Commit Graph

795 Commits

Author SHA1 Message Date
Bruce M Simpson
6b47cca2a7 Teach pfsync(4) that its member interfaces may go away.
This change partially resolves the issue in the PR. Further architectural
fixes, in the form of reference counting, are needed.

PR:		86848
Reviewed by:	yar
MFC after:	1 month
2007-03-19 17:52:15 +00:00
Florent Thoumie
7bd6fde395 - Add Intel firmwares for Intel PRO/Wireless LAN 2100/2200/2915 cards in a
uuencoded format along with their respective LICENSE files.
- Add new share/doc/legal directory to BSD.usr.dist mtree file. This is the
place we install LICENSE files for restricted firmwares.
- Teach firmware(9) and kmod.mk about licensed firmwares. Restricted firmwares
won't load properly unless legal.<name>.license_ack is set to 1, either
via kenv(1) or /boot/loader.conf.

Reviewed by:	mlaier, sam
Permitted by:	Intel (via Andrew Wilson)
MFC after:	1 month
2007-03-02 11:42:56 +00:00
Paolo Pisati
ef544f6312 o break newbus api: add a new argument of type driver_filter_t to
bus_setup_intr()

o add an int return code to all fast handlers

o retire INTR_FAST/IH_FAST

For more info: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=465712+0+current/freebsd-current

Reviewed by: many
Approved by: re@
2007-02-23 12:19:07 +00:00
Max Laier
191c6e1310 Clean up pfr_kentry_pl2 as well. This fixes a kernel panic in the vm.zone
sysctl after unloading pf.

Submitted by:	Earl Lapus
MFC after:	3 days
2007-01-01 16:51:11 +00:00
John Baldwin
0dea849ae9 Various bpf(4) related fixes to catch places up to the new bpf(4)
semantics.
- Stop testing bpf pointers for NULL.  In some cases use
  bpf_peers_present() and then call the function directly inside the
  conditional block instead of the macro.
- For places where the entire conditional block is the macro, remove the
  test and make the macro unconditional.
- Use BPF_MTAP() in if_pfsync on FreeBSD instead of an expanded version of
  the old semantics.

Reviewed by:	csjp (older version)
2006-12-29 13:59:50 +00:00
Max Laier
240589a9fe Work around a long standing LOR with user/group rules by doing the socket
lookup early.  This has some performance implications and should not be
enabled by default, but might help greatly in certain setups.  After some
more testing this could be turned into a sysctl.

Tested by:	avatar
LOR ids:	17, 24, 32, 46, 191 (conceptual)
MFC after:	6 weeks
2006-12-29 13:59:03 +00:00
Darren Reed
4012ba6ec7 TCP Window scaling was being recognised but the recorded settings were being
clobbered and thus effectively disabled.

MFC after:	7 days
2006-12-24 02:18:36 +00:00
Sam Leffler
8b33360649 This commit was generated by cvs2svn to compensate for changes in r165182,
which included commits to RCS files with non-trunk default branches.
2006-12-13 19:26:37 +00:00
Sam Leffler
0f3ff68694 Version 0.9.20.3:
o remove os-specific glue code; it's now the responsibility of
  the driver
o add wackelf utility for patching the ELF magic number on arm
  builds since noone can agree on how to mark a .o file as not
  having any floating point instructions
o remove radar/dfs-related entry points; folks have finally
  decided how to support dfs w/o polluting the hal
o properly recognize AR2424 chips (they were being rejected on
  attach despite being fully supported)
o add HAL_CAP_RXORN_FATAL capability to control how RXORN errors
  are handled; previously RXORN was always treated as fatal because
  older chips required a reset; now we do not treat it as fatal
  for "newer chips" (noone seems to know what the cutoff is so
  this capability can be used to override the current guestimate)
o HAL_CAP_RXTSTAMP_PREC capability to export the number of bits
  of precision for timestamp data returned in the rx descriptor
o remove public exposure of the compression buffer; it is chip
  specific and never belonged in the public view
o change definition of HAL_INT_GLOBAL from an enum member to a
  #define to workaround compilers that bitch about enum values
  that appear overflow 31 bits
o add support for newer chips that can store the tkip mic key
  together with the cipher key in a single key cache entry
o split tx/rx descriptor into a h/w section and a s/w portion;
  this permits storing the s/w area in cached memory when the
  h/w area is stored in uncached memory; this also shrinks
  memory use since only one status block is needed while multiple
  tx/rx descriptors may be required per frame
o add final transmit series index to the transmit descriptor status
  so rate control algorithms don't need to grovel through h/w state
  to find it
o remove ds_vdata field from the descriptor state as part of the
  radar changes
o fix excessive stack usage for some 5212 rf backends
o correct rfkill handling when the pin polarity is 0 true
o correct handling of tsf wrap when reading 64-bit values

MFC after:	1 month
2006-12-13 19:26:37 +00:00
Robert Watson
acd3428b7d Sweep kernel replacing suser(9) calls with priv(9) calls, assigning
specific privilege names to a broad range of privileges.  These may
require some future tweaking.

