aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet/ipfw
Commit message (Collapse)AuthorAgeFilesLines
...
* remove a leftover debugging messageLuigi Rizzo2010-03-291-1/+0
| | | | Notes: svn path=/head/; revision=205831
* Fix handling of set manipulations.Luigi Rizzo2010-03-291-25/+36
| | | | | | | | | | This patch has two fixes for potential kernel panics (one wrong index, one access to the wrong lock) and two fixes to wrong logic in a conditional. The potential panics are also on stable/8, so I am going to MFC the fix quickly. Notes: svn path=/head/; revision=205830
* Honor ip.fw.one_pass when a packet comes out of a pipe without being delayed.Luigi Rizzo2010-03-241-1/+5
| | | | | | | | | I forgot to handle this case when i did the mtag cleanup three months ago. PR: 145004 Notes: svn path=/head/; revision=205602
* Add a priority-based packet scheduler.Luigi Rizzo2010-03-212-1/+231
| | | | | | | | Sponsored by: The ONELAB2 Project Submitted by: Riccardo Panicucci Notes: svn path=/head/; revision=205417
* no need for ipfw_flush_tables(), we just need ipfw_destroy_tables()Luigi Rizzo2010-03-212-18/+6
| | | | Notes: svn path=/head/; revision=205415
* revise documentationLuigi Rizzo2010-03-211-2/+21
| | | | Notes: svn path=/head/; revision=205414
* small fixes to estimate the buffer size when requesting all pipes/flows.Luigi Rizzo2010-03-151-5/+9
| | | | Notes: svn path=/head/; revision=205178
* + implement (two lines) the kernel side of 'lookup dscp N' to use theLuigi Rizzo2010-03-156-33/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dscp as a search key in table lookups; + (re)implement a sysctl variable to control the expire frequency of pipes and queues when they become empty; + add 'queue number' as optional part of the flow_id. This can be enabled with the command queue X config mask queue ... and makes it possible to support priority-based schedulers, where packets should be grouped according to the priority and not some fields in the 5-tuple. This is implemented as follows: - redefine a field in the ipfw_flow_id (in sys/netinet/ip_fw.h) but without changing the size or shape of the structure, so there are no ABI changes. On passing, also document how other fields are used, and remove some useless assignments in ip_fw2.c - implement small changes in the userland code to set/read the field; - revise the functions in ip_dummynet.c to manipulate masks so they also handle the additional field; There are no ABI changes in this commit. Notes: svn path=/head/; revision=205173
* implement listing of a subset of pipes/queues/schedulers.Luigi Rizzo2010-03-112-63/+147
| | | | | | | | The filtering of the output is done in the kernel instead of userland to reduce the amount of data transfered. Notes: svn path=/head/; revision=205050
* fix handling of commands issued by RELENG_7 version of /sbin/ipfw,Luigi Rizzo2010-03-102-2/+4
| | | | | | | Submitted by: Riccardo Panicucci Notes: svn path=/head/; revision=204954
* cosmetic changes and C++ compatibilityLuigi Rizzo2010-03-081-0/+18
| | | | Notes: svn path=/head/; revision=204866
* don't use C++ keywords as variable namesLuigi Rizzo2010-03-082-8/+8
| | | | Notes: svn path=/head/; revision=204865
* do not report an error unnecessarilyLuigi Rizzo2010-03-081-0/+1
| | | | Notes: svn path=/head/; revision=204862
* Not only flush the ipfw tables when unloading ipfw or tearingBjoern A. Zeeb2010-03-073-1/+17
| | | | | | | | | | | down a virtual netowrk stack, but also free the Radix Node Head. Sponsored by: ISPsystem Reviewed by: julian MFC after: 5 days Notes: svn path=/head/; revision=204837
* plug a memory leak on pipe's reconfigurationLuigi Rizzo2010-03-051-20/+29
| | | | Notes: svn path=/head/; revision=204763
* fix a memory leak when deleting RED queuesLuigi Rizzo2010-03-051-0/+6
| | | | Notes: svn path=/head/; revision=204754
* portability fixesLuigi Rizzo2010-03-042-2/+17
| | | | Notes: svn path=/head/; revision=204736
* don't use keywords as variable names.Luigi Rizzo2010-03-041-7/+7
| | | | Notes: svn path=/head/; revision=204735
* use callout_drain() (outside the lock) when unloading the module.Luigi Rizzo2010-03-041-4/+7
| | | | | | | | | This prevents a potential deadlock. Submitted by: Francesco Magno Notes: svn path=/head/; revision=204714
* improve compatibility with RELENG_7.2Luigi Rizzo2010-03-041-0/+14
| | | | Notes: svn path=/head/; revision=204713
* Bring in the most recent version of ipfw and dummynet, developedLuigi Rizzo2010-03-0225-1953/+8667
