summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2013-05-11Set trunk(4)'s MTU to that of the first trunkport. Allows trunk to work withStuart Henderson
jumbo/baby-jumbo frames. To avoid problems with mismatches between trunkports, any additional ports must have the same MTU as already set on the trunk(4). Based on changes made in FreeBSD. Tested by myself and jj@, ok reyk@
2013-05-10Since pf_state_key_attach can decide to free the provided stateMike Belopuhov
key we need to sync our state key pointers with whatever values the function will pick. Not doing so will produce wrong results if address translation must be applied afterwards and we happen to have a state key collision. Then pf_translate will follow an old pointer and punch in garbage addresses into the packet. Noticed, initial patch and tests by Vitaly Sinilin <vs @ kp4 ! ru> ok tedu, henning
2013-05-03Export ingress/egress interface index in pflow(4).Florian Obser
Report that this is needed for some netflow collector and tests by Chris Ivancic & Colin Ligertwood. OK mikeb@, benno@
2013-04-20Remove unused macro function.YASUOKA Masahiko
diff from Michael W. Bombardieri.
2013-04-16Remove code under ifndef OpenBSD. No object change.Martin Pieuchot
2013-04-16When pipex session is terminated by idle timer, there was a problem thatYASUOKA Masahiko
the session is removed from the pipex_closed_wait_list twice, fixed it. It always causes panic because QUEUE_MACRO_DEBUG is enabled by default. Also remove some needless (struct pipex_session *) casts.
2013-04-10Remove various external variable declaration from sources files andMartin Pieuchot
move them to the corresponding header with an appropriate comment if necessary. ok guenther@
2013-04-10Fix various glitches in queue macro usage.Philip Guenther
ok millert@
2013-04-02Instead of storing the link-level address of every interface in a globalMartin Pieuchot
array indexed by interface numbers, add a new field to the interface descriptor pointing to it. claudio@ and todd@ like it, ok mikeb@
2013-03-29Declare struct pf_state_key in the mbuf and in_pcb header files toAlexander Bluhm
avoid ugly casts. OK krw@ tedu@
2013-03-29Replace hand-crafted loops in if.c with the FOREACH macro.Alexander Bluhm
OK tedu@ claudio@
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2013-03-28do not include machine/cpu.h from a .c file; it is the responsibility ofTheo de Raadt
.h files to pull it in, if needed ok tedu
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-28Replace some casts to struct in_ifaddr pointer by ifatoia() or NULL.Martin Pieuchot
ok millert@, haesbaert@, bluhm@
2013-03-28Unfortunately the satosin, sintosa, ifatoia, satosin6, sin6tosa,Alexander Bluhm
ifatoia6 macros do not check the source type. They just cast anything. Remove needless casts and do not use those macros if the source type does not match. Remove duplicate defines. No binary change. OK kettenis@ krw@
2013-03-27Use the correct src/dst ports depending on direction (one of src or dst wasRyan Thomas McBride
wrong in each direction). Report and fix from UMEZAWA Takeshi <umezawa@iij.ad.jp>
2013-03-26Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.Martin Pieuchot
ok beck@, mikeb@
2013-03-20Introduce if_get() to retrieve an interface descriptor pointer givenMartin Pieuchot
an interface index and replace all the redondant checks and accesses to a global array by a call to this function. With imputs from and ok bluhm@, mikeb@
2013-03-15change LIST_END to literal NULL for clarity.Ted Unangst
ok claudio mpi
2013-03-14tedu faith(4), suggested by todd@ some weeks ago after a submission byMartin Pieuchot
dhill. ok krw@, mikeb@, tedu@ (implicit)
2013-03-11Add a separate "translation" counter and use this rather than "memory"Stuart Henderson
when address translation fails due to no free ports in the configured range. ok mikeb@
2013-03-10Switch to ANSI C prototypes. Diff by somebody else which I no longer remember.Claudio Jeker
No binary change.
