summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Collapse)Author
2016-06-21To assist debugging TCP connection reuse with NAT, expand theAlexander Bluhm
existing log in pf_state_key_attach() from the failed to the reuse case. OK mikeb@
2016-06-15Kill nd6_output(), it doesn't do anything since the resolution logicMartin Pieuchot
has been moved to nd6_resolve(). ok visa@, millert@, florian@, sthen@
2016-06-15There's no need to convert values returned by arc4random to the networkMike Belopuhov
byte order. Spotted by Gleb Smirnoff (glebius@FreeBSD.org), thanks! ok tedu
2016-06-07per trending style, add continue to empty loops.Ted Unangst
ok mglocker
2016-05-31Do not call nd6_output() without route entry argument.Martin Pieuchot
ok sthen@, bluhm@
2016-05-28Backout pf.c r1.972, pf_norm.c r1.184, ok claudioStuart Henderson
pf_test calls pf_refragment6 with dst=NULL, which is passed down to rtable_match which attempts to dereference it.
2016-05-24Do not call nd6_output() without route entry argument.Martin Pieuchot
ok bluhm@
2016-05-23Pass a route entry to if_output() instead of relying on arpresolve() magic.Martin Pieuchot
This refactoring aims to reduce the number of places where a route entry is inserted in the routing table. ok bluhm@
2016-05-03Put back a panic() if an incoming packet already has a statekey.Martin Pieuchot
Apparently nobody can hit this condition anymore or people do not report bugs if their kernel do not panic. ok dlg@, sashan@
2016-04-15replace m_copym2 with m_dup_pkt for the dup-to handling.David Gwynne
note that this uses max_linkhdr as the adjustment arg. this follows what the ip stack does when generating packets as it provides space for link headers (like ethernet headers) to be prepended on the new packet. ok henning@
2016-04-07Instead of panicking if an mbuf(9) already has a statekey dump itsMartin Pieuchot
content and unlink the statekey. This should allow us to find the reminding corner cases of packets looped back in the stack. ok dlg@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-03-04- putting back KASSERT(), which I've backed out on Jan 31Alexandr Nedvedicky
We don't expect inbound packets to come to PF with statekey attached. - I've also found missing call to pf_pkt_addr_changed() at various places, which needs to get fixed to prevent KASSERT() from firing. OK mpi@, sthen@
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-25- plugging massive pf_state_key leakAlexandr Nedvedicky
OK mpi@ dlg@ sthen@
2016-01-07- retrying to commit earlier change, which got backed outAlexandr Nedvedicky
- yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. this time I'm also bringing fix contributed by Stefan Kempf. Stefan's fix makes sure we grab reference in m_dup_pkthdr() OK bluhm@
2015-12-23revert previous:Jasper Lievisse Adriaanse
---------------------------------------------------------------------- revision 1.961 date: 2015/12/22 13:33:26; author: sashan; state: Exp; lines: +153 -44; commitid: oBRhtWcDV0ThviVT; - yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@ ---------------------------------------------------------------------- there have been multiple reports of KASSERT(!pf_state_key_isvalid(sk)) being triggered without much effort, so back this out for now.
2015-12-22- yet another tiny step towards MP PF. This time we need to make sureAlexandr Nedvedicky
statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@
2015-12-06g/c pf_change_a6(). it's exactly the same thing as pf_change_ap() with p =Henning Brauer
NULL. inspired by Richard Procter <richard.n.procter@gmail.com>'s mail on tech from Aug 17, but redone. ok sashan vgross
2015-12-05g/c unneeded af (address family) params to pf_change_ap and _icmpHenning Brauer
both af and naf (af-to case) are in the pf_pdesc some code shuffling to actually set these before calling pf_change_ap/_icmp inspired by Richard Procter <richard.n.procter@gmail.com>'s mail on tech from Aug 17, but redone ok bluhm vgross
2015-12-05pass a pointer to pf_test()'s reason to pf_test_rule instead of using aHenning Brauer
local one. While we always intended to keep the logging in pf_test_rule and pf_test so seperate that we don't end up with a wrong reason, this is just too fragile and I can't even convince myself that it still is right. pointed out by markus, ok bluhm benno
2015-12-03ip_send()/ip6_send() allow PF to send response packet in ipsoftnet task.Alexandr Nedvedicky