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and tested over the past two months in the ipfw3-head branch. This also happens to be the same code available in the Linux and Windows ports of ipfw and dummynet. The major enhancement is a completely restructured version of dummynet, with support for different packet scheduling algorithms (loadable at runtime), faster queue/pipe lookup, and a much cleaner internal architecture and kernel/userland ABI which simplifies future extensions. In addition to the existing schedulers (FIFO and WF2Q+), we include a Deficit Round Robin (DRR or RR for brevity) scheduler, and a new, very fast version of WF2Q+ called QFQ. Some test code is also present (in sys/netinet/ipfw/test) that lets you build and test schedulers in userland. Also, we have added a compatibility layer that understands requests from the RELENG_7 and RELENG_8 versions of the /sbin/ipfw binaries, and replies correctly (at least, it does its best; sometimes you just cannot tell who sent the request and how to answer). The compatibility layer should make it possible to MFC this code in a relatively short time. Some minor glitches (e.g. handling of ipfw set enable/disable, and a workaround for a bug in RELENG_7's /sbin/ipfw) will be fixed with separate commits. CREDITS: This work has been partly supported by the ONELAB2 project, and mostly developed by Riccardo Panicucci and myself. The code for the qfq scheduler is mostly from Fabio Checconi, and Marta Carbone and Francesco Magno have helped with testing, debugging and some bug fixes. Notes: svn path=/head/; revision=204591
* remove recursive lock/unlock calls, we do them already before enteringLuigi Rizzo2010-02-171-6/+0
| | | | | | | | | the switch. Reported by: Marta Carbone Notes: svn path=/head/; revision=204003
* Change 'me' to match any IPv6 address configured on an interface inHajimu UMEMOTO2010-01-171-8/+14
| | | | | | | | | | the system as well as any IPv4 address. Reviewed by: David Horn <dhorn2000__at__gmail.com>, luigi, qingli MFC after: 2 weeks Notes: svn path=/head/; revision=202459
* we don't use dummynet_drain!Luigi Rizzo2010-01-071-32/+5
| | | | Notes: svn path=/head/; revision=201745
* check that we have an ipv4 packet before swapping ip_len and ip_off.Luigi Rizzo2010-01-071-2/+3
| | | | | | | | | | This should fix the handling of ipv6 packets which i broke when i made ipfw operate on packets in network format. Reported by: Hajimu UMEMOTO Notes: svn path=/head/; revision=201740
* Following up on a request from Ermal Luci to makeLuigi Rizzo2010-01-071-47/+1
| | | | | | | | | | | | | | | | | | | | ip_divert work as a client of pf(4), make ip_divert not depend on ipfw. This is achieved by moving to ip_var.h the struct ipfw_rule_ref (which is part of the mtag for all reinjected packets) and other declarations of global variables, and moving to raw_ip.c global variables for filter and divert hooks. Note that names and locations could be made more generic (ipfw_rule_ref is really a generic reference robust to reconfigurations; the packet filter is not necessarily ipfw; filters and their clients are not necessarily limited to ipv4), but _right now_ most of this stuff works on ipfw and ipv4, so i don't feel like doing a gratuitous renaming, at least for the time being. Notes: svn path=/head/; revision=201735
* some header shuffling to help decoupling ip_divert from ipfwLuigi Rizzo2010-01-075-11/+6
| | | | Notes: svn path=/head/; revision=201732
* put ip_len in correct order for ip_output().Luigi Rizzo2010-01-071-1/+2
| | | | | | | | | | This prevents a panic when ipfw generates packets on its own (such as reject or keepalives for dynamic rules). Reported by: Chagin Dmitry Notes: svn path=/head/; revision=201722
* this file does not require ip_dummynet.hLuigi Rizzo2010-01-051-1/+0
| | | | Notes: svn path=/head/; revision=201568
* Various cleanup done in ipfw3-head branch including:Luigi Rizzo2010-01-048-245/+181
