Commit Graph

223 Commits

Author SHA1 Message Date
piso
dc27114478 What's the point of adjusting a checksum if we are going to toss the
packet? Anticipate the check/return code.
2009-04-11 15:26:31 +00:00
piso
a36990c3db Plug two bugs introduced with modules conversion:
-UdpAliasIn(): correctly check return code after modules ran.
-alias_nbt: in case of malformed packets (or some other unrecoverable
 error), toss the packet.
2009-04-11 15:19:09 +00:00
piso
e605b01ef4 Remove stale comments. 2009-04-11 15:05:19 +00:00
piso
5551ee2e3d -don't pass down, to module's fingerprint function, unused data like
a pointer to the ip header.
-style
-spacing
2009-04-08 11:56:49 +00:00
rrs
d22f1350d2 This commit fixes the issue with alias_sctp.c. No
longer do we require SCTP to be in the kernel for the
lib to be able to handle SCTP. We do this by moving
the CRC32c checksum into libkern/crc32.c and then adjusting
all routines to use the common methods. Note that this
will improve the performance of iSCSI since they were
using the old single 256 bit table lookup versus the
slicing 8 algorithm (which gives a 4x speed up in
CRC32c calculation :-D)

Reviewed by:rwatson, gnn, scottl, paolo
MFC after:	4 week? (assuming we MFC the alias_sctp changes)
2009-02-14 11:34:57 +00:00
piso
d34fad2923 Add SCTP NAT support.
Submitted by: CAIA (http://caia.swin.edu.au)
2009-02-07 18:49:42 +00:00
piso
a5f2b191e0 Silent userland warnings about missing prototypes.
Submitted by:	Roman Divacky <rdivacky@freebsd.org>
2009-01-15 19:35:23 +00:00
piso
8af3d78dd2 Import sctp nat support in ipfw obtained from CAIA - http://caia.swin.edu.au. 2008-12-28 17:16:32 +00:00
zec
7b573d1496 Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.

Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out.  Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.

Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively

#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif

Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.

Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs.  This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.

Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.

De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps.  PF virtualization will be done
separately, most probably after next PF import.

Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw.  Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.

Discussed at:	devsummit Strassburg
Reviewed by:	bz, julian
Approved by:	julian (mentor)
Obtained from:	//depot/projects/vimage-commit2/...
X-MFC after:	never
Sponsored by:	NLnet Foundation, The FreeBSD Foundation
2008-12-10 23:12:39 +00:00
csjp
4d406f1257 Improve the entropy of the source port randomization for network address
translation.  It turns out this is useful for applications which require
source port randomization for security (i.e. dns servers).

Discussed with:	secteam
Requested by:	mlaier
MFC after:	2 weeks
2008-08-30 20:58:34 +00:00
mav
4537f7afad Partially revert previous commit. DeleteLink() does not deletes permanent
links so we should be aware of it and try to delete every link only once
or we will loop forever.
2008-06-22 11:39:42 +00:00
mav
dd48ea213d Implement UDP transparent proxy support.
PR:		bin/54274
Submitted by:	Nicolai Petri <nicolai@petri.cc>
2008-06-21 20:18:57 +00:00
mav
d3bd62e805 Add support for PORT/EPRT FTP commands in lowercase.
Use strncasecmp() instead of huge local implementation to reduce code size.
Check space presence after command/code.

PR:		kern/73034
2008-06-21 16:22:56 +00:00
mav
9b1d66c627 Increase LINK_TABLE_OUT_SIZE from 101 to 4001 like LINK_TABLE_IN_SIZE
to reduce performance degradation under heavy outgoing scan/flood.
Scalability is now much more important then several kilobytes of RAM.

Remove unneded TCP-specific expiration handeling. Before this connected
TCP sessions could never expire. Now connected TCP sessions will expire
after 24hours of inactivity.

Simplify HouseKeeping() to avoid several mul/div-s per packet. Taking into
account increased LINK_TABLE_OUT_SIZE, precision is still much more then
required.
2008-06-01 18:34:58 +00:00
mav
4dbba50d9d Make m_megapullup() more intelligent:
- to increase performance do not reallocate mbuf when possible,
 - to support up to 16K packets (was 2K max) use mbuf cluster of proper size.
This change depends on recent ng_nat and ip_fw_nat changes.
2008-06-01 17:52:40 +00:00
mav
f9451aca1b Fix packet fragmentation support broken by copy/paste error in rev.1.60.
ip_id should be u_short, but not u_char.
2008-06-01 11:47:04 +00:00
marck
c683ca0c36 Fix build, together with a bit of style breakage. 2008-05-02 18:54:36 +00:00
piso
c487d69141 Explicitate the newpacket size.
Bug pointed out by: many
Pointy hat to: me :(
2008-03-19 11:28:13 +00:00
piso
10c89ab0d1 Don't abuse stack space while in kernel land, use heap instead. 2008-03-17 22:08:31 +00:00
piso
0c792dea70 -Don't pass down the entire pkt to ProtoAliasIn, ProtoAliasOut, FragmentIn
and FragmentOut.
-Axe the old PacketAlias API: it has been deprecated since 5.x.
2008-03-12 11:58:29 +00:00
piso
5f33f90d24 MFP4:
restrict the utilization of direct pointers to the content of
	ip packet. These modifications are functionally nop()s thus
	can be merged with no side effects.
2008-03-06 21:50:41 +00:00
des
90c2422b90 Simpler version of the previous commit. 2007-12-06 09:31:13 +00:00
jb
0d56ea8bec Fix strict alias warnings. 2007-11-23 23:56:03 +00:00
maxim
9428c924dd o Kill EOLWS while I'm here. 2007-04-30 20:26:11 +00:00
maxim
3f7c014f10 o Fix strtoul() error conditions check.
PR:		kern/108211
Submitted by:	Yong Tang
MFC after:	2 weeks
2007-04-30 20:22:11 +00:00
piso
591e129226 Prevent the usage of an uninitialized variable: do not accept
StartMediaTx message before an OpnRcvChnAck message was received.

