summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2012-03-17remove IP_JUMBO, SO_JUMBO, and RTF_JUMBO.David Gwynne
no objection from mcbride@ krw@ markus@ deraadt@
2012-02-05Improve the ICMPv6 direction checkMike Belopuhov
Following bluhm's advice this changes the way we setup state keys and perform state lookups for ICMPv6 Neighbor Discovery packets: - replace the NS-dst with ND target address; - replace the NA-src with ND target address; - replace the NA-dst with unspecified address if it is a multicast. This allows pf to match Address Resolution, Neighbor Unreachability Detection and Duplicate Address Detection packets to the corresponding states without the need to create new ones or match unrelated ones. As a side effect we're doing now one state table lookup for ND packets instead of two. Fixes a bug uncovered by one of the previous commits that virtually breaks IPv6 connectivity after few minutes of use. ok stsp henning, with and ok bluhm
2012-02-03The kernel did not compile without INET6. Put some #ifdefs intoAlexander Bluhm
pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
2012-02-02add netflow v9/ipfix support to pflow(4).Sebastian Benoit
large parts written by Florian Obser (florian -at- narrans -dot- de). feedback from sperreault@ gollo@ sthen@ ok from gollo@ dlg@ henning@
2012-01-31add missing calls to pf_pkt_addr_changed(); ok henning@Markus Friedl
2012-01-29Remove fastq from struct sppp. Missed when I committed if_spppsubr.c r1.96,Stuart Henderson
pointed out / ok mikeb@
2012-01-28improve icmp virtual id generation for ND and MLD packets so thatMike Belopuhov
two consecutive host addresses won't generate the same value which is used as a port number in state entries; ok bluhm, sperreault
2012-01-28try to lookup the icmp state based on a correct packet descriptor;Mike Belopuhov
ok bluhm, henning
2012-01-28Remove a horrible sppp(4)-specific "fast queue" used for tcp ports 21 23 513.Stuart Henderson
You should use the proper queues via pf instead. ok phessler@ henning@
2012-01-27If some length checks in pflog_bpfcopy() failed, the functionAlexander Bluhm
returned early. As a result tcpdump -i pflog0 printed uninitialized kernel memory for short packets. Fix this by copying the mbuf data we have if we cannot decode the packet. ok mikeb@ henning@
2012-01-26Clean up the pf normalization code:Alexander Bluhm
- Let pf_normalize_ip() and pf_normalize_ip6() take the struct pf_pdesc pd as argument. - Always check wether the mbuf got NULL after normalization to make the code more robust. - Make the code structure of pf_normalize_ip6() more like pf_normalize_ip() to make the differences obvious. ok henning@
2012-01-26Minor fixes for pf_walk_header6():Alexander Bluhm
- Fragment offset is in network byte order. - Check for legal short fragments before calling pf_pull_hdr() to avoid bogus reason accounting. - When checking wether the protocol header is within the fragment, count the IPv6 payload length relative to the end of the IPv6 header. ok henning@
2012-01-26when table content changes we need to reset indexMike Belopuhov
to the initial value and do not use the counter; reported by Sebastian Benoit and Daniel Krambrock, tested by Sebastian Benoit, ok henning zinke
2012-01-23Do not keep state when dropping overlapping IPv6 fragments in pfAlexander Bluhm
and IPv6 stack. ok sperreault@
2012-01-23The ingress filter of pipex and npppd become configurable and disabledYASUOKA Masahiko
by default. After this change we need to add ppp.ingress_filter: true to npppd.conf if it is needed. ok sthen
2012-01-20Ansify ppp... function definitions.Alexander Bluhm
from Michael W. Bombardieri
2012-01-19Teach pppoe(4) about RFC 4638. This allows negotiating increased MTU withStuart Henderson
