summaryrefslogtreecommitdiff
path: root/sys/net/pf_norm.c
AgeCommit message (Collapse)Author
2019-02-28IPv6 fragments with malformed extension headers could be erroneouslyAlexander Bluhm
passed by pf or cause a panic in pf. fix from sashan@; OK bluhm@ claudio@ bug found by Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv
2018-10-23Make pf compile without DIAGNOSTIC againReyk Floeter
OK bluhm@ kn@
2018-09-10Instead of calculating the mbuf packet header length here and there,Alexander Bluhm
put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
2018-09-10During fragment reassembly, mbuf chains with packet headers wereAlexander Bluhm
created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
2018-09-10Limit the fragment entry queue length to 64 per bucket. So we haveAlexander Bluhm
a global limit of 1024 fragments, but it is fine grained to the region of the packet. Smaller packets may have less fragments. This costs another 16 bytes of memory per reassembly and devides the worst case for searching by 8. requestd by claudio@; OK sashan@ claudio@
2018-09-08Split the pf(4) fragment reassembly queue into smaller parts.Alexander Bluhm
Remember 16 entry points based on the fragment offset. Instead of a worst case of 8196 list traversals we now check a maximum of 512 list entries or 16 array elements. discussed with claudio@ and sashan@; OK sashan@
2018-09-04Forgot to rename pf_frent_holes() prototype in previous commit.Alexander Bluhm
2018-09-04Avoid traversing the list of fragment entris to check whether theAlexander Bluhm
pf(4) reassembly is complete. Instead count the holes that are created when inserting a fragment. If there are no holes left, the fragments are continuous. idea from claudio@; OK claudio@ sashan@
2018-06-18Refactor the six ways to find TCP options into one new function. As a result:Richard Procter
- MSS and WSCALE option candidates must now meet their min type length. - 'max-mss' is now more tolerant of malformed option lists. These changes were immaterial to the live traffic I've examined. OK sashan@ mpi@
2018-02-06some finger muscle workout:Henning Brauer
bzero -> memset and (very few) bcopy -> memcpy/memmove
2017-06-26Fragments for a single connection (a combination of proto,src,dst,af)Alexander Bluhm
may easily reuse the fragment id as it is only 16 bit for IPv4. To avoid that pf reassembles them into the wrong packet, throw away stale fragments. With the default timeout this happens after 12,000 newer fragements have been seen. from markus@; OK sashan@
2017-06-24To avoid packet loss due to reuse of the 16 bit IPv4 fragment id,Alexander Bluhm
we need suitable data structures. Organize the pf fragments with two red-black trees. One is holding the address and protocol information and the other has only the fragment id. This will allow to drop fragemts for specific connections more aggressively. ` from markus@; OK sashan@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-06-05- let's add PF_LOCK()Alexandr Nedvedicky
to enable PF_LOCK(), you must add 'option WITH_PF_LOCK' to your kernel configuration. The code does not do much currently it's just the very small step towards MP. O.K. henning@, mikeb@, mpi@
2017-05-15Enable the NET_LOCK(), take 3.Martin Pieuchot
Recursions are still marked as XXXSMP. ok deraadt@, bluhm@
2017-04-23Some of the LOG_NOTICE messages from PF were seen in normal operationsStuart Henderson
with certain rulesets and excessively noisy; move them to LOG_INFO (which was previously unused). ok benno@
2017-03-17Revert the NET_LOCK() and bring back pf's contention lock for release.Martin Pieuchot
For the moment the NET_LOCK() is always taken by threads running under KERNEL_LOCK(). That means it doesn't buy us anything except a possible deadlock that we did not spot. So make sure this doesn't happen, we'll have plenty of time in the next release cycle to stress test it. ok visa@
