summaryrefslogtreecommitdiff
path: root/sys/net/pf_table.c
AgeCommit message (Collapse)Author
2023-08-10Table persistent flag (PFR_TFLAG_PERSIST) won't get setAlexandr Nedvedicky
by ioctl(2) operation if table exists already. The issue has been noticed by Giannis Kapetanakis (_at_) edu.physics.uoc.gr. Giannis noticed relayd(8) aborts unexpectedly when 'relay host' gets disabled by 'relayctl host dis ...' command. To understand what's going on we must look at the way how relayd(8) manages its firewall configuration. If relay-host 'example' is enabled relayd(8) inserts rule to anchor relayd/example. The rule looks somewhat like this: pass in from ... to ... rdr-to <example> When the rule gets inserted to pf(4) the table 'example' is created with flags: lumpy# pfctl -a relayd/example -vg -sT ----r-- example relayd/example r-flag indicates table is referred by rule only. In the next step relayd(8) creates and populates table example. It asks pf(4) to add a persistent flag (PFR_TFLAG_PERSIST), so table survives flush operation of relayd/example ruleset on behalf of 'relayctl host dis ...' command. relayd(8) exits via abort() when table is gone with disable operation. Giannis was patient enough so we could debug and fix issue. The committed change has been tested by Giannis too. OK kn@, bluhm@
2023-01-05pfctl fails to add addresses to undefined/inactive tableAlexandr Nedvedicky
pfr_add_tables() function must set PFR_TFLAG_ACTIVE flag to table which is attached to rule. This will then allow pfr_add_addrs() to populate the table with addresses. without this pair of pfctl(8) commands fails as follows: # echo 'pass from <foo> to any' |pfctl -f - # pfctl -t foo -T add 192.168.1.0/24 pfctl: Table does not exist OK mbuhl@
2022-06-26Allow waiting during ktable allocation in pf_ioctl.mbuhl
OK bluhm Reported-by: syzbot+50ea4f33ed5dd9264918@syzkaller.appspotmail.com Reported-by: syzbot+df65f8b7ee8c0089e885@syzkaller.appspotmail.com
2022-06-16pfctl reports existing table as being added. glitch hasAlexandr Nedvedicky
been spotted and reported by jmc@ OK kn@
2022-06-07fixes NULL pointer dereference panic triggered by relayd.Alexandr Nedvedicky
same panic can be triggered when address table is part of anchor loaded by 'load anchor ... from ..,' statement. pf_find_or_create_ruleset() function called by pfr_add_tables() must receive ruleset name which comes from pre-allocated root table. OK claudio@ dlg@
2022-05-10move memory allocations in pfr_add_tables() out ofAlexandr Nedvedicky
NET_LOCK()/PF_LOCK() scope. bluhm@ helped a lot to put this diff into shape. OK bluhm@
2021-11-22move PFR_TFLAG_CONST test, missed in rev 1.138Jonathan Gray
prompted by uninitialised var found by bluhm@ running regress on sparc64 ok sashan@
2021-11-16move memory allocations in pfr_add_addrs() outside of NET_LOCK()/PF_LOCK()Alexandr Nedvedicky
scope. feedback by bluhm@ OK bluhm@
2021-11-11Allow pfi_kif_get() callers to pre-allocate buffer for new kif. If kifAlexandr Nedvedicky
object exists already, then caller must free the pre-allocated buffer. If caller does not pre-allocate buffer, the pfi_kif_get() will get memory from pool using M_NOWAIT flag. Commit is also polishing pfi_initialize() a bit so it uses M_WAITOK allocation for pfi_all. there is no change in current behaviour. feedback by bluhm@ OK bluhm@
2021-10-24let pf_table.c to use standard way to work with listsAlexandr Nedvedicky
OK todd@, mvs@, kn@
2021-10-23YIELD() in pf_table.c should preempt for ioctl() callers onlyAlexandr Nedvedicky
OK @mpi
2020-07-28Use the table on root always if current table is not active.YASUOKA Masahiko
ok sashan
2020-06-24kernel: use gettime(9)/getuptime(9) in lieu of time_second(9)/time_uptime(9)cheloha
time_second(9) and time_uptime(9) are widely used in the kernel to quickly get the system UTC or system uptime as a time_t. However, time_t is 64-bit everywhere, so it is not generally safe to use them on 32-bit platforms: you have a split-read problem if your hardware cannot perform atomic 64-bit reads. This patch replaces time_second(9) with gettime(9), a safer successor interface, throughout the kernel. Similarly, time_uptime(9) is replaced with getuptime(9). There is a performance cost on 32-bit platforms in exchange for eliminating the split-read problem: instead of two register reads you now have a lockless read loop to pull the values from the timehands. This is really not *too* bad in the grand scheme of things, but compared to what we were doing before it is several times slower. There is no performance cost on 64-bit (__LP64__) platforms. With input from visa@, dlg@, and tedu@. Several bugs squashed by visa@. ok kettenis@
2020-06-04Fix pfr_kentry_byaddr() to be used for a rule in an anchor. ItYASUOKA Masahiko
couldn't find an entry if its table is attached a table on the root. This fixes the problem "route-to <TABLE> least-states" doesn't work. The problem is found by IIJ. OK sashan
2019-07-08free(9) sizes for M_RTABLE.Martin Pieuchot
ok kn@
2018-12-10Remove useless macroskn
These are just unhelpful case conversion. OK sashan henning
2018-10-15use PFR_RB_NONE consistentlykn
Replace hardcoded 0 and implicit checks with enum as done in all other use cases of `pfra_fback'. No object change. OK sashan
2018-03-28- memory leak occurs when adding same table twice.Alexandr Nedvedicky
(tj found fix in FreeBSD repo for us) OK @bluhm, @henning
2017-08-16Validate pfra_type after copyin before using it to index an arrayMike Belopuhov
