Commit Graph

9 Commits

Author SHA1 Message Date
Mateusz Guzik
858937bea4 pfctl: cache getprotobynumber results
As for example pfctl -ss keeps calling it, it saves a lot of overhead
from elided parsing of /etc/nsswitch.conf and /etc/protocols.

Sample result when running a pre-nvlist binary with nfs root and dumping
7 mln states:
before: 24.817u 62.993s 1:28.52 99.1%
after:	8.064u 1.117s 0:18.87 48.5%

Idea by Jim Thompson

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2021-07-01 21:31:45 +00:00
Kristof Provost
d0fdf2b28f pf: Track the original kif for floating states
Track (and display) the interface that created a state, even if it's a
floating state (and thus uses virtual interface 'all').

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30245
2021-05-20 12:49:27 +02:00
Kristof Provost
bc94129147 pfctl: Use DIOCGETSTATESNV
Migrate to using the new nvlist-based DIOCGETSTATESNV call to obtain the
states list.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30244
2021-05-20 12:49:27 +02:00
Kristof Provost
cc948296e6 pfctl: Optionally show gateway information for states
When showing the states, in very verbose mode, also display the gateway
(i.e. the target for route-to/reply-to).

Submitted by:	Steven Brown
Reviewed by:	donner
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30051
2021-05-07 22:13:30 +02:00
Pedro F. Giffuni
1de7b4b805 various: general adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.
2017-11-27 15:37:16 +00:00
Ian Lepore
1cac26262e Make pfctl(8) work on strict-alignment platforms, by copying a pair of
embedded structures out of a packed, unaligned struct into local copies
on the stack which are aligned.

The original patch to do this was submitted by Guy Yur <guyyur@gmail.com>,
and this is conceptually the same change, but restructured with the
#ifndef __NO_STRICT_ALIGNMENT wrapper, similar to how the same issue is
handled in the kernel pf code.

PR:		185617
PR:		206658
2016-01-30 22:03:14 +00:00
Baptiste Daroussin
e0b95cb532 Import pf_print_state.c 1.54 from OpenBSD
Original log:
pfctl -ss printed state levels for ICMPv6. Disable this the same
way it has already been done for ICMPv4.

Difference with OpenBSD:
- WITHOUT_INET6 safe

Obtained from:	OpenBSD
2013-10-27 21:07:37 +00:00
Gleb Smirnoff
a1ce87eced - Get rid of #ifdef __FreeBSD__.
- Use correct format when printing uint64_t.
2012-09-29 16:42:01 +00:00
Gleb Smirnoff
3b3a8eb937 o Create directory sys/netpfil, where all packet filters should
reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.c		-> sys/netpfil/pf/
sys/contrib/pf/net/*.h		-> sys/net/
contrib/pf/pfctl/*.c		-> sbin/pfctl
contrib/pf/pfctl/*.h		-> sbin/pfctl
contrib/pf/pfctl/pfctl.8	-> sbin/pfctl
contrib/pf/pfctl/*.4		-> share/man/man4
contrib/pf/pfctl/*.5		-> share/man/man5

sys/netinet/ipfw		-> sys/netpfil/ipfw

The arguable movement is pf/net/*.h -> sys/net. There are
future plans to refactor pf includes, so I decided not to
break things twice.

Not modified bits of pf left in contrib: authpf, ftp-proxy,
tftp-proxy, pflogd.

The ipfw(4) movement is planned to be merged to stable/9,
to make head and stable match.

Discussed with:		bz, luigi
2012-09-14 11:51:49 +00:00