summaryrefslogtreecommitdiffstats
path: root/sys/contrib/ipfilter
Commit message (Collapse)AuthorAgeFilesLines
* Pointer to an ICMP header was getting left behind after doing a pullup.darrenr2007-06-091-0/+1
|
* Merge IPFilter 4.1.23 back to HEADdarrenr2007-06-0422-1346/+3701
| | | | See src/contrib/ipfilter/HISTORY for details of changes since 4.1.13
* This commit was generated by cvs2svn to compensate for changes in r170263,darrenr2007-06-0412-154/+555
|\ | | | | | | which included commits to RCS files with non-trunk default branches.
| * Import IPFilter 4.1.23 to vendor branch.darrenr2007-06-0434-1527/+4276
| | | | | | | | See src/contrib/ipfilter/HISTORY for details of changes since 4.1.13
* | TCP Window scaling was being recognised but the recorded settings were beingdarrenr2006-12-241-19/+7
| | | | | | | | | | | | clobbered and thus effectively disabled. MFC after: 7 days
* | Workaround bad locking design:oleg2006-10-051-3/+9
| | | | | | | | | | | | | | | | | | | | do not try to lock/unlock destroyed/non-existsing mutex. PR: kern/103569 Reviewed by: guido Approved by: glebius (mentor) Silence from: darrenr MFC: 2 week
* | Resolve conflictsguido2006-08-1616-361/+501
| | | | | | | | MFC after: 2 weeks
* | This commit was generated by cvs2svn to compensate for changes in r161351,guido2006-08-163-10/+23
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
| * Import IP Filter 4.1.13guido2006-08-1621-402/+557
| |
* | fix "ipf -Z" reporting rubbish and possibly panic'ing boxdarrenr2006-04-181-1/+1
| | | | | | | | MFC after: 4 days
* | Add mcopywrap prototype to ip_compat.hguido2005-12-302-1/+1
| | | | | | | | Remove h323 proxy from ip_proxy (copyright issue)
* | Resolve conflictsguido2005-12-3021-509/+916
| |
* | This commit was generated by cvs2svn to compensate for changes in r153872,guido2005-12-3013-64/+41
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
| * Import IP Filter version 4.1.10guido2005-12-3035-651/+1053
| |
* | Fix -Wundef from compiling the amd64 LINT.ru2005-12-045-21/+26
| |
* | Normalize a significant number of kernel malloc type names:rwatson2005-10-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Prefer '_' to ' ', as it results in more easily parsed results in memory monitoring tools such as vmstat. - Remove punctuation that is incompatible with using memory type names as file names, such as '/' characters. - Disambiguate some collisions by adding subsystem prefixes to some memory types. - Generally prefer lower case to upper case. - If the same type is defined in multiple architecture directories, attempt to use the same name in additional cases. Not all instances were caught in this change, so more work is required to finish this conversion. Similar changes are required for UMA zone names.
* | Fix some minor problems before release:darrenr2005-06-232-15/+54
| | | | | | | | | | | | | | | | (1) "ipf -T" is broken for fetching single entries and (2) loading rules with numbered collections does not order insertion right. (3) stats aren't accumulated for hash table memory failures Approved by: re (dwhite)
* | locking on exit of reading from ip_sync is not correct for all instancesdarrenr2005-06-141-4/+9
| | | | | | | | Approved by: re (dwhite)
* | Enable building /sbin/ipf (but not the rescue version) with the ability todarrenr2005-05-161-0/+4
| | | | | | | | parse bpf strings for filter rules in ipf.conf
* | Enable IPFilter to correctly determine if BPF has been optioned into thedarrenr2005-05-151-2/+2
| | | | | | | | | | kernel it is being compiled against and subsequently enable using BPF for packet matching in ipf rules.
* | Fix the following warnings on amd64:ru2005-04-291-2/+2
| | | | | | | | | | | | | | /usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_newfrag': /usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:397: warning: cast to pointer from integer of different size /usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_knownfrag': /usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:582: warning: cast from pointer to integer of different size
* | Don't use quad_t on FreeBSD (deprecated) so use "long long" instead.darrenr2005-04-281-3/+3
| | | | | | | | | | Someday this should be converted to uint64_t and printstate.c changed to use those horrid PRiud64 things.
* | The current H.323 proxy source has a license that isn't suitable for inclusiondarrenr2005-04-271-1/+3
| | | | | | | | with FreeBSD so we shouldn't be trying to include it here.
* | - Comment out duplicate rcsid strings in *.c filesdarrenr2005-04-276-11/+18
| | | | | | | | | | - Move SIOCPROXY from ip_nat.h to ip_proxy.h and fix ip_proxy.h so that it can be easily compiled into kdump, et al.
* | Add an include for netinet/ip_compat.h directly so that we don't need todarrenr2005-04-261-0/+2
| | | | | | | | add another special file in the creation of ioctls.c for kdump.
