d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c5360c2998
freebsd-dev/sys/contrib/pf/net/if_pfsync.c

3473 lines
75 KiB
C
Raw Normal View History

Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* $OpenBSD: if_pfsync.c,v 1.110 2009/02/24 05:39:19 dlg Exp $ */
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
/*
* Copyright (c) 2002 Michael Shalayeff
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGE.
*/
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/*
* Copyright (c) 2009 David Gwynne <dlg@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#include "opt_inet.h"
#include "opt_inet6.h"
#include "opt_pf.h"
Fix -Wundef warnings found when compiling i386 LINT, GENERIC and custom kernels.
2005-12-05 11:58:35 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
In FreeBSD we always have bpf(4) API, either real or stub. No need in detecting presense of 'device bpf'.
2011-12-22 18:31:47 +00:00
#define NBPFILTER 1
Fix -Wundef warnings found when compiling i386 LINT, GENERIC and custom kernels.
2005-12-05 11:58:35 +00:00
#ifdef DEV_PFSYNC
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#define NPFSYNC DEV_PFSYNC
Fix -Wundef warnings found when compiling i386 LINT, GENERIC and custom kernels.
2005-12-05 11:58:35 +00:00
#else
#define NPFSYNC 0
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif /* __FreeBSD__ */
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <sys/param.h>
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#include <sys/kernel.h>
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#include <sys/bus.h>
#include <sys/interrupt.h>
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
#include <sys/priv.h>
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#include <sys/proc.h>
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <sys/systm.h>
#include <sys/time.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#ifdef __FreeBSD__
#include <sys/endian.h>
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#include <sys/malloc.h>
"Get rid of the nested include of <sys/module.h> from <sys/kernel.h>" or better do no longer depend on it. Requested-by: phk Approved-by: bms(mentor)
2004-05-31 22:48:19 +00:00
#include <sys/module.h>
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#include <sys/sockio.h>
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#include <sys/taskqueue.h>
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#include <sys/lock.h>
#include <sys/mutex.h>
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#else
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <sys/ioctl.h>
#include <sys/timeout.h>
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#include <sys/sysctl.h>
#ifndef __FreeBSD__
#include <sys/pool.h>
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <net/if.h>
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Major overhaul of pseudo-interface cloning. Highlights include: - Split the code out into if_clone.[ch]. - Locked struct if_clone. [1] - Add a per-cloner match function rather then simply matching names of the form <name><unit> and <name>. - Use the match function to allow creation of <interface>.<tag> vlan interfaces. The old way is preserved unchanged! - Also the match function to allow creation of stf(4) interfaces named stf0, stf, or 6to4. This is the only major user visible change in that "ifconfig stf" creates the interface stf rather then stf0 and does not print "stf0" to stdout. - Allow destroy functions to fail so they can refuse to delete interfaces. Currently, we forbid the deletion of interfaces which were created in the init function, particularly lo0, pflog0, and pfsync0. In the case of lo0 this was a panic implementation so it does not count as a user visiable change. :-) - Since most interfaces do not need the new functionality, an family of wrapper functions, ifc_simple_*(), were created to wrap old style cloner functions. - The IF_CLONE_INITIALIZER macro is replaced with a new incompatible IFC_CLONE_INITIALIZER and ifc_simple consumers use IFC_SIMPLE_DECLARE instead. Submitted by: Maurycy Pawlowski-Wieronski <maurycy at fouk.org> [1] Reviewed by: andre, mlaier Discussed on: net
2004-06-22 20:13:25 +00:00
#include <net/if_clone.h>
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <net/if_types.h>
#include <net/route.h>
#include <net/bpf.h>
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#include <net/netisr.h>
#ifdef __FreeBSD__
#include <net/vnet.h>
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#include <netinet/in.h>
#include <netinet/if_ether.h>
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#include <netinet/tcp.h>
#include <netinet/tcp_seq.h>
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#ifdef INET
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#include <netinet/in_systm.h>
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <netinet/in_var.h>
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#include <netinet/ip.h>
#include <netinet/ip_var.h>
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#endif
#ifdef INET6
#include <netinet6/nd6.h>
#endif /* INET6 */
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#ifdef __FreeBSD__
#include <netinet/ip_carp.h>
#else
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#include "carp.h"
#if NCARP > 0
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#include <netinet/ip_carp.h>
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#endif
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#include <net/pfvar.h>
#include <net/if_pfsync.h>
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifndef __FreeBSD__
#include "bpfilter.h"
#include "pfsync.h"
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#define PFSYNC_MINPKT ( \
sizeof(struct ip) + \
sizeof(struct pfsync_header) + \
sizeof(struct pfsync_subheader) + \
sizeof(struct pfsync_eof))
struct pfsync_pkt {
struct ip *ip;
struct in_addr src;
u_int8_t flags;
};
int pfsync_input_hmac(struct mbuf *, int);
int pfsync_upd_tcp(struct pf_state *, struct pfsync_state_peer *,
struct pfsync_state_peer *);
int pfsync_in_clr(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_ins(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_iack(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_upd(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_upd_c(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_ureq(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_del(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_del_c(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_bus(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_tdb(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_eof(struct pfsync_pkt *, struct mbuf *, int, int);
int pfsync_in_error(struct pfsync_pkt *, struct mbuf *, int, int);
int (*pfsync_acts[])(struct pfsync_pkt *, struct mbuf *, int, int) = {
pfsync_in_clr, /* PFSYNC_ACT_CLR */
pfsync_in_ins, /* PFSYNC_ACT_INS */
pfsync_in_iack, /* PFSYNC_ACT_INS_ACK */
pfsync_in_upd, /* PFSYNC_ACT_UPD */
pfsync_in_upd_c, /* PFSYNC_ACT_UPD_C */
pfsync_in_ureq, /* PFSYNC_ACT_UPD_REQ */
pfsync_in_del, /* PFSYNC_ACT_DEL */
pfsync_in_del_c, /* PFSYNC_ACT_DEL_C */
pfsync_in_error, /* PFSYNC_ACT_INS_F */
pfsync_in_error, /* PFSYNC_ACT_DEL_F */
pfsync_in_bus, /* PFSYNC_ACT_BUS */
pfsync_in_tdb, /* PFSYNC_ACT_TDB */
pfsync_in_eof /* PFSYNC_ACT_EOF */
};
struct pfsync_q {
int (*write)(struct pf_state *, struct mbuf *, int);
size_t len;
u_int8_t action;
};
/* we have one of these for every PFSYNC_S_ */
int pfsync_out_state(struct pf_state *, struct mbuf *, int);
int pfsync_out_iack(struct pf_state *, struct mbuf *, int);
int pfsync_out_upd_c(struct pf_state *, struct mbuf *, int);
int pfsync_out_del(struct pf_state *, struct mbuf *, int);
struct pfsync_q pfsync_qs[] = {
{ pfsync_out_state, sizeof(struct pfsync_state), PFSYNC_ACT_INS },
{ pfsync_out_iack, sizeof(struct pfsync_ins_ack), PFSYNC_ACT_INS_ACK },
{ pfsync_out_state, sizeof(struct pfsync_state), PFSYNC_ACT_UPD },
{ pfsync_out_upd_c, sizeof(struct pfsync_upd_c), PFSYNC_ACT_UPD_C },
{ pfsync_out_del, sizeof(struct pfsync_del_c), PFSYNC_ACT_DEL_C }
};
void pfsync_q_ins(struct pf_state *, int);
void pfsync_q_del(struct pf_state *);
struct pfsync_upd_req_item {
TAILQ_ENTRY(pfsync_upd_req_item) ur_entry;
struct pfsync_upd_req ur_msg;
};
TAILQ_HEAD(pfsync_upd_reqs, pfsync_upd_req_item);
struct pfsync_deferral {
TAILQ_ENTRY(pfsync_deferral) pd_entry;
struct pf_state *pd_st;
struct mbuf *pd_m;
#ifdef __FreeBSD__
struct callout pd_tmo;
#else
struct timeout pd_tmo;
#endif
};
TAILQ_HEAD(pfsync_deferrals, pfsync_deferral);
#define PFSYNC_PLSIZE MAX(sizeof(struct pfsync_upd_req_item), \
sizeof(struct pfsync_deferral))
#ifdef notyet
int pfsync_out_tdb(struct tdb *, struct mbuf *, int);
#endif
struct pfsync_softc {
#ifdef __FreeBSD__
struct ifnet *sc_ifp;
#else
struct ifnet sc_if;
#endif
struct ifnet *sc_sync_if;
#ifdef __FreeBSD__
uma_zone_t sc_pool;
#else
struct pool sc_pool;
#endif
struct ip_moptions sc_imo;
struct in_addr sc_sync_peer;
u_int8_t sc_maxupdates;
#ifdef __FreeBSD__
int pfsync_sync_ok;
#endif
struct ip sc_template;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pf_state_queue sc_qs[PFSYNC_S_COUNT];
size_t sc_len;
struct pfsync_upd_reqs sc_upd_req_list;
struct pfsync_deferrals sc_deferrals;
u_int sc_deferred;
void *sc_plus;
size_t sc_pluslen;
u_int32_t sc_ureq_sent;
int sc_bulk_tries;
#ifdef __FreeBSD__
struct callout sc_bulkfail_tmo;
#else
struct timeout sc_bulkfail_tmo;
#endif
u_int32_t sc_ureq_received;
struct pf_state *sc_bulk_next;
struct pf_state *sc_bulk_last;
#ifdef __FreeBSD__
struct callout sc_bulk_tmo;
#else
struct timeout sc_bulk_tmo;
#endif
TAILQ_HEAD(, tdb) sc_tdb_q;
#ifdef __FreeBSD__
struct callout sc_tmo;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct timeout sc_tmo;
#endif
#ifdef __FreeBSD__
eventhandler_tag sc_detachtag;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
};
#ifdef __FreeBSD__
static VNET_DEFINE(struct pfsync_softc *, pfsyncif) = NULL;
#define V_pfsyncif VNET(pfsyncif)
static VNET_DEFINE(struct pfsyncstats, pfsyncstats);
#define V_pfsyncstats VNET(pfsyncstats)
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
static VNET_DEFINE(int, pfsync_carp_adj) = CARP_MAXSKEW;
#define V_pfsync_carp_adj VNET(pfsync_carp_adj)
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
SYSCTL_NODE(_net, OID_AUTO, pfsync, CTLFLAG_RW, 0, "PFSYNC");
SYSCTL_VNET_STRUCT(_net_pfsync, OID_AUTO, stats, CTLFLAG_RW,
&VNET_NAME(pfsyncstats), pfsyncstats,
"PFSYNC statistics (struct pfsyncstats, net/if_pfsync.h)");
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
SYSCTL_INT(_net_pfsync, OID_AUTO, carp_demotion_factor, CTLFLAG_RW,
&VNET_NAME(pfsync_carp_adj), 0, "pfsync's CARP demotion factor adjustment");
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
struct pfsync_softc *pfsyncif = NULL;
struct pfsyncstats pfsyncstats;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#define V_pfsyncstats pfsyncstats
#endif
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
static void pfsyncintr(void *);
struct pfsync_swi {
void * pfsync_swi_cookie;
};
static struct pfsync_swi pfsync_swi;
#define schednetisr(p) swi_sched(pfsync_swi.pfsync_swi_cookie, 0)
#define NETISR_PFSYNC
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
void pfsyncattach(int);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
int pfsync_clone_create(struct if_clone *, int, caddr_t);
void pfsync_clone_destroy(struct ifnet *);
#else
int pfsync_clone_create(struct if_clone *, int);
int pfsync_clone_destroy(struct ifnet *);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
int pfsync_alloc_scrub_memory(struct pfsync_state_peer *,
struct pf_state_peer *);
void pfsync_update_net_tdb(struct pfsync_tdb *);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
int pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
Change if_output to take a struct route as its fourth argument in order to allow passing a cached struct llentry * down to L2 Reviewed by: rwatson
2009-04-16 20:30:28 +00:00
struct route *);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
struct rtentry *);
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
int pfsyncioctl(struct ifnet *, u_long, caddr_t);
void pfsyncstart(struct ifnet *);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct mbuf *pfsync_if_dequeue(struct ifnet *);
struct mbuf *pfsync_get_mbuf(struct pfsync_softc *);
void pfsync_deferred(struct pf_state *, int);
void pfsync_undefer(struct pfsync_deferral *, int);
void pfsync_defer_tmo(void *);
void pfsync_request_update(u_int32_t, u_int64_t);
void pfsync_update_state_req(struct pf_state *);
void pfsync_drop(struct pfsync_softc *);
void pfsync_sendout(void);
void pfsync_send_plus(void *, size_t);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
int pfsync_tdb_sendout(struct pfsync_softc *);
int pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
void pfsync_timeout(void *);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void pfsync_tdb_timeout(void *);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
void pfsync_send_bus(struct pfsync_softc *, u_int8_t);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void pfsync_bulk_start(void);
