summaryrefslogtreecommitdiff
path: root/sys/dist
AgeCommit message (Collapse)Author
2013-10-20fix compiler warningschristos
2013-07-01PFIL_HOOKS is dead.skrll
2013-06-30Fix pf module build. Adjust pfil_remove_hook 3rd arguments.njoly
2013-06-30Update pf to pfil(9) changes. Missed in previous commit.rmind
2012-09-15IPF 5.1.2 is in external/bsd/ipf and sys/external/bsd/ipf now;plunky
these files are obsolete
2012-03-22remove KAME IPSEC, replaced by FAST_IPSECdrochner
2012-02-15Back out the recent import of IPFilter 5.1.1 for the upcoming branch,riz
which will now have IPFilter 4.1.34. IPFilter 5.1.1 will be restored post-branch. ok: core, releng.
2012-02-09PR kern/45929darrenr
ipnat does not remove rules with -r
2012-02-01PR kern/45907darrenr
#ifdef USE_INET6 guards are missing around IPv6 code
2012-02-01ansifychristos
2012-02-01Don't refer to ipf_log_soft_destroy(), ipf_log_soft_create(),he
ipf_log_soft_init(), and ipf_log_soft_fini() unless IPFILTER_LOG is defined, since ipf_log.c won't be built unless that flag is defined, ref. sys/netinet/files.ipfilter.
2012-02-01Don't forward-declare ipf_dolog unless IPFILTER_LOG is defined,he
since its implementation is under that ifdef.
2012-02-01ansifychristos
2012-01-31PR bin/45894darrenr
ipftest core dumps when running tests
2012-01-30fix printf formatschristos
2012-01-30Initialize "match", it may be used uninitialized, and gcc complainsmartin
about it.
2012-01-30Merge IPFilter 5.1.1 into HEADdarrenr
2012-01-30Import IPFilter 5.1.1darrenr
2012-01-11protect "union sockaddr_union" from being defined twice by a CPP symboldrochner
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf
2011-12-19do missing ipsec->kame_ipsec renamesdrochner
2011-12-17Separate /dev/random pseudodevice implemenation from kernel entropy pooltls
implementation. Rewrite pseudodevice code to use cprng_strong(9). The new pseudodevice is cloning, so each caller gets bits from a stream generated with its own key. Users of /dev/urandom get their generators keyed on a "best effort" basis -- the kernel will rekey generators whenever the entropy pool hits the high water mark -- while users of /dev/random get their generators rekeyed every time key-length bits are output. The underlying cprng_strong API can use AES-256 or AES-128, but we use AES-128 because of concerns about related-key attacks on AES-256. This improves performance (and reduces entropy pool depletion) significantly for users of /dev/urandom but does cause users of /dev/random to rekey twice as often. Also fixes various bugs (including some missing locking and a reseed-counter overflow in the CTR_DRBG code) found while testing this. For long reads, this generator is approximately 20 times as fast as the old generator (dd with bs=64K yields 53MB/sec on 2Ghz Core2 instead of 2.5MB/sec) and also uses a separate mutex per instance so concurrency is greatly improved. For reads of typical key sizes for modern cryptosystems (16-32 bytes) performance is about the same as the old code: a little better for 32 bytes, a little worse for 16 bytes.
2011-11-28Remove arc4random() and arc4randbytes() from the kernel API. Replacetls
arc4random() hacks in rump with stubs that call the host arc4random() to get numbers that are hopefully actually random (arc4random() keyed with stack junk is not). This should fix some of the currently failing anita tests -- we should no longer generate duplicate "random" MAC addresses in the test environment.
2011-11-27Typo.mbalmer
2011-11-19First step of random number subsystem rework described intls
<20111022023242.BA26F14A158@mail.netbsd.org>. This change includes the following: An initial cleanup and minor reorganization of the entropy pool code in sys/dev/rnd.c and sys/dev/rndpool.c. Several bugs are fixed. Some effort is made to accumulate entropy more quickly at boot time. A generic interface, "rndsink", is added, for stream generators to request that they be re-keyed with good quality entropy from the pool as soon as it is available. The arc4random()/arc4randbytes() implementation in libkern is adjusted to use the rndsink interface for rekeying, which helps address the problem of low-quality keys at boot time. An implementation of the FIPS 140-2 statistical tests for random number generator quality is provided (libkern/rngtest.c). This is based on Greg Rose's implementation from Qualcomm. A new random stream generator, nist_ctr_drbg, is provided. It is based on an implementation of the NIST SP800-90 CTR_DRBG by Henric Jungheim. This generator users AES in a modified counter mode to generate a backtracking-resistant random stream. An abstraction layer, "cprng", is provided for in-kernel consumers of randomness. The arc4random/arc4randbytes API is deprecated for in-kernel use. It is replaced by "cprng_strong". The current cprng_fast implementation wraps the existing arc4random implementation. The current cprng_strong implementation wraps the new CTR_DRBG implementation. Both interfaces are rekeyed from the entropy pool automatically at intervals justifiable from best current cryptographic practice. In some quick tests, cprng_fast() is about the same speed as the old arc4randbytes(), and cprng_strong() is about 20% faster than rnd_extract_data(). Performance is expected to improve. The AES code in src/crypto/rijndael is no longer an optional kernel component, as it is required by cprng_strong, which is not an optional kernel component. The entropy pool output is subjected to the rngtest tests at startup time; if it fails, the system will reboot. There is approximately a 3/10000 chance of a false positive from these tests. Entropy pool _input_ from hardware random numbers is subjected to the rngtest tests at attach time, as well as the FIPS continuous-output test, to detect bad or stuck hardware RNGs; if any are detected, they are detached, but the system continues to run. A problem with rndctl(8) is fixed -- datastructures with pointers in arrays are no longer passed to userspace (this was not a security problem, but rather a major issue for compat32). A new kernel will require a new rndctl. The sysctl kern.arandom() and kern.urandom() nodes are hooked up to the new generators, but the /dev/*random pseudodevices are not, yet. Manual pages for the new kernel interfaces are forthcoming.
