summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2007-11-01correct fixTheo de Raadt
2007-11-01tsk tsk tsk, noone tested this; spotted by canacarTheo de Raadt
2007-10-31'block return' must not send anything on blocked icmp packets.Marco Pfatschbacher
Noticed by Kai_Doernemann_at_genua.de OK henning@, deraadt@
2007-10-31Don't leak potentially secret authname through ioctl interface.Mike Belopuhov
Suggestions from mpf@ and canacar@ ok deraadt mpf canacar
2007-10-30fix a typo, LIST_FOREACH(bp2, ... and then using bp instead of bp2Henning Brauer
inside that loop doesn't yield the expected results. from freebsd r1.37 Andrew Thompson <thompsa@freebsd.org>
2007-10-25Fix probability rules w/ numbers (e.g probability 0.4).Marco Pfatschbacher
Add support for probablities of 0% and 100%. With and OK deraadt@
2007-10-22use the input mbuf for the first active port instead of copying it inReyk Floeter
the broadcast start routing. ok pyr@
2007-10-22Add a broadcast mode to trunk(4). This mode sends frames on allPierre-Yves Ritschard
ports and receives frame on any port. This allows interaction with some L2 configurations. with input and ok reyk@
2007-10-18There is no point for IP addresses on pflog(4)Marco Pfatschbacher
OK dhartmei@, henning@
2007-10-14'syncronize' -> 'synchronize'. From Diego Casati.Kenneth R Westerback
2007-10-13remove unneeded declarations that shadows existing vars; ok by many.Federico G. Schwindt
2007-10-05add a 2.5 Gbps fiber media type.Brad Smith
From FreeBSD ok claudio@ dlg@
2007-09-27Add loginterface support for groups.Marco Pfatschbacher
Using a group sums up the statistics of all members. Modify pfctl(1) slightly to allow a groupname "all", which gives us an overall pf(4) statistic. OK henning@, markus@
2007-09-25Handle incoming protocol reject packets now that we haveCan Erkin Acar
more than one protocol. From FreeBSD, reported and tested by jmc@
2007-09-19tidy up a little.Brad Smith
ok claudio@ dlg@
2007-09-19Use the proper baudrate for 10Gb hw now that it can fit into the buadrateBrad Smith
field. ok claudio@ dlg@
2007-09-18allow 4095 instead of 20 multicast group memberships per socket (you needMarkus Friedl
one entry for each multicast group and interface combination). this allows you to run OSPF with more than 10 interfaces. adapted from freebsd; ok claudio, henning, mpf
2007-09-18allow state reuse for tcp if both sides are in FIN_WAIT_2 and a new SYNMarkus Friedl
arrives; ok dhartmei, henning, feedback aaron
2007-09-17- Use a 64-bit int for the baudrate within the ifmedia_baudrate struct andBrad Smith
return a 64-bit int for ifmedia_baudrate(). - Fix consumers of ifmedia_baudrate() to deal with the change. ok claudio@ dlg@
2007-09-17Do not take wild guesses at how if_enc's internal works, includePierre-Yves Ritschard
net/if_enc.h instead. ok todd@ and probably claudio who's in the train.
2007-09-16another M_ZERO diff.Pierre-Yves Ritschard
2007-09-15malloc sweep:Henning Brauer
-remove useless casts -MALLOC/FREE -> malloc/free -use M_ZERO where appropriate instead of seperate bzero feedback & ok krw, hshoexer
2007-09-13Convert MALLOC/FREE to malloc/free and use M_ZERO where applicable.Hans-Joerg Hoexer
ok krw@
2007-09-09Only clear the message header if it is called from a sysctl walk. ThisClaudio Jeker
unbreaks RTM_GET. Problem reported by fkr@
2007-09-08Clear the message header (and only the message header) in rt_msg2.Claudio Jeker
By doing so we ensure that all the memory is initialised and we no longer have to ensure that none of the structure elements is forgotten in sysctl_iflist() and sysctl_dumpentry(). This solves the route flush issues seen by aanriot@ OK henning@
2007-09-08we dont need net/rndvar.h since the code that used it has been moved toDavid Gwynne
if.c.