* | Merge the changes from 3.4.35 to 4.1.8 into the kernel source treedarrenr2005-04-2520-9332/+17345
| |
* | This commit was generated by cvs2svn to compensate for changes in r145516,darrenr2005-04-2518-111/+8348
|\ \ | |/ | | | | which included commits to RCS files with non-trunk default branches.
| * import ipfilter 4.1.8 into the kernel source treedarrenr2005-04-2538-7136/+25763
| |
| * Import ipfilter 3.4.35 (destinated for RELENG_4) to vendor branchdarrenr2004-06-2116-414/+736
| |
* | Use dynamic major number allocation.phk2005-02-271-2/+0
| |
* | Elminate 1 LOR (actually a recursive mutex grab) involving ipfilter wheredarrenr2005-01-081-25/+2
| | | | | | | | | | we loop through all the list of NICs (struct ifnet), holding the lock on it and then do a name lookup with ifunit() whilst holding it.
* | * Remove some code that's in a #ifndef FreeBSD that's no longer used.darrenr2004-12-261-5/+0
| |
* | * The #ifdef's to cause mutex's for freebsd to be declared were meant to pickdarrenr2004-12-262-19/+4
| | | | | | | | | | up on USE_MUTEX being defined, but this patch * Remove some code that's in a #ifndef FreeBSD that's no longer used.
* | Darnit, through a maze of twisty passages, ipfilter needs to have PFIL_HOOKSscottl2004-12-251-1/+1
| | | | | | | | defined. Revert part of the previous commit to fix this.
* | Sprinkle in some __FreeBSD_version checks so that this compiles again. Don'tscottl2004-12-253-3/+6
| | | | | | | | | | | | define PFIL_HOOKS anymore. Submitted by: keramida
* | Enable fine grained locking within IPFilter, using mtx(9) and sx(9) allowingdarrenr2004-12-249-27/+81
| | | | | | | | the the "needs giant" flag to be removed from the driver.
* | Make ip_nat compile again. Should read #if->n<-def LARGE_NAT as in ipf 4.xmlaier2004-12-181-1/+1
| |
* | Move two variables that are unused if LARGE_NAT is defined inside an #ifdefdarrenr2004-12-171-1/+4
| | | | | | | | | | | | to keep them out of harms way when compiling. PR: 72783
* | Allow ipnat redirect rules to work for non-TCP/UDP packets.darrenr2004-12-171-3/+5
| | | | | | | | | | | | | | PR: 70038 Submitted by: fming@borderware.com Reviewed by: darrenr Obtained from: fming@borderware.com
* | Using just m_pullup to get all of the interesting bits in packet into onedarrenr2004-12-161-1/+6
| | | | | | | | | | | | | | buffer doesn't work for ipv6 packets, so use m_defrag() here instead as an easy drop-in replacement. PR: 70399
* | Add an additional struct inpcb * argument to pfil(9) in order to enablemlaier2004-09-291-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in forseeable future. Suggested by: rwatson A lot of work by: csjp (he'd be even more helpful w/o mentor-reviews ;) Reviewed by: rwatson, csjp Tested by: -pf, -ipfw, LINT, csjp and myself MFC after: 3 days LOR IDs: 14 - 17 (not fixed yet)
* | From __FreeBSD_version 600001 on PFIL_HOOKS is permanently in the kernel andandre2004-08-272-2/+3
| | | | | | | | doesn't require to include opt_pfil_hooks.h.
* | Clean up a bunch of white-space difference with IPFilter source as well asdarrenr2004-07-111-9/+8
| | | | | | | | | | remove some superfluous assignments for .d_version/.d_flags in a cdevsw structure initialisation that never sees the light of day in FreeBSD.
* | Mess from update & merge - don't release the ifnet lock twice, just oncedarrenr2004-06-291-3/+0
| | | | | | | | and after we're finished with it.
* | revert section of code that calls netisr_queue() to match v1.33 of this filedarrenr2004-06-221-15/+1
| |
* | #ifdef's for FreeBSD are wrong, causing too many variable declaractions todarrenr2004-06-221-2/+3
| | | | | | | | disappear.
* | one too many #endif's from the update broke the builddarrenr2004-06-221-1/+0
| |
* | Update ipfilter from 3.4.31 -> 3.4.35. Some important changes:darrenr2004-06-2116-392/+692
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * block packets that fail to create state table entries * only allow non-fragmented packets to influence whether or not a logged packet is the same as the one logged before. * correct the ICMP packet checksum fixing up when processing ICMP errors for NAT * implement a maximum for the number of entries in the NAT table (NAT_TABLE_MAX and ipf_nattable_max) * frsynclist() wasn't paying attention to all the places where interface names are, like it should. * fix comparing ICMP packets with established TCP state where only 8 bytes of header are returned in the ICMP error. MFC after: 1 week
* | Do the dreaded s/dev_t/struct cdev */phk2004-06-163-8/+12
| | | | | | | | Bump __FreeBSD_version accordingly.
* | Recognise NOINET6 as an indication to not build IPv6 enabled source evendarrenr2004-06-081-1/+2
| | | | | | | | | | | | if FreeBSD header files, etc, support it. Submitted by: Sergey Mokryshev <mokr@mokr.net>
OpenPOWER on IntegriCloud