Page MenuHomeFreeBSD

pf: Do not hold PF_RULES_RLOCK while processing Ethernet rules

Authored by kp on Aug 31 2021, 8:24 AM.
Referenced Files
Unknown Object (File)
Mar 22 2023, 6:09 PM
Unknown Object (File)
Mar 22 2023, 6:09 PM
Unknown Object (File)
Mar 12 2023, 11:32 PM
Unknown Object (File)
Mar 5 2023, 7:41 AM
Unknown Object (File)
Jan 13 2023, 2:12 AM
Unknown Object (File)
Dec 31 2022, 2:53 AM
Unknown Object (File)
Dec 25 2022, 11:00 PM



Avoid the overhead of acquiring a (read) RULES lock when processing the
Ethernet rules.
We can get away with that because when rules are modified they're staged
in V_pf_keth_inactive. We take care to ensure the swap to V_pf_keth is
atomic, so that pf_test_eth_rule() always sees either the old rules, or
the new ruleset.

We need to take care not to delete the old ruleset until we're sure no
pf_test_eth_rule() is still running with those. We accomplish that by
using NET_EPOCH_CALL() to actually free the old rules.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

rG FreeBSD src repository
Lint Not Applicable
Tests Not Applicable

Event Timeline

Why the use of ck_* instead of atomic_*?

In D31739#776252, @mjg wrote:

Why the use of ck_* instead of atomic_*?

That'd probably work too, but we typically use the ck_* functions in combination with epoch. For example, in ifnet_byindex() or prison_ip_check().

This revision was not accepted when it landed; it landed in state Needs Review.Mar 2 2022, 4:01 PM
This revision was automatically updated to reflect the committed changes.