Commit Graph

96 Commits

Author SHA1 Message Date
Darren Reed
649a43212c fix "ipf -Z" reporting rubbish and possibly panic'ing box
MFC after:	4 days
2006-04-18 13:24:14 +00:00
Guido van Rooij
ecdad7e688 Add mcopywrap prototype to ip_compat.h
Remove h323 proxy from ip_proxy (copyright issue)
2005-12-30 11:55:37 +00:00
Guido van Rooij
9088f4e67b Resolve conflicts 2005-12-30 11:32:23 +00:00
Guido van Rooij
a311d8fc4c This commit was generated by cvs2svn to compensate for changes in r153872,
which included commits to RCS files with non-trunk default branches.
2005-12-30 11:22:11 +00:00
Guido van Rooij
fc79eaf127 Import IP Filter version 4.1.10 2005-12-30 11:22:11 +00:00
Ruslan Ermilov
3238c6bd33 Fix -Wundef from compiling the amd64 LINT. 2005-12-04 10:06:06 +00:00
Robert Watson
5bb84bc84b Normalize a significant number of kernel malloc type names:
- Prefer '_' to ' ', as it results in more easily parsed results in
  memory monitoring tools such as vmstat.

- Remove punctuation that is incompatible with using memory type names
  as file names, such as '/' characters.

- Disambiguate some collisions by adding subsystem prefixes to some
  memory types.

- Generally prefer lower case to upper case.

- If the same type is defined in multiple architecture directories,
  attempt to use the same name in additional cases.

Not all instances were caught in this change, so more work is required to
finish this conversion.  Similar changes are required for UMA zone names.
2005-10-31 15:41:29 +00:00
Darren Reed
721c3c7cc6 Fix some minor problems before release:
(1) "ipf -T" is broken for fetching single entries and
(2) loading rules with numbered collections does not order insertion right.
(3) stats aren't accumulated for hash table memory failures

Approved by: re (dwhite)
2005-06-23 14:19:02 +00:00
Darren Reed
ebcef7d42b locking on exit of reading from ip_sync is not correct for all instances
Approved by:	re (dwhite)
2005-06-14 09:18:26 +00:00
Darren Reed
051adc35a2 Enable building /sbin/ipf (but not the rescue version) with the ability to
parse bpf strings for filter rules in ipf.conf
2005-05-16 16:22:55 +00:00
Darren Reed
05793fcbf0 Enable IPFilter to correctly determine if BPF has been optioned into the
kernel it is being compiled against and subsequently enable using BPF for
packet matching in ipf rules.
2005-05-15 03:34:17 +00:00
Ruslan Ermilov
f9067637f7 Fix the following warnings on amd64:
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_newfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:397: warning: cast to pointer from integer of different size
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_knownfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:582: warning: cast from pointer to integer of different size
2005-04-29 05:57:17 +00:00
Darren Reed
e01de6cda3 Don't use quad_t on FreeBSD (deprecated) so use "long long" instead.
Someday this should be converted to uint64_t and printstate.c changed to
use those horrid PRiud64 things.
2005-04-28 21:36:30 +00:00
Darren Reed
caec4e7746 The current H.323 proxy source has a license that isn't suitable for inclusion
with FreeBSD so we shouldn't be trying to include it here.
2005-04-27 05:53:12 +00:00
Darren Reed
b1660bb30d - Comment out duplicate rcsid strings in *.c files
- Move SIOCPROXY from ip_nat.h to ip_proxy.h and fix ip_proxy.h so that it
  can be easily compiled into kdump, et al.
2005-04-27 03:48:10 +00:00
Darren Reed
c81e55a2df Add an include for netinet/ip_compat.h directly so that we don't need to
add another special file in the creation of ioctls.c for kdump.
2005-04-26 17:58:05 +00:00
Darren Reed
6eab6ed50f Merge the changes from 3.4.35 to 4.1.8 into the kernel source tree 2005-04-25 18:43:14 +00:00
Darren Reed
8158c4468d import ipfilter 4.1.8 into the kernel source tree 2005-04-25 18:15:41 +00:00
Darren Reed
d607092b37 This commit was generated by cvs2svn to compensate for changes in r145516,
which included commits to RCS files with non-trunk default branches.
2005-04-25 18:15:41 +00:00
Poul-Henning Kamp
4db0fda84e Use dynamic major number allocation. 2005-02-27 22:19:35 +00:00
Darren Reed
4d7cb202f1 Elminate 1 LOR (actually a recursive mutex grab) involving ipfilter where
we loop through all the list of NICs (struct ifnet), holding the lock on
it and then do a name lookup with ifunit() whilst holding it.
2005-01-08 04:32:02 +00:00
Darren Reed
4541c49f79 * Remove some code that's in a #ifndef FreeBSD that's no longer used. 2004-12-26 09:09:29 +00:00
Darren Reed
2fb1eb06a7 * The #ifdef's to cause mutex's for freebsd to be declared were meant to pick
up on USE_MUTEX being defined, but this patch
* Remove some code that's in a #ifndef FreeBSD that's no longer used.
2004-12-26 09:08:42 +00:00
Scott Long
98331badc2 Darnit, through a maze of twisty passages, ipfilter needs to have PFIL_HOOKS
defined.  Revert part of the previous commit to fix this.
2004-12-25 00:48:27 +00:00
Scott Long
0ca8ae1641 Sprinkle in some __FreeBSD_version checks so that this compiles again. Don't
define PFIL_HOOKS anymore.

