summaryrefslogtreecommitdiffstats
path: root/sys/netpfil/ipfw/ip_fw_pfil.c
Commit message (Collapse)AuthorAgeFilesLines
* Add l2 support to ipfw fwd.Luiz Otavio O Souza2017-07-201-66/+73
| | | | (cherry picked from commit e384dd50b923cdb01b401f4ab943cec5d61fbd7d)
* Merge remote-tracking branch 'origin/stable/11' into devel-11Renato Botelho2016-12-051-9/+4
|\
| * MFC r308237:loos2016-11-171-9/+4
| | | | | | | | | | | | | | | | | | Remove the mbuf tag after use (for reinjected packets). Fixes the packet processing in dummynet l2 rules. Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)
* | Merge remote-tracking branch 'origin/stable/11' into devel-11Luiz Otavio O Souza2016-11-161-7/+4
|\ \ | |/
| * Stop abusing from struct ifnet presence to determine the packet directionloos2016-11-151-7/+4
| | | | | | | | | | | | | | | | | | | | for dummynet, use the correct argument for that, remove the false coment about the presence of struct ifnet. Fixes the input match of dummynet l2 rules. Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)
* | Importing pfSense patch pfil.diffLuiz Otavio O Souza2016-04-151-1/+5
|/
* use proper types to represent function pointersluigi2015-05-191-1/+1
|
* Fix `ipfw fwd tablearg'. Use dedicated field nh4 in struct table_valueae2015-03-131-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | to obtain IPv4 next hop address in tablearg case. Add `fwd tablearg' support for IPv6. ipfw(8) uses INADDR_ANY as next hop address in O_FORWARD_IP opcode for specifying tablearg case. For IPv6 we still use this opcode, but when packet identified as IPv6 packet, we obtain next hop address from dedicated field nh6 in struct table_value. Replace hopstore field in struct ip_fw_args with anonymous union and add hopstore6 field. Use this field to copy tablearg value for IPv6. Replace spare1 field in struct table_value with zoneid. Use it to keep scope zone id for link-local IPv6 addresses. Since spare1 was used internally, replace spare0 array with two variables spare0 and spare1. Use getaddrinfo(3)/getnameinfo(3) functions for parsing and formatting IPv6 addresses in table_value. Use zoneid field in struct table_value to store sin6_scope_id value. Since the kernel still uses embedded scope zone id to represent link-local addresses, convert next_hop6 address into this form before return from pfil processing. This also fixes in6_localip() check for link-local addresses. Differential Revision: https://reviews.freebsd.org/D2015 Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove SYSCTL_VNET_* macros, and simply put CTLFLAG_VNET where needed.glebius2014-11-071-9/+10
| | | | Sponsored by: Nginx, Inc.
* Set oif only for outgoing packets.ae2014-04-161-1/+1
| | | | | | PR: 188543 MFC after: 1 week Sponsored by: Yandex LLC
* Fix breakage in ipfw+VIMAGE after r261590.glebius2014-03-211-14/+6
| | | | | PR: kern/187665 Sponsored by: Nginx, Inc.
* make ipfw_check_packet() and ipfw_check_frame() public,luigi2013-11-221-4/+4
| | | | | | | | so they can be used in the userspace version of ipfw/dummynet (normally using netmap for the I/O path). This is the first of a few commits to ease compiling the ipfw kernel code in userspace.
* Mechanically substitute flags from historic mbuf allocator withglebius2012-12-051-2/+2
| | | | | | | | | malloc(9) flags within sys. Exceptions: - sys/contrib not touched - sys/mbuf.h edited manually
* Remove the recently added sysctl variable net.pfil.forward.ae2012-11-021-2/+2
| | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnae2012-10-251-2/+4
| | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks
* Switch the entire IPv4 stack to keep the IP packet headerglebius2012-10-221-2/+0
| | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me>
* Catch up with r241245 and do not return packet back in host byte order.glebius2012-10-081-4/+1
|
* A step in resolving mess with byte ordering for AF_INET. After this change:glebius2012-10-061-6/+1
| | | | | | | | | | | | | | | | | | | - All packets in NETISR_IP queue are in net byte order. - ip_input() is entered in net byte order and converts packet to host byte order right _after_ processing pfil(9) hooks. - ip_output() is entered in host byte order and converts packet to net byte order right _before_ processing pfil(9) hooks. - ip_fragment() accepts and emits packet in net byte order. - ip_forward(), ip_mloopback() use host byte order (untouched actually). - ip_fastforward() no longer modifies packet at all (except ip_ttl). - Swapping of byte order there and back removed from the following modules: pf(4), ipfw(4), enc(4), if_bridge(4). - Swapping of byte order added to ipfilter(4), based on __FreeBSD_version - __FreeBSD_version bumped. - pfil(9) manual page updated. Reviewed by: ray, luigi, eri, melifaro Tested by: glebius (LE), ray (BE)
* o Create directory sys/netpfil, where all packet filters shouldglebius2012-09-141-0/+590
reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi
OpenPOWER on IntegriCloud