From a5a03901798c76f1f7c77535a2282a60f54b0ec2 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Thu, 15 Apr 2021 16:12:11 +0200 Subject: [PATCH] pf: Optionally attempt to preserve rule counter values across ruleset updates Usually rule counters are reset to zero on every update of the ruleset. With keepcounters set pf will attempt to find matching rules between old and new rulesets and preserve the rule counters. MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29780 (cherry picked from commit 42ec75f83aa321fcea8d2eddc4e9099724f0669e) --- lib/libpfctl/libpfctl.c | 22 +++++++++++ lib/libpfctl/libpfctl.h | 1 + sbin/pfctl/parse.y | 6 ++- sbin/pfctl/pfctl.c | 4 ++ sbin/pfctl/pfctl_parser.h | 1 + share/man/man5/pf.conf.5 | 12 +++++- sys/net/pfvar.h | 3 ++ sys/netpfil/pf/pf_ioctl.c | 81 ++++++++++++++++++++++++++++++++++++++- 8 files changed, 126 insertions(+), 4 deletions(-) diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c index c2147e1b04c..b07fcda9bd5 100644 --- a/lib/libpfctl/libpfctl.c +++ b/lib/libpfctl/libpfctl.c @@ -586,3 +586,25 @@ int pfctl_get_clear_rule(int dev, u_int32_t nr, u_int32_t ticket, return (0); } + +int +pfctl_set_keepcounters(int dev, bool keep) +{ + struct pfioc_nv nv; + nvlist_t *nvl; + int ret; + + nvl = nvlist_create(0); + + nvlist_add_bool(nvl, "keep_counters", keep); + + nv.data = nvlist_pack(nvl, &nv.len); + nv.size = nv.len; + + nvlist_destroy(nvl); + + ret = ioctl(dev, DIOCKEEPCOUNTERS, &nv); + + free(nv.data); + return (ret); +} diff --git a/lib/libpfctl/libpfctl.h b/lib/libpfctl/libpfctl.h index 0f4f5c90873..e19187fc252 100644 --- a/lib/libpfctl/libpfctl.h +++ b/lib/libpfctl/libpfctl.h @@ -188,5 +188,6 @@ int pfctl_get_clear_rule(int dev, u_int32_t nr, u_int32_t ticket, int pfctl_add_rule(int dev, const struct pfctl_rule *r, const char *anchor, const char *anchor_call, u_int32_t ticket, u_int32_t pool_ticket); +int pfctl_set_keepcounters(int dev, bool keep); #endif diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 0d0f6fea76b..903bbd47d66 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -464,7 +464,7 @@ int parseport(char *, struct range *r, int); %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY %token RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID -%token ANTISPOOF FOR INCLUDE +%token ANTISPOOF FOR INCLUDE KEEPCOUNTERS %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL @@ -722,6 +722,9 @@ option : SET OPTIMIZATION STRING { } keep_state_defaults = $3; } + | SET KEEPCOUNTERS { + pf->keep_counters = true; + } ; stringall : STRING { $$ = $1; } @@ -5591,6 +5594,7 @@ lookup(char *s) { "inet6", INET6}, { "interval", INTERVAL}, { "keep", KEEP}, + { "keepcounters", KEEPCOUNTERS}, { "label", LABEL}, { "limit", LIMIT}, { "linkshare", LINKSHARE}, diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 8fa8ef44813..af2ae6fe3bf 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -1753,6 +1753,10 @@ pfctl_load_options(struct pfctl *pf) if (pfctl_load_hostid(pf, pf->hostid)) error = 1; + /* load keepcounters */ + if (pfctl_set_keepcounters(pf->dev, pf->keep_counters)) + error = 1; + return (error); } diff --git a/sbin/pfctl/pfctl_parser.h b/sbin/pfctl/pfctl_parser.h index 43d8488dcab..0c66d5dda97 100644 --- a/sbin/pfctl/pfctl_parser.h +++ b/sbin/pfctl/pfctl_parser.h @@ -98,6 +98,7 @@ struct pfctl { u_int32_t debug; u_int32_t hostid; char *ifname; + bool keep_counters; u_int8_t timeout_set[PFTM_MAX]; u_int8_t limit_set[PF_LIMIT_MAX]; diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index 86870319df2..ca0f0da0204 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -28,7 +28,7 @@ .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd March 10, 2019 +.Dd April 19, 2021 .Dt PF.CONF 5 .Os .Sh NAME @@ -619,6 +619,13 @@ Generate debug messages for various errors. .It Ar loud Generate debug messages for common conditions. .El +.It Ar set keepcounters +Preserve rule counters across rule updates. +Usually rule counters are reset to zero on every update of the ruleset. +With +.Ar keepcounters +set pf will attempt to find matching rules between old and new rulesets +and preserve the rule counters. .El .Sh TRAFFIC NORMALIZATION Traffic normalization is used to sanitize packet content in such @@ -2889,7 +2896,8 @@ option = "set" ( [ "timeout" ( timeout | "{" timeout-list "}" ) ] | [ "require-order" ( "yes" | "no" ) ] [ "fingerprints" filename ] | [ "skip on" ifspec ] | - [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] ) + [ "debug" ( "none" | "urgent" | "misc" | "loud" ) ] + [ "keepcounters" ] ) pf-rule = action [ ( "in" | "out" ) ] [ "log" [ "(" logopts ")"] ] [ "quick" ] diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 6101f5f0ff5..dd69713d857 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -994,6 +994,7 @@ struct pf_kstatus { uint32_t hostid; char ifname[IFNAMSIZ]; uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; + bool keep_counters; }; struct pf_divert { @@ -1303,6 +1304,8 @@ struct pfioc_iface { #define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface) #define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface) #define DIOCKILLSRCNODES _IOWR('D', 91, struct pfioc_src_node_kill) +#define DIOCKEEPCOUNTERS _IOWR('D', 92, struct pfioc_nv) + struct pf_ifspeed_v0 { char ifname[IFNAMSIZ]; u_int32_t baudrate; diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index dd57d4ac5c0..4cedaba6050 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -197,6 +197,7 @@ static void pf_clear_states(void); static int pf_clear_tables(void); static void pf_clear_srcnodes(struct pf_ksrc_node *); static void pf_kill_srcnodes(struct pfioc_src_node_kill *); +static int pf_keepcounters(struct pfioc_nv *); static void pf_tbladdr_copyout(struct pf_addr_wrap *); /* @@ -1023,11 +1024,27 @@ pf_hash_rule(MD5_CTX *ctx, struct pf_krule *rule) PF_MD5_UPD(rule, tos); } +static bool +pf_krule_compare(struct pf_krule *a, struct pf_krule *b) +{ + MD5_CTX ctx[2]; + u_int8_t digest[2][PF_MD5_DIGEST_LENGTH]; + + MD5Init(&ctx[0]); + MD5Init(&ctx[1]); + pf_hash_rule(&ctx[0], a); + pf_hash_rule(&ctx[1], b); + MD5Final(digest[0], &ctx[0]); + MD5Final(digest[1], &ctx[1]); + + return (memcmp(digest[0], digest[1], PF_MD5_DIGEST_LENGTH) == 0); +} + static int pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) { struct pf_kruleset *rs; - struct pf_krule *rule, **old_array; + struct pf_krule *rule, **old_array, *tail; struct pf_krulequeue *old_rules; int error; u_int32_t old_rcount; @@ -1059,6 +1076,29 @@ pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) rs->rules[rs_num].inactive.ptr_array; rs->rules[rs_num].active.rcount = rs->rules[rs_num].inactive.rcount; + + /* Attempt to preserve counter information. */ + if (V_pf_status.keep_counters) { + TAILQ_FOREACH(rule, rs->rules[rs_num].active.ptr, + entries) { + tail = TAILQ_FIRST(old_rules); + while ((tail != NULL) && ! pf_krule_compare(tail, rule)) + tail = TAILQ_NEXT(tail, entries); + if (tail != NULL) { + counter_u64_add(rule->evaluations, + counter_u64_fetch(tail->evaluations)); + counter_u64_add(rule->packets[0], + counter_u64_fetch(tail->packets[0])); + counter_u64_add(rule->packets[1], + counter_u64_fetch(tail->packets[1])); + counter_u64_add(rule->bytes[0], + counter_u64_fetch(tail->bytes[0])); + counter_u64_add(rule->bytes[1], + counter_u64_fetch(tail->bytes[1])); + } + } + } + rs->rules[rs_num].inactive.ptr = old_rules; rs->rules[rs_num].inactive.ptr_array = old_array; rs->rules[rs_num].inactive.rcount = old_rcount; @@ -5022,6 +5062,10 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td pf_kill_srcnodes((struct pfioc_src_node_kill *)addr); break; + case DIOCKEEPCOUNTERS: + error = pf_keepcounters((struct pfioc_nv *)addr); + break; + case DIOCSETHOSTID: { u_int32_t *hostid = (u_int32_t *)addr; @@ -5301,6 +5345,41 @@ pf_kill_srcnodes(struct pfioc_src_node_kill *psnk) psnk->psnk_killed = pf_free_src_nodes(&kill); } +static int +pf_keepcounters(struct pfioc_nv *nv) +{ + nvlist_t *nvl = NULL; + void *nvlpacked = NULL; + int error = 0; + +#define ERROUT(x) do { error = (x); goto on_error; } while (0) + + if (nv->len > pf_ioctl_maxcount) + ERROUT(ENOMEM); + + nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); + if (nvlpacked == NULL) + ERROUT(ENOMEM); + + error = copyin(nv->data, nvlpacked, nv->len); + if (error) + ERROUT(error); + + nvl = nvlist_unpack(nvlpacked, nv->len, 0); + if (nvl == NULL) + ERROUT(EBADMSG); + + if (! nvlist_exists_bool(nvl, "keep_counters")) + ERROUT(EBADMSG); + + V_pf_status.keep_counters = nvlist_get_bool(nvl, "keep_counters"); + +on_error: + nvlist_destroy(nvl); + free(nvlpacked, M_TEMP); + return (error); +} + /* * XXX - Check for version missmatch!!! */ -- 2.45.0