#
84ff9e91 |
|
04-Jun-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: fix overly large memcpy() We only want to copy the labels array, we don't want to copy the counter as well. Reported by: CheriBSD Event: Kitchener-Waterloo Hackathon 202406
|
#
c36c90a2 |
|
01-Jun-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert DIOCSETDEBUG to netlink Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
71d3c704 |
|
31-May-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert DIOCNATLOOK to netlink Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
9dbbe68b |
|
30-May-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert DIOCCLRSTATUS to netlink Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
6ee3e376 |
|
24-May-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: fix incorrect anchor_call to userspace 777a4702c changed how we copy out the anchor_call string, and incorrectly limited it to 8 (4 on 32-bit systems) bytes. Fix that so we get the full anchor path, rather than just the first few characters. PR: 279225 Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
5824df8d |
|
23-Mar-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert DIOCGETSTATUS to netlink Introduce pfctl_get_status_h() because we need the pfctl_handle. In this variant use netlink to obtain the information. Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
470a2b33 |
|
18-Mar-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert DIOCSETSTATUSIF to netlink While here also add a basic test case for it. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D44368
|
#
706d465d |
|
26-Feb-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert kill/clear state to use netlink Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D44090
|
#
777a4702 |
|
12-Jan-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: implement addrule via netlink Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
04932601 |
|
07-Dec-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: store state creation/expiration timestamps with milisecond precision The primary beneficiary is pflow(4), which expects milisecond precision in timestamps. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D43112
|
#
7cbaab71 |
|
09-Jan-2024 |
Kristof Provost <kp@FreeBSD.org> |
pf: remove unused struct definition Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
e774c1ef |
|
22-Dec-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: mark netlink commands as requiring NETINET_PF privileges Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
881bf881 |
|
21-Dec-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: export missing state information We did not export all of the information pfctl expected to print via the new netlink code. This manifested as pfctl printing 'rtableid: 0', even when there is no rtable set. While we're addressing that also export other missing fields such as dummynet, min_ttl, max_mss, .. Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
e249f5da |
|
11-Dec-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: fix memory leak on rule add parse failure Reported by: Igor Ostapenko <pm@igoro.pro> Reviewed by: Igor Ostapenko <pm@igoro.pro> Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
44f323ec |
|
24-Nov-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: implement DIOCGETRULES via netlink Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
a6246a50 |
|
08-Nov-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: fix double free if pf_ioctl_addrule() fails If pf_ioctl_addrule() returns an error it will have freed the rule itself. There's no need for the caller to free it again. PR: 274915 Reported by: Dave Cottlehuber <dch@FreeBSD.org> MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate")
|
#
7b2ab18f |
|
23-Oct-2023 |
Konstantin Belousov <kib@FreeBSD.org> |
pf/netlink: explicitly include sys/ucred.h to provide struct ucred definition Also remove no longer needed standalone sys/cdefs.h include. Reviewed by: kp Sponsored by: NVidia Networking
|
#
044eef6a |
|
16-Oct-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: support basic filters for state listing Allow users(pace) to specify a protocol, interface, address family and/ or address and mask, allowing the state listing to be pre-filtered in the kernel. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42280
|
#
ffbf2595 |
|
14-Oct-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: convert rule addition to netlink The nvlist-based version will be removed in FreeBSD 16. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42279
|
#
81647eb6 |
|
10-Oct-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: implement start/stop calls via netlink Implement equivalents to DIOCSTART and DIOCSTOP in netlink. Provide a libpfctl implementation and add a basic test case, mostly to verify that we still return the same errors as before the conversion Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42145
|
#
ab393e95 |
|
12-Oct-2023 |
Kristof Provost <kp@FreeBSD.org> |
netlink: move NETLINK define to opt_global.h Move the NETLINK define into opt_global.h so we can rely on it being set correctly, without having to remember to include opt_netlink.h. This ensures that the NETLINK define is correctly set. If not we may end up with unloadable modules, due to missing symbols (such as nlmsg_get_group_writer). PR: 274306 Reviewed by: imp, markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D42179
|
#
a7191e5d |
|
03-Oct-2023 |
Kristof Provost <kp@FreeBSD.org> |
pf: add a way to list creator ids Allow userspace to retrieve a list of distinct creator ids for the current states. This is used by pfSense, and used to require dumping all states to userspace. It's rather inefficient to export a (potentially extremely large) state table to obtain a handful (typically 2) of 32-bit integers. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D42092
|
#
2cef6288 |
|
14-Sep-2023 |
Alexander V. Chernikov <melifaro@FreeBSD.org> |
pf: convert state retrieval to netlink Use netlink to export pf's state table. The primary motivation is to improve how we deal with very large state stables. With the previous implementation we had to build the entire list (both in the kernel and in userspace) before we could start processing. With netlink we start to get data in userspace while the kernel is still generating more. This reduces peak memory consumption (which can get to the GB range once we hit millions of states). Netlink also makes future extension easier, in that we can easily add fields to the state export without breaking userspace. In that regard it's similar to an nvlist-based approach, except that it also deals with transport to userspace and that it performs significantly better than nvlists. Testing has failed to measure a performance difference between the previous struct-copy based ioctl and the netlink approach. Differential Revision: https://reviews.freebsd.org/D38888
|