| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Correct __FreeBSD__ check.
|
|
|
|
|
|
|
| |
Don't assume checksums will be calculated later when fastfoward is
enabled (by default in r290383).
PR: 72210
|
|
|
|
| |
Obtained from: ipfilter cvs repo r1.48.2.25, r1.72 and NetBSD repo r1.4
|
|
|
|
|
|
|
|
| |
checkum. This commit fixes that.
PR: 166372
Submitted by: mk@neon1.net
Reviewed by: Darren Reed <darrenr@reed.wattle.id.au>
|
|
|
|
| |
Obtained from: ipfilter cvs repo r1.48.2.25
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fix mutex errors, fixup typos in comments.
Obtained from: NetBSD r1.4.
-This lie, anr those below, will be ignored--
> Description of fields to fill in above: 76 columns --|
> PR: If a GNATS PR is affected by the change.
> Submitted by: If someone else sent in the change.
> Reviewed by: If someone else reviewed your modification.
> Approved by: If you needed approval for this commit.
> Obtained from: If the change is from a third party.
> MFC after: N [day[s]|week[s]|month[s]]. Request a reminder email.
> MFH: Ports tree branch name. Request approval for merge.
> Relnotes: Set to 'yes' for mention in release notes.
> Security: Vulnerability reference (one per line) or description.
> Sponsored by: If the change was sponsored by an organization.
> Differential Revision: https://reviews.freebsd.org/D### (*full* phabric URL needed).
> Empty fields above will be automatically removed.
_M .
M sys/contrib/ipfilter/netinet/ip_state.c
|
|
|
|
| |
Correctly define constants.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Set the current vnet inside the ioctl handler for ipfilter.
Without this fix, the vnet was NULL and would crash.
This fix is similar to what was done inside the ioctl handler for PF.
Tested by:
(1) Boot a kernel with "options VIMAGE" enabled
(2) Type:
echo "map lo0 from 10.0.0.0/24 to ! 10.0.0.0/24 -> 127.0.0.1/32" > /etc/ipnat.rules ; service ipnat onerestart
PR: 176992
Differential Revision: https://reviews.freebsd.org/D1191
|
|
|
|
|
|
|
|
| |
ipfilter bug #537 NAT rules with sticky have incorrect hostmap IP address.
This fixes when an IP address mapping is put in the hostmap table for
sticky NAT rules, it ends up having the wrong byte order.
Obtained from: ipfilter CVS repo (r1.102), NetBSD CVS repo (r1.12)
|
|
|
|
|
|
| |
ipfilter bug #534 destination list hashing not endian neutral
Obtained from: ipfilter CVS repo (r1.26), NetBSD CVS repo (r1.8)
|
|
|
|
|
|
| |
ipfilter bug #538 ipf_p_dns_del should return void
Obtained from: ipfilter cvs repo (r1.8)
|
|
|
|
|
|
|
| |
ipfilter bug #554 Determining why a ipf rule matches is hard -- replace
ipfilter rule compare with new ipf_rule_compare() function.
Obtained from: ipfilter CVS rep (r1.129)
|
|
|
|
|
|
| |
ipfiler bug #550 filter rule list corrupted with inserted rules
Obtained from: ipfilter CVS repo (r1.128); NetBSD CVS repo (r1.15)
|
|
|
|
|
|
| |
ipfilter bug #558 add in some missing frag table function comments.
Obtained from: ipfilter CVS repo (r1.36)
|
|
|
|
|
|
|
| |
Check for NULL before de-refencing; in particular sel is assigned to NULL,
in the default case, and then couple of lines down we do sel->
Obtained from: NetBSD CVS repo (r1.5)
|
|
|
|
| |
Approved by: glebius (mentor - implicit)
|
|
|
|
|
|
|
| |
support, the userland was still built with INET6 turned on.
PR: 190964
Approved by: glebius (mentor, implicit)
|
|
|
|
|
|
|
|
| |
incorrect FIB.
PR: 183065
Submitted by: p-freebsd-bugs@ziemba.us
Approved by: glebius (mentor)
|
|
|
|
|
|
|
|
| |
Move mutex creation from ipf_log_soft_init() to ipf_log_soft_create()
to be consistent with mutex destruction in ipf_log_soft_destroy(). As a
result mutex destruction in ipf_log_soft_fini() is redundant.
Approved by: glebius (mentor)
|
|
|
|
|
|
|
|
|
|
| |
Implement the final missing sysctls by moving ipf_auth_softc_t from
ip_auth.c to ip_auth.h. ip_frag_soft_t moves from ip_frag.c to
ip_frag.h. mlfk_ipl.c creates sysctl MIBs that reference control blocks
that are dynamically created when IP Filter is loaded. This necessitated
creating them on-the-fly rather than statically at compile time.
Approved by: glebius (mentor)
|
|
|
|
|
|
|
|
|
|
| |
- Remove rt_metrics_lite and simply put its members into rtentry.
- Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This
removes another cache trashing ++ from packet forwarding path.
- Create zini/fini methods for the rtentry UMA zone. Via initialize
mutex and counter in them.
- Fix reporting of rmx_pksent to routing socket.
- Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode.
|
|
|
|
|
|
|
| |
silence a gcc warning.
Approved by: re (rodrigc)
X-MFC-With: r255332
|
|
|
|
|
|
|
| |
silence a gcc warning.
