diff options
author | Andre Oppermann <andre@FreeBSD.org> | 2004-08-27 15:16:24 +0000 |
---|---|---|
committer | Andre Oppermann <andre@FreeBSD.org> | 2004-08-27 15:16:24 +0000 |
commit | c21fd2326029e665c0e5cff99de267778ce6b6a5 (patch) | |
tree | 2f8a616b3f6fffde5d0da52a85305bbcf5376c9f /sys/netinet6 | |
parent | 9e4211a1b813baec6cf2a3197e5b0c82606a9738 (diff) | |
download | src-c21fd2326029e665c0e5cff99de267778ce6b6a5.tar.gz src-c21fd2326029e665c0e5cff99de267778ce6b6a5.zip |
Always compile PFIL_HOOKS into the kernel and remove the associated kernel
compile option. All FreeBSD packet filters now use the PFIL_HOOKS API and
thus it becomes a standard part of the network stack.
If no hooks are connected the entire packet filter hooks section and related
activities are jumped over. This removes any performance impact if no hooks
are active.
Both OpenBSD and DragonFlyBSD have integrated PFIL_HOOKS permanently as well.
Notes
Notes:
svn path=/head/; revision=134383
Diffstat (limited to 'sys/netinet6')
-rw-r--r-- | sys/netinet6/ip6_forward.c | 16 | ||||
-rw-r--r-- | sys/netinet6/ip6_input.c | 20 | ||||
-rw-r--r-- | sys/netinet6/ip6_output.c | 14 | ||||
-rw-r--r-- | sys/netinet6/ip6_var.h | 4 |
4 files changed, 22 insertions, 32 deletions
diff --git a/sys/netinet6/ip6_forward.c b/sys/netinet6/ip6_forward.c index 689404b61369..94206abe0809 100644 --- a/sys/netinet6/ip6_forward.c +++ b/sys/netinet6/ip6_forward.c @@ -34,7 +34,6 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_ipsec.h" -#include "opt_pfil_hooks.h" #include <sys/param.h> #include <sys/systm.h> @@ -50,9 +49,7 @@ #include <net/if.h> #include <net/route.h> -#ifdef PFIL_HOOKS #include <net/pfil.h> -#endif #include <netinet/in.h> #include <netinet/in_var.h> @@ -578,18 +575,19 @@ ip6_forward(m, srcrt) in6_clearscope(&ip6->ip6_src); in6_clearscope(&ip6->ip6_dst); -#ifdef PFIL_HOOKS - /* - * Run through list of hooks for output packets. - */ + /* Jump over all PFIL processing if hooks are not active. */ + if (inet6_pfil_hook.ph_busy_count == -1) + goto pass; + + /* Run through list of hooks for output packets. */ error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT); if (error != 0) goto senderr; if (m == NULL) goto freecopy; ip6 = mtod(m, struct ip6_hdr *); -#endif /* PFIL_HOOKS */ +pass: error = nd6_output(rt->rt_ifp, origifp, m, dst, rt); if (error) { in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard); @@ -605,9 +603,7 @@ ip6_forward(m, srcrt) } } -#ifdef PFIL_HOOKS senderr: -#endif if (mcopy == NULL) return; switch (error) { diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index e11cef16cc70..e5bb0c3e99e1 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -65,7 +65,6 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_ipsec.h" -#include "opt_pfil_hooks.h" #include <sys/param.h> #include <sys/systm.h> @@ -86,9 +85,7 @@ #include <net/if_dl.h> #include <net/route.h> #include <net/netisr.h> -#ifdef PFIL_HOOKS #include <net/pfil.h> -#endif #include <netinet/in.h> #include <netinet/in_systm.h> @@ -139,9 +136,7 @@ int ip6_sourcecheck_interval; /* XXX */ int ip6_ours_check_algorithm; -#ifdef PFIL_HOOKS struct pfil_head inet6_pfil_hook; -#endif /* firewall hooks */ ip6_fw_chk_t *ip6_fw_chk_ptr; @@ -181,13 +176,14 @@ ip6_init() if (pr->pr_domain->dom_family == PF_INET6 && pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) ip6_protox[pr->pr_protocol] = pr - inet6sw; -#ifdef PFIL_HOOKS + + /* Initialize packet filter hooks. */ inet6_pfil_hook.ph_type = PFIL_TYPE_AF; inet6_pfil_hook.ph_af = AF_INET6; if ((i = pfil_head_register(&inet6_pfil_hook)) != 0) printf("%s: WARNING: unable to register pfil hook, " "error %d\n", __func__, i); -#endif /* PFIL_HOOKS */ + ip6intrq.ifq_maxlen = ip6qmaxlen; mtx_init(&ip6intrq.ifq_mtx, "ip6_inq", NULL, MTX_DEF); netisr_register(NETISR_IPV6, ip6_input, &ip6intrq, 0); @@ -233,9 +229,7 @@ ip6_input(m) struct ifnet *deliverifp = NULL; struct sockaddr_in6 sa6; u_int32_t srczone, dstzone; -#ifdef PFIL_HOOKS struct in6_addr odst; -#endif int srcrt = 0; GIANT_REQUIRED; /* XXX for now */ @@ -417,7 +411,6 @@ ip6_input(m) } } -#ifdef PFIL_HOOKS /* * Run through list of hooks for input packets. * @@ -426,14 +419,19 @@ ip6_input(m) * tell ip6_forward to do the right thing. */ odst = ip6->ip6_dst; + + /* Jump over all PFIL processing if hooks are not active. */ + if (inet6_pfil_hook.ph_busy_count == -1) + goto passin; + if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN)) return; if (m == NULL) /* consumed by filter */ return; ip6 = mtod(m, struct ip6_hdr *); srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); -#endif /* PFIL_HOOKS */ +passin: /* * Check with the firewall... */ diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index f5c35594e8ed..bdee8febe770 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -65,7 +65,6 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_ipsec.h" -#include "opt_pfil_hooks.h" #include <sys/param.h> #include <sys/malloc.h> @@ -80,9 +79,7 @@ #include <net/if.h> #include <net/route.h> -#ifdef PFIL_HOOKS #include <net/pfil.h> -#endif #include <netinet/in.h> #include <netinet/in_var.h> @@ -936,16 +933,17 @@ skip_ipsec2:; m->m_pkthdr.rcvif = NULL; } -#ifdef PFIL_HOOKS - /* - * Run through list of hooks for output packets. - */ + /* Jump over all PFIL processing if hooks are not active. */ + if (inet6_pfil_hook.ph_busy_count == -1) + goto passout; + + /* Run through list of hooks for output packets. */ error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT); if (error != 0 || m == NULL) goto done; ip6 = mtod(m, struct ip6_hdr *); -#endif /* PFIL_HOOKS */ +passout: /* * Send the packet to the outgoing interface. * If necessary, do IPv6 fragmentation before sending. diff --git a/sys/netinet6/ip6_var.h b/sys/netinet6/ip6_var.h index 36bf36dfcc3a..2841b635dbba 100644 --- a/sys/netinet6/ip6_var.h +++ b/sys/netinet6/ip6_var.h @@ -318,9 +318,7 @@ extern int ip6_use_tempaddr; /* whether to use temporary addresses. */ extern int ip6_prefer_tempaddr; /* whether to prefer temporary addresses in the source address selection */ -#ifdef PFIL_HOOKS -extern struct pfil_head inet6_pfil_hook; -#endif +extern struct pfil_head inet6_pfil_hook; /* packet filter hooks */ extern struct pr_usrreqs rip6_usrreqs; struct sockopt; |