From nobody Mon Feb 5 21:19:20 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TTK545ndKz592cq; Mon, 5 Feb 2024 21:19:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TTK544bGpz53PD; Mon, 5 Feb 2024 21:19:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1707167960; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4482zJ0ZCTZAh3MEEljd4pQfPRYv25KGMxApG7YMEKY=; b=gjc8m/d5rezTmtFvRsqUgepa0EtO2SJrmTe/p8/o7kak92/B93PJ3RfJuVJbw5Yw0VxhHM P22yEPSYDM5CI/ea1lsjmhswmMj1K7zR442hjubGRf+KsYc5KH4lqAGROfLx6GhiD8C6Cm aqesVOppcXPUNHd2lTCOuhdZfPDY9BZCaxDxmIKxAPIJRij8UsXRmK0ioMXe+4FtBKaXJQ EDibuQ0r7dGbrBAlf3IcyXlz7IaXq9CEXyHSAjaV+XQTsS7e3VV7qtL+jWPHtI1ofE4jOI 2252JNq7DNnUHRnZ24dZHFvqN6Moq987euWY491ATtGwNgZQC1H988uznuDK1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1707167960; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4482zJ0ZCTZAh3MEEljd4pQfPRYv25KGMxApG7YMEKY=; b=qp7ghLZ/gST7OU8sE1EIn2AfRQS/YEQTlJhGs65mhSiGk27EWpy9c+p/fJcRz41wNtChcI ElEktDjatY7epvJOdswomkBO6VeSYUmCfgEF13yAHpp9KWXkHPuuH9wQogVp1tsnqq/e3o 2oct3KRcKu5YJavAtQsIuTTOwNopEhMYsj/t2vW3MOJ4xmxybzwQ5STWP9yu3pbq3JA+ca vGatQFIo0VsRRINAXSqadOv0NgQ/zy1KhCalqf0VDjqrepkcKhiQMrza+6H+J7cOh93T2A yVGengehXUI4pCYXFamclcZqO7vMrU6aZJu4n901sjRlA7BO36rKnhZTDH7iLg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1707167960; a=rsa-sha256; cv=none; b=jHtkqVVdUCcNYb8HH0LuxW9VYFa4GHtEce7/b3wlkBpdcSZJC6QxS7/7BRu0STisXAASMA O1qOzVtlksXI08BwvpL+vjbyEPN7SOA2Qnwj2vBcOhpnEHXkIEDjTNxFqgol99wiRoWCI3 kVNFv3CM9xPf4pXphdh7HOnIMydVUsqNkeywBziXwYfXGvsG/RNQgJUMVj8Tx5fqu2SKRl rqX4m1ZaR2ci0WFW4W683pjajQteqWfQeDQTaMeQzOaGxgLCOk/Ecjk31qz7u1MzoqfIjp JDY2M7lfiIZyWGUXSuM5R7rGtcWCuuY83AxbxN6cP2RPrjVrLvr55vkqfhj5hA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TTK543h7czwHr; Mon, 5 Feb 2024 21:19:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 415LJKCP037383; Mon, 5 Feb 2024 21:19:20 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 415LJKSN037380; Mon, 5 Feb 2024 21:19:20 GMT (envelope-from git) Date: Mon, 5 Feb 2024 21:19:20 GMT Message-Id: <202402052119.415LJKSN037380@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 6d4a140acfdf - main - pf: Ensure that st->kif is obtained in a way which respects the r->rpool->mtx mutex List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6d4a140acfdf637bb559d371c583e4db478e1549 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=6d4a140acfdf637bb559d371c583e4db478e1549 commit 6d4a140acfdf637bb559d371c583e4db478e1549 Author: Igor Ostapenko AuthorDate: 2024-02-05 16:22:31 +0000 Commit: Kristof Provost CommitDate: 2024-02-05 21:18:11 +0000 pf: Ensure that st->kif is obtained in a way which respects the r->rpool->mtx mutex The redirection pool stored in r->rpool.cur is used for loadbalancing and cur can change whenever loadbalancing happens, which is for every new connection. Therefore it can't be trusted outside of pf_map_addr() and the r->rpool->mtx mutex. After evaluating the ruleset, loadbalancing decission is made in pf_map_addr() called from within pf_create_state() and stored in the state itself. This patch modifies BOUND_IFACE() so that it only uses the information already stored in the state which has been obtained in a way which respects the r->rpool->mtx mutex. Reviewed by: kp Differential Revision: https://reviews.freebsd.org/D43741 --- sys/netpfil/pf/pf.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 9f2c07c614b3..12b72f50aa02 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -413,25 +413,22 @@ VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]); } while (0) static struct pfi_kkif * -BOUND_IFACE(struct pf_krule *r, struct pfi_kkif *k, struct pf_pdesc *pd) +BOUND_IFACE(struct pf_kstate *st, struct pfi_kkif *k) { /* Floating unless otherwise specified. */ - if (! (r->rule_flag & PFRULE_IFBOUND)) + if (! (st->rule.ptr->rule_flag & PFRULE_IFBOUND)) return (V_pfi_all); /* Don't overrule the interface for states created on incoming packets. */ - if (pd->dir == PF_IN) - return (k); - - /* No route-to, so don't overrrule. */ - if (r->rt != PF_ROUTETO) + if (st->direction == PF_IN) return (k); - if (r->rpool.cur == NULL) + /* No route-to, so don't overrule. */ + if (st->rt != PF_ROUTETO) return (k); /* Bind to the route-to interface. */ - return (r->rpool.cur->kif); + return (st->rt_kif); } #define STATE_INC_COUNTERS(s) \ @@ -5018,7 +5015,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, __func__, nr, sk, nk)); /* Swap sk/nk for PF_OUT. */ - if (pf_state_insert(BOUND_IFACE(r, kif, pd), kif, + if (pf_state_insert(BOUND_IFACE(s, kif), kif, (pd->dir == PF_IN) ? sk : nk, (pd->dir == PF_IN) ? nk : sk, s)) { REASON_SET(&reason, PFRES_STATEINS);