Commit Graph

274 Commits

Author SHA1 Message Date
plunky 08432b7b14 handle STDC and GNUC inline semantic differences by providing and
using an EXTERN_INLINE definition for functions that are defined as
inline but provide an externally callable reference.

(these are externally called in ipftest)
2010-06-01 08:53:20 +00:00
degroote ca38e323d1 Add support for pfs(8)
pfs(8) is a tool similar to ipfs(8) but for pf(4). It allows the admin to
dump internal configuration of pf, and restore at a latter point, after a
maintenance reboot for example, in a transparent way for user.

This work has been done mostly during my GSoC 2009

No objections on tech-net@
2010-05-07 17:41:57 +00:00
darrenr c8b0eee463 clean up compile time warnings to due caddr_t and empty statements 2010-04-17 22:04:00 +00:00
darrenr 9355c196fd New file for 4.1.34 that is in src/dist/ipf but not src/sys/dist/ipf/netinet 2010-04-17 21:36:56 +00:00
darrenr 46fa5e0711 Commit IPFilter 4.1.34 to HEAD 2010-04-17 21:00:08 +00:00
ahoka 8f356e922b Do not unload pf when enabled, not even manually. 2010-04-13 13:08:16 +00:00
ahoka 3bca1c92ed change module class to driver. 2010-04-13 11:53:18 +00:00
ahoka b9e768f315 Do not auto unload pf if it's enabled. 2010-04-13 01:02:43 +00:00
ahoka f6a8ba3d97 - Make the pf and pflog driver able to detach.
- Add code for module support.

Original patch from Jared McNeill
2010-04-12 13:57:38 +00:00
skrll ea3fb23f81 Spello in comment. 2010-04-12 06:56:19 +00:00
joerg 58e867556f Push the bpf_ops usage back into bpf.h. Push the common ifp->if_bpf
check into the inline functions as well the fourth argument for
bpf_attach.
2010-04-05 07:19:28 +00:00
minskim 6f5cce7306 Fix a typo introduced by the bpf linkage change. 2010-01-23 01:17:23 +00:00
pooka 10fe49d72c Redefine bpf linkage through an always present op vector, i.e.
#if NBPFILTER is no longer required in the client.  This change
doesn't yet add support for loading bpf as a module, since drivers
can register before bpf is attached.  However, callers of bpf can
now be modularized.

Dynamically loadable bpf could probably be done fairly easily with
coordination from the stub driver and the real driver by registering
attachments in the stub before the real driver is loaded and doing
a handoff.  ... and I'm not going to ponder the depths of unload
here.

Tested with i386/MONOLITHIC, modified MONOLITHIC without bpf and rump.
2010-01-19 22:06:18 +00:00
elad 579013ded4 Replace uidinfo.h with kauth.h, should fix problems observed by tron@. 2009-12-30 19:47:15 +00:00
elad 67a179c338 Use the right member to store gid in the non-NetBSD case.
Pointed out by uebayasi@ and cegger@, thanks!
2009-12-30 16:49:02 +00:00
elad cd2e2d5571 Get uid/gid from the socket's credentials. 2009-12-30 07:00:01 +00:00
dsl 835104494b If pfi_address_add() has to extend the buffer, copy the data in the
right direction!
Fixes PR/41939.
2009-12-06 16:46:11 +00:00
mbalmer 0ae57f90dd more s/the the/the/ 2009-11-22 19:09:15 +00:00
elad 52bc2f0e12 Attach the listener in the correct "attach" function.
Should fix issues reported by Anon Ymous.
2009-10-05 03:44:01 +00:00
elad 6991fd9ea2 Move firewall/NAT policy back to respective subsystems (pf, ipf).
Note: the ipf code contains a lot of ifdefs, some of them for NetBSD
versions that are no longer maintained. It won't make the code more
readable, but we should consider removing them.
2009-10-03 00:37:01 +00:00
degroote 2d48ac808c Import pfsync support from OpenBSD 4.2
Pfsync interface exposes change in the pf(4) over a pseudo-interface, and can
be used to synchronise different pf.

