summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2002-12-27Fixups for pf_route and pf_route6.Ryan Thomas McBride
- pull the route-to ifp from the current pf_pooladdr (not the last one) with stateful rules - remove unnecessary PF_ACPY and PF_AZERO ok dhartme@ on pf_route version, pf_route6 is the same.
2002-12-27Handle binat-anchor rules in pf_match_translation(), they don't have aDaniel Hartmeier
redirection target address. Reported by Michael Lucas. ok mcbride@
2002-12-27Initialize rt_ifp in newly allocated pf_state objects to NULL.Daniel Hartmeier
Solves the crashes in pf_route() with -current. Reports from Michael Lucas and Bjorn Runaker.
2002-12-26Prettier debug printing in pf_map_addr.Ryan Thomas McBride
2002-12-26Additional sanity checks for pf_route(). Please report when any of theseDaniel Hartmeier
panics should occur. ok mcbride@
2002-12-23no need to htons the port, it's already in net order, since we swapped it ↵Michael Shalayeff
back in tcpdump, worked fine (; from bdd@ieee.org
2002-12-23Change from array to single pf_pabuf (no longer need multiple buffers asRyan Thomas McBride
we don't need the second list of addresses for DIOCCHANGE* operations) Also get rid of a bug where DIOCBEGINADDRS clears pabuf[1] when pabuf[0] is the one being used. ok henning@ dhartmei@
2002-12-22pfioc_changealtq is not needed anymore; queues will eventually beRyan Thomas McBride
referenced by number in DIOCCHANGEALTQ (like rule and pooladdress) "go for it" henning@
2002-12-22Handle rdr rules with unspecified proxy ports correctly. Also don'tRyan Thomas McBride
print the port number in pf_print_host if it's 0 (like when pf_print_host is called from pf_map_addr) ok dhartmei@
2002-12-22mv PF_RULESET_MAX into the enum, slightly less confusing.Ryan Thomas McBride
ok dhartmei@
2002-12-20replace struct assignment w/ bcopy w/ help and testing of millert@; henning@ ↵Michael Shalayeff
ok; fixes unaligned trap on alpha from pr3037
2002-12-19Clear pf_state.nat_rule pointers when non-main nat rules are removed.Daniel Hartmeier
Unlike with filter rules, nat rules inside anchors might be pointed to.
2002-12-19Replace skip step calculation so it scales O(n) instead of O(n*n).Daniel Hartmeier
Loading large rulesets consists of two phases. First, the rules are parsed and added, one by one, to the inactive ruleset. The machine remains responsive during that phase. Then, the new ruleset is activated, and the skip steps are calculated. The machine locks up during that phase. This second phase is greatly reduced with the new algorithm. With the old one, calculation could take 30s for 12k rules, with the new one, 100k rules take less than 1s. For small rulesets (less than 1000 rules), the gain is insignificant. ok mcbride@, henning@
2002-12-19fix 'no nat/rdr/binat' evaluation. from mcbride@, slightly modified :)Daniel Hartmeier
2002-12-19Initialize pf_state.nat_rule to NULL if there's no translation used.Daniel Hartmeier
Found by markus@
2002-12-18Store translation rule pointer in state entries, so pfctl -vsn can printDaniel Hartmeier
evaluation, packet, byte and state entry counters similar to -vsr. Helps verify whether/how often translation rules are evaluated/matched. ok frantzen@, henning@
2002-12-18KNFHenning Brauer
2002-12-18little styleHenning Brauer
2002-12-18When logging packets matched by rules within anchors, use the anchor ruleDaniel Hartmeier
(in the main set) number, not the number of the rule within the anchor. Eventually, both will get logged. But as long as we only log one number, this makes more sense.
2002-12-18KNFHenning Brauer
2002-12-18big KNF roundHenning Brauer
2002-12-18Pass skip step values through ioctl interface, pfctl -vvsr shows them,Daniel Hartmeier
main purpose is making them regress-testable.
