Commit Graph

9636 Commits

Author SHA1 Message Date
Kristof Provost
d0fdf2b28f pf: Track the original kif for floating states
Track (and display) the interface that created a state, even if it's a
floating state (and thus uses virtual interface 'all').

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30245
2021-05-20 12:49:27 +02:00
Kristof Provost
bc94129147 pfctl: Use DIOCGETSTATESNV
Migrate to using the new nvlist-based DIOCGETSTATESNV call to obtain the
states list.

MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30244
2021-05-20 12:49:27 +02:00
Kirk McKusick
fe815b88b5 Fix fsck_ffs Pass 1b error exit "bad inode number 256 to nextinode".
Pass 1b of fsck_ffs runs only when Pass 1 has found duplicate blocks.
Pass 1 only knows that a block is duplicate when it finds the second
instance of its use. The role of Pass 1b is to find the first use
of all the duplicate blocks. It makes a pass over the cylinder groups
looking for these blocks. When moving to the next cylinder group,
Pass 1b failed to properly calculate the starting inode number for
the cylinder group resulting in the above error message when it
tried to read the first inode in the cylinder group.

Reported by:  Px
Tested by:    Px
PR:           255979
MFC after:    3 days
Sponsored by: Netflix
2021-05-19 14:39:24 -07:00
Warner Losh
086feed850 md5: Create md5sum, etc compatible programs
On Linux, there's a similar set of programs to ours, but that end in the
letters 'sum'. These act basically like FreeBSD versions run with the -r
option. Add code so that when the program ends in 'sum' you get the
linux -r behavior. This is enough to make most things that use sha*sum
work correctly (the -c / --check options, as well as the long args are
not implemented). When running with the -sum programs, ignore -t instead
of running internal speed tests and make -c an error.

Reviewed by:		sef, and kp and allanjude (earlier version)
Relnotes:		yes
Sponsored by:		Netflix
Differential Revision:	https://reviews.freebsd.org/D30309
2021-05-19 11:41:53 -06:00
Kirk McKusick
efe145a745 Correct assert added to dump program.
The dump program was exiting with the message:

Assertion failed: (spcl.c_count + blks < TP_NINDIR), function appendextdata, file /usr/src/sbin/dump/traverse.c, line 759.

The problem arose when dumping external attributes.

This assertion was added in this commit with no review by someone
with expertise in the dump program:

    commit 2d518c6518
    Author:     Warner Losh <imp@FreeBSD.org>
    AuthorDate: Mon Jun 11 19:32:36 2018 +0000
    Commit:     Warner Losh <imp@FreeBSD.org>
    CommitDate: Mon Jun 11 19:32:36 2018 +0000

	Add asserts to prevent overflows of c_addr.

It is clearly wrong as the statement immediately above it in the
code which is deciding if the data will fit is:

	if (spcl.c_count + blks > TP_NINDIR)
		return (0);

As is pointed out in the bug report, the assert should be:

	(spcl.c_count + blks <= TP_NINDIR)

This commit corrects the assert. I am sorry that it took so long to
be brought to my attention and get fixed.

Reported by:  Hampton Finger
PR:           244470
MFC after:    3 days
Sponsored by: Netflix
2021-05-17 16:34:53 -07:00
Kirk McKusick
a3628327e7 Ensure that files with no allocated blocks are trimmed to zero length.
UFS does not allow files to end with a hole; it requires that the
last block of a file be allocated. As fsck_ffs(8) initially scans
each allocated inode, it tracks the last allocated block in the
inode. It then checks that the inode's size falls in the last
allocated block. If the last allocated block falls before the size,
a `file size beyond end of allocated file' warning is issued and
the file is shortened to reference the last allocated block (to avoid
having it reference a hole at its end). If the last allocated block
falls after the size, a `partially truncated file' warning is issued
and all blocks following the block referenced by the size are freed.

Because of an incorrect unsigned comparison, this test was failing
to handle files with no allocated blocks but non-zero size (which
should have had their size reset to zero). Once that was fixed the
test started incorrectly complaining about short symbolic links
that place the link path in the inode rather than in a disk block.
Because these symbolic links have a non-zero size, but no allocated
blocks, fsck_ffs wanted to zero out their size. This patch has to
detect and avoid changing the size of such symbolic links.

