summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sbin/pfctl/parse.y15
-rw-r--r--sbin/pfctl/pfctl.c7
-rw-r--r--sbin/pfctl/pfctl_parser.c4
-rw-r--r--sys/net/if_pflog.h4
-rw-r--r--sys/net/pfvar.h6
-rw-r--r--sys/netpfil/pf/if_pflog.c6
-rw-r--r--sys/netpfil/pf/pf.c8
-rw-r--r--sys/netpfil/pf/pf_ioctl.c26
8 files changed, 3 insertions, 73 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index b5577e2..1ee564f 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -234,7 +234,6 @@ struct filter_opts {
u_int32_t tos;
u_int32_t dscp;
u_int32_t prob;
- u_int32_t tracker;
struct {
int action;
struct node_state_opt *options;
@@ -264,7 +263,6 @@ struct filter_opts {
struct antispoof_opts {
char *label;
- u_int32_t tracker;
u_int rtableid;
} antispoof_opts;
@@ -463,7 +461,7 @@ int parseport(char *, struct range *r, int);
%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL SCHEDULE
-%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DSCP DROP TABLE TRACKER
+%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DSCP DROP TABLE
%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
@@ -1246,7 +1244,6 @@ antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
if (rule_label(&r, $5.label))
YYERROR;
r.rtableid = $5.rtableid;
- r.cuid = $5.tracker;
j = calloc(1, sizeof(struct node_if));
if (j == NULL)
err(1, "antispoof: calloc");
@@ -1296,7 +1293,6 @@ antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
r.logif = $2.logif;
r.quick = $2.quick;
r.af = $4;
- r.cuid = $5.tracker;
if (rule_label(&r, $5.label))
YYERROR;
r.rtableid = $5.rtableid;
@@ -1358,9 +1354,6 @@ antispoof_opt : label {
}
antispoof_opts.label = $1;
}
- | TRACKER number {
- antispoof_opts.tracker = $2;
- }
| RTABLE NUMBER {
if ($2 < 0 || $2 > rt_tableid_max()) {
yyerror("invalid rtable id");
@@ -2070,8 +2063,6 @@ pfrule : action dir logquick interface route af proto fromto
if (rule_schedule(&r, $9.schedule))
YYERROR;
free($9.schedule);
- if ($9.tracker)
- r.cuid = $9.tracker;
r.flags = $9.flags.b1;
r.flagset = $9.flags.b2;
if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
@@ -2522,9 +2513,6 @@ filter_opt : USER uids {
filter_opts.keep.action = $1.action;
filter_opts.keep.options = $1.options;
}
- | TRACKER number {
- filter_opts.tracker = $2;
- }
| FRAGMENT {
filter_opts.fragment = 1;
}
@@ -5761,7 +5749,6 @@ lookup(char *s)
{ "timeout", TIMEOUT},
{ "to", TO},
{ "tos", TOS},
- { "tracker", TRACKER},
{ "ttl", TTL},
{ "upperlimit", UPPERLIMIT},
{ "urpf-failed", URPFFAILED},
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index d606b62b..3a93fa2 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -825,17 +825,10 @@ pfctl_print_rule_counters(struct pf_rule *rule, int opts)
(unsigned long long)(rule->bytes[0] +
rule->bytes[1]), (uintmax_t)rule->u_states_cur);
if (!(opts & PF_OPT_DEBUG))
-#ifdef PF_USER_INFO
printf(" [ Inserted: uid %u pid %u "
"State Creations: %-6ju]\n",
(unsigned)rule->cuid, (unsigned)rule->cpid,
(uintmax_t)rule->u_states_tot);
-#else
- printf(" [ Inserted: pid %u "
- "State Creations: %-6ju]\n",
- (unsigned)rule->cpid,
- (uintmax_t)rule->states_tot);
-#endif
}
}
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 5b03a93..b4fe20a 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -736,11 +736,7 @@ print_rule(struct pf_rule *r, const char *anchor_call, int verbose, int numeric)
int i, opts;
if (verbose)
-#ifdef PF_USER_INFO
printf("@%d ", r->nr);
-#else
- printf("@%d(%u) ", r->nr, r->cuid);
-#endif
if (r->action == PF_MATCH)
printf("match");
else if (r->action > PF_NORDR)
diff --git a/sys/net/if_pflog.h b/sys/net/if_pflog.h
index 326b551..0faeb7d 100644
--- a/sys/net/if_pflog.h
+++ b/sys/net/if_pflog.h
@@ -40,14 +40,10 @@ struct pfloghdr {
char ruleset[PFLOG_RULESET_NAME_SIZE];
u_int32_t rulenr;
u_int32_t subrulenr;
-#ifdef PF_USER_INFO
uid_t uid;
pid_t pid;
uid_t rule_uid;
pid_t rule_pid;
-#else
- u_int32_t ridentifier;
-#endif
u_int8_t dir;
u_int8_t pad[3];
};
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index e46bb69..2936771 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -547,11 +547,7 @@ struct pf_rule {
u_int32_t rt_listid;
u_int32_t nr;
u_int32_t prob;
-#ifdef PF_USER_INFO
uid_t cuid;
-#else
- u_int32_t cuid;
-#endif
pid_t cpid;
counter_u64_t states_cur;
@@ -1148,13 +1144,11 @@ struct pfi_kif {
#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */
struct pf_pdesc {
-#ifdef PF_USER_INFO
struct {
int done;
uid_t uid;
gid_t gid;
} lookup;
-#endif
u_int64_t tot_len; /* Make Mickey money */
union {
struct tcphdr *tcp;
diff --git a/sys/netpfil/pf/if_pflog.c b/sys/netpfil/pf/if_pflog.c
index 5c22806..1efd5e2 100644
--- a/sys/netpfil/pf/if_pflog.c
+++ b/sys/netpfil/pf/if_pflog.c
@@ -209,7 +209,7 @@ pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
return (0);
bzero(&hdr, sizeof(hdr));
- hdr.length = PFLOG_HDRLEN;
+ hdr.length = PFLOG_REAL_HDRLEN;
hdr.af = af;
hdr.action = rm->action;
hdr.reason = reason;
@@ -218,16 +218,13 @@ pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
if (am == NULL) {
hdr.rulenr = htonl(rm->nr);
hdr.subrulenr = 1;
- hdr.ridentifier = rm->cuid;
} else {
hdr.rulenr = htonl(am->nr);
hdr.subrulenr = htonl(rm->nr);
- hdr.ridentifier = rm->cuid;
if (ruleset != NULL && ruleset->anchor != NULL)
strlcpy(hdr.ruleset, ruleset->anchor->name,
sizeof(hdr.ruleset));
}
-#ifdef PF_USER_INFO
/*
* XXXGL: we avoid pf_socket_lookup() when we are holding
* state lock, since this leads to unsafe LOR.
