mirror of
https://github.com/lgcosta/pf-linux-port.git
synced 2026-11-12 20:15:36 -03:00
M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer handling with NF_STOLEN + re-injection (documented divergence: re-entry) - pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback - pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires under the write lock — observed as full-VM network hang) - tools: static pfctl link for musl VMs
This commit is contained in:
lgcosta committed
1 parent
0119e70960
commit
5323ee2c71
49 files changed
+20028
-28
No files matched your search
@@ -0,0 +1,56 @@
|
||||
/* PFLINUX: shadow <netinet/icmp6.h> — glibc's copy lacks the MLD/nodeinfo
|
||||
* and ND redirect-code constants pfctl_parser.c's icmp6-type keyword
|
||||
* table references. Values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/icmp6.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_ICMP6_H
|
||||
#define _PFLINUX_NETINET_ICMP6_H
|
||||
|
||||
#include_next <netinet/icmp6.h>
|
||||
|
||||
#ifndef ICMP6_MEMBERSHIP_QUERY
|
||||
#define ICMP6_MEMBERSHIP_QUERY 130 /* group membership query */
|
||||
#endif
|
||||
#ifndef ICMP6_MEMBERSHIP_REPORT
|
||||
#define ICMP6_MEMBERSHIP_REPORT 131 /* group membership report */
|
||||
#endif
|
||||
#ifndef ICMP6_MEMBERSHIP_REDUCTION
|
||||
#define ICMP6_MEMBERSHIP_REDUCTION 132 /* membership termination */
|
||||
#endif
|
||||
#ifndef ICMP6_WRUREQUEST
|
||||
#define ICMP6_WRUREQUEST 139 /* who are you request */
|
||||
#endif
|
||||
#ifndef ICMP6_WRUREPLY
|
||||
#define ICMP6_WRUREPLY 140 /* who are you reply */
|
||||
#endif
|
||||
#ifndef ICMP6_FQDN_QUERY
|
||||
#define ICMP6_FQDN_QUERY 139 /* FQDN query */
|
||||
#endif
|
||||
#ifndef ICMP6_FQDN_REPLY
|
||||
#define ICMP6_FQDN_REPLY 140 /* FQDN reply */
|
||||
#endif
|
||||
#ifndef ICMP6_NI_QUERY
|
||||
#define ICMP6_NI_QUERY 139 /* node information request */
|
||||
#endif
|
||||
#ifndef ICMP6_NI_REPLY
|
||||
#define ICMP6_NI_REPLY 140 /* node information reply */
|
||||
#endif
|
||||
#ifndef MLD_LISTENER_DONE
|
||||
#define MLD_LISTENER_DONE 132 /* multicast listener done */
|
||||
#endif
|
||||
#ifndef MLD_MTRACE_RESP
|
||||
#define MLD_MTRACE_RESP 200 /* mtrace resp (to sender) */
|
||||
#endif
|
||||
#ifndef MLD_MTRACE
|
||||
#define MLD_MTRACE 201 /* mtrace messages */
|
||||
#endif
|
||||
#ifndef MLDV2_LISTENER_REPORT
|
||||
#define MLDV2_LISTENER_REPORT 143 /* RFC3810 listener report */
|
||||
#endif
|
||||
#ifndef ND_REDIRECT_ONLINK
|
||||
#define ND_REDIRECT_ONLINK 0 /* redirect to on-link node */
|
||||
#endif
|
||||
#ifndef ND_REDIRECT_ROUTER
|
||||
#define ND_REDIRECT_ROUTER 1 /* redirect to better router */
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_ICMP6_H */
|
||||
@@ -0,0 +1,44 @@
|
||||
/* PFLINUX: shadow <netinet/ip.h> — glibc's copy lacks the IPTOS_DSCP_CS*
|
||||
* class-selector codepoints parse.y's `set tos` table references (plus a
|
||||
* few neighbours); values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/ip.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_IP_H
|
||||
#define _PFLINUX_NETINET_IP_H
|
||||
|
||||
#include_next <netinet/ip.h>
|
||||
|
||||
#ifndef IPTOS_DSCP_CS0
|
||||
#define IPTOS_DSCP_CS0 0x00
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_LE
|
||||
#define IPTOS_DSCP_LE 0x04
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS1
|
||||
#define IPTOS_DSCP_CS1 0x20
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS2
|
||||
#define IPTOS_DSCP_CS2 0x40
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS3
|
||||
#define IPTOS_DSCP_CS3 0x60
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS4
|
||||
#define IPTOS_DSCP_CS4 0x80
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS5
|
||||
#define IPTOS_DSCP_CS5 0xa0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_VA
|
||||
#define IPTOS_DSCP_VA 0xb0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_EF
|
||||
#define IPTOS_DSCP_EF 0xb8
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS6
|
||||
#define IPTOS_DSCP_CS6 0xc0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS7
|
||||
#define IPTOS_DSCP_CS7 0xe0
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_IP_H */
|
||||
@@ -0,0 +1,62 @@
|
||||