2017-01-30removes the pf_consistency_lock and protects the users withSebastian Benoit
NET_LOCK(). pfioctl() will need the NET_LOCK() anyway. So better keep things simple until we're going to redesign PF for a MP world. fixes the crash reported by Kaya Saman. ok mpi@, bluhm@
2016-12-29In pf_refragment6() use the valid route from pf_route6() insteadAlexander Bluhm
of calling rtalloc() again. OK mpi@
2016-12-29Use __func__ instead of explicit function name in panic messages.Alexander Bluhm
2016-12-28Fix white spaces. No binary change.Alexander Bluhm
2016-11-22Fold union pf_headers buffer into struct pf_pdesc (enabled by pfvar_priv.h).Richard Procter
Prevent pf_socket_lookup() reading uninitialised header buffers on fragments. OK blum@ sashan@
2016-11-21Follow RFC 5722 more strictly when handling overlapping fragmentsAlexander Bluhm
in pf. Drop the whole fragment state if IPv6 fragments appear which have invalid length or fragment-offset or more-fragment-bit. In IPv4 they are considered invalid and just dropped like before. Found by Antonios Atlasis; OK sashan@ sthen@
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-02pool_setipl for pf bitsDavid Gwynne
ok phessler@ henning@
2016-08-24Kill ip6_forward_rt reducing differences between v4 and v6.Martin Pieuchot
A single forwarding cache is not the answer. The answer is 42... err PF! ok bluhm@
2016-08-17Reintroduce 5.3-style checksum modification to preserve end-to-end checksumsprocter
when fiddling with packets but without the mess that motivated Henning to remove it. Affects only this one aspect of Henning's checksum work. Also tweak the basic algorithm and supply a correctness argument. OK dlg@ deraadt@ sthen@; no objection henning@
2016-06-15Kill nd6_output(), it doesn't do anything since the resolution logicMartin Pieuchot
has been moved to nd6_resolve(). ok visa@, millert@, florian@, sthen@
2016-06-15There's no need to convert values returned by arc4random to the networkMike Belopuhov
byte order. Spotted by Gleb Smirnoff (glebius@FreeBSD.org), thanks! ok tedu
2016-05-31Do not call nd6_output() without route entry argument.Martin Pieuchot
ok sthen@, bluhm@
2016-05-28Backout pf.c r1.972, pf_norm.c r1.184, ok claudioStuart Henderson
pf_test calls pf_refragment6 with dst=NULL, which is passed down to rtable_match which attempts to dereference it.
2016-05-24Do not call nd6_output() without route entry argument.Martin Pieuchot
ok bluhm@
2015-11-24No need for <net/if_types.h>Martin Pieuchot
As a bonus this removes a "#if NCARP > 0", say yeah!
2015-09-10Kill two simple in6_ifstat_inc().Martin Pieuchot
2015-08-19PF must keep IPv6 fragment size as chosen by sender also for packets,Alexandr Nedvedicky
which are routed on behalf route-to action. OK bluhm@
2015-07-19unused arguments at pf_normalize_tcp_init() and pf_refragment6()sashan
OK deraadt.
2015-07-18INET/INET6 address family check should be unified in PFsashan
it also adds af_unhandled(), where it is currently missing. ok mcbride@
2015-05-05Eliminate rabid semicolonChris Cappuccio
2015-04-29In most cases, IP fragments do not have an Ethernet padding. SoAlexander Bluhm
add a condition to save a useless call to m_adj() and have a paranoid length check in the other cases. OK henning@
2015-04-17On Ethernet packets have a minimal length, so very short packetsAlexander Bluhm
get padding appended to them. This padding is not stripped off in ip6_input() (due to support for IPv6 Jumbograms, RFC2675). That means PF needs to be careful when reassembling fragmented packets to not include the padding in the reassembled packet. from FreeBSD; via Kristof Provost; OK henning@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-08pf normalization code was in dire need of style normalization.Henning Brauer
ok mpi pelikan
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-10-10s/lenght/length/ in commentsStuart Henderson
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 12:06:00 +0000