summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_ioctl.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Deep inside DIOCXCOMMIT, should return a real errno instead of -1deraadt2013-10-201-3/+4
| | | | ok henning pelikan
* The header file netinet/in_var.h included netinet6/in6_var.h. Thisbluhm2013-10-171-2/+1
| | | | | | | created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
* new bandwidth shaping subsystem, kernel sidehenning2013-10-121-15/+237
| | | | | | | uses hfsc behind the scenes; altq stays in parallel for a migration phase. if.h even more messy for the transition, but eventuelly it should become readable... looked over & tested by many, ok phessler sthen
* give tagname2tag and its siblings an extra "create" parameter. if 1, ithenning2013-10-121-8/+11
| | | | | behaves like before and creates the mapping if needed. if 0, lookup only. looked over by many, ok phessler sthen
* no need for a lot of code to include proc.htedu2013-03-281-2/+1
|
* Use the correct src/dst ports depending on direction (one of src or dst wasmcbride2013-03-271-3/+3
| | | | | | wrong in each direction). Report and fix from UMEZAWA Takeshi <umezawa@iij.ad.jp>
* Don't try to purge one-time rules from the main ruleset.mikeb2013-02-261-1/+4
| | | | Reported by Wesley M.A. on misc@, ok deraadt
* Use time_uptime for expiration values as time_second can be skewed atflorian2012-10-301-3/+3
| | | | | | | | | | | | | | | | runtime while time_uptime is monotonic. Prevent underflows in pfsync(4) and pflow(4) by using signed variables. pfsync(4) problem pointed out by camield. Diff originally by dlg, frag and pflow bits by me. feedback dlg man page tweak jmc Various versions of the pflow bits tested by Hrvoje Popovski (hrvoje AT srce DOT hr), thanks! ok benno, henning, dlg
* Lower pf frags limit to not risk running out of mbuf clusterscamield2012-09-201-1/+7
| | | | | | | | | when dealing with lots of IP fragments. This sets the default to 25% of the mbuf cluster maximum (hint from beck). And the example in the manpage is sane now. ok mikeb henning beck deraadt
* prio 0 is valid, therefore, I chose an "impossible" value for prio meaninghenning2012-09-181-5/+4
| | | | | | | | "not set" and used a PF_PRIO_NOTSET define for it. now that means that everything that creates a struct pf_rule doesn't get away with bzero'ing it, which turned out to be not so nice. so get rid of PF_PRIO_NOTSET, instead, make a rule+state flag PFSTATE_SETPRIO which indicates wether the prio should be set. ok benno claudio mikeb
* there was a limit on the number of pflog interfaces - 16. remove that.henning2012-07-081-3/+1
| | | | | mostly by dynamically allocating pflogifs instead of making that a static array. ok claudio zinke
* rename prio in struct pf_rule and related structs to set_prio so it ishenning2012-07-071-6/+7
| | | | | | | utterly clear this is not a filter criteria but a packet modification thing. also preparation for upcoming changes, including one to unscrew this mess (I should not have to touch half the tree for this - ifixitlater) not user visible, ok gcc
* restore DIOCKILLSTATE semantics to what they were before the NAT rewrite.henning2012-07-071-2/+3
| | | | | | | | | | | when you kill states by IP, it is not all that clear which IP we're talking about - before or after rewriting? the old semantics were to always look at the "original" IP, i. e. before rewriting. ever since the NAT rewrite we were unconditionally looking at the wire side state key, which is the original address for PF_IN states, but not for PF_OUT. So look at the SK_STACK state key in the PF_OUT case. should fix "authpf doesn't remove NAT states" seen on misc a while ago ok & testing & half of the analysis bob (he sez beck)
* Fix kernel compilation with pf but without pfsync pseudo-device bymikeb2012-04-031-3/+5
| | | | | moving the state export functionality from pfsync code into pf. Based on the initial diff diff by guenther, ok henning.
* Another pid that needs to be the process pid and not the thread one.claudio2012-03-281-3/+3
| | | | OK deraadt@, guenther@
* fixup af-to regression with match rulesmikeb2011-12-121-3/+2
| | | | | | | | | | pfctl should not infer the af-to behavior from the af/naf difference. instead, we should be clear that this is an af-to rule. essentially this change converts FOM_AFTO marker into a rule flag PFRULE_AFTO so that we don't rely on ambiguous checks (like r->af != r->naf) when setting things up. positive review and comments from claudio, ok henning, sperreault
* use a u_int64_t for the state id in pfsync_state. this makes it consistentdlg2011-11-291-2/+2
| | | | | | | | | | | | with every other thing that stores the state id (including other pfsync messages). includes improvements to the systat code to consider the creatorid as well as the state id in its cache to avoid collisions between states created on different hosts. tested by me in production and on amd64 talking to sparc64. ok henning@
* deprecate PFTM_UNTIL_PACKET. nothing in the tree uses it, anddlg2011-11-281-3/+2
| | | | | | | pf_state_expires() handled it incorrectly. discussed with mikeb@ ok henning@
* use time_uptime to set state creation values as time_second can bedlg2011-11-251-2/+2
| | | | | | | skewed at runtime by things like date(1) and ntpd. time_uptime is monotonic and therefore more useful to compare against. ok deraadt@ mikeb@
* Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyclaudio2011-10-131-1/+3
| | | | | | | | "af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
* rename some vars and functionshenning2011-10-071-20/+23
| | | | | | unfortunately altq is one giant namespace violation. rename just those that conflict with new stuff for now only to be found on my laptop. reduce pain, the diff is huge already. ok ryan
* Add support for one shot rules that remove themselves from an activemikeb2011-08-301-1/+19
| | | | | | | | ruleset after match. In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched. This is an extremely handy technique for firewall proxies. ok henning, mcbride
* surprisingly, we use pf as classifier for the new priority queueinghenning2011-07-081-1/+7
| | | | | implementation. ok ryan mpf sthen and also testing pea and halex looked at it and commented as well
* Don't destroy a non-persistent table if referenced by src_nodes. Fixessthen2011-06-021-2/+2
| | | | | | a crash if max-src-* options are triggered both before and after a ruleset reload, when the rules are overloading to a non-persistent table. Discovered by and fix from Martin Pelikan.
