summaryrefslogtreecommitdiffstats
path: root/sys/netpfil
Commit message (Collapse)AuthorAgeFilesLines
* MFC r309563: pflog: Correctly initialise subrulenrkp2016-12-141-1/+1
| | | | | | | | | | | | | subrulenr is considered unset if it's set to -1, not if it's set to 1. See contrib/tcpdump/print-pflog.c pflog_print() for a user. This caused incorrect pflog output (tcpdump -n -e -ttt -i pflog0): rule 0..16777216(match) instead of the correct output of rule 0/0(match) PR: 214832 Submitted by: andywhite@gmail.com
* MFC r304152:kp2016-08-191-6/+6
| | | | | | | | | | pf: Add missing byte-order swap to pf_match_addr_range Without this, rules using address ranges (e.g. "10.1.1.1 - 10.1.1.5") did not match addresses correctly on little-endian systems. PR: 211796 Obtained from: OpenBSD (sthen)
* MFC r302497:kp2016-08-171-4/+12
| | | | | | | | | | | | pf: Map hook returns onto the correct error values pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers expect to get E<foo> error codes. Map the returns values. A pass is 0 (everything is OK), anything else means pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP error message. PR: 207598
* MFC r290521:kp2016-08-081-2/+2
| | | | | | | | | | pf: Fix broken rule skip calculation r289932 accidentally broke the rule skip calculation. The address family argument to PF_ANEQ() is now important, and because it was set to 0 the macro always evaluated to false. This resulted in incorrect skip values, which in turn broke the rule evaluations.
* MFC r302667truckman2016-07-181-136/+87
| | | | | | | | | | | | | | | | | | | | | | | Fix problems in the FQ-PIE AQM cleanup code that could leak memory or cause a crash. Because dummynet calls pie_cleanup() while holding a mutex, pie_cleanup() is not able to use callout_drain() to make sure that all callouts are finished before it returns, and callout_stop() is not sufficient to make that guarantee. After pie_cleanup() returns, dummynet will free a structure that any remaining callouts will want to access. Fix these problems by allocating a separate structure to contain the data used by the callouts. In pie_cleanup(), call callout_reset_sbt() to replace the normal callout with a cleanup callout that does the cleanup work for each sub-queue. The instance of the cleanup callout that destroys the last flow will also free the extra allocated block of memory. Protect the reference count manipulation in the cleanup callout with DN_BH_WLOCK() to be consistent with all of the other usage of the reference count where this lock is held by the dummynet code. Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> Differential Revision: https://reviews.freebsd.org/D7174
* MFC r302338truckman2016-07-081-33/+28
| | | | | | | | | | | | | | | | | | | | | | Fix a race condition between the main thread in aqm_pie_cleanup() and the callout thread that can cause a kernel panic. Always do the final cleanup in the callout thread by passing a separate callout function for that task to callout_reset_sbt(). Protect the ref_count decrement in the callout with DN_BH_WLOCK(). All other ref_count manipulation is protected with this lock. There is still a tiny window between ref_count reaching zero and the end of the callout function where it is unsafe to unload the module. Fixing this would require the use of callout_drain(), but this can't be done because dummynet holds a mutex and callout_drain() might sleep. Remove the callout_pending(), callout_active(), and callout_deactivate() calls from calculate_drop_prob(). They are not needed because this callout uses callout_init_mtx(). Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> Differential Revision: https://reviews.freebsd.org/D6928
* MFC r300779, r300781, r300783, r300784, r300949, r301162, r301180truckman2016-06-1019-2/+4545
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r300779 | truckman | 2016-05-26 14:40:13 -0700 (Thu, 26 May 2016) | 64 lines Import Dummynet AQM version 0.2.1 (CoDel, FQ-CoDel, PIE and FQ-PIE). Centre for Advanced Internet Architectures Implementing AQM in FreeBSD * Overview <http://caia.swin.edu.au/freebsd/aqm/index.html> * Articles, Papers and Presentations <http://caia.swin.edu.au/freebsd/aqm/papers.html> * Patches and Tools <http://caia.swin.edu.au/freebsd/aqm/downloads.html> Overview Recent years have seen a resurgence of interest in better managing the depth of bottleneck queues in routers, switches and other places that get congested. Solutions include transport protocol enhancements at the end-hosts (such