summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2004-12-19Make it possible for carp to work on fddi and token ring again.Ryan Thomas McBride
ok pascoe@ mpf@
2004-12-17ICMP state entries use the ICMP ID as port for the unique state key. WhenDaniel Hartmeier
checking for a usable key, construct the key in the same way. Otherwise, a colliding key might be missed or a state insertion might be refused even though it could be inserted. The second case triggers the endless loop fixed by 1.474, possibly allowing a NATed LAN client to lock up the kernel. Report and test data by Srebrenko Sehic.
2004-12-17knf cleanup, convert old k&r-style functions to ansi-style for aReyk Floeter
consistent style in sys/net/bpf.c. ok henning@, "looks fine" canacar@
2004-12-17Reorder code in the ethernet output path, and enhance unicast addressChristopher Pascoe
matching in the bridge receive path to make CARP operate correctly on physical interfaces that are participating in a bridge. ok mcbride@ henning@ dlg@
2004-12-16Clean up handling of sync_flags.Ryan Thomas McBride
ok pascoe@
2004-12-14move the ioctls w/ all the other ifaces; mcbride@ okMichael Shalayeff
2004-12-14Initialise init_addr in pf_map_addr() in the PF_POOL_ROUNDROBIN,Ryan Thomas McBride
prevents a possible endless loop in pf_get_sport() with 'static-port' Reported by adm at celeritystorm dot com in FreeBSD PR74930, debugging by dhartmei@ ok dhartmei@
2004-12-13move splsoftnet() below ACCEPT_FLAGS(), which contains a potential return.Daniel Hartmeier
from Max Laier.
2004-12-13Set creation timestamps correctly on states learnt by pfsync that areChristopher Pascoe
more than a second old. ok mcbride@ henning@
2004-12-11SADB_X_EXT_LIFETIME_LASTUSE is always definedMarkus Friedl
2004-12-11pass out the correct lifetime type on expireMarkus Friedl
2004-12-11count SADB_REGISTER only once per socketMarkus Friedl
2004-12-11Handle errors in pf_route{,6} more gracefully.Marco Pfatschbacher
Proposed by mcbride. ok henning@, mcbride@
2004-12-10Rename carp_output() to carp_fix_lladdr().Ryan Thomas McBride
2004-12-10allow pf to filter on route labelsHenning Brauer
pass in from route dtag keep state queue reallyslow tested by Gabriel Kihlman <gk@stacken.kth.se> and Michael Knudsen <e@molioner.dk> and ryan ok ryan
2004-12-10fix ipsec crash from pr 4025, Stefan Miltchev; ok hshoexer@Markus Friedl
2004-12-10Run address change notification hooks when the interface address is updated.Christian Weisgerber
Notably, this fixes "(pppoe0)" in pf. ok markus@
2004-12-09Remove shadow variable 'error'. From camield@Ryan Thomas McBride
2004-12-08Call if_down() in if_clone_destroy(). Based on diff from Chris Pascoe.Ryan Thomas McBride
ok markus@
2004-12-08Check if_type in carp_carpdev_state() to make sure we're notRyan Thomas McBride
dealing with a carp interface.
2004-12-07Convert carp(4) to behave more like a regular interface, much in the sameRyan Thomas McBride
style as vlan(4). carp interfaces no longer require the physical interface to be on the same subnet as the carp interface, or even that the physical interface has an adress at all, so CARP can now be used on /30 networks. ok deraadt@ henning@
2004-12-07KNFRyan Thomas McBride
2004-12-07KNFRyan Thomas McBride
2004-12-07re-commit mcbride@'s 'flush global', this time without the breakage inDaniel Hartmeier
pfvar.h. builds kernel and userland.
