summaryrefslogtreecommitdiff
path: root/sys/net/pf_ioctl.c
AgeCommit message (Collapse)Author
2015-07-21- added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...Alexandr Nedvedicky
ok mpi@
2015-07-19potential memory leak in SIOCADDRULEsashan
ok mcbride@
2015-07-19unsinged variables should not be compared to be leq than 0 (unsigned a <= 0)sashan
ok mcbride@
2015-07-18msg.mpisashan
2015-04-11the hfsc pools are only used in hfsc.c, so move the init of themDavid Gwynne
there instead of pf_ioctl.c. ok henning@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-20fix a memory leak in the error case found by Maxime Villard's BrainyTed Unangst
code scanner. Changing return to break also fixes a failure to unlock. Also fix a NULL check for that variable noticed by bluhm. ok bluhm henning millert
2015-02-10since we inherit prio (as in, the queuing priority) from outside sources,Henning Brauer
i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-09More malloc() -> mallocarray() in the kernel.Doug Hogan
ok deraadt@ tedu@
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-08-12Finally implement what's stated in the man page regarding parentMike Belopuhov
anchors for "once" rules: "In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched." Employ an additional pointer pair to keep track of the parent ruleset containing the anchor that we want to remove. OK henning
2014-08-12Apart from some minor code reshuffling the big change is that weMike Belopuhov
start with a ruleset pointer assigned to pf_main_ruleset so that pf_purge_rule doesn't get called with a NULL. Prompted by the discussion with Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. OK henning
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-04-22Remove some altq tentacles.Martin Pieuchot
ok pelikan@, henning@
2014-04-19shrink pf by 445 lines.Henning Brauer
while there, get rid of the altq ioctls and assciated now obsolete code
2014-03-30Eliminates struct pcred by moving the real and saved ugids intoPhilip Guenther
struct ucred; struct process then directly links to the ucred Based on a discussion at c2k10 or so before noting that FreeBSD and NetBSD did this too. ok matthew@
2014-02-04reduce the length of some pool names. ok deraadt guenther mpiTed Unangst
2014-01-20support negated matches on the rcvif, ok dlg bennoHenning Brauer
2014-01-03Switch frequently allocated structs from malloc(M_DEVBUF) to separate pools.pelikan
ok henning, "looks fine" mikeb, input from guenther.
2014-01-03Make queues disappear correctly on interfaces being destroyed.pelikan
ok henning
2013-11-13DIOCGETSRCNODES was leaking a little bit more kernel informationTheo de Raadt
ok benno
2013-11-12two ioctl's were disclosing kernel pointers and such.Theo de Raadt
ok henning benno
2013-10-20Deep inside DIOCXCOMMIT, should return a real errno instead of -1Theo de Raadt
ok henning pelikan
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-10-12new bandwidth shaping subsystem, kernel sideHenning Brauer
uses hfsc behind the scenes; altq stays in parallel for a migration phase. if.h even more messy for the transition, but eventuelly it should become readable... looked over & tested by many, ok phessler sthen
2013-10-12give tagname2tag and its siblings an extra "create" parameter. if 1, itHenning Brauer
behaves like before and creates the mapping if needed. if 0, lookup only. looked over by many, ok phessler sthen
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-27Use the correct src/dst ports depending on direction (one of src or dst wasRyan Thomas McBride
wrong in each direction). Report and fix from UMEZAWA Takeshi <umezawa@iij.ad.jp>
2013-02-26Don't try to purge one-time rules from the main ruleset.Mike Belopuhov
Reported by Wesley M.A. on misc@, ok deraadt
2012-10-30Use time_uptime for expiration values as time_second can be skewed atFlorian Obser
runtime while time_uptime is monotonic. Prevent underflows in pfsync(4) and pflow(4) by using signed variables. pfsync(4) problem pointed out by camield. Diff originally by dlg, frag and pflow bits by me. feedback dlg man page tweak jmc Various versions of the pflow bits tested by Hrvoje Popovski (hrvoje AT srce DOT hr), thanks! ok benno, henning, dlg
2012-09-20Lower pf frags limit to not risk running out of mbuf clustersCamiel Dobbelaar
when dealing with lots of IP fragments. This sets the default to 25% of the mbuf cluster maximum (hint from beck). And the example in the manpage is sane now. ok mikeb henning beck deraadt
