Page MenuHomeFreeBSD
Differential D36277 Diff 112819 sys/netpfil/pf/if_pfsync.c

Changeset View

Standalone View

View Options

sys/netpfil/pf/if_pfsync.c

Show First 20 Lines • Show All 69 Lines • ▼ Show 20 Lines
#include <sys/bus.h> #include <sys/bus.h>
#include <sys/endian.h> #include <sys/endian.h>
#include <sys/interrupt.h> #include <sys/interrupt.h>
#include <sys/kernel.h> #include <sys/kernel.h>
#include <sys/lock.h> #include <sys/lock.h>
#include <sys/mbuf.h> #include <sys/mbuf.h>
#include <sys/module.h> #include <sys/module.h>
#include <sys/mutex.h> #include <sys/mutex.h>
#include <sys/nv.h>
#include <sys/priv.h> #include <sys/priv.h>
#include <sys/smp.h> #include <sys/smp.h>
#include <sys/socket.h> #include <sys/socket.h>
#include <sys/sockio.h> #include <sys/sockio.h>
#include <sys/sysctl.h> #include <sys/sysctl.h>
#include <sys/syslog.h> #include <sys/syslog.h>
#include <net/bpf.h> #include <net/bpf.h>
#include <net/if.h> #include <net/if.h>
#include <net/if_var.h> #include <net/if_var.h>
#include <net/if_clone.h> #include <net/if_clone.h>
#include <net/if_types.h> #include <net/if_types.h>
#include <net/vnet.h> #include <net/vnet.h>
#include <net/pfvar.h> #include <net/pfvar.h>
glebiusUnsubmitted
Not Done
Inline Actions

What did bring in this requirement?

glebius: What did bring in this requirement?
email_luiz.eng.brAuthorUnsubmitted
Done
Inline Actions

What did bring in this requirement?

email_luiz.eng.br: > What did bring in this requirement?
email_luiz.eng.brAuthorUnsubmitted
Not Done
Inline Actions

It doesn't belong on this diff, ended up here by accident.

With the IPv6 code in place, it's needed in order to have RT_DEFAULT_FIB for a in6_selectsrc_addr() call.

email_luiz.eng.br: It doesn't belong on this diff, ended up here by accident. With the IPv6 code in place, it's…
#include <net/if_pfsync.h> #include <net/if_pfsync.h>
#include <netinet/if_ether.h> #include <netinet/if_ether.h>
#include <netinet/in.h> #include <netinet/in.h>
#include <netinet/in_var.h> #include <netinet/in_var.h>
#include <netinet/ip.h> #include <netinet/ip.h>
#include <netinet/ip_carp.h> #include <netinet/ip_carp.h>
#include <netinet/ip_var.h> #include <netinet/ip_var.h>
#include <netinet/tcp.h> #include <netinet/tcp.h>
#include <netinet/tcp_fsm.h> #include <netinet/tcp_fsm.h>
#include <netinet/tcp_seq.h> #include <netinet/tcp_seq.h>
#include <netpfil/pf/pfsync_nv.h>
struct pfsync_bucket;
union inet_template {
struct ip ipv4;
};
#define PFSYNC_MINPKT ( \ #define PFSYNC_MINPKT ( \
sizeof(struct ip) + \ sizeof(union inet_template) + \
sizeof(struct pfsync_header) + \ sizeof(struct pfsync_header) + \
sizeof(struct pfsync_subheader) ) sizeof(struct pfsync_subheader) )
struct pfsync_bucket;
static int pfsync_upd_tcp(struct pf_kstate *, struct pfsync_state_peer *, static int pfsync_upd_tcp(struct pf_kstate *, struct pfsync_state_peer *,
kpUnsubmitted
Not Done
Inline Actions

Same question here. If we change the size of pfsync_pkt we're going to be changing the on-wire protocol, and that's going to break sync between versions with and without IPv6 support.

kp: Same question here. If we change the size of pfsync_pkt we're going to be changing the on-wire…
email_luiz.eng.brAuthorUnsubmitted
Not Done
Inline Actions

Same as the previous case, I did the change without being aware of the implications.

I honestly don't have an idea on how to deal with it. I welcome any suggestions.

