summaryrefslogtreecommitdiff
path: root/sys/net/if_bridge.c
AgeCommit message (Collapse)Author
2012-12-22Return EEXIST to 'add' when a port is already a bridge member. This makesCamiel Dobbelaar
reconfiguration with /etc/netstart silent again. (noticed by deraadt) And do the same for 'addspan'. ok deraadt
2012-12-07Remove stray semicolon. Fixes mbuf leak with devices sending BPDUs toPaul de Weerd
bridge(4) members that are not configured with stp. Lots of debug help (and actual find) sthen@ OK sthen@, mpf@
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-10-10make bridge_rtflush and bridge_flushrule void functions, as they neverHenning Brauer
return anything but 0 anyways From: "Michael W. Bombardieri" <mb at ii dot net>, ok camield
2012-10-08Make carp_ourether() shorter and more generic. Only a mac addressCamiel Dobbelaar
is really needed, instead of an ethernet header and selector. ok mikeb henning mpf
2012-10-06Remove bridge_rttrim(). It's only triggered in the unlikely event that theCamiel Dobbelaar
routecache is full and the admin is making it smaller. It then does a lame attempt at shrinking the routecache, something that a flush or flushall can do better. ok henning beck
2012-10-05Point an interface directly to its bridgeport configuration, insteadCamiel Dobbelaar
of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
2012-09-20Don't filter spanning tree BPDUs. Either process, or forward them.Marco Pfatschbacher
Even though this violates IEEE 802.1D, we'd rather avoid bridging loops by not getting in the way of STP. OK henning, camield, reyk
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
2012-07-16add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)Markus Friedl
can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
2011-07-04Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.Claudio Jeker
The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
2011-05-16bring back r1.189, but keep doing the ip csum unconditionally for now untilHenning Brauer
the broadcast shortcut codepath is fixed. ok claudio
2011-04-10Revert Rev. 1.189. The delayed ip checksum calculation causes problemsClaudio Jeker
with broadcast packets.
2011-04-05mechanic rename M_{TCP|UDP}V4_CSUM_OUT -> M_{TCP|UDP}_CSUM_OUTHenning Brauer
ok claudio krw
2011-04-04all I wanted is to make the bridge behave like the real stack wrt the ipHenning Brauer
chekcsum. turned out is always recalculates it as long as your kernel does have pf compiled in, as in, always, since compilation of GENERIC without pf explodes in about a hundred ways. so rename bridge_filter -> bridge_ip and always compile it, pf or not, just make the pf_test calls #if NPF, and sync the ip fuckery code with ip_output. as a bonus this lets us use the checksum offloading to the NIC if it is capable of that. ok claudio dlg sthen
2010-11-04Filter out reserved destination MAC addresses (01:80:C2:00:00:0x) asPaul de Weerd
per the 802.1D-2004 spec. With lots of help and guidance (and some nagging) from claudio. Tested with net/ladvd port on i386 and amd64. 'be a man' claudio@, ok mpf@
2010-10-31Remove unused bstp_list and bstp_attach.Marco Pfatschbacher
OK blambert, claudio.
2010-10-28Fix a 'bstp still active' panic that happens if a stp enabledMarco Pfatschbacher
interface is destroyed while in the bridge. Fixed by using bridge_delete() which includes the missing bstp_delete() call: Less code and more consistency. Also fix SIOCBRDGDEL to return an error if an interface can not be found. OK claudio, markus.
2010-10-28A function that only returns NULL should return void.Claudio Jeker
bstp_input() always consumes the packet so remove the mbuf handling dance around it.
