Changes in Makefile

83271c68 - Fix some modules to export more used symbols

Sun, 07 Nov 2021 08:42:24 +0000

Fix some modules to export more used symbols(cherry picked from commit 5bb3134a8c21cb87b30e135ef168483f0333dabb) List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

b99a6823 - Rework ipfw dynamic states implementation to be lockless on fast path.

Wed, 07 Feb 2018 18:59:54 +0000

Rework ipfw dynamic states implementation to be lockless on fast path.o added struct ipfw_dyn_info that keeps all needed for ipfw_chk and for dynamic states implementation information;o added DYN_LOOKUP_NEEDED() macro that can be used to determine the need of new lookup of dynamic states;o ipfw_dyn_rule now becomes obsolete. Currently it used to pass information from kernel to userland only.o IPv4 and IPv6 states now described by different structures dyn_ipv4_state and dyn_ipv6_state;o IPv6 scope zones support is added;o ipfw(4) now depends from Concurrency Kit;o states are linked with "entry" field using CK_SLIST. This allows lockless lookup and protected by mutex modifications.o the "expired" SLIST field is used for states expiring.o struct dyn_data is used to keep generic information for both IPv4 and IPv6;o struct dyn_parent is used to keep O_LIMIT_PARENT information;o IPv4 and IPv6 states are stored in different hash tables;o O_LIMIT_PARENT states now are kept separately from O_LIMIT and O_KEEP_STATE states;o per-cpu dyn_hp pointers are used to implement hazard pointers and they prevent freeing states that are locklessly used by lookup threads;o mutexes to protect modification of lists in hash tables now kept in separate arrays. 65535 limit to maximum number of hash buckets now removed.o Separate lookup and install functions added for IPv4 and IPv6 states and for parent states.o By default now is used Jenkinks hash function.Obtained from: Yandex LLCMFC after: 42 daysSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D12685 List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

e11f0a0c - Unconditionally enable support for O_IPSEC opcode.

Fri, 17 Nov 2017 22:40:02 +0000

Unconditionally enable support for O_IPSEC opcode.IPsec support can be loaded as kernel module, thus do not depend fromkernel option IPSEC and always build O_IPSEC opcode implementation asenabled.Obtained from: Yandex LLCMFC after: 1 weekSponsored by: Yandex LLC List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

193d9e76 - sys/modules: normalize .CURDIR-relative paths to SRCTOP

Sat, 04 Mar 2017 10:10:17 +0000

sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

56132dcc - Move logging via BPF support into separate file.

Sat, 13 Aug 2016 15:41:04 +0000

Move logging via BPF support into separate file.* make interface cloner VNET-aware;* simplify cloner code and use if_clone_simple();* migrate LOGIF_LOCK() to rmlock;* add ipfw_bpf_mtap2() function to pass mbuf to BPF;* introduce new additional ipfwlog0 pseudo interface. It differs from ipfw0 by DLT type used in bpfattach. This interface is intended to used by ipfw modules to dump packets with additional info attached. Currently pflog format is used. ipfw_bpf_mtap2() function uses second argument to determine which interface use for dumping. If dlen is equal to ETHER_HDR_LEN it uses old ipfw0 interface, if dlen is equal to PFLOG_HDRLEN - ipfwlog0 will be used.Obtained from: Yandex LLCSponsored by: Yandex LLC List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

2acdf79f - Add External Actions KPI to ipfw(9).

Thu, 14 Apr 2016 22:51:23 +0000

Add External Actions KPI to ipfw(9).It allows implementing loadable kernel modules with new actions andwithout needing to modify kernel headers and ipfw(8). The moduleregisters its action handler and keyword string, that will be usedas action name. Using generic syntax user can add rules with thisaction. Also ipfw(8) can be easily modified to extend basic syntaxfor external actions, that become a part base system.Sample modules will coming soon.Obtained from: Yandex LLCSponsored by: Yandex LLC List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

b1d105bc - Add pre-alfa version of DXR lookup module.

Sun, 21 Sep 2014 18:15:09 +0000

Add pre-alfa version of DXR lookup module.It does build but (currently) does not work.This change is not intended to be merged along with other ipfw changes. List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

0cba2b28 - Add support for multi-field values inside ipfw tables.

