Module Name: src
Committed By: rmind
Date: Mon Feb 20 00:18:20 UTC 2012
Modified Files:
src/sys/net/npf: npf.c npf_alg.c npf_alg_icmp.c npf_ctl.c npf_handler.c
npf_impl.h npf_inet.c npf_instr.c npf_log.c npf_nat.c
npf_processor.c npf_rproc.c npf_ruleset.c npf_sendpkt.c
npf_session.c npf_tableset.c
src/usr.sbin/npf/npfctl: npf_build.c
Log Message:
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/sys/net/npf/npf.c
cvs rdiff -u -r1.2 -r1.3 src/sys/net/npf/npf_alg.c src/sys/net/npf/npf_log.c
cvs rdiff -u -r1.8 -r1.9 src/sys/net/npf/npf_alg_icmp.c \
src/sys/net/npf/npf_sendpkt.c
cvs rdiff -u -r1.12 -r1.13 src/sys/net/npf/npf_ctl.c
cvs rdiff -u -r1.13 -r1.14 src/sys/net/npf/npf_handler.c
cvs rdiff -u -r1.10 -r1.11 src/sys/net/npf/npf_impl.h \
src/sys/net/npf/npf_inet.c src/sys/net/npf/npf_nat.c \
src/sys/net/npf/npf_ruleset.c src/sys/net/npf/npf_session.c
cvs rdiff -u -r1.9 -r1.10 src/sys/net/npf/npf_instr.c \
src/sys/net/npf/npf_processor.c src/sys/net/npf/npf_tableset.c
cvs rdiff -u -r1.1 -r1.2 src/sys/net/npf/npf_rproc.c
cvs rdiff -u -r1.4 -r1.5 src/usr.sbin/npf/npfctl/npf_build.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/npf/npf.c
diff -u src/sys/net/npf/npf.c:1.7 src/sys/net/npf/npf.c:1.8
--- src/sys/net/npf/npf.c:1.7 Sun Jan 15 00:49:48 2012
+++ src/sys/net/npf/npf.c Mon Feb 20 00:18:19 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf.c,v 1.7 2012/01/15 00:49:48 rmind Exp $ */
+/* $NetBSD: npf.c,v 1.8 2012/02/20 00:18:19 rmind Exp $ */
/*-
* Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7 2012/01/15 00:49:48 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.8 2012/02/20 00:18:19 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -70,6 +70,7 @@ typedef struct {
npf_ruleset_t * n_rules;
npf_tableset_t * n_tables;
npf_ruleset_t * n_nat_rules;
+ bool n_default_pass;
} npf_core_t;
static void npf_core_destroy(npf_core_t *);
@@ -106,7 +107,7 @@ npf_init(void)
rset = npf_ruleset_create();
tset = npf_tableset_create();
nset = npf_ruleset_create();
- npf_reload(rset, tset, nset);
+ npf_reload(rset, tset, nset, true);
KASSERT(npf_core != NULL);
#ifdef _MODULE
@@ -265,12 +266,14 @@ npf_core_destroy(npf_core_t *nc)
* Then destroy old (unloaded) structures.
*/
void
-npf_reload(npf_ruleset_t *rset, npf_tableset_t *tset, npf_ruleset_t *nset)
+npf_reload(npf_ruleset_t *rset, npf_tableset_t *tset, npf_ruleset_t *nset,
+ bool flush)
{
npf_core_t *nc, *onc;
/* Setup a new core structure. */
- nc = kmem_alloc(sizeof(npf_core_t), KM_SLEEP);
+ nc = kmem_zalloc(sizeof(npf_core_t), KM_SLEEP);
+ nc->n_default_pass = flush;
nc->n_rules = rset;
nc->n_tables = tset;
nc->n_nat_rules = nset;
@@ -330,6 +333,13 @@ npf_core_locked(void)
return rw_lock_held(&npf_lock);
}
+bool
+npf_default_pass(void)
+{
+ KASSERT(rw_lock_held(&npf_lock));
+ return npf_core->n_default_pass;
+}
+
/*
* NPF statistics interface.
