summaryrefslogtreecommitdiffstats
path: root/sbin/ipfw
Commit message (Collapse)AuthorAgeFilesLines
...
* Check nat id a bit more strictly.ae2011-06-141-6/+7
|
* Initialize co.use_set variable before parsing each new rule.ae2011-06-061-0/+1
| | | | | PR: bin/134975 MFC after: 2 weeks
* Increase buffer size for the command line.ae2011-06-061-2/+2
| | | | | | PR: bin/125370 Submitted by: sem MFC after: 2 weeks
* Add tablearg support for ipfw setfib.ae2011-05-302-11/+19
| | | | | PR: kern/156410 MFC after: 2 weeks
* mdoc:pluknet2011-05-171-2/+2
| | | | | - use a proper macro for interface name ipfw0. - add missing section number for bpf cross reference.
* Rewrite NAT configuration parser, so that memory allocation size isglebius2011-04-191-186/+189
| | | | | | calculated dynamically. PR: kern/143653
* More whitespace fixes.glebius2011-04-184-41/+41
| | | | Checked with: md5, diff -x -w
* Whitespace fixes.glebius2011-04-186-268/+266
| | | | Checked with: md5, diff -w
* The first customer of the SO_USER_COOKIE option:luigi2010-11-123-0/+19
| | | | | | | | | | | | the "sockarg" ipfw option matches packets associated to a local socket and with a non-zero so_user_cookie value. The value is made available as tablearg, so it can be used as a skipto target or pipe number in ipfw/dummynet rules. Code by Paul Joe, manpage by me. Submitted by: Paul Joe MFC after: 1 week
* mdoc: make pages render with mandocuqs2010-10-211-2/+1
| | | | | | It's a bit more pedantic regarding .Bl list elements. This has an added benefit of unbreaking the ipfw(8) manpage, where groff was silently skipping one list element.
* document logging through bpfluigi2010-10-131-13/+18
|
* mdoc: drop redundant .Pp and .LP callsuqs2010-10-081-2/+0
| | | | They have no effect when coming in pairs, or before .Bl/.Bd
* Fix incorrect usage of 'assure' and 'insure'.brucec2010-08-281-1/+1
| | | | Approved by: rrs (mentor)
* expand_number(3) takes a uint64_t * now.des2010-08-191-1/+1
| | | | MFC after: 3 weeks
* Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki whilejoel2010-08-161-2/+2
| | | | | | translating these manual pages. Minor corrections by me. Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>
* Document that the "ngtee" action no longer accepts packet, andglebius2010-07-271-4/+2
| | | | | | | | thus don't depend on one_pass flag anymore. This is a POLA violation, but it is quite difficult to restore the old behavior with new code. Also, the new behavior matches behavior of the older "tee" action, and this is more intuitive.
* better printing of headers when listing flowsluigi2010-07-151-8/+18
|
* fix 64-bit buildluigi2010-04-191-2/+4
| | | | Reported by: Robert Noland
* Slightly different handling of printf/snprintf for unaligned uint64_t,luigi2010-04-193-36/+40
| | | | | | | which should improve readability, and also to ease the port to platforms that do not support %llu MFC after: 3 days
* fix a buffer overflow with large (100k+) number of input lines.luigi2010-04-121-2/+2
| | | | MFC after: 3 days
* Set net.inet6.ip6.fw.enable as well.ume2010-04-061-0/+2
|
* fix another bug in "ipfw set N ..."luigi2010-03-241-1/+1
| | | | Submitted by: Marcin Wisnicki
* Tweak language to make one point potentially clearer for non-native spekersgavin2010-03-201-2/+2
| | | | | PR: bin/121424 Submitted by: "Julian H. Stacey" <jhs berklix.org>
* accept lower case m as a synonym for Mega (bit/s or bytes/s).luigi2010-03-151-1/+1
|
* print correctly commands of the formluigi2010-03-151-8/+17
| | | | | | | | | | ipfw add 100 allow ip from { 1.2.3.4 or 5.6.7.8 } (note that the above example could be better written as ipfw add 100 allow dst-ip 1.2.3.4,5.6.7.8 Submitted by: Riccardo Panicucci
* + implement (two lines) the kernel side of 'lookup dscp N' to use theluigi2010-03-151-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | dscp as a search key in table lookups; + (re)implement a sysctl variable to control the expire frequency of pipes and queues when they become empty; + add 'queue number' as optional part of the flow_id. This can be enabled with the command queue X config mask queue ... and makes it possible to support priority-based schedulers, where packets should be grouped according to the priority and not some fields in the 5-tuple. This is implemented as follows: - redefine a field in the ipfw_flow_id (in sys/netinet/ip_fw.h) but without changing the size or shape of the structure, so there are no ABI changes. On passing, also document how other fields are used, and remove some useless assignments in ip_fw2.c - implement small changes in the userland code to set/read the field; - revise the functions in ip_dummynet.c to manipulate masks so they also handle the additional field; There are no ABI changes in this commit.
* Implement "lookup dscp N" which does a lookup of the DSCP (top 6 bitsluigi2010-03-152-2/+4
| | | | | | | | | | of ip->ip_tos) in a table. This can be useful to direct traffic to different pipes/queues according to the DSCP of the packet, as follows: ipfw add 100 queue tablearg lookup dscp 3 // table 3 maps dscp->queue This change is a no-op (but harmless) until the two-line kernel side is committed, which will happen shortly.
* implement listing of a subset of pipes/queues/schedulers.luigi2010-03-111-28/+117
| | | | | The filtering of the output is done in the kernel instead of userland to reduce the amount of data transfered.
