summaryrefslogtreecommitdiffstats
path: root/sys/net/pf.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Cleanup leftover PF_ICMP_MULTI_* code that is not needed anymore.mikeb2015-05-221-23/+17
| | | | ok henning
* fix a potential use-after-free in pf_state_rm_src_nodehenning2015-05-111-2/+4
| | | | found by jsg; ok jsg mikeb
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-17/+1
| | | | No objection from reyk@, OK markus, hshoexer
* the hfsc pools are only used in hfsc.c, so move the init of themdlg2015-04-111-2/+1
| | | | | | there instead of pf_ioctl.c. ok henning@
* Destination table needs it's own negation flag passed to the pfr_update_stats.mikeb2015-04-081-2/+2
| | | | | Spotted by Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>, thanks a lot! Ok florian
* remove the congestion handling from struct ifqueue.dlg2015-03-181-18/+2
| | | | | | | | | | | | | | | | | its only used for the ip and ip6 network stack input queues, so it seems unfair that every instance of ifqueue has to carry a pointer around for this specific use case. this moves the congestion marker to a kernel global. if we detect that we're congested, we assume the whole system is busy and punish all input queues. marking a system as congested is done by setting the global to the current value of ticks. as the system moves away from that value, it moves away from being congested until the comparison fails. written at s2k15 ok henning@ beck@ bluhm@ claudio@
* When state creations happen in short term by outgoing packets of oneyasuoka2015-03-161-1/+4
| | | | | | | | | SO_BINDANY socket, the new state didn't have a link of the socket's pcb. So the incoming packets allowed by the state were mistakenly forwarded and the pcb could not get them. Fix pf not to lost the link of the pcb when the state is recreated. ok bluhm mikeb
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* Rather than using 0xff as a placeholder for "don't check prio", use 0xff tosthen2015-02-141-3/+3
| | | | | | | | | mean "prio is 0". This avoids the need for code changes in programs which add pf rules (as was done in pfctl but not other programs) to handle the new "check prio" functionality. Specifically this unbreaks ftp-proxy. Use of #define rather than magic 0xff suggested by benno. ok benno "if henning doesnt like it he can change it when he recovers from jet-lag"
* change log(matches) semantics slightly to make it more useful. since ithenning2015-02-121-11/+31
| | | | | | | | | | | | | is a debug tool change of semantics not considered problematic. up until now, log(matches) forced logging on subsequent matching rules, the actual logging used the log settings from that matched rule. now, log(matches) causes subsequent matches to be logged with the log settings from the log(matches) rule. in particular (this was the driving point), log(matches, to pflog23) allows you to have the trace log going to a seperate pflog interface, not clobbering your regular pflogs, actually not affecting them at all. long conversation with bluhm about it, which didn't lead to a single bit changed in the diff but was very very helpful. ok bluhm as well.
* include the "set prio" values.henning2015-02-101-1/+3
| | | | | | | | no real compat issue since we're using spare bytes. old -> new ends up with set prio (0, 0) equivalent new -> old is entirely harmless, old ignores the prios. requested by Alexey Suslikov <alexey.suslikov at gmail> ok phessler pelikan dlg
* since we inherit prio (as in, the queuing priority) from outside sources,henning2015-02-101-1/+4
| | | | | | | | i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
* correctly reset max_win if the SYN-ACK lacks a wscale option. pfmarkus2015-02-091-3/+4
| | | | | | was setting max_win to 0 and discarded retransmitted SYN-ACK segments without wscale if the original SYN contained a wscale option. with gerhard@, ok henning@
* pf synproxy will do the 3WHS on behalf of the target machine, and oncehenning2015-02-071-2/+2
| | | | | | | | the 3WHS is completed, establish the backend connection. The trigger for "3WHS completed" is the reception of the first ACK. However, we should not proceed if that ACK also has RST or FIN set. ACK+RST part pointed out by Kojedzinszky Richard <krichy at tvnetwork hu> ok mikeb dlg phessler claudio
* Make sure pf(4) does not see embedded scopes.mpi2015-02-051-6/+1
| | | | | | | | | | | | | Packets destinated to link-local addresses are looped back with embedded scopes because we cannot restore them using the receiving interface (lo0). Embedded scopes are needed by the routing table to match RTF_LOCAL routes, but pf(4) never saw them and existing rules are likely to break without teaching the rule engine about them, found by dlg@ the hard way. So save and restore embedded scopes around pf_test() for packets going through loopback. ok dlg@, mikeb@
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-1/+2
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-81/+1
| | | | | long live the one true internet. ok henning mikeb
* Do not use "struct route" when it is not necessary.mpi2014-12-111-65/+44
| | | | | | | This structure is now only used to pass a cached route entry to ip{6,}_output() which will be converted shortly. With inputs from millert@, ok bluhm@
* Rework the handling of interfaces and IPv6 addresses for local delivery.mpi2014-11-201-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | - Unicast packets sent to any local address will have their interface set to loobpack. - In order to differentiate traffic from interfaces having identical link-local addresses, provide the scoped addresses to pf(4). - Update the icmp6 state lookup logic to match scoped MLL addresses. - Remove a shortcut in ip6_input() that bypasses pf and always look for an RTF_LOCAL route. Packets sent to multicast addresses still retain their original interface due to the fact that local multicast packet delivering does not use if_output. This makes ping6 to link-local addresses work even with pf enabled and "set skip" on loopbacks, reported by Pieter Verberne. Debugged, analysed and tested with mikeb@. ok mikeb@, henning@, sthen@
