summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_ioctl.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* g/c DIOCCLRRULECTRShenning2017-05-301-16/+1
| | | | | | kinda deprecated for a decade now, nothing in base uses it, nothing in ports uses it (thanks sthen) ok phessler sashan
* Enable the NET_LOCK(), take 3.mpi2017-05-151-13/+3
| | | | | | Recursions are still marked as XXXSMP. ok deraadt@, bluhm@
* Hook up FQ-CoDel to the tree and enable configuration in the pfctl(8)mikeb2017-05-151-4/+15
| | | | OK sthen, visa
* Provide pluggable queueing interface for pfmikeb2017-05-021-39/+44
| | | | | | | | | | | | | By hiding H-FSC behind pfq_ops structure similar to the ifq_ops, we provide a possibility to plug alternative queueing interfaces for use in pf. This reduces amount of H-FSC specific code in the pf ioctl handler While here, change the the order of elements in hfsc_class_stats to provide some compatibility between queue stat structures of different traffic conditioners. No objections from henning@, ok sthen@
* Speed up DIOCKILLSTATES by using the RB tree index if all fields usedyasuoka2017-04-211-3/+57
| | | | | | by the tree of given state key are filled. ok sasha
* Revert the NET_LOCK() and bring back pf's contention lock for release.mpi2017-03-171-3/+13
| | | | | | | | | For the moment the NET_LOCK() is always taken by threads running under KERNEL_LOCK(). That means it doesn't buy us anything except a possible deadlock that we did not spot. So make sure this doesn't happen, we'll have plenty of time in the next release cycle to stress test it. ok visa@
* removes the pf_consistency_lock and protects the users withbenno2017-01-301-13/+3
| | | | | | | NET_LOCK(). pfioctl() will need the NET_LOCK() anyway. So better keep things simple until we're going to redesign PF for a MP world. fixes the crash reported by Kaya Saman. ok mpi@, bluhm@
* A space here, a space there. Soon we're talking real whitespacekrw2017-01-241-5/+5
| | | | rectification.
* Kill recursive splsoftnet()s.mpi2016-11-161-4/+2
| | | | ok bluhm@
* - once rule should not attempt to remove its parent rule.sashan2016-10-281-1/+2
| | | | (problem pointed out by Petr, fix proposed by Dilli) _at_ oracle
* Put union pf_headers and struct pf_pdesc into separate header filebluhm2016-10-261-7/+12
| | | | | | | | | pfvar_priv.h. The pf_headers had to be defined in multiple .c files before. In pfvar.h it would have unknown storage size, this file is included in too many places. The idea is to have a private pf header that is only included in the pf part of the kernel. For now it contains pf_pdesc and pf_headers, it may be extended later. discussion, input and OK henning@ procter@ sashan@
* roll back turning RB into RBT until i get better at this process.dlg2016-09-271-17/+18
|
* move pf from the RB macros to the RBT functions.dlg2016-09-271-18/+17
|
* all pools have their ipl set via pool_setipl, so fold it into pool_init.dlg2016-09-151-25/+17
| | | | | | | | | | | | | | | | | | | | | | the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
* Let purge thread to remove once rules, not packets.sashan2016-09-031-14/+11
| | | | | | Thanks mikeb@ for idea to add expire time. OK mpi@, OK mikeb@
* pool_setipl for pf bitsdlg2016-09-021-1/+9
| | | | ok phessler@ henning@
* Add sizes to most free calls. OK sashan@ tedu@claudio2015-12-031-42/+42
|
* allocate PF tags as M_RTABLE vice M_TEMPblambert2015-12-031-3/+3
| | | | ok henning@ claudio@
* Rename pf_unlink_state() to pf_remove_state() so the name does notbluhm2015-12-031-4/+4
| | | | | collide with the statekey to inp unlinking. OK sashan@ mpi@
* No need for <net/if_types.h>mpi2015-11-241-2/+1
| | | | As a bonus this removes a "#if NCARP > 0", say yeah!