email_luiz.eng.br: Same as the previous case, I did the change without being aware of the implications. I…
struct pfsync_state_peer *); struct pfsync_state_peer *);
static int pfsync_in_clr(struct mbuf *, int, int, int); static int pfsync_in_clr(struct mbuf *, int, int, int);
static int pfsync_in_ins(struct mbuf *, int, int, int); static int pfsync_in_ins(struct mbuf *, int, int, int);
static int pfsync_in_iack(struct mbuf *, int, int, int); static int pfsync_in_iack(struct mbuf *, int, int, int);
static int pfsync_in_upd(struct mbuf *, int, int, int); static int pfsync_in_upd(struct mbuf *, int, int, int);
static int pfsync_in_upd_c(struct mbuf *, int, int, int); static int pfsync_in_upd_c(struct mbuf *, int, int, int);
static int pfsync_in_ureq(struct mbuf *, int, int, int); static int pfsync_in_ureq(struct mbuf *, int, int, int);
static int pfsync_in_del(struct mbuf *, int, int, int); static int pfsync_in_del(struct mbuf *, int, int, int);
▲ Show 20 Lines • Show All 81 Lines • ▼ Show 20 Lines#define PFSYNCF_BUCKET_PUSH 0x00000001
struct ifaltq b_snd; struct ifaltq b_snd;
}; };
struct pfsync_softc { struct pfsync_softc {
/* Configuration */ /* Configuration */
struct ifnet *sc_ifp; struct ifnet *sc_ifp;
struct ifnet *sc_sync_if; struct ifnet *sc_sync_if;
struct ip_moptions sc_imo; struct ip_moptions sc_imo;
struct in_addr sc_sync_peer; struct sockaddr_storage sc_sync_peer;
uint32_t sc_flags; uint32_t sc_flags;
uint8_t sc_maxupdates; uint8_t sc_maxupdates;
struct ip sc_template; union inet_template sc_template;
struct mtx sc_mtx; struct mtx sc_mtx;
/* Queued data */ /* Queued data */
struct pfsync_bucket *sc_buckets; struct pfsync_bucket *sc_buckets;
/* Bulk update info */ /* Bulk update info */
struct mtx sc_bulk_mtx; struct mtx sc_bulk_mtx;
uint32_t sc_ureq_sent; uint32_t sc_ureq_sent;
▲ Show 20 Lines • Show All 76 Lines • ▼ Show 20 Lines
static void pfsync_send_plus(void *, size_t); static void pfsync_send_plus(void *, size_t);
static void pfsync_bulk_start(void); static void pfsync_bulk_start(void);
static void pfsync_bulk_status(u_int8_t); static void pfsync_bulk_status(u_int8_t);
static void pfsync_bulk_update(void *); static void pfsync_bulk_update(void *);
static void pfsync_bulk_fail(void *); static void pfsync_bulk_fail(void *);
static void pfsync_detach_ifnet(struct ifnet *); static void pfsync_detach_ifnet(struct ifnet *);
static int pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *,
struct pfsync_kstatus *);
static int pfsync_kstatus_to_softc(struct pfsync_kstatus *,
struct pfsync_softc *);
#ifdef IPSEC #ifdef IPSEC
static void pfsync_update_net_tdb(struct pfsync_tdb *); static void pfsync_update_net_tdb(struct pfsync_tdb *);
#endif #endif
static struct pfsync_bucket *pfsync_get_bucket(struct pfsync_softc *, static struct pfsync_bucket *pfsync_get_bucket(struct pfsync_softc *,
struct pf_kstate *); struct pf_kstate *);
#define PFSYNC_MAX_BULKTRIES 12 #define PFSYNC_MAX_BULKTRIES 12
#define PFSYNC_DEFER_TIMEOUT ((20 * hz) / 1000) #define PFSYNC_DEFER_TIMEOUT ((20 * hz) / 1000)
▲ Show 20 Lines • Show All 299 Lines • ▼ Show 20 Lines
cleanup_state: /* pf_state_insert() frees the state keys. */ cleanup_state: /* pf_state_insert() frees the state keys. */
if (st) { if (st) {
st->timeout = PFTM_UNLINKED; /* appease an assert */ st->timeout = PFTM_UNLINKED; /* appease an assert */
pf_free_state(st); pf_free_state(st);
} }
return (error); return (error);
} }
#ifdef INET
static int static int
pfsync_input(struct mbuf **mp, int *offp __unused, int proto __unused) pfsync_input(struct mbuf **mp, int *offp __unused, int proto __unused)
{ {
struct pfsync_softc *sc = V_pfsyncif; struct pfsync_softc *sc = V_pfsyncif;
struct mbuf *m = *mp; struct mbuf *m = *mp;
struct ip *ip = mtod(m, struct ip *); struct ip *ip = mtod(m, struct ip *);
struct pfsync_header *ph; struct pfsync_header *ph;
struct pfsync_subheader subh; struct pfsync_subheader subh;
▲ Show 20 Lines • Show All 83 Lines • ▼ Show 20 Lines while (offset <= len - sizeof(subh)) {
offset += rv; offset += rv;
} }
PF_RULES_RUNLOCK(); PF_RULES_RUNLOCK();
done: done:
m_freem(m); m_freem(m);
return (IPPROTO_DONE); return (IPPROTO_DONE);
} }
#endif
static int static int
pfsync_in_clr(struct mbuf *m, int offset, int count, int flags) pfsync_in_clr(struct mbuf *m, int offset, int count, int flags)
{ {
struct pfsync_clr *clr; struct pfsync_clr *clr;
struct mbuf *mp; struct mbuf *mp;
int len = sizeof(*clr) * count; int len = sizeof(*clr) * count;
int i, offp; int i, offp;
▲ Show 20 Lines • Show All 576 Lines • ▼ Show 20 Lines
/* ARGSUSED */ /* ARGSUSED */
static int static int
pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data) pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{ {
struct pfsync_softc *sc = ifp->if_softc; struct pfsync_softc *sc = ifp->if_softc;
struct ifreq *ifr = (struct ifreq *)data; struct ifreq *ifr = (struct ifreq *)data;
struct pfsyncreq pfsyncr; struct pfsyncreq pfsyncr;
size_t nvbuflen;
int error; int error;
int c; int c;
switch (cmd) { switch (cmd) {
case SIOCSIFFLAGS: case SIOCSIFFLAGS:
PFSYNC_LOCK(sc); PFSYNC_LOCK(sc);
if (ifp->if_flags & IFF_UP) { if (ifp->if_flags & IFF_UP) {
ifp->if_drv_flags |= IFF_DRV_RUNNING; ifp->if_drv_flags |= IFF_DRV_RUNNING;
Show All 16 Lines if (ifr->ifr_mtu < ifp->if_mtu) {
if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT) if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT)
pfsync_sendout(1, c); pfsync_sendout(1, c);
PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]); PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]);
} }
} }
ifp->if_mtu = ifr->ifr_mtu; ifp->if_mtu = ifr->ifr_mtu;
break; break;
case SIOCGETPFSYNC: case SIOCGETPFSYNC:
bzero(&pfsyncr, sizeof(pfsyncr)); bzero(&pfsyncr, sizeof(pfsyncr));
kpUnsubmitted
Done
Inline Actions

