summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2018-11-14Batch copyout(9)s in preparation for finer locking.Martin Pieuchot
Tested by Hrvoje Popovski, inputs and ok visa@
2018-11-14remove the encapsulation headers before looking at the inner headersDavid Gwynne
it works less well when you look before the adj
2018-11-14revert 1.121. i got confused between ecn on ingress and egressDavid Gwynne
2018-11-14get ecn ingress args the right way round. again.David Gwynne
2018-11-14use the txprio setting to populate the tos in keepalive packets.David Gwynne
the mbuf prio will still be set according to the llprio value, but the tos on the packet may be forced to a specific number by txprio
2018-11-14according to ip_ipip.c, rfc1853 says not to copy the ttl on decapsulationDavid Gwynne
rfc1853 is about IP in IP Tunneling. rfc2003 about IP Encapsulation within IP agrees.
2018-11-13get the inner and outer tos values right for passing to ip_ecn_ingressDavid Gwynne
2018-11-13add txprio support to gre, mgre, egre, nvgre, and eoipDavid Gwynne
for l3 interfaces (gre and mgre), allow txprio from the payload, the mbuf, or a hardcoded value. for l2 interfaces (egre, ngre, and eoip), get txprio from the mbuf or a hardcoded value. ok claudio@
2018-11-13add txprio setting supportDavid Gwynne
gif encaps l3, so it can get a prio from the payload, as well as from the mbuf itself, or a hardcoded value. ok claudio@
2018-11-12add txprio supportDavid Gwynne
etherip puts the prio in the encapsulating ip header, and supports using hardcoded prio values or the prio from the mbuf. it encapsulates ethernet, which doesnt have a prio field unelss you parse the ether payload, which is not worth it. ok claudio@
2018-11-12only let root configure the txprio setting on an interfaceDavid Gwynne
ok claudio@
2018-11-12add ifreq bits for the tx header prio field ioctlsDavid Gwynne
a tx header prio can set to a fixed value from 0 to 7, or magic values to represent populating the prio field from the encapsulated packet, or from the mbuf prio value. ok claudio@
2018-11-12Add new routing socket message RTM_80211INFO to provide details ofKenneth R Westerback
802.11 interface state changes (e.g. SSID) to interested parties. Original diff from phessler@. Many suggestions and tweaks from claudio@, stsp@, anton@. ok claudio@ stsp@ anton@ phessler@
2018-11-12set the hardmtu on ether encap ifs so the mtu can be raised above 1500David Gwynne
2018-11-12limit the number of interface units to the number of device minorsDavid Gwynne
this prevents creation of tap and tun devices that you cannot open from userland because of the limit on the number of dev_t minor numbers. the lack of limit was pointed out by Greg Steuck ok deraadt@ guenther@
2018-11-11copy the mpls cos and use it as the ip dscp/tos/tclass thing.David Gwynne
2018-11-11when encapsulating mpls, map the mpls qos value to an ip tos.David Gwynne
2018-11-11actually use the if_llprio to set the mbuf prio.David Gwynne
the llprio is already used to set the gre and eoip packet tos/tclass, but it was queued at the default prio before this.
2018-11-11use the llprio on gre(4) and eoip(4) interfaces for the keepalive tosDavid Gwynne
llprios are valued 0 to 7, while the ip tos/dscp/tclass is an 8 bit value. fortunately the high 3 bits map nicely to the llprio values, so we shift the llprio into place when generating the keepalive frames. the llprio is defaulted to the value that cisco uses for their gre keepalives.
2018-11-09M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forClaudio Jeker
m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
2018-10-29use the tunnelttl in the ip6 encap too, not ip6_defhlim.David Gwynne
2018-10-26Make it clear that `if_bridgeport' is dereferenced in the ioctl pathMartin Pieuchot
by making all handlers consistent. ok bluhm@, visa@
2018-10-25start both the sc_ka_send and sc_ka_hold timeout whenDavid Gwynne
the timeout gets configured instead of gre_up(). this avoids complex gre_ioctl() ordering rules and enables the sc_ka_hold timeout before the first packet is received. from markus@
2018-10-23Make pf compile without DIAGNOSTIC againReyk Floeter
OK bluhm@ kn@
2018-10-22Don't let HFSC force the packet priority to 7 when enabledDavid Gwynne
HFSC on a vlan(4) (or similar) interface caused all packets over that interface to get marked with the highest packet priority, no matter what the rest of the system said about it. Leaving the prio alone lets the rest of the network still do something useful, not matter whether the local system queues packets in a particular way. Reported by and fix tested by Adrian Close ok claudio@ kn@ mikeb@
2018-10-22Rename 'bridge_iflist' variables for coherency, missed in previous.Martin Pieuchot
2018-10-18provide a default case for all switch statements handling address familiesDavid Gwynne
from markus@
2018-10-18make sure keepalive ioctl values are either both zero, or both not zero.David Gwynne
2018-10-18make sure the tunnel is configured in gre_keepalive_sendDavid Gwynne
check sc_tunnel.t_af for AF_UNSPEC, otherwise we panic in gre_encap() from markus@