Don't trust the value of pfra_type blindly since it's coming from userland and sanitize it in pfr_validate_addr that is called after every copyin and also perform the check in pfr_create_kentry before we attempt to use the value not after. Coverity CID 1452909, 1453097, 1453384; Severity: Minor It can be triggered only by root by default or anyone with write access to /dev/pf if such access is provided. ok visa, bcook, sashan, jsg
2017-05-08Replace the global variables pfr_{sin,sin6} with stack local variablesPatrick Wildt
so that we can run these parts of pf in parallel. Also replace a single usage of pfr_mask with a stack local variable. ok mpi@
2017-02-14Convert most of the manual checks for CPU hogging to sched_pause().Martin Pieuchot
The distinction between preempt() and yield() stays as it is usueful to know if a thread decided to yield by itself or if the kernel told him to go away. ok tedu@, guenther@
2017-02-09Replace a custom loop calling yield() by the idiom to check if theMartin Pieuchot
current process is hogging a CPU. ok mikeb@, visa@, tedu@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2017-01-23Kill unecessary splsoftnet()/splx() dances, what's protecting radixMartin Pieuchot
globals is the KERNEL_LOCK(). ok claudio@
2016-10-26Put union pf_headers and struct pf_pdesc into separate header fileAlexander Bluhm
pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
2016-09-27roll back turning RB into RBT until i get better at this process.David Gwynne
2016-09-27move pf from the RB macros to the RBT functions.David Gwynne
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-02pool_setipl for pf bitsDavid Gwynne
ok phessler@ henning@
2015-11-03- fixes potential use-after-free in pfr_set_addrs()Alexandr Nedvedicky
OK mikeb@, OK bluhm@
2015-10-07rn_inithead() offset argument is now specified in byte, missed in previous.Martin Pieuchot
2015-09-04Make every subsystem using a radix tree call rn_init() and pass theMartin Pieuchot
length of the key as argument. This way every consumer of the radix tree has a chance to explicitly initialize the shared data structures and no longer rely on another subsystem to do the initialization. As a bonus ``dom_maxrtkey'' is no longer used an die. ART kernels should now be fully usable because pf(4) and IPSEC properly initialized the radix tree. ok chris@, reyk@
2015-07-20Add some panics to default paths where code later assumes a non defaultJonathan Gray
path was taken. This both prevents warnings from clang and acts as a sanity check. ok mcbride@ henning@
2015-07-18follow up changes on unknown AF handlingsashan
- PF should always use unhandled_af() - 0 is lame, AF_UNSPEC is profi ok bluhm@
2015-07-18INET/INET6 address family check should be unified in PFsashan
it also adds af_unhandled(), where it is currently missing. ok mcbride@
2015-07-16Fix rn_match and there for the expoerted lookup functions in radix.cClaudio Jeker
to never return the internal RNF_ROOT nodes. This removes the checks in the callee to verify that not an RNF_ROOT node was returned. OK mpi@
2015-06-07Introduce unhandled_af() for cases where code conditionally doesJonathan Gray
something based on an address family and later assumes one of the paths was taken. This was initially just calls to panic until guenther suggested a function to reduce the amount of strings needed. This reduces the amount of noise with static analysers and acts as a sanity check. ok guenther@ bluhm@
2015-04-09Plug a memory leak in pfr_destroy_kentryMike Belopuhov
pfi_kif objects allocated for table entries created by route-to or by specifying weight weren't garbage collected when the table entry was destroyed. Spotted by Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>, thanks! Ok henning, florian
2015-04-08Table flags are not looked at when a table entry is created.Mike Belopuhov
Spotted by Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>, thanks!
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-01-20Prevent tables referenced by rules in anchors from getting disabled.Mike Belopuhov
Analysis and patch by Richard Kojedzinszky, thanks! ok henning
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2013-07-05Collect and display 'match' counters for pf tables.Bret Lambert
While here, fix pf table displays to fit within 80 chars. Manpage input jmc@ ok henning@ reyk@
2013-07-04Re-commit: use time_t for storing time_t values. This is an ABIPhilip Guenther
change for pf, but that's fine at this time. You'll need to rebuild pf userland after updating your kernel. change to 'since' member ok henning@ rest ok henning@ deraadt@
2013-07-02Revert previous: sizeof(time_t) != sizeof(long) on LP64, so there wasPhilip Guenther
an ABI change involved.
2013-07-02Use time_t for storing time_t values. No change to the underlyingPhilip Guenther
type**, so no ABI change. ok henning@ deraadt@ ** ...yet
2013-02-18DIOCRCLRASTATS ioctl wasn't specifying a timestamp when clearedMike Belopuhov
table statistics so it appeared later on as the Epoch. Noticed by [the] Shining on bugs@. Thanks! ok sthen, waver from deraadt
2013-01-16Unbreak the negation toggle code when re-loading pf tables. OtherwiseMarkus Friedl
negating existing entries on re-load does not work (e.g. changing 192.168.6.0/24 to !192.168.6.0/24 in table was ignoed). ok mikeb@, henning@ mpf@, bluhm@,
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 13:16:21 +0000