This work was part of my 2009 GSoC

No objection on tech-net@
2009-09-14 10:36:48 +00:00
cegger e470472c02 build fix: caddr_t -> void * 2009-08-19 13:07:59 +00:00
darrenr aa4e57639b Update head to version 4.1.33 from vendor branch 2009-08-19 08:35:30 +00:00
jmcneill a8fec90e57 acpica has been moved to src/sys/external/intel-public/acpica 2009-08-18 16:44:10 +00:00
cegger f7b6b09d0b Apply fix from upstream:
http://git.moblin.org/cgit.cgi/acpica/commit/?id=26a2eea9f4a18acb0ba2a92070d945d9835df948

I uncovered the bug by having the console flooded with:

ACPI Error (evgpe-0896): No handler or method for GPE[ 0], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 1], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 2], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 4], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 5], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 6], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 7], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 8], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ 9], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ A], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ B], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ C], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ D], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ E], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[ F], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[10], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[11], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[12], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[13], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[14], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[15], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[16], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[17], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[18], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[19], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1A], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1B], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1C], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1D], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1E], disabling event [20080321]
ACPI Error (evgpe-0896): No handler or method for GPE[1F], disabling event [20080321]

and with breaking into ddb:

ACPI Error (evgpe-0899): No handler or method for GPE[ 0], disabling event [20080321]
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8020c1fd cs e030 rflags 296 cr2  0 cpl 8 rsp ffffffff80f32c98
Stopped in pid 0.1 (system) at  netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
AcpiEvGpeDispatch() at netbsd:AcpiEvGpeDispatch+0x9f
AcpiEvGpeDetect() at netbsd:AcpiEvGpeDetect+0x136
AcpiEvSciXruptHandler() at netbsd:AcpiEvSciXruptHandler+0x46
Xresume_xenev6() at netbsd:Xresume_xenev6+0x55

With this merged fix console is no longer flooded and I get in dmesg:

ACPI Exception (evevent-0165): AE_BAD_ADDRESS, Unable to initialize fixed events [20080321]
acpi0: unable to enable ACPI: AE_BAD_ADDRESS

Upstream fix pointed out by jmcneill@, merged fix ok'd by joerg@.
2009-08-17 15:36:10 +00:00
minskim 3c24e51c76 Remove LKM code from pf. 2009-07-28 18:15:26 +00:00
minskim 8221d4ac16 Reduce diff with OpenBSD. No functional change. 2009-06-16 05:15:41 +00:00
kefren 1130fba7b6 Don't call callout_stop() without callout_init()
Fixes PR/41364
2009-05-08 05:18:34 +00:00
tsutsui 12de89c17b Fix harmless merge botch. 2009-04-19 18:08:56 +00:00
tsutsui 2380352549 Pull a fix for ipnat from upstream as per info from darrenr@:
2031730 4.1.31 Nat drops fragmented packets after the first
 http://ipfilter.cvs.sourceforge.net/viewvc/ipfilter/ipfilter/ip_nat.c#rev1.2.2.48

Fixes problems on UDP NFS with ipnat as mentioned in PR kern/38773 and
PR kern/41074.  Tested on several slow NFS clients and an i386 server
running ipnat.

Should be pulled up to 5.0.
2009-04-18 11:19:09 +00:00
christos ae0fe2262f Fix http://www.securityfocus.com/archive/1/502634, from OpenBSD.
XXX: should be pulled up to 5.x
2009-04-13 22:29:11 +00:00
dsl 02cdf4d2c8 Remove all the __P() from sys (excluding sys/dist)
Diff checked with grep and MK1 eyeball.
i386 and amd64 GENERIC and sys still build.
2009-03-14 14:45:51 +00:00
jmcneill 37c6542e1a Fix build on ia64, from kiyohara@kk.iij4u.or.jp 2009-03-14 13:51:23 +00:00
jmcneill 72d5239ba1 PR# port-i386/40676: ACPI Exception AE_AML_NO_OPERAND when booting on VAIO P
Fix to allow zero-length ASL field declarations:

  http://bugzilla.kernel.org/show_bug.cgi?id=10606
2009-02-17 23:34:19 +00:00
bouyer a95c0eef3a When IPFilter 4.1.29 has been imported, the mbuf argument to nd6_output()
has been changed from m0 to *mpp. But as *mpp has been set to NULL just
before the call, we end up calling ether_output() with a NULL mbuf,
leading to a NULL pointer dereference. Revert back to using m0 here.

