libalias: fix divide by zero causing panic

The packet_limit can fall to 0, leading to a divide by zero abort in
the "packets % packet_limit".

An possible solution would be to apply a lower limit of

libalias: fix divide by zero causing panic

The packet_limit can fall to 0, leading to a divide by zero abort in
the "packets % packet_limit".

An possible solution would be to apply a lower limit of 1 after the
calculation of packet_limit, but since any number modulo 1 gives 0,
the more efficient solution is to skip the modulo operation for
packet_limit <= 1.

Reported by: Karl Denninger <[email protected]>

(cherry picked from commit 58080fbca09fda6d5f011d37059edbca8ceb4c58)

show more ...

libalias: Switch to SPLAY trees

Current data structure is using a hash of unordered lists. Those
unordered lists are quite efficient, because the least recently
inserted entries are most likely to

libalias: Switch to SPLAY trees

Current data structure is using a hash of unordered lists. Those
unordered lists are quite efficient, because the least recently
inserted entries are most likely to be used again. In order to avoid
long search times in other cases, the lists are hashed into many
buckets. Unfortunatly a search for a miss needs an exhaustive
inspection and a careful definition of the hash.

Splay trees offer a similar feature - almost O(1) for access of the
least recently used entries), and amortized O(ln(n) - for almost all
other cases. Get rid of the hash.

Now the data structure should able to quickly react to external
packets without eating CPU cycles for breakfast, preventing a DoS.

PR: 192888
Discussed with: Dimitry Luhtionov
Differential Revision: https://reviews.freebsd.org/D30516
Differential Revision: https://reviews.freebsd.org/D30536
Differential Revision: https://reviews.freebsd.org/D30844

(cherry picked from commit 935fc93af157dee352eb4b6c83f8a2a9e7fd9a4e)
(cherry picked from commit d261e57deacb0d00d9e827447f235df83dda3e3a)
(cherry picked from commit f70c98a2f5d993dc518efd606aa341eda99400ef)
(cherry picked from commit 25392fac9488bcae5c451500df2e2945430484a6)
(cherry picked from commit 2f4d91f9cb22fc65eb65407e8118b433a5d71976)
(cherry picked from commit 4060e77f49d1b9fd2254f3f4da94fd64fce83f72)

show more ...

libalias: Restructure

Clean up the database handling in order to switch to more efficient
data structures. The development of this patch was artificially split
in to many small steps to ease review

libalias: Restructure

Clean up the database handling in order to switch to more efficient
data structures. The development of this patch was artificially split
in to many small steps to ease reviewing.

- Common search terms
- Separate fully qualified search
- Separate table for partial links
- Cleanup _FindLinkIn
- Factor out the outgoing search function
- Factor out a common idiom to return found links
- Reorder incoming links by grouping of common search terms
- Remove LSNAT from outgoing search
- Group internal structure semantically
- Separate table for PPTP
- Use AliasRange instead of PORT_BASE
- Remove temporary state deleteAllLinks from global struct
- Avoid uninitialized expiration

Discussed with: Dimitry Luhtionov
Differential Revision: https://reviews.freebsd.org/D30568
Differential Revision: https://reviews.freebsd.org/D30569
Differential Revision: https://reviews.freebsd.org/D30570
Differential Revision: https://reviews.freebsd.org/D30571
Differential Revision: https://reviews.freebsd.org/D30572
Differential Revision: https://reviews.freebsd.org/D30573
Differential Revision: https://reviews.freebsd.org/D30574
Differential Revision: https://reviews.freebsd.org/D30575
Differential Revision: https://reviews.freebsd.org/D30580
Differential Revision: https://reviews.freebsd.org/D30581
Differential Revision: https://reviews.freebsd.org/D30604
Differential Revision: https://reviews.freebsd.org/D30582

(cherry picked from commit d41044ddfdbc2a026570cae11d5fc2e18f5e4b92)
(cherry picked from commit 32f9c2ceb3ec8266e48ec0f6d1556fd98ef12db6)
(cherry picked from commit cac129e6030095c33e95c5ce1cdcb9c5c21efce9)
(cherry picked from commit 19dcc4f2250b3850991366e3058ca8a64b2f135d)
(cherry picked from commit d5419034381d0e8e8c99f0f678118b197144bfff)
(cherry picked from commit d4ab07d2aeb13b1aae9ad5d73e5fe77131f2350c)
(cherry picked from commit 492d3b7109b45ff30fd199b7eeed797447746e42)
(cherry picked from commit 7b44ff4c52ce9e7a89e772566a249e5481fe0ac4)
(cherry picked from commit 1178dda53d10b096e0b99e356d15b7c24390e099)
(cherry picked from commit 9efcad61d8309ecad3c15392b277fd329a1e45e4)
(cherry picked from commit fe83900f9fa931e3d0942ec9c0709896b887c3d7)
(cherry picked from commit d989935b5bcd880353f0de89eda958c45e7e3342)
(cherry picked from commit b50a4dce185481bebf8096c27588ae04a4a2fd7c)
(cherry picked from commit f28455344483310cfd1aa5c0bdd4d014810c0e32)

show more ...

libalias: Promote per instance global variable timeStamp

Summary:
- Use LibAliasTime as a real global variable for central timekeeping.
- Reduce number of syscalls in user space considerably.
- Dyna

libalias: Promote per instance global variable timeStamp

Summary:
- Use LibAliasTime as a real global variable for central timekeeping.
- Reduce number of syscalls in user space considerably.
- Dynamically adjust the packet counters to match the second resolution.
- Only check the first few packets after a time increase for expiry.

