From owner-freebsd-pf@FreeBSD.ORG Mon Jan 31 11:07:06 2011 Return-Path: Delivered-To: freebsd-pf@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 72B1B10656A3 for ; Mon, 31 Jan 2011 11:07:06 +0000 (UTC) (envelope-from owner-bugmaster@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 61F078FC15 for ; Mon, 31 Jan 2011 11:07:06 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p0VB76xv091845 for ; Mon, 31 Jan 2011 11:07:06 GMT (envelope-from owner-bugmaster@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p0VB75Wp091843 for freebsd-pf@FreeBSD.org; Mon, 31 Jan 2011 11:07:05 GMT (envelope-from owner-bugmaster@FreeBSD.org) Date: Mon, 31 Jan 2011 11:07:05 GMT Message-Id: <201101311107.p0VB75Wp091843@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: gnats set sender to owner-bugmaster@FreeBSD.org using -f From: FreeBSD bugmaster To: freebsd-pf@FreeBSD.org Cc: Subject: Current problem reports assigned to freebsd-pf@FreeBSD.org X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 11:07:06 -0000 Note: to view an individual PR, use: http://www.freebsd.org/cgi/query-pr.cgi?pr=(number). The following is a listing of current problems submitted by FreeBSD users. These represent problem reports covering all versions including experimental development code and obsolete releases. S Tracker Resp. Description -------------------------------------------------------------------------------- o kern/153307 pf [pf] Bug with PF firewall o kern/148290 pf [pf] "sticky-address" option of Packet Filter (PF) blo o kern/148260 pf [pf] [patch] pf rdr incompatible with dummynet o kern/147789 pf [pf] Firewall PF no longer drops connections by sendin o kern/146832 pf [pf] "(self)" not always matching all local IPv6 addre o kern/143543 pf [pf] [panic] PF route-to causes kernel panic o bin/143504 pf [patch] outgoing states are not killed by authpf(8) o conf/142961 pf [pf] No way to adjust pidfile in pflogd o conf/142817 pf [patch] etc/rc.d/pf: silence pfctl o kern/141905 pf [pf] [panic] pf kernel panic on 7.2-RELEASE with empty o kern/140697 pf [pf] pf behaviour changes - must be documented o kern/137982 pf [pf] when pf can hit state limits, random IP failures o kern/136781 pf [pf] Packets appear to drop with pf scrub and if_bridg o kern/135948 pf [pf] [gre] pf not natting gre protocol o kern/135162 pf [pfsync] pfsync(4) not usable with GENERIC kernel o kern/134996 pf [pf] Anchor tables not included when pfctl(8) is run w o kern/133732 pf [pf] max-src-conn issue o kern/132769 pf [pf] [lor] 2 LOR's with pf task mtx / ifnet and rtent f kern/132176 pf [pf] pf stalls connection when using route-to [regress o conf/130381 pf [rc.d] [pf] [ip6] ipv6 not fully configured when pf st o kern/129861 pf [pf] [patch] Argument names reversed in pf_table.c:_co o kern/127920 pf [pf] ipv6 and synproxy don't play well together o conf/127814 pf [pf] The flush in pf_reload in /etc/rc.d/pf does not w o kern/127439 pf [pf] deadlock in pf f kern/127345 pf [pf] Problem with PF on FreeBSD7.0 [regression] o kern/127121 pf [pf] [patch] pf incorrect log priority o kern/127042 pf [pf] [patch] pf recursion panic if interface group is o kern/125467 pf [pf] pf keep state bug while handling sessions between s kern/124933 pf [pf] [ip6] pf does not support (drops) IPv6 fragmented o kern/124364 pf [pf] [panic] Kernel panic with pf + bridge o kern/122773 pf [pf] pf doesn't log uid or pid when configured to o kern/122014 pf [pf] [panic] FreeBSD 6.2 panic in pf o kern/120281 pf [pf] [request] lost returning packets to PF for a rdr o kern/120057 pf [pf] [patch] Allow proper settings of ALTQ_HFSC. The c o bin/118355 pf [pf] [patch] pfctl(8) help message options order false o kern/114567 pf [pf] [lor] pf_ioctl.c + if.c o kern/114095 pf [carp] carp+pf delay with high state limit o kern/111220 pf [pf] repeatable hangs while manipulating pf tables s conf/110838 pf [pf] tagged parameter on nat not working on FreeBSD 5. o kern/103283 pf pfsync fails to sucessfully transfer some