Page MenuHomeFreeBSD

ipfw: fix jail option
ClosedPublic

Authored by kevans on Aug 1 2019, 4:01 PM.
Tags
None
Referenced Files
F148330027: D21128.id60358.diff
Tue, Mar 17, 5:11 AM
F148320169: D21128.id60458.diff
Tue, Mar 17, 3:58 AM
F148319805: D21128.diff
Tue, Mar 17, 3:55 AM
Unknown Object (File)
Mon, Mar 16, 4:13 PM
Unknown Object (File)
Mon, Mar 16, 1:42 AM
Unknown Object (File)
Fri, Mar 6, 1:50 PM
Unknown Object (File)
Fri, Mar 6, 2:38 AM
Unknown Object (File)
Jan 31 2026, 2:29 AM
Subscribers

Details

Summary

rS348215 changed jail_getid(3) to validate passed-in jids as active jails (as the function is documented to return -1 if the jail does not exist). This broke the jail option (in some cases?) as the jail historically hasn't needed to exist at the time of rule parsing; jids will get stored and later applied.

Fix this caller to attempt to parse *av as a number first and just use it as-is to match historical behavior. jail_getid(3) must still be used in order for name arguments to work, but it's strictly a fallback in case we weren't given a number.

[reviewer's note]
Future work should probably change the kernel interface in some way or note in the interface the caveats of the jail parameter. If given a name, it'll resolve to a jid immediately and the name gets lost in transition to kernel -- if the jail restarts and is given a different jid, the rule doesn't follow the name unless the rule's re-evaluated (which isn't done frequently, I would assume). Jids passed in aren't validated for existence and always apply to a jail with that jid, it would likely be nice if jail names worked the same way.

Test Plan

it needs to be tested, as I don't have a setup to test it with- it has only been build-tested.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

ae added inline comments.
sbin/ipfw/ipfw2.c
4693 ↗(On Diff #60358)

It seems *av can not be '\0' here. The NEED1() macro does check for required argument.

This revision is now accepted and ready to land.Aug 2 2019, 8:32 AM

The user who reported this on freebsd-stable@ confirms that it works for them, so I'll likely commit it tomorrow morning (~20 hours from now) with a 3-day MFC window and afterwards propose it as 11.3 EN.

sbin/ipfw/ipfw2.c
4693 ↗(On Diff #60358)

Ah, true enough! I'll just drop that clause pre-commit without another review iteration of that's alright with you.

This revision was automatically updated to reflect the committed changes.