src/sys/netinet/ipfw, branch main

o Create directory sys/netpfil, where all packet filters should

2012-09-14T11:51:49+00:00

  reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.c		-> sys/netpfil/pf/
sys/contrib/pf/net/*.h		-> sys/net/
contrib/pf/pfctl/*.c		-> sbin/pfctl
contrib/pf/pfctl/*.h		-> sbin/pfctl
contrib/pf/pfctl/pfctl.8	-> sbin/pfctl
contrib/pf/pfctl/*.4		-> share/man/man4
contrib/pf/pfctl/*.5		-> share/man/man5

sys/netinet/ipfw		-> sys/netpfil/ipfw

The arguable movement is pf/net/*.h -> sys/net. There are
future plans to refactor pf includes, so I decided not to
break things twice.

Not modified bits of pf left in contrib: authpf, ftp-proxy,
tftp-proxy, pflogd.

The ipfw(4) movement is planned to be merged to stable/9,
to make head and stable match.

Discussed with:		bz, luigi

Merge the projects/pf/head branch, that was worked on for last six months,

2012-09-08T06:41:54+00:00

into head. The most significant achievements in the new code:

 o Fine grained locking, thus much better performance.
 o Fixes to many problems in pf, that were specific to FreeBSD port.

New code doesn't have that many ifdefs and much less OpenBSDisms, thus
is more attractive to our developers.

  Those interested in details, can browse through SVN log of the
projects/pf/head branch. And for reference, here is exact list of
revisions merged:

r232043, r232044, r232062, r232148, r232149, r232150, r232298, r232330,
r232332, r232340, r232386, r232390, r232391, r232605, r232655, r232656,
r232661, r232662, r232663, r232664, r232673, r232691, r233309, r233782,
r233829, r233830, r233834, r233835, r233836, r233865, r233866, r233868,
r233873, r234056, r234096, r234100, r234108, r234175, r234187, r234223,
r234271, r234272, r234282, r234307, r234309, r234382, r234384, r234456,
r234486, r234606, r234640, r234641, r234642, r234644, r234651, r235505,
r235506, r235535, r235605, r235606, r235826, r235991, r235993, r236168,
r236173, r236179, r236180, r236181, r236186, r236223, r236227, r236230,
r236252, r236254, r236298, r236299, r236300, r236301, r236397, r236398,
r236399, r236499, r236512, r236513, r236525, r236526, r236545, r236548,
r236553, r236554, r236556, r236557, r236561, r236570, r236630, r236672,
r236673, r236679, r236706, r236710, r236718, r237154, r237155, r237169,
r237314, r237363, r237364, r237368, r237369, r237376, r237440, r237442,
r237751, r237783, r237784, r237785, r237788, r237791, r238421, r238522,
r238523, r238524, r238525, r239173, r239186, r239644, r239652, r239661,
r239773, r240125, r240130, r240131, r240136, r240186, r240196, r240212.

I'd like to thank people who participated in early testing:

Tested by:	Florian Smeets 
Tested by:	Chekaluk Vitaly 
Tested by:	Ben Wilber 
Tested by:	Ian FREISLICH

Introduce new link-layer PFIL hook V_link_pfil_hook.

2012-09-04T19:43:26+00:00

Merge ether_ipfw_chk() and part of bridge_pfil() into
unified ipfw_check_frame() function called by PFIL.
This change was suggested by rwatson? @ DevSummit.

Remove ipfw headers from ether/bridge code since they are unneeded now.

Note this thange introduce some (temporary) performance penalty since
PFIL read lock has to be acquired for every link-level packet.

MFC after:     3 weeks

Mark the ipfw interface type as not being ether. This fixes an issue

2012-09-01T23:33:49+00:00

    where uuidgen tried to obtain a ipfw device's mac address which was
    always zero.

    PR:		170460
    Submitted by:	wxs
    Reviewed by:	bdrewery
    Reviewed by:	delphij
    Approved by:	cperciva
    MFC after:	1 week

s/lenght/length/ in comments

2012-08-07T07:52:25+00:00

move functions outside the SYSBEGIN/SYSEND block

2012-08-06T11:02:23+00:00

(SYSBEGIN/SYSEND are specific to ipfw/dummynet and are used to
emulate sysctl on platforms that do not have them, and they work
by creating an array which contains all the sysctl-ed symbols.)

use FREE_PKT instead of m_freem to free an mbuf.

2012-08-06T10:50:43+00:00

The former is the standard form used in ipfw/dummynet, so that
it is easier to remap it to different memory managers depending
on the platform.

replace __unused with a portable construct;

2012-08-02T12:45:13+00:00

fix a couple of signed/unsigned warnings.

replace inet_ntoa_r with the more standard inet_ntop().

2012-08-01T18:52:07+00:00

As discussed on -current, inet_ntoa_r() is non standard,
has different arguments in userspace and kernel, and
almost unused (no clients in userspace, only
net/flowtable.c, net/if_llatbl.c, netinet/in_pcb.c, netinet/tcp_subr.c
in the kernel)

add a cast to avoid a signed/unsigned warning (to be removed

2012-08-01T18:49:00+00:00

when we will have TUNABLE_UINT constructors)