summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2012-10-23Only clear the revarp_ifp if the ifp pointing to it is detached.Claudio Jeker
Since the ifp is not detached in the SIOCSIFRDOMAIN case remove the clear there. With and OK deraadt@
2012-10-21Add the IP_DIVERTFL socket option on divert(4) sockets to controlSebastian Benoit
which packets (as in direction) of the traffic will be diverted through the divert socket. ok claudio@, henning@
2012-10-18Move revarp code into #ifdef NFSCLIENT; saving space on some media.Theo de Raadt
Resurrect the rather silly "unplug my network device while I am doing nfs diskless revarp" safety code which was disabled due to a missing "ether.h" include, found by jsg ok jsg
2012-10-10make bridge_rtflush and bridge_flushrule void functions, as they neverHenning Brauer
return anything but 0 anyways From: "Michael W. Bombardieri" <mb at ii dot net>, ok camield
2012-10-09simplify hook_disestablish() handling by always resetting the hook whenMarkus Friedl
the syncdev gets set. this also makes sure we no longer leak hooks on repeatet 'ifconfig syncdev' invocations. ok mikeb@
2012-10-08Make carp_ourether() shorter and more generic. Only a mac addressCamiel Dobbelaar
is really needed, instead of an ethernet header and selector. ok mikeb henning mpf
2012-10-08make sure we don't call hook_disestablish() twice e.g. ifconfig -syncdevMarkus Friedl
followed by ifconfig destroy; ok mikeb
2012-10-08Forward declare struct m_tag in netinet/ip_ipsp.h so we don't need toCamiel Dobbelaar
include sys/mbuf.h in net/pfvar.h. Flagged by and ok guenther@
2012-10-07spacingMike Belopuhov
2012-10-06Remove bridge_rttrim(). It's only triggered in the unlikely event that theCamiel Dobbelaar
routecache is full and the admin is making it smaller. It then does a lame attempt at shrinking the routecache, something that a flush or flushall can do better. ok henning beck
2012-10-05Point an interface directly to its bridgeport configuration, insteadCamiel Dobbelaar
of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
2012-10-05include sys/mbuf.hCamiel Dobbelaar
2012-09-30There is no need to set IFF_OACTIVE in vlan, since there is no DMA ringClaudio Jeker
that can be filled. OK dlg@, mikeb@
2012-09-28fix adress family for ipv6 bpf packet capture; ok yasuokaMarkus Friedl
2012-09-26add M_ZEROIZE as an mbuf flag, so copied PFKEY messages (with embedded keys)Markus Friedl
are cleared as well; from hshoexer@, feedback and ok bluhm@, ok claudio@
2012-09-20Fix a pair of typos in comments.Bret Lambert
ok claudio@
2012-09-20pfsync_cancel_full_update needs to restore carp demotions sinceMike Belopuhov
it's cancelling the bulk update and can leave the machine in a demoted state. bug was noticed by benno, who was kind enough to verify that the fix is working fine. ok mpf, benno
2012-09-20Don't filter spanning tree BPDUs. Either process, or forward them.Marco Pfatschbacher
Even though this violates IEEE 802.1D, we'd rather avoid bridging loops by not getting in the way of STP. OK henning, camield, reyk
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
2012-09-20Lower pf frags limit to not risk running out of mbuf clustersCamiel Dobbelaar
when dealing with lots of IP fragments. This sets the default to 25% of the mbuf cluster maximum (hint from beck). And the example in the manpage is sane now. ok mikeb henning beck deraadt
2012-09-19ioctl requests are u_long not int, spotted via clangJonathan Gray
ok deraadt@ miod@
2012-09-19cleanup around the pipex. naming style, delete or update comments.YASUOKA Masahiko
no functional changes.
