summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2012-08-21Reverse the name and meaning of the IFXF_INET6_PRIVACY interfaceAlexander Bluhm
flag. It is now called IFXF_INET6_NOPRIVACY. So IPv6 privacy addresses are on by default without resetting the flag during ifconfig down/up. OK stsp@, sperreault@ (who wrote the same diff)
2012-07-26rename all_state_flags to state_flags to finish the transitionMike Belopuhov
to the 16 bit flags; reminded by claudio, ok henning
2012-07-24decls before codeTheo de Raadt
2012-07-23Call sppp_clear_ip_addrs from a workq. Problem reported by RD Thrush andStuart Henderson
LEVAI Daniel, diagnosed by matthew@, original diff from RD Thrush, cleaned up by me with feedback from mikeb@. OK mikeb dcoppa deraadt
2012-07-17use IPsec flowinfo on pipex(4) to select the IPsec tunnel for sendingYASUOKA Masahiko
L2TP packets. ok markus henning
2012-07-16add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)Markus Friedl
can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
2012-07-13Use NULL instead of 0 in pointer context. approvedz blambert@Claudio Jeker
2012-07-13remove confuzzling commentHenning Brauer
:dlg: the xxx can go ...and this time commit to the real repo and not the one on my laptop
2012-07-10With address family translation, the ip length of the quoted ipAlexander Bluhm
packet within the icmp error packet was wrong. Fix this by using the pd2.tot_len of the inner packet and substract the old header's length. OK mikeb@ henning@
2012-07-10Place declarations for internal radix functions inside radix.c, stopBret Lambert
exporting them to the outside world via radix.h. ok claudio@ sthen@ henning@
2012-07-10define a PFSTATE_SCRUBMASK. relying on numeric order of flags is stupidHenning Brauer
and bound to break sooner or later.
2012-07-09Enable support for the 'weight' keyword in the 'least-states'Joerg Zinke
load balancing case, this allows Weighted Least States (WLS). Everything prepared on c2k11 with help from mcbride@. This finally makes PF ready for the cloud. ok henning@ mikeb@ pyr@
2012-07-08there was a limit on the number of pflog interfaces - 16. remove that.Henning Brauer
mostly by dynamically allocating pflogifs instead of making that a static array. ok claudio zinke
2012-07-07rename prio in struct pf_rule and related structs to set_prio so it isHenning Brauer
utterly clear this is not a filter criteria but a packet modification thing. also preparation for upcoming changes, including one to unscrew this mess (I should not have to touch half the tree for this - ifixitlater) not user visible, ok gcc
2012-07-07restore DIOCKILLSTATE semantics to what they were before the NAT rewrite.Henning Brauer
when you kill states by IP, it is not all that clear which IP we're talking about - before or after rewriting? the old semantics were to always look at the "original" IP, i. e. before rewriting. ever since the NAT rewrite we were unconditionally looking at the wire side state key, which is the original address for PF_IN states, but not for PF_OUT. So look at the SK_STACK state key in the PF_OUT case. should fix "authpf doesn't remove NAT states" seen on misc a while ago ok & testing & half of the analysis bob (he sez beck)
2012-06-30Fix a number of problems introduced by the link state handling commit:Mike Belopuhov
1) demote by 32 on the first bulk update to prevent failovers w/o having a full state table; 2) don't do any demotion adjustments on the link up event and undemote when bulk update finishes (or times out) preventing a race between nodes getting a link state update asynchronously. With phessler; tested by phessler and Kapetanakis Giannis. Thanks! Looked through by henning and dlg. Now the correct version.
2012-06-30backout rev1.185 as it's not what i have intended to commitMike Belopuhov
2012-06-29add ESN-related bits missed in the previous commitMike Belopuhov
2012-06-29Add support for the Extended (64-bit) Sequence Number as definedMike Belopuhov
in RFC4302 and RFC4303. Right now only software crypto engine is capable of doing it. Replay check was rewritten to implement algorithm described in the Appendix A of RFC4303 and the window size was increased to 64. Tested against OpenBSD, Linux (strongswan) and Windows. No objection from the usual suspects.
2012-06-28Fix a number of problems introduced by the link state handling commit:Mike Belopuhov
1) demote by 32 on the first bulk update to prevent failovers w/o having a full state table; 2) don't do any demotion adjustments on the link up event and undemote when bulk update finishes (or times out) preventing a race between nodes getting a link state update asynchronously. With phessler; tested by phessler and Kapetanakis Giannis. Thanks! Looked through by henning and dlg.
