pf: take the rules read lock in pf_handle_getrule()
pfctl -sr calls PFNL_CMD_GETRULE once per rule, and
pf_handle_getrule() takes the rules write lock each time, so listing a
ruleset of N rules stops packet processing N times. Only zeroing the
counters (pfctl -z) needs the write lock. Take the read lock
otherwise, as DIOCGETRULENV does.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: 777a4702c591 ("pf: implement addrule via netlink")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60161
pf: leave the epoch to purge unlinked rules
pf_purge_thread() calls pf_purge_unlinked_rules() in the network
epoch, where sleeping is not allowed, and it takes pf_config_lock, an
sx lock. If a rule is being added at the time, the purge thread
can sleep on the lock, which panics with INVARIANTS.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: f92d9b1aad73 ("pflow: import from OpenBSD")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60160
pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()
When the PFNL_CMD_ADDRULE message fails to parse, pf_handle_addrule()
frees the rule with pf_free_rule(), which asserts the rules and config
locks (neither is held) and releases references that
pf_ioctl_addrule() has not taken yet. With INVARIANTS this panics on
any parse error; without, a rule address parsed as PF_ADDR_TABLE makes
pfr_detach_table() dereference NULL.
Use pf_krule_free(), as the ioctl paths do.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: e249f5daa41f ("pf: fix memory leak on rule add parse failure")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60104
libpfctl: zero the counters before summing per-chunk results
The chunked table address functions (set, add, del, clr_astats) add
each chunk's result to the caller's counter without initialising it.
pfctl reuses nadd for the number of tables created, so a replace that
also creates the table is off by one:
pfctl -t foo -T replace 192.0.2.1
reports "2 addresses added".
Zero the counters first, as pfctl_test_addrs() already does. Remove
the workaround for the add case from pfctl (da64f6e047b5), which is
no longer needed.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
[4 lines not shown]
pf: modify pfik_flags atomically
The purge thread sets PFI_IFLAG_REFS on the interfaces that states
refer to without the rules lock, under which the other flags are
changed. The updates can interleave, so that a "set skip on" is lost,
or outlives its removal, until the next ruleset load.
Use atomic operations to modify the flags. In the purge thread, only
write if the flag is not already set.
Reviewed by: kp
Approved by: kp (mentor)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60107
pfctl: print "pass" on nat/rdr/binat rules again
c2d03a920ec7 rewrote the action printing in print_rule() from OpenBSD,
which has no natpass, and dropped the "pass" keyword. A ruleset
loaded from "pfctl -sn" output therefore lost its nat-pass semantics.
Add a parser test covering nat, rdr, rdr log and binat with pass.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: c2d03a920ec7 ("pfctl: fix anchortypes bounds test")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60183
cxgbe: Add a sysctl/tunable to control KTLS offload of AES-CBC cipher suites
Disable these by default as they are less efficient and rarely used.
Sponsored by: Chelsio Communications
jh7110_gpio: fdt_pinctrl interface
This provides GPIO programming/configuration at attach time based on the
device tree 'pinmux' descriptions.
Reference:
device-tree/Bindings/pinctrl/starfive,jh7110-sys-pinctrl.yaml
Reviewed by: Brian Scott <bscott at bunyatech.com.au>
Tested by: Brian Scott <bscott at bunyatech.com.au>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59992
jh7110_gpio: handle preset high/low
Take action in the presence of the GPIO_PIN_PRESET_LOW/HIGH flags. This
part of the GPIO interface seems to be unused, but is trivially
implemented in our driver.
Reviewed by: Brian Scott <bscott at bunyatech.com.au>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59991
cxgbe tls: Send final data as immediate when trailing waste is trimmed
When a request needs to drop data from the crypto output (via a split
mode request), send the last 16 bytes of input as immediate data
instead of via DSGL. Requests with small payloads (16 bytes or fewer)
are now sent as immediate data only without any DSGL at all.
Sponsored by: Chelsio Communications
cxgbe: Don't cache nsegs for KTLS requests
KTLS mbufs are initially parsed when they are first enqueued to
estimate the number of transmit descriptors needed so that the mbuf is
queued until enough descriptors are available. As part of this
estimate, the number of DSGL segments required by each KTLS mbuf is
calculated. Originally, the count for the first TLS record in a chain
was cached in the header mbuf to avoid having to recalculate it when
writing out the actual work request for the first TLS record, but this
requires duplicating fairly complex logic both when parsing and
transmitting requests.
Sponsored by: Chelsio Communications
cxgbe: Greatly simplify ktls_wr_len for T7
Don't try to fine-tune the WR size when estimating the work request
length when parsing the packet. Use a much simpler worst-case
estimate that only depends on a few fields in the mbuf metadata.
Sponsored by: Chelsio Communications
cxgbe: Various assertions for lengths in KTLS work requests
The construction of KTLS work requests is quite fragile, and these
assertions ensure that the constructed work requests match the length
fields encoded in some of the WR structures.
Sponsored by: Chelsio Communications
crypto/openssl: update generated files to match 3.5.9 release content
A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "version bump" update
(3.5.8 -> 3.5.9).
MFC after: 1 day
MFC with: b3a31d78
(cherry picked from commit be0569f12f48fe414467cf9cba8627e439ca1cd4)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
crypto/openssl: update to 3.5.9
This is a security fix release addressing CVE High issues. Users are
strongly encouraged to update to this version.
See the release notes for the release for more details on what is being
fixed.
MFC after: 1 day
Merge commit 'af5a659dc1cd2b0a6994f2cee1956d0bf50bb1a2'
(cherry picked from commit f9bc005b8ef3b507a5ecbc2d7fe4411ef70eff38)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
crypto/openssl: update generated files to match 3.5.9 release content
A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "version bump" update
(3.5.8 -> 3.5.9).
MFC after: 1 day
MFC with: b3a31d78
crypto/openssl: update to 3.5.9
This is a security fix release addressing CVE High issues. Users are
strongly encouraged to update to this version.
See the release notes for the release for more details on what is being
fixed.
MFC after: 1 day
Merge commit 'af5a659dc1cd2b0a6994f2cee1956d0bf50bb1a2'
hwpmc: add credential-transition exec tests (keep and drop)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
(cherry picked from commit bea7b932b9eeaff39393347e0600b982fd859a92)
hwpmc tests: the sampling log file
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 8f0789bee7abb2fdb2ff6d625f254533a138e6e8)
