Commit Graph

659 Commits

Author SHA1 Message Date
Don Lewis
a25ffb5ab7 Belatedly bump .Dd date for Dummynet AQM import in r300779. 2016-06-02 00:42:15 +00:00
Don Lewis
91336b403a Import Dummynet AQM version 0.2.1 (CoDel, FQ-CoDel, PIE and FQ-PIE).
Centre for Advanced Internet Architectures

Implementing AQM in FreeBSD

* Overview <http://caia.swin.edu.au/freebsd/aqm/index.html>

* Articles, Papers and Presentations
  <http://caia.swin.edu.au/freebsd/aqm/papers.html>

* Patches and Tools <http://caia.swin.edu.au/freebsd/aqm/downloads.html>

Overview

Recent years have seen a resurgence of interest in better managing
the depth of bottleneck queues in routers, switches and other places
that get congested. Solutions include transport protocol enhancements
at the end-hosts (such as delay-based or hybrid congestion control
schemes) and active queue management (AQM) schemes applied within
bottleneck queues.

The notion of AQM has been around since at least the late 1990s
(e.g. RFC 2309). In recent years the proliferation of oversized
buffers in all sorts of network devices (aka bufferbloat) has
stimulated keen community interest in four new AQM schemes -- CoDel,
FQ-CoDel, PIE and FQ-PIE.

The IETF AQM working group is looking to document these schemes,
and independent implementations are a corner-stone of the IETF's
process for confirming the clarity of publicly available protocol
descriptions. While significant development work on all three schemes
has occured in the Linux kernel, there is very little in FreeBSD.

Project Goals

This project began in late 2015, and aims to design and implement
functionally-correct versions of CoDel, FQ-CoDel, PIE and FQ_PIE
in FreeBSD (with code BSD-licensed as much as practical). We have
chosen to do this as extensions to FreeBSD's ipfw/dummynet firewall
and traffic shaper. Implementation of these AQM schemes in FreeBSD
will:
* Demonstrate whether the publicly available documentation is
  sufficient to enable independent, functionally equivalent implementations

* Provide a broader suite of AQM options for sections the networking
  community that rely on FreeBSD platforms

Program Members:

* Rasool Al Saadi (developer)

* Grenville Armitage (project lead)

Acknowledgements:

This project has been made possible in part by a gift from the
Comcast Innovation Fund.

Submitted by:	Rasool Al-Saadi <ralsaadi@swin.edu.au>
X-No objection:	core
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D6388
2016-05-26 21:40:13 +00:00
Andrey V. Elsukov
825f02a9ed Make ipfw internal olist output more user friendly.
Print object type as string for known types.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2016-05-17 11:22:08 +00:00
Andrey V. Elsukov
2685841b38 Make named objects set-aware. Now it is possible to create named
objects with the same name in different sets.

Add optional manage_sets() callback to objects rewriting framework.
It is intended to implement handler for moving and swapping named
object's sets. Add ipfw_obj_manage_sets() function that implements
generic sets handler. Use new callback to implement sets support for
lookup tables.
External actions objects are global and they don't support sets.
Modify eaction_findbyname() to reflect this.
ipfw(8) now may fail to move rules or sets, because some named objects
in target set may have conflicting names.
Note that ipfw_obj_ntlv type was changed, but since lookup tables
actually didn't support sets, this change is harmless.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2016-05-17 07:47:23 +00:00
Pedro F. Giffuni
b68ac8007d sbin: minor spelling fixes.
No functional change.
2016-04-30 19:04:59 +00:00
Glen Barber
0edd2576c0 MFH
Sponsored by:	The FreeBSD Foundation
2016-04-16 02:32:12 +00:00
Andrey V. Elsukov
2acdf79f53 Add External Actions KPI to ipfw(9).
It allows implementing loadable kernel modules with new actions and
without needing to modify kernel headers and ipfw(8). The module
registers its action handler and keyword string, that will be used
as action name. Using generic syntax user can add rules with this
action. Also ipfw(8) can be easily modified to extend basic syntax
for external actions, that become a part base system.
Sample modules will coming soon.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2016-04-14 22:51:23 +00:00
Andrey V. Elsukov
7b34dbe450 Fix output formatting of O_UNREACH6 opcode.
Obtained from:	Yandex LLC
2016-04-14 18:22:08 +00:00
Glen Barber
7d536dc855 MFH
Sponsored by:	The FreeBSD Foundation
2016-03-10 21:16:01 +00:00
Andrey V. Elsukov
7aee4940a5 Set buffer to empty string to prevent duplicated output in some cases.
PR:		193888
2016-03-09 14:47:05 +00:00
Glen Barber
52259a98ad MFH
Sponsored by:	The FreeBSD Foundation
2016-03-02 16:14:46 +00:00
Andrey V. Elsukov
23a6c7330c Fix bug in filling and handling ipfw's O_DSCP opcode.
Due to integer overflow CS4 token was handled as BE.