* Fix potential null dereference.chl2011-04-191-5/+5
| | | | | | Found by LLVM/Clang Static Analyzer. ok henning@
* Allow PF to filter on the rdomain a packet belongs to. This allows toclaudio2011-04-061-2/+7
| | | | | write rules like "pass in on rdomain 1". Tested by phessler@, OK henning@
* Include original rdomain in DIOCNATLOOK. This allows userland proxiesclaudio2011-03-251-1/+2
| | | | | to establish cross rdomain proxy sessions. OK henning@, mpf@
* Be more careful when copying the pf rule from userland into the kernel.claudio2010-12-151-125/+147
| | | | | | | | All pointers in the struct need to be cleared and reset. So instead of bcopy the struct and clear some fields start with a clean struct and assign the values that need to be copied. Fixes a local vulnerability but only root can issue the problematic ioctl(). Reported by Jean Sigwald, has been in snaps for a while and OK deraadt@
* fix route label awesomeness, issue also known as PR6416henning2010-06-301-7/+1
| | | | | | | broken by ryan in australia problem found & nagging by sthen jsg found the fix but failed to apply the cluestick correctly ;) test & ok sthen
* Clean up iterface stats handling:mcbride2010-06-281-6/+13
| | | | | | | | | - 'make -Fi' reset ALL the interface statistics can be restricted with -i ifname - 'make -Fa -i ifname' fail (it's meaningless) - get rid of a silly little struct that's only used for one thing ok henning
* Fix DIOCCHANGERULE ioctl broken in the remove of the address pools.mcbride2010-06-271-7/+1
| | | | Reported by Alexander Vladimirov.
* Convert pf debug logging to using log()/addlog(), a single standardisedmcbride2010-01-181-7/+7
| | | | | | | definition of DPFPRINTF(), and log priorities from syslog.h. Old debug levels will still work for now, but will eventually be phased out. discussed with henning, ok dlg
* First pass at removing the 'pf_pool' mechanism for translation and routingmcbride2010-01-121-434/+78
| | | | | | | | | | | actions. Allow interfaces to be specified in special table entries for the routing actions. Lists of addresses can now only be done using tables, which pfctl will generate automatically from the existing syntax. Functionally, this deprecates the use of multiple tables or dynamic interfaces in a single nat or rdr rule. ok henning dlg claudio
* add support to pf for filtering a packet by the interface it was receiveddlg2009-12-241-1/+23
| | | | | | | | | | | | on. use the received-on IFNAME filter option on a pf.conf rule to restrict which packet the interface had to be received on. eg: pass out on em0 from $foo to $bar received-on fxp0 ive been running this in production for a week now. i find it particularly usefull with interface groups. no objections, and a few "i like"s from henning, claudio, deraadt, mpf
* fix sticky-address - by pretty much re-implementing it. still followinghenning2009-12-141-12/+8
| | | | | | | | the original approach using a source tracking node. the reimplementation i smore flexible than the original one, we now have an slist of source tracking nodes per state. that is cheap because more than one entry will be an absolute exception. ok beck and jsg, also stress tested by Sebastian Benoit <benoit-lists at fb12.de>
* kill obsolete natpasshenning2009-11-241-2/+1
|
* remove the nat_rule pointer on pf_state and pf_pdesc, obsolete afterhenning2009-11-231-8/+3
| | | | | | the NAT rewrite and ever since then only checked in a couple of plaes but never set. same for nat_src_node on pf_state. with this the NAT rewrite made pf over 1000 lines shorter.
