M1: pf.c compiles into pf.ko
This commit is contained in:
lgcosta committed
1 parent
1fcd7b3046
commit
0119e70960
54 files changed
+14853
-96
No files matched your search
+1
-1
@@ -1 +1 @@
|
||||
savedcmd_pf.mod := printf '%s\n' pfsrc/pfk_mod.o pfsrc/pfk_hooks.o compat/pfk_mbuf.o compat/pfk_kern.o compat/pfk_if.o compat/pfk_xmit.o compat/siphash.o compat/toeplitz.o compat/md5.o compat/sha2.o compat/radix.o compat/pfk_rtable.o compat/pfk_ip6.o pfsrc/pf_ruleset.o pfsrc/pf_table.o pfsrc/pf_norm.o pfsrc/pf_if.o pfsrc/pf_lb.o pfsrc/pf_osfp.o pfsrc/pf_syncookies.o pfsrc/pf_ioctl.o pfsrc/pf.o pfsrc/divert_sock.o compat/pfk_ifq.o | awk '!x[$$0]++ { print("./"$$0) }' > pf.mod
|
||||
savedcmd_pf.mod := printf '%s\n' pfsrc/pfk_mod.o pfsrc/pfk_hooks.o compat/pfk_mbuf.o compat/pfk_kern.o compat/pfk_if.o compat/pfk_xmit.o compat/pfk_pcb.o compat/pfk_ip4.o compat/siphash.o compat/toeplitz.o compat/md5.o compat/sha2.o compat/radix.o compat/pfk_rtable.o compat/pfk_ip6.o compat/subr_tree.o pfsrc/pf_ruleset.o pfsrc/pf_table.o pfsrc/pf_norm.o pfsrc/pf_if.o pfsrc/pf_lb.o pfsrc/pf_osfp.o pfsrc/pf_syncookies.o pfsrc/pf_ioctl.o pfsrc/pf.o pfsrc/divert_sock.o compat/pfk_ifq.o | awk '!x[$$0]++ { print("./"$$0) }' > pf.mod
|
||||
+3
-1
@@ -12,8 +12,10 @@ ccflags-y := -I$(src)/include -I$(src)/include/compat -DPFLINUX=1 \
|
||||
# our glue + compat layer
|
||||
pf-objs := pfsrc/pfk_mod.o pfsrc/pfk_hooks.o \
|
||||
compat/pfk_mbuf.o compat/pfk_kern.o compat/pfk_if.o compat/pfk_xmit.o \
|
||||
compat/pfk_pcb.o compat/pfk_ip4.o \
|
||||
compat/siphash.o compat/toeplitz.o compat/md5.o compat/sha2.o \
|
||||
compat/radix.o compat/pfk_rtable.o compat/pfk_ip6.o
|
||||
compat/radix.o compat/pfk_rtable.o compat/pfk_ip6.o \
|
||||
compat/subr_tree.o
|
||||
|
||||
# ported OpenBSD 8.0 engine
|
||||
pf-objs += pfsrc/pf_ruleset.o pfsrc/pf_table.o pfsrc/pf_norm.o pfsrc/pf_if.o \
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/md5.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/md5.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/md5.o: $(deps_compat/md5.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/pfk_if.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/pfk_if.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/pfk_if.o: $(deps_compat/pfk_if.o)
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -1811,6 +1811,9 @@ deps_compat/pfk_ip6.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/pfk_ip6.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/pfk_ip6.o: $(deps_compat/pfk_ip6.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/pfk_kern.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/pfk_kern.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/pfk_kern.o: $(deps_compat/pfk_kern.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/pfk_mbuf.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/pfk_mbuf.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/pfk_mbuf.o: $(deps_compat/pfk_mbuf.o)
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -3,6 +3,7 @@ savedcmd_compat/pfk_rtable.o := gcc -Wp,-MMD,compat/.pfk_rtable.o.d -nostdinc -I
|
||||
source_compat/pfk_rtable.o := compat/pfk_rtable.c
|
||||
|
||||
deps_compat/pfk_rtable.o := \
|
||||
$(wildcard include/config/IPV6) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h \
|
||||
$(wildcard include/config/CC_VERSION_TEXT) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h \
|
||||
@@ -1207,7 +1208,6 @@ deps_compat/pfk_rtable.o := \
|
||||
$(wildcard include/config/DEBUG_NET_SMALL_RTNL) \
|
||||
$(wildcard include/config/WIRELESS_EXT) \
|
||||
$(wildcard include/config/NET_L3_MASTER_DEV) \
|
||||
$(wildcard include/config/IPV6) \
|
||||
$(wildcard include/config/TLS_DEVICE) \
|
||||
$(wildcard include/config/VLAN_8021Q) \
|
||||
$(wildcard include/config/NET_DSA) \
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/pfk_rtable.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,14 +1823,11 @@ deps_compat/pfk_rtable.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/net/rtable.h \
|
||||
|
||||
compat/pfk_rtable.o: $(deps_compat/pfk_rtable.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/pfk_xmit.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/pfk_xmit.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/pfk_xmit.o: $(deps_compat/pfk_xmit.o)
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
savedcmd_compat/radix.o := gcc -Wp,-MMD,compat/.radix.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -D_KERNEL=1 -Wno-declaration-after-statement -DMODULE -DKBUILD_BASENAME='"radix"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o compat/radix.o compat/radix.c
|
||||
savedcmd_compat/radix.o := gcc -Wp,-MMD,compat/.radix.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -D_KERNEL=1 -Wno-declaration-after-statement -Wno-implicit-fallthrough -Wno-frame-larger-than -DMODULE -DKBUILD_BASENAME='"radix"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o compat/radix.o compat/radix.c
|
||||
|
||||
source_compat/radix.o := compat/radix.c
|
||||
|
||||
@@ -1810,6 +1810,10 @@ deps_compat/radix.o := \
|
||||
include/compat/sys/socket.h \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1819,13 +1823,11 @@ deps_compat/radix.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/radix.o: $(deps_compat/radix.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/sha2.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/sha2.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/sha2.o: $(deps_compat/sha2.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_compat/siphash.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/siphash.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
compat/siphash.o: $(deps_compat/siphash.o)
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -1811,6 +1811,9 @@ deps_compat/toeplitz.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_compat/toeplitz.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/crypto/hash.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/crypto.h \
|
||||
|
||||
|
||||
@@ -30,6 +30,11 @@ pfk_ifnet_new(struct net_device *dev)
|
||||
ifp->dev = dev;
|
||||
ifp->alive = 1;
|
||||
INIT_LIST_HEAD(&ifp->link);
|
||||
/* BSD TAILQ heads are self-referential when empty (tqh_last points
|
||||
* at &tqh_first); kzalloc leaves tqh_last == NULL, which the first
|
||||
* TAILQ_INSERT_TAIL would dereference. */
|
||||
TAILQ_INIT(&ifp->if_addrlist);
|
||||
TAILQ_INIT(&ifp->if_groups);
|
||||
ifp->if_type = IFT_OTHER;
|
||||
switch (dev->type) {
|
||||
case ARPHRD_ETHER: ifp->if_type = IFT_ETHER; break;
|
||||
@@ -64,10 +69,37 @@ pfk_if_refresh(struct pfk_ifnet *ifp)
|
||||
{
|
||||
ifp->if_mtu = ifp->dev->mtu;
|
||||
ifp->if_flags = pfk_dev_flags_bsd(ifp->dev);
|
||||
if (ifp->dev->hard_header_len > max_linkhdr)
|
||||
max_linkhdr = ifp->dev->hard_header_len;
|
||||
/* PFLINUX: sync the BSD sysctl mirrors on device events */
|
||||
pfk_sysctl_sync();
|
||||
/* address snapshot: rebuild list from Linux in_ifaddr/inet6_ifaddr */
|
||||
pfk_if_addrlist_refresh(ifp);
|
||||
}
|
||||
|
||||
/*
|
||||
* OpenBSD if_get/if_put: registry entries are refcounted there; the port's
|
||||
* pfk_ifnet objects are freed via call_rcu on UNREGISTER, so RCU/NET_LOCK
|
||||
* readers can use them without an extra count (PFLINUX: if_put is a no-op).
|
||||
*/
|
||||
struct pfk_ifnet *
|
||||
if_get(int ifidx)
|
||||
{
|
||||
return pfk_ifp_byindex(ifidx);
|
||||
}
|
||||
|
||||
struct pfk_ifnet *
|
||||
if_get_smr(int ifidx)
|
||||
{
|
||||
return pfk_ifp_byindex(ifidx);
|
||||
}
|
||||
|
||||
void
|
||||
if_put(struct pfk_ifnet *ifp)
|
||||
{
|
||||
(void)ifp;
|
||||
}
|
||||
|
||||
struct pfk_ifnet *
|
||||
pfk_ifp_byindex(int idx)
|
||||
{
|
||||
|
||||
+19
-2
@@ -162,7 +162,7 @@ struct pfk_pfq {
|
||||
};
|
||||
|
||||
static void *
|
||||
pfk_pfq_alloc(struct ifnet *ifp)
|
||||
pfk_pfq_alloc(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct pfk_pfq *pfq = kzalloc(sizeof(*pfq), GFP_KERNEL);
|
||||
|
||||
@@ -280,7 +280,7 @@ const struct pfq_ops * const pfq_fqcodel_ops = &pfk_priq_pfq_ops;
|
||||
|
||||
/* ---------------- framework ---------------- */
|
||||
void
|
||||
ifq_init(struct ifqueue *ifq, struct ifnet *ifp, unsigned int maxlen)
|
||||
ifq_init(struct ifqueue *ifq, struct pfk_ifnet *ifp, unsigned int maxlen)
|
||||
{
|
||||
memset(ifq, 0, sizeof(*ifq));
|
||||
ifq->ifq_if = ifp;
|
||||
@@ -422,3 +422,20 @@ ifq_hdatalen(struct ifqueue *ifq)
|
||||
(void)ifq;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ---------------- scheduler back ends (milestone M5) ---------------- */
|
||||
/* The staged OpenBSD hfsc.c/fq_codel.c are not in the build yet; the priq
|
||||
* ops above are the active scheduler. These wrappers keep pf_ioctl's
|
||||
* initialisation calls valid until M5 replaces them with the ported
|
||||
* schedulers (docs/porting-notes.md). */
|
||||
void
|
||||
hfsc_initialize(void)
|
||||
{
|
||||
pr_info("pfk: hfsc back end pending M5 (priq active)\n");
|
||||
}
|
||||
|
||||
void
|
||||
fq_codel_initialize(void)
|
||||
{
|
||||
pr_info("pfk: fq_codel back end pending M5 (priq active)\n");
|
||||
}
|
||||
@@ -0,0 +1,540 @@
|
||||
/*
|
||||
* PF-on-Linux BSD IPv4/IPv6 layer used by pf.c (ISC 2026).
|
||||
*
|
||||
* OpenBSD's netinet entry points that PF calls directly for the AFRT
|
||||
* (64<->4 translation), route-to, RST/error-return and state-ICMP paths.
|
||||
* The staging seds rename ip_output/ip_forward/ip6_output to pfk_* (they
|
||||
* clash with Linux declarations); ip_send/ip6_send/icmp_error/ip_fragment
|
||||
* have no Linux declaration and keep their BSD names.
|
||||
*
|
||||
* All of these CONSUME the mbuf (OpenBSD semantics), matching the callers
|
||||
* in pf.c which set pd->m = NULL right after.
|
||||
*/
|
||||
#include <pfk.h>
|
||||
|
||||
static struct rtable *
|
||||
pfk_ip4_route(__be32 daddr, __be32 saddr)
|
||||
{
|
||||
struct flowi4 fl4 = { };
|
||||
struct rtable *rt;
|
||||
|
||||
fl4.daddr = daddr;
|
||||
fl4.saddr = saddr;
|
||||
rt = ip_route_output_key(&init_net, &fl4);
|
||||
if (IS_ERR(rt))
|
||||
return NULL;
|
||||
return rt;
|
||||
}
|
||||
|
||||
/* one's complement sum over an mbuf range (shim: linear sk_buff) */
|
||||
u_int16_t
|
||||
in_cksum(struct mbuf *m, int len)
|
||||
{
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
|
||||
if (!skb || !pskb_may_pull(skb, len))
|
||||
return 0xffff;
|
||||
return pfk_in_cksum(skb->data, len);
|
||||
}
|
||||
|
||||
/*
|
||||
* in4_cksum(m, nxt, off, len): transport checksum including the IPv4
|
||||
* pseudo-header. off/len are relative to the packet start (the IP hdr).
|
||||
* Returns the one's complement sum; a valid packet computes to 0, and a
|
||||
* value to be STORED is (sum == 0 ? 0xffff : ~sum) style — callers do
|
||||
* their own fixups; we return the raw folded sum like OpenBSD.
|
||||
*/
|
||||
u_int16_t
|
||||
in4_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len)
|
||||
{
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
struct pf_ip *ip;
|
||||
struct {
|
||||
__be32 src, dst;
|
||||
__u8 zero, proto;
|
||||
__be16 len;
|
||||
} ph;
|
||||
__wsum base;
|
||||
|
||||
if (!skb || !pskb_may_pull(skb, off + len) ||
|
||||
!pskb_may_pull(skb, sizeof(*ip)))
|
||||
return 0xffff;
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
|
||||
ph.src = ip->ip_src.s_addr;
|
||||
ph.dst = ip->ip_dst.s_addr;
|
||||
ph.zero = 0;
|
||||
ph.proto = nxt;
|
||||
ph.len = htons(len);
|
||||
base = csum_partial(&ph, sizeof(ph), 0);
|
||||
return csum_fold(csum_partial(skb->data + off, len, base));
|
||||
}
|
||||
|
||||
u_int16_t
|
||||
in6_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len)
|
||||
{
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
struct pf_ip6_hdr *ip6;
|
||||
__wsum base;
|
||||
|
||||
if (!skb || !pskb_may_pull(skb, sizeof(*ip6)) ||
|
||||
!pskb_may_pull(skb, off + len))
|
||||
return 0xffff;
|
||||
ip6 = (struct pf_ip6_hdr *)skb->data;
|
||||
|
||||
base = csum_partial(ip6->ip6_src.s6_addr, sizeof(ip6->ip6_src), 0);
|
||||
base = csum_add(base, csum_partial(ip6->ip6_dst.s6_addr,
|
||||
sizeof(ip6->ip6_dst), 0));
|
||||
base = csum_add(base, (__force __u32)htonl(len));
|
||||
base = csum_add(base, (__force __u32)htonl(nxt));
|
||||
return csum_fold(csum_partial(skb->data + off, len, base));
|
||||
}
|
||||
|
||||
/* recompute the IPv4 header checksum in place */
|
||||
void
|
||||
in_hdr_cksum_out(struct mbuf *m, void *ro)
|
||||
{
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
struct pf_ip *ip;
|
||||
int hlen;
|
||||
|
||||
(void)ro;
|
||||
if (!skb || !pskb_may_pull(skb, sizeof(*ip)))
|
||||
return;
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
hlen = ip->ip_hl << 2;
|
||||
if (hlen < (int)sizeof(*ip) || !pskb_may_pull(skb, hlen))
|
||||
return;
|
||||
ip->ip_sum = 0;
|
||||
ip->ip_sum = csum_fold(csum_partial(skb->data, hlen, 0));
|
||||
pfk_mbuf_refresh(m);
|
||||
}
|
||||
|
||||
/* compute a pending transport checksum requested via csum_flags */
|
||||
static void
|
||||
pfk_proto_cksum_out(struct mbuf *m)
|
||||
{
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
struct pf_ip *ip;
|
||||
int hlen;
|
||||
|
||||
if (!skb || !(m->m_pkthdr.csum_flags &
|
||||
(M_TCP_CSUM_OUT | M_UDP_CSUM_OUT)))
|
||||
return;
|
||||
if (!pskb_may_pull(skb, sizeof(*ip)))
|
||||
return;
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
hlen = ip->ip_hl << 2;
|
||||
if (ip->ip_p == IPPROTO_TCP) {
|
||||
__be16 *sum;
|
||||
u_int16_t s;
|
||||
|
||||
if (!pskb_may_pull(skb, hlen + 20))
|
||||
return;
|
||||
sum = (__be16 *)(skb->data + hlen + 16); /* th_sum */
|
||||
*sum = 0;
|
||||
s = in4_cksum(m, IPPROTO_TCP, hlen, ntohs(ip->ip_len) - hlen);
|
||||
*sum = s == 0 ? (__force __be16)0xffff : (__force __be16)~s;
|
||||
} else if (ip->ip_p == IPPROTO_UDP) {
|
||||
__be16 *sum;
|
||||
u_int16_t s;
|
||||
|
||||
if (!pskb_may_pull(skb, hlen + 8))
|
||||
return;
|
||||
sum = (__be16 *)(skb->data + hlen + 6); /* uh_sum */
|
||||
*sum = 0;
|
||||
s = in4_cksum(m, IPPROTO_UDP, hlen, ntohs(ip->ip_len) - hlen);
|
||||
if (s == 0)
|
||||
s = 0xffff; /* RFC 768: zero means "unused" */
|
||||
*sum = (__force __be16)s;
|
||||
}
|
||||
pfk_mbuf_refresh(m);
|
||||
}
|
||||
|
||||
/*
|
||||
* pfk_ip_output(m, opt, ro, flags, imcb, so, flowid) — BSD ip_output().
|
||||
* PFLINUX: option processing (opt/record-route), IPsec metadata (imcb) and
|
||||
* socket accounting (so) are not modelled; flags IP_FORWARDING /
|
||||
* IP_ALLOWBROADCAST / IP_REDIRECT / *_IPSEC are accepted. The packet is
|
||||
* routed by its own destination header and injected into the stack output
|
||||
* path (exactly what OpenBSD's ip_output ends up doing at if_output).
|
||||
* Consumes m. Returns 0 or errno.
