DF-3456 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 | --- a/sys/net/pf/pf.c +++ b/sys/net/pf/pf.c @@ -140,12 +140,14 @@ int pf_tcp_secret_init; int pf_tcp_iss_off; +#define PF_ANCHOR_STACKSIZE 64 + struct pf_anchor_stackframe { struct pf_ruleset *rs; struct pf_rule *r; struct pf_anchor_node *parent; struct pf_anchor *child; -} pf_anchor_stack[64]; +}; struct malloc_type *pf_src_tree_pl, *pf_rule_pl, *pf_pooladdr_pl; struct malloc_type *pf_state_pl, *pf_state_key_pl, *pf_state_item_pl; @@ -230,9 +232,11 @@ void *, struct pf_pdesc *, u_short *); int pf_test_state_other(struct pf_state **, int, struct pfi_kif *, struct mbuf *, struct pf_pdesc *); -void pf_step_into_anchor(int *, struct pf_ruleset **, int, +void pf_step_into_anchor(struct pf_anchor_stackframe *, + int *, struct pf_ruleset **, int, struct pf_rule **, struct pf_rule **, int *); -int pf_step_out_of_anchor(int *, struct pf_ruleset **, +int pf_step_out_of_anchor(struct pf_anchor_stackframe *, + int *, struct pf_ruleset **, int, struct pf_rule **, struct pf_rule **, int *); void pf_hash(struct pf_addr *, struct pf_addr *, @@ -2498,21 +2502,22 @@ } void -pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, - struct pf_rule **r, struct pf_rule **a, int *match) +pf_step_into_anchor(struct pf_anchor_stackframe *stack, int *depth, + struct pf_ruleset **rs, int n, struct pf_rule **r, struct pf_rule **a, + int *match) { struct pf_anchor_stackframe *f; (*r)->anchor->match = 0; if (match) *match = 0; - if (*depth >= NELEM(pf_anchor_stack)) { + if (*depth >= PF_ANCHOR_STACKSIZE) { kprintf("pf_step_into_anchor: stack overflow\n"); *r = TAILQ_NEXT(*r, entries); return; } else if (*depth == 0 && a != NULL) *a = *r; - f = pf_anchor_stack + (*depth)++; + f = stack + (*depth)++; f->rs = *rs; f->r = *r; if ((*r)->anchor_wildcard) { @@ -2532,8 +2537,9 @@ } int -pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, - struct pf_rule **r, struct pf_rule **a, int *match) +pf_step_out_of_anchor(struct pf_anchor_stackframe *stack, int *depth, + struct pf_ruleset **rs, int n, struct pf_rule **r, struct pf_rule **a, + int *match) { struct pf_anchor_stackframe *f; int quick = 0; @@ -2541,7 +2547,7 @@ do { if (*depth <= 0) break; - f = pf_anchor_stack + *depth - 1; + f = stack + *depth - 1; if (f->parent != NULL && f->child != NULL) { if (f->child->match || (match != NULL && *match)) { @@ -3076,6 +3082,7 @@ { struct pf_rule *r, *rm = NULL; struct pf_ruleset *ruleset = NULL; + struct pf_anchor_stackframe astack[PF_ANCHOR_STACKSIZE]; int tag = -1; int rtableid = -1; int asd = 0; @@ -3138,12 +3145,12 @@ if (r->anchor == NULL) { rm = r; } else - pf_step_into_anchor(&asd, &ruleset, rs_num, - &r, NULL, NULL); + pf_step_into_anchor(astack, &asd, &ruleset, + rs_num, &r, NULL, NULL); } if (r == NULL) - pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r, - NULL, NULL); + pf_step_out_of_anchor(astack, &asd, &ruleset, rs_num, + &r, NULL, NULL); } if (pf_tag_packet(m, tag, rtableid)) return (NULL); @@ -3697,6 +3704,7 @@ sa_family_t af = pd->af; struct pf_rule *r, *a = NULL; struct pf_ruleset *ruleset = NULL; + struct pf_anchor_stackframe astack[PF_ANCHOR_STACKSIZE]; struct pf_src_node *nsn = NULL; struct tcphdr *th = pd->hdr.tcp; struct pf_state_key *skw = NULL, *sks = NULL; @@ -3979,11 +3987,11 @@ break; r = TAILQ_NEXT(r, entries); } else - pf_step_into_anchor(&asd, &ruleset, + pf_step_into_anchor(astack, &asd, &ruleset, PF_RULESET_FILTER, &r, &a, &match); } - if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, - PF_RULESET_FILTER, &r, &a, &match)) + if (r == NULL && pf_step_out_of_anchor(astack, &asd, + &ruleset, PF_RULESET_FILTER, &r, &a, &match)) break; } r = *rm; @@ -4335,6 +4343,7 @@ { struct pf_rule *r, *a = NULL; struct pf_ruleset *ruleset = NULL; + struct pf_anchor_stackframe astack[PF_ANCHOR_STACKSIZE]; sa_family_t af = pd->af; u_short reason; int tag = -1; @@ -4386,11 +4395,11 @@ break; r = TAILQ_NEXT(r, entries); } else - pf_step_into_anchor(&asd, &ruleset, + pf_step_into_anchor(astack, &asd, &ruleset, PF_RULESET_FILTER, &r, &a, &match); } - if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, - PF_RULESET_FILTER, &r, &a, &match)) + if (r == NULL && pf_step_out_of_anchor(astack, &asd, + &ruleset, PF_RULESET_FILTER, &r, &a, &match)) break; } r = *rm; |