summaryrefslogtreecommitdiffstats
path: root/sys/netpfil
Commit message (Collapse)AuthorAgeFilesLines
* MFC: 281529gnn2015-05-091-1/+1
| | | | | | | | | | I can find no reason to allow packets with both SYN and FIN bits set past this point in the code. The packet should be dropped and not massaged as it is here. Differential Revision: https://reviews.freebsd.org/D2266 Submitted by: eri Sponsored by: Rubicon Communications (Netgate)
* MFC r279910:ae2015-03-191-0/+1
| | | | | | Reset mbuf pointer to NULL in fastroute case to indicate that mbuf was consumed by filter. This fixes several panics due to accessing to mbuf after free.
* Merge r274709 by eri@: deal with IPv6 same way as we IPv4 and calculateglebius2015-01-231-6/+6
| | | | | | the checksum before entering pf_test6(). PR: 172648, 179392
* MFC: 272906gnn2014-11-131-7/+7
| | | | | | | | | Change the PF hash from Jenkins to Murmur3. In forwarding tests this showed a conservative 3% incrase in PPS. Original Differential Revision: https://reviews.freebsd.org/D461 Submitted by: des Reviewed by: emaste
* MFC r263710, r273377, r273378, r273423 and r273455:hselasky2014-10-273-45/+43
| | | | | | | - De-vnet hash sizes and hash masks. - Fix multiple issues related to arguments passed to SYSCTL macros. Sponsored by: Mellanox Technologies
* Merge r272358 from head:glebius2014-10-161-2/+2
| | | | Use rn_detachhead() instead of direct free(9) for radix tables.
* Merge r270928: explicitly free packet on PF_DROP, otherwise a "quick"glebius2014-09-091-0/+8
| | | | | | | rule with "route-to" may still forward it. PR: 177808 Approved by: re (gjb)
* Fix ABI broken in r270576. This is direct commit to stable/10.glebius2014-09-012-4/+2
| | | | Reported by: kib
* Merge r270023 from head:glebius2014-08-252-13/+19
| | | | | | | | Do not lookup source node twice when pf_map_addr() is used. PR: 184003 Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH
* Merge r270022 from head:glebius2014-08-252-29/+16
| | | | | | | | | | | | pf_map_addr() can fail and in this case we should drop the packet, otherwise bad consequences including a routing loop can occur. Move pf_set_rt_ifp() earlier in state creation sequence and inline it, cutting some extra code. PR: 183997 Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH
* Merge 270010 from head:glebius2014-08-251-0/+3
| | | | | | | | Fix synproxy with IPv6. pf_test6() was missing a check for M_SKIP_FIREWALL. PR: 127920 Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH
* Merge r269998 from head:glebius2014-08-253-23/+120
| | | | | | | | | | | | - Count global pf(4) statistics in counter(9). - Do not count global number of states and of src_nodes, use uma_zone_get_cur() to obtain values. - Struct pf_status becomes merely an ioctl API structure, and moves to netpfil/pf/pf.h with its constants. - V_pf_status is now of type struct pf_kstatus. Submitted by: Kajetan Staszkiewicz <vegeta tuxpowered.net> Sponsored by: InnoGames GmbH
* Merge r268492:glebius2014-08-221-15/+26
| | | | | | | On machines with strict alignment copy pfsync_state_key from packet on stack to avoid unaligned access. PR: 187381
* MFC r266399:ae2014-05-261-1/+1
| | | | | | | | Since ipfw nat configures all options in one step, we should set all bits in the mask when calling LibAliasSetMode() to properly clear unneeded options. PR: 189655
* Merge r258708, r258711, r260247, r261117.melifaro2014-05-084-33/+32
| | | | | | | | | | | | | | | | | | | | r258708: Check ipfw table numbers in both user and kernel space before rule addition. Found by: Saychik Pavel <umka@localka.net> r258711: Simplify O_NAT opcode handling. r260247: Use rnh_matchaddr instead of rnh_lookup for longest-prefix match. rnh_lookup is effectively the same as rnh_matchaddr if called with empy network mask. r261117: Reorder struct ip_fw_chain: * move rarely-used fields down * move uh_lock to different cacheline * remove some usused fields
* MFC r264963:trociny2014-05-021-2/+2
| | | | Define startup order the same way as it is in dummynet.
* MFC r264689:mm2014-04-272-12/+26
| | | | | | | | | De-virtualize UMA zone pf_mtag_z and move to global initialization part. The m_tag struct does not know about vnet context and the pf_mtag_free() callback is called unaware of current vnet. This causes a panic. PR: kern/182964
* MFC r264540:ae2014-04-231-1/+1
| | | | | | Set oif only for outgoing packets. PR: 188543
* MFC: r264421brueffer2014-04-231-3/+7
| | | | | | | Free resources in error cases; re-indent a curly brace while here. CID: 1199366 Found with: Coverity Prevent(tm)
* MFC r264220:mm2014-04-141-6/+12
| | | | | | Execute pf_overload_task() in vnet context. Fixes a vnet kernel panic. Reviewed by: trociny
* Merge r263497: fix ipfw + VIMAGE sysctls.glebius2014-03-241-14/+6
| | | | PR: kern/187665
* Merge r262763, r262767, r262771, r262806 from head:glebius2014-03-211-1/+1
| | | | | | | | | | - Remove rt_metrics_lite and simply put its members into rtentry. - Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This removes another cache trashing ++ from packet forwarding path. - Create zini/fini methods for the rtentry UMA zone. Via initialize mutex and counter in them. - Fix reporting of rmx_pksent to routing socket. - Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode.
