summaryrefslogtreecommitdiffstats
path: root/sys/netpfil
Commit message (Collapse)AuthorAgeFilesLines
* Merge 'struct ip6protosw' and 'struct protosw' into one. Now we havekevlo2014-08-081-4/+7
| | | | | | | only one protocol switch structure that is shared between ipv4 and ipv6. Phabric: D476 Reviewed by: jhb
* On machines with strict alignment copy pfsync_state_key from packetglebius2014-07-101-15/+26
| | | | | | | on stack to avoid unaligned access. PR: 187381 Submitted by: Lytochkin Boris <lytboris gmail.com>
* Pull in r267961 and r267973 again. Fix for issues reported will follow.hselasky2014-06-282-3/+0
|
* Revert r267961, r267973:gjb2014-06-272-0/+3
| | | | | | | | | | These changes prevent sysctl(8) from returning proper output, such as: 1) no output from sysctl(8) 2) erroneously returning ENOMEM with tools like truss(1) or uname(1) truss: can not get etype: Cannot allocate memory
* Extend the meaning of the CTLFLAG_TUN flag to automatically check ifhselasky2014-06-272-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | there is an environment variable which shall initialize the SYSCTL during early boot. This works for all SYSCTL types both statically and dynamically created ones, except for the SYSCTL NODE type and SYSCTLs which belong to VNETs. A new flag, CTLFLAG_NOFETCH, has been added to be used in the case a tunable sysctl has a custom initialisation function allowing the sysctl to still be marked as a tunable. The kernel SYSCTL API is mostly the same, with a few exceptions for some special operations like iterating childrens of a static/extern SYSCTL node. This operation should probably be made into a factored out common macro, hence some device drivers use this. The reason for changing the SYSCTL API was the need for a SYSCTL parent OID pointer and not only the SYSCTL parent OID list pointer in order to quickly generate the sysctl path. The motivation behind this patch is to avoid parameter loading cludges inside the OFED driver subsystem. Instead of adding special code to the OFED driver subsystem to post-load tunables into dynamically created sysctls, we generalize this in the kernel. Other changes: - Corrected a possibly incorrect sysctl name from "hw.cbb.intr_mask" to "hw.pcic.intr_mask". - Removed redundant TUNABLE statements throughout the kernel. - Some minor code rewrites in connection to removing not needed TUNABLE statements. - Added a missing SYSCTL_DECL(). - Wrapped two very long lines. - Avoid malloc()/free() inside sysctl string handling, in case it is called to initialize a sysctl from a tunable, hence malloc()/free() is not ready when sysctls from the sysctl dataset are registered. - Bumped FreeBSD version to indicate SYSCTL API change. MFC after: 2 weeks Sponsored by: Mellanox Technologies
* DNOLD_IS_ECN introduced by r266941 is not required.hiren2014-06-011-3/+0
| | | | | | DNOLD_* flags are for compat with old binaries. Suggested by: luigi
* ECN marking implenetation for dummynet.hiren2014-06-013-5/+81
| | | | | | | | | | Changes include both DCTCP and RFC 3168 ECN marking methodology. DCTCP draft: http://tools.ietf.org/html/draft-bensley-tcpm-dctcp-00 Submitted by: Midori Kato (aoimidori27@gmail.com) Worked with: Lars Eggert (lars@netapp.com) Reviewed by: luigi, hiren
* Fix pf(4) to build with MAXCPU set to 256. MAXCPU is actually a count,jhb2014-05-291-1/+1
| | | | not a maximum ID value (so it is a cap on mp_ncpus, not mp_maxid).
