Attachment 259552 Details for Bug 286072 – proposed patch

[patch] proposed patch

diff (text/plain), 1.26 KB, created by Mark Johnston on 2025-04-14 17:15:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Johnston

Created: 2025-04-14 17:15:05 UTC

Size: 1.26 KB

patch

obsolete

>commit afa5156faf83481a08a9c74134c55817c3b2a948
>Author: Marius Halden <mhalden@entersekt.com>
>Date:   Tue Feb 11 11:19:30 2025 -0500
>
>    freebsd-relayd: Avoid flushing pf tables unnecessarily after a config reload
>    
>    When handling a config reload, the pfe receives all of the new config
>    structures (redirects, tables, etc.), and then flushes all of the
>    corresponding pf tables prior to syncing them with pf.  This behaviour
>    results in a small window where the redirect rule will fail to handle
>    new connection requests.
>    
>    Only flush tables if they have been explicitly disabled.
>
>diff --git a/usr.sbin/relayd/pfe_filter.c b/usr.sbin/relayd/pfe_filter.c
>index c1851260c62..7fe0c30cf4c 100644
>--- a/usr.sbin/relayd/pfe_filter.c
>+++ b/usr.sbin/relayd/pfe_filter.c
>@@ -91,10 +91,14 @@ init_tables(struct relayd *env)
> 		return;
> 
> 	/*
>-	 * clear all tables, since some already existed
>+	 * Clear disabled tables and tables belonging to disabled redirects.
>+	 * Don't touch enabled tables since that could disrupt traffic.
> 	 */
>-	TAILQ_FOREACH(rdr, env->sc_rdrs, entry)
>-		flush_table(env, rdr);
>+	TAILQ_FOREACH(rdr, env->sc_rdrs, entry) {
>+		if (rdr->conf.flags & F_DISABLE ||
>+		    rdr->table->conf.flags & F_DISABLE)
>+			flush_table(env, rdr);
>+	}
> 
> 	return;
>

Actions: View | Diff

Attachments on bug 286072: 259520 | 259552 | 259553 | 259580