summaryrefslogtreecommitdiffstats
path: root/sbin/pfctl/pfctl_optimize.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* sbin/pfctl: replace TAILQ concatenation loop with TAILQ_CONCATbket2020-01-281-15/+4
| | | | OK kn@, sashan@, florian@
* Do the actual pfr_strerror() to pf_strerror() renamekn2020-01-151-3/+3
| | | | Missed in previous
* Unify error message for nonexisting anchorskn2020-01-151-3/+3
| | | | | | | | | | | | | pf(4) returns EINVAL for DIOCGETRULE, DIOCGETRULES and DIOCGETRULESET if the specified anchor does not exist. Extend and rename {pfr -> pf}_strerror() to make error message more consistent. There are other occasions as well but those need additional tweaks; that's stuff for another diff. OK and rename from sashan
* Avoid optimizing empty rulesetskn2019-12-121-2/+5
| | | | | | | | | All optimizations work on actual rules; if there are none, return early. While here, tell which ruleset/anchor is being optimized to make the debug message actually useful. OK mikeb
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-3/+3
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* Remove pfctl_*_pool() remnantskn2019-03-071-6/+1
| | | | | | | | | Left behind in pfctl_parser.h revision 1.91 "First pass at removing the 'pf_pool' mechanism [...]" These functions don't exist anymore, no object change. OK procter
* Unbreak build under OPT_DEBUGkn2019-01-031-4/+2
| | | | | | | | | | | | In r1.39 I removed the `af' parameter from `unmask()' but accidently zapped the macro's closing paranthese. Since DEBUG() is needlessly under an OPT_DEBUG guard, this was not effecting normal builds. Add the missing ')' and remove the ifdef. OK sashan
* Remove unused af argument from unmask()kn2018-09-061-6/+6
| | | | | | | | | This has been unused for years. While here, zap the duplicate function signature from pfctl.h (already present in pfctl_parser.h); spotted by sashan, thanks. OK sashan
* - patching use-after-free and innocent memory leak in pfctl_optimzie.csashan2017-11-251-30/+38
| | | | OK bluhm@
* - pfctl rule optimizer: anchor name vs. anchor path mix upsashan2017-11-251-2/+2
| | | | OK bluhm@
* A couple of "a->blah == a->blah" -> "a->blah == b->blah".krw2016-08-031-3/+3
| | | | | | Spotted by the Echelon team with AppChecker static analyzer. ok sashan@
* Include <netinet/in.h> before <net/pfvar.h>. In a future change whenderaadt2015-01-211-4/+3
| | | | ports is ready, <net/pfvar.h> will stop including a pile of balony.
* Replace all queue *_END macro calls except CIRCLEQ_END with NULL.doug2014-09-131-2/+2
| | | | | | | | CIRCLEQ_* is deprecated and not called in the tree. The other queue types have *_END macros which were added for symmetry with CIRCLEQ_END. They are defined as NULL. There's no reason to keep the other *_END macro calls. ok millert@
* Whole bunch of (unsigned char) casts carefully added for ctype calls.deraadt2013-11-221-2/+2
| | | | Careful second audit by millert
* rtableid must be BREAK instead of MERGE, otherwise the optimizer mighthenning2012-10-191-2/+2
| | | | | | | | | | | | | | | | | | | | reorder rules incorrectly, i. e.: pass rtable 2 pass from 10/16 rtable 0 pass from 10.1/16 rtable 1 so with this ruleset a packet from 10/16 will end up in rtable 0. now let's see what pfctl makes out of it, with default optimization: <brahe@tachi> pfctl $ pfctl -nvf t.conf pass inet from 10.0.0.0/16 to any flags S/SA rtable 0 pass inet from 10.1.0.0/16 to any flags S/SA rtable 1 pass all flags S/SA rtable 2 OUPS! a packet from 10/16 will end up in rtable 2 now. found by phessler, fix by your's truly, from EuroBSDcon ok beck phessler benno mikeb sthen
* unbreak rule optimizer; ok henning, looksmikeb2011-12-191-1/+2
|
* print ports as numbers by default; -P prints names insteadhenning2011-11-231-2/+2
| | | | | 2/2 from Lawrence Teo <lteo at devio dot us> ok sthen dlg and myself
* Add support for weighted round-robin in load balancing pools and tables.mcbride2011-07-271-1/+2
| | | | | Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
* Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesmcbride2011-07-071-2/+2
| | | | | | | | | | a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
* bring in least-states load balancing algorithmzinke2011-07-031-2/+2
| | | | ok mcbride@ henning@
* Userland bits to allow PF to filter on the rdomain a packet belongs to.claudio2011-04-061-1/+14
| | | | | This allows to write rules like "pass in on rdomain 1". Tested by phessler@, OK henning@
* remove -A, -O, -R and -T loadhenning2010-03-231-6/+1
| | | | | | | the partial loading of a ruleset (leaving ancors aside) is wrong and conflicts with the general idea of how pf works. last not least it breaks with the optimizer generating tables automagically. ok deraadt sthen krw manpage jmc
* First pass at removing the 'pf_pool' mechanism for translation and routingmcbride2010-01-121-43/+8
| | | | | | | | | | | actions. Allow interfaces to be specified in special table entries for the routing actions. Lists of addresses can now only be done using tables, which pfctl will generate automatically from the existing syntax. Functionally, this deprecates the use of multiple tables or dynamic interfaces in a single nat or rdr rule. ok henning dlg claudio
* plug some memory leaks; found by parfait, ok henningderaadt2009-12-101-1/+2
|
* since "nat/rdr pass" are history natpass can gohenning2009-11-231-3/+2
|
* cleanup after the NAT changes. we used to have multiple rulesets (scrub,henning2009-11-221-13/+7