PR:		207459
MFC after:	1 week
2016-02-24 13:16:03 +00:00
Glen Barber
7de1daeb93 Create packages for atm, ccdconfig, devd, ipf, ipfw,
iscsi, natd, nandfs, pf, quotacheck, and routed.

Add ping6 and rtsol to the runtime package.

Sponsored by:	The FreeBSD Foundation
2016-02-09 19:30:31 +00:00
Andrey V. Elsukov
5dc5a0e0aa Implement ipfw internal olist command to list named objects.
Reviewed by:	melifaro
Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2015-11-03 10:21:53 +00:00
Eitan Adler
463a577b27 Fix a ton of speelling errors
arc lint is helpful

Reviewed By: allanjude, wblock, #manpages, chris@bsdjunk.com
Differential Revision: https://reviews.freebsd.org/D3337
2015-10-21 05:37:09 +00:00
Andrey V. Elsukov
56afe65ca9 Fix possible segmentation fault.
PR:		203494
MFC after:	1 week
2015-10-03 03:12:57 +00:00
Marcelo Araujo
b7684f4b85 Code cleanup unused-but-set-variable spotted by gcc.
Reviewed by:	melifaro
Approved by:	bapt (mentor)
Differential Revision:	D3473
2015-08-25 15:32:08 +00:00
Dimitry Andric
dbe90f04b4 In ipfw2, avoid left-shifting negative integers, which is undefined.
While here, make some other arguments to htonl(3) unsigned too.

MFC after:	3 days
2015-08-12 21:07:57 +00:00
Mark Felder
f5846f166c sbin/ipfw fix typo: info -> into
example:

DEPRECATED: inserting data into non-existent table sshguard. (auto-created)

Approved by:	bdrewery
2015-08-10 22:02:01 +00:00
Alexander V. Chernikov
0b501d960c Fix ipfw range deletion.
Spotted by:	ian,julian
2015-08-03 14:31:06 +00:00
Simon J. Gerraty
ccfb965433 Add META_MODE support.
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.

Still need to add real targets under targets/ to build packages.

Differential Revision:       D2796
Reviewed by: brooks imp
2015-06-13 19:20:56 +00:00
Simon J. Gerraty
44d314f704 dirdeps.mk now sets DEP_RELDIR 2015-06-08 23:35:17 +00:00
Simon J. Gerraty
98e0ffaefb Merge sync of head 2015-05-27 01:19:58 +00:00
Alexander V. Chernikov
8755aff6c9 Bring back support for checking tables via "ipfw -n".
Currently we have different table key types which can easily interfere
with each other (numbers and IPv4 address, interface names and hostnames,
  flows and hostnames/addresses).
This conflicts are solved by [auto-]creating _typed_ tables, so after
table is created, only keys of given type can be inserted to that table.
ipfw(8) consults with kernel about key/value type for particular table so
it knows key/value interpretation.
However, we have 2 cases (adding entries to non-existing table and
  parsing configuration file via `ipfw -n`) when kernel is unable to
  provide us table info we need. Fix the latter case by partially importing
  old `table_fill_xentry()` parse function responsible for guessing key type.

Sponsored by:	Yandex LLC
2015-05-19 18:29:13 +00:00
Alexander V. Chernikov
8a6dbb6455 Correctly print valtype for empty bitmask. 2015-05-06 11:23:14 +00:00
Alexander V. Chernikov
8963c5055d Generalize object reference handling in ipfw rules.
No ABI changes.
2015-04-26 10:53:35 +00:00
Alexander V. Chernikov
0577d6e0d5 Fix use-after-free.
Reported by:	Coverity Scan, pfg
CID:		1245747
2015-04-19 12:49:30 +00:00
Andrey V. Elsukov
dc9fa19b3b Properly initialize scope zone id when next hop address stored
directly in the O_FORWARD_IP6 opcode. Use getnameinfo(3) to formatting
the IPv6 addresses of such opcodes.

Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2015-03-13 13:46:50 +00:00
Andrey V. Elsukov
2530ed9e70 Fix `ipfw fwd tablearg'. Use dedicated field nh4 in struct table_value
to obtain IPv4 next hop address in tablearg case.

Add `fwd tablearg' support for IPv6. ipfw(8) uses INADDR_ANY as next hop
address in O_FORWARD_IP opcode for specifying tablearg case. For IPv6 we
still use this opcode, but when packet identified as IPv6 packet, we
obtain next hop address from dedicated field nh6 in struct table_value.

Replace hopstore field in struct ip_fw_args with anonymous union and add
hopstore6 field. Use this field to copy tablearg value for IPv6.

Replace spare1 field in struct table_value with zoneid. Use it to keep
scope zone id for link-local IPv6 addresses. Since spare1 was used
internally, replace spare0 array with two variables spare0 and spare1.

Use getaddrinfo(3)/getnameinfo(3) functions for parsing and formatting
IPv6 addresses in table_value. Use zoneid field in struct table_value
to store sin6_scope_id value.