Reviewed by:	glebius
Approved by:	glebius (mentor)
MFC after:      3 days
Found with:	Coverity Prevent(tm)
CID:		498
2007-04-07 09:52:36 +00:00
piso
9e43cc8d03 Silence Coverity about an unused variable.
Reviewed by: 	glebius
Approved by: 	glebius (mentor)
MFC after: 	3 days
CID: 		538
2007-04-07 09:47:39 +00:00
kan
ecc1614c2b Include string.h for non-kernel builds to get proper memcpy prototype. 2007-04-04 03:16:59 +00:00
kan
3ee45e3f2e Include string.h for non-kernel builds to get proper strcpy, strlen
prototypes.
2007-04-04 03:14:15 +00:00
kan
8aa4f2f59c Do not assign result of (char *) cast to u_char * variable. 2007-04-04 03:10:42 +00:00
piso
9ddea13291 o made in kernel libalias mpsafe
o fixed a comment
o made in kernel libalias a bit less verbose (disabled automatic
  logging everytime a new link is added or deleted)

Approved by: glebius (mentor)
2006-12-15 12:50:06 +00:00
piso
8e272a902a Make libalias.conf parsing a bit smarter.
This closes PR kern/106112.

While here, add mbuf's #includes i forgot in the previous commit.

Approved by: gleb
2006-12-01 16:34:53 +00:00
piso
e2023fe5e9 Remove m_megapullup from ng_nat and put it under libalias.
Approved by: gleb
2006-12-01 16:27:11 +00:00
marcus
42daf70603 Fix TFTP NAT support by making sure the appropriate fingerprinting checks
are done.

Reviewed by:	piso
2006-11-07 21:06:48 +00:00
ru
da24a0b645 Merge the rest of my changes. 2006-10-11 07:11:56 +00:00
piso
862e1ed026 Various mdoc and grammar fixes.
Approved by: glebius
Reviewed by: glebius, ru
2006-10-08 13:53:45 +00:00
piso
f925eb73aa Compilation. 2006-09-27 02:08:44 +00:00
piso
5582e56d9d Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:

-made libalias modular:

 -support for 'particular' protocols (like ftp/irc/etcetc) is no more
  hardcoded inside libalias, but it's available through external
  modules loadable at runtime

 -modules are available both in kernel (/boot/kernel/alias_*.ko) and
  user land (/lib/libalias_*)

 -protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
  skinny and smedia

-added logging support for kernel side

-cleanup

After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.

During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.

User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.

The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).

General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.

NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.

Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
maxim
3463a7b118 o Kill BUGS section as it is not valid since rev. 1.4 alias_pptp.c.
Spotted by:	ru.unix.bsd activists
MFC after:	1 week
2006-07-04 20:39:38 +00:00
ru
7aa2a06ebf Fix prototype. 2005-11-24 14:17:35 +00:00
andre
c4178ac83e Use monotonic 'time_uptime' instead of 'time_second' as timebase
for timeouts.
2005-09-19 22:31:45 +00:00
phk
4df35786e2 Libalias incorrectly applies proxy rules to the global divert
socket: it should only look for existing translation entries,
not create new ones (no matter how it got the idea).

Approved by:	re(scottl)
2005-06-27 22:21:42 +00:00
glebius
c6e57e046e Disable checksum processing in LibAlias, when it works as a
kernel module. LibAlias is not aware about checksum offloading,
so the caller should provide checksum calculation. (The only
current consumer is ng_nat(4)). When TCP packet internals has
been changed and it requires checksum recalculation, a cookie
is set in th_x2 field of TCP packet, to inform caller that it
needs to recalculate checksum. This ugly hack would be removed
when LibAlias is made more kernel friendly.

Incremental checksum updates are left as is, since they don't
conflict with offloading.

Approved by:	re (scottl)
2005-06-27 07:36:02 +00:00
glebius
5b74333367 - Don't use legacy function in a non-legacy one. This gives us
possibility to compile libalias without legacy support.
- Use correct way to mark variable as unused.

Approved by:	re (dwhite)
2005-06-20 08:31:48 +00:00
glebius
62a51b2dbf Add a workaround for 64-bit archs: store unsigned long return value in
temporary variable, check it and then cast to in_addr_t.
2005-05-06 13:01:31 +00:00
glebius
3eab4ba5cc s/DEBUG/LIBALIAS_DEBUG/, since DEBUG is defined in LINT and
not supported for kernel build.
2005-05-06 11:07:49 +00:00
glebius
225ea2fb02 More bits for kernel version:
- copy inet_aton() from libc
- disable getservbyname() lookup and accept only numeric port
2005-05-05 22:00:32 +00:00
glebius
32b37f4983 Always include alias.h before alias_local.h 2005-05-05 21:55:17 +00:00
glebius
98fced80c8 When used in kernel define NO_FW_PUNCH, NO_LOGGING, NO_USE_SOCKETS. 2005-05-05 21:53:17 +00:00
glebius
fa23219cf2 Fix argument order for bcopy() in last commit.
Noticed by:	njl
Pointy hat to:	glebius
2005-05-05 21:40:49 +00:00