Is this comment still relevant?

kp: Is this comment still relevant?
PFSYNC_LOCK(sc); PFSYNC_LOCK(sc);
if (sc->sc_sync_if) { if (sc->sc_sync_if) {
strlcpy(pfsyncr.pfsyncr_syncdev, strlcpy(pfsyncr.pfsyncr_syncdev,
sc->sc_sync_if->if_xname, IFNAMSIZ); sc->sc_sync_if->if_xname, IFNAMSIZ);
} }
pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer; pfsyncr.pfsyncr_syncpeer = ((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr;
pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates; pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
pfsyncr.pfsyncr_defer = sc->sc_flags; pfsyncr.pfsyncr_defer = sc->sc_flags;
PFSYNC_UNLOCK(sc); PFSYNC_UNLOCK(sc);
return (copyout(&pfsyncr, ifr_data_get_ptr(ifr), return (copyout(&pfsyncr, ifr_data_get_ptr(ifr),
sizeof(pfsyncr))); sizeof(pfsyncr)));
case SIOCGETPFSYNCNV:
{
nvlist_t *nvl_syncpeer;
nvlist_t *nvl = nvlist_create(0);
if (nvl == NULL)
return (ENOMEM);
if (sc->sc_sync_if)
nvlist_add_string(nvl, "syncdev", sc->sc_sync_if->if_xname);
nvlist_add_number(nvl, "maxupdates", sc->sc_maxupdates);
nvlist_add_number(nvl, "flags", sc->sc_flags);
if ((nvl_syncpeer = pfsync_sockaddr_to_syncpeer_nvlist(&sc->sc_sync_peer)) != NULL)
nvlist_add_nvlist(nvl, "syncpeer", nvl_syncpeer);
void *packed = NULL;
packed = nvlist_pack(nvl, &nvbuflen);
if (packed == NULL) {
free(packed, M_NVLIST);
nvlist_destroy(nvl);
kpUnsubmitted
Done
Inline Actions

I'd just ENOMEM here, that's by far the most likely cause anyway, and nvlist_error() isn't going to tell us that.

kp: I'd just ENOMEM here, that's by far the most likely cause anyway, and nvlist_error() isn't…
return (ENOMEM);
}
kpUnsubmitted
Done
Inline Actions

We're leaking packed and nvl here.

