CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Wed Aug 23 18:19:32 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_ruleset.c Log Message: Pull up following revision(s) (requested by kardel in ticket #340): sys/net/npf/npf_ruleset.c: revision 1.52 The analysis documented in PR misc/56990 is correct. Fix by not returning when encountering a ruleset rule. The code up to now would stop at any group rule. ruleset rules are marked as group rule and a dynamic rule. processing is only finished when a result is present AND we are looking at a plain group rule. To generate a diff of this commit: cvs rdiff -u -r1.51 -r1.51.20.1 src/sys/net/npf/npf_ruleset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src
Committed By: martin
Date: Wed Aug 23 18:19:32 UTC 2023
Modified Files:
src/sys/net/npf [netbsd-10]: npf_ruleset.c
Log Message:
Pull up following revision(s) (requested by kardel in ticket #340):
sys/net/npf/npf_ruleset.c: revision 1.52
The analysis documented in PR misc/56990 is correct.
Fix by not returning when encountering a ruleset rule.
The code up to now would stop at any group rule.
ruleset rules are marked as group rule and a dynamic rule.
processing is only finished when a result is present AND
we are looking at a plain group rule.
To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.51.20.1 src/sys/net/npf/npf_ruleset.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/npf/npf_ruleset.c
diff -u src/sys/net/npf/npf_ruleset.c:1.51 src/sys/net/npf/npf_ruleset.c:1.51.20.1
--- src/sys/net/npf/npf_ruleset.c:1.51 Sat May 30 14:16:56 2020
+++ src/sys/net/npf/npf_ruleset.c Wed Aug 23 18:19:32 2023
@@ -34,7 +34,7 @@
#ifdef _KERNEL
#include
-__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.51 2020/05/30 14:16:56 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.51.20.1 2023/08/23 18:19:32 martin Exp $");
#include
#include
@@ -891,7 +891,7 @@ npf_ruleset_inspect(npf_cache_t *npc, co
KASSERT(n < skip_to);
/* Group is a barrier: return a matching if found any. */
- if ((attr & NPF_RULE_GROUP) != 0 && final_rl) {
+ if ((attr & NPF_DYNAMIC_GROUP) == NPF_RULE_GROUP && final_rl) {
break;
}
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src
Committed By: martin
Date: Mon Aug 21 12:18:17 UTC 2023
Modified Files:
src/sys/net/npf [netbsd-10]: npf_tableset.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #332):
sys/net/npf/npf_tableset.c: revision 1.41
npf(9): Drop table lock around copyout.
It is forbidden to hold a spin lock around copyout, and t_lock is a
spin lock.
We need t_lock in order to iterate over the list of entries.
However, during copyout itself, we only need to ensure that the
object we're copying out isn't freed by npf_table_remove or
npf_table_gc.
Fortunately, the only caller of npf_table_list, npf_table_remove, and
npf_table_gc is npfctl_table, and it serializes all of them by the
npf config lock. So we can safely drop t_lock across copyout.
PR kern/57136
PR kern/57181
To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.38.4.1 src/sys/net/npf/npf_tableset.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/npf/npf_tableset.c
diff -u src/sys/net/npf/npf_tableset.c:1.38 src/sys/net/npf/npf_tableset.c:1.38.4.1
--- src/sys/net/npf/npf_tableset.c:1.38 Sat Apr 9 23:38:33 2022
+++ src/sys/net/npf/npf_tableset.c Mon Aug 21 12:18:17 2023
@@ -46,7 +46,7 @@
#ifdef _KERNEL
#include
-__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.38 2022/04/09 23:38:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.38.4.1 2023/08/21 12:18:17 martin Exp $");
#include
#include
@@ -762,15 +762,17 @@ table_ent_copyout(const npf_addr_t *addr
}
static int
-table_generic_list(const npf_table_t *t, void *ubuf, size_t len)
+table_generic_list(npf_table_t *t, void *ubuf, size_t len)
{
npf_tblent_t *ent;
size_t off = 0;
int error = 0;
LIST_FOREACH(ent, >t_list, te_listent) {
+ mutex_exit(>t_lock);
error = table_ent_copyout(>te_addr,
ent->te_alen, ent->te_preflen, ubuf, len, );
+ mutex_enter(>t_lock);
if (error)
break;
}
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Mon Aug 21 12:18:17 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_tableset.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #332): sys/net/npf/npf_tableset.c: revision 1.41 npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181 To generate a diff of this commit: cvs rdiff -u -r1.38 -r1.38.4.1 src/sys/net/npf/npf_tableset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Tue Mar 14 17:09:21 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf.h npf_mbuf.c npf_sendpkt.c Log Message: Pull up following revision(s) (requested by kardel in ticket #119): sys/net/npf/npf_mbuf.c: revision 1.25 sys/net/npf/npf.h: revision 1.64 sys/net/npf/npf_sendpkt.c: revision 1.23 PR kern/56052: allow block-return packets passed through without rule matching. Included up-stream ashttps://github.com/rmind/npf/pull/115 To generate a diff of this commit: cvs rdiff -u -r1.63 -r1.63.20.1 src/sys/net/npf/npf.h cvs rdiff -u -r1.24 -r1.24.20.1 src/sys/net/npf/npf_mbuf.c cvs rdiff -u -r1.22 -r1.22.20.1 src/sys/net/npf/npf_sendpkt.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src
Committed By: martin
Date: Tue Mar 14 17:09:21 UTC 2023
Modified Files:
src/sys/net/npf [netbsd-10]: npf.h npf_mbuf.c npf_sendpkt.c
Log Message:
Pull up following revision(s) (requested by kardel in ticket #119):
sys/net/npf/npf_mbuf.c: revision 1.25
sys/net/npf/npf.h: revision 1.64
sys/net/npf/npf_sendpkt.c: revision 1.23
PR kern/56052:
allow block-return packets passed through without rule matching.
