summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Ensure an address is removed from the interface addressqingli2010-01-081-1/+1
| | | | | | list when the installation of that address fails. PR: 139559
* Complete the swap of carp(4) log levels and document the change.ru2010-01-081-2/+2
| | | | MFC after: 3 days
* Remove extraneous semicolons, no functional changes.mbr2010-01-074-4/+4
| | | | | Submitted by: Marc Balmer <marc@msys.ch> MFC after: 1 week
* we don't use dummynet_drain!luigi2010-01-071-32/+5
|
* check that we have an ipv4 packet before swapping ip_len and ip_off.luigi2010-01-071-2/+3
| | | | | | | This should fix the handling of ipv6 packets which i broke when i made ipfw operate on packets in network format. Reported by: Hajimu UMEMOTO
* Following up on a request from Ermal Luci to makeluigi2010-01-074-77/+72
| | | | | | | | | | | | | | | | | ip_divert work as a client of pf(4), make ip_divert not depend on ipfw. This is achieved by moving to ip_var.h the struct ipfw_rule_ref (which is part of the mtag for all reinjected packets) and other declarations of global variables, and moving to raw_ip.c global variables for filter and divert hooks. Note that names and locations could be made more generic (ipfw_rule_ref is really a generic reference robust to reconfigurations; the packet filter is not necessarily ipfw; filters and their clients are not necessarily limited to ipv4), but _right now_ most of this stuff works on ipfw and ipv4, so i don't feel like doing a gratuitous renaming, at least for the time being.
* some header shuffling to help decoupling ip_divert from ipfwluigi2010-01-075-11/+6
|
* put ip_len in correct order for ip_output().luigi2010-01-071-1/+2
| | | | | | | This prevents a panic when ipfw generates packets on its own (such as reject or keepalives for dynamic rules). Reported by: Chagin Dmitry
* this file does not require ip_dummynet.hluigi2010-01-051-1/+0
|
* An existing incomplete ARP entry would expire a subsequentqingli2010-01-051-10/+16
| | | | | | | | | | | statically configured entry of the same host. This bug was due to the expiration timer was not cancelled when installing the static entry. Since there exist a potential race condition with respect to timer cancellation, simply check for the LLE_STATIC bit inside the expiration function instead of cancelling the active timer. MFC after: 5 days
* Various cleanup done in ipfw3-head branch including:luigi2010-01-0411-326/+225
| | | | | | | | | | | | | | | | | | | | | | | | | - use a uniform mtag format for all packets that exit and re-enter the firewall in the middle of a rulechain. On reentry, all tags containing reinject info are renamed to MTAG_IPFW_RULE so the processing is simpler. - make ipfw and dummynet use ip_len and ip_off in network format everywhere. Conversion is done only once instead of tracking the format in every place. - use a macro FREE_PKT to dispose of mbufs. This eases portability. On passing i also removed a few typos, staticise or localise variables, remove useless declarations and other minor things. Overall the code shrinks a bit and is hopefully more readable. I have tested functionality for all but ng_ipfw and if_bridge/if_ethersubr. For ng_ipfw i am actually waiting for feedback from glebius@ because we might have some small changes to make. For if_bridge and if_ethersubr feedback would be welcome (there are still some redundant parts in these two modules that I would like to remove, but first i need to check functionality).
