git: bc9e66886a25 - main - ipfw: gc disabled old hashing code

The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=bc9e66886a2537d4536e24353669ef1a21105b70

commit bc9e66886a2537d4536e24353669ef1a21105b70
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2026-10-19 17:32:15 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2026-10-19 17:32:15 +0000

    ipfw: gc disabled old hashing code
    
    This code was disabled for 8 years already.  It used to produce very
    predictable hash without a salt, and that made the dynamic state engine an
    easy DoS attack vector.  No chance we will ever use it again.
---
 sys/netpfil/ipfw/ip_fw_dynamic.c | 34 ----------------------------------
 1 file changed, 34 deletions(-)

diff --git a/sys/netpfil/ipfw/ip_fw_dynamic.c b/sys/netpfil/ipfw/ip_fw_dynamic.c
index d2bf4f4fc899..18ba2b3caf27 100644
--- a/sys/netpfil/ipfw/ip_fw_dynamic.c
+++ b/sys/netpfil/ipfw/ip_fw_dynamic.c
@@ -111,9 +111,6 @@
  * passes through the firewall. XXX check the latter!!!
  */
 
-/* By default use jenkins hash function */
-#define	IPFIREWALL_JENKINSHASH
-
 #define	DYN_COUNTER_INC(d, dir, pktlen)	do {	\
 	(d)->pcnt_ ## dir++;			\
 	(d)->bcnt_ ## dir += pktlen;		\
@@ -778,34 +775,6 @@ static struct opcode_obj_rewrite dyn_opcodes[] = {
  * in source and destination (ip,port), because rules are bidirectional
  * and we want to find both in the same bucket.
  */
-#ifndef IPFIREWALL_JENKINSHASH
-static __inline uint32_t
-hash_packet(const struct ipfw_flow_id *id)
-{
-	uint32_t i;
-
-#ifdef INET6
-	if (IS_IP6_FLOW_ID(id))
-		i = ntohl((id->dst_ip6.__u6_addr.__u6_addr32[2]) ^
-		    (id->dst_ip6.__u6_addr.__u6_addr32[3]) ^
-		    (id->src_ip6.__u6_addr.__u6_addr32[2]) ^
-		    (id->src_ip6.__u6_addr.__u6_addr32[3]));
-	else
-#endif /* INET6 */
-	i = (id->dst_ip) ^ (id->src_ip);
-	i ^= (id->dst_port) ^ (id->src_port);
-	return (i);
-}
-
-static __inline uint32_t
-hash_parent(const struct ipfw_flow_id *id, const void *rule)
-{
-
-	return (hash_packet(id) ^ ((uintptr_t)rule));
-}
-
-#else /* IPFIREWALL_JENKINSHASH */
-
 VNET_DEFINE_STATIC(uint32_t, dyn_hashseed);
 #define	V_dyn_hashseed		VNET(dyn_hashseed)
 
@@ -900,7 +869,6 @@ hash_parent(const struct ipfw_flow_id *id, const void *rule)
 	return (jenkins_hash32((const uint32_t *)&rule,
 	    sizeof(rule) / sizeof(uint32_t), hash_packet(id)));
 }
-#endif /* IPFIREWALL_JENKINSHASH */
 
 /*
  * Print customizable flow id description via log(9) facility.
@@ -3179,9 +3147,7 @@ void
 ipfw_dyn_init(struct ip_fw_chain *chain)
 {
 
-#ifdef IPFIREWALL_JENKINSHASH
 	V_dyn_hashseed = arc4random();
-#endif
 	V_dyn_max = 16384;		/* max # of states */
 	V_dyn_parent_max = 4096;	/* max # of parent states */
 	V_dyn_buckets_max = 8192;	/* must be power of 2 */