summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2003-10-20tyopJason Wright
2003-10-19Add missing "#ifdef ALTQ"'s in the ioctl transacions code.Ryan Thomas McBride
Allows non-ALTQ kernel compile. Pointed out by tedu@ ok itojun@, "works here" tedu@
2003-10-19more typosDavid Krause
2003-10-17Common Address Redundancy ProtocolRyan Thomas McBride
Allows multiple hosts to share an IP address, providing high availability and load balancing. Based on code by mickey@, with additional help from markus@ and Marco_Pfatschbacher@genua.de ok deraadt@
2003-10-10make sure pd is initialized before use (or byte counters may increaseDaniel Hartmeier
by random values). ok mcbride@, cedric@, henning@
2003-10-08obviously i'm on drugs, revertHenning Brauer
2003-10-08missing DIOCX* in the securelevel > 1 caseHenning Brauer
2003-10-04bpf support for atm cards; from jason@ackley.netTheo de Raadt
none of us can test this, but that does not mean it has to sit in the pr database
2003-10-02do not try to send incomplete fragments on ENOBUFS caseJun-ichiro itojun Hagino
(behavior change from 4.4bsd). dhartmei ok
2003-10-02correct endian handling of ip->ip_off.Jun-ichiro itojun Hagino
do not try to send incomplete fragments on ENOBUFS case (behavior change from 4.4bsd). dhartmei ok
2003-10-01Fix stack leak into pfloghdr (the pad field is not initialized),Can Erkin Acar
which ends up in the pflog pcap file. From dhartmei@ ok dhartmei@, frantzen@, henning@
2003-10-01make ifindex2ifnet growing code more correct. (found by iij seil team)Jun-ichiro itojun Hagino
2003-09-28Correct off-by-ones with respect to PRC_NCMDS. Mostly from FreeBSD.Chad Loder
OK krw@, deraadt@
2003-09-26Rearchitecture of the userland/kernel IOCTL interface for transactions.Cedric Berger
This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
2003-09-26Move statistics counters from individual pf_test_<proto>() andRyan Thomas McBride
pf_test_state_<proto>() to pf_test() and pf_test6(). Reduce code redundancy, and fix the following bugs: - ICMP packets were not being accounted for correctly (missing statistics code in pf_test_state_icmp() - Some packets were not being counted in the loginterface statistics NOTE: Under some situations with route-to, packets may get counted once on the original interface, and once on the pf-routed interface. This can be dealt with by rules which specify the each interface explicitly. ok cedric@, henning@
2003-09-24Remove state setup no-ops.Ryan Thomas McBride
ok cedric@ frantzen@ henning@
2003-09-23Replace select backends with poll backends. selscan() and pollscan()Todd C. Miller
now call the poll backend. With this change we implement greater poll(2) functionality instead of emulating it via the select backend. Adapted from NetBSD and including some changes from FreeBSD. Tested by many, deraadt@ OK
2003-09-21sync with netbsd defines. no functional changes.Federico G. Schwindt
ok markus deraadt
2003-09-18comment spelling, from jonathon grayTed Unangst
2003-09-01KNFHenning Brauer
2003-09-01Make nat rule update the table counters when no filtering rule is used.Cedric Berger
This is mostly to support the new "nat pass" rule. ok dhartmei@ henning@
2003-08-29Fix three cases of potential accesses to free'd memory. At least one ofDaniel Hartmeier
them could be used to panic pf with scrub rules remotely. Found by Rob Pickering. ok frantzen@, henning
2003-08-28fix "pfctl -vvsr" output for rules with tables inside anchors.Cedric Berger
ok henning@
2003-08-27fix inconsistency how we handle tcpopt EOL versus how p0f v2 handles itMike Frantzen
2003-08-27it is supprisingly common (>4%) for some NAT and DSL routers to tweak MSSMike Frantzen
by setting it to whatever is suitable for the link type. so we try a guessed 1460 MTU and 1500 MSS if the primary check fails. algorithm tweak from Michal Zalewski name a few constants too while I'm in there
2003-08-27RNF_IGNORE can corrupt the radix tree when an interface is down, itHenric Jungheim
makes routing lookups slightly more expensive, and serves no useful purpose. ok itojun@ tedu@
2003-08-27cut-and-paste error; henricJun-ichiro itojun Hagino
2003-08-26mark cloned route with RTF_CLONED. remove RTF_CLONED route when clone parentJun-ichiro itojun Hagino
disappers. deraadt ok
2003-08-25if_init support, required by ieee80211.Federico G. Schwindt
deraadt@ ok.