* There's no longer a need to include <net/hfsc.h> in <net/if_var.h>mpi2015-11-231-1/+2
|
* shuffle struct ifqueue so in flight mbufs are protected by a mutex.dlg2015-11-201-42/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the code is refactored so the IFQ macros call newly implemented ifq functions. the ifq code is split so each discipline (priq and hfsc in our case) is an opaque set of operations that the common ifq code can call. the common code does the locking, accounting (ifq_len manipulation), and freeing of the mbuf if the disciplines enqueue function rejects it. theyre kind of like bufqs in the block layer with their fifo and nscan disciplines. the new api also supports atomic switching of disciplines at runtime. the hfsc setup in pf_ioctl.c has been tweaked to build a complete hfsc_if structure which it attaches to the send queue in a single operation, rather than attaching to the interface up front and building up a list of queues. the send queue is now mutexed, which raises the expectation that packets can be enqueued or purged on one cpu while another cpu is dequeueing them in a driver for transmission. a lot of drivers use IFQ_POLL to peek at an mbuf and attempt to fit it on the ring before committing to it with a later IFQ_DEQUEUE operation. if the mbuf gets freed in between the POLL and DEQUEUE operations, fireworks will ensue. to avoid this, the ifq api introduces ifq_deq_begin, ifq_deq_rollback, and ifq_deq_commit. ifq_deq_begin allows a driver to take the ifq mutex and get a reference to the mbuf they wish to try and tx. if there's space, they can ifq_deq_commit it to remove the mbuf and release the mutex. if there's no space, ifq_deq_rollback simply releases the mutex. this api was developed to make updating the drivers using IFQ_POLL easy, instead of having to do significant semantic changes to avoid POLL that we cannot test on all the hardware. the common code has been tested pretty hard, and all the driver modifications are straightforward except for de(4). if that breaks it can be dealt with later. ok mpi@ jmatthew@
* - pf_insert_src_node(): global argument (arg6) is useless, functionsashan2015-10-131-3/+2
| | | | | | | | | | | always gets pointer to rule. - pf_remove_src_node(): function should always remove matching src node, regardless the sn->rule.ptr being NULL or valid rule - sn->rule.ptr is never NULL, spotted by mpi and Richard Procter _von_ gmail.com OK mpi@, OK mikeb@
* The pf_osfp_pl and pf_osfp_entry_pl never get used in interrupt context.kettenis2015-09-041-2/+2
| | | | | | | | | | | Drop the explicit pool backend allocator here and add PR_WAITOK to the flags passed to pool_init(9). The pfi_addr_pl and pf_rule_pl can get used in interrupt context though. So simply drop the explicit pool backend allocator without adding PR_WAITOK to the flags passed to pool_init(9). ok mikeb@
* - added /* FALLTHROUGH */ comments, typecasts (u_int32_t)-1, ...sashan2015-07-211-4/+4
| | | | ok mpi@
* potential memory leak in SIOCADDRULEsashan2015-07-191-3/+5
| | | | ok mcbride@
* unsinged variables should not be compared to be leq than 0 (unsigned a <= 0)sashan2015-07-191-2/+2
| | | | ok mcbride@
* msg.mpisashan2015-07-181-5/+5
|
* the hfsc pools are only used in hfsc.c, so move the init of themdlg2015-04-111-7/+2
| | | | | | there instead of pf_ioctl.c. ok henning@
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-5/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* fix a memory leak in the error case found by Maxime Villard's Brainytedu2015-02-201-4/+8
| | | | | | code scanner. Changing return to break also fixes a failure to unlock. Also fix a NULL check for that variable noticed by bluhm. ok bluhm henning millert
* since we inherit prio (as in, the queuing priority) from outside sources,henning2015-02-101-1/+2
| | | | | | | | i. e. on vlan interfaces, it is useful to be able to match on it - effectively matching on classification done elsewhere. i thought i had long implemented that, but chrisz@ asking for it made me notice that wasn't the case. tests by chrisz, ok phessler pelikan
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-5/+6
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-5/+1
| | | | | long live the one true internet. ok henning mikeb
* More malloc() -> mallocarray() in the kernel.doug2014-12-091-3/+4
| | | | ok deraadt@ tedu@
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-2/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Finally implement what's stated in the man page regarding parentmikeb2014-08-121-4/+14
| | | | | | | | | anchors for "once" rules: "In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched." Employ an additional pointer pair to keep track of the parent ruleset containing the anchor that we want to remove. OK henning
* Apart from some minor code reshuffling the big change is that wemikeb2014-08-121-8/+3
| | | | | | | | | | start with a ruleset pointer assigned to pf_main_ruleset so that pf_purge_rule doesn't get called with a NULL. Prompted by the discussion with Alexandr Nedvedicky <alexandr ! nedvedicky at oracle ! com>. OK henning
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-44/+44
| | | | after discussions with beck deraadt kettenis.
* Remove some altq tentacles.mpi2014-04-221-8/+1
| | | | ok pelikan@, henning@
* shrink pf by 445 lines.henning2014-04-191-418/+3
| | | | while there, get rid of the altq ioctls and assciated now obsolete code
* Eliminates struct pcred by moving the real and saved ugids intoguenther2014-03-301-3/+3
| | | | | | | | | struct ucred; struct process then directly links to the ucred Based on a discussion at c2k10 or so before noting that FreeBSD and NetBSD did this too. ok matthew@
* reduce the length of some pool names. ok deraadt guenther mpitedu2014-02-041-10/+10
|
* support negated matches on the rcvif, ok dlg bennohenning2014-01-201-1/+3
|
* Switch frequently allocated structs from malloc(M_DEVBUF) to separate pools.pelikan2014-01-031-1/+7
| | | | ok henning, "looks fine" mikeb, input from guenther.
* Make queues disappear correctly on interfaces being destroyed.pelikan2014-01-031-25/+31
| | | | ok henning
* DIOCGETSRCNODES was leaking a little bit more kernel informationderaadt2013-11-131-1/+2
| | | | ok benno
* two ioctl's were disclosing kernel pointers and such.deraadt2013-11-121-1/+11
| | | | ok henning benno
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.