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    1 week
Sponsored by: Netflix
2021-05-11 14:52:26 -07:00
Lutz Donnerhacke
802637be06 ipfw.8: Fix table example
Fix some erronous lines in the example section.

PR:		248943
Submitted by:	Jose Luis Duran
MFC after:	2 weeks
Reviewers:	ae, manpages (gbe)
Differential Revision: https://reviews.freebsd.org/D30191
2021-05-11 17:38:26 +02:00
Lutz Donnerhacke
f6f297871d sbin/ipfw: Allow tablearg as hostname
Hostnames starting with "tablearg" are considered as a functional
argument instead of a literal.

Reported by:	ae
Reviewers:	ae
MFC after:	1 week
Differential Revision: https://reviews.freebsd.org/D30208
2021-05-11 10:44:33 +02:00
Lutz Donnerhacke
6cb13813ca sbin/ipfw: Fix parsing error in table based forward
The argument parser does not recognise the optional port for an
"tablearg" argument.  Fix simplifies the code by make the internal
representation expicit for the parser.

PR:		252744
MFC:		1 week
Reported by:	<bugs.freebsd.org@mx.zzux.com>
Approved by:	nc
Tested by:	<bugs.freebsd.org@mx.zzux.com>
Differential Revision: https://reviews.freebsd.org/D30164
2021-05-08 22:52:17 +02:00
Kristof Provost
93abcf17e6 pf: Support killing 'matching' states
Optionally also kill states that match (i.e. are the NATed state or
opposite direction state entry for) the state we're killing.

See also https://redmine.pfsense.org/issues/8555

Submitted by:	Steven Brown
Reviewed by:	bcr (man page)
Obtained from:	https://github.com/pfsense/FreeBSD-src/pull/11/
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30092
2021-05-07 22:13:31 +02:00
Kristof Provost
abbcba9cf5 pf: Allow states to by killed per 'gateway'
This allows us to kill states created from a rule with route-to/reply-to
set.  This is particularly useful in multi-wan setups, where one of the
WAN links goes down.

Submitted by:	Steven Brown
Obtained from:	https://github.com/pfsense/FreeBSD-src/pull/11/
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30058
2021-05-07 22:13:31 +02:00
Kristof Provost
2a00c4db93 pfctl: Start using DIOCKILLSTATESNV
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30055
2021-05-07 22:13:31 +02:00
Kristof Provost
53714a5861 pfctl: Start using DIOCCLRSTATESNV
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30053
2021-05-07 22:13:30 +02:00
Kristof Provost
cc948296e6 pfctl: Optionally show gateway information for states
When showing the states, in very verbose mode, also display the gateway
(i.e. the target for route-to/reply-to).

Submitted by:	Steven Brown
Reviewed by:	donner
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D30051
2021-05-07 22:13:30 +02:00
Ceri Davies
1a212abd54 devd.conf: Remove support for coldsync
The coldsync port was removed in 2012.  The last stable release of
coldsync was issued in 2002.  Let's get rid of it.

PR:		255051
Reviewed by:	imp
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D30100
2021-05-07 14:31:08 -04:00
Ceri Davies
6a8ed85f48 devd.conf: Typo
PR:		255051
MFC after:	3 days
2021-05-07 14:31:02 -04:00
Edward Tomasz Napierala
95a74ab4fb nvmecontrol: fix typo (s/Managment/Management/)
Reported By:	pstef
2021-05-07 13:12:30 +01:00
Warner Losh
6d6cca3633 nvmecontrol: update copyright on passthru command
I wrote this code, not Intel, so put my copyright on this. I mistakenly
copied it for the initial commit.

Sponsored by:		Netflix
2021-05-06 16:09:31 -06:00
Warner Losh
510a3da147 nvmecontrol: Report status from passthru commands
Report status from dword0 for passthru commands. Many commands report
some status or information here, so reporting it can help know what's
going on.

