summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_fw2.c
Commit message (Collapse)AuthorAgeFilesLines
* Shorten text string for ip_fw2 dynamic rules zone by removing the wordrwatson2007-04-171-1/+1
| | | | | | | "zone", which is generally not present in zone names. This reduces the incidence of line-wrapping in "vmstat -z " using 80-column displays. MFC after: 3 days
* Since we switched to using monatomically increasing timestamps,julian2007-04-031-0/+9
| | | | | | | | they have been reported back to the userland as being in 1970. Add boot time to the timestamp to give the time in the scale of the 'current' real timescale. Not perfect if you change the time a lot but good enough to keep all the rules correct relative to each other correct in terms of time relative to "now".
* Include opt_ipdivert.h so that the message announcing ipfw correctlyalc2007-02-031-0/+1
| | | | describes the state of IPDIVERT.
* Remove two lines that somehow snuck back in after testing.julian2007-01-091-2/+0
| | | | ip is now an argument to the function ipfw_log()
* Prevent adding a rule with a nat action in case IPFIREWALL_NAT was not defined.piso2007-01-051-0/+4
| | | | Reviewed: luigi
* Wrap ipfw nat support in a new kernel config option namedpiso2007-01-031-1/+16
| | | | | | | "IPFIREWALL_NAT": this way nat is turned off by default and POLA is preserved. Reviewed by: rwatson
* Remove a bunch of dependencies in the IP header being the first thing in thejulian2007-01-021-57/+94
| | | | | | | | | mbuf. First moves toward being able to cope better with having layer 2 (or other encapsulation data) before the IP header in the packet being examined. More commits to come to round out this functionality. This commit should have no practical effect but clears the way for what is coming. Revirewed by: luigi, yar MFC After: 2 weeks
* Summer of Code 2005: improve libalias - part 2 of 2piso2006-12-291-2/+546
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With the second (and last) part of my previous Summer of Code work, we get: -ipfw's in kernel nat -redirect_* and LSNAT support General information about nat syntax and some examples are available in the ipfw (8) man page. The redirect and LSNAT syntax are identical to natd, so please refer to natd (8) man page. To enable in kernel nat in rc.conf, two options were added: o firewall_nat_enable: equivalent to natd_enable o firewall_nat_interface: equivalent to natd_interface Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet to continue being checked by the firewall ruleset after being (de)aliased. NOTA BENE: due to some problems with libalias architecture, in kernel nat won't work with TSO enabled nic, thus you have to disable TSO via ifconfig (ifconfig foo0 -tso). Approved by: glebius (mentor)
* MFp4: 92972, 98913 + one more changebz2006-12-121-4/+6
| | | | | | | In ip6_sprintf no longer use and return one of eight static buffers for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument.
* Add SCTP as a known upper layer protocol over v6.bz2006-11-131-0/+8
| | | | | | | | We are not yet aware of the protocol internals but this way SCTP traffic over v6 will not be discarded. Reported by: Peter Lei via rrs Tested by: Peter Lei <peterlei cisco.com>
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-1/+2
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+2
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* o Do not do args->f_id.addr_type == 6 when there ismaxim2006-10-111-2/+2
| | | | IS_IP6_FLOW_ID() exactly for that.
