From nobody Mon Oct 19 17:32:34 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j7jKv3Rthz6vjJs for ; Mon, 19 Oct 2026 17:32:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j7jKt6yMGz4fGL for ; Mon, 19 Oct 2026 17:32:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792431155; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U9NZ1EprTKsgmNnNlq0JvjbsrK0vBYDoFpIlFkZSLG8=; b=pRCX40AWrg2cqEQ2YKiSLCdSd0oAmLo3I5CKjy4+qxr1m+WSy5dKt4ehyqO/41GC5PPsuC DpRoooNh995WQYzGe0RsMy+oWcX8watuacB5HDvISE/podt349xntRtYGkfGOSv92xCwzX 4A/huB37kSTe6v6vCUUQGHg/IvVH7HhqdgsqvMK3RfmNTxrCQrcZ2qydYIE0f4NRe/FhcM JiUakzur9exBvLfPcpgRPYNCjnrCy60PLmc9wjLj4eABDaDmuKiSwCWewHX9iBG/2YaLYE nYYQnyZ6rsar5eKLjT/9pd/zahuvo4X8iiZf/ebcD9/rc9dHMm2xSH9VtIFIPw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792431155; b=WIgKABj7M/t11o5zaHHrVMRTLkvBiwLp0isuFB8Rg+kfEm66IPJr4F6Dfufj+iPTaXQM3e W6w0BjpIpJIF8WJnuGMLtWg57WdSK4mvdjqAAPCKR+sbJdjUlhbLhkFS3eUBljwhI6H8n9 TPZ1/CW8h7O7vfEn9w9mJn3IQMs2owvqg6WTXyqT4c37vHfhZ2uJlqCYOrOBUQUUHYPQDn dQOLL3Es713XObORHpQvbTyRCSurgDOG1poDT2kQN+bmwVBezJ69ggNE8y1mvfZtqFYbhm bpG9UKQHC7kz1OtDTxknIGxsTZHoDGNALQBLKnDWEvll2ZUvcBBDK63yj8X3zw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792431155; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=U9NZ1EprTKsgmNnNlq0JvjbsrK0vBYDoFpIlFkZSLG8=; b=x+oPQ8jN7JWvicwbcoao3T0O4XIs+j1Zum9J5g+mqowi5AumKOIu7hXiyw++jh7mIJLrFQ APNYAL4Pnqd1aDNgG9P+fLCIDaOQoDJLBoQbTyyoQAJP0VgBc6+irhWOO/z4g3BiO1JLef AF5qDkJa3y95bYXOj2uzl8F4utRlIuw7snqqwz99YcUnGf/5jUQ0Z9fkGpmsnXG5rpFcKI kpKJkigvyDgZakP7ihAmOP1XNW4zLsSC6n/jPyiO3Z45YHJOFGjLM5XtjYMYX9AZMWgHb/ zJq7ef7ovTO6+1D/cZHHBgAixCDT6jqUwEfUnvwpIx0lWgvENUmw1p6vnf8yUQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j7jKt5t0VzVf3 for ; Mon, 19 Oct 2026 17:32:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2400c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 19 Oct 2026 17:32:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: bc9e66886a25 - main - ipfw: gc disabled old hashing code List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bc9e66886a2537d4536e24353669ef1a21105b70 Auto-Submitted: auto-generated Date: Mon, 19 Oct 2026 17:32:34 +0000 Message-Id: <6ad65432.2400c.7322d979@gitrepo.freebsd.org> The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=bc9e66886a2537d4536e24353669ef1a21105b70 commit bc9e66886a2537d4536e24353669ef1a21105b70 Author: Gleb Smirnoff AuthorDate: 2026-10-19 17:32:15 +0000 Commit: Gleb Smirnoff CommitDate: 2026-10-19 17:32:15 +0000 ipfw: gc disabled old hashing code This code was disabled for 8 years already. It used to produce very predictable hash without a salt, and that made the dynamic state engine an easy DoS attack vector. No chance we will ever use it again. --- sys/netpfil/ipfw/ip_fw_dynamic.c | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/sys/netpfil/ipfw/ip_fw_dynamic.c b/sys/netpfil/ipfw/ip_fw_dynamic.c index d2bf4f4fc899..18ba2b3caf27 100644 --- a/sys/netpfil/ipfw/ip_fw_dynamic.c +++ b/sys/netpfil/ipfw/ip_fw_dynamic.c @@ -111,9 +111,6 @@ * passes through the firewall. XXX check the latter!!! */ -/* By default use jenkins hash function */ -#define IPFIREWALL_JENKINSHASH - #define DYN_COUNTER_INC(d, dir, pktlen) do { \ (d)->pcnt_ ## dir++; \ (d)->bcnt_ ## dir += pktlen; \ @@ -778,34 +775,6 @@ static struct opcode_obj_rewrite dyn_opcodes[] = { * in source and destination (ip,port), because rules are bidirectional * and we want to find both in the same bucket. */ -#ifndef IPFIREWALL_JENKINSHASH -static __inline uint32_t -hash_packet(const struct ipfw_flow_id *id) -{ - uint32_t i; - -#ifdef INET6 - if (IS_IP6_FLOW_ID(id)) - i = ntohl((id->dst_ip6.__u6_addr.__u6_addr32[2]) ^ - (id->dst_ip6.__u6_addr.__u6_addr32[3]) ^ - (id->src_ip6.__u6_addr.__u6_addr32[2]) ^ - (id->src_ip6.__u6_addr.__u6_addr32[3])); - else -#endif /* INET6 */ - i = (id->dst_ip) ^ (id->src_ip); - i ^= (id->dst_port) ^ (id->src_port); - return (i); -} - -static __inline uint32_t -hash_parent(const struct ipfw_flow_id *id, const void *rule) -{ - - return (hash_packet(id) ^ ((uintptr_t)rule)); -} - -#else /* IPFIREWALL_JENKINSHASH */ - VNET_DEFINE_STATIC(uint32_t, dyn_hashseed); #define V_dyn_hashseed VNET(dyn_hashseed) @@ -900,7 +869,6 @@ hash_parent(const struct ipfw_flow_id *id, const void *rule) return (jenkins_hash32((const uint32_t *)&rule, sizeof(rule) / sizeof(uint32_t), hash_packet(id))); } -#endif /* IPFIREWALL_JENKINSHASH */ /* * Print customizable flow id description via log(9) facility. @@ -3179,9 +3147,7 @@ void ipfw_dyn_init(struct ip_fw_chain *chain) { -#ifdef IPFIREWALL_JENKINSHASH V_dyn_hashseed = arc4random(); -#endif V_dyn_max = 16384; /* max # of states */ V_dyn_parent_max = 4096; /* max # of parent states */ V_dyn_buckets_max = 8192; /* must be power of 2 */