Sponsored by:		Netflix
2021-05-06 16:09:31 -06:00
Warner Losh
36be84b966 ttys: diff reduction
Back in the day, we used to have a number of entries that were either
'on' or 'off' directly, rather than conditionally on 'onifexists'
etc. Back then, we tried to line up the 'secure' columns by using the
construct 'on secure' or 'off secure' (one space or two). Now that these
have all moved to a conditional construct, remove the second space on
the ttys that still have it. This reduces diffs between the different
ttys and is no functional change. i386 and amd64 did this a long time
ago, and those are the only ones that affected external users (who used
to sed 's/on /off /' the entires as part of the automation).

MFC After:		3 days
Sponsored by:		Netflix
2021-05-04 14:06:31 -06:00
Jose Luis Duran
0ea8a7f36d ifconfig: Minor documentation fix
Fix what appears to have been a small copy/paste typo in ifconfig(8)'s
documentation (man page and header file).

Not that it matters anymore.

Reference: Table I-2 in IEEE Std 802.1Q-2014.

PR:	255557
Submitted by:	Jose Luis Duran <jlduran@gmail.com>
MFC after:	1 week
2021-05-03 14:38:52 +03:00
Lutz Donnerhacke
bf7cc0f9cb sbin/ipfw: Fix null pointer deference when printing counters
ipfw -[tT] prints statistics of the last access. If the rule was never
used, the counter might be not exist.  This happens unconditionally on
inserting a new rule.  Avoid printing statistics in this case.

PR:	255491
Reported by:	Haisheng Zhouz
Reviewed by:	ae
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D30046
2021-05-02 21:28:46 +02:00
Andrew Turner
f1957db43d Fix building sysctl(8) after c78ad20
In sysctl we parse an efi header on amd64. Fix this after changing the
virtual memory type from a void * to a uint64_t in c78ad20.
2021-05-01 11:10:03 +00:00
Kristof Provost
d5b08e13dd pfctl: Revert "pfctl: Another set skip <group> fix"
This reverts commit 0c156a3c32.
This fix broke using '<ifgroup>:network' in tables.

MFC after:	1 week
2021-04-27 09:05:14 +02:00
Kirk McKusick
689724cb23 Clean up fsck_ffs error message output.
When fsck_ffs is creating a lost+found directory it must allocate
an inode and a filesystem block. If it encounters a cylinder group
with a bad check hash, it complains twice: once for the inode and
again for the filesystem block.

This change suppresses the second complaint.

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    1 week
Sponsored by: Netflix
2021-04-26 18:43:51 -07:00
Kirk McKusick
84a0e3f957 Make fsck_ffs more persistent in creating a lost+found directory.
When fsck_ffs is running in interactive mode and finds unlinked files,
it offers to either unlink them or place them in a lost+found directory.
If the lost+found directory option is requested and no lost+found
directory exists, fsck_ffs offers to create one. When creating one,
it must allocate an inode and a filesystem block. It attempts to
allocate them from the first cylinder group. If the first cylinder
group has a bad check hash, it gives up.

This change expands the search into later cylinder groups when the
first one fails with a bad check hash.

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    1 week
Sponsored by: Netflix
2021-04-26 16:48:30 -07:00
Kristof Provost
5f5bf88949 pfsync: Expose PFSYNCF_OK flag to userspace
Add 'syncok' field to ifconfig's pfsync interface output. This allows
userspace to figure out when pfsync has completed the initial bulk
import.

Reviewed by:	donner
MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29948
2021-04-26 14:31:17 +02:00
Kristof Provost
6fcc8e042a pf: Allow multiple labels to be set on a rule
Allow up to 5 labels to be set on each rule.
This offers more flexibility in using labels. For example, it replaces
the customer 'schedule' keyword used by pfSense to terminate states
according to a schedule.

Reviewed by:	glebius
MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29936
2021-04-26 14:14:21 +02:00
Kristof Provost
42ec75f83a pf: Optionally attempt to preserve rule counter values across ruleset updates
Usually rule counters are reset to zero on every update of the ruleset.
With keepcounters set pf will attempt to find matching rules between old
and new rulesets and preserve the rule counters.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29780
2021-04-19 14:31:47 +02:00
Mateusz Piotrowski
5b9b65e92f Explain the newfs naming convention
It might be unclear why newfs and newfs_msdos should cross-reference
each other. Add a note explaining it.

This is a follow-up to 74bd207697.