Sponsored by:           nCircle Network Security, Inc.
Obtained from:          TrustedBSD Project
Discussed on:           arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
                        Alex Lyashkov <umka at sevcity dot net>,
                        Skip Ford <skip dot ford at verizon dot net>,
                        Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
Robert Watson
aed5570872 Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h
begun with a repo-copy of mac.h to mac_framework.h.  sys/mac.h now
contains the userspace and user<->kernel API and definitions, with all
in-kernel interfaces moved to mac_framework.h, which is now included
across most of the kernel instead.

This change is the first step in a larger cleanup and sweep of MAC
Framework interfaces in the kernel, and will not be MFC'd.

Obtained from:	TrustedBSD Project
Sponsored by:	SPARTA
2006-10-22 11:52:19 +00:00
Oleg Bulyzhin
29453026ea Workaround bad locking design:
do not try to lock/unlock destroyed/non-existsing mutex.

PR:		kern/103569
Reviewed by:	guido
Approved by:	glebius (mentor)
Silence from:	darrenr
MFC:		2 week
2006-10-05 09:48:25 +00:00
Sam Leffler
d9994d8bb4 remove this from HEAD too since it got taken off the vendor branch 2006-09-18 17:01:35 +00:00
Sam Leffler
313ae6522b o move ath hal os glue code from the hal to the driver: this code was
part of the hal distribution early on when the hal was built for
  each os but it's been portable for a long time so move the os-specific
  code out (and off the vendor branch)
o correct the copyright on ah_osdep.?; it was mistakenly given a
  restricted license and not a dual-bsd/gpl license
o remove the module api definition as it was never used
o fixup include paths for move of ah_osdep.h

MFC after:	2 weeks
2006-09-18 16:49:15 +00:00
Sam Leffler
6432da677c This commit was generated by cvs2svn to compensate for changes in r162413,
which included commits to RCS files with non-trunk default branches.
2006-09-18 16:49:15 +00:00
Christian S.J. Peron
d94f2a68f8 Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point
exists to allow the mandatory access control policy to properly initialize
mbufs generated by the firewall. An example where this might happen is keep
alive packets, or ICMP error packets in response to other packets.

This takes care of kernel panics associated with un-initialize mbuf labels
when the firewall generates packets.

[1] I modified this patch from it's original version, the initial patch
    introduced a number of entry points which were programmatically
    equivalent. So I introduced only one. Instead, we should leverage
    mac_create_mbuf_netlayer() which is used for similar situations,
    an example being icmp_error()

    This will minimize the impact associated with the MFC

Submitted by:	mlaier [1]
MFC after:	1 week

This is a RELENG_6 candidate
2006-09-12 04:25:13 +00:00
Max Laier
a7c4fe03a8 Fix stateful filtering of loopback IPv6 traffic to an address not configured
on lo0.  While here fix a comment.

PR:		kern/102647
Reported by:	Frank Steinborn
Submitted by:	suz (earlier version)
MFC after:	3 days
2006-09-06 17:19:45 +00:00
Guido van Rooij
4160f4c64e Resolve conflicts
MFC after:	2 weeks
2006-08-16 12:06:35 +00:00
Guido van Rooij
0be1832174 Import IP Filter 4.1.13 2006-08-16 11:51:32 +00:00
Guido van Rooij
2b8b5c44fc This commit was generated by cvs2svn to compensate for changes in r161351,
which included commits to RCS files with non-trunk default branches.
2006-08-16 11:51:32 +00:00
Pawel Jakub Dawidek
dbb78f2906 The strstr() function is in the libkern now. 2006-08-12 15:29:12 +00:00
Max Laier
cff1b3389b Import from OpenBSD 1.168, dhartmei:
fix a bug in the input sanity check of DIOCCHANGERULE (not used by pfctl,
  but third-party tools). a rule must have a non-empty replacement address
  list when it's a translation rule but not an anchor call (i.e. "nat ...
  ->" needs a replacement address, but "nat-anchor ..." doesn't). the check
  confused "rule is an anchor call" with "rule is defined within an anchor".
  report from Michal Mertl, Max Laier.

Obtained from:	OpenBSD
MFC after:	2 weeks
2006-07-21 09:48:13 +00:00
Sam Leffler
6b7330e2d4 Revise network interface cloning to take an optional opaque
parameter that can specify configuration parameters:
o rev cloner api's to add optional parameter block
o add SIOCCREATE2 that accepts parameter data
o rev vlan support to use new api (maintain old code)

Reviewed by:	arch@
2006-07-09 06:04:01 +00:00
Max Laier
05206588f2 Make in-kernel multicast protocols for pfsync and carp work after enabling
dynamic resizing of multicast membership array.

