summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_fastfwd.c
Commit message (Collapse)AuthorAgeFilesLines
* In IPv4 fast forwarding path, send ICMP unreachable messages forbms2007-03-181-1/+2
| | | | | | | | routes which have RTF_REJECT set *and* a zero expiry timer. PR: kern/109246 MFC after: 10 days Submitted by: Ingo Flaschberger
* When fast-forwarding is enabled, do not forward directed IPv4 broadcastsbms2007-02-051-2/+4
| | | | | | | | | | to locally attached broadcast networks. Note well: This relies on the layer 2 route cloning behaviour in BSD. PR: 98799 Tested by: Dmitry Sergienko MFC after: 1 week
* In fast forwarding path, defer processing of 169.254.0.0/16bms2007-02-031-0/+2
| | | | to ip_input(). See RFC 3927 section 2.7.
* Remove the IPFIREWALL_FORWARD_EXTENDED option and make it on by default as ↵julian2006-08-171-5/+1
| | | | | | | | | | | | | | | it always was in older versions of FreeBSD. This option is pointless as it is needed in just about every interesting usage of forward that I have ever seen. It doesn't make the system any safer and just wastes huge amounts of develper time when the system doesn't behave as expected when code is moved from 4.x to 6.x It doesn't make the system any safer and just wastes huge amounts of develper time when the system doesn't behave as expected when code is moved from 4.x to 6.x or 7.x Reviewed by: glebius MFC after: 1 week
* Merge rev. 1.240 of ip_output.c, so that IPFIREWALL_FORWARD_EXTENDEDglebius2006-04-181-2/+6
| | | | kernel option will affect both forwarding methods - classic and fast.
* Somewhat re-factor the read/write locking mechanism associated with the packetcsjp2006-02-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filtering mechanisms to use the new rwlock(9) locking API: - Drop the variables stored in the phil_head structure which were specific to conditions and the home rolled read/write locking mechanism. - Drop some includes which were used for condition variables - Drop the inline functions, and convert them to macros. Also, move these macros into pfil.h - Move pfil list locking macros intp phil.h as well - Rename ph_busy_count to ph_nhooks. This variable will represent the number of IN/OUT hooks registered with the pfil head structure - Define PFIL_HOOKED macro which evaluates to true if there are any hooks to be ran by pfil_run_hooks - In the IP/IP6 stacks, change the ph_busy_count comparison to use the new PFIL_HOOKED macro. - Drop optimization in pfil_run_hooks which checks to see if there are any hooks to be ran, and returns if not. This check is already performed by the IP stacks when they call: if (!PFIL_HOOKED(ph)) goto skip_hooks; - Drop in assertion which makes sure that the number of hooks never drops below 0 for good measure. This in theory should never happen, and if it does than there are problems somewhere - Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep - Drop variables which support home rolled read/write locking mechanism from the IPFW firewall chain structure. - Swap out the read/write firewall chain lock internal to use the rwlock(9) API instead of our home rolled version - Convert the inlined functions to macros Reviewed by: mlaier, andre, glebius Thanks to: jhb for the new locking API
* Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointerandre2006-01-181-18/+18
| | | | | | | | | | | may have changed by m_pullup() during fastforward processing. While this is a bug it is actually never triggered in real world situations and it is not remotely exploitable. Found by: Coverity Prevent(tm) Coverity ID: CID780 Sponsored by: TCP/IP Optimization Fundraise 2005
* Consolidate all IP Options handling functions into ip_options.[ch] andandre2005-11-181-0/+1
| | | | | | | | | | | | | | | | | | | | include ip_options.h into all files making use of IP Options functions. From ip_input.c rev 1.306: ip_dooptions(struct mbuf *m, int pass) save_rte(m, option, dst) ip_srcroute(m0) ip_stripoptions(m, mopt) From ip_output.c rev 1.249: ip_insertoptions(m, opt, phlen) ip_optcopy(ip, jp) ip_pcbopts(struct inpcb *inp, int optname, struct mbuf *m) No functional changes in this commit. Discussed with: rwatson Sponsored by: TCP/IP Optimization Fundraise 2005
* Use monotonic 'time_uptime' instead of 'time_second' as timebaseandre2005-09-191-1/+1
| | | | for rt->rt_rmx.rmx_expire.
