diff options
| author | Mateusz Guzik <mjg@FreeBSD.org> | 2022-02-25 17:56:45 +0000 |
|---|---|---|
| committer | Mateusz Guzik <mjg@FreeBSD.org> | 2022-03-28 11:44:46 +0000 |
| commit | 93f8c38c0371139fbe444b645ef36ae0d92d400a (patch) | |
| tree | 99159dc85badce73985e7eccc25ee8d012c16cf8 /sys/netpfil | |
| parent | 2f968abce5439d5a71b6b685416b219f0450fd5b (diff) | |
| download | src-93f8c38c0371139fbe444b645ef36ae0d92d400a.tar.gz src-93f8c38c0371139fbe444b645ef36ae0d92d400a.zip | |
pf: add pf_config_lock
For now only protects rule creation/destruction, but will allow
gradually reducing the scope of rules lock when changing the
rules.
Reviewed by: kp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Diffstat (limited to 'sys/netpfil')
| -rw-r--r-- | sys/netpfil/pf/pf.c | 5 | ||||
| -rw-r--r-- | sys/netpfil/pf/pf_ioctl.c | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 0a479c8a77e8..027d48c82688 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -236,6 +236,9 @@ struct mtx_padalign pf_unlnkdrules_mtx; MTX_SYSINIT(pf_unlnkdrules_mtx, &pf_unlnkdrules_mtx, "pf unlinked rules", MTX_DEF); +struct sx pf_config_lock; +SX_SYSINIT(pf_config_lock, &pf_config_lock, "pf config"); + struct mtx_padalign pf_table_stats_lock; MTX_SYSINIT(pf_table_stats_lock, &pf_table_stats_lock, "pf table stats", MTX_DEF); @@ -2201,12 +2204,14 @@ pf_purge_unlinked_rules() PF_UNLNKDRULES_UNLOCK(); if (!TAILQ_EMPTY(&tmpq)) { + PF_CONFIG_LOCK(); PF_RULES_WLOCK(); TAILQ_FOREACH_SAFE(r, &tmpq, entries, r1) { TAILQ_REMOVE(&tmpq, r, entries); pf_free_rule(r); } PF_RULES_WUNLOCK(); + PF_CONFIG_UNLOCK(); } } diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 45f14fc92f7b..117ee0d04c53 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2088,6 +2088,7 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, rule->cpid = td->td_proc ? td->td_proc->p_pid : 0; TAILQ_INIT(&rule->rpool.list); + PF_CONFIG_LOCK(); PF_RULES_WLOCK(); #ifdef PF_WANT_32_TO_64_COUNTER LIST_INSERT_HEAD(&V_pf_allrulelist, rule, allrulelist); @@ -2203,12 +2204,14 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, ruleset->rules[rs_num].inactive.rcount++; PF_RULES_WUNLOCK(); + PF_CONFIG_UNLOCK(); return (0); #undef ERROUT errout: PF_RULES_WUNLOCK(); + PF_CONFIG_UNLOCK(); errout_unlocked: pf_kkif_free(kif); pf_krule_free(rule); |