summaryrefslogtreecommitdiffstats
path: root/sys/netpfil
Commit message (Collapse)AuthorAgeFilesLines
* Remove the recently added sysctl variable net.pfil.forward.ae2012-11-022-4/+2
| | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre
* o Remove last argument to ip_fragment(), and obtain all needed informationglebius2012-10-261-9/+9
| | | | | | | | | | | on checksums directly from mbuf flags. This simplifies code. o Clear CSUM_IP from the mbuf in ip_fragment() if we did checksums in hardware. Some driver may not announce CSUM_IP in theur if_hwassist, although try to do checksums if CSUM_IP set on mbuf. Example is em(4). o While here, consistently use CSUM_IP instead of its alias CSUM_DELAY_IP. After this change CSUM_DELAY_IP vanishes from the stack. Submitted by: Sebastian Kuzminsky <seb lineratesystems.com>
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnae2012-10-253-17/+7
| | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks
* Switch the entire IPv4 stack to keep the IP packet headerglebius2012-10-226-29/+6
| | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me>
* Remove unnecessary chain read lock in ipfw nat 'global' code.melifaro2012-10-221-2/+7
| | | | | | Document case when ipfw chain lock must be held while calling ipfw_nat(). MFC after: 2 weeks
* Make the "struct if_clone" opaque to users of the cloning API. Usersglebius2012-10-163-30/+28
| | | | | | | | | | | | now use function calls: if_clone_simple() if_clone_advanced() to initialize a cloner, instead of macros that initialize if_clone structure. Discussed with: brooks, bz, 1 year ago
* Revert previous commit...kevlo2012-10-105-5/+5
| | | | Pointyhat to: kevlo (myself)
* Prefer NULL over 0 for pointerskevlo2012-10-095-5/+5
|
* Fix typo: s/unknow/unknownkevlo2012-10-091-2/+2
|
* Any pfil(9) hooks should be called with already set VNET context.glebius2012-10-081-4/+0
| | | | Reviewed by: bz
* Catch up with r241245 and do not return packet back in host byte order.glebius2012-10-081-4/+1
|
* After r241245 it appeared that in_delayed_cksum(), which still expectsglebius2012-10-082-13/+9
| | | | | | | | | | | | | | host byte order, was sometimes called with net byte order. Since we are moving towards net byte order throughout the stack, the function was converted to expect net byte order, and its consumers fixed appropriately: - ip_output(), ipfilter(4) not changed, since already call in_delayed_cksum() with header in net byte order. - divert(4), ng_nat(4), ipfw_nat(4) now don't need to swap byte order there and back. - mrouting code and IPv6 ipsec now need to switch byte order there and back, but I hope, this is temporary solution. - In ipsec(4) shifted switch to net byte order prior to in_delayed_cksum(). - pf_route() catches up on r241245 changes to ip_output().
* A step in resolving mess with byte ordering for AF_INET. After this change:glebius2012-10-062-57/+6
| | | | | | | | | | | | | | | | | | | - All packets in NETISR_IP queue are in net byte order. - ip_input() is entered in net byte order and converts packet to host byte order right _after_ processing pfil(9) hooks. - ip_output() is entered in host byte order and converts packet to net byte order right _before_ processing pfil(9) hooks. - ip_fragment() accepts and emits packet in net byte order. - ip_forward(), ip_mloopback() use host byte order (untouched actually). - ip_fastforward() no longer modifies packet at all (except ip_ttl). - Swapping of byte order there and back removed from the following modules: pf(4), ipfw(4), enc(4), if_bridge(4). - Swapping of byte order added to ipfilter(4), based on __FreeBSD_version - __FreeBSD_version bumped. - pfil(9) manual page updated. Reviewed by: ray, luigi, eri, melifaro Tested by: glebius (LE), ray (BE)
* The pfil(9) layer guarantees us presence of the protocol header,glebius2012-10-061-14/+0
| | | | | | so remove extra check, that is always false. P.S. Also, goto there lead to unlocking a not locked rwlock.
* To reduce volume of pfsync traffic:glebius2012-10-021-4/+8
| | | | | - Scan request update queue to prevent doubles. - Do not push undersized daragram in pfsync_update_request().
* Clear and re-setup all function pointers that glue pf(4) and pfsync(4)glebius2012-09-291-19/+39
| | | | together whenever the pfsync0 is brought down or up respectively.
