summaryrefslogtreecommitdiffstats
path: root/sys/netpfil
Commit message (Collapse)AuthorAgeFilesLines
...
* Cast some expressions that multiply a long long constant by atruckman2016-05-292-12/+12
| | | | | | | | | | | floating point constant to int64_t. This avoids the runtime conversion of the the other operand in a set of comparisons from int64_t to floating point and doing the comparisions in floating point. Suggested by: lidl Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> MFC after: 2 weeks (with r300779)
* Correct a typo in a comment.truckman2016-05-261-1/+1
| | | | MFC after: 2 weeks (with r300779)
* Modify BOUND_VAR() macro to wrap all of its arguments in () and tweaktruckman2016-05-261-2/+2
| | | | | | | | its expression to work on powerpc and sparc64 (gcc compatibility). Correct a typo in a nearby comment. MFC after: 2 weeks (with r300779)
* Import Dummynet AQM version 0.2.1 (CoDel, FQ-CoDel, PIE and FQ-PIE).truckman2016-05-2619-2/+4572
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Centre for Advanced Internet Architectures Implementing AQM in FreeBSD * Overview <http://caia.swin.edu.au/freebsd/aqm/index.html> * Articles, Papers and Presentations <http://caia.swin.edu.au/freebsd/aqm/papers.html> * Patches and Tools <http://caia.swin.edu.au/freebsd/aqm/downloads.html> Overview Recent years have seen a resurgence of interest in better managing the depth of bottleneck queues in routers, switches and other places that get congested. Solutions include transport protocol enhancements at the end-hosts (such as delay-based or hybrid congestion control schemes) and active queue management (AQM) schemes applied within bottleneck queues. The notion of AQM has been around since at least the late 1990s (e.g. RFC 2309). In recent years the proliferation of oversized buffers in all sorts of network devices (aka bufferbloat) has stimulated keen community interest in four new AQM schemes -- CoDel, FQ-CoDel, PIE and FQ-PIE. The IETF AQM working group is looking to document these schemes, and independent implementations are a corner-stone of the IETF's process for confirming the clarity of publicly available protocol descriptions. While significant development work on all three schemes has occured in the Linux kernel, there is very little in FreeBSD. Project Goals This project began in late 2015, and aims to design and implement functionally-correct versions of CoDel, FQ-CoDel, PIE and FQ_PIE in FreeBSD (with code BSD-licensed as much as practical). We have chosen to do this as extensions to FreeBSD's ipfw/dummynet firewall and traffic shaper. Implementation of these AQM schemes in FreeBSD will: * Demonstrate whether the publicly available documentation is sufficient to enable independent, functionally equivalent implementations * Provide a broader suite of AQM options for sections the networking community that rely on FreeBSD platforms Program Members: * Rasool Al Saadi (developer) * Grenville Armitage (project lead) Acknowledgements: This project has been made possible in part by a gift from the Comcast Innovation Fund. Submitted by: Rasool Al-Saadi <ralsaadi@swin.edu.au> X-No objection: core MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D6388
* pf: Fix more ICMP mistranslationkp2016-05-231-1/+1
| | | | | | | | In the default case fix the substitution of the destination address. PR: 201519 Submitted by: Max <maximos@als.nnov.ru> MFC after: 1 week
* pf: Fix ICMP translationkp2016-05-231-10/+5
| | | | | | | | Fix ICMP source address rewriting in rdr scenarios. PR: 201519 Submitted by: Max <maximos@als.nnov.ru> MFC after: 1 week
* pf: Fix fragment timeoutkp2016-05-201-1/+1
| | | | | | | | We were inconsistent about the use of time_second vs. time_uptime. Always use time_uptime so the value can be meaningfully compared. Submitted by: "Max" <maximos@als.nnov.ru> MFC after: 4 days
* Fix the regression introduced in r300143.ae2016-05-201-3/+3
| | | | | When we are creating new dynamic state use MATCH_FORWARD direction to correctly initialize protocol's state.
