pf: take the rules read lock in pf_handle_getrule()
pfctl -sr calls PFNL_CMD_GETRULE once per rule, and
pf_handle_getrule() takes the rules write lock each time, so listing a
ruleset of N rules stops packet processing N times. Only zeroing the
counters (pfctl -z) needs the write lock. Take the read lock
otherwise, as DIOCGETRULENV does.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: 777a4702c591 ("pf: implement addrule via netlink")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60161
pf: leave the epoch to purge unlinked rules
pf_purge_thread() calls pf_purge_unlinked_rules() in the network
epoch, where sleeping is not allowed, and it takes pf_config_lock, an
sx lock. If a rule is being added at the time, the purge thread
can sleep on the lock, which panics with INVARIANTS.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: f92d9b1aad73 ("pflow: import from OpenBSD")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60160
pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()
When the PFNL_CMD_ADDRULE message fails to parse, pf_handle_addrule()
frees the rule with pf_free_rule(), which asserts the rules and config
locks (neither is held) and releases references that
pf_ioctl_addrule() has not taken yet. With INVARIANTS this panics on
any parse error; without, a rule address parsed as PF_ADDR_TABLE makes
pfr_detach_table() dereference NULL.
Use pf_krule_free(), as the ioctl paths do.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: e249f5daa41f ("pf: fix memory leak on rule add parse failure")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60104
libpfctl: zero the counters before summing per-chunk results
The chunked table address functions (set, add, del, clr_astats) add
each chunk's result to the caller's counter without initialising it.
pfctl reuses nadd for the number of tables created, so a replace that
also creates the table is off by one:
pfctl -t foo -T replace 192.0.2.1
reports "2 addresses added".
Zero the counters first, as pfctl_test_addrs() already does. Remove
the workaround for the add case from pfctl (da64f6e047b5), which is
no longer needed.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
[4 lines not shown]
pf: modify pfik_flags atomically
The purge thread sets PFI_IFLAG_REFS on the interfaces that states
refer to without the rules lock, under which the other flags are
changed. The updates can interleave, so that a "set skip on" is lost,
or outlives its removal, until the next ruleset load.
Use atomic operations to modify the flags. In the purge thread, only
write if the flag is not already set.
Reviewed by: kp
Approved by: kp (mentor)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60107
pfctl: print "pass" on nat/rdr/binat rules again
c2d03a920ec7 rewrote the action printing in print_rule() from OpenBSD,
which has no natpass, and dropped the "pass" keyword. A ruleset
loaded from "pfctl -sn" output therefore lost its nat-pass semantics.
Add a parser test covering nat, rdr, rdr log and binat with pass.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: c2d03a920ec7 ("pfctl: fix anchortypes bounds test")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60183
cxgbe: Add a sysctl/tunable to control KTLS offload of AES-CBC cipher suites
Disable these by default as they are less efficient and rarely used.
Sponsored by: Chelsio Communications
jh7110_gpio: fdt_pinctrl interface
This provides GPIO programming/configuration at attach time based on the
device tree 'pinmux' descriptions.
Reference:
device-tree/Bindings/pinctrl/starfive,jh7110-sys-pinctrl.yaml
Reviewed by: Brian Scott <bscott at bunyatech.com.au>
Tested by: Brian Scott <bscott at bunyatech.com.au>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59992
jh7110_gpio: handle preset high/low
Take action in the presence of the GPIO_PIN_PRESET_LOW/HIGH flags. This
part of the GPIO interface seems to be unused, but is trivially
implemented in our driver.
Reviewed by: Brian Scott <bscott at bunyatech.com.au>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59991
cxgbe: Don't cache nsegs for KTLS requests
KTLS mbufs are initially parsed when they are first enqueued to
estimate the number of transmit descriptors needed so that the mbuf is
queued until enough descriptors are available. As part of this
estimate, the number of DSGL segments required by each KTLS mbuf is
calculated. Originally, the count for the first TLS record in a chain
was cached in the header mbuf to avoid having to recalculate it when
writing out the actual work request for the first TLS record, but this
requires duplicating fairly complex logic both when parsing and
transmitting requests.
Sponsored by: Chelsio Communications
cxgbe: Greatly simplify ktls_wr_len for T7
Don't try to fine-tune the WR size when estimating the work request
length when parsing the packet. Use a much simpler worst-case
estimate that only depends on a few fields in the mbuf metadata.