* Correct usage of parenthesis.tuexen2010-01-041-2/+2
| | | | | | | PR: kern/142066 Approved by: rrs (mentor) Obtained from: Henning Petersen, Bruce Cran. MFC after: 2 weeks
* Avoid NULL dereference in arpresolve.np2010-01-031-2/+2
|
* Consolidate the route message generation code for when addressqingli2009-12-301-48/+49
| | | | | | | | aliases were added or deleted. The announced route entry for an address alias is no longer empty because this empty route entry was causing some route daemon to fail and exit abnormally. MFC after: 5 days
* The proxy arp entries could not be added into the system over theqingli2009-12-301-8/+44
| | | | | | | | | | | | | | | | | | IFF_POINTOPOINT link types. The reason was due to the routing entry returned from the kernel covering the remote end is of an interface type that does not support ARP. This patch fixes this problem by providing a hint to the kernel routing code, which indicates the prefix route instead of the PPP host route should be returned to the caller. Since a host route to the local end point is also added into the routing table, and there could be multiple such instantiations due to multiple PPP links can be created with the same local end IP address, this patch also fixes the loopback route installation failure problem observed prior to this patch. The reference count of loopback route to local end would be either incremented or decremented. The first instantiation would create the entry and the last removal would delete the route entry. MFC after: 5 days
* Make sure the multicast forwarding cache entry's stall queue is properlysyrinx2009-12-301-0/+9
| | | | | | | | initialized before trying to insert an entry into it. PR: kern/142052 Reviewed by: bms MFC after: now
* we really need htonl() here, see the comment a few lines above in the code.luigi2009-12-291-1/+1
|
* (S)LIST_HEAD_INITIALIZER takes a (S)LIST_HEAD as an argument.antoine2009-12-282-3/+3
| | | | | | | | | Fix some wrong usages. Note: this does not affect generated binaries as this argument is not used. PR: 137213 Submitted by: Eygene Ryabinkin (initial version) MFC after: 1 month
* Make the compiler happy after r201125:bz2009-12-281-1/+1
| | | | | - + remove two unnecessary initializations in ip_output; + + remove one unnecessary initializations in ip_output;
* introduce a local variable rte acting as a cache of ro->ro_rtluigi2009-12-281-18/+22
| | | | | | | within ip_output, achieving (in random order of importance): - a reduction of the number of 'r's in the source code; - improved legibility; - a reduction of 64 bytes in the .text
* + remove an unused #define print_ip;luigi2009-12-281-19/+13
| | | | | | | | | + remove two unnecessary initializations in ip_output; + localize 'len'; + introduce a temporary variable n to count the number of fragments, the compiler seems unable to identify a common subexpression (written 3 times, used twice); + document some assumptions on ip_len and ip_hl
* bring the NGM_IPFW_COOKIE back into ng_ipfw.h, libnetgraph expectsluigi2009-12-282-1/+1
| | | | | to find it there. Unfortunately this reintroduces the dependency on ip_fw_pfil.c
* bring in several cleanups tested in ipfw3-head branch, namely:luigi2009-12-2810-458/+318
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r201011 - move most of ng_ipfw.h into ip_fw_private.h, as this code is ipfw-specific. This removes a dependency on ng_ipfw.h from some files. - move many equivalent definitions of direction (IN, OUT) for reinjected packets into ip_fw_private.h - document the structure of the packet tags used for dummynet and netgraph; r201049 - merge some common code to attach/detach hooks into a single function. r201055 - remove some duplicated code in ip_fw_pfil. The input and output processing uses almost exactly the same code so there is no need to use two separate hooks. ip_fw_pfil.o goes from 2096 to 1382 bytes of .text r201057 (see the svn log for full details) - macros to make the conversion of ip_len and ip_off between host and network format more explicit r201113 (the remaining parts) - readability fixes -- put braces around some large for() blocks, localize variables so the compiler does not think they are uninitialized, do not insist on precise allocation size if we have more than we need. r201119 - when doing a lookup, keys must be in big endian format because this is what the radix code expects (this fixes a bug in the recently-introduced 'lookup' option) No ABI changes in this commit. MFC after: 1 week
* readability fixes -- add braces on large blocks, remove unnecessaryluigi2009-12-281-28/+31
| | | | initializations
* explain details of operation of table lookups, and improve portabilityluigi2009-12-281-4/+16
|
* diverted packet must re-enter _after_ the matching rule,luigi2009-12-271-1/+1
| | | | | | | | or we create loops. The divert cookie (that can be set from userland too) contains the matching rule nr, so we must start from nr+1. Reported by: Joe Marcus Clarke
* fix poor indentation resulting from a mergeluigi2009-12-241-14/+14
|
* mostly style changes, such as removal of trailing whitespace,luigi2009-12-231-183/+152
| | | | | | | | | | | reformatting to avoid unnecessary line breaks, small block restructuring to avoid unnecessary nesting, replace macros with function calls, etc. As a side effect of code restructuring, this commit fixes one bug: previously, if a realloc() failed, memory was leaked. Now, the realloc is not there anymore, as we first count how much memory we need and then do a single malloc.
