summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Collapse)Author
2017-01-09pf_purge_thread() needs the NET_LOCK().Martin Pieuchot
ok sashan@, visa@
2016-12-29In pf_refragment6() use the valid route from pf_route6() insteadAlexander Bluhm
of calling rtalloc() again. OK mpi@
2016-12-28In pf_find_state() pkt_sk was set to NULL if pkt_sk->reverse wasAlexander Bluhm
not valid. This did not work as the value of pkt_sk must be used later to establish the link. So discard the packet statekey only if it is invalid itself and use it to establish the reverse link. From Christiano Haesbaert; OK sashan@
2016-12-28Better check for a valid route than for an existing route in pfAlexander Bluhm
route-to by calling rtisvalid(). Make pf_route() and pf_route6() similar and move the rtalloc() call to the same place. OK mpi@
2016-12-23Replace function names with __func__ in debug prints to make grepAlexander Bluhm
happy.
2016-12-23Fix white spaces. No binary change.Alexander Bluhm
2016-12-06Use the sizeof udphdr not the sizeof a pointer to it in the af-toJonathan Gray
specific part of pf_test_state_icmp(). This worked by accident on LP64 archs as the struct is eight bytes long. ok mikeb@ bluhm@ krw@ jca@
2016-11-28Path MTU discovery and traceroute did not always work with pf af-to.Alexander Bluhm
If an incoming packet is directly put into the output path, sending the icmp error packet is never done. As this is basically forwarding, calling ip_forward() for such packets does everything that is needed. OK mikeb@
2016-11-23Explicitly forbid to combine af-to with route-to in pfctl. TheAlexander Bluhm
parser cannot handle that correctly and is is unclear wether the kernel code would work. Remove the feature until someone needs it and properly implements and tests it. OK mike@ sashan@ mpi@
2016-11-22Fold union pf_headers buffer into struct pf_pdesc (enabled by pfvar_priv.h).Richard Procter
Prevent pf_socket_lookup() reading uninitialised header buffers on fragments. OK blum@ sashan@
2016-11-21In pf_route() and pf_route6() the !r->rt case was only used byAlexander Bluhm
af-to. pf_route6() called ip6_output() to do the work while pf_route() had some custom implementation for that. It is simpler to call ip_output() or ip6_output() from pf_test() directly. OK procter@ sashan@
2016-11-17The pf fragment reassembly code accepted IPv6 hop-by-hop headersAlexander Bluhm
after fragment headers. Add an extra check that the hop-by-hop header is always the first extension header after the IPv6 header. Found by Antonios Atlasis; OK sthen@ mpi@
2016-11-14Instead of passing an extra mbuf pointer to pf_route(), it shouldAlexander Bluhm
just use pd->m. Then pf_test() can also operate on pd.m and set the *m0 value in the caller just before it returns. OK sashan@
2016-11-14turn ipstat into a set of percpu counters.David Gwynne
each counter is identified by an enum value which correspond to the original members of the ipstat struct. ipstat_inc(ips_foo) replaces ipstat.ips_foo++ for the actual updates. ipstat_inc is a thin wrapper around counters_inc. counters are still returned to userland via the ipstat struct for now. ok mpi@ mikeb@
2016-10-28- once rule should not attempt to remove its parent rule.Alexandr Nedvedicky
(problem pointed out by Petr, fix proposed by Dilli) _at_ oracle
2016-10-27Pass a struct pf_pdesc to pf_route() like it is done in the otherAlexander Bluhm
pf functions. That means less parameters, more consistency and later we can call functions that need a pd from pf_route(). OK sashan@
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-10-20- PF should send a challenge ACK as response to SYN, which matches existingAlexandr Nedvedicky
state. Extra thanks goes to bluhm@ for careful testing and fixing patch I've sent to tech@ O.K. henning@ bluhm@
2016-10-18split pf_send_tcp() into the part that builds the mbuf and the actualHenning Brauer
sending, needed soon. ok sashan mikeb lteo
2016-10-18The variable dlen is always positive and d may be negative. SoAlexander Bluhm
declare both with the correct sign in pf_change_icmp_af(). OK henning@
2016-10-18The checksum of a ICMP "need to frag" packet for TCP was wrong whenAlexander Bluhm
created from a ICMP6 "too big" packet. The function pf_change_icmp_af() has code to adjust the pseudo-header checksum in the ICMP6 case, but pf_test_state_icmp() changed the proto before the case was entered. So call pf_change_icmp_af() before the pd->proto is converted in the TCP and UDP payload case like it was already done for ICMP and ICMP6 payload. Found by sys/net/pf_forward regress test; OK henning@
2016-10-09formatting nit (a tab got lost somewhen)Henning Brauer
2016-10-06Remove redundant comments that say a function must be called atAlexander Bluhm
splsoftnet() if the function does a splsoftassert(IPL_SOFTNET) anyway.