as delay-based or hybrid congestion control schemes) and active queue management (AQM) schemes applied within bottleneck queues. The notion of AQM has been around since at least the late 1990s (e.g. RFC 2309). In recent years the proliferation of oversized buffers in all sorts of network devices (aka bufferbloat) has stimulated keen community interest in four new AQM schemes -- CoDel, FQ-CoDel, PIE and FQ-PIE. The IETF AQM working group is looking to document these schemes, and independent implementations are a corner-stone of the IETF's process for confirming the clarity of publicly available protocol descriptions. While significant development work on all three schemes has occured in the Linux kernel, there is very little in FreeBSD. Project Goals This project began in late 2015, and aims to design and implement functionally-correct versions of CoDel, FQ-CoDel, PIE and FQ_PIE in FreeBSD (with code BSD-licensed as much as practical). We have chosen to do this as extensions to FreeBSD's ipfw/dummynet firewall and traffic shaper. Implementation of these AQM schemes in FreeBSD will: * Demonstrate whether the publicly available documentation is sufficient to enable independent, functionally equivalent implementations * Provide a broader suite of AQM options for sections the networking community that rely on FreeBSD platforms Program Members: * Rasool Al Saadi (developer) * Grenville Armitage (project lead) Acknowledgements: This project has been made possible in part by a gift from the Comcast Innovation Fund. Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> X-No objection: core MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D6388 [Remove some code that was added to the mq_append() inline function in HEAD by r258457, which was not merged to stable/10. The AQM patch moved mq_append() from ip_dn_io.c to the new file ip_dn_private.h, so we need to remove that copy of the r258457 changes.] ------------------------------------------------------------------------ r300781 | truckman | 2016-05-26 14:44:52 -0700 (Thu, 26 May 2016) | 7 lines Modify BOUND_VAR() macro to wrap all of its arguments in () and tweak its expression to work on powerpc and sparc64 (gcc compatibility). Correct a typo in a nearby comment. MFC after: 2 weeks (with r300779) ------------------------------------------------------------------------ r300783 | truckman | 2016-05-26 15:03:28 -0700 (Thu, 26 May 2016) | 4 lines Correct a typo in a comment. MFC after: 2 weeks (with r300779) ------------------------------------------------------------------------ r300784 | truckman | 2016-05-26 15:07:09 -0700 (Thu, 26 May 2016) | 5 lines Include the new AQM files when compiling a kernel with options DUMMYNET. Reported by: Nikolay Denev <nike_d AT cytexbg DOT com> MFC after: 2 weeks (with r300779) ------------------------------------------------------------------------ r300949 | truckman | 2016-05-29 00:23:56 -0700 (Sun, 29 May 2016) | 10 lines Cast some expressions that multiply a long long constant by a floating point constant to int64_t. This avoids the runtime conversion of the the other operand in a set of comparisons from int64_t to floating point and doing the comparisions in floating point. Suggested by: lidl Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> MFC after: 2 weeks (with r300779) ------------------------------------------------------------------------ r301162 | truckman | 2016-06-01 13:04:24 -0700 (Wed, 01 Jun 2016) | 9 lines Replace constant expressions that contain multiplications by fractional floating point values with integer divides. This will eliminate any chance that the compiler will generate code to evaluate the expression using floating point at runtime. Suggested by: bde Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> MFC after: 8 days (with r300779 and r300949) ------------------------------------------------------------------------ r301180 | truckman | 2016-06-01 17:42:15 -0700 (Wed, 01 Jun 2016) | 2 lines Belatedly bump .Dd date for Dummynet AQM import in r300779. Relnotes: yes
* MFC r266941, r266955truckman2016-06-032-5/+78
| | | | | | | | | | | | | | | | | | | | | | | | | Needed for anticipated dummynet AQM MFC next week. r266941 | hiren | 2014-06-01 00:28:24 -0700 (Sun, 01 Jun 2014) | 9 lines ECN marking implenetation for dummynet. Changes include both DCTCP and RFC 3168 ECN marking methodology. DCTCP draft: http://tools.ietf.org/html/draft-bensley-tcpm-dctcp-00 Submitted by: Midori Kato (aoimidori27@gmail.com) Worked with: Lars Eggert (lars@netapp.com) Reviewed by: luigi, hiren r266955 | hiren | 2014-06-01 13:19:17 -0700 (Sun, 01 Jun 2014) | 5 lines DNOLD_IS_ECN introduced by r266941 is not required. DNOLD_* flags are for compat with old binaries. Suggested by: luigi Discussed with: hiren Relnotes: yes