* o Kill a nit in the comment.maxim2006-10-111-1/+1
|
* o Extend not very informative ipfw(4) message 'drop session, too manymaxim2006-10-111-2/+32
| | | | | | | | | entries' by src:port and dst:port pairs. IPv6 part is non-functional as ``limit'' does not support IPv6 flows. PR: kern/103967 Submitted by: based on Bruce Campbell patch MFC after: 1 month
* Set scope on MC address so IPv6 carp advertisement will not get droppedbz2006-10-071-0/+11
| | | | | | | | | | | in ip6_output. In case this fails handle the error directly and log it[1]. In addition permit CARP over v6 in ip_fw2. PR: kern/98622 Similar patch by: suz Discussed with: glebius [1] Tested by: Paul.Dekkers surfnet.nl, Philippe.Pegon crc.u-strasbg.fr MFC after: 3 days
* Handle a list of IPv6 src and dst addresses correctly, eg.jhay2006-09-161-14/+17
| | | | | | | | ipfw add allow ip6 from any to 2000::/16,2002::/16 PR: 102422 (part 3) Submitted by: Andrey V. Elsukov <bu7cher at yandex dot ru> MFC after: 5 days
* Introduce a new entry point, mac_create_mbuf_from_firewall. This entry pointcsjp2006-09-121-5/+20
| | | | | | | | | | | | | | | | | | | | | | exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
* Recognise IPv6 PIM packets.jhay2006-08-311-0/+6
| | | | MFC after: 1 week
* comply with style policejulian2006-08-181-5/+8
| | | | | Submitted by: ru MFC after: 1 month
* Allow ipfw to forward to a destination that is specified by a table.julian2006-08-171-7/+23
| | | | | | | | | | | | | | | | | for example: fwd tablearg ip from any to table(1) where table 1 has entries of the form: 1.1.1.0/24 10.2.3.4 208.23.2.0/24 router2 This allows trivial implementation of a secondary routing table implemented in the firewall layer. I expect more work (under discussion with Glebius) to follow this to clean up some of the messy parts of ipfw related to tables. Reviewed by: Glebius MFC after: 1 month
* Remove useless NULL pointer check: we are using M_WAITOK flag for memoryoleg2006-08-041-4/+0
| | | | | | | | allocation. Submitted by: Andrey Elsukov <bu7cher at yandex dot ru> Approved by: glebius (mentor) MFC after: 1 week
* Do not leak memory while flushing rules.oleg2006-08-021-2/+3
| | | | | | Noticed by: yar Approved by: glebius (mentor) MFC after: 1 week
* There is a consensus that ifaddr.ifa_addr should never be NULL,yar2006-06-291-4/+0
| | | | | | | | | | except in places dealing with ifaddr creation or destruction; and in such special places incomplete ifaddrs should never be linked to system-wide data structures. Therefore we can eliminate all the superfluous checks for "ifa->ifa_addr != NULL" and get ready to the system crashing honestly instead of masking possible bugs. Suggested by: glebius, jhb, ru
* Use TAILQ_FOREACH consistently.yar2006-06-291-2/+1
|
* Eliminate the offset argument from send_reject. It's not beenbz2006-06-291-9/+7
| | | | | | | | used since FreeBSD-SA-06:04.ipfw. Adopt send_reject6 to what had been done for legacy IP: no longer send or permit sending rejects for any but the first fragment. Discussed with: oleg, csjp (some weeks ago)
* Use INPLOOKUP_WILDCARD instead of just 1 more consistently.bz2006-06-291-1/+1
| | | | OKed by: rwatson (some weeks ago)
* - Pullup even when the extention header is unknown, to preventume2006-06-221-1/+13
| | | | | | | | | | | infinite loop with net.inet6.ip6.fw.deny_unknown_exthdrs=0. - Teach ipv6 and ipencap as they appear in an IPv4/IPv6 over IPv6 tunnel. - Test the next extention header even when the routing header type is unknown with net.inet6.ip6.fw.deny_unknown_exthdrs=0. Found by: xcast-fan-club MFC after: 1 week
* Add support of 'tablearg' feature for:oleg2006-06-151-15/+30
| | | | | | | | | | | | | | | | | | | - 'tag' & 'untag' action parameters. - 'tagged' & 'limit' rule options. Rule examples: pipe 1 tag tablearg ip from table(1) to any allow ip from any to table(2) tagged tablearg allow tcp from table(3) to any 25 setup limit src-addr tablearg sbin/ipfw/ipfw2.c: 1) new macros GET_UINT_ARG - support of 'tablearg' keyword, argument range checking. PRINT_UINT_ARG - support of 'tablearg' keyword. 2) strtoport(): do not silently truncate/accept invalid port list expressions like: '1,2-abc' or '1,2-3-4' or '1,2-3x4'. style(9) cleanup. Approved by: glebius (mentor) MFC after: 1 month
* install_state(): style(9) cleanupoleg2006-06-151-33/+36
| | | | | Approved by: glebius (mentor) MFC after: 1 month
* install_state() should properly initialize 'addr_type' field of newly createdoleg2006-06-081-0/+1
| | | | | | | | | flows for O_LIMIT rules. Otherwise 'ipfw -d show' is unable to display PARENT rules properly. (This bug was exposed by ipfw2.c rev.1.90) Approved by: glebius (mentor) MFC after: 2 weeks
* Implement internal (i.e. inside kernel) packet tagging using mbuf_tags(9).oleg2006-05-241-1/+57
| | | | | | | | | | | Since tags are kept while packet resides in kernelspace, it's possible to use other kernel facilities (like netgraph nodes) for altering those tags. Submitted by: Andrey Elsukov <bu7cher at yandex dot ru> Submitted by: Vadim Goncharov <vadimnuclight at tpu dot ru> Approved by: glebius (mentor) Idea from: OpenBSD PF MFC after: 1 month
* Use only lower 64bit of src/dest (and src/dest port) for hashing of IPv6mlaier2006-05-141-4/+4
| | | | | | | | | | connections and get rid of the flow_id as it is not guaranteed to be stable some (most?) current implementations seem to just zero it out. PR: kern/88664 Reported by: jylefort Submitted by: Joost Bekkers (w/ changes) Tested by "regisr" <regisrApoboxDcom>
* Remove ip6fw. Since ipfw has full functional IPv6 support now and - inmlaier2006-05-121-1/+0
| | | | contrast to ip6fw - is properly lockes, it is time to retire ip6fw.
