summaryrefslogtreecommitdiffstats
path: root/sys/net/if_pfsync.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Kill yet another argument to functions in IPv6. This time ip6_output'sclaudio2015-09-111-2/+2
| | | | | | | ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
* Store a unique ID, an interface index, rather than a pointer to thempi2015-06-161-2/+2
| | | | | | | | | | | | | | | receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* include the "set prio" values.henning2015-02-101-1/+3
| | | | | | | | no real compat issue since we're using spare bytes. old -> new ends up with set prio (0, 0) equivalent new -> old is entirely harmless, old ignores the prios. requested by Alexey Suslikov <alexey.suslikov at gmail> ok phessler pelikan dlg
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-2/+9
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-7/+1
| | | | | long live the one true internet. ok henning mikeb
* Remove the "multicast_" prefix from the fields a multicast-only struct.mpi2014-12-171-3/+3
| | | | Prodded by claudio@ and mikeb@
* Use an interface index instead of a pointer for multicast options.mpi2014-12-171-4/+4
| | | | | | | | | | | | Output interface (port) selection for multicast traffic is not done via route lookups. Instead the output ifp is registred when setsockopt(2) is called with the IP{V6,}_MULTICAST_IF option. But since there is no mechanism to invalidate such pointer stored in a pcb when an interface is destroyed/removed, it might lead your kernel to fault. Prevent a fault upon resume reported by frantisek holop, thanks! ok mikeb@, claudio@
* length argument for some free() calls; ok dougderaadt2014-11-231-2/+2
|
* Remove unneeded netinet6/ip6_divert.h include.lteo2014-11-061-2/+1
| | | | ok bluhm@ dlg@ florian@ mpi@
* reset all the pfsync packet state before calling ip_output indlg2014-10-171-4/+4
| | | | | | | | | | | | | | | | | | | pfsync_sendout. more specifically, move the reset of sc->sc_len to PFSYNC_MINPKT above ip_output. this prevents a situation where ipsec via ip_output calls pfsync_update_tdb for syncing the ipsec flow to a peer, which accounts for the tdb in the next pfsync packet, before unwinding back to pfsync_output which resets the accounting we just did. the next pfsync packet to be sent out will be allocated with a short length because sc_len is wrong, and the long lists of things (eg, the tdb) can overwrite memory after the mbuf. this manifests as incorrect poisoning or xsimpleq entry corruption in mbufs still in a pool, or random corruption of m->m_next on other mbufs in the system. bug found, fix tested, and ok stsp@
* remove uneeded route.h includesjsg2014-09-081-3/+2
| | | | ok miod@ mpi@
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-3/+3
| | | | after discussions with beck deraadt kettenis.
* ip_output() using varargs always struck me as bizarre, esp since it's onlyhenning2014-04-211-4/+4
| | | | | | ever used to pass on uint32 (for ipsec). stop that madness and just pass the uint32, 0 in all cases but the two that pass the ipsec flowinfo. ok deraadt reyk guenther
* "struct pkthdr" holds a routing table ID, not a routing domain one.mpi2014-04-141-2/+2
| | | | | | | | | | | | | | Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
* Fix potential null dereference.chl2013-11-181-2/+2
| | | | | | Found by LLVM/Clang Static Analyzer. ok benno@ henning@
* inherit the rdomain sc to pkthdrhenning2013-11-151-1/+3
| | | | from erik at halon dot se, ok benno phessler benno
* The header file netinet/in_var.h included netinet6/in6_var.h. Thisbluhm2013-10-171-1/+2
| | | | | | | created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
* states learnt via pfsync from a peer with the same ruleset checksum weredlg2013-08-071-2/+2
| | | | | | | not getting assigned to rules like they should cos pfsync_in_upd() wasnt passing the PFSYNC_SI_CKSUM flag along to pfsync_state_import. found and fixed by pedro
* Revert previous and unbreak asr, the new include should be protected.mpi2013-06-201-5/+5
| | | | Reported by naddy@
* Allocate the various hook head descriptors as part of the ifnetmpi2013-06-201-5/+5
| | | | | | | structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
* Since pf_state_key_attach can decide to free the provided statemikeb2013-05-101-2/+2
| | | | | | | | | | | key we need to sync our state key pointers with whatever values the function will pick. Not doing so will produce wrong results if address translation must be applied afterwards and we happen to have a state key collision. Then pf_translate will follow an old pointer and punch in garbage addresses into the packet. Noticed, initial patch and tests by Vitaly Sinilin <vs @ kp4 ! ru> ok tedu, henning
* no need for a lot of code to include proc.htedu2013-03-281-2/+1
|
* Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.mpi2013-03-261-2/+2
| | | | ok beck@, mikeb@
* Use time_uptime for expiration values as time_second can be skewed atflorian2012-10-301-5/+5
| | | | | | | | | | | | | | | | runtime while time_uptime is monotonic. Prevent underflows in pfsync(4) and pflow(4) by using signed variables. pfsync(4) problem pointed out by camield. Diff originally by dlg, frag and pflow bits by me. feedback dlg man page tweak jmc Various versions of the pflow bits tested by Hrvoje Popovski (hrvoje AT srce DOT hr), thanks! ok benno, henning, dlg
* simplify hook_disestablish() handling by always resetting the hook whenmarkus2012-10-091-19/+8
| | | | | | the syncdev gets set. this also makes sure we no longer leak hooks on repeatet 'ifconfig syncdev' invocations. ok mikeb@
* make sure we don't call hook_disestablish() twice e.g. ifconfig -syncdevmarkus2012-10-081-5/+13
| | | | followed by ifconfig destroy; ok mikeb
* pfsync_cancel_full_update needs to restore carp demotions sincemikeb2012-09-201-10/+14
| | | | | | | | it's cancelling the bulk update and can leave the machine in a demoted state. bug was noticed by benno, who was kind enough to verify that the fix is working fine. ok mpf, benno
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-2/+2
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* update the tdb replay counter endian conversion to 64 bits;mikeb2012-09-191-3/+3
| | | | ok camield mpf
* rename all_state_flags to state_flags to finish the transitionmikeb2012-07-261-3/+2
| | | | to the 16 bit flags; reminded by claudio, ok henning
* Fix a number of problems introduced by the link state handling commit:mikeb2012-06-301-18/+64
| | | | | | | | | | | | | 1) demote by 32 on the first bulk update to prevent failovers w/o having a full state table; 2) don't do any demotion adjustments on the link up event and undemote when bulk update finishes (or times out) preventing a race between nodes getting a link state update asynchronously. With phessler; tested by phessler and Kapetanakis Giannis. Thanks! Looked through by henning and dlg. Now the correct version.
