summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2003-05-18speed hack: delay fetching the mbuf tag until we really need it (hit aHenning Brauer
"tagged X" rule), and only get it when we really need it. simplifies code too. ok dhartmei@ pb@
2003-05-18Merge pf_send_ack() and _send_syn() into a generic _send_tcp().Daniel Hartmeier
In the SYN proxy, generate ACKs with proper window sizes after the handshakes.
2003-05-17Correct two comment typos.Daniel Hartmeier
2003-05-17With rdr we want the source IP from the packet, not the source IP fromRyan Thomas McBride
the rule. Fixes rdr with address pools using bitmask and source-hash address selection methods. ok dhartmei@ henning@
2003-05-17allow inverse matching on tagsHenning Brauer
ok dhartmei@ pb@
2003-05-17Add an 'action' code that allows the SYN proxy to swallow/drop a packetDaniel Hartmeier
without causing EHOSTUNREACH to be delivered to local sockets, so it works for outgoing connections originating on the same host. ok frantzen@
2003-05-16TCP SYN proxy. Instead of 'keep state' or 'modulate state', one can useDaniel Hartmeier
'synproxy state' for TCP connections. pf will complete the TCP handshake with the active endpoint before passing any packets to the passive end- point, preventing spoofed SYN floods from reaching the passive endpoint. No additional memory requirements, no cookies needed, random initial sequence numbers, uses the existing sequence number modulators to translate packets after the handshakes. ok frantzen@
2003-05-14- modulate TCP Timestamps so they can't be used to detect NAT and to precludeMike Frantzen
remote uptime determination - scrub modifier "reassemble tcp" turns on stateful TCP normalizations ok henning@ dhartmei@
2003-05-14tag on each matching rule, not just the last one.Henning Brauer
idea from theo. to speed that up the real mbuf tag is not written until we hit the last match but an internal variable is used to track the tag. this can be used to split classification and policy enforcement, for example. and much much much more... ok dhartmei@ frantzen@
2003-05-14unifdef __FreeBSD__ and stuff. markus okJun-ichiro itojun Hagino
2003-05-14Use official (from pcap people) link type for pflog.Can Erkin Acar
With this change, the log header format also changes. The new log format is extendible and allows logging of the originating anchor and ruleset information. ok henning@ dhartmei@ frantzen@
2003-05-142 lines of code bring us tags on nat rulesHenning Brauer
ok dhartmei@ frantzen@
2003-05-14move ETHERTYPE_xx declarations to <net/ethertypes.h>. meets netbsd practice.Jun-ichiro itojun Hagino
deraadt ok
2003-05-14fix use after free race when purging the new PF tagsMike Frantzen
ok henning@
2003-05-13add support for tagging packets with arbitary tags and filtering based onHenning Brauer
those tags later on. ok dhartmei@ pb@ mcbride@ frantzen@
2003-05-13back out. these changes were not tested. it might come as a surpriseTheo de Raadt
to some developers, but include files are not just used by the kernel. there are applications that pull them in as well. this change broke tcpdump, and who knows what else. i've been talking for 24 hours now about tree breakage and let this be official: I am prepared to lock the tree entirely if need be. YOU WILL GET OK PERMISSION FROM EVERYONE, NOT JUST FROM ONE PERSON
2003-05-13move ethernet protocol type defs into sys/net/, as it is not just for ethernetJun-ichiro itojun Hagino
(FDDI, ieee1394, ...). follows netbsd practice. 2 jasons, dhartmei, thierry ok
2003-05-13Kill a bunch more commons (very few left =)Jason Wright
2003-05-13nuke common: ifnet_addrsJason Wright
2003-05-12- TCP window scaling is not applied to the SYNs' window so we must retract theMike Frantzen
initial maximum window by the scaling factor. otherwise our view of the allowable sequence window is too big. back out the scaling factor adjustment from the max window if the other endpoint rejects window scaling - window scale the forward ACK skew check ok dhartmei@
2003-05-12Add comment about special (non-index) PFTM_* values.Daniel Hartmeier
2003-05-12Reorder IPv6 address comparisons to check the least significant partsRyan Thomas McBride
first. The least significant portions of the IPv6 address are more likely to differ than the more significant ones, since in most situations half the addresses (either the source or the destination) will be in the local subnet. ok dhartmei@ henning@
2003-05-12Correctness nit. Initialise state search trees properly.Ryan Thomas McBride
ok henning@ frantzen@
