cvs commit: src/sys/netinet ip_fw2.c

[Christian S.J. Peron]

csjp        2005-01-07 23:09:39 UTC

  FreeBSD src repository

  Modified files:        (Branch: RELENG_5)
    sys/netinet          ip_fw2.c 
  Log:
  MFC v1.85
    Log:
    This commit adds a shared locking mechanism very similar to the
    mechanism used by pfil.  This shared locking mechanism will remove
    a nasty lock order reversal which occurs when ucred based rules
    are used which results in hard locks while mpsafenet=1.
  
    So this removes the debug.mpsafenet=0 requirement when using
    ucred based rules with IPFW.
  
    It should be noted that this locking mechanism does not guarantee
    fairness between read and write locks, and that it will favor
    firewall chain readers over writers. This seemed acceptable since
    write operations to firewall chains protected by this lock tend to
    be less frequent than reads.
  
    Reviewed by:    andre, rwatson
    Tested by:      myself, seanc
    Silence on:     ipfw@
    MFC after:      1 month
  
  Revision  Changes    Path
  1.70.2.8  +69 -29    src/sys/netinet/ip_fw2.c