compatible equipment provided that the physical interface and other layer 2 devices involved support and are configured to use jumbo frames. Manpage to follow; typical use is to request 1500 MTU for pppoe, this requires 1508+ MTU on the physical interface, e.g. "ifconfig em0 mtu 1508; ifconfig pppoe0 mtu 1500". Known to be usable in the UK with some ISPs (e.g. aaisp) using BT FTTC backhaul. From Matt Dainty, originally based on support in NetBSD, changed to decouple pppoe from physical interface MTU. Tested with UK FTTC by Matt, no regressions on my standard UK ADSL setup or yasuoka@'s setup (in Japan, NTT uses 1452 byte MTU for PPPoE and 1500 byte MTU for IPv6 on the same network). ok yasuoka@
2012-01-18Remove dead assignments and newly created unused variables.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ markus@
2012-01-18Fix a problem that causes LCP keepalive timeout. In case the ack number ofYASUOKA Masahiko
a packet that is passed to the userland has not incremented, `pipex' passed the packet mistakenly with invalid ack number. Then `npppd' will drop these packets, so that caused the problem. tested jmatthew ok jmatthew
2012-01-17Fix trailing whitespace.Alexander Bluhm
2012-01-16Pass struct pf_pdesc to pf_walk_option6() and pf_walk_header6() toAlexander Bluhm
make their argument list shorter. Also fix a bug where pf_walk_option6() used the outer header in the pd2 case. ok henning@ mikeb@
2012-01-16do carp demotion adjustments on syncdev link state change.Mike Belopuhov
this prevents backup to failover back to master immediately after getting link back on carpdev interface if underlying pfsync interface went down as well. instead pfsync will request a bulk update to get new states from the master. sthen and mpf like the idea, ok dlg
2012-01-16bpf devices behave similar to raw sockets and never block on write,Philip Guenthe
so always show as writable to poll()/select(). Behavior pointed out by Fernando Gont. ok deraadt@
2012-01-15Calling pf_normalize_ip() from pf_setup_pdesc() was bad as theAlexander Bluhm
latter is called from pf packet logging. This resulted in normalization and reassembly of bad packets to be logged. So rearrange the code and move the call to pf_test(). ok henning@
2012-01-13Drop IPv6 packets built from overlapping fragments in pf reassembly.Alexander Bluhm
The reassembly state will be dropped after timeout, all related fragments are dropped until that. This is conforming to RFC 5722. - Sort pf_fragment fields while there. - If the fr_queue is empty, we had overlapping fragments, don't add new ones. - If we detect overlapping IPv6 fragments, flush the fr_queue and drop all fragments immediately. - Rearrange debug output, to make clear what happens. - An IPv4 fragment that is totaly overlapped does not inclease the bad fragment counter. - Put an KASSERT into pf_isfull_fragment() to make sure that the fr_queue is never emtpy there. discussed with Fernando Gont; ok henning@
2012-01-11Ansify raw_... function definitions. No binary change.Alexander Bluhm
from Michael W. Bombardieri; ok henning@
2012-01-11ansify and de'register some prototypesDavid Hill
ok miod@
2012-01-03To access the ifaddr of an in_ifaddr or in6_ifaddr struct, it isAlexander Bluhm
cleaner to access the first member via ia_ifa instead of casting. No binary change. ok henning@ krw@
2012-01-03Instead of having two functions pf_free_fragment() and pf_remove_fragment()Alexander Bluhm
doing more or less the same, merge them into one. Just remove fragment entries from the queue in pf_join_fragment() before they are freed. Then pf_remove_fragment() is not needed anymore. ok henning@
2011-12-21Just use pd->sidx and pd->didx to reverse the state key argumentsMarco Pfatschbacher
in pf_test_state_*(). This needs less code and is more consistent. OK mikeb, markus, henning.
