summaryrefslogtreecommitdiff
path: root/sys/net/if_pflog.c
AgeCommit message (Collapse)Author
2018-01-09Creating a cloned interface could return ENOMEM due to temporaryAlexander Bluhm
memory shortage. As it is invoked from a system call, it should not fail and wait instead. OK visa@ mpi@
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-05-16Kill unused global list and protect global array by the NET_LOCK().Martin Pieuchot
ok bluhm@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2017-01-23Flag pseudo-interfaces as such in order to call add_net_randomness()Martin Pieuchot
only once per packet. Fix a regression introduced when if_input() started to be called by every pseudo-driver. ok claudio@, dlg@
2016-11-22Fold union pf_headers buffer into struct pf_pdesc (enabled by pfvar_priv.h).Richard Procter
Prevent pf_socket_lookup() reading uninitialised header buffers on fragments. OK blum@ sashan@
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-04-29Make if_output() return EAFNOSUPPORT instead of just dropping packetsKenneth R Westerback
and pretending the output succeeded. Packets are still dropped! Idea from jsg@ following same change to bridge(4). ok mpi@
2015-12-05remove old lint annotationsTed Unangst
2015-11-10flush the send queue in start routines with IFQ_PURGE.David Gwynne
ok mpi@ uebayasi@
2015-08-25#if INET && INET6 -> #ifdef INET6, the kernel no longer defines INETJonathan Gray
since July. The code involved deals with af-to handling.
2015-07-15m_freem() can handle NULL, do not check for this condition beforehands.Theo de Raadt
ok stsp mpi
2015-02-13Include sys/stdint.h for SIZE_MAX instead of relying on the misplacedTodd C. Miller
define in sys/limits.h. OK guenther@
2015-02-12change log(matches) semantics slightly to make it more useful. since itHenning Brauer
is a debug tool change of semantics not considered problematic. up until now, log(matches) forced logging on subsequent matching rules, the actual logging used the log settings from that matched rule. now, log(matches) causes subsequent matches to be logged with the log settings from the log(matches) rule. in particular (this was the driving point), log(matches, to pflog23) allows you to have the trace log going to a seperate pflog interface, not clobbering your regular pflogs, actually not affecting them at all. long conversation with bluhm about it, which didn't lead to a single bit changed in the diff but was very very helpful. ok bluhm as well.
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-12-02replace some malloc multiplies with mallocarry. ok deraadt henningTed Unangst
2014-09-08When logging a packet to a listener on the pflog0 interface, theAlexander Bluhm
function pflog_bpfcopy() is setting up a packet description with pf_setup_pdesc(). When pf_setup_pdesc() is droppig a bad packet, it increments the the pf status counters. This way bad packets could be accounted multiple times. Now pflog_bpfcopy() passes a reason pointer NULL to indicate that no accounting should be done. From Florian Riehm; OK henning@
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-07-09tedu bpf_mtap_pflog().Henning Brauer
now that it is a trivial wrapper around the extended bpf_mtap_hdr, we can use bpf_mtap_hdr directly. added benefit: pflog_bpfcopy doesn't need to be exported any more and can stay private to if_pflog.c ok benno bluhm reyk
2014-06-25pf_translate doesn't use the mbuf argument anymore.Mike Belopuhov
From Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. Thanks!
2013-11-16Remove dead assignments and now unused variables.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ mikeb@ bluhm@
2013-10-24Remove the number of in6_var.h inclusions by moving some functions andMartin Pieuchot
global variables to in6.h. ok deraadt@
2013-10-23Remove the number of in_var.h inclusions by moving some functions andMartin Pieuchot
global variables to in.h. ok mikeb@, deraadt@
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-03-26Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.Martin Pieuchot
ok beck@, mikeb@
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-07-08there was a limit on the number of pflog interfaces - 16. remove that.Henning Brauer
mostly by dynamically allocating pflogifs instead of making that a static array. ok claudio zinke
2012-02-03The kernel did not compile without INET6. Put some #ifdefs intoAlexander Bluhm
pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
2012-01-27If some length checks in pflog_bpfcopy() failed, the functionAlexander Bluhm
returned early. As a result tcpdump -i pflog0 printed uninitialized kernel memory for short packets. Fix this by copying the mbuf data we have if we cannot decode the packet. ok mikeb@ henning@
2012-01-15Calling pf_normalize_ip() from pf_setup_pdesc() was bad as theAlexander Bluhm
latter is called from pf packet logging. This resulted in normalization and reassembly of bad packets to be logged. So rearrange the code and move the call to pf_test(). ok henning@
2011-12-21don't attempt to run pf_translate on fragments: it will fail miserably.Mike Belopuhov
also don't do af translation if pf_translate didn't succeed. ok henning
2011-10-21strengthen some checks to prevent m_copy* routines from operatingMike Belopuhov
on mbuf chains of insufficient length; prevents crashes seen by dhill. also bring in some chunks omitted in the nat64 commit and are essential for correct packet interpretation. tested by dhill and me, ok henning
2011-10-13Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyClaudio Jeker
"af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
2011-09-28As requested by henning, move the mbuf pointer into struct pf_pdesc.Alexander Bluhm
Also sort pd to the beginning of the functions' parameter lists for consistency. ok henning
2011-09-20Put kif and dir into pdesc an use this instead of passing the valuesAlexander Bluhm
around. This is a mechanical change. Initialize pd2 and use it where appropriate. ok henning on an earlier version; ok mpf
2011-09-19Consolidate pf function parameters. Move off and hdrlen into pdescAlexander Bluhm
and change their type from int to u_int32_t. Do not pass struct tcphdr *th and sa_family_t af, it is in pd anyway. Do not use af and pd->af intermixed, the latter makes clear where it comes from. Do not calculate the packet length again if pd already has it. Use pd2.off instead of off2. go go go go don't stop henning@ mpf@
2011-09-18Move the pdesc initialization code into pf_setup_pdesc(). UnifyAlexander Bluhm
some IPv4 and IPv6 code. Make sure that both code paths set the same fields in the same order. ok mpf henning
2011-09-18Move the call to pf_test_rule() for fragments that have not beenAlexander Bluhm
reassembled by normalization from pf_setup_pdesc() to pf_test(). This simplifies the paramter list of pf_setup_pdesc() as it can concentrate on its job filling the pf_pdesc struct. ok henning mpf
2011-07-07Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesRyan Thomas McBride
a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
2011-07-06cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmHenning Brauer
2011-07-05Explicitly reserve space for special ICMP6 headers in pf_hdrs, likeAlexander Bluhm
it was done for pf_headers in pf.c. ok mcbride@ henning@
2011-06-20More cleanup in pf_test/pf_test6 this time mostly the fragmentClaudio Jeker
handling. More to come to make the two codepathes a bit more identical. tested by many (esp. krw@ and sthen@) input and OK bluhm@
2011-05-22Do not pass AF specific information to pf_test_rule() and PFLOG_PACKET()Claudio Jeker
because either the info is already available in struct pd or easy to figure out. Makes pf_test() and pf_test6() even more similar (with the target to remove one of them in the near future). OK henning@
2010-12-07remove a bunch of unused argumentsJonathan Gray
ok henning@
2010-09-21Don't dereference null pointers for protocols without port numbers.Stuart Henderson
From henning@, fixed pflog_bgpcopy crashes.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 01:09:22 +0000