* cleanup after the NAT changes. we used to have multiple rulesets (scrub,henning2009-11-221-154/+96
| | | | | | | | | NAT, filter). now we only have one. no need for an array any more. simplifies the code quite a bit. in the process fix the abuse of PF_RULESET_* by (surprise, isn't it) the table code. written at the filesystem hackathon in stockholm, committed from the hardware hackathon in portugal. ok gcc and jsing
* Fix some memory leaks in error cases.jsg2009-11-111-1/+5
| | | | | | Found by parfait. ok henning@
* Use u_int16_t for rdomains for everything. Using various types makesclaudio2009-11-031-2/+2
| | | | | everything just more complicated. Make sure the structs align nicely. OK deraadt@
* rtables are stacked on rdomains (it is possible to have multiple routingclaudio2009-11-031-3/+6
| | | | | | | | | | | | | | tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
* Add a dedicated pf pool for route options as suggested by henning,jsg2009-10-281-10/+37
| | | | | | | | which unbreaks ie route-to after the recent pf changes. With much help debugging and pointing out of missing bits from claudio@ ok claudio@ "looks good" henning@
* Replace if (af) tests operating as an af blacklist with stricter switchmcbride2009-10-061-36/+53
| | | | | | | | statements operating as a whitelist, taking care to allow af 0 (which is the wildcard value in pf rules) diff from Vadim Zhukov ok henning
* the diff theo calls me insanae for:henning2009-09-011-31/+67
| | | | | | | | | | | | | | | rewrite of the NAT code, basically. nat and rdr become actions on regular rules, seperate nat/rdr/binat rules do not exist any more. match in on $intf rdr-to 1.2.3.4 match out on $intf nat-to 5.6.7.8 the code is capable of doing nat and rdr in any direction, but we prevent this in pfctl for now, there are implications that need to be documented better. the address rewrite happens inline, subsequent rules will see the already changed addresses. nat / rdr can be applied multiple times as well. match in on $intf rdr-to 1.2.3.4 match in on $intf to 1.2.3.4 rdr-to 5.6.7.8 help and ok dlg sthen claudio, reyk tested too
* make set loginterface, set hostid, set reassemble and set debughenning2009-05-311-6/+39
| | | | transactional. sanity checked claudio, requested by theo for some time
* Really turn fragment reassembly on by default. pfctl must handle thisdavid2009-04-161-3/+1
| | | | | | | since the DIOCSETREASS ioctl is called on every ruleset load and was overriding the initial setting in pfattach(). Fix setting of the global no-df bitmask as well. ok henning@
* turn fragment reassembly on by default. the is little to no reason tohenning2009-04-071-1/+2
| | | | | not do fragment reassembly. discussed with dlg and ryan in basel. ok ryan dlg sthen jdixon todd deraadt
* 1) scrub rules are completely gone.henning2009-04-061-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2) packet reassembly: only one method remains, full reassembly. crop and drop-ovl are gone. . set reassemble yes|no [no-df] if no-df is given fragments (and only fragments!) with the df bit set have it cleared before entering the fragment cache, and thus the reassembled packet doesn't have df set either. it does NOT touch non-fragmented packets. 3) regular rules can have scrub options. . pass scrub(no-df, min-ttl 64, max-mss 1400, set-tos lowdelay) . match scrub(reassemble tcp, random-id) of course all options are optional. the individual options still do what they used to do on scrub rules, but everything is stateful now. 4) match rules "match" is a new action, just like pass and block are, and can be used like they do. opposed to pass or block, they do NOT change the pass/block state of a packet. i. e. . pass . match passes the packet, and . block . match blocks it. Every time (!) a match rule matches, i. e. not only when it is the last matching rule, the following actions are set: -queue assignment. can be overwritten later, the last rule that set a queue wins. note how this is different from the last matching rule wins, if the last matching rule has no queue assignments and the second last matching rule was a match rule with queue assignments, these assignments are taken. -rtable assignments. works the same as queue assignments. -set-tos, min-ttl, max-mss, no-df, random-id, reassemble tcp, all work like the above -logging. every matching rule causes the packet to be logged. this means a single packet can get logged more than once (think multiple log interfaces with different receivers, like pflogd and spamlogd) . almost entirely hacked at n2k9 in basel, could not be committed close to release. this really should have been multiple diffs, but splitting them now is not feasible any more. input from mcbride and dlg, and frantzen about the fragment handling. speedup around 7% for the common case, the more the more scrub rules were in use. manpage not up to date, being worked on.
* Make the DIOCSETIFFLAG, DIOCSETLIMIT, and DIOCSETTIMEOUT ioctlsmcbride2009-03-091-14/+40
| | | | | | | transactional, closing PRs 4941 and 5910. Minor flag day, requires rebuild of userland tools that use struct pfi_kif. ok henning deraadt
* pfsync v5, mostly written at n2k9, but based on work done at n2k8.dlg2009-02-161-12/+2
| | | | | | | | | | | | | | | | | WARNING: THIS BREAKS COMPATIBILITY WITH THE PREVIOUS VERSION OF PFSYNC this is a new variant of the protocol and a large reworking of the pfsync code to address some performance issues. the single largest benefit comes from having multiple pfsync messages of different types handled in a single packet. pfsyncs handling of pf states is highly optimised now, along with packet parsing and construction. huggz for beck@ for testing. huge thanks to mcbride@ for his help during development and for finding all the bugs during the initial tests. thanks to peter sutton for letting me get credit for this work. ok beck@ mcbride@ "good." deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.