mirror of
https://github.com/lgcosta/pf-linux-port.git
synced 2026-11-12 23:48:06 -03:00
M1 progress: engine port compiles except pf.c; AF_DIVERT socket family; ifq framework
- compat layer extended through the full BSD API surface pf_ioctl/pf_lb/ pf_if/pf_norm/pf_table/pf_ruleset/radix/md5/sha2 need (all compile): cpumem/counters model, ifaddr/ifg groups, cred view, endian+in6 names, NAT46/64, SipHash24, mbuf_list, frag6 helpers, ip6 forward/checksum, tcp options/FSM names, taskqueue & sysctl shims (documented in docs/porting-notes.md) - pfsrc/divert_sock.c: real BSD divert(4) as runtime-registered PF_DIVERT=32 socket family inside the module (sock_register; NPROTO=AF_MAX=45 -> zero core patches); divert_packet/divert6_packet wired for pf.c - compat/pfk_ifq.c: OpenBSD 8.0 ifq framework with priq back end; hfsc and fq_codel aliases pending M5 (recorded in feature matrix as pending) - design + plan updated for the divert decision (user-requested) - stage-port.sh: single deterministic rename program for headers and .c
This commit is contained in:
lgcosta committed
1 parent
a84b2c91f3
commit
1fcd7b3046
77 files changed
+28002
-1114
No files matched your search
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
+45
-5
@@ -1,5 +1,45 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/fq_codel.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: fq_codel.c,v 1.21 2026/08/13 09:01:49 bket Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2017 Mike Belopuhov
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* K. Nichols, V. Jacobson, A. McGregor and J. Iyengar, Controlled Delay
|
||||
* Active Queue Management, RFC 8289, January 2018
|
||||
*
|
||||
* Based on the algorithm by Kathleen Nichols and Van Jacobson with
|
||||
* improvements from Dave Taht and Eric Dumazet.
|
||||
*/
|
||||
|
||||
/*
|
||||
* T. Hoeiland-Joergensen, P. McKenney, D. Taht, J. Gettys and E. Dumazet,
|
||||
* The Flow Queue CoDel Packet Scheduler and Active Queue Management
|
||||
* Algorithm, RFC 8290, January 2018
|
||||
*
|
||||
* Based on the implementation by Rasool Al-Saadi, Centre for Advanced
|
||||
* Internet Architectures, Swinburne University of Technology, Melbourne,
|
||||
* Australia.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
/* #define FQCODEL_DEBUG 1 */
|
||||
|
||||
@@ -59,7 +99,7 @@ struct fqcodel {
|
||||
struct flow *flows;
|
||||
unsigned int qlength;
|
||||
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
struct codel_params cparams;
|
||||
|
||||
@@ -107,7 +147,7 @@ static const struct ifq_ops fqcodel_ops = {
|
||||
|
||||
const struct ifq_ops *const ifq_fqcodel_ops = &fqcodel_ops;
|
||||
|
||||
void *fqcodel_pf_alloc(struct ifnet *);
|
||||
void *fqcodel_pf_alloc(struct pfk_ifnet *);
|
||||
int fqcodel_pf_addqueue(void *, struct pf_queuespec *);
|
||||
void fqcodel_pf_free(void *);
|
||||
int fqcodel_pf_qstats(struct pf_queuespec *, void *, int *);
|
||||
@@ -701,7 +741,7 @@ fqcodel_if_purge(struct ifqueue *ifq, struct mbuf_list *ml)
|
||||
}
|
||||
|
||||
void *
|
||||
fqcodel_pf_alloc(struct ifnet *ifp)
|
||||
fqcodel_pf_alloc(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct fqcodel *fqc;
|
||||
|
||||
@@ -717,7 +757,7 @@ fqcodel_pf_alloc(struct ifnet *ifp)
|
||||
int
|
||||
fqcodel_pf_addqueue(void *arg, struct pf_queuespec *qs)
|
||||
{
|
||||
struct ifnet *ifp = qs->kif->pfik_ifp;
|
||||
struct pfk_ifnet *ifp = qs->kif->pfik_ifp;
|
||||
struct fqcodel *fqc = arg;
|
||||
|
||||
if (qs->flowqueue.flows == 0 || qs->flowqueue.flows > 0xffff)
|
||||
@@ -773,7 +813,7 @@ fqcodel_pf_free(void *arg)
|
||||
int
|
||||
fqcodel_pf_qstats(struct pf_queuespec *qs, void *ubuf, int *nbytes)
|
||||
{
|
||||
struct ifnet *ifp = qs->kif->pfik_ifp;
|
||||
struct pfk_ifnet *ifp = qs->kif->pfik_ifp;
|
||||
struct fqcodel_stats stats;
|
||||
struct fqcodel *fqc;
|
||||
int64_t delay;
|
||||
|
||||
+53
-4
@@ -1,5 +1,54 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/hfsc.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: hfsc.c,v 1.53 2026/03/19 14:59:05 sthen Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2012-2013 Henning Brauer <henning@openbsd.org>
|
||||
* Copyright (c) 1997-1999 Carnegie Mellon University. All Rights Reserved.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software and
|
||||
* its documentation is hereby granted (including for commercial or
|
||||
* for-profit use), provided that both the copyright notice and this
|
||||
* permission notice appear in all copies of the software, derivative
|
||||
* works, or modified versions, and any portions thereof.
|
||||
*
|
||||
* THIS SOFTWARE IS EXPERIMENTAL AND IS KNOWN TO HAVE BUGS, SOME OF
|
||||
* WHICH MAY HAVE SERIOUS CONSEQUENCES. CARNEGIE MELLON PROVIDES THIS
|
||||
* SOFTWARE IN ITS ``AS IS'' CONDITION, AND ANY EXPRESS OR IMPLIED
|
||||
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
|
||||
* OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
||||
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
|
||||
* USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
|
||||
* DAMAGE.
|
||||
*
|
||||
* Carnegie Mellon encourages (but does not require) users of this
|
||||
* software to return any improvements or extensions that they make,
|
||||
* and to grant Carnegie Mellon the rights to redistribute these
|
||||
* changes without encumbrance.
|
||||
*/
|
||||
/*
|
||||
* H-FSC is described in Proceedings of SIGCOMM'97,
|
||||
* "A Hierarchical Fair Service Curve Algorithm for Link-Sharing,
|
||||
* Real-Time and Priority Service"
|
||||
* by Ion Stoica, Hui Zhang, and T. S. Eugene Ng.
|
||||
*
|
||||
* Oleg Cherevko <olwi@aq.ml.com.ua> added the upperlimit for link-sharing.
|
||||
* when a class has an upperlimit, the fit-time is computed from the
|
||||
* upperlimit service curve. the link-sharing scheduler does not schedule
|
||||
* a class whose fit-time exceeds the current time.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* kernel internal service curve representation
|
||||
@@ -223,7 +272,7 @@ const struct ifq_ops * const ifq_hfsc_ops = &hfsc_ops;
|
||||
* pf queue glue.
