aboutsummaryrefslogtreecommitdiff
path: root/sys/netpfil/ipfw
Commit message (Collapse)AuthorAgeFilesLines
* Fix build without INET6.Gleb Smirnoff2019-02-011-2/+4
| | | | Notes: svn path=/head/; revision=343635
* New pfil(9) KPI together with newborn pfil API and control utility.Gleb Smirnoff2019-01-312-66/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The KPI have been reviewed and cleansed of features that were planned back 20 years ago and never implemented. The pfil(9) internals have been made opaque to protocols with only returned types and function declarations exposed. The KPI is made more strict, but at the same time more extensible, as kernel uses same command structures that userland ioctl uses. In nutshell [KA]PI is about declaring filtering points, declaring filters and linking and unlinking them together. New [KA]PI makes it possible to reconfigure pfil(9) configuration: change order of hooks, rehook filter from one filtering point to a different one, disconnect a hook on output leaving it on input only, prepend/append a filter to existing list of filters. Now it possible for a single packet filter to provide multiple rulesets that may be linked to different points. Think of per-interface ACLs in Cisco or Juniper. None of existing packet filters yet support that, however limited usage is already possible, e.g. default ruleset can be moved to single interface, as soon as interface would pride their filtering points. Another future feature is possiblity to create pfil heads, that provide not an mbuf pointer but just a memory pointer with length. That would allow filtering at very early stages of a packet lifecycle, e.g. when packet has just been received by a NIC and no mbuf was yet allocated. Differential Revision: https://reviews.freebsd.org/D18951 Notes: svn path=/head/; revision=343631
* Revert r316461: Remove "IPFW static rules" rmlock, and use pfil's global lock.Gleb Smirnoff2019-01-318-14/+13
| | | | | | | | | | The pfil(9) system is about to be converted to epoch(9) synchronization, so we need [temporarily] go back with ipfw internal locking. Discussed with: ae Notes: svn path=/head/; revision=343619
* Fix the bug introduced in r342908, that causes problems with dynamicAndrey V. Elsukov2019-01-291-1/+1
| | | | | | | | | | | | | | | handling for protocols without ports numbers. Since port numbers were uninitialized for protocols like ICMP/ICMPv6, ipfw_chk() used some non-zero values to create dynamic states, and due this it failed to match replies with created states. Reported by: Oliver Hartmann, Boris Lytochkin Obtained from: Yandex LLC X-MFC after: r342908 Notes: svn path=/head/; revision=343551
* Relax requirement to packet size of CARP protocol and remove version check.Andrey V. Elsukov2019-01-111-6/+4
| | | | | | | | | | | | | | | | | | CARP shares protocol number 112 with VRRP (RFC 5798). And the size of VRRP packet may be smaller than CARP. ipfw_chk() does m_pullup() to at least sizeof(struct carp_header) and can fail when packet is VRRP. This leads to packet drop and message about failed pullup attempt. Also, RFC 5798 defines version 3 of VRRP protocol, this version number also unsupported by CARP and such check leads to packet drop. carp_input() does its own checks for protocol version and packet size, so we can remove these checks to be able pass VRRP packets. PR: 234207 MFC after: 1 week Notes: svn path=/head/; revision=342925
* Fix the build with INVARIANTS.Andrey V. Elsukov2019-01-101-5/+5
| | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=342909