*/
Index: src/sys/net/npf/npf_alg.c
diff -u src/sys/net/npf/npf_alg.c:1.2 src/sys/net/npf/npf_alg.c:1.3
--- src/sys/net/npf/npf_alg.c:1.2 Thu Nov 11 06:30:39 2010
+++ src/sys/net/npf/npf_alg.c Mon Feb 20 00:18:19 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_alg.c,v 1.2 2010/11/11 06:30:39 rmind Exp $ */
+/* $NetBSD: npf_alg.c,v 1.3 2012/02/20 00:18:19 rmind Exp $ */
/*-
* Copyright (c) 2010 The NetBSD Foundation, Inc.
@@ -36,10 +36,9 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.2 2010/11/11 06:30:39 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.3 2012/02/20 00:18:19 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
#include <sys/kmem.h>
#include <sys/pool.h>
#include <net/pfil.h>
@@ -83,7 +82,7 @@ npf_alg_register(npf_algfunc_t match, np
{
npf_alg_t *alg;
- alg = kmem_alloc(sizeof(npf_alg_t), KM_SLEEP);
+ alg = kmem_zalloc(sizeof(npf_alg_t), KM_SLEEP);
alg->na_bptr = alg;
alg->na_match_func = match;
alg->na_out_func = out;
Index: src/sys/net/npf/npf_log.c
diff -u src/sys/net/npf/npf_log.c:1.2 src/sys/net/npf/npf_log.c:1.3
--- src/sys/net/npf/npf_log.c:1.2 Tue Jan 18 20:33:46 2011
+++ src/sys/net/npf/npf_log.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_log.c,v 1.2 2011/01/18 20:33:46 rmind Exp $ */
+/* $NetBSD: npf_log.c,v 1.3 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2010-2011 The NetBSD Foundation, Inc.
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_log.c,v 1.2 2011/01/18 20:33:46 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_log.c,v 1.3 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <sys/conf.h>
#include <sys/kmem.h>
Index: src/sys/net/npf/npf_alg_icmp.c
diff -u src/sys/net/npf/npf_alg_icmp.c:1.8 src/sys/net/npf/npf_alg_icmp.c:1.9
--- src/sys/net/npf/npf_alg_icmp.c:1.8 Tue Nov 29 20:05:30 2011
+++ src/sys/net/npf/npf_alg_icmp.c Mon Feb 20 00:18:19 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_alg_icmp.c,v 1.8 2011/11/29 20:05:30 rmind Exp $ */
+/* $NetBSD: npf_alg_icmp.c,v 1.9 2012/02/20 00:18:19 rmind Exp $ */
/*-
* Copyright (c) 2010 The NetBSD Foundation, Inc.
@@ -34,10 +34,9 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_alg_icmp.c,v 1.8 2011/11/29 20:05:30 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_alg_icmp.c,v 1.9 2012/02/20 00:18:19 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
#include <sys/module.h>
#include <sys/pool.h>
Index: src/sys/net/npf/npf_sendpkt.c
diff -u src/sys/net/npf/npf_sendpkt.c:1.8 src/sys/net/npf/npf_sendpkt.c:1.9
--- src/sys/net/npf/npf_sendpkt.c:1.8 Tue Nov 29 20:05:30 2011
+++ src/sys/net/npf/npf_sendpkt.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_sendpkt.c,v 1.8 2011/11/29 20:05:30 rmind Exp $ */
+/* $NetBSD: npf_sendpkt.c,v 1.9 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2010-2011 The NetBSD Foundation, Inc.
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.8 2011/11/29 20:05:30 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_sendpkt.c,v 1.9 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
Index: src/sys/net/npf/npf_ctl.c
diff -u src/sys/net/npf/npf_ctl.c:1.12 src/sys/net/npf/npf_ctl.c:1.13
--- src/sys/net/npf/npf_ctl.c:1.12 Sun Feb 5 00:37:13 2012
+++ src/sys/net/npf/npf_ctl.c Mon Feb 20 00:18:19 2012
@@ -1,7 +1,7 @@
-/* $NetBSD: npf_ctl.c,v 1.12 2012/02/05 00:37:13 rmind Exp $ */
+/* $NetBSD: npf_ctl.c,v 1.13 2012/02/20 00:18:19 rmind Exp $ */
/*-
- * Copyright (c) 2009-2011 The NetBSD Foundation, Inc.
+ * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
@@ -37,11 +37,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.12 2012/02/05 00:37:13 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.13 2012/02/20 00:18:19 rmind Exp $");
#include <sys/param.h>
#include <sys/conf.h>
-#include <sys/kernel.h>
#include <prop/proplib.h>
@@ -479,7 +478,7 @@ npfctl_reload(u_long cmd, void *data)
* Finally - reload ruleset, tableset and NAT policies.
* Operation will be performed as a single transaction.
*/
- npf_reload(rlset, tblset, nset);
+ npf_reload(rlset, tblset, nset, flush);
/* Turn on/off session tracking accordingly. */
npf_session_tracking(!flush);
@@ -506,7 +505,9 @@ fail:
/* Error report. */
prop_dictionary_set_int32(errdict, "errno", error);
+#ifdef _KERNEL
prop_dictionary_copyout_ioctl(pref, cmd, errdict);
+#endif
prop_object_release(errdict);
return 0;
}
@@ -561,7 +562,9 @@ out: /* Error path. */
/* Error report. */
prop_dictionary_set_int32(errdict, "errno", error);
+#ifdef _KERNEL
prop_dictionary_copyout_ioctl(pref, cmd, errdict);
+#endif
prop_object_release(errdict);
return error;
}
Index: src/sys/net/npf/npf_handler.c
diff -u src/sys/net/npf/npf_handler.c:1.13 src/sys/net/npf/npf_handler.c:1.14
--- src/sys/net/npf/npf_handler.c:1.13 Mon Feb 6 23:30:14 2012
+++ src/sys/net/npf/npf_handler.c Mon Feb 20 00:18:19 2012
@@ -1,7 +1,7 @@
-/* $NetBSD: npf_handler.c,v 1.13 2012/02/06 23:30:14 rmind Exp $ */
+/* $NetBSD: npf_handler.c,v 1.14 2012/02/20 00:18:19 rmind Exp $ */
/*-
- * Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
+ * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.13 2012/02/06 23:30:14 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.14 2012/02/20 00:18:19 rmind Exp $");
+#include <sys/types.h>
#include <sys/param.h>
-#include <sys/systm.h>
#include <sys/mbuf.h>
#include <sys/mutex.h>
@@ -61,8 +61,6 @@ static struct pfil_head * npf_ph_if = NU
static struct pfil_head * npf_ph_inet = NULL;
static struct pfil_head * npf_ph_inet6 = NULL;
-static bool default_pass = true;
-
int npf_packet_handler(void *, struct mbuf **, ifnet_t *, int);
/*
@@ -89,26 +87,28 @@ npf_packet_handler(void *arg, struct mbu
npf_ruleset_t *rlset;
npf_rule_t *rl;
npf_rproc_t *rp;
- int retfl, error, ret;
+ int error, retfl;
+ int decision;
/*
* Initialise packet information cache.
* Note: it is enough to clear the info bits.
*/
npc.npc_info = 0;
+ decision = NPF_DECISION_BLOCK;
error = 0;
retfl = 0;
rp = NULL;
- ret = 0;
/* Cache everything. Determine whether it is an IP fragment. */
if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) {
+ int ret = -1;
+
/* Pass to IPv4 or IPv6 reassembly mechanism. */
if (npf_iscached(&npc, NPC_IP4)) {
struct ip *ip = nbuf_dataptr(*mp);
ret = ip_reass_packet(mp, ip);
- } else {
- KASSERT(npf_iscached(&npc, NPC_IP6));
+ } else if (npf_iscached(&npc, NPC_IP6)) {
#ifdef INET6
/*
* Note: frag6_input() offset is the start of the
@@ -116,11 +116,8 @@ npf_packet_handler(void *arg, struct mbu
*/
const u_int hlen = npf_cache_hlen(&npc);
ret = ip6_reass_packet(mp, hlen);
-#else
- ret = -1;
#endif
}
-
if (ret) {
error = EINVAL;
se = NULL;