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-22Fix indentation. No binary change.Jonathan Gray
2016-09-07Rename rtable_mpath_next() into rtable_iterate() and make it do a properMartin Pieuchot
reference count. rtable_iterate() frees the passed ``rt'' and returns the next one on the multipath list or NULL if there's none. ok dlg@
2016-09-03Let purge thread to remove once rules, not packets.Alexandr Nedvedicky
Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
2016-08-20Push 'field changed' guards into 'change field' functions;Richard Procter
optimise pf_patch_32(); simplify pf_match_addr() OK mikeb@
2016-08-20Retire pf_translate_ap()Richard Procter
OK mpi@ mikeb@
2016-08-17Reintroduce 5.3-style checksum modification to preserve end-to-end checksumsprocter
when fiddling with packets but without the mess that motivated Henning to remove it. Affects only this one aspect of Henning's checksum work. Also tweak the basic algorithm and supply a correctness argument. OK dlg@ deraadt@ sthen@; no objection henning@
2016-07-18Hide pf internals by moving code from in_ouraddr() to pf_ouraddr().Alexander Bluhm
OK mpi@ sashan@
2016-06-21To assist debugging TCP connection reuse with NAT, expand theAlexander Bluhm
existing log in pf_state_key_attach() from the failed to the reuse case. OK mikeb@
2016-06-15Kill nd6_output(), it doesn't do anything since the resolution logicMartin Pieuchot
has been moved to nd6_resolve(). ok visa@, millert@, florian@, sthen@
2016-06-15There's no need to convert values returned by arc4random to the networkMike Belopuhov
byte order. Spotted by Gleb Smirnoff (glebius@FreeBSD.org), thanks! ok tedu
2016-06-07per trending style, add continue to empty loops.Ted Unangst
ok mglocker
2016-05-31Do not call nd6_output() without route entry argument.Martin Pieuchot
ok sthen@, bluhm@
2016-05-28Backout pf.c r1.972, pf_norm.c r1.184, ok claudioStuart Henderson
pf_test calls pf_refragment6 with dst=NULL, which is passed down to rtable_match which attempts to dereference it.
2016-05-24Do not call nd6_output() without route entry argument.Martin Pieuchot
ok bluhm@
2016-05-23Pass a route entry to if_output() instead of relying on arpresolve() magic.Martin Pieuchot
This refactoring aims to reduce the number of places where a route entry is inserted in the routing table. ok bluhm@
2016-05-03Put back a panic() if an incoming packet already has a statekey.Martin Pieuchot
Apparently nobody can hit this condition anymore or people do not report bugs if their kernel do not panic. ok dlg@, sashan@
2016-04-15replace m_copym2 with m_dup_pkt for the dup-to handling.David Gwynne
note that this uses max_linkhdr as the adjustment arg. this follows what the ip stack does when generating packets as it provides space for link headers (like ethernet headers) to be prepended on the new packet. ok henning@
2016-04-07Instead of panicking if an mbuf(9) already has a statekey dump itsMartin Pieuchot
content and unlink the statekey. This should allow us to find the reminding corner cases of packets looped back in the stack. ok dlg@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-03-04- putting back KASSERT(), which I've backed out on Jan 31Alexandr Nedvedicky
We don't expect inbound packets to come to PF with statekey attached. - I've also found missing call to pf_pkt_addr_changed() at various places, which needs to get fixed to prevent KASSERT() from firing. OK mpi@, sthen@
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-25- plugging massive pf_state_key leakAlexandr Nedvedicky
OK mpi@ dlg@ sthen@
2016-01-07- retrying to commit earlier change, which got backed outAlexandr Nedvedicky
- yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. this time I'm also bringing fix contributed by Stefan Kempf. Stefan's fix makes sure we grab reference in m_dup_pkthdr() OK bluhm@
2015-12-23revert previous:Jasper Lievisse Adriaanse
---------------------------------------------------------------------- revision 1.961 date: 2015/12/22 13:33:26; author: sashan; state: Exp; lines: +153 -44; commitid: oBRhtWcDV0ThviVT; - yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@ ---------------------------------------------------------------------- there have been multiple reports of KASSERT(!pf_state_key_isvalid(sk)) being triggered without much effort, so back this out for now.
2015-12-22- yet another tiny step towards MP PF. This time we need to make sureAlexandr Nedvedicky
statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-09 19:39:01 +0000