summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2004-12-10Rename carp_output() to carp_fix_lladdr().Ryan Thomas McBride
2004-12-10allow pf to filter on route labelsHenning Brauer
pass in from route dtag keep state queue reallyslow tested by Gabriel Kihlman <gk@stacken.kth.se> and Michael Knudsen <e@molioner.dk> and ryan ok ryan
2004-12-10fix ipsec crash from pr 4025, Stefan Miltchev; ok hshoexer@Markus Friedl
2004-12-10Run address change notification hooks when the interface address is updated.Christian Weisgerber
Notably, this fixes "(pppoe0)" in pf. ok markus@
2004-12-09Remove shadow variable 'error'. From camield@Ryan Thomas McBride
2004-12-08Call if_down() in if_clone_destroy(). Based on diff from Chris Pascoe.Ryan Thomas McBride
ok markus@
2004-12-08Check if_type in carp_carpdev_state() to make sure we're notRyan Thomas McBride
dealing with a carp interface.
2004-12-07Convert carp(4) to behave more like a regular interface, much in the sameRyan Thomas McBride
style as vlan(4). carp interfaces no longer require the physical interface to be on the same subnet as the carp interface, or even that the physical interface has an adress at all, so CARP can now be used on /30 networks. ok deraadt@ henning@
2004-12-07KNFRyan Thomas McBride
2004-12-07KNFRyan Thomas McBride
2004-12-07re-commit mcbride@'s 'flush global', this time without the breakage inDaniel Hartmeier
pfvar.h. builds kernel and userland.
2004-12-07tree does not compile, spotted by dlg (not obvious how to fix)Theo de Raadt
---- Change the default for 'overload <table> flush' to flush only states from the offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-07Change the default for 'overload <table> flush' to flush only states from theRyan Thomas McBride
offending source created by the rule. 'flush global' flushes all states originating from the offending source. ABI change, requires kernel and pfctl to be in sync. ok deraadt@ henning@ dhartmei@
2004-12-06support max-src-conn-rate with synproxy, ok mcbride@Daniel Hartmeier
2004-12-06Check a NULL dereference before it could happen.Marco Pfatschbacher
ok mcbride@
2004-12-06At PFSYNC_ACT_CLR:Marco Pfatschbacher
Also purge states with an empty ifname. ok mcbride@
2004-12-05IPv6 packets can contain headers (like options) before the TCP/UDP/ICMP6Daniel Hartmeier
header. pf finds the first TCP/UDP/ICMP6 header to filter by traversing the header chain. In the case where headers are skipped, the protocol checksum verification used the wrong length (included the skipped headers), leading to incorrectly mismatching checksums. Such IPv6 packets with headers were silently dropped. Reported by Bernhard Schmidt. ok mcbride@
2004-12-05after attaching an overload table, set its active flag. otherwise, theDaniel Hartmeier
table is not visible/accessible when the rule is the only reference (you don't HAVE to reference the table elsewhere).
2004-12-04use C comments.Markus Friedl
2004-12-04Add kernel code to keep track of tcp connections which have completedRyan Thomas McBride
the 3-way handshake. Allow limits on both total connections and connection rate, put offenders in a table which can be used in the ruleset, and optionally kill existing states. Rate tracking code from dhartmei@. Adds a second pool for table entries using the default allocator, which allows entries to be added at splsoftnet(). ok deraadt@ dhartmei@
2004-12-03do not use one struct timeout for the if congestion stuff, but embedHenning Brauer
a struct timeout to struct ifqueue so that each one has its own - it is a per-queue thing. from chris pascoe
2004-12-01replace finer-grained spl locking in pfioctl() with a single broad lockDaniel Hartmeier
around the entire body. this resolves the (misleading) panics in pf_tag_packet() during heavy ioctl operations (like when using authpf) that occur because softclock can interrupt ioctl on i386 since SMP. patch from camield@. ok mcbride@, henning@ and (presumably ;) bob@
2004-11-30missing $OpenBSDMarkus Friedl
2004-11-29tiny knf, no binary change.Hans-Joerg Hoexer
ok otto jsg henning pat markus deraadt fgs
2004-11-29plug memory leaks on errorPatrick Latifi
ok canacar markus millert
2004-11-29remove old header. everything should use net80211/ stuff.Federico G. Schwindt
as for the ports, i could only find one. if there are more, they will be fixed in the tree as discussed with peter. deraadt@ pvalchev@ ok.
