d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFC: pf.c 1.39+1.40 and pfvar.h 1.13+1.14

Browse Source 
Move PFSTATE_EXPIRING from sync_flags to a new local_flags.  sync_flags
  has special handling when zero.  This caused no PFSYNC_ACT_DEL message and
  thus disfunction of pfflowd and state synchronisation in general.

  Discovered by:  thompsa
  Good catch by:  thompsa

and

  Only decrement the max-src-conn counter for tcp connections that reached
  "established" state.

  Similar to OpenBSD's rev. 1.499 by joel but not breaking ABI.

  Obtained from:  OpenBSD (with changes)
  Reported by:    Bruno Afonso

ok reyk@
This commit is contained in:
mlaier 2005-12-30 00:50:18 +00:00
parent 0ac73030bb
commit 1937d32dc3
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/contrib/pf/net/pf.c
View File

@ -726,6 +726,9 @@ pf_src_connlimit(struct pf_state **state)
int bad = 0;
(*state)->src_node->conn++;
#ifdef __FreeBSD__
(*state)->local_flags |= PFSTATE_SRC_CONN;
#endif
pf_add_threshold(&(*state)->src_node->conn_rate);
if ((*state)->rule.ptr->max_src_conn &&
@ -1058,8 +1061,12 @@ pf_src_tree_remove_state(struct pf_state *s)
if (s->src_node != NULL) {
if (s->proto == IPPROTO_TCP) {
#ifdef __FreeBSD__
if (s->local_flags & PFSTATE_SRC_CONN)
#else
if (s->src.state == PF_TCPS_PROXY_DST ||
s->timeout >= PFTM_TCP_ESTABLISHED)
#endif
--s->src_node->conn;
}
if (--s->src_node->states <= 0) {
@ -1086,9 +1093,9 @@ void
pf_purge_expired_state(struct pf_state *cur)
{
#ifdef __FreeBSD__
if (cur->sync_flags & PFSTATE_EXPIRING)
if (cur->local_flags & PFSTATE_EXPIRING)
return;
cur->sync_flags |= PFSTATE_EXPIRING;
cur->local_flags |= PFSTATE_EXPIRING;
#endif
if (cur->src.state == PF_TCPS_PROXY_DST)
pf_send_tcp(cur->rule.ptr, cur->af,

7
sys/contrib/pf/net/pfvar.h
View File

@ -791,9 +791,12 @@ struct pf_state {
#define PFSTATE_FROMSYNC 0x02
#define PFSTATE_STALE 0x04
#ifdef __FreeBSD__
#define PFSTATE_EXPIRING 0x10
#endif
u_int8_t local_flags;
#define PFSTATE_EXPIRING 0x01
#define PFSTATE_SRC_CONN 0x02
#else
u_int8_t pad;
#endif
};
TAILQ_HEAD(pf_rulequeue, pf_rule);