@@ -137,7 +134,9 @@ npf_packet_handler(void *arg, struct mbu
*/
nbuf = (nbuf_t *)*mp;
npc.npc_info = 0;
- (void)npf_cache_all(&npc, nbuf);
+
+ ret = npf_cache_all(&npc, nbuf);
+ KASSERT((ret & NPC_IPFRAG) == 0);
}
/* Inspect the list of sessions. */
@@ -146,8 +145,10 @@ npf_packet_handler(void *arg, struct mbu
/* If "passing" session found - skip the ruleset inspection. */
if (se && npf_session_pass(se, &rp)) {
npf_stats_inc(NPF_STAT_PASS_SESSION);
+ KASSERT(error == 0);
goto pass;
- } else if (error) {
+ }
+ if (error) {
goto block;
}
@@ -156,13 +157,14 @@ npf_packet_handler(void *arg, struct mbu
rlset = npf_core_ruleset();
rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3);
if (rl == NULL) {
+ bool default_pass = npf_default_pass();
npf_core_exit();
+
if (default_pass) {
npf_stats_inc(NPF_STAT_PASS_DEFAULT);
goto pass;
}
npf_stats_inc(NPF_STAT_BLOCK_DEFAULT);
- error = ENETUNREACH;
goto block;
}
@@ -181,20 +183,21 @@ npf_packet_handler(void *arg, struct mbu
}
npf_stats_inc(NPF_STAT_PASS_RULESET);
- /* Establish a "pass" session, if required. */
+ /*
+ * Establish a "pass" session, if required. Just proceed, if session
+ * creation fails (e.g. due to unsupported protocol).
+ *
+ * Note: the reference on the rule procedure is transfered to the
+ * session. It will be released on session destruction.
+ */
if ((retfl & NPF_RULE_KEEPSTATE) != 0 && !se) {
se = npf_session_establish(&npc, nbuf, di);
- if (se == NULL) {
- error = ENOMEM;
- goto out;
+ if (se) {
+ npf_session_setpass(se, rp);
}
- /*
- * Note: the reference to the rule procedure is transfered to
- * the session. It will be released on session destruction.
- */
- npf_session_setpass(se, rp);
}
pass:
+ decision = NPF_DECISION_PASS;
KASSERT(error == 0);
/*
* Perform NAT.
@@ -218,8 +221,8 @@ out:
npf_rproc_release(rp);
}
- /* Pass the packet, if no error. */
- if (!error) {
+ /* Pass the packet if decided and there is no error. */
+ if (decision == NPF_DECISION_PASS && !error) {
/*
* XXX: Disable for now, it will be set accordingly later,
* for optimisations (to reduce inspection).
@@ -236,9 +239,10 @@ out:
if (retfl) {
npf_return_block(&npc, nbuf, retfl);
}
- if (error != ENETUNREACH) {
- NPF_PRINTF(("NPF: error in handler '%d'\n", error));
+ if (error) {
npf_stats_inc(NPF_STAT_ERROR);
+ } else {
+ error = ENETUNREACH;
}
m_freem(*mp);
*mp = NULL;
@@ -267,7 +271,7 @@ npf_register_pfil(void)
npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
- if (npf_ph_if == NULL || npf_ph_inet == NULL) {
+ if (npf_ph_if == NULL || npf_ph_inet == NULL || npf_ph_inet6 == NULL) {
npf_ph_if = NULL;
error = ENOENT;
goto fail;
Index: src/sys/net/npf/npf_impl.h
diff -u src/sys/net/npf/npf_impl.h:1.10 src/sys/net/npf/npf_impl.h:1.11
--- src/sys/net/npf/npf_impl.h:1.10 Mon Feb 6 23:30:14 2012
+++ src/sys/net/npf/npf_impl.h Mon Feb 20 00:18:19 2012
@@ -1,7 +1,7 @@
-/* $NetBSD: npf_impl.h,v 1.10 2012/02/06 23:30:14 rmind Exp $ */
+/* $NetBSD: npf_impl.h,v 1.11 2012/02/20 00:18:19 rmind Exp $ */
/*-
- * Copyright (c) 2009-2011 The NetBSD Foundation, Inc.
+ * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
@@ -91,6 +91,9 @@ typedef npf_table_t * npf_tableset_t;
* DEFINITIONS.
