Page MenuHomeFreeBSD

pf: Do not hold PF_RULES_RLOCK while processing Ethernet rules
Needs ReviewPublic

Authored by kp on Aug 31 2021, 8:24 AM.

Details

Reviewers
None
Group Reviewers
network
pfsense
Summary

Avoid the overhead of acquiring a (read) RULES lock when processing the
Ethernet rules.
We can get away with that because when rules are modified they're staged
in V_pf_keth_inactive. We take care to ensure the swap to V_pf_keth is
atomic, so that pf_test_eth_rule() always sees either the old rules, or
the new ruleset.

We need to take care not to delete the old ruleset until we're sure no
pf_test_eth_rule() is still running with those. We accomplish that by
using NET_EPOCH_CALL() to actually free the old rules.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint OK
Unit
No Unit Test Coverage
Build Status
Buildable 42107
Build 38995: arc lint + arc unit