sessions o kern/103281 pf pfsync reports bulk update failures o kern/93825 pf [pf] pf reply-to doesn't work o sparc/93530 pf [pf] Incorrect checksums when using pf's route-to on s o kern/92949 pf [pf] PF + ALTQ problems with latency o bin/86635 pf [patch] pfctl(8): allow new page character (^L) in pf. o kern/82271 pf [pf] cbq scheduler cause bad latency 46 problems total. From owner-freebsd-pf@FreeBSD.ORG Mon Jan 31 11:22:36 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 282131065670 for ; Mon, 31 Jan 2011 11:22:36 +0000 (UTC) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (106-30.3-213.fix.bluewin.ch [213.3.30.106]) by mx1.freebsd.org (Postfix) with ESMTP id B59EA8FC0A for ; Mon, 31 Jan 2011 11:22:34 +0000 (UTC) Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1]) by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id p0VB6aXP016462 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO); Mon, 31 Jan 2011 12:06:36 +0100 (MET) Received: (from dhartmei@localhost) by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id p0VB6ZZ6010367; Mon, 31 Jan 2011 12:06:35 +0100 (MET) Date: Mon, 31 Jan 2011 12:06:35 +0100 From: Daniel Hartmeier To: Kevin Wilcox Message-ID: <20110131110635.GA5861@insomnia.benzedrine.cx> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.12-2006-07-14 Cc: freebsd-pf@freebsd.org Subject: Re: log NAT translations X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 11:22:36 -0000 On Thu, Jan 27, 2011 at 11:33:51AM -0500, Kevin Wilcox wrote: > Before I write something to interpret state changes from pfsync, can > anyone offer guidance on how to pull those translations? pfsync should be the simplest source to get that information from, the idea is that you can use tcpdump on the pfsync interface to filter and print any state changes. It seems neither the stock tcpdump nor the one from ports actually does this (yet) in FreeBSD. That's a pity, since it's sometimes a very useful feature, not just for debugging. The patch below adds this to the stock tcpdump (against 8.2), so you can run # tcpdump -s 1600 -npi pfsync0 'ether[2]!=2' to get output like 11:56:24.843786 11:56:24.843786 INS ST: all icmp 172.17.227.9:512 <- 192.168.107.134 0:0 11:56:27.285591 11:56:27.285591 DEL ST: all icmp 172.17.227.9:16 <- 192.168.107.25 0:0 If the states involve address translation, you'll see three pairs of addresses/ports, including before/after translation. The filter 'ether[2]!=2' means 'any action except update', as the ether layer in this context means struct pfsync_header, see /usr/include/net/if_pfsync.h. Updates are chatty, inserts and deletions usually less so. There are probably more pieces to be lifted from OpenBSD's tcpdump, but this might be enough or at least a good start. You can use other tcpdump options, like write to a pcap file, then later use tcpdump to read that file and search for specific time slices, etc. HTH, Daniel Index: usr.sbin/tcpdump/tcpdump/Makefile =================================================================== RCS file: /home/ncvs/src/usr.sbin/tcpdump/tcpdump/Makefile,v retrieving revision 1.47.2.1 diff -u -r1.47.2.1 Makefile --- usr.sbin/tcpdump/tcpdump/Makefile 3 Aug 2009 08:13:06 -0000 1.47.2.1 +++ usr.sbin/tcpdump/tcpdump/Makefile 31 Jan 2011 10:42:07 -0000 @@ -61,6 +61,9 @@ .if ${MK_PF} != "no" SRCS+= print-pflog.c +SRCS+= print-pfsync.c +SRCS+= pf_print_state.c +CFLAGS+= -I/usr/src/contrib/pf/pfctl CFLAGS+= -DHAVE_NET_PFVAR_H .endif Index: contrib/tcpdump/interface.h =================================================================== RCS file: /home/ncvs/src/contrib/tcpdump/interface.h,v retrieving revision 1.14.2.1 diff -u -r1.14.2.1 interface.h --- contrib/tcpdump/interface.h 3 Aug 2009 08:13:06 -0000 1.14.2.1 +++ contrib/tcpdump/interface.h 31 Jan 2011 09:37:35 -0000 @@ -203,6 +203,7 @@ extern void egp_print(const u_char *, u_int); extern u_int enc_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int pflog_if_print(const struct pcap_pkthdr *, const u_char *); +extern u_int pfsync_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int arcnet_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int arcnet_linux_if_print(const struct pcap_pkthdr *, const u_char *); extern void ether_print(const u_char *, u_int, u_int); Index: contrib/tcpdump/tcpdump.c =================================================================== RCS file: /home/ncvs/src/contrib/tcpdump/tcpdump.c,v retrieving revision 1.14.2.1 diff -u -r1.14.2.1 tcpdump.c --- contrib/tcpdump/tcpdump.c 3 Aug 2009 08:13:06 -0000 1.14.2.1 +++ contrib/tcpdump/tcpdump.c 31 Jan 2011 09:35:23 -0000 @@ -197,6 +197,9 @@ #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) { pflog_if_print, DLT_PFLOG }, #endif +#if defined(DLT_PFSYNC) && defined(HAVE_NET_PFVAR_H) + { pfsync_if_print, DLT_PFSYNC }, +#endif #ifdef DLT_FR { fr_if_print, DLT_FR }, #endif --- /dev/null 2011-01-31 11:44:00.000000000 +0100 +++ contrib/tcpdump/print-pfsync.c 2011-01-31 11:09:28.000000000 +0100 @@ -0,0 +1,247 @@ +/* $OpenBSD: print-pfsync.c,v 1.29 2005/11/04 08:24:15 mcbride Exp $ */ + +/* + * Copyright (c) 2002 Michael Shalayeff + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF + * THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef lint +static const char rcsid[] = + "@(#) $Header: /open/anoncvs/cvs/src/usr.sbin/tcpdump/print-pfsync.c,v 1.29 2005/11/04 08:24:15 mcbride Exp $"; +#endif + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#ifndef HAVE_NET_PFVAR_H +#error "No pf headers available" +#endif +#include +#include +#include +#include +#include +#include +#include +#define PFSYNC_TDB +#include + +#include + +#include +#include +#include +#include + +#include "interface.h" +#include "addrtoname.h" +#include "pfctl_parser.h" + + +const char *pfsync_acts[] = { PFSYNC_ACTIONS }; + +void pfsync_print(struct pfsync_header *, int); +void print_state(struct pf_state *, int); + +/* +void +pfsync_if_print(u_char *user, const struct pcap_pkthdr *h, + register const u_char *p) +*/ +u_int +pfsync_if_print(const struct pcap_pkthdr *h, register const u_char *p) +{ + u_int caplen = h->caplen; + + ts_print(&h->ts); + + if (caplen < PFSYNC_HDRLEN) { + printf("[|pfsync]"); + goto out; + } + + pfsync_print((struct pfsync_header *)p, + caplen - sizeof(struct pfsync_header)); +out: + if (xflag) { + default_print((const u_char *)h, caplen); + } + putchar('\n'); +} + +void +pfsync_ip_print(const u_char *bp, u_int len, const u_char *bp2) +{ + struct pfsync_header *hdr = (struct pfsync_header *)bp; + struct ip *ip = (struct ip *)bp2; + + if (vflag) + printf("%s > %s: ", ipaddr_string(&ip->ip_src), + ipaddr_string(&ip->ip_dst)); + else + printf("%s: ", ipaddr_string(&ip->ip_src)); + + if (len < PFSYNC_HDRLEN) + printf("[|pfsync]"); + else + pfsync_print(hdr, (len - sizeof(struct pfsync_header))); + putchar('\n'); +} + +void +pfsync_print(struct pfsync_header *hdr, int len) +{ + struct pfsync_state *s; + struct pfsync_state_upd *u; + struct pfsync_state_del *d; + struct pfsync_state_clr *c; + struct pfsync_state_upd_req *r; + struct pfsync_state_bus *b; + struct pfsync_tdb *t; + int i, flags = 0, min, sec; + u_int64_t id; + + if (eflag) + printf("PFSYNCv%d count %d: ", + hdr->version, hdr->count); + + if (hdr->action < PFSYNC_ACT_MAX) + printf("%s:", pfsync_acts[hdr->action]); + else + printf("%d?:", hdr->action); + + if (vflag) + flags |= PF_OPT_VERBOSE; + if (vflag > 1) + flags |= PF_OPT_VERBOSE2; + if (!nflag) + flags |= PF_OPT_USEDNS; + + switch (hdr->action) { + case PFSYNC_ACT_CLR: + if (sizeof(*c) <= len) { + c = (void *)((char *)hdr + PFSYNC_HDRLEN); + printf("\n\tcreatorid: %08x", htonl(c->creatorid)); + if (c->ifname[0] != '\0') + printf(" interface: %s", c->ifname); + } + case PFSYNC_ACT_INS: + case PFSYNC_ACT_UPD: + case PFSYNC_ACT_DEL: + for (i = 1, s = (void *)((char *)hdr + PFSYNC_HDRLEN); + i <= hdr->count && i * sizeof(*s) <= len; i++, s++) { + struct pf_state