freebsd stable - Sep 2008 - Warning: known instability using ipfw "uid" rules

An FYI: In the past couple of days, presumably as testing of 7.x becomes more 
widespread, I've seen several reports of instability resulting from ipfw 
credential rules.  For those unfamiliar with them, these allow the matching of 
packets in ipfw rules based on the credentials of the socket that generated 
them, or the credentials of the socket that likely will receive them.

These problems are a side effect of elimating support for lock recursion on 
inpcbinfo locks as part of the UDP performance optimization work for 7.1. 
There are two minor TCP fixes, and a more serious ipfw bug fix, in the queue 
to be MFC'd in the next couple of days.  Once they're fixed, please make
sure
any further problems with deadlocks or panics involving ipfw rules are brought 
to my attention.

Thanks, and apologies for any inconvenience -- this issue did not arise during 
testing in HEAD over the course of several months, but fortunately appears 
fairly straight forward to resolve now that it's a bit better understood.

Robert N M Watson
Computer Laboratory
University of Cambridge

On Sat, 27 Sep 2008, Robert Watson wrote:
> An FYI: In the past couple of days, presumably as testing of 7.x becomes 
> more widespread, I've seen several reports of instability resulting
from
> ipfw credential rules.  For those unfamiliar with them, these allow the 
> matching of packets in ipfw rules based on the credentials of the socket 
> that generated them, or the credentials of the socket that likely will 
> receive them.
>
> These problems are a side effect of elimating support for lock recursion on
> inpcbinfo locks as part of the UDP performance optimization work for 7.1. 
> There are two minor TCP fixes, and a more serious ipfw bug fix, in the
queue
> to be MFC'd in the next couple of days.  Once they're fixed, please
make
> sure any further problems with deadlocks or panics involving ipfw rules are
> brought to my attention.
I've now MFC'd two fixes to TCP and one fix to IPFW that appear to have 
resolved known reports of panics or deadlocks with ipfw uid/gid/jail rules. 
If you are a user of uid/gid/jail rules and have been experiencing stability 
problems, please let me know if they persist (or if you want, let me know that 
they are resolved).  If you're someone generally interested in testing out 
7.1, more testing of this feature would, of course, be welcome.

Thanks,

Robert N M Watson
Computer Laboratory
University of Cambridge