pflow: add RFC8158 NAT support
ClosedPublic
Actions

Authored by kp on Dec 19 2023, 10:06 AM.

Details

Reviewers

None

Group Reviewers

network
pfsense

Commits

rGfc6e50699615: pflow: add RFC8158 NAT support

Summary

Extend pflow(4) to send NAT44 Session Create and Delete events.
This applies only to IPFIX (i.e. proto version 10), and requires no
user configuration.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 55021
Build 51910: arc lint + arc unit

Event Timeline

kp created this revision.Dec 19 2023, 10:06 AM

Herald added subscribers: glebius, melifaro, farrokhi and 2 others. · View Herald TranscriptDec 19 2023, 10:06 AM

kp requested review of this revision.Dec 19 2023, 10:06 AM

Harbormaster completed remote builds in B55021: Diff 131568.Dec 19 2023, 10:06 AM

kp added a parent revision: D43113: pflow: allow observation domain to be configured.Dec 19 2023, 10:06 AM

kp added a child revision: D43115: pf tests: verify pflow over IPv6.

rebase

Harbormaster completed remote builds in B55311: Diff 132462.Jan 8 2024, 11:36 PM

This revision was not accepted when it landed; it landed in state Needs Review.Jan 16 2024, 8:55 AM

Closed by commit rGfc6e50699615: pflow: add RFC8158 NAT support (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rGfc6e50699615: pflow: add RFC8158 NAT support.

Revision Contents
Changeset List

Path

Size

sbin/

pfctl/

parse.y

16 lines

sys/

net/

if_pflow.h

44 lines

netpfil/

pf/

if_pflow.c

214 lines

pf.c

3 lines

Diff 131568

View Options

sbin/pfctl/parse.y

Show First 20 Lines • Show All 320 Lines • ▼ Show 20 Lines	if (bootverbose) {
unit->unit, busno, slot, func);		unit->unit, busno, slot, func);
}		}
return (false);		return (false);
}		}
iommu_set_buswide_ctx(unit, busno);		iommu_set_buswide_ctx(unit, busno);
return (true);		return (true);
}		}

		void
		iommu_set_buswide_ctx(struct iommu_unit *unit, u_int busno)
		kibUnsubmitted Not Done Inline Actions I still prefer to have this code fragment to exist as a function. kib: I still prefer to have this code fragment to exist as a function.
		{

		MPASS(busno <= PCI_BUSMAX);
		IOMMU_LOCK(unit);
		unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] \|=
		1 << (busno % (NBBY * sizeof(uint32_t)));
		IOMMU_UNLOCK(unit);
		}

		bool
		iommu_is_buswide_ctx(struct iommu_unit *unit, u_int busno)
		{

		MPASS(busno <= PCI_BUSMAX);
		return ((unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] &
		(1U << (busno % (NBBY * sizeof(uint32_t))))) != 0);
		}

static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");		static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");

static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,		static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,
struct bus_dmamap_iommu *map);		struct bus_dmamap_iommu *map);

static int		static int
iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,		iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,
bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,		bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,
▲ Show 20 Lines • Show All 714 Lines • Show Last 20 Lines

View Options

sys/net/if_pflow.h

Show First 20 Lines • Show All 320 Lines • ▼ Show 20 Lines	if (bootverbose) {
unit->unit, busno, slot, func);		unit->unit, busno, slot, func);
}		}
return (false);		return (false);
}		}
iommu_set_buswide_ctx(unit, busno);		iommu_set_buswide_ctx(unit, busno);
return (true);		return (true);
}		}

		void
		iommu_set_buswide_ctx(struct iommu_unit *unit, u_int busno)
		kibUnsubmitted Not Done Inline Actions I still prefer to have this code fragment to exist as a function. kib: I still prefer to have this code fragment to exist as a function.
		{

