CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Tue Mar 14 17:09:21 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf.h npf_mbuf.c npf_sendpkt.c Log Message: Pull up following revision(s) (requested by kardel in ticket #119): sys/net/npf/npf_mbuf.c: revision 1.25 sys/net/npf/npf.h: revision 1.64 sys/net/npf/npf_sendpkt.c: revision 1.23 PR kern/56052: allow block-return packets passed through without rule matching. Included up-stream ashttps://github.com/rmind/npf/pull/115 To generate a diff of this commit: cvs rdiff -u -r1.63 -r1.63.20.1 src/sys/net/npf/npf.h cvs rdiff -u -r1.24 -r1.24.20.1 src/sys/net/npf/npf_mbuf.c cvs rdiff -u -r1.22 -r1.22.20.1 src/sys/net/npf/npf_sendpkt.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/net/npf/npf.h diff -u src/sys/net/npf/npf.h:1.63 src/sys/net/npf/npf.h:1.63.20.1 --- src/sys/net/npf/npf.h:1.63 Sat May 30 14:16:56 2020 +++ src/sys/net/npf/npf.h Tue Mar 14 17:09:21 2023 @@ -122,6 +122,7 @@ void * nbuf_ensure_writable(nbuf_t *, s bool nbuf_cksum_barrier(nbuf_t *, int); int nbuf_add_tag(nbuf_t *, uint32_t); +int npf_mbuf_add_tag(nbuf_t *, struct mbuf *, uint32_t); int nbuf_find_tag(nbuf_t *, uint32_t *); /* Index: src/sys/net/npf/npf_mbuf.c diff -u src/sys/net/npf/npf_mbuf.c:1.24 src/sys/net/npf/npf_mbuf.c:1.24.20.1 --- src/sys/net/npf/npf_mbuf.c:1.24 Sat May 30 14:16:56 2020 +++ src/sys/net/npf/npf_mbuf.c Tue Mar 14 17:09:21 2023 @@ -36,7 +36,7 @@ #ifdef _KERNEL #include -__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.24 2020/05/30 14:16:56 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.24.20.1 2023/03/14 17:09:21 martin Exp $"); #include #include @@ -297,14 +297,13 @@ nbuf_cksum_barrier(nbuf_t *nbuf, int di) } /* - * nbuf_add_tag: associate a tag with the network buffer. + * npf_mbuf_add_tag: associate a tag with the network buffer. * * => Returns 0 on success or error number on failure. */ int -nbuf_add_tag(nbuf_t *nbuf, uint32_t val) +npf_mbuf_add_tag(nbuf_t *nbuf, struct mbuf *m, uint32_t val) { - struct mbuf *m = nbuf->nb_mbuf0; #ifdef _KERNEL struct m_tag *mt; uint32_t *dat; @@ -328,6 +327,18 @@ nbuf_add_tag(nbuf_t *nbuf, uint32_t val) } /* + * nbuf_add_tag: associate a tag with the network buffer. + * + * => Returns 0 on success or error number on failure. + */ +int +nbuf_add_tag(nbuf_t *nbuf, uint32_t val) +{ + struct mbuf *m = nbuf->nb_mbuf0; + return npf_mbuf_add_tag(nbuf, m, val); +} + +/* * nbuf_find_tag: find a tag associated with a network buffer. * * => Returns 0 on success or error number on failure. Index: src/sys/net/npf/npf_sendpkt.c diff -u src/sys/net/npf/npf_sendpkt.c:1.22 src/sys/net/npf/npf_sendpkt.c:1.22.20.1 --- src/sys/net/npf/npf_sendpkt.c:1.22 Sat May 30 14:16:56 2020 +++ src/sys/net/npf/npf_sendpkt.c Tue Mar 14 17:09:21 2023 @@ -33,7 +33,7 @@ #ifdef _KERNEL #include -__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.22 2020/05/30 14:16:56 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.22.20.1 2023/03/14 17:09:21 martin Exp $"); #include #include @@ -197,6 +197,9 @@ npf_return_tcp(npf_cache_t *npc) } } + /* don't look at our generated reject packets going out */ + (void)npf_mbuf_add_tag(npc->npc_nbuf, m, NPF_NTAG_PASS); + /* Pass to IP layer. */ if (npf_iscached(npc, NPC_IP4)) { return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL); @@ -215,6 +218,9 @@ npf_return_icmp(const npf_cache_t *npc) { struct mbuf *m = nbuf_head_mbuf(npc->npc_nbuf); + /* don't look at our generated reject packets going out */ + (void)nbuf_add_tag(npc->npc_nbuf, NPF_NTAG_PASS); + if (npf_iscached(npc, NPC_IP4)) { icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_ADMIN_PROHIBIT, 0, 0); return 0;
