summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2010-10-18Revert non-compatible and undocumented bullshit commited by 3 developersTheo de Raadt
who decided to just do it on their own. henning, mcbride, jsing -- shame on you -- if you had shown this diff to just 1 other network developer, the astounding mistake in it would have been noticed. Start practicing inclusionary development instead of going alone. ok claudio
2010-10-17Add quirks support to operating system fingerprinting. tcpdump partJoel Sing
by mcbride@. ok mcbride@ henning@
2010-10-11Implement an rtsocket filter for rtableids. A process will initiallyClaudio Jeker
only get messages that are for the rtable the process is bound to. Depending on the rtm_type the rdomain or rtable id are used for comparison. It is possible to change the filter with a setsockopt(s, AF_ROUTE, ROUTE_TABLEFILTER,...) and if set to RTABLE_ANY the filter is deactivated. Additionally set the tableid in struct if_msghdr to the rdomain id and use the process rtableid in the sysctl if no table was specified. OK henning@
2010-10-11Remove some commented code we will never have.Claudio Jeker
2010-10-06Retire SkipjackMike Belopuhov
There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
2010-10-04fp_wscale is only a single byte so do not byteswap it. This makes osClaudio Jeker
fingerprinting on little endian systems work. People using the osfp feature need to update /etc/pf.os or -current will be blocked. OK deraadt@, jsg@, jsing@, millert@, sthen@
2010-09-30Convert printf()'s to DPFDEBUG() macro.Ryan Thomas McBride
ok dlg
2010-09-29pipex_pptp_userland_output() calls always m_pullup() 16 bytes to theYASUOKA Masahiko
GRE message. But when npppd send a ack-only GRE message, the message will be only 12 bytes, so the m_pullup() will fail. call m_pullup() with proper length.
2010-09-29Adjust to the pipex changes introduced during j2k10. Compiles again notClaudio Jeker
sure if all protocols work.
2010-09-28wrap long line. correct indent. delete a useless comment.YASUOKA Masahiko
OK djm@ claudio@ dlg@
2010-09-28replace hand-rolled infinite loop with LIST_FOREACHBret Lambert
ok claudio@ guenther@
2010-09-27must have either PR_WAITOK or PR_NOWAIT set.David Gwynne
2010-09-27a pool_get() assuming that PR_NOWAIT is 0 (not anymore!); run into by naddyTheo de Raadt
2010-09-26Length field in L2TP header was broken.YASUOKA Masahiko
2010-09-24avoid potential infinite loopBret Lambert
ok deraadt@
2010-09-24Add L2TP support to PIPEX.SUENAGA Hiroki
We can use IPv6 address as outer header of L2TP. Kernel ABI is changed. You must update npppd. OK @claudio, yasuoka@, dlg@
2010-09-24Implement if_freenameindex() as a real function as required by posix.Claudio Jeker
OK deraadt@, millert@
2010-09-24itojun picked exactly the right reason in that REASON_SET call. really noHenning Brauer
reason to question himself by adding an XXX
2010-09-24use pd->rdomain for the PF_MISMATCHAW checks in pf_test_fragment instead ofHenning Brauer
hardcoding 0. roughly almost a bit equivalent to what pf_test_rule does. changing the rdomain for not reassembled fragments is not going to work ever, so the full dance pf_test_rule does doesn't make sense here. speaking of sense, I don't see anything remotely resembling sense in pf filtering on fragments without reassembling them first. with/ok claudio
2010-09-24no need to pf_tag_packet in the stateless case in pf_test sinceHenning Brauer
pf_test_rule will have done it already, as correctly XXX-comment noted by claudio almost a year ago. pf_test6 (which is scarily different there) didn't have that at all.
2010-09-24hello, this is captain obvious speaking:Henning Brauer
/* XXX This does NOT affect pass rules! */ SLIST_FOREACH(ri, &s->match_rules, entry) { ... delete that comment, entirely superfluous
2010-09-24remove misleading XXX comment. it is pretty clear by now thatHenning Brauer
pf_compare_state_keys will stay, we play safe.
2010-09-24nicer linewraps, purely cosmeticHenning Brauer
2010-09-24kill some unused arguments to pf_create_stateJonathan Gray
ok henning@
2010-09-23Break out rule counter update code into a separate function, makes theRyan Thomas McBride
behaviour consistent between IPv4 and IPv6. From martin.pelikan@gmail.com
2010-09-23fix indentation to not confusingly align with an unassociated while() statementBret Lambert
ok claudio@
2010-09-23tweak the mclgeti algorithm to behave better under load.David Gwynne
instead of letting hardware rings grow on every interrupt, restrict it so it can only grow once per softclock tick. we can only punish the rings on softclock ticks, so it make sense to only grow on softclock tick boundaries too. the rings are now punished after >1 lost softclock tick rather than >2. mclgeti is now more aggressive at detecting livelock. the rings get punished by an 8th, rather than by half. we now allow the rings to be punished again even if the system is already considered in livelock. without this diff a livelocked system will have its rx ring sizes scale up and down very rapidly, while holding the rings low for too long. this affected throughput significantly. discussed and tested heavily at j2k10. there are still some games with softnet we can play, but this is a good first step. "put it in" and ok deraadt@ ok claudio@ krw@ henning@ mcbride@ if we find out that it sucks we can pull it out again later. till then we'll run with it and see how it goes.
