summaryrefslogtreecommitdiff
path: root/sys/contrib/pf/net/pfvar.h
Commit message (Collapse)AuthorAgeFilesLines
* o Create directory sys/netpfil, where all packet filters shouldGleb Smirnoff2012-09-141-1961/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi Notes: svn path=/head/; revision=240494
* Merge the projects/pf/head branch, that was worked on for last six months,Gleb Smirnoff2012-09-081-480/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into head. The most significant achievements in the new code: o Fine grained locking, thus much better performance. o Fixes to many problems in pf, that were specific to FreeBSD port. New code doesn't have that many ifdefs and much less OpenBSDisms, thus is more attractive to our developers. Those interested in details, can browse through SVN log of the projects/pf/head branch. And for reference, here is exact list of revisions merged: r232043, r232044, r232062, r232148, r232149, r232150, r232298, r232330, r232332, r232340, r232386, r232390, r232391, r232605, r232655, r232656, r232661, r232662, r232663, r232664, r232673, r232691, r233309, r233782, r233829, r233830, r233834, r233835, r233836, r233865, r233866, r233868, r233873, r234056, r234096, r234100, r234108, r234175, r234187, r234223, r234271, r234272, r234282, r234307, r234309, r234382, r234384, r234456, r234486, r234606, r234640, r234641, r234642, r234644, r234651, r235505, r235506, r235535, r235605, r235606, r235826, r235991, r235993, r236168, r236173, r236179, r236180, r236181, r236186, r236223, r236227, r236230, r236252, r236254, r236298, r236299, r236300, r236301, r236397, r236398, r236399, r236499, r236512, r236513, r236525, r236526, r236545, r236548, r236553, r236554, r236556, r236557, r236561, r236570, r236630, r236672, r236673, r236679, r236706, r236710, r236718, r237154, r237155, r237169, r237314, r237363, r237364, r237368, r237369, r237376, r237440, r237442, r237751, r237783, r237784, r237785, r237788, r237791, r238421, r238522, r238523, r238524, r238525, r239173, r239186, r239644, r239652, r239661, r239773, r240125, r240130, r240131, r240136, r240186, r240196, r240212. I'd like to thank people who participated in early testing: Tested by: Florian Smeets <flo freebsd.org> Tested by: Chekaluk Vitaly <artemrts ukr.net> Tested by: Ben Wilber <ben desync.com> Tested by: Ian FREISLICH <ianf cloudseed.co.za> Notes: svn path=/head/; revision=240233
* Correct table counter functionality to not panic.Ermal Luçi2012-05-311-0/+2
| | | | | | | | | | | This was caused by not proper initialization of necessary parameters. PR: 168200 Reviewed by: bz@, glebius@ MFC after: 1 week Notes: svn path=/head/; revision=236364
* Extend IPv6 routing lookups in pf(4) to use the new multi-FIB KPI.Bjoern A. Zeeb2012-02-031-6/+12
| | | | | | | | | | | | Try to make the "rtable" handling work but the current version of pf(4) does not fully support it yet as especially callers of PF_MISMATCHAW() are not fully FIB-aware. OpenBSD seems to have fixed this in a later version. Prepare as much as possible. Sponsored by: Cisco Systems, Inc. Notes: svn path=/projects/multi-fibv6/head/; revision=230944
* When running with INVARIANTS the mutex(9) code does all necessaryGleb Smirnoff2012-01-111-9/+2
| | | | | | | asserts for non-recursive mutexes. Notes: svn path=/head/; revision=229959
* Correct flag for uma_zalloc() is M_WAITOK. M_WAIT is an old andGleb Smirnoff2011-10-231-1/+1
| | | | | | | | | deprecated flag from historical mbuf(9) allocator. This is style only change. Notes: svn path=/head/; revision=226655
* De-virtualize the pf_task_mtx lock. At the current state of pf lockingBjoern A. Zeeb2011-10-191-9/+5
| | | | | | | | | | | | and virtualization it is not helpful but complicates things. Current state of art is to not virtualize these kinds of locks - inp_group/hash/info/.. are all not virtualized either. MFC after: 3 days Notes: svn path=/head/; revision=226536
* Adjust the PF_ASSERT() macro to what we usually use in the network stack:Bjoern A. Zeeb2011-10-191-4/+6
| | | | | | | | | PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days Notes: svn path=/head/; revision=226535
* In the non-FreeBSD case we do not expect PF_LOCK and friends to do anything.Bjoern A. Zeeb2011-10-191-13/+4
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=226533
* Update packet filter (pf) code to OpenBSD 4.5.Bjoern A. Zeeb2011-06-281-210/+588
| | | | | | | | | | | You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri Notes: svn path=/head/; revision=223637
* Adapt OpenBSD pf's "sloopy" TCP state machine which is useful for DirectXin LI2009-12-241-1/+4
| | | | | | | | | | | | | | | | | | Server Return mode, where not all packets would be visible to the load balancer or gateway. This commit should be reverted when we merge future pf versions. The benefit it would provide is that this version does not break any existing public interface and thus won't be a problem if we want to MFC it to earlier FreeBSD releases. Discussed with: mlaier Obtained from: OpenBSD Sponsored by: iXsystems, Inc. MFC after: 1 month Notes: svn path=/head/; revision=200930
