summaryrefslogtreecommitdiffstats
path: root/sys/netinet/libalias/alias_db.c
Commit message (Collapse)AuthorAgeFilesLines
* Remove LIBALIAS_LOCK_ASSERT(), including a couple with an uninitialzedglebius2013-03-111-6/+1
| | | | | | | argument, in code that isn't compiled in kernel. PR: kern/176667 Sponsored by: Nginx, Inc.
* Export AddLink() function from libalias. It can be used when customae2011-06-221-18/+6
| | | | | | | | | | | alias address needs to be specified. Add inbound handler to the alias_ftp module. It helps handle active FTP transfer mode for the case with external clients and FTP server behind NAT. Fix passive FTP transfer case for server behind NAT using redirect with external IP address different from NAT ip address. PR: kern/157957 Submitted by: Alexander V. Chernikov
* LibAliasInit() should allocate memory with M_WAITOK flag. Modify itglebius2011-04-181-0/+5
| | | | and its callers.
* Don't use struct timezone.ed2010-08-081-4/+2
| | | | | The timezone structure acquired by gettimeofday() is not used at all. Just remove it.
* Remove extraneous semicolons, no functional changes.mbr2010-01-071-1/+1
| | | | | Submitted by: Marc Balmer <marc@msys.ch> MFC after: 1 week
* Add SCTP NAT support.piso2009-02-071-2/+59
|\ | | | | | | Submitted by: CAIA (http://caia.swin.edu.au)
| * Import sctp nat support in ipfw obtained from CAIA - http://caia.swin.edu.au.piso2008-12-281-6/+106
|/
* Conditionally compile out V_ globals while instantiating the appropriatezec2008-12-101-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | container structures, depending on VIMAGE_GLOBALS compile time option. Make VIMAGE_GLOBALS a new compile-time option, which by default will not be defined, resulting in instatiations of global variables selected for V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be effectively compiled out. Instantiate new global container structures to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0, vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0. Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_ macros resolve either to the original globals, or to fields inside container structures, i.e. effectively #ifdef VIMAGE_GLOBALS #define V_rt_tables rt_tables #else #define V_rt_tables vnet_net_0._rt_tables #endif Update SYSCTL_V_*() macros to operate either on globals or on fields inside container structs. Extend the internal kldsym() lookups with the ability to resolve selected fields inside the virtualization container structs. This applies only to the fields which are explicitly registered for kldsym() visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently this is done only in sys/net/if.c. Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code, and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in turn result in proper code being generated depending on VIMAGE_GLOBALS. De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c which were prematurely V_irtualized by automated V_ prepending scripts during earlier merging steps. PF virtualization will be done separately, most probably after next PF import. Convert a few variable initializations at instantiation to initialization in init functions, most notably in ipfw. Also convert TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in initializer functions. Discussed at: devsummit Strassburg Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Improve the entropy of the source port randomization for network addresscsjp2008-08-301-6/+6
| | | | | | | | | translation. It turns out this is useful for applications which require source port randomization for security (i.e. dns servers). Discussed with: secteam Requested by: mlaier MFC after: 2 weeks
* Partially revert previous commit. DeleteLink() does not deletes permanentmav2008-06-221-1/+5
| | | | | links so we should be aware of it and try to delete every link only once or we will loop forever.
* Increase LINK_TABLE_OUT_SIZE from 101 to 4001 like LINK_TABLE_IN_SIZEmav2008-06-011-67/+22
| | | | | | | | | | | | | to reduce performance degradation under heavy outgoing scan/flood. Scalability is now much more important then several kilobytes of RAM. Remove unneded TCP-specific expiration handeling. Before this connected TCP sessions could never expire. Now connected TCP sessions will expire after 24hours of inactivity. Simplify HouseKeeping() to avoid several mul/div-s per packet. Taking into account increased LINK_TABLE_OUT_SIZE, precision is still much more then required.
* MFP4:piso2008-03-061-23/+11
| | | | | | restrict the utilization of direct pointers to the content of ip packet. These modifications are functionally nop()s thus can be merged with no side effects.
* Silence Coverity about an unused variable.piso2007-04-071-1/+1
| | | | | | | Reviewed by: glebius Approved by: glebius (mentor) MFC after: 3 days CID: 538
* o made in kernel libalias mpsafepiso2006-12-151-16/+116
| | | | | | | | o fixed a comment o made in kernel libalias a bit less verbose (disabled automatic logging everytime a new link is added or deleted) Approved by: glebius (mentor)
* Summer of Code 2005: improve libalias - part 1 of 2piso2006-09-261-66/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the first part of my previous Summer of Code work, we get: -made libalias modular: -support for 'particular' protocols (like ftp/irc/etcetc) is no more hardcoded inside libalias, but it's available through external modules loadable at runtime -modules are available both in kernel (/boot/kernel/alias_*.ko) and user land (/lib/libalias_*) -protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp, skinny and smedia -added logging support for kernel side -cleanup After a buildworld, do a 'mergemaster -i' to install the file libalias.conf in /etc or manually copy it. During startup (and after every HUP signal) user land applications running the new libalias will try to read a file in /etc called libalias.conf: that file contains the list of modules to load. User land applications affected by this commit are ppp and natd: if libalias.conf is present in /etc you won't notice any difference. The only kernel land bit affected by this commit is ng_nat: if you are using ng_nat, and it doesn't correctly handle ftp/irc/etcetc sessions anymore, remember to kldload the correspondent module (i.e. kldload alias_ftp). General information and details about the inner working are available in the libalias man page under the section 'MODULAR ARCHITECTURE (AND ipfw(4) SUPPORT)'. NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat support will be part of the next libalias-related commit. Approved by: glebius Reviewed by: glebius, ru
* Use monotonic 'time_uptime' instead of 'time_second' as timebaseandre2005-09-191-3/+3
| | | | for timeouts.
