summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2012-11-23Add SIOCGIFHARDMTU to allow retrieving the driver's maximum supported MTUStuart Henderson
looks fine reyk@ ok mikeb@
2012-11-23make sure to always pass an array of struct pf_src_node pointers toMike Belopuhov
the pf_map_addr. doing otherwise leads to the stack corruption. bug was reported and fix tested by arjan schrijver, thanks! ok jsing, henning, florian who has also found the same bug in pf_route and pf_route6 functions.
2012-11-15this code is shared into userland, and there it should not pullTheo de Raadt
in sys/mbuf.h ok claudio
2012-11-11align ifaliasreq.ifra_addr similar to the way that ifreq is fixed --Theo de Raadt
a gruesome union, to block the compiler from placing the struct incorrectly aligned on stack frames ok guenther
2012-11-08wrap bpfilter portion with #if NBPFILTER > 0.Gleydson Soares
fix kernel builds without bpfilter. OK sthen@ mikeb@ deraadt@ henning@
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-10-30Use time_uptime for expiration values as time_second can be skewed atFlorian Obser
runtime while time_uptime is monotonic. Prevent underflows in pfsync(4) and pflow(4) by using signed variables. pfsync(4) problem pointed out by camield. Diff originally by dlg, frag and pflow bits by me. feedback dlg man page tweak jmc Various versions of the pflow bits tested by Hrvoje Popovski (hrvoje AT srce DOT hr), thanks! ok benno, henning, dlg
2012-10-23Only clear the revarp_ifp if the ifp pointing to it is detached.Claudio Jeker
Since the ifp is not detached in the SIOCSIFRDOMAIN case remove the clear there. With and OK deraadt@
2012-10-21Add the IP_DIVERTFL socket option on divert(4) sockets to controlSebastian Benoit
which packets (as in direction) of the traffic will be diverted through the divert socket. ok claudio@, henning@
2012-10-18Move revarp code into #ifdef NFSCLIENT; saving space on some media.Theo de Raadt
Resurrect the rather silly "unplug my network device while I am doing nfs diskless revarp" safety code which was disabled due to a missing "ether.h" include, found by jsg ok jsg
2012-10-10make bridge_rtflush and bridge_flushrule void functions, as they neverHenning Brauer
return anything but 0 anyways From: "Michael W. Bombardieri" <mb at ii dot net>, ok camield
2012-10-09simplify hook_disestablish() handling by always resetting the hook whenMarkus Friedl
the syncdev gets set. this also makes sure we no longer leak hooks on repeatet 'ifconfig syncdev' invocations. ok mikeb@
2012-10-08Make carp_ourether() shorter and more generic. Only a mac addressCamiel Dobbelaar
is really needed, instead of an ethernet header and selector. ok mikeb henning mpf
2012-10-08make sure we don't call hook_disestablish() twice e.g. ifconfig -syncdevMarkus Friedl
followed by ifconfig destroy; ok mikeb
2012-10-08Forward declare struct m_tag in netinet/ip_ipsp.h so we don't need toCamiel Dobbelaar
include sys/mbuf.h in net/pfvar.h. Flagged by and ok guenther@
2012-10-07spacingMike Belopuhov
2012-10-06Remove bridge_rttrim(). It's only triggered in the unlikely event that theCamiel Dobbelaar
routecache is full and the admin is making it smaller. It then does a lame attempt at shrinking the routecache, something that a flush or flushall can do better. ok henning beck
2012-10-05Point an interface directly to its bridgeport configuration, insteadCamiel Dobbelaar
of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
2012-10-05include sys/mbuf.hCamiel Dobbelaar
2012-09-30There is no need to set IFF_OACTIVE in vlan, since there is no DMA ringClaudio Jeker
that can be filled. OK dlg@, mikeb@
2012-09-28fix adress family for ipv6 bpf packet capture; ok yasuokaMarkus Friedl
2012-09-26add M_ZEROIZE as an mbuf flag, so copied PFKEY messages (with embedded keys)Markus Friedl
are cleared as well; from hshoexer@, feedback and ok bluhm@, ok claudio@
2012-09-20Fix a pair of typos in comments.Bret Lambert
ok claudio@
2012-09-20pfsync_cancel_full_update needs to restore carp demotions sinceMike Belopuhov
it's cancelling the bulk update and can leave the machine in a demoted state. bug was noticed by benno, who was kind enough to verify that the fix is working fine. ok mpf, benno
2012-09-20Don't filter spanning tree BPDUs. Either process, or forward them.Marco Pfatschbacher
Even though this violates IEEE 802.1D, we'd rather avoid bridging loops by not getting in the way of STP. OK henning, camield, reyk
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
2012-09-20Lower pf frags limit to not risk running out of mbuf clustersCamiel Dobbelaar
when dealing with lots of IP fragments. This sets the default to 25% of the mbuf cluster maximum (hint from beck). And the example in the manpage is sane now. ok mikeb henning beck deraadt
2012-09-19ioctl requests are u_long not int, spotted via clangJonathan Gray
ok deraadt@ miod@
2012-09-19cleanup around the pipex. naming style, delete or update comments.YASUOKA Masahiko
no functional changes.
