summaryrefslogtreecommitdiff
path: root/sys/external/bsd/ipf
AgeCommit message (Collapse)Author
2023-06-24Fix typo in comment.msaitoh
2023-02-03Fix use after free on packet with broken lengthschristos
Under the scenario with a packet with length of 67 bytes, a header length using the default of 20 bytes and a TCP data offset (th_off) of 48 will cause m_pullup() to fail to make sure bytes are arranged contiguously. m_pullup() will free the mbuf chain and return a null. ipfilter stores the resultant mbuf address (or the resulting NULL) in its fr_info_t structure. Unfortunately the erroneous packet is not flagged for drop. From FreeBSD via CY Schubert; originally reported by: Robert Morris <rtm at lcs.mit.edu>
2022-09-02Remove unnecessary inclusion of <net/netisr.h>.thorpej
2022-05-07remove conditional code that defines members of natstat_t.mrg
kernels without INET6 support end up with a different size of this structure than the userland does and then it errors: # ipnat -l 70:ioctl(SIOCGNATS) object size mismatch for copying out ipfobj with these members (which are zeroed at ipf init) enabled, the size check works. XXX: pullup-9 (change tested there.)
2022-03-28driver(9): devsw_detach never fails. Make it return void.riastradh
Prune a whole lotta dead branches as a result of this. (Some logic calling this is also wrong for other reasons; devsw_detach is final -- you should never have any reason to decide to roll it back. To be cleaned up in subsequent commits...) XXX kernel ABI change to devsw_detach signature requires bump
2022-02-02s/Incluse/Include/msaitoh
2021-12-05s/recusive/recursive/ in comment.msaitoh
2021-12-05s/imples/implies/ in comment.msaitoh
2021-09-21don't opencode kauth_cred_get()christos
2021-05-26Fix ip_nat memory leak and use-after-free, wrong element freed (Cy Schubert)christos
https://cgit.freebsd.org/src/commit/?id=323a4e2c4e285e6f8eee8db3fe2cb74
2021-03-08Adjust for fewer args in calling functionschristos
2021-02-10From Cy Schubert:christos
ipfilter: Use the softn (NAT softc) host map size in ip_nat6 calculation. The ipfilter NAT table host map size is a tunable that defaults to a macro value defined at build time. HOSTMAP_SIZE is saved in softn (the ipnat softc) at initialization. It can be tuned (changed) at runtime using the ipf -T command. If the hostmap_size tunable is adjusted the calculation to determine where to put new entries in the table was incorrect. Use the tunable in the NAT softc instead of the static build time value.
2020-08-01Remove #ifdef BRIDGE_IPF, compile in the code by default. Sent tomaxv
tech-net@.
2020-06-24reduce stack usage in ipf_nat_ioctl()jdolecek
also, in SIOCADNAT, make sure to not leak kernel data
2020-06-12ipfilter: Prepare for life without in kernel RAroy
2020-04-18be consistent about byte flipping (cosmetic no functional change)christos
2020-04-09PR/55149: Kouichi Hashikawa: Get morefrag before we strip it out from offchristos
2020-04-05PR/55137: Kouichi Hashikawa: ipfstat -f incorrect outputchristos
- make sure frag is initialized to 0 - initialize ipfr_p field
2020-04-05PR/55137: Kouichi Hashikawa: ipfstat -f incorrect outputchristos
Fix incorrect byte order.
2020-02-21Explicitly cast pointers to uintptr_t before casting to enums. They arejoerg
not necessarily the same size. Don't cast pointers to bool, check for NULL instead.
2019-11-11revert rev 1.7 (which removed the fd_local field from frdest_t).chs
this structure is part of the kernel/user ABI and so we would need to version the ioctl ABI again in order to remove this field. but that's a big pain so let's just leave the field there. the problem that was being fixed in FreeBSD related to this was a failure to locate filter rules in certain situations, but having an unused always-zero field there won't cause that problem.
2019-09-30fix double space in commentbouyer
2019-09-30Fix 2 bugs, reported by Edgar Fuß on tech-net@bouyer
- pfil_run_hooks() can be called recursively, so we have to #define FASTROUTE_RECURSION in fil.c - ip6_if_output()/nd6_output() will free the mbuf on error, to make sure to set *mpp to NULL so the caller won't try to free it again.
