Page MenuHomeFreeBSD

pf: fix dummynet + ipdivert use case
ClosedPublic

Authored by igor.ostapenko_pm.me on Nov 15 2023, 12:56 AM.
Tags
None
Referenced Files
F82730208: D42609.diff
Thu, May 2, 1:51 AM
Unknown Object (File)
Thu, Apr 25, 8:22 PM
Unknown Object (File)
Wed, Apr 10, 4:38 AM
Unknown Object (File)
Wed, Apr 10, 2:43 AM
Unknown Object (File)
Apr 2 2024, 10:24 PM
Unknown Object (File)
Mar 10 2024, 2:35 AM
Unknown Object (File)
Dec 20 2023, 10:18 AM
Unknown Object (File)
Dec 20 2023, 8:38 AM

Details

Summary
Dummynet re-injects an mbuf with MTAG_IPFW_RULE added, and the same mtag
is used by divert(4) as parameters for packet diversion.

If according to pf rule set a packet should go through dummynet first
and through ipdivert after then mentioned mtag must be removed after
dummynet not to make ipdivert think that this is its input parameters.

At the very beginning ipfw consumes this mtag what means the same
behavior with tag clearing after dummynet.

And after fabf705f4b5a pf passes parameters to ipdivert using its
personal MTAG_PF_DIVERT mtag.
    
PR:             274850

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This seems sane to me (and the existing tests pass, which is a nice thing to have).

Two minor remarks, more about taste than actual issues.

sys/netpfil/pf/pf.c
306

I'd call that pf_dummynet_flag_remove() or something

tests/sys/netpfil/pf/Makefile
11 ↗(On Diff #130104)

I'd put this in the existing divert-to tests file.

igor.ostapenko_pm.me edited the summary of this revision. (Show Details)

Sure, it makes sense. Please, consider the second version of the patch.

This revision was not accepted when it landed; it landed in state Needs Review.Nov 17 2023, 5:07 PM
This revision was automatically updated to reflect the committed changes.