Reported and testing by:	Maxim Konovalov, Scott Ullrich
Reminded by:			thompsa
MFC after:			2 weeks
2006-07-08 00:01:01 +00:00
Marcel Moolenaar
b6352de96c Apply local modifications to make Unwind Express BETA 10 buildable and
usable in the FreeBSD kernel.
2006-07-07 23:56:34 +00:00
Marcel Moolenaar
870376755a This commit was generated by cvs2svn to compensate for changes in r160160,
which included commits to RCS files with non-trunk default branches.
2006-07-07 23:04:49 +00:00
Marcel Moolenaar
50074ddd37 This commit was generated by cvs2svn to compensate for changes in r160157,
which included commits to RCS files with non-trunk default branches.
2006-07-07 22:59:01 +00:00
Marcel Moolenaar
924c6192ce Import BETA 10 of HP's Unwind Express. This import does not contain
any modifications to make it build as part of the FreeBSD kernel.
Now that the source appears to have stabilized, local changes will
happen on HEAD and will therefore cause affected files to be pulled
from the vendor branch.
2006-07-07 22:59:01 +00:00
Max Laier
a6831e7e3a Fix pfsync w/o carp compilation.
Submitted by:	yar
2006-06-16 10:25:06 +00:00
Max Laier
c0e9fdd321 Fix byteorder of syncpeer and make it actually work.
Submitted by:	glebius
MFC after:	1 week
2006-06-14 11:11:54 +00:00
Sam Leffler
a08db7182a reposition defines so things build on architectures where AH_REGOPS_FUNC
is defined
2006-06-07 18:09:33 +00:00
Sam Leffler
93057fddc1 resolve merge conflicts
MFC after:	1 month
2006-06-05 17:46:41 +00:00
Sam Leffler
7937397e81 Version 0.9.17.2:
o define HAL_SOFTC, HAL_BUS_TAG, and HAL_BUS_HANDLE to be machine
  independent; this fixes portability issues with bsd systems
o add ah_disable api for turning off operation of both MAC and PHY
o add ah_getAntennaSwitch and ah_setAntennaSwitch api's for better control
  of antenna usage and diversity
o add ah_setAckCTSRate and ah_setAckCTSRate for controlling tx rate of
  h/w generated frames
o add ah_setBeaconTimers api for simpler setting of the beacon timer registers
o remove ah_waitForBeaconDone api
o add HAL_TXDESC_DURENA flag to enable h/w duration setting in tx descriptor
o correct documentation of min/max tx power units (.5 dBm)
o switch arm, mips, and powerpc builds to use functions for register
  read/write operations
o fix sparc builds to not reference %g2 and %g3 registers
o add public builds for SoC's

MFC after:	1 month
2006-06-05 17:43:51 +00:00
Sam Leffler
a46aeff755 This commit was generated by cvs2svn to compensate for changes in r159285,
which included commits to RCS files with non-trunk default branches.
2006-06-05 17:43:51 +00:00
Poul-Henning Kamp
c40da00ca3 Since DELAY() was moved, most <machine/clock.h> #includes have been
unnecessary.
2006-05-16 14:37:58 +00:00
Max Laier
210c3cc4c3 Put debugging messages related to inconsistent ticket numbers under misc and
wrap it __FreeBSD__ specific as I couldn't figure out which version of
OpenBSD I got it from.

Reported by:	Scott Ullrich
2006-05-12 16:15:34 +00:00
Darren Reed
649a43212c fix "ipf -Z" reporting rubbish and possibly panic'ing box
MFC after:	4 days
2006-04-18 13:24:14 +00:00
Max Laier
94f2dfdd76 Loopback pf_norm.c rev. 1.106 from OpenBSD:
fixup IP checksum when modifying IP header fields

PR:		kern/93849
Obtained from:	OpenBSD
MFC after:	3 days
2006-03-25 21:15:25 +00:00
Yaroslav Tykhiy
3546dc71f0 Avoid pulling in the whole <net/pfvar.h> by opaquely declaring
the structs pflog_packet() takes pointers to.

Approved by:	mlaier
MFC after:	3 days
2006-03-09 15:54:01 +00:00
Andrew Thompson
95d4af215e Do not use the TSC where its known to be broken, this will cause the queue
speeds to perform below the desired bitrate and throughput will be erratic.

This makes queueing work on the Geode SC1100, K5 model 0 and IDT WinChip C6
processors.

MFC after:	3 days
2006-03-02 00:51:39 +00:00
Sam Leffler
1be92ea1ca resolve merge conflicts
MFC after:	2 weeks
2006-02-10 19:01:02 +00:00
Sam Leffler
c6f3555125 Version 0.9.16.16:
o new chip support
o new platforms: powerpc-be-elf, sparc64-be-elf, and alpha-elf
  (alpha is untested, others are known to work)
o many fixes and improvements

MFC after:	2 weeks
2006-02-10 18:57:38 +00:00
Sam Leffler
07c5770b96 This commit was generated by cvs2svn to compensate for changes in r155511,
which included commits to RCS files with non-trunk default branches.
2006-02-10 18:57:38 +00:00
Max Laier
5bba2114d0 Make pflog a seperate module. As a result pflog_packet() becomes a function
pointer that is declared in pf_ioctl.c

Requested by:	yar (as part of the module build reorg)
MFC after:	1 week
X-MFC with:	yar's module reorg
2006-02-05 17:17:32 +00:00
Daniel Hartmeier
31f9d10a77 fix a bug in the fragment cache (used for 'scrub fragment crop/drop-ovl',
but not 'fragment reassemble'), which can cause some fragments to get
inserted into the cache twice, thereby violating an invariant, and panic-
ing the system subsequently.