* fix build with the new fast lookup structure.luigi2009-12-231-79/+56
| | | | Also remove some unnecessary headers
* fix build on 64-bit architectures.luigi2009-12-231-15/+15
| | | | Also fix the indentation on a few lines.
* merge code from ipfw3-head to reduce contention on the ipfw lockluigi2009-12-228-389/+395
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and remove all O(N) sequences from kernel critical sections in ipfw. In detail: 1. introduce a IPFW_UH_LOCK to arbitrate requests from the upper half of the kernel. Some things, such as 'ipfw show', can be done holding this lock in read mode, whereas insert and delete require IPFW_UH_WLOCK. 2. introduce a mapping structure to keep rules together. This replaces the 'next' chain currently used in ipfw rules. At the moment the map is a simple array (sorted by rule number and then rule_id), so we can find a rule quickly instead of having to scan the list. This reduces many expensive lookups from O(N) to O(log N). 3. when an expensive operation (such as insert or delete) is done by userland, we grab IPFW_UH_WLOCK, create a new copy of the map without blocking the bottom half of the kernel, then acquire IPFW_WLOCK and quickly update pointers to the map and related info. After dropping IPFW_LOCK we can then continue the cleanup protected by IPFW_UH_LOCK. So userland still costs O(N) but the kernel side is only blocked for O(1). 4. do not pass pointers to rules through dummynet, netgraph, divert etc, but rather pass a <slot, chain_id, rulenum, rule_id> tuple. We validate the slot index (in the array of #2) with chain_id, and if successful do a O(1) dereference; otherwise, we can find the rule in O(log N) through <rulenum, rule_id> All the above does not change the userland/kernel ABI, though there are some disgusting casts between pointers and uint32_t Operation costs now are as follows: Function Old Now Planned ------------------------------------------------------------------- + skipto X, non cached O(N) O(log N) + skipto X, cached O(1) O(1) XXX dynamic rule lookup O(1) O(log N) O(1) + skipto tablearg O(N) O(1) + reinject, non cached O(N) O(log N) + reinject, cached O(1) O(1) + kernel blocked during setsockopt() O(N) O(1) ------------------------------------------------------------------- The only (very small) regression is on dynamic rule lookup and this will be fixed in a day or two, without changing the userland/kernel ABI Supported by: Valeria Paoli MFC after: 1 month
* - Rename the __tcpi_(snd|rcv)_mss fields of the tcp_info structure to removejhb2009-12-222-6/+8
| | | | | | | | | the leading underscores since they are now implemented. - Implement the tcpi_rto and tcpi_last_data_recv fields in the tcp_info structure. Reviewed by: rwatson MFC after: 2 weeks
* some mostly cosmetic changes in preparation for upcoming work:luigi2009-12-224-92/+89
| | | | | | | | | + in many places, replace &V_layer3_chain with a local variable chain; + bring the counter of rules and static_len within ip_fw_chain replacing static variables; + remove some spurious comments and extern declaration; + document which lock protects certain data structures
* Added proper attribution.ru2009-12-181-1/+1
| | | | Requested by: luigi
* Add some experimental code to log traffic with tcpdump,luigi2009-12-173-3/+79
| | | | | | | | | | | | | | | | | | similar to pflog(4). To use the feature, just put the 'log' options on rules you are interested in, e.g. ipfw add 5000 count log .... and run tcpdump -ni ipfw0 ... net.inet.ip.fw.verbose=0 enables logging to ipfw0, net.inet.ip.fw.verbose=1 sends logging to syslog as before. More features can be added, similar to pflog(), to store in the MAC header metadata such as rule numbers and actions. Manpage to come once features are settled.
* simplify and document lookup_next_rule()luigi2009-12-171-43/+22
|
* simplify the code that finds the next rule after reinjectionsluigi2009-12-171-18/+16
| | | | MFC after: 1 week
* remove a duplicate sysctl entryluigi2009-12-161-4/+2
|
* bring back a couple of #include that are supplied by nesting,luigi2009-12-162-1/+2
| | | | and explain why they are used.