|
||||
*/
|
||||
|
||||
void *hfsc_pf_alloc(struct ifnet *);
|
||||
void *hfsc_pf_alloc(struct pfk_ifnet *);
|
||||
int hfsc_pf_addqueue(void *, struct pf_queuespec *);
|
||||
void hfsc_pf_free(void *);
|
||||
int hfsc_pf_qstats(struct pf_queuespec *, void *, int *);
|
||||
@@ -320,7 +369,7 @@ hfsc_initialize(void)
|
||||
}
|
||||
|
||||
void *
|
||||
hfsc_pf_alloc(struct ifnet *ifp)
|
||||
hfsc_pf_alloc(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct hfsc_if *hif;
|
||||
|
||||
@@ -416,7 +465,7 @@ hfsc_pf_addqueue(void *arg, struct pf_queuespec *q)
|
||||
int
|
||||
hfsc_pf_qstats(struct pf_queuespec *q, void *ubuf, int *nbytes)
|
||||
{
|
||||
struct ifnet *ifp = q->kif->pfik_ifp;
|
||||
struct pfk_ifnet *ifp = q->kif->pfik_ifp;
|
||||
struct hfsc_if *hif;
|
||||
struct hfsc_class *cl;
|
||||
struct hfsc_class_stats stats;
|
||||
@@ -876,7 +925,7 @@ hfsc_update_sc(struct hfsc_if *hif, struct hfsc_class *cl, int len)
|
||||
void
|
||||
hfsc_deferred(void *arg)
|
||||
{
|
||||
struct ifnet *ifp = arg;
|
||||
struct pfk_ifnet *ifp = arg;
|
||||
struct ifqueue *ifq = &ifp->if_snd;
|
||||
struct hfsc_if *hif;
|
||||
|
||||
|
||||
+58
-10
@@ -1,5 +1,53 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/if_pflog.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: if_pflog.c,v 1.99 2025/07/07 02:28:50 jsg Exp $ */
|
||||
/*
|
||||
* The authors of this code are John Ioannidis (ji@tla.org),
|
||||
* Angelos D. Keromytis (kermit@csd.uch.gr) and
|
||||
* Niels Provos (provos@physnet.uni-hamburg.de).
|
||||
*
|
||||
* This code was written by John Ioannidis for BSD/OS in Athens, Greece,
|
||||
* in November 1995.
|
||||
*
|
||||
* Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
|
||||
* by Angelos D. Keromytis.
|
||||
*
|
||||
* Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
|
||||
* and Niels Provos.
|
||||
*
|
||||
* Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
|
||||
* and Niels Provos.
|
||||
* Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
|
||||
* Copyright (c) 2002 - 2010 Henning Brauer
|
||||
*
|
||||
* Permission to use, copy, and modify this software with or without fee
|
||||
* is hereby granted, provided that this entire notice is included in
|
||||
* all copies of any software which is or includes a copy or
|
||||
* modification of this software.
|
||||
* You may use this code under the GNU public license if you so wish. Please
|
||||
* contribute changes back to the authors under this freer than GPL license
|
||||
* so that we may further the use of strong encryption without limitations to
|
||||
* all.
|
||||
*
|
||||
* THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
|
||||
* IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
|
||||
* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
|
||||
* MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
|
||||
* PURPOSE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
#if NBPFILTER > 0
|
||||
#endif
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
#define PFLOGMTU (32768 + MHLEN + MLEN)
|
||||
|
||||
@@ -10,11 +58,11 @@
|
||||
#endif
|
||||
|
||||
void pflogattach(int);
|
||||
int pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
|
||||
struct rtentry *);
|
||||
int pflogioctl(struct ifnet *, u_long, caddr_t);
|
||||
int pflogoutput(struct pfk_ifnet *, struct mbuf *, struct sockaddr *,
|
||||
struct pf_rtentry *);
|
||||
int pflogioctl(struct pfk_ifnet *, u_long, caddr_t);
|
||||
int pflog_clone_create(struct if_clone *, int);
|
||||
int pflog_clone_destroy(struct ifnet *);
|
||||
int pflog_clone_destroy(struct pfk_ifnet *);
|
||||
struct pflog_softc *pflog_getif(int);
|
||||
|
||||
struct if_clone pflog_cloner =
|
||||
@@ -31,7 +79,7 @@ pflogattach(int npflog)
|
||||
int
|
||||
pflog_clone_create(struct if_clone *ifc, int unit)
|
||||
{
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
struct pflog_softc *pflogif;
|
||||
|
||||
pflogif = malloc(sizeof(*pflogif), M_DEVBUF, M_WAITOK|M_ZERO);
|
||||
@@ -60,7 +108,7 @@ pflog_clone_create(struct if_clone *ifc, int unit)
|
||||
}
|
||||
|
||||
int
|
||||
pflog_clone_destroy(struct ifnet *ifp)
|
||||
pflog_clone_destroy(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct pflog_softc *pflogif = ifp->if_softc;
|
||||
|
||||
@@ -75,15 +123,15 @@ pflog_clone_destroy(struct ifnet *ifp)
|
||||
}
|
||||
|
||||
int
|
||||
pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
|
||||
struct rtentry *rt)
|
||||
pflogoutput(struct pfk_ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
|
||||
struct pf_rtentry *rt)
|
||||
{
|
||||
m_freem(m); /* drop packet */
|
||||
return (EAFNOSUPPORT);
|
||||
}
|
||||
|
||||
int
|
||||
pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
|
||||
pflogioctl(struct pfk_ifnet *ifp, u_long cmd, caddr_t data)
|
||||
{
|
||||
switch (cmd) {
|
||||
case SIOCSIFFLAGS:
|
||||
@@ -120,7 +168,7 @@ pflog_packet(struct pf_pdesc *pd, u_int8_t reason, struct pf_rule *rm,
|
||||
{
|
||||
#if NBPFILTER > 0
|
||||
struct pflog_softc *pflogif;
|
||||
struct ifnet *ifn;
|
||||
struct pfk_ifnet *ifn;
|
||||
caddr_t if_bpf;
|
||||
struct pfloghdr hdr;
|
||||
|
||||
|
||||
+34
-6
@@ -1,5 +1,33 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/ifq.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: ifq.c,v 1.62 2025/07/28 05:25:44 dlg Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2015 David Gwynne <dlg@openbsd.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
#if NBPFILTER > 0
|
||||
#endif
|
||||
|
||||
#if NKSTAT > 0
|
||||
#endif
|
||||
|
||||
/*
|
||||
@@ -96,7 +124,7 @@ void
|
||||
ifq_start_task(void *p)
|
||||
{
|
||||
struct ifqueue *ifq = p;
|
||||
struct ifnet *ifp = ifq->ifq_if;
|
||||
struct pfk_ifnet *ifp = ifq->ifq_if;
|
||||
|
||||
if (!ISSET(ifp->if_flags, PFIFF_RUNNING) ||
|
||||
ifq_empty(ifq) || ifq_is_oactive(ifq))
|
||||
@@ -134,7 +162,7 @@ void
|
||||
ifq_restart_task(void *p)
|
||||
{
|
||||
struct ifqueue *ifq = p;
|
||||
struct ifnet *ifp = ifq->ifq_if;
|
||||
struct pfk_ifnet *ifp = ifq->ifq_if;
|
||||
|
||||
ifq_clr_oactive(ifq);
|
||||
ifp->if_qstart(ifq);
|
||||
@@ -218,7 +246,7 @@ ifq_kstat_copy(struct kstat *ks, void *dst)
|
||||
#endif
|
||||
|
||||
void
|
||||
ifq_init(struct ifqueue *ifq, struct ifnet *ifp, unsigned int idx)
|
||||
ifq_init(struct ifqueue *ifq, struct pfk_ifnet *ifp, unsigned int idx)
|
||||
{
|
||||
ifq->ifq_if = ifp;
|
||||