Approved by: re (gjb)
X-MFC-With: r255332
|
|
|
|
|
|
|
| |
re-enabled following it being disabled.
Approved by: glebius (mentor)
Approved by: re (blanket)
|
|
|
|
|
| |
Approved by: glebius (mentor)
Approved by: re (blanket)
|
|
|
|
|
|
| |
Submitted by: jhb
Approved by: glebius (mentor)
Approved by: re (blanket)
|
|
|
|
|
| |
Approved by: glebius (mentor)
Approved by: re (blanket)
|
| |
|
|\
| |
| |
| |
| | |
Approved by: glebius (mentor)
BSD Licensed by: Darren Reed <darrenr@reed.wattle.id.au> (author)
|
| |
| |
| |
| |
| |
| |
| |
| | |
import of new ipfilter vendor sources by flattening them.
To keep the tags consistent with dist, the tags are also flattened.
Approved by: glebius (Mentor)
|
| |
| |
| |
| | |
isn't included with forced _KERNEL define.
|
| |
| |
| |
| | |
Reported & tested by: Oleg Ginzburg
|
| |
| |
| |
| | |
Pointyhat to: kevlo (myself)
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- All packets in NETISR_IP queue are in net byte order.
- ip_input() is entered in net byte order and converts packet
to host byte order right _after_ processing pfil(9) hooks.
- ip_output() is entered in host byte order and converts packet
to net byte order right _before_ processing pfil(9) hooks.
- ip_fragment() accepts and emits packet in net byte order.
- ip_forward(), ip_mloopback() use host byte order (untouched actually).
- ip_fastforward() no longer modifies packet at all (except ip_ttl).
- Swapping of byte order there and back removed from the following modules:
pf(4), ipfw(4), enc(4), if_bridge(4).
- Swapping of byte order added to ipfilter(4), based on __FreeBSD_version
- __FreeBSD_version bumped.
- pfil(9) manual page updated.
Reviewed by: ray, luigi, eri, melifaro
Tested by: glebius (LE), ray (BE)
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This fixes ipfilter w/ network controllers that implement only
partial rx csum offloading.
PR: 106438
Obtained from: upstream
MFC after: 1 week
|
| | |
|
| |
| |
| |
| |
| |
| | |
determine which version of FreeBSD kernel we're compiling.
Approved by: kib (mentor)
|
| |
| |
| |
| | |
Found by: clang
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
"Whitspace" churn after the VIMAGE/VNET whirls.
Remove the need for some "init" functions within the network
stack, like pim6_init(), icmp_init() or significantly shorten
others like ip6_init() and nd6_init(), using static initialization
again where possible and formerly missed.
Move (most) variables back to the place they used to be before the
container structs and VIMAGE_GLOABLS (before r185088) and try to
reduce the diff to stable/7 and earlier as good as possible,
to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9.
This also removes some header file pollution for putatively
static global variables.
Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are
no longer needed.
Reviewed by: jhb
Discussed with: rwatson
Sponsored by: The FreeBSD Foundation
Sponsored by: CK Software GmbH
MFC after: 6 days
|
| |
| |
| |
| |
| |
| |
| | |
it from machine/in_cksum.h. This definition prevents us from using
hand-tuned assembler versions of in_cksum.
# this fixes the modules build on arm for ipfilter.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
vnet.h, we now use jails (rather than vimages) as the abstraction
for virtualization management, and what remained was specific to
virtual network stacks. Minor cleanups are done in the process,
and comments updated to reflect these changes.
Reviewed by: bz
Approved by: re (vimage blanket)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
by creating a child jail, which is visible to that jail and to any
parent jails. Child jails may be restricted more than their parents,
but never less. Jail names reflect this hierarchy, being MIB-style
dot-separated strings.
Every thread now points to a jail, the default being prison0, which
contains information about the physical system. Prison0's root
directory is the same as rootvnode; its hostname is the same as the
global hostname, and its securelevel replaces the global securelevel.
Note that the variable "securelevel" has actually gone away, which
should not cause any problems for code that properly uses
securelevel_gt() and securelevel_ge().
Some jail-related permissions that were kept in global variables and
set via sysctls are now per-jail settings. The sysctls still exist for
backward compatibility, used only by the now-deprecated jail(2) system
call.
Approved by: bz (mentor)
|
| |
| |
| |
| |
| |
| |
| |
| | |
rearrange / replace / adjust several INIT_VNET_* initializer
macros, all of which currently resolve to whitespace.
Reviewed by: bz (an older version of the patch)
Approved by: julian (mentor)
|
| |
| |
| |
| |
| |
| | |
to allow passing a cached struct llentry * down to L2
Reviewed by: rwatson
|
| | |
|
| |
| |
| |
| |
| |
| | |
It hasn't been needed for more than 5 years, since r120386.
MFC after: 4 weeks
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
directly include only the header files needed. This reduces the
unneeded spamming of various headers into lots of files.
For now, this leaves us with very few modules including vnet.h
and thus needing to depend on opt_route.h.
Reviewed by: brooks, gnn, des, zec, imp
Sponsored by: The FreeBSD Foundation
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
underneath #ifdef VIMAGE blocks.
This change introduces some churn in #include ordering and nesting
throughout the network stack and drivers but is not expected to cause
any additional issues.
In the next step this will allow us to instantiate the virtualization
container structures and switch from using global variables to their
"containerized" counterparts.
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
|