summaryrefslogtreecommitdiff
path: root/sys/net/pf_ioctl.c
AgeCommit message (Collapse)Author
2017-07-27For pf the anchor is a C string so ensure that the value passed in via ioctlClaudio Jeker
is correctly NUL terminated. Reported by Ilja Van Sprundel With and OK bluhm@
2017-07-19Rework HFSC vs FQ-CoDel checksMike Belopuhov
The selection mechanism introduced in pf_ioctl.c -r1.316 suffers from being too ambiguous and lacks robustness. Instead of relying on composition of multiple flags in the queue specification, it's easier to identify the root class (if it exists) and derive all further checks from it.
2017-07-05Convert pf tagname malloc(9) into pool_get(9) to make it MP safe.Alexander Bluhm
While there use TAILQ_FOREACH macro for traversing tags. OK mpi@
2017-06-28Introduce a simple mechanism to select the appropriate queue managerMike Belopuhov
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-28Tighten up FQ-CoDel vs HFSC checksMike Belopuhov
PFQS_FLOWQUEUE is about to become a flag that HFSC classes may specify as well; thus a better way of telling FQ-CoDel and HFSC apart needs to be found. At the moment its derived from the queue specification. Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-05- let's add PF_LOCK()Alexandr Nedvedicky
to enable PF_LOCK(), you must add 'option WITH_PF_LOCK' to your kernel configuration. The code does not do much currently it's just the very small step towards MP. O.K. henning@, mikeb@, mpi@
2017-06-01Return time_uptime as value for when pf was enabled instead ofPatrick Wildt
time_second. Since time_second changes depending on the wall- clock time, time_second is not a reliable source for the status. We can even end up with a negative time delta. Thus, use the monotonically growing time_uptime and export it to userland. ok bluhm@ mikeb@
2017-05-30g/c DIOCCLRRULECTRSHenning Brauer
kinda deprecated for a decade now, nothing in base uses it, nothing in ports uses it (thanks sthen) ok phessler sashan
2017-05-15Enable the NET_LOCK(), take 3.Martin Pieuchot
Recursions are still marked as XXXSMP. ok deraadt@, bluhm@
2017-05-15Hook up FQ-CoDel to the tree and enable configuration in the pfctl(8)Mike Belopuhov
OK sthen, visa
2017-05-02Provide pluggable queueing interface for pfMike Belopuhov
By hiding H-FSC behind pfq_ops structure similar to the ifq_ops, we provide a possibility to plug alternative queueing interfaces for use in pf. This reduces amount of H-FSC specific code in the pf ioctl handler While here, change the the order of elements in hfsc_class_stats to provide some compatibility between queue stat structures of different traffic conditioners. No objections from henning@, ok sthen@
2017-04-21Speed up DIOCKILLSTATES by using the RB tree index if all fields usedYASUOKA Masahiko
by the tree of given state key are filled. ok sasha
2017-03-17Revert the NET_LOCK() and bring back pf's contention lock for release.Martin Pieuchot
For the moment the NET_LOCK() is always taken by threads running under KERNEL_LOCK(). That means it doesn't buy us anything except a possible deadlock that we did not spot. So make sure this doesn't happen, we'll have plenty of time in the next release cycle to stress test it. ok visa@
2017-01-30removes the pf_consistency_lock and protects the users withSebastian Benoit
NET_LOCK(). pfioctl() will need the NET_LOCK() anyway. So better keep things simple until we're going to redesign PF for a MP world. fixes the crash reported by Kaya Saman. ok mpi@, bluhm@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2016-11-16Kill recursive splsoftnet()s.Martin Pieuchot
ok bluhm@
2016-10-28- once rule should not attempt to remove its parent rule.Alexandr Nedvedicky
(problem pointed out by Petr, fix proposed by Dilli) _at_ oracle
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-03Let purge thread to remove once rules, not packets.Alexandr Nedvedicky
Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
2016-09-02pool_setipl for pf bitsDavid Gwynne
ok phessler@ henning@
2015-12-03Add sizes to most free calls. OK sashan@ tedu@Claudio Jeker
2015-12-03allocate PF tags as M_RTABLE vice M_TEMPBret Lambert
ok henning@ claudio@
2015-12-03Rename pf_unlink_state() to pf_remove_state() so the name does notAlexander Bluhm
collide with the statekey to inp unlinking. OK sashan@ mpi@
2015-11-24No need for <net/if_types.h>Martin Pieuchot
As a bonus this removes a "#if NCARP > 0", say yeah!
