CVS log for src/sys/external/bsd/ipf/netinet/fil.c

Up to [cvs.NetBSD.org] / src / sys / external / bsd / ipf / netinet

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Fix typo in comment.

Fix use after free on packet with broken lengths

Under the scenario with a packet with length of 67 bytes, a header length
using the default of 20 bytes and a TCP data offset (th_off) of 48 will
cause m_pullup() to fail to make sure bytes are arranged contiguously.
m_pullup() will free the mbuf chain and return a null. ipfilter stores
the resultant mbuf address (or the resulting NULL) in its fr_info_t
structure. Unfortunately the erroneous packet is not flagged for drop.
From FreeBSD via CY Schubert; originally reported by: Robert Morris
<rtm at lcs.mit.edu>

s/recusive/recursive/ in comment.

s/imples/implies/ in comment.

Sync with HEAD

Mostly merge changes from HEAD upto 20200411

Pull up following revision(s) (requested by christos in ticket #827):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.32
	sys/external/bsd/ipf/netinet/fil.c: revision 1.33
	sys/external/bsd/ipf/netinet/ip_frag.c: revision 1.8

PR/55137: Kouichi Hashikawa: ipfstat -f incorrect output
Fix incorrect byte order.

PR/55137: Kouichi Hashikawa: ipfstat -f incorrect output
- make sure frag is initialized to 0
- initialize ipfr_p field

PR/55149: Kouichi Hashikawa: Get morefrag before we strip it out from off

PR/55149: Kouichi Hashikawa: Get morefrag before we strip it out from off

Merge changes from current as of 20200406

PR/55137: Kouichi Hashikawa: ipfstat -f incorrect output
Fix incorrect byte order.

Pull up following revision(s) (requested by bouyer in ticket #1399):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.31
	sys/external/bsd/ipf/netinet/ip_fil_netbsd.c: revision 1.32
	sys/external/bsd/ipf/netinet/ip_fil_netbsd.c: revision 1.33

Fix 2 bugs, reported by Edgar Fuss on tech-net@
- pfil_run_hooks() can be called recursively, so we have to
  #define FASTROUTE_RECURSION in fil.c
- ip6_if_output()/nd6_output() will free the mbuf on error, to make sure
  to set *mpp to NULL so the caller won't try to free it again.

fix double space in comment

Pull up following revision(s) (requested by bouyer in ticket #274):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.31
	sys/external/bsd/ipf/netinet/ip_fil_netbsd.c: revision 1.32
	sys/external/bsd/ipf/netinet/ip_fil_netbsd.c: revision 1.33

Fix 2 bugs, reported by Edgar Fuss on tech-net@
- pfil_run_hooks() can be called recursively, so we have to
  #define FASTROUTE_RECURSION in fil.c
- ip6_if_output()/nd6_output() will free the mbuf on error, to make sure
  to set *mpp to NULL so the caller won't try to free it again.

fix double space in comment

Fix 2 bugs, reported by Edgar Fuß on tech-net@
- pfil_run_hooks() can be called recursively, so we have to
  #define FASTROUTE_RECURSION in fil.c
- ip6_if_output()/nd6_output() will free the mbuf on error, to make sure
  to set *mpp to NULL so the caller won't try to free it again.

Pull up following revision(s) (requested by christos in ticket #1701):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.30

PR/54443: Edgar Fu�: ipf mistakenly regards UDP packet with checksum field
0xffff as bad

Pull up following revision(s) (requested by christos in ticket #1331):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.30

PR/54443: Edgar Fu�: ipf mistakenly regards UDP packet with checksum field
0xffff as bad

Pull up following revision(s) (requested by christos in ticket #40):

	sys/external/bsd/ipf/netinet/fil.c: revision 1.30

PR/54443: Edgar Fu�: ipf mistakenly regards UDP packet with checksum field
0xffff as bad

PR/54443: Edgar Fuß: ip mistakenly regards UDP packet with checksum field
0xffff as bad

Revert previous and do the off == 1 case after we've taken the mask.

Conform to RFC 3128 by dropping TCP fragments with offset = 1.
In addition to dropping these fragments, add a DTrace probe to allow
for more detailed monitoring and diagnosis if required.
From FreeBSD r349399, reported vy Cy Schubert

Remove fd_local, it is not used, from FreeBSD r349401, reported by Cy Schubert

Remove redundant off != 0 check, from FreeBSD r349400, reported by Cy Schubert

Sync with HEAD

add fallthru comments.

Pull up the following, requested by sevan in ticket #1144:

	sys/external/bsd/ipf/netinet/fil.c	1.22

accidently commited to HEAD by mrg with a very misleading log message and
a bunch of unrelated changes - but really:

fix missing braces around a block (detected by newer gcc's indentation
checks).

Sync with HEAD

Rename

	ip_undefer_csum  -> in_undefer_cksum
	in_delayed_cksum -> in_undefer_cksum_tcpudp

The two previous names were inconsistent and misleading.

Put the two functions into in_offload.c. Add comments to explain what
we're doing.

The same could be done for IPv6.

Sync with HEAD

Constify a bunch of global varialbes under ipf/ so that they land in
.rodata (3472 bytes).

Also, remove ipf_tuneables[], unused.

apply __attribute__((__used__)) for rcsid, etc.

update from HEAD

Pull up following revision(s) (requested by christos in ticket #283):
	sys/external/bsd/ipf/netinet/fil.c: revision 1.21
Revert changing the byte order of fi->fi_addr. It is already correct. From
Timo Buhrmester

Revert changing the byte order of fi->fi_addr. It is already correct. From
Timo Buhrmester
XXX: pullup 8.

