Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
153,010 Commits 606 Branches 0 Tags 3.1 GiB
Commit Graph

138 Commits

Author SHA1 Message Date
peter e6a70f95cf Apply a patch from OpenBSD 3.6 branch (ok yamt@). 
MFC:
Fix by dhartmei@

fix a bug that leads to a crash when binat rules of the form
'binat from ... to ... -> (if)' are used, where the interface
is dynamic. reported by kos(at)bastard(dot)net, analyzed by
Pyun YongHyeon.
 2004-12-05 13:32:17 +00:00
peter fd3bd491c0 Improve the cleanup routines for detachment. Fixes PR 28132. 
Reviewed by yamt.
 2004-12-04 14:26:01 +00:00
peter 3cfd10be8b Don't put the hook definitions into #ifdef _KERNEL. 
(needed to compile pf programs because of the previous change)
 2004-12-04 14:21:23 +00:00
yamt 0a7a28fcc4 plug pfik_ifaddrhooks leaks by embedding it to pfi_kif. 2004-12-04 10:35:54 +00:00
martin 897d73f414 Patch from PR kern/26839, OK'd as a stopgap fix by Darren. 2004-12-01 08:25:54 +00:00
christos 35a75baff6 PR/28418: Do not drop packets for which we cannot add state, because adding 
state is not applicable. The fix just reverts the new code that blocked
packets where fr_addstate() fails. This is not correct in all cases, but
blocking them is a bit drastic and breaks existing functionality. The proper
fix is to change fr_addstate() to return:

- state added
- adding state failed
- adding state is not applicable

and then filter packets only in the second case. I am leaving this for someone
else.
 2004-11-25 09:49:12 +00:00
peter c7f5faeaa9 Apply a patch from the OPENBSD_3_6 branch, ok itojun. 
MFC:
Fix by dhartmei@

The flag to re-filter pf-generated packets was set wrong by synproxy
for ACKs. It should filter the ACK replayed to the server, instead of
of the one to the client.
 2004-11-21 17:59:24 +00:00
peter a3452e6de2 Apply a patch from the OPENBSD_3_6 branch, ok itojun. 
MFC:
Fix by dhartmei@

For RST generated due to state mismatch during handshake, don't set
th_flags TH_ACK and leave th_ack 0, just like the RST generated by
the stack in this case. Fixes the Raptor workaround.
 2004-11-21 17:57:52 +00:00
yamt da18614102 resolve conflicts. (pf from OpenBSD 3.6, kernel part) 2004-11-14 11:12:16 +00:00
yamt 3d5ba5bca1 backout whitespace changes to make further import easier. 2004-11-13 21:13:07 +00:00
he 4a9ab9770a Apply patch from Darren for the ctype() functions/macros. 
Encapsulates the ctype() functions so that the casts are centralized.
 2004-11-13 19:14:48 +00:00
he 76d82c7f1f Revert previous, paving the way for Darren's cleaner patch. 2004-11-13 18:43:49 +00:00
he dd5a52f76d More instances of cast to unsigned char for arguments to ctype functions. 
Will also be sent to maintainer for possible inclusion in master source.
 2004-11-13 15:19:58 +00:00
darrenr 90032de19d build a new fr_info_t structure in fr_send_ip() and pass it through to 
the fastroute function so that it uses accurate packet information about
the packet being sent out rather than the packet received (impacts both
return-rst and return-icmp features.)

PR: kern/27093
 2004-10-31 04:52:50 +00:00
darrenr 8fe036145c * Prevent hang when attempting to flush state entries for ipv4 when ipv6 
are present or vice versa
* Fix matching of IPv6 state entries when the initial packet is a
  sent to a multicast address.  This includes not updating the address as
  being fixed when a second (or further) such packet is seen before a reply.
* Disable code, for now, that limited how many ICMP packets could match a
  state entry based on the number of real packets seen.
 2004-10-07 03:57:02 +00:00
darrenr 328bd73105 The change in 1.3 is incorrect - it checks for FI_OOW regardless of what 
type of data is stored in the rule (only a valid check for FR_T_IPF rules.)
 2004-10-06 15:06:29 +00:00
yamt 2c46ccce37 move netinet/ip_lookup.h -> dist/ipf/netinet/ip_lookup.h. 2004-10-05 04:56:41 +00:00
jdolecek 20d2b45d7d fix bug introduced in rev 1.70 - in the "keep state" & "oow" flag check, 
ensure a pointer to a state structure is non-NULL before dereferencing