Sun, 31 Aug 2014 23:51:09 +0000

Add support for multi-field values inside ipfw tables.This is the last major change in given branch.Kernel changes:* Use 64-bytes structures to hold multi-value variables.* Use shared array to hold values from all tables (assume each table algo is capable of holding 32-byte variables).* Add some placeholders to support per-table value arrays in future.* Use simple eventhandler-style API to ease the process of adding new table items. Currently table addition may required multiple UH drops/ acquires which is quite tricky due to atomic table modificatio/swap support, shared array resize, etc. Deal with it by calling special notifier capable of rolling back state before actually performing swap/resize operations. Original operation then restarts itself after acquiring UH lock.* Bump all objhash users default values to at least 64* Fix custom hashing inside objhash.Userland changes:* Add support for dumping shared value array via "vlist" internal cmd.* Some small print/fill_flags dixes to support u32 values.* valtype is now bitmask of . New values can hold distinct values for each of this types.* Provide special "legacy" type which assumes all values are the same.* More helpers/docs following..Some examples:3:41 [1] zfscurr0# ipfw table mimimi create valtype skipto,limit,ipv4,ipv63:41 [1] zfscurr0# ipfw table mimimi info+++ table(mimimi), set(0) +++ kindex: 2, type: addr references: 0, valtype: skipto,limit,ipv4,ipv6 algorithm: addr:radix items: 0, size: 2963:42 [1] zfscurr0# ipfw table mimimi add 10.0.0.5 3000,10,10.0.0.1,2a02:978:2::1added: 10.0.0.5/32 3000,10,10.0.0.1,2a02:978:2::13:42 [1] zfscurr0# ipfw table mimimi list+++ table(mimimi), set(0) +++10.0.0.5/32 3000,0,10.0.0.1,2a02:978:2::1 List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

aeaed508 - Move most of the 15 variations on generating opt_inet.h and

Mon, 04 Aug 2014 22:37:02 +0000

Move most of the 15 variations on generating opt_inet.h andopt_inet6.h into kmod.mk by forcing almost everybody to eat the samedogfood. While at it, consolidate the opt_bpf.h and opt_mroute.htargets here too. List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

68394ec8 - * Add generic ipfw interface tracking API

Mon, 28 Jul 2014 19:01:25 +0000

* Add generic ipfw interface tracking API* Rewrite interface tables to use interface indexesKernel changes:* Add generic interface tracking API: - ipfw_iface_ref (must call unlocked, performs lazy init if needed, allocates state & bumps ref) - ipfw_iface_add_ntfy(UH_WLOCK+WLOCK, links comsumer & runs its callback to update ifindex) - ipfw_iface_del_ntfy(UH_WLOCK+WLOCK, unlinks consumer) - ipfw_iface_unref(unlocked, drops reference)Additionally, consumer callbacks are called in interface withdrawal/departure.* Rewrite interface tables to use iface tracking API. Currently tables are implemented the following way: runtime data is stored as sorted array of {ifidx, val} for existing interfaces full data is stored inside namedobj instance (chained hashed table).* Add IP_FW_XIFLIST opcode to dump status of tracked interfaces* Pass @chain ptr to most non-locked algorithm callbacks: (prepare_add, prepare_del, flush_entry ..). This may be needed for better interaction of given algorithm an other ipfw subsystems* Add optional "change_ti" algorithm handler to permit updating of cached table_info pointer (happens in case of table_max resize)* Fix small bug in ipfw_list_tables()* Add badd (insert into sorted array) and bdel (remove from sorted array) funcsUserland changes:* Add "iflist" cmd to print status of currently tracked interface* Add stringnum_cmp for better interface/table names sorting List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

409fd736 - Add ip_fw_algo.c to ipfw Makefile.