Sponsored by: Chelsio Communications
cxgbe tls: Send final data as immediate when trailing waste is trimmed
When a request needs to drop data from the crypto output (via a split
mode request), send the last 16 bytes of input as immediate data
instead of via DSGL. Requests with small payloads (16 bytes or fewer)
are now sent as immediate data only without any DSGL at all.
Sponsored by: Chelsio Communications
cxgbe: Various assertions for lengths in KTLS work requests
The construction of KTLS work requests is quite fragile, and these
assertions ensure that the constructed work requests match the length
fields encoded in some of the WR structures.
Sponsored by: Chelsio Communications
vendor/openssl-3.0: remove test/recipes
This directory contains a large number of files which are not currently
used by OpenSSL in the base system. Remove the files to reduce space
needed when doing version updates.
crypto/openssl: update generated files to match 3.5.9 release content
A new manpage has been added and some source files have been refactored
slightly, but by and large this is just a standard "version bump" update
(3.5.8 -> 3.5.9).
MFC after: 1 day
MFC with: b3a31d78
hwpmc tests: the sampling log file
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 8f0789bee7abb2fdb2ff6d625f254533a138e6e8)
hwpmc: add credential-transition exec tests (keep and drop)
The companion to pmc_exec_test.c, which covers only the drop side of a
credential-changing exec. Three cases cover what the drop must not
overreach into: an exec that changes no credentials keeps the PMC, a
set-id exec whose credential change the kernel suppresses for a traced
target keeps it too, and a set-id fexecve(2) drops it. They exercise
the permission logic FreeBSD-SA-26:56.hwpmc reworked, not the defect
it fixed.
All three pass on a debug (INVARIANTS+WITNESS) kernel. The two
keep-cases were each observed to fail on a kernel mutated to detach
unconditionally.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 4.8)
(cherry picked from commit bea7b932b9eeaff39393347e0600b982fd859a92)
hwpmc tests: process-attachment lifecycle and ownership cases
Seven ATF cases covering process-attachment teardown orderings: a
target that exits before it is detached, the owner that exits before
its target (hwpmc's other unlink path), releasing a still-running
attached PMC, row exhaustion with out-of-order release, and
PMC_F_DESCENDANTS inheritance including a fork storm.
All pass on a debug (INVARIANTS+WITNESS) and a KASAN kernel.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit d00da14532bc4408f3e66535c88276d00905af7c)
hwpmc: add tests for handle validation and the privilege boundaries
A pmc_id_t is a packed integer that the driver hands to userland and
accepts back on eleven operations, and nothing tested what happens when
one comes back forged, stale, or belonging to another process. Neither
was there a test that an unprivileged caller is refused the operations
that need a privilege.
The cases use a SOFT-class PMC wherever the counter itself does not
matter, so they run on a machine with no PMU.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 17fca802ded118102d04a7a0bbc0c076de18c4d8)
hwpmc tests: sort the list of test programs
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
(cherry picked from commit df537ff1520d82410328ebd6de529929dae620a6)
hwpmc: add regression tests for a credential-changing exec
This tests what FreeBSD-SA-26:56.hwpmc fixed.
exec_setgid_drops_pmc asserts the kernel takes a process-mode PMC away
when its target execs a set-gid program its owner is not entitled to
trace.
exec_setuid_no_double_unlink lets the target exec a set-uid program;
the teardown must unlink the process descriptor exactly once, and
completing at all is the assertion.
Both need an unprivileged owner and must not drop privileges themselves,
since p_candebug() would then refuse the target to its own owner; they
ask for require.user instead.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
[3 lines not shown]
crypto/openssl: update to 3.5.9
This is a security fix release addressing CVE High issues. Users are
strongly encouraged to update to this version.
See the release notes for the release for more details on what is being
fixed.
MFC after: 1 day
Merge commit 'af5a659dc1cd2b0a6994f2cee1956d0bf50bb1a2'
hwpmc tests: the sampling log file
Nine ATF cases covering PMC_OP_CONFIGURELOG and the descriptor-less
log operations: which descriptors are accepted, when a log is required
in the first place, and what the log operations do without one.
MFC after: 1 month
MFC to: stable/15
MFC to: stable/14
Assisted-by: Claude Code (Opus 5)
(cherry picked from commit 8f0789bee7abb2fdb2ff6d625f254533a138e6e8)
