d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge several fixlets from head:

Browse Source 
r257619: Remove unused PFTM_UNTIL_PACKET const.
r257620: Code logic of handling PFTM_PURGE into pf_find_state().
r258475: Don't compare unsigned <= 0.
r258477: Fix off by ones when scanning source nodes hash.
This commit is contained in:
glebius 2014-01-22 10:18:25 +00:00
parent 34e36d1706
commit 5da449f113
3 changed files with 13 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/net/pfvar.h
View File

@ -78,8 +78,7 @@ enum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
PFTM_UNTIL_PACKET };
PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED };
/* PFTM default values */
#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */

18
sys/netpfil/pf/pf.c
View File

@ -310,7 +310,7 @@ VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]);
#define STATE_LOOKUP(i, k, d, s, pd) \
do { \
(s) = pf_find_state((i), (k), (d)); \
if ((s) == NULL || (s)->timeout == PFTM_PURGE) \
if ((s) == NULL) \
return (PF_DROP); \
if (PACKET_LOOPED(pd)) \
return (PF_PASS); \
@ -1222,11 +1222,11 @@ pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
if (s->kif == V_pfi_all || s->kif == kif) {
PF_STATE_LOCK(s);
PF_HASHROW_UNLOCK(kh);
if (s->timeout == PFTM_UNLINKED) {
if (s->timeout >= PFTM_MAX) {
/*
* State is being processed
* by pf_unlink_state() in
* an other thread.
* State is either being processed by
* pf_unlink_state() in an other thread, or
* is scheduled for immediate expiry.
*/
PF_STATE_UNLOCK(s);
return (NULL);
@ -1427,8 +1427,6 @@ pf_state_expires(const struct pf_state *state)
/* handle all PFTM_* > PFTM_MAX here */
if (state->timeout == PFTM_PURGE)
return (time_uptime);
if (state->timeout == PFTM_UNTIL_PACKET)
return (0);
KASSERT(state->timeout != PFTM_UNLINKED,
("pf_state_expires: timeout == PFTM_UNLINKED"));
KASSERT((state->timeout < PFTM_MAX),
@ -1465,7 +1463,7 @@ pf_purge_expired_src_nodes()
for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++) {
PF_HASHROW_LOCK(sh);
LIST_FOREACH_SAFE(cur, &sh->nodes, entry, next)
if (cur->states <= 0 && cur->expire <= time_uptime) {
if (cur->states == 0 && cur->expire <= time_uptime) {
if (cur->rule.ptr != NULL)
cur->rule.ptr->src_nodes--;
LIST_REMOVE(cur, entry);
@ -1486,7 +1484,7 @@ pf_src_tree_remove_state(struct pf_state *s)
if (s->src_node != NULL) {
if (s->src.tcp_est)
--s->src_node->conn;
if (--s->src_node->states <= 0) {
if (--s->src_node->states == 0) {
timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
if (!timeout)
timeout =
@ -1495,7 +1493,7 @@ pf_src_tree_remove_state(struct pf_state *s)
}
}
if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
if (--s->nat_src_node->states <= 0) {
if (--s->nat_src_node->states == 0) {
timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
if (!timeout)
timeout =

9
sys/netpfil/pf/pf_ioctl.c
View File

@ -1682,8 +1682,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
struct pfioc_state *ps = (struct pfioc_state *)addr;
struct pfsync_state *sp = &ps->state;
if (sp->timeout >= PFTM_MAX &&
sp->timeout != PFTM_UNTIL_PACKET) {
if (sp->timeout >= PFTM_MAX) {
error = EINVAL;
break;
}
@ -3078,7 +3077,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
uint32_t i, nr = 0;
if (psn->psn_len == 0) {
for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask;
for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask;
i++, sh++) {
PF_HASHROW_LOCK(sh);
LIST_FOREACH(n, &sh->nodes, entry)
@ -3090,7 +3089,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
}
p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK);
for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask;
for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask;
i++, sh++) {
PF_HASHROW_LOCK(sh);
LIST_FOREACH(n, &sh->nodes, entry) {
@ -3382,7 +3381,7 @@ pf_clear_srcnodes(struct pf_src_node *n)
if (n == NULL) {
struct pf_srchash *sh;
for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask;
for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask;
i++, sh++) {
PF_HASHROW_LOCK(sh);
LIST_FOREACH(n, &sh->nodes, entry) {