summaryrefslogtreecommitdiff
path: root/sys/contrib
Commit message (Collapse)AuthorAgeFilesLines
* MFC 1.28:Gleb Smirnoff2005-04-251-2/+2
| | | | | | | | | | Fix error in synproxy connection completion. Source and destination windows were confused, one instead of other. Approved by: re (kensmith) Notes: svn path=/releng/5.4/; revision=145506
* MFC 1.27:Gleb Smirnoff2005-04-151-0/+2
| | | | | | | | | | | | | Fix mss byte order, only affects synproxy code path. Submitted by: John L. Scarfone via OpenBSD Reviewed by: mlaier Obtained from: OpenBSD, rev. 1.483 Approved by: re (kensmith) Notes: svn path=/stable/5/; revision=145107
* MFC gui_lib.c,v 1.4:David Schultz2005-03-291-1/+1
| | | | | | | | | Don't read past the end of pVDevice[]. Approved by: re Notes: svn path=/stable/5/; revision=144272
* Merge a series of changes from HEAD to RELENG_5 that properly enableRobert Watson2005-03-1312-74/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fine-grained locking for ipfilter. This is an approximate merge of several overlapping changes introduced due to build problems with the original changes, first attempted fixes, second attempted fixes, et al. ip_auth.c:1.37, ip_compat.h:1.24, ip_frag.c:1.26, ip_log.c:1.28, ip_nat.h:1.22, ip_proxy.c:1.23, ip_state.c:1.34, ip_state.h:1.16, mlfk_ipl.c:1.14 Enable fine grained locking within IPFilter, using mtx(9) and sx(9) allowing the the "needs giant" flag to be removed from the driver. fil.c:1.41, ip_file.c:1.50, ip_fil.h:1.28 Sprinkle in some __FreeBSD_version checks so that this compiles again. Don't define PFIL_HOOKS anymore. Submitted by: keramida || (__FreeBSD_version >= 503000) ip_fil.h:1.29 Darnit, through a maze of twisty passages, ipfilter needs to have PFIL_HOOKS defined. Revert part of the previous commit to fix this. fil.c:1.42, ip_fil.c:1.51 * The #ifdef's to cause mutex's for freebsd to be declared were meant to pick up on USE_MUTEX being defined, but this patch * Remove some code that's in a #ifndef FreeBSD that's no longer used. ip_auth.c:1.38 * Remove some code that's in a #ifndef FreeBSD that's no longer used. This collective set of changes should reduce/eliminate reported crashes associated with ipfilter and SMP configurations. Timeout: darrenr Approved by: re (kensmith) Tested by: nectar Notes: svn path=/stable/5/; revision=143526
* MFC: pf_if.c, rev. 1.8Pyun YongHyeon2005-02-251-1/+8
| | | | | | | | | | Fix inteface clear time. pf printed "Thu Jan 1 09:00:01 1970" in "pfctl -vvsI" output when pf was statically linked to kernel. Discussed with: mlaier Notes: svn path=/stable/5/; revision=142434
* MFC: pf_if.c, rev. 1.9Max Laier2005-02-241-2/+5
| | | | | | | | | | | | Fix a terrible braino in pfi_maybe_destroy() and unbreak "$pfctl -Fall" with renamed interfaces. PR: kern/77645 Reported by: Harald Schmalzbauer <harryNOschmalzbauerSPAMde> Reviewed by: yongari Notes: svn path=/stable/5/; revision=142380
* MFC 1.26: Use the packet's address family instead of the rule's whenDaniel Hartmeier2005-01-281-1/+1
| | | | | | | | | | | selecting a replacement address for an rdr rule. Some rdr rules have no address family (when the replacement is a table and no other criterion implies one AF). In this case, pf would fail to select a replacement address and drop the packet due to translation failure. Notes: svn path=/stable/5/; revision=140937
* MFC 1.17: Prohibit ruleset changes at securelevel > 2, not > 1. It'sDaniel Hartmeier2005-01-211-1/+1
| | | | | | | | | | documented like this in init(8), but the code didn't match the documentation. PR: kern/76526 Notes: svn path=/stable/5/; revision=140593
* MFC 1.1.1.23: Fix small memory leak with implicit return from _STA.Nate Lawson2005-01-151-0/+7
| | | | Notes: svn path=/stable/5/; revision=140277
* MFC 1.1.1.23: Fix implicit return for external methods (e.g., _STA)Nate Lawson2005-01-131-1/+2
| | | | Notes: svn path=/stable/5/; revision=140160
* MFC 1.25: Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,Daniel Hartmeier2004-12-221-3/+5
| | | | | | | | | | | | | | | prevents a possible endless loop in pf_get_sport() with 'static-port' ICMP state entries use the ICMP ID as port for the unique state key. When checking for a usable key, construct the key in the same way. Otherwise, a colliding key might be missed or a state insertion might be refused even though it could be inserted. The second case triggers the endless loop, possibly allowing a NATed LAN client to lock up the kernel. Notes: svn path=/stable/5/; revision=139155