* Simplify send out queue code:glebius2012-09-291-30/+21
| | | | | | | | | | - Write method of a queue now is void,length of item is taken as queue property. - Write methods don't need to know about mbud, supply just buf to them. - No need for safe queue iterator in pfsync_sendout(). Obtained from: OpenBSD
* Simplify and somewhat redesign interaction between pf_purge_thread() andglebius2012-09-281-18/+15
| | | | | | | | | | | | | | | | pf_purge_expired_states(). Now pf purging daemon stores the current hash table index on stack in pf_purge_thread(), and supplies it to next iteration of pf_purge_expired_states(). The latter returns new index back. The important change is that whenever pf_purge_expired_states() wraps around the array it returns immediately. This makes our knowledge about status of states expiry run more consistent. Prior to this change it could happen that n-th run stopped on i-th entry, and returned (1) as full run complete, then next (n+1) full run stopped on j-th entry, where j < i, and that broke the mark-and-sweep algorythm that saves references rules. A referenced rule was freed, and this later lead to a crash.
* EBUSY is a better reply for refusing to unload pf(4) or pfsync(4).glebius2012-09-222-2/+2
| | | | Submitted by: pluknet
* When connection rate hits and we overload a source to a table,glebius2012-09-222-81/+109
| | | | | | | | | | | | | | | | | | we are actually editing table, which means editing rules, thus we need writer access to 'em. Fix this by offloading the update of table to the same taskqueue, we already use for flushing. Since taskqueues major task is now overloading, and flushing is optional, do mechanical rename s/flush/overload/ in the code related to the taskqueue. Since overloading tasks do unsafe referencing of rules, provide a bandaid in pf_purge_unlinked_rules(). If the latter sees any queued tasks, then it skips purging for this run. In table code: - Assert any lock in pfr_lookup_addr(). - Assert writer lock in pfr_route_kentry().
* In pfr_insert_kentry() return ENOMEM if memory allocation failed.glebius2012-09-221-1/+1
|
* Fix fallout from r236397 in pfr_update_stats(), that was missedglebius2012-09-221-1/+3
| | | | | later in r237155. We need to zero sockaddr before lookup. While here, make pfr_update_stats() panic on unknown af.
* Reduce copy/paste when freeing an source node.glebius2012-09-201-10/+9
|
* Utilize Jenkins hash with random seed for source nodes storage.glebius2012-09-201-0/+21
|
* Provide kernel compile time option to make pf(4) default rule to drop.glebius2012-09-181-0/+4
| | | | | | | | This is important to secure a small timeframe at boot time, when network is already configured, but pf(4) is not yet. PR: kern/171622 Submitted by: Olivier Cochard-LabbИ <olivier cochard.me>
* Make ruleset anchors in pf(4) reentrant. We've got two problems here:glebius2012-09-182-51/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) Ruleset parser uses a global variable for anchor stack. 2) When processing a wildcard anchor, matching anchors are marked. To fix the first one: o Allocate anchor processing stack on stack. To make this allocation as small as possible, following measures taken: - Maximum stack size reduced from 64 to 32. - The struct pf_anchor_stackframe trimmed by one pointer - parent. We can always obtain the parent via the rule pointer. - When pf_test_rule() calls pf_get_translation(), the former lends its stack to the latter, to avoid recursive allocation 32 entries. The second one appeared more tricky. The code, that marks anchors was added in OpenBSD rev. 1.516 of pf.c. According to commit log, the idea is to enable the "quick" keyword on an anchor rule. The feature isn't documented anywhere. The most obscure part of the 1.516 was that code examines the "match" mark on a just processed child, which couldn't be put here by current frame. Since this wasn't documented even in the commit message and functionality of this is not clear to me, I decided to drop this examination for now. The rest of 1.516 is redone in a thread safe manner - the mark isn't put on the anchor itself, but on current stack frame. To avoid growing stack frame, we utilize LSB from the rule pointer, relying on kernel malloc(9) returning pointer aligned addresses. Discussed with: dhartmei
* Fix DIOCNATLOOK: zero key padding before performing lookup.glebius2012-09-181-0/+1
|
* o Create directory sys/netpfil, where all packet filters shouldglebius2012-09-1438-0/+37145
reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi
OpenPOWER on IntegriCloud