summaryrefslogtreecommitdiffstats
path: root/sys/net/pf_table.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* KNFmcbride2004-12-071-2/+2
|
* Add kernel code to keep track of tcp connections which have completedmcbride2004-12-041-8/+41
| | | | | | | | | | | the 3-way handshake. Allow limits on both total connections and connection rate, put offenders in a table which can be used in the ruleset, and optionally kill existing states. Rate tracking code from dhartmei@. Adds a second pool for table entries using the default allocator, which allows entries to be added at splsoftnet(). ok deraadt@ dhartmei@
* correctly parse the anchor names to which tables refer.jaredy2004-10-151-1/+39
| | | | | | | | | now they abide to the same rules as anchor names referred to by rules: - initial slashes (/) are stripped - anchor names with characters after the terminating NUL byte are considered invalid ok dhartmei (and previously) beck henning
* Make 0/0 table entries work; also fix a problem setting the network maskmcbride2004-07-081-3/+3
| | | | | | on v6 addresses. Reported by Ilya A. Kovalenko, fix from Cedric Berger.
* pfr_commit_ktable calls functions that can result in the currentmcbride2004-06-231-3/+5
| | | | | | ktable being destroyed, which makes it unsafe in a SLIST_FOREACH. Fix from Chris Pascoe
* First step towards more sane time handling in the kernel -- this changestholo2004-06-211-9/+9
| | | | | | | | things such that code that only need a second-resolution uptime or wall time, and used to get that from time.tv_secs or mono_time.tv_secs now get this from separate time_t globals time_second and time_uptime. ok art@ niklas@ nordin@
* Eliminate a dereference after pool_put when an inactive/no-longer referencedmcbride2004-06-111-3/+5
| | | | | | table is destroyed in pfr_setflags_ktable. Fix from Chris Pascoe
* Make deletion of a few addresses much faster on big tables. ok claudio@cedric2004-06-071-3/+30
|
* tables like to allocate lots of memory at once. use the previoustedu2004-06-021-3/+3
| | | | pool allocator, _nointr. testing/ok beck@ cedric@
* Allow recursive anchors (anchors within anchors, up to 64dhartmei2004-05-191-36/+11
| | | | | | | levels deep). More work required, but this is already functional. authpf users will need to adjust their anchor calls, but this will change again soon. ok beck@, cedric@, henning@, mcbride@
* gcc3 shut up (from naddy@)pb2004-04-281-1/+2
|
* do not return herepb2004-04-281-2/+1
|
* Dont step into INET6 code, just because af != AF_INETpb2004-04-281-13/+36
| | | | | | Also comment #endif properly while being here ok mcbride@
* radix tree with multipath support. from kame. deraadt okitojun2004-04-251-3/+3
| | | | | | | | | | | | | user visible changes: - you can add multiple routes with same key (route add A B then route add A C) - you have to specify gateway address if there are multiple entries on the table (route delete A B, instead of route delete A) kernel change: - radix_node_head has an extra entry - rnh_deladdr takes extra argument TODO: - actually take advantage of multipath (rtalloc -> rtalloc_mpath)
* move some of the non-interrupt pools from the small kmem_map to the muchfrantzen2004-04-091-3/+3
| | | | larger kernel map
* KNF, ok cedric@ deraadt@mcbride2004-03-091-10/+12
|
* KNFdhartmei2004-02-101-4/+4
|
* KNFhenning2004-02-101-12/+12
|
* spacing. note this, cedricderaadt2003-12-311-2/+2
|
* Many improvements to the handling of interfaces in PF.cedric2003-12-311-46/+107
