Commit Graph

144 Commits

Author SHA1 Message Date
plunky 08432b7b14 handle STDC and GNUC inline semantic differences by providing and
using an EXTERN_INLINE definition for functions that are defined as
inline but provide an externally callable reference.

(these are externally called in ipftest)
2010-06-01 08:53:20 +00:00
darrenr c8b0eee463 clean up compile time warnings to due caddr_t and empty statements 2010-04-17 22:04:00 +00:00
darrenr 9355c196fd New file for 4.1.34 that is in src/dist/ipf but not src/sys/dist/ipf/netinet 2010-04-17 21:36:56 +00:00
darrenr 46fa5e0711 Commit IPFilter 4.1.34 to HEAD 2010-04-17 21:00:08 +00:00
pooka 10fe49d72c Redefine bpf linkage through an always present op vector, i.e.
#if NBPFILTER is no longer required in the client.  This change
doesn't yet add support for loading bpf as a module, since drivers
can register before bpf is attached.  However, callers of bpf can
now be modularized.

Dynamically loadable bpf could probably be done fairly easily with
coordination from the stub driver and the real driver by registering
attachments in the stub before the real driver is loaded and doing
a handoff.  ... and I'm not going to ponder the depths of unload
here.

Tested with i386/MONOLITHIC, modified MONOLITHIC without bpf and rump.
2010-01-19 22:06:18 +00:00
mbalmer 0ae57f90dd more s/the the/the/ 2009-11-22 19:09:15 +00:00
elad 52bc2f0e12 Attach the listener in the correct "attach" function.
Should fix issues reported by Anon Ymous.
2009-10-05 03:44:01 +00:00
elad 6991fd9ea2 Move firewall/NAT policy back to respective subsystems (pf, ipf).
Note: the ipf code contains a lot of ifdefs, some of them for NetBSD
versions that are no longer maintained. It won't make the code more
readable, but we should consider removing them.
2009-10-03 00:37:01 +00:00
cegger e470472c02 build fix: caddr_t -> void * 2009-08-19 13:07:59 +00:00
darrenr aa4e57639b Update head to version 4.1.33 from vendor branch 2009-08-19 08:35:30 +00:00
kefren 1130fba7b6 Don't call callout_stop() without callout_init()
Fixes PR/41364
2009-05-08 05:18:34 +00:00
tsutsui 12de89c17b Fix harmless merge botch. 2009-04-19 18:08:56 +00:00
tsutsui 2380352549 Pull a fix for ipnat from upstream as per info from darrenr@:
2031730 4.1.31 Nat drops fragmented packets after the first
 http://ipfilter.cvs.sourceforge.net/viewvc/ipfilter/ipfilter/ip_nat.c#rev1.2.2.48

Fixes problems on UDP NFS with ipnat as mentioned in PR kern/38773 and
PR kern/41074.  Tested on several slow NFS clients and an i386 server
running ipnat.

Should be pulled up to 5.0.
2009-04-18 11:19:09 +00:00
dsl 02cdf4d2c8 Remove all the __P() from sys (excluding sys/dist)
Diff checked with grep and MK1 eyeball.
i386 and amd64 GENERIC and sys still build.
2009-03-14 14:45:51 +00:00
bouyer a95c0eef3a When IPFilter 4.1.29 has been imported, the mbuf argument to nd6_output()
has been changed from m0 to *mpp. But as *mpp has been set to NULL just
before the call, we end up calling ether_output() with a NULL mbuf,
leading to a NULL pointer dereference. Revert back to using m0 here.

The issue show up when using 'return-rst' or 'return-icmp' in ipf6.conf.
Problem discovered and fix tested on ftp.fr.netbsd.org.
2009-02-12 12:12:39 +00:00
cegger 9b87d582bd kill MALLOC and FREE macros. 2008-12-17 20:51:31 +00:00
darrenr 552614e264 38456 ipf mostly ignores locking in NetBSD 2008-11-06 09:51:57 +00:00
darrenr 60886a044c 38456 ipf mostly ignores locking in NetBSD
...plus some cleanup of fastroute code.
2008-11-06 09:49:59 +00:00
darrenr 7f27612b9c wakeup is not the macro WAKEUP everywhere 2008-11-04 21:41:11 +00:00
darrenr 4dac121dab 2020447 IPFilter's NAT can undo name server random port selection
(fix output port range, was a random number in [0,max-min]
	 (byteswapped on litle endian), instead of [min,max])
2008-07-26 19:44:28 +00:00
darrenr 9f0bfbf3da 2020447 IPFilter's NAT can undo name server random port selection 2008-07-24 09:37:57 +00:00
darrenr 1752f1637c Use of kernel malloc to record what memory ipfilter was using was broken
due to bad placement of a #define inside a macro that was never true for
a kernel build.
2008-06-08 11:31:28 +00:00
darrenr 50cc588ca0 Prior import mismerged changes already in NetBSD with those coming in from
the open source project, leading to regression errors and state tracking
failures.
2008-06-01 22:26:11 +00:00
darrenr 2f5a5e95ad Pullup IPFilter 4.1.29 from the vendor branch to HEAD.
See src/dist/ipf/HISTORY for a list of bug fixes since 4.1.23 (although
a few are already in NetBSD)
2008-05-20 07:08:06 +00:00
rmind c6186face4 Welcome to 4.99.55:
- Add a lot of missing selinit() and seldestroy() calls.

- Merge selwakeup() and selnotify() calls into a single selnotify().

- Add an additional 'events' argument to selnotify() call.  It will
  indicate which event (POLL_IN, POLL_OUT, etc) happen.  If unknown,
  zero may be used.