void pfsync_bulk_status(u_int8_t);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
void pfsync_bulk_update(void *);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void pfsync_bulk_fail(void *);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void pfsync_ifdetach(void *, struct ifnet *);
/* XXX: ugly */
#define betoh64 (unsigned long long)be64toh
#define timeout_del callout_stop
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#define PFSYNC_MAX_BULKTRIES 12
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifndef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int pfsync_sync_ok;
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Major overhaul of pseudo-interface cloning. Highlights include: - Split the code out into if_clone.[ch]. - Locked struct if_clone. [1] - Add a per-cloner match function rather then simply matching names of the form <name><unit> and <name>. - Use the match function to allow creation of <interface>.<tag> vlan interfaces. The old way is preserved unchanged! - Also the match function to allow creation of stf(4) interfaces named stf0, stf, or 6to4. This is the only major user visible change in that "ifconfig stf" creates the interface stf rather then stf0 and does not print "stf0" to stdout. - Allow destroy functions to fail so they can refuse to delete interfaces. Currently, we forbid the deletion of interfaces which were created in the init function, particularly lo0, pflog0, and pfsync0. In the case of lo0 this was a panic implementation so it does not count as a user visiable change. :-) - Since most interfaces do not need the new functionality, an family of wrapper functions, ifc_simple_*(), were created to wrap old style cloner functions. - The IF_CLONE_INITIALIZER macro is replaced with a new incompatible IFC_CLONE_INITIALIZER and ifc_simple consumers use IFC_SIMPLE_DECLARE instead. Submitted by: Maurycy Pawlowski-Wieronski <maurycy at fouk.org> [1] Reviewed by: andre, mlaier Discussed on: net
2004-06-22 20:13:25 +00:00
IFC_SIMPLE_DECLARE(pfsync, 1);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
struct if_clone pfsync_cloner =
IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy);
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
#endif
Defer ip_output of pfsync updates to an independent callout thread instead of just dropping the lock around the ip_output call. This used to cause corrupted state tree walks for some call-paths. In a second stage all callouts will be marked MPSAFE according to the setting of mpsafenet. Reported and tested by: Matthew Grooms <mgrooms at seton dot org> MFC after: 3 days X-MFC after: Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void
pfsyncattach(int npfsync)
{
if_clone_attach(&pfsync_cloner);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
int
Revise network interface cloning to take an optional opaque parameter that can specify configuration parameters: o rev cloner api's to add optional parameter block o add SIOCCREATE2 that accepts parameter data o rev vlan support to use new api (maintain old code) Reviewed by: arch@
2006-07-09 06:04:01 +00:00
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param)
Revise network interface cloning to take an optional opaque parameter that can specify configuration parameters: o rev cloner api's to add optional parameter block o add SIOCCREATE2 that accepts parameter data o rev vlan support to use new api (maintain old code) Reviewed by: arch@
2006-07-09 06:04:01 +00:00
#else
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
pfsync_clone_create(struct if_clone *ifc, int unit)
Revise network interface cloning to take an optional opaque parameter that can specify configuration parameters: o rev cloner api's to add optional parameter block o add SIOCCREATE2 that accepts parameter data o rev vlan support to use new api (maintain old code) Reviewed by: arch@
2006-07-09 06:04:01 +00:00
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
struct ifnet *ifp;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int q;
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if (unit != 0)
return (EINVAL);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifndef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsync_sync_ok = 1;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
sc = malloc(sizeof(struct pfsync_softc), M_DEVBUF, M_NOWAIT | M_ZERO);
if (sc == NULL)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
return (ENOMEM);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (q = 0; q < PFSYNC_S_COUNT; q++)
TAILQ_INIT(&sc->sc_qs[q]);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->pfsync_sync_ok = 1;
sc->sc_pool = uma_zcreate("pfsync", PFSYNC_PLSIZE,
NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
if (sc->sc_pool == NULL) {
free(sc, M_DEVBUF);
return (ENOMEM);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
pool_init(&sc->sc_pool, PFSYNC_PLSIZE, 0, 0, 0, "pfsync", NULL);
#endif
TAILQ_INIT(&sc->sc_upd_req_list);
TAILQ_INIT(&sc->sc_deferrals);
sc->sc_deferred = 0;
TAILQ_INIT(&sc->sc_tdb_q);
sc->sc_len = PFSYNC_MINPKT;
sc->sc_maxupdates = 128;
#ifdef __FreeBSD__
sc->sc_imo.imo_membership = (struct in_multi **)malloc(
(sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_DEVBUF,
M_NOWAIT | M_ZERO);
sc->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS;
sc->sc_imo.imo_multicast_vif = -1;
#else
sc->sc_imo.imo_membership = (struct in_multi **)malloc(
(sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_IPMOPTS,
M_WAITOK | M_ZERO);
sc->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS;
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
ifp = sc->sc_ifp = if_alloc(IFT_PFSYNC);
Stop embedding struct ifnet at the top of driver softcs. Instead the struct ifnet or the layer 2 common structure it was embedded in have been replaced with a struct ifnet pointer to be filled by a call to the new function, if_alloc(). The layer 2 common structure is also allocated via if_alloc() based on the interface type. It is hung off the new struct ifnet member, if_l2com. This change removes the size of these structures from the kernel ABI and will allow us to better manage them as interfaces come and go. Other changes of note: - Struct arpcom is no longer referenced in normal interface code. Instead the Ethernet address is accessed via the IFP2ENADDR() macro. To enforce this ac_enaddr has been renamed to _ac_enaddr. - The second argument to ether_ifattach is now always the mac address from driver private storage rather than sometimes being ac_enaddr. Reviewed by: sobomax, sam
2005-06-10 16:49:24 +00:00
if (ifp == NULL) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
free(sc->sc_imo.imo_membership, M_DEVBUF);
uma_zdestroy(sc->sc_pool);
free(sc, M_DEVBUF);
Stop embedding struct ifnet at the top of driver softcs. Instead the struct ifnet or the layer 2 common structure it was embedded in have been replaced with a struct ifnet pointer to be filled by a call to the new function, if_alloc(). The layer 2 common structure is also allocated via if_alloc() based on the interface type. It is hung off the new struct ifnet member, if_l2com. This change removes the size of these structures from the kernel ABI and will allow us to better manage them as interfaces come and go. Other changes of note: - Struct arpcom is no longer referenced in normal interface code. Instead the Ethernet address is accessed via the IFP2ENADDR() macro. To enforce this ac_enaddr has been renamed to _ac_enaddr. - The second argument to ether_ifattach is now always the mac address from driver private storage rather than sometimes being ac_enaddr. Reviewed by: sobomax, sam
2005-06-10 16:49:24 +00:00
return (ENOSPC);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if_initname(ifp, ifc->ifc_name, unit);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_detachtag = EVENTHANDLER_REGISTER(ifnet_departure_event,
#ifdef __FreeBSD__
pfsync_ifdetach, V_pfsyncif, EVENTHANDLER_PRI_ANY);
#else
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsync_ifdetach, pfsyncif, EVENTHANDLER_PRI_ANY);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
if (sc->sc_detachtag == NULL) {
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
if_free(ifp);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
free(sc->sc_imo.imo_membership, M_DEVBUF);
uma_zdestroy(sc->sc_pool);
free(sc, M_DEVBUF);
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
return (ENOSPC);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ifp = &sc->sc_if;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit);
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ifp->if_softc = sc;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
ifp->if_ioctl = pfsyncioctl;
ifp->if_output = pfsyncoutput;
ifp->if_start = pfsyncstart;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
ifp->if_type = IFT_PFSYNC;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
ifp->if_snd.ifq_maxlen = ifqmaxlen;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ifp->if_hdrlen = sizeof(struct pfsync_header);
ifp->if_mtu = 1500; /* XXX */
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
callout_init(&sc->sc_tmo, CALLOUT_MPSAFE);
- Fix a bad typo (FreeBSD specific) in pfsync_bulk_update(). Instead of scheduling next run pfsync_bulk_update(), pfsync_bulk_fail() was scheduled. This lead to instant 100% state leak after first bulk update request. - After above fix, it appeared that pfsync_bulk_update() lacks locking. To fix this, sc_bulk_tmo callout was converted to an mtx one. Eventually, all pf/pfsync callouts should be converted to mtx version, since it isn't possible to stop or drain a non-mtx callout without risk of race. - Add comment that callout_stop() in pfsync_clone_destroy() lacks locking. Since pfsync0 can't be destroyed (yet), let it be here.
2011-10-23 15:08:18 +00:00
callout_init_mtx(&sc->sc_bulk_tmo, &pf_task_mtx, 0);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
callout_init(&sc->sc_bulkfail_tmo, CALLOUT_MPSAFE);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ifp->if_hardmtu = MCLBYTES; /* XXX */
timeout_set(&sc->sc_tmo, pfsync_timeout, sc);
timeout_set(&sc->sc_bulk_tmo, pfsync_bulk_update, sc);
timeout_set(&sc->sc_bulkfail_tmo, pfsync_bulk_fail, sc);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
if_attach(ifp);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifndef __FreeBSD__
if_alloc_sadl(ifp);
#if NCARP > 0
if_addgroup(ifp, "carp");
#endif
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#if NBPFILTER > 0
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
bpfattach(ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bpfattach(&sc->sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
V_pfsyncif = sc;
#else
pfsyncif = sc;
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
return (0);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
void
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
int
#endif
pfsync_clone_destroy(struct ifnet *ifp)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = ifp->if_softc;
#ifdef __FreeBSD__
EVENTHANDLER_DEREGISTER(ifnet_departure_event, sc->sc_detachtag);
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
timeout_del(&sc->sc_bulk_tmo);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
timeout_del(&sc->sc_tmo);
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
#ifdef __FreeBSD__
PF_UNLOCK();
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
if (!sc->pfsync_sync_ok && carp_demote_adj_p)
(*carp_demote_adj_p)(-V_pfsync_carp_adj, "pfsync destroy");
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#if NCARP > 0
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!pfsync_sync_ok)
carp_group_demote_adj(&sc->sc_if, -1);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#if NBPFILTER > 0
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
bpfdetach(ifp);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if_detach(ifp);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_drop(sc);
while (sc->sc_deferred > 0)
pfsync_undefer(TAILQ_FIRST(&sc->sc_deferrals), 0);
#ifdef __FreeBSD__
UMA_DESTROY(sc->sc_pool);
#else
pool_destroy(&sc->sc_pool);
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
if_free(ifp);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
free(sc->sc_imo.imo_membership, M_DEVBUF);
#else
free(sc->sc_imo.imo_membership, M_IPMOPTS);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
free(sc, M_DEVBUF);
#ifdef __FreeBSD__
V_pfsyncif = NULL;
#else
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsyncif = NULL;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifndef __FreeBSD__
return (0);
#endif
}
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct mbuf *
pfsync_if_dequeue(struct ifnet *ifp)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
struct mbuf *m;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifndef __FreeBSD__
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
int s;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
IF_LOCK(&ifp->if_snd);
_IF_DROP(&ifp->if_snd);
_IF_DEQUEUE(&ifp->if_snd, m);
IF_UNLOCK(&ifp->if_snd);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splnet();
IF_DEQUEUE(&ifp->if_snd, m);
splx(s);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (m);
}
/*
* Start output on the pfsync interface.
