summaryrefslogtreecommitdiff
path: root/sys/net/if_pfsync.c
AgeCommit message (Collapse)Author
2018-10-03Fix a race condition that affects pfsync interface deletion.Visa Hankala
When a pfsync interface is being deleted, all its timeout handlers and pfsync_send_dispatch() have to stop accessing the software context before the context is freed. Ensure sufficient synchronization by acquiring NET_LOCK() and clearing `pfsyncif' inside the critical section in pfsync_clone_destroy(). When a timeout handler has entered the critical section, it has to check `pfsyncif' and bail out if the value is NULL. pfsync_send_dispatch() already does this check. Issue reported and fix tested by Hrvoje Popovski. OK mpi@ bluhm@
2018-10-02- pfsync: avoid a recursion on PF_LOCKAlexandr Nedvedicky
OK bluhm@
2018-09-11- moving state look up outside of PF_LOCK()Alexandr Nedvedicky
this change adds a pf_state_lock rw-lock, which protects consistency of state table in PF. The code delivered in this change is guarded by 'WITH_PF_LOCK', which is still undefined. People, who are willing to experiment and want to run it must do two things: - compile kernel with -DWITH_PF_LOCK - bump NET_TASKQ from 1 to ... sky is the limit, (just select some sensible value for number of tasks your system is able to handle) OK bluhm@
2018-08-24- cosmetic tweak to if_pfsync.cAlexandr Nedvedicky
OK bluhm@, OK mpi@, henning@, jca@
2018-02-19Remove almost unused `flags' argument of suser().Martin Pieuchot
The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
2018-01-09Creating a cloned interface could return ENOMEM due to temporaryAlexander Bluhm
memory shortage. As it is invoked from a system call, it should not fail and wait instead. OK visa@ mpi@
2017-11-20Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningMartin Pieuchot
pr_input handlers without KERNEL_LOCK(). ok visa@
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-06-09- pfsync_input() must grab PF_LOCKAlexandr Nedvedicky
reported and patch tested by Hrvoje Popovski O.K. bluhm@
2017-05-27Remove useless splnet()/splx() dances.Martin Pieuchot
pfsyncioctl() is executed with the NET_LOCK() held which is enough. ok sashan@
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-04-11Partially revert previous mallocarray conversions that containDavid Hill
constants. The consensus is that if both operands are constant, we don't need mallocarray. Reminded by tedu@ ok deraadt@
2017-04-09Use mallocarray to allocate multicast group memberships.David Hill
ok deraadt@
2017-04-05When building counter memory in preparation to copy to userland, alwaysTheo de Raadt
zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
2017-03-11Add a detachhook to pfsync(4) which deals with the syncdev going away.Stefan Sperling
Fixes a panic observed by douple-p (aka pb@) when destroying the syncdev. tweak & ok mpi@
2017-02-20pfsync(4) percpu countersJeremie Courreges-Anglas
ok florian@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
2017-01-25Since raw_input() and route_input() are gone from pr_input, we canAlexander Bluhm
make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
2017-01-23Flag pseudo-interfaces as such in order to call add_net_randomness()Martin Pieuchot
only once per packet. Fix a regression introduced when if_input() started to be called by every pseudo-driver. ok claudio@, dlg@
2017-01-20pfsync_update_net_tdb() is only called at IPL_SOFTNET, no need for aMartin Pieuchot
splsofnet()/splx() dance. Tested by Hrvoje Popovski, ok visa@
2017-01-20No need to handle SIOCAIFADDR in drivers, it's never passed down toMartin Pieuchot
them. ok claudio@
2016-12-19Timer sending packets need to grab the NET_LOCK().Martin Pieuchot
ok bluhm@
2016-11-22Fold union pf_headers buffer into struct pf_pdesc (enabled by pfvar_priv.h).Richard Procter
Prevent pf_socket_lookup() reading uninitialised header buffers on fragments. OK blum@ sashan@
2016-11-14Instead of passing an extra mbuf pointer to pf_route(), it shouldAlexander Bluhm
just use pd->m. Then pf_test() can also operate on pd.m and set the *m0 value in the caller just before it returns. OK sashan@
2016-10-27Pass a struct pf_pdesc to pf_route() like it is done in the otherAlexander Bluhm
pf functions. That means less parameters, more consistency and later we can call functions that need a pd from pf_route(). OK sashan@
2016-10-04Convert timeouts that need a process context to timeout_set_proc(9).Martin Pieuchot
The current reason is that rtalloc_mpath(9) inside ip_output() might end up inserting a RTF_CLONED route and that require a write lock. ok kettenis@, bluhm@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-21Remove recursive splsoftnet() calls, from David Hill.Martin Pieuchot
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-08-23pool_setiplDavid Gwynne
2016-04-29Make if_output() return EAFNOSUPPORT instead of just dropping packetsKenneth R Westerback
and pretending the output succeeded. Packets are still dropped! Idea from jsg@ following same change to bridge(4). ok mpi@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-27white space tweaks. no functional change.David Gwynne
2016-01-26- state keys imported by if_pfsync trip refcnt != ~0 AssertAlexandr Nedvedicky
OK mpi@
2015-12-05remove old lint annotationsTed Unangst
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-11-10flush the send queue in start routines with IFQ_PURGE.David Gwynne
ok mpi@ uebayasi@
2015-10-30Clean up handling of 'clear states' pfsync packets.Mike Belopuhov
If interface was specified in the packet only if-bound states attached to this interface must be purged. ok mpi, looked at by sasha@
2015-09-11Kill yet another argument to functions in IPv6. This time ip6_output'sClaudio Jeker
ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
2015-06-16Store a unique ID, an interface index, rather than a pointer to theMartin Pieuchot
receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-10include the "set prio" values.Henning Brauer
no real compat issue since we're using spare bytes. old -> new ends up with set prio (0, 0) equivalent new -> old is entirely harmless, old ignores the prios. requested by Alexey Suslikov <alexey.suslikov at gmail> ok phessler pelikan dlg
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-17Remove the "multicast_" prefix from the fields a multicast-only struct.Martin Pieuchot
Prodded by claudio@ and mikeb@
2014-12-17Use an interface index instead of a pointer for multicast options.Martin Pieuchot
Output interface (port) selection for multicast traffic is not done via route lookups. Instead the output ifp is registred when setsockopt(2) is called with the IP{V6,}_MULTICAST_IF option. But since there is no mechanism to invalidate such pointer stored in a pcb when an interface is destroyed/removed, it might lead your kernel to fault. Prevent a fault upon resume reported by frantisek holop, thanks! ok mikeb@, claudio@
2014-11-23length argument for some free() calls; ok dougTheo de Raadt
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 07:51:08 +0000