Submitted by: keramida
2004-12-25 00:22:25 +00:00
Darren Reed
77bb8ca4a3 Enable fine grained locking within IPFilter, using mtx(9) and sx(9) allowing
the the "needs giant" flag to be removed from the driver.
2004-12-24 09:14:26 +00:00
Max Laier
905c6b87b7 Make ip_nat compile again. Should read #if->n<-def LARGE_NAT as in ipf 4.x 2004-12-18 03:47:54 +00:00
Darren Reed
f42b5dbebb Move two variables that are unused if LARGE_NAT is defined inside an #ifdef
to keep them out of harms way when compiling.

PR:	72783
2004-12-17 15:59:16 +00:00
Darren Reed
8a377db272 Allow ipnat redirect rules to work for non-TCP/UDP packets.
PR:             70038
Submitted by:   fming@borderware.com
Reviewed by:    darrenr
Obtained from:  fming@borderware.com
2004-12-17 02:29:34 +00:00
Darren Reed
6de0f6c8b8 Using just m_pullup to get all of the interesting bits in packet into one
buffer doesn't work for ipv6 packets, so use m_defrag() here instead as an
easy drop-in replacement.

PR:	70399
2004-12-16 21:02:16 +00:00
Max Laier
d6a8d58875 Add an additional struct inpcb * argument to pfil(9) in order to enable
passing along socket information. This is required to work around a LOR with
the socket code which results in an easy reproducible hard lockup with
debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do
so later. The missing piece is to turn the filter locking into a leaf lock
and will follow in a seperate (later) commit.

This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in
forseeable future.

Suggested by:		rwatson
A lot of work by:	csjp (he'd be even more helpful w/o mentor-reviews ;)
Reviewed by:		rwatson, csjp
Tested by:		-pf, -ipfw, LINT, csjp and myself
MFC after:		3 days