* Reintroduce net.inet6.ip6.fw.enable sysctl to dis/enable the ipv6 processingmlaier2006-05-121-8/+13
| | | | | | seperately. Also use pfil hook/unhook instead of keeping the check functions in pfil just to return there based on the sysctl. While here fix some whitespace on a nearby SYSCTL_ macro.
* Don't claim "(+ipv6)" if we didn't build with INET6.mlaier2006-05-111-1/+5
|
* - Do not leak read lock in IP_FW_TABLE_GETSIZE case of ipfw_ctl().glebius2006-03-031-7/+5
| | | | | | - Acquire read (not write) lock in case of IP_FW_TABLE_LIST. In collaboration with: ru
* Use PFIL_HOOKED macros in if_bridge and pass the right argument tocsjp2006-02-021-1/+1
| | | | | | | rw_assert. This un-breaks the build. Submitted by: Kostik Belousov Pointy hat to: csjp
* Somewhat re-factor the read/write locking mechanism associated with the packetcsjp2006-02-021-45/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filtering mechanisms to use the new rwlock(9) locking API: - Drop the variables stored in the phil_head structure which were specific to conditions and the home rolled read/write locking mechanism. - Drop some includes which were used for condition variables - Drop the inline functions, and convert them to macros. Also, move these macros into pfil.h - Move pfil list locking macros intp phil.h as well - Rename ph_busy_count to ph_nhooks. This variable will represent the number of IN/OUT hooks registered with the pfil head structure - Define PFIL_HOOKED macro which evaluates to true if there are any hooks to be ran by pfil_run_hooks - In the IP/IP6 stacks, change the ph_busy_count comparison to use the new PFIL_HOOKED macro. - Drop optimization in pfil_run_hooks which checks to see if there are any hooks to be ran, and returns if not. This check is already performed by the IP stacks when they call: if (!PFIL_HOOKED(ph)) goto skip_hooks; - Drop in assertion which makes sure that the number of hooks never drops below 0 for good measure. This in theory should never happen, and if it does than there are problems somewhere - Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep - Drop variables which support home rolled read/write locking mechanism from the IPFW firewall chain structure. - Swap out the read/write firewall chain lock internal to use the rwlock(9) API instead of our home rolled version - Convert the inlined functions to macros Reviewed by: mlaier, andre, glebius Thanks to: jhb for the new locking API
* Fix minor bug in uRPF:oleg2006-01-241-2/+8
| | | | | | | | | | | If net.link.ether.inet.useloopback=1 and we send broadcast packet using our own source ip address it may be rejected by uRPF rules. Same bug was fixed for IPv6 in rev. 1.115 by suz. PR: kern/76971 Approved by: glebius (mentor) MFC after: 3 days
* - Change the return type for init_tables from void to int so we can propagatecsjp2006-01-201-10/+25
| | | | | | | | | | | | | | | | | errors from rn_inithead back to the ipfw initialization function. - Check return value of rn_inithead for failure, if table allocation has failed for any reason, free up any tables we have created and return ENOMEM - In ipfw_init check the return value of init_tables and free up any mutexes or UMA zones which may have been created. - Assert that the supplied table is not NULL before attempting to dereference. This fixes panics which were a result of invalid memory accesses due to failed table allocation. This is an issue mainly because the R_Zalloc function is a malloc(M_NOWAIT) wrapper, thus making it possible for allocations to fail. Found by: Coverity Prevent (tm) Coverity ID: CID79 MFC after: 1 week
* Destroy the dynamic rule zone in the event that we fail to insert thecsjp2006-01-201-0/+1
| | | | | | initial default rule. MFC after: 1 week