* Since ipfw nat configures all options in one step, we should set all bitsae2014-05-181-1/+1
| | | | | | | | | in the mask when calling LibAliasSetMode() to properly clear unneeded options. PR: 189655 MFC after: 1 week Sponsored by: Yandex LLC
* Fix wrong formatting of 0.0.0.0/X table records in ipfw(8).melifaro2014-05-171-0/+1
| | | | | | | | | | | | | | Add `flags` u16 field to the hole in ipfw_table_xentry structure. Kernel has been guessing address family for supplied record based on xent length size. Userland, however, has been getting fixed-size ipfw_table_xentry structures guessing address family by checking address by IN6_IS_ADDR_V4COMPAT(). Fix this behavior by providing specific IPFW_TCF_INET flag for IPv4 records. PR: bin/189471 Submitted by: Dennis Yusupoff <dyr@smartspb.net> MFC after: 2 weeks
* o In pf_normalize_ip() we don't need mtag inglebius2014-05-171-22/+7
| | | | | | | | !(PFRULE_FRAGCROP|PFRULE_FRAGDROP) case. o In the (PFRULE_FRAGCROP|PFRULE_FRAGDROP) case we should allocate mtag if we don't find any. Tested by: Ian FREISLICH <ianf cloudseed.co.za>
* Define startup order the same way as it is in dummynet.trociny2014-04-261-2/+2
|
* The current API for adding rules with pool addresses is the following:glebius2014-04-251-1/+3
| | | | | | | | | | | | | | | | | | | | | - DIOCADDADDR adds addresses and puts them into V_pf_pabuf - DIOCADDRULE takes all addresses from V_pf_pabuf and links them into rule. The ugly part is that if address is a table, then it is initialized in DIOCADDRULE, because we need ruleset, and DIOCADDADDR doesn't supply ruleset. But if address is a dynaddr, we need address family, and address family could be different for different addresses in one rule, so dynaddr is initialized in DIOCADDADDR. This leads to the entangled state of addresses on V_pf_pabuf. Some are initialized, and some not. That's why running pf_empty_pool(&V_pf_pabuf) can lead to a panic on a NULL table address. Since proper fix requires API/ABI change, for now simply plug the panic in pf_empty_pool(). Reported by: danger
* Backport from projects/pf r263908:mm2014-04-202-12/+26
| | | | | | | | | De-virtualize UMA zone pf_mtag_z and move to global initialization part. The m_tag struct does not know about vnet context and the pf_mtag_free() callback is called unaware of current vnet. This causes a panic. MFC after: 1 week
* Set oif only for outgoing packets.ae2014-04-161-1/+1
| | | | | | PR: 188543 MFC after: 1 week Sponsored by: Yandex LLC
* Backout r257223,r257224,r257225,r257246,r257710. The changes causedglebius2014-04-162-355/+84
| | | | | | | some regressions in ICMP handling, and right now me and Baptiste are out of time on analyzing them. PR: 188253
* Free resources and error cases; re-indent a curly brace while here.brueffer2014-04-131-3/+7
| | | | | | CID: 1199366 Found with: Coverity Prevent(tm) MFC after: 1 week
* Merge from projects/pf r264198:mm2014-04-071-6/+12
| | | | | | | Execute pf_overload_task() in vnet context. Fixes a vnet kernel panic. Reviewed by: trociny MFC after: 1 week
* Merge from projects/pf r251993 (glebius@):mm2014-03-253-45/+43
| | | | | | | | | De-vnet hash sizes and hash masks. Submitted by: Nikos Vassiliadis <nvass gmx.com> Reviewed by: trociny MFC after: 1 month
* Fix breakage in ipfw+VIMAGE after r261590.glebius2014-03-211-14/+6
| | | | | PR: kern/187665 Sponsored by: Nginx, Inc.
* - Remove rt_metrics_lite and simply put its members into rtentry.glebius2014-03-051-1/+1
| | | | | | | | | | | | | | | | - Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This removes another cache trashing ++ from packet forwarding path. - Create zini/fini methods for the rtentry UMA zone. Via initialize mutex and counter in them. - Fix reporting of rmx_pksent to routing socket. - Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode. The change is mostly targeted for stable/10 merge. For head, rt_pksent is expected to just disappear. Discussed with: melifaro Sponsored by: Netflix Sponsored by: Nginx, Inc.
* Instead of playing games with casts simply add 3 more members to theglebius2014-03-051-10/+3
| | | | | | | structure pf_rule, that are used when the structure is passed via ioctl(). PR: 187074
* Revert r262196mm2014-02-191-30/+19
| | | | | I am going to split this into two individual patches and test it with the projects/pf branch that may get merged later.