@@ -242,7 +239,6 @@ pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
hdr.pid = NO_PID;
hdr.rule_uid = rm->cuid;
hdr.rule_pid = rm->cpid;
-#endif
hdr.dir = dir;
#ifdef INET
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index eed1ac8..89a2716 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2851,7 +2851,6 @@ pf_match_ieee8021q_pcp(u_int8_t op, u_int8_t pcp1, u_int8_t pcp2,
return (pf_match(op, pcp1, pcp2, mpcp));
}
-#ifdef PF_USER_INFO
static int
pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
{
@@ -2867,7 +2866,6 @@ pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
return (0);
return (pf_match(op, a1, a2, g));
}
-#endif
int
pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag, int mtag)
@@ -3076,7 +3074,6 @@ pf_rule_to_actions(struct pf_rule *r, struct pf_rule_actions *a)
a->flags |= PFRULE_DN_IS_PIPE;
}
-#ifdef PF_USER_INFO
int
pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m)
{
@@ -3156,7 +3153,6 @@ pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m)
return (1);
}
-#endif
static u_int8_t
pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
@@ -3348,14 +3344,12 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
PF_RULES_RASSERT();
-#ifdef PF_USER_INFO
if (inp != NULL) {
INP_LOCK_ASSERT(inp);
pd->lookup.uid = inp->inp_cred->cr_uid;
pd->lookup.gid = inp->inp_cred->cr_groups[0];
pd->lookup.done = 1;
}
-#endif
switch (pd->proto) {
case IPPROTO_TCP:
@@ -3578,7 +3572,6 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
(r->flagset & th->th_flags) != r->flags)
r = TAILQ_NEXT(r, entries);
/* tcp/udp only. uid.op always 0 in other cases */
-#ifdef PF_USER_INFO
else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
pf_socket_lookup(direction, pd, m), 1)) &&
!pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
@@ -3590,7 +3583,6 @@ pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
!pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
pd->lookup.gid))
r = TAILQ_NEXT(r, entries);
-#endif
else if (r->ieee8021q_pcp.op &&
!pf_match_ieee8021q_pcp(r->ieee8021q_pcp.op,
r->ieee8021q_pcp.pcp[0], r->ieee8021q_pcp.pcp[1], m))
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index 146a56f..cacae58 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -1168,9 +1168,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
rule->states_cur = counter_u64_alloc(M_WAITOK);
rule->states_tot = counter_u64_alloc(M_WAITOK);
rule->src_nodes = counter_u64_alloc(M_WAITOK);
-#ifdef PF_USER_INFO
rule->cuid = td->td_ucred->cr_ruid;
-#endif
rule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
TAILQ_INIT(&rule->rpool.list);
@@ -1196,6 +1194,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
V_ticket_pabuf));
ERROUT(EBUSY);
}
+
tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
pf_rulequeue);
if (tail)
@@ -1274,29 +1273,8 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
}
rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
-#ifndef PF_USER_INFO
- if (rule->cuid) {
- tail = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
- while ((tail != NULL) && (tail->cuid != rule->cuid))
- tail = TAILQ_NEXT(tail, entries);
- if (tail != NULL) {
- rule->evaluations = tail->evaluations;
- rule->packets[0] = tail->packets[0];
- rule->packets[1] = tail->packets[1];
- rule->bytes[0] = tail->bytes[0];
- rule->bytes[1] = tail->bytes[1];
- } else {
- rule->evaluations = rule->packets[0] = rule->packets[1] =
- rule->bytes[0] = rule->bytes[1] = 0;
- }
- } else {
- rule->evaluations = rule->packets[0] = rule->packets[1] =
- rule->bytes[0] = rule->bytes[1] = 0;
- }
-#else
rule->evaluations = rule->packets[0] = rule->packets[1] =
rule->bytes[0] = rule->bytes[1] = 0;
-#endif
TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
rule, entries);
ruleset->rules[rs_num].inactive.rcount++;
@@ -1446,9 +1424,7 @@ DIOCADDRULE_error:
newrule->states_cur = counter_u64_alloc(M_WAITOK);
newrule->states_tot = counter_u64_alloc(M_WAITOK);
newrule->src_nodes = counter_u64_alloc(M_WAITOK);
-#ifdef PF_USER_INFO
newrule->cuid = td->td_ucred->cr_ruid;
-#endif
newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
TAILQ_INIT(&newrule->rpool.list);
}
OpenPOWER on IntegriCloud