st; + + bzero(&st, sizeof(st)); + bcopy(&s->id, &st.id, sizeof(st.id)); + strlcpy(st.u.ifname, s->ifname, sizeof(st.u.ifname)); + pf_state_host_ntoh(&s->lan, &st.lan); + pf_state_host_ntoh(&s->gwy, &st.gwy); + pf_state_host_ntoh(&s->ext, &st.ext); + pf_state_peer_ntoh(&s->src, &st.src); + pf_state_peer_ntoh(&s->dst, &st.dst); + st.rule.nr = ntohl(s->rule); + st.nat_rule.nr = ntohl(s->nat_rule); + st.anchor.nr = ntohl(s->anchor); + bcopy(&s->rt_addr, &st.rt_addr, sizeof(st.rt_addr)); + st.creation = ntohl(s->creation); + st.expire = ntohl(s->expire); + pf_state_counter_ntoh(s->packets[0], st.packets[0]); + pf_state_counter_ntoh(s->packets[1], st.packets[1]); + pf_state_counter_ntoh(s->bytes[0], st.bytes[0]); + pf_state_counter_ntoh(s->bytes[1], st.bytes[1]); + st.creatorid = s->creatorid; + st.af = s->af; + st.proto = s->proto; + st.direction = s->direction; + st.log = s->log; + st.timeout = s->timeout; + st.sync_flags = s->sync_flags; + + putchar('\n'); + print_state(&st, flags); + if (vflag > 1 && hdr->action == PFSYNC_ACT_UPD) + printf(" updates: %d", s->updates); + } + break; + case PFSYNC_ACT_UPD_C: + for (i = 1, u = (void *)((char *)hdr + PFSYNC_HDRLEN); + i <= hdr->count && i * sizeof(*u) <= len; i++, u++) { + bcopy(&u->id, &id, sizeof(id)); + printf("\n\tid: %016llx creatorid: %08x", + be64toh(id), ntohl(u->creatorid)); + if (vflag > 1) + printf(" updates: %d", u->updates); + } + break; + case PFSYNC_ACT_DEL_C: + for (i = 1, d = (void *)((char *)hdr + PFSYNC_HDRLEN); + i <= hdr->count && i * sizeof(*d) <= len; i++, d++) { + bcopy(&d->id, &id, sizeof(id)); + printf("\n\tid: %016llx creatorid: %08x", + be64toh(id), ntohl(d->creatorid)); + } + break; + case PFSYNC_ACT_UREQ: + for (i = 1, r = (void *)((char *)hdr + PFSYNC_HDRLEN); + i <= hdr->count && i * sizeof(*r) <= len; i++, r++) { + bcopy(&r->id, &id, sizeof(id)); + printf("\n\tid: %016llx creatorid: %08x", + be64toh(id), ntohl(r->creatorid)); + } + break; + case PFSYNC_ACT_BUS: + if (sizeof(*b) <= len) { + b = (void *)((char *)hdr + PFSYNC_HDRLEN); + printf("\n\tcreatorid: %08x", htonl(b->creatorid)); + sec = b->endtime % 60; + b->endtime /= 60; + min = b->endtime % 60; + b->endtime /= 60; + printf(" age %.2u:%.2u:%.2u", b->endtime, min, sec); + switch (b->status) { + case PFSYNC_BUS_START: + printf(" status: start"); + break; + case PFSYNC_BUS_END: + printf(" status: end"); + break; + default: + printf(" status: ?"); + break; + } + } + break; + case PFSYNC_ACT_TDB_UPD: + for (i = 1, t = (void *)((char *)hdr + PFSYNC_HDRLEN); + i <= hdr->count && i * sizeof(*t) <= len; i++, t++) + printf("\n\tspi: %08x rpl: %u cur_bytes: %llu", + htonl(t->spi), htonl(t->rpl), + be64toh(t->cur_bytes)); + break; + default: + break; + } +} --- /dev/null 2011-01-31 11:44:00.000000000 +0100 +++ contrib/tcpdump/pf_print_state.c 2010-01-23 01:32:19.000000000 +0100 @@ -0,0 +1,332 @@ +/* $OpenBSD: pf_print_state.c,v 1.44 2007/03/01 17:20:53 deraadt Exp $ */ + +/* + * Copyright (c) 2001 Daniel Hartmeier + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * - Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials provided + * with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN + * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +#include +__FBSDID("$FreeBSD: src/contrib/pf/pfctl/pf_print_state.c,v 1.4.10.2 2010/01/23 00:32:19 delphij Exp $"); + +#include +#include +#include +#include +#define TCPSTATES +#include +#include +#include +#include + +#include +#include + +#include "pfctl_parser.h" +#include "pfctl.h" + +void print_name(struct pf_addr *, sa_family_t); + +void +print_addr(struct pf_addr_wrap *addr, sa_family_t af, int verbose) +{ + switch (addr->type) { + case PF_ADDR_DYNIFTL: + printf("(%s", addr->v.ifname); + if (addr->iflags & PFI_AFLAG_NETWORK) + printf(":network"); + if (addr->iflags & PFI_AFLAG_BROADCAST) + printf(":broadcast"); + if (addr->iflags & PFI_AFLAG_PEER) + printf(":peer"); + if (addr->iflags & PFI_AFLAG_NOALIAS) + printf(":0"); + if (verbose) { + if (addr->p.dyncnt <= 0) + printf(":*"); + else + printf(":%d", addr->p.dyncnt); + } + printf(")"); + break; + case PF_ADDR_TABLE: + if (verbose) + if (addr->p.tblcnt == -1) + printf("<%s:*>", addr->v.tblname); + else + printf("<%s:%d>", addr->v.tblname, + addr->p.tblcnt); + else + printf("<%s>", addr->v.tblname); + return; + case PF_ADDR_ADDRMASK: + if (PF_AZERO(&addr->v.a.addr, AF_INET6) && + PF_AZERO(&addr->v.a.mask, AF_INET6)) + printf("any"); + else { + char buf[48]; + + if (inet_ntop(af, &addr->v.a.addr, buf, + sizeof(buf)) == NULL) + printf("?"); + else + printf("%s", buf); + } + break; + case PF_ADDR_NOROUTE: + printf("no-route"); + return; + case PF_ADDR_URPFFAILED: + printf("urpf-failed"); + return; + case PF_ADDR_RTLABEL: + printf("route \"%s\"", addr->v.rtlabelname); + return; + default: + printf("?"); + return; + } + + /* mask if not _both_ address and mask are zero */ + if (!(PF_AZERO(&addr->v.a.addr, AF_INET6) && + PF_AZERO(&addr->v.a.mask, AF_INET6))) { + int bits = unmask(&addr->v.a.mask, af); + + if (bits != (af == AF_INET ? 32 : 128)) + printf("/%d", bits); + } +} + +void +print_name(struct pf_addr *addr, sa_family_t af) +{ + char host[NI_MAXHOST]; + + strlcpy(host, "?", sizeof(host)); + switch (af) { + case AF_INET: { + struct sockaddr_in sin; + + memset(&sin, 0, sizeof(sin)); + sin.sin_len = sizeof(sin); + sin.sin_family = AF_INET; + sin.sin_addr = addr->v4; + getnameinfo((struct sockaddr *)&sin, sin.sin_len, + host, sizeof(host), NULL, 0, NI_NOFQDN); + break; + } + case AF_INET6: { + struct sockaddr_in6 sin6; + + memset(&sin6, 0, sizeof(sin6)); + sin6.sin6_len = sizeof(sin6); + sin6.sin6_family = AF_INET6; + sin6.sin6_addr = addr->v6; + getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len, + host, sizeof(host), NULL, 0, NI_NOFQDN); + break; + } + } + printf("%s", host); +} + +void +print_host(struct pf_state_host *h, sa_family_t af, int opts) +{ + u_int16_t p = ntohs(h->port); + + if (opts & PF_OPT_USEDNS) + print_name(&h->addr, af); + else { + struct pf_addr_wrap aw; + + memset(&aw, 0, sizeof(aw)); + aw.v.a.addr = h->addr; + if (af == AF_INET) + aw.v.a.mask.addr32[0] = 0xffffffff; + else { + memset(&aw.v.a.mask, 0xff, sizeof(aw.v.a.mask)); + af = AF_INET6; + } + print_addr(&aw, af, opts & PF_OPT_VERBOSE2); + } + + if (p) { + if (af == AF_INET) + printf(":%u", p); + else + printf("[%u]", p); + } +} + +void +print_seq(struct pf_state_peer *p) +{ + if (p->seqdiff) + printf("[%u + %u](+%u)", p->seqlo, p->seqhi - p->seqlo, + p->seqdiff); + else + printf("[%u + %u]", p->seqlo, p->seqhi - p->seqlo); +} + +void +print_state(struct pf_state *s, int opts) +{ + struct pf_state_peer *src, *dst; + struct protoent *p; + int min, sec; + + if (s->direction == PF_OUT) { + src = &s->src; + dst = &s->dst; + } else { + src = &s->dst; + dst = &s->src; + } + printf("%s ", s->u.ifname); + if ((p = getprotobynumber(s->proto)) != NULL) + printf("%s ", p->p_name); + else + printf("%u ", s->proto); + if (PF_ANEQ(&s->lan.addr, &s->gwy.addr, s->af) || + (s->lan.port != s->gwy.port)) { + print_host(&s->lan, s->af, opts); + if (s->direction == PF_OUT) + printf(" -> "); + else + printf(" <- "); + } + print_host(&s->gwy, s->af, opts); + if (s->direction == PF_OUT) + printf(" -> "); + else + printf(" <- "); + print_host(&s->ext, s->af, opts); + + printf(" "); + if (s->proto == IPPROTO_TCP) { + if (src->state <= TCPS_TIME_WAIT && + dst->state <= TCPS_TIME_WAIT) + printf(" %s:%s\n", tcpstates[src->state], + tcpstates[dst->state]); + else if (src->state == PF_TCPS_PROXY_SRC || + dst->state == PF_TCPS_PROXY_SRC) + printf(" PROXY:SRC\n"); + else if (src->state == PF_TCPS_PROXY_DST || + dst->state == PF_TCPS_PROXY_DST) + printf(" PROXY:DST\n"); + else + printf(" \n", + src->state, dst->state); + if (opts & PF_OPT_VERBOSE) { + printf(" "); + print_seq(src); + if (src->wscale && dst->wscale) + printf(" wscale %u", + src->wscale & PF_WSCALE_MASK); + printf(" "); + print_seq(dst); + if (src->wscale && dst->wscale) + printf(" wscale %u", + dst->wscale & PF_WSCALE_MASK); + printf("\n"); + } + } else if (s->proto == IPPROTO_UDP && src->state < PFUDPS_NSTATES && + dst->state < PFUDPS_NSTATES) { + const char *states[] = PFUDPS_NAMES; + + printf(" %s:%s\n", states[src->state], states[dst->state]); + } else if (s->proto != IPPROTO_ICMP && src->state < PFOTHERS_NSTATES && + dst->state < PFOTHERS_NSTATES) { + /* XXX ICMP doesn't really have state levels */ + const char *states[] = PFOTHERS_NAMES; + + printf(" %s:%s\n", states[src->state], states[dst->state]); + } else { + printf(" %u:%u\n", src->state, dst->state); + } + + if (opts & PF_OPT_VERBOSE) { + sec = s->creation % 60; + s->creation /= 60; + min = s->creation % 60; + s->creation /= 60; + printf(" age %.2u:%.2u:%.2u", s->creation, min, sec); + sec = s->expire % 60; + s->expire /= 60; + min = s->expire % 60; + s->expire /= 60; + printf(", expires in %.2u:%.2u:%.2u", s->expire, min, sec); + printf(", %llu:%llu pkts, %llu:%llu bytes", +#ifdef __FreeBSD__ + (unsigned long long)s->packets[0], + (unsigned long long)s->packets[1], + (unsigned long long)s->bytes[0], + (unsigned long long)s->bytes[1]); +#else + s->packets[0], s->packets[1], s->bytes[0], s->bytes[1]); +#endif + if (s->anchor.nr != -1) + printf(", anchor %u", s->anchor.nr); + if (s->rule.nr != -1) + printf(", rule %u", s->rule.nr); + if (s->state_flags & PFSTATE_SLOPPY) + printf(", sloppy"); + if (s->src_node != NULL) + printf(", source-track"); + if (s->nat_src_node != NULL) + printf(", sticky-address"); + printf("\n"); + } + if (opts & PF_OPT_VERBOSE2) { + printf(" id: %016llx creatorid: %08x%s\n", +#ifdef __FreeBSD__ + (unsigned long long)be64toh(s->id), ntohl(s->creatorid), +#else + betoh64(s->id), ntohl(s->creatorid), +#endif + ((s->sync_flags & PFSTATE_NOSYNC) ? " (no-sync)" : "")); + } +} + +int +unmask(struct pf_addr *m, sa_family_t af) +{ + int i = 31, j = 0, b = 0; + u_int32_t tmp; + + while (j < 4 && m->addr32[j] == 0xffffffff) { + b += 32; + j++; + } + if (j < 4) { + tmp = ntohl(m->addr32[j]); + for (i = 31; tmp & (1 << i); --i) + b++; + } + return (b); +} From owner-freebsd-pf@FreeBSD.ORG Mon Jan 31 15:20:03 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DCDF4106564A for ; Mon, 31 Jan 2011 15:20:03 +0000 (UTC) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (106-30.3-213.fix.bluewin.ch [213.3.30.106]) by mx1.freebsd.org (Postfix) with ESMTP id BF3798FC16 for ; Mon, 31 Jan 2011 15:20:01 +0000 (UTC) Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1]) by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id p0VFK2gW031925 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO); Mon, 31 Jan 2011 16:20:02 +0100 (MET) Received: (from dhartmei@localhost) by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id p0VFK1SJ003585; Mon, 31 Jan 2011 16:20:01 +0100 (MET) Date: Mon, 31 Jan 2011 16:20:01 +0100 From: Daniel Hartmeier To: andy thomas Message-ID: <20110131152001.GE5861@insomnia.benzedrine.cx> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.12-2006-07-14 Cc: freebsd-pf@freebsd.org Subject: Re: PF port forward problem with Sonicwall VPN X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 15:20:03 -0000 On Fri, Jan 28, 2011 at 08:49:27AM +0000, andy thomas wrote: > and this works fine as I can access webmail on port 444. But why can't I > access the Sonicwall on port 444? Does anyone know if the Sonicwall uses > additional ports or has anyone got this device to with with a PF-based > firewall? First, I'd try to connect to the Sonicwall from the pf box itself, so it's using its local address. If that doesn't work, how's the pf box different from any other local client, for which this works? Then try and add NAT on the pf box' internal interface, so redirected connections should work like the previous test. If they don't, the problem clearly is with the pf box. But if they do work, but don't without NAT: Check if maybe the Sonicwall has a list of networks it accepts connections from. It might default to refuse connections from non-local networks. Also check if the Sonicwall has a