ifq->ifq_softnet = net_tq(idx);
|
||||
@@ -616,7 +644,7 @@ ifiq_kstat_copy(struct kstat *ks, void *dst)
|
||||
static void ifiq_process(void *);
|
||||
|
||||
void
|
||||
ifiq_init(struct ifiqueue *ifiq, struct ifnet *ifp, unsigned int idx)
|
||||
ifiq_init(struct ifiqueue *ifiq, struct pfk_ifnet *ifp, unsigned int idx)
|
||||
{
|
||||
ifiq->ifiq_if = ifp;
|
||||
ifiq->ifiq_bpfp = NULL;
|
||||
@@ -669,7 +697,7 @@ unsigned int ifiq_maxlen_return = 2048 * 3;
|
||||
int
|
||||
ifiq_input(struct ifiqueue *ifiq, struct mbuf_list *ml)
|
||||
{
|
||||
struct ifnet *ifp = ifiq->ifiq_if;
|
||||
struct pfk_ifnet *ifp = ifiq->ifiq_if;
|
||||
struct mbuf *m;
|
||||
uint64_t packets;
|
||||
uint64_t bytes = 0;
|
||||
@@ -763,7 +791,7 @@ ifiq_add_data(struct ifiqueue *ifiq, struct if_data *data)
|
||||
int
|
||||
ifiq_enqueue_qlim(struct ifiqueue *ifiq, struct mbuf *m, unsigned int qlim)
|
||||
{
|
||||
struct ifnet *ifp = ifiq->ifiq_if;
|
||||
struct pfk_ifnet *ifp = ifiq->ifiq_if;
|
||||
unsigned int len;
|
||||
#if NBPFILTER > 0
|
||||
caddr_t if_bpf = ifp->if_bpf;
|
||||
|
||||
@@ -1,5 +1,29 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 netinet/ip_divert.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: ip_divert.c,v 1.108 2026/06/24 15:56:17 claudio Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* Locks used to protect data:
|
||||
@@ -91,8 +115,8 @@ divert_output(struct inpcb *inp, struct mbuf *m, struct mbuf *nam,
|
||||
m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED_PACKET;
|
||||
|
||||
if (dir == PF_IN) {
|
||||
struct rtentry *rt;
|
||||
struct ifnet *ifp;
|
||||
struct pf_rtentry *rt;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
rt = rtalloc(sintosa(sin), 0, inp->inp_rtableid);
|
||||
if (!rtisvalid(rt) || !ISSET(rt->rt_flags, RTF_LOCAL)) {
|
||||
@@ -168,11 +192,11 @@ divert_packet(struct mbuf *m, int dir, u_int16_t divert_port)
|
||||
|
||||
memset(&sin, 0, sizeof(sin));
|
||||
sin.sin_family = AF_INET;
|
||||
sin./* PFLINUX sin_len */;
|
||||
;
|
||||
|
||||
if (dir == PF_IN) {
|
||||
struct ifaddr *ifa;
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
ifp = if_get(m->m_pkthdr.ph_ifidx);
|
||||
if (ifp == NULL) {
|
||||
|
||||
+95
-42
@@ -1,5 +1,58 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf.c,v 1.1242 2026/10/02 09:40:22 sashan Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org>
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* Effort sponsored in part by the Defense Advanced Research Projects
|
||||
* Agency (DARPA) and Air Force Research Laboratory, Air Force
|
||||
* Materiel Command, USAF, under agreement number F30602-01-2-0537.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
#if NPFLOW > 0
|
||||
#endif /* NPFLOW > 0 */
|
||||
|
||||
#if NPFSYNC > 0
|
||||
#endif /* NPFSYNC > 0 */
|
||||
|
||||
/*
|
||||
@@ -2939,7 +2992,7 @@ pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type, int *icmp_dir,
|
||||
|
||||
case MLD_LISTENER_QUERY:
|
||||
case MLD_LISTENER_REPORT: {
|
||||
struct mld_hdr *mld = &pd->hdr.mld;
|
||||
struct pf_mld_hdr *mld = &pd->hdr.mld;
|
||||
u_int32_t h;
|
||||
|
||||
/*
|
||||
@@ -2984,7 +3037,7 @@ pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type, int *icmp_dir,
|
||||
*icmp_dir = PF_IN;
|
||||
/* FALLTHROUGH */
|
||||
case ND_NEIGHBOR_ADVERT: {
|
||||
struct nd_neighbor_solicit *nd = &pd->hdr.nd_ns;
|
||||
struct pf_nd_neighbor_solicit *nd = &pd->hdr.nd_ns;
|
||||
u_int32_t h;
|
||||
|
||||
*virtual_type = ND_NEIGHBOR_SOLICIT;
|
||||
@@ -3313,7 +3366,7 @@ int
|
||||
pf_translate_icmp_af(struct pf_pdesc *pd, int af, void *arg)
|
||||
{
|
||||
struct pf_icmp *icmp4;
|
||||
struct icmp6hdr *icmp6;
|
||||
struct pf_icmp6 *icmp6;
|
||||
u_int32_t mtu;
|
||||
int32_t ptr = -1;
|
||||
u_int8_t type;
|
||||
@@ -3870,7 +3923,7 @@ pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag)
|
||||
int
|
||||
pf_match_rcvif(struct mbuf *m, struct pf_rule *r)
|
||||
{
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
struct pfi_kif *kif = NULL;
|
||||
|
||||
if (m->m_pkthdr.ph_ifidx == 0)
|
||||
@@ -3882,7 +3935,7 @@ pf_match_rcvif(struct mbuf *m, struct pf_rule *r)
|
||||
kif = (struct pfi_kif *)ifp->if_pf_kif;
|
||||
#if NCARP > 0
|
||||
if (ifp->if_type == IFT_CARP) {
|
||||
struct ifnet *ifp0 = if_get_smr(ifp->if_carpdevidx);
|
||||
struct pfk_ifnet *ifp0 = if_get_smr(ifp->if_carpdevidx);
|
||||
if (ifp0 != NULL)
|
||||
kif = (struct pfi_kif *)ifp0->if_pf_kif;
|
||||
}
|
||||
@@ -4246,12 +4299,12 @@ u_int16_t
|
||||
pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, uint16_t offer,
|
||||
uint16_t mssdflt)
|
||||
{
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
struct sockaddr_in *dst;
|
||||
#ifdef INET6
|
||||
struct sockaddr_in6 *dst6;
|
||||
#endif /* INET6 */
|
||||
struct rtentry *rt = NULL;
|
||||
struct pf_rtentry *rt = NULL;
|
||||
struct sockaddr_storage ss;
|
||||
int hlen, mss;
|
||||
|
||||
@@ -4262,7 +4315,7 @@ pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, uint16_t offer,
|
||||
hlen = sizeof(struct pf_ip);
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->/* PFLINUX sin_len */;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
dst->sin_addr = addr->v4;
|
||||
rt = rtalloc(sintosa(dst), 0, rtableid);
|
||||
break;
|
||||
@@ -6338,7 +6391,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
&pd->hdr.icmp6.icmp6_id, nk->port[iidx]);
|
||||
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr), &pd->hdr.icmp6,
|
||||
sizeof(struct pf_icmp6), &pd->hdr.icmp6,
|
||||
M_NOWAIT);
|
||||
copyback = 1;
|
||||
break;
|
||||
@@ -6403,7 +6456,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
break;
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
ipoff2 = pd->off + sizeof(struct icmp6hdr);
|
||||
ipoff2 = pd->off + sizeof(struct pf_icmp6);
|
||||
|
||||
if (!pf_pull_hdr(pd2.m, ipoff2, &h2_6, sizeof(h2_6),
|
||||
reason, pd2.af)) {
|
||||
@@ -6560,7 +6613,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
&pd->hdr.icmp))
|
||||
return (PF_DROP);
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
if (pf_change_icmp_af(pd->m, ipoff2,
|
||||
pd, &pd2, &nk->addr[sidx],
|
||||
@@ -6633,7 +6686,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
m_copyback(pd2.m, ipoff2, sizeof(h2_6),
|
||||
&h2_6, M_NOWAIT);
|
||||
@@ -6690,7 +6743,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
&pd->hdr.icmp))
|
||||
return (PF_DROP);
