summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2013-08-10Cancel timeouts on pflow interface destruction.Florian Obser
OK benno@
2013-08-08Insert new IPv4 addresses in only one place, no functional change.Martin Pieuchot
ok mikeb@, henning@
2013-08-07states learnt via pfsync from a peer with the same ruleset checksum wereDavid Gwynne
not getting assigned to rules like they should cos pfsync_in_upd() wasnt passing the PFSYNC_SI_CKSUM flag along to pfsync_state_import. found and fixed by pedro
2013-08-05sync the bridge_broadcast comment with realityMike Belopuhov
2013-07-31Move bridge_broadcast and subsequently all IPsec SPD lookup code outMike Belopuhov
of the IPL_NET. pf_test should be no longer called under IPL_NET as well. The problem became evident after the related issue was brought up by David Hill <dhill at mindcry ! org>. With input from and OK mpi. Tested by David and me.
2013-07-23Do not reset the fragment timeout each time a fragment arrives.Alexander Bluhm
Start the expire counter when the queue is created by the first fragment and drop it if the packet could not be reassembled within 60 seconds. Reported by Antonios Atlasis; OK henning@ deraadt@
2013-07-15Remove a comment which is no longer true.Martin Pieuchot
2013-07-10Change the structure used in the SPPPIOSDEFS and SPPPIOGDEFS ioctlsMartin Pieuchot
to only include what is really needed. In particular stop including a "struct ifnet" and move kernel-only definition into the proper #if dance. While here remove the unused spppinfo() from ifconfig. ok guenther@, sthen@, mikeb@
2013-07-05bring back pflow v10; broken in previous commit, sorry.Florian Obser
ok benno@
2013-07-05Collect and display 'match' counters for pf tables.Bret Lambert
While here, fix pf table displays to fit within 80 chars. Manpage input jmc@ ok henning@ reyk@
2013-07-04Re-commit: use time_t for storing time_t values. This is an ABIPhilip Guenther
change for pf, but that's fine at this time. You'll need to rebuild pf userland after updating your kernel. change to 'since' member ok henning@ rest ok henning@ deraadt@
2013-07-03Switch times in the SLIP softc to time_t and reorder slightlyPhilip Guenther
ok mpi@ deraadt@
2013-07-02Revert previous: sizeof(time_t) != sizeof(long) on LP64, so there wasPhilip Guenther
an ABI change involved.
2013-07-02Use time_t for storing time_t values. No change to the underlyingPhilip Guenther
type**, so no ABI change. ok henning@ deraadt@ ** ...yet
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-06-26Rudimentary counter fix for tables used in match rules.Bret Lambert
Fixes an issue seen by reyk@ ok henning@ reyk@
2013-06-25Protect various driver descriptors by _KERNEL to stop exposing to muchMartin Pieuchot
stuff to userland, especially the "struct ifnet". ok sthen@, henning@, uebayasi@
2013-06-24Revert r1.20 for now, to make sure the newly created address is addedMartin Pieuchot
to the global list, until the issue with carp is addressed.
2013-06-20Revert previous and unbreak asr, the new include should be protected.Martin Pieuchot
Reported by naddy@
2013-06-20Allocate the various hook head descriptors as part of the ifnetMartin Pieuchot
structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
2013-06-18Use malloc(M_WAITOK) in if_attach_common(), because this function mustMasao Uebayashi
succeed, and it's always called in sleepable context. OK mikeb@ yasuoka@
2013-06-18Oops, forgot this file in previous. Should be part of adding/removingMartin Pieuchot
IPv4 addresses consistently from the global list and tree, in.c r1.78 ok bluhm@, mikeb@
2013-06-17Before pulling the TCP options from the mbuf onto the stack, do anAlexander Bluhm
additional length check in pf_modulate_sack() and pf_normalize_mss(). Overflow cannot happen due to the restricted values in the length calculation. As this is not obvious, be better safe than sorry. OK henning@
2013-06-17Instead of bcopy() and bcmp() a single pointer in an mbuf tag,Alexander Bluhm
assign with = and compare with == . This way the compiler will check deeper wether the cast is correct. Alignment is fine, tested on sparc64. OK claudio@
2013-06-16Remove variable sa_family_t family in gif_start() and gif_output().Alexander Bluhm
No functional change. From David Hill; OK claudio@
2013-06-11Replace all ovbcopy with memmove; swap the src and dst arguments tooTheo de Raadt
ok otto
2013-06-08Add new sysctl for pipex packet input/output queue length andYASUOKA Masahiko
counters. ok guenther, feedback jmc
2013-06-05Include sys/timeout.h to make if_gre.c compile without pf.Alexander Bluhm
No binary change. OK henning@
2013-06-05ansi function declarations.David Gwynne
ok sha256
2013-06-05Unbreak the kernel to userspace SADB_X_EXT_TAG message.Reyk Floeter
ok deraadt@
2013-06-05after the pf_test_state folding, in pf_test in the proto switch, theHenning Brauer
udp and the default case are 100% identical, tcp does a little more, but that is easier to add w/ two "if tcp" blocks in the default case, so the udp and tcp cases die. ok bluhm