2015-11-23There's no longer a need to include <net/hfsc.h> in <net/if_var.h>Martin Pieuchot
2015-11-20shuffle struct ifqueue so in flight mbufs are protected by a mutex.David Gwynne
the code is refactored so the IFQ macros call newly implemented ifq functions. the ifq code is split so each discipline (priq and hfsc in our case) is an opaque set of operations that the common ifq code can call. the common code does the locking, accounting (ifq_len manipulation), and freeing of the mbuf if the disciplines enqueue function rejects it. theyre kind of like bufqs in the block layer with their fifo and nscan disciplines. the new api also supports atomic switching of disciplines at runtime. the hfsc setup in pf_ioctl.c has been tweaked to build a complete hfsc_if structure which it attaches to the send queue in a single operation, rather than attaching to the interface up front and building up a list of queues. the send queue is now mutexed, which raises the expectation that packets can be enqueued or purged on one cpu while another cpu is dequeueing them in a driver for transmission. a lot of drivers use IFQ_POLL to peek at an mbuf and attempt to fit it on the ring before committing to it with a later IFQ_DEQUEUE operation. if the mbuf gets freed in between the POLL and DEQUEUE operations, fireworks will ensue. to avoid this, the ifq api introduces ifq_deq_begin, ifq_deq_rollback, and ifq_deq_commit. ifq_deq_begin allows a driver to take the ifq mutex and get a reference to the mbuf they wish to try and tx. if there's space, they can ifq_deq_commit it to remove the mbuf and release the mutex. if there's no space, ifq_deq_rollback simply releases the mutex. this api was developed to make updating the drivers using IFQ_POLL easy, instead of having to do significant semantic changes to avoid POLL that we cannot test on all the hardware. the common code has been tested pretty hard, and all the driver modifications are straightforward except for de(4). if that breaks it can be dealt with later. ok mpi@ jmatthew@
2015-10-13- pf_insert_src_node(): global argument (arg6) is useless, functionAlexandr Nedvedicky
always gets pointer to rule. - pf_remove_src_node(): function should always remove matching src node, regardless the sn->rule.ptr being NULL or valid rule - sn->rule.ptr is never NULL, spotted by mpi and Richard Procter _von_ gmail.com OK mpi@, OK mikeb@
2015-09-04The pf_osfp_pl and pf_osfp_entry_pl never get used in interrupt context.Mark Kettenis
Drop the explicit pool backend allocator here and add PR_WAITOK to the flags passed to pool_init(9). The pfi_addr_pl and pf_rule_pl can get used in interrupt context though. So simply drop the explicit pool backend allocator without adding PR_WAITOK to the flags passed to pool_init(9). ok mikeb@
2015-07-21- added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...Alexandr Nedvedicky
ok mpi@
2015-07-19potential memory leak in SIOCADDRULEsashan
ok mcbride@
2015-07-19unsinged variables should not be compared to be leq than 0 (unsigned a <= 0)sashan
ok mcbride@
2015-07-18msg.mpisashan
2015-04-11the hfsc pools are only used in hfsc.c, so move the init of themDavid Gwynne
there instead of pf_ioctl.c. ok henning@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-20fix a memory leak in the error case found by Maxime Villard's BrainyTed Unangst
code scanner. Changing return to break also fixes a failure to unlock. Also fix a NULL check for that variable noticed by bluhm. ok bluhm henning millert
2015-02-10since we inherit prio (as in, the queuing priority) from outside sources,Henning Brauer
i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-09More malloc() -> mallocarray() in the kernel.Doug Hogan
ok deraadt@ tedu@
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-08-12Finally implement what's stated in the man page regarding parentMike Belopuhov
anchors for "once" rules: "In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched." Employ an additional pointer pair to keep track of the parent ruleset containing the anchor that we want to remove. OK henning
2014-08-12Apart from some minor code reshuffling the big change is that weMike Belopuhov
start with a ruleset pointer assigned to pf_main_ruleset so that pf_purge_rule doesn't get called with a NULL. Prompted by the discussion with Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. OK henning
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-04-22Remove some altq tentacles.Martin Pieuchot
ok pelikan@, henning@
2014-04-19shrink pf by 445 lines.Henning Brauer
while there, get rid of the altq ioctls and assciated now obsolete code
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-03 12:53:06 +0000