Page MenuHomeFreeBSD
Differential D1312

VIMAGE PF fixes #2
AbandonedPublic
Actions

Authored by • rodrigc on Dec 14 2014, 3:18 AM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 21, 5:03 AM
Unknown Object (File)
Fri, Mar 14, 3:09 AM
Unknown Object (File)
Tue, Mar 4, 3:38 AM
Unknown Object (File)
Jan 9 2025, 3:01 PM
Unknown Object (File)
Dec 11 2024, 7:25 AM
Unknown Object (File)
Dec 5 2024, 8:28 PM
Unknown Object (File)
Dec 3 2024, 12:03 AM
Unknown Object (File)
Dec 2 2024, 4:52 AM
View All 79 Files
Subscribers
freebsd-net-list
freebsd-pf-list
freebsd-virtualization-list

Details

Reviewers
trociny
glebius
bz
zec
Group Reviewers
network
Summary

Virtualize the pfr_ktables variable.




Submitted by: Nikos Vassiliadis <nvass gmx.com>
Diff Detail
Lint 
Lint Skipped
 
Unit 
Tests Skipped
 
Event Timeline
• rodrigc updated this revision to Diff 2740.Dec 14 2014, 3:18 AM
• rodrigc retitled this revision from  to VNET PF fixes #2.
• rodrigc updated this object.
• rodrigc edited the test plan for this revision. (Show Details)
• rodrigc added reviewers: bz, glebius, trociny.
• rodrigc retitled this revision from VNET PF fixes #2 to VIMAGE PF fixes #2.
• rodrigc added subscribers: Unknown Object (MLST), Unknown Object (MLST), Unknown Object (MLST).
• rodrigc added reviewers: zec, network.Dec 14 2014, 7:01 PM
• rodrigc abandoned this revision.Jan 6 2015, 8:49 AM
Committed as part of D1309
Revision Contents
Changeset List
PathSize
sys/
netpfil/
pf/
46 lines
Diff 2740
View Options
sys/netpfil/pf/pf_table.c
Context not available.
static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);

static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);




struct pfr_ktablehead         pfr_ktables;
VNET_DEFINE(struct pfr_ktablehead, pfr_ktables);

#define V_pfr_ktables           VNET(pfr_ktables)



struct pfr_table         pfr_nulltable;
struct pfr_table         pfr_nulltable;

int                         pfr_ktable_cnt;


VNET_DEFINE(int, pfr_ktable_cnt);

#define V_pfr_ktable_cnt        VNET(pfr_ktable_cnt)




void
void

pfr_initialize(void)
pfr_initialize(void)

Context not available.
                return (ENOENT);
                return (ENOENT);




        SLIST_INIT(&workq);
        SLIST_INIT(&workq);

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (pfr_skip_table(filter, p, flags))
                if (pfr_skip_table(filter, p, flags))

                        continue;
                        continue;

                if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
                if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))

Context not available.
                    flags & PFR_FLAG_USERIOCTL))
                    flags & PFR_FLAG_USERIOCTL))

                        senderr(EINVAL);
                        senderr(EINVAL);

                key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
                key.pfrkt_flags |= PFR_TFLAG_ACTIVE;

                p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                if (p == NULL) {
                if (p == NULL) {

                        p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
                        p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);

                        if (p == NULL)
                        if (p == NULL)

Context not available.



                        /* find or create root table */
                        /* find or create root table */

                        bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
                        bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));

                        r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                        r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                        if (r != NULL) {
                        if (r != NULL) {

                                p->pfrkt_root = r;
                                p->pfrkt_root = r;

                                goto _skip;
                                goto _skip;

Context not available.
                if (pfr_validate_table(&key.pfrkt_t, 0,
                if (pfr_validate_table(&key.pfrkt_t, 0,

                    flags & PFR_FLAG_USERIOCTL))
                    flags & PFR_FLAG_USERIOCTL))

                        return (EINVAL);
                        return (EINVAL);

                p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
                if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {

                        SLIST_FOREACH(q, &workq, pfrkt_workq)
                        SLIST_FOREACH(q, &workq, pfrkt_workq)

                                if (!pfr_ktable_compare(p, q))
                                if (!pfr_ktable_compare(p, q))

Context not available.
                *size = n;
                *size = n;

                return (0);
                return (0);

        }
        }

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (pfr_skip_table(filter, p, flags))
                if (pfr_skip_table(filter, p, flags))

                        continue;
                        continue;

                if (n-- <= 0)
                if (n-- <= 0)

Context not available.
                return (0);
                return (0);

        }
        }

        SLIST_INIT(&workq);
        SLIST_INIT(&workq);

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (pfr_skip_table(filter, p, flags))
                if (pfr_skip_table(filter, p, flags))

                        continue;
                        continue;

                if (n-- <= 0)
                if (n-- <= 0)

Context not available.
                bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
                bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));

                if (pfr_validate_table(&key.pfrkt_t, 0, 0))
                if (pfr_validate_table(&key.pfrkt_t, 0, 0))

                        return (EINVAL);
                        return (EINVAL);

                p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                if (p != NULL) {
                if (p != NULL) {

                        SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
                        SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);

                        xzero++;
                        xzero++;