2004-11-29put text after #endif in comment (compile w/ gcc3)Peter Valchev
2004-11-28In kernel pppoe client, a simple IPv4 only implementation.Can Erkin Acar
Initial porting from NetBSD by David Berghoff. Modified/simplified to match our sppp implementation. ok deraadt@
2004-11-26implement net.key.v2.sadb_dump.{unspec,esp,ah,...} sysctl subtreeMarkus Friedl
and use sysctl for 'ipsecadm show'; ok deraadt
2004-11-24fix a bug that leads to a crash when binat rules of the formDaniel Hartmeier
'binat from ... to ... -> (if)' are used, where the interface is dynamic. reported by kos(at)bastard(dot)net, analyzed by Pyun YongHyeon
2004-11-19remove superfluous m_tag_copy/m_tag_prepend, already covered by m_copym2()Daniel Hartmeier
reported by Joerg Sonnenberger, ok henning@
2004-11-19Plug memory leak. Found by pat@. Thanks!Hans-Joerg Hoexer
ok myself markus@
2004-11-18s/Access/Address/ at IFT_CARPMarco Pfatschbacher
2004-11-16Fix for PR3983Ryan Thomas McBride
- Add a new PFSTATE_STALE flag to uncompressed state updates sent as a result of a stale state being detected, and prevent updates with this flag from generating similar messages. - For the specific case where the state->src in the recieved update is ok but the state.dst is not, take the partial update, then "fail" to let the other peers pick up the better data that we have. From Chris Pascoe. ok dhartmei@
2004-11-12The flag to re-filter pf-generated packets was set wrong by synproxyDaniel Hartmeier
for ACKs. It should filter the ACK replayed to the server, instead of of the one to the client. Thanks to Daniel Polak for testing.
2004-11-11Check IFF_UP at tun_output().Marco Pfatschbacher
ok henning, markus.
2004-11-10Safer IF_INPUT_ENQUEUE macro.Alexander Yurchenko
ok millert@
2004-11-09big KNF spanking, no change in object file, ecstatic ok from claudioHenning Brauer
2004-11-09use NULL instead of 0 for poiter comparisions,Henning Brauer
from "Alexey E. Suslikov" <cruel@texnika.com.ua> with a little help from itojun
2004-11-07For RST generated due to state mismatch during handshake, don't setDaniel Hartmeier
th_flags TH_ACK and leave th_ack 0, just like the RST generated by the stack in this case. Fixes the Raptor workaround. ok beck@, markus@
2004-11-02added new commands to ifconfig used by net80211 interfaces:Reyk Floeter
mode (set mode for multi-mode interfaces) and chan (set the radio channel). some additional output will be printed by "ifconfig -m". ok deraadt@ millert@ damien@
2004-10-28media descriptions and such for carp, ryan daniel okHenning Brauer
2004-10-28define IFT_CARP, and set if_type to that on carp interfaces insteadHenning Brauer
of hiding under IFT_PROPVIRTUAL, ryan daniel ok
2004-10-17Replace ifdef NATM with if NATM > 0Alexander Yurchenko
ok millert@ miod@
2004-10-15correctly parse the anchor names to which tables refer.Jared Yanovich
now they abide to the same rules as anchor names referred to by rules: - initial slashes (/) are stripped - anchor names with characters after the terminating NUL byte are considered invalid ok dhartmei (and previously) beck henning
2004-10-14avoid stupid commonsMichael Shalayeff
2004-10-11ifgroups reqriteHenning Brauer
there is now a TAILQ with all interface groups as members, and in struct ofnet there is only a pointer to the group structure stored and not its name. mostly hacked at c2k4 and somewhere over the atlantic ocean ok markus mcbride
2004-10-09sizeof(struct ether_header) -> ETHER_HDR_LENBrad Smith
ok mcbride@
2004-10-07Add an Ethernet option bit for master mode (for 1000baseT, the linkBrad Smith
master provides the clock -- this is normally the switch, but if you are doing back-to-back NICs, you need to tell one side to be the master). ok mcbride@
2004-09-29reset anchor pointer to NULL when stepping back into the main ruleset,Daniel Hartmeier
fixes pflog attributing states wrongly to anchors and pfctl -vvsn/sr showing wrong state counters for anchor rules. found by camield@, ok henning@, -stable candidate
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-05 02:35:49 +0000