summaryrefslogtreecommitdiffstats
path: root/sys/net/pfil.h
Commit message (Collapse)AuthorAgeFilesLines
* Whitespace, style cleanups, and improved comments.andre2013-08-241-22/+24
|
* ename PFIL_LIST_[UN]LOCK() to PFIL_HEADLIST_[UN]LOCK() to avoidandre2013-08-241-2/+4
| | | | confusion with the pfil_head chain locking macros.
* Resolve the confusion between the head_list and the hook list.andre2013-08-241-10/+19
| | | | | | | | | | | The linked list of pfil hooks is changed to "chain" and this term is applied consistently. The head_list remains with "list" term. Add KASSERT to vnet_pfil_uninit(). Update and extend comments. Reviewed by: eri (previous version)
* Internalize pfil_hook_get(). There are no outside consumers ofandre2013-08-241-12/+0
| | | | | | | this API, it is only safe for internal use and even the pfil(9) man page says so in the BUGS section. Reviewed by: eri
* Introduce typedef for pfil hook callback function and replace allandre2013-08-241-6/+6
| | | | | | spelled out occurrences with it. Reviewed by: eri
* Fix style and comments.ae2013-03-191-8/+8
|
* Remove the recently added sysctl variable net.pfil.forward.ae2012-11-021-3/+0
| | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnae2012-10-251-0/+3
| | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks
* Make PFIL use per-VNET lock instead of per-AF lock. Since most used packetmelifaro2012-10-221-10/+36
| | | | | | | | | | | | | | | | | | | | | | filters (ipfw and PF) use the same ruleset with the same lock for both AF_INET and AF_INET6 there is no need in more fine-grade locking. However, it is possible to request personal lock by specifying PFIL_FLAG_PRIVATE_LOCK flag in pfil_head structure (see pfil.9 for more details). Export PFIL lock via rw_lock(9)/rm_lock(9)-like API permitting pfil consumers to use this lock instead of own lock. This help reducing locks on main traffic path. pfil_assert() is currently not implemented due to absense of rm_assert(). Waiting for some kind of r234648 to be merged in HEAD. This change is part of bigger patch reducing routing locking. Sponsored by: Yandex LLC Reviewed by: glebius, ae OK'd by: silence on net@ MFC after: 3 weeks
* small portability fix to build on linux/windowsluigi2010-07-151-0/+4
|
* Remove unused pfil_flags field in packet_filter_hook.rwatson2009-10-181-1/+0
| | | | MFC after: 3 days
* Sort function prototypes in pfil.h, clean up white space, and betterrwatson2009-10-181-6/+6
| | | | | | align fields for printing. MFC after: 3 days
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:rwatson2009-05-291-1/+1
| | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page.
* Line wrap very long line in struct packet_filter_hook definition.rwatson2008-12-131-1/+2
| | | | MFC after: pretty soon
* pfil(9) locking take 3: Switch to rmlock(9)mlaier2007-11-251-6/+9
| | | | | | | | | This has the benefit that rmlocks have proper support for reader recursion (in contrast to rwlock(9) which could potential lead to writer stravation). It also means a significant performance gain, eventhough only visible in microbenchmarks at the moment. Discussed on: -arch, -net
* Correct the definition of PFIL_HOOKED() so that it comparesgallatin2007-06-081-1/+1
| | | | | | | | | the value of ph_nhooks to zero, not the address. This removes extranious calls to pfil_run_hooks (and an rw lock) from the network stack's critical path when no pfil hooks are active. Reviewed by: csjp Sponsored by: Myricom Inc.