* De-virtualize pf_mtag_z [1]mm2014-02-181-19/+30
| | | | | | | | | | | | Process V_pf_overloadqueue in vnet context [2] This fixes two VIMAGE kernel panics and allows to simultaneously run host-pf and vnet jails. pf inside jails remains broken. PR: kern/182964 Submitted by: glebius@FreeBSD.org [2], myself [1] Tested by: rodrigc@FreeBSD.org, myself MFC after: 2 weeks
* Summary: Two quick edits to the implementation notes as they're nognn2014-02-151-2/+2
| | | | longer stored in netinet but in netpfil.
* Under sys/netpfil/ipfw, surround two IPv6-specific static functions withdim2014-02-152-0/+4
| | | | | | #ifdef INET6, since they are unused when INET6 is disabled. MFC after: 3 days
* Once pf became not covered by a single mutex, many counters in it becameglebius2014-02-143-46/+72
| | | | | | | | | | | | | | | | | | | | race prone. Some just gather statistics, but some are later used in different calculations. A real problem was the race provoked underflow of the states_cur counter on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this value is used in pf_state_expires() and any state created by this rule is immediately expired. Thus, make fields states_cur, states_tot and src_nodes of struct pf_rule be counter(9)s. Thanks to Dennis for providing me shell access to problematic box and his help with reproducing, debugging and investigating the problem. Thanks to: Dennis Yusupoff <dyr smartspb.net> Also reported by: dumbbell, pgj, Rambler Sponsored by: Nginx, Inc.
* Reorder struct ip_fw_chain:melifaro2014-01-243-10/+12
| | | | | | | | * move rarely-used fields down * move uh_lock to different cacheline * remove some usused fields Sponsored by: Yandex LLC
* Remove NULL pointer dereference.glebius2014-01-221-1/+0
| | | | CID: 1009118
* Fix resource leak and simplify code for DIOCCHANGEADDR.glebius2014-01-221-24/+18
| | | | CID: 1007035
* Revert r260548. We really should not use IPFW_WLOCK() heremelifaro2014-01-111-3/+3
| | | | but this requires some more playing with IPFW_UH_WLOCK(). Leave till later.
* We don't need chain write lock since we're not modifying its contents.melifaro2014-01-111-3/+3
| | | | | | | | | LibAliasSetAddress() uses its own mutex to serialize changes. While here, convert ifp->if_xname access to if_name() function. MFC after: 2 weeks Sponsored by: Yandex LLC
* When pf_get_translation() fails, it should leave *sn pointer pristine,glebius2014-01-061-0/+1
| | | | | | otherwise we will panic in pf_test_rule(). PR: 182557
* Use rnh_matchaddr instead of rnh_lookup for longest-prefix match.melifaro2014-01-031-3/+3
| | | | | | | rnh_lookup is effectively the same as rnh_matchaddr if called with empy network mask. MFC after: 2 weeks
* Fix incorrect header guard define in sys/netpfil/pf/pf.h, which snuck indim2013-12-221-1/+1
| | | | in r257186. Found by clang 3.4.
* Fix fallout from r258479: in pf_free_src_node() the node must alreadyglebius2013-12-221-1/+0
| | | | | | | be unlinked. Reported by: Konstantin Kukushkin <dark rambler-co.ru> Sponsored by: Nginx, Inc.