* MFC 300501, 300508kp2016-05-301-10/+5
| | | | | | | | | | | | | pf: Fix ICMP translation Fix ICMP source address rewriting in rdr scenarios. pf: Fix more ICMP mistranslation In the default case fix the substitution of the destination address. PR: 201519 Submitted by: Max <maximos@als.nnov.ru>
* MFC 300307:kp2016-05-241-1/+1
| | | | | | | | | pf: Fix fragment timeout We were inconsistent about the use of time_second vs. time_uptime. Always use time_uptime so the value can be meaningfully compared. Submitted by: "Max" <maximos@als.nnov.ru>
* MFC r287009, r287120 and r298131:loos2016-04-161-0/+7
| | | | | | | | | | | | | Add ALTQ(9) support for the CoDel algorithm. CoDel is a parameterless queue discipline that handles variable bandwidth and RTT. It can be used as the single queue discipline on an interface or as a sub discipline of existing queue disciplines such as PRIQ, CBQ, HFSC, FAIRQ. Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)
* MFC r284777, r284814, r284863 and r298088:loos2016-04-163-0/+34
| | | | | | | | ALTQ FAIRQ discipline import from DragonFLY. Differential Revision: https://reviews.freebsd.org/D2847 Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)
* MFC 296932:kp2016-03-301-4/+6
| | | | | | | | | pf: Improve forwarding detection When we guess the nature of the outbound packet (output vs. forwarding) we need to take bridges into account. When bridging the input interface does not match the output interface, but we're not forwarding. Similarly, it's possible for the interface to actually be the bridge interface itself (and not a member interface).
* MFC r292254:hselasky2016-03-243-6/+11
| | | | | | | | | | | | | | | | | | Properly drain callouts in the IPFW subsystem to avoid use after free panics when unloading the dummynet and IPFW modules: - The callout drain function can sleep and should not be called having a non-sleepable lock locked. Remove locks around "ipfw_dyn_uninit(0)". - Add a new "dn_gone" variable to prevent asynchronous restart of dummynet callouts when unloading the dummynet kernel module. - Call "dn_reschedule()" locked so that "dn_gone" can be set and checked atomically with regard to starting a new callout. PR: 208171 Requested by: Franco Fichtner (opnsense.org) Differential Revision: https://reviews.freebsd.org/D3855
* MFC r296348:ae2016-03-111-1/+1
| | | | Use correct size for malloc.
* MFC: r296025:kp2016-03-031-2/+3
| | | | | | | | | | | | | | | | | | | pf: Fix possible out-of-bounds write In the DIOCRSETADDRS ioctl() handler we allocate a table for struct pfr_addrs, which is processed in pfr_set_addrs(). At the users request we also provide feedback on the deleted addresses, by storing them after the new list ('bcopy(&ad, addr + size + i, sizeof(ad));' in pfr_set_addrs()). This means we write outside the bounds of the buffer we've just allocated. We need to look at pfrio_size2 instead (i.e. the size the user reserved for our feedback). That'd allow a malicious user to specify a smaller pfrio_size2 than pfrio_size though, in which case we'd still read outside of the allocated buffer. Instead we allocate the largest of the two values. Reported By: Paul J Murphy <paul@inetstat.net> PR: 207463 Approved by: re (marius)
* MFC r295969:ae2016-03-021-1/+1
| | | | | | | | Fix bug in filling and handling ipfw's O_DSCP opcode. Due to integer overflow CS4 token was handled as BE. PR: 207459 Approved by: re (gjb)
* MFC r286641 (from oshogbo):garga2016-02-221-2/+2
| | | | | | | | | | | | Use correct src/dst ports when removing states. Submitted by: Milosz Kaniewski <m.kaniewski@wheelsystems.com>, UMEZAWA Takeshi <umezawa@iij.ad.jp> (orginal) Reviewed by: glebius Approved by: re (marius) Obtained from: OpenBSD Sponsored by: Rubicon Communications (Netgate) Differential revision: https://reviews.freebsd.org/D5392
* Merge r264915: fix NULL pointer derefernce with special sequence ofglebius2016-02-081-1/+3
| | | | | | | DIOCADDADDR and DIOCADDRULE. PR: 206933 Approved by: re (marius)
* MFC r291001:bdrewery2015-12-041-0/+3
| | | | | | ipfw: Fix dynamic IPv6 rules showing junk for non-specified address masks. Relnotes: yes
* MFC r290161:kp2015-11-111-0/+7