2019-08-08PR/54443: Edgar Fuß: ip mistakenly regards UDP packet with checksum fieldchristos
0xffff as bad
2019-06-28Revert previous and do the off == 1 case after we've taken the mask.christos
2019-06-26Conform to RFC 3128 by dropping TCP fragments with offset = 1.christos
In addition to dropping these fragments, add a DTrace probe to allow for more detailed monitoring and diagnosis if required. From FreeBSD r349399, reported vy Cy Schubert
2019-06-26Remove fd_local, it is not used, from FreeBSD r349401, reported by Cy Schubertchristos
2019-06-26Remove redundant off != 0 check, from FreeBSD r349400, reported by Cy Schubertchristos
2019-02-04add fallthru comments.mrg
2018-08-10Fix compilation of PF/IPF...maxv
2018-08-10Renamemaxv
ip6_undefer_csum -> in6_undefer_cksum in6_delayed_cksum -> in6_undefer_cksum_tcpudp The two previous names were inconsistent and misleading. Put the two functions into in6_offload.c. Add comments to explain what we're doing. Same as IPv4.
2018-07-11Renamemaxv
ip_undefer_csum -> in_undefer_cksum in_delayed_cksum -> in_undefer_cksum_tcpudp The two previous names were inconsistent and misleading. Put the two functions into in_offload.c. Add comments to explain what we're doing. The same could be done for IPv6.
2018-06-03Constify a bunch of global varialbes under ipf/ so that they land inmaxv
.rodata (3472 bytes). Also, remove ipf_tuneables[], unused.
2018-05-03Remove now unused tcpip.h includes. Some were already unused before.maxv
2018-05-03Remove m_copy completely.maxv
2018-05-01Remove unused alias to tcpiphdr.maxv
2018-02-08updates for GCC 6:mrg
- frentry_4_1_0_to_current() has duplicated code section, found via the indent checker. didn't setup a test to confirm the bug/fix, but the other 2 similar functions are similar here now.
2018-02-04apply __attribute__((__used__)) for rcsid, etc.mrg
2017-10-12put back the cast.christos
2017-10-12When growing the state, remember to grow the seed array, otherwise we'll endchristos
up accessing memory we did not allocate.
2017-09-05Revert changing the byte order of fi->fi_addr. It is already correct. Fromchristos
Timo Buhrmester XXX: pullup 8.
2017-07-23use the scoping functions (JINMEI, Tatuya)christos
2017-07-23From Edgar Fuss:christos
ipf's return-icmp doesn't work when the packet matched by the rule is directed at a link local address. The problem is that ipf_send_icmp_err() calls ipf_ifpaddr() to find an address of the interface in question, but that routine discards link local addresses. I guess the best fix is to simply use the destination address instead if it is link local, i.e. treat the rule as if return-icmp-as-dest was given in this case.
2017-07-20Fix ipf failing to sent TCP RST's on link-local interfaces by stuffingchristos
the scope KAME style before calling the routing routines instead of after. From Edgar Fuss.
2017-07-01Typokhorben
2017-05-12Call the right filter function for hook removal found by Stephen Borrill.christos
2017-04-23Disconnect maintaining fragment state from keeping session state. The userchristos
now must specify keep frags along with keep state to have ipfilter do what it did before, as documented in ipf.conf.5. (Cy Schubert @ FreeBSD)
2017-04-23Free the right fragment (Cy Schubert @ FreeBSD). This will cause use after freechristos
issues and eventually panic.
2017-02-14Do ND in L2_output in the same manner as arpresolveozaki-r
The benefits of this change are: - The flow is consistent with IPv4 (and FreeBSD and OpenBSD) - old: ip6_output => nd6_output (do ND if needed) => L2_output (lookup a stored cache) - new: ip6_output => L2_output (lookup a cache. Do ND if cache not found) - We can remove some workarounds in nd6_output - We can move L2 specific operations to their own place - The performance slightly improves because one cache lookup is reduced
2017-01-13Don't play with the linked list while holding only a read lock!christos