Included up-stream ashttps://github.com/rmind/npf/pull/115
To generate a diff of this commit:
cvs rdiff -u -r1.63 -r1.63.20.1 src/sys/net/npf/npf.h
cvs rdiff -u -r1.24 -r1.24.20.1 src/sys/net/npf/npf_mbuf.c
cvs rdiff -u -r1.22 -r1.22.20.1 src/sys/net/npf/npf_sendpkt.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/npf/npf.h
diff -u src/sys/net/npf/npf.h:1.63 src/sys/net/npf/npf.h:1.63.20.1
--- src/sys/net/npf/npf.h:1.63 Sat May 30 14:16:56 2020
+++ src/sys/net/npf/npf.h Tue Mar 14 17:09:21 2023
@@ -122,6 +122,7 @@ void * nbuf_ensure_writable(nbuf_t *, s
bool nbuf_cksum_barrier(nbuf_t *, int);
int nbuf_add_tag(nbuf_t *, uint32_t);
+int npf_mbuf_add_tag(nbuf_t *, struct mbuf *, uint32_t);
int nbuf_find_tag(nbuf_t *, uint32_t *);
/*
Index: src/sys/net/npf/npf_mbuf.c
diff -u src/sys/net/npf/npf_mbuf.c:1.24 src/sys/net/npf/npf_mbuf.c:1.24.20.1
--- src/sys/net/npf/npf_mbuf.c:1.24 Sat May 30 14:16:56 2020
+++ src/sys/net/npf/npf_mbuf.c Tue Mar 14 17:09:21 2023
@@ -36,7 +36,7 @@
#ifdef _KERNEL
#include
-__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.24 2020/05/30 14:16:56 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.24.20.1 2023/03/14 17:09:21 martin Exp $");
#include
#include
@@ -297,14 +297,13 @@ nbuf_cksum_barrier(nbuf_t *nbuf, int di)
}
/*
- * nbuf_add_tag: associate a tag with the network buffer.
+ * npf_mbuf_add_tag: associate a tag with the network buffer.
*
* => Returns 0 on success or error number on failure.
*/
int
-nbuf_add_tag(nbuf_t *nbuf, uint32_t val)
+npf_mbuf_add_tag(nbuf_t *nbuf, struct mbuf *m, uint32_t val)
{
- struct mbuf *m = nbuf->nb_mbuf0;
#ifdef _KERNEL
struct m_tag *mt;
uint32_t *dat;
@@ -328,6 +327,18 @@ nbuf_add_tag(nbuf_t *nbuf, uint32_t val)
}
/*
+ * nbuf_add_tag: associate a tag with the network buffer.
+ *
+ * => Returns 0 on success or error number on failure.
+ */
+int
+nbuf_add_tag(nbuf_t *nbuf, uint32_t val)
+{
+ struct mbuf *m = nbuf->nb_mbuf0;
+ return npf_mbuf_add_tag(nbuf, m, val);
+}
+
+/*
* nbuf_find_tag: find a tag associated with a network buffer.
*
* => Returns 0 on success or error number on failure.
Index: src/sys/net/npf/npf_sendpkt.c
diff -u src/sys/net/npf/npf_sendpkt.c:1.22 src/sys/net/npf/npf_sendpkt.c:1.22.20.1
--- src/sys/net/npf/npf_sendpkt.c:1.22 Sat May 30 14:16:56 2020
+++ src/sys/net/npf/npf_sendpkt.c Tue Mar 14 17:09:21 2023
@@ -33,7 +33,7 @@
#ifdef _KERNEL
#include
-__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.22 2020/05/30 14:16:56 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.22.20.1 2023/03/14 17:09:21 martin Exp $");
#include
#include
@@ -197,6 +197,9 @@ npf_return_tcp(npf_cache_t *npc)
}
}
+ /* don't look at our generated reject packets going out */
+ (void)npf_mbuf_add_tag(npc->npc_nbuf, m, NPF_NTAG_PASS);
+
/* Pass to IP layer. */
if (npf_iscached(npc, NPC_IP4)) {
return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
@@ -215,6 +218,9 @@ npf_return_icmp(const npf_cache_t *npc)
{
struct mbuf *m = nbuf_head_mbuf(npc->npc_nbuf);
+ /* don't look at our generated reject packets going out */
+ (void)nbuf_add_tag(npc->npc_nbuf, NPF_NTAG_PASS);
+
if (npf_iscached(npc, NPC_IP4)) {
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_ADMIN_PROHIBIT, 0, 0);
return 0;