Discussed with: hselasky
Differential Revision: https://reviews.freebsd.org/D30566

(cherry picked from commit ef828d39be8e4b6d922db080ed41611702dec56d)

show more ...

libalias: tidy up housekeeping

Replace current expensive, but sparsly called housekeeping
by a single, repetive action.

This is part of a larger restructure of libalias in order to switch to
more e

libalias: tidy up housekeeping

Replace current expensive, but sparsly called housekeeping
by a single, repetive action.

This is part of a larger restructure of libalias in order to switch to
more efficient data structures. The whole restructure process is
split into 15 reviews to ease reviewing. All those steps will be
squashed into a single commit for MFC in order to hide the
intermediate states from production systems.

Reviewed by: hselasky
Differential Revision: https://reviews.freebsd.org/D30277

(cherry picked from commit 294799c6b081faece556a5010a4f51552e131c2f)

show more ...

libalias: Remove unused function LibAliasCheckNewLink

The functionality to detect a newly created link after processing a
single packet is decoupled from the packet processing. Every new
packet is

libalias: Remove unused function LibAliasCheckNewLink

The functionality to detect a newly created link after processing a
single packet is decoupled from the packet processing. Every new
packet is processed asynchronously and will reset the indicator, hence
the function is unusable. I made a Google search for third party code,
which uses the function, and failed to find one.

That's why the function should be removed: It unusable and unused.
A much simplified API/ABI will remain in anything below 14.

Discussed with: kp
Reviewed by: manpages (bcr)
Differential Revision: https://reviews.freebsd.org/D30275

(cherry picked from commit bfd41ba1fe1d0e40b6a813aeb0354cac8d884f5b)

show more ...

libalias: replace placeholder with static constant

The field nullAddress in struct libalias is never set and never used.
It exists as a placeholder for an unused argument only.

Reviewed by: hselask

libalias: replace placeholder with static constant

The field nullAddress in struct libalias is never set and never used.
It exists as a placeholder for an unused argument only.

Reviewed by: hselasky
Differential Revision: https://reviews.freebsd.org/D30253

(cherry picked from commit 189f8eea138a78b09c9f19114b1362b0df1cf87d)
(cherry picked from commit b03a41befeaf17ef25da96fc7bc2dc19c9a6b253)

show more ...

libalias: Style cleanup

libalias is a convolut of various coding styles modified by a series
of different editors enforcing interesting convetions on spacing and
comments.

This patch is a baseline

libalias: Style cleanup

libalias is a convolut of various coding styles modified by a series
of different editors enforcing interesting convetions on spacing and
comments.

This patch is a baseline to start with a perfomance rework of
libalias. Upcoming patches should be focus on the code, not on the
style. That's why most annoying style errors should be fixed
beforehand.

Reviewed by: hselasky
Discussed by: emaste
Differential Revision: https://reviews.freebsd.org/D30259

(cherry picked from commit effc8e57fbf03d7f1423c662caf2b63f0d1d21a9)

At some places the ASSERT was inserted before variable declarations are
finished. This is fixed now.

Reported by: kib
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D30282

(cherry picked from commit 2e6b07866f9e1520626a1523f6609cc411bdda1c)

show more ...

MFC 9febbc454190:
Fix for natd(8) sending wrong sequence number after TCP retransmission,
terminating a TCP connection.

If a TCP packet must be retransmitted and the data length has changed in the
r

MFC 9febbc454190:
Fix for natd(8) sending wrong sequence number after TCP retransmission,
terminating a TCP connection.

If a TCP packet must be retransmitted and the data length has changed in the
retransmitted packet, due to the internal workings of TCP, typically when ACK
packets are lost, then there is a 30% chance that the logic in GetDeltaSeqOut()
will find the correct length, which is the last length received.

This can be explained as follows:

If a "227 Entering Passive Mode" packet must be retransmittet and the length
changes from 51 to 50 bytes, for example, then we have three cases for the
list scan in GetDeltaSeqOut(), depending on how many prior packets were
received modulus N_LINK_TCP_DATA=3:

case 1: index 0: original packet 51
index 1: retransmitted packet 50
index 2: not relevant

case 2: index 0: not relevant
index 1: original packet 51
index 2: retransmitted packet 50

case 3: index 0: retransmitted packet 50
index 1: not relevant
index 2: original packet 51

This patch simply changes the searching order for TCP packets, always starting
at the last received packet instead of any received packet, in
GetDeltaAckIn() and GetDeltaSeqOut().

