summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_if.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* kernel: use gettime(9)/getuptime(9) in lieu of time_second(9)/time_uptime(9)cheloha2020-06-241-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | time_second(9) and time_uptime(9) are widely used in the kernel to quickly get the system UTC or system uptime as a time_t. However, time_t is 64-bit everywhere, so it is not generally safe to use them on 32-bit platforms: you have a split-read problem if your hardware cannot perform atomic 64-bit reads. This patch replaces time_second(9) with gettime(9), a safer successor interface, throughout the kernel. Similarly, time_uptime(9) is replaced with getuptime(9). There is a performance cost on 32-bit platforms in exchange for eliminating the split-read problem: instead of two register reads you now have a lockless read loop to pull the values from the timehands. This is really not *too* bad in the grand scheme of things, but compared to what we were doing before it is several times slower. There is no performance cost on 64-bit (__LP64__) platforms. With input from visa@, dlg@, and tedu@. Several bugs squashed by visa@. ok kettenis@
* don't leak the the task struct used for the addrhook in pfi_detach_ifnet.dlg2019-11-181-1/+4
|
* convert interface address change hooks to tasks and a task_list.dlg2019-11-081-6/+9
| | | | | | | | | | | | | | | this follows what's been done for detach and link state hooks, and makes handling of hooks generally more robust. address hooks are a bit different to detach/link state hooks in that there's only a few things that register hooks (carp, pf, vxlan), but a lot of places to run the hooks (lots of ipv4 and ipv6 address configuration). an address hook cookie was in struct pfi_kif, which is part of the pf abi. rather than break pfctl -sI, this maintains the void * used for the cookie and uses it to store a task, which is then used as intended with the new api.
* Fix previous commit which made src-node have a reference for the kif.yasuoka2019-07-091-2/+14
| | | | | | | Src-node should use the reference counter since it might live longer than its table entry, rule or the associated states. OK sashan
* Remove useless macroskn2018-12-101-3/+3
| | | | | | These are just unhelpful case conversion. OK sashan henning
* Disambiguate the source of panics in sys/net* by adding __func__nayden2018-07-111-5/+5
| | | | | magic constant to panic() calls. ok benno@ henning@ tb@
* provide pfi_group_addmember(), which makes the new member interface inherithenning2018-07-111-1/+14
| | | | set flags from the group. ok phessler benno
* Fix copy and paste typo in pfi_kif_unref route error message.bluhm2018-04-241-2/+2
|
* some finger muscle workout:henning2018-02-061-10/+10
| | | | bzero -> memset and (very few) bcopy -> memcpy/memmove
* sizes for free()deraadt2017-05-301-3/+3
| | | | ok henning
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-2/+2
| | | | ok visa@
* A space here, a space there. Soon we're talking real whitespacekrw2017-01-241-2/+2
| | | | rectification.
* Kill recursive splsoftnet().mpi2016-12-121-23/+3
| | | | ok bluhm@
* Kill recursive splsoftnet()s.mpi2016-11-161-27/+4
| | | | ok bluhm@
* roll back turning RB into RBT until i get better at this process.dlg2016-09-271-16/+16
|
* move pf from the RB macros to the RBT functions.dlg2016-09-271-16/+16
|
* all pools have their ipl set via pool_setipl, so fold it into pool_init.dlg2016-09-151-3/+2
| | | | | | | | | | | | | | | | | | | | | | the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
* pool_setipl for pf bitsdlg2016-09-021-1/+2
| | | | ok phessler@ henning@
* shuffle struct ifqueue so in flight mbufs are protected by a mutex.dlg2015-11-201-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the code is refactored so the IFQ macros call newly implemented ifq functions. the ifq code is split so each discipline (priq and hfsc in our case) is an opaque set of operations that the common ifq code can call. the common code does the locking, accounting (ifq_len manipulation), and freeing of the mbuf if the disciplines enqueue function rejects it. theyre kind of like bufqs in the block layer with their fifo and nscan disciplines. the new api also supports atomic switching of disciplines at runtime. the hfsc setup in pf_ioctl.c has been tweaked to build a complete hfsc_if structure which it attaches to the send queue in a single operation, rather than attaching to the interface up front and building up a list of queues. the send queue is now mutexed, which raises the expectation that packets can be enqueued or purged on one cpu while another cpu is dequeueing them in a driver for transmission. a lot of drivers use IFQ_POLL to peek at an mbuf and attempt to fit it on the ring before committing to it with a later IFQ_DEQUEUE operation. if the mbuf gets freed in between the POLL and DEQUEUE operations, fireworks will ensue. to avoid this, the ifq api introduces ifq_deq_begin, ifq_deq_rollback, and ifq_deq_commit. ifq_deq_begin allows a driver to take the ifq mutex and get a reference to the mbuf they wish to try and tx. if there's space, they can ifq_deq_commit it to remove the mbuf and release the mutex. if there's no space, ifq_deq_rollback simply releases the mutex. this api was developed to make updating the drivers using IFQ_POLL easy, instead of having to do significant semantic changes to avoid POLL that we cannot test on all the hardware. the common code has been tested pretty hard, and all the driver modifications are straightforward except for de(4). if that breaks it can be dealt with later. ok mpi@ jmatthew@
* Clean up handling of 'clear states' pfsync packets.mikeb2015-10-301-4/+11
| | | | | | | If interface was specified in the packet only if-bound states attached to this interface must be purged. ok mpi, looked at by sasha@
* The pf_osfp_pl and pf_osfp_entry_pl never get used in interrupt context.kettenis2015-09-041-2/+2
| | | | | | | | | | | Drop the explicit pool backend allocator here and add PR_WAITOK to the flags passed to pool_init(9). The pfi_addr_pl and pf_rule_pl can get used in interrupt context though. So simply drop the explicit pool backend allocator without adding PR_WAITOK to the flags passed to pool_init(9). ok mikeb@
* - added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...sashan2015-07-211-7/+7
| | | | ok mpi@
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-3/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* replace some malloc multiplies with mallocarry. ok deraadt henningtedu2014-12-021-3/+3
|
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-3/+3
| | | | after discussions with beck deraadt kettenis.