this avoids current recursion to pf_test() function. the change also switches icmp_error()/icmp6_error() to use ip_send()/ip6_send() so they are safe for PF. The idea comes from Markus Friedl. bluhm, mikeb and mpi helped me a lot to get it into shape. OK bluhm@, mpi@
2015-12-03To avoid that the stack manipules the pf statekeys directly, introduceAlexander Bluhm
pf_inp_...() lookup, link and unlink functions as an interface. Locking can be added to them later. Remove the first linking at the beginning of tcp_input() and udp_input() as it is not necessary. It will be done later anyway. That code was a relict, from the time before I had added the second linking. Input from mikeb@ and sashan@; OK sashan@
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-12-02- hide PF internals to pf_unlink_divert_state() from in_pcb.cAlexandr Nedvedicky
OK mpi@, bluhm@
2015-12-02Kill the RT_REPORT flag to rtalloc() and stop sending RTM_MISS messagesClaudio Jeker
for failed route lookups. This is something that was maybe useful in the 90is but in this modern times it is just annoying and nothing expect it anyway. OK mpi@, sthen@
2015-11-21Add a comment after every #endifMartin Pieuchot
requested by sashan@
2015-11-20Make use if_get() and get rid of rt_ifp.Martin Pieuchot
While here keep carp(4) bits under NCARP. Tested by and ok sthen@, ok visa@
2015-11-12Prefix flowid with ph_ and print it in m_print().Martin Pieuchot
ok dlg@
2015-11-06Rename rt_mpath_next() into rtable_mpath_next() and provide anMartin Pieuchot
implementation for ART based on the singly-linked list of route entries.
2015-10-27Use rt_ifidx rather than rt_ifp.Martin Pieuchot
ok bluhm@
2015-10-13- pf_insert_src_node(): global argument (arg6) is useless, functionAlexandr Nedvedicky
always gets pointer to rule. - pf_remove_src_node(): function should always remove matching src node, regardless the sn->rule.ptr being NULL or valid rule - sn->rule.ptr is never NULL, spotted by mpi and Richard Procter _von_ gmail.com OK mpi@, OK mikeb@
2015-10-08use the state id to set a flowid on an mbuf.David Gwynne
ok mpi@ mikeb@ sthen@
2015-09-23Always increment rt_use inside rtalloc(9) instead of doing it in someMartin Pieuchot
specific places. ok claudio@, benno@
2015-09-13There's no point in abstracting ifp->if_output() as long as pf_test()Martin Pieuchot
needs to see lo0 in the output path. ok claudio@
2015-09-12Stop overwriting the rt_ifp pointer of RTF_LOCAL routes with lo0ifp.Martin Pieuchot
Use instead the RTF_LOCAL flag to loop local traffic back to the corresponding protocol queue. With this change rt_ifp is now always the same as rt_ifa->ifa_ifp. ok claudio@
2015-09-12If M_PREPEND() fails, it frees the mbuf. In this case pf_translate_af()Alexander Bluhm
must reset pd->m to avoid a use after free. OK sashan@ mikeb@
2015-09-11rtfree(9) accepts NULL now.Martin Pieuchot
2015-09-11Kill yet another argument to functions in IPv6. This time ip6_output'sClaudio Jeker
ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
2015-09-10Kill two simple in6_ifstat_inc().Martin Pieuchot
2015-09-09add if_put after the if_get.David Gwynne
ok claudio@
2015-09-01- route-to, dup-to, reply-to should not override the block actionAlexandr Nedvedicky
Spotted by Dilli Paudel <dilli ! paudel at oracle ! com> ok jung@, ok mikeb@
2015-08-19PF must keep IPv6 fragment size as chosen by sender also for packets,Alexandr Nedvedicky
which are routed on behalf route-to action. OK bluhm@
2015-07-21- added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...Alexandr Nedvedicky
ok mpi@
2015-07-20Add some panics to default paths where code later assumes a non defaultJonathan Gray
path was taken. This both prevents warnings from clang and acts as a sanity check. ok mcbride@ henning@
2015-07-20INET6 is here to stay, so stop hauling around never-compiled codeRyan Thomas McBride
to optimize for an INET-only kernel, as well as the fantasy unicorn INET6-only kernel. (INET-only kernel still works) prompted by deraadt ok bluhm sashan
2015-07-19rule_item might leak, when pf_create_state() failssashan
OK @mcbride
2015-07-19unsinged variables should not be compared to be leq than 0 (unsigned a <= 0)sashan
ok mcbride@
2015-07-19unused arguments at pf_normalize_tcp_init() and pf_refragment6()sashan
OK deraadt.
2015-07-18pf_send_tcp() should also use unhandled_af()sashan
ok jsg@, ok mpi@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-18 00:34:43 +0000