summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_lb.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Enable support for the 'weight' keyword in the 'least-states'zinke2012-07-091-6/+28
| | | | | | | | | load balancing case, this allows Weighted Least States (WLS). Everything prepared on c2k11 with help from mcbride@. This finally makes PF ready for the cloud. ok henning@ mikeb@ pyr@
* The kernel did not compile without INET6. Put some #ifdefs intobluhm2012-02-031-1/+5
| | | | | | | | | | | | | pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
* Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyclaudio2011-10-131-5/+139
| | | | | | | | "af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
* Fix various format string types to as a minimum match the width of themiod2011-09-181-2/+2
| | | | | variables being processed. ok bluhm@ henning@
* Make sure we use the right tbl/dyn pointer to check the pfrkt_refcntcost;mcbride2011-07-291-7/+17
| | | | | | improved debugging for error cases inside the weighted round-robin loop. original diff from claudio, ok henning
* Add support for weighted round-robin in load balancing pools and tables.mcbride2011-07-271-18/+57
| | | | | Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
* bring in least-states load balancing algorithmzinke2011-07-031-10/+190
| | | | ok mcbride@ henning@
* exclude link local address from the dynamic interface address poolmikeb2011-05-171-3/+12
| | | | | | so that rules like "pass out on vr1 inet6 nat-to (vr1)" won't map to the non routable ipv6 link local address; with suggestions and ok claudio, henning
* stuff nsaddr/ndaddr/nsport/ndport (addrs/ports after NAT, used a lot whilehenning2010-06-271-42/+37
| | | | | | | | walking the ruleset and up until state is fully set up) into pf_pdesc instead of passing around those 4 seperately all the time, also shrinks the argument count for a few functions that have/partialy had an insane count of arguments. kinda preparational since we'll need them elsewhere too, soon ok ryan jsing
* pf_get_sport() picks a random port from the port range specified in asthen2010-02-041-19/+24
| | | | | | | | | | | | | | | | nat rule. It should check to see if it's in-use (i.e. matches an existing PF state), if it is, it cycles sequentially through other ports until it finds a free one. However the check was being done with the state keys the wrong way round so it was never actually finding the state to be in-use. - switch the keys to correct this, avoiding random state collisions with nat. Fixes PR 6300 and problems reported by robert@ and viq. - check pf_get_sport() return code in pf_test(); if port allocation fails the packet should be dropped rather than sent out untranslated. Help/ok claudio@.
* Convert pf debug logging to using log()/addlog(), a single standardisedmcbride2010-01-181-15/+13
| | | | | | | definition of DPFPRINTF(), and log priorities from syslog.h. Old debug levels will still work for now, but will eventually be phased out. discussed with henning, ok dlg
* First pass at removing the 'pf_pool' mechanism for translation and routingmcbride2010-01-121-58/+27
| | | | | | | | | | | actions. Allow interfaces to be specified in special table entries for the routing actions. Lists of addresses can now only be done using tables, which pfctl will generate automatically from the existing syntax. Functionally, this deprecates the use of multiple tables or dynamic interfaces in a single nat or rdr rule. ok henning dlg claudio
* fix sticky-address - by pretty much re-implementing it. still followinghenning2009-12-141-23/+30
| | | | | | | | the original approach using a source tracking node. the reimplementation i smore flexible than the original one, we now have an slist of source tracking nodes per state. that is cheap because more than one entry will be an absolute exception. ok beck and jsg, also stress tested by Sebastian Benoit <benoit-lists at fb12.de>
* rtables are stacked on rdomains (it is possible to have multiple routingclaudio2009-11-031-4/+7
| | | | | | | | | | | | | | tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
* Fix static-port, found by jmc@. ok henning@.sthen2009-09-071-2/+3
|
* the diff theo calls me insanae for:henning2009-09-011-257/+55
| | | | | | | | | | | | | | | rewrite of the NAT code, basically. nat and rdr become actions on regular rules, seperate nat/rdr/binat rules do not exist any more. match in on $intf rdr-to 1.2.3.4 match out on $intf nat-to 5.6.7.8 the code is capable of doing nat and rdr in any direction, but we prevent this in pfctl for now, there are implications that need to be documented better. the address rewrite happens inline, subsequent rules will see the already changed addresses. nat / rdr can be applied multiple times as well. match in on $intf rdr-to 1.2.3.4 match in on $intf to 1.2.3.4 rdr-to 5.6.7.8 help and ok dlg sthen claudio, reyk tested too
* move the "pf_map_addr: selected address" printf up to -xnoisy.sthen2009-06-241-2/+2
| | | | ok henning@
* Stricter state checking for ICMP and ICMPv6 packets: include the ICMP typemcbride2009-03-051-4/+7
| | | | | | | | | | | | | | | | in one port of the state key, using the type to determine which side should be the id, and which should be the type. Also: - Handle ICMP6 messages which are typically sent to multicast addresses but recieve unicast replies, by doing fallthrough lookups against the correct multicast address. - Clear up some mistaken assumptions in the PF code: - Not all ICMP packets have an icmp_id, so simulate one based on other data if we can, otherwise set it to 0. - Don't modify the icmp id field in NAT unless it's echo - Use the full range of possible id's when NATing icmp6 echoy ok henning marco testing matthieu todd
* bring back the NAT NOP fix, but this time right.henning2009-02-181-1/+11
| | | | | | | when we want to pretend pf_get_translation didn't do anything we must get rid of _both_ state keys and reset all 4 sk pointers to NULL and not leave one key behind and have all 4 pointers point to it - that must fail. tested dhill sthen, david agrees, deraadt ok
* revert pf.c r1.629 (which moved to this file) which was causingsthen2009-02-121-10/+1
| | | | | | "panic: pool_do_get(pfstatekeypl): free list modified" discussed with many. ok dlg
* Split the address selection from pools away from pf.c and put it inpyr2009-01-291-0/+694
pf_lb.c. This will ease the process of adding more selection types without bloatening pf.c even more. ok and a weird death threat, henning@ raised eyebrow, dlg@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.