From nobody Fri Jan 24 15:48:13 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Yfhzd6Pdgz5lZS4; Fri, 24 Jan 2025 15:48:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Yfhzd5jFnz4688; Fri, 24 Jan 2025 15:48:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737733693; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yt7WnfR01VyREjI5XnE+ehbJJfBCRFYbQK6lxP0ZRUU=; b=sBCILoR4A4OZP5UwTGh3rwO94BpQVQ1sdjo/2TZzCU3HcQw/eZ9ela0fakhurcmd7j9VLy Z+iYlszQlgDQRYRUTPLp9lsJwe5XIZXD3T7FwzZCSPWZhalPimVlxqA/NtTrgSLhZlP6Bm meZwJ9vmJGTIsrkTenQTFcDGPADjITNXNi8wm1oA5KNQa5EC1jseQ/GSrC+A04CJD5ilYJ SKi+a9HOEEQQI4xwsD0ul7AQC7S5EpqklPmu58DJH6OquZ2oEMFA6pBopL2ZpVDO3Hktva IxTpTtPTEcE0uhOcfEam7YVW65hr4cGrk24el/FFxPJg7F8yycLWkPZKsvrIHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737733693; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yt7WnfR01VyREjI5XnE+ehbJJfBCRFYbQK6lxP0ZRUU=; b=L6iD5hUk0lxWJqmwnNcIqZYyebDTmFCS8r1K+1YqmzcTBTgObEnqKxeeqVYb4q7rWPePib oaz38MOytc8L3iMMj2zKg+8jy2vLfQE9XiXFGk6nyR29G1RGJf1pqnygFM1Fq5A2/tod2N EuBRX6EAw8pXrGAsgYz0ZwhbBBJ4GSVKx7snvtsRVSlZyDwKw0LN/qsunz/j8VqUts5hcb hoLKFrBVRZ8lUysKQkcftIkpRCZj1rEJa4z4zdkbBWgYU0h6UWzEYqvyb32FKmv8gevAwk a1H9MjZ2K/ZZid7CNEW/dL60slhltTXZxjR0w0SFdDSGev1GFuMCGe2bAU+nDw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1737733693; a=rsa-sha256; cv=none; b=uleEbuMzFCvYbn72RzWjK8dpL8AQSXEovuWXcR8E8XgU0tEEJyxhDdNtMavWnfzW+BVZgJ uhsTT7iL4Rtl/epLS6btklozg4fV+VFcx0zNMUalPm2GA3gFoZads9Ne2SBDtJYUiQQKPq i+n72JmWRlC2bIwComd9SbL5HDFehmIes+H0dj0yoSldQondtfIL9sGk03xzsVoieM5qGR FVleQvfd8AS+d3vejuUplrBOm8E3+lHh8WtaRYqe6E5IubKCcWWT19QhNBu8q3dxPFa1tO NddXQmajVNSK2eOpKy3fZHpS6PBIS/EWa1x9OPOcPP0UcCz5hz+0Z1NIlcIFjQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Yfhzd4p0bzXRv; Fri, 24 Jan 2025 15:48:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50OFmD4e038987; Fri, 24 Jan 2025 15:48:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50OFmDYF038984; Fri, 24 Jan 2025 15:48:13 GMT (envelope-from git) Date: Fri, 24 Jan 2025 15:48:13 GMT Message-Id: <202501241548.50OFmDYF038984@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Zhenlei Huang Subject: git: 3965be101c43 - stable/14 - pf: Convert PF_DEFAULT_TO_DROP into a vnet loader tunable 'net.pf.default_to_drop' List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 3965be101c434437ce8819250e9e6b3e5c3d702e Auto-Submitted: auto-generated The branch stable/14 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=3965be101c434437ce8819250e9e6b3e5c3d702e commit 3965be101c434437ce8819250e9e6b3e5c3d702e Author: Zhenlei Huang AuthorDate: 2023-09-22 10:05:02 +0000 Commit: Zhenlei Huang CommitDate: 2025-01-24 15:46:20 +0000 pf: Convert PF_DEFAULT_TO_DROP into a vnet loader tunable 'net.pf.default_to_drop' 7f7ef494f11d introduced a compile time option PF_DEFAULT_TO_DROP to make the pf(4) default rule to drop. While this change exposes a vnet loader tunable 'net.pf.default_to_drop' so that users can change the default rule without re-compiling the pf(4) module. This change is similiar to that for IPFW [1]. 1. 5f17ebf94db5 Convert IPFW_DEFAULT_TO_ACCEPT into a loader tunable 'net.inet.ip.fw.default_to_accept' Reviewed by: #network, kp MFC after: 2 weeks Relnotes: yes Differential Revision: https://reviews.freebsd.org/D39866 (cherry picked from commit c531c1d1462c45f7ce5de4f9913226801f3073bd) --- share/man/man4/pf.4 | 4 ++++ sys/netpfil/pf/pf_ioctl.c | 16 +++++++++++----- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/share/man/man4/pf.4 b/share/man/man4/pf.4 index 4938e719b17e..cd87b98ea45d 100644 --- a/share/man/man4/pf.4 +++ b/share/man/man4/pf.4 @@ -87,6 +87,10 @@ Default value is 131072. Size of hash table that store source nodes. Should be power of 2. Default value is 32768. +.It Va net.pf.default_to_drop +This value overrides +.Cd "options PF_DEFAULT_TO_DROP" +from kernel configuration file. .It Va net.pf.rdr_srcport_rewrite_tries The maximum number of times to try and find a free source port when handling redirects. diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 6cb7bc95df2b..e67a0ddadfb7 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -199,6 +199,16 @@ SYSCTL_BOOL(_net_pf, OID_AUTO, filter_local, CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(pf_filter_local), false, "Enable filtering for packets delivered to local network stack"); +#ifdef PF_DEFAULT_TO_DROP +VNET_DEFINE_STATIC(bool, default_to_drop) = true; +#else +VNET_DEFINE_STATIC(bool, default_to_drop); +#endif +#define V_default_to_drop VNET(default_to_drop) +SYSCTL_BOOL(_net_pf, OID_AUTO, default_to_drop, CTLFLAG_RDTUN | CTLFLAG_VNET, + &VNET_NAME(default_to_drop), false, + "Make the default rule drop all packets."); + static void pf_init_tagset(struct pf_tagset *, unsigned int *, unsigned int); static void pf_cleanup_tagset(struct pf_tagset *); @@ -335,11 +345,7 @@ pfattach_vnet(void) /* default rule should never be garbage collected */ V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next; -#ifdef PF_DEFAULT_TO_DROP - V_pf_default_rule.action = PF_DROP; -#else - V_pf_default_rule.action = PF_PASS; -#endif + V_pf_default_rule.action = V_default_to_drop ? PF_DROP : PF_PASS; V_pf_default_rule.nr = -1; V_pf_default_rule.rtableid = -1;