83 Commits

Author SHA1 Message Date
csjp
4796f5064e MFC the firewall labeling changes.
This fixes kernel panics which occur when the firewall sends out a packet.
This can happen for keep alives, or instances when the firewall is
configured to return RST or ICMP unreach packets. These panics occured
only if MLS, BIBA or LOMAC security policies were loaded.

Approved by:	re@ (kensmith)
Submitted by:	mlaier (with changes)
2006-09-19 15:45:22 +00:00
mlaier
b04f4baadd MFC: pf_ioctl.c, 1.26
Fix stateful filtering of loopback IPv6 traffic to an address not
  configured on lo0.  While here fix a comment.

  PR:		kern/102647
  Reported by:	Frank Steinborn
  Submitted by:	suz (earlier version)
2006-09-09 00:50:25 +00:00
glebius
16edd18a0e MFC rev. 1.27:
Fix byteorder of syncpeer and make it actually work.

  Submitted by:   glebius
2006-08-10 13:45:59 +00:00
mlaier
7db313238f MFC, pf_ioctl.c, 1.25:
Import from OpenBSD 1.168, dhartmei:
    fix a bug in the input sanity check of DIOCCHANGERULE (not used by
    pfctl, but third-party tools). a rule must have a non-empty replacement
    address list when it's a translation rule but not an anchor call (i.e.
    "nat ... ->" needs a replacement address, but "nat-anchor ..." doesn't).
    the check confused "rule is an anchor call" with "rule is defined within
    an anchor".  report from Michal Mertl, Max Laier.
2006-08-07 15:22:53 +00:00
mlaier
93baff0064 MFC pf_norm.c rev. 1.17:
Loopback pf_norm.c rev. 1.106 from OpenBSD:
      fixup IP checksum when modifying IP header fields

  PR:			kern/93849
  Obtained from:	OpenBSD

Approved by:	re (kensmith)
2006-03-28 15:06:03 +00:00
yar
b481a27976 MFC rev. 1.8:
Avoid pulling in the whole <net/pfvar.h> by opaquely declaring
the structs pflog_packet() takes pointers to.

Approved by:	re (scottl)
2006-03-22 15:18:04 +00:00
mlaier
b439464437 MFC:
Make pflog a seperate module.  As a result pflog_packet() becomes a
  function pointer that is declared in pf_ioctl.c

  Requested by:   yar (as part of the module build reorg)

Approved by:	re (scottl)
2006-03-06 16:10:19 +00:00
cperciva
5648502507 Make sure buffers in if_bridge are fully initialized before copying
them to userland. [1]

MFC rev. 1.16 of sys/contrib/pf/net/pf_norm.c: Correct an error in pf
handling of IP packet fragments which could result in a kernel panic.
[2]

Security:	FreeBSD-SA-06:06.kmem [1]
Security:	FreeBSD-SA-06:07.pf [2]
2006-01-25 10:00:59 +00:00
mlaier
f6a52266ef MFC: pf_norm.c, 1.15:
Move m_adj after checking that m_dup succeeded.

    Found with:	Coverity Prevent(tm)
2006-01-17 13:05:32 +00:00
mlaier
1937d32dc3 MFC: pf.c 1.39+1.40 and pfvar.h 1.13+1.14
Move PFSTATE_EXPIRING from sync_flags to a new local_flags.  sync_flags
  has special handling when zero.  This caused no PFSYNC_ACT_DEL message and
  thus disfunction of pfflowd and state synchronisation in general.

  Discovered by:  thompsa
  Good catch by:  thompsa

and

  Only decrement the max-src-conn counter for tcp connections that reached
  "established" state.

  Similar to OpenBSD's rev. 1.499 by joel but not breaking ABI.

