On Wed, Oct 19, 2016 at 11:49:56PM +0200, Alexander Bluhm wrote:
> I would like to pass a struct pf_pdesc to pf_route() like it is
> done in the other pf functions. That means less parameters, more
> consistency and later I can call functions that need an pd from
> pf_route().
After splitting pf_pdesc and pf_headers into a separate header file,
the diff looks like this.
While there, sort the includes like in the other pf files.
ok?
bluhm
Index: net/if_pfsync.c
===================================================================
RCS file: /cvs/src/sys/net/if_pfsync.c,v
retrieving revision 1.235
diff -u -p -r1.235 if_pfsync.c
--- net/if_pfsync.c 4 Oct 2016 13:54:32 -0000 1.235
+++ net/if_pfsync.c 26 Oct 2016 21:44:33 -0000
@@ -59,19 +59,19 @@
#include <net/if_types.h>
#include <net/bpf.h>
#include <net/netisr.h>
+
#include <netinet/in.h>
#include <netinet/if_ether.h>
-#include <netinet/tcp.h>
-#include <netinet/tcp_seq.h>
-#include <netinet/tcp_fsm.h>
-
-#include <netinet/in_var.h>
#include <netinet/ip.h>
+#include <netinet/in_var.h>
#include <netinet/ip_var.h>
-
-#ifdef IPSEC
#include <netinet/ip_ipsp.h>
-#endif /* IPSEC */
+#include <netinet/ip_icmp.h>
+#include <netinet/icmp6.h>
+#include <netinet/tcp.h>
+#include <netinet/tcp_seq.h>
+#include <netinet/tcp_fsm.h>
+#include <netinet/udp.h>
#ifdef INET6
#include <netinet6/in6_var.h>
@@ -87,7 +87,7 @@
#define PF_DEBUGNAME "pfsync: "
#include <net/pfvar.h>
-#include <netinet/ip_ipsp.h>
+#include <net/pfvar_priv.h>
#include <net/if_pfsync.h>
#include "bpfilter.h"
@@ -1732,6 +1732,8 @@ void
pfsync_undefer(struct pfsync_deferral *pd, int drop)
{
struct pfsync_softc *sc = pfsyncif;
+ struct pf_pdesc pdesc;
+ union pf_headers pdhdrs;
splsoftassert(IPL_SOFTNET);
@@ -1743,17 +1745,22 @@ pfsync_undefer(struct pfsync_deferral *p
m_freem(pd->pd_m);
else {
if (pd->pd_st->rule.ptr->rt == PF_ROUTETO) {
+ if (pf_setup_pdesc(&pdesc, &pdhdrs,
+ pd->pd_st->key[PF_SK_WIRE]->af,
+ pd->pd_st->direction, pd->pd_st->rt_kif,
+ pd->pd_m, NULL) != PF_PASS) {
+ m_freem(pd->pd_m);
+ goto out;
+ }
switch (pd->pd_st->key[PF_SK_WIRE]->af) {
case AF_INET:
- pf_route(&pd->pd_m, pd->pd_st->rule.ptr,
- pd->pd_st->direction,
- pd->pd_st->rt_kif->pfik_ifp, pd->pd_st);
+ pf_route(&pd->pd_m, &pdesc,
+ pd->pd_st->rule.ptr, pd->pd_st);
break;
#ifdef INET6
case AF_INET6:
- pf_route6(&pd->pd_m, pd->pd_st->rule.ptr,
- pd->pd_st->direction,
- pd->pd_st->rt_kif->pfik_ifp, pd->pd_st);
+ pf_route6(&pd->pd_m, &pdesc,
+ pd->pd_st->rule.ptr, pd->pd_st);
break;
#endif /* INET6 */
}
@@ -1772,7 +1779,7 @@ pfsync_undefer(struct pfsync_deferral *p
}
}
}
-
+ out:
pool_put(&sc->sc_pool, pd);
}
Index: net/pf.c
===================================================================
RCS file: /cvs/src/sys/net/pf.c,v
retrieving revision 1.994
diff -u -p -r1.994 pf.c
--- net/pf.c 26 Oct 2016 21:07:22 -0000 1.994
+++ net/pf.c 26 Oct 2016 21:44:34 -0000
@@ -5782,7 +5782,7 @@ pf_rtlabel_match(struct pf_addr *addr, s
}
void
-pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
+pf_route(struct mbuf **m, struct pf_pdesc *pd, struct pf_rule *r,
struct pf_state *s)
{
struct mbuf *m0, *m1;
@@ -5795,8 +5795,7 @@ pf_route(struct mbuf **m, struct pf_rule
int error = 0;
unsigned int rtableid;