* backout rev1.185 as it's not what i have intended to commitmikeb2012-06-301-18/+7
|
* add ESN-related bits missed in the previous commitmikeb2012-06-291-4/+6
|
* Fix a number of problems introduced by the link state handling commit:mikeb2012-06-281-7/+18
| | | | | | | | | | | | | 1) demote by 32 on the first bulk update to prevent failovers w/o having a full state table; 2) don't do any demotion adjustments on the link up event and undemote when bulk update finishes (or times out) preventing a race between nodes getting a link state update asynchronously. With phessler; tested by phessler and Kapetanakis Giannis. Thanks! Looked through by henning and dlg.
* fix all the suser calls which pass an incorrect p_acflag argument;mikeb2012-04-111-2/+2
| | | | figured out by and ok guenther
* remove superfluous return, ok mikebcamield2012-04-071-2/+2
|
* Fix kernel compilation with pf but without pfsync pseudo-device bymikeb2012-04-031-63/+2
| | | | | moving the state export functionality from pfsync code into pf. Based on the initial diff diff by guenther, ok henning.
* The kernel did not compile without INET6. Put some #ifdefs intobluhm2012-02-031-2/+2
| | | | | | | | | | | | | pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
* do carp demotion adjustments on syncdev link state change.mikeb2012-01-161-1/+55
| | | | | | | | | this prevents backup to failover back to master immediately after getting link back on carpdev interface if underlying pfsync interface went down as well. instead pfsync will request a bulk update to get new states from the master. sthen and mpf like the idea, ok dlg
* Make sure we only enter pf_route() when undefering in the PF_ROUTETO case.mcbride2011-12-011-2/+2
| | | | ok dlg claudio
* use a u_int64_t for the state id in pfsync_state. this makes it consistentdlg2011-11-291-9/+9
| | | | | | | | | | | | with every other thing that stores the state id (including other pfsync messages). includes improvements to the systat code to consider the creatorid as well as the state id in its cache to avoid collisions between states created on different hosts. tested by me in production and on amd64 talking to sparc64. ok henning@
* Protect more operations in the pfsync_clone_destroy to preventmikeb2011-11-271-3/+3
| | | | accidental race conditions. From Erik Lax, thanks! ok dlg
* Apply route-to to deferred packet; without this the first packet of amcbride2011-11-261-8/+29
| | | | | | connection does not observe the route-to option. ok dlg mikeb
* use time_uptime to set state creation values as time_second can bedlg2011-11-251-3/+3
| | | | | | | skewed at runtime by things like date(1) and ntpd. time_uptime is monotonic and therefore more useful to compare against. ok deraadt@ mikeb@
* Improve flag setting ioctl so that bulk updates are requestedmikeb2011-11-161-3/+6
| | | | | | | | only when we're going up, not when we set PROMISC or any other flag. Fixes spontaneous CARP failovers when running tcpdump on pfsync. ok henning, mcbride, camield
* State expire time is a baseline time ("last active") for expirycamield2011-11-091-12/+11
| | | | | | | | | | | | | | | | | | calculations, and does _not_ denote the time when to expire. So it should never be added to (set into the future). Try to reconstruct it with an educated guess on state import and just set it to the current time on state updates. This fixes a problem on pfsync listeners where the expiry time could be double the expected value and cause a lot more states to linger. Timeout code from mikeb. Found and testing by Maxim Bourmistrov. ok mikeb dlg
* Select a correct protocol for a stack side state key when importingmikeb2011-11-041-2/+14
| | | | an icmp<->icmp6 state (nat64); ok henning, mcbride, dlg
* Don't forget to cancel bulk update failure timeout when destroying anmikeb2011-10-311-1/+2
| | | | interface. Problem report and fix from Erik Lax, thanks!
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.