From nobody Wed Sep 25 12:34:26 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XDGPt5qfHz5XQcT; Wed, 25 Sep 2024 12:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XDGPt58Msz4vTw; Wed, 25 Sep 2024 12:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1727267666; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xHiNIzuSznN62dUTkEXbjedp58FESY54nyYZdKzBdNk=; b=g8JpCB0jc/OWMPRFVvuNCgo39+KO0MgK2m6/eQ7iuz4ip6Rj6WPEJEYm8ZxtyA1frrPdVf 4qG39XqeIvWRmY5nl2uECIaVcX3VZithVaCJDFjzuCGjZQj7EjTUiPGJrdzK+iceQdS0hp IvfuRL4HIZ5Z5kZuZQX0EmLvKPnrXzDzSKS20NhrKuxSBlLX5i1osXDC6hIOMriO32guDs SXKpz8CRs39T0dU2pmVdtSsEs/H9XGkG0Kcx34E6TxAYbgKkg/mjle4UGzHoTZbxkiBHc3 CCfzEjg3lgNUN1e9gXso+aE3U/JJTu6CrMVpYf4q1YU8QUjNpDEtetG0LNRojw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1727267666; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xHiNIzuSznN62dUTkEXbjedp58FESY54nyYZdKzBdNk=; b=Ke9Pd5/6dhFR45J+d9DQiJxgmpisne/pjjVNmTnR3AuLwFQETD+TM1qwJ856aHHEAjRNgx KJ2LGgtlmlkZt8aSC3g/dYYCCGcOTrot9nE/z+C4yHyn5rqaaAs6VIeDPa4oGDUUrEV+i2 WtzXl79ZmZPi7LWgaZ2HfZdBaa7XwEzz8QMQf/Y26T+z/MNnwASxqgb7AkjAOcAfW24svp lV2qYvJvLnXUiVBBmw2usrq0+k7tT0uzwtwVAtpLeqKtay7EswoIWh8igWKJdP8MBcJnoE oNt7WEaD0PvCN3qbKMOAU6RDFF8XhJxKk//zmMTBw4MIPNGKVr24h8pphNMFLg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1727267666; a=rsa-sha256; cv=none; b=dmIuyzbOXobl3t1QkSbIP2O8nT1oMbuhg9yb9FmY+Om7KfKBkwKLeKPYPGTyXxkO6mFpuj Pp6nGKmbHUCJMnH+vJzVicAY8CRMK1VZTpAJoHAAd+UUr27idoSZgaXaMD3TVo2SGUIelF 5w3qMhc9+RWqD4sOKRRemMnNYaAIFmFKh7Yv6Ip8wliFq2dsMW7fgkUDn1VSc4exWukI/c tIWuyLl+oD0dand9AYSPbNX4oaH2Pn5Bs+3eMVnD28qp70IP11XAZI5mbWQqBB78WFveGN HXLCftilOFznpq6yRM3wCeYF0X9uBBrknHWRKciamOijkic8yiIEFb9JW2/9cQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XDGPt4KBlz1CRL; Wed, 25 Sep 2024 12:34:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 48PCYQba071582; Wed, 25 Sep 2024 12:34:26 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 48PCYQ8L071579; Wed, 25 Sep 2024 12:34:26 GMT (envelope-from git) Date: Wed, 25 Sep 2024 12:34:26 GMT Message-Id: <202409251234.48PCYQ8L071579@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 4f9e688708f1 - main - pf: merge pf_scrub_ip() and pf_scrub_ip6() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4f9e688708f1bead81954c429f7eca5109ee454b Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=4f9e688708f1bead81954c429f7eca5109ee454b commit 4f9e688708f1bead81954c429f7eca5109ee454b Author: Kristof Provost AuthorDate: 2024-09-06 11:32:53 +0000 Commit: Kristof Provost CommitDate: 2024-09-25 10:44:18 +0000 pf: merge pf_scrub_ip() and pf_scrub_ip6() Merge pf_scrub_ip() and pf_scrub_ip6() into a single function. Call pf_scrub with the right arugments in the rule case so that match rules will work as expected. OK henning@ Obtained from: OpenBSD, claudio , 48c45e6969 Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D46597 --- sys/net/pfvar.h | 9 +++----- sys/netpfil/pf/pf.c | 4 ++-- sys/netpfil/pf/pf_norm.c | 60 +++++++++++++++++++++++++----------------------- 3 files changed, 36 insertions(+), 37 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 0dfa58979f16..61752a146b57 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2642,12 +2642,9 @@ void pf_rule_to_actions(struct pf_krule *, struct pf_rule_actions *); int pf_normalize_mss(struct mbuf *m, int off, struct pf_pdesc *pd); -#ifdef INET -void pf_scrub_ip(struct mbuf *, struct pf_pdesc *); -#endif /* INET */ -#ifdef INET6 -void pf_scrub_ip6(struct mbuf *, struct pf_pdesc *); -#endif /* INET6 */ +#if defined(INET) || defined(INET6) +void pf_scrub(struct mbuf *, struct pf_pdesc *); +#endif struct pfi_kkif *pf_kkif_create(int); void pf_kkif_free(struct pfi_kkif *); diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index d4adf1363cdf..456fdd0aa9bd 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -9221,7 +9221,7 @@ done: REASON_SET(&reason, PFRES_MEMORY); } - pf_scrub_ip(m, &pd); + pf_scrub(m, &pd); if (pd.proto == IPPROTO_TCP && pd.act.max_mss) pf_normalize_mss(m, off, &pd); @@ -9676,7 +9676,7 @@ done: REASON_SET(&reason, PFRES_MEMORY); } - pf_scrub_ip6(m, &pd); + pf_scrub(m, &pd); if (pd.proto == IPPROTO_TCP && pd.act.max_mss) pf_normalize_mss(m, off, &pd); diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 284660767224..926529330619 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -2267,14 +2267,20 @@ sctp_drop: return (PF_DROP); } -#ifdef INET +#if defined(INET) || defined(INET6) void -pf_scrub_ip(struct mbuf *m, struct pf_pdesc *pd) +pf_scrub(struct mbuf *m, struct pf_pdesc *pd) { + struct ip *h = mtod(m, struct ip *); +#ifdef INET6 + struct ip6_hdr *h6 = mtod(m, struct ip6_hdr *); +#endif /* Clear IP_DF if no-df was requested */ - if (pd->act.flags & PFSTATE_NODF && h->ip_off & htons(IP_DF)) { + if (pd->af == AF_INET && pd->act.flags & PFSTATE_NODF && + h->ip_off & htons(IP_DF)) + { u_int16_t ip_off = h->ip_off; h->ip_off &= htons(~IP_DF); @@ -2282,48 +2288,44 @@ pf_scrub_ip(struct mbuf *m, struct pf_pdesc *pd) } /* Enforce a minimum ttl, may cause endless packet loops */ - if (pd->act.min_ttl && h->ip_ttl < pd->act.min_ttl) { + if (pd->af == AF_INET && pd->act.min_ttl && + h->ip_ttl < pd->act.min_ttl) { u_int16_t ip_ttl = h->ip_ttl; h->ip_ttl = pd->act.min_ttl; h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0); } - +#ifdef INET6 + /* Enforce a minimum ttl, may cause endless packet loops */ + if (pd->af == AF_INET6 && pd->act.min_ttl && + h6->ip6_hlim < pd->act.min_ttl) + h6->ip6_hlim = pd->act.min_ttl; +#endif /* Enforce tos */ if (pd->act.flags & PFSTATE_SETTOS) { - u_int16_t ov, nv; + if (pd->af == AF_INET) { + u_int16_t ov, nv; - ov = *(u_int16_t *)h; - h->ip_tos = pd->act.set_tos | (h->ip_tos & IPTOS_ECN_MASK); - nv = *(u_int16_t *)h; + ov = *(u_int16_t *)h; + h->ip_tos = pd->act.set_tos | (h->ip_tos & IPTOS_ECN_MASK); + nv = *(u_int16_t *)h; - h->ip_sum = pf_cksum_fixup(h->ip_sum, ov, nv, 0); + h->ip_sum = pf_cksum_fixup(h->ip_sum, ov, nv, 0); +#ifdef INET6 + } else if (pd->af == AF_INET6) { + h6->ip6_flow &= IPV6_FLOWLABEL_MASK | IPV6_VERSION_MASK; + h6->ip6_flow |= htonl((pd->act.set_tos | IPV6_ECN(h6)) << 20); +#endif + } } /* random-id, but not for fragments */ - if (pd->act.flags & PFSTATE_RANDOMID && !(h->ip_off & ~htons(IP_DF))) { + if (pd->af == AF_INET && + pd->act.flags & PFSTATE_RANDOMID && !(h->ip_off & ~htons(IP_DF))) { uint16_t ip_id = h->ip_id; ip_fillid(h); h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_id, h->ip_id, 0); } } -#endif /* INET */ - -#ifdef INET6 -void -pf_scrub_ip6(struct mbuf *m, struct pf_pdesc *pd) -{ - struct ip6_hdr *h = mtod(m, struct ip6_hdr *); - - /* Enforce a minimum ttl, may cause endless packet loops */ - if (pd->act.min_ttl && h->ip6_hlim < pd->act.min_ttl) - h->ip6_hlim = pd->act.min_ttl; - - /* Enforce tos. Set traffic class bits */ - if (pd->act.flags & PFSTATE_SETTOS) { - h->ip6_flow &= IPV6_FLOWLABEL_MASK | IPV6_VERSION_MASK; - h->ip6_flow |= htonl((pd->act.set_tos | IPV6_ECN(h)) << 20); - } -} #endif