|
||||
*/
|
||||
int
|
||||
pfk_ip_output(struct mbuf *m, void *opt, void *ro, u_int flags, void *imcb,
|
||||
void *so, u_int flowid)
|
||||
{
|
||||
struct sk_buff *skb = m ? m_to_skb(m) : NULL;
|
||||
struct pf_ip *ip;
|
||||
struct rtable *rt;
|
||||
|
||||
(void)opt; (void)ro; (void)flags; (void)imcb; (void)so; (void)flowid;
|
||||
if (!skb)
|
||||
return EINVAL;
|
||||
if (!pskb_may_pull(skb, sizeof(*ip))) {
|
||||
m_freem(m);
|
||||
return EMSGSIZE;
|
||||
}
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
|
||||
pfk_proto_cksum_out(m);
|
||||
in_hdr_cksum_out(m, NULL);
|
||||
skb_reset_network_header(skb);
|
||||
skb->protocol = htons(ETH_P_IP);
|
||||
|
||||
rt = pfk_ip4_route(ip->ip_dst.s_addr, ip->ip_src.s_addr);
|
||||
if (!rt) {
|
||||
/* BSD: no route while forwarding → ICMP host unreachable */
|
||||
if (flags & IP_FORWARDING) {
|
||||
/* re-derive a mutable copy for quoting */
|
||||
struct sk_buff *q;
|
||||
|
||||
q = skb_copy(skb, GFP_ATOMIC);
|
||||
if (q) {
|
||||
icmp_error(m_dtom(q), ICMP_UNREACH,
|
||||
ICMP_UNREACH_HOST, 0, 0);
|
||||
}
|
||||
} else {
|
||||
struct sk_buff *q = skb_copy(skb, GFP_ATOMIC);
|
||||
|
||||
if (q)
|
||||
icmp_error(m_dtom(q), ICMP_UNREACH,
|
||||
ICMP_UNREACH_HOST, 0, 0);
|
||||
}
|
||||
m_freem(m);
|
||||
pfk_if_congestion();
|
||||
return EHOSTUNREACH;
|
||||
}
|
||||
skb_dst_set(skb, &rt->dst);
|
||||
skb->dev = rt->dst.dev;
|
||||
if (!netif_running(skb->dev)) {
|
||||
m->skb = NULL;
|
||||
m_freem(m);
|
||||
kfree_skb(skb);
|
||||
return ENETDOWN;
|
||||
}
|
||||
m->skb = NULL; /* output consumes the skb */
|
||||
m_freem(m);
|
||||
skb_dst(skb)->output(&init_net, NULL, skb);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* ip_send(m): route + transmit a complete IPv4 packet to its own
|
||||
* destination (OpenBSD: used by PF to send RST/error packets).
|
||||
* Consumes m.
|
||||
*/
|
||||
void
|
||||
ip_send(struct mbuf *m)
|
||||
{
|
||||
if (!m)
|
||||
return;
|
||||
(void)pfk_ip_output(m, NULL, NULL, 0, NULL, NULL, 0);
|
||||
}
|
||||
|
||||
/*
|
||||
* pfk_ip_forward(m, ifp, tag, flags) — BSD ip_forward(): ttl-- , recheck,
|
||||
* forward toward the packet's destination.
|
||||
* PFLINUX: ICMP redirect generation (IP_REDIRECT flag) is NOT implemented;
|
||||
* the port lets Linux routing emit redirects. IP_FORWARDING_IPSEC has no
|
||||
* meaning in the port (no kernel IPsec coupling) and is ignored.
|
||||
* Consumes m.
|
||||
*/
|
||||
void
|
||||
pfk_ip_forward(struct mbuf *m, struct pfk_ifnet *ifp, void *tag, u_int flags)
|
||||
{
|
||||
struct sk_buff *skb = m ? m_to_skb(m) : NULL;
|
||||
struct pf_ip *ip;
|
||||
|
||||
(void)ifp; (void)tag;
|
||||
if (!skb)
|
||||
return;
|
||||
if (!pskb_may_pull(skb, sizeof(*ip))) {
|
||||
m_freem(m);
|
||||
return;
|
||||
}
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
if (skb_ensure_writable(skb, sizeof(*ip))) {
|
||||
m_freem(m);
|
||||
return;
|
||||
}
|
||||
ip = (struct pf_ip *)skb->data;
|
||||
|
||||
if (ip->ip_ttl <= IPTTLDEC) {
|
||||
struct sk_buff *q = skb_copy(skb, GFP_ATOMIC);
|
||||
|
||||
if (q)
|
||||
icmp_error(m_dtom(q), ICMP_TIMXCEED,
|
||||
ICMP_TIMXCEED_INTRANS, 0, 0);
|
||||
m_freem(m);
|
||||
return;
|
||||
}
|
||||
ip->ip_ttl -= IPTTLDEC;
|
||||
in_hdr_cksum_out(m, NULL);
|
||||
|
||||
(void)pfk_ip_output(m, NULL, NULL, flags | IP_FORWARDING, NULL, NULL,
|
||||
0);
|
||||
}
|
||||
|
||||
/*
|
||||
* ip_fragment(m, ml, ifp, mtu): split a too-large IPv4 packet into
|
||||
* MTU-sized fragments appended to ml; consumes m (OpenBSD semantics:
|
||||
* always consumed). Returns 0 or errno.
|
||||
*/
|
||||
int
|
||||
ip_fragment(struct mbuf *m, struct mbuf_list *ml, struct pfk_ifnet *ifp,
|
||||
int mtu)
|
||||
{
|
||||
struct pf_ip *ip;
|
||||
int hlen, len, dlen, flen, off, error = 0;
|
||||
__be16 ipid;
|
||||
int maxfacilen;
|
||||
|
||||
if (!m || !ml)
|
||||
return EINVAL;
|
||||
ip = mtod(m, struct pf_ip *);
|
||||
if (m->m_len < (int)sizeof(*ip)) {
|
||||
m_freem(m);
|
||||
return EMSGSIZE;
|
||||
}
|
||||
hlen = ip->ip_hl << 2;
|
||||
len = ntohs(ip->ip_len);
|
||||
if (len <= mtu) {
|
||||
/* single piece */
|
||||
if (ml->ml_last)
|
||||
ml->ml_last->m_next = m;
|
||||
else
|
||||
ml->ml_first = m;
|
||||
ml->ml_last = m;
|
||||
ml->ml_len++;
|
||||
return 0;
|
||||
}
|
||||
dlen = len - hlen;
|
||||
flen = (mtu - hlen) & ~7;
|
||||
if (flen < 8) {
|
||||
m_freem(m);
|
||||
return EMSGSIZE;
|
||||
}
|
||||
ipid = ip->ip_id;
|
||||
maxfacilen = dlen;
|
||||
|
||||
off = 0;
|
||||
while (off < maxfacilen) {
|
||||
struct mbuf *fm;
|
||||
struct pf_ip *fi;
|
||||
int thislen = maxfacilen - off;
|
||||
int totlen;
|
||||
|
||||
if (thislen > flen)
|
||||
thislen = flen;
|
||||
fm = m_gethdr(M_NOWAIT, MT_HEADER);
|
||||
if (!fm) {
|
||||
error = ENOBUFS;
|
||||
break;
|
||||
}
|
||||
totlen = hlen + thislen;
|
||||
if (skb_put(fm->skb, totlen) == NULL) {
|
||||
m_freem(fm);
|
||||
error = ENOBUFS;
|
||||
break;
|
||||
}
|
||||
memcpy(fm->m_data, m->m_data, hlen);
|
||||
memcpy(fm->m_data + hlen, m->m_data + hlen + off, thislen);
|
||||
fi = mtod(fm, struct pf_ip *);
|
||||
fi->ip_len = htons(totlen);
|
||||
fi->ip_id = ipid;
|
||||
fi->ip_off = htons(off >> 3);
|
||||
if (off + thislen < maxfacilen)
|
||||
fi->ip_off |= htons(IP_MF);
|
||||
fi->ip_sum = 0;
|
||||
pfk_mbuf_refresh(fm);
|
||||
in_hdr_cksum_out(fm, NULL);
|
||||
|
||||
if (ml->ml_last)
|
||||
ml->ml_last->m_next = fm;
|
||||
else
|
||||
ml->ml_first = fm;
|
||||
ml->ml_last = fm;
|
||||
ml->ml_len++;
|
||||
off += thislen;
|
||||
}
|
||||
m_freem(m);
|
||||
return error;
|
||||
}
|
||||
|
||||
/*
|
||||
* icmp_error(n, type, code, dest, mtu): build and send an ICMP error
|
||||
* quoting the offending packet n; consumes n (OpenBSD semantics).
|
||||
*/
|
||||
void
|
||||
icmp_error(struct mbuf *n, u_int type, u_int code, u_int dest, u_int mtu)
|
||||
{
|
||||
struct sk_buff *skb = n ? m_to_skb(n) : NULL;
|
||||
struct pf_ip *oip;
|
||||
struct mbuf *m;
|
||||
struct pf_ip *ip;
|
||||
struct pf_icmp *ic;
|
||||
int hlen, qlen, len;
|
||||
__be32 rsaddr;
|
||||
|
||||
if (!skb || !pskb_may_pull(skb, sizeof(*oip))) {
|
||||
if (n)
|
||||
m_freem(n);
|
||||
return;
|
||||
}
|
||||
oip = (struct pf_ip *)skb->data;
|
||||
hlen = oip->ip_hl << 2;
|
||||
|
||||
/* quote: ip header + at least 8 bytes, fit into RFC 792 minimum */
|
||||
qlen = min_t(int, ntohs(oip->ip_len), 576 - 20 - 8);
|
||||
if (qlen < hlen + 8)
|
||||
qlen = min(hlen + 8, (int)skb->len);
|
||||
|
||||
len = 20 + 8 + qlen;
|
||||
m = m_gethdr(M_DONTWAIT, MT_HEADER);
|
||||
if (!m) {
|
||||
m_freem(n);
|
||||
return;
|
||||
}
|
||||
if (skb_put(m->skb, len) == NULL) {
|
||||
m_freem(m);
|
||||
m_freem(n);
|
||||
return;
|
||||
}
|
||||
ip = mtod(m, struct pf_ip *);
|
||||
ic = (struct pf_icmp *)(ip + 1);
|
||||
memset(ip, 0, 20);
|
||||
ip->ip_v = 4;
|
||||
ip->ip_hl = 5;
|
||||
ip->ip_len = htons(len);
|
||||
ip->ip_id = ip_randomid();
|
||||
ip->ip_off = htons(atomic_load_int(&ip_mtudisc) ? IP_DF : 0);
|
||||
ip->ip_ttl = atomic_load_int(&ip_defttl);
|
||||
ip->ip_p = IPPROTO_ICMP;
|
||||
ip->ip_dst = oip->ip_src; /* answer to the offender */
|
||||
/* source: address of our route egress interface (mirrors BSD,
|
||||
* which fills ip_src from the route/interface). Linux 7.3's
|
||||
* struct rtable no longer caches rt_src, so consult the PF
|
||||
* interface registry for the device's first IPv4 address. */
|
||||
{
|
||||
struct rtable *rt = pfk_ip4_route(oip->ip_src.s_addr, 0);
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
rsaddr = 0;
|
||||
if (rt) {
|
||||
ifp = rt->dst.dev ?
|
||||
pfk_ifp_byindex(rt->dst.dev->ifindex) : NULL;
|
||||
if (ifp) {
|
||||
struct ifaddr *ifa;
|
||||
|
||||
TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
|
||||
if (ifa->ifa_addr &&
|
||||
ifa->ifa_addr->sa_family == AF_INET) {
|
||||
rsaddr = sintosa(ifa->ifa_addr)->sin_addr.s_addr;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
dst_release(&rt->dst);
|
||||
}
|
||||
}
|
||||
ip->ip_src.s_addr = rsaddr;
|
||||
|
||||
ic->icmp_type = type;
|
||||
ic->icmp_code = code;
|
||||
ic->icmp_cksum = 0;
|
||||
if (type == ICMP_UNREACH && code == ICMP_UNREACH_NEEDFRAG) {
|
||||
ic->icmp_nextmtu = htons(((__u16)mtu));
|
||||
} else {
|
||||
ic->icmp_void = 0;
|
||||
if (dest)
|
||||
ic->icmp_gwaddr = (__force __be32)dest;
|
||||
}
|
||||
memcpy(ic + 1, (char *)oip, qlen);
|
||||
{
|
||||
__wsum w = csum_partial(ic, 8 + qlen, 0);
|
||||
|
||||
ic->icmp_cksum = csum_fold(w);
|
||||
}
|
||||
m->m_pkthdr.len = m->m_len = len;
|
||||
pfk_mbuf_refresh(m);
|
||||
m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
|
||||
|
||||
if (n)
|
||||
m_freem(n);
|
||||
ip_send(m);
|
||||
}
|
||||
|
||||
/*
|
||||
* pfk_ip6_output(m, opt, ro, flags, so, flowid) — BSD ip6_output() for
|
||||
* IPv6 packets with a complete header. PFLINUX: same reductions as
|
||||
* pfk_ip_output; consumes m; returns 0/errno.
|
||||
*/
|
||||
int
|
||||
pfk_ip6_output(struct mbuf *m, void *opt, void *ro, u_int flags, void *so,
|
||||
void *flowid)
|
||||
{
|
||||
struct sk_buff *skb = m ? m_to_skb(m) : NULL;
|
||||
struct pf_ip6_hdr *ip6;
|
||||
struct flowi6 fl6 = { };
|
||||
struct dst_entry *d;
|
||||
|
||||
(void)opt; (void)ro; (void)flags; (void)so; (void)flowid;
|
||||
if (!skb)
|
||||
return EINVAL;
|
||||
if (!pskb_may_pull(skb, sizeof(*ip6))) {
|
||||
m_freem(m);
|
||||
return EMSGSIZE;
|
||||
}
|
||||
ip6 = (struct pf_ip6_hdr *)skb->data;
|
||||
if (m->m_pkthdr.csum_flags & (M_TCP_CSUM_OUT | M_UDP_CSUM_OUT)) {
|
||||
int plen = ntohs(ip6->ip6_plen);
|
||||
|
||||
if (ip6->ip6_nxt == IPPROTO_TCP && plen >= 20) {
|
||||
__be16 *sum = (__be16 *)(skb->data + sizeof(*ip6) + 16);
|
||||
|
||||
*sum = 0;
|
||||
*sum = (__force __be16)in6_cksum(m, IPPROTO_TCP,
|
||||
sizeof(*ip6), plen);
|
||||
} else if (ip6->ip6_nxt == IPPROTO_UDP && plen >= 8) {
|
||||
__be16 *sum = (__be16 *)(skb->data + sizeof(*ip6) + 6);
|
||||
u_int16_t s = in6_cksum(m, IPPROTO_UDP, sizeof(*ip6),
|
||||
plen);
|
||||
|
||||
*sum = s == 0 ? 0xffff : (__force __be16)s;
|
||||
}
|
||||
}
|
||||
skb_reset_network_header(skb);
|
||||
skb->protocol = htons(ETH_P_IPV6);
|
||||
fl6.daddr = ip6->ip6_dst;
|
||||
fl6.saddr = ip6->ip6_src;
|
||||
d = ip6_route_output(&init_net, NULL, &fl6);
|
||||
if (!d || d->error) {
|
||||
if (d)
|
||||
dst_release(d);
|
||||
m_freem(m);
|
||||
pfk_if_congestion();
|
||||
return EHOSTUNREACH;
|
||||
}
|
||||
skb_dst_set(skb, d);
|
||||
skb->dev = d->dev;
|
||||
if (!netif_running(skb->dev)) {
|
||||
m->skb = NULL;
|
||||
m_freem(m);
|
||||
kfree_skb(skb);
|
||||
return ENETDOWN;
|
||||
}
|
||||
m->skb = NULL;
|
||||
m_freem(m);
|
||||
skb_dst(skb)->output(&init_net, NULL, skb);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ip6_send(m): BSD convenience — output an IPv6 packet to its dst */
|
||||
void
|
||||
ip6_send(struct mbuf *m)
|
||||
{
|
||||
if (!m)
|
||||
return;
|
||||
(void)pfk_ip6_output(m, NULL, NULL, 0, NULL, 0);
|
||||
}
|
||||
+176
-1
@@ -284,7 +284,7 @@ pfk_timeout_fire(struct timer_list *tl)
|
||||
void
|
||||
timeout_set(struct timeout *to, timeout_fn *fn, void *arg)
|
||||
{
|
||||
if (!to->fn) { /* one-time setup */
|
||||
if (!to->timer.function) { /* one-time setup */
|
||||
timer_setup(&to->timer, pfk_timeout_fire, 0);
|
||||
INIT_WORK(&to->work, pfk_timeout_work);
|
||||
to->period_ms = -1;
|
||||
@@ -299,9 +299,22 @@ timeout_set_micro(struct timeout *to, timeout_fn *fn, void *arg)
|
||||
timeout_set(to, fn, arg);
|
||||
}
|
||||
|
||||
/* OpenBSD TIMEOUT_INITIALIZER() statics never see timeout_set(): lazily
|
||||
* complete the Linux timer/work plumbing on the first use (PFLINUX). */
|
||||
static inline void
|
||||
pfk_timeout_ensure(struct timeout *to)
|
||||
{
|
||||
if (!to->timer.function) {
|
||||
timer_setup(&to->timer, pfk_timeout_fire, 0);
|
||||
INIT_WORK(&to->work, pfk_timeout_work);
|
||||
to->period_ms = -1;
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
timeout_add(struct timeout *to, long ms)
|
||||
{
|
||||
pfk_timeout_ensure(to);
|
||||
if (ms < 0)
|
||||
ms = 0;
|
||||
to->pending = 1;
|
||||
@@ -309,6 +322,12 @@ timeout_add(struct timeout *to, long ms)
|
||||
return mod_timer(&to->timer, to->deadline_jif);
|
||||
}
|
||||
|
||||
int
|
||||
timeout_add_msec(struct timeout *to, int msecs)
|
||||
{
|
||||
return timeout_add(to, msecs);
|
||||
}
|
||||
|
||||
int
|
||||
timeout_add_sec(struct timeout *to, int secs)
|
||||
{
|
||||
@@ -331,6 +350,8 @@ int
|
||||
timeout_del(struct timeout *to)
|
||||
{
|
||||
to->pending = 0;
|
||||
if (!to->timer.function)
|
||||
return 0;
|
||||
return timer_delete(&to->timer);
|
||||
}
|
||||
|
||||
@@ -338,6 +359,8 @@ void
|
||||
timeout_del_sync(struct timeout *to)
|
||||
{
|
||||
to->pending = 0;
|
||||
if (!to->timer.function)
|
||||
return;
|
||||
timer_delete_sync(&to->timer);
|
||||
cancel_work_sync(&to->work);
|
||||
}
|
||||
@@ -345,6 +368,8 @@ timeout_del_sync(struct timeout *to)
|
||||
void
|
||||
timeout_barrier(struct timeout *to, int flags)
|
||||
{
|
||||
if (!to->timer.function)
|
||||
return;
|
||||
timer_delete_sync(&to->timer);
|
||||
cancel_work_sync(&to->work);
|
||||
}
|
||||
@@ -405,3 +430,153 @@ pfk_wakeup(void *p)
|
||||
}
|
||||
spin_unlock(&pfk_tsleep_lock);
|
||||
}
|
||||
|
||||
/* ---------------- OpenBSD counters(9) over cpumem ---------------- */
|
||||
/* Each "counter" slot is an array of `count` u64s per possible CPU.