- if (m == NULL || *m == NULL || r == NULL ||
- (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
+ if (m == NULL || *m == NULL || r == NULL)
panic("pf_route: invalid parameters");
if ((*m)->m_pkthdr.pf.routed++ > 3) {
@@ -5809,7 +5808,7 @@ pf_route(struct mbuf **m, struct pf_rule
if ((m0 = m_dup_pkt(*m, max_linkhdr, M_NOWAIT)) == NULL)
return;
} else {
- if ((r->rt == PF_REPLYTO) == (r->direction == dir))
+ if ((r->rt == PF_REPLYTO) == (r->direction == pd->dir))
return;
m0 = *m;
}
@@ -5874,7 +5873,7 @@ pf_route(struct mbuf **m, struct pf_rule
goto bad;
- if (oifp != ifp) {
+ if (pd->kif->pfik_ifp != ifp) {
if (pf_test(AF_INET, PF_OUT, ifp, &m0) != PF_PASS)
goto bad;
else if (m0 == NULL)
@@ -5949,7 +5948,7 @@ bad:
#ifdef INET6
void
-pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
+pf_route6(struct mbuf **m, struct pf_pdesc *pd, struct pf_rule *r,
struct pf_state *s)
{
struct mbuf *m0;
@@ -5962,8 +5961,7 @@ pf_route6(struct mbuf **m, struct pf_rul
struct m_tag *mtag;
unsigned int rtableid;
- if (m == NULL || *m == NULL || r == NULL ||
- (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
+ if (m == NULL || *m == NULL || r == NULL)
panic("pf_route6: invalid parameters");
if ((*m)->m_pkthdr.pf.routed++ > 3) {
@@ -5976,7 +5974,7 @@ pf_route6(struct mbuf **m, struct pf_rul
if ((m0 = m_dup_pkt(*m, max_linkhdr, M_NOWAIT)) == NULL)
return;
} else {
- if ((r->rt == PF_REPLYTO) == (r->direction == dir))
+ if ((r->rt == PF_REPLYTO) == (r->direction == pd->dir))
return;
m0 = *m;
}
@@ -6022,7 +6020,7 @@ pf_route6(struct mbuf **m, struct pf_rul
if (ifp == NULL)
goto bad;
- if (oifp != ifp) {
+ if (pd->kif->pfik_ifp != ifp) {
if (pf_test(AF_INET6, PF_OUT, ifp, &m0) != PF_PASS)
goto bad;
else if (m0 == NULL)
@@ -6923,9 +6921,9 @@ done:
break;
}
if (pd.naf == AF_INET)
- pf_route(&pd.m, r, dir, kif->pfik_ifp, s);
+ pf_route(&pd.m, &pd, r, s);
if (pd.naf == AF_INET6)
- pf_route6(&pd.m, r, dir, kif->pfik_ifp, s);
+ pf_route6(&pd.m, &pd, r, s);
*m0 = NULL;
action = PF_PASS;
break;
@@ -6939,11 +6937,11 @@ done:
if (r->rt) {
switch (pd.af) {
case AF_INET:
- pf_route(m0, r, pd.dir, pd.kif->pfik_ifp, s);
+ pf_route(m0, &pd, r, s);
break;
#ifdef INET6
case AF_INET6:
- pf_route6(m0, r, pd.dir, pd.kif->pfik_ifp, s);
+ pf_route6(m0, &pd, r, s);
break;
#endif /* INET6 */
}
Index: net/pfvar.h
===================================================================
RCS file: /cvs/src/sys/net/pfvar.h,v
retrieving revision 1.442
diff -u -p -r1.442 pfvar.h
--- net/pfvar.h 26 Oct 2016 21:07:22 -0000 1.442
+++ net/pfvar.h 26 Oct 2016 21:44:34 -0000
@@ -1710,10 +1710,10 @@ int pf_state_key_attach(struct pf_state_
int pf_translate(struct pf_pdesc *, struct pf_addr *, u_int16_t,
struct pf_addr *, u_int16_t, u_int16_t, int);
int pf_translate_af(struct pf_pdesc *);
-void pf_route(struct mbuf **, struct pf_rule *, int,
- struct ifnet *, struct pf_state *);
-void pf_route6(struct mbuf **, struct pf_rule *, int,
- struct ifnet *, struct pf_state *);
+void pf_route(struct mbuf **, struct pf_pdesc *, struct pf_rule *,
+ struct pf_state *);
+void pf_route6(struct mbuf **, struct pf_pdesc *, struct pf_rule *,
+ struct pf_state *);
void pfr_initialize(void);
int pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t);
