From owner-svn-src-all@freebsd.org Thu Jun 11 16:51:14 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 45234339AE3; Thu, 11 Jun 2020 16:51:14 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49jVHQ1C1gz43VL; Thu, 11 Jun 2020 16:51:14 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 2330E1B713; Thu, 11 Jun 2020 16:51:14 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 05BGpETW002316; Thu, 11 Jun 2020 16:51:14 GMT (envelope-from kp@FreeBSD.org) Received: (from kp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 05BGpEQt002315; Thu, 11 Jun 2020 16:51:14 GMT (envelope-from kp@FreeBSD.org) Message-Id: <202006111651.05BGpEQt002315@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kp set sender to kp@FreeBSD.org using -f From: Kristof Provost Date: Thu, 11 Jun 2020 16:51:14 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r362064 - stable/12/sys/netpfil/pf X-SVN-Group: stable-12 X-SVN-Commit-Author: kp X-SVN-Commit-Paths: stable/12/sys/netpfil/pf X-SVN-Commit-Revision: 362064 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jun 2020 16:51:14 -0000 Author: kp Date: Thu Jun 11 16:51:13 2020 New Revision: 362064 URL: https://svnweb.freebsd.org/changeset/base/362064 Log: MFC r357061: pf: Apply kif flags to new group members If we have a 'set skip on ' rule this flag it set on the group kif, but must also be set on all members. pfctl does this when the rules are set, but if groups are added afterwards we must also apply the flags to the new member. If not, new group members will not be skipped until the rules are reloaded. Modified: stable/12/sys/netpfil/pf/pf_if.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/netpfil/pf/pf_if.c ============================================================================== --- stable/12/sys/netpfil/pf/pf_if.c Thu Jun 11 15:59:49 2020 (r362063) +++ stable/12/sys/netpfil/pf/pf_if.c Thu Jun 11 16:51:13 2020 (r362064) @@ -463,13 +463,27 @@ static void pfi_kif_update(struct pfi_kif *kif) { struct ifg_list *ifgl; + struct ifg_member *ifgm; struct pfi_dynaddr *p; + struct pfi_kif *tmpkif; PF_RULES_WASSERT(); /* update all dynaddr */ TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) pfi_dynaddr_update(p); + + /* Apply group flags to new members. */ + if (kif->pfik_group != NULL) { + CK_STAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, + ifgm_next) { + tmpkif = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif; + if (tmpkif == NULL) + continue; + + tmpkif->pfik_flags |= kif->pfik_flags; + } + } /* again for all groups kif is member of */ if (kif->pfik_ifp != NULL) {