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
if (pf_change_icmp_af(pd->m, ipoff2,
|
||||
pd, &pd2, &nk->addr[sidx],
|
||||
@@ -6761,7 +6814,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
m_copyback(pd2.m, ipoff2, sizeof(h2_6),
|
||||
&h2_6, M_NOWAIT);
|
||||
@@ -6825,7 +6878,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
&pd->hdr.icmp))
|
||||
return (PF_DROP);
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
if (pf_change_icmp_af(pd->m, ipoff2,
|
||||
pd, &pd2, &nk->addr[sidx],
|
||||
@@ -6893,7 +6946,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
}
|
||||
#ifdef INET6
|
||||
case IPPROTO_ICMPV6: {
|
||||
struct icmp6hdr *iih = &pd2.hdr.icmp6;
|
||||
struct pf_icmp6 *iih = &pd2.hdr.icmp6;
|
||||
|
||||
if (pd2.af != AF_INET6) {
|
||||
REASON_SET(reason, PFRES_NORM);
|
||||
@@ -6901,7 +6954,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
}
|
||||
|
||||
if (!pf_pull_hdr(pd2.m, pd2.off, iih,
|
||||
sizeof(struct icmp6hdr), reason, pd2.af)) {
|
||||
sizeof(struct pf_icmp6), reason, pd2.af)) {
|
||||
DPFPRINTF(LOG_NOTICE,
|
||||
"ICMP error message too short (icmp6)");
|
||||
return (PF_DROP);
|
||||
@@ -6943,7 +6996,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
&pd->hdr.icmp))
|
||||
return (PF_DROP);
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
if (pf_change_icmp_af(pd->m, ipoff2,
|
||||
pd, &pd2, &nk->addr[sidx],
|
||||
@@ -6958,7 +7011,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
pf_patch_16(pd, &iih->icmp6_id,
|
||||
nk->port[iidx]);
|
||||
m_copyback(pd2.m, pd2.off,
|
||||
sizeof(struct icmp6hdr), iih,
|
||||
sizeof(struct pf_icmp6), iih,
|
||||
M_NOWAIT);
|
||||
pd->m->m_pkthdr.ph_rtableid =
|
||||
nk->rdomain;
|
||||
@@ -6996,12 +7049,12 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
pd->src, &nk->addr[pd2.didx], 0);
|
||||
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr), &pd->hdr.icmp6,
|
||||
sizeof(struct pf_icmp6), &pd->hdr.icmp6,
|
||||
M_NOWAIT);
|
||||
m_copyback(pd2.m, ipoff2, sizeof(h2_6), &h2_6,
|
||||
M_NOWAIT);
|
||||
m_copyback(pd2.m, pd2.off,
|
||||
sizeof(struct icmp6hdr), iih, M_NOWAIT);
|
||||
sizeof(struct pf_icmp6), iih, M_NOWAIT);
|
||||
copyback = 1;
|
||||
}
|
||||
break;
|
||||
@@ -7054,7 +7107,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
m_copyback(pd->m, pd->off,
|
||||
sizeof(struct icmp6hdr),
|
||||
sizeof(struct pf_icmp6),
|
||||
&pd->hdr.icmp6, M_NOWAIT);
|
||||
m_copyback(pd2.m, ipoff2, sizeof(h2_6),
|
||||
&h2_6, M_NOWAIT);
|
||||
@@ -7124,7 +7177,7 @@ pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
|
||||
#ifdef INET6
|
||||
struct sockaddr_in6 *dst6;
|
||||
#endif /* INET6 */
|
||||
struct rtentry *rt = NULL;
|
||||
struct pf_rtentry *rt = NULL;
|
||||
|
||||
check_mpath = 0;
|
||||
memset(&ss, 0, sizeof(ss));
|
||||
@@ -7132,7 +7185,7 @@ pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
|
||||
case AF_INET:
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->/* PFLINUX sin_len */;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
dst->sin_addr = addr->v4;
|
||||
if (atomic_load_int(&ipmultipath))
|
||||
check_mpath = 1;
|
||||
@@ -7177,7 +7230,7 @@ pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
|
||||
ret = 1;
|
||||
#if NCARP > 0
|
||||
} else {
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
smr_read_enter();
|
||||
ifp = if_get_smr(rt->rt_ifidx);
|
||||
@@ -7207,7 +7260,7 @@ pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw,
|
||||
#ifdef INET6
|
||||
struct sockaddr_in6 *dst6;
|
||||
#endif /* INET6 */
|
||||
struct rtentry *rt;
|
||||
struct pf_rtentry *rt;
|
||||
int ret = 0;
|
||||
|
||||
memset(&ss, 0, sizeof(ss));
|
||||
@@ -7215,7 +7268,7 @@ pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw,
|
||||
case AF_INET:
|
||||
dst = (struct sockaddr_in *)&ss;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->/* PFLINUX sin_len */;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
dst->sin_addr = addr->v4;
|
||||
break;
|
||||
#ifdef INET6
|
||||
@@ -7245,9 +7298,9 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
|
||||
struct mbuf *m0;
|
||||
struct mbuf_list ml;
|
||||
struct sockaddr_in *dst, sin;
|
||||
struct rtentry *rt = NULL;
|
||||
struct pf_rtentry *rt = NULL;
|
||||
struct pf_ip *ip;
|
||||
struct ifnet *ifp = NULL;
|
||||
struct pfk_ifnet *ifp = NULL;
|
||||
unsigned int rtableid;
|
||||
|
||||
if (pd->m->m_pkthdr.pf.routed++ > 3) {
|
||||
@@ -7289,7 +7342,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
|
||||
memset(&sin, 0, sizeof(sin));
|
||||
dst = &sin;
|
||||
dst->sin_family = AF_INET;
|
||||
dst->/* PFLINUX sin_len */;
|
||||
dst->sin_len = sizeof(*dst);
|
||||
dst->sin_addr = st->rt_addr.v4;
|
||||
rtableid = m0->m_pkthdr.ph_rtableid;
|
||||
|
||||
@@ -7363,9 +7416,9 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
|
||||
{
|
||||
struct mbuf *m0;
|
||||
struct sockaddr_in6 *dst, sin6;
|
||||
struct rtentry *rt = NULL;
|
||||
struct pf_rtentry *rt = NULL;
|
||||
struct pf_ip6_hdr *ip6;
|
||||
struct ifnet *ifp = NULL;
|
||||
struct pfk_ifnet *ifp = NULL;
|
||||
struct m_tag *mtag;
|
||||
unsigned int rtableid;
|
||||
|
||||
@@ -7751,7 +7804,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct pf_ip6_hdr *h, u_short *reason)
|
||||
{
|
||||
struct ip6_frag frag;
|
||||
struct ip6_ext ext;
|
||||
struct icmp6hdr icmp6;
|
||||
struct pf_icmp6 icmp6;
|
||||
struct ip6_rthdr rthdr;
|
||||
u_int32_t end;
|
||||
int hdr_cnt, fraghdr_cnt = 0, rthdr_cnt = 0;
|
||||
@@ -7919,7 +7972,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct pf_ip6_hdr *h, u_short *reason)
|
||||
if (pd->fragoff != 0 && end < pd->off +
|
||||
(pd->proto == IPPROTO_TCP ? sizeof(struct pf_tcphdr) :
|
||||
pd->proto == IPPROTO_UDP ? sizeof(struct pf_udphdr) :
|
||||
sizeof(struct icmp6hdr))) {
|
||||
sizeof(struct pf_icmp6))) {
|
||||
pd->off = pd->fragoff;
|
||||
pd->proto = IPPROTO_FRAGMENT;
|
||||
}
|
||||
@@ -8104,7 +8157,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
|
||||
}
|
||||
#ifdef INET6
|
||||
case IPPROTO_ICMPV6: {
|
||||
size_t icmp_hlen = sizeof(struct icmp6hdr);
|
||||
size_t icmp_hlen = sizeof(struct pf_icmp6);
|
||||
|
||||
if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
|
||||
reason, pd->af))
|
||||
@@ -8113,11 +8166,11 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
|
||||
switch (pd->hdr.icmp6.icmp6_type) {
|
||||
case MLD_LISTENER_QUERY:
|
||||