Reviewed by:	mlaier
MFC after:	1 day
2006-01-19 11:46:45 +00:00
Max Laier
4cd9957a80 Move m_adj after checking that m_dup succeeded.
Found with:	Coverity Prevent(tm)
MFC after:	3 days
2006-01-14 22:19:17 +00:00
Guido van Rooij
ecdad7e688 Add mcopywrap prototype to ip_compat.h
Remove h323 proxy from ip_proxy (copyright issue)
2005-12-30 11:55:37 +00:00
Guido van Rooij
9088f4e67b Resolve conflicts 2005-12-30 11:32:23 +00:00
Guido van Rooij
fc79eaf127 Import IP Filter version 4.1.10 2005-12-30 11:22:11 +00:00
Guido van Rooij
a311d8fc4c This commit was generated by cvs2svn to compensate for changes in r153872,
which included commits to RCS files with non-trunk default branches.
2005-12-30 11:22:11 +00:00
Max Laier
6ae8d74a9e Only decrement the max-src-conn counter for tcp connections that reached
"established" state.

Similar to OpenBSD's rev. 1.499 by joel but not breaking ABI.

Obtained from:	OpenBSD (with changes)
Reported by:	Bruno Afonso
MFC after:	3 days
X-MFC:		together with local_flags
2005-12-25 23:52:00 +00:00
Max Laier
8d13037cda Fix build after timeval.tv_sec changed from long to time_t. 2005-12-25 22:57:08 +00:00
Max Laier
602d8f4030 Move PFSTATE_EXPIRING from sync_flags to a new local_flags. sync_flags has
special handling when zero.  This caused no PFSYNC_ACT_DEL message and thus
disfunction of pfflowd and state synchronisation in general.

Discovered by:	thompsa
Good catch by:	thompsa
MFC after:	7 days
2005-12-20 00:33:33 +00:00
David E. O'Brien
d5d59bade9 This commit was generated by cvs2svn to compensate for changes in r153200,
which included commits to RCS files with non-trunk default branches.
2005-12-07 17:32:13 +00:00
David E. O'Brien
b734606dff Update the nForce MCP NIC bits. This is version 1.0-0310 23-Nov-2005. 2005-12-07 17:32:13 +00:00
Ruslan Ermilov
342ed5d948 Fix -Wundef warnings found when compiling i386 LINT, GENERIC and
custom kernels.
2005-12-05 11:58:35 +00:00
Ruslan Ermilov
3238c6bd33 Fix -Wundef from compiling the amd64 LINT. 2005-12-04 10:06:06 +00:00
Ruslan Ermilov
4a0d6638b3 - Store pointer to the link-level address right in "struct ifnet"
rather than in ifindex_table[]; all (except one) accesses are
  through ifp anyway.  IF_LLADDR() works faster, and all (except
  one) ifaddr_byindex() users were converted to use ifp->if_addr.

- Stop storing a (pointer to) Ethernet address in "struct arpcom",
  and drop the IFP2ENADDR() macro; all users have been converted
  to use IF_LLADDR() instead.
2005-11-11 16:04:59 +00:00
Ruslan Ermilov
d09ed26fd8 - Make IFP2ENADDR() a pointer to IF_LLADDR() rather than another
copy of Ethernet address.

- Change iso88025_ifattach() and fddi_ifattach() to accept MAC
  address as an argument, similar to ether_ifattach(), to make
  this work.
2005-11-11 07:36:14 +00:00
Andrew Thompson
4e7e0183e1 Move the cloned interface list management in to if_clone. For some drivers the
softc lists and associated mutex are now unused so these have been removed.

Calling if_clone_detach() will now destroy all the cloned interfaces for the
driver and in most cases is all thats needed to unload.

Idea by:	brooks
Reviewed by:	brooks
2005-11-08 20:08:34 +00:00
Jung-uk Kim
e9bfb92a8e - Fix more resource parsing problems. The previous commit was imcomplete.
- Fix a typo in rsmisc.c and a style change for consistency.

This patch will also appear in future ACPI-CA release.

Submitted by:	Robert Moore <robert dot moore at intel dot com>
Tested by:	ru
2005-11-04 21:29:41 +00:00
Jung-uk Kim
45e7d2e745 This commit was generated by cvs2svn to compensate for changes in r152069,
which included commits to RCS files with non-trunk default branches.
2005-11-04 21:29:41 +00:00
Nate Lawson
ce60eb2a14 Account for the minimum resource size when parsing the end tag resource
descriptor.  This should fix the "memory modified after free" panics.  This
patch will appear in a future acpi-ca distribution.

Submitted by:	Robert Moore <robert.moore / intel.com>
Tested by:	Peter Holm
2005-11-04 20:15:09 +00:00
Nate Lawson
d4d37d2fc9 This commit was generated by cvs2svn to compensate for changes in r152058,
which included commits to RCS files with non-trunk default branches.
2005-11-04 20:15:09 +00:00
Jung-uk Kim
2a74e7368d Fix build breakage on tinderbox. 2005-11-03 20:27:38 +00:00
Jung-uk Kim
6eb081af76 Update to reflect import of ACPI-CA 20051021 with includes fixups 2005-11-01 22:38:50 +00:00
Jung-uk Kim
5475ddb73a Local change: remove unnecessary __cdecl 2005-11-01 22:33:32 +00:00
Jung-uk Kim
0dd793f645 Local change: remove compilation warnings 2005-11-01 22:30:52 +00:00
Jung-uk Kim
b56f6e1fd7 Fix conflicts from import of Intel ACPI-CA 20051021 2005-11-01 22:28:49 +00:00
Jung-uk Kim
775a51a92f Unchanged files that are off the vendor branch 2005-11-01 22:23:25 +00:00
Jung-uk Kim
5e41bc61d8 Fix few compilation problems on vendor branch.
These fixes will be submitted vendor.
2005-11-01 22:18:47 +00:00
Jung-uk Kim
43ea53ef1f This commit was generated by cvs2svn to compensate for changes in r151940,
which included commits to RCS files with non-trunk default branches.
2005-11-01 22:18:47 +00:00
Jung-uk Kim
fba7fc7e34 Vendor import of Intel ACPI-CA 20051021 2005-11-01 22:11:18 +00:00
Jung-uk Kim
ff4eaaff6b This commit was generated by cvs2svn to compensate for changes in r151937,
which included commits to RCS files with non-trunk default branches.
2005-11-01 22:11:18 +00:00
Robert Watson
5bb84bc84b Normalize a significant number of kernel malloc type names:
- Prefer '_' to ' ', as it results in more easily parsed results in
  memory monitoring tools such as vmstat.