| | | | | | | | | NAT, filter). now we only have one. no need for an array any more. simplifies the code quite a bit. in the process fix the abuse of PF_RULESET_* by (surprise, isn't it) the table code. written at the filesystem hackathon in stockholm, committed from the hardware hackathon in portugal. ok gcc and jsing
* Add a dedicated pf pool for route options as suggested by henning,jsg2009-10-281-1/+13
| | | | | | | | which unbreaks ie route-to after the recent pf changes. With much help debugging and pointing out of missing bits from claudio@ ok claudio@ "looks good" henning@
* the diff theo calls me insanae for:henning2009-09-011-12/+24
| | | | | | | | | | | | | | | rewrite of the NAT code, basically. nat and rdr become actions on regular rules, seperate nat/rdr/binat rules do not exist any more. match in on $intf rdr-to 1.2.3.4 match out on $intf nat-to 5.6.7.8 the code is capable of doing nat and rdr in any direction, but we prevent this in pfctl for now, there are implications that need to be documented better. the address rewrite happens inline, subsequent rules will see the already changed addresses. nat / rdr can be applied multiple times as well. match in on $intf rdr-to 1.2.3.4 match in on $intf to 1.2.3.4 rdr-to 5.6.7.8 help and ok dlg sthen claudio, reyk tested too
* allow setting TOS with scrub; ok mcbride, claudiomarkus2008-05-071-1/+2
|
* Add a counter to record how many states have been created by a rule.mpf2008-05-061-2/+3
| | | | | | | It shows up in pfctl verbose mode and in the 7th field of the labels output. Also remove the label printing for scrub rules, as they do not support labels. OK dhartmei@ (on an earlier version), henning@, mcbride@
* Create the automatic tables at the base of the anchor stack rather thanmcbride2008-01-261-3/+4
| | | | | | | | | | in the inline anchor. Fixes optimizer bug where automatic table creation in inline anchors fails because rules are now loaded after optimization and no transaction has been opened for the anchor. bug reported by Henrik Johansen ok henning dhartmei
* Get rid of warning when compiling with OPT_DEBUG.mcbride2008-01-251-2/+2
|
* typos; ok jmc@martynas2007-11-271-3/+3
| | | | sys/dev/pci/pciide.c from naddy@
* Allow pfctl ruleset optimizer to be controlled from the ruleset.mcbride2006-10-311-3/+3
| | | | | | | | | | "set" "ruleset-optimization" [ "none" | "basic" | "profile" ] You can optionally control ruleset optimization with these keywords on the command line with the -o option; the command line setting will override the pf.conf setting. The existing -o/-oo flags continue to work as expected. cleanup and ok henning@
* Load all rules into memory before loading into the kernel, and add supportmcbride2006-10-281-32/+56
| | | | | | | | | | | | | | for anchors loaded inline in pf.conf, enclosed in a brace-delimited block ("{" "}"). anchor on fxp0 { pass in proto tcp port 22 } The anchor name is optional on inline loaded anchors. testing ckuethe@ ok henning@ dhartmei@
* teach the optimizer about logif, with & ok frantzenhenning2006-10-251-1/+2
|
* implement a Unicast Reverse Path Forwarding (uRPF) check for pf(4)djm2006-03-141-1/+3
| | | | | | | | | which optionally verifies that a packet is received on the interface that holds the route back to the packet's source address. This makes it an automatic ingress filter, but only when routing is fully symmetric. bugfix feedback claudio@; ok claudio@ and dhartmei@
* make the packet and byte counters on rules and src nodes per direction,henning2005-06-131-3/+5
| | | | | | | | matches the counters on states now. also fix the counting on scrub rules where we previously did not handle the byte counters at all. extend pfctl -sl output to include the new seperate in/out counters hacked on the ferry from Earls Cove to Saltery Bay ok ryan
* switch the max_src_{states,conn,conn_rate} from superblock breaks to superblockfrantzen2005-05-261-3/+4
| | | | | optimization barriers to prevent table merging or rule re-ordering ok dhartmei@
* make the remaining pf_rule fields named superblock BREAKs instead just lettingfrantzen2005-05-251-1/+13
| | | | them default to BREAKs. no functional change
* make the optimizer safe in the presence of interface groups. they must act asfrantzen2005-05-251-2/+42
| | | | | an optimization block break ok dhartmei@
* don't merge a rule's source address into a table if we're already trying tofrantzen2005-01-031-1/+3
| | | | | | | merge its destination address. caught by an assertion. it's tempting to do recursive reduction here to pick that low hanging fruit.... bug report from <gustavo AT hades DOT uint8t DOT org>
* &&/|| inversion would try to merge IP addresses with non-addresses into afrantzen2004-12-141-2/+2
| | | | | single table causing a ruleset load error and eventually a double-free. bug report and testing from martin{AT}spamcop net
* add two warn() calls to make sure a warning message gets printed if one offrantzen2004-12-141-3/+7
| | | | the table calls fails and the optimizer is gonna bomb out
* spacingderaadt2004-08-081-9/+8
|
* 'pfctl -o' ruleset optimizer that doesnt change the meaning of the final rulesetfrantzen2004-07-161-0/+1558
- remove identical and subsetted rules - when advantageous merge rules w/ similar addresses into a table and one rule - re-order rules to improve skip step performance (can do better w/ kernel mods) - 'pfctl -oo' will load the currently running ruleset and use it as a profile to direct the optimization of quicked rules ok henning@ mcbride@. man page help from jmc@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.