summaryrefslogtreecommitdiffstats
path: root/sys/contrib/pf/net
Commit message (Collapse)AuthorAgeFilesLines
* Comment out rev. 1.4 after problems w/ IPv6, a better solution must bemlaier2004-08-161-0/+2
| | | | found.
* Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSDdwmalone2004-08-142-9/+0
| | | | | | | | | | | | | | | | | | | | | have already done this, so I have styled the patch on their work: 1) introduce a ip_newid() static inline function that checks the sysctl and then decides if it should return a sequential or random IP ID. 2) named the sysctl net.inet.ip.random_id 3) IPv6 flow IDs and fragment IDs are now always random. Flow IDs and frag IDs are significantly less common in the IPv6 world (ie. rarely generated per-packet), so there should be smaller performance concerns. The sysctl defaults to 0 (sequential IP IDs). Reviewed by: andre, silby, mlaier, ume Based on: NetBSD MFC after: 2 months
* Loopback fix from Mathieu Sauve-Frankel:mlaier2004-08-121-2/+3
| | | | | Add missing check for NULL in DIOCCHANGERULE. This prevents a crash in certain rare cases.
* Loopback fix from Daniel Hartmeier:mlaier2004-08-123-7/+13
| | | | | | | | | pf_cksum_fixup() was called without last argument from normalization, also fixup checksum when random-id modifies ip_id. This would previously lead to incorrect checksums for packets modified by scrub random-id. (Originally) Submitted by: yongari
* Loopback fix from Henning Brauer:mlaier2004-08-121-0/+4
| | | | | | | skip over interface addresses without IFA_ROUTE, fixes some issue with pppd PR: misc/69954
* Initialize s variable early to shut up GCC warnings.kan2004-07-284-14/+31
| | | | | | | Do not declare inline functions without body as this is useless in general and generates a warning with GCC 3.4.x. Glanced over by: dhartmei
* Fix the following LOR on pf module unload:mlaier2004-07-231-4/+4
| | | | | | | 1st ifnet (ifnet) @/usr/src/sys/contrib/pf/net/pf_if.c:191 2nd pf task mtx (pf task mtx) @/usr/src/sys/contrib/pf/net/pf_if.c:197 Reported by: Pyun YongHyeon (a long time ago)
* Refine pf_check_proto_cksum() a bit in order to avoid additional in_pseudo()mlaier2004-07-231-25/+22
| | | | | | | | calls further down the stack. If we find the cksum to be okay we pretend that the hardware did all the work and hence keep the upper layers from checking again. Submitted by: Pyun YongHyeon
* Fix a stupid attemp to apply host arithmetics to network byte ordered data.mlaier2004-07-181-1/+1
| | | | | | | This fixes checksum for some drivers with partial H/W ckcsum offloads. Reported by: Simon 'corecode' Schubert, Devon H. O'Dell, hmp Reviewed by: Pyun YongHyeon
* m_tag_copy takes an additional "how" parameter in FreeBSD.mlaier2004-07-181-0/+8
| | | | Submitted by: rwatson
* Merge in a stable fix from OpenBSD:mlaier2004-07-171-52/+63
| | | | | | | | | | | MFC: Fix by dhartmei@ change pf_route() loop detection: introduce a counter (number of times a packet is routed already) in the mbuf tag, allow at most four times. Fixes some legitimate cases broken by the previous change. Reviewed by: dhartmei
* Define semantic of M_SKIP_FIREWALL more precisely, i.e. also pass associatedmlaier2004-07-171-10/+29
| | | | | | | | icmp_error() packets. While here retire PACKET_TAG_PF_GENERATED (which served the same purpose) and use M_SKIP_FIREWALL in pf as well. This should speed up things a bit as we get rid of the tag allocations. Discussed with: juli
* Major overhaul of pseudo-interface cloning. Highlights include:brooks2004-06-223-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Split the code out into if_clone.[ch]. - Locked struct if_clone. [1] - Add a per-cloner match function rather then simply matching names of the form <name><unit> and <name>. - Use the match function to allow creation of <interface>.<tag> vlan interfaces. The old way is preserved unchanged! - Also the match function to allow creation of stf(4) interfaces named stf0, stf, or 6to4. This is the only major user visible change in that "ifconfig stf" creates the interface stf rather then stf0 and does not print "stf0" to stdout. - Allow destroy functions to fail so they can refuse to delete interfaces. Currently, we forbid the deletion of interfaces which were created in the init function, particularly lo0, pflog0, and pfsync0. In the case of lo0 this was a panic implementation so it does not count as a user visiable change. :-) - Since most interfaces do not need the new functionality, an family of wrapper functions, ifc_simple_*(), were created to wrap old style cloner functions. - The IF_CLONE_INITIALIZER macro is replaced with a new incompatible IFC_CLONE_INITIALIZER and ifc_simple consumers use IFC_SIMPLE_DECLARE instead. Submitted by: Maurycy Pawlowski-Wieronski <maurycy at fouk.org> [1] Reviewed by: andre, mlaier Discussed on: net
* Import two fixes from the OpenBSD stable branch:mlaier2004-06-173-19/+16
| | | | | | | | | - prevent an endless loop with route-to lo0, fixes PR 3736 (dhartmei@) - The rule_number parameter for pf_get_pool() needs to be 32 bits, not 8 - this fixes corruption of the address pools with large rulesets. (mcbride@, pb@) Reviewed-by: dhartmei
* Commit pf version 3.5 and link additional files to the kernel build.mlaier2004-06-1612-2385/+4856
| | | | | | | | | | | | Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
* This commit was generated by cvs2svn to compensate for changes in r130610,mlaier2004-06-161-0/+840
|\ | | | | | | which included commits to RCS files with non-trunk default branches.
