aboutsummaryrefslogtreecommitdiff
path: root/sys/modules/pf
Commit message (Collapse)AuthorAgeFilesLines
* pf: nat64Kristof Provost2024-12-171-1/+1
| | | | | | | | | | | | | Since the IPv6 madness is not enough introduce NAT64 -- which is actually "af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@ Obtained from: OpenBSD, claudio <claudio@openbsd.org>, 97326e01c9 Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47786
* Remove residual blank line at start of MakefileWarner Losh2024-07-151-1/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* pf: convert state retrieval to netlinkAlexander V. Chernikov2023-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | Use netlink to export pf's state table. The primary motivation is to improve how we deal with very large state stables. With the previous implementation we had to build the entire list (both in the kernel and in userspace) before we could start processing. With netlink we start to get data in userspace while the kernel is still generating more. This reduces peak memory consumption (which can get to the GB range once we hit millions of states). Netlink also makes future extension easier, in that we can easily add fields to the state export without breaking userspace. In that regard it's similar to an nvlist-based approach, except that it also deals with transport to userspace and that it performs significantly better than nvlists. Testing has failed to measure a performance difference between the previous struct-copy based ioctl and the netlink approach. Differential Revision: https://reviews.freebsd.org/D38888
* sys: Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-161-1/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* Fix some modules to export more used symbolsKonstantin Belousov2021-11-181-0/+2
| | | | | | | | | and remove non-present symbols that are now reported by kmod_syms.awk. Reviewed by: emaste Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D32878
* modules: a lot: need opt_kern_tls.hKyle Evans2021-09-301-1/+2
| | | | This fixes the standalone build.
* pf: syncookie supportKristof Provost2021-07-201-1/+1
| | | | | | | | | | | | | | | | Import OpenBSD's syncookie support for pf. This feature help pf resist TCP SYN floods by only creating states once the remote host completes the TCP handshake rather than when the initial SYN packet is received. This is accomplished by using the initial sequence numbers to encode a cookie (hence the name) in the SYN+ACK response and verifying this on receipt of the client ACK. Reviewed by: kbowling Obtained from: OpenBSD MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D31138
* pf: Introduce nvlist variant of DIOCADDRULEKristof Provost2021-04-101-1/+1
| | | | | | | | | | This will make future extensions of the API much easier. The intent is to remove support for DIOCADDRULE in FreeBSD 14. Reviewed by: markj (previous version), glebius (previous version) MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D29557
* Add a missing include of opt_sctp.h.Mark Johnston2019-10-121-1/+1
| | | | | | | | MFC after: 1 week Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=353458
* sys/modules: normalize .CURDIR-relative paths to SRCTOPEnji Cooper2017-03-041-1/+1
| | | | | | | | | | | This simplifies make output/logic Tested with: `cd sys/modules; make ALL_MODULES=` on amd64 MFC after: 1 month Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314651
* Move most of the 15 variations on generating opt_inet.h andWarner Losh2014-08-041-15/+0
| | | | | | | | | opt_inet6.h into kmod.mk by forcing almost everybody to eat the same dogfood. While at it, consolidate the opt_bpf.h and opt_mroute.h targets here too. Notes: svn path=/head/; revision=269540
* Use src.opts.mk in preference to bsd.own.mk except where we need stuffWarner Losh2014-05-061-1/+1
| | | | | | | from the latter. Notes: svn path=/head/; revision=265420