* Move protocol state handling code from lookup_dyn_rule_locked() functionae2016-05-181-79/+86
| | | | | | | | | into dyn_update_proto_state(). This allows eliminate the second state lookup in the ipfw_install_state(). Also remove MATCH_* macros, they are defined in ip_fw_private.h as enum. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Make named objects set-aware. Now it is possible to create namedae2016-05-174-296/+493
| | | | | | | | | | | | | | | | | | | objects with the same name in different sets. Add optional manage_sets() callback to objects rewriting framework. It is intended to implement handler for moving and swapping named object's sets. Add ipfw_obj_manage_sets() function that implements generic sets handler. Use new callback to implement sets support for lookup tables. External actions objects are global and they don't support sets. Modify eaction_findbyname() to reflect this. ipfw(8) now may fail to move rules or sets, because some named objects in target set may have conflicting names. Note that ipfw_obj_ntlv type was changed, but since lookup tables actually didn't support sets, this change is harmless. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Fix memory leak possible in error case.ae2016-05-111-2/+4
| | | | | | | | Use free_rule() instead of free(), it will also release memory allocated for rule counters. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Change the type of objhash_cb_t callback function to be able return anae2016-05-066-25/+40
| | | | | | | error code. Use it to interrupt the loop in ipfw_objhash_foreach(). Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Rename find_name_tlv_type() to ipfw_find_name_tlv_type() and make itae2016-05-053-44/+9
| | | | | | | | global. Use it in ip_fw_table.c instead of find_name_tlv() to reduce duplicated code. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* sys/net*: minor spelling fixes.pfg2016-05-0314-32/+32
| | | | No functional change.
* Make create_object callback optional and return EOPNOTSUPP when it isn'tae2016-04-272-13/+10
| | | | | | | defined. Remove eaction_create_compat() and use designated initializers to initialize eaction_opcodes structure. Obtained from: Yandex LLC
* netpfil: for pointers replace 0 with NULL.pfg2016-04-153-4/+4
| | | | | | | | These are mostly cosmetical, no functional change. Found with devel/coccinelle. Reviewed by: ae
* Add External Actions KPI to ipfw(9).ae2016-04-145-16/+518
| | | | | | | | | | | | | It allows implementing loadable kernel modules with new actions and without needing to modify kernel headers and ipfw(8). The module registers its action handler and keyword string, that will be used as action name. Using generic syntax user can add rules with this action. Also ipfw(8) can be easily modified to extend basic syntax for external actions, that become a part base system. Sample modules will coming soon. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Change the type of 'etlv' field in struct named_object to uint16_t.ae2016-04-142-4/+5
| | | | | | | It should match with the type field in struct ipfw_obj_tlv. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Adjust some comments and make ref_opcode_object() static.ae2016-04-141-4/+3
|
* o Teach opcode rewriting framework handle several rewriters forae2016-04-141-80/+107
| | | | | | | | | | | | | | | | | | the same opcode. o Reduce number of times classifier callback is called. It is redundant to call it just after find_op_rw(), since the last does call it already and can have all results. o Do immediately opcode rewrite in the ref_opcode_object(). This eliminates additional classifier lookup later on bulk update. For unresolved opcodes the behavior still the same, we save information from classifier callback in the obj_idx array, then perform automatic objects creation, then perform rewriting for opcodes using indeces from created objects. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Move several functions related to opcode rewriting framework fromae2016-04-143-140/+141
| | | | | | ip_fw_table.c into ip_fw_sockopt.c and make them static. Obtained from: Yandex LLC
* Cleanup unnecessary semicolons from the kernel.pfg2016-04-101-1/+1
| | | | Found with devel/coccinelle.
