diff options
| author | Max Laier <mlaier@FreeBSD.org> | 2006-12-29 13:59:03 +0000 |
|---|---|---|
| committer | Max Laier <mlaier@FreeBSD.org> | 2006-12-29 13:59:03 +0000 |
| commit | 240589a9fec34f1cd809cc429f2c56147a0383bd (patch) | |
| tree | 450bece21275271ddebaac52f810c4d0c53088e3 /sys | |
| parent | 7e4277e59131df4d5227f5119e370bd09d4d6149 (diff) | |
Notes
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/conf/NOTES | 4 | ||||
| -rw-r--r-- | sys/conf/options | 1 | ||||
| -rw-r--r-- | sys/contrib/pf/net/pf.c | 12 |
3 files changed, 17 insertions, 0 deletions
diff --git a/sys/conf/NOTES b/sys/conf/NOTES index 58e2bfdaa859..6df0374fbafd 100644 --- a/sys/conf/NOTES +++ b/sys/conf/NOTES @@ -750,6 +750,9 @@ device mn # Munich32x/Falc54 Nx64kbit/sec cards. # The `pflog' device provides the pflog0 interface which logs packets. # The `pfsync' device provides the pfsync0 interface used for # synchronization of firewall state tables (over the net). +# The PF_MPSAFE_UGID option enables a special workaround for a LOR with +# user/group rules that would otherwise lead to a deadlock. This has +# performance implications and should be used with care. # # The PPP_BSDCOMP option enables support for compress(1) style entire # packet compression, the PPP_DEFLATE is for zlib/gzip style compression. @@ -780,6 +783,7 @@ device if_bridge #Bridge interface device pf #PF OpenBSD packet-filter firewall device pflog #logging support interface for PF device pfsync #synchronization interface for PF +options PF_MPSAFE_UGID #Workaround LOR with user/group rules device carp #Common Address Redundancy Protocol device enc #IPSec interface (needs FAST_IPSEC) device ppp #Point-to-point protocol diff --git a/sys/conf/options b/sys/conf/options index 36d3b5f0d05f..25512465177f 100644 --- a/sys/conf/options +++ b/sys/conf/options @@ -349,6 +349,7 @@ DEV_ENC opt_enc.h DEV_PF opt_pf.h DEV_PFLOG opt_pf.h DEV_PFSYNC opt_pf.h +PF_MPSAFE_UGID opt_pf.h ETHER_II opt_ef.h ETHER_8023 opt_ef.h ETHER_8022 opt_ef.h diff --git a/sys/contrib/pf/net/pf.c b/sys/contrib/pf/net/pf.c index f2be6e5e9e6a..15cff43adba3 100644 --- a/sys/contrib/pf/net/pf.c +++ b/sys/contrib/pf/net/pf.c @@ -3032,6 +3032,12 @@ pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, return (PF_DROP); } +#if defined(__FreeBSD__) && defined(PF_MPSAFE_UGID) + PF_UNLOCK(); + lookup = pf_socket_lookup(&uid, &gid, direction, pd, inp); + PF_LOCK(); +#endif + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); if (direction == PF_OUT) { @@ -3428,6 +3434,12 @@ pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, return (PF_DROP); } +#if defined(__FreeBSD__) && defined(PF_MPSAFE_UGID) + PF_UNLOCK(); + lookup = pf_socket_lookup(&uid, &gid, direction, pd, inp); + PF_LOCK(); +#endif + r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); if (direction == PF_OUT) { |