* Handle pure layer 2 broad- and multicasts properly and simplify relatedandre2005-08-221-19/+3
| | | | | | | | checks. PR: kern/85052 Submitted by: Dmitrij Tejblum <tejblum at yandex-team.ru> MFC after: 3 days
* Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE andrwatson2005-08-091-1/+1
| | | | | | | | | | | | | | IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to ifnet.if_drv_flags. Device drivers are now responsible for synchronizing access to these flags, as they are in if_drv_flags. This helps prevent races between the network stack and device driver in maintaining the interface flags field. Many __FreeBSD__ and __FreeBSD_version checks maintained and continued; some less so. Reviewed by: pjd, bz MFC after: 7 days
* Misc spelling and/or English fixes in comments.keramida2005-07-231-12/+12
| | | | Reviewed by: glebius, andre
* Pass icmp_error() the MTU argument directly instead ofandre2005-05-041-6/+6
| | | | | an interface pointer. This simplifies a couple of uses and removes some XXX workarounds.
* - Don't free mbuf, passed to interface output method if the latterglebius2005-03-291-2/+1
| | | | | | | | | | returns error. In this case mbuf has already been freed. [1] - Remove redundant declaration. PR: kern/78893 [1] Submitted by: Liang Yi [1] Reviewed by: sam MFC after: 1 day
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Fix a double-free in the 'hlen > m->m_len' sanity check.andre2004-11-091-1/+1
| | | | | Bug report by: <james@towardex.com> MFC after: 2 weeks
* Fix a double-free in the 'm->m_len < sizeof (struct ip)' sanity check.andre2004-11-061-2/+2
| | | | | Bug report by: <james@towardex.com> MFC after: 2 weeks
* When performing IP fast forwarding, immediately drop traffic which isbms2004-11-041-0/+6
| | | | | | | | | | | destined for a blackhole route. This also means that blackhole routes do not need to be bound to lo(4) or disc(4) interfaces for the net.inet.ip.fastforwarding=1 case. Submitted by: james at towardex dot com Sponsored by: eXtensible Open Router Project <URL:http://www.xorp.org/> MFC after: 3 weeks
* Make comments more clear. Change the order of one if() statement to check theandre2004-10-191-3/+8
| | | | more likely variable first.
* Add an additional struct inpcb * argument to pfil(9) in order to enablemlaier2004-09-291-2/+2
| | | | | | | | | | | | | | | | | | | passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in forseeable future. Suggested by: rwatson A lot of work by: csjp (he'd be even more helpful w/o mentor-reviews ;) Reviewed by: rwatson, csjp Tested by: -pf, -ipfw, LINT, csjp and myself MFC after: 3 days LOR IDs: 14 - 17 (not fixed yet)
* Fix ip_input() fallback for the destination modified cases (from the packetandre2004-09-131-6/+4
| | | | | | | | | filters). After the ipfw to pfil move ip_input() expects M_FASTFWD_OURS tagged packets to have ip_len and ip_off in host byte order instead of network byte order. PR: kern/71652 Submitted by: mlaier (patch)
* Remove a junk line left over from the recent IPFW to PFIL_HOOKS conversion.andre2004-08-271-1/+0
|
* Always compile PFIL_HOOKS into the kernel and remove the associated kernelandre2004-08-271-5/+9
| | | | | | | | | | | compile option. All FreeBSD packet filters now use the PFIL_HOOKS API and thus it becomes a standard part of the network stack. If no hooks are connected the entire packet filter hooks section and related activities are jumped over. This removes any performance impact if no hooks are active. Both OpenBSD and DragonFlyBSD have integrated PFIL_HOOKS permanently as well.