* o Create directory sys/netpfil, where all packet filters shouldGleb Smirnoff2012-09-141-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | reside, and move there ipfw(4) and pf(4). o Move most modified parts of pf out of contrib. Actual movements: sys/contrib/pf/net/*.c -> sys/netpfil/pf/ sys/contrib/pf/net/*.h -> sys/net/ contrib/pf/pfctl/*.c -> sbin/pfctl contrib/pf/pfctl/*.h -> sbin/pfctl contrib/pf/pfctl/pfctl.8 -> sbin/pfctl contrib/pf/pfctl/*.4 -> share/man/man4 contrib/pf/pfctl/*.5 -> share/man/man5 sys/netinet/ipfw -> sys/netpfil/ipfw The arguable movement is pf/net/*.h -> sys/net. There are future plans to refactor pf includes, so I decided not to break things twice. Not modified bits of pf left in contrib: authpf, ftp-proxy, tftp-proxy, pflogd. The ipfw(4) movement is planned to be merged to stable/9, to make head and stable match. Discussed with: bz, luigi Notes: svn path=/head/; revision=240494
* Merge the projects/pf/head branch, that was worked on for last six months,Gleb Smirnoff2012-09-081-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into head. The most significant achievements in the new code: o Fine grained locking, thus much better performance. o Fixes to many problems in pf, that were specific to FreeBSD port. New code doesn't have that many ifdefs and much less OpenBSDisms, thus is more attractive to our developers. Those interested in details, can browse through SVN log of the projects/pf/head branch. And for reference, here is exact list of revisions merged: r232043, r232044, r232062, r232148, r232149, r232150, r232298, r232330, r232332, r232340, r232386, r232390, r232391, r232605, r232655, r232656, r232661, r232662, r232663, r232664, r232673, r232691, r233309, r233782, r233829, r233830, r233834, r233835, r233836, r233865, r233866, r233868, r233873, r234056, r234096, r234100, r234108, r234175, r234187, r234223, r234271, r234272, r234282, r234307, r234309, r234382, r234384, r234456, r234486, r234606, r234640, r234641, r234642, r234644, r234651, r235505, r235506, r235535, r235605, r235606, r235826, r235991, r235993, r236168, r236173, r236179, r236180, r236181, r236186, r236223, r236227, r236230, r236252, r236254, r236298, r236299, r236300, r236301, r236397, r236398, r236399, r236499, r236512, r236513, r236525, r236526, r236545, r236548, r236553, r236554, r236556, r236557, r236561, r236570, r236630, r236672, r236673, r236679, r236706, r236710, r236718, r237154, r237155, r237169, r237314, r237363, r237364, r237368, r237369, r237376, r237440, r237442, r237751, r237783, r237784, r237785, r237788, r237791, r238421, r238522, r238523, r238524, r238525, r239173, r239186, r239644, r239652, r239661, r239773, r240125, r240130, r240131, r240136, r240186, r240196, r240212. I'd like to thank people who participated in early testing: Tested by: Florian Smeets <flo freebsd.org> Tested by: Chekaluk Vitaly <artemrts ukr.net> Tested by: Ben Wilber <ben desync.com> Tested by: Ian FREISLICH <ianf cloudseed.co.za> Notes: svn path=/head/; revision=240233
* Update packet filter (pf) code to OpenBSD 4.5.Bjoern A. Zeeb2011-06-281-3/+13
| | | | | | | | | | | You need to update userland (world and ports) tools to be in sync with the kernel. Submitted by: mlaier Submitted by: eri Notes: svn path=/head/; revision=223637
* Fix typo which has survived amazingly long!Ermal Luçi2009-10-101-1/+1
| | | | | | | | Approved by: mlaier(mentor) MFC after: 3 days Notes: svn path=/head/; revision=197928
* After r193232 rt_tables in vnet.h are no longer indirectly dependent onBjoern A. Zeeb2009-06-081-1/+1
| | | | | | | | | | | | the ROUTETABLES kernel option thus there is no need to include opt_route.h anymore in all consumers of vnet.h and no longer depend on it for module builds. Remove the hidden include in flowtable.h as well and leave the two explicit #includes in ip_input.c and ip_output.c. Notes: svn path=/head/; revision=193744
* Remove opt_mac.h generation for various kernel modules that no longerRobert Watson2009-06-061-1/+1
| | | | | | | | | require it. Submitted by: pjd Notes: svn path=/head/; revision=193588
* Rather than using hidden includes (with cicular dependencies),Bjoern A. Zeeb2008-12-021-1/+1
| | | | | | | | | | | | | | directly include only the header files needed. This reduces the unneeded spamming of various headers into lots of files. For now, this leaves us with very few modules including vnet.h and thus needing to depend on opt_route.h. Reviewed by: brooks, gnn, des, zec, imp Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=185571
* Per email to arch@ a little while ago (that was greeted with silence),Warner Losh2008-09-011-5/+5
| | | | | | | | prefer the more common > ${.TARGET} over > opt_foo.h in modules makefiles. Notes: svn path=/head/; revision=182668