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Tue Mar 14 17:09:21 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf.h npf_mbuf.c npf_sendpkt.c Log Message: Pull up following revision(s) (requested by kardel in ticket #119): sys/net/npf/npf_mbuf.c: revision 1.25 sys/net/npf/npf.h: revision 1.64 sys/net/npf/npf_sendpkt.c: revision 1.23 PR kern/56052: allow block-return packets passed through without rule matching. Included up-stream ashttps://github.com/rmind/npf/pull/115 To generate a diff of this commit: cvs rdiff -u -r1.63 -r1.63.20.1 src/sys/net/npf/npf.h cvs rdiff -u -r1.24 -r1.24.20.1 src/sys/net/npf/npf_mbuf.c cvs rdiff -u -r1.22 -r1.22.20.1 src/sys/net/npf/npf_sendpkt.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Mon Aug 21 12:18:17 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_tableset.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #332): sys/net/npf/npf_tableset.c: revision 1.41 npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181 To generate a diff of this commit: cvs rdiff -u -r1.38 -r1.38.4.1 src/sys/net/npf/npf_tableset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Mon Aug 21 12:18:17 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_tableset.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #332): sys/net/npf/npf_tableset.c: revision 1.41 npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181 To generate a diff of this commit: cvs rdiff -u -r1.38 -r1.38.4.1 src/sys/net/npf/npf_tableset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/net/npf/npf_tableset.c diff -u src/sys/net/npf/npf_tableset.c:1.38 src/sys/net/npf/npf_tableset.c:1.38.4.1 --- src/sys/net/npf/npf_tableset.c:1.38 Sat Apr 9 23:38:33 2022 +++ src/sys/net/npf/npf_tableset.c Mon Aug 21 12:18:17 2023 @@ -46,7 +46,7 @@ #ifdef _KERNEL #include -__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.38 2022/04/09 23:38:33 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.38.4.1 2023/08/21 12:18:17 martin Exp $"); #include #include @@ -762,15 +762,17 @@ table_ent_copyout(const npf_addr_t *addr } static int -table_generic_list(const npf_table_t *t, void *ubuf, size_t len) +table_generic_list(npf_table_t *t, void *ubuf, size_t len) { npf_tblent_t *ent; size_t off = 0; int error = 0; LIST_FOREACH(ent, &t->t_list, te_listent) { + mutex_exit(&t->t_lock); error = table_ent_copyout(&ent->te_addr, ent->te_alen, ent->te_preflen, ubuf, len, &off); + mutex_enter(&t->t_lock); if (error) break; }
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Wed Aug 23 18:19:32 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_ruleset.c Log Message: Pull up following revision(s) (requested by kardel in ticket #340): sys/net/npf/npf_ruleset.c: revision 1.52 The analysis documented in PR misc/56990 is correct. Fix by not returning when encountering a ruleset rule. The code up to now would stop at any group rule. ruleset rules are marked as group rule and a dynamic rule. processing is only finished when a result is present AND we are looking at a plain group rule. To generate a diff of this commit: cvs rdiff -u -r1.51 -r1.51.20.1 src/sys/net/npf/npf_ruleset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/sys/net/npf/npf_ruleset.c diff -u src/sys/net/npf/npf_ruleset.c:1.51 src/sys/net/npf/npf_ruleset.c:1.51.20.1 --- src/sys/net/npf/npf_ruleset.c:1.51 Sat May 30 14:16:56 2020 +++ src/sys/net/npf/npf_ruleset.c Wed Aug 23 18:19:32 2023 @@ -34,7 +34,7 @@ #ifdef _KERNEL #include -__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.51 2020/05/30 14:16:56 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.51.20.1 2023/08/23 18:19:32 martin Exp $"); #include #include @@ -891,7 +891,7 @@ npf_ruleset_inspect(npf_cache_t *npc, co KASSERT(n < skip_to); /* Group is a barrier: return a matching if found any. */ - if ((attr & NPF_RULE_GROUP) != 0 && final_rl) { + if ((attr & NPF_DYNAMIC_GROUP) == NPF_RULE_GROUP && final_rl) { break; }
CVS commit: [netbsd-10] src/sys/net/npf
Module Name:src Committed By: martin Date: Wed Aug 23 18:19:32 UTC 2023 Modified Files: src/sys/net/npf [netbsd-10]: npf_ruleset.c Log Message: Pull up following revision(s) (requested by kardel in ticket #340): sys/net/npf/npf_ruleset.c: revision 1.52 The analysis documented in PR misc/56990 is correct. Fix by not returning when encountering a ruleset rule. The code up to now would stop at any group rule. ruleset rules are marked as group rule and a dynamic rule. processing is only finished when a result is present AND we are looking at a plain group rule. To generate a diff of this commit: cvs rdiff -u -r1.51 -r1.51.20.1 src/sys/net/npf/npf_ruleset.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.