|
||||
* PFLINUX deviation from OpenBSD's cpumem-based counters_read(): the
|
||||
* scratch argument is accepted but unused (no cpu_info walk needed). */
|
||||
struct cpumem *
|
||||
counters_alloc(u_int count)
|
||||
{
|
||||
return cpumem_malloc((size_t)count * sizeof(uint64_t), M_WAITOK);
|
||||
}
|
||||
|
||||
void
|
||||
counters_free(struct cpumem *cm)
|
||||
{
|
||||
cpumem_free(cm, 0);
|
||||
}
|
||||
|
||||
void
|
||||
counters_inc(struct cpumem *cm, u_int idx)
|
||||
{
|
||||
uint64_t *p;
|
||||
|
||||
if (!cm)
|
||||
return;
|
||||
preempt_disable();
|
||||
p = (uint64_t *)cm->cm_base +
|
||||
(size_t)smp_processor_id() * cm->cm_item / sizeof(uint64_t);
|
||||
p[idx]++;
|
||||
preempt_enable();
|
||||
}
|
||||
|
||||
void
|
||||
counters_zero(struct cpumem *cm, u_int count)
|
||||
{
|
||||
unsigned int cpu;
|
||||
|
||||
if (!cm)
|
||||
return;
|
||||
for_each_possible_cpu(cpu) {
|
||||
uint64_t *p = (uint64_t *)cm->cm_base +
|
||||
(size_t)cpu * cm->cm_item / sizeof(uint64_t);
|
||||
unsigned int i;
|
||||
|
||||
for (i = 0; i < count; i++)
|
||||
p[i] = 0;
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
counters_read(struct cpumem *cm, uint64_t *result, u_int count,
|
||||
uint64_t *scratch)
|
||||
{
|
||||
unsigned int cpu;
|
||||
|
||||
(void)scratch; /* PFLINUX: unused (see header note) */
|
||||
memset(result, 0, count * sizeof(*result));
|
||||
if (!cm)
|
||||
return;
|
||||
for_each_possible_cpu(cpu) {
|
||||
uint64_t *p = (uint64_t *)cm->cm_base +
|
||||
(size_t)cpu * cm->cm_item / sizeof(uint64_t);
|
||||
unsigned int i;
|
||||
|
||||
for (i = 0; i < count; i++)
|
||||
result[i] += p[i];
|
||||
}
|
||||
}
|
||||
|
||||
/* ---------------- OpenBSD sysctl-backed globals ---------------- */
|
||||
/* PFLINUX: these are OpenBSD kern.sysctls PF consults per-packet. The
|
||||
* port keeps plain globals; ip_forwarding is synced from
|
||||
* init_net.ipv4.sysctl_ip_forward on ifevents (pfk_if.c) — a runtime
|
||||
* `sysctl -w net.ipv4.ip_forward` is picked up on the next event, not
|
||||
* instantly (recorded deviation). */
|
||||
int ip_forwarding;
|
||||
int ip_directedbcast;
|
||||
int ipmultipath;
|
||||
int ip6_multipath;
|
||||
int ip_mtudisc = 1; /* Linux enables PMTU discovery by default */
|
||||
int ip_defttl = 64; /* OpenBSD IP_DEFTTL */
|
||||
u_int max_linkhdr = 14; /* refreshed by pfk_if_refresh() */
|
||||
tcp_seq tcp_iss; /* PFLINUX: stays 0; pf_tcp_iss() supplies
|
||||
* the randomness (SHA512 + per-packet off) */
|
||||
|
||||
void
|
||||
pfk_sysctl_sync(void)
|
||||
{
|
||||
/* PFLINUX: OpenBSD ip_forwarding 0/1(/2 ipsec). Linux 7.3 keeps
|
||||
* the forwarding boolean in the "all" ipv4 device-configuration
|
||||
* (per-net ipv4.devconf_all, the old net.ipv4.ip_forward sysctl
|
||||
* storage); we mirror it as 0/1. */
|
||||
int fwd = 0;
|
||||
|
||||
if (init_net.ipv4.devconf_all)
|
||||
fwd = IPV4_DEVCONF(*init_net.ipv4.devconf_all, FORWARDING);
|
||||
WRITE_ONCE(ip_forwarding, fwd ? 1 : 0);
|
||||
}
|
||||
|
||||
/* ---------------- curcpu(9) ---------------- */
|
||||
static DEFINE_PER_CPU(struct pfk_cpu_info, pfk_cpu_infos);
|
||||
|
||||
struct pfk_cpu_info *
|
||||
pfk_curcpu(void)
|
||||
{
|
||||
struct pfk_cpu_info *ci;
|
||||
|
||||
preempt_disable();
|
||||
ci = this_cpu_ptr(&pfk_cpu_infos);
|
||||
ci->ci_schedstate.spc_schedflags =
|
||||
need_resched() ? SPCF_SHOULDYIELD : 0;
|
||||
preempt_enable();
|
||||
return ci;
|
||||
}
|
||||
|
||||
/* ---------------- if_congested(9) ---------------- */
|
||||
/* PFLINUX: OpenBSD sets ifq_congestion when any ifq hits resource
|
||||
* pressure; the port stamps the same instant from its xmit path
|
||||
* (pfk_if_congestion(), called on ENOBUFS-class drops in pfk_xmit.c). */
|
||||
static unsigned long pfk_congestion_jif;
|
||||
|
||||
void
|
||||
pfk_if_congestion(void)
|
||||
{
|
||||
WRITE_ONCE(pfk_congestion_jif, jiffies);
|
||||
}
|
||||
|
||||
int
|
||||
if_congested(void)
|
||||
{
|
||||
unsigned long c = READ_ONCE(pfk_congestion_jif);
|
||||
|
||||
if (!c || time_after(jiffies, c + HZ / 100))
|
||||
return 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
/* ---------------- pflog (netlink backend, milestone M4) ---------------- */
|
||||
/* NPFLOG=1: the staged if_pflog.c needs the OpenBSD ifpf layer; until the
|
||||
* netlink-backed pflog lands (M4), pflog_packet() consumes nothing and
|
||||
* reports the missing backend at least once so logged packets are never
|
||||
* silently vanished (see docs/porting-notes.md). */
|
||||
int
|
||||
pflog_packet(struct pf_pdesc *pd, u_int8_t reason, struct pf_rule *rm,
|
||||
struct pf_rule *am, struct pf_ruleset *ruleset, struct pf_rule *cm)
|
||||
{
|
||||
(void)pd; (void)reason; (void)rm; (void)am; (void)ruleset; (void)cm;
|
||||
pr_warn_once("pfk: pflog backend pending M4; packet not logged\n");
|
||||
return (0);
|
||||
}
|
||||
@@ -187,6 +187,80 @@ m_dup(struct mbuf *m, int wait)
|
||||
return n;
|
||||
}
|
||||
|
||||
/*
|
||||
* m_prepend(m, len, how): make room for `len` bytes at the front of the
|
||||
* packet (contents moved, not initialised — BSD semantics).
|
||||
*/
|
||||
struct mbuf *
|
||||
m_prepend(struct mbuf *m, int len, int how)
|
||||
{
|
||||
if (!m || len <= 0)
|
||||
return m;
|
||||
if (skb_headroom(m->skb) < len) {
|
||||
int extra = ALIGN(len - skb_headroom(m->skb), 64);
|
||||
gfp_t g = (how & M_WAITOK) ? GFP_ATOMIC : GFP_ATOMIC;
|
||||
|
||||
if ((how & (M_WAITOK|M_CANFAIL)) == M_WAITOK)
|
||||
g = GFP_KERNEL;
|
||||
if (pskb_expand_head(m->skb, extra, 0, g)) {
|
||||
m_freem(m);
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
skb_push(m->skb, len);
|
||||
pfk_mbuf_refresh(m);
|
||||
if (m->m_flags & M_PKTHDR)
|
||||
m->m_pkthdr.len += len;
|
||||
return m;
|
||||
}
|
||||
|
||||
/*
|
||||
* m_split(m, len, flags): cut m at `len`, return the tail (second half).
|
||||
* m keeps the first `len` bytes. On failure returns NULL and leaves m
|
||||
* untouched (OpenBSD semantics: m unchanged).
|
||||
*/
|
||||
struct mbuf *
|
||||
m_split(struct mbuf *m, int len, int flags)
|
||||
{
|
||||
struct mbuf *tail;
|
||||
|
||||
if (len >= m->m_len)
|
||||
return NULL; /* nothing to split off */
|
||||
tail = m_copym(m, len, m->m_len - len, flags);
|
||||
if (!tail)
|
||||
return NULL;
|
||||
skb_trim(m->skb, len);
|
||||
pfk_mbuf_refresh(m);
|
||||
if (m->m_flags & M_PKTHDR)
|
||||
m->m_pkthdr.len = len;
|
||||
return tail;
|
||||
}
|
||||
|
||||
/*
|
||||
* m_dup_pkt(m, hdr, how): full duplicate of m with at least `hdr` bytes of
|
||||
* headroom in front of the data (for link-layer rewriting downstream).
|
||||
*/
|
||||
struct mbuf *
|
||||
m_dup_pkt(struct mbuf *m, u_int hdr, int how)
|
||||
{
|
||||
struct mbuf *n = m_dup(m, how);
|
||||
|
||||
if (!n)
|
||||
return NULL;
|
||||
if ((unsigned int)skb_headroom(n->skb) < hdr) {
|
||||
int extra = ALIGN((int)hdr - skb_headroom(n->skb), 64);
|
||||
|
||||
if (pskb_expand_head(n->skb, extra, 0,
|
||||
(how & (M_WAITOK|M_CANFAIL)) == M_WAITOK ?
|
||||
GFP_KERNEL : GFP_ATOMIC)) {
|
||||
m_freem(n);
|
||||
return NULL;
|
||||
}
|
||||
pfk_mbuf_refresh(n);
|
||||
}
|
||||
return n;
|
||||
}
|
||||
|
||||
void
|
||||
m_adj(struct mbuf *m, int dlen)
|
||||
{
|
||||
|
||||
@@ -0,0 +1,176 @@
|
||||
/*
|
||||
* PF-on-Linux: BSD inpcb view over Linux sockets (ISC 2026).
|
||||
*
|
||||
* pf.c uses OpenBSD's PCB API to (a) find the socket owning an arriving
|
||||
* packet (pf_socket_lookup: uid/gid/pid match), and (b) link state keys to
|
||||
* sockets (sk_inp <-> inp_pf_sk). The port creates one struct inpcb per
|
||||
* successful Linux socket lookup; it holds the Linux `struct sock` and a
|
||||
* BSD-ish socket view. Reference semantics follow OpenBSD: lookups return
|
||||
* the pcb with one reference held; PF takes extra refs (mbufs, state keys)
|
||||
* via in_pcbref()/in_pcbunref().
|
||||
*
|
||||
* PFLINUX deviations (docs/porting-notes.md):
|
||||
* - so_egid: Linux does not store the group of the socket owner in
|
||||
* struct sock; reported as (gid_t)-1 ("unknown").
|
||||
* - so_cpid: Linux does not store the owning pid in struct sock
|
||||
* (/proc-based matching is a userland-side feature); reported NO_PID.
|
||||
* - Wildcard match: OpenBSD in_pcblookup() finds bound-with-wildcard
|
||||
* sockets in one pass; here established lookups are exact and the
|
||||
* wildcard is found via in_pcblookup_listen(), which is exactly the
|
||||
* sequence pf_socket_lookup already follows.
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <net/inet_hashtables.h>
|
||||
#include <net/inet6_hashtables.h>
|
||||
|
||||
struct inpcbtable tcbtable, udbtable, tcb6table, udb6table;
|
||||
|
||||
static struct inpcb *
|
||||
pfk_inpcb_of_sock(struct sock *sk)
|
||||
{
|
||||
struct inpcb *inp;
|
||||
|
||||
if (!sk)
|
||||
return NULL;
|
||||
|
||||
/* our stable reference on the Linux socket */
|
||||
if (!refcount_inc_not_zero(&sk->__sk_common.skc_refcnt))
|
||||
return NULL;
|
||||
|
||||
inp = pfk_malloc(sizeof(*inp), M_NOWAIT | M_ZERO);
|
||||
if (!inp) {
|
||||
sock_gen_put(sk);
|
||||
return NULL;
|
||||
}
|
||||
refcount_set(&inp->inp_refcnt, 1);
|
||||
inp->inp_sock = sk;
|
||||
inp->inp_socket = &inp->inp_soinfo_storage;
|
||||
inp->inp_socket->so_euid = __kuid_val(sk_uid(sk));
|
||||
/* PFLINUX: Linux stores no egid/owner-pid in struct sock */
|
||||
inp->inp_socket->so_egid = (gid_t)-1;
|
||||
inp->inp_socket->so_cpid = NO_PID;
|
||||
return inp;
|
||||
}
|
||||
|
||||
struct inpcb *
|
||||
in_pcbref(struct inpcb *inp)
|
||||
{
|
||||
if (inp != NULL)
|
||||
refcount_inc(&inp->inp_refcnt);
|
||||
return inp;
|
||||
}
|
||||
|
||||
void
|
||||
in_pcbunref(struct inpcb *inp)
|
||||
{
|
||||
struct sock *sk;
|
||||
|
||||
if (inp == NULL)
|
||||
return;
|
||||
if (!refcount_dec_and_test(&inp->inp_refcnt))
|
||||
return;
|
||||
sk = inp->inp_sock;
|
||||
if (sk != NULL)
|
||||
sock_gen_put(sk); /* drop our stable reference */
|
||||
pfk_free(inp);
|
||||
}
|
||||
|
||||
/*
|
||||
* Established/exact 4-tuple lookup. table selects the protocol family
|
||||
* (tcbtable: TCP, udbtable: UDP) — OpenBSD keeps them apart; Linux shares
|
||||
* the ehash for TCP but UDP needs its own lib lookup (which also covers
|
||||
* bound-wildcard matching, mirroring OpenBSD's behaviour).
|
||||
*/
|
||||
struct inpcb *
|
||||
in_pcblookup(struct inpcbtable *table, struct in_addr faddr, u_int fport,
|
||||
struct in_addr laddr, u_int lport, u_int rtableid)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct inpcb *inp;
|
||||
|
||||
rcu_read_lock();
|
||||
if (table == &udbtable) {
|
||||
sk = __udp4_lib_lookup(&init_net, faddr.s_addr, (__be16)fport,
|
||||
laddr.s_addr, (__be16)lport, 0, 0, NULL);
|
||||
} else {
|
||||
sk = __inet_lookup_established(&init_net, faddr.s_addr,
|
||||
(__be16)fport, laddr.s_addr, ntohs((__be16)lport), 0, 0);
|
||||
}
|
||||
inp = sk ? pfk_inpcb_of_sock(sk) : NULL;
|
||||
rcu_read_unlock();
|
||||
return inp;
|
||||
}
|
||||
|
||||
struct inpcb *
|
||||
in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr,
|
||||
u_int lport, struct mbuf *m, u_int rtableid)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct inpcb *inp;
|
||||
|
||||
rcu_read_lock();
|
||||
if (table == &udbtable) {
|
||||
/* UDP: the lib lookup matches the wildcard bound socket */
|
||||
sk = __udp4_lib_lookup(&init_net, 0, 0, laddr.s_addr,
|
||||
(__be16)lport, 0, 0, NULL);
|
||||
} else {
|
||||
sk = __inet_lookup_listener(&init_net, NULL, 0, 0, 0,
|
||||
laddr.s_addr, ntohs((__be16)lport), 0, 0);
|
||||
}
|
||||
inp = sk ? pfk_inpcb_of_sock(sk) : NULL;
|
||||
rcu_read_unlock();
|
||||
return inp;
|
||||
}
|
||||
|
||||
struct inpcb *
|
||||
in6_pcblookup(struct inpcbtable *table, const struct in6_addr *faddr,
|
||||
u_int fport, const struct in6_addr *laddr, u_int lport, u_int rtableid)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct inpcb *inp;
|
||||
|
||||
rcu_read_lock();
|
||||
if (table == &udb6table) {
|
||||
sk = __udp6_lib_lookup(&init_net, faddr, (__be16)fport,
|
||||
(struct in6_addr *)laddr, (__be16)lport, 0, 0, NULL);
|
||||
} else {
|
||||
sk = __inet6_lookup_established(&init_net, faddr,
|
||||
(__be16)fport, (struct in6_addr *)laddr,
|
||||
ntohs((__be16)lport), 0, 0);
|
||||
}
|
||||
inp = sk ? pfk_inpcb_of_sock(sk) : NULL;
|
||||
rcu_read_unlock();
|
||||
return inp;
|
||||
}
|
||||
|
||||
struct inpcb *
|
||||
in6_pcblookup_listen(struct inpcbtable *table, struct in6_addr *laddr,
|
||||
u_int lport, struct mbuf *m, u_int rtableid)
|
||||
{
|
||||
static const struct in6_addr any = { };
|
||||
struct sock *sk;
|
||||
struct inpcb *inp;
|
||||
|
||||
rcu_read_lock();
|
||||
if (table == &udb6table) {
|
||||
sk = __udp6_lib_lookup(&init_net, &any, 0, laddr,
|
||||
(__be16)lport, 0, 0, NULL);
|
||||
} else {
|
||||
sk = inet6_lookup_listener(&init_net, NULL, 0, &any, 0,
|
||||
laddr, ntohs((__be16)lport), 0, 0);
|
||||
}
|
||||
inp = sk ? pfk_inpcb_of_sock(sk) : NULL;
|
||||
rcu_read_unlock();
|
||||
return inp;
|
||||
}
|
||||
|
||||
int
|
||||
pfk_pcb_init(void)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
void
|
||||
pfk_pcb_exit(void)
|
||||
{
|
||||
}
|
||||
+152
-4
@@ -1,8 +1,14 @@
|
||||
/*
|
||||
* PFLINUX rtable compatibility (ISC 2026).
|
||||
* PFLINUX rtable/route compatibility (ISC 2026).
|
||||
* Linux has no per-rtableid FIBs: rtable_exists() accepts every id and
|
||||
* rtable_iterate() is a terminal stub — the route-to implementation uses
|
||||
* the Linux FIB through pfk_xmit.c (pf_route/pf_route6, plan task T14).
|
||||
* rtable_iterate() stops after the first route (multipath iteration is
|
||||
* not modelled; recorded deviation). The PF route-to/mb-path checks get
|
||||
* their answers from the Linux FIB here; forwarding itself happens in
|
||||
* pfk_ip4.c/pfk_xmit.c.
|
||||
*
|
||||
* struct pf_rtentry instances are small heap snapshots of the Linux
|
||||
* route: egress ifindex + a BSD-shaped interface address view (needed by
|
||||
* ifatoia/ifatoia6 in pf.c) + label id (always 0, labels not modelled).