* Bulk sync of pf changes from head, in attempt to fixup broken build Iglebius2014-03-127-4/+315
| | | | | | | | | made in r263029. Merge r257186,257215,257349,259736,261797. These changesets split pfvar.h into several smaller headers and make userland utilities to include only some of them.
* Merge r261882, r261898, r261937, r262760, r262799:glebius2014-03-113-46/+65
| | | | | | | | | | | | | | Once pf became not covered by a single mutex, many counters in it became race prone. Some just gather statistics, but some are later used in different calculations. A real problem was the race provoked underflow of the states_cur counter on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this value is used in pf_state_expires() and any state created by this rule is immediately expired. Thus, make fields states_cur, states_tot and src_nodes of struct pf_rule be counter(9)s.
* Merge r261029: remove NULL pointer dereference.glebius2014-03-111-1/+0
|
* Merge r261028: fix resource leak and simplify code for DIOCCHANGEADDR.glebius2014-03-111-24/+18
|
* MFC r261915:dim2014-02-192-0/+4
| | | | | Under sys/netpfil/ipfw, surround two IPv6-specific static functions with #ifdef INET6, since they are unused when INET6 is disabled.
* Merge r260377: fix panic on pf_get_translation() failure.glebius2014-01-221-0/+1
| | | | PR: 182557
* Merge r258478, r258479, r258480, r259719: fixes related to mass sourceglebius2014-01-222-54/+109
| | | | | | nodes removal. PR: 176763
* Merge several fixlets from head:glebius2014-01-222-15/+12
| | | | | | | r257619: Remove unused PFTM_UNTIL_PACKET const. r257620: Code logic of handling PFTM_PURGE into pf_find_state(). r258475: Don't compare unsigned <= 0. r258477: Fix off by ones when scanning source nodes hash.
* MFC r258588rodrigc2013-12-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In sys/netpfil/ipfw/ip_fw_nat.c:vnet_ipfw_nat_uninit() we call "IPFW_WLOCK(chain);". This lock gets deleted in sys/netpfil/ipfw/ip_fw2.c:vnet_ipfw_uninit(). Therefore, vnet_ipfw_nat_uninit() *must* be called before vnet_ipfw_uninit(), but this doesn't always happen, because the VNET_SYSINIT order is the same for both functions. In sys/net/netpfil/ipfw/ip_fw2.c and sys/net/netpfil/ipfw/ip_fw_nat.c, IPFW_SI_SUB_FIREWALL == IPFW_NAT_SI_SUB_FIREWALL == SI_SUB_PROTO_IFATTACHDOMAIN and IPFW_MODULE_ORDER == IPFW_NAT_MODULE_ORDER Consequently, if VIMAGE is enabled, and jails are created and destroyed, the system sometimes crashes, because we are trying to use a deleted lock. To reproduce the problem: (1) Take a GENERIC kernel config, and add options for: VIMAGE, WITNESS, INVARIANTS. (2) Run this command in a loop: jail -l -u root -c path=/ name=foo persist vnet && jexec foo ifconfig lo0 127.0.0.1/8 && jail -r foo (see http://lists.freebsd.org/pipermail/freebsd-current/2010-November/021280.html ) Fix the problem by increasing the value of IPFW_NAT_SI_SUB_FIREWALL, so that vnet_ipfw_nat_uninit() runs after vnet_ipfw_uninit(). Approved by: re (gjb)
* Use the correct EtherType for logging IPv6 packets.philip2013-09-281-2/+9
| | | | | | Reviewed by: melifaro Approved by: re (kib, glebius) MFC after: 3 days
* Merge 1.12 of pf_lb.c from OpenBSD, with some changes. Original commit:glebius2013-09-021-26/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | date: 2010/02/04 14:10:12; author: sthen; state: Exp; lines: +24 -19; pf_get_sport() picks a random port from the port range specified in a nat rule. It should check to see if it's in-use (i.e. matches an existing PF state), if it is, it cycles sequentially through other ports until it finds a free one. However the check was being done with the state keys the wrong way round so it was never actually finding the state to be in-use. - switch the keys to correct this, avoiding random state collisions with nat. Fixes PR 6300 and problems reported by robert@ and viq. - check pf_get_sport() return code in pf_test(); if port allocation fails the packet should be dropped rather than sent out untranslated. Help/ok claudio@. Some additional changes to 1.12: - We also need to bzero() the key to zero padding, otherwise key won't match. - Collapse two if blocks into one with ||, since both conditions lead to the same processing. - Only naddr changes in the cycle, so move initialization of other fields above the cycle. - s/u_intXX_t/uintXX_t/g PR: kern/181690 Submitted by: Olivier Cochard-Labbé <olivier cochard.me> Sponsored by: Nginx, Inc.