- Remove punctuation that is incompatible with using memory type names
  as file names, such as '/' characters.

- Disambiguate some collisions by adding subsystem prefixes to some
  memory types.

- Generally prefer lower case to upper case.

- If the same type is defined in multiple architecture directories,
  attempt to use the same name in additional cases.

Not all instances were caught in this change, so more work is required to
finish this conversion.  Similar changes are required for UMA zone names.
2005-10-31 15:41:29 +00:00
John Baldwin
28f22a242b Remove old ACPICA files from the INTEL vendor branch. They were removed
from HEAD about 4 years ago when we started flattening out the ACPICA
distribution.
2005-10-27 20:48:05 +00:00
David E. O'Brien
c33a1f33c8 Add a commented out version of what was done for the r20041119sysinc import. 2005-10-24 04:36:14 +00:00
David E. O'Brien
3e50df5a3e Fix conflicts of import of Intel ACPI-CA 20041119 with system includes fixups. 2005-10-24 04:35:20 +00:00
David E. O'Brien
27f081c52f Vendor import of Intel ACPI-CA 20041119 with system includes fixups. 2005-10-24 04:31:06 +00:00
David E. O'Brien
763384f7cd This commit was generated by cvs2svn to compensate for changes in r151600,
which included commits to RCS files with non-trunk default branches.
2005-10-24 04:31:06 +00:00
Ruslan Ermilov
e019908ee7 In detach method, move if_free() after bus_teardown_intr(). 2005-10-13 21:11:20 +00:00
Andrew Thompson
febd0759f3 Change the reference counting to count the number of cloned interfaces for each
cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks
2005-10-12 19:52:16 +00:00
Ruslan Ermilov
fead0681ed Fix "struct ifnet" leak if attach() fails in the middle. 2005-09-16 12:49:06 +00:00
David E. O'Brien
1aa7b020d7 Per a request from Nick Triantos of nVidia, nVidia's legal department asked
that we provide their license document beside their nForce MCP object code.
2005-09-11 17:50:20 +00:00
Max Laier
922e338183 Stop leaking a lock. This used to cause a propagate_priority() page fault
when setting syncdev and syncpeer.

Reported by:	Dominic Marks
2005-09-11 11:55:39 +00:00
Max Laier
82f0cb7f33 Unbreak the build. Committed from the wrong directory. 2005-09-08 17:42:42 +00:00
Max Laier
5e11e6c096 Commit imported changes to HEAD:
pf_ioctl.c Revision 1.153 Sun Aug 7 11:37:33 2005 UTC by dhartmei
 | verify ticket in DIOCADDADDR, from Boris Polevoy, ok deraadt@

 pf_ioctl.c Revision 1.158 Mon Sep 5 14:51:08 2005 UTC by dhartmei
 | in DIOCCHANGERULE, properly initialize table, if used in NAT rule.
 | from Boris Polevoy <vapcom at mail dot ru>, ok mcbride@

 pf.c Revision 1.502 Mon Aug 22 11:54:25 2005 UTC by dhartmei
 | when nat'ing icmp 'connections', replace icmp id with proxy values
 | (similar to proxy ports for tcp/udp). not all clients use
 | per-invokation random ids, this allows multiple concurrent
 | connections from such clients.
 | thanks for testing to Rod Whitworth, "looks ok" markus@

 pf.c Revision 1.501 Mon Aug 22 09:48:05 2005 UTC by dhartmei
 | fix rdr to bitmask replacement address pool. patch from Max Laier,
 | reported by Boris Polevoy, tested by Jean Debogue, ok henning@

Obtained from:	OpenBSD
MFC after:	3 days
2005-09-08 15:06:52 +00:00
Max Laier
ef2e5f06f2 Wrap the new world order in __FreeBSD__ to ease future imports. 2005-08-09 11:59:02 +00:00
Robert Watson
13f4c340ae Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE and
IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to
ifnet.if_drv_flags.  Device drivers are now responsible for
synchronizing access to these flags, as they are in if_drv_flags.  This
helps prevent races between the network stack and device driver in
maintaining the interface flags field.

Many __FreeBSD__ and __FreeBSD_version checks maintained and continued;
some less so.