kp: We're leaking packed and nvl here.
if (nvbuflen > ifr->ifr_cap_nv.buf_length) {
ifr->ifr_cap_nv.length = nvbuflen;
ifr->ifr_cap_nv.buffer = NULL;
free(packed, M_NVLIST);
nvlist_destroy(nvl);
return (EFBIG);
}
ifr->ifr_cap_nv.length = nvbuflen;
error = copyout(packed, ifr->ifr_cap_nv.buffer, nvbuflen);
nvlist_destroy(nvl);
nvlist_destroy(nvl_syncpeer);
free(packed, M_NVLIST);
break;
}
case SIOCSETPFSYNC: case SIOCSETPFSYNC:
{ {
struct in_mfilter *imf = NULL; struct pfsync_kstatus status;
struct ifnet *sifp;
struct ip *ip;
if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0) if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
return (error); return (error);
if ((error = copyin(ifr_data_get_ptr(ifr), &pfsyncr, if ((error = copyin(ifr_data_get_ptr(ifr), &pfsyncr,
sizeof(pfsyncr)))) sizeof(pfsyncr))))
return (error); return (error);
if (pfsyncr.pfsyncr_maxupdates > 255) memset((char *)&status, 0, sizeof(struct pfsync_kstatus));
return (EINVAL); pfsync_pfsyncreq_to_kstatus(&pfsyncr, &status);
if (pfsyncr.pfsyncr_syncdev[0] == 0) error = pfsync_kstatus_to_softc(&status, sc);
sifp = NULL; return (error);
else if ((sifp = ifunit_ref(pfsyncr.pfsyncr_syncdev)) == NULL) }
case SIOCSETPFSYNCNV:
{
struct pfsync_kstatus status;
void *data;
nvlist_t *nvl;
if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
return (error);
if (ifr->ifr_cap_nv.length > IFR_CAP_NV_MAXBUFSIZE)
return (EINVAL); return (EINVAL);
if (sifp != NULL && ( data = malloc(ifr->ifr_cap_nv.length, M_TEMP, M_WAITOK);
pfsyncr.pfsyncr_syncpeer.s_addr == 0 ||
pfsyncr.pfsyncr_syncpeer.s_addr ==
htonl(INADDR_PFSYNC_GROUP)))
imf = ip_mfilter_alloc(M_WAITOK, 0, 0);
PFSYNC_LOCK(sc); if ((error = copyin(ifr->ifr_cap_nv.buffer, data,
if (pfsyncr.pfsyncr_syncpeer.s_addr == 0) ifr->ifr_cap_nv.length)) != 0) {
sc->sc_sync_peer.s_addr = htonl(INADDR_PFSYNC_GROUP); free(data, M_TEMP);
else return (error);
sc->sc_sync_peer.s_addr =
pfsyncr.pfsyncr_syncpeer.s_addr;
sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
if (pfsyncr.pfsyncr_defer & PFSYNCF_DEFER) {
sc->sc_flags |= PFSYNCF_DEFER;
V_pfsync_defer_ptr = pfsync_defer;
} else {
sc->sc_flags &= ~PFSYNCF_DEFER;
V_pfsync_defer_ptr = NULL;
} }
if (sifp == NULL) { if ((nvl = nvlist_unpack(data, ifr->ifr_cap_nv.length, 0)) == NULL) {
if (sc->sc_sync_if) free(data, M_TEMP);
if_rele(sc->sc_sync_if); return (EINVAL);
sc->sc_sync_if = NULL;
pfsync_multicast_cleanup(sc);
PFSYNC_UNLOCK(sc);
break;
} }
for (c = 0; c < pfsync_buckets; c++) { memset((char *)&status, 0, sizeof(struct pfsync_kstatus));
PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]); pfsync_nvstatus_to_kstatus(nvl, &status);
if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT &&
(sifp->if_mtu < sc->sc_ifp->if_mtu ||
(sc->sc_sync_if != NULL &&
sifp->if_mtu < sc->sc_sync_if->if_mtu) ||
sifp->if_mtu < MCLBYTES - sizeof(struct ip)))
pfsync_sendout(1, c);
PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]);
}
pfsync_multicast_cleanup(sc); nvlist_destroy(nvl);
free(data, M_TEMP);
if (sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) { error = pfsync_kstatus_to_softc(&status, sc);
error = pfsync_multicast_setup(sc, sifp, imf);
if (error) {
if_rele(sifp);
ip_mfilter_free(imf);
PFSYNC_UNLOCK(sc);
return (error); return (error);
} }
}
if (sc->sc_sync_if)
if_rele(sc->sc_sync_if);
sc->sc_sync_if = sifp;
ip = &sc->sc_template;
bzero(ip, sizeof(*ip));
ip->ip_v = IPVERSION;
ip->ip_hl = sizeof(sc->sc_template) >> 2;
ip->ip_tos = IPTOS_LOWDELAY;
/* len and id are set later. */
ip->ip_off = htons(IP_DF);
ip->ip_ttl = PFSYNC_DFLTTL;
ip->ip_p = IPPROTO_PFSYNC;
ip->ip_src.s_addr = INADDR_ANY;
ip->ip_dst.s_addr = sc->sc_sync_peer.s_addr;
/* Request a full state table update. */
if ((sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
(*carp_demote_adj_p)(V_pfsync_carp_adj,
"pfsync bulk start");
sc->sc_flags &= ~PFSYNCF_OK;
if (V_pf_status.debug >= PF_DEBUG_MISC)
printf("pfsync: requesting bulk update\n");
PFSYNC_UNLOCK(sc);
PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]);
pfsync_request_update(0, 0);
PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]);
PFSYNC_BLOCK(sc);
sc->sc_ureq_sent = time_uptime;
callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulk_fail,
sc);
PFSYNC_BUNLOCK(sc);
break;
}
default: default:
return (ENOTTY); return (ENOTTY);
} }
return (0); return (0);
} }
static void static void
▲ Show 20 Lines • Show All 43 Lines • ▼ Show 20 Linespfsync_drop(struct pfsync_softc *sc)
struct pfsync_upd_req_item *ur; struct pfsync_upd_req_item *ur;
struct pfsync_bucket *b; struct pfsync_bucket *b;
int c, q; int c, q;
for (c = 0; c < pfsync_buckets; c++) { for (c = 0; c < pfsync_buckets; c++) {
b = &sc->sc_buckets[c]; b = &sc->sc_buckets[c];
for (q = 0; q < PFSYNC_S_COUNT; q++) { for (q = 0; q < PFSYNC_S_COUNT; q++) {
if (TAILQ_EMPTY(&b->b_qs[q])) if (TAILQ_EMPTY(&b->b_qs[q]))
continue; continue;
kpUnsubmitted
Not Done
Inline Actions