Reported by:	kib
Reviewed by:    imp, kib, rpokala
MFC after:	3 days
2021-04-17 23:16:17 +02:00
Ryan Moeller
407fb44c92 ifconfig: Reuse media state in ifmedia_getstate
This restores behavior lost in code cleanup, fixing a regression after
2803fa471e where changing media options
only applies some of the changes, not all.

Reported by:	np
Reviewed by:	donner
MFC after:	immediately
Differential Revision:	https://reviews.freebsd.org/D29741
2021-04-15 22:32:25 -04:00
Kristof Provost
4eabfe468b pfctl: Fix clearing rules counters
After the migration to libpfctl for rule retrieval we accidentally lost
support for clearing the rules counters.

Introduce a get_clear variant of pfctl_get_rule() which allows rules
counters to be cleared.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29727
2021-04-14 13:33:02 +02:00
Kurosawa Takahiro
2aa21096c7 pf: Implement the NAT source port selection of MAP-E Customer Edge
MAP-E (RFC 7597) requires special care for selecting source ports
in NAT operation on the Customer Edge because a part of bits of the port
numbers are used by the Border Relay to distinguish another side of the
IPv4-over-IPv6 tunnel.

PR:		254577
Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D29468
2021-04-13 10:53:18 +02:00
Gordon Bergling
bc54f5f1cd route(8): Add an example how to print the routing tables
The manual page currently doesn't show an example how to print
the routing table, so add one and .Xr netstat while here.

PR:		231579
Reported by:	Pekka Järvinen <pekka dot jarvinen at gmail dot com>
Reviewed by:	debdrup
MFC after:	5 days
Differential Revision:	https://reviews.freebsd.org/D29702
2021-04-13 06:45:22 +02:00
Kurosawa Takahiro
600bd6ce06 pfctl, libpfctl: introduce pfctl_pool
Introduce pfctl_pool to be able to extend the pool part of the pf rule
without breaking the ABI.

Reviewed by:	kp
MFC after:	4 weeks
Differential Revision:	https://reviews.freebsd.org/D29721
2021-04-12 18:30:29 +02:00
Kristof Provost
ab5707a5cf libpfctl: Fix u_* counters
struct pf_rule had a few counter_u64_t counters. Those couldn't be
usefully comminicated with userspace, so the fields were doubled up in
uint64_t u_* versions.

Now that we use struct pfctl_rule (i.e. a fully userspace version) we
can safely change the structure and remove this wart.

Reviewed by:	glebius
MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29645
2021-04-10 11:16:03 +02:00
Kristof Provost
e9eb09414a libpfctl: Switch to pfctl_rule
Stop using the kernel's struct pf_rule, switch to libpfctl's pfctl_rule.
Now that we use nvlists to communicate with the kernel these structures
can be fully decoupled.

Reviewed by:	glebius
MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29644
2021-04-10 11:16:02 +02:00
Kristof Provost
a9b338b260 pf: Move prototypes for userspace functions to userspace header
These functions no longer exist in the kernel, so there's no reason to
keep the prototypes in a kernel header. Move them to pfctl where they're
actually implemented.

Reviewed by:	glebius
MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29643
2021-04-10 11:16:02 +02:00
Kristof Provost
0d71f9f36e pfctl: Move ioctl abstraction functions into libpfctl
Introduce a library to wrap the pf ioctl interface.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29562
2021-04-10 11:16:02 +02:00
Kristof Provost
0d6c8174ef pfctl: Use the new DIOCGETRULENV ioctl
Create wrapper functions to handle the parsing of the nvlist and move
that code into pfctl_ioctl.c.
At some point this should be moved into a libpfctl.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29560
2021-04-10 11:16:01 +02:00
Kristof Provost
5c11c5a365 pfctl: Move to DIOCADDRULENV
Start using the new nvlist based ioctl to add rules.

MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D29558
2021-04-10 11:16:01 +02:00
Edward Tomasz Napierala
28b475b018 Cross-reference camcontrol(8) and zonectl(8) man pages. 2021-04-10 10:13:29 +01:00
Roman Bogorodskiy
066a576c5f ipfw: update man page example for nat show log
In d6164b77f8 the ability to show
ranges of nat log entries was removed.

