summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-23syncTheo de Raadt
2021-02-23remove unused malloc_roundup()Jonathan Gray
2021-02-23As ip_insertoptions() may prepend a mbuf, "goto bad" has to freeAlexander Bluhm
the new chain. This fixes a potential memory leak in ip_output(). Also simplify a bunch of "goto done". OK kn@ mvs@
2021-02-23Make more efficient clearing interrupts on all processors at boot time.Kenji Aoyama
Without this modification, because of the volatile qualifier, the compiler does not produce four `` = 0 '' assignments, but code equivalent to: *(volatile uint32_t *)INT_ST_MASK3 = 0; *(volatile uint32_t *)INT_ST_MASK2 = *(volatile uint32_t *)INT_ST_MASK3; *(volatile uint32_t *)INT_ST_MASK1 = *(volatile uint32_t *)INT_ST_MASK2; *(volatile uint32_t *)INT_ST_MASK0 = *(volatile uint32_t *)INT_ST_MASK1; Anders Gavare reported to Miod Vallat, and he gave me a diff.
2021-02-23small adjustment of the deck chairs, no functional change.David Gwynne
2021-02-23fix up which link flags do what.David Gwynne
ipsec code is written, but is disabled, so the ipsec words here are still commented out for now.
2021-02-23Use NULL instead of 0 in `m_nextpkt' assignment.mvs
ok deraadt@ dlg@
2021-02-23make a start on transparent ipsec interception, based on bridge(4).David Gwynne
i found the Transparent Network Security Policy Enforcement paper by angelos and jason was useful for understanding the background and why you'd want to do this. the implementation is a little bit different to the bridge one because i've tweaked the order that pf and ipsec processing happens, depending on which direction the packet is going over the bridge. bridge always runs ipsec processing before pf, no matter which direction the packet is going. packets going into veb, pf runs first and then ipsec input processing is allowed to happen. in the outgoing direction ipsec happens first and then pf. pf runs before ipsec in the inbound direction so pf can apply policy to ipsec encapsulated packets before they hit pf. this allows you to apply policy to both the encrypted and unencrypted packets in both directions. the code is disabled for now. this is mostly because i want veb(4) to have a good chance at operating outside the netlock, and i'm pretty sure the ipsec stack isn't ready for that yet. the other reason why it's disabled is getting a test setup is effort, but i want to sleep.
2021-02-23remove unused uvm_mapent_bias()Jonathan Gray
ok mpi@
2021-02-23Move `pgo_fault' handler outside of uvm_fault_lower().Martin Pieuchot
Reduce differences with NetBSD and prepare for `uobj' locking. No functionnal change. ok chris@, kettenis@
2021-02-23remove some unused includesJonathan Gray
2021-02-23use the ipv6 dst addr to look up an ipsec tdb in bridge_ipsec in.David Gwynne
using the ipv6 next protocol header probably doesnt work. it also probably doesnt matter cos i'm not sure anyone uses this feature in bridge. or maybe there isn't anyone who uses ipv6. both are plausible options. hahaha^Wok patrick@
2021-02-23Allow the user to specify a path to the mg startup file on the command line.Mark Lumsden
2021-02-23use link0 to allow vlans to cross the bridge.David Gwynne
2021-02-23implement support for the blocknonip port flag.David Gwynne
2006-10-06Preliminary bits for SuperH-based ports, based on NetBSD/sh3 codebase withMiod Vallat
minor changes.
2021-02-23add support for setting and getting bridge port flags.David Gwynne
2021-02-23timecounting: use C99-style initialization for all timecounter structscheloha
The timecounter struct is large and I think it may change in the future. Changing it later will be easier if we use C99-style initialization for all timecounter structs. It also makes reading the code a bit easier. For reasons I cannot explain, switching to C99-style initialization sometimes changes the hash of the resulting object file, even though the resulting struct should be the same. So there is a binary change here, but only sometimes. No behavior should change in either case. I can't compile-test this everywhere but I have been staring at the diff for days now and I'm relatively confident this will not break compilation. Fingers crossed. ok gnezdo@
2021-02-23filter MAC Bridge component Reserved addressDavid Gwynne
im considering converting ethernet addresses into uint64_ts to make comparisons (and masking) easier. im trialling it here, and it doesn't seem like the worst.