| | | | | | | | | | | | | | | pf: Fix IPv6 checksums with route-to. When using route-to (or reply-to) pf sends the packet directly to the output interface. If that interface doesn't support checksum offloading the checksum has to be calculated in software. That was already done in the IPv4 case, but not for the IPv6 case. As a result we'd emit packets with pseudo-header checksums (i.e. incorrect checksums). This issue was exposed by the changes in r289316 when pf stopped performing full checksum calculations for all packets. Submitted by: Luoqi Chen
* MFC r289316:kp2015-10-213-50/+88
| | | | | | | | | | | | | | | | | | | | pf: Fix TSO issues In certain configurations (mostly but not exclusively as a VM on Xen) pf produced packets with an invalid TCP checksum. The problem was that pf could only handle packets with a full checksum. The FreeBSD IP stack produces TCP packets with a pseudo-header checksum (only addresses, length and protocol). Certain network interfaces expect to see the pseudo-header checksum, so they end up producing packets with invalid checksums. To fix this stop calculating the full checksum and teach pf to only update TCP checksums if TSO is disabled or the change affects the pseudo-header checksum. PR: 154428, 193579, 198868 Relnotes: yes Sponsored by: RootBSD
* MFC r266310melifaro2015-09-181-0/+1
| | | | | | | | | | | | | | Fix wrong formatting of 0.0.0.0/X table records in ipfw(8). Add `flags` u16 field to the hole in ipfw_table_xentry structure. Kernel has been guessing address family for supplied record based on xent length size. Userland, however, has been getting fixed-size ipfw_table_xentry structures guessing address family by checking address by IN6_IS_ADDR_V4COMPAT(). Fix this behavior by providing specific IPFW_TCF_INET flag for IPv4 records. PR: bin/189471,kern/200169
* MFC r287376kp2015-09-111-1/+11
| | | | | | | | | | | | | | | | | pf: Fix misdetection of forwarding when net.link.bridge.pfil_bridge is set If net.link.bridge.pfil_bridge is set we can end up thinking we're forwarding in pf_test6() because the rcvif and the ifp (output interface) are different. In that case we're bridging though, and the rcvif the the bridge member on which the packet was received and ifp is the bridge itself. If we'd set dir to PF_FWD we'd end up calling ip6_forward() which is incorrect. Instead check if the rcvif is a member of the ifp bridge. (In other words, the if_bridge is the ifp's softc). If that's the case we're not forwarding but bridging. PR: 202351
* MFC r287119:loos2015-08-271-1/+1
| | | | | | | | | | | | | Reapply r196551 which was accidentally reverted by r223637 (update to OpenBSD pf 4.5). Fix argument ordering to memcpy as well as the size of the copy in the (theoretical) case that pfi_buffer_cnt should be greater than ~_max. This fix the failure when you hit the self table size and force it to be resized. Sponsored by: Rubicon Communications (Netgate)
* MFC r286862:loos2015-08-201-2/+1
| | | | | | | | | | Fix the copy of addresses passed from userland in table replace command. The size2 is the maximum userland buffer size (used when the addresses are copied back to userland). Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)
* MFC r285945, r285960:garga2015-07-311-2/+2
| | | | | | | | | | | Respect pf rule log option before log dropped packets with IP options or dangerous v6 headers Reviewed by: gnn, eri Approved by: gnn, glebius Obtained from: pfSense Sponsored by: Netgate Differential Revision: https://reviews.freebsd.org/D3222
* MFC r285999 (kp):gjb2015-07-301-3/+1
| | | | | | | | | | | | | | | | | | pf: Always initialise pf_fragment.fr_flags When we allocate the struct pf_fragment in pf_fillup_fragment() we forgot to initialise the fr_flags field. As a result we sometimes mistakenly thought the fragment to not be a buffered fragment. This resulted in panics because we'd end up freeing the pf_fragment but not removing it from V_pf_fragqueue (believing it to be part of V_pf_cachequeue). The next time we iterated V_pf_fragqueue we'd use a freed object and panic. While here also fix a pf_fragment use after free in pf_normalize_ip(). pf_reassemble() frees the pf_fragment, so we can't use it any more. X-MFS-To: releng/10.2 Sponsored by: The FreeBSD Foundation
* Merge r285944: fix typo: delete nsn if we were the last reference.glebius2015-07-291-1/+1
|
* Merge r283106:glebius2015-07-281-1/+1
| | | | | | During module unload unlock rules before destroying UMA zones, which may sleep in uma_drain(). It is safe to unlock here, since we are already dehooked from pfil(9) and all pf threads had quit.
