summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2011-11-12Fix a commentClaudio Jeker
From Abel Abraham Camarillo Ojeda, reminded by Brad.
2011-11-09State expire time is a baseline time ("last active") for expiryCamiel Dobbelaar
calculations, and does _not_ denote the time when to expire. So it should never be added to (set into the future). Try to reconstruct it with an educated guess on state import and just set it to the current time on state updates. This fixes a problem on pfsync listeners where the expiry time could be double the expected value and cause a lot more states to linger. Timeout code from mikeb. Found and testing by Maxim Bourmistrov. ok mikeb dlg
2011-11-04Select a correct protocol for a stack side state key when importingMike Belopuhov
an icmp<->icmp6 state (nat64); ok henning, mcbride, dlg
2011-11-02Expose if_capabilities to userland so that ifconfig can display theChristiano F. Haesbaert
device hardware features. Tune ifconfig to show them with 'hwfeatures' argument. While here, kill some old unused capabilities and respect 80 columns in brconfig.h. ok mcbride@, henning@, mpf@.
2011-10-31Don't forget to cancel bulk update failure timeout when destroying anMike Belopuhov
interface. Problem report and fix from Erik Lax, thanks!
2011-10-30Allow setting big MTU values on the pfsync interface but not largerMike Belopuhov
than the syncdev MTU. Prompted by the discussion with and tested by Maxim Bourmistrov; ok dlg, mpf
2011-10-28Take more care to ensure all callbacks are initialized. In particularKenneth R Westerback
tr_linkstate() was not initialized in trunk_rr_attach(), and tr_init() and tr_stop() were missing in trunk_lb_attach(). Fixes crash triggered by changing trunkproto, reported by Anders Berggren on bugs@. ok mpf henning
2011-10-25i didnt copy the tun code properly. fix a use of an uninitted value foundDavid Gwynne
by pedro/gcc.
2011-10-24Don't detach interface from group in if_clone_destroy(),Camiel Dobbelaar
if_detach() handles this ok. carpdetach() can now lower the demote count on the carp group correctly. ok henning mpf
2011-10-21strengthen some checks to prevent m_copy* routines from operatingMike Belopuhov
on mbuf chains of insufficient length; prevents crashes seen by dhill. also bring in some chunks omitted in the nat64 commit and are essential for correct packet interpretation. tested by dhill and me, ok henning
2011-10-21add forgotten fixup for icmp6 id's when translating; ok henningMike Belopuhov
2011-10-20remove a bogus chunk accidentally introduced by mcbride in rev1.141;Mike Belopuhov
mcbride agrees, ok mpf, dlg
2011-10-15Added "provision for rewound PPP frames" that allows receivingYASUOKA Masahiko
reorder packets to pass to the upper layer without reorder. It will improve performance (throughput or loss rate) for PPTP or L2TP(/IPesc) on networks that latency is unstable such as mobile network. As our test environment (bandwidth: 6Mbps, latency: 50ms for 97% of traffic and 52ms for rest of traffic), throughput has changed from 0.76MB to 2.17MB on file upload by PPTP connected Windows Vista ftp.exe. Developed by UMEZAWA Takeshi at IIJ. ok jmatthew@ tested jmatthew@ and myself.
2011-10-13Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyClaudio Jeker
"af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
2011-10-07rename some vars and functionsHenning Brauer
unfortunately altq is one giant namespace violation. rename just those that conflict with new stuff for now only to be found on my laptop. reduce pain, the diff is huge already. ok ryan
2011-10-07remove inaccurate comment - we don't have state tableS any more, there isHenning Brauer
just one and the variable name is clear enough. ryan ok
2011-10-07pf_poolqueue is long dead, remove corpses. from eurobsdcon, ryan okHenning Brauer
2011-09-28As requested by henning, move the mbuf pointer into struct pf_pdesc.Alexander Bluhm
Also sort pd to the beginning of the functions' parameter lists for consistency. ok henning
2011-09-22As I have touched half of pf lines anyway, fix whitespaces now.Alexander Bluhm
KNF, no binary change.
