summaryrefslogtreecommitdiffstats
path: root/sys/net (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* As requested by henning, move the mbuf pointer into struct pf_pdesc.bluhm2011-09-286-261/+259
| | | | | | Also sort pd to the beginning of the functions' parameter lists for consistency. ok henning
* As I have touched half of pf lines anyway, fix whitespaces now.bluhm2011-09-224-46/+47
| | | | KNF, no binary change.
* Check the protocol header length for tcp, udp, icmp, icmp6 inbluhm2011-09-213-9/+21
| | | | | | pf_setup_pdesc(). It is better to check and bail out early than to rely on pf_pull_hdr() later. ok henning mpf
* pf_setup_pdesc() panics if address family is neither AF_INET norbluhm2011-09-202-35/+32
| | | | | | | AF_INET6. So remove useless af switch defaults here and there. Always use "switch(af)" instead of "if (af) else" for af dependent code. Always use AF_ defines instead of PF_ when checking af values. ok claudio mpf henning
* Put kif and dir into pdesc an use this instead of passing the valuesbluhm2011-09-205-153/+144
| | | | | | around. This is a mechanical change. Initialize pd2 and use it where appropriate. ok henning on an earlier version; ok mpf
* Consolidate pf function parameters. Move off and hdrlen into pdescbluhm2011-09-195-197/+175
| | | | | | | | | and change their type from int to u_int32_t. Do not pass struct tcphdr *th and sa_family_t af, it is in pd anyway. Do not use af and pd->af intermixed, the latter makes clear where it comes from. Do not calculate the packet length again if pd already has it. Use pd2.off instead of off2. go go go go don't stop henning@ mpf@
* Move the pdesc initialization code into pf_setup_pdesc(). Unifybluhm2011-09-183-33/+29
| | | | | | some IPv4 and IPv6 code. Make sure that both code paths set the same fields in the same order. ok mpf henning
* Fix various format string types to as a minimum match the width of themiod2011-09-183-8/+8
| | | | | variables being processed. ok bluhm@ henning@
* Move the call to pf_test_rule() for fragments that have not beenbluhm2011-09-183-28/+21
| | | | | | | reassembled by normalization from pf_setup_pdesc() to pf_test(). This simplifies the paramter list of pf_setup_pdesc() as it can concentrate on its job filling the pf_pdesc struct. ok henning mpf
* The pd->ip_sum and pd->proto_sum fields are not needed. Replacebluhm2011-09-172-21/+15
| | | | | | the one occurrence in pf_test_state_icmp() that uses pd2.ip_sum by a local variable. Remove ip_sum and proto_sum from struct pf_pdesc. ok claudio henning
* move initialisation of pd->nsaddr and pd->ndaddr from pf_test_rule tohenning2011-09-171-15/+10
| | | | pf_setup_pdesc. fixes logging of packets passed statefully. ok bluhm
* Deduplicate IPv4 and IPv6 code that handles fragments that have notbluhm2011-09-171-30/+19
| | | | | been reassembled by normalization. ok henning claudio
* Add support for one shot rules that remove themselves from an activemikeb2011-08-303-3/+27
| | | | | | | | ruleset after match. In case this is the only rule in the anchor, the anchor will be destroyed automatically after the rule is matched. This is an extremely handy technique for firewall proxies. ok henning, mcbride
* Use the lowest available unit number for new pppx ifs. Somewhatjmatthew2011-08-211-5/+19
| | | | | | inefficient but doesn't matter with reasonable numbers of interfaces. ok dlg@
* Fix packet accounting in error cases.mcbride2011-08-203-7/+11
| | | | From Christiano F. Haesbaert.
* Remove redundant prototype for pf_socket_lookup().mpf2011-08-031-2/+1
| | | | | It's already in pfvar.h OK mcbride@
* someone (*cough*henning*cough*) made pf_state.state_flags a u_int16_tdlg2011-08-032-5/+9
| | | | | | | | | | | | | without growing it in pfsync_state too. to keep the wire format compat this uses some of the pad bytes to send all the state flags on the wire as well as maintaining the old state_flags field. after 5.0 we'll deprecate the original field and only use the new one. discussed with mcbride and deraadt and based on a diff from deraadt. tested against an "old" pfsync locally. ok mcbride@ henning@ deraadt@
* Replace one byte of padding with sa_family_t af in pfsync_state_key;mcbride2011-08-022-3/+7
| | | | | | | | Reject states with pfsync_state->af == 0 in pfsync_state_import(), in preparation for states which specify an address family in each state key instead (change will take place post-5.0). ok dlg henning mikeb
* Make sure we use the right tbl/dyn pointer to check the pfrkt_refcntcost;mcbride2011-07-291-7/+17
| | | | | | improved debugging for error cases inside the weighted round-robin loop. original diff from claudio, ok henning
* fix set skip group matching: don't match partial strings, i. e. 'set skip onhenning2011-07-281-2/+2
| | | | | | lo' must not match a group 'local'. diff from sthen who is not around for a few days, ok me and mpf. I can't find the mail of the guy who initially ran into this problem, sorry for that, thanks for reporting!
* Add support for weighted round-robin in load balancing pools and tables.mcbride2011-07-274-72/+202
| | | | | Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
* __arm32__ -> __arm__, since our new compiler isn't defining themartynas2011-07-261-2/+2
| | | | former anymore. OK miod@.