case MLD_LISTENER_REPORT:
|
||||
icmp_hlen = sizeof(struct mld_hdr);
|
||||
icmp_hlen = sizeof(struct pf_mld_hdr);
|
||||
break;
|
||||
case ND_NEIGHBOR_SOLICIT:
|
||||
case ND_NEIGHBOR_ADVERT:
|
||||
icmp_hlen = sizeof(struct nd_neighbor_solicit);
|
||||
icmp_hlen = sizeof(struct pf_nd_neighbor_solicit);
|
||||
/* FALLTHROUGH */
|
||||
case ND_ROUTER_SOLICIT:
|
||||
case ND_ROUTER_ADVERT:
|
||||
@@ -8128,7 +8181,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
|
||||
}
|
||||
break;
|
||||
}
|
||||
if (icmp_hlen > sizeof(struct icmp6hdr) &&
|
||||
if (icmp_hlen > sizeof(struct pf_icmp6) &&
|
||||
!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
|
||||
reason, pd->af))
|
||||
return (PF_DROP);
|
||||
@@ -8216,7 +8269,7 @@ pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_state *st,
|
||||
}
|
||||
|
||||
int
|
||||
pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0)
|
||||
pf_test(sa_family_t af, int fwdir, struct pfk_ifnet *ifp, struct mbuf **m0)
|
||||
{
|
||||
struct pfi_kif *kif = NULL;
|
||||
u_short action, reason = 0;
|
||||
@@ -8234,7 +8287,7 @@ pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0)
|
||||
|
||||
#if NCARP > 0
|
||||
if (ifp->if_type == IFT_CARP) {
|
||||
struct ifnet *ifp0;
|
||||
struct pfk_ifnet *ifp0;
|
||||
|
||||
smr_read_enter();
|
||||
ifp0 = if_get_smr(ifp->if_carpdevidx);
|
||||
@@ -8690,7 +8743,7 @@ done:
|
||||
action = PF_DROP;
|
||||
goto out;
|
||||
}
|
||||
ip6_forward(pd.m, NULL, flags);
|
||||
pfk_ip6_forward(pd.m, NULL, flags);
|
||||
} else
|
||||
ip6_output(pd.m, NULL, NULL, 0, NULL, NULL);
|
||||
break;
|
||||
@@ -9047,7 +9100,7 @@ void
|
||||
pf_pktenqueue_delayed(void *arg)
|
||||
{
|
||||
struct pf_pktdelay *pdy = arg;
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
|
||||
ifp = if_get(pdy->ifidx);
|
||||
if (ifp != NULL) {
|
||||
|
||||
+50
-8
@@ -1,9 +1,51 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_if.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_if.c,v 1.114 2026/09/08 18:42:14 bluhm Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright 2005 Henning Brauer <henning@openbsd.org>
|
||||
* Copyright 2005 Ryan McBride <mcbride@openbsd.org>
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* Copyright (c) 2003 Cedric Berger
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
#define isupper(c) ((c) >= 'A' && (c) <= 'Z')
|
||||
#define islower(c) ((c) >= 'a' && (c) <= 'z')
|
||||
#define isalpha(c) (isupper(c)||islower(c))
|
||||
|
||||
struct pfi_kif *pfi_all = NULL;
|
||||
struct pool pfi_addr_pl;
|
||||
@@ -18,7 +60,7 @@ void pfi_dynaddr_update(struct pfi_dynaddr *dyn);
|
||||
void pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
|
||||
u_int8_t, int);
|
||||
void pfi_kifaddr_update(void *);
|
||||
void pfi_instance_add(struct ifnet *, u_int8_t, int);
|
||||
void pfi_instance_add(struct pfk_ifnet *, u_int8_t, int);
|
||||
void pfi_address_add(struct sockaddr *, sa_family_t, u_int8_t);
|
||||
int pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
|
||||
int pfi_skip_if(const char *, struct pfi_kif *);
|
||||
@@ -243,7 +285,7 @@ pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
|
||||
}
|
||||
|
||||
void
|
||||
pfi_attach_ifnet(struct ifnet *ifp)
|
||||
pfi_attach_ifnet(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct pfi_kif *kif;
|
||||
struct task *t;
|
||||
@@ -267,7 +309,7 @@ pfi_attach_ifnet(struct ifnet *ifp)
|
||||
}
|
||||
|
||||
void
|
||||
pfi_detach_ifnet(struct ifnet *ifp)
|
||||
pfi_detach_ifnet(struct pfk_ifnet *ifp)
|
||||
{
|
||||
struct pfi_kif *kif;
|
||||
struct task *t;
|
||||
@@ -513,7 +555,7 @@ pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, u_int8_t net, int f
|
||||
}
|
||||
|
||||
void
|
||||
pfi_instance_add(struct ifnet *ifp, u_int8_t net, int flags)
|
||||
pfi_instance_add(struct pfk_ifnet *ifp, u_int8_t net, int flags)
|
||||
{
|
||||
struct ifaddr *ifa;
|
||||
int got4 = 0, got6 = 0;
|
||||
@@ -862,7 +904,7 @@ pfi_xcommit(void)
|
||||
{
|
||||
struct pfi_kif *p, *gkif;
|
||||
struct ifg_list *g;
|
||||
struct ifnet *ifp;
|
||||
struct pfk_ifnet *ifp;
|
||||
size_t n;
|
||||
|
||||
PF_ASSERT_LOCKED();
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -1,5 +1,52 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_lb.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_lb.c,v 1.78 2026/05/12 09:34:00 henning Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* Copyright (c) 2002 - 2008 Henning Brauer
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* Effort sponsored in part by the Defense Advanced Research Projects
|
||||
* Agency (DARPA) and Air Force Research Laboratory, Air Force
|
||||
* Materiel Command, USAF, under agreement number F30602-01-2-0537.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
u_int64_t pf_hash(struct pf_addr *, struct pf_addr *,
|
||||
struct pf_poolhashkey *, sa_family_t);
|
||||
|
||||
+45
-7
@@ -1,5 +1,43 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_norm.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_norm.c,v 1.239 2026/08/11 14:28:59 bluhm Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright 2001 Niels Provos <provos@citi.umich.edu>
|
||||
* Copyright 2009 Henning Brauer <henning@openbsd.org>
|
||||
* Copyright 2011-2018 Alexander Bluhm <bluhm@openbsd.org>
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
struct pf_frent {
|
||||
TAILQ_ENTRY(pf_frent) fr_next;
|
||||
@@ -886,7 +924,7 @@ fail:
|
||||
|
||||
int
|
||||
pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
|
||||
struct ifnet *ifp, struct rtentry *rt)
|
||||
struct pfk_ifnet *ifp, struct pf_rtentry *rt)
|
||||
{
|
||||
struct mbuf *m = *m0;
|
||||
struct mbuf_list ml;
|
||||
@@ -904,7 +942,7 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
|
||||
ftag = NULL;
|
||||
|
||||
/* Checksum must be calculated for the whole packet */
|
||||
in6_proto_cksum_out(m, NULL);
|
||||
pfk_in6_proto_cksum_out(m, NULL);
|
||||
|
||||
if (extoff) {
|
||||
int off;
|
||||
@@ -928,12 +966,12 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
|
||||
* Maxlen may be less than 8 iff there was only a single
|
||||
* fragment. As it was fragmented before, add a fragment
|
||||
* header also for a single fragment. If total or maxlen
|
||||
* is less than 8, ip6_fragment() will return EMSGSIZE and
|
||||
* is less than 8, pfk_ip6_fragment() will return EMSGSIZE and
|
||||
* we drop the packet.