		MPASS(busno <= PCI_BUSMAX);
		IOMMU_LOCK(unit);
		unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] \|=
		1 << (busno % (NBBY * sizeof(uint32_t)));
		IOMMU_UNLOCK(unit);
		}

		bool
		iommu_is_buswide_ctx(struct iommu_unit *unit, u_int busno)
		{

		MPASS(busno <= PCI_BUSMAX);
		return ((unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] &
		(1U << (busno % (NBBY * sizeof(uint32_t))))) != 0);
		}

static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");		static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");

static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,		static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,
struct bus_dmamap_iommu *map);		struct bus_dmamap_iommu *map);

static int		static int
iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,		iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,
bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,		bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,
▲ Show 20 Lines • Show All 714 Lines • Show Last 20 Lines

View Options

sys/netpfil/pf/if_pflow.c

Show First 20 Lines • Show All 320 Lines • ▼ Show 20 Lines	if (bootverbose) {
unit->unit, busno, slot, func);		unit->unit, busno, slot, func);
}		}
return (false);		return (false);
}		}
iommu_set_buswide_ctx(unit, busno);		iommu_set_buswide_ctx(unit, busno);
return (true);		return (true);
}		}

		void
		iommu_set_buswide_ctx(struct iommu_unit *unit, u_int busno)
		kibUnsubmitted Not Done Inline Actions I still prefer to have this code fragment to exist as a function. kib: I still prefer to have this code fragment to exist as a function.
		{

		MPASS(busno <= PCI_BUSMAX);
		IOMMU_LOCK(unit);
		unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] \|=
		1 << (busno % (NBBY * sizeof(uint32_t)));
		IOMMU_UNLOCK(unit);
		}

		bool
		iommu_is_buswide_ctx(struct iommu_unit *unit, u_int busno)
		{

		MPASS(busno <= PCI_BUSMAX);
		return ((unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] &
		(1U << (busno % (NBBY * sizeof(uint32_t))))) != 0);
		}

static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");		static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");

static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,		static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,
struct bus_dmamap_iommu *map);		struct bus_dmamap_iommu *map);

static int		static int
iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,		iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,
bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,		bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,
▲ Show 20 Lines • Show All 714 Lines • Show Last 20 Lines

View Options

sys/netpfil/pf/pf.c

Show First 20 Lines • Show All 320 Lines • ▼ Show 20 Lines	if (bootverbose) {
unit->unit, busno, slot, func);		unit->unit, busno, slot, func);
}		}
return (false);		return (false);
}		}
iommu_set_buswide_ctx(unit, busno);		iommu_set_buswide_ctx(unit, busno);
return (true);		return (true);
}		}

		void
		iommu_set_buswide_ctx(struct iommu_unit *unit, u_int busno)
		kibUnsubmitted Not Done Inline Actions I still prefer to have this code fragment to exist as a function. kib: I still prefer to have this code fragment to exist as a function.
		{

		MPASS(busno <= PCI_BUSMAX);
		IOMMU_LOCK(unit);
		unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] \|=
		1 << (busno % (NBBY * sizeof(uint32_t)));
		IOMMU_UNLOCK(unit);
		}

		bool
		iommu_is_buswide_ctx(struct iommu_unit *unit, u_int busno)
		{

		MPASS(busno <= PCI_BUSMAX);
		return ((unit->buswide_ctxs[busno / NBBY / sizeof(uint32_t)] &
		(1U << (busno % (NBBY * sizeof(uint32_t))))) != 0);
		}

static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");		static MALLOC_DEFINE(M_IOMMU_DMAMAP, "iommu_dmamap", "IOMMU DMA Map");

static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,		static void iommu_bus_schedule_dmamap(struct iommu_unit *unit,
struct bus_dmamap_iommu *map);		struct bus_dmamap_iommu *map);

static int		static int
iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,		iommu_bus_dma_tag_create(bus_dma_tag_t parent, bus_size_t alignment,
bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,		bus_addr_t boundary, bus_addr_t lowaddr, bus_addr_t highaddr,
▲ Show 20 Lines • Show All 714 Lines • Show Last 20 Lines

pflow: add RFC8158 NAT supportClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 131568

sbin/pfctl/parse.y

sys/net/if_pflow.h

sys/netpfil/pf/if_pflow.c

sys/netpfil/pf/pf.c

pflow: add RFC8158 NAT support
ClosedPublic
Actions

Revision Contents
Changeset List