summaryrefslogtreecommitdiffstats
path: root/sys/netpfil/ipfw/ip_fw2.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge r258708, r258711, r260247, r261117.melifaro2014-05-081-20/+17
| | | | | | | | | | | | | | | | | | | | r258708: Check ipfw table numbers in both user and kernel space before rule addition. Found by: Saychik Pavel <umka@localka.net> r258711: Simplify O_NAT opcode handling. r260247: Use rnh_matchaddr instead of rnh_lookup for longest-prefix match. rnh_lookup is effectively the same as rnh_matchaddr if called with empy network mask. r261117: Reorder struct ip_fw_chain: * move rarely-used fields down * move uh_lock to different cacheline * remove some usused fields
* Bulk sync of pf changes from head, in attempt to fixup broken build Iglebius2014-03-121-1/+2
| | | | | | | | | made in r263029. Merge r257186,257215,257349,259736,261797. These changesets split pfvar.h into several smaller headers and make userland utilities to include only some of them.
* Make ipfw nat init/unint work correctly for VIMAGE:trociny2013-08-241-0/+2
| | | | | | | | | | | | | | | | | | | | * Do per vnet instance cleanup (previously it was only for vnet0 on module unload, and led to libalias leaks and possible panics due to stale pointer dereferences). * Instead of protecting ipfw hooks registering/deregistering by only vnet0 lock (which does not prevent pointers access from another vnets), introduce per vnet ipfw_nat_loaded variable. The variable is set after hooks are registered and unset before they are deregistered. * Devirtualize ifaddr_event_tag as we run only one event handler for all vnets. * It is supposed that ifaddr_change event handler is called in the interface vnet context, so add an assertion. Reviewed by: zec MFC after: 2 weeks
* Use unified method for accessing / updating cached rule pointers.melifaro2013-05-041-40/+35
| | | | MFC after: 2 weeks
* Add ipfw support for setting/matching DiffServ codepoints (DSCP).melifaro2013-03-201-0/+52
| | | | | | | | | | | | | | | | | | | | | | Setting DSCP support is done via O_SETDSCP which works for both IPv4 and IPv6 packets. Fast checksum recalculation (RFC 1624) is done for IPv4. Dscp can be specified by name (AFXY, CSX, BE, EF), by value (0..63) or via tablearg. Matching DSCP is done via another opcode (O_DSCP) which accepts several classes at once (af11,af22,be). Classes are stored in bitmask (2 u32 words). Many people made their variants of this patch, the ones I'm aware of are (in alphabetic order): Dmitrii Tejblum Marcelo Araujo Roman Bogorodskiy (novel) Sergey Matveichuk (sem) Sergey Ryabin PR: kern/102471, kern/121122 MFC after: 2 weeks
* Separate the locking macros that are used in the packet flow pathae2013-03-191-3/+3
| | | | from others. This helps easy switch to use pfil(4) lock.
* Use unified IP_FW_ARG_TABLEARG() macro for most tablearg checks.melifaro2012-12-231-19/+10
| | | | | | | Log real value instead of IP_FW_TABLEARG (65535) in ipfw_log(). Noticed by: Vitaliy Tokarenko <rphone@ukr.net> MFC after: 2 weeks
* Use common macros for working with rule/dynamic counters.melifaro2012-11-301-19/+7
| | | | | | This is done as preparation to introduce per-cpu ipfw counters. MFC after: 3 weeks
* Make ipfw dynamic states operations SMP-ready.melifaro2012-11-301-4/+2
| | | | | | | | | | | | | * Global IPFW_DYN_LOCK() is changed to per-bucket mutex. * State expiration is done in ipfw_tick every second. * No expiration is done on forwarding path. * hash table resize is done automatically and does not flush all states. * Dynamic UMA zone is now allocated per each VNET * State limiting is now done via UMA(9) api. Discussed with: ipfw MFC after: 3 weeks Sponsored by: Yandex LLC
* Remove the recently added sysctl variable net.pfil.forward.ae2012-11-021-2/+0
| | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnae2012-10-251-6/+3
| | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks
* Switch the entire IPv4 stack to keep the IP packet headerglebius2012-10-221-8/+0
| | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me>
* Revert previous commit...kevlo2012-10-101-1/+1
| | | | Pointyhat to: kevlo (myself)
* Prefer NULL over 0 for pointerskevlo2012-10-091-1/+1
|
* o Create directory sys/netpfil, where all packet filters shouldglebius2012-09-141-0/+2791
reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi
OpenPOWER on IntegriCloud