Page MenuHomeFreeBSD

pf: Do not hold PF_RULES_RLOCK while processing Ethernet rules

Authored by kp on Aug 31 2021, 8:24 AM.
Referenced Files
Unknown Object (File)
Tue, Jun 11, 3:04 AM
Unknown Object (File)
Mon, May 20, 9:17 PM
Unknown Object (File)
Fri, May 17, 8:17 PM
Unknown Object (File)
May 1 2024, 4:52 AM
Unknown Object (File)
Apr 26 2024, 9:20 AM
Unknown Object (File)
Apr 23 2024, 6:19 PM
Unknown Object (File)
Mar 29 2024, 1:59 AM
Unknown Object (File)
Jan 14 2024, 7:42 AM



Avoid the overhead of acquiring a (read) RULES lock when processing the
Ethernet rules.
We can get away with that because when rules are modified they're staged
in V_pf_keth_inactive. We take care to ensure the swap to V_pf_keth is
atomic, so that pf_test_eth_rule() always sees either the old rules, or
the new ruleset.

We need to take care not to delete the old ruleset until we're sure no
pf_test_eth_rule() is still running with those. We accomplish that by
using NET_EPOCH_CALL() to actually free the old rules.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

rG FreeBSD src repository
Lint Not Applicable
Tests Not Applicable

Event Timeline

Why the use of ck_* instead of atomic_*?

In D31739#776252, @mjg wrote:

Why the use of ck_* instead of atomic_*?

That'd probably work too, but we typically use the ck_* functions in combination with epoch. For example, in ifnet_byindex() or prison_ip_check().

This revision was not accepted when it landed; it landed in state Needs Review.Mar 2 2022, 4:01 PM
This revision was automatically updated to reflect the committed changes.