2003-08-25add DLT_IEEE802_11; deraadt@ ok.Federico G. Schwindt
2003-08-24defines and struct for the ieee80211 framework; deraadt@ ok.Federico G. Schwindt
2003-08-22pf spelling policeDavid Krause
ok dhartmei@ jmc@
2003-08-22KNFHenning Brauer
2003-08-22don't expose pf_osfp_fingerprint() to ! _KERNEL. tcpdump et al useMike Frantzen
pf_osfp_fingerprint_hdr() which doesn't work on mbufs. pointed out by Max Laier
2003-08-21Add Michal Zalewski's p0f v2 style passive OS fingerprinting to PF.Mike Frantzen
Exposes the source IP's operating system to the filter language. Interesting policy decisions are now enforceable: . block proto tcp from any os SCO . block proto tcp from any os Windows to any port smtp . rdr ... from any os "Windows 98" to port WWW -> 127.0.0.1 port 8001
2003-08-18prevent looutput() feedback of broadcast/multicast packets if they areDaniel Hartmeier
pf routed. prevents a kernel lockup with some (non-sensical) route-to rules. report and debugging by mpech@. ok itojun@, henning@, mpech@.
2003-08-17Missing break, change NULL -> 0 for int parameter (no functionalDaniel Hartmeier
changes), from Andrey Matveev
2003-08-15change arguments to suser. suser now takes the process, and a flagsTed Unangst
argument. old cred only calls user suser_ucred. this will allow future work to more flexibly implement the idea of a root process. looks like something i saw in freebsd, but a little different. use of suser_ucred vs suser in file system code should be looked at again, for the moment semantics remain unchanged. review and input from art@ testing and further review miod@
2003-08-14m_copyback()'s 4th arg is const void *, nuke (caddr_t) casts.Jason Wright
2003-08-11Fix DIOCCHANGEADDR, use the supplied ticket instead of 0.Daniel Hartmeier
2003-08-09This patch remove the restriction that tables cannot be used in routing orCedric Berger
redirection rules... The advantage of using tables in redirection/routing rules is not efficiency, in fact it will run slower than straight address pools. However, this brings a lot of flexibility to PF, allowing simple scripts/daemons to add/remove addresses from redirection/routing pools easily. This implementation support all table features, including cidr blocks and negated addresses. So specifying { 10.0.0.0/29 !10.0.0.0 !10.0.0.7 } will correctly round-robin between the six addresses: .1, .2, .3, .4, .5, .6. Tables can also be combined with simple addresses, so the following rule will work as expected: "nat on foo0 -> { 1.1.1.1 <bar> }" ok henning@ mcbride@
2003-08-07make pf_match take u_int32_t instead of u_int16_tHenning Brauer
it's not only used to ,atch on ports any more but uid/gid as well, and uid_t/gid_t are u_int32_t. found by aaron@ ok cedric@
2003-07-31Make table tickets per-ruleset instead of global.Cedric Berger
Make table tickets u_int32_t for consistency with other parts of PF. Ok dhartmei@ henning@
2003-07-29avoid stack smash on FDDI case. found by kernel propolice.Jun-ichiro itojun Hagino
markus ok. miod/paul confirmed
2003-07-29Set pf_state->rt_ifp when creating the state entry, instead of doing itDaniel Hartmeier
later on, when another packet matches the state. ok mcbride@
2003-07-29More aggressive and easier to understand skip steps for addresses.Cedric Berger
Help daniel@ mcbride@ Ok henning@ mcbride@
2003-07-28typo. from cedricJun-ichiro itojun Hagino
2003-07-25do not flip ip_len/ip_off. pechkin and henning okJun-ichiro itojun Hagino
2003-07-25%lu for u_long argJason Wright
2003-07-24conform to RFC2367 on SADB_xx naming (local name must be prefixed withJun-ichiro itojun Hagino
SADB_X_xx)
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-11 15:14:24 +0000