libalias: index fully specified inbound links by remote endpoint
Inbound lookups find the (alias address, alias port, link type) group
with a splay tree and then walk grp->full, a list of every fully
specified link in that group, comparing the remote address and port.
With redirect_addr in front of a busy server, every client connection
to public:443 lands in the same group, so each inbound packet that is
not near the head of the list walks all of it. TCP links live up to
24 hours unless libalias sees a clean close, so the list can grow to
hundreds of thousands of entries and saturate a core at a few hundred
packets per second.
Keep the fully specified links of a group in an RB tree ordered by
(dst_addr, dst_port). Links that share an endpoint are ordered newest
first by a per-instance insertion counter, which keeps the "most recent
link wins" behaviour of the list (tested by 3_natin:2_portoverlap).
Lookups with an unknown remote address and a known port still scan the
group. Each link grows by 16 bytes.
[10 lines not shown]
libalias: Handle GetNewPort() errors properly
AddLink() fails when memory allocation fails or no free port is
available; both are error conditions. However, functions such as
FindUdpTcpIn() were converting such failures to PKT_ALIAS_IGNORED, which
effectively means, "pass the packet without translation," which isn't
what we want.
Fix the problem by making sure that AddLink() errors are converted to
PKT_ALIAS_ERROR where appropriate. The diff is a bit large but is
mostly mechanical: functions like TcpAliasOut() are converted to return
a result code, and an additional out-parameter is added to return the
alias_link pointer.
Reported by: Yuxiang Yang <yangyx22 at mails.tsinghua.edu.cn>
Tested by: Yuxiang Yang <yangyx22 at mails.tsinghua.edu.cn>
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D47778
(cherry picked from commit fb2ea26f3c3681f5ef639af9c798a631d800864b)
libalias: Add support for EIM NAT
Add support for endpoint-independent mapping ("full cone NAT") in
Libalias's UDP NAT.
This conforms to RFC 4787 requirements 1 and 3. All UDP packets sent out from a
particular internal address:port leave via the same NAT address:port,
regardless of their destination.
Add some libalias tests and supporting defines.
Reviewed by: igoro, thj
Differential Revision: https://reviews.freebsd.org/D46689D
(cherry picked from commit 61bf830cbb260c2a046cb44421d319184393e028)
tcp: address PR295870
Fix accounting in the sequence space for a FIN bit potentially
piggy bagged during SACK loss recovery triggered transmissions.
Reviewed By: #transport, tuexen
Sponsored by: NetApp, Inc.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61312
link_elf_obj: fix an off-by-one in the symbol string table index check
link_elf_load_file() checks the symbol table's sh_link against
e_shnum with ">" instead of ">=", so a malformed object whose sh_link
equals e_shnum makes the linker read one entry past the section header
array before the sh_type check rejects it. Use ">=", as
link_elf_link_preload() already does.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61055
vmm: Emulate the byte forms of OR and AND with an immediate
Opcode 0x80 (group 1: r/m8, imm8) is in the decode table and
emulate_cmp() handles 80 /7, but emulate_or() and emulate_and() only
accept 0x81 and 0x83. An "or byte ptr [mem], imm8" or "and byte ptr
[mem], imm8" on emulated memory therefore fails with EINVAL and bhyve
stops the guest with "Failed to emulate instruction sequence
[ 80 ... ]". Seen with macOS: VoodooHDA starts the HDA controller's
CORB with "or byte [rax+0x4c], 2" (CORBCTL |= CORBRUN), and the guest
died at the first sound.
Accept 0x80 in both, with a one byte operand as emulate_cmp() does.
The file is shared with bhyve(8), so the fix covers the in-kernel
devices (HPET, local APIC without APICv, I/O APIC) and the user space
device models alike.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
[3 lines not shown]
link_elf_obj: guard reltab/relatab frees in link_elf_unload_file()
link_elf_unload_file() frees the per-section relocation tables by iterating
ef->nreltab / ef->nrelatab, but dereferences ef->reltab / ef->relatab
unconditionally. The counts are set while scanning the section headers, before
the tables are allocated, so an error on the load path reaches it with a
non-zero count and a NULL table, faulting on ef->relatab[0].rela. Reachable
from link_elf_load_file() once a valid relocation section has been counted,
e.g. a later section with sh_info >= e_shnum (D60937).
Guard the loops with the table pointer, as is already done for ef->progtab
above.
MFC after: 1 week
Reviewed by: markj, kib
Differential Revision: https://reviews.freebsd.org/D61140
link_elf_obj: bounds-check a relocation section's sh_info
sh_info is used to index the section header array without checking it
against e_shnum, so a malformed object can make the linker read out of
bounds. Reject such a file with ENOEXEC in both the preload and kldload
paths.
MFC after: 1 week
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D60937
gptzfsboot: Use snprintf() to format file names
The stack buffer in fs_list() can be overflowed if a file name is too
long.
Reported by: Yudi Yang <yudi.yang at rice.edu>
MFC after: 1 week
Mark Johnsons Claude code found a duplicate call to rack_check_reorder_ack() in rack.c
Mark's Claude code properly points out an interesting bug case where if a new block is
created from a sack aka
rsm |--------|
sackblk |--------->
Then when the new block is created rack_check_reorder_ack() is called and then called again when
the block is actually ack'ed. Proper thing is to *not* in this case call the function and only call
it at the processing to ACK. You leave the hookery side however since that is just transfering
the existing block pointers.
Differential Revision:https://reviews.freebsd.org/D61159
kern: Remove unreachable compat_freebsd8 FEATURE
COMPAT_FREEBSD8 does not exist as a kernel option, so this is dead code.
No functional change intended.
Fixes: e256f71389fb ("kernel: add missed FEATUREs compat_freebsd 8-14")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: kib
Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/80
(cherry picked from commit 9da2c05a748fd17757638e1a9e78215cdb8b80d0)