Sync with HEAD

Pull up following revision(s) (requested by mrg in ticket #1412):
	sys/external/bsd/ipf/netinet/fil.c: revision 1.20
	sys/external/bsd/ipf/netinet/ip_frag.c: revision 1.5
	sys/external/bsd/ipf/netinet/ip_state.c: revision 1.7
Disconnect maintaining fragment state from keeping session state. The user
now must specify keep frags along with keep state to have ipfilter do what
it did before, as documented in ipf.conf.5. (Cy Schubert @ FreeBSD)
--
Free the right fragment (Cy Schubert @ FreeBSD). This will cause use after free
issues and eventually panic.

Pull up the following revisions(s) (requested by christos in ticket #1412):
	sys/external/bsd/ipf/netinet/fil.c:		revision 1.20
	sys/external/bsd/ipf/netinet/ip_state.c:	revision 1.7
	sys/external/bsd/ipf/netinet/ip_frag.c:		revision 1.5

Disconnect maintaining fragment state from keeping session state. The user
now must specify keep frags along with keep state to have ipfilter do what
it did before, as documented in ipf.conf.5.
Free the right fragment. This will cause use after free issues and eventually
panic.

Pull up the following revisions(s) (requested by christos in ticket #1412):
	sys/external/bsd/ipf/netinet/fil.c:		revision 1.20
	sys/external/bsd/ipf/netinet/ip_state.c:	revision 1.7
	sys/external/bsd/ipf/netinet/ip_frag.c:		revision 1.5

Disconnect maintaining fragment state from keeping session state. The user
now must specify keep frags along with keep state to have ipfilter do what
it did before, as documented in ipf.conf.5.
Free the right fragment. This will cause use after free issues and eventually
panic.

Sync with HEAD

Disconnect maintaining fragment state from keeping session state. The user
now must specify keep frags along with keep state to have ipfilter do what
it did before, as documented in ipf.conf.5. (Cy Schubert @ FreeBSD)

Sync with HEAD

Sync with HEAD

partial sync with FreeBSD

Pull up following revision(s) (requested by christos in ticket #1152):
	sys/external/bsd/ipf/netinet/fil.c: revision 1.17
Comment out the mutex calls that protect against concurrent configuration
changes and processing. This needs to be done differently since you can't
sleep during interrupt processing.

We don't need this in /current because packet processing does not happen in
an interrupt anymore (pointed out by ozaki@)

Comment out the mutex calls that protect against concurrent configuration
changes and processing. This needs to be done differently since you can't
sleep during interrupt processing.

Pull up following revision(s) (requested by khorben in ticket #671):
	external/bsd/ipf/dist/lib/interror.c: revision 1.4
	sys/external/bsd/ipf/netinet/fil.c: revision 1.16
Fix for PR kern/48109 (and its duplicate kern/49807)
As provided by Takahiro HAYASHI in PR kern/48109. Additional error
registration in ipf(8) by myself. Changes tested with GENERIC and
XEN3_DOM0. Thanks!

Sync with HEAD

Fix for PR kern/48109 (and its duplicate kern/49807)

As provided by Takahiro HAYASHI in PR kern/48109. Additional error
registration in ipf(8) by myself. Changes tested with GENERIC and
XEN3_DOM0. Thanks!

XXX pull-up netbsd-7

Rebase to HEAD as of a few days ago.

Rebase.

Darren Reed: #550 filter rule list corrupted with inserted rules

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

kill sprintf

CID 976267: NULL deref check

Add bpf_filter_ext() to use with BPF COP, restore bpf_filter() as it was
originally to preserve compatibility.  Similarly, add bpf_validate_ext()
which takes bpf_ctx_t.

Remove unused variable

bpf_filter: add a custom argument which can be passed to coprocessor routine.

Implement BPF_COP/BPF_COPX instructions in the misc category (BPF_MISC)
which add a capability to call external functions in a predetermined way.

It can be thought as a BPF "coprocessor" -- a generic mechanism to offload
more complex packet inspection operations.  There is no default coprocessor
and this functionality is not targeted to the /dev/bpf.  This is primarily
targeted to the kernel subsystems, therefore there is no way to set a custom
coprocessor at the userlevel.

Discussed on: tech-net@
OK: core@

resync with head

sync with head

Back out my last change, which was a partial fix for hash code computation problems.
Apply Darren's more complete reworking of hash code computation.
Ensure that the struct containing the red-black tree head is properly initialized.
From Geoff Adams

- Replace the seemingly broken built-in ipf rbtree implementation with ours.
- Fix typos in comments
- Fix 2 mutex errors
From Geoff Adams

Resync to 2012-11-19 00:00:00 UTC

sync with head

remove wrong ntohl (from Aran Clauson)

ansify new function definition

ansify new functio definitions

Merge IPFilter 5.1.2 into HEAD

Import IPFilter 5.1.2

Re-add new ipf on the jmcneill-usbmp branch.

sync with head

file fil.c was added on branch yamt-pagecache on 2012-04-17 00:08:15 +0000

file fil.c was added on branch jmcneill-usbmp on 2012-04-17 19:25:17 +0000

apply our changes.
- prototypes
- ip_h323_pxy.c is missing from the distribution
- original tar distribution is missing <$>Id values in most files

import kernel portion of ipfilter 5.1.1

Initial revision