*/
void
pfsyncstart(struct ifnet *ifp)
{
struct mbuf *m;
while ((m = pfsync_if_dequeue(ifp)) != NULL) {
#ifndef __FreeBSD__
IF_DROP(&ifp->if_snd);
#endif
m_freem(m);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
int
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsync_alloc_scrub_memory(struct pfsync_state_peer *s,
struct pf_state_peer *d)
{
if (s->scrub.scrub_flag && d->scrub == NULL) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
d->scrub = pool_get(&V_pf_state_scrub_pl, PR_NOWAIT | PR_ZERO);
#else
d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT | PR_ZERO);
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if (d->scrub == NULL)
return (ENOMEM);
}
return (0);
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifndef __FreeBSD__
void
pfsync_state_export(struct pfsync_state *sp, struct pf_state *st)
{
bzero(sp, sizeof(struct pfsync_state));
/* copy from state key */
sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
sp->proto = st->key[PF_SK_WIRE]->proto;
sp->af = st->key[PF_SK_WIRE]->af;
/* copy from state */
strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
sp->creation = htonl(time_second - st->creation);
sp->expire = pf_state_expires(st);
if (sp->expire <= time_second)
sp->expire = htonl(0);
else
sp->expire = htonl(sp->expire - time_second);
sp->direction = st->direction;
sp->log = st->log;
sp->timeout = st->timeout;
sp->state_flags = st->state_flags;
if (st->src_node)
sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
if (st->nat_src_node)
sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
bcopy(&st->id, &sp->id, sizeof(sp->id));
sp->creatorid = st->creatorid;
pf_state_peer_hton(&st->src, &sp->src);
pf_state_peer_hton(&st->dst, &sp->dst);
if (st->rule.ptr == NULL)
sp->rule = htonl(-1);
else
sp->rule = htonl(st->rule.ptr->nr);
if (st->anchor.ptr == NULL)
sp->anchor = htonl(-1);
else
sp->anchor = htonl(st->anchor.ptr->nr);
if (st->nat_rule.ptr == NULL)
sp->nat_rule = htonl(-1);
else
sp->nat_rule = htonl(st->nat_rule.ptr->nr);
pf_state_counter_hton(st->packets[0], sp->packets[0]);
pf_state_counter_hton(st->packets[1], sp->packets[1]);
pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
}
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
int
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_state_import(struct pfsync_state *sp, u_int8_t flags)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
{
struct pf_state *st = NULL;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pf_state_key *skw = NULL, *sks = NULL;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
struct pf_rule *r = NULL;
struct pfi_kif *kif;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int pool_flags;
int error;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
if (sp->creatorid == 0 && V_pf_status.debug >= PF_DEBUG_MISC) {
#else
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
printf("pfsync_state_import: invalid creator id:"
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
" %08x\n", ntohl(sp->creatorid));
return (EINVAL);
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if ((kif = pfi_kif_get(sp->ifname)) == NULL) {
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (pf_status.debug >= PF_DEBUG_MISC)
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
printf("pfsync_state_import: "
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
"unknown interface: %s\n", sp->ifname);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (flags & PFSYNC_SI_IOCTL)
return (EINVAL);
return (0); /* skip this state */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
/*
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
* If the ruleset checksums match or the state is coming from the ioctl,
* it's safe to associate the state with the rule of that number.
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
*/
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) &&
(flags & (PFSYNC_SI_IOCTL | PFSYNC_SI_CKSUM)) && ntohl(sp->rule) <
pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
r = pf_main_ruleset.rules[
PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)];
else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
r = &V_pf_default_rule;
#else
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
r = &pf_default_rule;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if ((r->max_states && r->states_cur >= r->max_states))
goto cleanup;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
if (flags & PFSYNC_SI_IOCTL)
pool_flags = PR_WAITOK | PR_ZERO;
else
Absense of M_WAITOK in malloc flags for UMA doesn't equals presense of M_NOWAIT. Specify M_NOWAIT explicitly. This fixes sleeping with PF_LOCK().
2011-10-23 10:13:20 +00:00
pool_flags = PR_NOWAIT | PR_ZERO;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if ((st = pool_get(&V_pf_state_pl, pool_flags)) == NULL)
goto cleanup;
#else
if (flags & PFSYNC_SI_IOCTL)
pool_flags = PR_WAITOK | PR_LIMITFAIL | PR_ZERO;
else
pool_flags = PR_LIMITFAIL | PR_ZERO;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if ((st = pool_get(&pf_state_pl, pool_flags)) == NULL)
goto cleanup;
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if ((skw = pf_alloc_state_key(pool_flags)) == NULL)
goto cleanup;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (PF_ANEQ(&sp->key[PF_SK_WIRE].addr[0],
&sp->key[PF_SK_STACK].addr[0], sp->af) ||
PF_ANEQ(&sp->key[PF_SK_WIRE].addr[1],
&sp->key[PF_SK_STACK].addr[1], sp->af) ||
sp->key[PF_SK_WIRE].port[0] != sp->key[PF_SK_STACK].port[0] ||
sp->key[PF_SK_WIRE].port[1] != sp->key[PF_SK_STACK].port[1]) {
if ((sks = pf_alloc_state_key(pool_flags)) == NULL)
goto cleanup;
} else
sks = skw;
/* allocate memory for scrub info */
if (pfsync_alloc_scrub_memory(&sp->src, &st->src) ||
pfsync_alloc_scrub_memory(&sp->dst, &st->dst))
goto cleanup;
/* copy to state key(s) */
skw->addr[0] = sp->key[PF_SK_WIRE].addr[0];
skw->addr[1] = sp->key[PF_SK_WIRE].addr[1];
skw->port[0] = sp->key[PF_SK_WIRE].port[0];
skw->port[1] = sp->key[PF_SK_WIRE].port[1];
skw->proto = sp->proto;
skw->af = sp->af;
if (sks != skw) {
sks->addr[0] = sp->key[PF_SK_STACK].addr[0];
sks->addr[1] = sp->key[PF_SK_STACK].addr[1];
sks->port[0] = sp->key[PF_SK_STACK].port[0];
sks->port[1] = sp->key[PF_SK_STACK].port[1];
sks->proto = sp->proto;
sks->af = sp->af;
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* copy to state */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
st->creation = time_second - ntohl(sp->creation);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
st->expire = time_second;
if (sp->expire) {
/* XXX No adaptive scaling. */
st->expire -= r->timeout[sp->timeout] - ntohl(sp->expire);
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
st->expire = ntohl(sp->expire) + time_second;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
st->direction = sp->direction;
st->log = sp->log;
st->timeout = sp->timeout;
Adapt OpenBSD pf's "sloopy" TCP state machine which is useful for Direct Server Return mode, where not all packets would be visible to the load balancer or gateway. This commit should be reverted when we merge future pf versions. The benefit it would provide is that this version does not break any existing public interface and thus won't be a problem if we want to MFC it to earlier FreeBSD releases. Discussed with: mlaier Obtained from: OpenBSD Sponsored by: iXsystems, Inc. MFC after: 1 month
2009-12-24 00:43:44 +00:00
st->state_flags = sp->state_flags;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
bcopy(sp->id, &st->id, sizeof(st->id));
st->creatorid = sp->creatorid;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pf_state_peer_ntoh(&sp->src, &st->src);
pf_state_peer_ntoh(&sp->dst, &st->dst);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
st->rule.ptr = r;
st->nat_rule.ptr = NULL;
st->anchor.ptr = NULL;
st->rt_kif = NULL;
st->pfsync_time = time_second;
st->sync_state = PFSYNC_S_NONE;
/* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
r->states_cur++;
r->states_tot++;
if (!ISSET(flags, PFSYNC_SI_IOCTL))
SET(st->state_flags, PFSTATE_NOSYNC);
if ((error = pf_state_insert(kif, skw, sks, st)) != 0) {
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
/* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
r->states_cur--;
goto cleanup_state;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!ISSET(flags, PFSYNC_SI_IOCTL)) {
CLR(st->state_flags, PFSTATE_NOSYNC);
if (ISSET(st->state_flags, PFSTATE_ACK)) {
pfsync_q_ins(st, PFSYNC_S_IACK);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
}
CLR(st->state_flags, PFSTATE_ACK);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
return (0);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
cleanup:
error = ENOMEM;
if (skw == sks)
sks = NULL;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (skw != NULL)
pool_put(&V_pf_state_key_pl, skw);
if (sks != NULL)
pool_put(&V_pf_state_key_pl, sks);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (skw != NULL)
pool_put(&pf_state_key_pl, skw);
if (sks != NULL)
pool_put(&pf_state_key_pl, sks);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
cleanup_state: /* pf_state_insert frees the state keys */
if (st) {
#ifdef __FreeBSD__
if (st->dst.scrub)
pool_put(&V_pf_state_scrub_pl, st->dst.scrub);
if (st->src.scrub)
pool_put(&V_pf_state_scrub_pl, st->src.scrub);
pool_put(&V_pf_state_pl, st);
#else
if (st->dst.scrub)
pool_put(&pf_state_scrub_pl, st->dst.scrub);
if (st->src.scrub)
pool_put(&pf_state_scrub_pl, st->src.scrub);
pool_put(&pf_state_pl, st);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
return (error);
}
void
#ifdef __FreeBSD__
pfsync_input(struct mbuf *m, __unused int off)
#else
pfsync_input(struct mbuf *m, ...)
#endif
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
struct pfsync_pkt pkt;
struct ip *ip = mtod(m, struct ip *);
struct pfsync_header *ph;
struct pfsync_subheader subh;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int offset;
int rv;
V_pfsyncstats.pfsyncs_ipackets++;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
/* verify that we have a sync interface configured */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
if (!sc || !sc->sc_sync_if || !V_pf_status.running)
#else
if (!sc || !sc->sc_sync_if || !pf_status.running)
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
/* verify that the packet came in on the right interface */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_sync_if != m->m_pkthdr.rcvif) {
V_pfsyncstats.pfsyncs_badif++;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
sc->sc_ifp->if_ipackets++;
sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
#else
sc->sc_if.if_ipackets++;
sc->sc_if.if_ibytes += m->m_pkthdr.len;
#endif
/* verify that the IP TTL is 255. */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (ip->ip_ttl != PFSYNC_DFLTTL) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
V_pfsyncstats.pfsyncs_badttl++;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
offset = ip->ip_hl << 2;
if (m->m_pkthdr.len < offset + sizeof(*ph)) {
V_pfsyncstats.pfsyncs_hdrops++;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (offset + sizeof(*ph) > m->m_len) {
if (m_pullup(m, offset + sizeof(*ph)) == NULL) {
V_pfsyncstats.pfsyncs_hdrops++;
return;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
ip = mtod(m, struct ip *);
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ph = (struct pfsync_header *)((char *)ip + offset);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
/* verify the version */
if (ph->version != PFSYNC_VERSION) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
V_pfsyncstats.pfsyncs_badver++;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#if 0
if (pfsync_input_hmac(m, offset) != 0) {
/* XXX stats */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
goto done;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
/* Cheaper to grab this now than having to mess with mbufs later */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pkt.ip = ip;
pkt.src = ip->ip_src;
pkt.flags = 0;
#ifdef __FreeBSD__
if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
#else
if (!bcmp(&ph->pfcksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
#endif
pkt.flags |= PFSYNC_SI_CKSUM;
offset += sizeof(*ph);
for (;;) {
m_copydata(m, offset, sizeof(subh), (caddr_t)&subh);
offset += sizeof(subh);
if (subh.action >= PFSYNC_ACT_MAX) {
V_pfsyncstats.pfsyncs_badact++;
goto done;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
rv = (*pfsync_acts[subh.action])(&pkt, m, offset,
ntohs(subh.count));
if (rv == -1)
return;
offset += rv;
}
done:
m_freem(m);
}
int
pfsync_in_clr(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct pfsync_clr *clr;
struct mbuf *mp;
int len = sizeof(*clr) * count;
int i, offp;
struct pf_state *st, *nexts;
struct pf_state_key *sk, *nextsk;
struct pf_state_item *si;
u_int32_t creatorid;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
clr = (struct pfsync_clr *)(mp->m_data + offp);
s = splsoftnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++) {
creatorid = clr[i].creatorid;
if (clr[i].ifname[0] == '\0') {
#ifdef __FreeBSD__
for (st = RB_MIN(pf_state_tree_id, &V_tree_id);
st; st = nexts) {
nexts = RB_NEXT(pf_state_tree_id, &V_tree_id, st);
#else
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
for (st = RB_MIN(pf_state_tree_id, &tree_id);
st; st = nexts) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
nexts = RB_NEXT(pf_state_tree_id, &tree_id, st);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
if (st->creatorid == creatorid) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
SET(st->state_flags, PFSTATE_NOSYNC);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pf_unlink_state(st);
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
} else {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (pfi_kif_get(clr[i].ifname) == NULL)
continue;
/* XXX correct? */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (sk = RB_MIN(pf_state_tree, &V_pf_statetbl);
#else
for (sk = RB_MIN(pf_state_tree, &pf_statetbl);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sk; sk = nextsk) {
nextsk = RB_NEXT(pf_state_tree,
#ifdef __FreeBSD__
&V_pf_statetbl, sk);
#else
&pf_statetbl, sk);
#endif
TAILQ_FOREACH(si, &sk->states, entry) {
if (si->s->creatorid == creatorid) {
SET(si->s->state_flags,
PFSTATE_NOSYNC);
pf_unlink_state(si->s);
}
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (len);
}
int
pfsync_in_ins(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct mbuf *mp;
struct pfsync_state *sa, *sp;
int len = sizeof(*sp) * count;
int i, offp;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sa = (struct pfsync_state *)(mp->m_data + offp);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splsoftnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++) {
sp = &sa[i];
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* check for invalid values */
if (sp->timeout >= PFTM_MAX ||
sp->src.state > PF_TCPS_PROXY_DST ||
sp->dst.state > PF_TCPS_PROXY_DST ||
sp->direction > PF_OUT ||
(sp->af != AF_INET && sp->af != AF_INET6)) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC) {
#else
if (pf_status.debug >= PF_DEBUG_MISC) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync_input: PFSYNC5_ACT_INS: "
"invalid value\n");
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
V_pfsyncstats.pfsyncs_badval++;
continue;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (pfsync_state_import(sp, pkt->flags) == ENOMEM) {
/* drop out, but process the rest of the actions */
break;
}
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
return (len);
}
int
pfsync_in_iack(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct pfsync_ins_ack *ia, *iaa;
struct pf_state_cmp id_key;
struct pf_state *st;
struct mbuf *mp;
int len = count * sizeof(*ia);
int offp, i;
int s;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
iaa = (struct pfsync_ins_ack *)(mp->m_data + offp);
s = splsoftnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++) {
ia = &iaa[i];
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bcopy(&ia->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = ia->creatorid;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
st = pf_find_state_byid(&id_key);
if (st == NULL)
continue;
if (ISSET(st->state_flags, PFSTATE_ACK))
pfsync_deferred(st, 0);
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
/*
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
* XXX this is not yet implemented, but we know the size of the
* message so we can skip it.