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) PF should do the right thing when unplugging/replugging or cloning/ destroying NICs. 2) Rules can be loaded in the kernel for not-yet-existing devices (USB, PCMCIA, Cardbus). For example, it is valid to write: "pass in on kue0" before kue USB is plugged in. 3) It is possible to write rules that apply to group of interfaces (drivers), like "pass in on ppp all" 4) There is a new ":peer" modifier that completes the ":broadcast" and ":network" modifiers. 5) There is a new ":0" modifier that will filter out interface aliases. Can also be applied to DNS names to restore original PF behaviour. 6) The dynamic interface syntax (foo) has been vastly improved, and now support multiple addresses, v4 and v6 addresses, and all userland modifiers, like "pass in from (fxp0:network)" 7) Scrub rules now support the !if syntax. 8) States can be bound to the specific interface that created them or to a group of interfaces for example: - pass all keep state (if-bound) - pass all keep state (group-bound) - pass all keep state (floating) 9) The default value when only keep state is given can be selected by using the "set state-policy" statement. 10) "pfctl -ss" will now print the interface scope of the state. This diff change the pf_state structure slighltly, so you should recompile your userland tools (pfctl, authpf, pflogd, tcpdump...) Tested on i386, sparc, sparc64 by Ryan Tested on macppc, sparc64 by Daniel ok deraadt@ mcbride@
* Rearchitecture of the userland/kernel IOCTL interface for transactions.cedric2003-09-261-1/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This brings us close to 100% atomicity for a "pfctl -f pf.conf" command. (some splxxx work remain in the kernel). Basically, improvements are: - Anchors/Rulesets cannot disappear unexpectedly anymore. - No more leftover in the kernel if "pfctl -f" fail. - Commit is now done in a single atomic IOCTL. WARNING: The kernel code is fully backward compatible, but the new pfctl/authpf userland utilities will only run on a new kernel. The following ioctls are deprecated (i.e. will be deleted sooner or later, depending on how many 3rd party utilities use them and how soon they can be upgraded): - DIOCBEGINRULES - DIOCCOMMITRULES - DIOCBEGINALTQS - DIOCCOMMITALTQS - DIOCRINABEGIN - DIOCRINADEFINE They are replaced by the following ioctls (yes, PF(4) will follow) which operate on a vector of rulesets: - DIOCXBEGIN - DIOCXCOMMIT - DIOCXROLLBACK Ok dhartmei@ mcbride@
* KNFhenning2003-08-221-6/+6
|
* This patch remove the restriction that tables cannot be used in routing orcedric2003-08-091-2/+122
| | | | | | | | | | | | | | | | | | redirection rules... The advantage of using tables in redirection/routing rules is not efficiency, in fact it will run slower than straight address pools. However, this brings a lot of flexibility to PF, allowing simple scripts/daemons to add/remove addresses from redirection/routing pools easily. This implementation support all table features, including cidr blocks and negated addresses. So specifying { 10.0.0.0/29 !10.0.0.0 !10.0.0.7 } will correctly round-robin between the six addresses: .1, .2, .3, .4, .5, .6. Tables can also be combined with simple addresses, so the following rule will work as expected: "nat on foo0 -> { 1.1.1.1 <bar> }" ok henning@ mcbride@
* Make table tickets per-ruleset instead of global.cedric2003-07-311-16/+28
| | | | | Make table tickets u_int32_t for consistency with other parts of PF. Ok dhartmei@ henning@
* KNFhenning2003-06-241-4/+4
|
* Returns the correct array size.cedric2003-06-081-7/+7
|
* A table in an anchor creates a real anchor: pfctl -sA works.cedric2003-06-081-20/+97
| | | | | | | The following two pfctl functions work with an "-a" option: - pfctl [-a foo[:bar]] -sT - pfctl [-a foo[:bar]] -FT ok dhartmei@
* Unused variable.cedric2003-05-241-3/+2
|
* Allow tables to be loaded into anchors.cedric2003-04-301-11/+99
| | | | | | Most pfctl table commands (excluding 'show' and 'flush') support the "-a" modifier. ok dhartmei@
* Update the pfioc_table IOCTL structure.cedric2003-04-271-5/+5
