Re: kern/59615: NPF seems to block all traffic with an HEAD (11.99.x) kernel and netbsd-10 userland

[Emmanuel Nyarko <emmankoko519%gmail.com@localhost>]

> On 6 Sep 2025, at 2:15 PM, Leonardo Taccari via gnats <gnats-admin%NetBSD.org@localhost> wrote:
> 
> The following reply was made to PR kern/59615; it has been noted by GNATS.
> 
> From: Leonardo Taccari <leot%NetBSD.org@localhost>
> To: gnats-bugs%netbsd.org@localhost
> Cc: 
> Subject: Re: kern/59615: NPF seems to block all traffic with an HEAD (11.99.x) kernel and netbsd-10 userland
> Date: Sat, 06 Sep 2025 16:10:23 +0200
> 
> Hello Emmanuel,
> 
> Emmanuel Nyarko writes:
>> 
> 
> I have tested it (both the former patch that you have shared off-list
> and I attached here a couple of days ago and this one you have shared
> yesterday) and I can confirm that now the stats looks good:

committing this. @leot

Index: ./sys/net/npf/npf_ruleset.c
===================================================================
RCS file: /cvsroot/src/sys/net/npf/npf_ruleset.c,v
retrieving revision 1.56
diff -u -r1.56 npf_ruleset.c
--- ./sys/net/npf/npf_ruleset.c	1 Jul 2025 18:42:37 -0000	1.56
+++ ./sys/net/npf/npf_ruleset.c	7 Sep 2025 15:47:06 -0000
@@ -925,7 +925,14 @@
 		const unsigned skip_to = rl->r_skip_to & SKIPTO_MASK;
 		const uint32_t attr = rl->r_attr;
 
-		if ((attr & layer) == 0) {
+		/*
+		 * PR kern/59615
+		 * we are skipping rule inspection on two cases
+		 * if layer attributes are set but we are on a different layer
+		 * or if no layer attributes set (10 userland), don't inspect at layer 2
+		 */
+		if ((((attr & (NPF_RULE_LAYER_2 | NPF_RULE_LAYER_3)) && (attr & layer) == 0)) ||
+		    (((attr & (NPF_RULE_LAYER_2 | NPF_RULE_LAYER_3)) == 0) && layer == NPF_RULE_LAYER_2)) {
 			n = skip_to;
 			continue;
 		}


RCS file: /cvsroot/src/sys/net/npf/npf.h,v
retrieving revision 1.67
diff -u -r1.67 npf.h
--- sys/net/npf/npf.h 1 Jul 2025 18:42:37 -0000 1.67
+++ sys/net/npf/npf.h 4 Sep 2025 11:41:15 -0000
@@ -355,11 +355,9 @@
  NPF_STAT_PASS_DEFAULT,
  NPF_STAT_PASS_RULESET,
  NPF_STAT_PASS_CONN,
- NPF_ETHER_STAT_PASS,
  /* Packets blocked. */
  NPF_STAT_BLOCK_DEFAULT,
  NPF_STAT_BLOCK_RULESET,
- NPF_ETHER_STAT_BLOCK,
  /* Connection and NAT entries. */
  NPF_STAT_CONN_CREATE,
  NPF_STAT_CONN_DESTROY,
@@ -382,6 +380,9 @@
  /* nbuf non-contiguous cases. */
  NPF_STAT_NBUF_NONCONTIG,
  NPF_STAT_NBUF_CONTIG_FAIL,
+ /* layer 2 statistics */
+ NPF_ETHER_STAT_PASS,
+ NPF_ETHER_STAT_BLOCK,
  /* Count (last). */
  NPF_STATS_COUNT
 } npf_stats_t;



fixes PR.


Emmanuel