*/
+#define NPF_DECISION_BLOCK 0
+#define NPF_DECISION_PASS 1
+
typedef bool (*npf_algfunc_t)(npf_cache_t *, nbuf_t *, void *);
#define NPF_NCODE_LIMIT 1024
@@ -127,7 +130,9 @@ npf_ruleset_t * npf_core_natset(void);
npf_tableset_t *npf_core_tableset(void);
void npf_core_exit(void);
bool npf_core_locked(void);
-void npf_reload(npf_ruleset_t *, npf_tableset_t *, npf_ruleset_t *);
+bool npf_default_pass(void);
+void npf_reload(npf_ruleset_t *, npf_tableset_t *,
+ npf_ruleset_t *, bool);
void npflogattach(int);
void npflogdetach(void);
Index: src/sys/net/npf/npf_inet.c
diff -u src/sys/net/npf/npf_inet.c:1.10 src/sys/net/npf/npf_inet.c:1.11
--- src/sys/net/npf/npf_inet.c:1.10 Tue Nov 29 20:05:30 2011
+++ src/sys/net/npf/npf_inet.c Mon Feb 20 00:18:19 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_inet.c,v 1.10 2011/11/29 20:05:30 rmind Exp $ */
+/* $NetBSD: npf_inet.c,v 1.11 2012/02/20 00:18:19 rmind Exp $ */
/*-
* Copyright (c) 2009-2011 The NetBSD Foundation, Inc.
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.10 2011/11/29 20:05:30 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.11 2012/02/20 00:18:19 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <net/pfil.h>
#include <net/if.h>
Index: src/sys/net/npf/npf_nat.c
diff -u src/sys/net/npf/npf_nat.c:1.10 src/sys/net/npf/npf_nat.c:1.11
--- src/sys/net/npf/npf_nat.c:1.10 Sun Feb 5 00:37:13 2012
+++ src/sys/net/npf/npf_nat.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_nat.c,v 1.10 2012/02/05 00:37:13 rmind Exp $ */
+/* $NetBSD: npf_nat.c,v 1.11 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2010-2011 The NetBSD Foundation, Inc.
@@ -76,10 +76,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.10 2012/02/05 00:37:13 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.11 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <sys/atomic.h>
#include <sys/bitops.h>
Index: src/sys/net/npf/npf_ruleset.c
diff -u src/sys/net/npf/npf_ruleset.c:1.10 src/sys/net/npf/npf_ruleset.c:1.11
--- src/sys/net/npf/npf_ruleset.c:1.10 Mon Feb 6 23:30:14 2012
+++ src/sys/net/npf/npf_ruleset.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_ruleset.c,v 1.10 2012/02/06 23:30:14 rmind Exp $ */
+/* $NetBSD: npf_ruleset.c,v 1.11 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.10 2012/02/06 23:30:14 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.11 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <sys/kmem.h>
#include <sys/queue.h>
@@ -208,7 +208,7 @@ npf_rule_alloc(prop_dictionary_t rldict,
int errat __unused;
/* Allocate a rule structure. */
- rl = kmem_alloc(sizeof(npf_rule_t), KM_SLEEP);
+ rl = kmem_zalloc(sizeof(npf_rule_t), KM_SLEEP);
TAILQ_INIT(&rl->r_subset.rs_queue);
rl->r_natp = NULL;
@@ -217,14 +217,14 @@ npf_rule_alloc(prop_dictionary_t rldict,
rl->r_ncode = nc;
rl->r_nc_size = nc_size;
- /* Name (string, optional) */
+ /* Name (optional) */
if (prop_dictionary_get_cstring_nocopy(rldict, "name", &rname)) {
strlcpy(rl->r_name, rname, NPF_RNAME_LEN);
} else {
rl->r_name[0] = '\0';
}
- /* Attributes, priority and interface ID. */
+ /* Attributes, priority and interface ID (optional). */
prop_dictionary_get_uint32(rldict, "attributes", &rl->r_attr);
prop_dictionary_get_int32(rldict, "priority", &rl->r_priority);
prop_dictionary_get_uint32(rldict, "interface", &rl->r_ifid);
Index: src/sys/net/npf/npf_session.c
diff -u src/sys/net/npf/npf_session.c:1.10 src/sys/net/npf/npf_session.c:1.11
--- src/sys/net/npf/npf_session.c:1.10 Tue Nov 29 20:05:30 2011
+++ src/sys/net/npf/npf_session.c Mon Feb 20 00:18:20 2012
@@ -1,7 +1,7 @@
-/* $NetBSD: npf_session.c,v 1.10 2011/11/29 20:05:30 rmind Exp $ */
+/* $NetBSD: npf_session.c,v 1.11 2012/02/20 00:18:20 rmind Exp $ */
/*-
- * Copyright (c) 2010-2011 The NetBSD Foundation, Inc.