2021-02-23try and use my words to explain what veb is and does.David Gwynne
ok jmatthew@
2021-02-23add veb(4), a Virtual Ethernet Bridge driver.David Gwynne
my intention is to replace bridge(4), but the way it works is different enough from from bridge that a name change is justified to distinguish them. it also makes it easier to commit it to the tree and work on it in parallel to bridge, and allows a window of migration. the main difference between veb(4) and bridge(4) is how they use interfaces as ports. veb takes over interfaces completely and only uses them to receive and transmit ethernet packets. bridge also use each interface as a port to the ethernet segment it's connected to, but also tries to continue supporting the use of the interface as a way to talk to the network stack on the local system. supporting the use of interfaces for both external and local communication is where most of my confusion with bridge comes from, both when i'm trying to operate it and also understand the code. changing this semantic is where most of the simplification in veb comes from compared to bridge. because veb takes over interfaces, the ethernet network set up on a veb is isolated from the host network stack. by default veb does not interact with pf or the ip (and mpls) stacks. to enable pf for ip frames going over veb ports link1 on the veb interface must be set. to have the stack interact with a veb network, vport interfaces must be created and added as ports to a veb. the vport interface driver is provided as part of veb, and is handled specially by veb. veb usually prevents the use of ports by the stack for sending an receiving packets, but that's why vports exist, so veb has special handling for them. veb already supports a lot of the other features that bridge has, including bridge rules and protected domains, but i got tired of working out of the tree and stopped implementing them. the main outstanding features is better address table management, the blocknonip flag on ports, transparent ipsec interception, and spanning tree. i may not bother with spanning tree unless someone tells me that they actually use it. the core ethernet learning bridge functionality is provided by the etherbridge code that was factored out of nvgre and bpe. veb is already (a lot) faster than bridge, and is better prepared to operate in parallel on multiple CPUs concurrently. thanks to hrvoje popovski for testing some earlier versions of this. discussed with many ok patrick@ jmatthew@
2021-02-23syncTheo de Raadt
2021-02-23warn when the user specifies a ForwardAgent path that does not existDamien Miller
and exit if ExitOnForwardFailure is set; bz3264
2021-02-23remove unused acpiec_lock() acpiec_unlock() functionsJonathan Gray
ok kettenis@ pirofti@
2021-02-22remove unused decode_hw_header() functionJonathan Gray
ok krw@
2021-02-22Terminate backtrace of secondary processors in ddb.Mark Kettenis
From miod@
2021-02-22Mark as arm64-specific.Mark Kettenis
2021-02-22Don't pass 'id' as argument to make function signature match similartobhe
functions. config_setpfkey() is always called with id PROC_IKEV2.
2021-02-22Enable bge(4).Mark Kettenis
2021-02-22Enable apldog(4).Mark Kettenis
2021-02-22apldog(4)Mark Kettenis
2021-02-22Add apldog(4), a driver for the watchdog on Apple M1 SoCs.Mark Kettenis
This allows us to reboot the machine. ok patrick@
2021-02-22Move UNIX socket's garbage collector to `systqmp'. It touches nothingmvs
which requires kernel lock to be held. ok mpi@
2021-02-22Disable double-data rate modes if 1.8V signalling is not possible.Patrick Wildt
ok kettenis@
2021-02-22Slow mode is only relevant for legacy and high speed timings.Patrick Wildt
ok kettenis@
2021-02-22Improve support for the variant found on the Apple M1 SoC.Mark Kettenis
This mostly adjust the interrupt masking and status support since this variant lacks the UINTM and UINTP registers. ok patrick@
2021-02-22Make the ober_get_* set of function to accept a NULL-pointer.Martijn van Duren
This allows us to do ber-type checking inside ober_scanf_elements, which will allow for stricter ASN.1 parsing in the future. Manpage feedback and OK claudio@, jmc@ OK claudio@
2021-02-22Fix bizarre punctuation and capitalization in a comment.Theo Buehler
2021-02-22Simplify version checks in the TLSv1.3 clientTheo Buehler
Ensure that the server announced TLSv1.3 (and nothing higher) in the supported_versions extension. In that case, the legacy_version must be TLSv1.2 according to RFC 8446, 4.1.3 and 4.2.1. This commit also removes some unreachable code which is a remnant of very early TLSv1.3 code from before the legacy fallback was introduced. Simplify a few checks and adjust some comments nearby. ok jsing
2021-02-22Factor out/change some of the legacy client version handling code.Joel Sing
This consolidates the version handling code and will make upcoming changes easier. ok tb@
2021-02-22When cutting of the head of an overlapping fragment during pfAlexander Bluhm
reassembly, reinsert the fragment into the lookup table with correct index. Reported-by: syzbot+d043455a5346f726f1c4@syzkaller.appspotmail.com OK claudio@
2021-02-22add 7.0 syspatch pubkeyRobert Nagy
2021-02-22expand_paths needs the global environment to be set up, do that first.Nicholas Marriott
2021-02-22Make use of the new '$' feature of ober_scanf_elements to enforce stricterMartijn van Duren
ASN.1 verification. OK claudio@
2021-02-22Rename mkpath() to mkpathat() since it uses mkdirat() internally.Claudio Jeker
2021-02-22Fix regex searching with wrapped lines, from Anindya Mukherjee; GitHubNicholas Marriott
issue 2570.
2021-02-22Move config file path expansion much earlier, keep the list of pathsNicholas Marriott
around rather than freeing later, and add a config_files format variable containing it. Suggested by kn@ a while back.
2021-02-22There are many format variables now so allocating all the default onesNicholas Marriott
each time a tree is created is too expensive. Instead, convert them all into callbacks and put them in a static table so they only allocate on demand. The tree remains for the moment for extra (non-default) variables added by for example copy mode or popups. Also reduce expensive calls to localtime_r/strftime. GitHub issue 2253.
2021-02-22Move jump commands to grid reader, make them UTF-8 aware, and tidy up,Nicholas Marriott
from Anindya Mukherjee.
2021-02-22Switch reboot timing to timespec, the better to handle theKenneth R Westerback
default reboot interval of 1 sec. Gives the DHCP server a fairer shot at replying before the timeout expires. ok millert@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-20 19:54:17 +0000