* OS fingerprinting can only be done on rules that explicitly specify TCPmcbride2011-07-241-6/+5
| | | | | | now, put it in the IPPROTO_TCP case of the pf_test_rule() inner loop. ok henning sthen
* Replace the IPv6 header walking loop in pf_test_state_icmp() withbluhm2011-07-231-61/+76
| | | | | | | | | | | | | the common function pf_walk_header6(). For that, pf_walk_header6() can now extract both the information wether it is a fragment and the final protocol if it is the first fragment. This allows to match the icmp6 too big packet of a first fragment to the reassembled packet's state. This is neccesary if a refragmented fragment is to big for the Path-MTU. Note that pd.proto contains the real protocol number for the first fragment and IPPROTO_FRAGMENT for later fragments. pd.virtual_protocol is set to PF_VPROTO_FRAGMENT for all fragments. ok mcbride@
* use ifmedia_delete_instance() when destroying a vetherderaadt2011-07-221-1/+2
| | | | from Martin Pelikan
* Sync 'block return' behaviour for ICMP packets with our IP stack:mcbride2011-07-221-3/+6
| | | | | | | | Rather than silently dropping ALL icmp packets, return icmp/icmp6 error for 'informational' message types (but continue dropping ICMP errors unconditionally). ok markus sthen henning
* fix typos, martin pelikanhenning2011-07-224-10/+10
|
* unbreak set-tos for ipv6; reported by babut at yandex dot ru,mikeb2011-07-181-2/+2
| | | | with input and ok from bluhm and claudio
* break up a line of code that involved a decrement operator and macrosjsg2011-07-121-2/+3
| | | | | | so it evaluates in the order we want. ok claudio@
* If ipv4+icmp6 or ipv6+icmp packets were embedded into an icmpbluhm2011-07-091-3/+15
| | | | | | payload, we missed to drop them. While there, also add a reason to the corresponding check in pf_test(). ok mcbride@ claudio@
* sned BPDUs at prio 6, just like lacp and carp, ryan zinke mpfhenning2011-07-091-1/+5
|
* mark the mgmt pkts for queueing prio 6, mpf okhenning2011-07-091-1/+4
|
* honor the net.inet.udp.checksum setting.dhill2011-07-092-9/+21
| | | | ok claudio henning yasuoka
* remove more atalk bitsderaadt2011-07-091-2/+1
|
* begone, fucking rotten appletalk shit. ok roomhenning2011-07-096-161/+5
|
* ensure that we won't enter an endless loop while iterating overmikeb2011-07-081-6/+12
| | | | | an address pool. problem found and solution tested by claudio. ok claudio, henning, "reads fine" to zinke
* Last part of pipex_{pppoe,l2tp,pptp}_input() are almost identical.yasuoka2011-07-082-128/+84
| | | | | | Integrate them into pipex_common_input(). ok hsuenaga@
* surprisingly, we use pf as classifier for the new priority queueinghenning2011-07-083-10/+42
| | | | | implementation. ok ryan mpf sthen and also testing pea and halex looked at it and commented as well
* new priority queueing implementation, extremely low overhead, thus fast.henning2011-07-082-46/+68
| | | | | unconditional, always on. 8 priority levels, as every better switch, the vlan header etc etc. ok ryan mpf sthen, pea tested as well
* Include PIPEX in kernel by default. And add new sysctl variableyasuoka2011-07-083-9/+47
| | | | | | | | `net.pipex.enable' to enable PIPEX. By default, pipex is disabled and it will not process packets from wire. Update man pages and update HOWTO_PIPEX_NPPPD.txt for testers. discussed with dlg@, ok deraadt@ mcbride@ claudio@
* Increase sdl_data so that more then IFNAMSIZ bytes are available.claudio2011-07-081-4/+5
| | | | | Additionally round the sizeof(struct sockaddr_dl) to a power of 2. OK guenther@ deraadt@
* We should not have any direct initialization of ifq structures.mcbride2011-07-071-3/+3
| | | | | | (in this case it's unnecessary, bss is initialized to zero at boot) ok henning
* There were two loops in pf_setup_pdesc() and pf_normalize_ip6()bluhm2011-07-073-204/+200
| | | | | | | | walking over the IPv6 header chain. Merge them into one loop, adjust some length checks and fix IPv6 jumbo option handling. Also allow strange but legal IPv6 packets with plen=0 passing through pf. IPv6 jumbo packets still get dropped. testing dhill@; ok mcbride@ henning@
* use IF_LEN/IFQ_LEN to access and ifqueue's length field. ryan okhenning2011-07-073-8/+8
| | | | | with this nothing in the tree fiddles if ifqueue internals any more, of course except if.c and if.h (and some altq)
* provide IF_LEN and IFQ_LEN to access ifq_len on an ifqueue, ryan okhenning2011-07-071-1/+3
|
* Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzderaadt2011-07-073-5281/+16
| | | | | | | | | | | | code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
* Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesmcbride2011-07-073-220/+179
| | | | | | | | | | a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
* another case of "clever" fiddling with ifq internals, just stumbled overhenning2011-07-071-4/+6
| | | | | this in my monster diff and wondered that i hadn't put that in already... claudio ryan ok
* ppp_ifstart unconditionally. depending on ALTQ for this is ridiculous.henning2011-07-061-12/+1
| | | | one tree less in my forest (for a few seconds)! ok claudio
* and make sppp_qflush a wrapper around IF_PURGE instead of handrollinghenning2011-07-061-11/+2
| | | | | the same, ok'd with IFQ_PURGE with happens to break on altq kernels by claudio, ryan and bluhm
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.