Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 07 Oct 2022 11:13:48 +0100
From:      Kristof Provost <kp@FreeBSD.org>
To:        Bryan Drewery <bdrewery@FreeBSD.org>
Cc:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org, matteo@freebsd.org
Subject:   Re: git: cfa1a1308709 - main - pfctl: fix recrusive printing of ethernet anchors
Message-ID:  <55FAE484-FD9E-4652-AD1D-45FBF3501CE8@FreeBSD.org>
In-Reply-To: <46F2B94F-DBCB-4E55-8055-051393C900C8@FreeBSD.org>
References:  <202209061119.286BJnOV024965@gitrepo.freebsd.org> <3fd7be3f-90b1-ae87-1b4e-8b183acf1a9c@FreeBSD.org> <46F2B94F-DBCB-4E55-8055-051393C900C8@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help

--=_MailMate_147620AD-E998-4965-86EC-EBA94BAC3B8A_=
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

> On 3 Oct 2022, at 18:13, Bryan Drewery wrote:
>> I think there's still a problem here.
>>
>> pfctl -a '*' -sr works
>> pfctl -a 'name/*' -sr does not.
>>
So I’ve looked at this a bit more, and I am now going to back away 
from the whole anchor thing, and try to pretend I didn’t see any of 
the tentacled horrors that lurk within.

To give you an idea of the issues, loading the following ruleset:

	anchor "foo" {
	        anchor "bar" {
	                pass in
	        }
	}

does exactly what you’d expect:

	# pfctl -sr -a "*"
	anchor "foo" all {
	  anchor "bar" all {
	    pass in all flags S/SA keep state
	  }
	}
	# pfctl -sr -a "foo/*"
	anchor "bar" all {
	  pass in all flags S/SA keep state
	}

However, if we `pfctl -Fr` to flush all rules:

	# pfctl -Fr
	rules cleared
	# pfctl -sr -a "*"
	# pfctl -sr -a "foo/*"
	anchor "bar" all {
	  pass in all flags S/SA keep state
	}

Unloading pf to actually delete the bar anchor, and then we set:

	anchor “foo”

And then

	# echo "pass" | pfctl -g -f - -a "foo/bar"
	# pfctl -sr -a "*"
	anchor "foo" all {
	}
	# pfctl -sr -a "foo/*"
	# pfctl -sr -a "foo/bar"
	pass all flags S/SA keep state

There are a lot of issues there, and it’ll take a lot of time and 
effort to root them out. My plan is to drink heavily and attempt to 
forget.

Kristof
--=_MailMate_147620AD-E998-4965-86EC-EBA94BAC3B8A_=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/xhtml; charset=3Dutf-8"=
>
</head>
<body><div style=3D"font-family: sans-serif;"><div class=3D"markdown" sty=
le=3D"white-space: normal;">
</div><div class=3D"plaintext" style=3D"white-space: normal;"><blockquote=
 style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136=
BCE; color: #136BCE;"><p dir=3D"auto">On 3 Oct 2022, at 18:13, Bryan Drew=
ery wrote:</p>
<blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px=
 solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir=3D"au=
to">I think there's still a problem here.</p>
<p dir=3D"auto">pfctl -a '*' -sr works
<br>
pfctl -a 'name/*' -sr does not.</p>
<br></blockquote></blockquote></div>
<div class=3D"markdown" style=3D"white-space: normal;">
<p dir=3D"auto">So I=E2=80=99ve looked at this a bit more, and I am now g=
oing to back away from the whole anchor thing, and try to pretend I didn=E2=
=80=99t see any of the tentacled horrors that lurk within.</p>
<p dir=3D"auto">To give you an idea of the issues, loading the following =
ruleset:</p>
<pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border=
: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #=
E4E4E4;"><code>anchor &quot;foo&quot; {
        anchor &quot;bar&quot; {
                pass in
        }
}
</code></pre>
<p dir=3D"auto">does exactly what you=E2=80=99d expect:</p>
<pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border=
: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #=
E4E4E4;"><code># pfctl -sr -a &quot;*&quot;
anchor &quot;foo&quot; all {
  anchor &quot;bar&quot; all {
    pass in all flags S/SA keep state
  }
}
# pfctl -sr -a &quot;foo/*&quot;
anchor &quot;bar&quot; all {
  pass in all flags S/SA keep state
}
</code></pre>
<p dir=3D"auto">However, if we <code>pfctl -Fr</code> to flush all rules:=
</p>
<pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border=
: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #=
E4E4E4;"><code># pfctl -Fr
rules cleared
# pfctl -sr -a &quot;*&quot;
# pfctl -sr -a &quot;foo/*&quot;
anchor &quot;bar&quot; all {
  pass in all flags S/SA keep state
}
</code></pre>
<p dir=3D"auto">Unloading pf to actually delete the bar anchor, and then =
we set:</p>
<pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border=
: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #=
E4E4E4;"><code>anchor =E2=80=9Cfoo=E2=80=9D
</code></pre>
<p dir=3D"auto">And then</p>
<pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border=
: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #=
E4E4E4;"><code># echo &quot;pass&quot; | pfctl -g -f - -a &quot;foo/bar&q=
uot;
# pfctl -sr -a &quot;*&quot;
anchor &quot;foo&quot; all {
}
# pfctl -sr -a &quot;foo/*&quot;
# pfctl -sr -a &quot;foo/bar&quot;
pass all flags S/SA keep state
</code></pre>
<p dir=3D"auto">There are a lot of issues there, and it=E2=80=99ll take a=
 lot of time and effort to root them out. My plan is to drink heavily and=
 attempt to forget.</p>
<p dir=3D"auto">Kristof</p>

</div></div></body>

</html>

--=_MailMate_147620AD-E998-4965-86EC-EBA94BAC3B8A_=--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55FAE484-FD9E-4652-AD1D-45FBF3501CE8>