| * Import pf from OpenBSD 3.5 (OPENBSD_3_5_BASE)mlaier2004-06-1611-1417/+4695
| |
| * Import OpenBSD 3.4-stable fixesdhartmei2004-05-023-19/+16
| |
| * Import another fix from the OpenBSD-Stable branch:mlaier2004-04-111-6/+11
| | | | | | | | | | | | | | | | | | | | | | Fix by dhartmei@ and mcbride@ 1.433 Properly m_copyback() modified TCP sequence number after demodulation 1.432 Fix icmp checksum when sequence number modlation is being used. Also fix a daddr vs saddr cut-n-paste error in ICMP error handling. Fixes PR 3724
| * Import two fixes from OpenBSD's stable branch:mlaier2004-03-282-4/+41
| | | | | | | | | | | | | | | | | | | | | | - Fix binat for incoming connections when a netblock (not just a single address) is used for source in the binat rule. closes PR 3535, reported by Karl O.Pinc. ok henning@, cedric@ - Fix a problem related to empty anchor rulesets, which could cause a kernel panic. Approved by: bms(mentor)
* | Do the dreaded s/dev_t/struct cdev */phk2004-06-161-9/+9
| | | | | | | | Bump __FreeBSD_version accordingly.
* | Remove some more leftover from the old pfaltq_module hack to allow formlaier2004-06-142-24/+8
| | | | | | | | | | | | kernels w/ pf, but w/o altq. Reported-by: Xin LI
* | Prepare pf for building with ALTQ:mlaier2004-06-133-56/+4
| | | | | | | | | | - remove old pfaltq module linkage - move pfaltq_running to pf_ioctl.c It is protected by PF_LOCK()
* | "Get rid of the nested include of <sys/module.h> from <sys/kernel.h>" ormlaier2004-05-313-0/+3
| | | | | | | | | | | | | | better do no longer depend on it. Requested-by: phk Approved-by: bms(mentor)
* | Commit three imported bugfixes from OpenBSD 3.4-stable:dhartmei2004-05-023-19/+16
| | | | | | | | | | | | | | | | | | | | | | - change pf_get_pool() argument rule_number type from u_int32_t to u_int8_t, fixes corruption of address pools with large rulesets (mcbride@) - prevent endless loops with route-to (dhartmei@) - limit option length to 2 octets max (frantzen@) Obtained from: OpenBSD Approved by: mlaier(mentor), bms(mentor)
* | Staticize <if>_clone_{create,destroy} functions.brooks2004-04-142-8/+8
| | | | | | | | Reviewed by: mlaier
* | Commit import of OpenBSD-stable fix:mlaier2004-04-111-6/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix by dhartmei@ and mcbride@ 1.433 Properly m_copyback() modified TCP sequence number after demodulation 1.432 Fix icmp checksum when sequence number modlation is being used. Also fix a daddr vs saddr cut-n-paste error in ICMP error handling. Fixes PR 3724 Obtained from: OpenBSD Reviewed by: dhartmei Approved by: rwatson
* | Shut up a couple of annoying gcc warnings. Do not enclose the fixes withmlaier2004-03-301-14/+16
| | | | | | | | | | | | | | | | #ifdefs in order to loop it back to OpenBSD after the next import. There are a some implicit asserts involved which might be better spelled out explicitly (af == AF_INET ...) Approved by: bms(mentor)
* | Commit two fixes from OpenBSD's stable branch:mlaier2004-03-282-6/+41
| | | | | | | | | | | | | | | | | | | | | | - Fix binat for incoming connections when a netblock (not just a single address) is used for source in the binat rule. closes PR 3535, reported by Karl O.Pinc. ok henning@, cedric@ - Fix a problem related to empty anchor rulesets, which could cause a kernel panic. Approved by: bms(mentor)
* | Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdefmlaier2004-03-1710-323/+283
| | | | | | | | | | | | | | | | Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
* | Remove `$Name$' leftovers from the port version reporting.mlaier2004-03-103-3/+0
| | | | | | | | | | Noticed by: Craig Rodrigues Approved by: bms(mentor)
* | Remove __inline keyword from functions that can't be inlined according tomlaier2004-02-292-0/+8
| | | | | | | | | | | | | | LINT. This fixes LINT compliation for now, but needs to be revised. Changes do not affect the objects. Approved by: bms(mentor)
* | Tweak existing header and other build infrastructure to be able to buildmlaier2004-02-261-0/+5
| | | | | | | | | | | | | | pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor)
* | Bring diff from the security/pf port. This has code been tested as a portmlaier2004-02-2610-50/+3037
|/ | | | | | | | | | | | | for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
* Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4mlaier2004-02-2610-0/+13504
Approved by: bms(mentor), core (in general)
OpenPOWER on IntegriCloud