Gleb Smirnoff 48278b8846 Once pf became not covered by a single mutex, many counters in it became ... race prone. Some just gather statistics, but some are later used in different calculations. A real problem was the race provoked underflow of the states_cur counter on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this value is used in pf_state_expires() and any state created by this rule is immediately expired. Thus, make fields states_cur, states_tot and src_nodes of struct pf_rule be counter(9)s. Thanks to Dennis for providing me shell access to problematic box and his help with reproducing, debugging and investigating the problem. Thanks to: Dennis Yusupoff <dyr smartspb.net> Also reported by: dumbbell, pgj, Rambler Sponsored by: Nginx, Inc.		2014-02-14 10:05:21 +00:00
..
Makefile	Use feature_present(3) to determine whether to open an INET or an	2013-12-26 15:51:14 +00:00
parse.y
pf_print_state.c	Import pf_print_state.c 1.54 from OpenBSD	2013-10-27 21:07:37 +00:00
pfctl_altq.c	Use feature_present(3) to determine whether to open an INET or an	2013-12-26 15:51:14 +00:00
pfctl_optimize.c
pfctl_osfp.c
pfctl_parser.c	Use feature_present(3) to determine whether to open an INET or an	2013-12-26 15:51:14 +00:00
pfctl_parser.h	Use feature_present(3) to determine whether to open an INET or an	2013-12-26 15:51:14 +00:00
pfctl_qstats.c
pfctl_radix.c
pfctl_table.c
pfctl.8
pfctl.c	Once pf became not covered by a single mutex, many counters in it became	2014-02-14 10:05:21 +00:00
pfctl.h