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include "compat/net/rtable.h"
|
||||
@@ -17,6 +23,148 @@ rtable_exists(unsigned int rtableid)
|
||||
struct pf_rtentry *
|
||||
rtable_iterate(struct pf_rtentry *rt)
|
||||
{
|
||||
/* PFLINUX: replaced by Linux FIB walk in pfk_route_next() (T14). */
|
||||
/* PFLINUX: multipath route iteration is not modelled; PF falls
|
||||
* back to the single Linux FIB answer (checked once). */
|
||||
(void)rt;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* attach a BSD interface-address view for the egress device */
|
||||
static void
|
||||
pfk_rt_fill_ifa(struct pf_rtentry *rt, struct pfk_ifnet *ifp, int family)
|
||||
{
|
||||
struct pfk_in_ifaddr *ia4;
|
||||
struct pfk_in6_ifaddr *ia6;
|
||||
struct ifaddr *ifa;
|
||||
|
||||
if (!ifp)
|
||||
return;
|
||||
if (family == AF_INET) {
|
||||
ia4 = pfk_malloc(sizeof(*ia4), M_NOWAIT | M_ZERO);
|
||||
if (!ia4)
|
||||
return;
|
||||
TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
|
||||
if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET) {
|
||||
ia4->ia_addr = *sintosa(ifa->ifa_addr);
|
||||
break;
|
||||
}
|
||||
}
|
||||
rt->rt_ifa = ia4;
|
||||
} else {
|
||||
ia6 = pfk_malloc(sizeof(*ia6), M_NOWAIT | M_ZERO);
|
||||
if (!ia6)
|
||||
return;
|
||||
TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
|
||||
if (ifa->ifa_addr && ifa->ifa_addr->sa_family == AF_INET6) {
|
||||
ia6->ia_addr = *sin6tosa(ifa->ifa_addr);
|
||||
break;
|
||||
}
|
||||
}
|
||||
rt->rt_ifa = ia6;
|
||||
}
|
||||
}
|
||||
|
||||
static struct pf_rtentry *
|
||||
pfk_rtentry_from_dst(struct dst_entry *d, const struct sockaddr *dst)
|
||||
{
|
||||
struct pf_rtentry *rt;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
rt = pfk_malloc(sizeof(*rt), M_NOWAIT | M_ZERO);
|
||||
if (!rt)
|
||||
return NULL;
|
||||
rt->rt_addr = (void *)dst; /* borrowed; not freed */
|
||||
rt->rt_ifidx = d->dev ? d->dev->ifindex : 0;
|
||||
rt->rt_flags = RTF_UP;
|
||||
ifp = d->dev ? pfk_ifp_byindex(d->dev->ifindex) : NULL;
|
||||
pfk_rt_fill_ifa(rt, ifp, dst->sa_family);
|
||||
return rt;
|
||||
}
|
||||
|
||||
struct pf_rtentry *
|
||||
rtalloc(const void *sap, int flags, unsigned int rtableid)
|
||||
{
|
||||
const struct sockaddr *sa = (const struct sockaddr *)sap;
|
||||
struct pf_rtentry *rt = NULL;
|
||||
|
||||
(void)flags; (void)rtableid; /* PFLINUX: one FIB, resolve implied */
|
||||
switch (sa->sa_family) {
|
||||
case AF_INET: {
|
||||
struct flowi4 fl4 = { };
|
||||
struct rtable *r4;
|
||||
|
||||
fl4.daddr = sintosa(sa)->sin_addr.s_addr;
|
||||
r4 = ip_route_output_key(&init_net, &fl4);
|
||||
if (!IS_ERR(r4)) {
|
||||
rt = pfk_rtentry_from_dst(&r4->dst, sa);
|
||||
dst_release(&r4->dst);
|
||||
}
|
||||
break;
|
||||
}
|
||||
case AF_INET6: {
|
||||
#if IS_ENABLED(CONFIG_IPV6)
|
||||
struct flowi6 fl6 = { };
|
||||
struct dst_entry *d;
|
||||
|
||||
fl6.daddr = sin6tosa(sa)->sin6_addr;
|
||||
d = ip6_route_output(&init_net, NULL, &fl6);
|
||||
if (d && !d->error) {
|
||||
rt = pfk_rtentry_from_dst(d, sa);
|
||||
dst_release(d);
|
||||
} else if (d)
|
||||
dst_release(d);
|
||||
break;
|
||||
#endif
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
return rt;
|
||||
}
|
||||
|
||||
struct pf_rtentry *
|
||||
rtalloc_mpath(const void *sa, uint32_t *hash, unsigned int rtableid)
|
||||
{
|
||||
/* PFLINUX: no multipath selection; hash hint unused. */
|
||||
(void)hash;
|
||||
return rtalloc(sa, RT_RESOLVE, rtableid);
|
||||
}
|
||||
|
||||
int
|
||||
rtisvalid(struct pf_rtentry *rt)
|
||||
{
|
||||
return rt != NULL;
|
||||
}
|
||||
|
||||
void
|
||||
rtfree(struct pf_rtentry *rt)
|
||||
{
|
||||
if (!rt)
|
||||
return;
|
||||
if (rt->rt_ifa)
|
||||
pfk_free(rt->rt_ifa);
|
||||
pfk_free(rt);
|
||||
}
|
||||
|
||||
/* ---------------- route labels ---------------- */
|
||||
/* Routing domains/labels are a non-goal of the port; these satisfy the
|
||||
* ioctl layer and report "unavailable" instead of pretending (pfk.h). */
|
||||
int
|
||||
rtlabel_name2id(const char *name)
|
||||
{
|
||||
(void)name;
|
||||
return (0); /* 0 == no label, pf_ioctl treats as failure */
|
||||
}
|
||||
|
||||
char *
|
||||
rtlabel_id2name(unsigned int id, char *buf, size_t len)
|
||||
{
|
||||
(void)id; (void)buf; (void)len;
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
void
|
||||
rtlabel_unref(unsigned int id)
|
||||
{
|
||||
(void)id;
|
||||
}
|
||||
@@ -48,12 +48,13 @@ pfk_route6(const struct in6_addr *daddr, const struct in6_addr *saddr, int oif)
|
||||
/* xmit: BSD semantics — caller hands fully-formed IP packet + dst sock.
|
||||
* rt arg is OpenBSD's cached route (opaque to us). Returns 0/errno. */
|
||||
int
|
||||
if_output_tso(struct pfk_ifnet *ifp, struct mbuf **mp, struct sockaddr *dst,
|
||||
if_output_tso(struct pfk_ifnet *ifp, struct mbuf **mp, void *dst,
|
||||
void *rt, int mtu)
|
||||
{
|
||||
struct mbuf *m = *mp;
|
||||
struct sk_buff *skb = m_to_skb(m);
|
||||
struct dst_entry *d = NULL;
|
||||
struct sockaddr *sa = (struct sockaddr *)dst;
|
||||
int ret = 0;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct pf_ip))) {
|
||||
@@ -64,7 +65,7 @@ if_output_tso(struct pfk_ifnet *ifp, struct mbuf **mp, struct sockaddr *dst,
|
||||
ret = ENOBUFS;
|
||||
goto drop;
|
||||
}
|
||||
switch (dst->sa_family) {
|
||||
switch (sa->sa_family) {
|
||||
case AF_INET: {
|
||||
struct pf_ip *ip = mtod(m, struct pf_ip *);
|
||||
__be32 gw = 0;
|
||||
@@ -129,12 +130,14 @@ drop:
|
||||
m_freem(m);
|
||||
*mp = NULL;
|
||||
}
|
||||
if (ret == ENOBUFS || ret == ENETDOWN || ret == EHOSTUNREACH)
|
||||
pfk_if_congestion();
|
||||
return ret;
|
||||
}
|
||||
|
||||
int
|
||||
if_output_ml(struct pfk_ifnet *ifp, struct mbuf_list *ml,
|
||||
struct sockaddr *dst, void *rt)
|
||||
void *dst, void *rt)
|
||||
{
|
||||
struct mbuf *m;
|
||||
int err = 0, n;
|
||||
@@ -212,7 +215,7 @@ pfk_send_icmp_error(int family, struct sk_buff *skb_in, int type, int code,
|
||||
* ported PF code (route-to / refragment / divert paths).
|
||||
*/
|
||||
int
|
||||
pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
|
||||
pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, void *dst,
|
||||
void *rt)
|
||||
{
|
||||
struct mbuf *mp = m;
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,642 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 kern/subr_tree.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: subr_tree.c,v 1.10 2018/10/09 08:28:43 dlg Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (c) 2016 David Gwynne <dlg@openbsd.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
|
||||
static inline struct rb_entry *
|
||||
rb_n2e(const struct rb_type *t, void *node)
|
||||
{
|
||||
unsigned long addr = (unsigned long)node;
|
||||
|
||||
return ((struct rb_entry *)(addr + t->t_offset));
|
||||
}
|
||||
|
||||
static inline void *
|
||||
rb_e2n(const struct rb_type *t, struct rb_entry *rbe)
|
||||
{
|
||||
unsigned long addr = (unsigned long)rbe;
|
||||
|
||||
return ((void *)(addr - t->t_offset));
|
||||
}
|
||||
|
||||
#define RBE_LEFT(_rbe) (_rbe)->rbt_left
|
||||
#define RBE_RIGHT(_rbe) (_rbe)->rbt_right
|
||||
#define RBE_PARENT(_rbe) (_rbe)->rbt_parent
|
||||
#define RBE_COLOR(_rbe) (_rbe)->rbt_color
|
||||
|
||||
#define RBH_ROOT(_rbt) (_rbt)->rbt_root
|
||||
|
||||
static inline void
|
||||
rbe_set(struct rb_entry *rbe, struct rb_entry *parent)
|
||||
{
|
||||
RBE_PARENT(rbe) = parent;
|
||||
RBE_LEFT(rbe) = RBE_RIGHT(rbe) = NULL;
|
||||
RBE_COLOR(rbe) = RB_RED;
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_set_blackred(struct rb_entry *black, struct rb_entry *red)
|
||||
{
|
||||
RBE_COLOR(black) = RB_BLACK;
|
||||
RBE_COLOR(red) = RB_RED;
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_augment(const struct rb_type *t, struct rb_entry *rbe)
|
||||
{
|
||||
(*t->t_augment)(rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_if_augment(const struct rb_type *t, struct rb_entry *rbe)
|
||||
{
|
||||
if (t->t_augment != NULL)
|
||||
rbe_augment(t, rbe);
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_rotate_left(const struct rb_type *t, struct rb_tree *rbt,
|
||||
struct rb_entry *rbe)
|
||||
{
|
||||
struct rb_entry *parent;
|
||||
struct rb_entry *tmp;
|
||||
|
||||
tmp = RBE_RIGHT(rbe);
|
||||
RBE_RIGHT(rbe) = RBE_LEFT(tmp);
|
||||
if (RBE_RIGHT(rbe) != NULL)
|
||||
RBE_PARENT(RBE_LEFT(tmp)) = rbe;
|
||||
|
||||
parent = RBE_PARENT(rbe);
|
||||
RBE_PARENT(tmp) = parent;
|
||||
if (parent != NULL) {
|
||||
if (rbe == RBE_LEFT(parent))
|
||||
RBE_LEFT(parent) = tmp;
|
||||
else
|
||||
RBE_RIGHT(parent) = tmp;
|
||||
} else
|
||||
RBH_ROOT(rbt) = tmp;
|
||||
|
||||
RBE_LEFT(tmp) = rbe;
|
||||
RBE_PARENT(rbe) = tmp;
|
||||
|
||||
if (t->t_augment != NULL) {
|
||||
rbe_augment(t, rbe);
|
||||
rbe_augment(t, tmp);
|
||||
parent = RBE_PARENT(tmp);
|
||||
if (parent != NULL)
|
||||
rbe_augment(t, parent);
|
||||
}
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_rotate_right(const struct rb_type *t, struct rb_tree *rbt,
|
||||
struct rb_entry *rbe)
|
||||
{
|
||||
struct rb_entry *parent;
|
||||
struct rb_entry *tmp;
|
||||
|
||||
tmp = RBE_LEFT(rbe);
|
||||
RBE_LEFT(rbe) = RBE_RIGHT(tmp);
|
||||
if (RBE_LEFT(rbe) != NULL)
|
||||
RBE_PARENT(RBE_RIGHT(tmp)) = rbe;
|
||||
|
||||
parent = RBE_PARENT(rbe);
|
||||
RBE_PARENT(tmp) = parent;
|
||||
if (parent != NULL) {
|
||||
if (rbe == RBE_LEFT(parent))
|
||||
RBE_LEFT(parent) = tmp;
|
||||
else
|
||||
RBE_RIGHT(parent) = tmp;
|
||||
} else
|
||||
RBH_ROOT(rbt) = tmp;
|
||||
|
||||
RBE_RIGHT(tmp) = rbe;
|
||||
RBE_PARENT(rbe) = tmp;
|
||||
|
||||
if (t->t_augment != NULL) {
|
||||
rbe_augment(t, rbe);
|
||||
rbe_augment(t, tmp);
|
||||
parent = RBE_PARENT(tmp);
|
||||
if (parent != NULL)
|
||||
rbe_augment(t, parent);
|
||||
}
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_insert_color(const struct rb_type *t, struct rb_tree *rbt,
|
||||
struct rb_entry *rbe)
|
||||
{
|
||||
struct rb_entry *parent, *gparent, *tmp;
|
||||
|
||||
while ((parent = RBE_PARENT(rbe)) != NULL &&
|
||||
RBE_COLOR(parent) == RB_RED) {
|
||||
gparent = RBE_PARENT(parent);
|
||||
|
||||
if (parent == RBE_LEFT(gparent)) {
|
||||
tmp = RBE_RIGHT(gparent);
|
||||
if (tmp != NULL && RBE_COLOR(tmp) == RB_RED) {
|
||||
RBE_COLOR(tmp) = RB_BLACK;
|
||||
rbe_set_blackred(parent, gparent);
|
||||
rbe = gparent;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (RBE_RIGHT(parent) == rbe) {
|
||||
rbe_rotate_left(t, rbt, parent);
|
||||
tmp = parent;
|
||||
parent = rbe;
|
||||
rbe = tmp;
|
||||
}
|
||||
|
||||
rbe_set_blackred(parent, gparent);
|
||||
rbe_rotate_right(t, rbt, gparent);
|
||||
} else {
|
||||
tmp = RBE_LEFT(gparent);
|
||||
if (tmp != NULL && RBE_COLOR(tmp) == RB_RED) {
|
||||
RBE_COLOR(tmp) = RB_BLACK;
|
||||
rbe_set_blackred(parent, gparent);
|
||||
rbe = gparent;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (RBE_LEFT(parent) == rbe) {
|
||||
rbe_rotate_right(t, rbt, parent);
|
||||
tmp = parent;
|
||||
parent = rbe;
|
||||
rbe = tmp;
|
||||
}
|
||||
|
||||
rbe_set_blackred(parent, gparent);
|
||||
rbe_rotate_left(t, rbt, gparent);
|
||||
}
|
||||
}
|
||||
|
||||
RBE_COLOR(RBH_ROOT(rbt)) = RB_BLACK;
|
||||
}
|
||||
|
||||
static inline void
|
||||
rbe_remove_color(const struct rb_type *t, struct rb_tree *rbt,
|
||||
struct rb_entry *parent, struct rb_entry *rbe)
|
||||
{
|
||||
struct rb_entry *tmp;
|
||||
|
||||
while ((rbe == NULL || RBE_COLOR(rbe) == RB_BLACK) &&
|
||||
rbe != RBH_ROOT(rbt)) {
|
||||
if (RBE_LEFT(parent) == rbe) {
|
||||
tmp = RBE_RIGHT(parent);
|
||||
if (RBE_COLOR(tmp) == RB_RED) {
|
||||
rbe_set_blackred(tmp, parent);
|
||||
rbe_rotate_left(t, rbt, parent);
|
||||
tmp = RBE_RIGHT(parent);
|
||||
}
|
||||
if ((RBE_LEFT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_LEFT(tmp)) == RB_BLACK) &&
|
||||
(RBE_RIGHT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_RIGHT(tmp)) == RB_BLACK)) {
|
||||
RBE_COLOR(tmp) = RB_RED;
|
||||
rbe = parent;
|
||||
parent = RBE_PARENT(rbe);
|
||||
} else {
|
||||
if (RBE_RIGHT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_RIGHT(tmp)) == RB_BLACK) {
|
||||
struct rb_entry *oleft;
|
||||
|
||||
oleft = RBE_LEFT(tmp);
|
||||
if (oleft != NULL)
|
||||
RBE_COLOR(oleft) = RB_BLACK;
|
||||
|
||||
RBE_COLOR(tmp) = RB_RED;
|
||||
rbe_rotate_right(t, rbt, tmp);
|
||||
tmp = RBE_RIGHT(parent);
|
||||
}
|
||||
|
||||
RBE_COLOR(tmp) = RBE_COLOR(parent);
|
||||
RBE_COLOR(parent) = RB_BLACK;
|
||||
if (RBE_RIGHT(tmp))
|
||||
RBE_COLOR(RBE_RIGHT(tmp)) = RB_BLACK;
|
||||
|
||||
rbe_rotate_left(t, rbt, parent);
|
||||
rbe = RBH_ROOT(rbt);
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
tmp = RBE_LEFT(parent);
|
||||
if (RBE_COLOR(tmp) == RB_RED) {
|
||||
rbe_set_blackred(tmp, parent);
|
||||
rbe_rotate_right(t, rbt, parent);
|
||||
tmp = RBE_LEFT(parent);
|
||||
}
|
||||
|
||||
if ((RBE_LEFT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_LEFT(tmp)) == RB_BLACK) &&
|
||||
(RBE_RIGHT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_RIGHT(tmp)) == RB_BLACK)) {
|
||||
RBE_COLOR(tmp) = RB_RED;
|
||||
rbe = parent;
|
||||
parent = RBE_PARENT(rbe);
|
||||
} else {
|
||||
if (RBE_LEFT(tmp) == NULL ||
|
||||
RBE_COLOR(RBE_LEFT(tmp)) == RB_BLACK) {
|
||||
struct rb_entry *oright;
|
||||
|
||||
oright = RBE_RIGHT(tmp);
|
||||
if (oright != NULL)
|
||||
RBE_COLOR(oright) = RB_BLACK;
|
||||
|
||||
RBE_COLOR(tmp) = RB_RED;
|
||||
rbe_rotate_left(t, rbt, tmp);
|
||||
tmp = RBE_LEFT(parent);
|
||||
}
|
||||
|
||||
RBE_COLOR(tmp) = RBE_COLOR(parent);
|
||||
RBE_COLOR(parent) = RB_BLACK;
|
||||
if (RBE_LEFT(tmp) != NULL)