* Reduce the size of struct ip_fw_args from 240 to 128 bytes on amd64.Andrey V. Elsukov2019-01-104-138/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And refactor the code to avoid unneeded initialization to reduce overhead of per-packet processing. ipfw(4) can be invoked by pfil(9) framework for each packet several times. Each call uses on-stack variable of type struct ip_fw_args to keep the state of ipfw(4) processing. Currently this variable has 240 bytes size on amd64. Each time ipfw(4) does bzero() on it, and then it initializes some fields. glebius@ has reported that they at Netflix discovered, that initialization of this variable produces significant overhead on packet processing. After patching I managed to increase performance of packet processing on simple routing with ipfw(4) firewalling to about 11% from 9.8Mpps up to 11Mpps (Xeon E5-2660 v4@ + Mellanox 100G card). Introduced new field flags, it is used to keep track of what fields was initialized. Some fields were moved into the anonymous union, to reduce the size. They all are mutually exclusive. dummypar field was unused, and therefore it is removed. The hopstore6 field type was changed from sockaddr_in6 to a bit smaller struct ip_fw_nh6. And now the size of struct ip_fw_args is 128 bytes. ipfw_chk() was modified to properly handle ip_fw_args.flags instead of rely on checking for NULL pointers. Reviewed by: gallatin Obtained from: Yandex LLC MFC after: 1 month Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D18690 Notes: svn path=/head/; revision=342908
* Add ability to request listing and deleting only for dynamic states.Andrey V. Elsukov2018-12-042-6/+27
| | | | | | | | | | | | | | | | | | | | This can be useful, when net.inet.ip.fw.dyn_keep_states is enabled, but after rules reloading some state must be deleted. Added new flag '-D' for such purpose. Retire '-e' flag, since there can not be expired states in the meaning that this flag historically had. Also add "verbose" mode for listing of dynamic states, it can be enabled with '-v' flag and adds additional information to states list. This can be useful for debugging. Obtained from: Yandex LLC MFC after: 2 months Sponsored by: Yandex LLC Notes: svn path=/head/; revision=341472
* Reimplement how net.inet.ip.fw.dyn_keep_states works.Andrey V. Elsukov2018-12-047-162/+401
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Turning on of this feature allows to keep dynamic states when parent rule is deleted. But it works only when the default rule is "allow from any to any". Now when rule with dynamic opcode is going to be deleted, and net.inet.ip.fw.dyn_keep_states is enabled, existing states will reference named objects corresponding to this rule, and also reference the rule. And when ipfw_dyn_lookup_state() will find state for deleted parent rule, it will return the pointer to the deleted rule, that is still valid. This implementation doesn't support O_LIMIT_PARENT rules. The refcnt field was added to struct ip_fw to keep reference, also next pointer added to be able iterate rules and not damage the content when deleted rules are chained. Named objects are referenced only when states are going to be deleted to be able reuse kidx of named objects when new parent rules will be installed. ipfw_dyn_get_count() function was modified and now it also looks into dynamic states and constructs maps of existing named objects. This is needed to correctly export orphaned states into userland. ipfw_free_rule() was changed to be global, since now dynamic state can free rule, when it is expired and references counters becomes 1. External actions subsystem also modified, since external actions can be deregisterd and instances can be destroyed. In these cases deleted rules, that are referenced by orphaned states, must be modified to prevent access to freed memory. ipfw_dyn_reset_eaction(), ipfw_reset_eaction_instance() functions added for these purposes. Obtained from: Yandex LLC MFC after: 2 months Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D17532 Notes: svn path=/head/; revision=341471
* Add assertion to check that named object has correct type.Andrey V. Elsukov2018-12-041-0/+2
| | | | | | | | Obtained from: Yandex LLC MFC after: 1 week Notes: svn path=/head/; revision=341469
* Do not limit the mbuf queue length for keepalive packets.Andrey V. Elsukov2018-11-271-3/+2
| | | | | | | | | | | It was unlimited before overhaul, and one user reported that this limit can be reached easily. PR: 233562 MFC after: 1 week Notes: svn path=/head/; revision=341073
* Add ability to use dynamic external prefix in ipfw_nptv6 module.Andrey V. Elsukov2018-11-122-15/+169