  Obtained from:  OpenBSD (with changes)
  Reported by:    Bruno Afonso

ok reyk@
2005-12-30 00:50:18 +00:00
ume
af6b9d9bdc MFC: move RFC3542 related definitions into ip6.h.
sys/contrib/pf/net/pf_norm.c:	1.12
	sys/netinet/ip6.h:		1.15

Approved by:    re (scottl)
Committed at:   CBUG Meeting meets XCAST6 Festival
2005-10-09 05:50:43 +00:00
mlaier
2280df04e8 MFC: if_pfsync.c, 1.23:
Stop leaking a lock.  This used to cause a propagate_priority() page fault
  when setting syncdev and syncpeer.

  Reported by:    Dominic Marks

Approved by:	re (scottl)
2005-09-17 15:19:38 +00:00
mlaier
48d8794b82 Commit imported changes to RELENG_6:
pf_ioctl.c Revision 1.153 Sun Aug 7 11:37:33 2005 UTC by dhartmei
 | verify ticket in DIOCADDADDR, from Boris Polevoy, ok deraadt@

 pf_ioctl.c Revision 1.158 Mon Sep 5 14:51:08 2005 UTC by dhartmei
 | in DIOCCHANGERULE, properly initialize table, if used in NAT rule.
 | from Boris Polevoy <vapcom at mail dot ru>, ok mcbride@

 pf.c Revision 1.502 Mon Aug 22 11:54:25 2005 UTC by dhartmei
 | when nat'ing icmp 'connections', replace icmp id with proxy values
 | (similar to proxy ports for tcp/udp). not all clients use
 | per-invokation random ids, this allows multiple concurrent
 | connections from such clients.
 | thanks for testing to Rod Whitworth, "looks ok" markus@

 pf.c Revision 1.501 Mon Aug 22 09:48:05 2005 UTC by dhartmei
 | fix rdr to bitmask replacement address pool. patch from Max Laier,
 | reported by Boris Polevoy, tested by Jean Debogue, ok henning@

Approved by:	re (scottl)
2005-09-12 11:25:17 +00:00
rwatson
e13b2df854 Merge linux_ioctl.c:1.128 svr4_sockio.c:1.17 altq_cbq.c:1.3 if_oltr.c:1.38
if_pflog.c:1.14 if_pfsync.c:1.21 if_an.c:1.70 if_ar.c:1.72 if_arl.c:1.11
amrr.c:1.10 onoe.c:1.10 if_ath.c:1.101 awi.c:1.41 if_bfe.c:1.27
if_bge.c:1.93 if_cm_isa.c:1.7 smc90cx6.c:1.16 if_cnw.c:1.20 if_cp.c:1.25
if_cs.c:1.42 if_ct.c:1.26 if_cx.c:1.46 if_ed.c:1.256 if_em.c:1.68
if_en_pci.c:1.37 midway.c:1.66 if_ep.c:1.143 if_ex.c:1.58 if_fatm.c:1.20
if_fe.c:1.93 if_fwe.c:1.38 if_fwip.c:1.8 if_fxp.c:1.244 if_gem.c:1.33
if_hatm.c:1.25 if_hatm_intr.c:1.20 if_hatm_ioctl.c:1.13 if_hatm_rx.c:1.10
if_hatm_tx.c:1.14 if_hme.c:1.39 if_ie.c:1.104 if_ndis.c:1.101
if_ic.c:1.24 if_ipw.c:1.10 if_iwi.c:1.10 if_ixgb.c:1.13 if_lge.c:1.41
if_lnc.c:1.113 if_my.c:1.31 if_nge.c:1.77 if_nve.c:1.10 if_owi.c:1.12
if_patm.c:1.9 if_patm_intr.c:1.6 if_patm_ioctl.c:1.10 if_patm_tx.c:1.10
pdq_ifsubr.c:1.28 if_plip.c:1.38 if_ral.c:1.12 if_ral_pci.c:1.2
if_ray.c:1.81 if_rayvar.h:1.22 if_re.c:1.49 if_sbni.c:1.21 if_sbsh.c:1.14
if_sn.c:1.48 dp83932.c:1.21 if_snc_pccard.c:1.9 if_sr.c:1.70 if_tx.c:1.91
if_txp.c:1.33 if_aue.c:1.92 if_axe.c:1.32 if_cdce.c:1.8 if_cue.c:1.59
if_kue.c:1.66 if_rue.c:1.23 if_udav.c:1.16 if_ural.c:1.12 if_vge.c:1.16
if_vx.c:1.58 if_wi.c:1.185 if_wi_pci.c:1.26 if_wl.c:1.68 if_xe.c:1.60
if_xe_pccard.c:1.30 if_el.c:1.68 i4b_ipr.c:1.35 i4b_isppp.c:1.31
kern_poll.c:1.20 bridge.c:1.94 bridgestp.c:1.4 if_arcsubr.c:1.27
if_atm.h:1.24 if_atmsubr.c:1.40 if_bridge.c:1.16 if_ef.c:1.35
if_ethersubr.c:1.196 if_faith.c:1.37 if_fddisubr.c:1.100 if_fwsubr.c:1.14
if_gif.c:1.54 if_gre.c:1.34 if_iso88025subr.c:1.70 if_loop.c:1.107
if_ppp.c:1.106 if_spppsubr.c:1.121 if_tap.c:1.57 if_tun.c:1.154
if_vlan.c:1.80 ppp_tty.c:1.67 ieee80211_ioctl.c:1.32 atm_if.c:1.31
ng_eiface.c:1.33 ng_ether.c:1.50 ng_fec.c:1.19 ng_iface.c:1.44
ng_sppp.c:1.9 ip_carp.c:1.30 ip_fastfwd.c:1.30 in6.c:1.53 nd6_nbr.c:1.31
natm.c:1.40 if_dc.c:1.162 if_de.c:1.168 if_pcn.c:1.72 if_rl.c:1.154
if_sf.c:1.84 if_sis.c:1.135 if_sk.c:1.108 if_ste.c:1.86 if_ti.c:1.109
if_tl.c:1.101 if_vr.c:1.106 if_wb.c:1.81 if_xl.c:1.194 from HEAD to
RELENG_6:

  Propagate rename of IFF_OACTIVE and IFF_RUNNING to IFF_DRV_OACTIVE and
  IFF_DRV_RUNNING, as well as the move from ifnet.if_flags to
  ifnet.if_drv_flags.  Device drivers are now responsible for
  synchronizing access to these flags, as they are in if_drv_flags.  This
  helps prevent races between the network stack and device driver in
  maintaining the interface flags field.

  Many __FreeBSD__ and __FreeBSD_version checks maintained and continued;
  some less so.

  Reviewed by:    pjd, bz

Approved by:	re (scottl)
2005-08-25 05:01:24 +00:00
mlaier
608ea247b8 MFC: pf.c, 1.35 pfvar.h, 1.12
Prevent a race condition.  As pf_send_tcp() - called for expired synproxy
  states - has to drop the lock when calling back to ip_output(), the state
  purge timeout might run and gc the state. This results in a rb-tree
  inconsistency.  With this change we flag expiring states while holding the
  lock and back off if the flag is already set.

  Reported by:	glebius

Approved by:	re (kensmith)
2005-08-06 01:52:35 +00:00
mlaier
e678c5edd8 MFC: if_pfsync.c, 1.20 in_proto.c, 1.78
Export pfsyncstats via sysctl "net.inet.pfsync" in order to print them
  with netstat (seperate commit).

  Requested by:   glebius

Approved by:	re (kensmith)
2005-07-23 17:02:10 +00:00
mlaier
79ac1f3888 Properly initialize ifq_maxlen for the defered send queue and make it
actually work.  Also use the right semantics for IF_HANDOFF to get correct
stats.

