summaryrefslogtreecommitdiff
path: root/sys/net/pf.c
AgeCommit message (Collapse)Author
2016-11-17The pf fragment reassembly code accepted IPv6 hop-by-hop headersAlexander Bluhm
after fragment headers. Add an extra check that the hop-by-hop header is always the first extension header after the IPv6 header. Found by Antonios Atlasis; OK sthen@ mpi@
2016-11-14Instead of passing an extra mbuf pointer to pf_route(), it shouldAlexander Bluhm
just use pd->m. Then pf_test() can also operate on pd.m and set the *m0 value in the caller just before it returns. OK sashan@
2016-11-14turn ipstat into a set of percpu counters.David Gwynne
each counter is identified by an enum value which correspond to the original members of the ipstat struct. ipstat_inc(ips_foo) replaces ipstat.ips_foo++ for the actual updates. ipstat_inc is a thin wrapper around counters_inc. counters are still returned to userland via the ipstat struct for now. ok mpi@ mikeb@
2016-10-28- once rule should not attempt to remove its parent rule.Alexandr Nedvedicky
(problem pointed out by Petr, fix proposed by Dilli) _at_ oracle
2016-10-27Pass a struct pf_pdesc to pf_route() like it is done in the otherAlexander Bluhm
pf functions. That means less parameters, more consistency and later we can call functions that need a pd from pf_route(). OK sashan@
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-10-20- PF should send a challenge ACK as response to SYN, which matches existingAlexandr Nedvedicky
state. Extra thanks goes to bluhm@ for careful testing and fixing patch I've sent to tech@ O.K. henning@ bluhm@
2016-10-18split pf_send_tcp() into the part that builds the mbuf and the actualHenning Brauer
sending, needed soon. ok sashan mikeb lteo
2016-10-18The variable dlen is always positive and d may be negative. SoAlexander Bluhm
declare both with the correct sign in pf_change_icmp_af(). OK henning@
2016-10-18The checksum of a ICMP "need to frag" packet for TCP was wrong whenAlexander Bluhm
created from a ICMP6 "too big" packet. The function pf_change_icmp_af() has code to adjust the pseudo-header checksum in the ICMP6 case, but pf_test_state_icmp() changed the proto before the case was entered. So call pf_change_icmp_af() before the pd->proto is converted in the TCP and UDP payload case like it was already done for ICMP and ICMP6 payload. Found by sys/net/pf_forward regress test; OK henning@
2016-10-09formatting nit (a tab got lost somewhen)Henning Brauer
2016-10-06Remove redundant comments that say a function must be called atAlexander Bluhm
splsoftnet() if the function does a splsoftassert(IPL_SOFTNET) anyway.
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-22Fix indentation. No binary change.Jonathan Gray
2016-09-07Rename rtable_mpath_next() into rtable_iterate() and make it do a properMartin Pieuchot
reference count. rtable_iterate() frees the passed ``rt'' and returns the next one on the multipath list or NULL if there's none. ok dlg@
2016-09-03Let purge thread to remove once rules, not packets.Alexandr Nedvedicky
Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
2016-08-20Push 'field changed' guards into 'change field' functions;Richard Procter
optimise pf_patch_32(); simplify pf_match_addr() OK mikeb@
2016-08-20Retire pf_translate_ap()Richard Procter
OK mpi@ mikeb@
2016-08-17Reintroduce 5.3-style checksum modification to preserve end-to-end checksumsprocter
when fiddling with packets but without the mess that motivated Henning to remove it. Affects only this one aspect of Henning's checksum work. Also tweak the basic algorithm and supply a correctness argument. OK dlg@ deraadt@ sthen@; no objection henning@
2016-07-18Hide pf internals by moving code from in_ouraddr() to pf_ouraddr().Alexander Bluhm
OK mpi@ sashan@
2016-06-21To assist debugging TCP connection reuse with NAT, expand theAlexander Bluhm
existing log in pf_state_key_attach() from the failed to the reuse case. OK mikeb@
2016-06-15Kill nd6_output(), it doesn't do anything since the resolution logicMartin Pieuchot
has been moved to nd6_resolve(). ok visa@, millert@, florian@, sthen@
2016-06-15There's no need to convert values returned by arc4random to the networkMike Belopuhov
byte order. Spotted by Gleb Smirnoff (glebius@FreeBSD.org), thanks! ok tedu
2016-06-07per trending style, add continue to empty loops.Ted Unangst
ok mglocker
2016-05-31Do not call nd6_output() without route entry argument.Martin Pieuchot
ok sthen@, bluhm@
2016-05-28Backout pf.c r1.972, pf_norm.c r1.184, ok claudioStuart Henderson
pf_test calls pf_refragment6 with dst=NULL, which is passed down to rtable_match which attempts to dereference it.