* Make dummynet use new direct callout(9) execution mechanism. Since the onlymav2013-08-241-4/+6
| | | | | | | | | | | | thing done by the dummynet handler is taskqueue_enqueue() call, it doesn't need extra switch to the clock SWI context. On idle system this change in half reduces number of active CPU cycles and wakes up only one CPU from sleep instead of two. I was going to make this change much earlier as part of calloutng project, but waited for better solution with skipping idle ticks to be implemented. Unfortunately with 10.0 release coming it is better get at least this.
* Make ipfw nat init/unint work correctly for VIMAGE:trociny2013-08-243-24/+58
| | | | | | | | | | | | | | | | | | | | * Do per vnet instance cleanup (previously it was only for vnet0 on module unload, and led to libalias leaks and possible panics due to stale pointer dereferences). * Instead of protecting ipfw hooks registering/deregistering by only vnet0 lock (which does not prevent pointers access from another vnets), introduce per vnet ipfw_nat_loaded variable. The variable is set after hooks are registered and unset before they are deregistered. * Devirtualize ifaddr_event_tag as we run only one event handler for all vnets. * It is supposed that ifaddr_change event handler is called in the interface vnet context, so add an assertion. Reviewed by: zec MFC after: 2 weeks
* Add m_clrprotoflags() to clear protocol specific mbuf flags at up andandre2013-08-191-2/+2
| | | | | | | | downwards layer crossings. Consistently use it within IP, IPv6 and ethernet protocols. Discussed with: trociny, glebius
* Fix a possible NULL-pointer dereference on the pfsync(4) reconfiguration.ae2013-07-291-1/+4
| | | | Reported by: Eugene M. Zheganin
* Improve locking strategy between keys hash and ID hash.glebius2013-06-131-21/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this change state creating sequence was: 1) lock wire key hash 2) link state's wire key 3) unlock wire key hash 4) lock stack key hash 5) link state's stack key 6) unlock stack key hash 7) lock ID hash 8) link into ID hash 9) unlock ID hash What could happen here is that other thread finds the state via key hash lookup after 6), locks ID hash and does some processing of the state. When the thread creating state unblocks, it finds the state it was inserting already non-virgin. Now we perform proper interlocking between key hash locks and ID hash lock: 1) lock wire & stack hashes 2) link state's keys 3) lock ID hash 4) unlock wire & stack hashes 5) link into ID hash 6) unlock ID hash To achieve that, the following hacking was performed in pf_state_key_attach(): - Key hash mutex is marked with MTX_DUPOK. - To avoid deadlock on 2 key hash mutexes, we lock them in order determined by their address value. - pf_state_key_attach() had a magic to reuse a > FIN_WAIT_2 state. It unlinked the conflicting state synchronously. In theory this could require locking a third key hash, which we can't do now. Now we do not remove the state immediately, instead we leave this task to the purge thread. To avoid conflicts in a short period before state is purged, we push to the very end of the TAILQ. - On success, before dropping key hash locks, pf_state_key_attach() locks ID hash and returns. Tested by: Ian FREISLICH <ianf clue.co.za>
* Return meaningful error code from pf_state_key_attach() andglebius2013-05-111-4/+5
| | | | pf_state_insert().
* Better debug message.glebius2013-05-111-1/+1
|
* Fix DIOCADDSTATE operation.glebius2013-05-111-1/+1
|
* Invalid creatorid is always EINVAL, not only when we are in verbose mode.glebius2013-05-111-3/+4
|
* Improve KASSERT() message.glebius2013-05-061-2/+2
|
* Simplify printf().glebius2013-05-061-2/+1
|
* Use unified method for accessing / updating cached rule pointers.melifaro2013-05-041-40/+35
| | | | MFC after: 2 weeks
* Correct a few sizeof()seadler2013-05-011-1/+1
| | | | | Submitted by: swildner@DragonFlyBSD.org Reviewed by: alfred
* Remove useless ifdef KLD_MODULE from dummynet module unload path. Thisglebius2013-04-291-7/+0
| | | | | | fixes panic on unload. Reported by: pho
* Add const qualifier to the dst parameter of the ifnet if_output method.glebius2013-04-263-7/+7
|
* Fix ipfw rule validation partially broken by r248552.melifaro2013-04-011-4/+5
| | | | | Pointed by: avg MFC with: r248552
* When we are removing a specific set, call ipfw_expire_dyn_rules only once.ae2013-03-251-4/+5
| | | | | Obtained from: Yandex LLC MFC after: 1 week
OpenPOWER on IntegriCloud