2011-12-21don't attempt to run pf_translate on fragments: it will fail miserably.Mike Belopuhov
also don't do af translation if pf_translate didn't succeed. ok henning
2011-12-19improve the icmp direction check to deal correctly with af-to statesMike Belopuhov
(there only one state and it's direction is always PF_IN) and don't exclude icmp echo replies from the test. ok mcbride, claudio on previous version, ok henning, "looks good" deraadt
2011-12-12fixup af-to regression with match rulesMike Belopuhov
pfctl should not infer the af-to behavior from the af/naf difference. instead, we should be clear that this is an af-to rule. essentially this change converts FOM_AFTO marker into a rule flag PFRULE_AFTO so that we don't rely on ambiguous checks (like r->af != r->naf) when setting things up. positive review and comments from claudio, ok henning, sperreault
2011-12-06Remove needless temporary variable for greater clarity.Bret Lambert
testing sthen@ ok sthen@ henning@ dlg@
2011-12-06don't duplicate rtfree actions taken by rtrequest1() in rtdeletemsg()Bret Lambert
testing sthen@ ok sthen@ henning@ dlg@
2011-12-06simplify the somewhat-tangled conditional maze in rt_getifa()Bret Lambert
testing sthen@ ok sthen@ henning@ dlg@
2011-12-02Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.Christiano F. Haesbaert
ok claudio@ henning@ mikeb@
2011-12-01Make sure we only enter pf_route() when undefering in the PF_ROUTETO case.Ryan Thomas McBride
ok dlg claudio
2011-11-29use a u_int64_t for the state id in pfsync_state. this makes it consistentDavid Gwynne
with every other thing that stores the state id (including other pfsync messages). includes improvements to the systat code to consider the creatorid as well as the state id in its cache to avoid collisions between states created on different hosts. tested by me in production and on amd64 talking to sparc64. ok henning@
2011-11-28deprecate PFTM_UNTIL_PACKET. nothing in the tree uses it, andDavid Gwynne
pf_state_expires() handled it incorrectly. discussed with mikeb@ ok henning@
2011-11-27Protect more operations in the pfsync_clone_destroy to preventMike Belopuhov
accidental race conditions. From Erik Lax, thanks! ok dlg
2011-11-27Kill old comment, we already do 802.1p tagging.Christiano F. Haesbaert
2011-11-26Tie the 802.1p (CoS) value in vlan(4) with the new prio scheme in pf.Christiano F. Haesbaert
When transmitting through vlan(4), it will now use the prio value in pf packet header. When receiving, we save the incoming Cos in the same place, this gives us the hability to preserve the CoS value across two different vlan interfaces. This kills the SIOC[GS]VLANPRIO ioctls and removes the corresponding buttons from ifconfig(8). ok henning@ claudio@ mcbride@
2011-11-26Apply route-to to deferred packet; without this the first packet of aRyan Thomas McBride
connection does not observe the route-to option. ok dlg mikeb
2011-11-25fix compile errors without INET6. no binary change.YASUOKA Masahiko
pointed out by Julien Crapovich on misc@ ok deraadt mikeb
2011-11-25use time_uptime to set state creation values as time_second can beDavid Gwynne
skewed at runtime by things like date(1) and ntpd. time_uptime is monotonic and therefore more useful to compare against. ok deraadt@ mikeb@
2011-11-16Improve flag setting ioctl so that bulk updates are requestedMike Belopuhov
only when we're going up, not when we set PROMISC or any other flag. Fixes spontaneous CARP failovers when running tcpdump on pfsync. ok henning, mcbride, camield
2011-11-12Fix a commentClaudio Jeker
From Abel Abraham Camarillo Ojeda, reminded by Brad.
2011-11-09State expire time is a baseline time ("last active") for expiryCamiel Dobbelaar
calculations, and does _not_ denote the time when to expire. So it should never be added to (set into the future). Try to reconstruct it with an educated guess on state import and just set it to the current time on state updates. This fixes a problem on pfsync listeners where the expiry time could be double the expected value and cause a lot more states to linger. Timeout code from mikeb. Found and testing by Maxim Bourmistrov. ok mikeb dlg
2011-11-04Select a correct protocol for a stack side state key when importingMike Belopuhov
an icmp<->icmp6 state (nat64); ok henning, mcbride, dlg
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-16 19:32:34 +0000