Gleb Smirnoff 48278b8846 Once pf became not covered by a single mutex, many counters in it became ... race prone. Some just gather statistics, but some are later used in different calculations. A real problem was the race provoked underflow of the states_cur counter on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this value is used in pf_state_expires() and any state created by this rule is immediately expired. Thus, make fields states_cur, states_tot and src_nodes of struct pf_rule be counter(9)s. Thanks to Dennis for providing me shell access to problematic box and his help with reproducing, debugging and investigating the problem. Thanks to: Dennis Yusupoff <dyr smartspb.net> Also reported by: dumbbell, pgj, Rambler Sponsored by: Nginx, Inc.		2014-02-14 10:05:21 +00:00
..
ipfw	Reorder struct ip_fw_chain:	2014-01-24 09:13:30 +00:00
pf	Once pf became not covered by a single mutex, many counters in it became	2014-02-14 10:05:21 +00:00