2012-06-26initialize 'reason' variable before passing it to the pflog_packet;Mike Belopuhov
from david hill; ok henning
2012-05-12Ignore/preserve ECN bits on ToS matching and scrubbing.Marco Pfatschbacher
The lower 2 bits of the tos-header are used for ECN. (http://tools.ietf.org/html/rfc2474#section-3) OK henning@, haesbaert@
2012-05-12Fix tcpdump for etherip packets.Marco Pfatschbacher
bpf_mtap() needs to be called without the etherip_header. Idea to use a forward declaration for struct tdb by claudio. OK claudio@
2012-05-09backout 1.134 since it introduced a use-after-free for routing entries;Markus Friedl
ok blambert@ sthen@ henning@ claudio@
2012-05-05pipex_ip6_input() called IF_DROP() with incorrect queue.YASUOKA Masahiko
diff from blambert
2012-04-22Remove redundant returns from functions returning void. Wrap returnYASUOKA Masahiko
values in () for consistency. diff from Michael W. Bombardieri. ok sthen dlg mikeb
2012-04-14Use DLT_LOOP for all tunneling interfaces.YASUOKA Masahiko
Byte order adjustment for bpf was hidden behind bpf_mtap_af() and sizeof(u_int32_t) is used for length of the bpf header. tested by sebastia and mxb at alumni.chalmers.se. ok claudio
2012-04-11fix all the suser calls which pass an incorrect p_acflag argument;Mike Belopuhov
figured out by and ok guenther
2012-04-11SLIST_REMOVE_NEXT -> SLIST_REMOVE_AFTER for better consistency andChristian Weisgerber
compatibility with FreeBSD/NetBSD. Also rename SIMPLEQ_REMOVE_NEXT to SIMPLEQ_REMOVE_AFTER. ok mikeb@ guenther@
2012-04-07remove superfluous return, ok mikebCamiel Dobbelaar
2012-04-04pipex hook in udp_usrreq() mistakenly assumed that `inp' is connected.YASUOKA Masahiko
It could not use the destination address properly, so it failed to find the pipex session. This bug caused LCP keepalive failures on some clients. found and tested by sebastia@ and mxb at alumni.chalmers.se. ok sthen
2012-04-03Fix kernel compilation with pf but without pfsync pseudo-device byMike Belopuhov
moving the state export functionality from pfsync code into pf. Based on the initial diff diff by guenther, ok henning.
2012-03-28pfkey needs some p_p->ps_pid too. OK deraadt@ guenther@Claudio Jeker
2012-03-28Another pid that needs to be the process pid and not the thread one.Claudio Jeker
OK deraadt@, guenther@
2012-03-28More p_pid to p_p->ps_pid updates. OK deraadt@, guenther@Claudio Jeker
2012-03-28Use p_p->ps_pid as pid in the route header instead of the thread pid. GiveClaudio Jeker
userland a chance to compare the value against getpid(). This unbreaks transmission for me. OK deraadt@, guenther@
2012-03-26Add DLT_PPP_SERIAL and DLT_C_HDLC to bpf.h even though the system will notClaudio Jeker
generate such packets but it helps porting applications that assume that these are available on any system. Requested by dhill long time ago.
2012-03-17remove IP_JUMBO, SO_JUMBO, and RTF_JUMBO.David Gwynne
no objection from mcbride@ krw@ markus@ deraadt@
2012-02-05Improve the ICMPv6 direction checkMike Belopuhov
Following bluhm's advice this changes the way we setup state keys and perform state lookups for ICMPv6 Neighbor Discovery packets: - replace the NS-dst with ND target address; - replace the NA-src with ND target address; - replace the NA-dst with unspecified address if it is a multicast. This allows pf to match Address Resolution, Neighbor Unreachability Detection and Duplicate Address Detection packets to the corresponding states without the need to create new ones or match unrelated ones. As a side effect we're doing now one state table lookup for ND packets instead of two. Fixes a bug uncovered by one of the previous commits that virtually breaks IPv6 connectivity after few minutes of use. ok stsp henning, with and ok bluhm
2012-02-03The kernel did not compile without INET6. Put some #ifdefs intoAlexander Bluhm
pf to fix that. - add #ifdef INET6 in obvious places - af translation is only possible with both INET and INET6 - interleave #endif /* INET6 */ and closing brace correctly - it is not necessary to #ifdef function prototypes - do not compile af translate functions at all instead of empty stub, then the linker will report inconsistencies - pf_poolmask() actually takes an sa_family_t not an u_int8_t argument No binary change for GENERIC compiled with -O2 and -UDIAGNOSTIC. reported by Olivier Cochard-Labbe; ok mikeb@ henning@
2012-02-02add netflow v9/ipfix support to pflow(4).Sebastian Benoit
large parts written by Florian Obser (florian -at- narrans -dot- de). feedback from sperreault@ gollo@ sthen@ ok from gollo@ dlg@ henning@
2012-01-31add missing calls to pf_pkt_addr_changed(); ok henning@Markus Friedl
2012-01-29Remove fastq from struct sppp. Missed when I committed if_spppsubr.c r1.96,Stuart Henderson
pointed out / ok mikeb@
2012-01-28improve icmp virtual id generation for ND and MLD packets so thatMike Belopuhov
two consecutive host addresses won't generate the same value which is used as a port number in state entries; ok bluhm, sperreault
2012-01-28try to lookup the icmp state based on a correct packet descriptor;Mike Belopuhov
ok bluhm, henning
2012-01-28Remove a horrible sppp(4)-specific "fast queue" used for tcp ports 21 23 513.Stuart Henderson
You should use the proper queues via pf instead. ok phessler@ henning@
2012-01-27If some length checks in pflog_bpfcopy() failed, the functionAlexander Bluhm
returned early. As a result tcpdump -i pflog0 printed uninitialized kernel memory for short packets. Fix this by copying the mbuf data we have if we cannot decode the packet. ok mikeb@ henning@
2012-01-26Clean up the pf normalization code:Alexander Bluhm
- Let pf_normalize_ip() and pf_normalize_ip6() take the struct pf_pdesc pd as argument. - Always check wether the mbuf got NULL after normalization to make the code more robust. - Make the code structure of pf_normalize_ip6() more like pf_normalize_ip() to make the differences obvious. ok henning@
2012-01-26Minor fixes for pf_walk_header6():Alexander Bluhm
- Fragment offset is in network byte order. - Check for legal short fragments before calling pf_pull_hdr() to avoid bogus reason accounting. - When checking wether the protocol header is within the fragment, count the IPv6 payload length relative to the end of the IPv6 header. ok henning@
2012-01-26when table content changes we need to reset indexMike Belopuhov
to the initial value and do not use the counter; reported by Sebastian Benoit and Daniel Krambrock, tested by Sebastian Benoit, ok henning zinke
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-12 09:00:58 +0000