* s/DEBUG/LIBALIAS_DEBUG/, since DEBUG is defined in LINT andglebius2005-05-061-14/+14
| | | | not supported for kernel build.
* Things required to build libalias as kernel module:glebius2005-05-051-0/+61
| | | | | | | | | | | - kernel module declarations and handler. - macros to map malloc(3) calls to malloc(9) ones. - malloc(9) declarations. - call finishoff() from module handler MOD_UNLOAD case instead of atexit(3). - use panic(9) instead of abort(3) - take time from time_second instead of gettimeofday(2) - define INADDR_NONE
* Add NO_USE_SOCKETS knob, which cuts off functionality socket binding.glebius2005-05-051-7/+16
|
* Add NO_LOGGING knob, which cuts off functionality of debug logging to a file.glebius2005-05-051-14/+15
|
* Play with includes so that libalias can be compiled both as userlandglebius2005-05-051-9/+23
| | | | library and kernel module.
* Cleanup IPFW2 ifdefs.glebius2005-05-041-58/+0
|
* Introduce inline {ip,udp,tcp}_next() functions which take a pointer to andes2004-07-061-3/+3
| | | | | | | {ip,udp,tcp} header and return a void * pointing to the payload (i.e. the first byte past the end of the header and any required padding). Use them consistently throughout libalias to a) reduce code duplication, b) improve code legibility, c) get rid of a bunch of alignment warnings.
* Make libalias WARNS?=6-clean. This mostly involves renaming variablesdes2004-07-051-379/+383
| | | | | | | | | named link, foo_link or link_foo to lnk, foo_lnk or lnk_foo, fixing signed / unsigned comparisons, and shoving unused function arguments under the carpet. I was hoping WARNS?=6 might reveal more serious problems, and perhaps the source of the -O2 breakage, but found no smoking gun.
* Parenthesize return values.des2004-07-051-24/+24
|
* Mechanical whitespace cleanup.des2004-07-051-60/+60
|
* Run through indent(1) so I can read the code without getting a headache.des2004-03-161-1710/+1580
| | | | | The result isn't quite knf, but it's knfer than the original, and far more consistent.
* Mostly mechanical rework of libalias:phk2004-01-171-391/+347
| | | | | | | | | | | | Makes it possible to have multiple packet aliasing instances in a single process by moving all static and global variables into an instance structure called "struct libalias". Redefine a new API based on s/PacketAlias/LibAlias/g Add new "instance" argument to all functions in the new API. Implement old API in terms of the new API.
* Add Cisco Skinny Station protocol support to libalias, natd, and ppp.marcus2003-09-231-0/+8
| | | | | | | | | | | | | | | Skinny is the protocol used by Cisco IP phones to talk to Cisco Call Managers. With this code, one can use a Cisco IP phone behind a FreeBSD NAT gateway. Currently, having the Call Manager behind the NAT gateway is not supported. More information on enabling Skinny support in libalias, natd, and ppp can be found in those applications' manpages. PR: 55843 Reviewed by: ru Approved by: ru MFC after: 30 days
* Fixed -Wpointer-arith warning.ru2003-09-091-1/+1
| | | | | Submitted by: Stefan Farfeleder PR: bin/56653
* A new API function PacketAliasRedirectDynamic() can be usedru2003-06-011-0/+15
| | | | | to mark a fully specified static link as dynamic; i.e. make it a one-time link.
* Make the PacketAliasSetAddress() function call optional. If itru2003-06-011-6/+10
| | | | | | is not called, and no static rules match an outgoing packet, the latter retains its source IP address. This is in support of the "static NAT only" mode.
* Move IPFW2 definition before including ip_fw.hluigi2002-07-181-32/+30
| | | | Make indentation of new parts consistent with the style used for this file.
* Fix a bug caused by dereferencing an invalid pointer whenluigi2002-07-081-62/+65
| | | | | | | | | no punch_fw was used. Fix another couple of bugs which prevented rules from being installed properly. On passing, use IPFW2 instead of NEW_IPFW to compile the new code, and slightly simplify the instruction generation code.