We should probably separate the input parsing (struct vs nvlist) from the actual pfsync configuration so we can re-use the latter for both cases.

kp: We should probably separate the input parsing (struct vs nvlist) from the actual pfsync…
TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, next) { TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, next) {
KASSERT(st->sync_state == q, KASSERT(st->sync_state == q,
("%s: st->sync_state == q", ("%s: st->sync_state == q",
__func__)); __func__));
st->sync_state = PFSYNC_S_NONE; st->sync_state = PFSYNC_S_NONE;
pf_release_state(st); pf_release_state(st);
} }
TAILQ_INIT(&b->b_qs[q]); TAILQ_INIT(&b->b_qs[q]);
} }
while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) { while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) {
TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry); TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry);
free(ur, M_PFSYNC); free(ur, M_PFSYNC);
} }
b->b_len = PFSYNC_MINPKT; b->b_len = PFSYNC_MINPKT;
b->b_plus = NULL; b->b_plus = NULL;
} }
kpUnsubmitted
Not Done
Inline Actions

We'd leak data here. Unless we failed to allocate data, in which case I'm not sure what copyin() will do.

kp: We'd leak data here. Unless we failed to allocate data, in which case I'm not sure what copyin…
email_luiz.eng.brAuthorUnsubmitted
Not Done
Inline Actions

I am freeing data before returning now.

According to copy(9), "All but copystr() return EFAULT if a bad address is encountered". So if the allocation fails, copyin() will see the address NULL and return EFAULT, right?

email_luiz.eng.br: I am freeing data before returning now. According to `copy(9)`, "All but copystr() return…
} }
static void static void
pfsync_sendout(int schedswi, int c) pfsync_sendout(int schedswi, int c)
{ {
struct pfsync_softc *sc = V_pfsyncif; struct pfsync_softc *sc = V_pfsyncif;
struct ifnet *ifp = sc->sc_ifp; struct ifnet *ifp = sc->sc_ifp;
kpUnsubmitted
Done
Inline Actions

How so? It should be safe as soon as you've copied the strings out. (numbers are always copied, as are bools. Byte arrays and strings need to be copied, but always should be, because we can't reasonably rely on the lifetime of the nvlist structure).

kp: How so? It should be safe as soon as you've copied the strings out. (numbers are always copied…
email_luiz.eng.brAuthorUnsubmitted
Done
Inline Actions

I wrote that when I still had a very poor understanding of nvlists. I removed the comment.

email_luiz.eng.br: I wrote that when I still had a very poor understanding of nvlists. I removed the comment.
struct mbuf *m; struct mbuf *m;
struct ip *ip;
struct pfsync_header *ph; struct pfsync_header *ph;
struct pfsync_subheader *subh; struct pfsync_subheader *subh;
struct pf_kstate *st, *st_next; struct pf_kstate *st, *st_next;
kpUnsubmitted
Not Done
Inline Actions

Leaks data.

kp: Leaks data.
email_luiz.eng.brAuthorUnsubmitted
Not Done
Inline Actions

I went with freeing data right after the nvlist_destroy(), which covers this case and prevents leaking on normal execution as well.