* add back DPADD (removed by mistake in a previous commit)luigi2010-03-081-0/+1
|
* more documentation on new dummynet features.luigi2010-03-051-18/+98
|
* make the listing of queues/pipes/schedulers handle the case ofluigi2010-03-041-4/+19
| | | | data size increasing while we fetch the info.
* fix handling of setsluigi2010-03-041-5/+13
|
* reduce diffs with the cross-platform version (windows needsluigi2010-03-041-0/+14
| | | | some extra initialization)
* remove stale commentluigi2010-03-041-2/+0
|
* Bring in the most recent version of ipfw and dummynet, developedluigi2010-03-027-593/+883
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and tested over the past two months in the ipfw3-head branch. This also happens to be the same code available in the Linux and Windows ports of ipfw and dummynet. The major enhancement is a completely restructured version of dummynet, with support for different packet scheduling algorithms (loadable at runtime), faster queue/pipe lookup, and a much cleaner internal architecture and kernel/userland ABI which simplifies future extensions. In addition to the existing schedulers (FIFO and WF2Q+), we include a Deficit Round Robin (DRR or RR for brevity) scheduler, and a new, very fast version of WF2Q+ called QFQ. Some test code is also present (in sys/netinet/ipfw/test) that lets you build and test schedulers in userland. Also, we have added a compatibility layer that understands requests from the RELENG_7 and RELENG_8 versions of the /sbin/ipfw binaries, and replies correctly (at least, it does its best; sometimes you just cannot tell who sent the request and how to answer). The compatibility layer should make it possible to MFC this code in a relatively short time. Some minor glitches (e.g. handling of ipfw set enable/disable, and a workaround for a bug in RELENG_7's /sbin/ipfw) will be fixed with separate commits. CREDITS: This work has been partly supported by the ONELAB2 project, and mostly developed by Riccardo Panicucci and myself. The code for the qfq scheduler is mostly from Fabio Checconi, and Marta Carbone and Francesco Magno have helped with testing, debugging and some bug fixes.
* Fixed dependencies (make checkdpadd).ru2010-02-251-0/+1
|
* implement a new match option,luigi2009-12-153-0/+60
| | | | | | | | | | | | | | lookup {dst-ip|src-ip|dst-port|src-port|uid|jail} N which searches the specified field in table N and sets tablearg accordingly. With dst-ip or src-ip the option replicates two existing options. When used with other arguments, the option can be useful to quickly dispatch traffic based on other fields. Work supported by the Onelab project. MFC after: 1 week
* fix the indentation for addr: valuesluigi2009-12-151-0/+2
| | | | MFC after: 3 days
* restore setting of sin_len (was removed in 1.146 last february) asluigi2009-12-061-1/+3
| | | | | | | | | | it seems that now it is necessary for 'forward' to work outside lo0. The bug (and fix) was reported on 8.0. This patch probably applies to RELENG_7 as well. It seems that 'pf' has a similar bug. Submitted by: Lytochkin Boris MFC after: 3 days
* fix argument type in the call to expand_numberluigi2009-12-041-1/+1
| | | | | Submitted by: gcc 4.3 MFC after: 3 days
* use qsort_r instead of heapsort;luigi2009-12-031-4/+4
| | | | | | staticize two functions. MFC after: 3 days
* Fix minor resource leak in a function.netchild2009-11-211-0/+2
| | | | | Reviewed by: luigi MFC after: 1 week
* Fix setfib(1) section number.brueffer2009-09-181-1/+1
| | | | | | PR: 133765 Submitted by: Konstantin Zolotukhin <erebus@gorodok.net> MFC after: 3 days
* - 'burst' description rewritten.oleg2009-06-261-5/+10
| | | | | Submitted by: Ben Kaduk Approved by: re (kib)
* o Kill grammar nits.maxim2009-06-261-2/+2
| | | | | | PR: docs/136061 Submitted by: Ben Kaduk MFC after: 1 week
* - fix dummynet 'fast' mode for WF2Q case.oleg2009-06-244-7/+48
| | | | | | - fix printing of pipe profile data. - introduce new pipe parameter: 'burst' - how much data can be sent through pipe bypassing bandwidth limit.
* Permit the specification of bandwidth values withinluigi2009-06-082-40/+72
| | | | | | | | | "profile" files (bandwidth is mandatory when using a profile, so it makes sense to have everything in one place). Update the manpage accordingly. Submitted by: Marta Carbone
* add a missing format in a printfluigi2009-06-081-1/+1
| | | | | | Detected building with gcc 4.3.3 MFC after: 3 days
* Several ipfw options and actions use a 16-bit argument to indicateluigi2009-06-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | pipes, queues, tags, rule numbers and so on. These are all different namespaces, and the only thing they have in common is the fact they use a 16-bit slot to represent the argument. There is some confusion in the code, mostly for historical reasons, on how the values 0 and 65535 should be used. At the moment, 0 is forbidden almost everywhere, while 65535 is used to represent a 'tablearg' argument, i.e. the result of the most recent table() lookup. For now, try to use explicit constants for the min and max allowed values, and do not overload the default rule number for that. Also, make the MTAG_IPFW declaration only visible to the kernel. NOTE: I think the issue needs to be revisited before 8.0 is out: the 2^16 namespace limit for rule numbers and pipe/queue is annoying, and we can easily bump the limit to 2^32 which gives a lot more flexibility in partitioning the namespace. MFC after: 5 days
* remove a printf that was only useful for debugging.luigi2009-06-051-2/+0
| | | | MFC after: 3 days
OpenPOWER on IntegriCloud