On Wed, Oct 19, 2016 at 11:49:56PM +0200, Alexander Bluhm wrote: > I would like to pass a struct pf_pdesc to pf_route() like it is > done in the other pf functions. That means less parameters, more > consistency and later I can call functions that need an pd from > pf_route().
After splitting pf_pdesc and pf_headers into a separate header file, the diff looks like this. While there, sort the includes like in the other pf files. ok? bluhm Index: net/if_pfsync.c =================================================================== RCS file: /cvs/src/sys/net/if_pfsync.c,v retrieving revision 1.235 diff -u -p -r1.235 if_pfsync.c --- net/if_pfsync.c 4 Oct 2016 13:54:32 -0000 1.235 +++ net/if_pfsync.c 26 Oct 2016 21:44:33 -0000 @@ -59,19 +59,19 @@ #include <net/if_types.h> #include <net/bpf.h> #include <net/netisr.h> + #include <netinet/in.h> #include <netinet/if_ether.h> -#include <netinet/tcp.h> -#include <netinet/tcp_seq.h> -#include <netinet/tcp_fsm.h> - -#include <netinet/in_var.h> #include <netinet/ip.h> +#include <netinet/in_var.h> #include <netinet/ip_var.h> - -#ifdef IPSEC #include <netinet/ip_ipsp.h> -#endif /* IPSEC */ +#include <netinet/ip_icmp.h> +#include <netinet/icmp6.h> +#include <netinet/tcp.h> +#include <netinet/tcp_seq.h> +#include <netinet/tcp_fsm.h> +#include <netinet/udp.h> #ifdef INET6 #include <netinet6/in6_var.h> @@ -87,7 +87,7 @@ #define PF_DEBUGNAME "pfsync: " #include <net/pfvar.h> -#include <netinet/ip_ipsp.h> +#include <net/pfvar_priv.h> #include <net/if_pfsync.h> #include "bpfilter.h" @@ -1732,6 +1732,8 @@ void pfsync_undefer(struct pfsync_deferral *pd, int drop) { struct pfsync_softc *sc = pfsyncif; + struct pf_pdesc pdesc; + union pf_headers pdhdrs; splsoftassert(IPL_SOFTNET); @@ -1743,17 +1745,22 @@ pfsync_undefer(struct pfsync_deferral *p m_freem(pd->pd_m); else { if (pd->pd_st->rule.ptr->rt == PF_ROUTETO) { + if (pf_setup_pdesc(&pdesc, &pdhdrs, + pd->pd_st->key[PF_SK_WIRE]->af, + pd->pd_st->direction, pd->pd_st->rt_kif, + pd->pd_m, NULL) != PF_PASS) { + m_freem(pd->pd_m); + goto out; + } switch (pd->pd_st->key[PF_SK_WIRE]->af) { case AF_INET: - pf_route(&pd->pd_m, pd->pd_st->rule.ptr, - pd->pd_st->direction, - pd->pd_st->rt_kif->pfik_ifp, pd->pd_st); + pf_route(&pd->pd_m, &pdesc, + pd->pd_st->rule.ptr, pd->pd_st); break; #ifdef INET6 case AF_INET6: - pf_route6(&pd->pd_m, pd->pd_st->rule.ptr, - pd->pd_st->direction, - pd->pd_st->rt_kif->pfik_ifp, pd->pd_st); + pf_route6(&pd->pd_m, &pdesc, + pd->pd_st->rule.ptr, pd->pd_st); break; #endif /* INET6 */ } @@ -1772,7 +1779,7 @@ pfsync_undefer(struct pfsync_deferral *p } } } - + out: pool_put(&sc->sc_pool, pd); } Index: net/pf.c =================================================================== RCS file: /cvs/src/sys/net/pf.c,v retrieving revision 1.994 diff -u -p -r1.994 pf.c --- net/pf.c 26 Oct 2016 21:07:22 -0000 1.994 +++ net/pf.c 26 Oct 2016 21:44:34 -0000 @@ -5782,7 +5782,7 @@ pf_rtlabel_match(struct pf_addr *addr, s } void -pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, +pf_route(struct mbuf **m, struct pf_pdesc *pd, struct pf_rule *r, struct pf_state *s) { struct mbuf *m0, *m1; @@ -5795,8 +5795,7 @@ pf_route(struct mbuf **m, struct pf_rule int error = 0; unsigned int rtableid; - if (m == NULL || *m == NULL || r == NULL || - (dir != PF_IN && dir != PF_OUT) || oifp == NULL) + if (m == NULL || *m == NULL || r == NULL) panic("pf_route: invalid parameters"); if ((*m)->m_pkthdr.pf.routed++ > 3) { @@ -5809,7 +5808,7 @@ pf_route(struct mbuf **m, struct pf_rule if ((m0 = m_dup_pkt(*m, max_linkhdr, M_NOWAIT)) == NULL) return; } else { - if ((r->rt == PF_REPLYTO) == (r->direction == dir)) + if ((r->rt == PF_REPLYTO) == (r->direction == pd->dir)) return; m0 = *m; } @@ -5874,7 +5873,7 @@ pf_route(struct mbuf **m, struct pf_rule goto bad; - if (oifp != ifp) { + if (pd->kif->pfik_ifp != ifp) { if (pf_test(AF_INET, PF_OUT, ifp, &m0) != PF_PASS) goto bad; else if (m0 == NULL) @@ -5949,7 +5948,7 @@ bad: #ifdef INET6 void -pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, +pf_route6(struct mbuf **m, struct pf_pdesc *pd, struct pf_rule *r, struct pf_state *s) { struct mbuf *m0; @@ -5962,8 +5961,7 @@ pf_route6(struct mbuf **m, struct pf_rul struct m_tag *mtag; unsigned int rtableid; - if (m == NULL || *m == NULL || r == NULL || - (dir != PF_IN && dir != PF_OUT) || oifp == NULL) + if (m == NULL || *m == NULL || r == NULL) panic("pf_route6: invalid parameters"); if ((*m)->m_pkthdr.pf.routed++ > 3) { @@ -5976,7 +5974,7 @@ pf_route6(struct mbuf **m, struct pf_rul if ((m0 = m_dup_pkt(*m, max_linkhdr, M_NOWAIT)) == NULL) return; } else { - if ((r->rt == PF_REPLYTO) == (r->direction == dir)) + if ((r->rt == PF_REPLYTO) == (r->direction == pd->dir)) return; m0 = *m; } @@ -6022,7 +6020,7 @@ pf_route6(struct mbuf **m, struct pf_rul if (ifp == NULL) goto bad; - if (oifp != ifp) { + if (pd->kif->pfik_ifp != ifp) { if (pf_test(AF_INET6, PF_OUT, ifp, &m0) != PF_PASS) goto bad; else if (m0 == NULL) @@ -6923,9 +6921,9 @@ done: break; } if (pd.naf == AF_INET) - pf_route(&pd.m, r, dir, kif->pfik_ifp, s); + pf_route(&pd.m, &pd, r, s); if (pd.naf == AF_INET6) - pf_route6(&pd.m, r, dir, kif->pfik_ifp, s); + pf_route6(&pd.m, &pd, r, s); *m0 = NULL; action = PF_PASS; break; @@ -6939,11 +6937,11 @@ done: if (r->rt) { switch (pd.af) { case AF_INET: - pf_route(m0, r, pd.dir, pd.kif->pfik_ifp, s); + pf_route(m0, &pd, r, s); break; #ifdef INET6 case AF_INET6: - pf_route6(m0, r, pd.dir, pd.kif->pfik_ifp, s); + pf_route6(m0, &pd, r, s); break; #endif /* INET6 */ } Index: net/pfvar.h =================================================================== RCS file: /cvs/src/sys/net/pfvar.h,v retrieving revision 1.442 diff -u -p -r1.442 pfvar.h --- net/pfvar.h 26 Oct 2016 21:07:22 -0000 1.442 +++ net/pfvar.h 26 Oct 2016 21:44:34 -0000 @@ -1710,10 +1710,10 @@ int pf_state_key_attach(struct pf_state_ int pf_translate(struct pf_pdesc *, struct pf_addr *, u_int16_t, struct pf_addr *, u_int16_t, u_int16_t, int); int pf_translate_af(struct pf_pdesc *); -void pf_route(struct mbuf **, struct pf_rule *, int, - struct ifnet *, struct pf_state *); -void pf_route6(struct mbuf **, struct pf_rule *, int, - struct ifnet *, struct pf_state *); +void pf_route(struct mbuf **, struct pf_pdesc *, struct pf_rule *, + struct pf_state *); +void pf_route6(struct mbuf **, struct pf_pdesc *, struct pf_rule *, + struct pf_state *); void pfr_initialize(void); int pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t);