email_luiz.eng.br: I went with freeing data right after the nvlist_destroy(), which covers this case and prevents…
struct pfsync_upd_req_item *ur; struct pfsync_upd_req_item *ur;
struct pfsync_bucket *b = &sc->sc_buckets[c]; struct pfsync_bucket *b = &sc->sc_buckets[c];
int offset; int aflen, offset;
int q, count = 0; int q, count = 0;
KASSERT(sc != NULL, ("%s: null sc", __func__)); KASSERT(sc != NULL, ("%s: null sc", __func__));
KASSERT(b->b_len > PFSYNC_MINPKT, KASSERT(b->b_len > PFSYNC_MINPKT,
("%s: sc_len %zu", __func__, b->b_len)); ("%s: sc_len %zu", __func__, b->b_len));
PFSYNC_BUCKET_LOCK_ASSERT(b); PFSYNC_BUCKET_LOCK_ASSERT(b);
if (ifp->if_bpf == NULL && sc->sc_sync_if == NULL) { if (ifp->if_bpf == NULL && sc->sc_sync_if == NULL) {
pfsync_drop(sc); pfsync_drop(sc);
return; return;
} }
m = m_get2(max_linkhdr + b->b_len, M_NOWAIT, MT_DATA, M_PKTHDR); m = m_get2(max_linkhdr + b->b_len, M_NOWAIT, MT_DATA, M_PKTHDR);
if (m == NULL) { if (m == NULL) {
if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1); if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
V_pfsyncstats.pfsyncs_onomem++; V_pfsyncstats.pfsyncs_onomem++;
return; return;
} }
m->m_data += max_linkhdr; m->m_data += max_linkhdr;
m->m_len = m->m_pkthdr.len = b->b_len; m->m_len = m->m_pkthdr.len = b->b_len;
/* build the ip header */ /* build the ip header */
ip = (struct ip *)m->m_data; switch (sc->sc_sync_peer.ss_family) {
bcopy(&sc->sc_template, ip, sizeof(*ip)); #ifdef INET
offset = sizeof(*ip); case AF_INET:
{
struct ip *ip;
ip = mtod(m, struct ip *);
bcopy(&sc->sc_template.ipv4, ip, sizeof(*ip));
aflen = offset = sizeof(*ip);
ip->ip_len = htons(m->m_pkthdr.len); ip->ip_len = htons(m->m_pkthdr.len);
ip_fillid(ip); ip_fillid(ip);
break;
}
#endif
default:
return;
}
/* build the pfsync header */ /* build the pfsync header */
ph = (struct pfsync_header *)(m->m_data + offset); ph = (struct pfsync_header *)(m->m_data + offset);
bzero(ph, sizeof(*ph)); bzero(ph, sizeof(*ph));
offset += sizeof(*ph); offset += sizeof(*ph);
ph->version = PFSYNC_VERSION; ph->version = PFSYNC_VERSION;
ph->len = htons(b->b_len - sizeof(*ip)); ph->len = htons(b->b_len - aflen);
bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH); bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
/* walk the queues */ /* walk the queues */
for (q = 0; q < PFSYNC_S_COUNT; q++) { for (q = 0; q < PFSYNC_S_COUNT; q++) {
if (TAILQ_EMPTY(&b->b_qs[q])) if (TAILQ_EMPTY(&b->b_qs[q]))
continue; continue;
subh = (struct pfsync_subheader *)(m->m_data + offset); subh = (struct pfsync_subheader *)(m->m_data + offset);
▲ Show 20 Lines • Show All 56 Lines • ▼ Show 20 Lines#endif
bzero(subh, sizeof(*subh)); bzero(subh, sizeof(*subh));
subh->action = PFSYNC_ACT_EOF; subh->action = PFSYNC_ACT_EOF;
subh->count = htons(1); subh->count = htons(1);
V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_EOF]++; V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_EOF]++;
/* we're done, let's put it on the wire */ /* we're done, let's put it on the wire */
if (ifp->if_bpf) { if (ifp->if_bpf) {
m->m_data += sizeof(*ip); m->m_data += aflen;
m->m_len = m->m_pkthdr.len = b->b_len - sizeof(*ip); m->m_len = m->m_pkthdr.len = b->b_len - aflen;
BPF_MTAP(ifp, m); BPF_MTAP(ifp, m);
m->m_data -= sizeof(*ip); m->m_data -= aflen;
m->m_len = m->m_pkthdr.len = b->b_len; m->m_len = m->m_pkthdr.len = b->b_len;
} }
if (sc->sc_sync_if == NULL) { if (sc->sc_sync_if == NULL) {
b->b_len = PFSYNC_MINPKT; b->b_len = PFSYNC_MINPKT;
m_freem(m); m_freem(m);
return; return;
} }
▲ Show 20 Lines • Show All 136 Lines • ▼ Show 20 Linespfsync_defer_tmo(void *arg)
TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry); TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry);
b->b_deferred--; b->b_deferred--;
pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */ pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */
if (pd->pd_refs == 0) if (pd->pd_refs == 0)