2012-09-19Make rt_lookup return a pointer to an rtentry struct instead ofBret Lambert
to a radix_node struct. The radix tree pushdown continues. ok claudio@
2012-09-19defina an IFCAP_CSUM_MASK, covering IFCAP_CSUM_*, and use it in if_vlan.cHenning Brauer
to replace the list of them. this actually makes vlan inherit the IPv6 CSUM flags from it's parent, that had been commented out since this code was committed back in 2001. ok benno mpf
2012-09-19update the tdb replay counter endian conversion to 64 bits;Mike Belopuhov
ok camield mpf
2012-09-19More radix internals pushdown; place rn_mpath_next, which accepts andBret Lambert
returns radix_node pointers, inside a new rt_mpath_next, which accepts and returns rtentry pointers, and start using that instead. ok claudio@
2012-09-18prio 0 is valid, therefore, I chose an "impossible" value for prio meaningHenning Brauer
"not set" and used a PF_PRIO_NOTSET define for it. now that means that everything that creates a struct pf_rule doesn't get away with bzero'ing it, which turned out to be not so nice. so get rid of PF_PRIO_NOTSET, instead, make a rule+state flag PFSTATE_SETPRIO which indicates wether the prio should be set. ok benno claudio mikeb
2012-09-18remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setMarkus Friedl
anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
2012-09-18Wrap rtable_add() and rtable_l2set() calls inside ifioctl() inside softnet,Bret Lambert
as functions that modify routing information shouldn't be interruptable by network traffic. Also make sure that both of those functions assert that they are called at softnet. I'm reasonably sure that there shouldn't be any, but if there is any codepath that was missed, we're going to be here for another 4 days to deal with any fallout. While here, move the multitude of "int s" declarations inside ifioctl to the beginning of the function. okay claudio@
2012-09-17Whitespace change (excess indentation).Bret Lambert
ok claudio@
2012-09-10drop the unencrypted packets when the MPPE is required. This wasYASUOKA Masahiko
missing on IPv6 path only. From brad
2012-09-10add missing the congestion indicator code on IPv6 path.YASUOKA Masahiko
From brad
2012-09-10Bring into compliance with POSIX, exposing just the specified bits.Philip Guenthe
Requested by jasper@, ok kettenis@
2012-08-30Sloppy state tracking renders ICMP direction check uselessMike Belopuhov
and harmful as we might see only half of the connection in the asymmetric setups but ignore the state match. The bug was reported and fix was verified by Insan Praja <insan () ims-solusi ! com>. Thanks! OK mcbride, henning
2012-08-21Reverse the name and meaning of the IFXF_INET6_PRIVACY interfaceAlexander Bluhm
flag. It is now called IFXF_INET6_NOPRIVACY. So IPv6 privacy addresses are on by default without resetting the flag during ifconfig down/up. OK stsp@, sperreault@ (who wrote the same diff)
2012-07-26rename all_state_flags to state_flags to finish the transitionMike Belopuhov
to the 16 bit flags; reminded by claudio, ok henning
2012-07-24decls before codeTheo de Raadt
2012-07-23Call sppp_clear_ip_addrs from a workq. Problem reported by RD Thrush andStuart Henderson
LEVAI Daniel, diagnosed by matthew@, original diff from RD Thrush, cleaned up by me with feedback from mikeb@. OK mikeb dcoppa deraadt
2012-07-17use IPsec flowinfo on pipex(4) to select the IPsec tunnel for sendingYASUOKA Masahiko
L2TP packets. ok markus henning
2012-07-16add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)Markus Friedl
can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
2012-07-13Use NULL instead of 0 in pointer context. approvedz blambert@Claudio Jeker
2012-07-13remove confuzzling commentHenning Brauer
:dlg: the xxx can go ...and this time commit to the real repo and not the one on my laptop
2012-07-10With address family translation, the ip length of the quoted ipAlexander Bluhm
packet within the icmp error packet was wrong. Fix this by using the pd2.tot_len of the inner packet and substract the old header's length. OK mikeb@ henning@
2012-07-10Place declarations for internal radix functions inside radix.c, stopBret Lambert
exporting them to the outside world via radix.h. ok claudio@ sthen@ henning@
2012-07-10define a PFSTATE_SCRUBMASK. relying on numeric order of flags is stupidHenning Brauer
and bound to break sooner or later.
2012-07-09Enable support for the 'weight' keyword in the 'least-states'Joerg Zinke
load balancing case, this allows Weighted Least States (WLS). Everything prepared on c2k11 with help from mcbride@. This finally makes PF ready for the cloud. ok henning@ mikeb@ pyr@
2012-07-08there was a limit on the number of pflog interfaces - 16. remove that.Henning Brauer
mostly by dynamically allocating pflogifs instead of making that a static array. ok claudio zinke
2012-07-07rename prio in struct pf_rule and related structs to set_prio so it isHenning Brauer
utterly clear this is not a filter criteria but a packet modification thing. also preparation for upcoming changes, including one to unscrew this mess (I should not have to touch half the tree for this - ifixitlater) not user visible, ok gcc
2012-07-07restore DIOCKILLSTATE semantics to what they were before the NAT rewrite.Henning Brauer
when you kill states by IP, it is not all that clear which IP we're talking about - before or after rewriting? the old semantics were to always look at the "original" IP, i. e. before rewriting. ever since the NAT rewrite we were unconditionally looking at the wire side state key, which is the original address for PF_IN states, but not for PF_OUT. So look at the SK_STACK state key in the PF_OUT case. should fix "authpf doesn't remove NAT states" seen on misc a while ago ok & testing & half of the analysis bob (he sez beck)
2012-06-30Fix a number of problems introduced by the link state handling commit:Mike Belopuhov
1) demote by 32 on the first bulk update to prevent failovers w/o having a full state table; 2) don't do any demotion adjustments on the link up event and undemote when bulk update finishes (or times out) preventing a race between nodes getting a link state update asynchronously. With phessler; tested by phessler and Kapetanakis Giannis. Thanks! Looked through by henning and dlg. Now the correct version.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-27 08:42:19 +0000