On Wed, Dec 02, 2015 at 07:45:09PM +0100, Alexander Bluhm wrote: > Here is a new version of the diff. This is new:
Now with feedback from sashan@ - merge - no SS_ISCONNECTED check in tcp as it was before - fix the disabled call to pf_inp_lookup() in udp input ok? bluhm Index: net/pf.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pf.c,v retrieving revision 1.955 diff -u -p -r1.955 pf.c --- net/pf.c 3 Dec 2015 09:49:15 -0000 1.955 +++ net/pf.c 3 Dec 2015 09:54:54 -0000 @@ -6728,6 +6728,40 @@ pf_pkt_addr_changed(struct mbuf *m) m->m_pkthdr.pf.inp = NULL; } +struct inpcb * +pf_inp_lookup(struct mbuf *m) +{ + struct inpcb *inp = NULL; + + if (m->m_pkthdr.pf.statekey) { + inp = m->m_pkthdr.pf.statekey->inp; + if (inp && inp->inp_pf_sk) + KASSERT(m->m_pkthdr.pf.statekey == inp->inp_pf_sk); + } + return (inp); +} + +void +pf_inp_link(struct mbuf *m, struct inpcb *inp) +{ + if (m->m_pkthdr.pf.statekey && inp && + !m->m_pkthdr.pf.statekey->inp && !inp->inp_pf_sk) { + m->m_pkthdr.pf.statekey->inp = inp; + inp->inp_pf_sk = m->m_pkthdr.pf.statekey; + } + /* The statekey has finished finding the inp, it is no longer needed. */ + m->m_pkthdr.pf.statekey = NULL; +} + +void +pf_inp_unlink(struct inpcb *inp) +{ + if (inp->inp_pf_sk) { + inp->inp_pf_sk->inp = NULL; + inp->inp_pf_sk = NULL; + } +} + #if NPFLOG > 0 void pf_log_matches(struct pf_pdesc *pd, struct pf_rule *rm, struct pf_rule *am, Index: net/pfvar.h =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfvar.h,v retrieving revision 1.425 diff -u -p -r1.425 pfvar.h --- net/pfvar.h 3 Dec 2015 09:49:15 -0000 1.425 +++ net/pfvar.h 3 Dec 2015 09:54:54 -0000 @@ -1754,6 +1754,9 @@ int pf_rtlabel_match(struct pf_addr *, s int pf_socket_lookup(struct pf_pdesc *); struct pf_state_key *pf_alloc_state_key(int); void pf_pkt_addr_changed(struct mbuf *); +struct inpcb *pf_inp_lookup(struct mbuf *); +void pf_inp_link(struct mbuf *, struct inpcb *); +void pf_inp_unlink(struct inpcb *); int pf_state_key_attach(struct pf_state_key *, struct pf_state *, int); int pf_translate(struct pf_pdesc *, struct pf_addr *, u_int16_t, struct pf_addr *, u_int16_t, u_int16_t, int); Index: netinet/in_pcb.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/in_pcb.c,v retrieving revision 1.191 diff -u -p -r1.191 in_pcb.c --- netinet/in_pcb.c 3 Dec 2015 09:49:15 -0000 1.191 +++ netinet/in_pcb.c 3 Dec 2015 09:55:13 -0000 @@ -530,8 +530,7 @@ in_pcbdetach(struct inpcb *inp) if (inp->inp_pf_sk) { pf_remove_divert_state(inp->inp_pf_sk); /* pf_remove_divert_state() may have detached the state */ - if (inp->inp_pf_sk) - inp->inp_pf_sk->inp = NULL; + pf_inp_unlink(inp); } #endif s = splnet(); Index: netinet/tcp_input.