2013-06-04fold pf_test_state_{tcp,udp,other} into one pf_test_state.Henning Brauer
the _icmp variant stays because it is completely different. factor out the synproxy code into a new pf_synproxy() for readability. pf_setup_pdesc sets us up with access to ports, cksum etc in a protocol independent matter, so we don't need many protocol switches here. tcp and udp were almost identical, the _other case changes significantly - not too unlikely this fixes a subtle bug or two in that case. ok ryan benno bluhm mikeb
2013-06-04add a pointer to the protocol checksum header field to pf_pdesc and setHenning Brauer
it up in pf_setup_pdesc(). ok ryan benno mikeb bluhm
2013-06-04make pf_change_ap() usable without a port. if the port pointer is NULL,Henning Brauer
just return after being done with the address. ok bluhm ryan mikeb
2013-06-03Link pf states and socket inpcbs together more tightly. The linkingAlexander Bluhm
was only done when a packet traveled up the stack from pf to tcp_input(). Now also link the state and inpcb when the packet is going down from tcp_output() to pf. As a consequence, divert-reply states where the initial SYN does not get an answer, can be handled more correctly. This change is part of a larger diff that has been backed out in 2011. Bring the feature back in small steps to see when bad things start to happen. OK henning deraadt
2013-06-03Update o[sd]port whenever n[sd]port is changed. This fixes aAlexander Bluhm
regression introduced with pf.c 1.827 and allows us to create icmp states again. OK henning@
2013-06-03put back the match member to the anchor stack struct - userland (pfctl)Henning Brauer
uses it. that is so incedibly wrong... sorry for the breakage, folks. found by tedu, SMSing me out of my breakfast bob
2013-06-03Replace "hot" bcopy() calls in ether_output() with memcpy(). This tells theMark Kettenis
compiler that source and destination are not overlapping, allowing for more aggressive optimization, leading to a significant performance improvement on busy firewalls. Reworking of a diff by dlg@, who did the hard work of benchmarking this. ok deraadt@, mikeb@, henning@, mcbride@, tedu@, matthew@
2013-06-03fix anchor quick with nested anchors. we lost the quick flag as soon asHenning Brauer
we stepped into a child anchor. simplify the logic, get rid of the match flag in the anchor stack, just use the match variable we already had (and used in a boolean style) to track the nest level we had a match at. when a child anchor had a match we also have a match in the current anchor, so update the match level accordingly, and thus correctly honour the quick flag. reported by, along with the right idea on how to fix this, by Sean Gallagher \sean at teletech.com.au/, who also helped testing the fix. ok ryan & benno
2013-06-02set up osport and odport (original src/dst port) in pf_setup_pdesc insteadHenning Brauer
of late in pf_test_rule - need that for upcoming changes. ok ryan
2013-06-01pf_step_{into,out_of}_anchor() are only ever called from pf_test_rule()Henning Brauer
these days, so: -move the prototypes from pfvar.h to pf.c -remove the now useless null point checks for *match, it is always provided ok ryan
2013-05-31export the original aka untranslated address for af-to in pflowFlorian Obser
inspired by benno@'s previous diff for nat-to tests/ok benno@
2013-05-31Remove the scrub argument from in_ifinit() and simply call in_ifscrub()Martin Pieuchot
unconditionally for SIOCSIFADDR. ok bluhm@, henning@
2013-05-30export the original aka untranslated address in pflowSebastian Benoit
ok florian@ henning@
2013-05-25set the IFF_RUNNNING flag when recreating an interface after theMike Belopuhov
IFF_LINK0 flag has been added; from form, ok deraadt claudio
2013-05-17Do not attempt to delete the undeletable RNF_ROOT route.Kenneth R Westerback
Discovered & fix tested by Peter J Philip. ok claudio@ blambert@
2013-05-14Pass the correct pointer to pool_put if pf_state_key_attach fails.Mike Belopuhov
Thanks to Brian Poole <pooleb @ gmail ! com> for noticing this.
2013-05-11Set trunk(4)'s MTU to that of the first trunkport. Allows trunk to work withStuart Henderson
jumbo/baby-jumbo frames. To avoid problems with mismatches between trunkports, any additional ports must have the same MTU as already set on the trunk(4). Based on changes made in FreeBSD. Tested by myself and jj@, ok reyk@
2013-05-10Since pf_state_key_attach can decide to free the provided stateMike Belopuhov
key we need to sync our state key pointers with whatever values the function will pick. Not doing so will produce wrong results if address translation must be applied afterwards and we happen to have a state key collision. Then pf_translate will follow an old pointer and punch in garbage addresses into the packet. Noticed, initial patch and tests by Vitaly Sinilin <vs @ kp4 ! ru> ok tedu, henning
2013-05-03Export ingress/egress interface index in pflow(4).Florian Obser
Report that this is needed for some netflow collector and tests by Chris Ivancic & Colin Ligertwood. OK mikeb@, benno@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 19:23:57 +0000