* pf: Improve forwarding detectionkp2016-03-161-4/+6
| | | | | | | | | | When we guess the nature of the outbound packet (output vs. forwarding) we need to take bridges into account. When bridging the input interface does not match the output interface, but we're not forwarding. Similarly, it's possible for the interface to actually be the bridge interface itself (and not a member interface). PR: 202351 MFC after: 2 weeks
* Use correct size for malloc.ae2016-03-031-1/+1
| | | | | Obtained from: Yandex LLC MFC after: 1 week
* Remove taskqueue_enqueue_fast().jhb2016-03-011-1/+1
| | | | | | | | | | taskqueue_enqueue() was changed to support both fast and non-fast taskqueues 10 years ago in r154167. It has been a compat shim ever since. It's time for the compat shim to go. Submitted by: Howard Su <howard0su@gmail.com> Reviewed by: sephe Differential Revision: https://reviews.freebsd.org/D5131
* pf: Fix possible out-of-bounds writekp2016-02-251-2/+3
| | | | | | | | | | | | | | | | | | In the DIOCRSETADDRS ioctl() handler we allocate a table for struct pfr_addrs, which is processed in pfr_set_addrs(). At the users request we also provide feedback on the deleted addresses, by storing them after the new list ('bcopy(&ad, addr + size + i, sizeof(ad));' in pfr_set_addrs()). This means we write outside the bounds of the buffer we've just allocated. We need to look at pfrio_size2 instead (i.e. the size the user reserved for our feedback). That'd allow a malicious user to specify a smaller pfrio_size2 than pfrio_size though, in which case we'd still read outside of the allocated buffer. Instead we allocate the largest of the two values. Reported By: Paul J Murphy <paul@inetstat.net> PR: 207463 MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D5426
* Fix bug in filling and handling ipfw's O_DSCP opcode.ae2016-02-241-1/+1
| | | | | | | Due to integer overflow CS4 token was handled as BE. PR: 207459 MFC after: 1 week
* in pf_print_state_parts, do not use skw->proto to print the protocol but ourkp2016-02-201-1/+1
| | | | | | | local copy proto that we very carefully set beforehands. skw being NULL is perfectly valid there. Obtained from: OpenBSD (henning)
* Fix obvious typo, that lead to incorrect sorting.glebius2016-02-181-1/+1
| | | | Found by: PVS-Studio
* These files were getting sys/malloc.h and vm/uma.h with header pollutionglebius2016-02-011-1/+2
| | | | via sys/mbuf.h
* cleanup and document in some detail the internals of the testing codeluigi2016-01-275-143/+199
| | | | for dummynet schedulers
* the _Static_assert was not supposed to be in the commit.luigi2016-01-271-1/+0
|
* bugfix: the scheduler template (dn_schk) for the round robin schedulerluigi2016-01-271-1/+2
| | | | | | | | | | | | is followed by another structure (rr_schk) whose size must be set in the schk_datalen field of the descriptor. Not allocating the memory may cause other memory to be overwritten (though dn_schk is 192 bytes and rr_schk only 12 so we may be lucky and end up in the padding after the dn_schk). This is a merge candidate for stable and 10.3 MFC after: 3 days
* fix various warnings to compile the test code with -Wextraluigi2016-01-263-3/+9
|
* fix various warnings (signed/unsigned, printf types, unused arguments)luigi2016-01-261-13/+16
|
* prevent warnings for signed/unsigned comparisons and unused arguments.luigi2016-01-261-6/+14
| | | | Add checks for parameters overflowing 32 bit.
* prevent warning for unused argumentluigi2016-01-261-0/+1
|
* avoid warnings for signed/unsigned comparison and unused argumentsluigi2016-01-261-1/+3
|
* Revert one chunk from commit 285362, which introduced an off-by-one errorluigi2016-01-261-2/+6
| | | | | | | | | in computing a shift index. The error was due to the use of mixed fls() / __fls() functions in another implementation of qfq. To avoid that the problem occurs again, properly document which incarnation of the function we need. Note that the bug only affects QFQ in FreeBSD head from last july, as the patch was not merged to other versions.