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
*/
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (count * sizeof(struct pfsync_ins_ack));
}
int
pfsync_upd_tcp(struct pf_state *st, struct pfsync_state_peer *src,
struct pfsync_state_peer *dst)
{
int sfail = 0;
/*
* The state should never go backwards except
* for syn-proxy states. Neither should the
* sequence window slide backwards.
*/
if (st->src.state > src->state &&
(st->src.state < PF_TCPS_PROXY_SRC ||
src->state >= PF_TCPS_PROXY_SRC))
sfail = 1;
else if (SEQ_GT(st->src.seqlo, ntohl(src->seqlo)))
sfail = 3;
else if (st->dst.state > dst->state) {
/* There might still be useful
* information about the src state here,
* so import that part of the update,
* then "fail" so we send the updated
* state back to the peer who is missing
* our what we know. */
pf_state_peer_ntoh(src, &st->src);
/* XXX do anything with timeouts? */
sfail = 7;
} else if (st->dst.state >= TCPS_SYN_SENT &&
SEQ_GT(st->dst.seqlo, ntohl(dst->seqlo)))
sfail = 4;
return (sfail);
}
int
pfsync_in_upd(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct pfsync_state *sa, *sp;
struct pf_state_cmp id_key;
struct pf_state_key *sk;
struct pf_state *st;
int sfail;
struct mbuf *mp;
int len = count * sizeof(*sp);
int offp, i;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
sa = (struct pfsync_state *)(mp->m_data + offp);
s = splsoftnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++) {
sp = &sa[i];
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* check for invalid values */
if (sp->timeout >= PFTM_MAX ||
sp->src.state > PF_TCPS_PROXY_DST ||
sp->dst.state > PF_TCPS_PROXY_DST) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC) {
#else
if (pf_status.debug >= PF_DEBUG_MISC) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync_input: PFSYNC_ACT_UPD: "
"invalid value\n");
}
V_pfsyncstats.pfsyncs_badval++;
continue;
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bcopy(sp->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = sp->creatorid;
st = pf_find_state_byid(&id_key);
if (st == NULL) {
/* insert the update */
if (pfsync_state_import(sp, 0))
V_pfsyncstats.pfsyncs_badstate++;
continue;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (ISSET(st->state_flags, PFSTATE_ACK))
pfsync_deferred(st, 1);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sk = st->key[PF_SK_WIRE]; /* XXX right one? */
sfail = 0;
if (sk->proto == IPPROTO_TCP)
sfail = pfsync_upd_tcp(st, &sp->src, &sp->dst);
else {
/*
* Non-TCP protocol state machine always go
* forwards
*/
if (st->src.state > sp->src.state)
sfail = 5;
else if (st->dst.state > sp->dst.state)
sfail = 6;
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sfail) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC) {
#else
if (pf_status.debug >= PF_DEBUG_MISC) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync: %s stale update (%d)"
" id: %016llx creatorid: %08x\n",
(sfail < 7 ? "ignoring" : "partial"),
sfail, betoh64(st->id),
ntohl(st->creatorid));
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
V_pfsyncstats.pfsyncs_stale++;
pfsync_update_state(st);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
continue;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_alloc_scrub_memory(&sp->dst, &st->dst);
pf_state_peer_ntoh(&sp->src, &st->src);
pf_state_peer_ntoh(&sp->dst, &st->dst);
st->expire = ntohl(sp->expire) + time_second;
st->timeout = sp->timeout;
st->pfsync_time = time_second;
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
return (len);
}
int
pfsync_in_upd_c(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct pfsync_upd_c *ua, *up;
struct pf_state_key *sk;
struct pf_state_cmp id_key;
struct pf_state *st;
int len = count * sizeof(*up);
int sfail;
struct mbuf *mp;
int offp, i;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ua = (struct pfsync_upd_c *)(mp->m_data + offp);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splsoftnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++) {
up = &ua[i];
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* check for invalid values */
if (up->timeout >= PFTM_MAX ||
up->src.state > PF_TCPS_PROXY_DST ||
up->dst.state > PF_TCPS_PROXY_DST) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC) {
#else
if (pf_status.debug >= PF_DEBUG_MISC) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync_input: "
"PFSYNC_ACT_UPD_C: "
"invalid value\n");
}
V_pfsyncstats.pfsyncs_badval++;
continue;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bcopy(&up->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = up->creatorid;
st = pf_find_state_byid(&id_key);
if (st == NULL) {
/* We don't have this state. Ask for it. */
pfsync_request_update(id_key.creatorid, id_key.id);
continue;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (ISSET(st->state_flags, PFSTATE_ACK))
pfsync_deferred(st, 1);
sk = st->key[PF_SK_WIRE]; /* XXX right one? */
sfail = 0;
if (sk->proto == IPPROTO_TCP)
sfail = pfsync_upd_tcp(st, &up->src, &up->dst);
else {
/*
* Non-TCP protocol state machine always go forwards
*/
if (st->src.state > up->src.state)
sfail = 5;
else if (st->dst.state > up->dst.state)
sfail = 6;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sfail) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (pf_status.debug >= PF_DEBUG_MISC) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync: ignoring stale update "
"(%d) id: %016llx "
"creatorid: %08x\n", sfail,
betoh64(st->id),
ntohl(st->creatorid));
}
V_pfsyncstats.pfsyncs_stale++;
pfsync_update_state(st);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
continue;
}
pfsync_alloc_scrub_memory(&up->dst, &st->dst);
pf_state_peer_ntoh(&up->src, &st->src);
pf_state_peer_ntoh(&up->dst, &st->dst);
st->expire = ntohl(up->expire) + time_second;
st->timeout = up->timeout;
st->pfsync_time = time_second;
}
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
splx(s);
return (len);
}
int
pfsync_in_ureq(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct pfsync_upd_req *ur, *ura;
struct mbuf *mp;
int len = count * sizeof(*ur);
int i, offp;
struct pf_state_cmp id_key;
struct pf_state *st;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
ura = (struct pfsync_upd_req *)(mp->m_data + offp);
for (i = 0; i < count; i++) {
ur = &ura[i];
bcopy(&ur->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = ur->creatorid;
if (id_key.id == 0 && id_key.creatorid == 0)
pfsync_bulk_start();
else {
st = pf_find_state_byid(&id_key);
if (st == NULL) {
V_pfsyncstats.pfsyncs_badstate++;
continue;
}
if (ISSET(st->state_flags, PFSTATE_NOSYNC))
continue;
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_update_state_req(st);
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
}
return (len);
}
int
pfsync_in_del(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct mbuf *mp;
struct pfsync_state *sa, *sp;
struct pf_state_cmp id_key;
struct pf_state *st;
int len = count * sizeof(*sp);
int offp, i;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
sa = (struct pfsync_state *)(mp->m_data + offp);
s = splsoftnet();
#ifdef __FreeBSD__
PF_LOCK();
#endif
for (i = 0; i < count; i++) {
sp = &sa[i];
bcopy(sp->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = sp->creatorid;
st = pf_find_state_byid(&id_key);
if (st == NULL) {
V_pfsyncstats.pfsyncs_badstate++;
continue;
}
SET(st->state_flags, PFSTATE_NOSYNC);
pf_unlink_state(st);
}
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
splx(s);
return (len);
}
int
pfsync_in_del_c(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
struct mbuf *mp;
struct pfsync_del_c *sa, *sp;
struct pf_state_cmp id_key;
struct pf_state *st;
int len = count * sizeof(*sp);
int offp, i;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
sa = (struct pfsync_del_c *)(mp->m_data + offp);
s = splsoftnet();
#ifdef __FreeBSD__
PF_LOCK();
#endif
for (i = 0; i < count; i++) {
sp = &sa[i];
bcopy(&sp->id, &id_key.id, sizeof(id_key.id));
id_key.creatorid = sp->creatorid;
st = pf_find_state_byid(&id_key);
if (st == NULL) {
V_pfsyncstats.pfsyncs_badstate++;
continue;
}
SET(st->state_flags, PFSTATE_NOSYNC);
pf_unlink_state(st);
}
#ifdef __FreeBSD__
Fix an obvious locking bug where we would lock again rather than unlock. MFC after: 3 days
2011-10-19 09:34:40 +00:00
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
splx(s);
return (len);
}
int
pfsync_in_bus(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
struct pfsync_bus *bus;
struct mbuf *mp;
int len = count * sizeof(*bus);
int offp;
/* If we're not waiting for a bulk update, who cares. */
if (sc->sc_ureq_sent == 0)
return (len);
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
bus = (struct pfsync_bus *)(mp->m_data + offp);
switch (bus->status) {
case PFSYNC_BUS_START:
#ifdef __FreeBSD__
callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulk_fail,
V_pfsyncif);
#else
timeout_add_sec(&sc->sc_bulkfail_tmo, 5); /* XXX magic */
#endif
#ifdef XXX
pf_pool_limits[PF_LIMIT_STATES].limit /
(PFSYNC_BULKPACKETS * sc->sc_maxcount));
#endif
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
#endif
printf("pfsync: received bulk update start\n");
break;
case PFSYNC_BUS_END:
if (time_uptime - ntohl(bus->endtime) >=
sc->sc_ureq_sent) {
/* that's it, we're happy */
sc->sc_ureq_sent = 0;
sc->sc_bulk_tries = 0;
timeout_del(&sc->sc_bulkfail_tmo);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
if (!sc->pfsync_sync_ok && carp_demote_adj_p)
(*carp_demote_adj_p)(-V_pfsync_carp_adj,
"pfsync bulk done");
sc->pfsync_sync_ok = 1;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#if NCARP > 0
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!pfsync_sync_ok)
carp_group_demote_adj(&sc->sc_if, -1);
#endif
pfsync_sync_ok = 1;
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync: received valid "
"bulk update end\n");
} else {
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
#endif
printf("pfsync: received invalid "
"bulk update end: bad timestamp\n");
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
break;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
return (len);
}
int
pfsync_in_tdb(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
int len = count * sizeof(struct pfsync_tdb);
#if defined(IPSEC)
struct pfsync_tdb *tp;
struct mbuf *mp;
int offp;
int i;
int s;
mp = m_pulldown(m, offset, len, &offp);
if (mp == NULL) {
V_pfsyncstats.pfsyncs_badlen++;
return (-1);
}
tp = (struct pfsync_tdb *)(mp->m_data + offp);
s = splsoftnet();
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
for (i = 0; i < count; i++)
pfsync_update_net_tdb(&tp[i]);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (len);
}
#if defined(IPSEC)
/* Update an in-kernel tdb. Silently fail if no tdb is found. */
void
pfsync_update_net_tdb(struct pfsync_tdb *pt)
{
struct tdb *tdb;
int s;
/* check for invalid values */
if (ntohl(pt->spi) <= SPI_RESERVED_MAX ||
(pt->dst.sa.sa_family != AF_INET &&
pt->dst.sa.sa_family != AF_INET6))
goto bad;
s = spltdb();
tdb = gettdb(pt->spi, &pt->dst, pt->sproto);
if (tdb) {
pt->rpl = ntohl(pt->rpl);
pt->cur_bytes = betoh64(pt->cur_bytes);
/* Neither replay nor byte counter should ever decrease. */
if (pt->rpl < tdb->tdb_rpl ||
pt->cur_bytes < tdb->tdb_cur_bytes) {
splx(s);
goto bad;
}
tdb->tdb_rpl = pt->rpl;
tdb->tdb_cur_bytes = pt->cur_bytes;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
return;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bad:
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
#endif
printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: "
"invalid value\n");
V_pfsyncstats.pfsyncs_badstate++;
return;
}
#endif
int
pfsync_in_eof(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
/* check if we are at the right place in the packet */
if (offset != m->m_pkthdr.len - sizeof(struct pfsync_eof))
V_pfsyncstats.pfsyncs_badact++;
/* we're done. free and let the caller return */
m_freem(m);
return (-1);
}
int
pfsync_in_error(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
{
V_pfsyncstats.pfsyncs_badact++;
m_freem(m);
return (-1);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
int
pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
struct route *rt)
#else
struct rtentry *rt)
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
m_freem(m);
return (0);
}
/* ARGSUSED */
int
pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifndef __FreeBSD__
struct proc *p = curproc;
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
struct pfsync_softc *sc = ifp->if_softc;
struct ifreq *ifr = (struct ifreq *)data;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
struct ip_moptions *imo = &sc->sc_imo;
struct pfsyncreq pfsyncr;
struct ifnet *sifp;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct ip *ip;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
int s, error;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
switch (cmd) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#if 0
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
case SIOCSIFADDR:
case SIOCAIFADDR:
case SIOCSIFDSTADDR:
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
case SIOCSIFFLAGS:
Wrap the new world order in __FreeBSD__ to ease future imports.