* define lock.h before rwlock.h for DEBUG_LOCKScsjp2006-02-021-0/+1
|
* Somewhat re-factor the read/write locking mechanism associated with the packetcsjp2006-02-021-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filtering mechanisms to use the new rwlock(9) locking API: - Drop the variables stored in the phil_head structure which were specific to conditions and the home rolled read/write locking mechanism. - Drop some includes which were used for condition variables - Drop the inline functions, and convert them to macros. Also, move these macros into pfil.h - Move pfil list locking macros intp phil.h as well - Rename ph_busy_count to ph_nhooks. This variable will represent the number of IN/OUT hooks registered with the pfil head structure - Define PFIL_HOOKED macro which evaluates to true if there are any hooks to be ran by pfil_run_hooks - In the IP/IP6 stacks, change the ph_busy_count comparison to use the new PFIL_HOOKED macro. - Drop optimization in pfil_run_hooks which checks to see if there are any hooks to be ran, and returns if not. This check is already performed by the IP stacks when they call: if (!PFIL_HOOKED(ph)) goto skip_hooks; - Drop in assertion which makes sure that the number of hooks never drops below 0 for good measure. This in theory should never happen, and if it does than there are problems somewhere - Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep - Drop variables which support home rolled read/write locking mechanism from the IPFW firewall chain structure. - Swap out the read/write firewall chain lock internal to use the rwlock(9) API instead of our home rolled version - Convert the inlined functions to macros Reviewed by: mlaier, andre, glebius Thanks to: jhb for the new locking API
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Add an additional struct inpcb * argument to pfil(9) in order to enablemlaier2004-09-291-4/+5
| | | | | | | | | | | | | | | | | | | passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in forseeable future. Suggested by: rwatson A lot of work by: csjp (he'd be even more helpful w/o mentor-reviews ;) Reviewed by: rwatson, csjp Tested by: -pf, -ipfw, LINT, csjp and myself MFC after: 3 days LOR IDs: 14 - 17 (not fixed yet)
* Include <sys/_lock.h>'s prerequisite <sys/queue.h> before including thebde2004-06-191-1/+1
| | | | | | former, not after. Don't hide this bug by including <sys/queue.h> in <sys/_lock.h>.
* o update PFIL_HOOKS support to current API used by netbsdsam2003-09-231-18/+50
| | | | | | | | | | | o revamp IPv4+IPv6+bridge usage to match API changes o remove pfil_head instances from protosw entries (no longer used) o add locking o bump FreeBSD version for 3rd party modules Heavy lifting by: "Max Laier" <max@love2party.net> Supported by: FreeBSD Foundation Obtained from: NetBSD (bits of pfil.h and pfil.c)
* Fixed some style bugs in the removal of __P(()). The main ones werebde2002-03-241-2/+1
| | | | | | not removing tabs before "__P((", and not outdenting continuation lines to preserve non-KNF lining up of code with parentheses. Switch to KNF formatting and/or rewrap the whole prototype in some cases.
* Remove __P.alfred2002-03-191-7/+7
|
* Remove extra memory region kept by "struct pfil_head pfil_head_t;".ru2001-10-221-1/+1
| | | | | | | Seems to be a typo for typedef, but we don't want this non-style(9) typedef anyway. PR: kern/31356
* Replace nonexistent !defined(_LKM) by !defined(KLD_MODULE)ache2000-08-011-1/+1
|
* Check IPFILTER (options IPFILTER generates) instead of NIPFILTERache2000-08-011-2/+2
|
* Nonexistent "ipfilter.h" -> "opt_ipfilter.h"ache2000-07-311-1/+1
| | | | Kernel 'make depend' fails otherwise
* Back out the previous change to the queue(3) interface.jake2000-05-261-2/+2
| | | | | | It was not discussed and should probably not happen. Requested by: msmith and others
* Change the way that the queue(3) structures are declared; don't assume thatjake2000-05-231-2/+2
| | | | | | | | the type argument to *_HEAD and *_ENTRY is a struct. Suggested by: phk Reviewed by: phk Approved by: mdodd
* Add pfil(9) subroutines and manpage from NetBSD.darrenr2000-05-101-0/+81
OpenPOWER on IntegriCloud