Since the kernel still uses embedded scope zone id to represent
link-local addresses, convert next_hop6 address into this form before
return from pfil processing. This also fixes in6_localip() check
for link-local addresses.

Differential Revision:	https://reviews.freebsd.org/D2015
Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC
2015-03-13 09:03:25 +00:00
Alexander V. Chernikov
5d43946785 Retrieve counters from kernel if rule timstamping is requested.
PR:		kern/197271
Submitted by:	lev
Sponsored by:	Yandex LLC
2015-02-05 14:08:33 +00:00
John Baldwin
2aa533b91d natd(8) will work with an unconfigured interface and effectively not do
anything until the interface is assigned an address.  This fixes
ipfw_nat to do the same by using an IP of INADDR_ANY instead of
aborting the nat setup if the requested interface is not yet configured.

Differential Revision:	https://reviews.freebsd.org/D1539
Reviewed by:	melifaro, glebius, gnn
MFC after:	1 week
2015-01-25 20:37:32 +00:00
Joel Dahl
f7e00d4bbd mdoc: remove EOL whitespace. 2014-12-29 13:50:59 +00:00
Baptiste Daroussin
13eb765f2d Convert sbin/ to LIBADD
Reduce overlinking
2014-11-25 11:23:12 +00:00
Joel Dahl
d4d112e34a Misc mdoc fixes:
- Remove superfluous paragraph macros.
- Remove/fix empty or incorrect macros.
- Sort sections into conventional order.
- Terminate quoted strings properly.
- Remove EOL whitespace.
2014-11-23 21:00:00 +00:00
Simon J. Gerraty
9268022b74 Merge from head@274682 2014-11-19 01:07:58 +00:00
Alexander V. Chernikov
ca807c8a88 Fix documentation issue.
PR:		194581
Submitted by:	madpilot
2014-10-24 17:06:56 +00:00
Alexander V. Chernikov
382a5cbf42 Fix displaying non-contiguous netmasks.
Found by:	ae
Sponsored by:	Yandex LLC
2014-10-24 13:29:12 +00:00
Alexander V. Chernikov
6ff33bb6aa * Zero rule buffer.
* Rename 'read' variable.

Pointed by:	luigi
2014-10-18 15:18:31 +00:00
Alexander V. Chernikov
d3de6c1d2f * Fix table sets handling.
* Simplify formatting.

Suggested by:	luigi
2014-10-17 20:47:55 +00:00
Alexander V. Chernikov
6ca0dd05f4 Show error when deleting non-existing rule number.
Found by:	Oleg Ginzburg
2014-10-13 12:49:04 +00:00
Alexander V. Chernikov
60f485ca9f * Fix zeroing individual entries via ipfw(8).
* Report error and return non-zero exit code if zeroing non-matched entries

Found by:	Oleg Ginzburg
2014-10-13 11:26:17 +00:00
Alexander V. Chernikov
9fe15d0612 Partially fix build on !amd64
Pointed by:	bz
2014-10-10 17:24:56 +00:00
Alexander V. Chernikov
68bde59ebe * Fix use-after-free in table printing code.
* Fix showing human-readable error in table cmds code.
2014-10-09 12:54:56 +00:00
Alexander V. Chernikov
a5fedf11fc Sync to HEAD@r272609. 2014-10-06 11:29:50 +00:00
Alexander V. Chernikov
9bb47e7068 Improve "reserved keywords" hack:
we can't easily predict (in current parsing model)
if the keyword is ipfw(8) reserved keyword or port name.
Checking proto database via getprotobyname() consumes a lot of
CPU and leads to tens of seconds for parsing large ruleset.
Use list of reserved keywords and check them as pre-requisite
before doing getprotobyname().

Obtained from:	Yandex LLC
2014-10-06 11:00:47 +00:00
Alexander V. Chernikov
4deb9c9287 Fix tracked interface list retrieval. 2014-10-05 10:20:47 +00:00
Alexander V. Chernikov
d91c61c364 Fix GCC wardnings. 2014-10-04 17:21:30 +00:00
Alexander V. Chernikov
5371ab1408 Document new table values.
Sponsored by:	Yandex LLC
2014-10-03 15:36:58 +00:00
Alexander V. Chernikov
d6164b77f8 Make ipfw_nat module use IP_FW3 codes.
Kernel changes:
* Split kernel/userland nat structures eliminating IPFW_INTERNAL hack.
* Add IP_FW_NAT44_* codes resemblin old ones.
* Assume that instances can be named (no kernel support currently).
* Use both UH+WLOCK locks for all configuration changes.
* Provide full ABI support for old sockopts.

Userland changes:
* Use IP_FW_NAT44_* codes for nat operations.
* Remove undocumented ability to show ranges of nat "log" entries.
2014-09-07 18:30:29 +00:00
Alexander V. Chernikov
1a33e79969 Change copyrights to the proper one. 2014-09-05 14:19:02 +00:00