d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
115,533 Commits 72 Branches 135 Tags 3.2 GiB
4d87b291ad
Commit Graph

595 Commits

Author SHA1 Message Date
Darren Reed
051adc35a2 Enable building /sbin/ipf (but not the rescue version) with the ability to 
parse bpf strings for filter rules in ipf.conf
 2005-05-16 16:22:55 +00:00
Darren Reed
05793fcbf0 Enable IPFilter to correctly determine if BPF has been optioned into the 
kernel it is being compiled against and subsequently enable using BPF for
packet matching in ipf rules.
 2005-05-15 03:34:17 +00:00
Max Laier
ac9dfc9061 if_mtu not ifp_mtu. 2005-05-04 19:51:06 +00:00
Max Laier
69d9333494 Bring back fix from rev. 1.28 which was lost during the import. 2005-05-04 16:03:01 +00:00
Max Laier
8398e1894d Combine rev. 1.29 and 1.30 to something that will make sense for future 
imports.
 2005-05-04 15:55:29 +00:00
Max Laier
10ca483be0 Make LINT happy. 2005-05-04 15:29:28 +00:00
Andre Oppermann
c773494edd Pass icmp_error() the MTU argument directly instead of 
an interface pointer.  This simplifies a couple of uses
and removes some XXX workarounds.
 2005-05-04 13:09:19 +00:00
Max Laier
b01933e6bf Resolve conflicts created during the import of pf 3.7 Some features are 
missing and will be implemented in a second step.  This is functional as is.

Tested by:	freebsd-pf, pfsense.org
Obtained from:	OpenBSD
X-MFC after:	never (breaks API/ABI)
 2005-05-03 16:43:32 +00:00
Ruslan Ermilov
f9067637f7 Fix the following warnings on amd64: 
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_newfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:397: warning: cast to pointer from integer of different size
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_knownfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:582: warning: cast from pointer to integer of different size
 2005-04-29 05:57:17 +00:00
Darren Reed
e01de6cda3 Don't use quad_t on FreeBSD (deprecated) so use "long long" instead. 
Someday this should be converted to uint64_t and printstate.c changed to
use those horrid PRiud64 things.
 2005-04-28 21:36:30 +00:00
Darren Reed
caec4e7746 The current H.323 proxy source has a license that isn't suitable for inclusion 
with FreeBSD so we shouldn't be trying to include it here.
 2005-04-27 05:53:12 +00:00
Darren Reed
b1660bb30d - Comment out duplicate rcsid strings in *.c files 
- Move SIOCPROXY from ip_nat.h to ip_proxy.h and fix ip_proxy.h so that it
  can be easily compiled into kdump, et al.
 2005-04-27 03:48:10 +00:00
Darren Reed
c81e55a2df Add an include for netinet/ip_compat.h directly so that we don't need to 
add another special file in the creation of ioctls.c for kdump.
 2005-04-26 17:58:05 +00:00
Darren Reed
6eab6ed50f Merge the changes from 3.4.35 to 4.1.8 into the kernel source tree 2005-04-25 18:43:14 +00:00
Darren Reed
d607092b37 This commit was generated by cvs2svn to compensate for changes in r145516, 
which included commits to RCS files with non-trunk default branches.
 2005-04-25 18:15:41 +00:00
Darren Reed
8158c4468d import ipfilter 4.1.8 into the kernel source tree 2005-04-25 18:15:41 +00:00
Gleb Smirnoff
2fa088e969 Fix error in synproxy connection completion. Source and 
destination windows were confused, one instead of other.
This error was masked, because first segment of just
established connection is usually smaller than initially
announced window, and it was successfully passed. First
window reannouncement corrected erroneous 'seqhi' value.
The error showed up when client connected to synproxy
with zero initial window, and reannounced it after
session establishment.

In collaboration with:	dhartmei [we came to same patch independtly]
Reviewed by:		mlaier
Sponsored by:		Rambler
MFC after:		3 days
 2005-04-22 09:53:46 +00:00
Robert Watson
e551d45211 Modify the alq(9) alq_open() API to accept a file creation mode, rather 
than defaulting the cmode argument to vn_open() to 0.  Supply a default
argument of ALQ_DEFAULT_CMODE (0600) in current callers.