Note: please pass appropriate value of 'events' where possible.
Proposed on: <tech-kern>
2008-03-01 14:16:49 +00:00
mrg 8a519a7389 initialise some variables to appease gcc -O3. 2008-02-04 02:42:52 +00:00
dyoung ffd53445a3 Convert rtcache_init()+rtcache_getrt() to single rtcache_init()
calls.
2008-01-14 17:17:19 +00:00
dyoung 72fa642a86 Poison struct route->ro_rt uses in the kernel by changing the name
to _ro_rt.  Use rtcache_getrt() to access a route cache's struct
rtentry *.

Introduce struct ifnet->if_dl that always points at the interface
identifier/link-layer address.  Make code that treated the first
ifaddr on struct ifnet->if_addrlist as the interface address use
if_dl, instead.

Remove stale debugging code from net/route.c.  Move the rtflush()
code into rtcache_clear() and delete rtflush().  Delete rtalloc(),
because nothing uses it any more.

Make ND6_HINT an inline, lowercase subroutine, nd6_hint.

I've done my best to convert IP Filter, the ISO stack, and the
AppleTalk stack to rtcache_getrt().  They compile, but I have not
tested them.  I have given the changes to PF, GRE, IPv4 and IPv6
stacks a lot of exercise.
2007-12-20 19:53:29 +00:00
lukem 6c9202e6d8 Use __KERNEL_RCSID() instead of vendor RCS or SCCS IDs. 2007-12-11 04:55:00 +00:00
martti 811a7577e8 Bring some fixes from IPF 4.1.27 in order to fix kern/37037. 2007-10-02 06:15:11 +00:00
martti abde7e33e0 Fixed IPF bug #1767831
ipflog() & ipmon ignore IPv6 extension headers
2007-09-17 18:02:21 +00:00
martti 05122b2bd9 Fixed IPF bug #1779455
state timer should be reset when retransmission is seen
2007-09-17 06:56:15 +00:00
martti 1f09bebe3d Returning from m_pulldown can leave the first mbut with no data (m_len = 0).
The mbuf chain wasn't being walked and thus fin_m was not updated to point
to the new first mbuf with data in it.

Patch from the official IPFilter repository.
2007-09-17 06:25:21 +00:00
martti 4a8ab0e43a Fixed IPF bug #1774745
retransmitted ACK may initiate connection state transition
2007-09-14 11:28:45 +00:00
martti 1122544750 Fixed IPF bug #1794544
keep frags does not work with IPv6
2007-09-14 09:57:07 +00:00
martti 61078fef5f Revert to previous, it was not working for me correctly... 2007-09-10 06:28:38 +00:00
martti fcbc8c046f Fixed IPF bug #1767831
ipflog() & ipmon ignore IPv6 extension headers

Patch fetched from the SourceForge bug report.
2007-09-10 06:12:02 +00:00
martti 20df8bbd24 Fixed IPF bug #1785199
fr_natderef causes lock contention and performance slowdown

Patch fetched from the SourceForge bug report.
2007-09-10 06:07:01 +00:00
martti 2021a17984 Fixed IPF bug #1791241 ("keep frag does not work with keep state for fragments")
Patch fetched from the SourceForge bug report.
2007-09-10 06:03:21 +00:00
gdt 7143faccbb Avoid casting to "i6addr_t *", because that type requires 64-bit
alignment and nothing guarantees that IPv6 packets in mbufs are 8-byte
aligned.  gcc was coalescing adjacent 32-bit compares into "ldx" on
sparc64, leading to alignment faults when processing icmp6 arriving on
gif with IPv4 outer addresses.

Fix mostly from darrenr@.  Discussed extensively on port-sparc64.
2007-07-19 14:04:34 +00:00
ad 88ab7da936 Merge some of the less invasive changes from the vmlocking branch:
- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements
2007-07-09 20:51:58 +00:00
mlelstv f9a2fc4868 Avoid use of cached pointers that might be stale due to mbuf operations. 2007-06-24 22:16:35 +00:00
martin 0d8033bf02 (Re-)add a missing cast in an #if part not used in current, but needed
for netbsd-4.
2007-06-17 09:32:34 +00:00
martin c77a3f5aad Upgraded IPFilter to v4.1.23 2007-06-16 10:52:24 +00:00
dyoung 95edb940c2 Get rid of radix_node_head.rnh_walktree, because it is only ever
set to rn_walktree.

Introduce rt_walktree(), which applies a subroutine to every route
in a particular address family.  Use it instead of rn_walktree()
virtually everywhere.  This helps to hide the routing table
implementation.
2007-06-09 03:07:21 +00:00
martti fff7fd04df s/iplattach/ipfattach/ and s/ipldetach/ipfdetach/ 2007-06-04 12:38:58 +00:00
darrenr fade943a7f The wrong condition was being tested for when deciding which fields to
update in ICMP error messages.  In the test case for this, the wrong
input was actually being used (it should be the headers from the previous
packet output) and therefore the expected results were also wildly wrong.

kern/36309
2007-05-31 10:33:54 +00:00
darrenr 5daa30646c the call to ipf_freetoken() free's the structure pointed to by 't' so doing
any sort of dereference of it afterwards is just a bad idea...
2007-05-30 06:27:11 +00:00
martti 6b17040b66 Fix problems with stateful filtering. Patch received from darrenr@. 2007-05-25 06:44:20 +00:00
martin 6718c86598 Merge IP-Filter 4.1.22 2007-05-15 22:52:20 +00:00