PR:	254192
Reviewed by:	allanjude
2021-04-07 15:37:46 +00:00
John-Mark Gurney
b8028f9d3c add Xr to the rc.d script... 2021-04-06 16:32:57 -07:00
Ed Maste
a64096aa63 ffsinfo: Update example to avoid to-be-deprecated vinum
Reviewed by:	mckusick
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D29478
2021-04-03 16:29:14 -04:00
Kirk McKusick
fc56fd262d Ensure that all allocated data structures in fsck_ffs are freed.
Several large data structures are allocated by fsck_ffs to track
resource usage. Most but not all were deallocated at the end of
checking each filesystem. This commit consolidates the freeing
of all data structures in one place and adds one that had previously
been missing.

It is important to clean up these data structures as they can be
large. If the previous allocations have not been freed, fsck_ffs
can run out of address space when many large filesystems are being
checked. An alternative would be to fork a new instance of fsck_ffs
for each filesystem to be checked, but we choose to free the small
set of large structures to save the fork overhead.

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    7 days
Sponsored by: Netflix
2021-04-02 11:58:49 -07:00
Ed Maste
b218441ac0 gvinum: add deprecation notice
Vinum is a Logical Volume Manager that was introduced in FreeBSD 3.0,
and for FreeBSD 5 was ported to geom(4) as gvinum. gvinum has had no
specific development at least as far back as 2010, and has a number of
known bugs which are unlikely to be resolved.

Add a deprecation notice to raise awareness but state that vinum "may
not be" available in FreeBSD 14.  Either it will be removed and the
notice will be updated to "is not" available, or someone will step up
to fix issues and maintain it and we will remove the notice.

Reviewed by:	imp (earlier version)
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D29424
2021-03-28 14:45:05 -04:00
Kirk McKusick
7848b25edd Fix fsck_ffs -R finds unfixed duplicate block errors when rerunning.
This fixes a long-standing but very obscure bug in fsck_ffs when
it is run with the -R (rerun after unexpected errors).  It only
occurs if fsck_ffs finds duplicate blocks and they are all contained
in inodes that reside in the first block of inodes (typically among
the first 128 inodes).

Rather than use the usual ginode() interface to walk through the
inodes in pass1, there is a special optimized `getnextinode()'
routine for walking through all the inodes. It has its own private
buffer for reading the inode blocks. If pass 1 finds duplicate
blocks it runs pass 1b to find all the inodes that contain these
duplicate blocks. Pass 1b also uses the `getnextinode()' to search
for the inodes with duplicate blocks. Pass 1b stops when all the
duplicate blocks have been found. If all the duplicate blocks are
found in the first block of inodes, then the getnextinode cache
holds this block of bad inodes. The subsequent cleanup of the inodes
in passes 2-5 is done using ginode() which uses the regular fsck_ffs
cache.

When fsck_ffs restarts, pass1() calls setinodebuf() to point at the
first block of inodes. When it calls getnextinode() to get inode
2, getnextino() sees that its private cache already has the first
set of inodes loaded and starts using them. They are of course the
trashed inodes left over from the previous run of pass1b().

The fix is to always invalidate the getnextinode cache when calling
setinodebuf().

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    3 days
Sponsored by: Netflix
2021-03-24 17:24:41 -07:00
Kirk McKusick
bc444e2ec6 Fix fsck_ffs Pass 1b error exit "bad inode number 2 to nextinode".
Pass 1b of fsck_ffs runs only when Pass 1 has found duplicate blocks.
When starting up, Pass 1b failed to properly skip over the two unused
inodes at the beginning of the filesystem resulting in the above error
message when it tried to read the filesystem root inode.

Reported by:  Chuck Silvers
Tested by:    Chuck Silvers
MFC after:    3 days
Sponsored by: Netflix
2021-03-24 16:53:28 -07:00
Bjoern A. Zeeb
5ba4c8de15 ifconfig: 80211, add line break after key info
Beauty correction for verbose mode or in case we print multiple key
information to not continue with the next options directly after
as we did so far, e.g.:
	AES-CCM 2:128-bit
	AES-CCM 3:128-bit powersavemode ...

Sponsored-by:	The FreeBSD Foundation
MFC-after:	2 weeks
Reviewed-by:	adrian
Differential Revision:	https://reviews.freebsd.org/D29393
2021-03-24 22:26:39 +00:00