summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Collapse)Author
2011-03-07Declare the inline function pf_addr_compare() non-static in pfvar.hAlexander Bluhm
to make it reusable by pf fragment reassembly. No functional change. discussed with henning@, claudio@, deraadt@, kettenis@ ok guenther@
2011-03-05The function pf_tag_packet() never fails. Remove a redundant checkAlexander Bluhm
and make it void. ok henning@, markus@, mcbride@
2011-02-23fixup source address rewriting for the icmp errors with the rdr-to setup.Mike Belopuhov
problem was reported by babut at yandex dot ru in the pr 6564, tested by the pr originator and me, ok henning mcbride. shaves off a bunch of XXXs.
2011-02-14Add missing byte-order swap to pf_match_addr_range. Without this, rulesStuart Henderson
using address ranges (e.g. "10.1.1.1 - 10.1.1.5") did not match addresses correctly on little-endian systems. ok henning@
2011-02-06pf_translate() may be called from pflog_packet(). Make sure thatAlexander Bluhm
IPv4-ICMP6 and IPv6-ICMP packets are not rewritten in case they are dropped and logged. spotted by mikeb@; ok henning@
2011-02-06pf_test() and pf_test6() drop IPv4-ICMP6 and IPv6-ICMP packets. DoAlexander Bluhm
not do the same check in pf_test_rule() again. ok henning
2011-02-05When a packet with an unusual protocol number got rewritten, theAlexander Bluhm
header lenght was uninitialized. This resulted in a panic in m_clget(). Initialize hdrlen with 0 and call m_copyback() only if necessary. ok henning@
2011-01-22Pf must not scrub packets which will be dropped anyway.Alexander Bluhm
ok henning@ markus@
2011-01-19Give pf_normalize_ip() the same 3 way semantics as pf_test().Alexander Bluhm
- PF_DROP, the packet is bad, the mbuf still exists and must be freed. - PF_PASS and *m0 is NULL, the packet has been processed, not an error. - PF_PASS and *m0 is not NULL, continue with packet processing. This fixes a potential mbuf use after free. ok henning@ markus@ mpf@
2011-01-11Perform IP options check in pf_test_rule(), before creating state.Ryan Thomas McBride
ok claudio henning dlg miod
2011-01-10If pf_test() was called recursively, the global variable pf_hdrsAlexander Bluhm
could be used multiple times for different packets. This happened when pflow(4) was used. Instead of a global variable, store the pf_headers in a local variable on the stack. david@ found the bug, narrowed it down and tested the fix. ok henning@
2011-01-10DPFPRINTF already adds the "pf: ", no need to put it in the errorRyan Thomas McBride
string. ok henning dlg claudio
2011-01-05Remove mbuf ptr save dance in pf_test6(). It was a leftover withAlexander Bluhm
misleading comment that did nothing. ok henning@ jsing@
2010-12-31Address comparisson is implemented twice in pf.c. Put this into aAlexander Bluhm
common function pf_addr_compare(). ok henning@
2010-12-24in pf_src_connlimit, the indices to sk->addr were swapped.Henning Brauer
tracked down and diff sent by Robert B Mills <rbmills at sdf.lonestar.org> thanks, very good work! ok claudio
2010-12-07remove a bunch of unused argumentsJonathan Gray
ok henning@
2010-09-24itojun picked exactly the right reason in that REASON_SET call. really noHenning Brauer
reason to question himself by adding an XXX
2010-09-24use pd->rdomain for the PF_MISMATCHAW checks in pf_test_fragment instead ofHenning Brauer
hardcoding 0. roughly almost a bit equivalent to what pf_test_rule does. changing the rdomain for not reassembled fragments is not going to work ever, so the full dance pf_test_rule does doesn't make sense here. speaking of sense, I don't see anything remotely resembling sense in pf filtering on fragments without reassembling them first. with/ok claudio
2010-09-24no need to pf_tag_packet in the stateless case in pf_test sinceHenning Brauer
pf_test_rule will have done it already, as correctly XXX-comment noted by claudio almost a year ago. pf_test6 (which is scarily different there) didn't have that at all.
2010-09-24hello, this is captain obvious speaking:Henning Brauer
/* XXX This does NOT affect pass rules! */ SLIST_FOREACH(ri, &s->match_rules, entry) { ... delete that comment, entirely superfluous
2010-09-24remove misleading XXX comment. it is pretty clear by now thatHenning Brauer
pf_compare_state_keys will stay, we play safe.
