cvs commit: src/sys/conf files options src/sys/modules/ipfw Makefile src/sys/net bridge.c src/sys/netgraph ng_bridge.c src/sys/netinet ip_divert.c ip_dummynet.c ip_dummynet.h...

Tue Aug 17 15:05:55 PDT 2004

andre       2004-08-17 22:05:54 UTC

  FreeBSD src repository

  Modified files:
    sys/conf             files options 
    sys/modules/ipfw     Makefile 
    sys/net              bridge.c 
    sys/netgraph         ng_bridge.c 
    sys/netinet          ip_divert.c ip_dummynet.c ip_dummynet.h 
                         ip_fastfwd.c ip_fw.h ip_fw2.c ip_input.c 
                         ip_output.c ip_var.h raw_ip.c tcp_input.c 
                         tcp_sack.c 
    sys/sys              mbuf.h 
  Added files:
    sys/netinet          ip_fw_pfil.c 
  Log:
  Convert ipfw to use PFIL_HOOKS.  This is change is transparent to userland
  and preserves the ipfw ABI.  The ipfw core packet inspection and filtering
  functions have not been changed, only how ipfw is invoked is different.

  However there are many changes how ipfw is and its add-on's are handled:

   In general ipfw is now called through the PFIL_HOOKS and most associated
   magic, that was in ip_input() or ip_output() previously, is now done in
   ipfw_check_[in|out]() in the ipfw PFIL handler.

   IPDIVERT is entirely handled within the ipfw PFIL handlers.  A packet to
   be diverted is checked if it is fragmented, if yes, ip_reass() gets in for
   reassembly.  If not, or all fragments arrived and the packet is complete,
   divert_packet is called directly.  For 'tee' no reassembly attempt is made
   and a copy of the packet is sent to the divert socket unmodified.  The
   original packet continues its way through ip_input/output().

   ipfw 'forward' is done via m_tag's.  The ipfw PFIL handlers tag the packet
   with the new destination sockaddr_in.  A check if the new destination is a
   local IP address is made and the m_flags are set appropriately.  ip_input()
   and ip_output() have some more work to do here.  For ip_input() the m_flags
   are checked and a packet for us is directly sent to the 'ours' section for
   further processing.  Destination changes on the input path are only tagged
   and the 'srcrt' flag to ip_forward() is set to disable destination checks
   and ICMP replies at this stage.  The tag is going to be handled on output.
   ip_output() again checks for m_flags and the 'ours' tag.  If found, the
   packet will be dropped back to the IP netisr where it is going to be picked
   up by ip_input() again and the directly sent to the 'ours' section.  When
   only the destination changes, the route's 'dst' is overwritten with the
   new destination from the forward m_tag.  Then it jumps back at the route
   lookup again and skips the firewall check because it has been marked with
   M_SKIP_FIREWALL.  ipfw 'forward' has to be compiled into the kernel with
   'option IPFIREWALL_FORWARD' to enable it.

   DUMMYNET is entirely handled within the ipfw PFIL handlers.  A packet for
   a dummynet pipe or queue is directly sent to dummynet_io().  Dummynet will
   then inject it back into ip_input/ip_output() after it has served its time.
   Dummynet packets are tagged and will continue from the next rule when they
   hit the ipfw PFIL handlers again after re-injection.

   BRIDGING and IPFW_ETHER are not changed yet and use ipfw_chk() directly as
   they did before.  Later this will be changed to dedicated ETHER PFIL_HOOKS.

  More detailed changes to the code:

   conf/files
          Add netinet/ip_fw_pfil.c.

   conf/options
          Add IPFIREWALL_FORWARD option.

   modules/ipfw/Makefile
          Add ip_fw_pfil.c.

   net/bridge.c
          Disable PFIL_HOOKS if ipfw for bridging is active.  Bridging ipfw
          is still directly invoked to handle layer2 headers and packets would
          get a double ipfw when run through PFIL_HOOKS as well.

   netinet/ip_divert.c
          Removed divert_clone() function.  It is no longer used.

   netinet/ip_dummynet.[ch]
          Neither the route 'ro' nor the destination 'dst' need to be stored
          while in dummynet transit.  Structure members and associated macros
          are removed.

   netinet/ip_fastfwd.c
          Removed all direct ipfw handling code and replace it with the new
          'ipfw forward' handling code.

   netinet/ip_fw.h
          Removed 'ro' and 'dst' from struct ip_fw_args.

   netinet/ip_fw2.c
          (Re)moved some global variables and the module handling.

   netinet/ip_fw_pfil.c
          New file containing the ipfw PFIL handlers and module initialization.

   netinet/ip_input.c
          Removed all direct ipfw handling code and replace it with the new
          'ipfw forward' handling code.  ip_forward() does not longer require
          the 'next_hop' struct sockaddr_in argument.  Disable early checks
          if 'srcrt' is set.

   netinet/ip_output.c
          Removed all direct ipfw handling code and replace it with the new
          'ipfw forward' handling code.

   netinet/ip_var.h
          Add ip_reass() as general function.  (Used from ipfw PFIL handlers
          for IPDIVERT.)

   netinet/raw_ip.c
          Directly check if ipfw and dummynet control pointers are active.

   netinet/tcp_input.c
          Rework the 'ipfw forward' to local code to work with the new way of
          forward tags.

   netinet/tcp_sack.c
          Remove include 'opt_ipfw.h' which is not needed here.

   sys/mbuf.h
          Remove m_claim_next() macro which was exclusively for ipfw 'forward'
          and is no longer needed.

  Approved by:    re (scottl)

  Revision  Changes    Path
  1.943     +1 -0      src/sys/conf/files
  1.475     +1 -0      src/sys/conf/options
  1.17      +1 -1      src/sys/modules/ipfw/Makefile
  1.82      +2 -0      src/sys/net/bridge.c
  1.28      +2 -0      src/sys/netgraph/ng_bridge.c
  1.98      +0 -21     src/sys/netinet/ip_divert.c
  1.83      +7 -35     src/sys/netinet/ip_dummynet.c
  1.32      +0 -2      src/sys/netinet/ip_dummynet.h
  1.17      +32 -200   src/sys/netinet/ip_fastfwd.c
  1.89      +15 -7     src/sys/netinet/ip_fw.h
  1.70      +14 -51    src/sys/netinet/ip_fw2.c
  1.1       +402 -0    src/sys/netinet/ip_fw_pfil.c (new)
  1.283     +65 -217   src/sys/netinet/ip_input.c
  1.225     +66 -281   src/sys/netinet/ip_output.c
  1.89      +2 -0      src/sys/netinet/ip_var.h
  1.142     +6 -6      src/sys/netinet/raw_ip.c
  1.252     +19 -7     src/sys/netinet/tcp_input.c
  1.3       +0 -1      src/sys/netinet/tcp_sack.c
  1.157     +0 -15     src/sys/sys/mbuf.h