aboutsummaryrefslogtreecommitdiff
path: root/sys/net/pfil.c
Commit message (Collapse)AuthorAgeFilesLines
* The r48589 promised to remove implicit inclusion of if_var.h soon. PrepareGleb Smirnoff2013-10-261-0/+1
| | | | | | | | | | | to this event, adding if_var.h to files that do need it. Also, include all includes that now are included due to implicit pollution via if_var.h Sponsored by: Netflix Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=257176
* ename PFIL_LIST_[UN]LOCK() to PFIL_HEADLIST_[UN]LOCK() to avoidAndre Oppermann2013-08-241-7/+7
| | | | | | | confusion with the pfil_head chain locking macros. Notes: svn path=/head/; revision=254774
* Resolve the confusion between the head_list and the hook list.Andre Oppermann2013-08-241-25/+29
| | | | | | | | | | | | | | The linked list of pfil hooks is changed to "chain" and this term is applied consistently. The head_list remains with "list" term. Add KASSERT to vnet_pfil_uninit(). Update and extend comments. Reviewed by: eri (previous version) Notes: svn path=/head/; revision=254773
* Internalize pfil_hook_get(). There are no outside consumers ofAndre Oppermann2013-08-241-0/+13
| | | | | | | | | | this API, it is only safe for internal use and even the pfil(9) man page says so in the BUGS section. Reviewed by: eri Notes: svn path=/head/; revision=254771
* Convert one instance of pfil hook callback missed in r254769.Andre Oppermann2013-08-241-4/+1
| | | | Notes: svn path=/head/; revision=254770
* Introduce typedef for pfil hook callback function and replace allAndre Oppermann2013-08-241-7/+3
| | | | | | | | | spelled out occurrences with it. Reviewed by: eri Notes: svn path=/head/; revision=254769
* Fix style and comments.Andrey V. Elsukov2013-03-191-4/+11
| | | | Notes: svn path=/head/; revision=248490
* Remove the recently added sysctl variable net.pfil.forward.Andrey V. Elsukov2012-11-021-6/+0
| | | | | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre Notes: svn path=/head/; revision=242463
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnAndrey V. Elsukov2012-10-251-0/+6
| | | | | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks Notes: svn path=/head/; revision=242079
* Make PFIL use per-VNET lock instead of per-AF lock. Since most used packetAlexander V. Chernikov2012-10-221-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | | filters (ipfw and PF) use the same ruleset with the same lock for both AF_INET and AF_INET6 there is no need in more fine-grade locking. However, it is possible to request personal lock by specifying PFIL_FLAG_PRIVATE_LOCK flag in pfil_head structure (see pfil.9 for more details). Export PFIL lock via rw_lock(9)/rm_lock(9)-like API permitting pfil consumers to use this lock instead of own lock. This help reducing locks on main traffic path. pfil_assert() is currently not implemented due to absense of rm_assert(). Waiting for some kind of r234648 to be merged in HEAD. This change is part of bigger patch reducing routing locking. Sponsored by: Yandex LLC Reviewed by: glebius, ae OK'd by: silence on net@ MFC after: 3 weeks Notes: svn path=/head/; revision=241888
* Clean up comments, white space, and style in pfil.c (especially new VNETRobert Watson2009-10-191-30/+28
| | | | | | | | | bits). MFC after: 3 days (not VNET bits) Notes: svn path=/head/; revision=198233
* Line-wrap pfil.c so that it prints more nicely.Robert Watson2009-10-181-6/+10
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=198198
* Virtualize the pfil hooks so that different jails may chose differentJulian Elischer2009-10-111-5/+48
| | | | | | | | | | | packet filters. ALso allows ipfw to be enabled on on ejail and disabled on another. In 8.0 it's a global setting. Sitting aroung in tree waiting to commit for: 2 months MFC after: 2 months Notes: svn path=/head/; revision=197952
* A few locking fixes and cleanups to pfil hook registration,Robert Watson2008-12-161-32/+10
| | | | | | | | | | | | | | | | | | | | | | | unregistration, and execution: - Add some brackets for clarity and trim a bit of vertical whitespace. - Remove comments that may not contribute to clarity, such as "Lock" before acquiring a lock and "Get memory" before allocating memory. - During hook registration, don't drop pfil_list_lock between checking for a duplicate and registering the hook, as this leaves a race condition by failing to enforce the "no duplicate hooks" invariant. - Don't lock the hook during registration, since it's not yet in use. - Document assumption that hooks will be quiesced before being unregistered. - Don't write-lock hooks during removal because they are assumed quiesced. - Rename "done" label to "locked_error" to be clear that it's an error path on the way out of hook execution. MFC after: pretty soon Notes: svn path=/head/; revision=186187
* pfil(9) locking take 3: Switch to rmlock(9)Max Laier2007-11-251-5/+6
| | | | | | | | | | | | This has the benefit that rmlocks have proper support for reader recursion (in contrast to rwlock(9) which could potential lead to writer stravation). It also means a significant performance gain, eventhough only visible in microbenchmarks at the moment. Discussed on: -arch, -net Notes: svn path=/head/; revision=173904
