d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: Apply kif flags to new group members

Browse Source 
If we have a 'set skip on <ifgroup>' rule this flag it set on the group
kif, but must also be set on all members. pfctl does this when the rules
are set, but if groups are added afterwards we must also apply the flags
to the new member. If not, new group members will not be skipped until
the rules are reloaded.

Reported by:	dvl@
Reviewed by:	glebius@
Differential Revision:	https://reviews.freebsd.org/D23254
This commit is contained in:
Kristof Provost 2020-01-23 22:13:41 +00:00
parent 2bd195af7e
commit e3e03bc159
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=357061
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netpfil/pf/pf_if.c
View File

@ -477,7 +477,9 @@ static void
pfi_kif_update(struct pfi_kif *kif)
{
struct ifg_list *ifgl;
struct ifg_member *ifgm;
struct pfi_dynaddr *p;
struct pfi_kif *tmpkif;
NET_EPOCH_ASSERT();
PF_RULES_WASSERT();
@ -486,6 +488,18 @@ pfi_kif_update(struct pfi_kif *kif)
TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
pfi_dynaddr_update(p);
/* Apply group flags to new members. */
if (kif->pfik_group != NULL) {
CK_STAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members,
ifgm_next) {
tmpkif = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
if (tmpkif == NULL)
continue;
tmpkif->pfik_flags |= kif->pfik_flags;
}
}
/* again for all groups kif is member of */
if (kif->pfik_ifp != NULL) {
CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)