* Convert ipfw to use PFIL_HOOKS. This is change is transparent to userlandandre2004-08-171-200/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and preserves the ipfw ABI. The ipfw core packet inspection and filtering functions have not been changed, only how ipfw is invoked is different. However there are many changes how ipfw is and its add-on's are handled: In general ipfw is now called through the PFIL_HOOKS and most associated magic, that was in ip_input() or ip_output() previously, is now done in ipfw_check_[in|out]() in the ipfw PFIL handler. IPDIVERT is entirely handled within the ipfw PFIL handlers. A packet to be diverted is checked if it is fragmented, if yes, ip_reass() gets in for reassembly. If not, or all fragments arrived and the packet is complete, divert_packet is called directly. For 'tee' no reassembly attempt is made and a copy of the packet is sent to the divert socket unmodified. The original packet continues its way through ip_input/output(). ipfw 'forward' is done via m_tag's. The ipfw PFIL handlers tag the packet with the new destination sockaddr_in. A check if the new destination is a local IP address is made and the m_flags are set appropriately. ip_input() and ip_output() have some more work to do here. For ip_input() the m_flags are checked and a packet for us is directly sent to the 'ours' section for further processing. Destination changes on the input path are only tagged and the 'srcrt' flag to ip_forward() is set to disable destination checks and ICMP replies at this stage. The tag is going to be handled on output. ip_output() again checks for m_flags and the 'ours' tag. If found, the packet will be dropped back to the IP netisr where it is going to be picked up by ip_input() again and the directly sent to the 'ours' section. When only the destination changes, the route's 'dst' is overwritten with the new destination from the forward m_tag. Then it jumps back at the route lookup again and skips the firewall check because it has been marked with M_SKIP_FIREWALL. ipfw 'forward' has to be compiled into the kernel with 'option IPFIREWALL_FORWARD' to enable it. DUMMYNET is entirely handled within the ipfw PFIL handlers. A packet for a dummynet pipe or queue is directly sent to dummynet_io(). Dummynet will then inject it back into ip_input/ip_output() after it has served its time. Dummynet packets are tagged and will continue from the next rule when they hit the ipfw PFIL handlers again after re-injection. BRIDGING and IPFW_ETHER are not changed yet and use ipfw_chk() directly as they did before. Later this will be changed to dedicated ETHER PFIL_HOOKS. More detailed changes to the code: conf/files Add netinet/ip_fw_pfil.c. conf/options Add IPFIREWALL_FORWARD option. modules/ipfw/Makefile Add ip_fw_pfil.c. net/bridge.c Disable PFIL_HOOKS if ipfw for bridging is active. Bridging ipfw is still directly invoked to handle layer2 headers and packets would get a double ipfw when run through PFIL_HOOKS as well. netinet/ip_divert.c Removed divert_clone() function. It is no longer used. netinet/ip_dummynet.[ch] Neither the route 'ro' nor the destination 'dst' need to be stored while in dummynet transit. Structure members and associated macros are removed. netinet/ip_fastfwd.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. netinet/ip_fw.h Removed 'ro' and 'dst' from struct ip_fw_args. netinet/ip_fw2.c (Re)moved some global variables and the module handling. netinet/ip_fw_pfil.c New file containing the ipfw PFIL handlers and module initialization. netinet/ip_input.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. ip_forward() does not longer require the 'next_hop' struct sockaddr_in argument. Disable early checks if 'srcrt' is set. netinet/ip_output.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. netinet/ip_var.h Add ip_reass() as general function. (Used from ipfw PFIL handlers for IPDIVERT.) netinet/raw_ip.c Directly check if ipfw and dummynet control pointers are active. netinet/tcp_input.c Rework the 'ipfw forward' to local code to work with the new way of forward tags. netinet/tcp_sack.c Remove include 'opt_ipfw.h' which is not needed here. sys/mbuf.h Remove m_claim_next() macro which was exclusively for ipfw 'forward' and is no longer needed. Approved by: re (scottl)
* Make use of in_localip() function and replace previous direct LIST_FOREACHandre2004-08-111-45/+39
| | | | loops over INADDR_HASH.
* Only check for local broadcast addresses if the mbuf is flagged with M_BCAST.andre2004-08-111-1/+2
|
* Make IP fastforwarding ALTQ-aware by adding the input traffic conditionerandre2004-08-111-0/+10
| | | | check and disabling the early output interface queue length check.
