summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2005-01-13protect pfkeyv2_dump_walker with spltdb(). Noticed by mpech@, thanks!Hans-Joerg Hoexer
ok ho@ markus@
2005-01-08Unslack and increase AUTHNAMELEN, since some ISP's prefer long usernames.Can Erkin Acar
Reported long time ago by Marc Huber and more recently by Steffen Schutz.
2005-01-07Make carp(4) traffic always appear on the physical (carpdev) interfaceRyan Thomas McBride
from pf's perspective. ok pascoe@ dhartmei@ henning@
2005-01-07add support for BIOCGDLTLIST and BIOCSDLT, see bpf(4)Reyk Floeter
ok canacar@, fgsch@, tested by some other people
2005-01-05- Use defines from pfvar.h for timeoutsRyan Thomas McBride
- instead of erroring on an attempt to set hostid to 0, just set it with arc4random() ok henning@ dhartmei@
2005-01-05Define defaults for the timeouts ensure consistency between kernelRyan Thomas McBride
and userland. ok henning@ dhartmei@
2005-01-01Disable timeout before destroying a pppoe interfaceCan Erkin Acar
ok deraadt@, henning@, krw@
2004-12-23Simplify hashtable (de)allocation by moving it into the clone functions.Camiel Dobbelaar
ok mickey@ henning@, "looks good" markus@ jason@
2004-12-22Introduce 'set skip on <ifspec>' to support a list of interfaces where noDaniel Hartmeier
packet filtering should occur (like loopback, for instance). Code from Max Laier, with minor improvements based on feedback from deraadt@. ok mcbride@, henning@
2004-12-20Enforce an ordering on ifnet such that CARP interfaces appear later in theChristopher Pascoe
list than physical interfaces. This makes ifa_ifwith* prefer a physical interface over a CARP one. This addresses the problem where a CARP interface in BACKUP state is selected after a route change, resulting in a loss of communications despite there being another interface available which is perfectly usable. ok mcbride@ mpf@
2004-12-19Make it possible for carp to work on fddi and token ring again.Ryan Thomas McBride
ok pascoe@ mpf@
2004-12-17ICMP state entries use the ICMP ID as port for the unique state key. WhenDaniel Hartmeier
checking for a usable key, construct the key in the same way. Otherwise, a colliding key might be missed or a state insertion might be refused even though it could be inserted. The second case triggers the endless loop fixed by 1.474, possibly allowing a NATed LAN client to lock up the kernel. Report and test data by Srebrenko Sehic.
2004-12-17knf cleanup, convert old k&r-style functions to ansi-style for aReyk Floeter
consistent style in sys/net/bpf.c. ok henning@, "looks fine" canacar@
2004-12-17Reorder code in the ethernet output path, and enhance unicast addressChristopher Pascoe
matching in the bridge receive path to make CARP operate correctly on physical interfaces that are participating in a bridge. ok mcbride@ henning@ dlg@
2004-12-16Clean up handling of sync_flags.Ryan Thomas McBride
ok pascoe@
2004-12-14move the ioctls w/ all the other ifaces; mcbride@ okMichael Shalayeff
2004-12-14Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,Ryan Thomas McBride
prevents a possible endless loop in pf_get_sport() with 'static-port' Reported by adm at celeritystorm dot com in FreeBSD PR74930, debugging by dhartmei@ ok dhartmei@
2004-12-13move splsoftnet() below ACCEPT_FLAGS(), which contains a potential return.Daniel Hartmeier
from Max Laier.
