Apply by doing:

Apply by doing:
cd /usr/src
patch -p0 < 005_pf.patch

Then build and install a new kernel.

Index: sys/net/pf_ioctl.c
===================================================================
RCS file: /cvs/src/sys/net/pf_ioctl.c,v
retrieving revision 1.235
retrieving revision 1.235.2.1
diff -u -r1.235 -r1.235.2.1
--- sys/net/pf_ioctl.c 30 Jun 2010 18:10:55 -0000 1.235
+++ sys/net/pf_ioctl.c 16 Dec 2010 11:11:18 -0000 1.235.2.1
@@ -1,4 +1,4 @@
-/* $OpenBSD: pf_ioctl.c,v 1.235 2010/06/30 18:10:55 henning Exp $ */
+/* $OpenBSD: pf_ioctl.c,v 1.235.2.1 2010/12/16 11:11:18 stephan Exp $ */

/*
* Copyright (c) 2001 Daniel Hartmeier
@@ -111,6 +111,9 @@
int pf_kif_setup(char *, struct pfi_kif **);
void pf_addr_copyout(struct pf_addr_wrap *);
void pf_trans_set_commit(void);
+void pf_pool_copyin(struct pf_pool *, struct pf_pool *);
+int pf_rule_copyin(struct pf_rule *, struct pf_rule *,
+ struct pf_ruleset *);

struct pf_rule pf_default_rule, pf_default_rule_new;
struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk");
@@ -1011,21 +1014,17 @@
error = EBUSY;
break;
}
- rule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
+ rule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL|PR_ZERO);
if (rule == NULL) {
error = ENOMEM;
break;
}
- bcopy(&pr->rule, rule, sizeof(struct pf_rule));
+ if ((error = pf_rule_copyin(&pr->rule, rule, ruleset))) {
+ pool_put(&pf_rule_pl, rule);
+ break;
+ }
rule->cuid = p->p_cred->p_ruid;
rule->cpid = p->p_pid;
- rule->anchor = NULL;
- rule->kif = NULL;
- rule->rcv_kif = NULL;
- /* initialize refcounting */
- rule->states_cur = 0;
- rule->src_nodes = 0;
- rule->entries.tqe_prev = NULL;

switch (rule->af) {
case 0:
@@ -1054,48 +1053,6 @@
rule->dst.addr.type == PF_ADDR_NONE)
error = EINVAL;

- if (pf_kif_setup(rule->ifname, &rule->kif))
- error = EINVAL;
- if (pf_kif_setup(rule->rcv_ifname, &rule->rcv_kif))
- error = EINVAL;
- if (pf_kif_setup(rule->rdr.ifname, &rule->rdr.kif))
- error = EINVAL;
- if (pf_kif_setup(rule->nat.ifname, &rule->nat.kif))
- error = EINVAL;
- if (pf_kif_setup(rule->route.ifname, &rule->route.kif))
- error = EINVAL;
-
- if (rule->rtableid > 0 && !rtable_exists(rule->rtableid))
- error = EBUSY;
-
-#ifdef ALTQ
- /* set queue IDs */
- if (rule->qname[0] != 0) {
- if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
- error = EBUSY;
- else if (rule->pqname[0] != 0) {
- if ((rule->pqid =
- pf_qname2qid(rule->pqname)) == 0)
- error = EBUSY;
- } else
- rule->pqid = rule->qid;
- }
-#endif
- if (rule->tagname[0])
- if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
- error = EBUSY;
- if (rule->match_tagname[0])
- if ((rule->match_tag =
- pf_tagname2tag(rule->match_tagname)) == 0)
- error = EBUSY;
- if (rule->rt && !rule->direction)
- error = EINVAL;
-#if NPFLOG > 0
- if (!rule->log)
- rule->logif = 0;
- if (rule->logif >= PFLOGIFS_MAX)
- error = EINVAL;
-#endif
if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
error = EINVAL;
if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
@@ -1108,22 +1065,13 @@
error = EINVAL;
if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
error = EINVAL;
-
- if (rule->overload_tblname[0]) {
- if ((rule->overload_tbl = pfr_attach_table(ruleset,
- rule->overload_tblname, 0)) == NULL)
- error = EINVAL;
- else
- rule->overload_tbl->pfrkt_flags |=
- PFR_TFLAG_ACTIVE;
- }
+ if (rule->rt && !rule->direction)
+ error = EINVAL;

if (error) {
pf_rm_rule(NULL, rule);
break;
}
- rule->evaluations = rule->packets[0] = rule->packets[1] =
- rule->bytes[0] = rule->bytes[1] = 0;
TAILQ_INSERT_TAIL(ruleset->rules.inactive.ptr,
rule, entries);
ruleset->rules.inactive.rcount++;
@@ -1232,17 +1180,15 @@
}

