From nobody Tue Jul 15 10:07:50 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bhFHW2tvGz62Dd0; Tue, 15 Jul 2025 10:07:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bhFHV6mKNz3fKp; Tue, 15 Jul 2025 10:07:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7gfKSaU49/C230ZxUZ2JT97APQduSy7R2nLazM9Vf3Q=; b=B0HKEs5PTWU8V9AuBi9j+vrvsl4LoOtxfA3t43W/sTppF6gAr1JBO9xlFbnvn96MJdsuFd Zn0tODdvHldwp6onYfG8U3UXMqTFWvtzsiFki5jb8qR0AdM3eJl5ldEVg5Gw11c68lBMaa QuNt+4X0F99itmaoHQ3IlvyuXYwQ7im/4L1x9nFdXAbWKKXgevfeMH5ZXJ6g1kGEZPg0wY +dRqZA7C1afkv4BNgHsaCm7Ebhj/Fwk3XUFnrspOpNB6qavAsglpNfDFbdb+49MOeamKDv WkLywFNh+PEv2rNUW7jLQHTTSSjYoDpzIgfZFlBUx7tOplugv/KURZ23DQBwuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752574071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7gfKSaU49/C230ZxUZ2JT97APQduSy7R2nLazM9Vf3Q=; b=ig+DV3J01dPMqr/qLj+8OVLb88fGA79LohLpiwSmbHYkBRXdJikhLjJ+ZJ3qYeVKtPXjK+ wclTTUp2gGtwYG4D0kEMAmNrxfyjnuYlSwF1/tK6x0DfvN8ASL+6Jae0iG6Ab+dT8hyp+Y ND5RjH7YAIS7lmsK5DntO6au/r0iIK8Lx23NepveFYp6MILbQgoyqcaxqqbT8wLWTVQh27 i90M1wENZcjoEiF+mYE9Rr0+GiceNVOJ3Wdy0P7LNK/OvvqffF0otq7nw206/j7XqN7AOW R0Sg+C+x9uRk3E+GT4IYIC4VHT5clwEN3Dt+91x5Bfxv4rdDEHt1cTzuiYMQFg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1752574071; a=rsa-sha256; cv=none; b=AiCaJXDXIDlCi3cpnSVEAYpp9EgwIwPx80Avz+TWnAZHRJGtKtjEJplAIuaY76TiklCrUb Rlx0czdiC7OH5G1z2c527kp+qonmL1Osy1bj1wv+lRm+XmG+zD6tnQ3W8uo1KktfpGFejp 8YeH5qdpVH/rE1r7rUSSLkFejUtLtggcExYDsauOOHq9uBVGSzMIqzVM2RwQxxs7LrGGXg sCGYsbg85aWXurCFuOkffQMxtRD2h9jll+dF/p6OWDjMmQn9GlmowNtuQFCniYsyHLYvBF uC8O5YRKiLQXvMIU+8CLhsdeiytqlCWRaj4Qnis8ElUENlf1BC6st7O/Yow87w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bhFHV6KVbzbbn; Tue, 15 Jul 2025 10:07:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56FA7oON027803; Tue, 15 Jul 2025 10:07:50 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56FA7obL027800; Tue, 15 Jul 2025 10:07:50 GMT (envelope-from git) Date: Tue, 15 Jul 2025 10:07:50 GMT Message-Id: <202507151007.56FA7obL027800@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: b09707abf932 - main - pf: synproxy should be processing incoming SYN packets only. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b09707abf932d3fea37aa7ef8bab0e9631fb7529 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=b09707abf932d3fea37aa7ef8bab0e9631fb7529 commit b09707abf932d3fea37aa7ef8bab0e9631fb7529 Author: Kristof Provost AuthorDate: 2025-07-07 14:47:42 +0000 Commit: Kristof Provost CommitDate: 2025-07-15 07:55:28 +0000 pf: synproxy should be processing incoming SYN packets only. issue noticed by sthen@. fix discussed with bluhm@ and procter@ OK bluhm@, kn@, procter@ Obtained from: OpenBSD, sashan , 4e62cf09d9 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sbin/pfctl/parse.y | 4 ++++ share/man/man5/pf.conf.5 | 1 + sys/netpfil/pf/pf.c | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 9a917d1d8464..4286b6149ac6 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -5324,6 +5324,10 @@ filter_consistent(struct pfctl_rule *r, int anchor_call) "synproxy state or modulate state"); problems++; } + if ((r->keep_state == PF_STATE_SYNPROXY) && (r->direction != PF_IN)) + fprintf(stderr, "%s:%d: warning: " + "synproxy used for inbound rules only, " + "ignored for outbound\n", file->name, yylval.lineno); if (r->rule_flag & PFRULE_AFTO && r->rt) { if (r->rt != PF_ROUTETO && r->rt != PF_REPLYTO) { yyerror("dup-to " diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5 index b5843d67e106..a51fde500367 100644 --- a/share/man/man5/pf.conf.5 +++ b/share/man/man5/pf.conf.5 @@ -2574,6 +2574,7 @@ will not work if .Xr pf 4 operates on a .Xr bridge 4 . +Also they act on incoming SYN packets only. .Pp Example: .Bd -literal -offset indent diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index a410fe570c39..ac05cad7d4c8 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -6219,7 +6219,7 @@ pf_create_state(struct pf_krule *r, struct pf_test_ctx *ctx, if (ctx->tag > 0) s->tag = ctx->tag; if (pd->proto == IPPROTO_TCP && (tcp_get_flags(th) & (TH_SYN|TH_ACK)) == - TH_SYN && r->keep_state == PF_STATE_SYNPROXY) { + TH_SYN && r->keep_state == PF_STATE_SYNPROXY && pd->dir == PF_IN) { pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC); pf_undo_nat(ctx->nr, pd, bip_sum); s->src.seqhi = arc4random();