* Those are unneeded too.pjd2004-06-271-1/+0
|
* Add two missing includes and remove two uneeded.pjd2004-06-271-1/+0
| | | | | This is quite serious fix, because even with MAC framework compiled in, MAC entry points in those two files were simply ignored.
* Provide the sysctl net.inet.ip.process_options to control the processingandre2004-05-061-2/+10
| | | | | | | | | | | | | | | | | | of IP options. net.inet.ip.process_options=0 Ignore IP options and pass packets unmodified. net.inet.ip.process_options=1 Process all IP options (default). net.inet.ip.process_options=2 Reject all packets with IP options with ICMP filter prohibited message. This sysctl affects packets destined for the local host as well as those only transiting through the host (routing). IP options do not have any legitimate purpose anymore and are only used to circumvent firewalls or to exploit certain behaviours or bugs in TCP/IP stacks. Reviewed by: sam (mentor)
* Back out a change that slipped into the previous commit for which otherandre2004-05-031-10/+2
| | | | | | supporting parts have not yet been committed. Remove pre-mature IP options ignoring option.
* Optimize IP fastforwarding some more:andre2004-05-031-95/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | o New function ip_findroute() to reduce code duplication for the route lookup cases. (luigi) o Store ip_len in host byte order on the stack instead of using it via indirection from the mbuf. This allows to defer the host byte conversion to a later point and makes a quicker fallback to normal ip_input() processing. (luigi) o Check if route is dampned with RTF_REJECT flag and drop packet already here when ARP is unable to resolve destination address. An ICMP unreachable is sent to inform the sender. o Check if interface output queue is full and drop packet already here. No ICMP notification is sent because signalling source quench is depreciated. o Check if media_state is down (used for ethernet type interfaces) and drop the packet already here. An ICMP unreachable is sent to inform the sender. o Do not account sent packets to the interface address counters. They are only for packets with that 'ia' as source address. o Update and clarify some comments. Submitted by: luigi (most of it)
* Re-remove MT_TAGs. The problems with dummynet have been fixed now.mlaier2004-02-251-80/+32
| | | | | Tested by: -current, bms(mentor), me Approved by: bms(mentor), sam
* Backout MT_TAG removal (i.e. bring back MT_TAGs) for now, as dummynet ismlaier2004-02-181-18/+67
| | | | | | not working properly with the patch in place. Approved by: bms(mentor)
* This set of changes eliminates the use of MT_TAG "pseudo mbufs", replacingmlaier2004-02-131-67/+18
| | | | | | | | | | | them mostly with packet tags (one case is handled by using an mbuf flag since the linkage between "caller" and "callee" is direct and there's no need to incur the overhead of a packet tag). This is (mostly) work from: sam Silence from: -arch Approved by: bms(mentor), sam, rwatson
* Catch a few places where NULL (pointer) was used where 0 (integer) waspeter2003-12-231-5/+4
| | | | expected.
* Remove RTF_PRCLONING from routing table and adjust users of itandre2003-11-201-2/+2
| | | | | | | | | | | | accordingly. The define is left intact for ABI compatibility with userland. This is a pre-step for the introduction of tcp_hostcache. The network stack remains fully useable with this change. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Make two casts correct for all types of 64bit platforms.andre2003-11-161-2/+2
| | | | Explained by: bde
* Correct a cast to make it compile on 64bit platforms (noticed by tinderbox)andre2003-11-151-6/+6
| | | | | | | | and remove two unneccessary variable initializations. Make the introduction comment more clear with regard which parts of the packet are touched. Requested by: luigi
* Introduce ip_fastforward and remove ip_flow.andre2003-11-141-0/+806
Short description of ip_fastforward: o adds full direct process-to-completion IPv4 forwarding code o handles ip fragmentation incl. hw support (ip_flow did not) o sends icmp needfrag to source if DF is set (ip_flow did not) o supports ipfw and ipfilter (ip_flow did not) o supports divert, ipfw fwd and ipfilter nat (ip_flow did not) o returns anything it can't handle back to normal ip_input Enable with sysctl -w net.inet.ip.fastforwarding=1 Reviewed by: sam (mentor)
OpenPOWER on IntegriCloud