|
||||
RBE_COLOR(RBE_LEFT(tmp)) = RB_BLACK;
|
||||
|
||||
rbe_rotate_right(t, rbt, parent);
|
||||
rbe = RBH_ROOT(rbt);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (rbe != NULL)
|
||||
RBE_COLOR(rbe) = RB_BLACK;
|
||||
}
|
||||
|
||||
static inline struct rb_entry *
|
||||
rbe_remove(const struct rb_type *t, struct rb_tree *rbt, struct rb_entry *rbe)
|
||||
{
|
||||
struct rb_entry *child, *parent, *old = rbe;
|
||||
unsigned int color;
|
||||
|
||||
if (RBE_LEFT(rbe) == NULL)
|
||||
child = RBE_RIGHT(rbe);
|
||||
else if (RBE_RIGHT(rbe) == NULL)
|
||||
child = RBE_LEFT(rbe);
|
||||
else {
|
||||
struct rb_entry *tmp;
|
||||
|
||||
rbe = RBE_RIGHT(rbe);
|
||||
while ((tmp = RBE_LEFT(rbe)) != NULL)
|
||||
rbe = tmp;
|
||||
|
||||
child = RBE_RIGHT(rbe);
|
||||
parent = RBE_PARENT(rbe);
|
||||
color = RBE_COLOR(rbe);
|
||||
if (child != NULL)
|
||||
RBE_PARENT(child) = parent;
|
||||
if (parent != NULL) {
|
||||
if (RBE_LEFT(parent) == rbe)
|
||||
RBE_LEFT(parent) = child;
|
||||
else
|
||||
RBE_RIGHT(parent) = child;
|
||||
|
||||
rbe_if_augment(t, parent);
|
||||
} else
|
||||
RBH_ROOT(rbt) = child;
|
||||
if (RBE_PARENT(rbe) == old)
|
||||
parent = rbe;
|
||||
*rbe = *old;
|
||||
|
||||
tmp = RBE_PARENT(old);
|
||||
if (tmp != NULL) {
|
||||
if (RBE_LEFT(tmp) == old)
|
||||
RBE_LEFT(tmp) = rbe;
|
||||
else
|
||||
RBE_RIGHT(tmp) = rbe;
|
||||
|
||||
rbe_if_augment(t, tmp);
|
||||
} else
|
||||
RBH_ROOT(rbt) = rbe;
|
||||
|
||||
RBE_PARENT(RBE_LEFT(old)) = rbe;
|
||||
if (RBE_RIGHT(old))
|
||||
RBE_PARENT(RBE_RIGHT(old)) = rbe;
|
||||
|
||||
if (t->t_augment != NULL && parent != NULL) {
|
||||
tmp = parent;
|
||||
do {
|
||||
rbe_augment(t, tmp);
|
||||
tmp = RBE_PARENT(tmp);
|
||||
} while (tmp != NULL);
|
||||
}
|
||||
|
||||
goto color;
|
||||
}
|
||||
|
||||
parent = RBE_PARENT(rbe);
|
||||
color = RBE_COLOR(rbe);
|
||||
|
||||
if (child != NULL)
|
||||
RBE_PARENT(child) = parent;
|
||||
if (parent != NULL) {
|
||||
if (RBE_LEFT(parent) == rbe)
|
||||
RBE_LEFT(parent) = child;
|
||||
else
|
||||
RBE_RIGHT(parent) = child;
|
||||
|
||||
rbe_if_augment(t, parent);
|
||||
} else
|
||||
RBH_ROOT(rbt) = child;
|
||||
color:
|
||||
if (color == RB_BLACK)
|
||||
rbe_remove_color(t, rbt, parent, child);
|
||||
|
||||
return (old);
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_remove(const struct rb_type *t, struct rb_tree *rbt, void *elm)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, elm);
|
||||
struct rb_entry *old;
|
||||
|
||||
old = rbe_remove(t, rbt, rbe);
|
||||
|
||||
return (old == NULL ? NULL : rb_e2n(t, old));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_insert(const struct rb_type *t, struct rb_tree *rbt, void *elm)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, elm);
|
||||
struct rb_entry *tmp;
|
||||
struct rb_entry *parent = NULL;
|
||||
void *node;
|
||||
int comp = 0;
|
||||
|
||||
tmp = RBH_ROOT(rbt);
|
||||
while (tmp != NULL) {
|
||||
parent = tmp;
|
||||
|
||||
node = rb_e2n(t, tmp);
|
||||
comp = (*t->t_compare)(elm, node);
|
||||
if (comp < 0)
|
||||
tmp = RBE_LEFT(tmp);
|
||||
else if (comp > 0)
|
||||
tmp = RBE_RIGHT(tmp);
|
||||
else
|
||||
return (node);
|
||||
}
|
||||
|
||||
rbe_set(rbe, parent);
|
||||
|
||||
if (parent != NULL) {
|
||||
if (comp < 0)
|
||||
RBE_LEFT(parent) = rbe;
|
||||
else
|
||||
RBE_RIGHT(parent) = rbe;
|
||||
|
||||
rbe_if_augment(t, parent);
|
||||
} else
|
||||
RBH_ROOT(rbt) = rbe;
|
||||
|
||||
rbe_insert_color(t, rbt, rbe);
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
/* Finds the node with the same key as elm */
|
||||
void *
|
||||
_rb_find(const struct rb_type *t, struct rb_tree *rbt, const void *key)
|
||||
{
|
||||
struct rb_entry *tmp = RBH_ROOT(rbt);
|
||||
void *node;
|
||||
int comp;
|
||||
|
||||
while (tmp != NULL) {
|
||||
node = rb_e2n(t, tmp);
|
||||
comp = (*t->t_compare)(key, node);
|
||||
if (comp < 0)
|
||||
tmp = RBE_LEFT(tmp);
|
||||
else if (comp > 0)
|
||||
tmp = RBE_RIGHT(tmp);
|
||||
else
|
||||
return (node);
|
||||
}
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
/* Finds the first node greater than or equal to the search key */
|
||||
void *
|
||||
_rb_nfind(const struct rb_type *t, struct rb_tree *rbt, const void *key)
|
||||
{
|
||||
struct rb_entry *tmp = RBH_ROOT(rbt);
|
||||
void *node;
|
||||
void *res = NULL;
|
||||
int comp;
|
||||
|
||||
while (tmp != NULL) {
|
||||
node = rb_e2n(t, tmp);
|
||||
comp = (*t->t_compare)(key, node);
|
||||
if (comp < 0) {
|
||||
res = node;
|
||||
tmp = RBE_LEFT(tmp);
|
||||
} else if (comp > 0)
|
||||
tmp = RBE_RIGHT(tmp);
|
||||
else
|
||||
return (node);
|
||||
}
|
||||
|
||||
return (res);
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_next(const struct rb_type *t, void *elm)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, elm);
|
||||
|
||||
if (RBE_RIGHT(rbe) != NULL) {
|
||||
rbe = RBE_RIGHT(rbe);
|
||||
while (RBE_LEFT(rbe) != NULL)
|
||||
rbe = RBE_LEFT(rbe);
|
||||
} else {
|
||||
if (RBE_PARENT(rbe) &&
|
||||
(rbe == RBE_LEFT(RBE_PARENT(rbe))))
|
||||
rbe = RBE_PARENT(rbe);
|
||||
else {
|
||||
while (RBE_PARENT(rbe) &&
|
||||
(rbe == RBE_RIGHT(RBE_PARENT(rbe))))
|
||||
rbe = RBE_PARENT(rbe);
|
||||
rbe = RBE_PARENT(rbe);
|
||||
}
|
||||
}
|
||||
|
||||
return (rbe == NULL ? NULL : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_prev(const struct rb_type *t, void *elm)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, elm);
|
||||
|
||||
if (RBE_LEFT(rbe)) {
|
||||
rbe = RBE_LEFT(rbe);
|
||||
while (RBE_RIGHT(rbe))
|
||||
rbe = RBE_RIGHT(rbe);
|
||||
} else {
|
||||
if (RBE_PARENT(rbe) &&
|
||||
(rbe == RBE_RIGHT(RBE_PARENT(rbe))))
|
||||
rbe = RBE_PARENT(rbe);
|
||||
else {
|
||||
while (RBE_PARENT(rbe) &&
|
||||
(rbe == RBE_LEFT(RBE_PARENT(rbe))))
|
||||
rbe = RBE_PARENT(rbe);
|
||||
rbe = RBE_PARENT(rbe);
|
||||
}
|
||||
}
|
||||
|
||||
return (rbe == NULL ? NULL : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_root(const struct rb_type *t, struct rb_tree *rbt)
|
||||
{
|
||||
struct rb_entry *rbe = RBH_ROOT(rbt);
|
||||
|
||||
return (rbe == NULL ? rbe : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_min(const struct rb_type *t, struct rb_tree *rbt)
|
||||
{
|
||||
struct rb_entry *rbe = RBH_ROOT(rbt);
|
||||
struct rb_entry *parent = NULL;
|
||||
|
||||
while (rbe != NULL) {
|
||||
parent = rbe;
|
||||
rbe = RBE_LEFT(rbe);
|
||||
}
|
||||
|
||||
return (parent == NULL ? NULL : rb_e2n(t, parent));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_max(const struct rb_type *t, struct rb_tree *rbt)
|
||||
{
|
||||
struct rb_entry *rbe = RBH_ROOT(rbt);
|
||||
struct rb_entry *parent = NULL;
|
||||
|
||||
while (rbe != NULL) {
|
||||
parent = rbe;
|
||||
rbe = RBE_RIGHT(rbe);
|
||||
}
|
||||
|
||||
return (parent == NULL ? NULL : rb_e2n(t, parent));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_left(const struct rb_type *t, void *node)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
rbe = RBE_LEFT(rbe);
|
||||
return (rbe == NULL ? NULL : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_right(const struct rb_type *t, void *node)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
rbe = RBE_RIGHT(rbe);
|
||||
return (rbe == NULL ? NULL : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void *
|
||||
_rb_parent(const struct rb_type *t, void *node)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
rbe = RBE_PARENT(rbe);
|
||||
return (rbe == NULL ? NULL : rb_e2n(t, rbe));
|
||||
}
|
||||
|
||||
void
|
||||
_rb_set_left(const struct rb_type *t, void *node, void *left)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
struct rb_entry *rbl = (left == NULL) ? NULL : rb_n2e(t, left);
|
||||
|
||||
RBE_LEFT(rbe) = rbl;
|
||||
}
|
||||
|
||||
void
|
||||
_rb_set_right(const struct rb_type *t, void *node, void *right)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
struct rb_entry *rbr = (right == NULL) ? NULL : rb_n2e(t, right);
|
||||
|
||||
RBE_RIGHT(rbe) = rbr;
|
||||
}
|
||||
|
||||
void
|
||||
_rb_set_parent(const struct rb_type *t, void *node, void *parent)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
struct rb_entry *rbp = (parent == NULL) ? NULL : rb_n2e(t, parent);
|
||||
|
||||
RBE_PARENT(rbe) = rbp;
|
||||
}
|
||||
|
||||
void
|
||||
_rb_poison(const struct rb_type *t, void *node, unsigned long poison)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
|
||||
RBE_PARENT(rbe) = RBE_LEFT(rbe) = RBE_RIGHT(rbe) =
|
||||
(struct rb_entry *)poison;
|
||||
}
|
||||
|
||||
int
|
||||
_rb_check(const struct rb_type *t, void *node, unsigned long poison)
|
||||
{
|
||||
struct rb_entry *rbe = rb_n2e(t, node);
|
||||
|
||||
return ((unsigned long)RBE_PARENT(rbe) == poison &&
|
||||
(unsigned long)RBE_LEFT(rbe) == poison &&
|
||||
(unsigned long)RBE_RIGHT(rbe) == poison);
|
||||
}
|
||||
@@ -13,4 +13,5 @@
|
||||
#define IFT_PFLOG 0xf0
|
||||
#define IFT_PFSYNC 0xf1
|
||||
#define IFT_CARP 0xf8
|
||||
#define IFT_ENC 0xf4 /* Encapsulation (OpenBSD net/if_types.h) */
|
||||
#endif
|
||||
@@ -13,7 +13,7 @@
|
||||
* pfk.h before this header. */
|
||||
struct mbuf;
|
||||
struct mbuf_list;
|
||||
struct ifnet;
|
||||
struct pfk_ifnet;
|
||||
struct pfk_ifnet;
|
||||
struct pf_queuespec;
|
||||
|
||||
@@ -60,7 +60,7 @@ extern const struct ifq_ops * const ifq_fqcodel_ops;
|
||||
extern const struct pfq_ops * const pfq_hfsc_ops;
|
||||
extern const struct pfq_ops * const pfq_fqcodel_ops;
|
||||
|
||||
void ifq_init(struct ifqueue *, struct ifnet *, unsigned int);
|
||||
void ifq_init(struct ifqueue *, struct pfk_ifnet *, unsigned int);
|
||||
void ifq_init_maxlen(struct ifqueue *, unsigned int);
|
||||
void ifq_attach(struct ifqueue *, const struct ifq_ops *, void *);
|
||||
void ifq_destroy(struct ifqueue *);
|
||||
|
||||
@@ -11,9 +11,12 @@ struct pf_rtentry {
|
||||
void *rt_addr; /* destination */
|
||||
unsigned int rt_ifidx; /* egress ifindex */
|
||||
unsigned int rt_flags;
|
||||
#ifndef RTF_UP
|
||||
#define RTF_UP 0x1 /* route usable (OpenBSD net/route.h) */
|
||||
#endif
|
||||
int rt_listid;
|
||||
int rt_labelid;
|
||||
void *rt_ifa;
|
||||
void *rt_ifa; /* BSD in_ifaddr/in6_ifaddr view */
|
||||
};
|
||||
|
||||
int rtable_exists(unsigned int rtableid);
|
||||
|
||||
@@ -3,6 +3,10 @@
|
||||
#define _PFK_NETINET_IN_H
|
||||
#include <linux/in.h>
|
||||
#include <linux/in6.h>
|
||||
/* BSD protocol number aliases (OpenBSD <netinet/in.h>) */
|
||||
#ifndef IPPROTO_IPV4
|
||||
#define IPPROTO_IPV4 IPPROTO_IPIP /* IP inside IP */
|
||||
#endif
|
||||
/* BSD IP-level option numbers (Linux uapi uses different values) */
|
||||
#define PF_IP_OPTIONS 1
|
||||
#define PF_IP_RECORD_ROUTE 7
|
||||
|
||||
+205
-3
@@ -218,6 +218,7 @@ struct ip6_frag {
|
||||
/* PF mbuf tags (our namespace; upstream uses PACKET_TAG_PF_*) */
|
||||
#define PACKET_TAG_PF_REASSEMBLED 0x50460001
|
||||
#define PACKET_TAG_PF_REFRAGMENTED 0x50460002
|
||||
#define PACKET_TAG_PF_DIVERT 0x50460003
|
||||
|
||||
/* OpenBSD builds the kernel with DIAGNOSTIC (extra KASSERT coverage) */
|
||||
#ifndef DIAGNOSTIC
|
||||
@@ -326,6 +327,7 @@ struct pfk_rwlock {
|
||||
#define PFKIOC_TYPE(nr) (((nr) >> PFKXIOC_TYPESHIFT) & ((1U<<PFKXIOC_TYPEBITS)-1))
|
||||
#define PFKIOC_NR(nr) (((nr) >> PFKXIOC_NRSHIFT) & ((1U<<PFKXIOC_NRBITS)-1))
|
||||
#define PFKIOC_DIR(nr) (((nr) >> PFKXIOC_DIRSHIFT) & ((1U<<PFKXIOC_DIRBITS)-1))
|
||||
#define PFKIOC_SIZE(nr) (((nr) >> PFKXIOC_SIZESHIFT) & ((1U<<PFKXIOC_SIZEBITS)-1))
|
||||
|
||||
/* BSD host<->big endian names (the kernel uses cpu_to_beXX spellings) */
|
||||
#ifndef htobe16
|
||||
@@ -580,10 +582,187 @@ unhandled_af(int af)
|
||||
|
||||
/* mbuf + BSD wire structs + pf ifnet registry */
|
||||
#include "compat/net/ifq.h"
|
||||
#include "compat/net/rtable.h"
|
||||
#include "compat/sys/percpu.h"
|
||||
#include "compat/netinet/in.h"
|
||||
#include "pfk_mbuf.h"
|
||||
#include "pfk_net.h"
|
||||
#include "pfk_if.h"
|
||||
|
||||
/* ---------------------------------------------------------------- M1 glue */
|
||||
/* BSD parameter helpers (OpenBSD <sys/param.h>) */
|
||||
#ifndef imax
|
||||
#define imax(a, b) ((a) > (b) ? (a) : (b))
|
||||
#endif
|
||||
#ifndef imin
|
||||
#define imin(a, b) ((a) < (b) ? (a) : (b))
|
||||
#endif
|
||||
#define ALIGNED_POINTER(p, t) ((((unsigned long)(p) % __alignof__(t)) == 0) && \
|
||||
(((unsigned long)(p) % sizeof(t)) == 0))
|
||||
|
||||
/* BSD asserts with message */
|
||||
#define KASSERTMSG(cond, fmt...) KASSERT(cond)
|
||||
|
||||
/* BSD process sentinel (OpenBSD <sys/proc.h> NO_PID) */
|
||||
#ifndef NO_PID
|
||||
#define NO_PID ((pid_t)-1)
|
||||
#endif
|
||||
|
||||
/* BSD atomic swap helpers (OpenBSD <sys/atomic.h>): like Linux cmpxchg but
|
||||
* return the old value on success and 0/NULL on failure (OpenBSD semantics
|
||||
* as used by pf.c). */
|
||||
#define atomic_cas_ptr(p, o, n) \
|
||||
((cmpxchg((p), (o), (n)) == (o)) ? (o) : (typeof(o))NULL)
|
||||
#define atomic_cas_uint(p, o, n) \
|
||||
((cmpxchg((p), (o), (n)) == (unsigned int)(o)) ? (unsigned int)(o) : 0u)
|
||||
|
||||
/* SMR → Linux RCU */
|
||||
static inline void smr_read_enter(void) { rcu_read_lock(); }
|
||||
static inline void smr_read_leave(void) { rcu_read_unlock(); }
|
||||
|
||||
/*
|
||||
* struct inpcb — OpenBSD's kernel PCB view as used by PF (pf.c:
|
||||
* pf_socket_lookup/pf_mbuf_link_inpcb/pf_state_key_link_inpcb). The port
|
||||
* does not have BSD PCBs: one struct inpcb is created per successful Linux
|
||||
* socket lookup and lives as long as PF holds references to it (mbufs,
|
||||
* state keys). Implemented in compat/pfk_pcb.c.