* If we cannot immediately get the pf_consistency_lock in the purge thread,Max Laier2009-08-191-0/+5
| | | | | | | | | | | | | | restart the scan after acquiring the lock the hard way. Otherwise we might end up with a dead reference. Reported by: pfsense Reviewed by: eri Initial patch by: eri Tested by: pfsense Approved by: re (kib) Notes: svn path=/head/; revision=196372
* Build on Jeff Roberson's linker-set based dynamic per-CPU allocatorRobert Watson2009-07-141-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (DPCPU), as suggested by Peter Wemm, and implement a new per-virtual network stack memory allocator. Modify vnet to use the allocator instead of monolithic global container structures (vinet, ...). This change solves many binary compatibility problems associated with VIMAGE, and restores ELF symbols for virtualized global variables. Each virtualized global variable exists as a "reference copy", and also once per virtual network stack. Virtualized global variables are tagged at compile-time, placing the in a special linker set, which is loaded into a contiguous region of kernel memory. Virtualized global variables in the base kernel are linked as normal, but those in modules are copied and relocated to a reserved portion of the kernel's vnet region with the help of a the kernel linker. Virtualized global variables exist in per-vnet memory set up when the network stack instance is created, and are initialized statically from the reference copy. Run-time access occurs via an accessor macro, which converts from the current vnet and requested symbol to a per-vnet address. When "options VIMAGE" is not compiled into the kernel, normal global ELF symbols will be used instead and indirection is avoided. This change restores static initialization for network stack global variables, restores support for non-global symbols and types, eliminates the need for many subsystem constructors, eliminates large per-subsystem structures that caused many binary compatibility issues both for monitoring applications (netstat) and kernel modules, removes the per-function INIT_VNET_*() macros throughout the stack, eliminates the need for vnet_symmap ksym(2) munging, and eliminates duplicate definitions of virtualized globals under VIMAGE_GLOBALS. Bump __FreeBSD_version and update UPDATING. Portions submitted by: bz Reviewed by: bz, zec Discussed with: gnn, jamie, jeff, jhb, julian, sam Suggested by: peter Approved by: re (kensmith) Notes: svn path=/head/; revision=195699
* Step 1.5 of importing the network stack virtualization infrastructureMarko Zec2008-10-021-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from the vimage project, as per plan established at devsummit 08/08: http://wiki.freebsd.org/Image/Notes200808DevSummit Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator macros, and CURVNET_SET() context setting macros, all currently resolving to NOPs. Prepare for virtualization of selected SYSCTL objects by introducing a family of SYSCTL_V_*() macros, currently resolving to their global counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT(). Move selected #defines from sys/sys/vimage.h to newly introduced header files specific to virtualized subsystems (sys/net/vnet.h, sys/netinet/vinet.h etc.). All the changes are verified to have zero functional impact at this point in time by doing MD5 comparision between pre- and post-change object files(*). (*) netipsec/keysock.c did not validate depending on compile time options. Implemented by: julian, bz, brooks, zec Reviewed by: julian, bz, brooks, kris, rwatson, ... Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation Notes: svn path=/head/; revision=183550
* Make ALTQ cope with disappearing interfaces (particularly common with mpdMax Laier2008-03-291-0/+7
| | | | | | | | | | | | and netgraph in gernal). This also allows to add queues for an interface that is not yet existing (you have to provide the bandwidth for the interface, however). PR: kern/106400, kern/117827 MFC after: 2 weeks Notes: svn path=/head/; revision=177700
* Add two place holders in struct pf_rule for future netgraph integration.Max Laier2007-07-031-0/+2
| | | | | | | | Submitted by: Ermal Luçi Approved by: re (kensmith) Notes: svn path=/head/; revision=171174
* Commit resolved import of OpenBSD 4.1 pf from perforce.Max Laier2007-07-031-159/+252
| | | | | | | Approved by: re (kensmith) Notes: svn path=/head/; revision=171168
* Only decrement the max-src-conn counter for tcp connections that reachedMax Laier2005-12-251-0/+1
| | | | | | | | | | | | | | "established" state. Similar to OpenBSD's rev. 1.499 by joel but not breaking ABI. Obtained from: OpenBSD (with changes) Reported by: Bruno Afonso MFC after: 3 days X-MFC: together with local_flags Notes: svn path=/head/; revision=153725
* Move PFSTATE_EXPIRING from sync_flags to a new local_flags. sync_flags hasMax Laier2005-12-201-2/+4