2012-09-18prio 0 is valid, therefore, I chose an "impossible" value for prio meaningHenning Brauer
"not set" and used a PF_PRIO_NOTSET define for it. now that means that everything that creates a struct pf_rule doesn't get away with bzero'ing it, which turned out to be not so nice. so get rid of PF_PRIO_NOTSET, instead, make a rule+state flag PFSTATE_SETPRIO which indicates wether the prio should be set. ok benno claudio mikeb
2012-07-08there was a limit on the number of pflog interfaces - 16. remove that.Henning Brauer
mostly by dynamically allocating pflogifs instead of making that a static array. ok claudio zinke
2012-07-07rename prio in struct pf_rule and related structs to set_prio so it isHenning Brauer
utterly clear this is not a filter criteria but a packet modification thing. also preparation for upcoming changes, including one to unscrew this mess (I should not have to touch half the tree for this - ifixitlater) not user visible, ok gcc
2012-07-07restore DIOCKILLSTATE semantics to what they were before the NAT rewrite.Henning Brauer
when you kill states by IP, it is not all that clear which IP we're talking about - before or after rewriting? the old semantics were to always look at the "original" IP, i. e. before rewriting. ever since the NAT rewrite we were unconditionally looking at the wire side state key, which is the original address for PF_IN states, but not for PF_OUT. So look at the SK_STACK state key in the PF_OUT case. should fix "authpf doesn't remove NAT states" seen on misc a while ago ok & testing & half of the analysis bob (he sez beck)
2012-04-03Fix kernel compilation with pf but without pfsync pseudo-device byMike Belopuhov
moving the state export functionality from pfsync code into pf. Based on the initial diff diff by guenther, ok henning.
2012-03-28Another pid that needs to be the process pid and not the thread one.Claudio Jeker
OK deraadt@, guenther@
2011-12-12fixup af-to regression with match rulesMike Belopuhov
pfctl should not infer the af-to behavior from the af/naf difference. instead, we should be clear that this is an af-to rule. essentially this change converts FOM_AFTO marker into a rule flag PFRULE_AFTO so that we don't rely on ambiguous checks (like r->af != r->naf) when setting things up. positive review and comments from claudio, ok henning, sperreault
2011-11-29use a u_int64_t for the state id in pfsync_state. this makes it consistentDavid Gwynne
with every other thing that stores the state id (including other pfsync messages). includes improvements to the systat code to consider the creatorid as well as the state id in its cache to avoid collisions between states created on different hosts. tested by me in production and on amd64 talking to sparc64. ok henning@
2011-11-28deprecate PFTM_UNTIL_PACKET. nothing in the tree uses it, andDavid Gwynne
pf_state_expires() handled it incorrectly. discussed with mikeb@ ok henning@
2011-11-25use time_uptime to set state creation values as time_second can beDavid Gwynne
skewed at runtime by things like date(1) and ntpd. time_uptime is monotonic and therefore more useful to compare against. ok deraadt@ mikeb@
2011-10-13Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyClaudio Jeker
"af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
2011-10-07rename some vars and functionsHenning Brauer
unfortunately altq is one giant namespace violation. rename just those that conflict with new stuff for now only to be found on my laptop. reduce pain, the diff is huge already. ok ryan
2011-08-30Add support for one shot rules that remove themselves from an activeMike Belopuhov
ruleset after match. In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched. This is an extremely handy technique for firewall proxies. ok henning, mcbride
2011-07-08surprisingly, we use pf as classifier for the new priority queueingHenning Brauer
implementation. ok ryan mpf sthen and also testing pea and halex looked at it and commented as well
2011-06-02Don't destroy a non-persistent table if referenced by src_nodes. FixesStuart Henderson
a crash if max-src-* options are triggered both before and after a ruleset reload, when the rules are overloading to a non-persistent table. Discovered by and fix from Martin Pelikan.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-03 07:44:18 +0000