if (pcr->action != PF_CHANGE_REMOVE) {
- newrule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
+ newrule = pool_get(&pf_rule_pl,
+ PR_WAITOK|PR_LIMITFAIL|PR_ZERO);
if (newrule == NULL) {
error = ENOMEM;
break;
}
- bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
+ pf_rule_copyin(&pcr->rule, newrule, ruleset);
newrule->cuid = p->p_cred->p_ruid;
newrule->cpid = p->p_pid;
- /* initialize refcounting */
- newrule->states_cur = 0;
- newrule->entries.tqe_prev = NULL;

switch (newrule->af) {
case 0:
@@ -1261,51 +1207,8 @@
goto fail;
}

- if (pf_kif_setup(newrule->ifname, &newrule->kif))
- error = EINVAL;
- if (pf_kif_setup(newrule->rcv_ifname, &newrule->rcv_kif))
- error = EINVAL;
- if (pf_kif_setup(newrule->rdr.ifname, &newrule->rdr.kif))
- error = EINVAL;
- if (pf_kif_setup(newrule->nat.ifname, &newrule->nat.kif))
- error = EINVAL;
- if (pf_kif_setup(newrule->route.ifname, &newrule->route.kif))
- error = EINVAL;
-
- if (newrule->rtableid > 0 &&
- !rtable_exists(newrule->rtableid))
- error = EBUSY;
-
-#ifdef ALTQ
- /* set queue IDs */
- if (newrule->qname[0] != 0) {
- if ((newrule->qid =
- pf_qname2qid(newrule->qname)) == 0)
- error = EBUSY;
- else if (newrule->pqname[0] != 0) {
- if ((newrule->pqid =
- pf_qname2qid(newrule->pqname)) == 0)
- error = EBUSY;
- } else
- newrule->pqid = newrule->qid;
- }
-#endif /* ALTQ */
- if (newrule->tagname[0])
- if ((newrule->tag =
- pf_tagname2tag(newrule->tagname)) == 0)
- error = EBUSY;
- if (newrule->match_tagname[0])
- if ((newrule->match_tag = pf_tagname2tag(
- newrule->match_tagname)) == 0)
- error = EBUSY;
if (newrule->rt && !newrule->direction)
error = EINVAL;
-#if NPFLOG > 0
- if (!newrule->log)
- newrule->logif = 0;
- if (newrule->logif >= PFLOGIFS_MAX)
- error = EINVAL;
-#endif
if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
error = EINVAL;
if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
@@ -1319,23 +1222,10 @@
if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
error = EINVAL;

- if (newrule->overload_tblname[0]) {
- if ((newrule->overload_tbl = pfr_attach_table(
- ruleset, newrule->overload_tblname, 0)) ==
- NULL)
- error = EINVAL;
- else
- newrule->overload_tbl->pfrkt_flags |=
- PFR_TFLAG_ACTIVE;
- }
-
if (error) {
pf_rm_rule(NULL, newrule);
break;
}
- newrule->evaluations = 0;
- newrule->packets[0] = newrule->packets[1] = 0;
- newrule->bytes[0] = newrule->bytes[1] = 0;
}

if (pcr->action == PF_CHANGE_ADD_HEAD)
@@ -1753,6 +1643,7 @@
break;
}
bcopy(&pa->altq, altq, sizeof(struct pf_altq));
+ altq->altq_disc = NULL;