2013-03-09re-arrange the pre-accounting of the objects in the buffer so itTheo de Raadt
is clearer; ok sthen
2013-03-09normalize structure definitionsTheo de Raadt
2013-03-07Remove unused ifa_ifwithaf() function.Martin Pieuchot
ok mikeb@, miod@
2013-03-07Remove the IFAFREE() macro, the ifafree() function it was calling alreadyMartin Pieuchot
check for the reference counter. ok mikeb@, miod@, pelikan@, kettenis@, krw@
2013-02-26Don't try to purge one-time rules from the main ruleset.Mike Belopuhov
Reported by Wesley M.A. on misc@, ok deraadt
2013-02-26Reserve space for source and destination addresses unconditionally ratherStuart Henderson
than checking if they're zero - export_address() is always called for these. Fixes memory corruption when doing ipsecctl -ssa with md5sig. Debugging hints from deraadt@, ok kettenis@ deraadt@
2013-02-25trunk_bcast_start sent packets on all its member interfaces by copyingDavid Gwynne
the mbuf it just sent on the previous interface. this is bad because the previous interface could have modified the mbuf chain, which can make the subsequent m_copym()s panic. this copies the dance that rtsock.c does for broadcasting mbufs which copies the mbuf before transmit, except for the last interface which it handles outside the loop. tested by halex@ who verified it fixes his panic. ok claudio@ deraadt@
2013-02-18DIOCRCLRASTATS ioctl wasn't specifying a timestamp when clearedMike Belopuhov
table statistics so it appeared later on as the Epoch. Noticed by [the] Shining on bugs@. Thanks! ok sthen, waver from deraadt
2013-02-13Pipex did panic when the 0 length mppe is given by ioctl. ReturnYASUOKA Masahiko
EINVAL instead of panic. Also npppd called ioctl with the invalid argument because of the bugs introduced by the config parser change commit. Fixed those bugs and make sure not to use 0 length keys for MPPE. reported by csszep at gmail and giovanni ok giovanni
2013-02-06add pppx(4) interfaces to the "pppx" interface group, as done for variousStuart Henderson
other interface types. suggested/tested Mattieu Baptiste, ok dlg@ yasuoka@ giovanni@, ifconfig(8) reminder jmc@
2013-02-05netflow v10 omitted the sysUpTime flow set header field fromFlorian Obser
v9. Without it it's not possible to find out at what time a flow started/ended with only flowStartSysUpTime/flowEndSysUpTime. Fix this by using flowStartSeconds/flowEndSeconds for v10. Problem reported by Chris Ivancic and Colin Ligertwood, analyzed by benno@ Tested by benno@ against nprobe (which doesn't care that much one way or the other) Tested by Chris Ivancic against solarwinds collector. OK benno@
2013-01-23Change interface and span interface lists from LIST to TAILQ.Camiel Dobbelaar
This way the configuration order is preserved. Order matters because MAC address are not unique: vlan interfaces can have the same MAC as their parent. Frames destined for the bridge itself are now delivered to the first-configured interface that matches the MAC instead of the last-configured. This means that the bridge behavior does not suddenly change anymore when adding a vlan interface. ok henning reyk (a while ago)
2013-01-20Make pf TCP sequence number tracking less strict by one octet forAlexander Bluhm
FIN packets. The data of a TCP packet must fit into the announced window, but this is not required for the sequence number of the FIN. A packet with the FIN bit set and containing data that fits exactly into the announced window was blocked. Our stack generates such packets when the receive buffer size is set to 1024. Now pf uses only the data lenght for window comparison. OK henning@
2013-01-18Relax the restriction on sending frames to trunk(4) members to allow BPF writes.Stuart Henderson
Method (checking for PACKET_TAG_DLT) suggested by claudio, ok mpf
2013-01-17hardwire SLIP_HIWAT to 100 (as the comment above suggests) since we areTheo de Raadt
using tty ring buffers instead of clists ok kettenis
2013-01-17first or second coming, commie or not commie, one m in coming is sufficientHenning Brauer
ok claudio
2013-01-16switch from using softclock ticks to getnanotime when putting time on theDavid Gwynne
wire for v5 packets. ok (and lots of gentle prodding from) florian@
2013-01-16Unbreak the negation toggle code when re-loading pf tables. OtherwiseMarkus Friedl
negating existing entries on re-load does not work (e.g. changing 192.168.6.0/24 to !192.168.6.0/24 in table was ignoed). ok mikeb@, henning@ mpf@, bluhm@,
2012-12-29make sure the entry from tree_src_tracking is still in the pool;Markus Friedl
fixes nat with sticky address and ip address change on pppoe(4) for example; ok henning@, zinke@; mikeb@
2012-12-29reset the counter in case its current value has been removedMarkus Friedl
from the pool (e.g. ifconfig em0 1.2.3.4 -alias) ok henning@, mikeb@
2012-12-29pass pf_pool directly to pfr_pool_get(); simplifies the API;Markus Friedl
ok henning@, zinke@, mikeb@
2012-12-28change the malloc(9) flags from M_DONTWAIT to M_NOWAIT; OK millert@Gleydson Soares
2012-12-22Return EEXIST to 'add' when a port is already a bridge member. This makesCamiel Dobbelaar
reconfiguration with /etc/netstart silent again. (noticed by deraadt) And do the same for 'addspan'. ok deraadt
2012-12-21Rather than calling mircotime in bpf_catchpacket each time it's calledMike Belopuhov
on a packet, make bpf_catchpacket take a timeval indicating when the packet was captured. Move microtime to the calling functions and grab the timestamp as soon as we know that we're going to call catchpacket at least once. From NetBSD, ok deraadt, claudio, sthen
2012-12-21bpf allocates packet buffers in the ioctl path and can sleepMike Belopuhov
waiting for memory to become available obtained from netbsd with tweaks, with input from deraadt and blambert, ok deraadt, claudio
2012-12-14oops, debug printf sneaked in. i must be out of practice.David Gwynne
spotted by krw@, poked by jmatthew@
2012-12-13pipex_init can be called multiple times (by whatever subsystems want to useDavid Gwynne
it), so return early if the work has already been done. ok yasuoka@ jmatthew@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-12 15:54:30 +0000