Remove no longer needed casts for radix routines

ipfw3_table: invoke the init in ipfw3_basic module

ipfw3 table 1 type ip
ipfw3 table 1 append ip <ip>
ipfw3 table list
ipfw3 table 1 show

kernel: Remove <sys/mplock2.h> from all files that do not need it.

kernel: Remove numerous #include <sys/thread2.h>.

Most of them were added when we converted spl*() calls to
crit_enter()/crit_exit(), almost 14 years ago. We can now
remove a good chunk of them agai

kernel: Remove numerous #include <sys/thread2.h>.

Most of them were added when we converted spl*() calls to
crit_enter()/crit_exit(), almost 14 years ago. We can now
remove a good chunk of them again for where crit_*() are
no longer used.

I had to adjust some files that were relying on thread2.h
or headers that it includes coming in via other headers
that it was removed from.

show more ...

kernel/ipfw3: Remove unused malloc type.

ipfw3_nat: highspeed lockless in-kernel NAT

RB-Tree to stored the state for the outgoing packets, and multidimentional
array of pointers to keep the state for the incoming packets.

ipfw3: remove legacy macros

ipfw3basic: misc

ipfw3basic: fix `to me`

ipfw/ipfw3: Use INTWAIT|NULLOK for mtag allocation.

netisr: netisr_forwardmsg -> netisr_forwardmsg_all

This function actually forwards netmsg to all available netisrs,
instead of netisr_ncpus netisrs.

For some modules, this is obviously not necessar

netisr: netisr_forwardmsg -> netisr_forwardmsg_all

This function actually forwards netmsg to all available netisrs,
instead of netisr_ncpus netisrs.

For some modules, this is obviously not necessary; they will be
fixed one-by-one later.

show more ...

ipfw3_basic: keep-state is a pseudo filter

ipfw3sync: dont call the sync func when centre not running

ipfw3_basic: move netisr_domsg out of callout func

ipfw3: Reduce dependency on ifnet threads.

Prepare to get rid of them.

ipfw3: lockless in-kernel NAT

The libalias is used in kernel space for in-kernel NAT, and its alias_link
entries are stored with LIST. so all the packets which need to be NAT will scan
against the L

ipfw3: lockless in-kernel NAT

The libalias is used in kernel space for in-kernel NAT, and its alias_link
entries are stored with LIST. so all the packets which need to be NAT will scan
against the LIST and trying to find the matched alias_link. by seperating the
libalias into context of different CPUs, the lock can be removed. and due to the
nature of NAT, the outgoing and incoming packets are possible to be handled by
different CPUs, to ensure the returning packet can be translated properly, the
newly created alias_link is required to be duplicated and inserted into contexts
of both CPUs.

e.g.
ipfw3 nat 1 config if em0
ipfw3 nat 1 all via em0
ipfw3 nat 1 show state

show more ...

ipfw3: update rule in func skipto

ipfw3: new feature 'ipfwsync'

ipfwsync is a new feature to synchronize firewall states between machines
which is running ipfw3 firewall for high availability. ipfw3 can be configured
in centre or ed

ipfw3: new feature 'ipfwsync'

ipfwsync is a new feature to synchronize firewall states between machines
which is running ipfw3 firewall for high availability. ipfw3 can be configured
in centre or edge mode. the centre will automatically sync the states from
centre to the edge.

e.g.
ipfw3 sync edge 5000
ipfw3 sync start edge

ipfw3 sync centre 192.168.1.1:5000,192.168.1.2:5000
ipfw3 sync start centre

ipfw3 sync show config
ipfw3 sync show status
ipfw3 sync test centre 123

show more ...

ipfw3: lookup_state for keep-state and check-state

ipfw3: support ip:port in filter from and new filter src-port
1. support ip:port in both filters 'from' and 'to'
2. new filters 'src-port' and 'dst-port'

e.g. block UDP packets to 192.168.1.1:1813
i

ipfw3: support ip:port in filter from and new filter src-port
1. support ip:port in both filters 'from' and 'to'
2. new filters 'src-port' and 'dst-port'

e.g. block UDP packets to 192.168.1.1:1813
ipfw3 add deny udp to 192.168.1.1:1813
ipfw3 add deny udp to 192.168.1.1 dst-port 1813

show more ...

ipfw3: filtering with lookup table

ipfw3: filter from/to supports me/any/subnet

usage:
ipfw3 add allow udp to any
ipfw3 add allow icmp from me
ipfw3 add allow icmp from 192.168.1.0/24

ipfw2 - Rename FreeBSD ipfw port to ipfw3

* Rename all elements of the port to ipfw3 to reduce confusion.