summaryrefslogtreecommitdiff
path: root/sys/net/pfvar.h
AgeCommit message (Collapse)Author
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-08-22pf spelling policeDavid Krause
ok dhartmei@ jmc@
2003-08-22KNFHenning Brauer
2003-08-22don't expose pf_osfp_fingerprint() to ! _KERNEL. tcpdump et al useMike Frantzen
pf_osfp_fingerprint_hdr() which doesn't work on mbufs. pointed out by Max Laier
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
2003-08-09This patch remove the restriction that tables cannot be used in routing orCedric Berger
redirection rules... The advantage of using tables in redirection/routing rules is not efficiency, in fact it will run slower than straight address pools. However, this brings a lot of flexibility to PF, allowing simple scripts/daemons to add/remove addresses from redirection/routing pools easily. This implementation support all table features, including cidr blocks and negated addresses. So specifying { 10.0.0.0/29 !10.0.0.0 !10.0.0.7 } will correctly round-robin between the six addresses: .1, .2, .3, .4, .5, .6. Tables can also be combined with simple addresses, so the following rule will work as expected: "nat on foo0 -> { 1.1.1.1 <bar> }" ok henning@ mcbride@
2003-08-07make pf_match take u_int32_t instead of u_int16_tHenning Brauer
it's not only used to ,atch on ports any more but uid/gid as well, and uid_t/gid_t are u_int32_t. found by aaron@ ok cedric@
2003-07-31Make table tickets per-ruleset instead of global.Cedric Berger
Make table tickets u_int32_t for consistency with other parts of PF. Ok dhartmei@ henning@
2003-07-19Simplify struct pf_pooladdr to include struct pf_addr_wrap directlyCedric Berger
instead of indirectly trough struct pf_rule_addr. Ryan McBride says: If I'm not mistaken, the code _used_ to use the ports in pf_rule_addr as well. The code was changed to fix some of the bugs with port ranges, but it was too late in the release cycle to make kernel API changes, so the structure was left as is. Needless to say: KERNEL/USERLAND SYNC REQUIRED. ok henning@ mcbride@
2003-07-04-add a "natpass" field to pf_ruleHenning Brauer
-if natpass is nonzero on nat/rdr/binat rules, do not evaluate the filter ruleset, but set the rulepointer to the default rule (which is a pass rule) in cooperation with daniel. ok dhartmei@ cedric@ markus@
2003-07-03unused global. dhartmei okJun-ichiro itojun Hagino
2003-06-30change that queue ID allocator so it always has the queues sorted by ID.Henning Brauer
that allows us to get rid of the "tagid" global which stored the highest tag ID in use. when allocating a new ID scan the list for a free slot and only use highest + 1 on failure instead of using highest + 1 from the beginning scanning for a dup afterwards. this prevents ID space fragmentation better. as a result this allows us do get rid of the pf_tag_purge() function completely and let pf_tag_unref() remove an entry once the reference counter reaches zero by itself. after all it makes for easier code and is about 50% faster. idea came up during a discussion on icb earlier today between cedric and myself, which itself was particulary inspired by Darren Reed questioning the need for pf_tag_purge on tech-net@netbsd. ok dhartmei@ cedric@
2003-06-30move prototype for pf_tag_purge() to pfvar.hHenning Brauer
2003-06-29normalize IPv6 packet (no reass, but it is a start). dhartmei & henning okJun-ichiro itojun Hagino
- length, jumbo payload option - TTL ("hoplimit" in IPv6 terminology) rewrite
2003-06-21count packets and bidirectionally on state entries, allowing for fine-grainedDamien Miller
traffic reporting w/ pfsync; ok dhartmei@ Note: ABI change (new fields in struct pf_state), requires a rebuild of pfctl and tcpdump.
