summaryrefslogtreecommitdiff
path: root/sys/net/pf_ioctl.c
AgeCommit message (Collapse)Author
2017-01-30removes the pf_consistency_lock and protects the users withSebastian Benoit
NET_LOCK(). pfioctl() will need the NET_LOCK() anyway. So better keep things simple until we're going to redesign PF for a MP world. fixes the crash reported by Kaya Saman. ok mpi@, bluhm@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2016-11-16Kill recursive splsoftnet()s.Martin Pieuchot
ok bluhm@
2016-10-28- once rule should not attempt to remove its parent rule.Alexandr Nedvedicky
(problem pointed out by Petr, fix proposed by Dilli) _at_ oracle
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-03Let purge thread to remove once rules, not packets.Alexandr Nedvedicky
Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
2016-09-02pool_setipl for pf bitsDavid Gwynne
ok phessler@ henning@
2015-12-03Add sizes to most free calls. OK sashan@ tedu@Claudio Jeker
2015-12-03allocate PF tags as M_RTABLE vice M_TEMPBret Lambert
ok henning@ claudio@
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-11-24No need for <net/if_types.h>Martin Pieuchot
As a bonus this removes a "#if NCARP > 0", say yeah!
2015-11-23There's no longer a need to include <net/hfsc.h> in <net/if_var.h>Martin Pieuchot
2015-11-20shuffle struct ifqueue so in flight mbufs are protected by a mutex.David Gwynne
the code is refactored so the IFQ macros call newly implemented ifq functions. the ifq code is split so each discipline (priq and hfsc in our case) is an opaque set of operations that the common ifq code can call. the common code does the locking, accounting (ifq_len manipulation), and freeing of the mbuf if the disciplines enqueue function rejects it. theyre kind of like bufqs in the block layer with their fifo and nscan disciplines. the new api also supports atomic switching of disciplines at runtime. the hfsc setup in pf_ioctl.c has been tweaked to build a complete hfsc_if structure which it attaches to the send queue in a single operation, rather than attaching to the interface up front and building up a list of queues. the send queue is now mutexed, which raises the expectation that packets can be enqueued or purged on one cpu while another cpu is dequeueing them in a driver for transmission. a lot of drivers use IFQ_POLL to peek at an mbuf and attempt to fit it on the ring before committing to it with a later IFQ_DEQUEUE operation. if the mbuf gets freed in between the POLL and DEQUEUE operations, fireworks will ensue. to avoid this, the ifq api introduces ifq_deq_begin, ifq_deq_rollback, and ifq_deq_commit. ifq_deq_begin allows a driver to take the ifq mutex and get a reference to the mbuf they wish to try and tx. if there's space, they can ifq_deq_commit it to remove the mbuf and release the mutex. if there's no space, ifq_deq_rollback simply releases the mutex. this api was developed to make updating the drivers using IFQ_POLL easy, instead of having to do significant semantic changes to avoid POLL that we cannot test on all the hardware. the common code has been tested pretty hard, and all the driver modifications are straightforward except for de(4). if that breaks it can be dealt with later. ok mpi@ jmatthew@
2015-10-13- pf_insert_src_node(): global argument (arg6) is useless, functionAlexandr Nedvedicky
always gets pointer to rule. - pf_remove_src_node(): function should always remove matching src node, regardless the sn->rule.ptr being NULL or valid rule - sn->rule.ptr is never NULL, spotted by mpi and Richard Procter _von_ gmail.com OK mpi@, OK mikeb@
2015-09-04The pf_osfp_pl and pf_osfp_entry_pl never get used in interrupt context.Mark Kettenis
Drop the explicit pool backend allocator here and add PR_WAITOK to the flags passed to pool_init(9). The pfi_addr_pl and pf_rule_pl can get used in interrupt context though. So simply drop the explicit pool backend allocator without adding PR_WAITOK to the flags passed to pool_init(9). ok mikeb@
2015-07-21- added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...Alexandr Nedvedicky
ok mpi@
2015-07-19potential memory leak in SIOCADDRULEsashan
ok mcbride@
2015-07-19unsinged variables should not be compared to be leq than 0 (unsigned a <= 0)sashan
ok mcbride@
2015-07-18msg.mpisashan
2015-04-11the hfsc pools are only used in hfsc.c, so move the init of themDavid Gwynne
there instead of pf_ioctl.c. ok henning@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-20fix a memory leak in the error case found by Maxime Villard's BrainyTed Unangst
code scanner. Changing return to break also fixes a failure to unlock. Also fix a NULL check for that variable noticed by bluhm. ok bluhm henning millert
2015-02-10since we inherit prio (as in, the queuing priority) from outside sources,Henning Brauer
i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-09More malloc() -> mallocarray() in the kernel.Doug Hogan
ok deraadt@ tedu@
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-08-12Finally implement what's stated in the man page regarding parentMike Belopuhov
anchors for "once" rules: "In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched." Employ an additional pointer pair to keep track of the parent ruleset containing the anchor that we want to remove. OK henning
2014-08-12Apart from some minor code reshuffling the big change is that weMike Belopuhov
start with a ruleset pointer assigned to pf_main_ruleset so that pf_purge_rule doesn't get called with a NULL. Prompted by the discussion with Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. OK henning
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-04-22Remove some altq tentacles.Martin Pieuchot
ok pelikan@, henning@
2014-04-19shrink pf by 445 lines.Henning Brauer
while there, get rid of the altq ioctls and assciated now obsolete code
2014-03-30Eliminates struct pcred by moving the real and saved ugids intoPhilip Guenther
struct ucred; struct process then directly links to the ucred Based on a discussion at c2k10 or so before noting that FreeBSD and NetBSD did this too. ok matthew@
2014-02-04reduce the length of some pool names. ok deraadt guenther mpiTed Unangst
2014-01-20support negated matches on the rcvif, ok dlg bennoHenning Brauer
2014-01-03Switch frequently allocated structs from malloc(M_DEVBUF) to separate pools.pelikan
ok henning, "looks fine" mikeb, input from guenther.
2014-01-03Make queues disappear correctly on interfaces being destroyed.pelikan
ok henning
2013-11-13DIOCGETSRCNODES was leaking a little bit more kernel informationTheo de Raadt
ok benno
2013-11-12two ioctl's were disclosing kernel pointers and such.Theo de Raadt
ok henning benno
2013-10-20Deep inside DIOCXCOMMIT, should return a real errno instead of -1Theo de Raadt
ok henning pelikan
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-10-12new bandwidth shaping subsystem, kernel sideHenning Brauer
uses hfsc behind the scenes; altq stays in parallel for a migration phase. if.h even more messy for the transition, but eventuelly it should become readable... looked over & tested by many, ok phessler sthen
2013-10-12give tagname2tag and its siblings an extra "create" parameter. if 1, itHenning Brauer
behaves like before and creates the mapping if needed. if 0, lookup only. looked over by many, ok phessler sthen
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-27Use the correct src/dst ports depending on direction (one of src or dst wasRyan Thomas McBride
wrong in each direction). Report and fix from UMEZAWA Takeshi <umezawa@iij.ad.jp>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-26 13:19:17 +0000