|
||||
*/
|
||||
struct pfk_socket { /* BSD struct socket fields PF consumes */
|
||||
uid_t so_euid;
|
||||
gid_t so_egid;
|
||||
pid_t so_cpid;
|
||||
};
|
||||
struct inpcb {
|
||||
refcount_t inp_refcnt;
|
||||
struct pf_state_key *inp_pf_sk; /* PF state linkage */
|
||||
struct sock *inp_sock; /* backing Linux socket */
|
||||
struct pfk_socket inp_soinfo_storage;
|
||||
struct pfk_socket *inp_socket; /* → storage above */
|
||||
};
|
||||
struct inpcbtable { /* OpenBSD PCB table head (opaque handle) */
|
||||
int pfk_unused;
|
||||
};
|
||||
extern struct inpcbtable tcbtable, udbtable, tcb6table, udb6table;
|
||||
|
||||
struct inpcb *in_pcbref(struct inpcb *);
|
||||
void in_pcbunref(struct inpcb *);
|
||||
struct inpcb *in_pcblookup(struct inpcbtable *, struct in_addr faddr,
|
||||
u_int fport, struct in_addr laddr, u_int lport, u_int rtableid);
|
||||
struct inpcb *in_pcblookup_listen(struct inpcbtable *, struct in_addr laddr,
|
||||
u_int lport, struct mbuf *m, u_int rtableid);
|
||||
struct inpcb *in6_pcblookup(struct inpcbtable *, const struct in6_addr *faddr,
|
||||
u_int fport, const struct in6_addr *laddr, u_int lport,
|
||||
u_int rtableid);
|
||||
struct inpcb *in6_pcblookup_listen(struct inpcbtable *, struct in6_addr *laddr,
|
||||
u_int lport, struct mbuf *m, u_int rtableid);
|
||||
int pfk_pcb_init(void);
|
||||
void pfk_pcb_exit(void);
|
||||
|
||||
/* OpenBSD counters(9): per-CPU u64 slots (struct cpumem from percpu.h) */
|
||||
struct cpumem *counters_alloc(u_int count);
|
||||
void counters_free(struct cpumem *);
|
||||
void counters_inc(struct cpumem *, u_int idx);
|
||||
void counters_zero(struct cpumem *, u_int count);
|
||||
void counters_read(struct cpumem *, uint64_t *result, u_int count,
|
||||
uint64_t *scratch);
|
||||
|
||||
/* task/timeout static initializers (OpenBSD <sys/task.h> <sys/timeout.h>) */
|
||||
#define TASK_INITIALIZER(_f, _a) { .ta_data = (_a), .ta_func = (_f) }
|
||||
#define TIMEOUT_INITIALIZER(_f, _a) { .fn = (_f), .arg = (_a) }
|
||||
|
||||
/* timeout_add_msec: timeout_add() already takes milliseconds upstream */
|
||||
int timeout_add_msec(struct timeout *to, int msecs);
|
||||
|
||||
/* curcpu(9): OpenBSD per-CPU info; only ci_schedstate.spc_schedflags is
|
||||
* consumed by pf.c (SPCF_SHOULDYIELD). Mapped to need_resched(). */
|
||||
struct pfk_schedstate { int spc_schedflags; };
|
||||
struct pfk_cpu_info { struct pfk_schedstate ci_schedstate; };
|
||||
#define SPCF_SHOULDYIELD 0x1
|
||||
struct pfk_cpu_info *pfk_curcpu(void);
|
||||
#define curcpu() pfk_curcpu()
|
||||
|
||||
/* interface refcounting (OpenBSD if_get/if_put/if_get_smr) */
|
||||
struct pfk_ifnet *if_get(int ifidx);
|
||||
struct pfk_ifnet *if_get_smr(int ifidx);
|
||||
void if_put(struct pfk_ifnet *ifp);
|
||||
int if_congested(void);
|
||||
void pfk_if_congestion(void); /* stamp "tx resources exhausted" now */
|
||||
|
||||
/* OpenBSD route/rtable API for PF (compat/pfk_rtable.c over the Linux FIB) */
|
||||
#define RT_RESOLVE 1 /* rtalloc() flag: resolve the route */
|
||||
/* PFLINUX: `sa` is const void * so BSD sintosa/sin6tosa/sstosa macro
|
||||
* results (which keep their concrete sockaddr types) pass directly. */
|
||||
struct pf_rtentry *rtalloc(const void *sa, int, unsigned int);
|
||||
struct pf_rtentry *rtalloc_mpath(const void *sa, uint32_t *,
|
||||
unsigned int);
|
||||
int rtisvalid(struct pf_rtentry *);
|
||||
void rtfree(struct pf_rtentry *);
|
||||
#define sstosa(ss) ((struct sockaddr *)(void *)(ss))
|
||||
|
||||
/* BSD in_ifaddr/in6_ifaddr views (OpenBSD <netinet/in_var.h>). The Linux
|
||||
* in_ifaddr tag is already taken, so the port keeps its own types. */
|
||||
struct pfk_in_ifaddr {
|
||||
struct ifaddr ifa_ifa;
|
||||
struct sockaddr_in ia_addr;
|
||||
};
|
||||
struct pfk_in6_ifaddr {
|
||||
struct ifaddr ifa_ifa;
|
||||
struct sockaddr_in6 ia_addr;
|
||||
};
|
||||
#define ifatoia(ifa) ((struct pfk_in_ifaddr *)(void *)(ifa))
|
||||
#define ifatoia6(ifa) ((struct pfk_in6_ifaddr *)(void *)(ifa))
|
||||
|
||||
/* OpenBSD sysctl-backed globals (pfk_kern.c) */
|
||||
extern int ip_forwarding; /* 0 off, 1 on, 2 ipsec-only (we: init-synced) */
|
||||
extern int ip_directedbcast; /* accept directed broadcast */
|
||||
extern int ipmultipath; /* multipath routing enable */
|
||||
extern int ip6_multipath;
|
||||
extern int ip_mtudisc; /* PMTU discovery */
|
||||
extern int ip_defttl; /* default IPv4 TTL */
|
||||
extern u_int max_linkhdr; /* max link-level header size */
|
||||
void pfk_sysctl_sync(void); /* mirror Linux sysctls into BSD globals */
|
||||
extern tcp_seq tcp_iss; /* tcp initial send seq # (random salt) */
|
||||
|
||||
/* ip_output/ip_forward flags (OpenBSD <netinet/ip_var.h>) */
|
||||
#define IP_FORWARDING 0x0001
|
||||
#define IP_ALLOWBROADCAST 0x0002
|
||||
#define IP_MINMTU 0x0004
|
||||
#define IP_REDIRECT 0x0008
|
||||
#define IP_FORWARDING_IPSEC 0x0010
|
||||
#define IPTTLDEC 1
|
||||
|
||||
/* BSD IPv4 layer entry points used by pf.c (compat/pfk_ip4.c). ip_output/
|
||||
* ip_forward/ip6_output clash with Linux declarations, so the staging seds
|
||||
* rename them to pfk_* (see stage-port.sh). */
|
||||
void ip_send(struct mbuf *);
|
||||
void ip6_send(struct mbuf *);
|
||||
void icmp_error(struct mbuf *, u_int type, u_int code, u_int dest,
|
||||
u_int mtu);
|
||||
int ip_fragment(struct mbuf *, struct mbuf_list *, struct pfk_ifnet *,
|
||||
int);
|
||||
int pfk_ip_output(struct mbuf *, void *, void *, u_int, void *, void *,
|
||||
u_int);
|
||||
void pfk_ip_forward(struct mbuf *, struct pfk_ifnet *, void *, u_int);
|
||||
int pfk_ip6_output(struct mbuf *, void *, void *, u_int, void *, void *);
|
||||
|
||||
/* BSD checksum helpers (compat/pfk_ip4.c) */
|
||||
u_int16_t in_cksum(struct mbuf *, int);
|
||||
u_int16_t in4_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len);
|
||||
u_int16_t in6_cksum(struct mbuf *m, __u8 nxt, u_int32_t off, u_int32_t len);
|
||||
void in_hdr_cksum_out(struct mbuf *, void *);
|
||||
|
||||
/* divert layer (pfsrc/divert_sock.c; BSD AF_DIVERT semantics) */
|
||||
void divert_packet(struct mbuf *, int dir, u_int16_t divert_port);
|
||||
void divert6_packet(struct mbuf *, int dir, u_int16_t divert_port);
|
||||
|
||||
/* BSD statistics hooks: counters live in pf_status_fcounters/pf_kif in the
|
||||
* port; the netinet ip/tcp counters are not ported (no-op). */
|
||||
#define ipstat_inc(c) do { } while (0)
|
||||
#define tcpstat_inc(c) do { } while (0)
|
||||
|
||||
/* BSD SEQ helpers (OpenBSD <netinet/tcp_seq.h>) */
|
||||
#define SEQ_LEQ(a, b) ((int)((a) - (b)) <= 0)
|
||||
|
||||
struct pf_source;
|
||||
#define SEC_TO_NSEC(x) ((uint64_t)(x) * 1000000000ULL)
|
||||
#define NSEC_TO_SEC(x) ((x) / 1000000000ULL)
|
||||
@@ -626,6 +805,9 @@ struct m_tag *m_tag_get(int type, int len, int flags);
|
||||
#define PF_TAG_REFRAGMENTED_PACKET 0x0020
|
||||
#define PF_TAG_SYNCOOKIE_RECREATED 0x0040
|
||||
#define PF_TAG_SYNCOOKIE 0x0080
|
||||
/* m_pkthdr.pf.flag bits, continuing the upstream bit space */
|
||||
#define PF_TAG_DIVERTED_PACKET 0x0100
|
||||
#define PF_TAG_PROCESSED 0x0200
|
||||
|
||||
/* OpenBSD route entry (kernel-internal PF type; pointer use only) */
|
||||
struct pf_rtentry;
|
||||
@@ -896,10 +1078,14 @@ timersub(const struct timeval *tvp, const struct timeval *uvp,
|
||||
}
|
||||
}
|
||||
|
||||
/* IPv6 forwarding state (OpenBSD sys/netinet6 variables) */
|
||||
/* IPv6 forwarding state (OpenBSD sys/netinet6 variables).
|
||||
* ip6_output/ip6_forward flag values per OpenBSD <netinet6/ip6_var.h>;
|
||||
* IPV6_MINMTU/IPV6_UNSPECSRC are omitted: upstream PF code never uses
|
||||
* them and IPV6_MINMTU already means 1280 above (name clash upstream). */
|
||||
extern int ip6_forwarding;
|
||||
#define IPV6_FORWARDING 0x1
|
||||
#define IPV6_FORWARDING_IPSEC 0x2
|
||||
#define IPV6_FORWARDING 0x02
|
||||
#define IPV6_REDIRECT 0x08
|
||||
#define IPV6_FORWARDING_IPSEC 0x10
|
||||
#define ip6s_cantforward 0
|
||||
#define ip6stat_inc(c) do { } while (0)
|
||||
|
||||
@@ -996,4 +1182,20 @@ void pf_update_state_timeout(struct pf_state *, int);
|
||||
|
||||
void pfk_mod_init_done(void);
|
||||
|
||||
/* pf.c entry points that are non-static upstream but have no header
|
||||
* prototype at this include order (-Wmissing-prototypes). */
|
||||
struct pf_anchor_stackframe;
|
||||
struct pf_anchor;
|
||||
struct pf_ruleset;
|
||||
void pf_anchor_stack_init(void);
|
||||
int pf_anchor_stack_is_full(struct pf_anchor_stackframe *);
|
||||
int pf_anchor_stack_is_empty(struct pf_anchor_stackframe *);
|
||||
struct pf_anchor_stackframe *pf_anchor_stack_top(void);
|
||||
int pf_anchor_stack_push(struct pf_ruleset *, struct pf_rule *,
|
||||
struct pf_rule *, struct pf_anchor *, int);
|
||||
int pf_anchor_stack_pop(struct pf_ruleset **, struct pf_rule **,
|
||||
struct pf_rule **, struct pf_anchor **, int *);
|
||||
struct inpcb;
|
||||
void pf_remove_divert_state(struct inpcb *);
|
||||
|
||||
#endif /* _PFK_H */
|
||||
@@ -86,13 +86,16 @@ struct pfk_ifnet *pfk_if_next(struct pfk_ifnet *ifp);
|
||||
struct pfk_ifnet *pfk_if_next_from(int *idp);
|
||||
struct net_device *ip_rt_get_default_dev(struct net *net);
|
||||
|
||||
/* xmit API used by pf_route/pf output (implemented in pfk_xmit.c) */
|
||||
/* xmit API used by pf_route/pf output (implemented in pfk_xmit.c).
|
||||
* PFLINUX: `dst` is void * so BSD accessor macros (sintosa/sin6tosa,
|
||||
* which keep the sockaddr_in/sockaddr_in6 type for field access) can be
|
||||
* passed directly, as staged pf.c does. */
|
||||
int if_output_tso(struct pfk_ifnet *ifp, struct mbuf **mp,
|
||||
struct sockaddr *dst, void *rt, int mtu);
|
||||
void *dst, void *rt, int mtu);
|
||||
int if_output_ml(struct pfk_ifnet *ifp, struct mbuf_list *ml,
|
||||
struct sockaddr *dst, void *rt);
|
||||
void *dst, void *rt);
|
||||
int if_enqueue(struct pfk_ifnet *ifp, struct mbuf *m);
|
||||
int pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, struct sockaddr *dst, void *rt);
|
||||
int pfk_if_output(struct pfk_ifnet *ifp, struct mbuf *m, void *dst, void *rt);
|
||||
|
||||
/* addr lookups (ifa_ifwithaddr, in_ifwithaddr etc.) */
|
||||
struct ifaddr *pfk_ifwithaddr(const struct sockaddr *sa);
|
||||
|
||||
@@ -91,6 +91,26 @@ struct pkthdr {
|
||||
#define M_BCAST 0x0020
|
||||
#define M_MCAST 0x0040
|
||||
#define M_LOOP 0x0080
|
||||
/* m_pkthdr.csum_flags bits (OpenBSD <sys/mbuf.h> names, port values).
