Author: ae
Date: Mon Jul 31 11:04:35 2017
New Revision: 321779
URL: https://svnweb.freebsd.org/changeset/base/321779
Log:
Add inpcb pointer to struct ipsec_ctx_data and pass it to the pfil hook
from enc_hhook().
This should solve the problem when pf is used with if_enc(4) interface,
and outbound packet with existing PCB checked by pf, and this leads to
deadlock due to pf does its own PCB lookup and tries to take rlock when
wlock is already held.
Now we pass PCB pointer if it is known to the pfil hook, this helps to
avoid extra PCB lookup and thus rlock acquiring is not needed.
For inbound packets it is safe to pass NULL, because we do not held any
PCB locks yet.
PR: 220217
MFC after: 3 weeks
Sponsored by: Yandex LLC
Modified:
head/sys/net/if_enc.c
head/sys/net/if_enc.h
head/sys/netipsec/ipsec.h
head/sys/netipsec/ipsec_input.c
head/sys/netipsec/ipsec_output.c
Modified: head/sys/net/if_enc.c
==============================================================================
--- head/sys/net/if_enc.c Mon Jul 31 09:54:04 2017 (r321778)
+++ head/sys/net/if_enc.c Mon Jul 31 11:04:35 2017 (r321779)
@@ -284,7 +284,7 @@ enc_hhook(int32_t hhook_type, int32_t hhook_id, void *
/* Make a packet looks like it was received on enc(4) */
rcvif = (*ctx->mp)->m_pkthdr.rcvif;
(*ctx->mp)->m_pkthdr.rcvif = ifp;
- if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
+ if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, ctx->inp) != 0 ||
*ctx->mp == NULL) {
*ctx->mp = NULL; /* consumed by filter */
return (EACCES);
Modified: head/sys/net/if_enc.h
==============================================================================
--- head/sys/net/if_enc.h Mon Jul 31 09:54:04 2017 (r321778)
+++ head/sys/net/if_enc.h Mon Jul 31 11:04:35 2017 (r321779)
@@ -33,6 +33,7 @@
struct ipsec_ctx_data {
struct mbuf **mp;
struct secasvar *sav;
+ struct inpcb *inp;
uint8_t af;
#define IPSEC_ENC_BEFORE 0x01
#define IPSEC_ENC_AFTER 0x02
Modified: head/sys/netipsec/ipsec.h
==============================================================================
--- head/sys/netipsec/ipsec.h Mon Jul 31 09:54:04 2017 (r321778)
+++ head/sys/netipsec/ipsec.h Mon Jul 31 11:04:35 2017 (r321779)
@@ -253,8 +253,9 @@ struct ipsecstat {
#include <sys/counter.h>
struct ipsec_ctx_data;
-#define IPSEC_INIT_CTX(_ctx, _mp, _sav, _af, _enc) do { \
+#define IPSEC_INIT_CTX(_ctx, _mp, _inp, _sav, _af, _enc) do { \
(_ctx)->mp = (_mp); \
+ (_ctx)->inp = (_inp); \
(_ctx)->sav = (_sav); \
(_ctx)->af = (_af); \
(_ctx)->enc = (_enc); \
Modified: head/sys/netipsec/ipsec_input.c
==============================================================================
--- head/sys/netipsec/ipsec_input.c Mon Jul 31 09:54:04 2017
(r321778)
+++ head/sys/netipsec/ipsec_input.c Mon Jul 31 11:04:35 2017
(r321779)
@@ -325,7 +325,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
(prot == IPPROTO_UDP || prot == IPPROTO_TCP))
udp_ipsec_adjust_cksum(m, sav, prot, skip);
- IPSEC_INIT_CTX(&ctx, &m, sav, AF_INET, IPSEC_ENC_BEFORE);
+ IPSEC_INIT_CTX(&ctx, &m, NULL, sav, AF_INET, IPSEC_ENC_BEFORE);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
goto bad;
ip = mtod(m, struct ip *); /* update pointer */
@@ -416,7 +416,7 @@ ipsec4_common_input_cb(struct mbuf *m, struct secasvar
goto bad;
}
- IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_AFTER);
+ IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
goto bad;
@@ -522,7 +522,7 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar
goto bad;
}
- IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_BEFORE);
+ IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_BEFORE);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
goto bad;
@@ -593,7 +593,7 @@ ipsec6_common_input_cb(struct mbuf *m, struct secasvar
else
#endif
af = AF_INET6;
- IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_AFTER);
+ IPSEC_INIT_CTX(&ctx, &m, NULL, sav, af, IPSEC_ENC_AFTER);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
goto bad;
if (skip == 0) {
Modified: head/sys/netipsec/ipsec_output.c
==============================================================================
--- head/sys/netipsec/ipsec_output.c Mon Jul 31 09:54:04 2017
(r321778)
+++ head/sys/netipsec/ipsec_output.c Mon Jul 31 11:04:35 2017
(r321779)
@@ -181,7 +181,8 @@ next:
* IPsec output logic for IPv4.