2007-09-07Do not recalculate TCP payload length in pf_test_rule() as it hasAlexander Bluhm
been cached in pd->p_len. ok henning@ markus@
2007-09-07Check if rtm_hdrlen is smaller then the passed message or it would be possibleClaudio Jeker
to access uninitialised memory. Set dst to 0 on error, the error path tries to access dst but dst is inited later down the code. This fixes a kernel panic seen by aanriot@ OK henning@
2007-09-07use M_ZEROReyk Floeter
2007-09-06bump the copyright while touching these filesReyk Floeter
2007-09-06With a trunk(4) interface in fail over mode the trunk(4) interfaceReyk Floeter
will show input errors for packets received from any of the ports that are part of a fail over interface but are not the "master" port at the time. This fixes the problem by checking the error condition correctly. From brad at comstyle dot com
2007-09-05IPv6 support for sppp layer, based on NetBSD version.Can Erkin Acar
ok claudio@
2007-09-03Bump RTM_VERSION to 4 and start a new aera of routing in OpenBSD :)Claudio Jeker
Changes include 64bit counters instead of u_long, routing table id in the header of most messages, reserved routing priority field, added a hdrlen field to skip over the header so that binary compatibility becomes easier. A minimal backward support for old binaries is included to ease upgrades but don't expect anything more than ifconfig, route and dhclient to correctly work. OK henning@ mglocker@
2007-09-03Make use of the pfsync 'badval' and 'stale' counters instead of usingJoel Knight
'badstate' everywhere. ok henning@
2007-09-01since theHenning Brauer
MGET* macros were changed to function calls, there wasn't any need for the pool declarations and the inclusion of pool.h From: tbert <bret.lambert@gmail.com>
2007-09-01replace the machine dependant bytes-to-clicks macro by the MI ptoa()Martin Reindl
version for i386 more architectures and ctob() replacement is being worked on prodded by and ok miod
2007-08-31zap unused "pf_tag" structure.Thordur I. Bjornsson
ok henning@
2007-08-30mechanic change:Henning Brauer
there is a 1:1 mapping between direction and the tree the states get attached to. there is no need to have anything outside the state insertion/ deletion/lookup routinbes know about these internals. so just pass the direction to the lookup functions and let them pick the right tree. ok dhartmei markus
2007-08-30handle address ranges in skip step calculationDaniel Hartmeier
2007-08-30add support for address ranges ("from 10.1.2.50 - 10.1.3.75") in from/toDaniel Hartmeier
criteria. ok mcbride@
2007-08-28showing this diff is shameful...Henning Brauer
if (r != NULL && r->rtableid >= 0) - m->m_pkthdr.pf.rtableid = m->m_pkthdr.pf.rtableid; + m->m_pkthdr.pf.rtableid = r->rtableid; fortunately it is in pf_send_tcp and thus the effect is very limited, RSTs sent due to "block return(-rst)" could be routed using the main routing table instead of an alternate one specified on the block rule. spotted by Janjaap van Velthooven <janjaap@stack.nl>
2007-08-28The m_pulldown used for aligning was not copying the header,Can Erkin Acar
revert back to m_pullup2. Reported and tested by Enache Adrian additional testing by naddy@ and claudio@ ok claudio@, deraadt@
2007-08-23allow RSTs with th_seq == seqlo +- 1, reduces the amount of 'loose state'Daniel Hartmeier
messages, add 'dir=' part to 'loose state' message, ok henning@, markus@
2007-08-21don't access th_flags when it isn't available (only 8 bytes of theDaniel Hartmeier
header are required in the ICMP error). ok deraadt@, henning@
2007-08-20Align the packet after the ppp header.Can Erkin Acar
The earlier change was broken in sparc due to alignment problems. reported and tested by nady@, ok deraadt@ claudio@
2007-08-14Make sure all the packet is in one continuous mbuf.Can Erkin Acar
This is a bandaid solution, a better solution will go in post 4.2. Reported and tested by Joerg Zinke. ok claudio@, deraadt@
2007-08-07Use the length of the mbuf instead of the packet.Can Erkin Acar
When sending a protocol reject. Prevents reading past the mbuf in case the mbuf does not cover the whole packet. ok claudio@, henning@
2007-08-06Fix some "that that"s.Tom Cosgrove
ok miod@ jmc@
2007-07-30With adding ipsec tags and exporting flow filters via sysctl SADB_GETHans-Joerg Hoexer
needs to be allowed to export that information too. Thus, adjust sadb_exts_allowed_out[] accordingly. This fixes isakmpd not being able to get the in-kernel last-used-counters of SAs, which are needed for DPD. ok ho@
2007-07-25Back out the tracking of procs in struct selinfo. There's one seriousArtur Grabowski
bug in the code, but as soon as I try to fix it, it seems to trigger some other bugs. Instead of trying to figure out what's going on while everyone suffers, it's better to back out and figure out the bugs outside the tree.