|
||||
*/
|
||||
mtu = hdrlen + sizeof(struct ip6_frag) + maxlen;
|
||||
error = ip6_fragment(m, &ml, hdrlen, proto, mtu);
|
||||
*m0 = NULL; /* ip6_fragment() has consumed original packet. */
|
||||
error = pfk_ip6_fragment(m, &ml, hdrlen, proto, mtu);
|
||||
*m0 = NULL; /* pfk_ip6_fragment() has consumed original packet. */
|
||||
if (error) {
|
||||
DPFPRINTF(LOG_NOTICE, "refragment error %d", error);
|
||||
return (PF_DROP);
|
||||
@@ -955,9 +993,9 @@ pf_refragment6(struct mbuf **m0, struct m_tag *mtag, struct sockaddr_in6 *dst,
|
||||
ip6stat_inc(ip6s_cantforward);
|
||||
return (PF_DROP);
|
||||
}
|
||||
ip6_forward(m, NULL, flags);
|
||||
pfk_ip6_forward(m, NULL, flags);
|
||||
} else if ((u_long)m->m_pkthdr.len <= ifp->if_mtu) {
|
||||
ifp->if_output(ifp, m, sin6tosa(dst), rt);
|
||||
pfk_if_output(ifp, m, (struct sockaddr *)sin6tosa(dst), rt);
|
||||
} else {
|
||||
icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
|
||||
}
|
||||
|
||||
+49
-2
@@ -1,5 +1,52 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_osfp.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_osfp.c,v 1.50 2026/09/13 03:27:17 deraadt Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifdef _KERNEL
|
||||
#endif /* _KERNEL */
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
#ifdef _KERNEL
|
||||
typedef struct pool pool_t;
|
||||
|
||||
#else /* !_KERNEL */
|
||||
/* Userland equivalents so we can lend code to tcpdump et al. */
|
||||
|
||||
#define pool_t int
|
||||
#define pool_get(pool, flags) malloc(*(pool))
|
||||
#define pool_put(pool, item) free(item)
|
||||
#define pool_init(pool, size, a, ao, f, m, p) (*(pool)) = (size)
|
||||
|
||||
#define PF_LOCK()
|
||||
#define PF_UNLOCK()
|
||||
#define PF_ASSERT_LOCKED()
|
||||
|
||||
#ifdef PFDEBUG
|
||||
#endif /* PFDEBUG */
|
||||
|
||||
#endif /* _KERNEL */
|
||||
@@ -88,7 +135,7 @@ pf_osfp_fingerprint_hdr(const struct pf_ip *ip, const struct pf_ip6_hdr *ip6,
|
||||
#else /* !_KERNEL */
|
||||
memset(&sin, 0, sizeof(sin));
|
||||
sin.sin_family = AF_INET;
|
||||
sin./* PFLINUX sin_len */;
|
||||
;
|
||||
sin.sin_addr = ip->ip_src;
|
||||
(void)getnameinfo((struct sockaddr *)&sin,
|
||||
sizeof(struct sockaddr_in), srcname, sizeof(srcname),
|
||||
@@ -111,7 +158,7 @@ pf_osfp_fingerprint_hdr(const struct pf_ip *ip, const struct pf_ip6_hdr *ip6,
|
||||
#else /* !_KERNEL */
|
||||
memset(&sin6, 0, sizeof(sin6));
|
||||
sin6.sin6_family = AF_INET6;
|
||||
sin6.sin6_len = sizeof(struct sockaddr_in6);
|
||||
;
|
||||
sin6.sin6_addr = ip6->ip6_src;
|
||||
(void)getnameinfo((struct sockaddr *)&sin6,
|
||||
sizeof(struct sockaddr_in6), srcname, sizeof(srcname),
|
||||
|
||||
@@ -1,5 +1,67 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_ruleset.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_ruleset.c,v 1.22 2025/07/07 02:28:50 jsg Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* Copyright (c) 2002,2003 Henning Brauer
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* Effort sponsored in part by the Defense Advanced Research Projects
|
||||
* Agency (DARPA) and Air Force Research Laboratory, Air Force
|
||||
* Materiel Command, USAF, under agreement number F30602-01-2-0537.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifdef _KERNEL
|
||||
#endif /* _KERNEL */
|
||||
|
||||
|
||||
#ifdef _KERNEL
|
||||
#define rs_malloc(x) malloc(x, M_PF, M_WAITOK|M_CANFAIL|M_ZERO)
|
||||
#define rs_free(x, siz) free(x, M_PF, siz)
|
||||
#define rs_pool_get_anchor() pool_get(&pf_anchor_pl, \
|
||||
PR_WAITOK|PR_LIMITFAIL|PR_ZERO)
|
||||
#define rs_pool_put_anchor(x) pool_put(&pf_anchor_pl, x)
|
||||
|
||||
struct pool pf_anchor_pl;
|
||||
|
||||
#else /* !_KERNEL */
|
||||
/* Userland equivalents so we can lend code to pfctl et al. */
|
||||
|
||||
#define rs_malloc(x) calloc(1, x)
|
||||
#define rs_free(x, siz) freezero(x, siz)
|
||||
#define rs_pool_get_anchor() calloc(1, sizeof(struct pf_anchor))
|
||||
#define rs_pool_put_anchor(x) freezero(x, sizeof(struct pf_anchor))
|
||||
|
||||
#ifdef PFDEBUG
|
||||
#endif /* PFDEBUG */
|
||||
#endif /* _KERNEL */
|
||||
|
||||
|
||||
@@ -1,5 +1,72 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_syncookies.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_syncookies.c,v 1.10 2025/07/07 02:28:50 jsg Exp $ */
|
||||
|
||||
/* Copyright (c) 2016,2017 Henning Brauer <henning@openbsd.org>
|
||||
* Copyright (c) 2016 Alexandr Nedvedicky <sashan@openbsd.org>
|
||||
*
|
||||
* syncookie parts based on FreeBSD sys/netinet/tcp_syncache.c
|
||||
*
|
||||
* Copyright (c) 2001 McAfee, Inc.
|
||||
* Copyright (c) 2006,2013 Andre Oppermann, Internet Business Solutions AG
|
||||
* All rights reserved.
|
||||
*
|
||||
* This software was developed for the FreeBSD Project by Jonathan Lemon
|
||||
* and McAfee Research, the Security Research Division of McAfee, Inc. under
|
||||
* DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
|
||||
* DARPA CHATS research program. [2001 McAfee, Inc.]