Reviewed by:	pjd, bz
MFC after:	7 days
2005-08-09 10:20:02 +00:00
Max Laier
ffe93c0d25 Prevent a race condition. As pf_send_tcp() - called for expired synproxy
states - has to drop the lock when calling back to ip_output(), the state
purge timeout might run and gc the state. This results in a rb-tree
inconsistency.  With this change we flag expiring states while holding the
lock and back off if the flag is already set.

Reported by:	glebius
MFC after:	2 weeks
2005-07-20 18:58:27 +00:00
Hajimu UMEMOTO
6c4eaa873f move RFC3542 related definitions into ip6.h.
Submitted by:	Keiichi SHIMA <keiichi__at__iijlab.net>
Reviewed by:	mlaier
Obtained from:	KAME
2005-07-20 10:30:52 +00:00
Max Laier
6de8d9dc52 Export pfsyncstats via sysctl "net.inet.pfsync" in order to print them with
netstat (seperate commit).

Requested by:	glebius
MFC after:	1 week
2005-07-14 22:22:51 +00:00
Max Laier
889ad0384e Properly initialize ifq_maxlen for the defered send queue and make it
actually work.  Also use the right semantics for IF_HANDOFF to get correct
stats.

Reported and tested by:	Sascha Luck <sascha at c4inet dot net>
Approved by:		re (blanket)
2005-06-26 21:00:52 +00:00
Darren Reed
721c3c7cc6 Fix some minor problems before release:
(1) "ipf -T" is broken for fetching single entries and
(2) loading rules with numbered collections does not order insertion right.
(3) stats aren't accumulated for hash table memory failures

Approved by: re (dwhite)
2005-06-23 14:19:02 +00:00
Darren Reed
ebcef7d42b locking on exit of reading from ip_sync is not correct for all instances
Approved by:	re (dwhite)
2005-06-14 09:18:26 +00:00
Max Laier
c8d1dc8cc8 Mark pf callouts as NET_MPSAFE.
Requested by:	yongari (serveral times)
Approved by:	re (blanket)
MFC after:	1 week
2005-06-12 16:46:20 +00:00
Max Laier
fe2f7b3b0d Defer ip_output of pfsync updates to an independent callout thread instead
of just dropping the lock around the ip_output call.  This used to cause
corrupted state tree walks for some call-paths.

In a second stage all callouts will be marked MPSAFE according to the
setting of mpsafenet.

Reported and tested by:	Matthew Grooms <mgrooms at seton dot org>
MFC after:		3 days
X-MFC after:		Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
Brooks Davis
fc74a9f93a Stop embedding struct ifnet at the top of driver softcs. Instead the
struct ifnet or the layer 2 common structure it was embedded in have
been replaced with a struct ifnet pointer to be filled by a call to the
new function, if_alloc(). The layer 2 common structure is also allocated
via if_alloc() based on the interface type. It is hung off the new
struct ifnet member, if_l2com.

This change removes the size of these structures from the kernel ABI and
will allow us to better manage them as interfaces come and go.

Other changes of note:
 - Struct arpcom is no longer referenced in normal interface code.
   Instead the Ethernet address is accessed via the IFP2ENADDR() macro.
   To enforce this ac_enaddr has been renamed to _ac_enaddr.
 - The second argument to ether_ifattach is now always the mac address
   from driver private storage rather than sometimes being ac_enaddr.

Reviewed by:	sobomax, sam
2005-06-10 16:49:24 +00:00
Hartmut Brandt
9fb7e9cad1 This commit was generated by cvs2svn to compensate for changes in r146539,
which included commits to RCS files with non-trunk default branches.
2005-05-23 13:08:32 +00:00
Hartmut Brandt
d32729f62c Virgin import of NgATM kernel part 1.2 2005-05-23 13:08:32 +00:00
Darren Reed
051adc35a2 Enable building /sbin/ipf (but not the rescue version) with the ability to
parse bpf strings for filter rules in ipf.conf
2005-05-16 16:22:55 +00:00
Darren Reed
05793fcbf0 Enable IPFilter to correctly determine if BPF has been optioned into the
kernel it is being compiled against and subsequently enable using BPF for
packet matching in ipf rules.
2005-05-15 03:34:17 +00:00
Max Laier
ac9dfc9061 if_mtu not ifp_mtu. 2005-05-04 19:51:06 +00:00
Max Laier
69d9333494 Bring back fix from rev. 1.28 which was lost during the import. 2005-05-04 16:03:01 +00:00
Max Laier
8398e1894d Combine rev. 1.29 and 1.30 to something that will make sense for future
imports.
2005-05-04 15:55:29 +00:00
Max Laier
10ca483be0 Make LINT happy. 2005-05-04 15:29:28 +00:00
Andre Oppermann
c773494edd Pass icmp_error() the MTU argument directly instead of
an interface pointer.  This simplifies a couple of uses
and removes some XXX workarounds.
2005-05-04 13:09:19 +00:00
Max Laier
b01933e6bf Resolve conflicts created during the import of pf 3.7 Some features are
missing and will be implemented in a second step.  This is functional as is.