|
||||
* PFLINUX: the port does not trust driver offload yet; ingress packets get
|
||||
* no IN_OK bit and pf.c re-checksums in software (pf_check_tcp_cksum). */
|
||||
#define M_TCP_CSUM_IN_OK 0x0001
|
||||
#define M_TCP_CSUM_IN_BAD 0x0002
|
||||
#define M_TCP_CSUM_OUT 0x0004
|
||||
#define M_UDP_CSUM_IN_OK 0x0010
|
||||
#define M_UDP_CSUM_IN_BAD 0x0020
|
||||
#define M_UDP_CSUM_OUT 0x0040
|
||||
#define M_ICMP_CSUM_OUT 0x0100
|
||||
#define M_IPV4_CSUM_OUT 0x0200
|
||||
#define M_FLOWID 0x0400
|
||||
/* m_copym/m_dup "copy everything" length (OpenBSD <sys/mbuf.h>) */
|
||||
#ifndef M_COPYALL
|
||||
#define M_COPYALL 1000000000
|
||||
#endif
|
||||
/* BSD M_PREPEND (OpenBSD <sys/mbuf.h>): m = m_prepend(m, h, f) */
|
||||
#ifndef M_PREPEND
|
||||
#define M_PREPEND(m, h, f) ((m) = m_prepend((m), (h), (f)))
|
||||
#endif
|
||||
#define M_SKIP_FIREWALL 0x0100
|
||||
#define M_BPF_MCAST 0x0200
|
||||
#define M_PROMISC 0x0400
|
||||
@@ -127,6 +147,9 @@ void pfk_m_setpkthdr(struct mbuf *m);
|
||||
|
||||
struct mbuf *m_copym(struct mbuf *m, int off, int len, int wait);
|
||||
struct mbuf *m_dup(struct mbuf *m, int wait); /* full dup + headroom */
|
||||
struct mbuf *m_prepend(struct mbuf *m, int len, int how);
|
||||
struct mbuf *m_split(struct mbuf *m, int len, int flags);
|
||||
struct mbuf *m_dup_pkt(struct mbuf *m, u_int hdr, int how);
|
||||
#define m_copypacket(m, w) m_copym((m), 0, 0, (w))
|
||||
void m_adj(struct mbuf *m, int dlen);
|
||||
void m_trim(struct mbuf *m, int dlen);
|
||||
|
||||
@@ -83,12 +83,19 @@ struct pf_icmp {
|
||||
__be16 ih_id[2]; /* id, seq */
|
||||
struct { __u8 type, code; __be16 cksum; } ih_type_hdr;
|
||||
__be32 ih_gwaddr;
|
||||
__u8 ih_pptr; /* ICMP_PARAMPROB pointer byte */
|
||||
__be32 ih_void;
|
||||
struct { __be16 ipm_void; __be16 ipm_nextmtu; } ih_pmtu;
|
||||
struct ih_frags { __be16 ih_rrechk; __be16 ih_length; } ih_frag;
|
||||
} icmp_hun;
|
||||
#define icmp_id icmp_hun.ih_id[0]
|
||||
#define icmp_seq icmp_hun.ih_id[1]
|
||||
#define icmp_cksum_alt icmp_hun.ih_type_hdr.cksum
|
||||
#define icmp_gwaddr icmp_hun.ih_gwaddr
|
||||
#define icmp_pptr icmp_hun.ih_pptr
|
||||
#define icmp_void icmp_hun.ih_void
|
||||
#define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void
|
||||
#define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu
|
||||
union {
|
||||
__s8 id_pad[8];
|
||||
__be16 id_ipid[2];
|
||||
@@ -136,8 +143,31 @@ struct pf_icmp {
|
||||
#define ICMP_ADDRESS 17
|
||||
#define ICMP_ADDRESSREPLY 18
|
||||
#define ICMP_MAXTYPE 18
|
||||
/* OpenBSD <netinet/ip_icmp.h> additional type/code constants (values are
|
||||
* RFC/IANA-frozen; names as used by pf.c). */
|
||||
#define ICMP_IREQ 15 /* information request */
|
||||
#define ICMP_IREQREPLY 16 /* information reply */
|
||||
#define ICMP_MASKREQ 17 /* address mask request */
|
||||
#define ICMP_MASKREPLY 18 /* address mask reply */
|
||||
#define ICMP_IPV6_WHEREAREYOU 33 /* IPv6 where-are-you */
|
||||
#define ICMP_IPV6_IAMHERE 34 /* IPv6 i-am-here */
|
||||
#define ICMP_MOBILE_REGREQUEST 35 /* mobile registration req */
|
||||
#define ICMP_MOBILE_REGREPLY 36 /* mobile registration reply */
|
||||
#define ICMP_MINLEN 8 /* abs minimum */
|
||||
#define ICMP_PARAMPROB_ERRATPTR 0 /* error at indicated pointer */
|
||||
#define ICMP_PARAMPROB_OPTABSENT 1 /* req. opt. absent */
|
||||
#define ICMP_PARAMPROB_LENGTH 2 /* bad length */
|
||||
#define ICMP_ECHOREQUEST ICMP_ECHO
|
||||
#define ICMP_INFOTYPE(type) \
|
||||
((type) == ICMP_ECHOREPLY || (type) == ICMP_ECHO || \
|
||||
(type) == ICMP_ROUTERADVERT || (type) == ICMP_ROUTERSOLICIT || \
|
||||
(type) == ICMP_TSTAMP || (type) == ICMP_TSTAMPREPLY || \
|
||||
(type) == ICMP_IREQ || (type) == ICMP_IREQREPLY || \
|
||||
(type) == ICMP_MASKREQ || (type) == ICMP_MASKREPLY)
|
||||
|
||||
/* ---- IPv6 (OpenBSD <netinet/ip6.h> ctl-union + macros) ---- */
|
||||
#define IPV6_DEFHLIM 64 /* default hop limit */
|
||||
#define IPV6_HLIMDEC 1 /* subtracted when forwarding */
|
||||
struct pf_ip6_hdr {
|
||||
union {
|
||||
struct ip6_hdrctl {
|
||||
@@ -146,10 +176,12 @@ struct pf_ip6_hdr {
|
||||
__u8 ip6_un1_nxt;
|
||||
__u8 ip6_un1_hlim;
|
||||
} ip6_un1;
|
||||
__u8 ip6_un2_vfc; /* version << 4 | tclass >> 4 */
|
||||
} ip6_ctlun;
|
||||
struct in6_addr ip6_src;
|
||||
struct in6_addr ip6_dst;
|
||||
};
|
||||
#define ip6_vfc ip6_ctlun.ip6_un2_vfc
|
||||
#define ip6_flow ip6_ctlun.ip6_un1->ip6_un1_flow
|
||||
#define ip6_plen ip6_ctlun.ip6_un1.ip6_un1_plen
|
||||
#define ip6_nxt ip6_ctlun.ip6_un1.ip6_un1_nxt
|
||||
@@ -189,6 +221,7 @@ struct pf_icmp6 {
|
||||
__be16 icmp6_seq;
|
||||
} un_h;
|
||||
} icmp6_dataun;
|
||||
#define icmp6_pptr icmp6_dataun.un_data32[0] /* parameter prob */
|
||||
};
|
||||
#define icmp6_id icmp6_dataun.un_h.icmp6_id
|
||||
#define icmp6_seq icmp6_dataun.un_h.icmp6_seq
|
||||
@@ -220,4 +253,81 @@ __sum16 pfk_icmp6_cksum(const struct pf_ip6_hdr *ip6,
|
||||
void pfk_send_icmp_error(int family, struct sk_buff *skb_in, int type,
|
||||
int code, __be32 info);
|
||||
|
||||
/* ---- IPv6 extension/option headers (OpenBSD <netinet/ip6.h>) ---- */
|
||||
struct ip6_opt {
|
||||
__u8 ip6o_type;
|
||||
__u8 ip6o_len;
|
||||
};
|
||||
#define IP6OPT_PAD1 0x00
|
||||
#define IP6OPT_PADN 0x01
|
||||
#define IP6OPT_JUMBO 0xC2
|
||||
#define IP6OPT_ROUTER_ALERT 0x05
|
||||
#define IP6OPT_MINLEN 2
|
||||
struct ip6_opt_jumbo {
|
||||
__u8 ip6oj_type;
|
||||
__u8 ip6oj_len;
|
||||
__u8 ip6oj_jumbo_len[4];
|
||||
};
|
||||
#define IP6OPT_JUMBO_LEN 6
|
||||
struct ip6_opt_router {
|
||||
__u8 ip6or_type;
|
||||
__u8 ip6or_len;
|
||||
__u8 ip6or_value[2];
|
||||
};
|
||||
struct ip6_rthdr {
|
||||
__u8 ip6r_nxt;
|
||||
__u8 ip6r_len;
|
||||
__u8 ip6r_type;
|
||||
__u8 ip6r_segleft;
|
||||
};
|
||||
#define IPV6_RTHDR_TYPE_0 0
|
||||
struct ip6_rthdr0 {
|
||||
__u8 ip6r0_nxt;
|
||||
__u8 ip6r0_len;
|
||||
__u8 ip6r0_type;
|
||||
__u8 ip6r0_segleft;
|
||||
__u32 ip6r0_reserved;
|
||||
};
|
||||
|
||||
/* ---- ICMPv6 types/codes (OpenBSD <netinet/icmp6.h>, RFC-frozen values) ---- */
|
||||
#define ICMP6_PARAM_PROB 4
|
||||
#define ICMP6_WRUREQUEST 139 /* who-are-you / NI query */
|
||||
#define ICMP6_WRUREPLY 140
|
||||
#define ICMP6_NI_QUERY 139
|
||||
#define ICMP6_NI_REPLY 140
|
||||
#define ICMP6_MAXTYPE 201
|
||||
#define ICMP6_DST_UNREACH_NOROUTE 0
|
||||
#define ICMP6_DST_UNREACH_ADMIN 1
|
||||
#define ICMP6_DST_UNREACH_BEYONDSCOPE 2
|
||||
#define ICMP6_DST_UNREACH_ADDR 3
|
||||
#define ICMP6_DST_UNREACH_NOPORT 4
|
||||
#define ICMP6_TIME_EXCEED_TRANSIT 0
|
||||
#define ICMP6_TIME_EXCEED_REASSEMBLY 1
|
||||
#define ICMP6_PARAMPROB_HEADER 0
|
||||
#define ICMP6_PARAMPROB_NEXTHEADER 1
|
||||
#define ICMP6_PARAMPROB_OPTION 2
|
||||
#define MLD_LISTENER_QUERY 130
|
||||
#define MLD_LISTENER_REPORT 131
|
||||
#define MLD_LISTENER_DONE 132
|
||||
#define MLDV2_LISTENER_REPORT 143
|
||||
#define MLD_MTRACE_RESP 200
|
||||
#define MLD_MTRACE 201
|
||||
#define ND_ROUTER_SOLICIT 133
|
||||
#define ND_ROUTER_ADVERT 134
|
||||
#define ND_NEIGHBOR_SOLICIT 135
|
||||
#define ND_NEIGHBOR_ADVERT 136
|
||||
#define ND_REDIRECT 137
|
||||
|
||||
/* ---- TCP (OpenBSD <netinet/tcp.h>/<netinet/tcp_var.h>/<netinet/tcp_seq.h>) */
|
||||
#define TCP_NSTATES 11 /* netinet/tcp_fsm.h */
|
||||
#define TCP_MAXWIN 65535 /* max value for (unscaled) window */
|
||||
#define TCP_MAX_WINSHIFT 14 /* max window shift */
|
||||
#define TCPOPT_SACK 5
|
||||
#define TCPOLEN_SACK 8 /* 2*sizeof(tcp_seq) */
|
||||
struct sackblk {
|
||||
__u32 start; /* start seq no. of sack block */
|
||||
__u32 end; /* end seq no. */
|
||||
};
|
||||
typedef __u32 tcp_seq;
|
||||
|
||||
#endif /* _PFK_NET_H */
|
||||
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_if.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_if.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_if.o: $(deps_pfsrc/pf_if.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_ioctl.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_ioctl.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_ioctl.o: $(deps_pfsrc/pf_ioctl.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_lb.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_lb.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_lb.o: $(deps_pfsrc/pf_lb.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_norm.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_norm.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_norm.o: $(deps_pfsrc/pf_norm.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_osfp.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_osfp.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_osfp.o: $(deps_pfsrc/pf_osfp.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_ruleset.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_ruleset.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_ruleset.o: $(deps_pfsrc/pf_ruleset.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_syncookies.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_syncookies.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_syncookies.o: $(deps_pfsrc/pf_syncookies.o)
|
||||
|
||||
|
||||
@@ -1811,6 +1811,9 @@ deps_pfsrc/pf_table.o := \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1820,13 +1823,11 @@ deps_pfsrc/pf_table.o := \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/compat/sys/percpu.h \
|
||||
|
||||
pfsrc/pf_table.o: $(deps_pfsrc/pf_table.o)
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
savedcmd_pfsrc/pfk_hooks.o := gcc -Wp,-MMD,pfsrc/.pfk_hooks.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -Wno-declaration-after-statement -DMODULE -DKBUILD_BASENAME='"pfk_hooks"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o pfsrc/pfk_hooks.o pfsrc/pfk_hooks.c
|
||||
savedcmd_pfsrc/pfk_hooks.o := gcc -Wp,-MMD,pfsrc/.pfk_hooks.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -D_KERNEL=1 -Wno-declaration-after-statement -Wno-implicit-fallthrough -Wno-frame-larger-than -DMODULE -DKBUILD_BASENAME='"pfk_hooks"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o pfsrc/pfk_hooks.o pfsrc/pfk_hooks.c
|
||||
|
||||
source_pfsrc/pfk_hooks.o := pfsrc/pfk_hooks.c
|
||||
|
||||
@@ -1108,6 +1108,11 @@ deps_pfsrc/pfk_hooks.o := \
|
||||
$(wildcard include/config/UNWINDER_ORC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/asm-generic/module.h \
|
||||
$(wildcard include/config/HAVE_MOD_ARCH_SPECIFIC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMALLOC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMAP) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/pgtable_areas.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/prandom.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/once.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/net.h \
|
||||
@@ -1153,7 +1158,6 @@ deps_pfsrc/pfk_hooks.o := \
|
||||
$(wildcard include/config/ARCH_HAS_HW_PTE_YOUNG) \
|
||||
$(wildcard include/config/GUP_GET_PXX_LOW_HIGH) \
|
||||
$(wildcard include/config/ARCH_WANT_PMD_MKWRITE) \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMAP) \
|
||||
$(wildcard include/config/X86_ESPFIX64) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/memremap.h \
|
||||
$(wildcard include/config/DEVICE_PRIVATE) \
|
||||
@@ -1754,10 +1758,6 @@ deps_pfsrc/pfk_hooks.o := \
|
||||
$(wildcard include/config/HAVE_ARCH_BITREVERSE) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/asm-generic/bitops/__bitrev.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi/linux/if_vlan.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMALLOC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/vmalloc.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/pgtable_areas.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/net/sch_generic.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/net/gen_stats.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi/linux/gen_stats.h \
|
||||
@@ -1810,6 +1810,10 @@ deps_pfsrc/pfk_hooks.o := \
|
||||
include/compat/sys/socket.h \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1817,12 +1821,14 @@ deps_pfsrc/pfk_hooks.o := \
|
||||
include/compat/crypto/md5.h \
|
||||
include/compat/crypto/siphash.h \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/pfk_api.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/pfk_api.h \
|
||||
|
||||
pfsrc/pfk_hooks.o: $(deps_pfsrc/pfk_hooks.o)
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
savedcmd_pfsrc/pfk_mod.o := gcc -Wp,-MMD,pfsrc/.pfk_mod.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -Wno-declaration-after-statement -DMODULE -DKBUILD_BASENAME='"pfk_mod"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o pfsrc/pfk_mod.o pfsrc/pfk_mod.c
|
||||
savedcmd_pfsrc/pfk_mod.o := gcc -Wp,-MMD,pfsrc/.pfk_mod.o.d -nostdinc -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/generated/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi -I/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/generated/uapi -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler-version.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/kconfig.h -include /home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/compiler_types.h -D__KERNEL__ -Werror -fshort-wchar -funsigned-char -fno-common -fno-PIE -fno-strict-aliasing -std=gnu11 -fms-extensions -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx -mno-sse4a -fcf-protection=branch -fno-jump-tables -m64 -falign-jumps=1 -falign-loops=1 -mno-80387 -mno-fp-ret-in-387 -mpreferred-stack-boundary=3 -mskip-rax-setup -march=x86-64 -mtune=generic -mno-red-zone -mcmodel=kernel -mstack-protector-guard-reg=gs -mstack-protector-guard-symbol=__ref_stack_chk_guard -Wno-sign-compare -fno-asynchronous-unwind-tables -mindirect-branch=thunk-extern -mindirect-branch-register -mindirect-branch-cs-prefix -mfunction-return=thunk-extern -fno-jump-tables -fpatchable-function-entry=16,16 -fno-delete-null-pointer-checks -O2 -fno-allow-store-data-races -fstack-protector-strong -fomit-frame-pointer -ftrivial-auto-var-init=zero -fzero-init-padding-bits=all -fno-stack-clash-protection -fdiagnostics-show-context=2 -fmin-function-alignment=16 -fstrict-flex-arrays=3 -fno-strict-overflow -fno-stack-check -fconserve-stack -fno-builtin-wcslen -Wall -Wextra -Wundef -Werror=implicit-function-declaration -Werror=implicit-int -Werror=return-type -Werror=strict-prototypes -Wno-format-security -Wno-trigraphs -Wno-frame-address -Wno-address-of-packed-member -Wmissing-declarations -Wmissing-prototypes -Wframe-larger-than=2048 -Wno-main -Wno-type-limits -Wno-dangling-pointer -Wvla-larger-than=1 -Wno-pointer-sign -Wcast-function-type -Wno-unterminated-string-initialization -Wno-array-bounds -Wno-stringop-overflow -Wno-alloc-size-larger-than -Wimplicit-fallthrough=5 -Werror=date-time -Werror=incompatible-pointer-types -Werror=designated-init -Wenum-conversion -Wunused -Wno-unused-but-set-variable -Wno-unused-const-variable -Wno-packed-not-aligned -Wno-format-overflow -Wno-format-truncation -Wno-stringop-truncation -Wno-override-init -Wno-missing-field-initializers -Wno-shift-negative-value -Wno-maybe-uninitialized -Wno-sign-compare -Wno-unused-parameter -I././include -I././include/compat -DPFLINUX=1 -D_KERNEL=1 -Wno-declaration-after-statement -Wno-implicit-fallthrough -Wno-frame-larger-than -DMODULE -DKBUILD_BASENAME='"pfk_mod"' -DKBUILD_MODNAME='"pf"' -D__KBUILD_MODNAME=pf -c -o pfsrc/pfk_mod.o pfsrc/pfk_mod.c
|
||||
|
||||
source_pfsrc/pfk_mod.o := pfsrc/pfk_mod.c
|
||||
|
||||
@@ -1108,6 +1108,11 @@ deps_pfsrc/pfk_mod.o := \
|
||||
$(wildcard include/config/UNWINDER_ORC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/asm-generic/module.h \
|
||||
$(wildcard include/config/HAVE_MOD_ARCH_SPECIFIC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMALLOC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMAP) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/pgtable_areas.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/prandom.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/once.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/net.h \
|
||||
@@ -1153,7 +1158,6 @@ deps_pfsrc/pfk_mod.o := \
|
||||
$(wildcard include/config/ARCH_HAS_HW_PTE_YOUNG) \
|
||||
$(wildcard include/config/GUP_GET_PXX_LOW_HIGH) \
|
||||
$(wildcard include/config/ARCH_WANT_PMD_MKWRITE) \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMAP) \
|
||||
$(wildcard include/config/X86_ESPFIX64) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/memremap.h \
|
||||
$(wildcard include/config/DEVICE_PRIVATE) \
|
||||
@@ -1754,10 +1758,6 @@ deps_pfsrc/pfk_mod.o := \
|
||||
$(wildcard include/config/HAVE_ARCH_BITREVERSE) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/asm-generic/bitops/__bitrev.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi/linux/if_vlan.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/linux/vmalloc.h \
|
||||
$(wildcard include/config/HAVE_ARCH_HUGE_VMALLOC) \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/vmalloc.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/arch/x86/include/asm/pgtable_areas.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/net/sch_generic.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/net/gen_stats.h \
|
||||
/home/lgcosta/lab/linux_kernel/linux-7.3.4/include/uapi/linux/gen_stats.h \
|
||||
@@ -1810,6 +1810,10 @@ deps_pfsrc/pfk_mod.o := \
|
||||
include/compat/sys/socket.h \
|
||||
include/compat/net/if_types.h \
|
||||
include/compat/net/if_var.h \
|
||||
include/compat/net/ifq.h \
|
||||
include/compat/net/rtable.h \
|
||||
include/compat/sys/percpu.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/pfk_mbuf.h \
|
||||
include/pfk_net.h \
|
||||
include/pfk_if.h \
|
||||
@@ -1817,12 +1821,14 @@ deps_pfsrc/pfk_mod.o := \
|
||||
include/compat/crypto/md5.h \
|
||||
include/compat/crypto/siphash.h \
|
||||
include/compat/net/toeplitz.h \
|
||||
include/pfk_api.h \
|
||||
include/net/pfvar.h \
|
||||
include/compat/sys/syslimits.h \
|
||||
include/compat/netinet/in.h \
|
||||
include/compat/net/radix.h \
|
||||
include/net/pfvar_priv.h \
|
||||
include/compat/sys/rwlock.h \
|
||||
include/compat/sys/mutex.h \
|
||||
include/compat/sys/pclock.h \
|
||||
include/pfk_api.h \
|
||||
|
||||
pfsrc/pfk_mod.o: $(deps_pfsrc/pfk_mod.o)
|
||||
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
/*
|
||||
* PF-on-Linux divert entry points used by pf.c (ISC 2026).