Reported and tested by:	Sascha Luck <sascha at c4inet dot net>
Approved by:		re (blanket)
2005-06-26 21:00:52 +00:00
mlaier
e15084485c Mark pf callouts as NET_MPSAFE.
Requested by:	yongari (serveral times)
Approved by:	re (blanket)
MFC after:	1 week
2005-06-12 16:46:20 +00:00
mlaier
2f60aac277 Defer ip_output of pfsync updates to an independent callout thread instead
of just dropping the lock around the ip_output call.  This used to cause
corrupted state tree walks for some call-paths.

In a second stage all callouts will be marked MPSAFE according to the
setting of mpsafenet.

Reported and tested by:	Matthew Grooms <mgrooms at seton dot org>
MFC after:		3 days
X-MFC after:		Marking callouts MPSAFE + 1 week
2005-06-10 17:23:49 +00:00
brooks
567ba9b00a Stop embedding struct ifnet at the top of driver softcs. Instead the
struct ifnet or the layer 2 common structure it was embedded in have
been replaced with a struct ifnet pointer to be filled by a call to the
new function, if_alloc(). The layer 2 common structure is also allocated
via if_alloc() based on the interface type. It is hung off the new
struct ifnet member, if_l2com.

This change removes the size of these structures from the kernel ABI and
will allow us to better manage them as interfaces come and go.

Other changes of note:
 - Struct arpcom is no longer referenced in normal interface code.
   Instead the Ethernet address is accessed via the IFP2ENADDR() macro.
   To enforce this ac_enaddr has been renamed to _ac_enaddr.
 - The second argument to ether_ifattach is now always the mac address
   from driver private storage rather than sometimes being ac_enaddr.

Reviewed by:	sobomax, sam
2005-06-10 16:49:24 +00:00
mlaier
896129e0f9 if_mtu not ifp_mtu. 2005-05-04 19:51:06 +00:00
mlaier
eba8487d85 Bring back fix from rev. 1.28 which was lost during the import. 2005-05-04 16:03:01 +00:00
mlaier
587ccf7938 Combine rev. 1.29 and 1.30 to something that will make sense for future
imports.
2005-05-04 15:55:29 +00:00
mlaier
2383ca5b3c Make LINT happy. 2005-05-04 15:29:28 +00:00
andre
e6d10efc2a Pass icmp_error() the MTU argument directly instead of
an interface pointer.  This simplifies a couple of uses
and removes some XXX workarounds.
2005-05-04 13:09:19 +00:00
mlaier
b14e72073d Resolve conflicts created during the import of pf 3.7 Some features are
missing and will be implemented in a second step.  This is functional as is.

Tested by:	freebsd-pf, pfsense.org
Obtained from:	OpenBSD
X-MFC after:	never (breaks API/ABI)
2005-05-03 16:43:32 +00:00
glebius
1268b440dc Fix error in synproxy connection completion. Source and
destination windows were confused, one instead of other.
This error was masked, because first segment of just
established connection is usually smaller than initially
announced window, and it was successfully passed. First
window reannouncement corrected erroneous 'seqhi' value.
The error showed up when client connected to synproxy
with zero initial window, and reannounced it after
session establishment.

In collaboration with:	dhartmei [we came to same patch independtly]
Reviewed by:		mlaier
Sponsored by:		Rambler
MFC after:		3 days
2005-04-22 09:53:46 +00:00
glebius
70458efe87 Fix mss byte order, only affects synproxy code path.
Submitted by:	John L. Scarfone via OpenBSD
Reviewed by:	mlaier
Obtained from:	OpenBSD, rev. 1.483
MFC after:	2 days
2005-04-13 21:05:55 +00:00
mlaier
1ad7875704 Fix a terrible braino in pfi_maybe_destroy() and unbreak "$pfctl -Fall" with
renamed interfaces.

PR:		kern/77645
Reported by:	Harald Schmalzbauer <harryNOschmalzbauerSPAMde>
Reviewed by:	yongari
MFC after:	3 days
2005-02-21 17:20:00 +00:00
yongari
13ffa2fe13 Fix inteface clear time. pf printed "Thu Jan 1 09:00:01 1970"
in "pfctl -vvsI" output when pf was statically linked to kernel.