+ * Copyright (c) 2010-2012 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
@@ -74,10 +74,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_session.c,v 1.10 2011/11/29 20:05:30 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_session.c,v 1.11 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
@@ -93,7 +93,6 @@ __KERNEL_RCSID(0, "$NetBSD: npf_session.
#include <sys/rwlock.h>
#include <sys/queue.h>
#include <sys/systm.h>
-#include <sys/types.h>
#include "npf_impl.h"
@@ -277,7 +276,7 @@ sess_htable_create(void)
npf_sehash_t *stbl, *sh;
u_int i;
- stbl = kmem_alloc(SESS_HASH_BUCKETS * sizeof(*sh), KM_SLEEP);
+ stbl = kmem_zalloc(SESS_HASH_BUCKETS * sizeof(*sh), KM_SLEEP);
if (stbl == NULL) {
return NULL;
}
@@ -406,7 +405,10 @@ npf_session_inspect(npf_cache_t *npc, nb
npf_sentry_t *sen;
npf_session_t *se;
- /* Layer 3 and 4 should be already cached for session tracking. */
+ /*
+ * If layer 3 and 4 are not cached - protocol is not supported
+ * or packet is invalid.
+ */
if (!sess_tracking || !npf_iscached(npc, NPC_IP46) ||
!npf_iscached(npc, NPC_LAYER4)) {
return NULL;
@@ -491,7 +493,7 @@ npf_session_inspect(npf_cache_t *npc, nb
/*
* npf_establish_session: create a new session, insert into the global list.
*
- * => Sessions is created with the held reference (for caller).
+ * => Session is created with the reference held for the caller.
*/
npf_session_t *
npf_session_establish(const npf_cache_t *npc, nbuf_t *nbuf, const int di)
@@ -504,11 +506,14 @@ npf_session_establish(const npf_cache_t
int proto, sz;
bool ok;
- if (!sess_tracking) {
+ /*
+ * If layer 3 and 4 are not cached - protocol is not supported
+ * or packet is invalid.
+ */
+ if (!sess_tracking || !npf_iscached(npc, NPC_IP46) ||
+ !npf_iscached(npc, NPC_LAYER4)) {
return NULL;
}
- KASSERT(npf_iscached(npc, NPC_IP46));
- KASSERT(npf_iscached(npc, NPC_LAYER4));
/* Allocate and initialise new state. */
se = pool_cache_get(sess_cache, PR_NOWAIT);
Index: src/sys/net/npf/npf_instr.c
diff -u src/sys/net/npf/npf_instr.c:1.9 src/sys/net/npf/npf_instr.c:1.10
--- src/sys/net/npf/npf_instr.c:1.9 Sun Jan 15 00:49:48 2012
+++ src/sys/net/npf/npf_instr.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_instr.c,v 1.9 2012/01/15 00:49:48 rmind Exp $ */
+/* $NetBSD: npf_instr.c,v 1.10 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
@@ -34,10 +34,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_instr.c,v 1.9 2012/01/15 00:49:48 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_instr.c,v 1.10 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <net/if.h>
#include <net/ethertypes.h>
Index: src/sys/net/npf/npf_processor.c
diff -u src/sys/net/npf/npf_processor.c:1.9 src/sys/net/npf/npf_processor.c:1.10
--- src/sys/net/npf/npf_processor.c:1.9 Sun Feb 5 00:37:13 2012
+++ src/sys/net/npf/npf_processor.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_processor.c,v 1.9 2012/02/05 00:37:13 rmind Exp $ */
+/* $NetBSD: npf_processor.c,v 1.10 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
@@ -47,17 +47,12 @@
* N-code memory address and thus instructions should be word aligned.
* All processing is done in 32 bit words, since both instructions (their
* codes) and arguments use 32 bits words.
