summaryrefslogtreecommitdiff
path: root/sys/net/if_bridge.c
AgeCommit message (Collapse)Author
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-07-09bpf code surgery / shuffling / simplification.Henning Brauer
the various bpf_mtap_* are very similiar, they differ in what (and to some extent how) they prepend something, and what copy function they pass to bpf_catchpacket. use an internal _bpf_mtap as "backend" for bpf_mtap and friends. extend bpf_mtap_hdr so that it covers all common cases: if dlen is 0, nothing gets prepended. copy function can be given, if NULL the default bpf_mcopy is used. adjust the existing bpf_mtap_hdr users to pass a NULL ptr for the copy fn. re-implement bpf_mtap_af as simple wrapper for bpf_mtap_hdr. re-implement bpf_mtap_ether using bpf_map_hdr re-implement bpf_mtap_pflog as trivial bpf_mtap_hdr wrapper ok bluhm benno
2014-04-19kill altq bits here as wellHenning Brauer
2014-04-14"struct pkthdr" holds a routing table ID, not a routing domain one.Martin Pieuchot
Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
2014-01-24clearing the _CSUM_IN_OK flags is now utterly pointless, was only done forHenning Brauer
statistics sideeffects before. ok lteo naddy
2014-01-23since the cksum rewrite the counters for hardware checksummed packetsHenning Brauer
are are lie, since the software engine emulates hardware offloading and that is later indistinguishable. so kill the hw cksummed counters. introduce software checksummed packet counters instead. tcp/udp handles ip & ipvshit, ip cksum covered, 6 has no ip layer cksum. as before we still have a miscounting bug for inbound with pf on, to be fixed in the next step. found by, prodding & ok naddy
2013-10-28Do not use the multicast macro IFP_TO_IA() to check if an interface hasMartin Pieuchot
a configured IPv4 address but iterates on its private list instead. ok deraadt@
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-10-13Just use sockaddr_union instead of a handcrafted version and renameReyk Floeter
bridge_tunnelupdate to a more generic name bridge_copyaddr. No functional change.
2013-10-13Import vxlan(4), the virtual extensible local area network tunnelReyk Floeter
interface. VXLAN is a UDP-based tunnelling protocol for overlaying virtualized layer 2 networks over layer 3 networks. The implementation is based on draft-mahalingam-dutt-dcops-vxlan-04 and has been tested with other implementations in the wild. put it in deraadt@
2013-10-12give tagname2tag and its siblings an extra "create" parameter. if 1, itHenning Brauer
behaves like before and creates the mapping if needed. if 0, lookup only. looked over by many, ok phessler sthen
2013-08-21No need to include if_vlan_var.h twice.Martin Pieuchot
2013-08-05sync the bridge_broadcast comment with realityMike Belopuhov
2013-07-31Move bridge_broadcast and subsequently all IPsec SPD lookup code outMike Belopuhov
of the IPL_NET. pf_test should be no longer called under IPL_NET as well. The problem became evident after the related issue was brought up by David Hill <dhill at mindcry ! org>. With input from and OK mpi. Tested by David and me.