2011-09-21Check the protocol header length for tcp, udp, icmp, icmp6 inAlexander Bluhm
pf_setup_pdesc(). It is better to check and bail out early than to rely on pf_pull_hdr() later. ok henning mpf
2011-09-20pf_setup_pdesc() panics if address family is neither AF_INET norAlexander Bluhm
AF_INET6. So remove useless af switch defaults here and there. Always use "switch(af)" instead of "if (af) else" for af dependent code. Always use AF_ defines instead of PF_ when checking af values. ok claudio mpf henning
2011-09-20Put kif and dir into pdesc an use this instead of passing the valuesAlexander Bluhm
around. This is a mechanical change. Initialize pd2 and use it where appropriate. ok henning on an earlier version; ok mpf
2011-09-19Consolidate pf function parameters. Move off and hdrlen into pdescAlexander Bluhm
and change their type from int to u_int32_t. Do not pass struct tcphdr *th and sa_family_t af, it is in pd anyway. Do not use af and pd->af intermixed, the latter makes clear where it comes from. Do not calculate the packet length again if pd already has it. Use pd2.off instead of off2. go go go go don't stop henning@ mpf@
2011-09-18Move the pdesc initialization code into pf_setup_pdesc(). UnifyAlexander Bluhm
some IPv4 and IPv6 code. Make sure that both code paths set the same fields in the same order. ok mpf henning
2011-09-18Fix various format string types to as a minimum match the width of theMiod Vallat
variables being processed. ok bluhm@ henning@
2011-09-18Move the call to pf_test_rule() for fragments that have not beenAlexander Bluhm
reassembled by normalization from pf_setup_pdesc() to pf_test(). This simplifies the paramter list of pf_setup_pdesc() as it can concentrate on its job filling the pf_pdesc struct. ok henning mpf
2011-09-17The pd->ip_sum and pd->proto_sum fields are not needed. ReplaceAlexander Bluhm
the one occurrence in pf_test_state_icmp() that uses pd2.ip_sum by a local variable. Remove ip_sum and proto_sum from struct pf_pdesc. ok claudio henning
2011-09-17move initialisation of pd->nsaddr and pd->ndaddr from pf_test_rule toHenning Brauer
pf_setup_pdesc. fixes logging of packets passed statefully. ok bluhm
2011-09-17Deduplicate IPv4 and IPv6 code that handles fragments that have notAlexander Bluhm
been reassembled by normalization. ok henning claudio
2011-08-30Add support for one shot rules that remove themselves from an activeMike Belopuhov
ruleset after match. In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched. This is an extremely handy technique for firewall proxies. ok henning, mcbride
2011-08-21Use the lowest available unit number for new pppx ifs. SomewhatJonathan Matthew
inefficient but doesn't matter with reasonable numbers of interfaces. ok dlg@
2011-08-20Fix packet accounting in error cases.Ryan Thomas McBride
From Christiano F. Haesbaert.
2011-08-03Remove redundant prototype for pf_socket_lookup().Marco Pfatschbacher
It's already in pfvar.h OK mcbride@
2011-08-03someone (*cough*henning*cough*) made pf_state.state_flags a u_int16_tDavid Gwynne
without growing it in pfsync_state too. to keep the wire format compat this uses some of the pad bytes to send all the state flags on the wire as well as maintaining the old state_flags field. after 5.0 we'll deprecate the original field and only use the new one. discussed with mcbride and deraadt and based on a diff from deraadt. tested against an "old" pfsync locally. ok mcbride@ henning@ deraadt@
2011-08-02Replace one byte of padding with sa_family_t af in pfsync_state_key;Ryan Thomas McBride
Reject states with pfsync_state->af == 0 in pfsync_state_import(), in preparation for states which specify an address family in each state key instead (change will take place post-5.0). ok dlg henning mikeb
2011-07-29Make sure we use the right tbl/dyn pointer to check the pfrkt_refcntcost;Ryan Thomas McBride
improved debugging for error cases inside the weighted round-robin loop. original diff from claudio, ok henning
2011-07-28fix set skip group matching: don't match partial strings, i. e. 'set skip onHenning Brauer
lo' must not match a group 'local'. diff from sthen who is not around for a few days, ok me and mpf. I can't find the mail of the guy who initially ran into this problem, sorry for that, thanks for reporting!
2011-07-27Add support for weighted round-robin in load balancing pools and tables.Ryan Thomas McBride
Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
2011-07-26__arm32__ -> __arm__, since our new compiler isn't defining theMartynas Venckus
former anymore. OK miod@.
2011-07-24OS fingerprinting can only be done on rules that explicitly specify TCPRyan Thomas McBride
now, put it in the IPPROTO_TCP case of the pf_test_rule() inner loop. ok henning sthen
2011-07-23Replace the IPv6 header walking loop in pf_test_state_icmp() withAlexander Bluhm
the common function pf_walk_header6(). For that, pf_walk_header6() can now extract both the information wether it is a fragment and the final protocol if it is the first fragment. This allows to match the icmp6 too big packet of a first fragment to the reassembled packet's state. This is neccesary if a refragmented fragment is to big for the Path-MTU. Note that pd.proto contains the real protocol number for the first fragment and IPPROTO_FRAGMENT for later fragments. pd.virtual_protocol is set to PF_VPROTO_FRAGMENT for all fragments. ok mcbride@
2011-07-22use ifmedia_delete_instance() when destroying a vetherTheo de Raadt
from Martin Pelikan
2011-07-22Sync 'block return' behaviour for ICMP packets with our IP stack:Ryan Thomas McBride
Rather than silently dropping ALL icmp packets, return icmp/icmp6 error for 'informational' message types (but continue dropping ICMP errors unconditionally). ok markus sthen henning
2011-07-22fix typos, martin pelikanHenning Brauer
2011-07-18unbreak set-tos for ipv6; reported by babut at yandex dot ru,Mike Belopuhov
with input and ok from bluhm and claudio
2011-07-12break up a line of code that involved a decrement operator and macrosJonathan Gray
so it evaluates in the order we want. ok claudio@
2011-07-09If ipv4+icmp6 or ipv6+icmp packets were embedded into an icmpAlexander Bluhm
payload, we missed to drop them. While there, also add a reason to the corresponding check in pf_test(). ok mcbride@ claudio@
2011-07-09sned BPDUs at prio 6, just like lacp and carp, ryan zinke mpfHenning Brauer
2011-07-09mark the mgmt pkts for queueing prio 6, mpf okHenning Brauer
2011-07-09honor the net.inet.udp.checksum setting.David Hill
ok claudio henning yasuoka
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-16 22:12:52 +0000