Re: kern/59615: NPF seems to block all traffic with an HEAD (11.99.x) kernel and netbsd-10 userland

["Emmanuel Nyarko via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/59615; it has been noted by GNATS.

From: Emmanuel Nyarko <emmankoko519%gmail.com@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost,
 netbsd-bugs%netbsd.org@localhost,
 "leot%netbsd.org@localhost" <leot%NetBSD.org@localhost>
Subject: Re: kern/59615: NPF seems to block all traffic with an HEAD (11.99.x)
 kernel and netbsd-10 userland
Date: Mon, 6 Oct 2025 18:18:13 +0000

 Hi Leot,
 
 I=E2=80=99m closing this PR.
 
 I=E2=80=99m committing this patch.
 
 Index: sys/net/npf/npf.h
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 RCS file: /cvsroot/src/sys/net/npf/npf.h,v
 retrieving revision 1.67
 diff -u -r1.67 npf.h
 --- sys/net/npf/npf.h	1 Jul 2025 18:42:37 -0000	1.67
 +++ sys/net/npf/npf.h	6 Oct 2025 18:13:26 -0000
 @@ -355,11 +355,9 @@
  	NPF_STAT_PASS_DEFAULT,
  	NPF_STAT_PASS_RULESET,
  	NPF_STAT_PASS_CONN,
 -	NPF_ETHER_STAT_PASS,
  	/* Packets blocked. */
  	NPF_STAT_BLOCK_DEFAULT,
  	NPF_STAT_BLOCK_RULESET,
 -	NPF_ETHER_STAT_BLOCK,
  	/* Connection and NAT entries. */
  	NPF_STAT_CONN_CREATE,
  	NPF_STAT_CONN_DESTROY,
 @@ -382,6 +380,9 @@
  	/* nbuf non-contiguous cases. */
  	NPF_STAT_NBUF_NONCONTIG,
  	NPF_STAT_NBUF_CONTIG_FAIL,
 +	/* layer 2 statistics */
 +	NPF_ETHER_STAT_PASS,
 +	NPF_ETHER_STAT_BLOCK,
  	/* Count (last). */
  	NPF_STATS_COUNT
  } npf_stats_t;
 Index: sys/net/npf/npf_ruleset.c
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 RCS file: /cvsroot/src/sys/net/npf/npf_ruleset.c,v
 retrieving revision 1.56
 diff -u -r1.56 npf_ruleset.c
 --- sys/net/npf/npf_ruleset.c	1 Jul 2025 18:42:37 -0000	1.56
 +++ sys/net/npf/npf_ruleset.c	6 Oct 2025 18:13:26 -0000
 @@ -925,7 +925,14 @@
  		const unsigned skip_to =3D rl->r_skip_to & SKIPTO_MASK;
  		const uint32_t attr =3D rl->r_attr;
 =20
 -		if ((attr & layer) =3D=3D 0) {
 +		/*
 +		 * PR kern/59615
 +		 * we are skipping rule inspection on two cases
 +		 * if layer attributes are set but we are on a different =
 layer
 +		 * or if no layer attributes set (10 userland), don't =
 inspect at layer 2
 +		 */
 +		if (!(((layer =3D=3D NPF_RULE_LAYER_3 && ((attr & =
 (NPF_RULE_LAYER_2 | NPF_RULE_LAYER_3)) =3D=3D 0)) ||
 +		    (attr & layer)))) {
  			n =3D skip_to;
  			continue;
  		}