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2013-03-28do not include machine/cpu.h from a .c file; it is the responsibility ofTheo de Raadt
.h files to pull it in, if needed ok tedu
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-26Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.Martin Pieuchot
ok beck@, mikeb@
2013-03-15change LIST_END to literal NULL for clarity.Ted Unangst
ok claudio mpi
2013-01-23Change interface and span interface lists from LIST to TAILQ.Camiel Dobbelaar
This way the configuration order is preserved. Order matters because MAC address are not unique: vlan interfaces can have the same MAC as their parent. Frames destined for the bridge itself are now delivered to the first-configured interface that matches the MAC instead of the last-configured. This means that the bridge behavior does not suddenly change anymore when adding a vlan interface. ok henning reyk (a while ago)
2012-12-22Return EEXIST to 'add' when a port is already a bridge member. This makesCamiel Dobbelaar
reconfiguration with /etc/netstart silent again. (noticed by deraadt) And do the same for 'addspan'. ok deraadt
2012-12-07Remove stray semicolon. Fixes mbuf leak with devices sending BPDUs toPaul de Weerd
bridge(4) members that are not configured with stp. Lots of debug help (and actual find) sthen@ OK sthen@, mpf@
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-10-10make bridge_rtflush and bridge_flushrule void functions, as they neverHenning Brauer
return anything but 0 anyways From: "Michael W. Bombardieri" <mb at ii dot net>, ok camield
2012-10-08Make carp_ourether() shorter and more generic. Only a mac addressCamiel Dobbelaar
is really needed, instead of an ethernet header and selector. ok mikeb henning mpf
2012-10-06Remove bridge_rttrim(). It's only triggered in the unlikely event that theCamiel Dobbelaar
routecache is full and the admin is making it smaller. It then does a lame attempt at shrinking the routecache, something that a flush or flushall can do better. ok henning beck
2012-10-05Point an interface directly to its bridgeport configuration, insteadCamiel Dobbelaar
of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
2012-09-20Don't filter spanning tree BPDUs. Either process, or forward them.Marco Pfatschbacher
Even though this violates IEEE 802.1D, we'd rather avoid bridging loops by not getting in the way of STP. OK henning, camield, reyk
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
2012-07-16add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)Markus Friedl
can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
2011-07-04Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.Claudio Jeker
The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
2011-05-16bring back r1.189, but keep doing the ip csum unconditionally for now untilHenning Brauer
the broadcast shortcut codepath is fixed. ok claudio
2011-04-10Revert Rev. 1.189. The delayed ip checksum calculation causes problemsClaudio Jeker
with broadcast packets.
2011-04-05mechanic rename M_{TCP|UDP}V4_CSUM_OUT -> M_{TCP|UDP}_CSUM_OUTHenning Brauer
ok claudio krw
2011-04-04all I wanted is to make the bridge behave like the real stack wrt the ipHenning Brauer
chekcsum. turned out is always recalculates it as long as your kernel does have pf compiled in, as in, always, since compilation of GENERIC without pf explodes in about a hundred ways. so rename bridge_filter -> bridge_ip and always compile it, pf or not, just make the pf_test calls #if NPF, and sync the ip fuckery code with ip_output. as a bonus this lets us use the checksum offloading to the NIC if it is capable of that. ok claudio dlg sthen
2010-11-04Filter out reserved destination MAC addresses (01:80:C2:00:00:0x) asPaul de Weerd
per the 802.1D-2004 spec. With lots of help and guidance (and some nagging) from claudio. Tested with net/ladvd port on i386 and amd64. 'be a man' claudio@, ok mpf@
2010-10-31Remove unused bstp_list and bstp_attach.Marco Pfatschbacher
OK blambert, claudio.
2010-10-28Fix a 'bstp still active' panic that happens if a stp enabledMarco Pfatschbacher
interface is destroyed while in the bridge. Fixed by using bridge_delete() which includes the missing bstp_delete() call: Less code and more consistency. Also fix SIOCBRDGDEL to return an error if an interface can not be found. OK claudio, markus.
2010-10-28A function that only returns NULL should return void.Claudio Jeker
bstp_input() always consumes the packet so remove the mbuf handling dance around it.
2010-09-28replace hand-rolled infinite loop with LIST_FOREACHBret Lambert
ok claudio@ guenther@
2010-09-24avoid potential infinite loopBret Lambert
ok deraadt@
2010-07-09Add support for using IPsec in multiple rdomains.Reyk Floeter
This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
2010-07-02m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsBret Lambert
are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
2010-07-01Allow to specify an alternative enc(4) interface for an SA. AllReyk Floeter
traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
2010-06-29Replace enc(4) with a new implementation as a cloner device. We stillReyk Floeter
create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
2010-06-03Add support for 802.1ad-style QinQ nested VLANs.Christian Weisgerber
QinQ-compliant svlan (service VLAN) interfaces are implemented as a new cloner type, use Ethernet type 0x88a8, and have a dedicated VLAN tag hash to avoid ID conflicts. vlan(4) interfaces can be stacked on top of svlan(4). Originally from reyk@, input from claudio@ and deraadt@ ok claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 14:45:21 +0000