2005-08-09 11:59:02 +00:00
#ifdef __FreeBSD__
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
if (ifp->if_flags & IFF_UP)
Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE and IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to ifnet.if_drv_flags. Device drivers are now responsible for synchronizing access to these flags, as they are in if_drv_flags. This helps prevent races between the network stack and device driver in maintaining the interface flags field. Many __FreeBSD__ and __FreeBSD_version checks maintained and continued; some less so. Reviewed by: pjd, bz MFC after: 7 days
2005-08-09 10:20:02 +00:00
ifp->if_drv_flags |= IFF_DRV_RUNNING;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
else
Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE and IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to ifnet.if_drv_flags. Device drivers are now responsible for synchronizing access to these flags, as they are in if_drv_flags. This helps prevent races between the network stack and device driver in maintaining the interface flags field. Many __FreeBSD__ and __FreeBSD_version checks maintained and continued; some less so. Reviewed by: pjd, bz MFC after: 7 days
2005-08-09 10:20:02 +00:00
ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
Wrap the new world order in __FreeBSD__ to ease future imports.
2005-08-09 11:59:02 +00:00
#else
if (ifp->if_flags & IFF_UP)
ifp->if_flags |= IFF_RUNNING;
else
ifp->if_flags &= ~IFF_RUNNING;
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
break;
case SIOCSIFMTU:
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (ifr->ifr_mtu <= PFSYNC_MINPKT)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
return (EINVAL);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (ifr->ifr_mtu > MCLBYTES) /* XXX could be bigger */
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
ifr->ifr_mtu = MCLBYTES;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (ifr->ifr_mtu < ifp->if_mtu) {
s = splnet();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_LOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_sendout();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
}
ifp->if_mtu = ifr->ifr_mtu;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
break;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
case SIOCGETPFSYNC:
bzero(&pfsyncr, sizeof(pfsyncr));
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_sync_if) {
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
strlcpy(pfsyncr.pfsyncr_syncdev,
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_sync_if->if_xname, IFNAMSIZ);
}
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr)));
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
case SIOCSETPFSYNC:
#ifdef __FreeBSD__
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
if ((error = suser(p, p->p_acflag)) != 0)
#endif
return (error);
if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
return (error);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_LOCK();
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
if (pfsyncr.pfsyncr_syncpeer.s_addr == 0)
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#ifdef __FreeBSD__
sc->sc_sync_peer.s_addr = htonl(INADDR_PFSYNC_GROUP);
#else
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
else
sc->sc_sync_peer.s_addr =
pfsyncr.pfsyncr_syncpeer.s_addr;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (pfsyncr.pfsyncr_maxupdates > 255)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
{
PF_UNLOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
return (EINVAL);
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
if (pfsyncr.pfsyncr_syncdev[0] == 0) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_sync_if = NULL;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
if (imo->imo_num_memberships > 0) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
in_delmulti(imo->imo_membership[
--imo->imo_num_memberships]);
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
imo->imo_multicast_ifp = NULL;
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
break;
}
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
return (EINVAL);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_LOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
s = splnet();
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
if (sifp->if_mtu < sc->sc_ifp->if_mtu ||
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#else
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (sifp->if_mtu < sc->sc_if.if_mtu ||
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
(sc->sc_sync_if != NULL &&
sifp->if_mtu < sc->sc_sync_if->if_mtu) ||
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
sifp->if_mtu < MCLBYTES - sizeof(struct ip))
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_sendout();
sc->sc_sync_if = sifp;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (imo->imo_num_memberships > 0) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_LOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
imo->imo_multicast_ifp = NULL;
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_sync_if &&
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#ifdef __FreeBSD__
sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) {
#else
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
struct in_addr addr;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!(sc->sc_sync_if->if_flags & IFF_MULTICAST)) {
sc->sc_sync_if = NULL;
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
splx(s);
return (EADDRNOTAVAIL);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
addr.s_addr = htonl(INADDR_PFSYNC_GROUP);
#else
addr.s_addr = INADDR_PFSYNC_GROUP;
#endif
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if ((imo->imo_membership[0] =
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
in_addmulti(&addr, sc->sc_sync_if)) == NULL) {
sc->sc_sync_if = NULL;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
splx(s);
return (ENOBUFS);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
PF_LOCK();
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
imo->imo_num_memberships++;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
imo->imo_multicast_ifp = sc->sc_sync_if;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
imo->imo_multicast_ttl = PFSYNC_DFLTTL;
imo->imo_multicast_loop = 0;
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ip = &sc->sc_template;
bzero(ip, sizeof(*ip));
ip->ip_v = IPVERSION;
ip->ip_hl = sizeof(sc->sc_template) >> 2;
ip->ip_tos = IPTOS_LOWDELAY;
/* len and id are set later */
In FreeBSD ip_output() expects ip_len and ip_off in host byte order PR: kern/159029
2011-10-21 11:11:18 +00:00
#ifdef __FreeBSD__
ip->ip_off = IP_DF;
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ip->ip_off = htons(IP_DF);
In FreeBSD ip_output() expects ip_len and ip_off in host byte order PR: kern/159029
2011-10-21 11:11:18 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ip->ip_ttl = PFSYNC_DFLTTL;
ip->ip_p = IPPROTO_PFSYNC;
ip->ip_src.s_addr = INADDR_ANY;
ip->ip_dst.s_addr = sc->sc_sync_peer.s_addr;
if (sc->sc_sync_if) {
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
/* Request a full state table update. */
sc->sc_ureq_sent = time_uptime;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
if (sc->pfsync_sync_ok && carp_demote_adj_p)
(*carp_demote_adj_p)(V_pfsync_carp_adj,
"pfsync bulk start");
sc->pfsync_sync_ok = 0;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#if NCARP > 0
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
if (pfsync_sync_ok)
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
carp_group_demote_adj(&sc->sc_if, 1);
#endif
pfsync_sync_ok = 0;
#endif
#ifdef __FreeBSD__
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
#endif
printf("pfsync: requesting bulk update\n");
#ifdef __FreeBSD__
Fix indentation, no code changed.
2011-10-23 15:10:15 +00:00
callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
pfsync_bulk_fail, V_pfsyncif);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
timeout_add_sec(&sc->sc_bulkfail_tmo, 5);
#endif
pfsync_request_update(0, 0);
}
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
splx(s);
break;
default:
return (ENOTTY);
}
return (0);
}
int
pfsync_out_state(struct pf_state *st, struct mbuf *m, int offset)
{
struct pfsync_state *sp = (struct pfsync_state *)(m->m_data + offset);
pfsync_state_export(sp, st);
return (sizeof(*sp));
}
int
pfsync_out_iack(struct pf_state *st, struct mbuf *m, int offset)
{
struct pfsync_ins_ack *iack =
(struct pfsync_ins_ack *)(m->m_data + offset);
iack->id = st->id;
iack->creatorid = st->creatorid;
return (sizeof(*iack));
}
int
pfsync_out_upd_c(struct pf_state *st, struct mbuf *m, int offset)
{
struct pfsync_upd_c *up = (struct pfsync_upd_c *)(m->m_data + offset);
up->id = st->id;
pf_state_peer_hton(&st->src, &up->src);
pf_state_peer_hton(&st->dst, &up->dst);
up->creatorid = st->creatorid;
up->expire = pf_state_expires(st);
if (up->expire <= time_second)
up->expire = htonl(0);
else
up->expire = htonl(up->expire - time_second);
up->timeout = st->timeout;
bzero(up->_pad, sizeof(up->_pad)); /* XXX */
return (sizeof(*up));
}
int
pfsync_out_del(struct pf_state *st, struct mbuf *m, int offset)
{
struct pfsync_del_c *dp = (struct pfsync_del_c *)(m->m_data + offset);
dp->id = st->id;
dp->creatorid = st->creatorid;
SET(st->state_flags, PFSTATE_NOSYNC);
return (sizeof(*dp));
}
void
pfsync_drop(struct pfsync_softc *sc)
{
struct pf_state *st;
struct pfsync_upd_req_item *ur;
#ifdef notyet
struct tdb *t;
#endif
int q;
for (q = 0; q < PFSYNC_S_COUNT; q++) {
if (TAILQ_EMPTY(&sc->sc_qs[q]))
continue;
TAILQ_FOREACH(st, &sc->sc_qs[q], sync_list) {
#ifdef PFSYNC_DEBUG
#ifdef __FreeBSD__
KASSERT(st->sync_state == q,
("%s: st->sync_state == q",
__FUNCTION__));
#else
KASSERT(st->sync_state == q);
#endif
#endif
st->sync_state = PFSYNC_S_NONE;
}
TAILQ_INIT(&sc->sc_qs[q]);
}
while ((ur = TAILQ_FIRST(&sc->sc_upd_req_list)) != NULL) {
TAILQ_REMOVE(&sc->sc_upd_req_list, ur, ur_entry);
pool_put(&sc->sc_pool, ur);
}
sc->sc_plus = NULL;
#ifdef notyet
if (!TAILQ_EMPTY(&sc->sc_tdb_q)) {
TAILQ_FOREACH(t, &sc->sc_tdb_q, tdb_sync_entry)
CLR(t->tdb_flags, TDBF_PFSYNC);
TAILQ_INIT(&sc->sc_tdb_q);
}
#endif
sc->sc_len = PFSYNC_MINPKT;
}
void
pfsync_sendout(void)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
#if NBPFILTER > 0
#ifdef __FreeBSD__
struct ifnet *ifp = sc->sc_ifp;
#else
struct ifnet *ifp = &sc->sc_if;
