Bug 248109 - ipfilter ipf.rules & ipnat.rules not loading when vnet jail starts
Summary: ipfilter ipf.rules & ipnat.rules not loading when vnet jail starts
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.1-RELEASE
Hardware: Any Any
: Normal Affects Some People
Assignee: Cy Schubert
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-19 15:50 UTC by joeb1
Modified: 2020-08-02 04:26 UTC (History)
1 user (show)

See Also:


Attachments
Fix (1.16 KB, patch)
2020-07-20 05:50 UTC, Cy Schubert
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description joeb1 2020-07-19 15:50:59 UTC
Running 12.1 on real hardware.
Vnet jails using bridge/epair method.

The rc.conf in the vnet jail is populated with the normal ipfilter lines to start ipfilter at vnet jail start up.

ipfilter_enable="YES"
ipmon_enable="YES"
ipmon_flags="-D"
ipfilter_rules="/etc/ipf.rules"
ipnat_enable="YES"
ipnat_rules="/etc/ipf.nat.rules"

The ipf.rules files has this content
pass in  quick on lo0 all
pass out quick on lo0 all
block out log quick on epair41b proto tcp from any to any port = 43 
pass in  log quick on epair41b all
pass out log quick on epair41b all

The ipf.nat.rules files has this content
map epair41b 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp
map epair41b 0.0.0.0/0 -> 0/32

I use the native jail command to start and stop the vnet jail.
jail -cv jailname  jail -rv jailname 

After logging into the jails console as root.
ipfstat -hnoi  replies with
empty list for ipfilter(out)
empty list for ipfilter(in)

ipnat -l replies with
List of active MAP/Redirects filters:
and then a blank line.

Then I issue this command from the vnet jails command line to load the rules
ipf -FS -Fa -f /etc/ipf.rules  followed by
ipfstat -hnoi  and the filter rules are shown and functioning.
You may ask how do I know the rules are functioning?
The whois command is blocked by the rule on port 43 and it will not work when I issue it from the vnet console.

The same thing is true for ipnat rules when I issue the command to load them
ipnat -FC -f /etc/ipf.nat.rules  then this command shows results
ipnat -l

Sure hopping a fix can make it into 12.2 and/or 13.0

For your feedback, I may be the first person to really test ipfilter in side of a vnet jail since ipfilter became vimage aware.
Comment 1 Cy Schubert freebsd_committer 2020-07-20 05:19:36 UTC
In the jail's /etc/rc.d/ipfilter, change
Comment 2 Cy Schubert freebsd_committer 2020-07-20 05:29:01 UTC
In the jail's /etc/rc.d/ipfilter, change KEYWORD: nojail to KEYWORD: jail.
Comment 3 Cy Schubert freebsd_committer 2020-07-20 05:35:58 UTC
Simply delete the line.
Comment 4 Cy Schubert freebsd_committer 2020-07-20 05:50:11 UTC
Created attachment 216593 [details]
Fix

If you're into mergemaster or etcupdate, apply this patch to your src tree or directly to /etc/rc.d.
Comment 5 joeb1 2020-07-20 16:10:22 UTC
Comment on attachment 216593 [details]
Fix

I tested this by changing the files by hand inside of a vnet jail and restarted the vnet jail.  The ipf.rules and ipnat.rules were auto loaded at vnet jail start time. Not using ippool so not tested.

Sure hope to see this fix included in 12.2 and 13.0 when they get published.

You did good job getting this fixed so fast. Thank you Cy.
Comment 6 commit-hook freebsd_committer 2020-07-23 17:40:02 UTC
A commit references this bug:

Author: cy
Date: Thu Jul 23 17:39:46 UTC 2020
New revision: 363452
URL: https://svnweb.freebsd.org/changeset/base/363452

Log:
  Load ipfilter, ipnat, and ippool rules, and start ipmon in a vnet jail.

  PR:		248109
  Reported by:	joeb1@a1poweruser.com
  MFC after:	2 weeks

Changes:
  head/libexec/rc/rc.d/ipfilter
  head/libexec/rc/rc.d/ipmon
  head/libexec/rc/rc.d/ipnat
  head/libexec/rc/rc.d/ippool
Comment 7 joeb1 2020-07-25 22:33:17 UTC
Good news I manually hand changed the ipfilter, ipmon, ipnat, ippool scripts in /etc/rc.d replacing the nojail with nojailvnet. Restarted the vnet jail and the ipmon log is now logging to the /var/log/security file in side of the vnet jail just like I wanted. Looks like the solution for this pr not only causes the ipf.rules file and ipnat.rules file to be loaded at vnet jail start time but also fixed the ipmon log problem described in 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248112
Comment 8 commit-hook freebsd_committer 2020-08-02 04:26:14 UTC
A commit references this bug:

Author: cy
Date: Sun Aug  2 04:25:14 UTC 2020
New revision: 363768
URL: https://svnweb.freebsd.org/changeset/base/363768

Log:
  MFC r363284-r363285, r363452, r363670

  r363284:
  pfil_run_hooks() can be called recursively, so we have to
  define FASTROUTE_RECURSION in fil.c

  Submitted by:	christos@NetBSD.org
  Reported by:	christos@NetBSD.org
  Obtained from:	NetBSD r1.31

  r363285:
  Fix incorrect byte order in ipfstat -f output.
  - make sure frag is initialized to 0
  - initialize ipfr_p field

  NetBSD PR:	55137
  Submitted by:	christos@NetBSD.org
  Reported by:	christos@NetBSD.org
  Obtained from:	NetBSD fil.c r1.32, ip_frag.c r1.8

  r363452:
  Load ipfilter, ipnat, and ippool rules, and start ipmon in a vnet jail.

  PR:		248109
  Reported by:	joeb1@a1poweruser.com

  r363670:
  Continued ipfilter #ifdef cleanup. The r343701 log entry contains a
  complete description.

Changes:
_U  stable/12/
  stable/12/contrib/ipfilter/iplang/iplang_y.y
  stable/12/contrib/ipfilter/ipsend/arp.c
  stable/12/contrib/ipfilter/ipsend/ipresend.c
  stable/12/contrib/ipfilter/ipsend/ipsend.c
  stable/12/contrib/ipfilter/ipsend/iptest.c
  stable/12/contrib/ipfilter/ipsend/iptests.c
  stable/12/contrib/ipfilter/ipsend/sock.c
  stable/12/libexec/rc/rc.d/ipfilter
  stable/12/libexec/rc/rc.d/ipmon
  stable/12/libexec/rc/rc.d/ipnat
  stable/12/libexec/rc/rc.d/ippool
  stable/12/sys/contrib/ipfilter/netinet/fil.c
  stable/12/sys/contrib/ipfilter/netinet/ip_frag.c