*/
static int
-ipsec4_perform_request(struct mbuf *m, struct secpolicy *sp, u_int idx)
+ipsec4_perform_request(struct mbuf *m, struct secpolicy *sp,
+ struct inpcb *inp, u_int idx)
{
struct ipsec_ctx_data ctx;
union sockaddr_union *dst;
@@ -211,7 +212,7 @@ ipsec4_perform_request(struct mbuf *m, struct secpolic
/*
* XXXAE: most likely ip_sum at this point is wrong.
*/
- IPSEC_INIT_CTX(&ctx, &m, sav, AF_INET, IPSEC_ENC_BEFORE);
+ IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET, IPSEC_ENC_BEFORE);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
goto bad;
@@ -235,9 +236,10 @@ ipsec4_perform_request(struct mbuf *m, struct secpolic
/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
goto bad;
}
+ inp = NULL;
}
- IPSEC_INIT_CTX(&ctx, &m, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
+ IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
goto bad;
@@ -285,7 +287,7 @@ ipsec4_process_packet(struct mbuf *m, struct secpolicy
struct inpcb *inp)
{
- return (ipsec4_perform_request(m, sp, 0));
+ return (ipsec4_perform_request(m, sp, inp, 0));
}
static int
@@ -491,7 +493,8 @@ next:
* IPsec output logic for IPv6.
*/
static int
-ipsec6_perform_request(struct mbuf *m, struct secpolicy *sp, u_int idx)
+ipsec6_perform_request(struct mbuf *m, struct secpolicy *sp,
+ struct inpcb *inp, u_int idx)
{
struct ipsec_ctx_data ctx;
union sockaddr_union *dst;
@@ -514,7 +517,7 @@ ipsec6_perform_request(struct mbuf *m, struct secpolic
ip6 = mtod(m, struct ip6_hdr *);
ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6));
- IPSEC_INIT_CTX(&ctx, &m, sav, AF_INET6, IPSEC_ENC_BEFORE);
+ IPSEC_INIT_CTX(&ctx, &m, inp, sav, AF_INET6, IPSEC_ENC_BEFORE);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
goto bad;
@@ -540,9 +543,10 @@ ipsec6_perform_request(struct mbuf *m, struct secpolic
/* XXXAE: IPSEC_OSTAT_INC(tunnel); */
goto bad;
}
+ inp = NULL;
}
- IPSEC_INIT_CTX(&ctx, &m, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
+ IPSEC_INIT_CTX(&ctx, &m, inp, sav, dst->sa.sa_family, IPSEC_ENC_AFTER);
if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_OUT)) != 0)
goto bad;
@@ -585,7 +589,7 @@ ipsec6_process_packet(struct mbuf *m, struct secpolicy
struct inpcb *inp)
{
- return (ipsec6_perform_request(m, sp, 0));
+ return (ipsec6_perform_request(m, sp, inp, 0));
}
static int
@@ -750,14 +754,14 @@ ipsec_process_done(struct mbuf *m, struct secpolicy *s
case AF_INET:
key_freesav(&sav);
IPSECSTAT_INC(ips_out_bundlesa);
- return (ipsec4_perform_request(m, sp, idx));
+ return (ipsec4_perform_request(m, sp, NULL, idx));
/* NOTREACHED */
#endif
#ifdef INET6
case AF_INET6:
key_freesav(&sav);
IPSEC6STAT_INC(ips_out_bundlesa);
- return (ipsec6_perform_request(m, sp, idx));
+ return (ipsec6_perform_request(m, sp, NULL, idx));
/* NOTREACHED */
#endif /* INET6 */
default:
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