| | | | | | | | | | | | | | | | Now an interface name can be specified for nptv6 instance instead of ext_prefix. The module will track if_addr_ext events and when suitable IPv6 address will be added to specified interface, it will be configured as external prefix. When address disappears instance becomes unusable, i.e. it doesn't match any packets. Reviewed by: 0mp (manpages) Tested by: Dries Michiels <driesm dot michiels gmail com> MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D17765 Notes: svn path=/head/; revision=340360
* ipfw: implement ngtee/netgraph actions for layer-2 frames.Eugene Grosbein2018-10-271-5/+19
| | | | | | | | | | | | | | | | | | | | | | Kernel part of ipfw does not support and ignores rules other than "pass", "deny" and dummynet-related for layer-2 (ethernet frames). Others are processed as "pass". Make it support ngtee/netgraph rules just like they are supported for IP packets. For example, this allows us to mirror some frames selectively to another interface for delivery to remote network analyzer over RSPAN vlan. Assuming ng_ipfw(4) netgraph node has a hook named "900" attached to "lower" hook of vlan900's ng_ether(4) node, that would be as simple as: ipfw add ngtee 900 ip from any to 8.8.8.8 layer2 out xmit igb0 PR: 213452 MFC after: 1 month Tested-by: Fyodor Ustinov <ufm@ufm.su> Notes: svn path=/head/; revision=339810
* Do not decrement RST life time if keep_alive is not turned on.Andrey V. Elsukov2018-10-211-1/+2
| | | | | | | | | | | | This allows use differen values configured by user for sysctl variable net.inet.ip.fw.dyn_rst_lifetime. Obtained from: Yandex LLC MFC after: 3 weeks Sponsored by: Yandex LLC Notes: svn path=/head/; revision=339545
* Call inet_ntop() only when its result is needed.Andrey V. Elsukov2018-10-211-8/+11
| | | | | | | | | Obtained from: Yandex LLC MFC after: 3 weeks Sponsored by: Yandex LLC Notes: svn path=/head/; revision=339544
* Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add abilityAndrey V. Elsukov2018-10-213-36/+92
| | | | | | | | | | | | | | | | | | to switch the output method in run-time. Also document some sysctl variables that can by changed for NAT64 module. NAT64 had compile time option IPFIREWALL_NAT64_DIRECT_OUTPUT to use if_output directly from nat64 module. By default is used netisr based output method. Now both methods can be used, but they require different handling by rules. Obtained from: Yandex LLC MFC after: 3 weeks Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D16647 Notes: svn path=/head/; revision=339542
* Add extra parentheses to fix "versrcreach" opcode, (oif != NULL) shouldAndrey V. Elsukov2018-10-151-2/+2
| | | | | | | | | | | not be used as condition for ternary operator. Submitted by: Tatsuki Makino <tatsuki_makino at hotmail dot com> Approved by: re (kib) MFC after: 1 week Notes: svn path=/head/; revision=339357
* Fix a typo in comment.Luiz Otavio O Souza2018-08-151-1/+1
| | | | | | | | | MFC after: 3 days X-MFC with: r321316 Sponsored by: Rubicon Communications, LLC (Netgate) Notes: svn path=/head/; revision=337860
* Use host byte order when comparing mss values.Andrey V. Elsukov2018-08-081-1/+1
| | | | | | | | | | This fixes tcp-setmss action on little endian machines. PR: 225536 Submitted by: John Zielinski Notes: svn path=/head/; revision=337469
* Use the new VNET_DEFINE_STATIC macro when we are defining static VNETAndrew Turner2018-07-247-52/+52
| | | | | | | | | | | variables. Reviewed by: bz Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D16147 Notes: svn path=/head/; revision=336676
* Use correct size when we are allocating array for skipto index.Andrey V. Elsukov2018-07-121-4/+2
| | | | | | | | | | | Also, there is no need to use M_ZERO for idxmap_back. It will be re-filled just after allocation in update_skipto_cache(). PR: 229665 MFC after: 1 week Notes: svn path=/head/; revision=336219
* Add "record-state", "set-limit" and "defer-action" rule options to ipfw.Andrey V. Elsukov2018-07-092-1/+19