2010-09-24nicer linewraps, purely cosmeticHenning Brauer
2010-09-24kill some unused arguments to pf_create_stateJonathan Gray
ok henning@
2010-09-23Break out rule counter update code into a separate function, makes theRyan Thomas McBride
behaviour consistent between IPv4 and IPv6. From martin.pelikan@gmail.com
2010-09-22add a new log opt PF_LOG_MATCHESHenning Brauer
forces logging on all subsequent matching rules real ok theo assumed oks ryan and dlg bikeshedding everyone in the room implementation time ~ 1 minute
2010-09-22various whitespace fixes that my hands did while i was looking for sthHenning Brauer
else and an unneeded if (r)
2010-09-21assert copyrights / bump yearsHenning Brauer
2010-09-21after ruleset eval is done, we must apply actions from the last matchingHenning Brauer
pass or block rule, not the last matching rule. triggered by pr6401. this means that, for example, a rdr-to on a pass rule can override an rdr-to on a match rule that comes later in the ruleset. but that's the semantics: for block and pass rules, the last matching one wins, aka actions are applied after we're done with ruleset eval, and match rules' actions are applied on the fly. discussion with dlg and claudio, ok dlg ryan
2010-09-21do not increment states_tot on match rules. it is purely cosmetic, thisHenning Brauer
value is used in verbose "show rules" output as "states creations", but match rules never create state. states_cur aka "States" is needed and correct, match rules are being associated with states. ok ryan
2010-09-21make "match log" rules log on the fly. thus you can log and see the packetHenning Brauer
as it is in the very same moment pf hits that match rule. really awesome with multiple rdr-to and the like. ok dlg - ryan would ok it too if he was here right now
2010-09-21remove now obsolete XXX commentHenning Brauer
2010-09-21make pf_translate (void so far) return 1 if it actually changed somethingHenning Brauer
and 0 if it didn't so we know wether we have to rewrite or not. ok ryan dlg and in just an hour from now on this might have reached cvs eventually from njetwork challenged j2k10 in japan
2010-09-21factor our the code to set up pf_pdesc, a central structure in pf carryingHenning Brauer
information about the packet we're currently dealing with, into its own function. ok ryan dlg and additional testing sthen
2010-08-05In pf_icmp_mapping() the ICMP and ICMPv6 types shared the sameAlexander Bluhm
number space. In fact they are independent and must be handled separately. Fix traceroute via pf by splitting pf_icmp_mapping() into IPv4 and IPv6 sections. ok henning@ mcbride@; tested mcbride@; sure deraadt@
2010-07-02m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsBret Lambert
are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
2010-07-01g/c unused param to pf_translateHenning Brauer
2010-06-27fix a comment and add a new one to make clear what the mbuf ptr save danceHenning Brauer
is for, it is not very obvious... with ryan and jsing
2010-06-27stuff nsaddr/ndaddr/nsport/ndport (addrs/ports after NAT, used a lot whileHenning Brauer
walking the ruleset and up until state is fully set up) into pf_pdesc instead of passing around those 4 seperately all the time, also shrinks the argument count for a few functions that have/partialy had an insane count of arguments. kinda preparational since we'll need them elsewhere too, soon ok ryan jsing
2010-05-07Start cleaning up the mess called rtalloc*. Kill rtalloc2, make rtalloc1Claudio Jeker
accept flags for report and nocloning. Move the rtableid into struct route (with a minor twist for now) and make a few more codepathes rdomain aware. Appart from the pf.c and route.c bits the diff is mostly mechanical. More to come... OK michele, henning
2010-02-04pf_get_sport() picks a random port from the port range specified in aStuart Henderson
nat rule. It should check to see if it's in-use (i.e. matches an existing PF state), if it is, it cycles sequentially through other ports until it finds a free one. However the check was being done with the state keys the wrong way round so it was never actually finding the state to be in-use. - switch the keys to correct this, avoiding random state collisions with nat. Fixes PR 6300 and problems reported by robert@ and viq. - check pf_get_sport() return code in pf_test(); if port allocation fails the packet should be dropped rather than sent out untranslated. Help/ok claudio@.
2010-01-18Convert pf debug logging to using log()/addlog(), a single standardisedRyan Thomas McBride
definition of DPFPRINTF(), and log priorities from syslog.h. Old debug levels will still work for now, but will eventually be phased out. discussed with henning, ok dlg
2010-01-14henning and I are both dumbasses, testing &foo against NULL is pointless.Ryan Thomas McBride
ok claudio
2010-01-14When printing states in debug output, print the rule number that createdRyan Thomas McBride
it if we have it. Requested by dlg, ok henning.
2010-01-14i forgot to remove a now obsolete comment in pf_create_state aboutHenning Brauer
incorrect error handling
2010-01-14in pf_create_state, when we fixed the leaks, we were a bit too triggerHenning Brauer
happy and went to use after free instead. ryan and I think we found the reason - just freeing that state keys in the error path is wrong as well, since pf_state_key_setup could have found existing, identical state keys and linked our state to these. if we now free them the other state that hung of these state keys would point back to the freed state keys. so instead of manually trying to free the state keys just call pf_state_key_detach which has all the magic checks. with and ok ryan
2010-01-13in pf_state_key_detach, ensure that the state key pointer on the stateHenning Brauer
is not null, to be safe and to be able to call this with half setup states. with and ok ryan
2010-01-12First pass at removing the 'pf_pool' mechanism for translation and routingRyan Thomas McBride
actions. Allow interfaces to be specified in special table entries for the routing actions. Lists of addresses can now only be done using tables, which pfctl will generate automatically from the existing syntax. Functionally, this deprecates the use of multiple tables or dynamic interfaces in a single nat or rdr rule. ok henning dlg claudio
2010-01-11"final" leak in state creation: in pf_state_key_setup, if we actuallyHenning Brauer
need two state keys (NAT case), and we succeed allocating the first one but fail getting the second we'd leak the first one. obvious and thus ok'd by dlg ryan and theo within seconds
2010-01-11fix a bug in pf_create_state that was a major source of amusement for meHenning Brauer
over the last couple of weeks (ever since I found it): when we are out of memory for the state keys we leak the state. oh the irony. instead of just fixing that one case rework the error handling in the entire function. verified painfully by yours truly by forcefully exercising each and every error path in there. ryan ok
2009-12-24add support to pf for filtering a packet by the interface it was receivedDavid Gwynne
on. use the received-on IFNAME filter option on a pf.conf rule to restrict which packet the interface had to be received on. eg: pass out on em0 from $foo to $bar received-on fxp0 ive been running this in production for a week now. i find it particularly usefull with interface groups. no objections, and a few "i like"s from henning, claudio, deraadt, mpf
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 12:02:49 +0000