free(pd, M_PFSYNC); free(pd, M_PFSYNC);
PFSYNC_BUCKET_UNLOCK(b); PFSYNC_BUCKET_UNLOCK(b);
switch (sc->sc_sync_peer.ss_family) {
#ifdef INET
case AF_INET:
ip_output(m, NULL, NULL, 0, NULL, NULL); ip_output(m, NULL, NULL, 0, NULL, NULL);
break;
#endif
}
pf_release_state(st); pf_release_state(st);
CURVNET_RESTORE(); CURVNET_RESTORE();
NET_EPOCH_EXIT(et); NET_EPOCH_EXIT(et);
} }
static void static void
▲ Show 20 Lines • Show All 473 Lines • ▼ Show 20 Lines
static void static void
pfsyncintr(void *arg) pfsyncintr(void *arg)
{ {
struct epoch_tracker et; struct epoch_tracker et;
struct pfsync_softc *sc = arg; struct pfsync_softc *sc = arg;
struct pfsync_bucket *b; struct pfsync_bucket *b;
struct mbuf *m, *n; struct mbuf *m, *n;
int c; int c, error;
NET_EPOCH_ENTER(et); NET_EPOCH_ENTER(et);
CURVNET_SET(sc->sc_ifp->if_vnet); CURVNET_SET(sc->sc_ifp->if_vnet);
for (c = 0; c < pfsync_buckets; c++) { for (c = 0; c < pfsync_buckets; c++) {
b = &sc->sc_buckets[c]; b = &sc->sc_buckets[c];
PFSYNC_BUCKET_LOCK(b); PFSYNC_BUCKET_LOCK(b);
if ((b->b_flags & PFSYNCF_BUCKET_PUSH) && b->b_len > PFSYNC_MINPKT) { if ((b->b_flags & PFSYNCF_BUCKET_PUSH) && b->b_len > PFSYNC_MINPKT) {
pfsync_sendout(0, b->b_id); pfsync_sendout(0, b->b_id);
b->b_flags &= ~PFSYNCF_BUCKET_PUSH; b->b_flags &= ~PFSYNCF_BUCKET_PUSH;
} }
_IF_DEQUEUE_ALL(&b->b_snd, m); _IF_DEQUEUE_ALL(&b->b_snd, m);
PFSYNC_BUCKET_UNLOCK(b); PFSYNC_BUCKET_UNLOCK(b);
for (; m != NULL; m = n) { for (; m != NULL; m = n) {
n = m->m_nextpkt; n = m->m_nextpkt;
m->m_nextpkt = NULL; m->m_nextpkt = NULL;
/* /*
* We distinguish between a deferral packet and our * We distinguish between a deferral packet and our
* own pfsync packet based on M_SKIP_FIREWALL * own pfsync packet based on M_SKIP_FIREWALL
* flag. This is XXX. * flag. This is XXX.
*/ */
if (m->m_flags & M_SKIP_FIREWALL) switch (sc->sc_sync_peer.ss_family) {
ip_output(m, NULL, NULL, 0, NULL, NULL); #ifdef INET
else if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, case AF_INET:
NULL) == 0) if (m->m_flags & M_SKIP_FIREWALL) {
error = ip_output(m, NULL, NULL, 0,
NULL, NULL);
} else {
error = ip_output(m, NULL, NULL,
IP_RAWOUTPUT, &sc->sc_imo, NULL);
}
break;
#endif
}
if (error == 0)
V_pfsyncstats.pfsyncs_opackets++; V_pfsyncstats.pfsyncs_opackets++;
else else
V_pfsyncstats.pfsyncs_oerrors++; V_pfsyncstats.pfsyncs_oerrors++;
} }
} }
CURVNET_RESTORE(); CURVNET_RESTORE();
NET_EPOCH_EXIT(et); NET_EPOCH_EXIT(et);
} }
static int static int
pfsync_multicast_setup(struct pfsync_softc *sc, struct ifnet *ifp, pfsync_multicast_setup(struct pfsync_softc *sc, struct ifnet *ifp,
struct in_mfilter *imf) struct in_mfilter *imf)
{ {
struct ip_moptions *imo = &sc->sc_imo; struct ip_moptions *imo = &sc->sc_imo;
int error; int error;
if (!(ifp->if_flags & IFF_MULTICAST)) if (!(ifp->if_flags & IFF_MULTICAST))
return (EADDRNOTAVAIL); return (EADDRNOTAVAIL);
switch (sc->sc_sync_peer.ss_family) {
#ifdef INET
case AF_INET:
{
ip_mfilter_init(&imo->imo_head);
imo->imo_multicast_vif = -1; imo->imo_multicast_vif = -1;
if ((error = in_joingroup(ifp, &((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr, NULL,
if ((error = in_joingroup(ifp, &sc->sc_sync_peer, NULL,
&imf->imf_inm)) != 0) &imf->imf_inm)) != 0)
return (error); return (error);
ip_mfilter_init(&imo->imo_head);
ip_mfilter_insert(&imo->imo_head, imf); ip_mfilter_insert(&imo->imo_head, imf);
imo->imo_multicast_ifp = ifp; imo->imo_multicast_ifp = ifp;
imo->imo_multicast_ttl = PFSYNC_DFLTTL; imo->imo_multicast_ttl = PFSYNC_DFLTTL;
imo->imo_multicast_loop = 0; imo->imo_multicast_loop = 0;
break;
}
#endif
}
return (0); return (0);
} }
static void static void
pfsync_multicast_cleanup(struct pfsync_softc *sc) pfsync_multicast_cleanup(struct pfsync_softc *sc)
{ {
struct ip_moptions *imo = &sc->sc_imo; struct ip_moptions *imo = &sc->sc_imo;
Show All 23 Lines if (sc->sc_sync_if == ifp) {
* cleanup later. * cleanup later.
*/ */
ip_mfilter_init(&sc->sc_imo.imo_head); ip_mfilter_init(&sc->sc_imo.imo_head);
