Age | Commit message (Collapse) | Author |
|
more accurate but also a good mnemonic.
ok jmc@
|
|
|
|
|
|
|
|
ok jmc@
|
|
oga pointed out that it was undocumented, which caused me to find out
that I had this diff in my tree.
`fine' deraadt
|
|
|
|
|
|
|
|
|
|
ok henning deraadt
|
|
|
|
tcp" parameter. ok henning@
|
|
Replaces pchb with amas for the AMD64 address map.
amas0 at pci0 dev 24 function 1 "AMD AMD64 0Fh Address Map" rev 0x00
Currently disabled (causing pchb to attach instead).
ok art@
|
|
|
|
|
|
has all space allocated such that we can make holes in it using extent_free().
ok miod@
|
|
|
|
|
|
|
|
while here, remove a few superfluous line breaks in examples.
ok henning@, jmc@
|
|
|
|
|
|
Couple of tweaks from jmc@
|
|
|
|
argument, so remove any examples that were not particularly illustrative;
ok henning
|
|
only and no pure build dependencies; ok jmc@
|
|
|
|
|
|
|
|
|
|
feedback (i.e. much tearing of hair) and ok henning
|
|
allocations, making sure that the union of all space is allocated.
ok deraadt@
|
|
|
|
The old text implied 'make release' was only concerned with
verifying file sets. Prodded by me, diff by jmc@
"if you like it, just commit it" jmc@
|
|
|
|
|
|
|
|
ok henning
|
|
|
|
|
|
ok henning@
|
|
ok henning
|
|
we are mostly documenting that fragment reassembly has nothing to do
with scrubbing anymore; there is room for a lot of improvements yet.
"commit it and we work on it in-tree. it is certainly well,
better than what there is now" henning@
|
|
input from and ok henning@
|
|
2) packet reassembly: only one method remains, full reassembly. crop
and drop-ovl are gone.
. set reassemble yes|no [no-df]
if no-df is given fragments (and only fragments!) with the df bit set
have it cleared before entering the fragment cache, and thus the
reassembled packet doesn't have df set either. it does NOT touch
non-fragmented packets.
3) regular rules can have scrub options.
. pass scrub(no-df, min-ttl 64, max-mss 1400, set-tos lowdelay)
. match scrub(reassemble tcp, random-id)
of course all options are optional. the individual options still do
what they used to do on scrub rules, but everything is stateful now.
4) match rules
"match" is a new action, just like pass and block are, and can be used
like they do. opposed to pass or block, they do NOT change the
pass/block state of a packet. i. e.
. pass
. match
passes the packet, and
. block
. match
blocks it.
Every time (!) a match rule matches, i. e. not only when it is the
last matching rule, the following actions are set:
-queue assignment. can be overwritten later, the last rule that set a
queue wins. note how this is different from the last matching rule
wins, if the last matching rule has no queue assignments and the
second last matching rule was a match rule with queue assignments,
these assignments are taken.
-rtable assignments. works the same as queue assignments.
-set-tos, min-ttl, max-mss, no-df, random-id, reassemble tcp, all work
like the above
-logging. every matching rule causes the packet to be logged. this
means a single packet can get logged more than once (think multiple log
interfaces with different receivers, like pflogd and spamlogd)
.
almost entirely hacked at n2k9 in basel, could not be committed close to
release. this really should have been multiple diffs, but splitting them
now is not feasible any more. input from mcbride and dlg, and frantzen
about the fragment handling.
speedup around 7% for the common case, the more the more scrub rules
were in use.
manpage not up to date, being worked on.
|
|
ok jasper@
|
|
Fix prodded and checked by jmc@, thanks.
|
|
Pointed by jmc@.
|
|
|