2004-12-07tree does not compile, spotted by dlg (not obvious how to fix)Theo de Raadt
---- Change the default for 'overload <table> flush' to flush only states from the offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-07Change the default for 'overload <table> flush' to flush only states from theRyan Thomas McBride
offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-06support max-src-conn-rate with synproxy, ok mcbride@Daniel Hartmeier
2004-12-06Check a NULL dereference before it could happen.Marco Pfatschbacher
ok mcbride@
2004-12-06At PFSYNC_ACT_CLR:Marco Pfatschbacher
Also purge states with an empty ifname. ok mcbride@
2004-12-05IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6Daniel Hartmeier
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing the header chain. In the case where headers are skipped, the protocol checksum verification used the wrong length (included the skipped headers), leading to incorrectly mismatching checksums. Such IPv6 packets with headers were silently dropped. Reported by Bernhard Schmidt. ok mcbride@
2004-12-05after attaching an overload table, set its active flag. otherwise, theDaniel Hartmeier
table is not visible/accessible when the rule is the only reference (you don't HAVE to reference the table elsewhere).
2004-12-04use C comments.Markus Friedl
2004-12-04Add kernel code to keep track of tcp connections which have completedRyan Thomas McBride
the 3-way handshake. Allow limits on both total connections and connection rate, put offenders in a table which can be used in the ruleset, and optionally kill existing states. Rate tracking code from dhartmei@. Adds a second pool for table entries using the default allocator, which allows entries to be added at splsoftnet(). ok deraadt@ dhartmei@
2004-12-03do not use one struct timeout for the if congestion stuff, but embedHenning Brauer
a struct timeout to struct ifqueue so that each one has its own - it is a per-queue thing. from chris pascoe
2004-12-01replace finer-grained spl locking in pfioctl() with a single broad lockDaniel Hartmeier
around the entire body. this resolves the (misleading) panics in pf_tag_packet() during heavy ioctl operations (like when using authpf) that occur because softclock can interrupt ioctl on i386 since SMP. patch from camield@. ok mcbride@, henning@ and (presumably ;) bob@
2004-11-30missing $OpenBSDMarkus Friedl
2004-11-29tiny knf, no binary change.Hans-Joerg Hoexer
ok otto jsg henning pat markus deraadt fgs
2004-11-29plug memory leaks on errorPatrick Latifi
ok canacar markus millert
2004-11-29remove old header. everything should use net80211/ stuff.Federico G. Schwindt
as for the ports, i could only find one. if there are more, they will be fixed in the tree as discussed with peter. deraadt@ pvalchev@ ok.
2004-11-29put text after #endif in comment (compile w/ gcc3)Peter Valchev
2004-11-28In kernel pppoe client, a simple IPv4 only implementation.Can Erkin Acar
Initial porting from NetBSD by David Berghoff. Modified/simplified to match our sppp implementation. ok deraadt@
2004-11-26implement net.key.v2.sadb_dump.{unspec,esp,ah,...} sysctl subtreeMarkus Friedl
and use sysctl for 'ipsecadm show'; ok deraadt
2004-11-24fix a bug that leads to a crash when binat rules of the formDaniel Hartmeier
'binat from ... to ... -> (if)' are used, where the interface is dynamic. reported by kos(at)bastard(dot)net, analyzed by Pyun YongHyeon
2004-11-19remove superfluous m_tag_copy/m_tag_prepend, already covered by m_copym2()Daniel Hartmeier
reported by Joerg Sonnenberger, ok henning@
2004-11-19Plug memory leak. Found by pat@. Thanks!Hans-Joerg Hoexer
ok myself markus@
2004-11-18s/Access/Address/ at IFT_CARPMarco Pfatschbacher
2004-11-16Fix for PR3983Ryan Thomas McBride
- Add a new PFSTATE_STALE flag to uncompressed state updates sent as a result of a stale state being detected, and prevent updates with this flag from generating similar messages. - For the specific case where the state->src in the recieved update is ok but the state.dst is not, take the partial update, then "fail" to let the other peers pick up the better data that we have. From Chris Pascoe. ok dhartmei@
2004-11-12The flag to re-filter pf-generated packets was set wrong by synproxyDaniel Hartmeier
for ACKs. It should filter the ACK replayed to the server, instead of of the one to the client. Thanks to Daniel Polak for testing.
2004-11-11Check IFF_UP at tun_output().Marco Pfatschbacher
ok henning, markus.
2004-11-10Safer IF_INPUT_ENQUEUE macro.Alexander Yurchenko
ok millert@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-08 01:37:29 +0000