Tested by:	freebsd-pf, pfsense.org
Obtained from:	OpenBSD
X-MFC after:	never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
Ruslan Ermilov
f9067637f7 Fix the following warnings on amd64:
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_newfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:397: warning: cast to pointer from integer of different size
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c: In function `fr_ipid_knownfrag':
/usr/src/sbin/ipf/ipftest/../../../sys/contrib/ipfilter/netinet/ip_frag.c:582: warning: cast from pointer to integer of different size
2005-04-29 05:57:17 +00:00
Darren Reed
e01de6cda3 Don't use quad_t on FreeBSD (deprecated) so use "long long" instead.
Someday this should be converted to uint64_t and printstate.c changed to
use those horrid PRiud64 things.
2005-04-28 21:36:30 +00:00
Darren Reed
caec4e7746 The current H.323 proxy source has a license that isn't suitable for inclusion
with FreeBSD so we shouldn't be trying to include it here.
2005-04-27 05:53:12 +00:00
Darren Reed
b1660bb30d - Comment out duplicate rcsid strings in *.c files
- Move SIOCPROXY from ip_nat.h to ip_proxy.h and fix ip_proxy.h so that it
  can be easily compiled into kdump, et al.
2005-04-27 03:48:10 +00:00
Darren Reed
c81e55a2df Add an include for netinet/ip_compat.h directly so that we don't need to
add another special file in the creation of ioctls.c for kdump.
2005-04-26 17:58:05 +00:00
Darren Reed
6eab6ed50f Merge the changes from 3.4.35 to 4.1.8 into the kernel source tree 2005-04-25 18:43:14 +00:00
Darren Reed
8158c4468d import ipfilter 4.1.8 into the kernel source tree 2005-04-25 18:15:41 +00:00
Darren Reed
d607092b37 This commit was generated by cvs2svn to compensate for changes in r145516,
which included commits to RCS files with non-trunk default branches.
2005-04-25 18:15:41 +00:00
Gleb Smirnoff
2fa088e969 Fix error in synproxy connection completion. Source and
destination windows were confused, one instead of other.
This error was masked, because first segment of just
established connection is usually smaller than initially
announced window, and it was successfully passed. First
window reannouncement corrected erroneous 'seqhi' value.
The error showed up when client connected to synproxy
with zero initial window, and reannounced it after
session establishment.

In collaboration with:	dhartmei [we came to same patch independtly]
Reviewed by:		mlaier
Sponsored by:		Rambler
MFC after:		3 days
2005-04-22 09:53:46 +00:00
Robert Watson
e551d45211 Modify the alq(9) alq_open() API to accept a file creation mode, rather
than defaulting the cmode argument to vn_open() to 0.  Supply a default
argument of ALQ_DEFAULT_CMODE (0600) in current callers.

Discussed with/pointed out by:	hmp
Reveiwed by:	jeff, hmp
MFC after:	3 days
2005-04-16 12:12:27 +00:00
Gleb Smirnoff
699df192d9 Fix mss byte order, only affects synproxy code path.
Submitted by:	John L. Scarfone via OpenBSD
Reviewed by:	mlaier
Obtained from:	OpenBSD, rev. 1.483
MFC after:	2 days
2005-04-13 21:05:55 +00:00
David E. O'Brien
1e5fec6b15 Import the nForce MCP NIC bits. This is version 1.0-0301.
Demanded by:	DES
Encouraged by:	scottl
2005-03-12 00:17:37 +00:00
David E. O'Brien
0587a1ea34 This commit was generated by cvs2svn to compensate for changes in r143439,
which included commits to RCS files with non-trunk default branches.
2005-03-12 00:17:37 +00:00
Scott Long
d38d9c9e5e Move all of the hptmv files to /sys/dev/hptmv so that they won't be mistaken
for being on a CVS vendor branch.  The files were moved via a repo-copy.
2005-03-02 05:14:28 +00:00
David E. O'Brien
bb4e63066a Add FreeBSD ID. 2005-02-28 00:53:29 +00:00
Poul-Henning Kamp
4db0fda84e Use dynamic major number allocation. 2005-02-27 22:19:35 +00:00
Sam Leffler
c01f36ef0c avoid sneaky double free
Noticed by:	Coverity Prevent analysis tool
Reviewed by:	scottl
2005-02-25 00:16:53 +00:00
Brian Feldman
d011a9158c Do not fail to initialize callouts (on SMP only) -- it leads to crashing. 2005-02-22 04:27:05 +00:00
Max Laier
93d6cddf05 Fix a terrible braino in pfi_maybe_destroy() and unbreak "$pfctl -Fall" with
renamed interfaces.

PR:		kern/77645
Reported by:	Harald Schmalzbauer <harryNOschmalzbauerSPAMde>
Reviewed by:	yongari
MFC after:	3 days
2005-02-21 17:20:00 +00:00
Max Laier
0df559602c Don't use the static CALLOUT_INITIALIZER for __FreeBSD_version >= 600000. It
was a bad idea, but since it is done like this in the vendor source we keep
it around for older versions. As a safe guard against future misuse we don't
even define CALLOUT_INITIALIZER anymore.

This fixes ALTQ after callout_init_mtx() and takes altq_var.h off the vendor
branch.

Submitted by:	Divacky Roman <xdivac02NOstud.fit.vutbrSPAMcz> (w/ changes)
2005-02-21 17:11:09 +00:00
Pyun YongHyeon
a94f16f4fa Fix inteface clear time. pf printed "Thu Jan 1 09:00:01 1970"
in "pfctl -vvsI" output when pf was statically linked to kernel.