/*
* if this is for a queue, find the discipline and
@@ -1764,7 +1655,6 @@
pool_put(&pf_altq_pl, altq);
break;
}
- altq->altq_disc = NULL;
TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
if (strncmp(a->ifname, altq->ifname,
IFNAMSIZ) == 0 && a->qname[0] == 0) {
@@ -2569,4 +2459,136 @@
pf_status.hostid = pf_trans_set.hostid;
if (pf_trans_set.mask & PF_TSET_REASS)
pf_status.reass = pf_trans_set.reass;
+}
+
+void
+pf_pool_copyin(struct pf_pool *from, struct pf_pool *to)
+{
+ bcopy(from, to, sizeof(*to));
+ to->kif = NULL;
+}
+
+int
+pf_rule_copyin(struct pf_rule *from, struct pf_rule *to,
+ struct pf_ruleset *ruleset)
+{
+ int i;
+
+ to->src = from->src;
+ to->dst = from->dst;
+
+ /* XXX union skip[] */
+
+ strlcpy(to->label, from->label, sizeof(to->label));
+ strlcpy(to->ifname, from->ifname, sizeof(to->ifname));
+ strlcpy(to->rcv_ifname, from->rcv_ifname, sizeof(to->rcv_ifname));
+ strlcpy(to->qname, from->qname, sizeof(to->qname));
+ strlcpy(to->pqname, from->pqname, sizeof(to->pqname));
+ strlcpy(to->tagname, from->tagname, sizeof(to->tagname));
+ strlcpy(to->match_tagname, from->match_tagname,
+ sizeof(to->match_tagname));
+ strlcpy(to->overload_tblname, from->overload_tblname,
+ sizeof(to->overload_tblname));
+
+ pf_pool_copyin(&from->nat, &to->nat);
+ pf_pool_copyin(&from->rdr, &to->rdr);
+ pf_pool_copyin(&from->route, &to->route);
+
+ if (pf_kif_setup(to->ifname, &to->kif))
+ return (EINVAL);
+ if (pf_kif_setup(to->rcv_ifname, &to->rcv_kif))
+ return (EINVAL);
+ if (to->overload_tblname[0]) {
+ if ((to->overload_tbl = pfr_attach_table(ruleset,
+ to->overload_tblname, 0)) == NULL)
+ return (EINVAL);
+ else
+ to->overload_tbl->pfrkt_flags |= PFR_TFLAG_ACTIVE;
+ }
+
+ if (pf_kif_setup(to->rdr.ifname, &to->rdr.kif))
+ return (EINVAL);
+ if (pf_kif_setup(to->nat.ifname, &to->nat.kif))
+ return (EINVAL);
+ if (pf_kif_setup(to->route.ifname, &to->route.kif))
+ return (EINVAL);
+
+ to->os_fingerprint = from->os_fingerprint;
+
+ to->rtableid = from->rtableid;
+ if (to->rtableid > 0 && !rtable_exists(to->rtableid))
+ return (EBUSY);
+
+ for (i = 0; i < PFTM_MAX; i++)
+ to->timeout[i] = from->timeout[i];
+ to->states_tot = from->states_tot;
+ to->max_states = from->max_states;
+ to->max_src_nodes = from->max_src_nodes;
+ to->max_src_states = from->max_src_states;
+ to->max_src_conn = from->max_src_conn;
+ to->max_src_conn_rate.limit = from->max_src_conn_rate.limit;
+ to->max_src_conn_rate.seconds = from->max_src_conn_rate.seconds;
+
+#ifdef ALTQ
+ /* set queue IDs */
+ if (to->qname[0] != 0) {
+ if ((to->qid = pf_qname2qid(to->qname)) == 0)
+ return (EBUSY);
+ else if (to->pqname[0] != 0) {
+ if ((to->pqid = pf_qname2qid(to->pqname)) == 0)
+ return (EBUSY);
+ } else
+ to->pqid = to->qid;
+ }
+#endif
+ to->rt_listid = from->rt_listid;
+ to->prob = from->prob;
+ to->return_icmp = from->return_icmp;
+ to->return_icmp6 = from->return_icmp6;
+ to->max_mss = from->max_mss;
+ if (to->tagname[0])
+ if ((to->tag = pf_tagname2tag(to->tagname)) == 0)
+ return (EBUSY);
+ if (to->match_tagname[0])
+ if ((to->match_tag = pf_tagname2tag(to->match_tagname)) == 0)
+ return (EBUSY);
+ to->scrub_flags = from->scrub_flags;
+ to->uid = from->uid;
+ to->gid = from->gid;
+ to->rule_flag = from->rule_flag;
+ to->action = from->action;
+ to->direction = from->direction;
+ to->log = from->log;
+ to->logif = from->logif;
+#if NPFLOG > 0
+ if (!to->log)
+ to->logif = 0;
+ if (to->logif >= PFLOGIFS_MAX)
+ return (EINVAL);
+#endif
+ to->quick = from->quick;
+ to->ifnot = from->ifnot;
+ to->match_tag_not = from->match_tag_not;
+ to->keep_state = from->keep_state;
+ to->af = from->af;
+ to->proto = from->proto;
+ to->type = from->type;
+ to->code = from->code;
+ to->flags = from->flags;
+ to->flagset = from->flagset;
+ to->min_ttl = from->min_ttl;
+ to->allow_opts = from->allow_opts;
+ to->rt = from->rt;
+ to->return_ttl = from->return_ttl;
+ to->tos = from->tos;
+ to->set_tos = from->set_tos;
+ to->anchor_relative = from->anchor_relative; /* XXX */
+ to->anchor_wildcard = from->anchor_wildcard; /* XXX */
+ to->flush = from->flush;
+ to->divert.addr = from->divert.addr;
+ to->divert.port = from->divert.port;
+ to->divert_packet.addr = from->divert_packet.addr;
+ to->divert_packet.port = from->divert_packet.port;
+
+ return (0);
}