summaryrefslogtreecommitdiff
path: root/sys/net/pf_norm.c
AgeCommit message (Collapse)Author
2015-11-24No need for <net/if_types.h>Martin Pieuchot
As a bonus this removes a "#if NCARP > 0", say yeah!
2015-09-10Kill two simple in6_ifstat_inc().Martin Pieuchot
2015-08-19PF must keep IPv6 fragment size as chosen by sender also for packets,Alexandr Nedvedicky
which are routed on behalf route-to action. OK bluhm@
2015-07-19unused arguments at pf_normalize_tcp_init() and pf_refragment6()sashan
OK deraadt.
2015-07-18INET/INET6 address family check should be unified in PFsashan
it also adds af_unhandled(), where it is currently missing. ok mcbride@
2015-05-05Eliminate rabid semicolonChris Cappuccio
2015-04-29In most cases, IP fragments do not have an Ethernet padding. SoAlexander Bluhm
add a condition to save a useless call to m_adj() and have a paranoid length check in the other cases. OK henning@
2015-04-17On Ethernet packets have a minimal length, so very short packetsAlexander Bluhm
get padding appended to them. This padding is not stripped off in ip6_input() (due to support for IPv6 Jumbograms, RFC2675). That means PF needs to be careful when reassembling fragmented packets to not include the padding in the reassembled packet. from FreeBSD; via Kristof Provost; OK henning@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-02-08pf normalization code was in dire need of style normalization.Henning Brauer
ok mpi pelikan
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-05Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.Martin Pieuchot
ok mikeb@, krw@, bluhm@, tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-10-10s/lenght/length/ in commentsStuart Henderson
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-13When reassembled IPv6 fragments are NATed or RDRed by pf, theAlexander Bluhm
checksum has to be recalculated before the packet is fragmented again. Put a missing in6_proto_cksum_out() into pf_refragment6(). This makes run-regress-frag6 and run-regress-frag6-ext pass again. From Matthias Pitzl; OK henning@
2014-03-27When enforcing TOS (Traffic Class), preserve the ECN bits, just as we doJeremie Courreges-Anglas
with IPv4 packets. ok mikeb@
2014-01-22one more absolutely obvious bcopy -> memcpyHenning Brauer
2013-11-16Remove dead assignments and now unused variables.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ mikeb@ bluhm@
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-10-01Format string fixes: Cast time_t to long longStefan Fritsch
and mnt_stat.f_ctime is long long, too
2013-07-23Do not reset the fragment timeout each time a fragment arrives.Alexander Bluhm
Start the expire counter when the queue is created by the first fragment and drop it if the packet could not be reassembled within 60 seconds. Reported by Antonios Atlasis; OK henning@ deraadt@
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-06-17Before pulling the TCP options from the mbuf onto the stack, do anAlexander Bluhm
additional length check in pf_modulate_sack() and pf_normalize_mss(). Overflow cannot happen due to the restricted values in the length calculation. As this is not obvious, be better safe than sorry. OK henning@
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-10-30Use time_uptime for expiration values as time_second can be skewed atFlorian Obser
runtime while time_uptime is monotonic. Prevent underflows in pfsync(4) and pflow(4) by using signed variables. pfsync(4) problem pointed out by camield. Diff originally by dlg, frag and pflow bits by me. feedback dlg man page tweak jmc Various versions of the pflow bits tested by Hrvoje Popovski (hrvoje AT srce DOT hr), thanks! ok benno, henning, dlg
2012-05-12Ignore/preserve ECN bits on ToS matching and scrubbing.Marco Pfatschbacher
The lower 2 bits of the tos-header are used for ECN. (http://tools.ietf.org/html/rfc2474#section-3) OK henning@, haesbaert@
2012-02-03The kernel did not compile without INET6. Put some #ifdefs intoAlexander Bluhm
pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
2012-01-26Clean up the pf normalization code:Alexander Bluhm
- Let pf_normalize_ip() and pf_normalize_ip6() take the struct pf_pdesc pd as argument. - Always check wether the mbuf got NULL after normalization to make the code more robust. - Make the code structure of pf_normalize_ip6() more like pf_normalize_ip() to make the differences obvious. ok henning@