2018-10-18move the timeout_add in gre_keepalive_send up.David Gwynne
gre_keepalive_send() should re-schedule immediately, otherwise we stop sending keepalive on temporary mbuf shortage or if the configuration is incomplete. from markus@
2018-10-18Process incoming gre(4) keepalives early to avoid bpf seeing them.David Gwynne
The packet processing done after the protocol detection effectively gets thrown away by the keepalive handling, so this saves some time, and avoids confusing tcpdump on the interface. Keepalives the driver transmits aren't made available for bpf, so taking it away from the receive side is consistent. discussed with and tested by markus@
2018-10-16- pf: honor quick on anchor rulesAlexandr Nedvedicky
Regression has been introduced in version 1.1024 (a 6.2 time frame). It's been discovered and reported by Fabian Mueller-Knapp. Fair amount of credit goes to kn@, benno@ and henning@ for pointing me to releveant section of pf.conf(5). Fabian and kn@ also did test the patch. OK kn@, henning@
2018-10-16pull and put the traffic class in ipv6 headersDavid Gwynne
this gives ipv6 handling equivalent the tos stuff in ipv4. ok visa@ benno@
2018-10-15use PFR_RB_NONE consistentlykn
Replace hardcoded 0 and implicit checks with enum as done in all other use cases of `pfra_fback'. No object change. OK sashan
2018-10-04Honor quick on anchor ruleskn
When evaluating the anchor's ruleset, prevent clobbering it's very own `quick' test result by blindly setting it. This makes the following pf.conf work as intended (packets would be blocked since `quick' had no effect): anchor quick { pass } block Broken since after 6.1 release as reported by Fabian Mueller-Knapp, thanks! OK henning sashan
2018-10-03Fix a race condition that affects pfsync interface deletion.Visa Hankala
When a pfsync interface is being deleted, all its timeout handlers and pfsync_send_dispatch() have to stop accessing the software context before the context is freed. Ensure sufficient synchronization by acquiring NET_LOCK() and clearing `pfsyncif' inside the critical section in pfsync_clone_destroy(). When a timeout handler has entered the critical section, it has to check `pfsyncif' and bail out if the value is NULL. pfsync_send_dispatch() already does this check. Issue reported and fix tested by Hrvoje Popovski. OK mpi@ bluhm@
2018-10-02- pfsync: avoid a recursion on PF_LOCKAlexandr Nedvedicky
OK bluhm@
2018-10-01Allow DIOCRGETADDRS when securelevel(7) > 1kn
This fixes certain operations such as `pfctl -t foo -T show' when the system is in "Highly secure mode". `pfctl -t foo -T show -v' would already work due to a different ioctl (DIOCRGETASTATS) being used. Reported by Zbyszek Żółkiewski, thanks! OK sthen sashan
2018-10-01Put bridge_input & output back under the KERNEL_LOCK().Martin Pieuchot
Wireless drivers call if_enqueue() out of the NET_LOCK() so it cannot be used to serialize bridge(4) states. Found by stsp@, ok visa@
2018-09-27Coherently name "struct bridge_iflist" variables `bif'.Martin Pieuchot
ok visa@
2018-09-27Make sure the L2 entry is cloned before dereferencing its parent.Martin Pieuchot
RTF_LOCAL entries or static ARP entries don't have parents, so the logic was incorrect. Note that it might be possible to extend the logic to work with non-cloned L2 entries but the few use cases do not justify the complexity (yet). Problem reported & fix tested by Elie Bouttier. ok bluhm@, visa@, claudio@
2018-09-26Move bridge input/output paths outside of the KERNEL_LOCK().Martin Pieuchot
Tested by Hrvoje Popovski who measured a 30% improvement of forwarded packets in the best case. ok visa@
2018-09-19Always call bridge_iflist `bif'.Martin Pieuchot
ok bluhm@, visa@
2018-09-13Add reference counting for inet pcb, this will be needed when weAlexander Bluhm
start locking the socket. An inp can be referenced by the PCB queue and hashes, by a pf mbuf header, or by a pf state key. OK visa@
2018-09-12Stop exporting TDB counters to userland, this change introduced aMartin Pieuchot
regression with iked(8). Reported by Mark Patruck.
2018-09-12Fix obvious cut&pasto in comment (ifa_msghdr -> if_announcemsghdr).Kenneth R Westerback
ok claudio@
2018-09-11Nuke some trailing spaces that wandered into theKenneth R Westerback
crosshairs.
2018-09-11- moving state look up outside of PF_LOCK()Alexandr Nedvedicky
this change adds a pf_state_lock rw-lock, which protects consistency of state table in PF. The code delivered in this change is guarded by 'WITH_PF_LOCK', which is still undefined. People, who are willing to experiment and want to run it must do two things: - compile kernel with -DWITH_PF_LOCK - bump NET_TASKQ from 1 to ... sky is the limit, (just select some sensible value for number of tasks your system is able to handle) OK bluhm@
2018-09-10- if_cloners list populated at boot time only then becomes immutable,Alexandr Nedvedicky
so we can let go if_cloners_lock. OK tb@, claudio@, bluhm@, kn@, henning@
2018-09-10Instead of calculating the mbuf packet header length here and there,Alexander Bluhm
put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 23:57:10 +0000