pf|ipfw|netinet6?: shared IP forwarding
This removes the if_output calls in the pf(4) code that escape further
processing by defering the forwarding execution to the network stack
using on/off style sysctls for both IPv4 and IPv6.
Also see: https://reviews.freebsd.org/D8877
rss: add sysctl enable toggle
This commit also includes the original refactoring changes
This change allows the kernel to operate with the default netisr cpu-affinity settings while having RSS compiled in. Normally, RSS changes quite a bit of the behaviour of the kernel dispatch service - this change allows for reducing impact on incompatible hardware while preserving the option to boost throughput speeds based on packet flow CPU affinity.
Make sure to compile the following options in the kernel:
options RSS
As well as setting the following sysctls:
net.inet.rss.enabled: 1
net.isr.bindthreads: 1
net.isr.maxthreads: -1 (automatically sets it to the number of CPUs)
And optionally (to force a 1:1 mapping between CPUs and buckets):
net.inet.rss.bits: 3 (for 8 CPUs)
[5 lines not shown]
Interfaces: Assignments - work in progress for https://github.com/opnsense/core/issues/9945
In order to migrate the interface assignments, we need to think of a way to use the differently named xml nodes for interfaces (wan, lan, ..) into something that closely resembles a standard model implementation.
Since we can't match these nodes in our statically defined model xmls, the main idea is to flush all via an in-memory model with a separate load [construct] and save hook [serializeToConfig].
The next challenge is to "stash" updates and wait for "apply" in certain cases, for this we add a temporary database holding the changes which are synced after the actual system change has happend (pending_action, pending_if). When succesfully applied, the apply function cleans up the final stage of the configuration to make everything consistent again.
This database is a simple single json encoded file named /tmp/.interfaces.todo
Interfaces: Assignments - work in progress for https://github.com/opnsense/core/issues/9945
In order to migrate the interface assignments, we need to think of a way to use the differently named xml nodes for interfaces (wan, lan, ..) into something that closely resembles a standard model implementation.
Since we can't match these nodes in our statically defined model xmls, the main idea is to flush all via an in-memory model with a separate load [construct] and save hook [serializeToConfig].
The next challenge is to "stash" updates and wait for "apply" in certain cases, for this we add a temporary database holding the changes which are synced after the actual system change has happend (pending_action, pending_if). When succesfully applied, the apply function cleans up the final stage of the configuration to make everything consistent again.
This database is a simple single json encoded file named /tmp/.interfaces.todo
pf: backport changes around the following commit #242
commit 49f39043a02d6011c1907e1b07eb034652a1269c
Author: phessler <phessler at openbsd.org>
Date: Fri Apr 28 14:08:34 2023 +0000
Relax the "pass all" rule so all forms of neighbor advertisements are allowed
in either direction.
This more closely matches the IPv4 ARP behaviour.
From sashan@
discussed with kn@ deraadt@
divert: Avoid using atomic_(load|store)_(acq|rel)_16
It's not implemented on some arches. Use a plain int to count the
number of sockets in a divert lbgroup.
Reported by: Jenkins
Fixes: 895a0ae67fe2 ("divert: Define semantics for SO_REUSEPORT_LB on divert sockets")
divert: Define semantics for SO_REUSEPORT_LB on divert sockets
Allow SO_REUSEPORT_LB to be set on divert sockets. If set, then bind()
will add the socket to a "load-balancing group". When a divert-to rule
matches a port with an associated group, the corresponding state ID is
used to select a specific socket from the group. Packets without an
associated state are simply forwarded to the first socket in the group.
For now I only pass a state ID from pf, as I couldn't see a useful
identifier on the ipfw side.
This implementation is simple but has a caveat, that being that if
sockets are added to the group while flows are being processed, the size
of the group will change and this changes the mapping of state IDs to
sockets. So, to get a consistent mapping, the divert socket application
must bind all of its sockets before any traffic is diverted by the
firewall.
Reviewed by: glebius
MFC after: 1 month
[3 lines not shown]
rtsold: check RA lifetime before triggering the one-shot always script
Historic context: rtsold is used by *sense to get a router address which
wasn't originally the daemon's purpose. We only ever get the first address
per interface lifetime so if the RA contains an invalid router with a zero
lifetime and we catch it we cannot get a valid one ever again.
This is suboptimal in a number of ways, but the obvious way to deal with
this is to ignore all RA messages from routers that do not advertise a
default route.
PR: https://github.com/opnsense/core/issues/9551
dummynet: passin after dispatch
Based on a patch originally found in m0n0wall, expanded
to IPv6 and aligned with FreeBSD's IP input path.
The limit may not be correctly accounted for on the WAN
interface due to dummynet counting the packet again even
though it was already processed.
The problem here is that there's no proper way to reinject
the packet at the point where it was previously removed
from so we make the assumption that ip input was already
done (including pfil) and more or less directly move to
packet output processing.
While here move the passin label up to take the extra check
but avoiding a second label. Also remove the spurious tag
read for forward check since we don't use it and we should
really trust the mbuf flag.
ixgbe: workaround to prevent an i2c bus read to keep trying to read an empty slot
When executing `ifconfig -v` this will lead to stalls for a second per
interface due to the timeout being set to a static 10 without a module
placed, this patch makes sure this is only allowed once per insertion.
libfetch: allow use of SSL_CRL_VERIFY
Since the default store already points to /etc/ssl/certs and the
CRLs are hashed there too it is trivial to bring libfetch applications
to verifying the CRLs contained when doing a SSL connection.
libfetch: ignore the error of an absence of a CRL
... when passing SSL_CRL_FILE / SSL_CRL_VERIFY.
The situation isn't ideal, but since we don't know what we are going to deal
with the situation is tricky. It's especially pointless in scenarios of
pkg multi-repo cases where we need to deal wit a mixed bag of URLs during
the same context. For the benefit of the doubt print the appropriate message
for the user to see.
In general it would be a bit safer if we could enforce the existence of a
CRL distribution point as a mandatory CRL check and the others as an optional
one with the warning as printed for the user to see. It would also need a
[18 lines not shown]
