summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_ruleset.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Check for main ruleset explicitlykn2018-12-271-4/+4
| | | | | | | | | | | All rulesets reference their parent anchor, except for the special cased main anchor containing the main ruleset, which's reference is always NULL since initialization and never changes. Replacing nullity tests with clearer equality checks makes the code less ambigious and easier to understand. OK sashan
* Rename pf_anchor_remove() to pf_remove_anchor()kn2018-12-171-9/+5
| | | | | | | | | For semantic consistency with pf_{create,find,remove}_{anchor,ruleset}(). Simplify logic by squashing the if/else block while here. No functional change. Feedback jca and mikeb, OK mikeb
* - split pf_find_or_create_ruleset() to smaller chunks.sashan2017-09-051-68/+123
| | | | | | tested by Hrvoje OK mpi@, OK bluhm@
* sizes for free()deraadt2017-05-301-17/+17
| | | | ok henning
* roll back turning RB into RBT until i get better at this process.dlg2016-09-271-16/+15
|
* move pf from the RB macros to the RBT functions.dlg2016-09-271-15/+16
|
* style: no spaces after # for define/include, ok phessler bennohenning2016-07-191-13/+13
|
* rs_malloc() does not need to be castmmcc2016-01-151-6/+6
|
* msg.mpisashan2015-07-181-3/+3
|
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-2/+2
| | | | after discussions with beck deraadt kettenis.
* this code is shared into userland, and there it should not pullderaadt2012-11-151-2/+2
| | | | | in sys/mbuf.h ok claudio
* Convert pf debug logging to using log()/addlog(), a single standardisedmcbride2010-01-181-17/+18
| | | | | | | definition of DPFPRINTF(), and log priorities from syslog.h. Old debug levels will still work for now, but will eventually be phased out. discussed with henning, ok dlg
* cleanup after the NAT changes. we used to have multiple rulesets (scrub,henning2009-11-221-42/+9
| | | | | | | | | NAT, filter). now we only have one. no need for an array any more. simplifies the code quite a bit. in the process fix the abuse of PF_RULESET_* by (surprise, isn't it) the table code. written at the filesystem hackathon in stockholm, committed from the hardware hackathon in portugal. ok gcc and jsing
* 1) scrub rules are completely gone.henning2009-04-061-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2) packet reassembly: only one method remains, full reassembly. crop and drop-ovl are gone. . set reassemble yes|no [no-df] if no-df is given fragments (and only fragments!) with the df bit set have it cleared before entering the fragment cache, and thus the reassembled packet doesn't have df set either. it does NOT touch non-fragmented packets. 3) regular rules can have scrub options. . pass scrub(no-df, min-ttl 64, max-mss 1400, set-tos lowdelay) . match scrub(reassemble tcp, random-id) of course all options are optional. the individual options still do what they used to do on scrub rules, but everything is stateful now. 4) match rules "match" is a new action, just like pass and block are, and can be used like they do. opposed to pass or block, they do NOT change the pass/block state of a packet. i. e. . pass . match passes the packet, and . block . match blocks it. Every time (!) a match rule matches, i. e. not only when it is the last matching rule, the following actions are set: -queue assignment. can be overwritten later, the last rule that set a queue wins. note how this is different from the last matching rule wins, if the last matching rule has no queue assignments and the second last matching rule was a match rule with queue assignments, these assignments are taken. -rtable assignments. works the same as queue assignments. -set-tos, min-ttl, max-mss, no-df, random-id, reassemble tcp, all work like the above -logging. every matching rule causes the packet to be logged. this means a single packet can get logged more than once (think multiple log interfaces with different receivers, like pflogd and spamlogd) . almost entirely hacked at n2k9 in basel, could not be committed close to release. this really should have been multiple diffs, but splitting them now is not feasible any more. input from mcbride and dlg, and frantzen about the fragment handling. speedup around 7% for the common case, the more the more scrub rules were in use. manpage not up to date, being worked on.
* Always check rs_malloc() returns. Also add M_ZERO and M_CANFAILthib2009-01-061-8/+11
| | | | | | | | | | to the flags passed to malloc() in the kernel case since we always zero the memory and are able to fail gracefully. remove memset()'s and bzero's accordingly and use calloc(1, ...) in the userland case so we get it zeroed. OK henning@, claudio@
* Remove redundant function prototypes which are already in pfvar.hdhill2008-12-181-9/+1
| | | | ok henning@
* Split ruleset manipulation functions out into pf_ruleset.c to allow them tomcbride2006-10-271-0/+415
be imported into pfctl. This is a precursor to separating ruleset parsing from loading in pfctl, and tons of good things will come from it. 2 minor changes aside from cut-n-paste and #define portability magic: - instead of defining the global pf_main_ruleset, define pf_main_anchor (which contains the pf_main_ruleset) - allow pf_find_or_create_ruleset() to return the pf_main_ruleset if it's passed an empty anchor name. ok henning dhartmei
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.