2004-12-13Set creation timestamps correctly on states learnt by pfsync that areChristopher Pascoe
more than a second old. ok mcbride@ henning@
2004-12-11SADB_X_EXT_LIFETIME_LASTUSE is always definedMarkus Friedl
2004-12-11pass out the correct lifetime type on expireMarkus Friedl
2004-12-11count SADB_REGISTER only once per socketMarkus Friedl
2004-12-11Handle errors in pf_route{,6} more gracefully.Marco Pfatschbacher
Proposed by mcbride. ok henning@, mcbride@
2004-12-10Rename carp_output() to carp_fix_lladdr().Ryan Thomas McBride
2004-12-10allow pf to filter on route labelsHenning Brauer
pass in from route dtag keep state queue reallyslow tested by Gabriel Kihlman <gk@stacken.kth.se> and Michael Knudsen <e@molioner.dk> and ryan ok ryan
2004-12-10fix ipsec crash from pr 4025, Stefan Miltchev; ok hshoexer@Markus Friedl
2004-12-10Run address change notification hooks when the interface address is updated.Christian Weisgerber
Notably, this fixes "(pppoe0)" in pf. ok markus@
2004-12-09Remove shadow variable 'error'. From camield@Ryan Thomas McBride
2004-12-08Call if_down() in if_clone_destroy(). Based on diff from Chris Pascoe.Ryan Thomas McBride
ok markus@
2004-12-08Check if_type in carp_carpdev_state() to make sure we're notRyan Thomas McBride
dealing with a carp interface.
2004-12-07Convert carp(4) to behave more like a regular interface, much in the sameRyan Thomas McBride
style as vlan(4). carp interfaces no longer require the physical interface to be on the same subnet as the carp interface, or even that the physical interface has an adress at all, so CARP can now be used on /30 networks. ok deraadt@ henning@
2004-12-07KNFRyan Thomas McBride
2004-12-07KNFRyan Thomas McBride
2004-12-07re-commit mcbride@'s 'flush global', this time without the breakage inDaniel Hartmeier
pfvar.h. builds kernel and userland.
2004-12-07tree does not compile, spotted by dlg (not obvious how to fix)Theo de Raadt
---- Change the default for 'overload <table> flush' to flush only states from the offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-07Change the default for 'overload <table> flush' to flush only states from theRyan Thomas McBride
offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-06support max-src-conn-rate with synproxy, ok mcbride@Daniel Hartmeier
2004-12-06Check a NULL dereference before it could happen.Marco Pfatschbacher
ok mcbride@
2004-12-06At PFSYNC_ACT_CLR:Marco Pfatschbacher
Also purge states with an empty ifname. ok mcbride@
2004-12-05IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6Daniel Hartmeier
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing the header chain. In the case where headers are skipped, the protocol checksum verification used the wrong length (included the skipped headers), leading to incorrectly mismatching checksums. Such IPv6 packets with headers were silently dropped. Reported by Bernhard Schmidt. ok mcbride@
2004-12-05after attaching an overload table, set its active flag. otherwise, theDaniel Hartmeier
table is not visible/accessible when the rule is the only reference (you don't HAVE to reference the table elsewhere).
2004-12-04use C comments.Markus Friedl
2004-12-04Add kernel code to keep track of tcp connections which have completedRyan Thomas McBride
the 3-way handshake. Allow limits on both total connections and connection rate, put offenders in a table which can be used in the ruleset, and optionally kill existing states. Rate tracking code from dhartmei@. Adds a second pool for table entries using the default allocator, which allows entries to be added at splsoftnet(). ok deraadt@ dhartmei@
2004-12-03do not use one struct timeout for the if congestion stuff, but embedHenning Brauer
a struct timeout to struct ifqueue so that each one has its own - it is a per-queue thing. from chris pascoe
2004-12-01replace finer-grained spl locking in pfioctl() with a single broad lockDaniel Hartmeier
around the entire body. this resolves the (misleading) panics in pf_tag_packet() during heavy ioctl operations (like when using authpf) that occur because softclock can interrupt ioctl on i386 since SMP. patch from camield@. ok mcbride@, henning@ and (presumably ;) bob@
2004-11-30missing $OpenBSDMarkus Friedl
2004-11-29tiny knf, no binary change.Hans-Joerg Hoexer
ok otto jsg henning pat markus deraadt fgs
2004-11-29plug memory leaks on errorPatrick Latifi
ok canacar markus millert
2004-11-29remove old header. everything should use net80211/ stuff.Federico G. Schwindt
as for the ports, i could only find one. if there are more, they will be fixed in the tree as discussed with peter. deraadt@ pvalchev@ ok.
2004-11-29put text after #endif in comment (compile w/ gcc3)Peter Valchev
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-23 04:21:20 +0000