* Merge r283061, r283063: don't dereference NULL is pf_get_mtag() fails.glebius2015-07-281-14/+18
| | | | PR: 200222
* Merge 280169: always lock the hash row of a source node when updatingglebius2015-07-282-66/+59
| | | | | | its 'states' counter. PR: 182401
* Merge r271458:glebius2015-07-281-10/+7
| | | | | | - Provide a sleepable lock to protect against ioctl() vs ioctl() races. - Use the new lock to protect against simultaneous DIOCSTART and/or DIOCSTOP ioctls.
* Merge r284280kp2015-06-181-7/+3
| | | | | | | | | | | pf: Remove frc_direction We don't use the direction of the fragments for anything. The frc_direction field is assigned, but never read. Just remove it. Differential Revision: https://reviews.freebsd.org/D2825 Reviewed by: gnn
* Merge r284222, r284260kp2015-06-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | pf: address family must be set when creating a pf_fragment Fix a panic when handling fragmented ip4 packets with 'drop-ovl' set. In that scenario we take a different branch in pf_normalize_ip(), taking us to pf_fragcache() (rather than pf_reassemble()). In pf_fragcache() we create a pf_fragment, but do not set the address family. This leads to a panic when we try to insert that into pf_frag_tree because pf_addr_cmp(), which is used to compare the pf_fragments doesn't know what to do if the address family is not set. Simply ensure that the address family is set correctly (always AF_INET in this path). When we try to look up a pf_fragment with pf_find_fragment() we compare (see pf_frag_compare()) addresses (and family), but also protocol. We failed to save the protocol to the pf_fragment in pf_fragcache(), resulting in failing reassembly. PR: 200330 Differential Revision: https://reviews.freebsd.org/D2824 Reviewed by: gnn
* Merge r278874, r278925, r278868kp2015-06-181-40/+36
| | | | | | | | | | | | - Improve INET/INET6 scope. - style(9) declarations. - Make couple of local functions static. - Even more fixes to !INET and !INET6 kernels. In collaboration with pluknet - Toss declarations to fix regular build and NO_INET6 build. Differential Revision: https://reviews.freebsd.org/D2823 Reviewed by: gnn
* Merge r281536kp2015-06-181-1/+1
| | | | | | | | | | | | | | pf: Fix forwarding detection If the direction is not PF_OUT we can never be forwarding. Some input packets have rcvif != ifp (looped back packets), which lead us to ip6_forward() inbound packets, causing panics. Equally, we need to ensure that packets were really received and not locally generated before trying to ip6_forward() them. Differential Revision: https://reviews.freebsd.org/D2822 Reviewed by: gnn
* Merge r281164kp2015-06-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | pf: Skip firewall for refragmented ip6 packets In cases where we scrub (fragment reassemble) on both input and output we risk ending up in infinite loops when forwarding packets. Fragmented packets come in and get collected until we can defragment. At that point the defragmented packet is handed back to the ip stack (at the pfil point in ip6_input(). Normal processing continues. Eventually we figure out that the packet has to be forwarded and we end up at the pfil hook in ip6_forward(). After doing the inspection on the defragmented packet we see that the packet has been defragmented and because we're forwarding we have to refragment it. In pf_refragment6() we split the packet up again and then ip6_forward() the individual fragments. Those fragments hit the pfil hook on the way out, so they're collected until we can reconstruct the full packet, at which point we're right back where we left off and things continue until we run out of stack. Break that loop by marking the fragments generated by pf_refragment6() as M_SKIP_FIREWALL. There's no point in processing those packets in the firewall anyway. We've already filtered on the full packet. Differential Revision: https://reviews.freebsd.org/D2819 Reviewed by: gnn