LOR IDs:		14 - 17 (not fixed yet)
2004-09-29 04:54:33 +00:00
Andre Oppermann
5f56967319 From __FreeBSD_version 600001 on PFIL_HOOKS is permanently in the kernel and
doesn't require to include opt_pfil_hooks.h.
2004-08-27 20:01:08 +00:00
Darren Reed
781950a42f Clean up a bunch of white-space difference with IPFilter source as well as
remove some superfluous assignments for .d_version/.d_flags in a cdevsw
structure initialisation that never sees the light of day in FreeBSD.
2004-07-11 10:13:05 +00:00
Darren Reed
be134cb640 Mess from update & merge - don't release the ifnet lock twice, just once
and after we're finished with it.
2004-06-29 03:39:06 +00:00
Darren Reed
01dbed783b revert section of code that calls netisr_queue() to match v1.33 of this file 2004-06-22 05:20:30 +00:00
Darren Reed
5e9c7ec5dc #ifdef's for FreeBSD are wrong, causing too many variable declaractions to
disappear.
2004-06-22 05:16:29 +00:00
Darren Reed
27944d9422 one too many #endif's from the update broke the build 2004-06-22 02:44:06 +00:00
Darren Reed
7b807523f4 Update ipfilter from 3.4.31 -> 3.4.35. Some important changes:
* block packets that fail to create state table entries
* only allow non-fragmented packets to influence whether or not a logged
  packet is the same as the one logged before.
* correct the ICMP packet checksum fixing up when processing ICMP errors for NAT
* implement a maximum for the number of entries in the NAT table (NAT_TABLE_MAX
  and ipf_nattable_max)
* frsynclist() wasn't paying attention to all the places where interface
  names are, like it should.
* fix comparing ICMP packets with established TCP state where only 8 bytes
  of header are returned in the ICMP error.

MFC after:	1 week
2004-06-21 22:46:36 +00:00
Darren Reed
866bef8856 Import ipfilter 3.4.35 (destinated for RELENG_4) to vendor branch 2004-06-21 22:26:10 +00:00
Poul-Henning Kamp
89c9c53da0 Do the dreaded s/dev_t/struct cdev */
Bump __FreeBSD_version accordingly.
2004-06-16 09:47:26 +00:00
Darren Reed
578a650271 Recognise NOINET6 as an indication to not build IPv6 enabled source even
if FreeBSD header files, etc, support it.

Submitted by:	Sergey Mokryshev <mokr@mokr.net>
2004-06-08 23:52:22 +00:00
Warner Losh
f36cfd49ad Remove advertising clause from University of California Regent's
license, per letter dated July 22, 1999 and email from Peter Wemm,
Alan Cox and Robert Watson.

Approved by: core, peter, alc, rwatson
2004-04-07 20:46:16 +00:00
Poul-Henning Kamp
dc08ffec87 Device megapatch 4/6:
Introduce d_version field in struct cdevsw, this must always be
initialized to D_VERSION.

Flip sense of D_NOGIANT flag to D_NEEDGIANT, this involves removing
four D_NOGIANT flags and adding 145 D_NEEDGIANT flags.
2004-02-21 21:10:55 +00:00
Brooks Davis
bd59f56d42 Use parens more reasionably so we match the vendor code. This is part
of the if_xname change.

Submitted by:	darrenr
Approved by:	re (scottl)
2003-12-02 18:28:00 +00:00
Brooks Davis
9bf40ede4a Replace the if_name and if_unit members of struct ifnet with new members
if_xname, if_dname, and if_dunit. if_xname is the name of the interface
and if_dname/unit are the driver name and instance.

This change paves the way for interface renaming and enhanced pseudo
device creation and configuration symantics.

Approved By:	re (in principle)
Reviewed By:	njl, imp
Tested On:	i386, amd64, sparc64
Obtained From:	NetBSD (if_xname)
2003-10-31 18:32:15 +00:00
Hajimu UMEMOTO
11e6ffbea3 use ND_IFINFO(). 2003-10-17 20:20:14 +00:00
Sam Leffler
e547d9ace2 o remove extraneous include of <net/pfil.h>
o guard wrapper code against user-mode compilation

Sponsored by:	FreeBSD Foundation
2003-09-24 05:08:58 +00:00
Sam Leffler
3fe1b4f5df update to reflect PFIL_HOOKS api changes
Supported by:	FreeBSD Foundation
2003-09-23 17:55:04 +00:00
David E. O'Brien
152385d122 Explicitly declare 'int' parameters. 2003-04-21 16:27:46 +00:00
Jonathan Lemon
1cafed3941 Update netisr handling; Each SWI now registers its queue, and all queue
drain routines are done by swi_net, which allows for better queue control
at some future point.  Packets may also be directly dispatched to a netisr
instead of queued, this may be of interest at some installations, but
currently defaults to off.

Reviewed by: hsu, silby, jayanth, sam
Sponsored by: DARPA, NAI Labs
2003-03-04 23:19:55 +00:00