* Link pf 4.1 to the build:Max Laier2007-07-031-0/+6
| | | | | | | | | | | - move ftp-proxy from libexec to usr.sbin - add tftp-proxy - new altq mtag link Approved by: re (kensmith) Notes: svn path=/head/; revision=171173
* Introduce a new entry point, mac_create_mbuf_from_firewall. This entry pointChristian S.J. Peron2006-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate Notes: svn path=/head/; revision=162238
* Reimplementation of world/kernel build options. For details, see:Ruslan Ermilov2006-03-171-1/+3
| | | | | | | | | | | http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html The src.conf(5) manpage is to follow in a few days. Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine) Notes: svn path=/head/; revision=156813
* The `pf' and `pflog' sources do not depend on DEV_PF or DEV_PFLOG,Yaroslav Tykhiy2006-03-091-3/+0
| | | | | | | | | | | which is normal for own files of a device driver. DEV_FOO should be used if an unrelated kernel file needs to know of the `foo' driver's static presence. Obviously, module source files should never use DEV_*. Notes: svn path=/head/; revision=156499
* Make pflog a seperate module. As a result pflog_packet() becomes a functionMax Laier2006-02-051-3/+0
| | | | | | | | | | | pointer that is declared in pf_ioctl.c Requested by: yar (as part of the module build reorg) MFC after: 1 week X-MFC with: yar's module reorg Notes: svn path=/head/; revision=155337
* Let modules use the kernel's opt_*.h files if built along withYaroslav Tykhiy2005-10-141-0/+2
| | | | | | | | | | | | | | | | | the kernel by wrapping all targets for fake opt_*.h files in .if defined(KERNBUILDDIR). Thus, such fake files won't be created at all if modules are built with the kernel. Some modules undergo cleanup like removing unused or unneeded options or .h files, without which they wouldn't build this way or the other. Reviewed by: ru Tested by: no binary changes in modules built alone Tested on: i386 sparc64 amd64 Notes: svn path=/head/; revision=151350
* Let kmod.mk create an empty .h file.Ruslan Ermilov2005-06-051-3/+1
| | | | Notes: svn path=/head/; revision=146992
* NOINET6 -> NO_INET6Ruslan Ermilov2004-12-211-1/+1
| | | | Notes: svn path=/head/; revision=139115
* Removed -Wall from CFLAGS.Ruslan Ermilov2004-09-011-1/+1
| | | | Notes: svn path=/head/; revision=134594
* Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSDDavid Malone2004-08-141-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | have already done this, so I have styled the patch on their work: 1) introduce a ip_newid() static inline function that checks the sysctl and then decides if it should return a sequential or random IP ID. 2) named the sysctl net.inet.ip.random_id 3) IPv6 flow IDs and fragment IDs are now always random. Flow IDs and frag IDs are significantly less common in the IPv6 world (ie. rarely generated per-packet), so there should be smaller performance concerns. The sysctl defaults to 0 (sequential IP IDs). Reviewed by: andre, silby, mlaier, ume Based on: NetBSD MFC after: 2 months Notes: svn path=/head/; revision=133720
* Commit pf version 3.5 and link additional files to the kernel build.Max Laier2004-06-161-3/+4
| | | | | | | | | | | | | | | Version 3.5 brings: - Atomic commits of ruleset changes (reduce the chance of ending up in an inconsistent state). - A 30% reduction in the size of state table entries. - Source-tracking (limit number of clients and states per client). - Sticky-address (the flexibility of round-robin with the benefits of source-hash). - Significant improvements to interface handling. - and many more ... Notes: svn path=/head/; revision=130613
* Make pf* modules respect NOINET6 from make.conf(5) in order to build themMax Laier2004-04-061-0/+4
| | | | | | | | | | for INET6-less kernel. Requested by: many Approved by: bms(mentor) Notes: svn path=/head/; revision=127946
* Tweak existing header and other build infrastructure to be able to buildMax Laier2004-02-261-0/+30
pf/pflog/pfsync as modules. Do not list them in NOTES or modules/Makefile (i.e. do not connect it to any (automatic) builds - yet). Approved by: bms(mentor) Notes: svn path=/head/; revision=126263
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-11 23:58:47 +0000