d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: PFRULE_REFS should not be user-visible

Browse Source 
Split the PFRULE_REFS flag from the rule_flag field. PFRULE_REFS is a
kernel-internal flag and should not be exposed to or read from
userspace.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29778
This commit is contained in:
Kristof Provost 2021-04-15 13:38:56 +02:00
parent 4ae3a97e12
commit 4f1f67e888
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/net/pfvar.h
View File

@ -378,6 +378,7 @@ struct pf_krule {
struct pf_rule_gid gid;
u_int32_t rule_flag;
uint32_t rule_ref;
u_int8_t action;
u_int8_t direction;
u_int8_t log;

12
sys/netpfil/pf/pf.c
View File

@ -1641,7 +1641,7 @@ pf_purge_expired_src_nodes()
pf_unlink_src_node(cur);
LIST_INSERT_HEAD(&freelist, cur, entry);
} else if (cur->rule.ptr != NULL)
cur->rule.ptr->rule_flag |= PFRULE_REFS;
cur->rule.ptr->rule_ref |= PFRULE_REFS;
PF_HASHROW_UNLOCK(sh);
}
@ -1783,11 +1783,11 @@ pf_purge_expired_states(u_int i, int maxcheck)
pf_unlink_state(s, PF_ENTER_LOCKED);
goto relock;
}
s->rule.ptr->rule_flag |= PFRULE_REFS;
s->rule.ptr->rule_ref |= PFRULE_REFS;
if (s->nat_rule.ptr != NULL)
s->nat_rule.ptr->rule_flag |= PFRULE_REFS;
s->nat_rule.ptr->rule_ref |= PFRULE_REFS;
if (s->anchor.ptr != NULL)
s->anchor.ptr->rule_flag |= PFRULE_REFS;
s->anchor.ptr->rule_ref |= PFRULE_REFS;
s->kif->pfik_flags |= PFI_IFLAG_REFS;
if (s->rt_kif)
s->rt_kif->pfik_flags |= PFI_IFLAG_REFS;
@ -1839,11 +1839,11 @@ pf_purge_unlinked_rules()
TAILQ_INIT(&tmpq);
PF_UNLNKDRULES_LOCK();
TAILQ_FOREACH_SAFE(r, &V_pf_unlinked_rules, entries, r1) {
if (!(r->rule_flag & PFRULE_REFS)) {
if (!(r->rule_ref & PFRULE_REFS)) {
TAILQ_REMOVE(&V_pf_unlinked_rules, r, entries);
TAILQ_INSERT_TAIL(&tmpq, r, entries);
} else
r->rule_flag &= ~PFRULE_REFS;
r->rule_ref &= ~PFRULE_REFS;
}
PF_UNLNKDRULES_UNLOCK();

2
sys/netpfil/pf/pf_ioctl.c
View File

@ -426,7 +426,7 @@ pf_unlink_rule(struct pf_krulequeue *rulequeue, struct pf_krule *rule)
TAILQ_REMOVE(rulequeue, rule, entries);
PF_UNLNKDRULES_LOCK();
rule->rule_flag |= PFRULE_REFS;
rule->rule_ref |= PFRULE_REFS;
TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries);
PF_UNLNKDRULES_UNLOCK();
}