2003-05-12Adaptive timeout value scaling. Allows to reduce timeout values as theDaniel Hartmeier
number of state table entries grows, so entries time out faster before the table fills up. Works both globally and per-rule. ok frantzen@
2003-05-12Nuke a whole bunch of commons; ok tedu (still more to come *sigh*)Jason Wright
2003-05-12missing includeHenning Brauer
2003-05-11the start of stateful TCP scrubbing. dynamically determine the highest TTL ofMike Frantzen
each side of the TCP connection and prevent it from being reduced ok pb@ dhartmei@
2003-05-11Use sizeof(struct icmp6_hdr) instead of ICMP_MINLEN for IPv6, both areDaniel Hartmeier
8 bytes, but the former is more appropriate. ok frantzen@
2003-05-10Pass ICMP error messages referring to non-TCP/UDP/ICMP packets statefully,Daniel Hartmeier
instead of just dropping them. ok frantzen@, henning@, pb@
2003-05-10Support return-icmp for 'other' protocols (non-TCP/UDP/ICMP), for instanceDaniel Hartmeier
stock OpenBSD stack returns 'protocol unreachable'. ok frantzen@, henning@, pb@
2003-05-10Prepare pf_change_icmp() for parameter ip == NULL use.Daniel Hartmeier
ok frantzen@, henning@, pb@
2003-05-06Fix a bug that prevents rdr/binat (but not nat) from working for protocolsDaniel Hartmeier
other than TCP, UDP and ICMP (for instance GRE). Reported by Gunnar Helliesen. ok henning@
2003-05-06string cleaning; tedu okTheo de Raadt
2003-05-03string fixes; tedu okTheo de Raadt
2003-05-03just as a safety measure, set m_flags to 0 for mbufs allocated on stack.Jun-ichiro itojun Hagino
dhartmei ok
2003-05-01use "tokenbroadcastaddr" throughout the code for consistency. deraadt okJun-ichiro itojun Hagino
2003-04-30Allow tables to be loaded into anchors.Cedric Berger
Most pfctl table commands (excluding 'show' and 'flush') support the "-a" modifier. ok dhartmei@
2003-04-27Update the pfioc_table IOCTL structure.Cedric Berger
Prepare for anchors, improve robustness. WARNING: need to sync kernel/userland. ok dhartmei@
2003-04-25Fix nat proxy port allocation. In case a range was manually specified,Daniel Hartmeier
ports outside that range could be used with a probability inversely proportional to the size of the specified range (occured often with very small, rarely with larger ranges). Reported by Gopakumar Pillai, ok henning@
2003-04-23Move m_copyback() to uipc_mbuf where it makes some kinda sense; ok dhartmeiJason Wright
2003-04-18Add code to set the TUN_* flags for INET6 addresses too. This allows aJason Wright
tun with ipv6 only to actually send/recv packets. itojun "looks ok to me" (after helping correct several iterations =)
2003-04-11set/update the queue IDs on filter rules (qid and pqid) onHenning Brauer
-DIOCCHANGERULE (just the affected rule) -DIOCCOMMITRULES (all filter rules that get committed - one anchor or main rs) -DIOCCOMMITALTQS (all filter rules, main set plus all anchors) This fixes a whole bunch of issues. previously, this was done in userland at load time. This worked fine for the usual case, full ruleset load. It did not work inside anchors, as the queue name <-> queue ID mapping is unknown there. Also, if the queue definitions were changed without reloading the rules too (pfctl -A), the queue IDs on the rules were not updated. The three ioctls mentioned above are all entry points where the mapping is touched. helpful discussion with dhartmei@ and cedric@ helped verifying my approach for this fix was right. ok dhartmei@ cedric@
2003-04-09KNFHenning Brauer
2003-04-09Change pf_state structure to point to both a rule and the anchor,Cedric Berger
so states created by rules in anchors correctly use rule options like routing and (soon) queues... Rule number bumped to 32 bit value. USERLAND NEED TO BE RECOMPILED. ok dhartmei@ henning@
2003-04-07Catch and refuse rules with invalid ICMP types (> 40), ok cedric@Daniel Hartmeier
2003-04-05Stick pf_default_rule everytime a packet pass because of theCedric Berger
implicit "pass all" first rule match and remove all "r == NULL" tests which are now useless. ok dhartmei@
2003-04-05Replace the timeout variables by the content of the timeoutCedric Berger
field of a new pf_default_rule structure. ok dhartmei@
2003-04-05Cleanup by replacing a bunch of "(*rm)" by just "r"Cedric Berger
ok dhartmei@
2003-04-04KNFTheo de Raadt
2003-04-03Back out my last change, which was incorrect or incomplete.Cedric Berger
States can still be created without a rule for people who have only NAT rules, for example.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-14 22:58:10 +0000