#endif
#endif
Fix build failure without BPF. Reported by: deeptech71 at gmail dot com Approved by: re (kib)
2011-08-17 13:02:50 +00:00
struct mbuf *m;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct ip *ip;
struct pfsync_header *ph;
struct pfsync_subheader *subh;
struct pf_state *st;
struct pfsync_upd_req_item *ur;
#ifdef notyet
struct tdb *t;
#endif
#ifdef __FreeBSD__
size_t pktlen;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
int dummy_error;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
int offset;
int q, count = 0;
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_NET);
#endif
if (sc == NULL || sc->sc_len == PFSYNC_MINPKT)
return;
#if NBPFILTER > 0
if (ifp->if_bpf == NULL && sc->sc_sync_if == NULL) {
#else
if (sc->sc_sync_if == NULL) {
#endif
pfsync_drop(sc);
return;
}
MGETHDR(m, M_DONTWAIT, MT_DATA);
if (m == NULL) {
#ifdef __FreeBSD__
sc->sc_ifp->if_oerrors++;
#else
sc->sc_if.if_oerrors++;
#endif
V_pfsyncstats.pfsyncs_onomem++;
pfsync_drop(sc);
return;
}
#ifdef __FreeBSD__
pktlen = max_linkhdr + sc->sc_len;
if (pktlen > MHLEN) {
/* Find the right pool to allocate from. */
/* XXX: This is ugly. */
m_cljget(m, M_DONTWAIT, pktlen <= MSIZE ? MSIZE :
pktlen <= MCLBYTES ? MCLBYTES :
#if MJUMPAGESIZE != MCLBYTES
pktlen <= MJUMPAGESIZE ? MJUMPAGESIZE :
#endif
pktlen <= MJUM9BYTES ? MJUM9BYTES : MJUM16BYTES);
#else
if (max_linkhdr + sc->sc_len > MHLEN) {
MCLGETI(m, M_DONTWAIT, NULL, max_linkhdr + sc->sc_len);
#endif
if (!ISSET(m->m_flags, M_EXT)) {
m_free(m);
#ifdef __FreeBSD__
sc->sc_ifp->if_oerrors++;
#else
sc->sc_if.if_oerrors++;
#endif
V_pfsyncstats.pfsyncs_onomem++;
pfsync_drop(sc);
return;
}
}
m->m_data += max_linkhdr;
m->m_len = m->m_pkthdr.len = sc->sc_len;
/* build the ip header */
ip = (struct ip *)m->m_data;
bcopy(&sc->sc_template, ip, sizeof(*ip));
offset = sizeof(*ip);
In FreeBSD ip_output() expects ip_len and ip_off in host byte order PR: kern/159029
2011-10-21 11:11:18 +00:00
#ifdef __FreeBSD__
ip->ip_len = m->m_pkthdr.len;
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ip->ip_len = htons(m->m_pkthdr.len);
In FreeBSD ip_output() expects ip_len and ip_off in host byte order PR: kern/159029
2011-10-21 11:11:18 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
ip->ip_id = htons(ip_randomid());
/* build the pfsync header */
ph = (struct pfsync_header *)(m->m_data + offset);
bzero(ph, sizeof(*ph));
offset += sizeof(*ph);
ph->version = PFSYNC_VERSION;
ph->len = htons(sc->sc_len - sizeof(*ip));
#ifdef __FreeBSD__
bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
#else
bcopy(pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
#endif
/* walk the queues */
for (q = 0; q < PFSYNC_S_COUNT; q++) {
if (TAILQ_EMPTY(&sc->sc_qs[q]))
continue;
subh = (struct pfsync_subheader *)(m->m_data + offset);
offset += sizeof(*subh);
count = 0;
TAILQ_FOREACH(st, &sc->sc_qs[q], sync_list) {
#ifdef PFSYNC_DEBUG
#ifdef __FreeBSD__
KASSERT(st->sync_state == q,
("%s: st->sync_state == q",
__FUNCTION__));
#else
KASSERT(st->sync_state == q);
#endif
#endif
offset += pfsync_qs[q].write(st, m, offset);
st->sync_state = PFSYNC_S_NONE;
count++;
}
TAILQ_INIT(&sc->sc_qs[q]);
bzero(subh, sizeof(*subh));
subh->action = pfsync_qs[q].action;
subh->count = htons(count);
}
if (!TAILQ_EMPTY(&sc->sc_upd_req_list)) {
subh = (struct pfsync_subheader *)(m->m_data + offset);
offset += sizeof(*subh);
count = 0;
while ((ur = TAILQ_FIRST(&sc->sc_upd_req_list)) != NULL) {
TAILQ_REMOVE(&sc->sc_upd_req_list, ur, ur_entry);
bcopy(&ur->ur_msg, m->m_data + offset,
sizeof(ur->ur_msg));
offset += sizeof(ur->ur_msg);
pool_put(&sc->sc_pool, ur);
count++;
}
bzero(subh, sizeof(*subh));
subh->action = PFSYNC_ACT_UPD_REQ;
subh->count = htons(count);
}
/* has someone built a custom region for us to add? */
if (sc->sc_plus != NULL) {
bcopy(sc->sc_plus, m->m_data + offset, sc->sc_pluslen);
offset += sc->sc_pluslen;
sc->sc_plus = NULL;
}
#ifdef notyet
if (!TAILQ_EMPTY(&sc->sc_tdb_q)) {
subh = (struct pfsync_subheader *)(m->m_data + offset);
offset += sizeof(*subh);
count = 0;
TAILQ_FOREACH(t, &sc->sc_tdb_q, tdb_sync_entry) {
offset += pfsync_out_tdb(t, m, offset);
CLR(t->tdb_flags, TDBF_PFSYNC);
count++;
}
TAILQ_INIT(&sc->sc_tdb_q);
bzero(subh, sizeof(*subh));
subh->action = PFSYNC_ACT_TDB;
subh->count = htons(count);
}
#endif
subh = (struct pfsync_subheader *)(m->m_data + offset);
offset += sizeof(*subh);
bzero(subh, sizeof(*subh));
subh->action = PFSYNC_ACT_EOF;
subh->count = htons(1);
/* XXX write checksum in EOF here */
/* we're done, let's put it on the wire */
#if NBPFILTER > 0
if (ifp->if_bpf) {
m->m_data += sizeof(*ip);
m->m_len = m->m_pkthdr.len = sc->sc_len - sizeof(*ip);
#ifdef __FreeBSD__
BPF_MTAP(ifp, m);
#else
bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
#endif
m->m_data -= sizeof(*ip);
m->m_len = m->m_pkthdr.len = sc->sc_len;
}
if (sc->sc_sync_if == NULL) {
sc->sc_len = PFSYNC_MINPKT;
m_freem(m);
return;
}
#endif
#ifdef __FreeBSD__
sc->sc_ifp->if_opackets++;
sc->sc_ifp->if_obytes += m->m_pkthdr.len;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
sc->sc_len = PFSYNC_MINPKT;
IFQ_ENQUEUE(&sc->sc_ifp->if_snd, m, dummy_error);
schednetisr(NETISR_PFSYNC);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
sc->sc_if.if_opackets++;
sc->sc_if.if_obytes += m->m_pkthdr.len;
if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL) == 0)
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
pfsyncstats.pfsyncs_opackets++;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
else
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
pfsyncstats.pfsyncs_oerrors++;
/* start again */
sc->sc_len = PFSYNC_MINPKT;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
}
void
pfsync_insert_state(struct pf_state *st)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_SOFTNET);
#endif
if (ISSET(st->rule.ptr->rule_flag, PFRULE_NOSYNC) ||
st->key[PF_SK_WIRE]->proto == IPPROTO_PFSYNC) {
SET(st->state_flags, PFSTATE_NOSYNC);
return;
}
if (sc == NULL || ISSET(st->state_flags, PFSTATE_NOSYNC))
return;
#ifdef PFSYNC_DEBUG
#ifdef __FreeBSD__
KASSERT(st->sync_state == PFSYNC_S_NONE,
("%s: st->sync_state == PFSYNC_S_NONE", __FUNCTION__));
#else
KASSERT(st->sync_state == PFSYNC_S_NONE);
#endif
#endif
if (sc->sc_len == PFSYNC_MINPKT)
#ifdef __FreeBSD__
callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
V_pfsyncif);
#else
timeout_add_sec(&sc->sc_tmo, 1);
#endif
pfsync_q_ins(st, PFSYNC_S_INS);
if (ISSET(st->state_flags, PFSTATE_ACK))
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
else
st->sync_updates = 0;
}
int defer = 10;
int
pfsync_defer(struct pf_state *st, struct mbuf *m)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
struct pfsync_deferral *pd;
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_SOFTNET);
#endif
if (sc->sc_deferred >= 128)
pfsync_undefer(TAILQ_FIRST(&sc->sc_deferrals), 0);
pd = pool_get(&sc->sc_pool, M_NOWAIT);
if (pd == NULL)
return (0);
sc->sc_deferred++;
#ifdef __FreeBSD__
m->m_flags |= M_SKIP_FIREWALL;
#else
m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
#endif
SET(st->state_flags, PFSTATE_ACK);
pd->pd_st = st;
pd->pd_m = m;
TAILQ_INSERT_TAIL(&sc->sc_deferrals, pd, pd_entry);
#ifdef __FreeBSD__
callout_init(&pd->pd_tmo, CALLOUT_MPSAFE);
callout_reset(&pd->pd_tmo, defer, pfsync_defer_tmo,
pd);
#else
timeout_set(&pd->pd_tmo, pfsync_defer_tmo, pd);
timeout_add(&pd->pd_tmo, defer);
#endif
return (1);
}
void
pfsync_undefer(struct pfsync_deferral *pd, int drop)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
int s;
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_SOFTNET);
#endif
TAILQ_REMOVE(&sc->sc_deferrals, pd, pd_entry);
sc->sc_deferred--;
CLR(pd->pd_st->state_flags, PFSTATE_ACK);
timeout_del(&pd->pd_tmo); /* bah */
if (drop)
m_freem(pd->pd_m);
else {
s = splnet();
#ifdef __FreeBSD__
/* XXX: use pf_defered?! */
PF_UNLOCK();
#endif
ip_output(pd->pd_m, (void *)NULL, (void *)NULL, 0,
(void *)NULL, (void *)NULL);
#ifdef __FreeBSD__
PF_LOCK();
#endif
splx(s);
}
pool_put(&sc->sc_pool, pd);
}
void
pfsync_defer_tmo(void *arg)
{
#if defined(__FreeBSD__) && defined(VIMAGE)
struct pfsync_deferral *pd = arg;
#endif
int s;
s = splsoftnet();
#ifdef __FreeBSD__
CURVNET_SET(pd->pd_m->m_pkthdr.rcvif->if_vnet); /* XXX */
PF_LOCK();
#endif
pfsync_undefer(arg, 0);
#ifdef __FreeBSD__
PF_UNLOCK();
CURVNET_RESTORE();
#endif
splx(s);
}
void
pfsync_deferred(struct pf_state *st, int drop)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
struct pfsync_deferral *pd;
TAILQ_FOREACH(pd, &sc->sc_deferrals, pd_entry) {
if (pd->pd_st == st) {
pfsync_undefer(pd, drop);
return;
}
}
panic("pfsync_send_deferred: unable to find deferred state");
}
u_int pfsync_upds = 0;
void
pfsync_update_state(struct pf_state *st)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
int sync = 0;
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_SOFTNET);
#endif
if (sc == NULL)
return;
if (ISSET(st->state_flags, PFSTATE_ACK))
pfsync_deferred(st, 0);
if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
if (st->sync_state != PFSYNC_S_NONE)
pfsync_q_del(st);
return;
}
if (sc->sc_len == PFSYNC_MINPKT)
#ifdef __FreeBSD__
callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
V_pfsyncif);
#else
timeout_add_sec(&sc->sc_tmo, 1);
#endif
switch (st->sync_state) {
case PFSYNC_S_UPD_C:
case PFSYNC_S_UPD:
case PFSYNC_S_INS:
/* we're already handling it */
st->sync_updates++;
if (st->sync_updates >= sc->sc_maxupdates)
sync = 1;
break;
case PFSYNC_S_IACK:
pfsync_q_del(st);
case PFSYNC_S_NONE:
pfsync_q_ins(st, PFSYNC_S_UPD_C);
st->sync_updates = 0;
break;
default:
panic("pfsync_update_state: unexpected sync state %d",
st->sync_state);
}
if (sync || (time_second - st->pfsync_time) < 2) {
pfsync_upds++;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
}
void
pfsync_request_update(u_int32_t creatorid, u_int64_t id)
{
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
struct pfsync_upd_req_item *item;
size_t nlen = sizeof(struct pfsync_upd_req);
int s;
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/*
* this code does nothing to prevent multiple update requests for the
* same state being generated.
*/
item = pool_get(&sc->sc_pool, PR_NOWAIT);
if (item == NULL) {
/* XXX stats */
return;
}
item->ur_msg.id = id;
item->ur_msg.creatorid = creatorid;
if (TAILQ_EMPTY(&sc->sc_upd_req_list))
nlen += sizeof(struct pfsync_subheader);
#ifdef __FreeBSD__
We really mean MTU of the real interface here, not of our pseudo.