2003-06-20Add MSS support to the synproxy. The client's MSS is sent to the server,Daniel Hartmeier
the server's MSS is guessed based on the routing table and interface MTU. Fine patch entirely from Krists Krilovs <pow@pow.za.net>, ok frantzen@ Note: ABI change (new field in struct pf_state), requires a pfctl rebuild (and tcpdump for pfsync).
2003-06-09Attempt to resolve byte order confusion in nat code once and for all.Ryan Thomas McBride
- pf_get_sport() leaves the translated port in the packet in network byte order - merge code for the p1=0 p2=0 case and static-port case in pr_get_sport() NOTE: people who use the static-port keyword in their pf.conf need to make sure pfctl is updated along with their kernel.
2003-06-08A table in an anchor creates a real anchor: pfctl -sA works.Cedric Berger
The following two pfctl functions work with an "-a" option: - pfctl [-a foo[:bar]] -sT - pfctl [-a foo[:bar]] -FT ok dhartmei@
2003-06-03move some prototypes to pfvar.h. needed soon.Henning Brauer
pf_tagname2tag, pf_tag2tagname, pf_tag_unref, pf_tag_packet
2003-05-17allow inverse matching on tagsHenning Brauer
ok dhartmei@ pb@
2003-05-17Add an 'action' code that allows the SYN proxy to swallow/drop a packetDaniel Hartmeier
without causing EHOSTUNREACH to be delivered to local sockets, so it works for outgoing connections originating on the same host. ok frantzen@
2003-05-16TCP SYN proxy. Instead of 'keep state' or 'modulate state', one can useDaniel Hartmeier
'synproxy state' for TCP connections. pf will complete the TCP handshake with the active endpoint before passing any packets to the passive end- point, preventing spoofed SYN floods from reaching the passive endpoint. No additional memory requirements, no cookies needed, random initial sequence numbers, uses the existing sequence number modulators to translate packets after the handshakes. ok frantzen@
2003-05-14- modulate TCP Timestamps so they can't be used to detect NAT and to precludeMike Frantzen
remote uptime determination - scrub modifier "reassemble tcp" turns on stateful TCP normalizations ok henning@ dhartmei@
2003-05-14Use official (from pcap people) link type for pflog.Can Erkin Acar
With this change, the log header format also changes. The new log format is extendible and allows logging of the originating anchor and ruleset information. ok henning@ dhartmei@ frantzen@
2003-05-13add support for tagging packets with arbitary tags and filtering based onHenning Brauer
those tags later on. ok dhartmei@ pb@ mcbride@ frantzen@
2003-05-12Add comment about special (non-index) PFTM_* values.Daniel Hartmeier
2003-05-12Reorder IPv6 address comparisons to check the least significant partsRyan Thomas McBride
first. The least significant portions of the IPv6 address are more likely to differ than the more significant ones, since in most situations half the addresses (either the source or the destination) will be in the local subnet. ok dhartmei@ henning@
2003-05-12Adaptive timeout value scaling. Allows to reduce timeout values as theDaniel Hartmeier
number of state table entries grows, so entries time out faster before the table fills up. Works both globally and per-rule. ok frantzen@
2003-05-11the start of stateful TCP scrubbing. dynamically determine the highest TTL ofMike Frantzen
each side of the TCP connection and prevent it from being reduced ok pb@ dhartmei@
2003-04-30Allow tables to be loaded into anchors.Cedric Berger
Most pfctl table commands (excluding 'show' and 'flush') support the "-a" modifier. ok dhartmei@
2003-04-27Update the pfioc_table IOCTL structure.Cedric Berger
Prepare for anchors, improve robustness. WARNING: need to sync kernel/userland. ok dhartmei@
2003-04-11set/update the queue IDs on filter rules (qid and pqid) onHenning Brauer