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* when we're under synflood, we use syncookies to prevent state table
|
||||
* exhaustion. Trigger for the synflood mode is the number of half-open
|
||||
* connections in the state table.
|
||||
* We leave synflood mode when the number of half-open states - including
|
||||
* in-flight syncookies - drops far enough again
|
||||
*/
|
||||
|
||||
/*
|
||||
* syncookie enabled Initial Sequence Number:
|
||||
* 24 bit MAC
|
||||
* 3 bit WSCALE index
|
||||
* 3 bit MSS index
|
||||
* 1 bit SACK permitted
|
||||
* 1 bit odd/even secret
|
||||
*
|
||||
* References:
|
||||
* RFC4987 TCP SYN Flooding Attacks and Common Mitigations
|
||||
* http://cr.yp.to/syncookies.html (overview)
|
||||
* http://cr.yp.to/syncookies/archive (details)
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
union pf_syncookie {
|
||||
uint8_t cookie;
|
||||
@@ -103,7 +170,7 @@ pf_syncookie_send(struct pf_pdesc *pd, u_short *reason)
|
||||
uint16_t mss, mssdflt;
|
||||
uint32_t iss;
|
||||
|
||||
mssdflt = atomic_load_int(&tcp_mssdflt);
|
||||
mssdflt = atomic_load_int(&pfk_tcp_mssdflt);
|
||||
mss = max(pf_get_mss(pd, mssdflt), mssdflt);
|
||||
iss = pf_syncookie_generate(pd, mss);
|
||||
pf_send_tcp(NULL, pd->af, pd->dst, pd->src, *pd->dport, *pd->sport,
|
||||
|
||||
+51
-10
@@ -1,5 +1,46 @@
|
||||
/* PFLINUX port of OpenBSD 8.0 net/pf_table.c — see docs/porting-notes.md */
|
||||
#include <pfk.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
/* $OpenBSD: pf_table.c,v 1.151 2026/10/02 09:40:22 sashan Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2002 Cedric Berger
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef INET6
|
||||
#endif /* INET6 */
|
||||
|
||||
|
||||
#define ACCEPT_FLAGS(flags, oklist) \
|
||||
do { \
|
||||
@@ -26,14 +67,14 @@
|
||||
|
||||
#define FILLIN_SIN(sin, addr) \
|
||||
do { \
|
||||
(sin)./* PFLINUX sin_len */; \
|
||||
; \
|
||||
(sin).sin_family = AF_INET; \
|
||||
(sin).sin_addr = (addr); \
|
||||
} while (0)
|
||||
|
||||
#define FILLIN_SIN6(sin6, addr) \
|
||||
do { \
|
||||
(sin6).sin6_len = sizeof(sin6); \
|
||||
; \
|
||||
(sin6).sin6_family = AF_INET6; \
|
||||
(sin6).sin6_addr = (addr); \
|
||||
} while (0)
|
||||
@@ -1215,13 +1256,13 @@ pfr_prepare_network(union sockaddr_union *sa, int af, int net)
|
||||
bzero(sa, sizeof(*sa));
|
||||
switch (af) {
|
||||
case AF_INET:
|
||||
sa->sin./* PFLINUX sin_len */;
|
||||
;
|
||||
sa->sin.sin_family = AF_INET;
|
||||
sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
|
||||
break;
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
sa->sin6.sin6_len = sizeof(sa->sin6);
|
||||
;
|
||||
sa->sin6.sin6_family = AF_INET6;
|
||||
for (i = 0; i < 4; i++) {
|
||||
if (net <= 32) {
|
||||
@@ -2416,7 +2457,7 @@ pfr_kentry_byaddr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
|
||||
switch (af) {
|
||||
case AF_INET:
|
||||
bzero(&tmp4, sizeof(tmp4));
|
||||
tmp4./* PFLINUX sin_len */;
|
||||
;
|
||||
tmp4.sin_family = AF_INET;
|
||||
tmp4.sin_addr.s_addr = a->addr32[0];
|
||||
ke = (struct pfr_kentry *)rn_match(&tmp4, kt->pfrkt_ip4);
|
||||
@@ -2424,7 +2465,7 @@ pfr_kentry_byaddr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
bzero(&tmp6, sizeof(tmp6));
|
||||
tmp6.sin6_len = sizeof(tmp6);
|
||||
;
|
||||
tmp6.sin6_family = AF_INET6;
|
||||
bcopy(a, &tmp6.sin6_addr, sizeof(tmp6.sin6_addr));
|
||||
ke = (struct pfr_kentry *)rn_match(&tmp6, kt->pfrkt_ip6);
|
||||
@@ -2460,7 +2501,7 @@ pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, struct pf_pdesc *pd,
|
||||
switch (af) {
|
||||
case AF_INET:
|
||||
bzero(&tmp4, sizeof(tmp4));
|
||||
tmp4./* PFLINUX sin_len */;
|
||||
;
|
||||
tmp4.sin_family = AF_INET;
|
||||
tmp4.sin_addr.s_addr = a->addr32[0];
|
||||
ke = (struct pfr_kentry *)rn_match(&tmp4, kt->pfrkt_ip4);
|
||||
@@ -2468,7 +2509,7 @@ pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, struct pf_pdesc *pd,
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
bzero(&tmp6, sizeof(tmp6));
|
||||
tmp6.sin6_len = sizeof(tmp6);
|
||||
;
|
||||
tmp6.sin6_family = AF_INET6;
|
||||
bcopy(a, &tmp6.sin6_addr, sizeof(tmp6.sin6_addr));
|
||||
ke = (struct pfr_kentry *)rn_match(&tmp6, kt->pfrkt_ip6);
|
||||
@@ -2597,14 +2638,14 @@ pfr_pool_get(struct pf_pool *rpool, struct pf_addr **raddr,
|
||||
switch (af) {
|
||||
case AF_INET:
|
||||
bzero(&tmp4, sizeof(tmp4));
|
||||
tmp4./* PFLINUX sin_len */;
|
||||
;
|
||||
tmp4.sin_family = AF_INET;
|
||||
addr = (struct pf_addr *)&tmp4.sin_addr;
|
||||
break;
|
||||
#ifdef INET6
|
||||
case AF_INET6:
|
||||
bzero(&tmp6, sizeof(tmp6));
|
||||
tmp6.sin6_len = sizeof(tmp6);
|
||||
;
|
||||
tmp6.sin6_family = AF_INET6;
|
||||
addr = (struct pf_addr *)&tmp6.sin6_addr;
|
||||
break;
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
/*
|
||||
* PF-on-Linux netfilter hook registration + M1 ioctl skeleton.