Discussed with:	mlaier
2005-02-17 03:36:31 +00:00
mlaier
d43f99469a Access softc embedded struct ifnet via function macro to make it easier to
untangle struct ifnet and softc/arpcom in the future.

Requested by:	brooks
2005-02-09 19:29:13 +00:00
dhartmei
77598c300e Use the packet's address family instead of the rule's when selecting a
replacement address for an rdr rule. Some rdr rules have no address family
(when the replacement is a table and no other criterion implies one AF).
In this case, pf would fail to select a replacement address and drop the
packet due to translation failure.

Found by:	Gustavo A. Baratto
2005-01-20 18:07:35 +00:00
dhartmei
82659e8246 Prohibit ruleset changes at securelevel > 2, not > 1. It's documented
like this in init(8), but the code didn't match the documentation.

Submitted by:	Juraj Lutter <otis at sk dot FreeBSD dot org>
Agrees:		mlaier
2005-01-19 21:37:00 +00:00
dhartmei
b61c49cccc Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,
prevents a possible endless loop in pf_get_sport() with 'static-port'

ICMP state entries use the ICMP ID as port for the unique state key. When
checking for a usable key, construct the key in the same way. Otherwise,
a colliding key might be missed or a state insertion might be refused even
though it could be inserted. The second case triggers the endless loop,
possibly allowing a NATed LAN client to lock up the kernel.

PR:			kern/74930
Reported and tested by:	Hugo Silva, Srebrenko Sehic
MFC after:		3 days
2004-12-19 19:43:04 +00:00
mlaier
5a1a81dd99 Compile pfsync w/o bpf.
Noticed by:	"Jayel Villamin" <jarthel operamail com>
2004-12-10 17:42:47 +00:00
dhartmei
de7cd2f92a IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing
the header chain. In the case where headers are skipped, the protocol
checksum verification used the wrong length (included the skipped headers),
leading to incorrectly mismatching checksums. Such IPv6 packets with
headers were silently dropped.

Discovered by:	Bernhard Schmidt
MFC after:	1 week
2004-12-05 12:15:43 +00:00
dhartmei
f808618fbd fix a bug that leads to a crash when binat rules of the form
'binat from ... to ... -> (if)' are used, where the interface
is dynamic.

Discovered by:	kos(at)bastard(dot)net
Analyzed by:	Pyun YongHyeon
Approved by:	mlaier (mentor)
MFC after:	1 week
2004-11-24 00:43:34 +00:00
ru
f4dd946343 Removed the remnants of gx(4). 2004-11-08 20:24:52 +00:00
mlaier
829a2496de Improved interface handling. This should fix the use of renamed interfaces
(ifconfig xl0 name foo) as well as some special interfaces such as the 6to4
tunnel.

Reported by:	Ed Schouten <ed (at) il ! fontys , nl>
Tested by:	freebsd-pf
PR:		kern/72444
MFC after:	3 weeks
2004-11-03 17:21:12 +00:00
mlaier
a18af33877 Fix a panic discovered with some apache2 configure test (that seemed to
trigger a socket creation race some some kind). Checking for non-NULL socket
and credential is not a bad idea anyway. Unfortunatly too late for the
release.

Reported & tested by:	Gilbert Cao
MFC after:		2 weeks
2004-10-24 19:35:02 +00:00
mlaier
b65eae4c19 Add an additional struct inpcb * argument to pfil(9) in order to enable
passing along socket information. This is required to work around a LOR with
the socket code which results in an easy reproducible hard lockup with
debug.mpsafenet=1. This commit does *not* fix the LOR, but enables us to do
so later. The missing piece is to turn the filter locking into a leaf lock
and will follow in a seperate (later) commit.

This will hopefully be MT5'ed in order to fix the problem for RELENG_5 in
forseeable future.

