o Create directory sys/netpfil, where all packet filters should

  reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.c		-> sys/netpfil/pf/
sys/contrib/pf/net/*.h		-> sys/net/
contrib/pf/pfctl/*.c		-> sbin/pfctl
contrib/pf/pfctl/*.h		-> sbin/pfctl
contrib/pf/pfctl/pfctl.8	-> sbin/pfctl
contrib/pf/pfctl/*.4		-> share/man/man4
contrib/pf/pfctl/*.5		-> share/man/man5

sys/netinet/ipfw		-> sys/netpfil/ipfw

The arguable movement is pf/net/*.h -> sys/net. There are
future plans to refactor pf includes, so I decided not to
break things twice.

Not modified bits of pf left in contrib: authpf, ftp-proxy,
tftp-proxy, pflogd.

The ipfw(4) movement is planned to be merged to stable/9,
to make head and stable match.

Discussed with:		bz, luigi

1 files changed, 0 insertions, 290 deletions

diff --git a/sys/contrib/pf/net/if_pflog.c b/sys/contrib/pf/net/if_pflog.c
deleted file mode 100644
index 20feea2..0000000
--- a/sys/contrib/pf/net/if_pflog.c
+++ /dev/null
@@ -1,290 +0,0 @@
-/*	$OpenBSD: if_pflog.c,v 1.26 2007/10/18 21:58:18 mpf Exp $	*/
-/*
- * The authors of this code are John Ioannidis (ji@tla.org),
- * Angelos D. Keromytis (kermit@csd.uch.gr) and
- * Niels Provos (provos@physnet.uni-hamburg.de).
- *
- * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
- * in November 1995.
- *
- * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
- * by Angelos D. Keromytis.
- *
- * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
- * and Niels Provos.
- *
- * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
- * and Niels Provos.
- * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
- *
- * Permission to use, copy, and modify this software with or without fee
- * is hereby granted, provided that this entire notice is included in
- * all copies of any software which is or includes a copy or
- * modification of this software.
- * You may use this code under the GNU public license if you so wish. Please
- * contribute changes back to the authors under this freer than GPL license
- * so that we may further the use of strong encryption without limitations to
- * all.
- *
- * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
- * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
- * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
- * PURPOSE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_bpf.h"
-#include "opt_pf.h"
-
-#include <sys/param.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <sys/proc.h>
-#include <sys/socket.h>
-#include <sys/sockio.h>
-
-#include <net/bpf.h>
-#include <net/if.h>
-#include <net/if_clone.h>
-#include <net/if_pflog.h>
-#include <net/if_types.h>
-#include <net/pfvar.h>
-
-#if defined(INET) || defined(INET6)
-#include <netinet/in.h>
-#endif
-#ifdef	INET
-#include <netinet/in_var.h>
-#include <netinet/ip.h>
-#endif
-
-#ifdef INET6
-#include <netinet6/in6_var.h>
-#include <netinet6/nd6.h>
-#endif /* INET6 */
-
-#ifdef INET
-#include <machine/in_cksum.h>
-#endif /* INET */
-
-#define PFLOGMTU	(32768 + MHLEN + MLEN)
-
-#ifdef PFLOGDEBUG
-#define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
-#else
-#define DPRINTF(x)
-#endif
-
-static int	pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
-		    struct route *);
-static void	pflogattach(int);
-static int	pflogioctl(struct ifnet *, u_long, caddr_t);
-static void	pflogstart(struct ifnet *);
-static int	pflog_clone_create(struct if_clone *, int, caddr_t);
-static void	pflog_clone_destroy(struct ifnet *);
-
-IFC_SIMPLE_DECLARE(pflog, 1);
-
-struct ifnet	*pflogifs[PFLOGIFS_MAX];	/* for fast access */
-
-static void
-pflogattach(int npflog)
-{
-	int	i;
-	for (i = 0; i < PFLOGIFS_MAX; i++)
-		pflogifs[i] = NULL;
-	if_clone_attach(&pflog_cloner);
-}
-
-static int
-pflog_clone_create(struct if_clone *ifc, int unit, caddr_t param)
-{
-	struct ifnet *ifp;
-
-	if (unit >= PFLOGIFS_MAX)
