Project

General

Profile

Actions

Bug #12703

closed

pf ``hostid`` value is handled inconsistently

Added by Jim Pingle 4 months ago. Updated 2 months ago.

Status:
Resolved
Priority:
Very Low
Category:
Operating System
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
22.05
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

We don't use this yet, but we should in the future (See #12702) but I've noticed an inconsistency in how pf handles the hostid/creator ID.

If you manually set a host ID in the pf rules like so:

set hostid 0x12345678

Then pf outputs that value differently:

pfctl -vvss | grep creator
[...]
   id: 127ee96100000000 creatorid: 78563412 gateway: 198.51.100.1
[...]

Note the byte order is reversed, it is 0x12345678 in the ruleset but 78563412 in the state table data.

When passing an ID to pfctl to kill a state from that creator, it only accepts the reversed form:

: pfctl -k id -k 127ee96100000000/0x12345678
killed 0 states
: pfctl -k id -k 127ee96100000000/0x78563412
killed 1 states

Similarly, if you specify an ID in decimal form (set hostid 1) it comes out as 01000000 instead.


Related issues

Related to Feature #12702: Use consistent pf host ID and add GUI option to set a custom host ID in state synchronization settingsResolvedJim Pingle

Actions
Actions #1

Updated by Jim Pingle 4 months ago

  • Related to Feature #12702: Use consistent pf host ID and add GUI option to set a custom host ID in state synchronization settings added
Actions #3

Updated by Jim Pingle 2 months ago

  • Status changed from New to Resolved
  • Target version changed from CE-Next to 2.7.0

This is good on the latest snapshot which was built after our recent upstream merge.

: grep hostid /tmp/rules.debug
set hostid 0x1

: pfctl -vsi | grep -i host
Hostid:   0x00000001

:pfctl -vvss
[...]
all icmp 198.51.100.12:24252 -> 198.51.100.1:24252       0:0
   age 00:00:02, expires in 00:00:10, 5:5 pkts, 145:145 bytes, rule 103
   id: fe29336200000000 creatorid: 00000001 gateway: 0.0.0.0
   origif: vtnet0
[...]

: pfctl -k id -k fe29336200000000/1
killed 1 states
Actions

Also available in: Atom PDF