summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2010-11-24malloc the temporary struct pppx_if used in pppx_if_find (it's currentlyStuart Henderson
only called from pppx_del_session); lets an amd64 pppx kernel build (otherwise we hit excessive stack use warnings with -Werror). if this ends up being called more frequently in future, then dlg suggests making it static instead. ok claudio@
2010-11-20throw some yields into the pf table code so it doesn't lock up the kernel.Ted Unangst
ok deraadt henning
2010-11-20__attribute__((packed)) -> __packed. The ioprbs.c chunk was commented out, andMiod Vallat
uncommenting it is intentional. ok deraadt@
2010-11-20remove bs_list occurrences. fixes panic on destroy.Federico G. Schwindt
ok from the m guild: mikeb@ miod@ mpf@
2010-11-17make ifa_ifwithaddr use the RB tree for lookups instead of nested listHenning Brauer
walking. make the function shorter, easier and faster with many addresses while still being at least as fast as the old one with a common "on real IP" setup. tested by many, ok claudio sthen dlg krw
2010-11-17add ifa_print_rb(), dumps the RB tree to the console, can be called fromHenning Brauer
ddb>, ok claudio dlg krw sthen
2010-11-17maintain an RB tree of ifaddrs in the system (addresses and broadcast addrs,Henning Brauer
the latter is also the dest addr on P2P interfaces) for faster lookups in the future. walking the linked list of all interfaces in the system to walk the linked list of addresses on each of them isn't particularily fast, especially with many interfaces and addresses. written at n2k10 in australia in january, but had to be backed out. the offenders have been fixed: -ipvshit rtsol code calling these functions in interrupt context (surprised this hasn't caused more havoc) -various places in the stack added empty ifaddr structs, filling them in later -sloppy recycling of ifaddrs in some places finished at j2k10 in japan in september tested by many, ok sthen krw dlg claudio
2010-11-17an extra parameter for in_ifinit, indicating wether the ifaddr passed to itHenning Brauer
is new or an already existing one. for existing ones, call ifa_del first tested by many as part of a larger diff, ok claudio dlg krw sthen
2010-11-17introduce ifa_update_broadaddr to update an ifaddr's broadcast address,Henning Brauer
trivial for the moment, more needed soon tested by many as part of a larger diff, ok sthen claudio dlg krw
2010-11-16If the interface address referenced by a cloning route did not pointAlexander Bluhm
to an interface any more, the kernel crashed with a null pointer dereference. This situation could be created by a strange sequence of route and ifconfig commands. Now when a cloning route references a stale interface address and rtrequest1(RTM_RESOLVE) has to create a cloned route, it does a lookup for a valid interface address with the same ip address. The new interface address and its interface are used for the new cloned route and they replace the old ones at the cloning route. ok claudio@, henning@
2010-11-12avoid pointer arithmetic on void *David Hill
no change in .o ok claudio
2010-11-04Filter out reserved destination MAC addresses (01:80:C2:00:00:0x) asPaul de Weerd
per the 802.1D-2004 spec. With lots of help and guidance (and some nagging) from claudio. Tested with net/ladvd port on i386 and amd64. 'be a man' claudio@, ok mpf@
2010-10-31Remove unused bstp_list and bstp_attach.Marco Pfatschbacher
OK blambert, claudio.
2010-10-29Align to 32-bits instead of sizeof(long) which may be bigger. There is noCan Erkin Acar
practical value of aligning things to 64-bit and waste more space then necessary on some architectures. ok deraadt@
2010-10-28Fix a 'bstp still active' panic that happens if a stp enabledMarco Pfatschbacher
interface is destroyed while in the bridge. Fixed by using bridge_delete() which includes the missing bstp_delete() call: Less code and more consistency. Also fix SIOCBRDGDEL to return an error if an interface can not be found. OK claudio, markus.
2010-10-28Do not send route messages to userland processes that the kernelClaudio Jeker
rejects because of bad encoding. Userland processes trust that the messages on the rtsock are correctly encoded. Moved some checks up to do the suser() check as soon as possible. After discussion with deraadt@, OK deraadt@ and sthen@ (earlier version)
2010-10-28A function that only returns NULL should return void.Claudio Jeker
bstp_input() always consumes the packet so remove the mbuf handling dance around it.
2010-10-25move to static initializers for the ifnet/ifg_head TAILQ'sBret Lambert
fixes a race-based kernel crash under rare circumstances reported and fix tested by chefren att pi daht net ok claudio@ henning@
2010-10-23remove PFR_FLAG_ATOMIC. not used, and doesn't work as advertised.Ted Unangst
ok henning
2010-10-18Revert non-compatible and undocumented bullshit commited by 3 developersTheo de Raadt
who decided to just do it on their own. henning, mcbride, jsing -- shame on you -- if you had shown this diff to just 1 other network developer, the astounding mistake in it would have been noticed. Start practicing inclusionary development instead of going alone. ok claudio
2010-10-17Add quirks support to operating system fingerprinting. tcpdump partJoel Sing
by mcbride@. ok mcbride@ henning@
2010-10-11Implement an rtsocket filter for rtableids. A process will initiallyClaudio Jeker
only get messages that are for the rtable the process is bound to. Depending on the rtm_type the rdomain or rtable id are used for comparison. It is possible to change the filter with a setsockopt(s, AF_ROUTE, ROUTE_TABLEFILTER,...) and if set to RTABLE_ANY the filter is deactivated. Additionally set the tableid in struct if_msghdr to the rdomain id and use the process rtableid in the sysctl if no table was specified. OK henning@
2010-10-11Remove some commented code we will never have.Claudio Jeker
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-10-04fp_wscale is only a single byte so do not byteswap it. This makes osClaudio Jeker
fingerprinting on little endian systems work. People using the osfp feature need to update /etc/pf.os or -current will be blocked. OK deraadt@, jsg@, jsing@, millert@, sthen@
2010-09-30Convert printf()'s to DPFDEBUG() macro.Ryan Thomas McBride
ok dlg
2010-09-29pipex_pptp_userland_output() calls always m_pullup() 16 bytes to theYASUOKA Masahiko
GRE message. But when npppd send a ack-only GRE message, the message will be only 12 bytes, so the m_pullup() will fail. call m_pullup() with proper length.