* MFP r287070,r287073: split radix implementation and route table structure.melifaro2016-01-252-54/+55
| | | | | | | | | | | | | | | | | | | | | | | There are number of radix consumers in kernel land (pf,ipfw,nfs,route) with different requirements. In fact, first 3 don't have _any_ requirements and first 2 does not use radix locking. On the other hand, routing structure do have these requirements (rnh_gen, multipath, custom to-be-added control plane functions, different locking). Additionally, radix should not known anything about its consumers internals. So, radix code now uses tiny 'struct radix_head' structure along with internal 'struct radix_mask_head' instead of 'struct radix_node_head'. Existing consumers still uses the same 'struct radix_node_head' with slight modifications: they need to pass pointer to (embedded) 'struct radix_head' to all radix callbacks. Routing code now uses new 'struct rib_head' with different locking macro: RADIX_NODE_HEAD prefix was renamed to RIB_ (which stands for routing information base). New net/route_var.h header was added to hold routing subsystem internal data. 'struct rib_head' was placed there. 'struct rtentry' will also be moved there soon.
* Fix panic on table/table entry delete. The panic could have happenedmelifaro2016-01-211-0/+1
| | | | | | | | | | | | | | if more than 64 distinct values had been used. Table value code uses internal objhash API which requires unique key for each object. For value code, pointer to the actual value data is used. The actual problem arises from the fact that 'actual' e.g. runtime data is stored in array and that array is auto-growing. There is special hook (update_tvalue() function) which is used to update the pointers after the change. For some reason, object 'key' was not updated. Fix this by adding update code to the update_tvalue(). Sponsored by: Yandex LLC
* Initialize error value ta_lookup_kfib() by default to please compiler.melifaro2016-01-101-3/+1
|
* Initialize error after r293626 in case neither INET nor INET6 isbz2016-01-101-0/+3
| | | | | | compiled into the kernel. Ideally lots more code would just not be called (or compiled in) in that case but that requires a lot more surgery. For now try to make IP-less kernels compile again.
* Make ipfw addr:kfib lookup algo use new routing KPI.melifaro2016-01-101-49/+72
|
* Use already pre-calculated number of entries instead of tc->count.melifaro2016-01-101-1/+1
|
* Remove sys/eventhandler.h from net/route.hmelifaro2016-01-091-0/+1
| | | | Reviewed by: ae
* Convert pf(4) to the new routing API.melifaro2016-01-071-42/+89
| | | | Differential Revision: https://reviews.freebsd.org/D4763
* Properly drain callouts in the IPFW subsystem to avoid use after freehselasky2015-12-153-6/+12
| | | | | | | | | | | | | | | | | panics when unloading the dummynet and IPFW modules: - The callout drain function can sleep and should not be called having a non-sleepable lock locked. Remove locks around "ipfw_dyn_uninit(0)". - Add a new "dn_gone" variable to prevent asynchronous restart of dummynet callouts when unloading the dummynet kernel module. - Call "dn_reschedule()" locked so that "dn_gone" can be set and checked atomically with regard to starting a new callout. Reviewed by: hiren MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D3855
* Merge helper fib* functions used for basic lookups.melifaro2015-12-081-59/+23
| | | | | | | | | | | | | | | | | | | | Vast majority of rtalloc(9) users require only basic info from route table (e.g. "does the rtentry interface match with the interface I have?". "what is the MTU?", "Give me the IPv4 source address to use", etc..). Instead of hand-rolling lookups, checking if rtentry is up, valid, dealing with IPv6 mtu, finding "address" ifp (almost never done right), provide easy-to-use API hiding all the complexity and returning the needed info into small on-stack structure. This change also helps hiding route subsystem internals (locking, direct rtentry accesses). Additionaly, using this API improves lookup performance since rtentry is not locked. (This is safe, since all the rtentry changes happens under both radix WLOCK and rtentry WLOCK). Sponsored by: Yandex LLC
* Add destroy_object callback to object rewriting framework.ae2015-11-232-2/+11
| | | | | | | | It is called when last reference to named object is going to be released and allows to do additional cleanup for implementation of named objects. Obtained from: Yandex LLC Sponsored by: Yandex LLC
OpenPOWER on IntegriCloud