2010-09-28replace hand-rolled infinite loop with LIST_FOREACHBret Lambert
ok claudio@ guenther@
2010-09-24avoid potential infinite loopBret Lambert
ok deraadt@
2010-07-09Add support for using IPsec in multiple rdomains.Reyk Floeter
This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
2010-07-02m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsBret Lambert
are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
2010-07-01Allow to specify an alternative enc(4) interface for an SA. AllReyk Floeter
traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
2010-06-29Replace enc(4) with a new implementation as a cloner device. We stillReyk Floeter
create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
2010-06-03Add support for 802.1ad-style QinQ nested VLANs.Christian Weisgerber
QinQ-compliant svlan (service VLAN) interfaces are implemented as a new cloner type, use Ethernet type 0x88a8, and have a dedicated VLAN tag hash to avoid ID conflicts. vlan(4) interfaces can be stacked on top of svlan(4). Originally from reyk@, input from claudio@ and deraadt@ ok claudio@
2010-01-13Preliminary rdomain support in bridge(4). Make sure that m->m_pkthdr.rdomainClaudio Jeker
is set whenever we changing the rcvif. It is still not possible to pass traffic between two vether but works now form outside. OK deraadt@
2009-11-22Add a lot of bpf and counter manipulation to the bridge. The bridgeTheo de Raadt
sneaks packets on and off network interfaces in some cases without calling the interrupt, start, or output functions, and thus must do these tasks which the drivers cannot do. The gif and vether are rather special. Someone should re-check gre. ok claudio
2009-11-09vether(4) is a virtual ethernet device driver which can be usedTheo de Raadt
so that a bridge-etherip-tunnel host can join into the bridge itself. It is ridiculous that this capability was missing from our network stack portfolio, considering we have bgp and ospf daemons... discussed at length with claudio
2009-01-06Send broadcast and multicast traffic not only out on all bridge interfaces butClaudio Jeker
also up into the network stack on all interfaces. Multicast addresses are bound to interfaces and without this local sockets did not see packets that entered the bridge on a different interface. This should help IPv6. OK naddy@
2008-10-16* Allow ether_input() and vlan_input() to handle incoming packetsChristian Weisgerber
where the tag is stored in the mbuf header. * Make bridge(4) handle interfaces with and without hardware tag support and forward packets inbetween. Help and ok claudio@
2008-09-10Convert timeout_add() calls using multiples of hz to timeout_add_sec()Bret Lambert
Really just the low-hanging fruit of (hopefully) forthcoming timeout conversions. ok art@, krw@
2008-09-02remove dead stores and newly created unused variables.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ mpf@
2008-06-14add carppeer; an option to specify a different multicast address orReyk Floeter
even the unicast address of the remote carp peer. this especially helps when the multicast carp advertisements are causing problems in the network (some crappy switches don't do well with multicast), there are conflicts with VRRP, or the policy of the network does not allow multicast (most Internet eXchange points didn't allow carped OpenBGP routers because of the multicast advertisements). discussed with many ok mpf@
2008-05-21Only cancel (timeout_del()) the timeout if we're not going to delay itMichael Knudsen
(timeout_add()) anyway. ok brad claudio
2008-05-07enable tx mitigation when putting packets on the wire by switching fromDavid Gwynne
calls to ifp->if_start to if_start(). these are the obviously right cases where we can do that, the less obvious ones may follow as theyre figured out. deraadt@ said to go for it
2008-04-24the softnet intr handlers check if the input queue has packets onDavid Gwynne
it by reading the queues head pointer. if that pointer is not null then it takes splnet and dequeues a packet for handling. this is bad because the ifqueue head is modified at splnet and the sofnet handlers read it without holding splnet. this removes that check of the head pointer and simply checks if the dequeue gave us a packet or not before proceeding. found while reading mpls code. discussed with norby@ and henning@ ok mcbride@ henning@
2007-12-20return with ENOTTY instead of EINVAL for unknown ioctl requests.Brad Smith
ok claudio@ krw@ jason@ dlg@
2007-09-15malloc sweep:Henning Brauer
-remove useless casts -MALLOC/FREE -> malloc/free -use M_ZERO where appropriate instead of seperate bzero feedback & ok krw, hshoexer
2007-05-28double pf performance.Henning Brauer
boring details: pf used to use an mbuf tag to keep track of route-to etc, altq, tags, routing table IDs, packets redirected to localhost etc. so each and every packet going through pf got an mbuf tag. mbuf tags use malloc'd memory, and that is knda slow. instead, stuff the information into the mbuf header directly. bridging soekris with just "pass" as ruleset went from 29 MBit/s to 58 MBit/s with that (before ryan's randomness fix, now it is even betterer) thanks to chris for the test setup! ok ryan ryan ckuethe reyk
2007-05-28Users of arc4random() should include dev/rndvar.h directly.Ryan Thomas McBride
ok dlg claudio
2007-05-26one extern seems to be better than 20 for ifqmaxlen; ok krwJason Wright
2007-05-21make bridge(4) mark packets with M_PROTO1 if gif(4) needs to useMarkus Friedl
etherip encapsulation; unbreaks remote ipsec bridges; ok claudio; additional testing Renaud Allard
2007-05-16fix return values in bridge_output.Michele Marchetto
OK claudio@ jason@
2007-05-15Update the ifp of bridge cache entries if the entry is not static. ThisClaudio Jeker
makes carp(4) fail-over work over bridge(4). OK michele@ jason@
2007-04-10``it's'' -> ``its'' when the grammar gods require this change.Miod Vallat
2007-01-08discard packet and return if ifp is not a member of the bridgeMichele Marchetto
this fix PR 5056 discussed with camield@ OK camield@ claudio@ henning@
2006-12-28check if ifqueue has anything queued before doing the dance ofTheo de Raadt
splnet/IF_DEQUEUE/splx; ok various people
2006-12-11refer to the RSTP point to point option as "PTP" instead of "P2P".Reyk Floeter
P2P is commonly used in relation to peer to peer networks, PTP is used in various protocols for layer 2 point to point links (ie., full duplex ethernet links). note that the newly added brconfig commands [-]p2p and [-]autop2p will change to [-]ptp and [-]autoptp. suggested by Andrew Thompson (thompsa@freebsd.org)
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-01 07:17:00 +0000