From c69121c473d75abab55f9ade8e8138ac09c0942c Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Wed, 26 May 2021 13:41:34 +0200 Subject: pfctl: syncookie configuration pfctl and libpfctl code required to enable/disable the syncookie feature. MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31140 --- sbin/pfctl/parse.y | 20 ++++++++++++++++++-- sbin/pfctl/pfctl.c | 30 ++++++++++++++++++++++++++++-- sbin/pfctl/pfctl_parser.c | 7 ++++++- sbin/pfctl/pfctl_parser.h | 3 ++- 4 files changed, 54 insertions(+), 6 deletions(-) (limited to 'sbin') diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 74744794370f..dbfe299cf34f 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -464,7 +464,7 @@ int parseport(char *, struct range *r, int); %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY %token RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID -%token ANTISPOOF FOR INCLUDE KEEPCOUNTERS +%token ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL @@ -480,7 +480,7 @@ int parseport(char *, struct range *r, int); %type number icmptype icmp6type uid gid %type tos not yesno %type probability -%type no dir af fragcache optimizer +%type no dir af fragcache optimizer syncookie_val %type sourcetrack flush unaryop statelock %type action nataction natpasslog scrubaction %type flags flag blockspec prio @@ -725,6 +725,21 @@ option : SET OPTIMIZATION STRING { | SET KEEPCOUNTERS { pf->keep_counters = true; } + | SET SYNCOOKIES syncookie_val { + pf->syncookies = $3; + } + ; + +syncookie_val : STRING { + if (!strcmp($1, "never")) + $$ = PFCTL_SYNCOOKIES_NEVER; + else if (!strcmp($1, "always")) + $$ = PFCTL_SYNCOOKIES_ALWAYS; + else { + yyerror("illegal value for syncookies"); + YYERROR; + } + } ; stringall : STRING { $$ = $1; } @@ -5673,6 +5688,7 @@ lookup(char *s) { "state-policy", STATEPOLICY}, { "static-port", STATICPORT}, { "sticky-address", STICKYADDRESS}, + { "syncookies", SYNCOOKIES}, { "synproxy", SYNPROXY}, { "table", TABLE}, { "tag", TAG}, diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 14b7f3a01657..6c689edf7c43 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -93,6 +93,7 @@ int pfctl_load_timeout(struct pfctl *, unsigned int, unsigned int); int pfctl_load_debug(struct pfctl *, unsigned int); int pfctl_load_logif(struct pfctl *, char *); int pfctl_load_hostid(struct pfctl *, u_int32_t); +int pfctl_load_syncookies(struct pfctl *, u_int8_t); int pfctl_get_pool(int, struct pfctl_pool *, u_int32_t, u_int32_t, int, char *); void pfctl_print_rule_counters(struct pfctl_rule *, int); @@ -1307,15 +1308,20 @@ pfctl_show_states(int dev, const char *iface, int opts) int pfctl_show_status(int dev, int opts) { - struct pf_status status; + struct pf_status status; + struct pfctl_syncookies cookies; if (ioctl(dev, DIOCGETSTATUS, &status)) { warn("DIOCGETSTATUS"); return (-1); } + if (pfctl_get_syncookies(dev, &cookies)) { + warn("DIOCGETSYNCOOKIES"); + return (-1); + } if (opts & PF_OPT_SHOWALL) pfctl_print_title("INFO:"); - print_status(&status, opts); + print_status(&status, &cookies, opts); return (0); } @@ -1861,6 +1867,10 @@ pfctl_load_options(struct pfctl *pf) if (pfctl_set_keepcounters(pf->dev, pf->keep_counters)) error = 1; + /* load syncookies settings */ + if (pfctl_load_syncookies(pf, pf->syncookies)) + error = 1; + return (error); } @@ -2047,6 +2057,22 @@ pfctl_load_hostid(struct pfctl *pf, u_int32_t hostid) return (0); } +int +pfctl_load_syncookies(struct pfctl *pf, u_int8_t val) +{ + struct pfctl_syncookies cookies; + + bzero(&cookies, sizeof(cookies)); + + cookies.mode = val ? PFCTL_SYNCOOKIES_ALWAYS : PFCTL_SYNCOOKIES_NEVER; + + if (pfctl_set_syncookies(dev, &cookies)) { + warnx("DIOCSETSYNCOOKIES"); + return (1); + } + return (0); +} + int pfctl_set_debug(struct pfctl *pf, char *d) { diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c index 62d4b42bd416..8991073ec693 100644 --- a/sbin/pfctl/pfctl_parser.c +++ b/sbin/pfctl/pfctl_parser.c @@ -497,7 +497,7 @@ const char * const pf_fcounters[FCNT_MAX+1] = FCNT_NAMES; const char * const pf_scounters[FCNT_MAX+1] = FCNT_NAMES; void -print_status(struct pf_status *s, int opts) +print_status(struct pf_status *s, struct pfctl_syncookies *cookies, int opts) { char statline[80], *running; time_t runtime; @@ -627,6 +627,11 @@ print_status(struct pf_status *s, int opts) else printf("%14s\n", ""); } + + printf("Syncookies\n"); + printf(" %-25s %s\n", "mode", + cookies->mode == PFCTL_SYNCOOKIES_NEVER ? + "never" : "always"); } } diff --git a/sbin/pfctl/pfctl_parser.h b/sbin/pfctl/pfctl_parser.h index 5353900b380a..0c64238ecefa 100644 --- a/sbin/pfctl/pfctl_parser.h +++ b/sbin/pfctl/pfctl_parser.h @@ -100,6 +100,7 @@ struct pfctl { u_int32_t hostid; char *ifname; bool keep_counters; + u_int8_t syncookies; u_int8_t timeout_set[PFTM_MAX]; u_int8_t limit_set[PF_LIMIT_MAX]; @@ -278,7 +279,7 @@ void print_pool(struct pfctl_pool *, u_int16_t, u_int16_t, sa_family_t, int); void print_src_node(struct pf_src_node *, int); void print_rule(struct pfctl_rule *, const char *, int, int); void print_tabledef(const char *, int, int, struct node_tinithead *); -void print_status(struct pf_status *, int); +void print_status(struct pf_status *, struct pfctl_syncookies *, int); void print_running(struct pf_status *); int eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *, -- cgit v1.2.3