summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2004-06-14Remove DIOCBEGINRULES, DIOCCOMMITRULES, DIOCBEGINALTQS, DIOCCOMMITALTQS,Cedric Berger
DIOCRINABEGIN, DIOCRINACOMMIT ioctls. Use DIOCXBEGIN/DIOCXCOMMIT/DIOCXROLLBACK instead. ok beck@ dhartmei@ henning@
2004-06-14de-__PTheo de Raadt
2004-06-13debranch SMP, have funNiklas Hallqvist
2004-06-11Eliminate a dereference after pool_put when an inactive/no-longer referencedRyan Thomas McBride
table is destroyed in pfr_setflags_ktable. Fix from Chris Pascoe
2004-06-10rename struct pf_rule_addr member 'not' to 'neg', as 'not' is a reservedDaniel Hartmeier
keyword in C++. ok henning@, cedric@
2004-06-07Make deletion of a few addresses much faster on big tables. ok claudio@Cedric Berger
2004-06-06extend routing table to be able to match and route packets based onCedric Berger
their *source* IP address in addition to their destination address. routing table "destination" now contains a "struct sockaddr_rtin" for IPv4 instead of a "struct sockaddr_in". the routing socket has been extended in a backward-compatible way. todo: PMTU enhancements, IPv6. ok deraadt@ mcbride@
2004-06-04Remove the multicast address when we unconfigure the syncif.Ryan Thomas McBride
2004-06-02tables like to allocate lots of memory at once. use the previousTed Unangst
pool allocator, _nointr. testing/ok beck@ cedric@
2004-05-31thinko, reported by Fernando BragaDaniel Hartmeier
2004-05-31remove the broken auto-append-'0' code; ok canacar, deraadt, thierryMarkus Friedl
2004-05-29introduce SIOCSIFDESCR and SIOCGIFDESCR to maintain interfacejoshua stein
descriptions, configurable with ifconfig help from various, ok deraadt@
2004-05-28bpf device cloning.Alexander Yurchenko
Now to have more bpf devices just add device nodes in /dev, no need to recompile kernel anymore. Code from form@pdp-11.org.ru, some help from markus@. ok markus@ canacar@ deraadt@
2004-05-25Return buffered packets when reading from a bpf descriptor and theCan Erkin Acar
interface is detached, and wakeup any polling processes when the bpf descriptor is closed. ok henning@, tedu@
2004-05-21Use '/' instead of ':' as separator for anchor path components. Note thatDaniel Hartmeier
the parser now needs quotes around paths containing separators. ok mcbride@
2004-05-21copy out relative anchor paths correctlyDaniel Hartmeier
2004-05-19Allow recursive anchors (anchors within anchors, up to 64Daniel Hartmeier
levels deep). More work required, but this is already functional. authpf users will need to adjust their anchor calls, but this will change again soon. ok beck@, cedric@, henning@, mcbride@
2004-05-18if_ether.hBrad Smith
add ETHER_MAX_LEN_JUMBO, ETHER_VLAN_ENCAP_LEN, ETHER_ALIGN, and ETHERMTU_JUMBO constants. if.h add a few more interface capabilities flags. Some from NetBSD, some from FreeBSD. ok markus@
2004-05-18In DIOCCHANGERULE, move ticket increment above code that might freeDaniel Hartmeier
the ruleset and invalidate the pointer. ok cedric@
2004-05-17fix uninitialized var; found by millert@Michael Shalayeff
2004-05-16add DLT_PPP_ETHER DLT typeBrad Smith
From NetBSD ok deraadt@
2004-05-12Rework a block readded by the multipath commit that should ensure thatClaudio Jeker
RTM_CHANGE/LOCK only work on perfect matching routes. ppp and bgpd got broken because of this. Most of the code in the "grotty" block is already done by rn_lookup() only host routes need some special treatment. OK cedric@
2004-05-11pf_cksum_fixup() was called without last argument from normalization,Daniel Hartmeier
also fixup checksum when random-id modifies ip_id. This would previously lead to incorrect checksums for packets modified by scrub random-id. From Pyun YongHyeon. ok cedric@
2004-05-11change pf_route() loop detection: introduce a counter (number of timesDaniel Hartmeier
a packet is routed already) in the mbuf tag, allow at most four times. Fixes some legitimate cases broken by the previous change. ok cedric@
2004-05-09Don't dereference scrub pointer when it's NULL, fix PR 3775, fromDaniel Hartmeier
Marc Huber. ok deraadt@
2004-05-08reference count bpf descriptors to protect against disappearing interfacesCan Erkin Acar
while asleep in read. ok deraadt@
2004-05-07Replace RSA-derived md5 code with code derived from Colin Plumb's PD version.Todd C. Miller