* Merge r280956kp2015-06-181-4/+4
| | | | | | | | | | | | | | | | pf: Deal with runt packets On Ethernet packets have a minimal length, so very short packets get padding appended to them. This padding is not stripped off in ip6_input() (due to support for IPv6 Jumbograms, RFC2675). That means PF needs to be careful when reassembling fragmented packets to not include the padding in the reassembled packet. While here also remove the 'Magic from ip_input.' bits. Splitting up and re-joining an mbuf chain here doesn't make any sense. Differential Revision: https://reviews.freebsd.org/D2818 Reviewed by: gnn
* Merge r280955kp2015-06-181-1/+7
| | | | | | | | | | | | | | | Preserve IPv6 fragment IDs accross reassembly and refragmentation When forwarding fragmented IPv6 packets and filtering with PF we reassemble and refragment. That means we generate new fragment headers and a new fragment ID. We already save the fragment IDs so we can do the reassembly so it's straightforward to apply the incoming fragment ID on the refragmented packets. Differential Revision: https://reviews.freebsd.org/D2817 Reviewed by: gnn
* Merge r278843, r278858kp2015-06-184-2/+93
| | | | | | | | | | | In the forwarding case refragment the reassembled packets with the same size as they arrived in. This allows the sender to determine the optimal fragment size by Path MTU Discovery. Roughly based on the OpenBSD work by Alexander Bluhm. Differential Revision: https://reviews.freebsd.org/D2816 Reviewed by: gnn
* Merge r278831, r278834kp2015-06-182-286/+552
| | | | | | | | Update the pf fragment handling code to closer match recent OpenBSD. That partially fixes IPv6 fragment handling. Differential Revision: https://reviews.freebsd.org/D2814 Reviewed by: gnn
* MFC 266852,270223:jhb2015-05-221-1/+1
| | | | | | | - Fix pf(4) to build with MAXCPU set to 256. MAXCPU is actually a count, not a maximum ID value (so it is a cap on mp_ncpus, not mp_maxid). - Bump MAXCPU on amd64 from 64 to 256. In practice APIC only permits 255 CPUs (IDs 0 through 254). Getting above that limit requires x2APIC.
* MFC: 281529gnn2015-05-091-1/+1
| | | | | | | | | | I can find no reason to allow packets with both SYN and FIN bits set past this point in the code. The packet should be dropped and not massaged as it is here. Differential Revision: https://reviews.freebsd.org/D2266 Submitted by: eri Sponsored by: Rubicon Communications (Netgate)
* MFC r279910:ae2015-03-191-0/+1
| | | | | | Reset mbuf pointer to NULL in fastroute case to indicate that mbuf was consumed by filter. This fixes several panics due to accessing to mbuf after free.
* Merge r274709 by eri@: deal with IPv6 same way as we IPv4 and calculateglebius2015-01-231-6/+6
| | | | | | the checksum before entering pf_test6(). PR: 172648, 179392
* MFC: 272906gnn2014-11-131-7/+7
| | | | | | | | | Change the PF hash from Jenkins to Murmur3. In forwarding tests this showed a conservative 3% incrase in PPS. Original Differential Revision: https://reviews.freebsd.org/D461 Submitted by: des Reviewed by: emaste
* MFC r263710, r273377, r273378, r273423 and r273455:hselasky2014-10-273-45/+43
| | | | | | | - De-vnet hash sizes and hash masks. - Fix multiple issues related to arguments passed to SYSCTL macros. Sponsored by: Mellanox Technologies
* Merge r272358 from head:glebius2014-10-161-2/+2
| | | | Use rn_detachhead() instead of direct free(9) for radix tables.
* Merge r270928: explicitly free packet on PF_DROP, otherwise a "quick"glebius2014-09-091-0/+8
| | | | | | | rule with "route-to" may still forward it. PR: 177808 Approved by: re (gjb)
OpenPOWER on IntegriCloud