Discussed with/pointed out by:	hmp
Reveiwed by:	jeff, hmp
MFC after:	3 days
 2005-04-16 12:12:27 +00:00
Gleb Smirnoff
699df192d9 Fix mss byte order, only affects synproxy code path. 
Submitted by:	John L. Scarfone via OpenBSD
Reviewed by:	mlaier
Obtained from:	OpenBSD, rev. 1.483
MFC after:	2 days
 2005-04-13 21:05:55 +00:00
David E. O'Brien
0587a1ea34 This commit was generated by cvs2svn to compensate for changes in r143439, 
which included commits to RCS files with non-trunk default branches.
 2005-03-12 00:17:37 +00:00
David E. O'Brien
1e5fec6b15 Import the nForce MCP NIC bits. This is version 1.0-0301. 
Demanded by:	DES
Encouraged by:	scottl
 2005-03-12 00:17:37 +00:00
Scott Long
d38d9c9e5e Move all of the hptmv files to /sys/dev/hptmv so that they won't be mistaken 
for being on a CVS vendor branch.  The files were moved via a repo-copy.
 2005-03-02 05:14:28 +00:00
David E. O'Brien
bb4e63066a Add FreeBSD ID. 2005-02-28 00:53:29 +00:00
Poul-Henning Kamp
4db0fda84e Use dynamic major number allocation. 2005-02-27 22:19:35 +00:00
Sam Leffler
c01f36ef0c avoid sneaky double free 
Noticed by:	Coverity Prevent analysis tool
Reviewed by:	scottl
 2005-02-25 00:16:53 +00:00
Brian Feldman
d011a9158c Do not fail to initialize callouts (on SMP only) -- it leads to crashing. 2005-02-22 04:27:05 +00:00
Max Laier
93d6cddf05 Fix a terrible braino in pfi_maybe_destroy() and unbreak "$pfctl -Fall" with 
renamed interfaces.

PR:		kern/77645
Reported by:	Harald Schmalzbauer <harryNOschmalzbauerSPAMde>
Reviewed by:	yongari
MFC after:	3 days
 2005-02-21 17:20:00 +00:00
Max Laier
0df559602c Don't use the static CALLOUT_INITIALIZER for __FreeBSD_version >= 600000. It 
was a bad idea, but since it is done like this in the vendor source we keep
it around for older versions. As a safe guard against future misuse we don't
even define CALLOUT_INITIALIZER anymore.

This fixes ALTQ after callout_init_mtx() and takes altq_var.h off the vendor
branch.

Submitted by:	Divacky Roman <xdivac02NOstud.fit.vutbrSPAMcz> (w/ changes)
 2005-02-21 17:11:09 +00:00
Pyun YongHyeon
a94f16f4fa Fix inteface clear time. pf printed "Thu Jan 1 09:00:01 1970" 
in "pfctl -vvsI" output when pf was statically linked to kernel.

Discussed with:	mlaier
 2005-02-17 03:36:31 +00:00
Max Laier
68198dedf8 Access softc embedded struct ifnet via function macro to make it easier to 
untangle struct ifnet and softc/arpcom in the future.

Requested by:	brooks
 2005-02-09 19:29:13 +00:00
Matthew N. Dodd
1f005b6723 - Split out PCI support. 
- Add previously removed ISA support.

Submitted by:	David S. Madole <david AT madole.net>
 2005-02-03 23:01:01 +00:00
Daniel Hartmeier
d4f925e4df Use the packet's address family instead of the rule's when selecting a 
replacement address for an rdr rule. Some rdr rules have no address family
(when the replacement is a table and no other criterion implies one AF).
In this case, pf would fail to select a replacement address and drop the
packet due to translation failure.

Found by:	Gustavo A. Baratto
 2005-01-20 18:07:35 +00:00
Daniel Hartmeier
9624b04d64 Prohibit ruleset changes at securelevel > 2, not > 1. It's documented 
like this in init(8), but the code didn't match the documentation.