2011-12-22 18:51:35 +00:00
if (sc->sc_len + nlen > sc->sc_sync_if->if_mtu) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
#endif
s = splnet();
pfsync_sendout();
splx(s);
nlen = sizeof(struct pfsync_subheader) +
sizeof(struct pfsync_upd_req);
}
TAILQ_INSERT_TAIL(&sc->sc_upd_req_list, item, ur_entry);
sc->sc_len += nlen;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
void
pfsync_update_state_req(struct pf_state *st)
{
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL)
panic("pfsync_update_state_req: nonexistant instance");
if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
if (st->sync_state != PFSYNC_S_NONE)
pfsync_q_del(st);
return;
}
switch (st->sync_state) {
case PFSYNC_S_UPD_C:
case PFSYNC_S_IACK:
pfsync_q_del(st);
case PFSYNC_S_NONE:
pfsync_q_ins(st, PFSYNC_S_UPD);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#ifdef __FreeBSD__
pfsync_sendout();
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
schednetisr(NETISR_PFSYNC);
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return;
case PFSYNC_S_INS:
case PFSYNC_S_UPD:
case PFSYNC_S_DEL:
/* we're already handling it */
return;
default:
panic("pfsync_update_state_req: unexpected sync state %d",
st->sync_state);
}
}
void
pfsync_delete_state(struct pf_state *st)
{
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
splassert(IPL_SOFTNET);
Resolve conflicts created during the import of pf 3.7 Some features are missing and will be implemented in a second step. This is functional as is. Tested by: freebsd-pf, pfsense.org Obtained from: OpenBSD X-MFC after: never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL)
return;
if (ISSET(st->state_flags, PFSTATE_ACK))
pfsync_deferred(st, 1);
if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
if (st->sync_state != PFSYNC_S_NONE)
pfsync_q_del(st);
return;
}
if (sc->sc_len == PFSYNC_MINPKT)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
V_pfsyncif);
#else
timeout_add_sec(&sc->sc_tmo, 1);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
switch (st->sync_state) {
case PFSYNC_S_INS:
/* we never got to tell the world so just forget about it */
pfsync_q_del(st);
return;
case PFSYNC_S_UPD_C:
case PFSYNC_S_UPD:
case PFSYNC_S_IACK:
pfsync_q_del(st);
/* FALLTHROUGH to putting it on the del list */
case PFSYNC_S_NONE:
pfsync_q_ins(st, PFSYNC_S_DEL);
return;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
default:
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
panic("pfsync_delete_state: unexpected sync state %d",
st->sync_state);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
}
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_clear_states(u_int32_t creatorid, const char *ifname)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct {
struct pfsync_subheader subh;
struct pfsync_clr clr;
} __packed r;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#ifdef __FreeBSD__
Adjust the PF_ASSERT() macro to what we usually use in the network stack: PF_LOCK_ASSERT() and PF_UNLOCK_ASSERT(). MFC after: 3 days
2011-10-19 10:16:42 +00:00
PF_LOCK_ASSERT();
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splassert(IPL_SOFTNET);
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL)
return;
bzero(&r, sizeof(r));
r.subh.action = PFSYNC_ACT_CLR;
r.subh.count = htons(1);
strlcpy(r.clr.ifname, ifname, sizeof(r.clr.ifname));
r.clr.creatorid = creatorid;
pfsync_send_plus(&r, sizeof(r));
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void
pfsync_q_ins(struct pf_state *st, int q)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
size_t nlen = pfsync_qs[q].len;
int s;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
KASSERT(st->sync_state == PFSYNC_S_NONE,
("%s: st->sync_state == PFSYNC_S_NONE", __FUNCTION__));
#else
KASSERT(st->sync_state == PFSYNC_S_NONE);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#if 1 || defined(PFSYNC_DEBUG)
if (sc->sc_len < PFSYNC_MINPKT)
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
panic("pfsync pkt len is too low %zu", sc->sc_len);
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
panic("pfsync pkt len is too low %d", sc->sc_len);
Access softc embedded struct ifnet via function macro to make it easier to untangle struct ifnet and softc/arpcom in the future. Requested by: brooks
2005-02-09 19:29:13 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (TAILQ_EMPTY(&sc->sc_qs[q]))
nlen += sizeof(struct pfsync_subheader);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_len + nlen > sc->sc_ifp->if_mtu) {
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splnet();
pfsync_sendout();
splx(s);
nlen = sizeof(struct pfsync_subheader) + pfsync_qs[q].len;
}
sc->sc_len += nlen;
TAILQ_INSERT_TAIL(&sc->sc_qs[q], st, sync_list);
st->sync_state = q;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void
pfsync_q_del(struct pf_state *st)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int q = st->sync_state;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
KASSERT(st->sync_state != PFSYNC_S_NONE,
("%s: st->sync_state != PFSYNC_S_NONE", __FUNCTION__));
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
KASSERT(st->sync_state != PFSYNC_S_NONE);
Fix byteorder of syncpeer and make it actually work. Submitted by: glebius MFC after: 1 week
2006-06-14 11:11:54 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_len -= pfsync_qs[q].len;
TAILQ_REMOVE(&sc->sc_qs[q], st, sync_list);
st->sync_state = PFSYNC_S_NONE;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (TAILQ_EMPTY(&sc->sc_qs[q]))
sc->sc_len -= sizeof(struct pfsync_subheader);
}
#ifdef notyet
void
pfsync_update_tdb(struct tdb *t, int output)
{
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
size_t nlen = sizeof(struct pfsync_tdb);
int s;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL)
return;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!ISSET(t->tdb_flags, TDBF_PFSYNC)) {
if (TAILQ_EMPTY(&sc->sc_tdb_q))
nlen += sizeof(struct pfsync_subheader);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
s = splnet();
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_sendout();
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
nlen = sizeof(struct pfsync_subheader) +
sizeof(struct pfsync_tdb);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_len += nlen;
TAILQ_INSERT_TAIL(&sc->sc_tdb_q, t, tdb_sync_entry);
SET(t->tdb_flags, TDBF_PFSYNC);
t->tdb_updates = 0;
} else {
if (++t->tdb_updates >= sc->sc_maxupdates)
schednetisr(NETISR_PFSYNC);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (output)
SET(t->tdb_flags, TDBF_PFSYNC_RPL);
else
CLR(t->tdb_flags, TDBF_PFSYNC_RPL);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void
pfsync_delete_tdb(struct tdb *t)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL || !ISSET(t->tdb_flags, TDBF_PFSYNC))
return;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_len -= sizeof(struct pfsync_tdb);
TAILQ_REMOVE(&sc->sc_tdb_q, t, tdb_sync_entry);
CLR(t->tdb_flags, TDBF_PFSYNC);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (TAILQ_EMPTY(&sc->sc_tdb_q))
sc->sc_len -= sizeof(struct pfsync_subheader);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
int
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_out_tdb(struct tdb *t, struct mbuf *m, int offset)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_tdb *ut = (struct pfsync_tdb *)(m->m_data + offset);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bzero(ut, sizeof(*ut));
ut->spi = t->tdb_spi;
bcopy(&t->tdb_dst, &ut->dst, sizeof(ut->dst));
/*
* When a failover happens, the master's rpl is probably above
* what we see here (we may be up to a second late), so
* increase it a bit for outbound tdbs to manage most such
* situations.
*
* For now, just add an offset that is likely to be larger
* than the number of packets we can see in one second. The RFC
* just says the next packet must have a higher seq value.
*
* XXX What is a good algorithm for this? We could use
* a rate-determined increase, but to know it, we would have
* to extend struct tdb.
* XXX pt->rpl can wrap over MAXINT, but if so the real tdb
* will soon be replaced anyway. For now, just don't handle
* this edge case.
*/
#define RPL_INCR 16384
ut->rpl = htonl(t->tdb_rpl + (ISSET(t->tdb_flags, TDBF_PFSYNC_RPL) ?
RPL_INCR : 0));
ut->cur_bytes = htobe64(t->tdb_cur_bytes);
ut->sproto = t->tdb_sproto;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (sizeof(*ut));
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_bulk_start(void)
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
struct pfsync_softc *sc = V_pfsyncif;
#else
struct pfsync_softc *sc = pfsyncif;
#endif
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC)
#else
if (pf_status.debug >= PF_DEBUG_MISC)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync: received bulk update request\n");
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
#ifdef __FreeBSD__
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK();
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
if (TAILQ_EMPTY(&V_state_list))
#else
if (TAILQ_EMPTY(&state_list))
#endif
pfsync_bulk_status(PFSYNC_BUS_END);
else {
sc->sc_ureq_received = time_uptime;
if (sc->sc_bulk_next == NULL)
#ifdef __FreeBSD__
sc->sc_bulk_next = TAILQ_FIRST(&V_state_list);
#else
sc->sc_bulk_next = TAILQ_FIRST(&state_list);
#endif
sc->sc_bulk_last = sc->sc_bulk_next;
pfsync_bulk_status(PFSYNC_BUS_START);
callout_reset(&sc->sc_bulk_tmo, 1,
pfsync_bulk_update, sc);
}
#ifdef __FreeBSD__
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_UNLOCK();
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
#endif
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_bulk_update(void *arg)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = arg;
struct pf_state *st = sc->sc_bulk_next;
int i = 0;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
int s;
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splsoftnet();
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_SET(sc->sc_ifp->if_vnet);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
for (;;) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (st->sync_state == PFSYNC_S_NONE &&
st->timeout < PFTM_MAX &&
st->pfsync_time <= sc->sc_ureq_received) {
pfsync_update_state_req(st);
i++;
}
st = TAILQ_NEXT(st, entry_list);
if (st == NULL)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
st = TAILQ_FIRST(&V_state_list);
#else
st = TAILQ_FIRST(&state_list);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
if (st == sc->sc_bulk_last) {
/* we're done */
sc->sc_bulk_next = NULL;
sc->sc_bulk_last = NULL;
pfsync_bulk_status(PFSYNC_BUS_END);
break;
}
#ifdef __FreeBSD__
if (i > 1 && (sc->sc_ifp->if_mtu - sc->sc_len) <
#else
if (i > 1 && (sc->sc_if.if_mtu - sc->sc_len) <
#endif
sizeof(struct pfsync_state)) {
/* we've filled a packet */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_bulk_next = st;
#ifdef __FreeBSD__
callout_reset(&sc->sc_bulk_tmo, 1,
- Fix a bad typo (FreeBSD specific) in pfsync_bulk_update(). Instead of scheduling next run pfsync_bulk_update(), pfsync_bulk_fail() was scheduled. This lead to instant 100% state leak after first bulk update request. - After above fix, it appeared that pfsync_bulk_update() lacks locking. To fix this, sc_bulk_tmo callout was converted to an mtx one. Eventually, all pf/pfsync callouts should be converted to mtx version, since it isn't possible to stop or drain a non-mtx callout without risk of race. - Add comment that callout_stop() in pfsync_clone_destroy() lacks locking. Since pfsync0 can't be destroyed (yet), let it be here.
2011-10-23 15:08:18 +00:00
pfsync_bulk_update, sc);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
timeout_add(&sc->sc_bulk_tmo, 1);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
break;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_RESTORE();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
splx(s);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_bulk_status(u_int8_t status)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct {
struct pfsync_subheader subh;
struct pfsync_bus bus;
} __packed r;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
bzero(&r, sizeof(r));
r.subh.action = PFSYNC_ACT_BUS;
r.subh.count = htons(1);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
r.bus.creatorid = V_pf_status.hostid;
#else
r.bus.creatorid = pf_status.hostid;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
r.bus.endtime = htonl(time_uptime - sc->sc_ureq_received);
r.bus.status = status;
pfsync_send_plus(&r, sizeof(r));
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
}
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_bulk_fail(void *arg)
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = arg;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_SET(sc->sc_ifp->if_vnet);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* Try again */
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
pfsync_bulk_fail, V_pfsyncif);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
timeout_add_sec(&sc->sc_bulkfail_tmo, 5);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_request_update(0, 0);
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_UNLOCK();
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
} else {
/* Pretend like the transfer was ok */
sc->sc_ureq_sent = 0;
sc->sc_bulk_tries = 0;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
if (!sc->pfsync_sync_ok && carp_demote_adj_p)
(*carp_demote_adj_p)(-V_pfsync_carp_adj,
"pfsync bulk fail");
sc->pfsync_sync_ok = 1;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Restore a feature that was present in 5.x and 6.x, and was cleared in 7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP preemption, while it is running its bulk update. However, reimplement the feature in more elegant manner, that is partially inspired by newer OpenBSD: - Rename term "suppression" to "demotion", to match with OpenBSD. - Keep a global demotion factor, that can be raised by several conditions, for now these are: - interface goes down - carp(4) has problems with ip_output() or ip6_output() - pfsync performs bulk update - Unlike in OpenBSD the demotion factor isn't a counter, but is actual value added to advskew. The adjustment values for particular error conditions are also configurable, and their defaults are maximum advskew value, so a single failure bumps demotion to maximum. This is for POLA compatibility, and should satisfy most users. - Demotion factor is a writable sysctl, so user can do foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
#if NCARP > 0
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (!pfsync_sync_ok)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
carp_group_demote_adj(&sc->sc_if, -1);
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_sync_ok = 1;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (V_pf_status.debug >= PF_DEBUG_MISC)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (pf_status.debug >= PF_DEBUG_MISC)
Compile pfsync w/o bpf. Noticed by: "Jayel Villamin" <jarthel operamail com>
2004-12-10 17:42:47 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
printf("pfsync: failed to receive bulk update\n");
}
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_RESTORE();
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
}
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
void
pfsync_send_plus(void *plus, size_t pluslen)
{
Various bpf(4) related fixes to catch places up to the new bpf(4) semantics. - Stop testing bpf pointers for NULL. In some cases use bpf_peers_present() and then call the function directly inside the conditional block instead of the macro. - For places where the entire conditional block is the macro, remove the test and make the macro unconditional. - Use BPF_MTAP() in if_pfsync on FreeBSD instead of an expanded version of the old semantics. Reviewed by: csjp (older version)
2006-12-29 13:59:50 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Various bpf(4) related fixes to catch places up to the new bpf(4) semantics. - Stop testing bpf pointers for NULL. In some cases use bpf_peers_present() and then call the function directly inside the conditional block instead of the macro. - For places where the entire conditional block is the macro, remove the test and make the macro unconditional. - Use BPF_MTAP() in if_pfsync on FreeBSD instead of an expanded version of the old semantics. Reviewed by: csjp (older version)
2006-12-29 13:59:50 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int s;
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Fix recursive pf locking leading to panics. Splatter PF_LOCK_ASSERT()s to document where we are expecting to be called with a lock held to more easily catch unnoticed code paths. This does not neccessarily improve locking in pfsync, it just tries to avoid the panics reported. PR: kern/159390, kern/158873 Submitted by: pluknet (at least something that partly resembles my patch ignoring other cleanup, which I only saw too late on the 2nd PR) MFC After: 3 days
2011-10-19 13:13:56 +00:00
PF_LOCK_ASSERT();
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_len + pluslen > sc->sc_ifp->if_mtu) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc->sc_len + pluslen > sc->sc_if.if_mtu) {
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splnet();
pfsync_sendout();
splx(s);
}
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_plus = plus;
sc->sc_len += (sc->sc_pluslen = pluslen);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splnet();
pfsync_sendout();
splx(s);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
int
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_up(void)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
{
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL || !ISSET(sc->sc_ifp->if_flags, IFF_DRV_RUNNING))
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL || !ISSET(sc->sc_if.if_flags, IFF_RUNNING))
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (0);
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (1);
}
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int
pfsync_state_in_use(struct pf_state *st)
{
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#ifdef __FreeBSD__
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = V_pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#else
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
struct pfsync_softc *sc = pfsyncif;
Commit pf version 3.5 and link additional files to the kernel build. Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ...