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - use a uniform mtag format for all packets that exit and re-enter the firewall in the middle of a rulechain. On reentry, all tags containing reinject info are renamed to MTAG_IPFW_RULE so the processing is simpler. - make ipfw and dummynet use ip_len and ip_off in network format everywhere. Conversion is done only once instead of tracking the format in every place. - use a macro FREE_PKT to dispose of mbufs. This eases portability. On passing i also removed a few typos, staticise or localise variables, remove useless declarations and other minor things. Overall the code shrinks a bit and is hopefully more readable. I have tested functionality for all but ng_ipfw and if_bridge/if_ethersubr. For ng_ipfw i am actually waiting for feedback from glebius@ because we might have some small changes to make. For if_bridge and if_ethersubr feedback would be welcome (there are still some redundant parts in these two modules that I would like to remove, but first i need to check functionality). Notes: svn path=/head/; revision=201527
* we really need htonl() here, see the comment a few lines above in the code.Luigi Rizzo2009-12-291-1/+1
| | | | Notes: svn path=/head/; revision=201150
* bring the NGM_IPFW_COOKIE back into ng_ipfw.h, libnetgraph expectsLuigi Rizzo2009-12-282-1/+1
| | | | | | | | to find it there. Unfortunately this reintroduces the dependency on ip_fw_pfil.c Notes: svn path=/head/; revision=201124
* bring in several cleanups tested in ipfw3-head branch, namely:Luigi Rizzo2009-12-288-433/+286
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r201011 - move most of ng_ipfw.h into ip_fw_private.h, as this code is ipfw-specific. This removes a dependency on ng_ipfw.h from some files. - move many equivalent definitions of direction (IN, OUT) for reinjected packets into ip_fw_private.h - document the structure of the packet tags used for dummynet and netgraph; r201049 - merge some common code to attach/detach hooks into a single function. r201055 - remove some duplicated code in ip_fw_pfil. The input and output processing uses almost exactly the same code so there is no need to use two separate hooks. ip_fw_pfil.o goes from 2096 to 1382 bytes of .text r201057 (see the svn log for full details) - macros to make the conversion of ip_len and ip_off between host and network format more explicit r201113 (the remaining parts) - readability fixes -- put braces around some large for() blocks, localize variables so the compiler does not think they are uninitialized, do not insist on precise allocation size if we have more than we need. r201119 - when doing a lookup, keys must be in big endian format because this is what the radix code expects (this fixes a bug in the recently-introduced 'lookup' option) No ABI changes in this commit. MFC after: 1 week Notes: svn path=/head/; revision=201122
* readability fixes -- add braces on large blocks, remove unnecessaryLuigi Rizzo2009-12-281-28/+31
| | | | | | | initializations Notes: svn path=/head/; revision=201121
* explain details of operation of table lookups, and improve portabilityLuigi Rizzo2009-12-281-4/+16
| | | | Notes: svn path=/head/; revision=201120
* diverted packet must re-enter _after_ the matching rule,Luigi Rizzo2009-12-271-1/+1
| | | | | | | | | | | or we create loops. The divert cookie (that can be set from userland too) contains the matching rule nr, so we must start from nr+1. Reported by: Joe Marcus Clarke Notes: svn path=/head/; revision=201046
* fix poor indentation resulting from a mergeLuigi Rizzo2009-12-241-14/+14
| | | | Notes: svn path=/head/; revision=200951
* mostly style changes, such as removal of trailing whitespace,Luigi Rizzo2009-12-231-183/+152
| | | | | | | | | | | | | | reformatting to avoid unnecessary line breaks, small block restructuring to avoid unnecessary nesting, replace macros with function calls, etc. As a side effect of code restructuring, this commit fixes one bug: previously, if a realloc() failed, memory was leaked. Now, the realloc is not there anymore, as we first count how much memory we need and then do a single malloc. Notes: svn path=/head/; revision=200909
* fix build with the new fast lookup structure.Luigi Rizzo2009-12-231-79/+56
| | | | | | | Also remove some unnecessary headers Notes: svn path=/head/; revision=200897
* fix build on 64-bit architectures.Luigi Rizzo2009-12-231-15/+15
| | | | | | | Also fix the indentation on a few lines. Notes: svn path=/head/; revision=200896
* merge code from ipfw3-head to reduce contention on the ipfw lockLuigi Rizzo2009-12-226-387/+392