* 7x bcopy -> memcpy, impossibility of overlaps verified. ok benno dlghenning2014-01-221-2/+2
|
* introduce a way to match "any" interface, excluding loopback ones.henning2014-01-211-1/+11
| | | | | | pfi_kif_get annotates the kif with a flag indicating it is the "any" match pfi_kif_match obeys that flag ok benno
* Name the local variables for struct ifaddr consistently "ifa".bluhm2014-01-081-11/+11
| | | | OK mikeb@
* Make queues disappear correctly on interfaces being destroyed.pelikan2014-01-031-1/+7
| | | | ok henning
* The header file netinet/in_var.h included netinet6/in6_var.h. Thisbluhm2013-10-171-2/+1
| | | | | | | created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
* Missing splx on return path.haesbaert2013-08-301-1/+2
| | | | ok bluhm@
* Revert previous and unbreak asr, the new include should be protected.mpi2013-06-201-3/+3
| | | | Reported by naddy@
* Allocate the various hook head descriptors as part of the ifnetmpi2013-06-201-3/+3
| | | | | | | structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
* change the malloc(9) flags from M_DONTWAIT to M_NOWAIT; OK millert@gsoares2012-12-281-2/+2
|
* fix set skip group matching: don't match partial strings, i. e. 'set skip onhenning2011-07-281-2/+2
| | | | | | lo' must not match a group 'local'. diff from sthen who is not around for a few days, ok me and mpf. I can't find the mail of the guy who initially ran into this problem, sorry for that, thanks for reporting!
* Change 'set skip on <...>' to work with interface groups.sthen2011-05-201-6/+9
| | | | | | | | | | | | | | | | | | | | Feedback from various people, ok henning@ Previously if an interface type (without number), e.g. "set skip on vlan" or "set skip on em" was used, it would have the undocumented behaviour of matching any interface of that type. Now it will only match an interface which is a member of the named group. This results in some changed behaviour: If you currently use "set skip" with a physical interface type (e.g. "set skip on ix") you will need to add the interface to a group of that name: 'ifconfig ix0 group ix' or add 'group ix' to hostname.ix0. Interfaces cloned at runtime (e.g. lo, trunk, vlan, pppoe, carp, gif, mpe and others) default to being in a group named after the interface type, so for these interfaces there will be no change in behaviour unless you have deliberately changed groups, e.g. 'ifconfig carp456 -group carp'.
* Clean up iterface stats handling:mcbride2010-06-281-2/+11
| | | | | | | | | - 'make -Fi' reset ALL the interface statistics can be restricted with -i ifname - 'make -Fa -i ifname' fail (it's meaningless) - get rid of a silly little struct that's only used for one thing ok henning
* Convert pf debug logging to using log()/addlog(), a single standardisedmcbride2010-01-181-9/+16
| | | | | | | definition of DPFPRINTF(), and log priorities from syslog.h. Old debug levels will still work for now, but will eventually be phased out. discussed with henning, ok dlg
* First pass at removing the 'pf_pool' mechanism for translation and routingmcbride2010-01-121-2/+12
| | | | | | | | | | | actions. Allow interfaces to be specified in special table entries for the routing actions. Lists of addresses can now only be done using tables, which pfctl will generate automatically from the existing syntax. Functionally, this deprecates the use of multiple tables or dynamic interfaces in a single nat or rdr rule. ok henning dlg claudio
* Clearly copy the whole, and nothing but the whole, old buffer intokrw2009-08-251-2/+2
| | | | | | | | | the resized buffer. From Pawel Jakob Dawidek via Max Laier via Marc Balmer via tech@. As was the previous commit where I didn't mention Pawel. 'should be olright' henning@
* Fix order of memcpy() arguments so data is copied from src to dest,krw2009-08-251-2/+2
| | | | | | | not the other way. At least partial fix for interfaces with >64 aliases. From Max Laier via Marc Balmer. 'seems right' sthen@ ok markus@
* Make the DIOCSETIFFLAG, DIOCSETLIMIT, and DIOCSETTIMEOUT ioctlsmcbride2009-03-091-3/+15
| | | | | | | transactional, closing PRs 4941 and 5910. Minor flag day, requires rebuild of userland tools that use struct pfi_kif. ok henning deraadt
* Fix splasserts seen in pr 5987 by propagating a flag that discribesmikeb2008-11-241-2/+2
| | | | | | | | | | whether we're called from the interrupt context to the functions performing allocations. Looked at by mpf@ and henning@, tested by mpf@ and Antti Harri, the pr originator. ok tedu
* Also do the PR_ZERO dance here. This was held back on Henning's requestmk2008-06-141-3/+3
| | | | | | because it conflicted with the change he did in pf_if.c earlier. He finally woke up to ok (well, ``yes'', really) this version now.
* pool_get()s not in interrupt context should not be PR_NOWAIT, buthenning2008-06-141-2/+2
| | | | PR_WAITOK | PR_LIMITFAIL. from discussion with art. ok ryan claudio thib
* KNFmcbride2008-05-181-2/+2
|
* Check for pfi_kif's that are neither groups nor have a real interface.mpf2007-11-071-1/+3
| | | | | | | This prevents a null-deref when empty groups are used in set loginterface. Fixes PR 5628 as reported by Andreas Bihlmaier. Bad mpf :( OK henning@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.