2004-06-16 23:24:02 +00:00
#endif
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL)
return (0);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
if (st->sync_state != PFSYNC_S_NONE ||
st == sc->sc_bulk_next ||
st == sc->sc_bulk_last)
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (1);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
Merge several fixes to bulk update processing from OpenBSD. Merged revisions: 1.148, 1.149, 1.150. This makes number of states on master/slave to be of a sane value.
2011-10-23 15:15:17 +00:00
return (0);
Vendor import of OpenBSD's packet filter (pf) as of OpenBSD 3.4 Approved by: bms(mentor), core (in general)
2004-02-26 02:04:28 +00:00
}
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
u_int pfsync_ints;
u_int pfsync_tmos;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_timeout(void *arg)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#if defined(__FreeBSD__) && defined(VIMAGE)
struct pfsync_softc *sc = arg;
#endif
int s;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
CURVNET_SET(sc->sc_ifp->if_vnet);
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_tmos++;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
s = splnet();
#ifdef __FreeBSD__
PF_LOCK();
#endif
pfsync_sendout();
#ifdef __FreeBSD__
PF_UNLOCK();
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
splx(s);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef __FreeBSD__
CURVNET_RESTORE();
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* this is a softnet/netisr handler */
void
#ifdef __FreeBSD__
pfsyncintr(void *arg)
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
{
struct pfsync_softc *sc = arg;
Utilize new IF_DEQUEUE_ALL(ifq, m) macro in pfsyncintr() to reduce contention on ifqueue lock.
2011-10-27 09:47:00 +00:00
struct mbuf *m, *n;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
CURVNET_SET(sc->sc_ifp->if_vnet);
pfsync_ints++;
Utilize new IF_DEQUEUE_ALL(ifq, m) macro in pfsyncintr() to reduce contention on ifqueue lock.
2011-10-27 09:47:00 +00:00
IF_DEQUEUE_ALL(&sc->sc_ifp->if_snd, m);
for (; m != NULL; m = n) {
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
Utilize new IF_DEQUEUE_ALL(ifq, m) macro in pfsyncintr() to reduce contention on ifqueue lock.
2011-10-27 09:47:00 +00:00
n = m->m_nextpkt;
m->m_nextpkt = NULL;
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL)
== 0)
V_pfsyncstats.pfsyncs_opackets++;
else
V_pfsyncstats.pfsyncs_oerrors++;
}
CURVNET_RESTORE();
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#else
pfsyncintr(void)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int s;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_ints++;
s = splnet();
pfsync_sendout();
splx(s);
}
Fix from r226623 is not sufficient to close all races in pfsync(4). The root of problem is re-locking at the end of pfsync_sendout(). Several functions are calling pfsync_sendout() holding pointers to pf data on stack, and these functions expect this data to be consistent. To fix this, the following approach was taken: - The pfsync_sendout() doesn't call ip_output() directly, but enqueues the mbuf on sc->sc_ifp's interfaces queue, that is currently unused. Then pfsync netisr is scheduled. PF_LOCK isn't dropped in pfsync_sendout(). - The netisr runs through queue and ip_output()s packets on it. Apart from fixing race, this also decouples stack, fixing potential issues, that may happen, when sending pfsync(4) packets on input path. Reviewed by: eri (a quick review)
2011-10-23 14:59:54 +00:00
#endif
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int
pfsync_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
{
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifdef notyet
/* All sysctl names at this level are terminal. */
if (namelen != 1)
return (ENOTDIR);
switch (name[0]) {
case PFSYNCCTL_STATS:
if (newp != NULL)
return (EPERM);
return (sysctl_struct(oldp, oldlenp, newp, newlen,
&V_pfsyncstats, sizeof(V_pfsyncstats)));
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
return (ENOPROTOOPT);
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
}
Style(9) round for the pf kernel parts. Mostly #if defined() -> #ifdef Also set HOOK_HACK to true (remove the related #ifdef's) as we have the hooks in the kernel this was missed during the merge from the port. Noticed by: Amir S. (for the HOOK_HACK part) Approved by: bms(mentor)
2004-03-17 21:11:02 +00:00
#ifdef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
void
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
pfsync_ifdetach(void *arg, struct ifnet *ifp)
{
struct pfsync_softc *sc = (struct pfsync_softc *)arg;
struct ip_moptions *imo;
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if (sc == NULL || sc->sc_sync_if != ifp)
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
return; /* not for us; unlocked read */
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_SET(sc->sc_ifp->if_vnet);
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
PF_LOCK();
/* Deal with a member interface going away from under us. */
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
sc->sc_sync_if = NULL;
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
imo = &sc->sc_imo;
if (imo->imo_num_memberships > 0) {
In member interface detach event handler, do not attempt to free state which has already been freed by in_ifdetach(). With this cumulative change, the removal of a member interface will not cause a panic in pfsync(4). Requested by: yar PR: 86848
2007-04-14 01:01:46 +00:00
KASSERT(imo->imo_num_memberships == 1,
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
("%s: imo_num_memberships != 1", __func__));
In member interface detach event handler, do not attempt to free state which has already been freed by in_ifdetach(). With this cumulative change, the removal of a member interface will not cause a panic in pfsync(4). Requested by: yar PR: 86848
2007-04-14 01:01:46 +00:00
/*
* Our event handler is always called after protocol
* domains have been detached from the underlying ifnet.
* Do not call in_delmulti(); we held a single reference
* which the protocol domain has purged in in_purgemaddrs().
*/
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
PF_UNLOCK();
In member interface detach event handler, do not attempt to free state which has already been freed by in_ifdetach(). With this cumulative change, the removal of a member interface will not cause a panic in pfsync(4). Requested by: yar PR: 86848
2007-04-14 01:01:46 +00:00
imo->imo_membership[--imo->imo_num_memberships] = NULL;
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
PF_LOCK();
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
imo->imo_multicast_ifp = NULL;
}
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
CURVNET_RESTORE();
Teach pfsync(4) that its member interfaces may go away. This change partially resolves the issue in the PR. Further architectural fixes, in the form of reference counting, are needed. PR: 86848 Reviewed by: yar MFC after: 1 month
2007-03-19 17:52:15 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
static int
vnet_pfsync_init(const void *unused)
Defer ip_output of pfsync updates to an independent callout thread instead of just dropping the lock around the ip_output call. This used to cause corrupted state tree walks for some call-paths. In a second stage all callouts will be marked MPSAFE according to the setting of mpsafenet. Reported and tested by: Matthew Grooms <mgrooms at seton dot org> MFC after: 3 days X-MFC after: Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
{
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
int error = 0;
Defer ip_output of pfsync updates to an independent callout thread instead of just dropping the lock around the ip_output call. This used to cause corrupted state tree walks for some call-paths. In a second stage all callouts will be marked MPSAFE according to the setting of mpsafenet. Reported and tested by: Matthew Grooms <mgrooms at seton dot org> MFC after: 3 days X-MFC after: Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsyncattach(0);
error = swi_add(NULL, "pfsync", pfsyncintr, V_pfsyncif,
SWI_NET, INTR_MPSAFE, &pfsync_swi.pfsync_swi_cookie);
if (error)
panic("%s: swi_add %d", __func__, error);
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_state_import_ptr = pfsync_state_import;
pfsync_up_ptr = pfsync_up;
pfsync_insert_state_ptr = pfsync_insert_state;
pfsync_update_state_ptr = pfsync_update_state;
pfsync_delete_state_ptr = pfsync_delete_state;
pfsync_clear_states_ptr = pfsync_clear_states;
pfsync_state_in_use_ptr = pfsync_state_in_use;
pfsync_defer_ptr = pfsync_defer;
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
return (0);
}
static int
vnet_pfsync_uninit(const void *unused)
{
swi_remove(pfsync_swi.pfsync_swi_cookie);
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
PF_LOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
pfsync_state_import_ptr = NULL;
pfsync_up_ptr = NULL;
pfsync_insert_state_ptr = NULL;
pfsync_update_state_ptr = NULL;
pfsync_delete_state_ptr = NULL;
pfsync_clear_states_ptr = NULL;
pfsync_state_in_use_ptr = NULL;
pfsync_defer_ptr = NULL;
- Cover pfsync callouts deletion with PF_LOCK(). - Cover setting up interface between pf and pfsync with PF_LOCK().
2011-12-20 12:34:16 +00:00
PF_UNLOCK();
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
if_clone_detach(&pfsync_cloner);
return (0);
Defer ip_output of pfsync updates to an independent callout thread instead of just dropping the lock around the ip_output call. This used to cause corrupted state tree walks for some call-paths. In a second stage all callouts will be marked MPSAFE according to the setting of mpsafenet. Reported and tested by: Matthew Grooms <mgrooms at seton dot org> MFC after: 3 days X-MFC after: Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
}
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
/* Define startup order. */
Pseudo interfaces should go at SI_SUB_PSEUDO. However at least pfsync also depends on pf to be initialized already so pf goes at FIRST and the interfaces go at ANY. Then the (VNET_)SYSINIT startups for pf stays at SI_SUB_PROTO_BEGIN and for pfsync we move to the later SI_SUB_PROTO_IF. This is not ideal either but at least an order that should work for the moment and can be re-fined with the VIMAGE merge, once this will actually work with more than one network stack. MFC after: 3 days
2011-10-19 10:04:24 +00:00
#define PFSYNC_SYSINIT_ORDER SI_SUB_PROTO_IF
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#define PFSYNC_MODEVENT_ORDER (SI_ORDER_FIRST) /* On boot slot in here. */
#define PFSYNC_VNET_ORDER (PFSYNC_MODEVENT_ORDER + 2) /* Later still. */
/*
* Starting up.
* VNET_SYSINIT is called for each existing vnet and each new vnet.
*/
VNET_SYSINIT(vnet_pfsync_init, PFSYNC_SYSINIT_ORDER, PFSYNC_VNET_ORDER,
vnet_pfsync_init, NULL);
/*
* Closing up shop. These are done in REVERSE ORDER,
* Not called on reboot.
* VNET_SYSUNINIT is called for each exiting vnet as it exits.
*/
VNET_SYSUNINIT(vnet_pfsync_uninit, PFSYNC_SYSINIT_ORDER, PFSYNC_VNET_ORDER,
vnet_pfsync_uninit, NULL);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
static int
pfsync_modevent(module_t mod, int type, void *data)
{
int error = 0;
switch (type) {
case MOD_LOAD:
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifndef __FreeBSD__
Commit resolved import of OpenBSD 4.1 pf from perforce. Approved by: re (kensmith)
2007-07-03 12:16:07 +00:00
pfsyncattach(0);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
break;
case MOD_UNLOAD:
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#ifndef __FreeBSD__
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
if_clone_detach(&pfsync_cloner);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
#endif
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
break;
default:
error = EINVAL;
break;
}
return error;
}
static moduledata_t pfsync_mod = {
"pfsync",
pfsync_modevent,
0
};
#define PFSYNC_MODVER 1
Pseudo interfaces should go at SI_SUB_PSEUDO. However at least pfsync also depends on pf to be initialized already so pf goes at FIRST and the interfaces go at ANY. Then the (VNET_)SYSINIT startups for pf stays at SI_SUB_PROTO_BEGIN and for pfsync we move to the later SI_SUB_PROTO_IF. This is not ideal either but at least an order that should work for the moment and can be re-fined with the VIMAGE merge, once this will actually work with more than one network stack. MFC after: 3 days
2011-10-19 10:04:24 +00:00
DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
MODULE_VERSION(pfsync, PFSYNC_MODVER);
Update packet filter (pf) code to OpenBSD 4.5. You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri
2011-06-28 11:57:25 +00:00
MODULE_DEPEND(pfsync, pf, PF_MODVER, PF_MODVER, PF_MODVER);
Bring diff from the security/pf port. This has code been tested as a port for a long time and is run in production use. This is the code present in portversion 2.03 with some additional tweaks. The rather extensive diff accounts for: - locking (to enable pf to work with a giant-free netstack) - byte order difference between OpenBSD and FreeBSD for ip_len/ip_off - conversion from pool(9) to zone(9) - api differences etc. Approved by: bms(mentor) (in general)
2004-02-26 02:34:12 +00:00
#endif /* __FreeBSD__ */
Reference in New Issue Copy Permalink