2012-09-19Make rt_lookup return a pointer to an rtentry struct instead ofBret Lambert
to a radix_node struct. The radix tree pushdown continues. ok claudio@
2012-09-19defina an IFCAP_CSUM_MASK, covering IFCAP_CSUM_*, and use it in if_vlan.cHenning Brauer
to replace the list of them. this actually makes vlan inherit the IPv6 CSUM flags from it's parent, that had been commented out since this code was committed back in 2001. ok benno mpf
2012-09-19update the tdb replay counter endian conversion to 64 bits;Mike Belopuhov
ok camield mpf
2012-09-19More radix internals pushdown; place rn_mpath_next, which accepts andBret Lambert
returns radix_node pointers, inside a new rt_mpath_next, which accepts and returns rtentry pointers, and start using that instead. ok claudio@
2012-09-18prio 0 is valid, therefore, I chose an "impossible" value for prio meaningHenning Brauer
"not set" and used a PF_PRIO_NOTSET define for it. now that means that everything that creates a struct pf_rule doesn't get away with bzero'ing it, which turned out to be not so nice. so get rid of PF_PRIO_NOTSET, instead, make a rule+state flag PFSTATE_SETPRIO which indicates wether the prio should be set. ok benno claudio mikeb
2012-09-18remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setMarkus Friedl
anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
2012-09-18Wrap rtable_add() and rtable_l2set() calls inside ifioctl() inside softnet,Bret Lambert
as functions that modify routing information shouldn't be interruptable by network traffic. Also make sure that both of those functions assert that they are called at softnet. I'm reasonably sure that there shouldn't be any, but if there is any codepath that was missed, we're going to be here for another 4 days to deal with any fallout. While here, move the multitude of "int s" declarations inside ifioctl to the beginning of the function. okay claudio@
2012-09-17Whitespace change (excess indentation).Bret Lambert
ok claudio@
2012-09-10drop the unencrypted packets when the MPPE is required. This wasYASUOKA Masahiko
missing on IPv6 path only. From brad
2012-09-10add missing the congestion indicator code on IPv6 path.YASUOKA Masahiko
From brad
2012-09-10Bring into compliance with POSIX, exposing just the specified bits.Philip Guenthe
Requested by jasper@, ok kettenis@
2012-08-30Sloppy state tracking renders ICMP direction check uselessMike Belopuhov
and harmful as we might see only half of the connection in the asymmetric setups but ignore the state match. The bug was reported and fix was verified by Insan Praja <insan () ims-solusi ! com>. Thanks! OK mcbride, henning
2012-08-21Reverse the name and meaning of the IFXF_INET6_PRIVACY interfaceAlexander Bluhm
flag. It is now called IFXF_INET6_NOPRIVACY. So IPv6 privacy addresses are on by default without resetting the flag during ifconfig down/up. OK stsp@, sperreault@ (who wrote the same diff)
2012-07-26rename all_state_flags to state_flags to finish the transitionMike Belopuhov
to the 16 bit flags; reminded by claudio, ok henning
2012-07-24decls before codeTheo de Raadt
2012-07-23Call sppp_clear_ip_addrs from a workq. Problem reported by RD Thrush andStuart Henderson
LEVAI Daniel, diagnosed by matthew@, original diff from RD Thrush, cleaned up by me with feedback from mikeb@. OK mikeb dcoppa deraadt
2012-07-17use IPsec flowinfo on pipex(4) to select the IPsec tunnel for sendingYASUOKA Masahiko
L2TP packets. ok markus henning
2012-07-16add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)Markus Friedl
can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
2012-07-13Use NULL instead of 0 in pointer context. approvedz blambert@Claudio Jeker
2012-07-13remove confuzzling commentHenning Brauer
:dlg: the xxx can go ...and this time commit to the real repo and not the one on my laptop
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 21:13:34 +0000