This moves md5.c out of libkern and into sys/crypto where it belongs (as requested by markus@). Note that md5.c is still mandatory (dev/rnd.c uses it). Verified with IPsec + hmac-md5 and tcp md5sig. OK henning@ and hshoexer@
2004-05-05Use RFC1323 PAWS timestamps as a logical extension to the conventional TCPMike Frantzen
sequence numbers by taking advantage of the maximum 1KHz clock as an upperbound on the timestamp. Typically gains 10 to 18 bits of additional security against blind data insertion attacks. More if the TS Echo wasn't optional :-( Enabled with: scrub on !lo0 all reassemble tcp ok dhartmei@. documentation help from jmc@
2004-05-04The tcp specific routing metrics are almost never used so reduce the routingClaudio Jeker
table from these metrics. struct rt_msghdr used by the routing socket is not affected and so most userland apps don't need to be changed. some man page polishing by jmc@ OK henning@ markus@ theo@
2004-05-04Apply bridge filter rules to incoming packets destined to the local machine.Can Erkin Acar
Allows tagging of the incoming packets, and a single interface bridge to be actually useful for MAC level filtering/tagging. ok henning@
2004-05-04Remove useless ``elm'' argument from the SIMPLEQ_REMOVE_HEAD macro.Alexander Yurchenko
This matches our SLIST behaviour and NetBSD's SIMPLEQ as well. ok millert krw deraadt
2004-05-03fix a stupid mistake in my previous commit.Kenjiro Cho
"if (error == 0)" should be "if (error != 0)".
2004-04-30Unbreak building pfsync without carp. Found by marc@Ryan Thomas McBride
2004-04-28gcc3 shut up (from naddy@)Philipp Buehler
2004-04-28do not return herePhilipp Buehler
2004-04-28make return-rst work on pure bridges. ok dhartmei@ henning@ mcbride@Cedric Berger
2004-04-28Dont step into INET6 code, just because af != AF_INETPhilipp Buehler
Also comment #endif properly while being here ok mcbride@
2004-04-28spacingTheo de Raadt
2004-04-28pfsync stats fixups:Ryan Thomas McBride
- convert counters to 64 bits - add dedicated counters for sanity checks added right before release - clean up netstat output
2004-04-28Make carp(4) aware of its physical interface:Ryan Thomas McBride
- If the physical interface goes down or the link goes down, the carp interface goes down as well. - We treat this like the preemption holdoff with pfsync. So if one of the carp interfaces is known to be bad (because the physical interface it's associated with is bad), all the other carp interfaces back off: they won't preempt, and their advskew goes to 240. ok cedric@
2004-04-28point out that pfsync_send_bus and pfsync_sendout must be called in splnet()Philipp Buehler
ok mcbride@
2004-04-27validate the sequence numbers on TCP resets are an exact match. check is onlyMike Frantzen
enabled when we're doing full frag reassembly and thus have full seq info ok markus@
2004-04-27make separate functions to enable/disable altq, and call them when weKenjiro Cho
reload rules. this fixes an altq problem that, if you reload pf rules not containing queues while running altq, the interface shaper is not properly removed. make pf_altq_running local to pf_ioctl.c since it is no longer used in altq_subr.c. ok henning@
2004-04-26- make the k field in struct bpf_insn unsigned, as promised in theOtto Moerbeek
manual page. - more strict bpf code validation, preventing arbitrary kernel memory read and writes. Some help from frantzen@ and canacar@; testing jmc@ markus@; ok canacar@ henning@ franzen@
2004-04-26Before enqueueing the packet, copy the contents of incoming clustersRyan Thomas McBride
to the mbuf and free the cluster when it contains a small packet. ok deraadt@
2004-04-26Prevent biases in arc4random() from disclosing the byte order of the firewall.Ryan Thomas McBride
ok deraadt@
2004-04-26The rule_number parameter for pf_get_pool() needs to be 32 bits, not 8 -Ryan Thomas McBride
this fixes corruption of the address pools with large rulesets. This is a candidate for -stable. Reported by Zbigniew Kossowski <zk@openbsd.com.pl>, hours of braintwisting debugging by pb@
2004-04-26anchor refcounting. ok dhartmei@ mcbride@Cedric Berger
2004-04-25permit multiple default route. from kameJun-ichiro itojun Hagino
2004-04-25check for input queue congestion on those as well and call if_congestion whenHenning Brauer
needed; these are slightly different so that we cannot use the new IF_INPUT_ENQUEUE macro deraadt ok
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-20 01:06:21 +0000