-		return (EINVAL);
-
-	ifp = if_alloc(IFT_PFLOG);
-	if (ifp == NULL) {
-		return (ENOSPC);
-	}
-	if_initname(ifp, ifc->ifc_name, unit);
-	ifp->if_mtu = PFLOGMTU;
-	ifp->if_ioctl = pflogioctl;
-	ifp->if_output = pflogoutput;
-	ifp->if_start = pflogstart;
-	ifp->if_snd.ifq_maxlen = ifqmaxlen;
-	ifp->if_hdrlen = PFLOG_HDRLEN;
-	if_attach(ifp);
-
-	bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
-
-	pflogifs[unit] = ifp;
-
-	return (0);
-}
-
-static void
-pflog_clone_destroy(struct ifnet *ifp)
-{
-	int i;
-
-	for (i = 0; i < PFLOGIFS_MAX; i++)
-		if (pflogifs[i] == ifp)
-			pflogifs[i] = NULL;
-
-	bpfdetach(ifp);
-	if_detach(ifp);
-	if_free(ifp);
-}
-
-/*
- * Start output on the pflog interface.
- */
-static void
-pflogstart(struct ifnet *ifp)
-{
-	struct mbuf *m;
-
-	for (;;) {
-		IF_LOCK(&ifp->if_snd);
-		_IF_DROP(&ifp->if_snd);
-		_IF_DEQUEUE(&ifp->if_snd, m);
-		IF_UNLOCK(&ifp->if_snd);
-
-		if (m == NULL)
-			return;
-		else
-			m_freem(m);
-	}
-}
-
-static int
-pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
-	struct route *rt)
-{
-	m_freem(m);
-	return (0);
-}
-
-/* ARGSUSED */
-static int
-pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
-{
-	switch (cmd) {
-	case SIOCSIFFLAGS:
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_drv_flags |= IFF_DRV_RUNNING;
-		else
-			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-		break;
-	default:
-		return (ENOTTY);
-	}
-
-	return (0);
-}
-
-static int
-pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
-    u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
-    struct pf_ruleset *ruleset, struct pf_pdesc *pd, int lookupsafe)
-{
-	struct ifnet *ifn;
-	struct pfloghdr hdr;
-
-	if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
-		return ( 1);
-
-	if ((ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf)
-		return (0);
-
-	bzero(&hdr, sizeof(hdr));
-	hdr.length = PFLOG_REAL_HDRLEN;
-	hdr.af = af;
-	hdr.action = rm->action;
-	hdr.reason = reason;
-	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
-
-	if (am == NULL) {
-		hdr.rulenr = htonl(rm->nr);
-		hdr.subrulenr =  1;
-	} else {
-		hdr.rulenr = htonl(am->nr);
-		hdr.subrulenr = htonl(rm->nr);
-		if (ruleset != NULL && ruleset->anchor != NULL)
-			strlcpy(hdr.ruleset, ruleset->anchor->name,
-			    sizeof(hdr.ruleset));
-	}
-	/*
-	 * XXXGL: we avoid pf_socket_lookup() when we are holding
-	 * state lock, since this leads to unsafe LOR.
-	 * These conditions are very very rare, however.
-	 */
-	if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done && lookupsafe)
-		pd->lookup.done = pf_socket_lookup(dir, pd, m);
-	if (pd->lookup.done > 0)
-		hdr.uid = pd->lookup.uid;
-	else
-		hdr.uid = UID_MAX;
-	hdr.pid = NO_PID;
-	hdr.rule_uid = rm->cuid;
-	hdr.rule_pid = rm->cpid;
-	hdr.dir = dir;
-
-#ifdef INET
-	if (af == AF_INET && dir == PF_OUT) {
-		struct ip *ip;
-
-		ip = mtod(m, struct ip *);
-		ip->ip_sum = 0;
-		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
-	}
-#endif /* INET */
-
-	ifn->if_opackets++;
-	ifn->if_obytes += m->m_pkthdr.len;
-	BPF_MTAP2(ifn, &hdr, PFLOG_HDRLEN, m);
-
-	return (0);
-}
-
-static int
-pflog_modevent(module_t mod, int type, void *data)
-{
-	int error = 0;
-
-	switch (type) {
-	case MOD_LOAD:
-		pflogattach(1);
-		PF_RULES_WLOCK();
-		pflog_packet_ptr = pflog_packet;
-		PF_RULES_WUNLOCK();
-		break;
-	case MOD_UNLOAD:
-		PF_RULES_WLOCK();
-		pflog_packet_ptr = NULL;
-		PF_RULES_WUNLOCK();
-		if_clone_detach(&pflog_cloner);
-		break;
-	default:
-		error = EINVAL;
-		break;
-	}
-
-	return error;
-}
-
-static moduledata_t pflog_mod = { "pflog", pflog_modevent, 0 };
-
-#define PFLOG_MODVER 1
-
-DECLARE_MODULE(pflog, pflog_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
-MODULE_VERSION(pflog, PFLOG_MODVER);
-MODULE_DEPEND(pflog, pf, PF_MODVER, PF_MODVER, PF_MODVER);