Context not available.
                if (pfr_validate_table(&key.pfrkt_t, 0,
                if (pfr_validate_table(&key.pfrkt_t, 0,

                    flags & PFR_FLAG_USERIOCTL))
                    flags & PFR_FLAG_USERIOCTL))

                        return (EINVAL);
                        return (EINVAL);

                p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
                if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {

                        p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
                        p->pfrkt_nflags = (p->pfrkt_flags | setflag) &

                            ~clrflag;
                            ~clrflag;

Context not available.
        if (rs == NULL)
        if (rs == NULL)

                return (ENOMEM);
                return (ENOMEM);

        SLIST_INIT(&workq);
        SLIST_INIT(&workq);

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||

                    pfr_skip_table(trs, p, 0))
                    pfr_skip_table(trs, p, 0))

                        continue;
                        continue;

Context not available.
                return (EBUSY);
                return (EBUSY);

        tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
        tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;

        SLIST_INIT(&tableq);
        SLIST_INIT(&tableq);

        kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
        kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl);

        if (kt == NULL) {
        if (kt == NULL) {

                kt = pfr_create_ktable(tbl, 0, 1);
                kt = pfr_create_ktable(tbl, 0, 1);

                if (kt == NULL)
                if (kt == NULL)

Context not available.
                /* find or create root table */
                /* find or create root table */

                bzero(&key, sizeof(key));
                bzero(&key, sizeof(key));

                strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
                strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));

                rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
                rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key);

                if (rt != NULL) {
                if (rt != NULL) {

                        kt->pfrkt_root = rt;
                        kt->pfrkt_root = rt;

                        goto _skip;
                        goto _skip;

Context not available.
        if (rs == NULL || !rs->topen || ticket != rs->tticket)
        if (rs == NULL || !rs->topen || ticket != rs->tticket)

                return (0);
                return (0);

        SLIST_INIT(&workq);
        SLIST_INIT(&workq);

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||

                    pfr_skip_table(trs, p, 0))
                    pfr_skip_table(trs, p, 0))

                        continue;
                        continue;

Context not available.
                return (EBUSY);
                return (EBUSY);




        SLIST_INIT(&workq);
        SLIST_INIT(&workq);

        RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
        RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) {

                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
                if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||

                    pfr_skip_table(trs, p, 0))
                    pfr_skip_table(trs, p, 0))

                        continue;
                        continue;

Context not available.
        PF_RULES_ASSERT();
        PF_RULES_ASSERT();




        if (flags & PFR_FLAG_ALLRSETS)
        if (flags & PFR_FLAG_ALLRSETS)

                return (pfr_ktable_cnt);
                return (V_pfr_ktable_cnt);

        if (filter->pfrt_anchor[0]) {
        if (filter->pfrt_anchor[0]) {

                rs = pf_find_ruleset(filter->pfrt_anchor);
                rs = pf_find_ruleset(filter->pfrt_anchor);

                return ((rs != NULL) ? rs->tables : -1);
                return ((rs != NULL) ? rs->tables : -1);

Context not available.



        PF_RULES_WASSERT();
        PF_RULES_WASSERT();




        RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
        RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt);

        pfr_ktable_cnt++;
        V_pfr_ktable_cnt++;

        if (kt->pfrkt_root != NULL)
        if (kt->pfrkt_root != NULL)

                if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
                if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)

                        pfr_setflags_ktable(kt->pfrkt_root,
                        pfr_setflags_ktable(kt->pfrkt_root,

Context not available.
        if (!(newf & PFR_TFLAG_ACTIVE))
        if (!(newf & PFR_TFLAG_ACTIVE))

                newf &= ~PFR_TFLAG_USRMASK;
                newf &= ~PFR_TFLAG_USRMASK;

        if (!(newf & PFR_TFLAG_SETMASK)) {
        if (!(newf & PFR_TFLAG_SETMASK)) {

                RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
                RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt);

                if (kt->pfrkt_root != NULL)
                if (kt->pfrkt_root != NULL)

                        if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
                        if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])

                                pfr_setflags_ktable(kt->pfrkt_root,
                                pfr_setflags_ktable(kt->pfrkt_root,

                                    kt->pfrkt_root->pfrkt_flags &
                                    kt->pfrkt_root->pfrkt_flags &

                                        ~PFR_TFLAG_REFDANCHOR);
                                        ~PFR_TFLAG_REFDANCHOR);

                pfr_destroy_ktable(kt, 1);
                pfr_destroy_ktable(kt, 1);

                pfr_ktable_cnt--;
                V_pfr_ktable_cnt--;

                return;
                return;

        }
        }

        if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
        if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {

Context not available.
pfr_lookup_table(struct pfr_table *tbl)
pfr_lookup_table(struct pfr_table *tbl)

{
{

        /* struct pfr_ktable start like a struct pfr_table */
        /* struct pfr_ktable start like a struct pfr_table */

        return (RB_FIND(pfr_ktablehead, &pfr_ktables,
        return (RB_FIND(pfr_ktablehead, &V_pfr_ktables,

            (struct pfr_ktable *)tbl));
            (struct pfr_ktable *)tbl));

}
}




Context not available.