|
||||
*
|
||||
* BSD semantics (OpenBSD netinet/ip_divert.c): divert_packet()/divert6_packet()
|
||||
* find the AF_DIVERT pcb bound to `divert_port`, queue the packet to it and
|
||||
* consume the mbuf; when NO divert socket is attached, OpenBSD drops the
|
||||
* packet (m_freem) — that is exactly the observable behaviour implemented
|
||||
* here until the pfdiv socket layer is instantiated for Linux (milestone
|
||||
* M6); a rate-limited kernel log records the event so drops are never
|
||||
* silent.
|
||||
*
|
||||
* The upstream BSD socket layer is staged in pfsrc/ip_divert.c and becomes
|
||||
* the real back end in M6; these wrappers keep the same call signature
|
||||
* (struct mbuf *, int dir, u_int16_t divert_port).
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
|
||||
void
|
||||
divert_packet(struct mbuf *m, int dir, u_int16_t divert_port)
|
||||
{
|
||||
pr_warn_ratelimited("pfk: divert v4 port %u: no divert socket layer (M6 pending), dropping\n",
|
||||
ntohs(divert_port));
|
||||
m_freem(m);
|
||||
}
|
||||
|
||||
void
|
||||
divert6_packet(struct mbuf *m, int dir, u_int16_t divert_port)
|
||||
{
|
||||
pr_warn_ratelimited("pfk: divert v6 port %u: no divert socket layer (M6 pending), dropping\n",
|
||||
ntohs(divert_port));
|
||||
m_freem(m);
|
||||
}
|
||||
+14
-14
@@ -152,7 +152,7 @@ static __inline int pf_create_state(struct pf_pdesc *, struct pf_rule *,
|
||||
struct pf_state_key **, struct pf_state_key **,
|
||||
int *, struct pf_state **, int,
|
||||
struct pf_rule_slist *, struct pf_rule_actions *,
|
||||
struct pf_src_node **, struct pf_test_ctx *);
|
||||
struct pf_src_node *[PF_SN_MAX], struct pf_test_ctx *);
|
||||
static __inline int pf_state_key_addr_setup(struct pf_pdesc *, void *,
|
||||
int, struct pf_addr *, int, struct pf_addr *,
|
||||
int, int);
|
||||
@@ -4315,7 +4315,7 @@ pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, uint16_t offer,
|
||||
hlen = sizeof(struct pf_ip);
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
;
|
||||
dst->sin_addr = addr->v4;
|
||||
rt = rtalloc(sintosa(dst), 0, rtableid);
|
||||
break;
|
||||
@@ -4324,7 +4324,7 @@ pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, uint16_t offer,
|
||||
hlen = sizeof(struct pf_ip6_hdr);
|
||||
dst6 = (struct sockaddr_in6 *)&ss;
|
||||
dst6->sin6_family = AF_INET6;
|
||||
dst6->sin6_len = sizeof(*dst6);
|
||||
;
|
||||
dst6->sin6_addr = addr->v6;
|
||||
rt = rtalloc(sin6tosa(dst6), 0, rtableid);
|
||||
break;
|
||||
@@ -5389,7 +5389,7 @@ pf_create_state(struct pf_pdesc *pd, struct pf_rule *r, struct pf_rule *a,
|
||||
pf_set_protostate(st, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
|
||||
st->src.seqhi = arc4random();
|
||||
/* Find mss option */
|
||||
mssdflt = atomic_load_int(&tcp_mssdflt);
|
||||
mssdflt = atomic_load_int(&pfk_tcp_mssdflt);
|
||||
mss = pf_get_mss(pd, mssdflt);
|
||||
mss = pf_calc_mss(pd->src, pd->af, rtid, mss, mssdflt);
|
||||
mss = pf_calc_mss(pd->dst, pd->af, rtid, mss, mssdflt);
|
||||
@@ -6066,7 +6066,7 @@ pf_synproxy_ack(struct pf_rule *r, struct pf_pdesc *pd, struct pf_state **sm,
|
||||
pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
|
||||
s->src.seqhi = arc4random();
|
||||
/* Find mss option */
|
||||
mssdflt = atomic_load_int(&tcp_mssdflt);
|
||||
mssdflt = atomic_load_int(&pfk_tcp_mssdflt);
|
||||
mss = pf_get_mss(pd, mssdflt);
|
||||
mss = pf_calc_mss(pd->src, pd->af, rtid, mss, mssdflt);
|
||||
mss = pf_calc_mss(pd->dst, pd->af, rtid, mss, mssdflt);
|
||||
@@ -7185,7 +7185,7 @@ pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
|
||||
case AF_INET:
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
;
|
||||
dst->sin_addr = addr->v4;
|
||||
if (atomic_load_int(&ipmultipath))
|
||||
check_mpath = 1;
|
||||
@@ -7200,7 +7200,7 @@ pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
|
||||
goto out;
|
||||
dst6 = (struct sockaddr_in6 *)&ss;
|
||||
dst6->sin6_family = AF_INET6;
|
||||
dst6->sin6_len = sizeof(*dst6);
|
||||
;
|
||||
dst6->sin6_addr = addr->v6;
|
||||
if (atomic_load_int(&ip6_multipath))
|
||||
check_mpath = 1;
|
||||
@@ -7268,14 +7268,14 @@ pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw,
|
||||
case AF_INET:
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
;
|
||||
dst->sin_addr = addr->v4;
|
||||
break;
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
dst6 = (struct sockaddr_in6 *)&ss;
|
||||
dst6->sin6_family = AF_INET6;
|
||||
dst6->sin6_len = sizeof(*dst6);
|
||||
;
|
||||
dst6->sin6_addr = addr->v6;
|
||||
break;
|
||||
#endif /* INET6 */
|
||||
@@ -7342,7 +7342,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
|
||||
memset(&sin, 0, sizeof(sin));
|
||||
dst = &sin;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
;
|
||||
dst->sin_addr = st->rt_addr.v4;
|
||||
rtableid = m0->m_pkthdr.ph_rtableid;
|
||||
|
||||
@@ -7460,7 +7460,7 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
|
||||
memset(&sin6, 0, sizeof(sin6));
|
||||
dst = &sin6;
|
||||
dst->sin6_family = AF_INET6;
|
||||
dst->sin6_len = sizeof(*dst);
|
||||
;
|
||||
dst->sin6_addr = st->rt_addr.v6;
|
||||
rtableid = m0->m_pkthdr.ph_rtableid;
|
||||
|
||||
@@ -8723,9 +8723,9 @@ done:
|
||||
}
|
||||
if (atomic_load_int(&ip_directedbcast))
|
||||
SET(flags, IP_ALLOWBROADCAST);
|
||||
ip_forward(pd.m, ifp, NULL, flags);
|
||||
pfk_ip_forward(pd.m, ifp, NULL, flags);
|
||||
} else
|
||||
ip_output(pd.m, NULL, NULL, 0, NULL, NULL, 0);
|
||||
pfk_ip_output(pd.m, NULL, NULL, 0, NULL, NULL, 0);
|
||||
break;
|
||||
case AF_INET6:
|
||||
if (pd.dir == PF_IN) {
|
||||
@@ -8745,7 +8745,7 @@ done:
|
||||
}
|
||||
pfk_ip6_forward(pd.m, NULL, flags);
|
||||
} else
|
||||
ip6_output(pd.m, NULL, NULL, 0, NULL, NULL);
|
||||
pfk_ip6_output(pd.m, NULL, NULL, 0, NULL, NULL);
|
||||
break;
|
||||
}
|
||||
pd.m = NULL;
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
/*
|
||||
* PF-on-Linux netfilter hook registration + engine status surface.
|
||||
* The verdict path is staged pf.c (pf_test()); hook→pf_test wiring with
|
||||
* mbuf ingress is milestone M2's data-path task — until then the hooks
|
||||
* accept so the module is inert once loaded (never silent: pr_info at
|
||||
* registration says so). (ISC 2026)
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <pfk_api.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
static int pfk_enabled = 1; /* like pf_defaultwise/pf_enable on boot */
|
||||
static struct pf_status pfk_stat;
|
||||
|
||||
void pfk_status(struct pf_status *s)
|
||||
{
|
||||
if (s)
|
||||
*s = pfk_stat;
|
||||
}
|
||||
|
||||
int pfk_enable(int on)
|
||||
{
|
||||
pfk_enabled = on ? 1 : 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* --- netfilter hooks: ingress/egress plumbing --- */
|
||||
static unsigned int
|
||||
pfk_ipv4_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *st)
|
||||
{
|
||||
/* PFLINUX M1: pf_test() routing arrives with the M2 data-path task;
|
||||
* until then the hooks accept (module inert). */
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
static struct nf_hook_ops pfk_hooks[] = {
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_PRE_ROUTING,
|
||||
.priority = NF_IP_PRI_FIRST },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_LOCAL_IN,
|
||||
.priority = NF_IP_PRI_FIRST + 1 },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_FORWARD,
|
||||
.priority = NF_IP_PRI_FIRST },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_LOCAL_OUT,
|
||||
.priority = NF_IP_PRI_CONNTRACK + 1 },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_POST_ROUTING,
|
||||
.priority = NF_IP_PRI_LAST - 1 },
|
||||
};
|
||||
#define PFK_NHOOKS ARRAY_SIZE(pfk_hooks)
|
||||
|
||||
int
|
||||
pfk_hooks_register(void)
|
||||
{
|
||||
int i, err;
|
||||
|
||||
pr_info("pfk: netfilter hooks registered (verdict path inert until M2)\n");
|
||||
for (i = 0; i < PFK_NHOOKS; i++) {
|
||||
pfk_hooks[i].priv = NULL;
|
||||
err = nf_register_net_hook(&init_net, &pfk_hooks[i]);
|
||||
if (err)
|
||||
goto fail;
|
||||
}
|
||||
return 0;
|
||||
fail:
|
||||
while (--i >= 0)
|
||||
nf_unregister_net_hook(&init_net, &pfk_hooks[i]);
|
||||
return err;
|
||||
}
|
||||
|
||||
void
|
||||
pfk_hooks_unregister(void)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; i < PFK_NHOOKS; i++)
|
||||
nf_unregister_net_hook(&init_net, &pfk_hooks[i]);
|
||||
}
|
||||
@@ -0,0 +1,143 @@
|
||||
/*
|
||||
* PF-on-Linux: pfk module core — load/exit, /dev/pf misc device,
|
||||
* NET_LOCK bring-up, engine ioctl dispatch. (ISC 2026)
|
||||
*
|
||||
* Restored during the M1 compile-loop: this file had been dropped from
|
||||
* the tree by commit 1fcd7b3 while its objects still linked from stale
|
||||
* build artifacts; the /dev/pf path now dispatches into the staged
|
||||
* pf_ioctl.c (pfioctl()) instead of the old minimal placeholder.
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <pfk_api.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
extern void pfk_mbuf_exit(void);
|
||||
extern int pfk_if_init(void);
|
||||
extern void pfk_if_exit(void);
|
||||
extern int pfk_pcb_init(void);
|
||||
extern void pfk_pcb_exit(void);
|
||||
int pfk_hooks_register(void);
|
||||
void pfk_hooks_unregister(void);
|
||||
|
||||
extern int pfioctl(dev_t, u_long, caddr_t, int, struct proc *);
|
||||
|
||||
static int pfk_open(struct inode *inode, struct file *filp)
|
||||
{
|
||||
if (filp->f_mode & FMODE_WRITE)
|
||||
return capable(CAP_NET_ADMIN) ? 0 : -EPERM;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* PFLINUX: OpenBSD's kernel ioctl layer copies the parameter structure
|
||||
* (size taken from the command encoding) before dispatching to pfioctl();
|
||||
* the port does the same here, using the OpenBSD _IOR/_IOW size field
|
||||
* that pfk.h preserves bit-for-bit.
|
||||
*/
|
||||
static long
|
||||
pfk_ioctl_io(struct file *filp, unsigned int cmd, unsigned long arg)
|
||||
{
|
||||
size_t sz = PFKIOC_SIZE(cmd);
|
||||
unsigned int dir = PFKIOC_DIR(cmd);
|
||||
void __user *uarg = (void __user *)arg;
|
||||
struct pfk_ucred cred;
|
||||
struct pfk_proc_p pp;
|
||||
struct proc p;
|
||||
caddr_t kdata;
|
||||
int err, err2;
|
||||
|
||||
cred.uid = from_kuid(&init_user_ns, current_euid());
|
||||
cred.gid = from_kgid(&init_user_ns, current_egid());
|
||||
pp.pid = task_pid_nr(current);
|
||||
p.p_flags = 0;
|
||||
p.p_ucred = &cred;
|
||||
p.p_p = &pp;
|
||||
|
||||
kdata = kzalloc(sz ? sz : sizeof(long), GFP_KERNEL);
|
||||
if (!kdata)
|
||||
return -ENOMEM;
|
||||
|
||||
if ((dir & PFKXIOC_WRITE) && sz) {
|
||||
if (copy_from_user(kdata, uarg, sz)) {
|
||||
kfree(kdata);
|
||||
return -EFAULT;
|
||||
}
|
||||
}
|
||||
|
||||
err = pfioctl(0, (u_long)cmd, kdata,
|
||||
(filp->f_mode & FMODE_WRITE) ? FWRITE : 0, &p);
|
||||
|
||||
err2 = 0;
|
||||
if (!err && (dir & PFKXIOC_READ) && sz) {
|
||||
if (copy_to_user(uarg, kdata, sz))
|
||||
err2 = EFAULT;
|
||||
}
|
||||
kfree(kdata);
|
||||
return err ? -err : (err2 ? -err2 : 0);
|
||||
}
|
||||
|
||||
static const struct file_operations pfk_fops = {
|
||||
.owner = THIS_MODULE,
|
||||
.open = pfk_open,
|
||||
.unlocked_ioctl = pfk_ioctl_io,
|
||||
.compat_ioctl = compat_ptr_ioctl,
|
||||
};
|
||||
|
||||
static struct miscdevice pfk_dev = {
|
||||
.minor = MISC_DYNAMIC_MINOR,
|
||||
.name = "pf",
|
||||
.fops = &pfk_fops,
|
||||
.mode = 0600,
|
||||
};
|
||||
|
||||
static int __init pfk_init(void)
|
||||
{
|
||||
int err;
|
||||
|
||||
pfk_net_lock_init();
|
||||
err = pfk_mbuf_init();
|
||||
if (err)
|
||||
return err;
|
||||
err = pfk_pcb_init();
|
||||
if (err)
|
||||
goto err_mbuf;
|
||||
err = pfk_if_init();
|
||||
if (err)
|
||||
goto err_pcb;
|
||||
err = pfk_hooks_register();
|
||||
if (err)
|
||||
goto err_if;
|
||||
err = misc_register(&pfk_dev);
|
||||
if (err)
|
||||
goto err_hooks;
|
||||
pr_info("pfk: PF-on-Linux engine loaded (OpenBSD 8.0 base)\n");
|
||||
return 0;
|
||||
err_hooks:
|
||||
pfk_hooks_unregister();
|
||||
err_if:
|
||||
pfk_if_exit();
|
||||
err_pcb:
|
||||
pfk_pcb_exit();
|
||||
err_mbuf:
|
||||
pfk_mbuf_exit();
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __exit pfk_exit(void)
|
||||
{
|
||||
misc_deregister(&pfk_dev);
|
||||
pfk_hooks_unregister();
|
||||
pfk_if_exit();
|
||||
pfk_pcb_exit();
|
||||
pfk_mbuf_exit();
|
||||
pr_info("pfk: unloaded\n");
|
||||
}
|
||||
|
||||
module_init(pfk_init);
|
||||
module_exit(pfk_exit);
|
||||
MODULE_LICENSE("Dual MIT/GPL"); /* ISC/BSD code; Dual MIT/GPL is the kernel-
|
||||
* recognised tag for permissive BSD-licensed
|
||||
* modules linking GPL exports (see LICENSE). */
|
||||
MODULE_DESCRIPTION("PF packet filter (ported from OpenBSD 8.0) for Linux");
|
||||
MODULE_AUTHOR("PF-on-Linux contributors");
|
||||
Reference in new issue
Block a user