summaryrefslogtreecommitdiff
path: root/sys/net/if_pfsync.c
AgeCommit message (Collapse)Author
2017-06-09- pfsync_input() must grab PF_LOCKAlexandr Nedvedicky
reported and patch tested by Hrvoje Popovski O.K. bluhm@
2017-05-27Remove useless splnet()/splx() dances.Martin Pieuchot
pfsyncioctl() is executed with the NET_LOCK() held which is enough. ok sashan@
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-04-11Partially revert previous mallocarray conversions that containDavid Hill
constants. The consensus is that if both operands are constant, we don't need mallocarray. Reminded by tedu@ ok deraadt@
2017-04-09Use mallocarray to allocate multicast group memberships.David Hill
ok deraadt@
2017-04-05When building counter memory in preparation to copy to userland, alwaysTheo de Raadt
zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
2017-03-11Add a detachhook to pfsync(4) which deals with the syncdev going away.Stefan Sperling
Fixes a panic observed by douple-p (aka pb@) when destroying the syncdev. tweak & ok mpi@
2017-02-20pfsync(4) percpu countersJeremie Courreges-Anglas
ok florian@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
2017-01-25Since raw_input() and route_input() are gone from pr_input, we canAlexander Bluhm
make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
2017-01-23Flag pseudo-interfaces as such in order to call add_net_randomness()Martin Pieuchot
only once per packet. Fix a regression introduced when if_input() started to be called by every pseudo-driver. ok claudio@, dlg@
2017-01-20pfsync_update_net_tdb() is only called at IPL_SOFTNET, no need for aMartin Pieuchot
splsofnet()/splx() dance. Tested by Hrvoje Popovski, ok visa@
2017-01-20No need to handle SIOCAIFADDR in drivers, it's never passed down toMartin Pieuchot
them. ok claudio@
2016-12-19Timer sending packets need to grab the NET_LOCK().Martin Pieuchot
ok bluhm@
2016-11-22Fold union pf_headers buffer into struct pf_pdesc (enabled by pfvar_priv.h).Richard Procter
Prevent pf_socket_lookup() reading uninitialised header buffers on fragments. OK blum@ sashan@
2016-11-14Instead of passing an extra mbuf pointer to pf_route(), it shouldAlexander Bluhm
just use pd->m. Then pf_test() can also operate on pd.m and set the *m0 value in the caller just before it returns. OK sashan@
2016-10-27Pass a struct pf_pdesc to pf_route() like it is done in the otherAlexander Bluhm
pf functions. That means less parameters, more consistency and later we can call functions that need a pd from pf_route(). OK sashan@
2016-10-04Convert timeouts that need a process context to timeout_set_proc(9).Martin Pieuchot
The current reason is that rtalloc_mpath(9) inside ip_output() might end up inserting a RTF_CLONED route and that require a write lock. ok kettenis@, bluhm@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-21Remove recursive splsoftnet() calls, from David Hill.Martin Pieuchot
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-08-23pool_setiplDavid Gwynne
2016-04-29Make if_output() return EAFNOSUPPORT instead of just dropping packetsKenneth R Westerback
and pretending the output succeeded. Packets are still dropped! Idea from jsg@ following same change to bridge(4). ok mpi@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-27white space tweaks. no functional change.David Gwynne
2016-01-26- state keys imported by if_pfsync trip refcnt != ~0 AssertAlexandr Nedvedicky
OK mpi@
2015-12-05remove old lint annotationsTed Unangst
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-11-10flush the send queue in start routines with IFQ_PURGE.David Gwynne
ok mpi@ uebayasi@
2015-10-30Clean up handling of 'clear states' pfsync packets.Mike Belopuhov
If interface was specified in the packet only if-bound states attached to this interface must be purged. ok mpi, looked at by sasha@
2015-09-11Kill yet another argument to functions in IPv6. This time ip6_output'sClaudio Jeker
ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
2015-06-16Store a unique ID, an interface index, rather than a pointer to theMartin Pieuchot
receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-10include the "set prio" values.Henning Brauer
no real compat issue since we're using spare bytes. old -> new ends up with set prio (0, 0) equivalent new -> old is entirely harmless, old ignores the prios. requested by Alexey Suslikov <alexey.suslikov at gmail> ok phessler pelikan dlg
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-17Remove the "multicast_" prefix from the fields a multicast-only struct.Martin Pieuchot
Prodded by claudio@ and mikeb@
2014-12-17Use an interface index instead of a pointer for multicast options.Martin Pieuchot
Output interface (port) selection for multicast traffic is not done via route lookups. Instead the output ifp is registred when setsockopt(2) is called with the IP{V6,}_MULTICAST_IF option. But since there is no mechanism to invalidate such pointer stored in a pcb when an interface is destroyed/removed, it might lead your kernel to fault. Prevent a fault upon resume reported by frantisek holop, thanks! ok mikeb@, claudio@
2014-11-23length argument for some free() calls; ok dougTheo de Raadt
2014-11-06Remove unneeded netinet6/ip6_divert.h include.Lawrence Teo
ok bluhm@ dlg@ florian@ mpi@
2014-10-17reset all the pfsync packet state before calling ip_output inDavid Gwynne
pfsync_sendout. more specifically, move the reset of sc->sc_len to PFSYNC_MINPKT above ip_output. this prevents a situation where ipsec via ip_output calls pfsync_update_tdb for syncing the ipsec flow to a peer, which accounts for the tdb in the next pfsync packet, before unwinding back to pfsync_output which resets the accounting we just did. the next pfsync packet to be sent out will be allocated with a short length because sc_len is wrong, and the long lists of things (eg, the tdb) can overwrite memory after the mbuf. this manifests as incorrect poisoning or xsimpleq entry corruption in mbufs still in a pool, or random corruption of m->m_next on other mbufs in the system. bug found, fix tested, and ok stsp@
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-04-21ip_output() using varargs always struck me as bizarre, esp since it's onlyHenning Brauer
ever used to pass on uint32 (for ipsec). stop that madness and just pass the uint32, 0 in all cases but the two that pass the ipsec flowinfo. ok deraadt reyk guenther
2014-04-14"struct pkthdr" holds a routing table ID, not a routing domain one.Martin Pieuchot
Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
2013-11-18Fix potential null dereference.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok benno@ henning@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 20:10:29 +0000