- *
- * TODO:
- * - There is some space for better a abstraction. Duplicated opcode
- * maintenance in npf_ncode_process() and nc_insn_check() might be avoided.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_processor.c,v 1.9 2012/02/05 00:37:13 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_processor.c,v 1.10 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
#include <sys/types.h>
#include <sys/kmem.h>
Index: src/sys/net/npf/npf_tableset.c
diff -u src/sys/net/npf/npf_tableset.c:1.9 src/sys/net/npf/npf_tableset.c:1.10
--- src/sys/net/npf/npf_tableset.c:1.9 Sun Jan 15 00:49:49 2012
+++ src/sys/net/npf/npf_tableset.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_tableset.c,v 1.9 2012/01/15 00:49:49 rmind Exp $ */
+/* $NetBSD: npf_tableset.c,v 1.10 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -39,10 +39,10 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.9 2012/01/15 00:49:49 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_tableset.c,v 1.10 2012/02/20 00:18:20 rmind Exp $");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <sys/atomic.h>
#include <sys/hash.h>
Index: src/sys/net/npf/npf_rproc.c
diff -u src/sys/net/npf/npf_rproc.c:1.1 src/sys/net/npf/npf_rproc.c:1.2
--- src/sys/net/npf/npf_rproc.c:1.1 Mon Feb 6 23:30:14 2012
+++ src/sys/net/npf/npf_rproc.c Mon Feb 20 00:18:20 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_rproc.c,v 1.1 2012/02/06 23:30:14 rmind Exp $ */
+/* $NetBSD: npf_rproc.c,v 1.2 2012/02/20 00:18:20 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -37,11 +37,10 @@
__KERNEL_RCSID(0, "$NetBSD");
#include <sys/param.h>
-#include <sys/kernel.h>
+#include <sys/types.h>
#include <sys/atomic.h>
#include <sys/kmem.h>
-#include <sys/types.h>
#include "npf_impl.h"
@@ -69,7 +68,7 @@ npf_rproc_create(prop_dictionary_t rpdic
npf_rproc_t *rp;
const char *rname;
- rp = kmem_zalloc(sizeof(npf_rproc_t), KM_SLEEP);
+ rp = kmem_intr_zalloc(sizeof(npf_rproc_t), KM_SLEEP);
rp->rp_refcnt = 1;
/* Name and flags. */
@@ -107,7 +106,7 @@ npf_rproc_release(npf_rproc_t *rp)
if (atomic_dec_uint_nv(&rp->rp_refcnt) != 0) {
return;
}
- kmem_free(rp, sizeof(npf_rproc_t));
+ kmem_intr_free(rp, sizeof(npf_rproc_t));
}
void
Index: src/usr.sbin/npf/npfctl/npf_build.c
diff -u src/usr.sbin/npf/npfctl/npf_build.c:1.4 src/usr.sbin/npf/npfctl/npf_build.c:1.5
--- src/usr.sbin/npf/npfctl/npf_build.c:1.4 Mon Feb 6 00:37:52 2012
+++ src/usr.sbin/npf/npfctl/npf_build.c Mon Feb 20 00:18:19 2012
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_build.c,v 1.4 2012/02/06 00:37:52 rmind Exp $ */
+/* $NetBSD: npf_build.c,v 1.5 2012/02/20 00:18:19 rmind Exp $ */
/*-
* Copyright (c) 2011-2012 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__RCSID("$NetBSD: npf_build.c,v 1.4 2012/02/06 00:37:52 rmind Exp $");
+__RCSID("$NetBSD: npf_build.c,v 1.5 2012/02/20 00:18:19 rmind Exp $");
#include <sys/types.h>
#include <sys/ioctl.h>
@@ -400,9 +400,8 @@ npfctl_build_group(const char *name, int
} else if ((attr & attr_di) == 0) {
attr |= attr_di;
}
- attr |= (NPF_RULE_PASS | NPF_RULE_FINAL);
- rl = npf_rule_create(name, attr, if_idx);
+ rl = npf_rule_create(name, attr | NPF_RULE_FINAL, if_idx);
npf_rule_insert(npf_conf, NULL, rl, NPF_PRI_NEXT);
current_group = rl;
}
