From owner-dev-commits-src-all@freebsd.org Thu May 20 11:54:54 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 4920F63BF5F; Thu, 20 May 2021 11:54:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fm7TB0PFxz3GZD; Thu, 20 May 2021 11:54:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E456A25A01; Thu, 20 May 2021 11:54:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 14KBsrZQ056911; Thu, 20 May 2021 11:54:53 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 14KBsrXX056910; Thu, 20 May 2021 11:54:53 GMT (envelope-from git) Date: Thu, 20 May 2021 11:54:53 GMT Message-Id: <202105201154.14KBsrXX056910@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: b62489cc92ed - main - pf: Support killing floating states by interface MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b62489cc92edbec318fb6c57cdc02b5e3cfa3a67 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 May 2021 11:54:54 -0000 The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=b62489cc92edbec318fb6c57cdc02b5e3cfa3a67 commit b62489cc92edbec318fb6c57cdc02b5e3cfa3a67 Author: Kristof Provost AuthorDate: 2021-05-13 07:51:28 +0000 Commit: Kristof Provost CommitDate: 2021-05-20 10:49:27 +0000 pf: Support killing floating states by interface Floating states get assigned to interface 'all' (V_pfi_all), so when we try to flush all states for an interface states originally created through this interface are not flushed. Only if-bound states can be flushed in this way. Given that we track the original interface we can check if the state's interface is 'all', and if so compare to the orig_if instead. MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D30246 --- sys/netpfil/pf/pf_ioctl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 62c1f35c3c3f..91a175caa74f 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2828,10 +2828,14 @@ pf_killstates_row(struct pf_kstate_kill *psk, struct pf_idhash *ih) int idx, killed = 0; unsigned int dir; u_int16_t srcport, dstport; + struct pfi_kkif *kif; relock_DIOCKILLSTATES: PF_HASHROW_LOCK(ih); LIST_FOREACH(s, &ih->states, entry) { + /* For floating states look at the original kif. */ + kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; + sk = s->key[PF_SK_WIRE]; if (s->direction == PF_OUT) { srcaddr = &sk->addr[1]; @@ -2880,7 +2884,7 @@ relock_DIOCKILLSTATES: continue; if (psk->psk_ifname[0] && strcmp(psk->psk_ifname, - s->kif->pfik_name)) + kif->pfik_name)) continue; if (psk->psk_kill_match) { @@ -5662,6 +5666,7 @@ pf_clear_states(const struct pf_kstate_kill *kill) { struct pf_state_key_cmp match_key; struct pf_state *s; + struct pfi_kkif *kif; int idx; unsigned int killed = 0, dir; @@ -5671,9 +5676,12 @@ pf_clear_states(const struct pf_kstate_kill *kill) relock_DIOCCLRSTATES: PF_HASHROW_LOCK(ih); LIST_FOREACH(s, &ih->states, entry) { + /* For floating states look at the original kif. */ + kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; + if (kill->psk_ifname[0] && strcmp(kill->psk_ifname, - s->kif->pfik_name)) + kif->pfik_name)) continue; if (kill->psk_kill_match) {