| | | | | | | | | | | | | | | | | | "record-state" is similar to "keep-state", but it doesn't produce implicit O_PROBE_STATE opcode in a rule. "set-limit" is like "limit", but it has the same feature as "record-state", it is single opcode without implicit O_PROBE_STATE opcode. "defer-action" is targeted to be used with dynamic states. When rule with this opcode is matched, the rule's action will not be executed, instead dynamic state will be created. And when this state will be matched by "check-state", then rule action will be executed. This allows create a more complicated rulesets. Submitted by: lev MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D1776 Notes: svn path=/head/; revision=336132
* Create a new macro for static DPCPU data.Andrew Turner2018-07-051-1/+1
| | | | | | | | | | | | | | | | | On arm64 (and possible other architectures) we are unable to use static DPCPU data in kernel modules. This is because the compiler will generate PC-relative accesses, however the runtime-linker expects to be able to relocate these. In preparation to fix this create two macros depending on if the data is global or static. Reviewed by: bz, emaste, markj Sponsored by: ABT Systems Ltd Differential Revision: https://reviews.freebsd.org/D16140 Notes: svn path=/head/; revision=336007
* Switch RIB and RADIX_NODE_HEAD lock from rwlock(9) to rmlock(9).Andrey V. Elsukov2018-06-161-0/+1
| | | | | | | | | | | | | | Using of rwlock with multiqueue NICs for IP forwarding on high pps produces high lock contention and inefficient. Rmlock fits better for such workloads. Reviewed by: melifaro, olivier Obtained from: Yandex LLC Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D15789 Notes: svn path=/head/; revision=335250
* uma: implement provisional api for per-cpu zonesMateusz Guzik2018-06-081-2/+2
| | | | | | | | | | | | | Per-cpu zone allocations are very rarely done compared to regular zones. The intent is to avoid pessimizing the latter case with per-cpu specific code. In particular contrary to the claim in r334824, M_ZERO is sometimes being used for such zones. But the zeroing method is completely different and braching on it in the fast path for regular zones is a waste of time. Notes: svn path=/head/; revision=334858
* Restore the ability to keep states after parent rule deletion.Andrey V. Elsukov2018-05-221-6/+30
| | | | | | | | | | | | | | | | | | | | This feature is disabled by default and was removed when dynamic states implementation changed to be lockless. Now it is reimplemented with small differences - when dyn_keep_states sysctl variable is enabled, dyn_match_ipv[46]_state() function doesn't match child states of deleted rule. And thus they are keept alive until expired. ipfw_dyn_lookup_state() function does check that state was not orphaned, and if so, it returns pointer to default_rule and its position in the rules map. The main visible difference is that orphaned states still have the same rule number that they have before parent rule deleted, because now a state has many fields related to rule and changing them all atomically to point to default_rule seems hard enough. Reported by: <lantw44 at gmail.com> MFC after: 2 days Notes: svn path=/head/; revision=334039
* Remove check for matching the rulenum, ruleid and rule pointer fromAndrey V. Elsukov2018-05-211-28/+7
| | | | | | | | | | | | | | | dyn_lookup_ipv[46]_state_locked(). These checks are remnants of not ready to be committed code, and they are there by accident. Due to the race these checks can lead to creating of duplicate states when concurrent threads in the same time will try to add state for two packets of the same flow, but in reverse directions and matched by different parent rules. Reported by: lev MFC after: 3 days Notes: svn path=/head/; revision=333986