/* PFLINUX: shadow <netinet/ip_icmp.h> — glibc's copy lacks the extended
|
||||
* ICMP type/code constants pfctl_parser.c's icmp-type keyword table
|
||||
* references. Values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/ip_icmp.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_IP_ICMP_H
|
||||
#define _PFLINUX_NETINET_IP_ICMP_H
|
||||
|
||||
#include_next <netinet/ip_icmp.h>
|
||||
|
||||
#ifndef ICMP_ALTHOSTADDR
|
||||
#define ICMP_ALTHOSTADDR 6 /* alternate host address */
|
||||
#endif
|
||||
#ifndef ICMP_TRACEROUTE
|
||||
#define ICMP_TRACEROUTE 30 /* traceroute */
|
||||
#endif
|
||||
#ifndef ICMP_DATACONVERR
|
||||
#define ICMP_DATACONVERR 31 /* data conversion error */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REDIRECT
|
||||
#define ICMP_MOBILE_REDIRECT 32 /* mobile host redirect */
|
||||
#endif
|
||||
#ifndef ICMP_IPV6_WHEREAREYOU
|
||||
#define ICMP_IPV6_WHEREAREYOU 33 /* IPv6 where-are-you */
|
||||
#endif
|
||||
#ifndef ICMP_IPV6_IAMHERE
|
||||
#define ICMP_IPV6_IAMHERE 34 /* IPv6 i-am-here */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REGREQUEST
|
||||
#define ICMP_MOBILE_REGREQUEST 35 /* mobile registration req */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REGREPLY
|
||||
#define ICMP_MOBILE_REGREPLY 36 /* mobile registration reply */
|
||||
#endif
|
||||
#ifndef ICMP_SKIP
|
||||
#define ICMP_SKIP 39 /* SKIP */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS
|
||||
#define ICMP_PHOTURIS 40 /* Photuris */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_UNKNOWN_INDEX
|
||||
#define ICMP_PHOTURIS_UNKNOWN_INDEX 1 /* unknown sec index */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_AUTH_FAILED
|
||||
#define ICMP_PHOTURIS_AUTH_FAILED 2 /* auth failed */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_DECRYPT_FAILED
|
||||
#define ICMP_PHOTURIS_DECRYPT_FAILED 3 /* decrypt failed */
|
||||
#endif
|
||||
#ifndef ICMP_PARAMPROB_ERRATPTR
|
||||
#define ICMP_PARAMPROB_ERRATPTR 0 /* req. opt. absent */
|
||||
#endif
|
||||
#ifndef ICMP_PARAMPROB_LENGTH
|
||||
#define ICMP_PARAMPROB_LENGTH 2 /* bad length */
|
||||
#endif
|
||||
#ifndef ICMP_ROUTERADVERT_NORMAL
|
||||
#define ICMP_ROUTERADVERT_NORMAL 0 /* normal advertisement */
|
||||
#endif
|
||||
#ifndef ICMP_ROUTERADVERT_NOROUTE_COMMON
|
||||
#define ICMP_ROUTERADVERT_NOROUTE_COMMON 16 /* selective routing */
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_IP_ICMP_H */
|
||||
@@ -0,0 +1,32 @@
|
||||
/* PFLINUX: <netinet/tcp_fsm.h> — OpenBSD 8.0 TCP state machine header
|
||||
* (glibc has no equivalent). Values copied from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/tcp_fsm.h. Kernel-only bodies
|
||||
* (TCPOUTFLAGS/TCPSTATES arrays) dropped; tcpstates[] is declared extern
|
||||
* and defined in tools/compat-user/bsd.c for pf_print_state.c. */
|
||||
#ifndef _PFLINUX_NETINET_TCP_FSM_H
|
||||
#define _PFLINUX_NETINET_TCP_FSM_H
|
||||
|
||||
#define TCP_NSTATES 11
|
||||
|
||||
#define TCPS_CLOSED 0 /* closed */
|
||||
#define TCPS_LISTEN 1 /* listening for connection */
|
||||
#define TCPS_SYN_SENT 2 /* active, have sent syn */
|
||||
#define TCPS_SYN_RECEIVED 3 /* have sent and received syn */
|
||||
/* states < TCPS_ESTABLISHED are those where connections not established */
|
||||
#define TCPS_ESTABLISHED 4 /* established */
|
||||
#define TCPS_CLOSE_WAIT 5 /* rcvd fin, waiting for close */
|
||||
/* states > TCPS_CLOSE_WAIT are those where user has closed */
|
||||
#define TCPS_FIN_WAIT_1 6 /* have closed, sent fin */
|
||||
#define TCPS_CLOSING 7 /* closed xchd FIN; await FIN ACK */
|
||||
#define TCPS_LAST_ACK 8 /* had fin and close; await FIN ACK */
|
||||
/* states > TCPS_CLOSE_WAIT && < TCPS_FIN_WAIT_2 await ACK of FIN */
|
||||
#define TCPS_FIN_WAIT_2 9 /* have closed, fin is acked */
|
||||
#define TCPS_TIME_WAIT 10 /* in 2*msl quiet wait after close */
|
||||
|
||||
#define TCPS_HAVERCVDSYN(s) ((s) >= TCPS_SYN_RECEIVED)
|
||||
#define TCPS_HAVEESTABLISHED(s) ((s) >= TCPS_ESTABLISHED)
|
||||
#define TCPS_HAVERCVDFIN(s) ((s) >= TCPS_TIME_WAIT)
|
||||
|
||||
extern const char *const tcpstates[];
|
||||
|
||||
#endif /* _PFLINUX_NETINET_TCP_FSM_H */
|
||||
Reference in new issue
Block a user