October 18, 2009 posted by Christos Zoulas
This summer I mentored Arnaud Degroote's Summer of Code project 'A
tool to dump/restore the pf state table'.
Pf is a powerful packet filter system with a large number of
features, but it misses the capability to dump the contents of its
internal state to a file so that it can be restored it after a
reboot maintaining existing connections. The suggested solution
from the OpenBSD project is to use pfsync(4), to synchronise two
instances of pf, but this solution requires another machine. The
first goal of the project was to implement a tool similar to ipfs(8)
for for ipf(4) that works with pf(4).
At mid-term, Arnaud had a working pfs tool which is able to dump /
restore the internal state table of pf, using a binary format to
store the information. After that, he improved the tool to dump /
restore the state table in an ASCII format. Having an ASCII format allows
one to do easily some transformation on the state table, using the
standard unix tools, without the need to implement ad-hoc options
in pfs tool (such as ipfs -i if1,if2).
In the second part of the SoC, Arnaud imported pfsync(4) from OpenBSD
(the version from OpenBSD 4_2 + a few more patches), and updated
the different network userland tools to work with it. This part of
the work was merged in the NetBSD tree on September 14th.
In the last few weeks, Arnaud has been looking into integrating a more
recent version of pf(4) in NetBSD, but little work has been done yet.
He hopes to continue to work on it, but does not have a lot
of spare time these days.
pfs(8) is usable currently, but it is not yet integrated in the
NetBSD tree. It can be found on my GSoC page, if you want to play
with it (http://netbsd-soc.sourceforge.net/projects/pfstate/). Arnaud
tells me he would like to integrate it with pf 4_5 (or 4_6 now), then to update
the pfs tool to understand the new pfsync_state structure before
asking for a public review / integration in NetBSD (and in a perfect
world in OpenBSD).