|
||||
* The real verdict logic arrives from staged pf.c (T12); this file owns
|
||||
* hook lifecycle and /dev/pf dispatch. (ISC 2026)
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <pfk_api.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
static int pfk_enabled = 1; /* like pf_defaultwise/pf_enable on boot */
|
||||
static struct pf_status pfk_stat;
|
||||
|
||||
/* --- temporary M1 control surface (replaced by staged pf_ioctl.c, T7b) --- */
|
||||
static int pfk_ioctl_min(struct file *f, unsigned int cmd, unsigned long addr)
|
||||
{
|
||||
struct pf_status s;
|
||||
|
||||
switch (cmd) {
|
||||
case DIOCGETSTATUS:
|
||||
memset(&s, 0, sizeof(s));
|
||||
s.running = pfk_enabled;
|
||||
strscpy(s.ifname, "pf", sizeof(s.ifname));
|
||||
if (copy_to_user((void __user *)addr, &s, sizeof(s)))
|
||||
return EFAULT;
|
||||
return 0;
|
||||
default:
|
||||
/* Rule/state/table ioctls arrive with the staged pf_ioctl.c
|
||||
* (plan T7b); until then they are rejected (not silently
|
||||
* accepted) so behaviour is explicit. */
|
||||
return EINVAL;
|
||||
}
|
||||
}
|
||||
|
||||
long pfk_ioctl(struct file *f, unsigned int cmd, unsigned long addr)
|
||||
{
|
||||
return pfk_ioctl_min(f, cmd, addr);
|
||||
}
|
||||
|
||||
void pfk_status(struct pf_status *s)
|
||||
{
|
||||
if (s)
|
||||
*s = pfk_stat;
|
||||
}
|
||||
int pfk_enable(int on) { pfk_enabled = on ? 1 : 0; return 0; }
|
||||
|
||||
/* --- netfilter hooks: ingress/egress plumbing (real work lands in T12) --- */
|
||||
static unsigned int
|
||||
pfk_ipv4_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *st)
|
||||
{
|
||||
/* PFLINUX M1: accept-everything placeholder; T12 routes to pf_test() */
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
||||
static struct nf_hook_ops pfk_hooks[] = {
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_PRE_ROUTING,
|
||||
.priority = NF_IP_PRI_FIRST },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_LOCAL_IN,
|
||||
.priority = NF_IP_PRI_FIRST + 1 },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_FORWARD,
|
||||
.priority = NF_IP_PRI_FIRST },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_LOCAL_OUT,
|
||||
.priority = NF_IP_PRI_CONNTRACK + 1 },
|
||||
{ .hook = pfk_ipv4_hook, .pf = NFPROTO_IPV4, .hooknum = NF_INET_POST_ROUTING,
|
||||
.priority = NF_IP_PRI_LAST - 1 },
|
||||
};
|
||||
#define PFK_NHOOKS ARRAY_SIZE(pfk_hooks)
|
||||
|
||||
int pfk_hooks_register(void)
|
||||
{
|
||||
int i, err;
|
||||
|
||||
for (i = 0; i < PFK_NHOOKS; i++) {
|
||||
pfk_hooks[i].priv = NULL;
|
||||
err = nf_register_net_hook(&init_net, &pfk_hooks[i]);
|
||||
if (err)
|
||||
goto fail;
|
||||
}
|
||||
return 0;
|
||||
fail:
|
||||
while (--i >= 0)
|
||||
nf_unregister_net_hook(&init_net, &pfk_hooks[i]);
|
||||
return err;
|
||||
}
|
||||
|
||||
void pfk_hooks_unregister(void)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; i < PFK_NHOOKS; i++)
|
||||
nf_unregister_net_hook(&init_net, &pfk_hooks[i]);
|
||||
}
|
||||
@@ -1,86 +0,0 @@
|
||||
/*
|
||||
* PF-on-Linux: pfk module core — load/exit, /dev/pf misc device,
|
||||
* NET_LOCK bring-up, staged upstream bring-up hooks. (ISC 2026)
|
||||
*/
|
||||
#include <pfk.h>
|
||||
#include <pfk_api.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pfvar_priv.h>
|
||||
|
||||
extern void pfk_mbuf_exit(void);
|
||||
extern int pfk_if_init(void);
|
||||
extern void pfk_if_exit(void);
|
||||
|
||||
static int pfk_open(struct inode *inode, struct file *filp)
|
||||
{
|
||||
if (filp->f_mode & FMODE_WRITE)
|
||||
return capable(CAP_NET_ADMIN) ? 0 : -EPERM;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static long pfk_ioctl_io(struct file *filp, unsigned int cmd,
|
||||
unsigned long arg)
|
||||
{
|
||||
if (!capable(CAP_NET_ADMIN))
|
||||
return -EPERM;
|
||||
return pfk_ioctl(filp, cmd, arg);
|
||||
}
|
||||
|
||||
static const struct file_operations pfk_fops = {
|
||||
.owner = THIS_MODULE,
|
||||
.open = pfk_open,
|
||||
.unlocked_ioctl = pfk_ioctl_io,
|
||||
.compat_ioctl = compat_ptr_ioctl,
|
||||
};
|
||||
|
||||
static struct miscdevice pfk_dev = {
|
||||
.minor = MISC_DYNAMIC_MINOR,
|
||||
.name = "pf",
|
||||
.fops = &pfk_fops,
|
||||
.mode = 0600,
|
||||
};
|
||||
|
||||
static int __init pfk_init(void)
|
||||
{
|
||||
int err;
|
||||
|
||||
pfk_net_lock_init();
|
||||
err = pfk_mbuf_init();
|
||||
if (err)
|
||||
return err;
|
||||
err = pfk_if_init();
|
||||
if (err)
|
||||
goto err_mbuf;
|
||||
err = pfk_hooks_register();
|
||||
if (err)
|
||||
goto err_if;
|
||||
err = misc_register(&pfk_dev);
|
||||
if (err)
|
||||
goto err_hooks;
|
||||
pr_info("pfk: PF-on-Linux engine loaded (OpenBSD 8.0 base)\n");
|
||||
return 0;
|
||||
err_hooks:
|
||||
pfk_hooks_unregister();
|
||||
err_if:
|
||||
pfk_if_exit();
|
||||
err_mbuf:
|
||||
pfk_mbuf_exit();
|
||||
return err;
|
||||
}
|
||||
|
||||
static void __exit pfk_exit(void)
|
||||
{
|
||||
misc_deregister(&pfk_dev);
|
||||
pfk_hooks_unregister();
|
||||
pfk_if_exit();
|
||||
pfk_mbuf_exit();
|
||||
pr_info("pfk: unloaded\n");
|
||||
}
|
||||
|
||||
module_init(pfk_init);
|
||||
module_exit(pfk_exit);
|
||||
MODULE_LICENSE("Dual MIT/GPL"); /* ISC/BSD code; Dual MIT/GPL is the kernel-
|
||||
* recognised tag for permissive BSD-licensed
|
||||
* modules linking GPL exports (see LICENSE). */
|
||||
MODULE_DESCRIPTION("PF packet filter (ported from OpenBSD 8.0) for Linux");
|
||||
MODULE_AUTHOR("PF-on-Linux contributors");
|
||||
Reference in new issue
Block a user