2002-12-18KNFHenning Brauer
2002-12-18Match the rule protocol against the actual protocol of the packet, not justRyan Thomas McBride
tcp. A silly copy/paste error by yours truly located by deraadt@
2002-12-17Merge pf_nat/pf_binat/pf_rdr structs into pf_rule. Simplifies code, allowsRyan Thomas McBride
skip steps on translation rules. Also: - Require a ticket for DIOCCHANGERULE operations to prevent races. - Remove pf_compare_* functions from pf_ioctl.c. DIOCCHANGE* operations use a rule number, and comparisons happen in userland. Testing and fixes from dhartmei@ and frantzen@ ok dhartmei@ henning@
2002-12-16add options for 2 more queueing disciplines, PRIQ and HFSC.Kenjiro Cho
ok henning@ dhartmei@
2002-12-13add pqueue and pqid to pf_rule.Henning Brauer
this allows for a second queue on pf_rule. assign packets with tos 0x10 (lowdelay) to this one. if the second queue isn't specified set pqid = qid idea dhartmei@ ok dhartmei@ frantzen@ deraadt@
2002-12-12Pastos in pf_compare_pool(); dhartmei@, mcbride@ ok.Aaron Campbell
2002-12-12minor KNFHenning Brauer
2002-12-11Use m_copym2 to copy the whole mbuf (cluster included) and notFederico G. Schwindt
incrementing its reference. Fixes a m_zero panic reported by markus@ when pfdatatopacket returns a cluster. Tested by markus@, jason@ ok.
2002-12-11unpeeMichael Shalayeff
2002-12-10renumber the get/set debug ioctls for they conflict w/ ppp, we do not keep ↵Michael Shalayeff
the O versions since these are debugging only and should not affect normal functionality; deraadt@ ok
2002-12-10check IFF_RUNNING early in bstp_transmit_tcn; from netbsd; ok jason@Markus Friedl
2002-12-09NPF, not NFP (prevented outgoing bridge_ipsec() packets from being ↵Jason Wright
filtered); Darren Reed <avalon@coombs.anu.edu.au>
2002-12-09knfTheo de Raadt
2002-12-09allow setting of ifcost with brconfig. enables selection of preferredMarkus Friedl
port/path to root bridge among several LANs. unlike ifpriority, which allows you to select designated port if serveral interfaces belong to the same LAN; ok jason@
2002-12-06Replace license with something that's actually free.Nathan Binkert
Approved by original author. Julian.Onions@nexor.co.uk
2002-12-06Introduce anchors and named rule sets, allowing to load additional ruleDaniel Hartmeier
sets with pfctl and evaluate them from the main rule set using a new type of rule (which will support conditional evaluation soon). Makes maintenance of sub-rulesets simpler for pfctl and daemons. Idea and ok deraadt@
2002-12-04spanning tree: flush dynamic mac cache if interface goes to theMarkus Friedl
blocking or disabled state. send packets only if interface is the forwarding state; comment from netbsd; with and ok jason@
2002-12-03no need to mh_align (while it's wrong), cleaner mtu setting; dhartmei@ okMichael Shalayeff
2002-12-01KNFHenning Brauer
2002-12-01- Clean up pf_ioctl mainly by adding new functions to handle cleaning andRyan Thomas McBride
freeing rules. Fixes a number of potential memory leaks and other bugs. - Add new pool_ticket to insure that address pools don't get messed with by someone else while we add rules. - Add a second address pool buffer, so that DIOCCHANGE* operations which use pf_compare* will work correctly. Excellent bug report and anaylsis from DJ Gregor. ok dhartmei@ henning@
2002-12-01pfsync currently causes kernel faults, so we don't want to call these functionsRyan Thomas McBride
ok dhartmei@
2002-11-29minor KNFHenning Brauer
2002-11-29expose state table changesMichael Shalayeff
2002-11-29Get the address pool in DIOCCHANGEADDR for all operations, preventsRyan Thomas McBride
PF_CHANGE_REMOVE from dereferencing a NULL pointer. Noticed by dhartmei@ ok dhartmei@
2002-11-28- MD5 too slow, replace with pf_hash (based on hash from if_bridge.c)Ryan Thomas McBride
- Always fold the key in Many fixes & suggestions from camield@ ok mickey@ camield@ henning@
2002-11-26Call the enable function, don't set the variable directly.Jason Wright
2002-11-26pass struct pfioc_changeaddr to DIOCCHANGEADDRRyan Thomas McBride
rather than struct pfioc_pooladdr an obvious fix from dhartmei@
2002-11-261000baseTX -> 1000baseTNathan Binkert
- More technically correct - Matches FreeBSD and NetBSD - Preserved #define for 1000baseTX for backwards compatibility ok jason@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-10 23:50:47 +0000