correct default route. Without a correct default route, non-local connections would fail precisely in the way you describe... Kind regards, Daniel From owner-freebsd-pf@FreeBSD.ORG Mon Jan 31 15:31:43 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D81AA1065696 for ; Mon, 31 Jan 2011 15:31:43 +0000 (UTC) (envelope-from andy@time-domain.co.uk) Received: from mail.time-domain.co.uk (81-179-248-237.static.dsl.pipex.com [81.179.248.237]) by mx1.freebsd.org (Postfix) with ESMTP id 6A1678FC28 for ; Mon, 31 Jan 2011 15:31:42 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.time-domain.co.uk (8.14.3/8.14.3) with ESMTP id p0VFVdMP014503; Mon, 31 Jan 2011 15:31:39 GMT Date: Mon, 31 Jan 2011 15:31:39 +0000 (GMT) From: andy thomas X-X-Sender: andy-tds@mail.time-domain.co.uk To: Daniel Hartmeier In-Reply-To: <20110131152001.GE5861@insomnia.benzedrine.cx> Message-ID: References: <20110131152001.GE5861@insomnia.benzedrine.cx> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Cc: arun@netstat-a.net, freebsd-pf@freebsd.org Subject: Re: PF port forward problem with Sonicwall VPN X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Jan 2011 15:31:43 -0000 On Mon, 31 Jan 2011, Daniel Hartmeier wrote: > On Fri, Jan 28, 2011 at 08:49:27AM +0000, andy thomas wrote: > >> and this works fine as I can access webmail on port 444. But why can't I >> access the Sonicwall on port 444? Does anyone know if the Sonicwall uses >> additional ports or has anyone got this device to with with a PF-based >> firewall? > > First, I'd try to connect to the Sonicwall from the pf box itself, > so it's using its local address. If that doesn't work, how's the > pf box different from any other local client, for which this works? > > Then try and add NAT on the pf box' internal interface, so redirected > connections should work like the previous test. If they don't, the > problem clearly is with the pf box. I've logged into the pf box via ssh and used the lynx text browser to access the Sonicwall's web interface on the internal interface and this works fine. > But if they do work, but don't without NAT: > > Check if maybe the Sonicwall has a list of networks it accepts > connections from. It might default to refuse connections from > non-local networks. I'll get the guy who installed the Sonicwall to check this. > Also check if the Sonicwall has a correct default route. Without > a correct default route, non-local connections would fail precisely > in the way you describe... I'd thought of that and the installer has confirmed it is set up correctly. Thanks for getting back to me, Andy From owner-freebsd-pf@FreeBSD.ORG Tue Feb 1 08:26:26 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 37DD71065673 for ; Tue, 1 Feb 2011 08:26:26 +0000 (UTC) (envelope-from peterjeremy@acm.org) Received: from fallbackmx10.syd.optusnet.com.au (fallbackmx10.syd.optusnet.com.au [211.29.132.251]) by mx1.freebsd.org (Postfix) with ESMTP id E849B8FC17 for ; Tue, 1 Feb 2011 08:26:23 +0000 (UTC) Received: from mail17.syd.optusnet.com.au (mail17.syd.optusnet.com.au [211.29.132.198]) by fallbackmx10.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id p115wEoK032387 for ; Tue, 1 Feb 2011 16:58:14 +1100 Received: from server.vk2pj.dyndns.org (c220-239-52-50.belrs4.nsw.optusnet.com.au [220.239.52.50]) by mail17.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id p115vulM001292 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 1 Feb 2011 16:57:58 +1100 X-Bogosity: Ham, spamicity=0.000000 Received: from server.vk2pj.dyndns.org (localhost.vk2pj.dyndns.org [127.0.0.1]) by server.vk2pj.dyndns.org (8.14.4/8.14.4) with ESMTP id p115vt6v061481; Tue, 1 Feb 2011 16:57:55 +1100 (EST) (envelope-from peter@server.vk2pj.dyndns.org) Received: (from peter@localhost) by server.vk2pj.dyndns.org (8.14.4/8.14.4/Submit) id p115vrRJ061480; Tue, 1 Feb 2011 16:57:53 +1100 (EST) (envelope-from peter) Date: Tue, 1 Feb 2011 16:57:53 +1100 From: Peter Jeremy To: Daniel Hartmeier Message-ID: <20110201055753.GA61465@server.vk2pj.dyndns.org> References: <20110131110635.GA5861@insomnia.benzedrine.cx> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="IS0zKkzwUGydFO0o" Content-Disposition: inline In-Reply-To: <20110131110635.GA5861@insomnia.benzedrine.cx> X-PGP-Key: http://members.optusnet.com.au/peterjeremy/pubkey.asc User-Agent: Mutt/1.5.20 (2009-06-14) Cc: freebsd-pf@freebsd.org Subject: Re: log NAT translations X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Feb 2011 08:26:26 -0000 --IS0zKkzwUGydFO0o Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2011-Jan-31 12:06:35 +0100, Daniel Hartmeier wrot= e: >pfsync should be the simplest source to get that information from, >the idea is that you can use tcpdump on the pfsync interface to >filter and print any state changes. > >It seems neither the stock tcpdump nor the one from ports actually >does this (yet) in FreeBSD. That's a pity, since it's sometimes >a very useful feature, not just for debugging. I submitted patches for this some time ago in PR bin/124825. --=20 Peter Jeremy --IS0zKkzwUGydFO0o Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (FreeBSD) iEYEARECAAYFAk1HoOEACgkQ/opHv/APuIcyhQCfVniHvzCZ3GP6qlMVvplhOpd4 DnEAnAh9u9x3TwcaDQrdMIlKivfOZbOu =FARS -----END PGP SIGNATURE----- --IS0zKkzwUGydFO0o-- From owner-freebsd-pf@FreeBSD.ORG Fri Feb 4 19:35:41 2011 Return-Path: Delivered-To: freebsd-pf@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CA4571065674; Fri, 4 Feb 2011 19:35:41 +0000 (UTC) (envelope-from linimon@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id A09088FC12; Fri, 4 Feb 2011 19:35:41 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p14JZf4b034359; Fri, 4 Feb 2011 19:35:41 GMT (envelope-from linimon@freefall.freebsd.org) Received: (from linimon@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p14JZfR6034355; Fri, 4 Feb 2011 19:35:41 GMT (envelope-from linimon) Date: Fri, 4 Feb 2011 19:35:41 GMT Message-Id: <201102041935.p14JZfR6034355@freefall.freebsd.org> To: linimon@FreeBSD.org, freebsd-bugs@FreeBSD.org, freebsd-pf@FreeBSD.org From: linimon@FreeBSD.org Cc: Subject: Re: kern/154504: [pf] [patch] PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2011 19:35:41 -0000 Old Synopsis: PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used New Synopsis: [pf] [patch] PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used Responsible-Changed-From-To: freebsd-bugs->freebsd-pf Responsible-Changed-By: linimon Responsible-Changed-When: Fri Feb 4 19:35:14 UTC 2011 Responsible-Changed-Why: Over to maintainer(s). http://www.freebsd.org/cgi/query-pr.cgi?pr=154504 From owner-freebsd-pf@FreeBSD.ORG Fri Feb 4 21:00:43 2011 Return-Path: Delivered-To: freebsd-pf@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9F21B106566B; Fri, 4 Feb 2011 21:00:43 +0000 (UTC) (envelope-from linimon@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 7500F8FC08; Fri, 4 Feb 2011 21:00:43 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p14L0hT9021928; Fri, 4 Feb 2011 21:00:43 GMT (envelope-from linimon@freefall.freebsd.org) Received: (from linimon@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p14L0h2I021921; Fri, 4 Feb 2011 21:00:43 GMT (envelope-from linimon) Date: Fri, 4 Feb 2011 21:00:43 GMT Message-Id: <201102042100.p14L0h2I021921@freefall.freebsd.org> To: linimon@FreeBSD.org, freebsd-pf@FreeBSD.org, freebsd-bugs@FreeBSD.org From: linimon@FreeBSD.org Cc: Subject: Re: kern/154504: [libc] recv(2): PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2011 21:00:43 -0000 Old Synopsis: [pf] [patch] PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used New Synopsis: [libc] recv(2): PF_LOCAL stream connection is stuck in sbwait when recv(MSG_WAITALL) is used Responsible-Changed-From-To: freebsd-pf->freebsd-bugs Responsible-Changed-By: linimon Responsible-Changed-When: Fri Feb 4 20:58:46 UTC 2011 Responsible-Changed-Why: Fix misclassification. Pointed out by: Gary Palmer http://www.freebsd.org/cgi/query-pr.cgi?pr=154504