2010-09-23If tunread() fails, we should increment if_oerrors, not if_ierrors.Matthew Dempsky
"yup" deraadt@
2010-09-22Add a new interface pppx(4) -- the ppp multiplexer to be used with npppdClaudio Jeker
and pipex. pppx(4) creates an interface whenever a session is created so that altq and pf can work on these. Started by dlg@ debugged and made usable by myself OK dlg@ yasuoka@ deraadt@
2010-09-22Add AES-GCM Transform Identifiers as specified by IANA inMike Belopuhov
RFC 4106 and 4543. Please note that although IKEv1 and IKEv2 identifiers are different for ESP_NULL_AUTH_AES-GMAC (SADB_X_EALG_AESGMAC), we use the IKEv2 one only (which is 21). ipsecctl(8) will be taught to handle exported SA correctly.
2010-09-22add a new log opt PF_LOG_MATCHESHenning Brauer
forces logging on all subsequent matching rules real ok theo assumed oks ryan and dlg bikeshedding everyone in the room implementation time ~ 1 minute
2010-09-22Don't bother calling suser() in tunopen().Matthew Dempsky
"Sure" deraadt@
2010-09-22various whitespace fixes that my hands did while i was looking for sthHenning Brauer
else and an unneeded if (r)
2010-09-21Don't dereference null pointers for protocols without port numbers.Stuart Henderson
From henning@, fixed pflog_bgpcopy crashes.
2010-09-21assert copyrights / bump yearsHenning Brauer
2010-09-21aye. that should not have been forgotten. add the rewritten indicatorHenning Brauer
to struct pflog. ok gcc
2010-09-21stuff the original (before rewriting) addresses into the already existantHenning Brauer
address fields in the pflog header, same for ports, and add a "rewritten" indicator. ok ryan dlg
2010-09-21after ruleset eval is done, we must apply actions from the last matchingHenning Brauer
pass or block rule, not the last matching rule. triggered by pr6401. this means that, for example, a rdr-to on a pass rule can override an rdr-to on a match rule that comes later in the ruleset. but that's the semantics: for block and pass rules, the last matching one wins, aka actions are applied after we're done with ruleset eval, and match rules' actions are applied on the fly. discussion with dlg and claudio, ok dlg ryan
2010-09-21do not increment states_tot on match rules. it is purely cosmetic, thisHenning Brauer
value is used in verbose "show rules" output as "states creations", but match rules never create state. states_cur aka "States" is needed and correct, match rules are being associated with states. ok ryan
2010-09-21Cleanup handlings for memory shortage condition:YASUOKA Masahiko
- use rn_inithead0() instead of rn_inithead() to avoid failures on memory shortage. - delete a needless failure handling for malloc(,M_WAITOK) in pipex_add_session(). pointed out by blambert@. ok hsuenaga@
2010-09-21make "match log" rules log on the fly. thus you can log and see the packetHenning Brauer
as it is in the very same moment pf hits that match rule. really awesome with multiple rdr-to and the like. ok dlg - ryan would ok it too if he was here right now
2010-09-21No need to m_freem() a NULL pointer and change the error for unknownClaudio Jeker
protocols to EPFNOSUPPORT.
2010-09-21remove now obsolete XXX commentHenning Brauer
2010-09-21pflog overhaulHenning Brauer
pflog was logging the "wrong" as in not yet rewritten (nat/rdr) addresses. to address this without making an extra copy of the mbuf chain: -introduce bpf_mtap_pflog, which is a 1:1 copy of bpf_mtap_hdr, except that it supplies bpf_catchpacket with pflog_bpfcopy as copy function instead of plain bcopy -said new shiny pflog_bpfcopy knows what a pflog packet looks like, copies everything into bpf's buffer, contructs a fake mbuf (which is allocated once at attach time and reused over and over) which points to the bpf buffer as data storage -call pf_setup_pdesc on said fake mbuf -then call pf_translate to rewrite the addresses as needed right in the bpf buffer this changes the pflog header as we have to pass the new addresses/ports around. relies on canacar's awesome work in libpcap to work olrite with the new, longer pflog header as well as with the old, shorter one. almost completely written at c2k10 in canada, finished here at j2k10 in japan. ok ryan dlg
2010-09-21make pf_translate (void so far) return 1 if it actually changed somethingHenning Brauer
and 0 if it didn't so we know wether we have to rewrite or not. ok ryan dlg and in just an hour from now on this might have reached cvs eventually from njetwork challenged j2k10 in japan
2010-09-21factor our the code to set up pf_pdesc, a central structure in pf carryingHenning Brauer
information about the packet we're currently dealing with, into its own function. ok ryan dlg and additional testing sthen
2010-09-13Using a normaly unavailable 0.0.0.1 gateway on routes on sppp(4) basedClaudio Jeker
devices is a bad idea. The problem is that the default route per se works but PMTU is unable to clone host routes because the gateway is unreachable. Fix sppp(4) so that it walks the routing table and fixes the gateways. This makes PMTU work again. Diff tested by weerd@ and markus@ (older version) for a long time.
2010-09-08creating a pfsync interface is always done from process context, soBret Lambert
we can pass M_WAITOK to malloc(9) (which was already done a few lines down, which set off my aesthetic alarm). While here, include malloc.h, since we're calling malloc. ok dlg@
2010-09-08Switch the MPLS blocks for RTM_CHANGE. Do not always remove the MPLSClaudio Jeker
information if the gateway changes, since real MPLS routes need to change gateway and outgoing label on topology changes. So if there is MPLS information and an outgoing label do a proper change but if the gateway of a non-MPLS route is changed remove the MPLS path since it is no longer valid. OK michele@
2010-09-02don't attempt to enqueue routing messages on sockets marked SS_CANTRCVMOREBret Lambert
ok claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 18:47:30 +0000