* Remove trailing whitespacebrian2002-07-011-35/+35
|
* The new ipfw code.luigi2002-06-271-0/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code makes use of variable-size kernel representation of rules (exactly the same concept of BPF instructions, as used in the BSDI's firewall), which makes firewall operation a lot faster, and the code more readable and easier to extend and debug. The interface with the rest of the system is unchanged, as witnessed by this commit. The only extra kernel files that I am touching are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In userland I only had to touch those programs which manipulate the internal representation of firewall rules). The code is almost entirely new (and I believe I have written the vast majority of those sections which were taken from the former ip_fw.c), so rather than modifying the old ip_fw.c I decided to create a new file, sys/netinet/ip_fw2.c . Same for the user interface, which is in sbin/ipfw/ipfw2.c (it still compiles to /sbin/ipfw). The old files are still there, and will be removed in due time. I have not renamed the header file because it would have required touching a one-line change to a number of kernel files. In terms of user interface, the new "ipfw" is supposed to accepts the old syntax for ipfw rules (and produce the same output with "ipfw show". Only a couple of the old options (out of some 30 of them) has not been implemented, but they will be soon. On the other hand, the new code has some very powerful extensions. First, you can put "or" connectives between match fields (and soon also between options), and write things like ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any This should make rulesets slightly more compact (and lines longer!), by condensing 2 or more of the old rules into single ones. Also, as an example of how easy the rules can be extended, I have implemented an 'address set' match pattern, where you can specify an IP address in a format like this: 10.20.30.0/26{18,44,33,22,9} which will match the set of hosts listed in braces belonging to the subnet 10.20.30.0/26 . The match is done using a bitmap, so it is essentially a constant time operation requiring a handful of CPU instructions (and a very small amount of memmory -- for a full /24 subnet, the instruction only consumes 40 bytes). Again, in this commit I have focused on functionality and tried to minimize changes to the other parts of the system. Some performance improvement can be achieved with minor changes to the interface of ip_fw_chk_t. This will be done later when this code is settled. The code is meant to compile unmodified on RELENG_4 (once the PACKET_TAG_* changes have been merged), for this reason you will see #ifdef __FreeBSD_version in a couple of places. This should minimize errors when (hopefully soon) it will be time to do the MFC.
* cmott@scientech.com -> cm@linktel.netbrian2001-11-031-1/+1
| | | | Requested by: Charles Mott <cmott@scientech.com>
* Add __FBSDID's to libaliasdillon2001-09-301-2/+3
|
* Make the copyright consistent.brian2001-08-201-3/+0
| | | | Previously approved by: Charles Mott <cmott@scientech.com>
* Add BSD-style copyright headersbrian2001-06-041-3/+31
| | | | Approved by: Charles Mott <cmott@scientech.com>
* Add an integer field to keep protocol-specific flags with links.ru2001-05-301-9/+7
| | | | | | | | | | For FTP control connection, keep the CRLF end-of-line termination status in there. Fixed the bug when the first FTP command in a session was ignored. PR: 24048 MFC after: 1 week
* Make header files conform to style(9).brian2001-03-251-6/+8
| | | | | | Reviewed by (*): bde (*) alias_local.h only got a cursory glance.
* Added boolean argument to link searching functions, indicatingru2000-10-301-73/+14
| | | | whether they should create a link if lookup has failed or not.
* A significant rewrite of PPTP aliasing code.ru2000-10-301-56/+111
| | | | | | | | | | | | | | PPTP links are no longer dropped by simple (and inappropriate in this case) "inactivity timeout" procedure, only when requested through the control connection. It is now possible to have multiple PPTP servers running behind NAT. Just redirect the incoming TCP traffic to port 1723, everything else is done transparently. Problems were reported and the fix was tested by: Michael Adler <Michael.Adler@compaq.com>, David Andersen <dga@lcs.mit.edu>
* A failure to allocate memory for auxiliary TCP data is now fatal.ru2000-10-191-16/+15
| | | | | This fixes a null pointer dereference problem that is unlikely to happen in normal circumstances.
* Create aliasing links for incoming ICMP echo/timestamp requests.ru2000-08-311-1/+14
| | | | | This makes outgoing ICMP echo/timestamp replies to be de-aliased with the right source IP, not exactly the primary aliasing IP.
* Fixed PunchFW code segmentation violation bug.ru2000-08-141-5/+4
| | | | Reported by: Christian Schade <chris@cube.sax.de>
* Use queue(3) LIST_* macros for doubly-linked lists.ru2000-08-141-65/+18
|
* Add address translation support for RTSP/RTP used by RealPlayer andarchie2000-07-261-0/+213
| | | | | | | | Quicktime streaming media applications. Add a BUGS section to the man page. Submitted by: Erik Salander <erik@whistle.com>
* Fixed PunchFWHole():ru2000-06-271-2/+3
| | | | | - ipfw always rejected rule with `neither in nor out' diagnostics. - number of src/dst ports was not set properly.
OpenPOWER on IntegriCloud