Discussed with:	mlaier
2005-02-17 03:36:31 +00:00
Max Laier
68198dedf8 Access softc embedded struct ifnet via function macro to make it easier to
untangle struct ifnet and softc/arpcom in the future.

Requested by:	brooks
2005-02-09 19:29:13 +00:00
Matthew N. Dodd
1f005b6723 - Split out PCI support.
- Add previously removed ISA support.

Submitted by:	David S. Madole <david AT madole.net>
2005-02-03 23:01:01 +00:00
Daniel Hartmeier
d4f925e4df Use the packet's address family instead of the rule's when selecting a
replacement address for an rdr rule. Some rdr rules have no address family
(when the replacement is a table and no other criterion implies one AF).
In this case, pf would fail to select a replacement address and drop the
packet due to translation failure.

Found by:	Gustavo A. Baratto
2005-01-20 18:07:35 +00:00
Daniel Hartmeier
9624b04d64 Prohibit ruleset changes at securelevel > 2, not > 1. It's documented
like this in init(8), but the code didn't match the documentation.

Submitted by:	Juraj Lutter <otis at sk dot FreeBSD dot org>
Agrees:		mlaier
2005-01-19 21:37:00 +00:00
Nate Lawson
edd973a013 Clean up a small memory leak introduced with the previous commit to
dsutils.c.  We need to GC the implicitly-returned object.

Submitted by:	Robert.Moore at Intel
MFC after:	1 day
2005-01-14 06:37:43 +00:00
Nate Lawson
d26e4b9a02 This commit was generated by cvs2svn to compensate for changes in r140216,
which included commits to RCS files with non-trunk default branches.
2005-01-14 06:37:43 +00:00
Nate Lawson
4802655124 Fix handling of the implicit return case for methods called from an
external source (i.e., _STA).  The previous case only handled calls
occurring within AML.  This should fix Toshibas, among others.  Thanks
to Robert Moore of Intel for the fix.

MFC after:	2 days
2005-01-12 00:52:40 +00:00
Nate Lawson
6023610d63 This commit was generated by cvs2svn to compensate for changes in r140094,
which included commits to RCS files with non-trunk default branches.
2005-01-12 00:52:40 +00:00
Darren Reed
4d7cb202f1 Elminate 1 LOR (actually a recursive mutex grab) involving ipfilter where
we loop through all the list of NICs (struct ifnet), holding the lock on
it and then do a name lookup with ifunit() whilst holding it.
2005-01-08 04:32:02 +00:00
Darren Reed
4541c49f79 * Remove some code that's in a #ifndef FreeBSD that's no longer used. 2004-12-26 09:09:29 +00:00
Darren Reed
2fb1eb06a7 * The #ifdef's to cause mutex's for freebsd to be declared were meant to pick
up on USE_MUTEX being defined, but this patch
* Remove some code that's in a #ifndef FreeBSD that's no longer used.
2004-12-26 09:08:42 +00:00
Scott Long
98331badc2 Darnit, through a maze of twisty passages, ipfilter needs to have PFIL_HOOKS
defined.  Revert part of the previous commit to fix this.
2004-12-25 00:48:27 +00:00
Scott Long
0ca8ae1641 Sprinkle in some __FreeBSD_version checks so that this compiles again. Don't
define PFIL_HOOKS anymore.

Submitted by: keramida
2004-12-25 00:22:25 +00:00
Darren Reed
77bb8ca4a3 Enable fine grained locking within IPFilter, using mtx(9) and sx(9) allowing
the the "needs giant" flag to be removed from the driver.
2004-12-24 09:14:26 +00:00
Daniel Hartmeier
2726bbe221 Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,
prevents a possible endless loop in pf_get_sport() with 'static-port'

ICMP state entries use the ICMP ID as port for the unique state key. When
checking for a usable key, construct the key in the same way. Otherwise,
a colliding key might be missed or a state insertion might be refused even
though it could be inserted. The second case triggers the endless loop,
possibly allowing a NATed LAN client to lock up the kernel.

PR:			kern/74930
Reported and tested by:	Hugo Silva, Srebrenko Sehic
MFC after:		3 days
2004-12-19 19:43:04 +00:00
Max Laier
905c6b87b7 Make ip_nat compile again. Should read #if->n<-def LARGE_NAT as in ipf 4.x 2004-12-18 03:47:54 +00:00
Darren Reed
f42b5dbebb Move two variables that are unused if LARGE_NAT is defined inside an #ifdef
to keep them out of harms way when compiling.

PR:	72783
2004-12-17 15:59:16 +00:00
Darren Reed
8a377db272 Allow ipnat redirect rules to work for non-TCP/UDP packets.
PR:             70038
Submitted by:   fming@borderware.com
Reviewed by:    darrenr
Obtained from:  fming@borderware.com
2004-12-17 02:29:34 +00:00
Darren Reed
6de0f6c8b8 Using just m_pullup to get all of the interesting bits in packet into one
buffer doesn't work for ipv6 packets, so use m_defrag() here instead as an
easy drop-in replacement.

PR:	70399
2004-12-16 21:02:16 +00:00
Max Laier
7cadbe4109 Compile pfsync w/o bpf.
Noticed by:	"Jayel Villamin" <jarthel operamail com>
2004-12-10 17:42:47 +00:00
Sam Leffler
8c489f7420 clear old files now in public 2004-12-08 18:27:44 +00:00