Else no functional changes.

Discussed with: rscheff@
Submitted by: Andreas Longwitz <[email protected]>
PR: 230755
Sponsored by: Mellanox Technologies // NVIDIA Networking

(cherry picked from commit 9febbc4541903bb8e6b0f1c84988c98b2f7c96ef)

show more ...

Allow setting alias port ranges in libalias and ipfw.

This will allow a system to be a true RFC 6598 NAT444 setup, where each
network segment (e.g. user, subnet) can have their own dedicated port
al

Allow setting alias port ranges in libalias and ipfw.

This will allow a system to be a true RFC 6598 NAT444 setup, where each
network segment (e.g. user, subnet) can have their own dedicated port
aliasing ranges.

Reviewed by: donner, kp
Approved by: 0mp (mentor), donner, kp
Differential Revision: https://reviews.freebsd.org/D23450

(cherry picked from commit a08cdb6cfb1c84b80b5337d46c574b55d0e15c63)

show more ...

libalias: Fix -Wcast-align compiler warnings

This fixes -Wcast-align warnings caused by the underaligned `struct ip`.
This also silences them in the public functions by changing the function
signatu

libalias: Fix -Wcast-align compiler warnings

This fixes -Wcast-align warnings caused by the underaligned `struct ip`.
This also silences them in the public functions by changing the function
signature from char * to void *. This is source and binary compatible and
avoids the -Wcast-align warning.

Reviewed By: ae, gbe (manpages)
Differential Revision: https://reviews.freebsd.org/D27882

show more ...

net: clean up empty lines in .c and .h files

netinet/libalias: Fix typo in debug message

No functional change.

PR: 243831
Submitted by: Neel Chauhan <neel AT neelc DOT org>
Differential Revision: https://reviews.freebsd.org/D23365

sys: general adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
pro

sys: general adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.

show more ...

netinet: for pointers replace 0 with NULL.

These are mostly cosmetical, no functional change.

Found with devel/coccinelle.

Reviewed by: ae. tuexen

Cleanup alias module handler register/unregister.

- Remove locking, since all module(9) events are running under &Giant.
- Use TAILQ for protocol handlers and fix a bug which led to
infinite cycle

Cleanup alias module handler register/unregister.

- Remove locking, since all module(9) events are running under &Giant.
- Use TAILQ for protocol handlers and fix a bug which led to
infinite cycle. Bug found in VirtualBox [1]
- Simplify code everywhere.
- Fix documentation.

[1] https://www.virtualbox.org/pipermail/vbox-dev/2013-November/011936.html

PR: 183792 [1]
Submitted by: Valery Ushakov <uwe NetBSD.org> [1]
Sponsored by: Nginx, Inc.

show more ...

Provide includes that are needed in these files, and before were read
in implicitly via if.h -> if_var.h pollution.

Sponsored by: Netflix
Sponsored by: Nginx, Inc.

Remove LIBALIAS_LOCK_ASSERT(), including a couple with an uninitialzed
argument, in code that isn't compiled in kernel.

PR: kern/176667
Sponsored by: Nginx, Inc.

Export AddLink() function from libalias. It can be used when custom
alias address needs to be specified.
Add inbound handler to the alias_ftp module. It helps handle active
FTP transfer mode for the

Export AddLink() function from libalias. It can be used when custom
alias address needs to be specified.
Add inbound handler to the alias_ftp module. It helps handle active
FTP transfer mode for the case with external clients and FTP server behind
NAT. Fix passive FTP transfer case for server behind NAT using redirect with
external IP address different from NAT ip address.

PR: kern/157957
Submitted by: Alexander V. Chernikov

show more ...

LibAliasInit() should allocate memory with M_WAITOK flag. Modify it
and its callers.

Don't use struct timezone.

The timezone structure acquired by gettimeofday() is not used at all.
Just remove it.

MFC a number of changes from head for ISP (203478,203463,203444,202418,201758,
201408,201325,200089,198822,197373,197372,197214,196162). Since one of those
changes was a semicolon cleanup from somebo

MFC a number of changes from head for ISP (203478,203463,203444,202418,201758,
201408,201325,200089,198822,197373,197372,197214,196162). Since one of those
changes was a semicolon cleanup from somebody else, this touches a lot more.

show more ...

Remove extraneous semicolons, no functional changes.

Submitted by: Marc Balmer <[email protected]>
MFC after: 1 week

Add SCTP NAT support.

Submitted by: CAIA (http://caia.swin.edu.au)

Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.

Make VIMAGE_GLOBALS a new compile-time option, which b

Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.

Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out. Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.

Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively

#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif

Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.

Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs. This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.

Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.

De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps. PF virtualization will be done
separately, most probably after next PF import.

Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw. Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.

Discussed at: devsummit Strassburg
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation

show more ...