* MFC of ACPI-CA 20041119 import.Mark Santcroos2004-12-1999-1902/+3903
| | | | Notes: svn path=/stable/5/; revision=139029
* MFC ip_nat.c rev. 1.37:Max Laier2004-12-181-1/+1
| | | | | | | | | Make ip_nat compile again. Should read #if->n<-def LARGE_NAT as in ipf 4.x Insta-MFC approved by: scottl Notes: svn path=/stable/5/; revision=139006
* Move two variables that are unused if LARGE_NAT is defined inside an #ifdefDarren Reed2004-12-171-1/+4
| | | | | | | | | to keep them out of harms way when compiling. PR: 72783 Notes: svn path=/stable/5/; revision=138979
* Allow ipnat redirect rules to work for non-TCP/UDP packets.Darren Reed2004-12-171-2/+4
| | | | | | | | | | PR: 70038 Submitted by: fming@borderware.com Reviewed by: darrenr Obtained from: fming@borderware.com Notes: svn path=/stable/5/; revision=138947
* Using just m_pullup to get all of the interesting bits in packet into oneDarren Reed2004-12-161-1/+6
| | | | | | | | | | buffer doesn't work for ipv6 packets, so use m_defrag() here instead as an easy drop-in replacement. PR: 70399 Notes: svn path=/stable/5/; revision=138928
* MFC: IPv6 packets can contain headers (like options) before the TCP/UDP/Daniel Hartmeier2004-12-131-3/+6
| | | | | | | | | | | ICMP6 header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing the header chain. In the case where headers are skipped, the protocol checksum verification used the wrong length (included the skipped headers), leading to incorrectly mismatching checksums. Such IPv6 packets with headers were silently dropped. Notes: svn path=/stable/5/; revision=138793
* MFC: fix a bug that leads to a crash when binat rules of the formDaniel Hartmeier2004-12-061-1/+1
| | | | | | | | 'binat from ... to ... -> (if)' are used, where the interface is dynamic. Notes: svn path=/stable/5/; revision=138466
* MFC, pf_if.c rev. 1.7:Max Laier2004-11-241-17/+12
| | | | | | | | | | | | | Improved interface handling. This fixes the use of renamed interfaces (ifconfig xl0 name foo) as well as some special interfaces such as the 6to4 tunnel. Reported by: Ed Schouten <ed (at) il ! fontys , nl> Tested by: freebsd-pf PR: kern/72444 Notes: svn path=/stable/5/; revision=138052
* MFC pf_if.c, 1.6:Max Laier2004-11-081-2/+10
| | | | | | | | | | | | | | | | | | | | Reactivate skipping over bogus IPCP addresses on ppp interfaces. Be more careful with the skip condition this time. Addresses are only not taken into account if: - The interface is POINTTOPOINT - There is no route installed for the address - The user specified noalias (:0) and - We are looking at an IPv4 address. This should be enough paranoia to not cause any false positives. PR: misc/69954 Discussed with: yongari Another forgotten MFC :-( ... 5.4R then ... Notes: svn path=/stable/5/; revision=137385
* MFC pf.c, 1.21:Max Laier2004-11-081-0/+5
| | | | | | | | | | | | | | | | | | Fix a panic discovered with some apache2 configure test (that seemed to trigger a socket creation race some some kind). Checking for non-NULL socket and credential is not a bad idea anyway. Unfortunatly too late for the release. Reported & tested by: Gilbert Cao I completly forgot about this when the release was pushed back. Depending on the new maintance policies for RELENG_5_3 it might be a candidate. Let's just not forget ... I hope the MFC reminder works here ... MFC after: 2 weeks Notes: svn path=/stable/5/; revision=137371
* This commit was manufactured by cvs2svn to create branch 'RELENG_5'.cvs2svn2004-10-2413-0/+6514
| | | | Notes: svn path=/stable/5/; revision=136863
* MFC pfil API change:Max Laier2004-10-034-16/+137
| | | | | | | | | | | | | | | | | | Add an additional struct inpcb * argument to pfil(9) in order to enable passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. Suggested by: rwatson A lot of work by: csjp LOR IDs: 14 - 17 (not fixed yet) Approved by: re (scottl) Notes: svn path=/stable/5/; revision=136098
* MFC from pfvar.h, rev. 1.9 and keydb.h, rev. 1.4Max Laier2004-09-301-10/+9
