(self): + srv_vnet = self.vnet_map["vnet2"] + + ToolsHelper.print_output("/sbin/pfctl -e") + ToolsHelper.pf_rules([ + "set state-policy if-bound", + "block proto sctp", + "pass inet proto sctp to 192.0.2.3 keep state (allow-related)", + "pass on lo"]) + + # Sanity check, we can communicate with the primary address. + client = SCTPClient("192.0.2.3", 1234) + client.send(b"hello", 0) + rcvd = self.wait_object(srv_vnet.pipe) + print(rcvd) + assert rcvd['ppid'] == 0 + assert rcvd['data'] == "hello" + + success=False + try: + client.newpeer("192.0.2.2") + client.send(b"world", 0) + rcvd = self.wait_object(srv_vnet.pipe) + print(rcvd) + assert rcvd['ppid'] == 0 + assert rcvd['data'] == "world" + success=True + finally: + # Debug output + ToolsHelper.print_output("/sbin/pfctl -ss") + ToolsHelper.print_output("/sbin/pfctl -sr -vv") + assert success + + # Check that we have a state for 192.0.2.3 and 192.0.2.2 to 192.0.2.1 + states = ToolsHelper.get_output("/sbin/pfctl -ss") + assert re.search(r"epair.*sctp 192.0.2.1:.*192.0.2.3:1234", states) + assert re.search(r"epair.*sctp 192.0.2.1:.*192.0.2.2:1234", states) + class TestSCTPv6(VnetTestTemplate): REQUIRED_MODULES = ["sctp", "pf"] TOPOLOGY = {