sc->sc_imo.imo_multicast_ifp = NULL; sc->sc_imo.imo_multicast_ifp = NULL;
sc->sc_sync_if = NULL; sc->sc_sync_if = NULL;
} }
PFSYNC_UNLOCK(sc); PFSYNC_UNLOCK(sc);
}
static int
pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *pfsyncr, struct pfsync_kstatus *status)
{
struct sockaddr_storage sa;
status->maxupdates = pfsyncr->pfsyncr_maxupdates;
status->flags = pfsyncr->pfsyncr_defer;
strlcpy(status->syncdev, pfsyncr->pfsyncr_syncdev, IFNAMSIZ);
memset(&sa, 0, sizeof(sa));
if (pfsyncr->pfsyncr_syncpeer.s_addr != 0) {
struct sockaddr_in *in = (struct sockaddr_in *)&sa;
in->sin_family = AF_INET;
in->sin_len = sizeof(*in);
in->sin_addr.s_addr = pfsyncr->pfsyncr_syncpeer.s_addr;
}
status->syncpeer = sa;
return 0;
}
static int
pfsync_kstatus_to_softc(struct pfsync_kstatus *status, struct pfsync_softc *sc)
{
struct in_mfilter *imf = NULL;
struct ifnet *sifp;
struct ip *ip;
int error;
int c;
if ((status->maxupdates < 0) || (status->maxupdates > 255))
return (EINVAL);
if (status->syncdev[0] == '\0')
sifp = NULL;
else if ((sifp = ifunit_ref(status->syncdev)) == NULL)
return (EINVAL);
struct sockaddr_in *status_sin =
(struct sockaddr_in *)&(status->syncpeer);
if (sifp != NULL && (status_sin->sin_addr.s_addr == 0 ||
status_sin->sin_addr.s_addr ==
htonl(INADDR_PFSYNC_GROUP)))
imf = ip_mfilter_alloc(M_WAITOK, 0, 0);
PFSYNC_LOCK(sc);
struct sockaddr_in *sc_sin = (struct sockaddr_in *)&sc->sc_sync_peer;
sc_sin->sin_family = AF_INET;
sc_sin->sin_len = sizeof(*sc_sin);
if (status_sin->sin_addr.s_addr == 0) {
sc_sin->sin_addr.s_addr = htonl(INADDR_PFSYNC_GROUP);
} else {
sc_sin->sin_addr.s_addr = status_sin->sin_addr.s_addr;
}
sc->sc_maxupdates = status->maxupdates;
if (status->flags & PFSYNCF_DEFER) {
sc->sc_flags |= PFSYNCF_DEFER;
V_pfsync_defer_ptr = pfsync_defer;
} else {
sc->sc_flags &= ~PFSYNCF_DEFER;
V_pfsync_defer_ptr = NULL;
}
if (sifp == NULL) {
if (sc->sc_sync_if)
if_rele(sc->sc_sync_if);
sc->sc_sync_if = NULL;
pfsync_multicast_cleanup(sc);
PFSYNC_UNLOCK(sc);
return (0);
}
for (c = 0; c < pfsync_buckets; c++) {
PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]);
if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT &&
(sifp->if_mtu < sc->sc_ifp->if_mtu ||
(sc->sc_sync_if != NULL &&
sifp->if_mtu < sc->sc_sync_if->if_mtu) ||
sifp->if_mtu < MCLBYTES - sizeof(struct ip)))
pfsync_sendout(1, c);
PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]);
}
pfsync_multicast_cleanup(sc);
if (sc_sin->sin_addr.s_addr == htonl(INADDR_PFSYNC_GROUP)) {
error = pfsync_multicast_setup(sc, sifp, imf);
if (error) {
if_rele(sifp);
ip_mfilter_free(imf);
PFSYNC_UNLOCK(sc);
return (error);
}
}
if (sc->sc_sync_if)
if_rele(sc->sc_sync_if);
sc->sc_sync_if = sifp;
ip = &sc->sc_template.ipv4;
bzero(ip, sizeof(*ip));
ip->ip_v = IPVERSION;
ip->ip_hl = sizeof(sc->sc_template.ipv4) >> 2;
ip->ip_tos = IPTOS_LOWDELAY;
/* len and id are set later. */
ip->ip_off = htons(IP_DF);
ip->ip_ttl = PFSYNC_DFLTTL;
ip->ip_p = IPPROTO_PFSYNC;
ip->ip_src.s_addr = INADDR_ANY;
ip->ip_dst.s_addr = sc_sin->sin_addr.s_addr;
/* Request a full state table update. */
if ((sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
(*carp_demote_adj_p)(V_pfsync_carp_adj,
"pfsync bulk start");
sc->sc_flags &= ~PFSYNCF_OK;
if (V_pf_status.debug >= PF_DEBUG_MISC)
printf("pfsync: requesting bulk update\n");
PFSYNC_UNLOCK(sc);
PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]);
pfsync_request_update(0, 0);
PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]);
PFSYNC_BLOCK(sc);
sc->sc_ureq_sent = time_uptime;
callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulk_fail, sc);
PFSYNC_BUNLOCK(sc);
return (0);
} }
static void static void
pfsync_pointers_init(void) pfsync_pointers_init(void)
{ {
PF_RULES_WLOCK(); PF_RULES_WLOCK();
V_pfsync_state_import_ptr = pfsync_state_import; V_pfsync_state_import_ptr = pfsync_state_import;
▲ Show 20 Lines • Show All 116 Lines • Show Last 20 Lines