From owner-svn-src-all@freebsd.org Thu Jun 23 22:31:45 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6154DB74D32; Thu, 23 Jun 2016 22:31:45 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 3DE542BAB; Thu, 23 Jun 2016 22:31:45 +0000 (UTC) (envelope-from bz@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u5NMVikm075949; Thu, 23 Jun 2016 22:31:44 GMT (envelope-from bz@FreeBSD.org) Received: (from bz@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u5NMViLv075948; Thu, 23 Jun 2016 22:31:44 GMT (envelope-from bz@FreeBSD.org) Message-Id: <201606232231.u5NMViLv075948@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: bz set sender to bz@FreeBSD.org using -f From: "Bjoern A. Zeeb" Date: Thu, 23 Jun 2016 22:31:44 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r302160 - head/sys/netpfil/pf X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 22:31:45 -0000 Author: bz Date: Thu Jun 23 22:31:44 2016 New Revision: 302160 URL: https://svnweb.freebsd.org/changeset/base/302160 Log: Proerply virtualize pfsync for bringup after pf is initialized and teardown of VNETs once pf(4) has been shut down. Properly split resources into VNET_SYS(UN)INITs and one time module loading. While here cover the INET parts in the uninit callpath with proper #ifdefs. Approved by: re (gjb) Obtained from: projects/vnet MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Modified: head/sys/netpfil/pf/if_pfsync.c Modified: head/sys/netpfil/pf/if_pfsync.c ============================================================================== --- head/sys/netpfil/pf/if_pfsync.c Thu Jun 23 22:31:10 2016 (r302159) +++ head/sys/netpfil/pf/if_pfsync.c Thu Jun 23 22:31:44 2016 (r302160) @@ -78,6 +78,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include @@ -2315,71 +2316,67 @@ pfsync_pointers_uninit() PF_RULES_WUNLOCK(); } -static int -pfsync_init() +static void +vnet_pfsync_init(const void *unused __unused) { - VNET_ITERATOR_DECL(vnet_iter); - int error = 0; + int error; - VNET_LIST_RLOCK(); - VNET_FOREACH(vnet_iter) { - CURVNET_SET(vnet_iter); - V_pfsync_cloner = if_clone_simple(pfsyncname, - pfsync_clone_create, pfsync_clone_destroy, 1); - error = swi_add(NULL, pfsyncname, pfsyncintr, V_pfsyncif, - SWI_NET, INTR_MPSAFE, &V_pfsync_swi_cookie); - CURVNET_RESTORE(); - if (error) - goto fail_locked; + V_pfsync_cloner = if_clone_simple(pfsyncname, + pfsync_clone_create, pfsync_clone_destroy, 1); + error = swi_add(NULL, pfsyncname, pfsyncintr, V_pfsyncif, + SWI_NET, INTR_MPSAFE, &V_pfsync_swi_cookie); + if (error) { + if_clone_detach(V_pfsync_cloner); + log(LOG_INFO, "swi_add() failed in %s\n", __func__); } - VNET_LIST_RUNLOCK(); +} +VNET_SYSINIT(vnet_pfsync_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY, + vnet_pfsync_init, NULL); + +static void +vnet_pfsync_uninit(const void *unused __unused) +{ + + if_clone_detach(V_pfsync_cloner); + swi_remove(V_pfsync_swi_cookie); +} +/* + * Detach after pf is gone; otherwise we might touch pfsync memory + * from within pf after freeing pfsync. + */ +VNET_SYSUNINIT(vnet_pfsync_uninit, SI_SUB_INIT_IF, SI_ORDER_SECOND, + vnet_pfsync_uninit, NULL); + +static int +pfsync_init() +{ #ifdef INET + int error; + error = pf_proto_register(PF_INET, &in_pfsync_protosw); if (error) - goto fail; + return (error); error = ipproto_register(IPPROTO_PFSYNC); if (error) { pf_proto_unregister(PF_INET, IPPROTO_PFSYNC, SOCK_RAW); - goto fail; + return (error); } #endif pfsync_pointers_init(); return (0); - -fail: - VNET_LIST_RLOCK(); -fail_locked: - VNET_FOREACH(vnet_iter) { - CURVNET_SET(vnet_iter); - if (V_pfsync_swi_cookie) { - swi_remove(V_pfsync_swi_cookie); - if_clone_detach(V_pfsync_cloner); - } - CURVNET_RESTORE(); - } - VNET_LIST_RUNLOCK(); - - return (error); } static void pfsync_uninit() { - VNET_ITERATOR_DECL(vnet_iter); pfsync_pointers_uninit(); +#ifdef INET ipproto_unregister(IPPROTO_PFSYNC); pf_proto_unregister(PF_INET, IPPROTO_PFSYNC, SOCK_RAW); - VNET_LIST_RLOCK(); - VNET_FOREACH(vnet_iter) { - CURVNET_SET(vnet_iter); - if_clone_detach(V_pfsync_cloner); - swi_remove(V_pfsync_swi_cookie); - CURVNET_RESTORE(); - } - VNET_LIST_RUNLOCK(); +#endif } static int @@ -2416,6 +2413,7 @@ static moduledata_t pfsync_mod = { #define PFSYNC_MODVER 1 -DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY); +/* Stay on FIREWALL as we depend on pf being initialized and on inetdomain. */ +DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY); MODULE_VERSION(pfsync, PFSYNC_MODVER); MODULE_DEPEND(pfsync, pf, PF_MODVER, PF_MODVER, PF_MODVER);