From nobody Mon Nov 18 11:22:31 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XsQFz45P6z5ck96; Mon, 18 Nov 2024 11:22:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XsQFz3S1Zz4HnY; Mon, 18 Nov 2024 11:22:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731928951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ec8Xy85a0KN5nnivXhlL6ZYlEN77d6NTSB3Cn4z+jSc=; b=ZpP1990hN+XL4Kx1bO2cRhefjMXN0fKQnFAmLp9xwMvys91DW/bkw4l58oVvWEE8S8A1fB 9nddknaTMWFZa38o5gXBitGi0kXQjwMcjQUpM/Liu6/zrJWmk7voVn1zPVC8ztKaUqTDe3 9+sAJSa00AawkAE7sJweW78O1fZuD7kte+PX7fJrPfMg6Cvw/yvQH8MlST5PqdnZyuZ9GZ orvtstOyXpsRrxxSS3/HRaVj0376e9lM0mfOnSZSdy0ZaaIUiUnyvAjftFBuRDbBPSK3SJ slAhMv9+1jCTdMIAAh2b7cHgPko5mBL+FX667ESPv3AowCg8DGReGjYDrqsxSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1731928951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ec8Xy85a0KN5nnivXhlL6ZYlEN77d6NTSB3Cn4z+jSc=; b=oq4o+wnH5mxhNUO/6qahuOVIbcfe8uFlOgN+frucVPQFjjmnYSMfe4ya8HmQlbydRGtoqn BEZpqjPAgN/fAaAKsTW1Jxoioa4ESqkWzVsUAruVHzFOflfDc0nyPuK2NSclTGdJrnJM/z ETk9m1MoQrtIwfNtRRfBMM/Ku7V2tMe66K9t/7frkmQ50xbc9ziVBMQVASnBNxgJfa6Fvi xu9IlhaBCPR13YiTpCfO7FHesI8NncpCuqWrYyjn3w4U+KvryAyGt3Y7Kn16OjSCuQtEaJ 22oPjFB0KDHDtLpdxBjQm8Lmn1hyxpftoNWMOg3gfcX+LpRB/5AGFZUN8oVBjQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1731928951; a=rsa-sha256; cv=none; b=fvzEhTeBYlHgntxgPPRQQ8y2CmpR3KGakEEU43hA2ZfDb4oekZ/hSFY6QOpA+Izpe53w51 aoekTjujpNoPUiyyT26VjO9rLsJyTKF9ZFiunKUEZavQ5q7grhIQgftMMweHcSsGovQYhk qe24MKMlddq3fAMnm2YYF59y/NpXYewqAXRBheie+Dmu1QkVNw8mrv/uVX9kAx3ZXgsd3W FwLEK89OFs9dVtiYTWmCDV/s1K3BBaK0WU8BgAg8tVMit0A+mgvcfe2u2wnzNiazUuLCQz 2XtpNcFJ6beiKRbxM0ZKTubO3i+KjclWjKJf3ueHLTkc9ZAAH1tqXKB0WejMqQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XsQFz2m49zdYv; Mon, 18 Nov 2024 11:22:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4AIBMV3W012276; Mon, 18 Nov 2024 11:22:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4AIBMV16012273; Mon, 18 Nov 2024 11:22:31 GMT (envelope-from git) Date: Mon, 18 Nov 2024 11:22:31 GMT Message-Id: <202411181122.4AIBMV16012273@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 83641335f96c - main - pf: clean up pflow sockets on jail removal List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 83641335f96cf7eb590c07eb911a8117ec363fd0 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=83641335f96cf7eb590c07eb911a8117ec363fd0 commit 83641335f96cf7eb590c07eb911a8117ec363fd0 Author: Kristof Provost AuthorDate: 2024-11-18 10:06:41 +0000 Commit: Kristof Provost CommitDate: 2024-11-18 10:06:46 +0000 pf: clean up pflow sockets on jail removal pflow opens sockets in the kernel to transmit netflow information. If this is done in a (vnet) jail these sockets end up preventing the removal of the jail. The VNET_SYSUNINIT() vnet_pflowdetach() function doesn't get called, but that's the function that would remove the sockets. Install a callback on the PR_METHOD_REMOVE jail callback and close the sockets there. This ensures that the jail can get cleaned up. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47545 --- sys/netpfil/pf/pflow.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pflow.c b/sys/netpfil/pf/pflow.c index 5ce1369d9f14..36b528290306 100644 --- a/sys/netpfil/pf/pflow.c +++ b/sys/netpfil/pf/pflow.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -184,15 +185,28 @@ vnet_pflowattach(void) VNET_SYSINIT(vnet_pflowattach, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY, vnet_pflowattach, NULL); -static void -vnet_pflowdetach(void) +static int +pflow_jail_remove(void *obj, void *data __unused) { +#ifdef VIMAGE + const struct prison *pr = obj; +#endif struct pflow_softc *sc; + CURVNET_SET(pr->pr_vnet); CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { pflow_destroy(sc->sc_id, false); } + CURVNET_RESTORE(); + + return (0); +} +static void +vnet_pflowdetach(void) +{ + + /* Should have been done by pflow_jail_remove() */ MPASS(CK_LIST_EMPTY(&V_pflowif_list)); delete_unrhdr(V_pflow_unr); mtx_destroy(&V_pflowif_list_mtx); @@ -1776,6 +1790,8 @@ static const struct nlhdr_parser *all_parsers[] = { &set_parser, }; +static unsigned pflow_do_osd_jail_slot; + static int pflow_init(void) { @@ -1784,6 +1800,11 @@ pflow_init(void) NL_VERIFY_PARSERS(all_parsers); + static osd_method_t methods[PR_MAXMETHOD] = { + [PR_METHOD_REMOVE] = pflow_jail_remove, + }; + pflow_do_osd_jail_slot = osd_jail_register(NULL, methods); + family_id = genl_register_family(PFLOWNL_FAMILY_NAME, 0, 2, PFLOWNL_CMD_MAX); MPASS(family_id != 0); ret = genl_register_cmds(PFLOWNL_FAMILY_NAME, pflow_cmds, NL_ARRAY_LEN(pflow_cmds)); @@ -1794,6 +1815,7 @@ pflow_init(void) static void pflow_uninit(void) { + osd_jail_deregister(pflow_do_osd_jail_slot); genl_unregister_family(PFLOWNL_FAMILY_NAME); }