git: network - Fix PF mis-handling and other bugs
commit aa1da1872e577bc6cbfed56abcf10828532075f3
Author: Matthew Dillon <dillon@apollo.backplane.com>
Date: Wed Sep 22 00:01:08 2010 -0700
network - Fix PF mis-handling and other bugs
* The mbuf subsystem does NOT clear pkthdr.pf.* fields on mbuf allocation.
PF was assuming that pf.flags was being cleared. Instead move the
PF_TAG_GENERATED flag from pf.flags to fw_flags and call it PF_MBUF_TAGGED.
The fw_flags field is cleared by the mbuf subsystem.
Then clear pf.flags whenever we set PF_MBUF_TAGGED or determine that it
has not been set.
This fixes a serious bug where the PF filters start missing packets,
increasing from system boot. This is because more and more packets in
the objcache wind up with non-zero pf.flags which cause PF to pass
the packet unconditionally.
For example NAT packets would wind up in the normal protocol stack which
would of course would get confused and generate a RST.
* Move the 'cur' static pointer in pf_purge_expired_states() up a bit
so pf_free_state() can access it and rename it 'purge_cur'.
Adjust pf_free_state() to iterate purge_cur when it matches the state
being destroyed.
* Protect the pf_purge_thread() with pf_token, it was depending on the MP
lock before which definitely does not do the job.
* Flag the pfil hook as being MPSAFE.
Reported-by: "Jan Lentfer" <Jan.Lentfer@web.de>
Summary of changes:
sys/net/pf/pf.c | 82 +++++++++++++++++++++++++++++++++++++-----------
sys/net/pf/pf_ioctl.c | 9 ++---
sys/net/pf/pfvar.h | 7 +++-
3 files changed, 73 insertions(+), 25 deletions(-)
http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/aa1da1872e577bc6cbfed56abcf10828532075f3
--
DragonFly BSD source repository
討論串 (同標題文章)