* ifnet: Replace if_addr_lock rwlock with epoch + mutexMatt Macy2018-05-183-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Run on LLNW canaries and tested by pho@ gallatin: Using a 14-core, 28-HTT single socket E5-2697 v3 with a 40GbE MLX5 based ConnectX 4-LX NIC, I see an almost 12% improvement in received packet rate, and a larger improvement in bytes delivered all the way to userspace. When the host receiving 64 streams of netperf -H $DUT -t UDP_STREAM -- -m 1, I see, using nstat -I mce0 1 before the patch: InMpps OMpps InGbs OGbs err TCP Est %CPU syscalls csw irq GBfree 4.98 0.00 4.42 0.00 4235592 33 83.80 4720653 2149771 1235 247.32 4.73 0.00 4.20 0.00 4025260 33 82.99 4724900 2139833 1204 247.32 4.72 0.00 4.20 0.00 4035252 33 82.14 4719162 2132023 1264 247.32 4.71 0.00 4.21 0.00 4073206 33 83.68 4744973 2123317 1347 247.32 4.72 0.00 4.21 0.00 4061118 33 80.82 4713615 2188091 1490 247.32 4.72 0.00 4.21 0.00 4051675 33 85.29 4727399 2109011 1205 247.32 4.73 0.00 4.21 0.00 4039056 33 84.65 4724735 2102603 1053 247.32 After the patch InMpps OMpps InGbs OGbs err TCP Est %CPU syscalls csw irq GBfree 5.43 0.00 4.20 0.00 3313143 33 84.96 5434214 1900162 2656 245.51 5.43 0.00 4.20 0.00 3308527 33 85.24 5439695 1809382 2521 245.51 5.42 0.00 4.19 0.00 3316778 33 87.54 5416028 1805835 2256 245.51 5.42 0.00 4.19 0.00 3317673 33 90.44 5426044 1763056 2332 245.51 5.42 0.00 4.19 0.00 3314839 33 88.11 5435732 1792218 2499 245.52 5.44 0.00 4.19 0.00 3293228 33 91.84 5426301 1668597 2121 245.52 Similarly, netperf reports 230Mb/s before the patch, and 270Mb/s after the patch Reviewed by: gallatin Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D15366 Notes: svn path=/head/; revision=333813
* Bring in some last changes in NAT64 implementation:Andrey V. Elsukov2018-05-0910-350/+380
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o Modify ipfw(8) to be able set any prefix6 not just Well-Known, and also show configured prefix6; o relocate some definitions and macros into proper place; o convert nat64_debug and nat64_allow_private variables to be VNET-compatible; o add struct nat64_config that keeps generic configuration needed to NAT64 code; o add nat64_check_prefix6() function to check validness of specified by user IPv6 prefix according to RFC6052; o use nat64_check_private_ip4() and nat64_embed_ip4() functions instead of nat64_get_ip4() and nat64_set_ip4() macros. This allows to use any configured IPv6 prefixes that are allowed by RFC6052; o introduce NAT64_WKPFX flag, that is set when IPv6 prefix is Well-Known IPv6 prefix. It is used to reduce overhead to check this; o modify nat64lsn_cfg and nat64stl_cfg structures to use nat64_config structure. And respectivelly modify the rest of code; o remove now unused ro argument from nat64_output() function; o remove __FreeBSD_version ifdef, NAT64 was not merged to older versions; o add commented -DIPFIREWALL_NAT64_DIRECT_OUTPUT flag to module's Makefile as example. Obtained from: Yandex LLC MFC after: 1 month Sponsored by: Yandex LLC Notes: svn path=/head/; revision=333403
* To avoid possible deadlock do not acquire JQUEUE_LOCK before callout_drain.Andrey V. Elsukov2018-04-131-3/+0
| | | | | | | | | Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=332467
* Fix integer types mismatch for flags field in nat64stl_cfg structure.Andrey V. Elsukov2018-04-122-3/+3
| | | | | | | | | | | Also preserve internal flags on NAT64STL reconfiguration. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=332459
* Use cfg->nomatch_verdict as return value from NAT64LSN handler whenAndrey V. Elsukov2018-04-123-10/+9
| | | | | | | | | | | | | | | | | | given mbuf is considered as not matched. If mbuf was consumed or freed during handling, we must return IP_FW_DENY, since ipfw's pfil handler ipfw_check_packet() expects IP_FW_DENY when mbuf pointer is NULL. This fixes KASSERT panics when NAT64 is used with INVARIANTS. Also remove unused nomatch_final field from struct nat64lsn_cfg. Reported by: Justin Holcomb <justin at justinholcomb dot me> Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=332457
* Migrate NAT64 to FIB KPI.Andrey V. Elsukov2018-04-122-121/+84
| | | | | | | | Obtained from: Yandex LLC MFC after: 1 week Notes: svn path=/head/; revision=332456