2012-01-23Do not keep state when dropping overlapping IPv6 fragments in pfAlexander Bluhm
and IPv6 stack. ok sperreault@
2012-01-15Calling pf_normalize_ip() from pf_setup_pdesc() was bad as theAlexander Bluhm
latter is called from pf packet logging. This resulted in normalization and reassembly of bad packets to be logged. So rearrange the code and move the call to pf_test(). ok henning@
2012-01-13Drop IPv6 packets built from overlapping fragments in pf reassembly.Alexander Bluhm
The reassembly state will be dropped after timeout, all related fragments are dropped until that. This is conforming to RFC 5722. - Sort pf_fragment fields while there. - If the fr_queue is empty, we had overlapping fragments, don't add new ones. - If we detect overlapping IPv6 fragments, flush the fr_queue and drop all fragments immediately. - Rearrange debug output, to make clear what happens. - An IPv4 fragment that is totaly overlapped does not inclease the bad fragment counter. - Put an KASSERT into pf_isfull_fragment() to make sure that the fr_queue is never emtpy there. discussed with Fernando Gont; ok henning@
2012-01-03Instead of having two functions pf_free_fragment() and pf_remove_fragment()Alexander Bluhm
doing more or less the same, merge them into one. Just remove fragment entries from the queue in pf_join_fragment() before they are freed. Then pf_remove_fragment() is not needed anymore. ok henning@
2011-11-25use time_uptime to set state creation values as time_second can beDavid Gwynne
skewed at runtime by things like date(1) and ntpd. time_uptime is monotonic and therefore more useful to compare against. ok deraadt@ mikeb@
2011-09-28As requested by henning, move the mbuf pointer into struct pf_pdesc.Alexander Bluhm
Also sort pd to the beginning of the functions' parameter lists for consistency. ok henning
2011-09-22As I have touched half of pf lines anyway, fix whitespaces now.Alexander Bluhm
KNF, no binary change.
2011-09-21Check the protocol header length for tcp, udp, icmp, icmp6 inAlexander Bluhm
pf_setup_pdesc(). It is better to check and bail out early than to rely on pf_pull_hdr() later. ok henning mpf
2011-09-20Put kif and dir into pdesc an use this instead of passing the valuesAlexander Bluhm
around. This is a mechanical change. Initialize pd2 and use it where appropriate. ok henning on an earlier version; ok mpf
2011-09-19Consolidate pf function parameters. Move off and hdrlen into pdescAlexander Bluhm
and change their type from int to u_int32_t. Do not pass struct tcphdr *th and sa_family_t af, it is in pd anyway. Do not use af and pd->af intermixed, the latter makes clear where it comes from. Do not calculate the packet length again if pd already has it. Use pd2.off instead of off2. go go go go don't stop henning@ mpf@
2011-09-18Fix various format string types to as a minimum match the width of theMiod Vallat
variables being processed. ok bluhm@ henning@
2011-07-18unbreak set-tos for ipv6; reported by babut at yandex dot ru,Mike Belopuhov
with input and ok from bluhm and claudio
2011-07-07There were two loops in pf_setup_pdesc() and pf_normalize_ip6()Alexander Bluhm
walking over the IPv6 header chain. Merge them into one loop, adjust some length checks and fix IPv6 jumbo option handling. Also allow strange but legal IPv6 packets with plen=0 passing through pf. IPv6 jumbo packets still get dropped. testing dhill@; ok mcbride@ henning@
2011-07-05Instead of passing the ip header and mbuf to pf_reassemble(), lookupAlexander Bluhm
the header address in the mbuf. ok henning@
2011-07-05add missing ifdefs for INET6; diff from form, ok henning, bluhm, claudioMike Belopuhov
2011-07-03Refactor the fragment handling in pf_setup_pdesc() so that AF_INETClaudio Jeker
and AF_INET6 are doing the fragment handling the same way. Makes code more readable. With and OK bluhm@
2011-06-21There is no need to handle fragmented TCP reset packets in a specialAlexander Bluhm
way. Remove PFDESC_IP_REAS and pf_pdesc flags completely. ok claudio@ henning@
2011-06-20More cleanup in pf_test/pf_test6 this time mostly the fragmentClaudio Jeker
handling. More to come to make the two codepathes a bit more identical. tested by many (esp. krw@ and sthen@) input and OK bluhm@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 13:55:41 +0000