hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-21 18:50:50 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

pf: clean up pflow sockets on jail removal

Browse Source 
pflow opens sockets in the kernel to transmit netflow information.
If this is done in a (vnet) jail these sockets end up preventing the removal of
the jail. The VNET_SYSUNINIT() vnet_pflowdetach() function doesn't get called,
but that's the function that would remove the sockets.

Install a callback on the PR_METHOD_REMOVE jail callback and close the sockets
there. This ensures that the jail can get cleaned up.

Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D47545
This commit is contained in:
Kristof Provost 2024-11-18 11:06:41 +01:00
parent 43778a593f
commit 83641335f9
1 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
sys/netpfil/pf/pflow.c
View File

@ -26,6 +26,7 @@
#include <sys/callout.h>
#include <sys/endian.h>
#include <sys/interrupt.h>
#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/module.h>
@ -184,15 +185,28 @@ vnet_pflowattach(void)
VNET_SYSINIT(vnet_pflowattach, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY,
vnet_pflowattach, NULL);
static void
vnet_pflowdetach(void)
static int
pflow_jail_remove(void *obj, void *data __unused)
{
#ifdef VIMAGE
const struct prison *pr = obj;
#endif
struct pflow_softc *sc;
CURVNET_SET(pr->pr_vnet);
CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) {
pflow_destroy(sc->sc_id, false);
}
CURVNET_RESTORE();
return (0);
}
static void
vnet_pflowdetach(void)
{
/* Should have been done by pflow_jail_remove() */
MPASS(CK_LIST_EMPTY(&V_pflowif_list));
delete_unrhdr(V_pflow_unr);
mtx_destroy(&V_pflowif_list_mtx);
@ -1776,6 +1790,8 @@ static const struct nlhdr_parser *all_parsers[] = {
&set_parser,
};
static unsigned pflow_do_osd_jail_slot;
static int
pflow_init(void)
{
@ -1784,6 +1800,11 @@ pflow_init(void)
NL_VERIFY_PARSERS(all_parsers);
static osd_method_t methods[PR_MAXMETHOD] = {
[PR_METHOD_REMOVE] = pflow_jail_remove,
};
pflow_do_osd_jail_slot = osd_jail_register(NULL, methods);
family_id = genl_register_family(PFLOWNL_FAMILY_NAME, 0, 2, PFLOWNL_CMD_MAX);
MPASS(family_id != 0);
ret = genl_register_cmds(PFLOWNL_FAMILY_NAME, pflow_cmds, NL_ARRAY_LEN(pflow_cmds));
@ -1794,6 +1815,7 @@ pflow_init(void)
static void
pflow_uninit(void)
{
osd_jail_deregister(pflow_do_osd_jail_slot);
genl_unregister_family(PFLOWNL_FAMILY_NAME);
}