* Fix ipfw table creation when net.inet.ip.fw.tables_sets = 0 and non zero setOleg Bulyzhin2018-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | specified on table creation. This fixes following: # sysctl net.inet.ip.fw.tables_sets net.inet.ip.fw.tables_sets: 0 # ipfw table all info # ipfw set 1 table 1 create type addr # ipfw set 1 table 1 create type addr # ipfw add 10 set 1 count ip from table\(1\) to any 00010 count ip from table(1) to any # ipfw add 10 set 1 count ip from table\(1\) to any 00010 count ip from table(1) to any # ipfw table all info --- table(1), set(1) --- kindex: 4, type: addr references: 1, valtype: legacy algorithm: addr:radix items: 0, size: 296 --- table(1), set(1) --- kindex: 3, type: addr references: 1, valtype: legacy algorithm: addr:radix items: 0, size: 296 --- table(1), set(1) --- kindex: 2, type: addr references: 0, valtype: legacy algorithm: addr:radix items: 0, size: 296 --- table(1), set(1) --- kindex: 1, type: addr references: 0, valtype: legacy algorithm: addr:radix items: 0, size: 296 # MFC after: 1 week Notes: svn path=/head/; revision=332402
* Do not try to reassemble IPv6 fragments in "reass" rule.Andrey V. Elsukov2018-03-121-1/+3
| | | | | | | | | | | | ip_reass() expects IPv4 packet and will just corrupt any IPv6 packets that it gets. Until proper IPv6 fragments handling function will be implemented, pass IPv6 packets to next rule. PR: 170604 MFC after: 1 week Notes: svn path=/head/; revision=330792
* Remove duplicate #include <netinet/ip_var.h>.Andrey V. Elsukov2018-02-071-1/+0
| | | | Notes: svn path=/head/; revision=328989
* Rework ipfw dynamic states implementation to be lockless on fast path.Andrey V. Elsukov2018-02-074-1079/+2502
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o added struct ipfw_dyn_info that keeps all needed for ipfw_chk and for dynamic states implementation information; o added DYN_LOOKUP_NEEDED() macro that can be used to determine the need of new lookup of dynamic states; o ipfw_dyn_rule now becomes obsolete. Currently it used to pass information from kernel to userland only. o IPv4 and IPv6 states now described by different structures dyn_ipv4_state and dyn_ipv6_state; o IPv6 scope zones support is added; o ipfw(4) now depends from Concurrency Kit; o states are linked with "entry" field using CK_SLIST. This allows lockless lookup and protected by mutex modifications. o the "expired" SLIST field is used for states expiring. o struct dyn_data is used to keep generic information for both IPv4 and IPv6; o struct dyn_parent is used to keep O_LIMIT_PARENT information; o IPv4 and IPv6 states are stored in different hash tables; o O_LIMIT_PARENT states now are kept separately from O_LIMIT and O_KEEP_STATE states; o per-cpu dyn_hp pointers are used to implement hazard pointers and they prevent freeing states that are locklessly used by lookup threads; o mutexes to protect modification of lists in hash tables now kept in separate arrays. 65535 limit to maximum number of hash buckets now removed. o Separate lookup and install functions added for IPv4 and IPv6 states and for parent states. o By default now is used Jenkinks hash function. Obtained from: Yandex LLC MFC after: 42 days Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D12685 Notes: svn path=/head/; revision=328988
* When IPv6 packet is handled by O_REJECT opcode, convert ICMP codeAndrey V. Elsukov2018-01-241-3/+32
| | | | | | | | | | | | specified in the arg1 into ICMPv6 destination unreachable code according to RFC7915. Obtained from: Yandex LLC MFC after: 2 weeks Sponsored by: Yandex LLC Notes: svn path=/head/; revision=328326
* Unsign some values related to allocation.Pedro F. Giffuni2018-01-222-3/+3
| | | | | | | | | | | | | | When allocating memory through malloc(9), we always expect the amount of memory requested to be unsigned as a negative value would either stand for an error or an overflow. Unsign some values, found when considering the use of mallocarray(9), to avoid unnecessary casting. Also consider that indexes should be of at least the same size/type as the upper limit they pretend to index. MFC after: 3 weeks Notes: svn path=/head/; revision=328238
* Add UDPLite support to ipfw(4).Andrey V. Elsukov2018-01-193-5/+20
| | | | | | | | | | | | | Now it is possible to use UDPLite's port numbers in rules, create dynamic states for UDPLite packets and see "UDPLite" for matched packets in log. Obtained from: Yandex LLC MFC after: 2 weeks Sponsored by: Yandex LLC Notes: svn path=/head/; revision=328161
* Implement 'domainset', a cpuset based NUMA policy mechanism. This allowsJeff Roberson2018-01-121-0/+1