| | | | | | | | | | | | | | > Protect sockaddr_union definitions with a protecting define. This allows > to build kernels with FAST_IPSEC and PF. This is the least disruptive > fix. > > PR: kern/71836 > Reviewed by: bms, various mailing lists Approved by: re (scottl) Notes: svn path=/stable/5/; revision=135989
* Undo incrementing __FreeBSD_version and have IPFILTER check against 503000Andre Oppermann2004-09-222-2/+2
| | | | | | | | | | | instead. This works just as well because it didn't check before for this at all. Pointed out by: ceri Approved by: re (implicit) Notes: svn path=/stable/5/; revision=135582
* MFC: Make PFIL_HOOKS a permanent part of the kernel and remove the associatedAndre Oppermann2004-09-222-2/+3
| | | | | | | | | kernel compile option. Approved by: re (scottl) Notes: svn path=/stable/5/; revision=135580
* MFC: boot order change:Max Laier2004-09-203-3/+3
| | | | | | | | | | | | | | | | | | | Move pf* init from SI_SUB_PSEUDO to SI_SUB_PROTO_IFATTACHDOMAIN where it is save to call if_attachdomain from if_attach() (as done for if_loop.c). We will now end up with a properly initialized if_afdata array and the nd6 callout will no longer try to deref a NULL pointer. Still this is a temp workaround and the locking for if_afdata should be revisited at a later point. Requested by: rwatson Discussed with and tested by: yongari (a while ago) PR: kern/70393 Approved by: re (scottl) Notes: svn path=/stable/5/; revision=135521
* MFC: pf_ioctl.c, rev. 1.15:Max Laier2004-09-201-41/+83
| | | | | | | | | | | | | | | | Break out altq_enable/disable from DIOC{START,STOP}ALTQ into seprate functions that can be called from enable/disable pf as well. This improves switching from non-altq ruleset to altq ruleset (and the other way 'round) by a great deal and makes pfctl act like the user would except it to. PR: kern/71746 Tested by: Aurilien "beorn" Rougemont (PR submitter) Approved by: re (scottl) Notes: svn path=/stable/5/; revision=135519
* MFC pf.c, rev. 1.19:Max Laier2004-09-171-3/+2
| | | | | | | | | | | | | | | One more round on the H/W supported checksum code: Fix NICs that can't do the pseudo header. We really need the TCP packet length here. This happens to end up in ip->ip_len in tcp_input.c, but here we should get it from the len function variable instead. Submitted by: yongari Tested by: Nicolas Linard, yongari (sparc64 + hme) Approved by: re (scottl) Notes: svn path=/stable/5/; revision=135390
* MT5:Max Laier2004-08-291-0/+5
| | | | | | | | | | | | | | | | | Fix securelevel handling for tables: Loopback a fix from Cedric Berger: Fix table add/replace commands with securelevel=2. Reported by James J. Lippard. and Use securelevel_gt instead of reading global securelevel unprotected. Approved by: re (kensmith) Notes: svn path=/stable/5/; revision=134484
* Comment out rev. 1.4 after problems w/ IPv6, a better solution must beMax Laier2004-08-161-0/+2
| | | | | | | found. Notes: svn path=/head/; revision=133872
* Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSDDavid Malone2004-08-142-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | have already done this, so I have styled the patch on their work: 1) introduce a ip_newid() static inline function that checks the sysctl and then decides if it should return a sequential or random IP ID. 2) named the sysctl net.inet.ip.random_id 3) IPv6 flow IDs and fragment IDs are now always random. Flow IDs and frag IDs are significantly less common in the IPv6 world (ie. rarely generated per-packet), so there should be smaller performance concerns. The sysctl defaults to 0 (sequential IP IDs). Reviewed by: andre, silby, mlaier, ume Based on: NetBSD MFC after: 2 months Notes: svn path=/head/; revision=133720
* Since if_oltr doesn't contain locking or run with INTR_MPSAFE, markRobert Watson2004-08-141-1/+1
| | | | | | | the interface as IFF_NEEDSGIANT so if_start is run holding Giant. Notes: svn path=/head/; revision=133705
* Loopback fix from Mathieu Sauve-Frankel:Max Laier2004-08-121-2/+3
| | | | | | | | Add missing check for NULL in DIOCCHANGERULE. This prevents a crash in certain rare cases. Notes: svn path=/head/; revision=133577
* Loopback fix from Daniel Hartmeier:Max Laier2004-08-123-7/+13
| | | | | | | | | | | | pf_cksum_fixup() was called without last argument from normalization, also fixup checksum when random-id modifies ip_id. This would previously lead to incorrect checksums for packets modified by scrub random-id. (Originally) Submitted by: yongari Notes: svn path=/head/; revision=133574