2016-05-24Do not call nd6_output() without route entry argument.Martin Pieuchot
ok bluhm@
2016-05-23Pass a route entry to if_output() instead of relying on arpresolve() magic.Martin Pieuchot
This refactoring aims to reduce the number of places where a route entry is inserted in the routing table. ok bluhm@
2016-05-03Put back a panic() if an incoming packet already has a statekey.Martin Pieuchot
Apparently nobody can hit this condition anymore or people do not report bugs if their kernel do not panic. ok dlg@, sashan@
2016-04-15replace m_copym2 with m_dup_pkt for the dup-to handling.David Gwynne
note that this uses max_linkhdr as the adjustment arg. this follows what the ip stack does when generating packets as it provides space for link headers (like ethernet headers) to be prepended on the new packet. ok henning@
2016-04-07Instead of panicking if an mbuf(9) already has a statekey dump itsMartin Pieuchot
content and unlink the statekey. This should allow us to find the reminding corner cases of packets looped back in the stack. ok dlg@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-03-04- putting back KASSERT(), which I've backed out on Jan 31Alexandr Nedvedicky
We don't expect inbound packets to come to PF with statekey attached. - I've also found missing call to pf_pkt_addr_changed() at various places, which needs to get fixed to prevent KASSERT() from firing. OK mpi@, sthen@
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-25- plugging massive pf_state_key leakAlexandr Nedvedicky
OK mpi@ dlg@ sthen@
2016-01-07- retrying to commit earlier change, which got backed outAlexandr Nedvedicky
- yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. this time I'm also bringing fix contributed by Stefan Kempf. Stefan's fix makes sure we grab reference in m_dup_pkthdr() OK bluhm@
2015-12-23revert previous:Jasper Lievisse Adriaanse
---------------------------------------------------------------------- revision 1.961 date: 2015/12/22 13:33:26; author: sashan; state: Exp; lines: +153 -44; commitid: oBRhtWcDV0ThviVT; - yet another tiny step towards MP PF. This time we need to make sure statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@ ---------------------------------------------------------------------- there have been multiple reports of KASSERT(!pf_state_key_isvalid(sk)) being triggered without much effort, so back this out for now.
2015-12-22- yet another tiny step towards MP PF. This time we need to make sureAlexandr Nedvedicky
statekey attached to packet stays around, while accepted packet is routed through IP stack. OK mpi@, henning@
2015-12-06g/c pf_change_a6(). it's exactly the same thing as pf_change_ap() with p =Henning Brauer
NULL. inspired by Richard Procter <richard.n.procter@gmail.com>'s mail on tech from Aug 17, but redone. ok sashan vgross
2015-12-05g/c unneeded af (address family) params to pf_change_ap and _icmpHenning Brauer
both af and naf (af-to case) are in the pf_pdesc some code shuffling to actually set these before calling pf_change_ap/_icmp inspired by Richard Procter <richard.n.procter@gmail.com>'s mail on tech from Aug 17, but redone ok bluhm vgross
2015-12-05pass a pointer to pf_test()'s reason to pf_test_rule instead of using aHenning Brauer
local one. While we always intended to keep the logging in pf_test_rule and pf_test so seperate that we don't end up with a wrong reason, this is just too fragile and I can't even convince myself that it still is right. pointed out by markus, ok bluhm benno
2015-12-03ip_send()/ip6_send() allow PF to send response packet in ipsoftnet task.Alexandr Nedvedicky
this avoids current recursion to pf_test() function. the change also switches icmp_error()/icmp6_error() to use ip_send()/ip6_send() so they are safe for PF. The idea comes from Markus Friedl. bluhm, mikeb and mpi helped me a lot to get it into shape. OK bluhm@, mpi@
2015-12-03To avoid that the stack manipules the pf statekeys directly, introduceAlexander Bluhm
pf_inp_...() lookup, link and unlink functions as an interface. Locking can be added to them later. Remove the first linking at the beginning of tcp_input() and udp_input() as it is not necessary. It will be done later anyway. That code was a relict, from the time before I had added the second linking. Input from mikeb@ and sashan@; OK sashan@
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-12-02- hide PF internals to pf_unlink_divert_state() from in_pcb.cAlexandr Nedvedicky
OK mpi@, bluhm@
2015-12-02Kill the RT_REPORT flag to rtalloc() and stop sending RTM_MISS messagesClaudio Jeker
for failed route lookups. This is something that was maybe useful in the 90is but in this modern times it is just annoying and nothing expect it anyway. OK mpi@, sthen@
2015-11-21Add a comment after every #endifMartin Pieuchot
requested by sashan@
2015-11-20Make use if_get() and get rid of rt_ifp.Martin Pieuchot
While here keep carp(4) bits under NCARP. Tested by and ok sthen@, ok visa@
2015-11-12Prefix flowid with ph_ and print it in m_print().Martin Pieuchot
ok dlg@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 04:15:17 +0000