Fixes PR kern/26927 by me and PR kern/26947 by Brett Lymn
 2004-10-03 12:21:13 +00:00
jdolecek a9bc4a2fda frrequest(): move some variable initializations for clarity 
no functional change
 2004-10-03 12:16:32 +00:00
jdolecek 46134b3da6 move ip_htable.h from sys/netinet/ to sys/dist/ipf/netinet/, it's ipfilter file 2004-10-02 07:59:14 +00:00
christos d0905be2d3 moved from sys/netinet. 2004-10-02 07:51:53 +00:00
christos f33294b6a4 Moved from sys/netinet as part of the ipfilter separation. 2004-10-01 15:25:59 +00:00
dyoung 34a3fbf64e "RB_PROTOTYPE();" does not lint because you end up with two 
consecutive semicolons, so let's use RB_PROTOTYPE() alone.
 2004-09-28 00:14:02 +00:00
yamt d37ce14181 pflog_packet: use bpf_mtap2(). 
(our bpf_mtap() is more "strict" about mbufs
than openbsd's one is.  eg. M_PKTHDR should be set properly.)
 2004-09-10 08:48:32 +00:00
yamt c3b066f850 pull following fixes from openbsd. ok'ed by itojun. 
> ----------------------------
> revision 1.58
> date: 2004/06/23 04:34:17;  author: mcbride;  state: Exp;  lines: +5 -3
> pfr_commit_ktable calls functions that can result in the current
> ktable being destroyed, which makes it unsafe in a SLIST_FOREACH.
>
> Fix from Chris Pascoe
> ----------------------------
> revision 1.56
> date: 2004/06/11 05:21:20;  author: mcbride;  state: Exp;  lines: +5 -3
> Eliminate a dereference after pool_put when an inactive/no-longer referenced
> table is destroyed in pfr_setflags_ktable.
>
> Fix from Chris Pascoe
> ----------------------------
 2004-09-09 14:56:00 +00:00
yamt 31715f4eb9 remove no longer needed caddr_t casts to reduce diffs from openbsd. 2004-09-08 12:11:25 +00:00
yamt 421ffa4969 pfil4_wrapper, pfil6_wrapper: 
ensure that mbufs are writable beforehand as pf assumes it.
PR/26433.
 2004-09-06 10:01:39 +00:00
yamt 0370fc7128 - rename PFIL_NEWIF to PFIL_IFNET, and handle interface detach events 
as well.
- use it for pf(4).

mostly from Peter Postma.  PR/26403.
 2004-07-27 12:22:59 +00:00
yamt 46abcaebe4 fix dynaddr tracking. 
from Peter Postma, PR/26369.
ok'ed by itojun.
 2004-07-26 13:46:43 +00:00
yamt 4f755d07b4 ANSIfy. (inside #ifdef __NetBSD__) 
from Peter Postma.
ok'ed by itojun.
 2004-07-26 13:45:40 +00:00
yamt 48d156e320 call PFIL_NEWIF hooks at a correct place. 
(on SIOCAIFADDR rather than SIOCGIFALIAS.)

from Peter Postma, PR/26402.
ok'ed by itojun.
 2004-07-26 13:43:14 +00:00
itojun 0407dd42ae make PF lkm working. from Peter Postma and Joel Wilsson. 
remove pf_ioctl_head/pf_newif_head, which was never used.
 2004-06-29 04:42:54 +00:00
itojun ce0e658ff3 PR kern/26011: pf leaks mbufs on disallowed packets. Peter Postma 2004-06-25 13:17:01 +00:00
martin 149fa38cf4 Make it compile on non-IPv6 kernels. 2004-06-22 18:59:14 +00:00
martin be9dcae132 Fix formatting for 64 bit archs. This fixes PR port-sparc64/26010. 
While there, make it compile for non-INET6 aware kernels.
 2004-06-22 18:37:49 +00:00
christos 6ecf0e2cbe add a pfdetach() method to be used by lkm's 2004-06-22 18:04:32 +00:00
itojun bfcdaa5766 PF from openbsd 3.5. missing features: 
- pfsync (due to protocol # assignment issues)
- carp (not really a PF portion, but thought important to mention)
- PF and ALTQ are mutually-exclusive.  this will be sorted out when
  kjc@csl.sony.co.jp updates ALTQ and PF (and API inbetween)

reviewed by matt, christos, perry

torture-test is very welcomed.
 2004-06-22 14:17:07 +00:00
itojun 6adffbf983 PF from OpenBSD 3.5 2004-06-22 13:52:05 +00:00