* Correct insecure temporary file usage in texindex. [06:01]cperciva2006-01-111-1/+1
| | | | | | | | | | | | | | Correct insecure temporary file usage in ee. [06:02] Correct a race condition when setting file permissions, sanitize file names by default, and fix a buffer overflow when handling files larger than 4GB in cpio. [06:03] Fix an error in the handling of IP fragments in ipfw which can cause a kernel panic. [06:04] Security: FreeBSD-SA-06:01.texindex Security: FreeBSD-SA-06:02.ee Security: FreeBSD-SA-06:03.cpio Security: FreeBSD-SA-06:04.ipfw
* Cleanup __FreeBSD_version.glebius2005-12-161-5/+0
|
* Add a new feature for optimizining ipfw rulesets - substitution of theglebius2005-12-131-5/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | action argument with the value obtained from table lookup. The feature is now applicable only to "pipe", "queue", "divert", "tee", "netgraph" and "ngtee" rules. An example usage: ipfw pipe 1000 config bw 1000Kbyte/s ipfw pipe 4000 config bw 4000Kbyte/s ipfw table 1 add x.x.x.x 1000 ipfw table 1 add x.x.x.y 4000 ipfw pipe tablearg ip from table(1) to any In the example above the rule will throw different packets to different pipes. TODO: - Support "skipto" action, but without searching all rules. - Improve parser, so that it warns about bad rules. These are: - "tablearg" argument to action, but no "table" in the rule. All traffic will be blocked. - "tablearg" argument to action, but "table" searches for entry with a specific value. All traffic will be blocked. - "tablearg" argument to action, and two "table" looks - for src and for dst. The last lookup will match.
* Optimize parallel processing of ipfw(4) rulesets eliminating the lockingglebius2005-12-061-71/+54
| | | | | | | | | | | | | | | | | | | | | of the radix lookup tables. Since several rnh_lookup() can run in parallel on the same table, we can piggyback on the shared locking provided by ipfw(4). However, the single entry cache in the ip_fw_table can't be used lockless, so it is removed. This pessimizes two cases: processing of bursts of similar packets and matching one packet against the same table several times during one ipfw_chk() lookup. To optimize the processing of similar packet bursts administrator should use stateful firewall. To optimize the second problem a solution will be provided soon. Details: o Since we piggyback on the ipfw(4) locking, and the latter is per-chain, the tables are moved from the global declaration to the struct ip_fw_chain. o The struct ip_fw_table is shrunk to one entry and thus vanished. o All table manipulating functions are extended to accept the struct ip_fw_chain * argument. o All table modifing functions use IPFW_WLOCK_ASSERT().
* obey opt_inet6.h and opt_ipsec.h in kernel build directory.ume2005-11-291-2/+2
| | | | Requested by: hrs
* Garbage-collect now unused struct _ipfw_insn_pipe and flush_pipe_ptrs(),glebius2005-11-291-29/+1
| | | | | thus removing a few XXXes. Document the ABI breakage in UPDATING.
* fixed a bug that uRPF does not work properly for an IPv6 packet bound for ↵suz2005-11-101-2/+8
| | | | | | | the sending machine itself (this is a bug introduced due to a change in ip6_input.c:Rev.1.83) Pointed out by: Sean McNeil and J.R.Oldroyd MFC after: 3 days
* Retire MT_HEADER mbuf type and change its users to use MT_DATA.andre2005-11-021-1/+1
| | | | | | | | | | | | Having an additional MT_HEADER mbuf type is superfluous and redundant as nothing depends on it. It only adds a layer of confusion. The distinction between header mbuf's and data mbuf's is solely done through the m->m_flags M_PKTHDR flag. Non-native code is not changed in this commit. For compatibility MT_HEADER is mapped to MT_DATA. Sponsored by: TCP/IP Optimization Fundraise 2005
OpenPOWER on IntegriCloud