* Add net.inet.ip.fw.dyn_keep_states sysctl whichmelifaro2013-12-181-1/+24
| | | | | | | | | | | re-links dynamic states to default rule instead of flushing on rule deletion. This can be useful while performing ruleset reload (think about `atomic` reload via changing sets). Currently it is turned off by default. MFC after: 2 weeks Sponsored by: Yandex LLC
* Simplify O_NAT opcode handling.melifaro2013-11-281-19/+16
| | | | | MFC after: 2 weeks Sponsored by: Yandex LLC
* Check ipfw table numbers in both user and kernel space before rule addition.melifaro2013-11-281-1/+1
| | | | | | Found by: Saychik Pavel <umka@localka.net> MFC after: 2 weeks Sponsored by: Yandex LLC
* In sys/netpfil/ipfw/ip_fw_nat.c:vnet_ipfw_nat_uninit() we call ↵rodrigc2013-11-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | "IPFW_WLOCK(chain);". This lock gets deleted in sys/netpfil/ipfw/ip_fw2.c:vnet_ipfw_uninit(). Therefore, vnet_ipfw_nat_uninit() *must* be called before vnet_ipfw_uninit(), but this doesn't always happen, because the VNET_SYSINIT order is the same for both functions. In sys/net/netpfil/ipfw/ip_fw2.c and sys/net/netpfil/ipfw/ip_fw_nat.c, IPFW_SI_SUB_FIREWALL == IPFW_NAT_SI_SUB_FIREWALL == SI_SUB_PROTO_IFATTACHDOMAIN and IPFW_MODULE_ORDER == IPFW_NAT_MODULE_ORDER Consequently, if VIMAGE is enabled, and jails are created and destroyed, the system sometimes crashes, because we are trying to use a deleted lock. To reproduce the problem: (1) Take a GENERIC kernel config, and add options for: VIMAGE, WITNESS, INVARIANTS. (2) Run this command in a loop: jail -l -u root -c path=/ name=foo persist vnet && jexec foo ifconfig lo0 127.0.0.1/8 && jail -r foo (see http://lists.freebsd.org/pipermail/freebsd-current/2010-November/021280.html ) Fix the problem by increasing the value of IPFW_NAT_SI_SUB_FIREWALL, so that vnet_ipfw_nat_uninit() runs after vnet_ipfw_uninit().
* The DIOCKILLSRCNODES operation was implemented with O(m*n) complexity,glebius2013-11-221-38/+56
| | | | | | | | | | | | | | | | where "m" is number of source nodes and "n" is number of states. Thus, on heavy loaded router its processing consumed a lot of CPU time. Reimplement it with O(m+n) complexity. We first scan through source nodes and disconnect matching ones, putting them on the freelist and marking with a cookie value in their expire field. Then we scan through the states, detecting references to source nodes with a cookie, and disconnect them as well. Then the freelist is passed to pf_free_src_nodes(). In collaboration with: Kajetan Staszkiewicz <kajetan.staszkiewicz innogames.de> PR: kern/176763 Sponsored by: InnoGames GmbH Sponsored by: Nginx, Inc.
* To support upcoming changes change internal API for source node handling:glebius2013-11-221-16/+54
| | | | | | | | | | | | | | | - Removed pf_remove_src_node(). - Introduce pf_unlink_src_node() and pf_unlink_src_node_locked(). These function do not proceed with freeing of a node, just disconnect it from storage. - New function pf_free_src_nodes() works on a list of previously disconnected nodes and frees them. - Utilize new API in pf_purge_expired_src_nodes(). In collaboration with: Kajetan Staszkiewicz <kajetan.staszkiewicz innogames.de> Sponsored by: InnoGames GmbH Sponsored by: Nginx, Inc.
* Fix off by ones when scanning source nodes hash.glebius2013-11-221-3/+3
| | | | Sponsored by: Nginx, Inc.
* Style: don't compare unsigned <= 0.glebius2013-11-221-3/+3
| | | | Sponsored by: Nginx, Inc.
* add a counter on the struct mq (a queue of mbufs),luigi2013-11-223-0/+32
| | | | and add a block for userspace compiling.
* disable some ipfw match options when compiling in userspaceluigi2013-11-221-2/+10
|
* make this code compile in userspace on OSXluigi2013-11-221-0/+7
|
* more support for userspace compiling of this code:luigi2013-11-221-0/+10
| | | | emulate the uma_zone for dynamic rules.
* make ipfw_check_packet() and ipfw_check_frame() public,luigi2013-11-221-4/+4
| | | | | | | | so they can be used in the userspace version of ipfw/dummynet (normally using netmap for the I/O path). This is the first of a few commits to ease compiling the ipfw kernel code in userspace.
* Some fixups to pf_get_sport after r257223:glebius2013-11-141-7/+4
| | | | | | | - Do not return blindly if proto isn't ICMP. - The dport is in network order, so fix comparisons. - Remove ridiculous htonl(arc4random()). - Push local variable to a narrower block.
OpenPOWER on IntegriCloud