From owner-svn-src-all@freebsd.org Thu Jan 23 22:13:42 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2071D1FF8B7; Thu, 23 Jan 2020 22:13:42 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 483c4602vzz4BBj; Thu, 23 Jan 2020 22:13:42 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F0E7D1D934; Thu, 23 Jan 2020 22:13:41 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 00NMDfhP082708; Thu, 23 Jan 2020 22:13:41 GMT (envelope-from kp@FreeBSD.org) Received: (from kp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 00NMDfsl082707; Thu, 23 Jan 2020 22:13:41 GMT (envelope-from kp@FreeBSD.org) Message-Id: <202001232213.00NMDfsl082707@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kp set sender to kp@FreeBSD.org using -f From: Kristof Provost Date: Thu, 23 Jan 2020 22:13:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r357061 - head/sys/netpfil/pf X-SVN-Group: head X-SVN-Commit-Author: kp X-SVN-Commit-Paths: head/sys/netpfil/pf X-SVN-Commit-Revision: 357061 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jan 2020 22:13:42 -0000 Author: kp Date: Thu Jan 23 22:13:41 2020 New Revision: 357061 URL: https://svnweb.freebsd.org/changeset/base/357061 Log: pf: Apply kif flags to new group members If we have a 'set skip on ' rule this flag it set on the group kif, but must also be set on all members. pfctl does this when the rules are set, but if groups are added afterwards we must also apply the flags to the new member. If not, new group members will not be skipped until the rules are reloaded. Reported by: dvl@ Reviewed by: glebius@ Differential Revision: https://reviews.freebsd.org/D23254 Modified: head/sys/netpfil/pf/pf_if.c Modified: head/sys/netpfil/pf/pf_if.c ============================================================================== --- head/sys/netpfil/pf/pf_if.c Thu Jan 23 21:46:33 2020 (r357060) +++ head/sys/netpfil/pf/pf_if.c Thu Jan 23 22:13:41 2020 (r357061) @@ -477,7 +477,9 @@ static void pfi_kif_update(struct pfi_kif *kif) { struct ifg_list *ifgl; + struct ifg_member *ifgm; struct pfi_dynaddr *p; + struct pfi_kif *tmpkif; NET_EPOCH_ASSERT(); PF_RULES_WASSERT(); @@ -485,6 +487,18 @@ pfi_kif_update(struct pfi_kif *kif) /* update all dynaddr */ TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) pfi_dynaddr_update(p); + + /* Apply group flags to new members. */ + if (kif->pfik_group != NULL) { + CK_STAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, + ifgm_next) { + tmpkif = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif; + if (tmpkif == NULL) + continue; + + tmpkif->pfik_flags |= kif->pfik_flags; + } + } /* again for all groups kif is member of */ if (kif->pfik_ifp != NULL) {