| | | | | | | | | | | | special handling when zero. This caused no PFSYNC_ACT_DEL message and thus disfunction of pfflowd and state synchronisation in general. Discovered by: thompsa Good catch by: thompsa MFC after: 7 days Notes: svn path=/head/; revision=153545
* Prevent a race condition. As pf_send_tcp() - called for expired synproxyMax Laier2005-07-201-0/+3
| | | | | | | | | | | | | states - has to drop the lock when calling back to ip_output(), the state purge timeout might run and gc the state. This results in a rb-tree inconsistency. With this change we flag expiring states while holding the lock and back off if the flag is already set. Reported by: glebius MFC after: 2 weeks Notes: svn path=/head/; revision=148196
* Resolve conflicts created during the import of pf 3.7 Some features areMax Laier2005-05-031-64/+172
| | | | | | | | | | | missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI) Notes: svn path=/head/; revision=145836
* Add an additional struct inpcb * argument to pfil(9) in order to enableMax Laier2004-09-291-0/+11
| | | | | | | | | | | | | | | | | | | | | | passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in forseeable future. Suggested by: rwatson A lot of work by: csjp (he'd be even more helpful w/o mentor-reviews ;) Reviewed by: rwatson, csjp Tested by: -pf, -ipfw, LINT, csjp and myself MFC after: 3 days LOR IDs: 14 - 17 (not fixed yet) Notes: svn path=/head/; revision=135920
* Protect sockaddr_union definitions with a protecting define. This allows toMax Laier2004-09-231-10/+9
| | | | | | | | | | | build kernels with FAST_IPSEC and PF. This is the least disruptive fix. PR: kern/71836 Reviewed by: bms, various mailing lists MFC after: 3 days Notes: svn path=/head/; revision=135615
* Loopback fix from Daniel Hartmeier:Max Laier2004-08-121-0/+3
| | | | | | | | | | | | pf_cksum_fixup() was called without last argument from normalization, also fixup checksum when random-id modifies ip_id. This would previously lead to incorrect checksums for packets modified by scrub random-id. (Originally) Submitted by: yongari Notes: svn path=/head/; revision=133574
* Major overhaul of pseudo-interface cloning. Highlights include:Brooks Davis2004-06-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Split the code out into if_clone.[ch]. - Locked struct if_clone. [1] - Add a per-cloner match function rather then simply matching names of the form <name><unit> and <name>. - Use the match function to allow creation of <interface>.<tag> vlan interfaces. The old way is preserved unchanged! - Also the match function to allow creation of stf(4) interfaces named stf0, stf, or 6to4. This is the only major user visible change in that "ifconfig stf" creates the interface stf rather then stf0 and does not print "stf0" to stdout. - Allow destroy functions to fail so they can refuse to delete interfaces. Currently, we forbid the deletion of interfaces which were created in the init function, particularly lo0, pflog0, and pfsync0. In the case of lo0 this was a panic implementation so it does not count as a user visiable change. :-) - Since most interfaces do not need the new functionality, an family of wrapper functions, ifc_simple_*(), were created to wrap old style cloner functions. - The IF_CLONE_INITIALIZER macro is replaced with a new incompatible IFC_CLONE_INITIALIZER and ifc_simple consumers use IFC_SIMPLE_DECLARE instead. Submitted by: Maurycy Pawlowski-Wieronski <maurycy at fouk.org> [1] Reviewed by: andre, mlaier Discussed on: net Notes: svn path=/head/; revision=130933
* Commit pf version 3.5 and link additional files to the kernel build.Max Laier2004-06-161-66/+289
| | | | | | | | | | | | | | | Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ... Notes: svn path=/head/; revision=130613
* Prepare pf for building with ALTQ:Max Laier2004-06-131-4/+0
| | | | | | | | - remove old pfaltq module linkage - move pfaltq_running to pf_ioctl.c It is protected by PF_LOCK() Notes: svn path=/head/; revision=130397
* Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdefMax Laier2004-03-171-13/+13
| | | | | | | | | | | Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor) Notes: svn path=/head/; revision=127145
* Tweak existing header and other build infrastructure to be able to buildMax Laier2004-02-261-0/+5
| | | | | | | | | | pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor) Notes: svn path=/head/; revision=126263
* Bring diff from the security/pf port. This has code been tested as a portMax Laier2004-02-261-0/+141
| | | | | | | | | | | | | | | | for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general) Notes: svn path=/head/; revision=126261
* Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4vendor/pf-sys/3.4Max Laier2004-02-261-0/+1264
Approved by: bms(mentor), core (in general) Notes: svn path=/vendor-sys/pf/dist/; revision=126258 svn path=/vendor-sys/pf/3.4/; revision=126260; tag=vendor/pf-sys/3.4
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-16 12:01:48 +0000