* Various cosmetic cleanup of the files:luigi2009-12-169-143/+183
| | | | | | | | | | | | | | - move global variables around to reduce the scope and make them static if possible; - add an ipfw_ prefix to all public functions to prevent conflicts (the same should be done for variables); - try to pack variable declaration in an uniform way across files; - clarify some comments; - remove some misspelling of names (#define V_foo VNET(bar)) that slipped in due to cut&paste - remove duplicate static variables in different files; MFC after: 1 month
* Quick fix to make this compile:imp2009-12-161-6/+0
| | | | | Remove redundant extern declearations. If the maintainer has a better fix, then feel free to back this out.
* more splitting of ip_fw2.c, now extract the 'table' routinesluigi2009-12-154-1209/+1398
| | | | | | | | | | | | and the sockopt routines (the upper half of the kernel). Whoever is the author of the 'table' code (Ruslan/glebius/oleg ?) please change the attribution in ip_fw_table.c. I have copied the copyright line from ip_fw2.c but it carries my name and I have neither written nor designed the feature so I don't deserve the credit. MFC after: 1 month
* Start splitting ip_fw2.c and ip_fw.h into smaller components.luigi2009-12-159-1531/+1853
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At this time we pull out from ip_fw2.c the logging functions, and support for dynamic rules, and move kernel-only stuff into netinet/ipfw/ip_fw_private.h No ABI change involved in this commit, unless I made some mistake. ip_fw.h has changed, though not in the userland-visible part. Files touched by this commit: conf/files now references the two new source files netinet/ip_fw.h remove kernel-only definitions gone into netinet/ipfw/ip_fw_private.h. netinet/ipfw/ip_fw_private.h new file with kernel-specific ipfw definitions netinet/ipfw/ip_fw_log.c ipfw_log and related functions netinet/ipfw/ip_fw_dynamic.c code related to dynamic rules netinet/ipfw/ip_fw2.c removed the pieces that goes in the new files netinet/ipfw/ip_fw_nat.c minor rearrangement to remove LOOKUP_NAT from the main headers. This require a new function pointer. A bunch of other kernel files that included netinet/ip_fw.h now require netinet/ipfw/ip_fw_private.h as well. Not 100% sure i caught all of them. MFC after: 1 month
* implement a new match option,luigi2009-12-151-0/+31
| | | | | | | | | | | | | | lookup {dst-ip|src-ip|dst-port|src-port|uid|jail} N which searches the specified field in table N and sets tablearg accordingly. With dst-ip or src-ip the option replicates two existing options. When used with other arguments, the option can be useful to quickly dispatch traffic based on other fields. Work supported by the Onelab project. MFC after: 1 week
* Throughout the network stack we have a few places ofbz2009-12-131-2/+2
| | | | | | | | | | | | | | | | | | if (jailed(cred)) left. If you are running with a vnet (virtual network stack) those will return true and defer you to classic IP-jails handling and thus things will be "denied" or returned with an error. Work around this problem by introducing another "jailed()" function, jailed_without_vnet(), that also takes vnets into account, and permits the calls, should the jail from the given cred have its own virtual network stack. We cannot change the classic jailed() call to do that, as it is used outside the network stack as well. Discussed with: julian, zec, jamie, rwatson (back in Sept) MFC after: 5 days
* use div64 when converting back the burst value for userlandluigi2009-12-101-1/+1
|
* when draining a flowset free the entire chain, not just one packet.luigi2009-12-101-1/+1
|
* centralize the code to free a packet (or a chain) while in dummynet.luigi2009-12-101-32/+27
| | | | Remove an old macro and its stale comment.
* Fix burst processing for WF2Q pipes - do not increase available burst sizeoleg2009-12-051-1/+3
| | | | | | | | unless pipe is idle. This should fix follwing issues: - 'dummynet: OUCH! pipe should have been idle!' log messages. - exceeding configured pipe bandwidth. MFC after: 1 week
* adjust comment in previous commit after Julian's explanationluigi2009-12-051-8/+9
|
OpenPOWER on IntegriCloud