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_input.c,v retrieving revision 1.310 diff -u -p -r1.310 tcp_input.c --- netinet/tcp_input.c 29 Nov 2015 15:09:32 -0000 1.310 +++ netinet/tcp_input.c 3 Dec 2015 11:05:44 -0000 @@ -580,11 +580,7 @@ tcp_input(struct mbuf *m, ...) * Locate pcb for segment. */ #if NPF > 0 - if (m->m_pkthdr.pf.statekey) { - inp = m->m_pkthdr.pf.statekey->inp; - if (inp && inp->inp_pf_sk) - KASSERT(m->m_pkthdr.pf.statekey == inp->inp_pf_sk); - } + inp = pf_inp_lookup(m); #endif findpcb: if (inp == NULL) { @@ -602,12 +598,6 @@ findpcb: m->m_pkthdr.ph_rtableid); break; } -#if NPF > 0 - if (m->m_pkthdr.pf.statekey && inp) { - m->m_pkthdr.pf.statekey->inp = inp; - inp->inp_pf_sk = m->m_pkthdr.pf.statekey; - } -#endif } if (inp == NULL) { int inpl_reverse = 0; @@ -880,13 +870,7 @@ findpcb: #endif #if NPF > 0 - if (m->m_pkthdr.pf.statekey && !m->m_pkthdr.pf.statekey->inp && - !inp->inp_pf_sk) { - m->m_pkthdr.pf.statekey->inp = inp; - inp->inp_pf_sk = m->m_pkthdr.pf.statekey; - } - /* The statekey has finished finding the inp, it is no longer needed. */ - m->m_pkthdr.pf.statekey = NULL; + pf_inp_link(m, inp); #endif #ifdef IPSEC @@ -1294,10 +1278,7 @@ trimthenstep6: * has already been linked to the socket. Remove the * link between old socket and new state. */ - if (inp->inp_pf_sk) { - inp->inp_pf_sk->inp = NULL; - inp->inp_pf_sk = NULL; - } + pf_inp_unlink(inp); #endif /* * Advance the iss by at least 32768, but Index: netinet/udp_usrreq.c =================================================================== RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/udp_usrreq.c,v retrieving revision 1.207 diff -u -p -r1.207 udp_usrreq.c --- netinet/udp_usrreq.c 11 Sep 2015 07:42:35 -0000 1.207 +++ netinet/udp_usrreq.c 3 Dec 2015 11:12:14 -0000 @@ -527,12 +527,8 @@ udp_input(struct mbuf *m, ...) /* * Locate pcb for datagram. */ -#if 0 - if (m->m_pkthdr.pf.statekey) { - inp = m->m_pkthdr.pf.statekey->inp; - if (inp && inp->inp_pf_sk) - KASSERT(m->m_pkthdr.pf.statekey == inp->inp_pf_sk); - } +#if NPF > 0 && 0 /* currently disabled */ + inp = pf_inp_lookup(m); #endif if (inp == NULL) { #ifdef INET6 @@ -544,12 +540,6 @@ udp_input(struct mbuf *m, ...) #endif /* INET6 */ inp = in_pcbhashlookup(&udbtable, ip->ip_src, uh->uh_sport, ip->ip_dst, uh->uh_dport, m->m_pkthdr.ph_rtableid); -#if NPF > 0 - if (m->m_pkthdr.pf.statekey && inp) { - m->m_pkthdr.pf.statekey->inp = inp; - inp->inp_pf_sk = m->m_pkthdr.pf.statekey; - } -#endif } if (inp == 0) { int inpl_reverse = 0; @@ -591,13 +581,8 @@ udp_input(struct mbuf *m, ...) KASSERT(sotoinpcb(inp->inp_socket) == inp); #if NPF > 0 - if (m->m_pkthdr.pf.statekey && !m->m_pkthdr.pf.statekey->inp && - !inp->inp_pf_sk && (inp->inp_socket->so_state & SS_ISCONNECTED)) { - m->m_pkthdr.pf.statekey->inp = inp; - inp->inp_pf_sk = m->m_pkthdr.pf.statekey; - } - /* The statekey has finished finding the inp, it is no longer needed. */ - m->m_pkthdr.pf.statekey = NULL; + if (inp->inp_socket->so_state & SS_ISCONNECTED) + pf_inp_link(m, inp); #endif #ifdef IPSEC