Suggested by:		rwatson
A lot of work by:	csjp (he'd be even more helpful w/o mentor-reviews ;)
Reviewed by:		rwatson, csjp
Tested by:		-pf, -ipfw, LINT, csjp and myself
MFC after:		3 days

LOR IDs:		14 - 17 (not fixed yet)
2004-09-29 04:54:33 +00:00
mlaier
83e80bafba Protect sockaddr_union definitions with a protecting define. This allows to
build kernels with FAST_IPSEC and PF. This is the least disruptive fix.

PR:		kern/71836
Reviewed by:	bms, various mailing lists
MFC after:	3 days
2004-09-23 12:44:40 +00:00
mlaier
69a40e03c1 Break out altq_enable/disable from DIOC{START,STOP}ALTQ into seprate
functions that can be called from enable/disable pf as well. This improves
switching from non-altq ruleset to altq ruleset (and the other way 'round)
by a great deal and makes pfctl act like the user would except it to.

PR:		kern/71746
Tested by:	Aurilien "beorn" Rougemont (PR submitter)
MFC after:	3 days
2004-09-17 02:15:05 +00:00
mlaier
23fe0c08ee Reactivate skipping over bogus IPCP addresses on ppp interfaces. Be more
careful with the skip condition this time. Addresses are only not taken into
account if:
	- The interface is POINTTOPOINT
	- There is no route installed for the address
	- The user specified noalias (:0)
and	- We are looking at an IPv4 address.

This should be enough paranoia to not cause any false positives.

PR:	 	misc/69954
Discussed with:	yongari
MFC after:	4 days
2004-09-14 15:20:24 +00:00
mlaier
de866b234b Move pf* init from SI_SUB_PSEUDO to SI_SUB_PROTO_IFATTACHDOMAIN where it is
save to call if_attachdomain from if_attach() (as done for if_loop.c). We
will now end up with a properly initialized if_afdata array and the nd6
callout will no longer try to deref a NULL pointer.

Still this is a temp workaround and the locking for if_afdata should be
revisited at a later point.

Requested by:			rwatson
Discussed with and tested by:	yongari (a while ago)
PR:				kern/70393
MFC after:			5 days
2004-09-14 03:12:01 +00:00
mlaier
431ad26757 One more round on the H/W supported checksum code: Fix NICs that can't do
the pseudo header. We really need the TCP packet length here. This happens
to end up in ip->ip_len in tcp_input.c, but here we should get it from the
len function variable instead.

Submitted by:	yongari
Tested by:	Nicolas Linard, yongari (sparc64 + hme)
MFC after:	5 days
2004-09-11 11:18:25 +00:00
mlaier
9c209cbf17 Use securelevel_gt instead of reading global securelevel unprotected.
Submitted by:	yongari
MFC after:	3 days
2004-08-22 15:23:48 +00:00
mlaier
c6cd25836d Comment out rev. 1.4 after problems w/ IPv6, a better solution must be
found.
2004-08-16 17:58:12 +00:00
dwmalone
5df13d37b2 Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSD
have already done this, so I have styled the patch on their work:

        1) introduce a ip_newid() static inline function that checks
        the sysctl and then decides if it should return a sequential
        or random IP ID.

        2) named the sysctl net.inet.ip.random_id

        3) IPv6 flow IDs and fragment IDs are now always random.
        Flow IDs and frag IDs are significantly less common in the
        IPv6 world (ie. rarely generated per-packet), so there should
        be smaller performance concerns.

The sysctl defaults to 0 (sequential IP IDs).

Reviewed by:	andre, silby, mlaier, ume
Based on:	NetBSD
MFC after:	2 months
2004-08-14 15:32:40 +00:00
mlaier
939573c38d Loopback fix from Mathieu Sauve-Frankel:
Add missing check for NULL in DIOCCHANGERULE. This prevents a crash
	in certain rare cases.
2004-08-12 14:15:42 +00:00