The issue show up when using 'return-rst' or 'return-icmp' in ipf6.conf.
Problem discovered and fix tested on ftp.fr.netbsd.org.
2009-02-12 12:12:39 +00:00
cegger e6e72079ad make this compile 2009-01-11 10:25:29 +00:00
cegger dcf705893e use M_ZERO on malloc() and remove subsequent bzero(). 2008-12-19 18:49:37 +00:00
cegger 9c1c1ad122 pass M_NOWAIT instead of M_DONTWAIT to malloc. 2008-12-19 14:07:37 +00:00
cegger 9b87d582bd kill MALLOC and FREE macros. 2008-12-17 20:51:31 +00:00
dyoung de87fe677d *** Summary ***
When a link-layer address changes (e.g., ifconfig ex0 link
02🇩🇪ad:be:ef:02 active), send a gratuitous ARP and/or a Neighbor
Advertisement to update the network-/link-layer address bindings
on our LAN peers.

Refuse a change of ethernet address to the address 00:00:00:00:00:00
or to any multicast/broadcast address.  (Thanks matt@.)

Reorder ifnet ioctl operations so that driver ioctls may inherit
the functions of their "class"---ether_ioctl(), fddi_ioctl(), et
cetera---and the class ioctls may inherit from the generic ioctl,
ifioctl_common(), but both driver- and class-ioctls may override
the generic behavior.  Make network drivers share more code.

Distinguish a "factory" link-layer address from others for the
purposes of both protecting that address from deletion and computing
EUI64.

Return consistent, appropriate error codes from network drivers.

Improve readability.  KNF.

*** Details ***

In if_attach(), always initialize the interface ioctl routine,
ifnet->if_ioctl, if the driver has not already initialized it.
Delete if_ioctl == NULL tests everywhere else, because it cannot
happen.

In the ioctl routines of network interfaces, inherit common ioctl
behaviors by calling either ifioctl_common() or whichever ioctl
routine is appropriate for the class of interface---e.g., ether_ioctl()
for ethernets.

Stop (ab)using SIOCSIFADDR and start to use SIOCINITIFADDR.  In
the user->kernel interface, SIOCSIFADDR's argument was an ifreq,
but on the protocol->ifnet interface, SIOCSIFADDR's argument was
an ifaddr.  That was confusing, and it would work against me as I
make it possible for a network interface to overload most ioctls.
On the protocol->ifnet interface, replace SIOCSIFADDR with
SIOCINITIFADDR.  In ifioctl(), return EPERM if userland tries to
invoke SIOCINITIFADDR.

In ifioctl(), give the interface the first shot at handling most
interface ioctls, and give the protocol the second shot, instead
of the other way around. Finally, let compatibility code (COMPAT_OSOCK)
take a shot.

Pull device initialization out of switch statements under
SIOCINITIFADDR.  For example, pull ..._init() out of any switch
statement that looks like this:

        switch (...->sa_family) {
        case ...:
                ..._init();
                ...
                break;
        ...
        default:
                ..._init();
                ...
                break;
        }

Rewrite many if-else clauses that handle all permutations of IFF_UP
and IFF_RUNNING to use a switch statement,

        switch (x & (IFF_UP|IFF_RUNNING)) {
        case 0:
                ...
                break;
        case IFF_RUNNING:
                ...
                break;
        case IFF_UP:
                ...
                break;
        case IFF_UP|IFF_RUNNING:
                ...
                break;
        }

unifdef lots of code containing #ifdef FreeBSD, #ifdef NetBSD, and
#ifdef SIOCSIFMTU, especially in fwip(4) and in ndis(4).