Sat, 14 Jun 2014 11:02:55 +0000

Add ip_fw_algo.c to ipfw Makefile. List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

c6063d0d - Use src.opts.mk in preference to bsd.own.mk except where we need stuff

Tue, 06 May 2014 04:22:01 +0000

Use src.opts.mk in preference to bsd.own.mk except where we need stufffrom the latter. List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

3b3a8eb9 - o Create directory sys/netpfil, where all packet filters should

Fri, 14 Sep 2012 11:51:49 +0000

o Create directory sys/netpfil, where all packet filters should reside, and move there ipfw(4) and pf(4).o Move most modified parts of pf out of contrib.Actual movements:sys/contrib/pf/net/*.c -> sys/netpfil/pf/sys/contrib/pf/net/*.h -> sys/net/contrib/pf/pfctl/*.c -> sbin/pfctlcontrib/pf/pfctl/*.h -> sbin/pfctlcontrib/pf/pfctl/pfctl.8 -> sbin/pfctlcontrib/pf/pfctl/*.4 -> share/man/man4contrib/pf/pfctl/*.5 -> share/man/man5sys/netinet/ipfw -> sys/netpfil/ipfwThe arguable movement is pf/net/*.h -> sys/net. There arefuture plans to refactor pf includes, so I decided not tobreak things twice.Not modified bits of pf left in contrib: authpf, ftp-proxy,tftp-proxy, pflogd.The ipfw(4) movement is planned to be merged to stable/9,to make head and stable match.Discussed with: bz, luigi List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

8813217a - Always use the opt_*.h options for ipfw.ko, not just when

Fri, 04 Nov 2011 16:24:19 +0000

Always use the opt_*.h options for ipfw.ko, not just whencompiled into the kernel.Do not try to build the module in case of no INET support butkeep #error calls for now in case we would compile it into thekernel.This should fix an issue where the module would fail to enableIPv6 support from the rc framework, but also other INET and INET6parts being silently compiled out without giving a warning in themodule case.While here garbage collect unneeded opt_*.h includes.opt_ipdn.h is not used anywhere but we need to leave the DUMMYNETentry in options for conditional inclusion in kernel so keep thefile with the same name.Reported by: pluknetReviewed by: plunket, jhbMFC After: 3 days List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

75e54d60 - Unbreak no-ip and no-inet6 module builds with ipfw. For now continue to

Tue, 27 Sep 2011 13:27:17 +0000

Unbreak no-ip and no-inet6 module builds with ipfw. For now continue tobuild the ip_fw_pfil.c hooks and ipfw even in case of no-ip under theassumption that the private L2 hook (which hopefully eventually will be apfil hook as well) can still be useful.Allow building the module without inet as well.Glanced at by: jhbMFC after: 3 days List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

5bb3652f - Allow the ipfw.ko module built with a kernel to honor any IPFIREWALL_*

Mon, 12 Sep 2011 21:09:56 +0000

Allow the ipfw.ko module built with a kernel to honor any IPFIREWALL_*options defined in the kernel config. This more closely matches thebehavior of other modules which inherit configuration settings from thekernel configuration during a kernel + modules build.Reviewed by: luigiApproved by: re (kib)MFC after: 1 week List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

76f8c5c9 - Do not build ip_fw_nat.c for ipfw.ko. It can be build as separate module.

Tue, 29 Mar 2011 06:42:52 +0000

Do not build ip_fw_nat.c for ipfw.ko. It can be build as separate module.MFC after: 1 week List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

183fd3c9 - MFC r200636, list all files needed to build the ipfw module

Wed, 24 Mar 2010 15:11:10 +0000

MFC r200636, list all files needed to build the ipfw moduleSubmitted by: Alexander Wittig List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

8c5d93d4 - Now that ipfw is split into multiple files, we need

Thu, 17 Dec 2009 17:44:34 +0000

Now that ipfw is split into multiple files, we needto list them all in the Makefile for the module,otherwise it won't load due to missing symbols.The problem only affected head with ipfw built as a module.Reported by David Horn List of files: /freebsd-13.1/sys/modules/ipfw/Makefile

8d8bc018 - After r193232 rt_tables in vnet.h are no longer indirectly dependent on

Mon, 08 Jun 2009 19:57:35 +0000

After r193232 rt_tables in vnet.h are no longer indirectly dependent onthe ROUTETABLES kernel option thus there is no need to include opt_route.hanymore in all consumers of vnet.h and no longer depend on it for modulebuilds.Remove the hidden include in flowtable.h as well and leave the twoexplicit #includes in ip_input.c and ip_output.c. List of files: /freebsd-13.1/sys/modules/ipfw/Makefile