2011-08-30fix -Wshadow warnings when ALTQ is enabledjmcneill
2011-08-29build pf module with WARNS=3, and remove the need for -Wno-shadowjmcneill
2011-07-01fix an uninitialised variable problem. large-ish function, but imrg
couldn't see how GCC 4.5 isn't wrong about this one.
2011-05-18remove unused expressiondrochner
2011-05-11Commit the patch fromhauke
<http://mail-index.netbsd.org/current-users/2010/09/12/msg014289.html>, fixing a "panic: pool 'pfrktable' is IPL_NONE, but called from interrupt context" that occurred on NetBSD/sparc.
2011-05-03Reduces the resources demanded by TCP sessions in TIME_WAIT-state usingdyoung
methods called Vestigial Time-Wait (VTW) and Maximum Segment Lifetime Truncation (MSLT). MSLT and VTW were contributed by Coyote Point Systems, Inc. Even after a TCP session enters the TIME_WAIT state, its corresponding socket and protocol control blocks (PCBs) stick around until the TCP Maximum Segment Lifetime (MSL) expires. On a host whose workload necessarily creates and closes down many TCP sockets, the sockets & PCBs for TCP sessions in TIME_WAIT state amount to many megabytes of dead weight in RAM. Maximum Segment Lifetimes Truncation (MSLT) assigns each TCP session to a class based on the nearness of the peer. Corresponding to each class is an MSL, and a session uses the MSL of its class. The classes are loopback (local host equals remote host), local (local host and remote host are on the same link/subnet), and remote (local host and remote host communicate via one or more gateways). Classes corresponding to nearer peers have lower MSLs by default: 2 seconds for loopback, 10 seconds for local, 60 seconds for remote. Loopback and local sessions expire more quickly when MSLT is used. Vestigial Time-Wait (VTW) replaces a TIME_WAIT session's PCB/socket dead weight with a compact representation of the session, called a "vestigial PCB". VTW data structures are designed to be very fast and memory-efficient: for fast insertion and lookup of vestigial PCBs, the PCBs are stored in a hash table that is designed to minimize the number of cacheline visits per lookup/insertion. The memory both for vestigial PCBs and for elements of the PCB hashtable come from fixed-size pools, and linked data structures exploit this to conserve memory by representing references with a narrow index/offset from the start of a pool instead of a pointer. When space for new vestigial PCBs runs out, VTW makes room by discarding old vestigial PCBs, oldest first. VTW cooperates with MSLT. It may help to think of VTW as a "FIN cache" by analogy to the SYN cache. A 2.8-GHz Pentium 4 running a test workload that creates TIME_WAIT sessions as fast as it can is approximately 17% idle when VTW is active versus 0% idle when VTW is inactive. It has 103 megabytes more free RAM when VTW is active (approximately 64k vestigial PCBs are created) than when it is inactive.
2011-03-05Use %zu for size_t in debugging printf.jakllsch
2011-02-24avoid #ifdef/#endif inside sprint() argument list, as with USE_FORT=yesplunky
sprint becomes a macro
2011-02-12Add 1 to the port range so the range is inclusive as documented.christos
2011-02-12PR/44070: Avoid zero divide in modulo operations.christos
2011-01-19make sure the "overload_tbl" member of "struct pf_rule" copied indrochner
from userland is initialized (it is used by the kernel only) fixes crash or data injection (CVE-2010-3830), usually by root user only OpenBSD has rewritten the code to start with a zero'd struct and fills in needed parts only - to be considered in case a newer pf version is imported.
2010-11-05ip_randomid: make mechanism MP-safe and more modular.rmind
OK matt@
2010-09-05Fix mbuf corruption when sending ICMP errors for blocked IPv6mlelstv
packets due to wrong buffer size computations. The corrupted mbufs could lead to a panic. Fix computation of link mtu where the link mtu itself is unspecified. Limit ICMP error packets for IPv6 to MMTU as required by RFC4443. This also avoids dropped errors when the length exceeds the link mtu.
2010-08-11Revert previous - changes here are irrelevant to NetBSDpgoyette
Need more caffeine.
2010-08-11Keep condvar wmesg's within 8-char limit.pgoyette
2010-06-01handle STDC and GNUC inline semantic differences by providing andplunky
using an EXTERN_INLINE definition for functions that are defined as inline but provide an externally callable reference. (these are externally called in ipftest)
2010-05-07Add support for pfs(8)degroote
pfs(8) is a tool similar to ipfs(8) but for pf(4). It allows the admin to dump internal configuration of pf, and restore at a latter point, after a maintenance reboot for example, in a transparent way for user. This work has been done mostly during my GSoC 2009 No objections on tech-net@
2010-04-17clean up compile time warnings to due caddr_t and empty statementsdarrenr
2010-04-17New file for 4.1.34 that is in src/dist/ipf but not src/sys/dist/ipf/netinetdarrenr
2010-04-17Commit IPFilter 4.1.34 to HEADdarrenr
2010-04-13Do not unload pf when enabled, not even manually.ahoka
2010-04-13change module class to driver.ahoka
2010-04-13Do not auto unload pf if it's enabled.ahoka
2010-04-12- Make the pf and pflog driver able to detach.ahoka
- Add code for module support. Original patch from Jared McNeill
2010-04-12Spello in comment.skrll
2010-04-05Push the bpf_ops usage back into bpf.h. Push the common ifp->if_bpfjoerg
check into the inline functions as well the fourth argument for bpf_attach.