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-2/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* remove now unnecessary casts from hash update calls.tedu2014-11-161-8/+8
|
* convert to use sha512 for pf iss. ok deraadt dlgtedu2014-11-161-16/+19
|
* mix the rdomain (rtable?) into the hash for tcp iss generation.dlg2014-11-161-1/+2
| | | | ok phessler@ tedu@
* Ask networking stack to recalculate the ICMPv6 checksum in pf_route6mikeb2014-11-111-1/+3
| | | | | | | since we might have tweaked the addresses. Problem reported and fix test by Bastien Durel <bastien at geekwu ! org>, thanks! OK henning
* Rename rtalloc1() into rtalloc(9) and convert its flags to only enablempi2014-11-011-10/+10
| | | | | | functionnality instead of a mix of enable/disable. ok bluhm@, jca@
* Use rtfree() instead of RTFREE(), NULLify some free'd route pointers andmpi2014-10-141-5/+5
| | | | | | kill the macro. ok mikeb@, henning@
* Use rtalloc1() instead of rtalloc_noclone().mpi2014-10-081-5/+9
| | | | ok henning@, phessler@
* Kill rtalloc() and update rtalloc1() and rtalloc_mpath() to no longermpi2014-09-271-2/+2
| | | | | | rely on "struct route" that should die. ok claudio@
* Finally implement what's stated in the man page regarding parentmikeb2014-08-121-6/+12
| | | | | | | | | anchors for "once" rules: "In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched." Employ an additional pointer pair to keep track of the parent ruleset containing the anchor that we want to remove. OK henning
* Make sure that pf_step_into_anchor always saves a pointer to the rulemikeb2014-08-121-2/+4
| | | | | | | | | | | | that owns the anchor on the pf anchor stack. There's no reason why we should check for depth here. As a side effect this makes sure that the correct nested anchor gets it's counter bumped instead of the top most. For the save/restore symmetry pf_step_out_of_anchor is made to always restore previous value of the anchor rule. depth == 0 means what we a at the top (main ruleset). OK henning
* Apart from some minor code reshuffling the big change is that wemikeb2014-08-121-1/+2
| | | | | | | | | | start with a ruleset pointer assigned to pf_main_ruleset so that pf_purge_rule doesn't get called with a NULL. Prompted by the discussion with Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. OK henning
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* Put back a m_copyback() that got lost in rev 1.837 of pf.c. Thisbluhm2014-07-131-2/+4
| | | | | | | | fixes the rewrite of an IPv6 header of an ICMP6 packet in the payload of an ICMP6 error packet. Path MTU discovery with ping6 over pf nat or rdr works again. Found by src/regress/sys/net/pf_fragment make run-regress-fragping6 OK henning@
* Simplify the way divert(4) sends packets to userspace: Instead oflteo2014-07-101-10/+5
| | | | | | | | | unnecessarily allocating an mbuf tag to store the divert port, just pass the divert port directly to divert_packet() or divert6_packet() as an argument. includes a style fix pointed out by bluhm@ ok bluhm@ henning@ reyk@
* u_int32_t's can't go negativemikeb2014-07-021-8/+8
|
* pf_translate doesn't use the mbuf argument anymore.mikeb2014-06-251-3/+3
| | | | From Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. Thanks!
* Assign the queue ID to the correct packet header when sending ICMP messages.mpi2014-05-201-2/+2
| | | | ok henning@
* ewps... repair qid assignmenthenning2014-04-241-1/+7
|
* Remove some altq tentacles.mpi2014-04-221-9/+2
| | | | ok pelikan@, henning@
* ip_output() using varargs always struck me as bizarre, esp since it's onlyhenning2014-04-211-3/+3
| | | | | | ever used to pass on uint32 (for ipsec). stop that madness and just pass the uint32, 0 in all cases but the two that pass the ipsec flowinfo. ok deraadt reyk guenther
* we'll do fine without casting NULL to struct foo * / void *henning2014-04-211-5/+3
| | | | ok gcc & md5 (alas, no binary change)
* shrink pf by 445 lines.henning2014-04-191-24/+1
| | | | while there, get rid of the altq ioctls and assciated now obsolete code
* pf_send_tcp: ask the stack to do the cksum instead of doing it manuallyhenning2014-04-181-23/+11
| | | | ok benno lteo naddy (back in january)
* "struct pkthdr" holds a routing table ID, not a routing domain one.mpi2014-04-141-18/+22
| | | | | | | | | | | | | | Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
* When translating packets from one address family to another, pass thejca2014-03-101-1/+3
| | | | TOS/Traffic Class field of the original packet. Discussed with mikeb@
* When setting up the packet description, also retrieve the Traffic Classjca2014-03-101-2/+2
| | | | | field of IPv6 packets. Issue reported by Christophe Heurtaux on frnog. ok mikeb@
* Simplify and shorten the way ICMP checksums are verified inlteo2014-01-251-17/+5
| | | | | | | pf_check_proto_cksum() by letting it use the same in4_cksum() call that is used for TCP and UDP checksums. ok henning@ naddy@
* in pf_check_proto_cksum, updtae the swcksum counters if we cksummed inhenning2014-01-241-1/+8
| | | | | software. ok naddy (this is pbly the ultimate commit'n'run)
* since the cksum rewrite the counters for hardware checksummed packetshenning2014-01-231-9/+5
| | | | | | | | | | are are lie, since the software engine emulates hardware offloading and that is later indistinguishable. so kill the hw cksummed counters. introduce software checksummed packet counters instead. tcp/udp handles ip & ipvshit, ip cksum covered, 6 has no ip layer cksum. as before we still have a miscounting bug for inbound with pf on, to be fixed in the next step. found by, prodding & ok naddy
* 7x bcopy -> memcpy, impossibility of overlaps verified. ok benno dlghenning2014-01-221-7/+7
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.