d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Most Ethernet drivers that potentially can run a pfil(9) hook with

Browse Source 
PFIL_MEMPTR flag are intentionally providing a memory address that
isn't aligned to pointer alignment. This is done to align an IPv4
or IPv6 header that is expected to follow Ethernet header.

When we return PFIL_REALLOCED we store a pointer to allocated mbuf
at this address. With this change the KPI changes to store the pointer
at aligned address, which usually yields in +2 bytes.

Provide two inlines:

pfil_packet_align() to get aligned pfil_packet_t for a misaligned one
pfil_mem2mbuf() to read out mbuf pointer from misaligned pfil_packet_t

Provide function pfil_realloc(), not used yet, that would convert a
memory pfil_packet_t to an mbuf one.

Reported by:	hps
Reviewed by:	hps, gallatin
This commit is contained in:
Gleb Smirnoff 2019-03-10 17:20:09 +00:00
parent b9fdb4b3a3
commit c93410229c
2 changed files with 45 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
sys/net/pfil.c
View File

@ -118,15 +118,31 @@ VNET_DEFINE_STATIC(struct pfilhookhead, pfil_hook_list) =
static struct pfil_link *pfil_link_remove(pfil_chain_t *, pfil_hook_t );
static void pfil_link_free(epoch_context_t);
int
pfil_realloc(pfil_packet_t *p, int flags, struct ifnet *ifp)
{
struct mbuf *m;
MPASS(flags & PFIL_MEMPTR);
if ((m = m_devget(p->mem, PFIL_LENGTH(flags), 0, ifp, NULL)) == NULL)
return (ENOMEM);
*p = pfil_packet_align(*p);
*p->m = m;
return (0);
}
static __noinline int
pfil_fake_mbuf(pfil_func_t func, void *mem, struct ifnet *ifp, int flags,
pfil_fake_mbuf(pfil_func_t func, pfil_packet_t *p, struct ifnet *ifp, int flags,
void *ruleset, struct inpcb *inp)
{
struct mbuf m, *mp;
pfil_return_t rv;
(void)m_init(&m, M_NOWAIT, MT_DATA, M_NOFREE | M_PKTHDR);
m_extadd(&m, mem, PFIL_LENGTH(flags), NULL, NULL, NULL, 0, EXT_RXRING);
m_extadd(&m, p->mem, PFIL_LENGTH(flags), NULL, NULL, NULL, 0,
EXT_RXRING);
m.m_len = m.m_pkthdr.len = PFIL_LENGTH(flags);
mp = &m;
flags &= ~(PFIL_MEMPTR | PFIL_LENMASK);
@ -135,10 +151,11 @@ pfil_fake_mbuf(pfil_func_t func, void *mem, struct ifnet *ifp, int flags,
if (rv == PFIL_PASS && mp != &m) {
/*
* Firewalls that need pfil_fake_mbuf() most likely don't
* know to return PFIL_REALLOCED.
* know they need return PFIL_REALLOCED.
*/
rv = PFIL_REALLOCED;
*(struct mbuf **)mem = mp;
*p = pfil_packet_align(*p);
*p->m = mp;
}
return (rv);
@ -168,8 +185,8 @@ pfil_run_hooks(struct pfil_head *head, pfil_packet_t p, struct ifnet *ifp,
PFIL_EPOCH_ENTER(et);
CK_STAILQ_FOREACH(link, pch, link_chain) {
if ((flags & PFIL_MEMPTR) && !(link->link_flags & PFIL_MEMPTR))
rv = pfil_fake_mbuf(link->link_func, p.mem, ifp,
flags, link->link_ruleset, inp);
rv = pfil_fake_mbuf(link->link_func, &p, ifp, flags,
link->link_ruleset, inp);
else
rv = (*link->link_func)(p, ifp, flags,
link->link_ruleset, inp);

22
sys/net/pfil.h
View File

@ -98,8 +98,25 @@ struct inpcb;
typedef union {
struct mbuf **m;
void *mem;
uintptr_t __ui;
} pfil_packet_t __attribute__((__transparent_union__));
static inline pfil_packet_t
pfil_packet_align(pfil_packet_t p)
{
return ((pfil_packet_t ) (((uintptr_t)(p).mem +
(_Alignof(void *) - 1)) & - _Alignof(void *)));
}
static inline struct mbuf *
pfil_mem2mbuf(void *v)
{
return (*(struct mbuf **) (((uintptr_t)(v) +
(_Alignof(void *) - 1)) & - _Alignof(void *)));
}
typedef enum {
PFIL_PASS = 0,
PFIL_DROPPED,
@ -188,5 +205,10 @@ struct _pfil_head {
#define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0)
#define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0)
/*
* Alloc mbuf to be used instead of memory pointer.
*/
int pfil_realloc(pfil_packet_t *, int, struct ifnet *);
#endif /* _KERNEL */
#endif /* _NET_PFIL_H_ */