Submitted by:	Juraj Lutter <otis at sk dot FreeBSD dot org>
Agrees:		mlaier
 2005-01-19 21:37:00 +00:00
Nate Lawson
d26e4b9a02 This commit was generated by cvs2svn to compensate for changes in r140216, 
which included commits to RCS files with non-trunk default branches.
 2005-01-14 06:37:43 +00:00
Nate Lawson
edd973a013 Clean up a small memory leak introduced with the previous commit to 
dsutils.c.  We need to GC the implicitly-returned object.

Submitted by:	Robert.Moore at Intel
MFC after:	1 day
 2005-01-14 06:37:43 +00:00
Nate Lawson
4802655124 Fix handling of the implicit return case for methods called from an 
external source (i.e., _STA).  The previous case only handled calls
occurring within AML.  This should fix Toshibas, among others.  Thanks
to Robert Moore of Intel for the fix.

MFC after:	2 days
 2005-01-12 00:52:40 +00:00
Nate Lawson
6023610d63 This commit was generated by cvs2svn to compensate for changes in r140094, 
which included commits to RCS files with non-trunk default branches.
 2005-01-12 00:52:40 +00:00
Darren Reed
4d7cb202f1 Elminate 1 LOR (actually a recursive mutex grab) involving ipfilter where 
we loop through all the list of NICs (struct ifnet), holding the lock on
it and then do a name lookup with ifunit() whilst holding it.
 2005-01-08 04:32:02 +00:00
Darren Reed
4541c49f79 * Remove some code that's in a #ifndef FreeBSD that's no longer used. 2004-12-26 09:09:29 +00:00
Darren Reed
2fb1eb06a7 * The #ifdef's to cause mutex's for freebsd to be declared were meant to pick 
up on USE_MUTEX being defined, but this patch
* Remove some code that's in a #ifndef FreeBSD that's no longer used.
 2004-12-26 09:08:42 +00:00
Scott Long
98331badc2 Darnit, through a maze of twisty passages, ipfilter needs to have PFIL_HOOKS 
defined.  Revert part of the previous commit to fix this.
 2004-12-25 00:48:27 +00:00
Scott Long
0ca8ae1641 Sprinkle in some __FreeBSD_version checks so that this compiles again. Don't 
define PFIL_HOOKS anymore.

Submitted by: keramida
 2004-12-25 00:22:25 +00:00
Darren Reed
77bb8ca4a3 Enable fine grained locking within IPFilter, using mtx(9) and sx(9) allowing 
the the "needs giant" flag to be removed from the driver.
 2004-12-24 09:14:26 +00:00
Daniel Hartmeier
2726bbe221 Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN, 
prevents a possible endless loop in pf_get_sport() with 'static-port'

ICMP state entries use the ICMP ID as port for the unique state key. When
checking for a usable key, construct the key in the same way. Otherwise,
a colliding key might be missed or a state insertion might be refused even
though it could be inserted. The second case triggers the endless loop,
possibly allowing a NATed LAN client to lock up the kernel.

PR:			kern/74930
Reported and tested by:	Hugo Silva, Srebrenko Sehic
MFC after:		3 days
 2004-12-19 19:43:04 +00:00
Max Laier
905c6b87b7 Make ip_nat compile again. Should read #if->n<-def LARGE_NAT as in ipf 4.x 2004-12-18 03:47:54 +00:00
Darren Reed
f42b5dbebb Move two variables that are unused if LARGE_NAT is defined inside an #ifdef 
to keep them out of harms way when compiling.

PR:	72783
 2004-12-17 15:59:16 +00:00
Darren Reed
8a377db272 Allow ipnat redirect rules to work for non-TCP/UDP packets. 
PR:             70038
Submitted by:   fming@borderware.com
Reviewed by:    darrenr
Obtained from:  fming@borderware.com
 2004-12-17 02:29:34 +00:00
Darren Reed
6de0f6c8b8 Using just m_pullup to get all of the interesting bits in packet into one 
buffer doesn't work for ipv6 packets, so use m_defrag() here instead as an
easy drop-in replacement.

PR:	70399
 2004-12-16 21:02:16 +00:00
Max Laier
7cadbe4109 Compile pfsync w/o bpf. 
Noticed by:	"Jayel Villamin" <jarthel operamail com>
 2004-12-10 17:42:47 +00:00
Sam Leffler
8c489f7420 clear old files now in public 2004-12-08 18:27:44 +00:00