* Somewhat re-factor the read/write locking mechanism associated with the packetChristian S.J. Peron2006-02-021-100/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filtering mechanisms to use the new rwlock(9) locking API: - Drop the variables stored in the phil_head structure which were specific to conditions and the home rolled read/write locking mechanism. - Drop some includes which were used for condition variables - Drop the inline functions, and convert them to macros. Also, move these macros into pfil.h - Move pfil list locking macros intp phil.h as well - Rename ph_busy_count to ph_nhooks. This variable will represent the number of IN/OUT hooks registered with the pfil head structure - Define PFIL_HOOKED macro which evaluates to true if there are any hooks to be ran by pfil_run_hooks - In the IP/IP6 stacks, change the ph_busy_count comparison to use the new PFIL_HOOKED macro. - Drop optimization in pfil_run_hooks which checks to see if there are any hooks to be ran, and returns if not. This check is already performed by the IP stacks when they call: if (!PFIL_HOOKED(ph)) goto skip_hooks; - Drop in assertion which makes sure that the number of hooks never drops below 0 for good measure. This in theory should never happen, and if it does than there are problems somewhere - Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep - Drop variables which support home rolled read/write locking mechanism from the IPFW firewall chain structure. - Swap out the read/write firewall chain lock internal to use the rwlock(9) API instead of our home rolled version - Convert the inlined functions to macros Reviewed by: mlaier, andre, glebius Thanks to: jhb for the new locking API Notes: svn path=/head/; revision=155201
* Fix semantics of ph_busy_count == -1 to pass instead of block.Max Laier2005-05-231-1/+3
| | | | | | | | | PR: kern/81128 Submitted by: Joost Bekkers MFC-after: 2 weeks Notes: svn path=/head/; revision=146550
* /* -> /*- for license, minor formatting changesWarner Losh2005-01-071-1/+1
| | | | Notes: svn path=/head/; revision=139823
* Change pfil starvation prevention from fail-open to fail-close.Max Laier2004-10-081-2/+10
| | | | | | | | | | | | We return ENOBUF to indicate the problem, which is an errno that should be handled well everywhere. Requested & Submitted by: green Silently okay'ed by: The rest of the firewall gang MFC after: 3 days Notes: svn path=/head/; revision=136258
* Add an additional struct inpcb * argument to pfil(9) in order to enableMax Laier2004-09-291-6/+6
| | | | | | | | | | | | | | | | | | | | | | passing along socket information. This is required to work around a LOR with the socket code which results in an easy reproducible hard lockup with debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do so later. The missing piece is to turn the filter locking into a leaf lock and will follow in a seperate (later) commit. This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in forseeable future. Suggested by: rwatson A lot of work by: csjp (he'd be even more helpful w/o mentor-reviews ;) Reviewed by: rwatson, csjp Tested by: -pf, -ipfw, LINT, csjp and myself MFC after: 3 days LOR IDs: 14 - 17 (not fixed yet) Notes: svn path=/head/; revision=135920
* Switch order for mtx_unlock and cv_signal as (condvar(9)) sez:Max Laier2004-09-221-2/+2
| | | | | | | | | | | | | | | A thread must hold mp while calling cv_signal(), cv_broadcast(), or cv_broadcastpri() even though it isn't passed as an argument. and is right with this claim. While here remove a "\" from the macro -> __inline conversion. Found by: csjp MFC after: 4 days Notes: svn path=/head/; revision=135588
* o update PFIL_HOOKS support to current API used by netbsdSam Leffler2003-09-231-76/+280
| | | | | | | | | | | | | | o revamp IPv4+IPv6+bridge usage to match API changes o remove pfil_head instances from protosw entries (no longer used) o add locking o bump FreeBSD version for 3rd party modules Heavy lifting by: "Max Laier" <max@love2party.net> Supported by: FreeBSD Foundation Obtained from: NetBSD (bits of pfil.h and pfil.c) Notes: svn path=/head/; revision=120386
* Back out M_* changes, per decision of the TRB.Warner Losh2003-02-191-2/+2
| | | | | | | Approved by: trb Notes: svn path=/head/; revision=111119
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.Alfred Perlstein2003-01-211-2/+2
| | | | | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT. Notes: svn path=/head/; revision=109623
* Remove __P.Alfred Perlstein2002-03-191-11/+7
| | | | Notes: svn path=/head/; revision=92725
* Mechanical change to use <sys/queue.h> macro API instead ofPoul-Henning Kamp2001-02-041-1/+1
| | | | | | | | | | fondling implementation details. Created with: sed(1) Reviewed by: md5(1) Notes: svn path=/head/; revision=71999
* Use <sys/queue.h> macro api rather than fondle its implementation detals.Poul-Henning Kamp2001-02-031-3/+3
| | | | | | | | Created with: /usr/bin/sed Reviewed by: /sbin/md5 Notes: svn path=/head/; revision=71959
* Remove unneeded #include <sys/proc.h> lines.Poul-Henning Kamp2000-10-291-1/+0
| | | | Notes: svn path=/head/; revision=67882
* Add pfil(9) subroutines and manpage from NetBSD.Darren Reed2000-05-101-0/+176
Notes: svn path=/head/; revision=60317
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-18 05:23:25 +0000