* Loopback fix from Henning Brauer:Max Laier2004-08-121-0/+4
| | | | | | | | | | skip over interface addresses without IFA_ROUTE, fixes some issue with pppd PR: misc/69954 Notes: svn path=/head/; revision=133573
* Exclusion list for easier import.Hartmut Brandt2004-08-111-0/+15
| | | | Notes: svn path=/head/; revision=133495
* This commit was generated by cvs2svn to compensate for changes in r133492,Hartmut Brandt2004-08-1111-65/+67
|\ | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=133493
| * Virgin import of NgATM shared kernel/user part 1.1vendor/ngatm/1.1Hartmut Brandt2004-08-1111-65/+67
| | | | | | | | | | Notes: svn path=/vendor-sys/ngatm/dist/; revision=133492 svn path=/vendor-sys/ngatm/1.1/; revision=133494; tag=vendor/ngatm/1.1
* | Use in_cksum_skip() to calculate in4_cksum instead of doing handrolled magicMax Laier2004-08-051-279/+12
| | | | | | | | | | | | | | | | | | | | | | (that does not compile with !gcc). Moreover we get the benefit for all archs that have a hand optimized in_cksum_skip(). Submitted by: yongari Tested by: me (i386, extensivly), pf4freebsd ML (various) Notes: svn path=/head/; revision=133181
* | Initialize s variable early to shut up GCC warnings.Alexander Kabaev2004-07-284-14/+31
| | | | | | | | | | | | | | | | | | | | Do not declare inline functions without body as this is useless in general and generates a warning with GCC 3.4.x. Glanced over by: dhartmei Notes: svn path=/head/; revision=132767
* | Fix the following LOR on pf module unload:Max Laier2004-07-231-4/+4
| | | | | | | | | | | | | | | | | | | | 1st ifnet (ifnet) @/usr/src/sys/contrib/pf/net/pf_if.c:191 2nd pf task mtx (pf task mtx) @/usr/src/sys/contrib/pf/net/pf_if.c:197 Reported by: Pyun YongHyeon (a long time ago) Notes: svn path=/head/; revision=132567
* | Refine pf_check_proto_cksum() a bit in order to avoid additional in_pseudo()Max Laier2004-07-231-25/+22
| | | | | | | | | | | | | | | | | | | | | | calls further down the stack. If we find the cksum to be okay we pretend that the hardware did all the work and hence keep the upper layers from checking again. Submitted by: Pyun YongHyeon Notes: svn path=/head/; revision=132566
* | Fix a stupid attemp to apply host arithmetics to network byte ordered data.Max Laier2004-07-181-1/+1
| | | | | | | | | | | | | | | | | | | | This fixes checksum for some drivers with partial H/W ckcsum offloads. Reported by: Simon 'corecode' Schubert, Devon H. O'Dell, hmp Reviewed by: Pyun YongHyeon Notes: svn path=/head/; revision=132350
* | m_tag_copy takes an additional "how" parameter in FreeBSD.Max Laier2004-07-181-0/+8
| | | | | | | | | | | | | | Submitted by: rwatson Notes: svn path=/head/; revision=132321
* | Merge in a stable fix from OpenBSD:Max Laier2004-07-171-52/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | MFC: Fix by dhartmei@ change pf_route() loop detection: introduce a counter (number of times a packet is routed already) in the mbuf tag, allow at most four times. Fixes some legitimate cases broken by the previous change. Reviewed by: dhartmei Notes: svn path=/head/; revision=132303
* | Define semantic of M_SKIP_FIREWALL more precisely, i.e. also pass associatedMax Laier2004-07-171-10/+29
| | | | | | | | | | | | | | | | | | | | | | icmp_error() packets. While here retire PACKET_TAG_PF_GENERATED (which served the same purpose) and use M_SKIP_FIREWALL in pf as well. This should speed up things a bit as we get rid of the tag allocations. Discussed with: juli Notes: svn path=/head/; revision=132280
* | Send the fla driver in the AtticPoul-Henning Kamp2004-07-137-1614/+0
| | | | | | | | Notes: svn path=/head/; revision=132113
* | Clean up a bunch of white-space difference with IPFilter source as well asDarren Reed2004-07-111-9/+8
| | | | | | | | | | | | | | | | remove some superfluous assignments for .d_version/.d_flags in a cdevsw structure initialisation that never sees the light of day in FreeBSD. Notes: svn path=/head/; revision=131974
* | This commit was generated by cvs2svn to compensate for changes in r131826,Hartmut Brandt2004-07-0855-149/+7612
|\| | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=131827
generated by cgit v1.3 (git 2.53.0) at 2026-07-26 22:24:44 +0000