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and remove all O(N) sequences from kernel critical sections in ipfw. In detail: 1. introduce a IPFW_UH_LOCK to arbitrate requests from the upper half of the kernel. Some things, such as 'ipfw show', can be done holding this lock in read mode, whereas insert and delete require IPFW_UH_WLOCK. 2. introduce a mapping structure to keep rules together. This replaces the 'next' chain currently used in ipfw rules. At the moment the map is a simple array (sorted by rule number and then rule_id), so we can find a rule quickly instead of having to scan the list. This reduces many expensive lookups from O(N) to O(log N). 3. when an expensive operation (such as insert or delete) is done by userland, we grab IPFW_UH_WLOCK, create a new copy of the map without blocking the bottom half of the kernel, then acquire IPFW_WLOCK and quickly update pointers to the map and related info. After dropping IPFW_LOCK we can then continue the cleanup protected by IPFW_UH_LOCK. So userland still costs O(N) but the kernel side is only blocked for O(1). 4. do not pass pointers to rules through dummynet, netgraph, divert etc, but rather pass a <slot, chain_id, rulenum, rule_id> tuple. We validate the slot index (in the array of #2) with chain_id, and if successful do a O(1) dereference; otherwise, we can find the rule in O(log N) through <rulenum, rule_id> All the above does not change the userland/kernel ABI, though there are some disgusting casts between pointers and uint32_t Operation costs now are as follows: Function Old Now Planned ------------------------------------------------------------------- + skipto X, non cached O(N) O(log N) + skipto X, cached O(1) O(1) XXX dynamic rule lookup O(1) O(log N) O(1) + skipto tablearg O(N) O(1) + reinject, non cached O(N) O(log N) + reinject, cached O(1) O(1) + kernel blocked during setsockopt() O(N) O(1) ------------------------------------------------------------------- The only (very small) regression is on dynamic rule lookup and this will be fixed in a day or two, without changing the userland/kernel ABI Supported by: Valeria Paoli MFC after: 1 month Notes: svn path=/head/; revision=200855
* some mostly cosmetic changes in preparation for upcoming work:Luigi Rizzo2009-12-224-92/+89
| | | | | | | | | | | | + in many places, replace &V_layer3_chain with a local variable chain; + bring the counter of rules and static_len within ip_fw_chain replacing static variables; + remove some spurious comments and extern declaration; + document which lock protects certain data structures Notes: svn path=/head/; revision=200838
* Added proper attribution.Ruslan Ermilov2009-12-181-1/+1
| | | | | | | Requested by: luigi Notes: svn path=/head/; revision=200673
* Add some experimental code to log traffic with tcpdump,Luigi Rizzo2009-12-173-3/+79
| | | | | | | | | | | | | | | | | | | | | similar to pflog(4). To use the feature, just put the 'log' options on rules you are interested in, e.g. ipfw add 5000 count log .... and run tcpdump -ni ipfw0 ... net.inet.ip.fw.verbose=0 enables logging to ipfw0, net.inet.ip.fw.verbose=1 sends logging to syslog as before. More features can be added, similar to pflog(), to store in the MAC header metadata such as rule numbers and actions. Manpage to come once features are settled. Notes: svn path=/head/; revision=200654
* simplify and document lookup_next_rule()Luigi Rizzo2009-12-171-43/+22
| | | | Notes: svn path=/head/; revision=200634
* simplify the code that finds the next rule after reinjectionsLuigi Rizzo2009-12-171-18/+16
| | | | | | | MFC after: 1 week Notes: svn path=/head/; revision=200629
* remove a duplicate sysctl entryLuigi Rizzo2009-12-161-4/+2
| | | | Notes: svn path=/head/; revision=200610
* bring back a couple of #include that are supplied by nesting,Luigi Rizzo2009-12-162-1/+2
| | | | | | | and explain why they are used. Notes: svn path=/head/; revision=200603
* Various cosmetic cleanup of the files:Luigi Rizzo2009-12-169-143/+183
| | | | | | | | | | | | | | | | | - move global variables around to reduce the scope and make them static if possible; - add an ipfw_ prefix to all public functions to prevent conflicts (the same should be done for variables); - try to pack variable declaration in an uniform way across files; - clarify some comments; - remove some misspelling of names (#define V_foo VNET(bar)) that slipped in due to cut&paste - remove duplicate static variables in different files; MFC after: 1 month Notes: svn path=/head/; revision=200601
* Quick fix to make this compile:Warner Losh2009-12-161-6/+0
| | | | | | | | Remove redundant extern declearations. If the maintainer has a better fix, then feel free to back this out. Notes: svn path=/head/; revision=200598
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-18 10:46:05 +0000