| | | | | | Prepare for anchors, improve robustness. WARNING: need to sync kernel/userland. ok dhartmei@
* KNFderaadt2003-04-041-2/+2
|
* - Add missing "\n" to some pf_table.c printf()cedric2003-03-211-15/+15
| | | | | | | | | | | | - Fix two problems with pfr_update_stats(). Filtering was done properly, only stats were wrong. People should upgrade their kernel if: - They use bidirectional rules (without "in" or "out") with tables. - They use tables in negated statements, like "block from !<foo>" Thanks to David Krause for discovering the problem. Ok dhartmei@ henning@
* Correctly flag out radix_node entries with RNF_ROOT flag set: this is notcedric2003-03-141-1/+15
| | | | | | | | a match. Before that patch, an IP packet with source or dest address of 0.0.0.0 could corrupt the kernel. People filtering DHCP packets on their firewall using tables should upgrade their kernel now. Thanks to Chris Cappuccio for the good bug report. Ok dhartmei@ henning@
* Plug slow memory leak (radix_mask structure).cedric2003-03-131-1/+20
| | | | | tested on i386 by me and Daniel on macppc. ok dhartmei@ henning@
* Small fixes after code review, mostly on error path.cedric2003-03-051-12/+8
| | | | ok dhartmei@ henning@ pb@
* splsoftnet() around rn_lookup() which is not thread-safe.cedric2003-02-281-1/+4
| | | | ok dhartmei@ henning@
* Repair IPv6 support for tables.cedric2003-02-271-3/+3
| | | | ok dhartmei@ henning@
* Labels should be followed by statements (fix gcc3 warning).henric2003-02-121-1/+4
| | | | ok cedric, jason, theo
* Fix another buglet with inactive sets.cedric2003-01-151-4/+7
| | | | | | table <foo> { 1.2.3.4 1.2.3.4 1.2.3.4 } Was causing the kernel to become noisy. Now duplicates are silently rejected.
* Fix a buglet when one "creates" a table which is already in thecedric2003-01-151-24/+26
| | | | | referenced or inactive set. Flags were not updated correctly. Tested on i386, sparc64. More regression tests coming.
* Cleanup NULL tests in and around pfr_destroy_ktable().cedric2003-01-151-14/+10
| | | | Makes code more readable.
* Kill stupid leaks when using FLAG_DUMMY option.cedric2003-01-151-5/+7
| | | | | Removes "_" from pool names. Regression tests for memory allocation coming soon....
* Improve robustness & error handling. More thorough checks of user data.cedric2003-01-131-35/+96
| | | | | | | | | - Reject invalid CIDR networks (1.2.3.4/16 & friends). - Only allow values 0 or 1 for the "neg" flag. - Require all unused data to be set to 0 in pfr_addr and pfr_table. - Always check the return value of pfr_route_entry(). - Remove redundant kernel messages. Tested on i386, sparc64. Pass my (uncommited) regression tests.
* Fix adding and deleting addresses in a table when there is a conflict withcedric2003-01-101-9/+19
| | | | | | | the "negated" attribute of an address. The previous behaviour was incorrect in both cases (too strict for the add command and too permissive for the delete command). ok dhartmei@
* Cosmetic change, makes code a bit easier to understand.cedric2003-01-101-5/+8
|
* (whitespace) KNF, re-fold -w 80dhartmei2003-01-091-5/+5
|
* Add support for active/inactive tablesets in the kernel.cedric2003-01-091-190/+459
| | | | | | | Add table definition/initialisation construct in pfctl parser. Add and fix documentation for pf.4 and pf.conf.5. Tested on i386 and sparc64 by myself, macppc by Daniel. ok dhartmei@
* Remove table name hashing (pass the name in each ioctl instead), anddhartmei2003-01-071-145/+78
| | | | | | introduce reference counting for tables, they are now automatically created and deleted through referencing rules. Diff partly from cedric@. ok mcbride@, henning@, cedric@
* Move initialisation of radix table globals in pfr_initialize()cedric2003-01-061-3/+17
| | | | ok dhartmei@
* knfderaadt2003-01-061-21/+19
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.