| | | | | | | | | | | | | | | | | | | userspace to control NUMA policy administratively and programmatically. Implement domainset based iterators in the page layer. Remove the now legacy numa_* syscalls. Cleanup some header polution created by having seq.h in proc.h. Reviewed by: markj, kib Discussed with: alc Tested by: pho Sponsored by: Netflix, Dell/EMC Isilon Differential Revision: https://reviews.freebsd.org/D13403 Notes: svn path=/head/; revision=327895
* netpfil/ipfw: Make some use of mallocarray(9).Pedro F. Giffuni2018-01-113-5/+5
| | | | | | | | Reviewed by: kp, ae Differential Revision: https://reviews.freebsd.org/D13834 Notes: svn path=/head/; revision=327829
* sys: general adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-2721-6/+48
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. No functional change intended. Notes: svn path=/head/; revision=326272
* Add to ipfw support for sending an SCTP packet containing an ABORT chunk.Michael Tuexen2017-11-262-5/+267
| | | | | | | | | | | | | | | | This is similar to the TCP case. where a TCP RST segment can be sent. There is one limitation: When sending an ABORT in response to an incoming packet, it should be tested if there is no ABORT chunk in the received packet. Currently, it is only checked if the first chunk is an ABORT chunk to avoid parsing the whole packet, which could result in a DOS attack. Thanks to Timo Voelker for helping me to test this patch. Reviewed by: bcr@ (man page part), ae@ (generic, non-SCTP part) Differential Revision: https://reviews.freebsd.org/D13239 Notes: svn path=/head/; revision=326233
* Modify ipfw's dynamic states KPI.Andrey V. Elsukov2017-11-233-52/+42
| | | | | | | | | | | | | | | | | | | Hide the locking logic used in the dynamic states implementation from generic code. Rename ipfw_install_state() and ipfw_lookup_dyn_rule() function to have similar names: ipfw_dyn_install_state() and ipfw_dyn_lookup_state(). Move dynamic rule counters updating to the ipfw_dyn_lookup_state() function. Now this function return NULL when there is no state and pointer to the parent rule when state is found. Thus now there is no need to return pointer to dynamic rule, and no need to hold bucket lock for this state. Remove ipfw_dyn_unlock() function. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D11657 Notes: svn path=/head/; revision=326118
* Check that address family of state matches address family of packet.Andrey V. Elsukov2017-11-231-0/+3
| | | | | | | | | | | If it is not matched avoid comparing other state fields. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=326117
* Move ipfw_send_pkt() from ip_fw_dynamic.c into ip_fw2.c.Andrey V. Elsukov2017-11-232-149/+149
| | | | | | | | | | | | It is not specific for dynamic states function and called also from generic code. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=326116
* Rework rule ranges matching. Use comparison rule id with UINT32_MAX toAndrey V. Elsukov2017-11-231-7/+6
| | | | | | | | | | | match all rules with the same rule number. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=326115
* Add ipfw_add_protected_rule() function that creates rule with 65535Andrey V. Elsukov2017-11-223-13/+31
| | | | | | | | | | | number in the reserved set 31. Use this function to create default rule. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=326086
* Add comment for accidentally committed unrelated change in r325960.Andrey V. Elsukov2017-11-171-0/+4
| | | | | | | | | | | | | | | | | Do not invoke IPv4 NAT handler for non IPv4 packets. Libalias expects a packet is IPv4. And in case when it is IPv6, it just translates them as IPv4. This leads to corruption and in some cases to panics. In particular a panic can happen when value of ip6_plen modified to something that leads to IP fragmentation, but actual packet length does not match the IP length. Packets that are not IPv4 will be dropped by NAT rule. Reported by: Viktor Dukhovni <freebsd at dukhovni dot org> MFC after: 1 week Notes: svn path=/head/; revision=325962
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-21 01:30:10 +0000