In ipw(4), remove an if_set_sadl() call that is out of place.

In nfe(4), reuse the jumbo MTU logic in ether_ioctl().

Let ethernets register a callback for setting h/w state such as
promiscuous mode and the multicast filter in accord with a change
in the if_flags: ether_set_ifflags_cb() registers a callback that
returns ENETRESET if the caller should reset the ethernet by calling
if_init(), 0 on success, != 0 on failure.  Pull common code from
ex(4), gem(4), nfe(4), sip(4), tlp(4), vge(4) into ether_ioctl(),
and register if_flags callbacks for those drivers.

Return ENOTTY instead of EINVAL for inappropriate ioctls.  In
zyd(4), use ENXIO instead of ENOTTY to indicate that the device is
not any longer attached.

Add to if_set_sadl() a boolean 'factory' argument that indicates
whether a link-layer address was assigned by the factory or some
other source.  In a comment, recommend using the factory address
for generating an EUI64, and update in6_get_hw_ifid() to prefer a
factory address to any other link-layer address.

Add a routing message, RTM_LLINFO_UPD, that tells protocols to
update the binding of network-layer addresses to link-layer addresses.
Implement this message in IPv4 and IPv6 by sending a gratuitous
ARP or a neighbor advertisement, respectively.  Generate RTM_LLINFO_UPD
messages on a change of an interface's link-layer address.

In ether_ioctl(), do not let SIOCALIFADDR set a link-layer address
that is broadcast/multicast or equal to 00:00:00:00:00:00.

Make ether_ioctl() call ifioctl_common() to handle ioctls that it
does not understand.

In gif(4), initialize if_softc and use it, instead of assuming that
the gif_softc and ifp overlap.

Let ifioctl_common() handle SIOCGIFADDR.

Sprinkle rtcache_invariants(), which checks on DIAGNOSTIC kernels
that certain invariants on a struct route are satisfied.

In agr(4), rewrite agr_ioctl_filter() to be a bit more explicit
about the ioctls that we do not allow on an agr(4) member interface.

bzero -> memset.  Delete unnecessary casts to void *.  Use
sockaddr_in_init() and sockaddr_in6_init().  Compare pointers with
NULL instead of "testing truth".  Replace some instances of (type
*)0 with NULL.  Change some K&R prototypes to ANSI C, and join
lines.
2008-11-07 00:20:01 +00:00
darrenr 552614e264 38456 ipf mostly ignores locking in NetBSD 2008-11-06 09:51:57 +00:00
darrenr 60886a044c 38456 ipf mostly ignores locking in NetBSD
...plus some cleanup of fastroute code.
2008-11-06 09:49:59 +00:00
darrenr 7f27612b9c wakeup is not the macro WAKEUP everywhere 2008-11-04 21:41:11 +00:00
pooka 7e5aba5af0 Move uidinfo to its own module in kern_uidinfo.c and include in rump.
No functional change to uidinfo.
2008-10-11 13:40:57 +00:00
cherry 370d9398c5 Allow $arch/stand to use dist/acpica/acpica.h 2008-07-30 11:45:20 +00:00
darrenr 4dac121dab 2020447 IPFilter's NAT can undo name server random port selection
(fix output port range, was a random number in [0,max-min]
	 (byteswapped on litle endian), instead of [min,max])
2008-07-26 19:44:28 +00:00
darrenr 9f0bfbf3da 2020447 IPFilter's NAT can undo name server random port selection 2008-07-24 09:37:57 +00:00
peter 899faae713 Wrap definition of pfil6_wrapper in #ifdef INET6.
From Scott Ellis in PR/39007.
2008-06-22 11:36:33 +00:00
yamt 957749de49 remove pf42 branch's todo. 2008-06-19 03:37:57 +00:00
yamt fff57c5525 merge yamt-pf42 branch.
(import newer pf from OpenBSD 4.2)

ok'ed by peter@.  requested by core@
2008-06-18 09:06:25 +00:00