2010-09-29Adjust to the pipex changes introduced during j2k10. Compiles again notClaudio Jeker
sure if all protocols work.
2010-09-28wrap long line. correct indent. delete a useless comment.YASUOKA Masahiko
OK djm@ claudio@ dlg@
2010-09-28replace hand-rolled infinite loop with LIST_FOREACHBret Lambert
ok claudio@ guenther@
2010-09-27must have either PR_WAITOK or PR_NOWAIT set.David Gwynne
2010-09-27a pool_get() assuming that PR_NOWAIT is 0 (not anymore!); run into by naddyTheo de Raadt
2010-09-26Length field in L2TP header was broken.YASUOKA Masahiko
2010-09-24avoid potential infinite loopBret Lambert
ok deraadt@
2010-09-24Add L2TP support to PIPEX.SUENAGA Hiroki
We can use IPv6 address as outer header of L2TP. Kernel ABI is changed. You must update npppd. OK @claudio, yasuoka@, dlg@
2010-09-24Implement if_freenameindex() as a real function as required by posix.Claudio Jeker
OK deraadt@, millert@
2010-09-24itojun picked exactly the right reason in that REASON_SET call. really noHenning Brauer
reason to question himself by adding an XXX
2010-09-24use pd->rdomain for the PF_MISMATCHAW checks in pf_test_fragment instead ofHenning Brauer
hardcoding 0. roughly almost a bit equivalent to what pf_test_rule does. changing the rdomain for not reassembled fragments is not going to work ever, so the full dance pf_test_rule does doesn't make sense here. speaking of sense, I don't see anything remotely resembling sense in pf filtering on fragments without reassembling them first. with/ok claudio
2010-09-24no need to pf_tag_packet in the stateless case in pf_test sinceHenning Brauer
pf_test_rule will have done it already, as correctly XXX-comment noted by claudio almost a year ago. pf_test6 (which is scarily different there) didn't have that at all.
2010-09-24hello, this is captain obvious speaking:Henning Brauer
/* XXX This does NOT affect pass rules! */ SLIST_FOREACH(ri, &s->match_rules, entry) { ... delete that comment, entirely superfluous
2010-09-24remove misleading XXX comment. it is pretty clear by now thatHenning Brauer
pf_compare_state_keys will stay, we play safe.
2010-09-24nicer linewraps, purely cosmeticHenning Brauer
2010-09-24kill some unused arguments to pf_create_stateJonathan Gray
ok henning@
2010-09-23Break out rule counter update code into a separate function, makes theRyan Thomas McBride
behaviour consistent between IPv4 and IPv6. From martin.pelikan@gmail.com
2010-09-23fix indentation to not confusingly align with an unassociated while() statementBret Lambert
ok claudio@
2010-09-23tweak the mclgeti algorithm to behave better under load.David Gwynne
instead of letting hardware rings grow on every interrupt, restrict it so it can only grow once per softclock tick. we can only punish the rings on softclock ticks, so it make sense to only grow on softclock tick boundaries too. the rings are now punished after >1 lost softclock tick rather than >2. mclgeti is now more aggressive at detecting livelock. the rings get punished by an 8th, rather than by half. we now allow the rings to be punished again even if the system is already considered in livelock. without this diff a livelocked system will have its rx ring sizes scale up and down very rapidly, while holding the rings low for too long. this affected throughput significantly. discussed and tested heavily at j2k10. there are still some games with softnet we can play, but this is a good first step. "put it in" and ok deraadt@ ok claudio@ krw@ henning@ mcbride@ if we find out that it sucks we can pull it out again later. till then we'll run with it and see how it goes.
2010-09-23If tunread() fails, we should increment if_oerrors, not if_ierrors.Matthew Dempsky
"yup" deraadt@
2010-09-22Add a new interface pppx(4) -- the ppp multiplexer to be used with npppdClaudio Jeker
and pipex. pppx(4) creates an interface whenever a session is created so that altq and pf can work on these. Started by dlg@ debugged and made usable by myself OK dlg@ yasuoka@ deraadt@
2010-09-22Add AES-GCM Transform Identifiers as specified by IANA inMike Belopuhov
RFC 4106 and 4543. Please note that although IKEv1 and IKEv2 identifiers are different for ESP_NULL_AUTH_AES-GMAC (SADB_X_EALG_AESGMAC), we use the IKEv2 one only (which is 21). ipsecctl(8) will be taught to handle exported SA correctly.
2010-09-22add a new log opt PF_LOG_MATCHESHenning Brauer
forces logging on all subsequent matching rules real ok theo assumed oks ryan and dlg bikeshedding everyone in the room implementation time ~ 1 minute
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 22:54:48 +0000