-DIOCCHANGERULE (just the affected rule) -DIOCCOMMITRULES (all filter rules that get committed - one anchor or main rs) -DIOCCOMMITALTQS (all filter rules, main set plus all anchors) This fixes a whole bunch of issues. previously, this was done in userland at load time. This worked fine for the usual case, full ruleset load. It did not work inside anchors, as the queue name <-> queue ID mapping is unknown there. Also, if the queue definitions were changed without reloading the rules too (pfctl -A), the queue IDs on the rules were not updated. The three ioctls mentioned above are all entry points where the mapping is touched. helpful discussion with dhartmei@ and cedric@ helped verifying my approach for this fix was right. ok dhartmei@ cedric@
2003-04-09Change pf_state structure to point to both a rule and the anchor,Cedric Berger
so states created by rules in anchors correctly use rule options like routing and (soon) queues... Rule number bumped to 32 bit value. USERLAND NEED TO BE RECOMPILED. ok dhartmei@ henning@
2003-04-05Replace the timeout variables by the content of the timeoutCedric Berger
field of a new pf_default_rule structure. ok dhartmei@
2003-03-31Only delete rule structure when no state refer to it.Cedric Berger
Fix a bunch of issues. Removal of unneeded (r != null) tests coming soon... ok dhartmei@
2003-03-03Make "pfctl -ss" output easier to parse. NO TRAFFIC -> NO_TRAFFIC.Cedric Berger
ok dhartmei@ henning@
2003-02-08Add scrub option 'random-id', which replaces IP IDs with random valuesDaniel Hartmeier
for outgoing packets that are not fragmented (after reassembly), to compensate for predictable IDs generated by some hosts, and defeat fingerprinting and NAT detection as described in the Bellovin paper http://www.research.att.com/~smb/papers/fnat.pdf. ok theo@
2003-01-21Support for TCP window scaling (RFC 1323). ok frantzen@Daniel Hartmeier
2003-01-15Fix a buglet when one "creates" a table which is already in theCedric Berger
referenced or inactive set. Flags were not updated correctly. Tested on i386, sparc64. More regression tests coming.
2003-01-10Fix adding and deleting addresses in a table when there is a conflict withCedric Berger
the "negated" attribute of an address. The previous behaviour was incorrect in both cases (too strict for the add command and too permissive for the delete command). ok dhartmei@
2003-01-09(whitespace) KNF, re-fold -w 80Daniel Hartmeier
2003-01-09Add support for active/inactive tablesets in the kernel.Cedric Berger
Add table definition/initialisation construct in pfctl parser. Add and fix documentation for pf.4 and pf.conf.5. Tested on i386 and sparc64 by myself, macppc by Daniel. ok dhartmei@
2003-01-07Remove table name hashing (pass the name in each ioctl instead), andDaniel Hartmeier
introduce reference counting for tables, they are now automatically created and deleted through referencing rules. Diff partly from cedric@. ok mcbride@, henning@, cedric@
2003-01-06Move initialisation of radix table globals in pfr_initialize()Cedric Berger
ok dhartmei@
2003-01-05Move ifname from pf_addr to pf_addr_wrap, prepare pf_addr_wrap for tableDaniel Hartmeier
name. ok henning@, mcbride@, cedric@
2003-01-04move noroute from flag in pf_rule_addr into type in pf_addr_wrap.Daniel Hartmeier
ok henning@, mcbride@
2003-01-031) pfr_insert_kentries() cannot return ENOMEM anymore -> make it void.Cedric Berger
2) add new PFR_FLAG_REPLACE for use by pfr_tst_addrs(). 3) add new pfrio_nmatch alias to pfioc_table, set by pfr_tst_addrs(). Tested on i386, sparc64
2003-01-02Remove explicit numbering of enums.Ryan Thomas McBride
ok fgsch@ dhartmei@ henning@
2003-01-01use a #define for the default state table sizeHenning Brauer
2003-01-01Behaves correctly when duplicate addresses are given in the same ioctl.Cedric Berger
(i.e: pfradix -a test 1.2.3.4 1.2.3.4). The ioctl can also report theses duplicate to the caller using the new PFR_FB_DUPLICATE feedback tag.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-11 19:40:42 +0000