| Age | Commit message (Collapse) | Author |
|---|
|
|
|
ok frantzen, dhartmei, henning
|
|
for equality (ip_tos == x). for priority queue assignment, compare AND-wise
(ip_tos & IPTOS_LOWDELAY). this matters mostly for cases where the reserved
bits in ip_tos are used (RFC791, 1349) and more than a single bit is set.
from Steve Welham, closes PR5226 and PR5227.
|
|
numbers, reported by Raja Subramanian; ok henning@
|
|
as the resulting demotion counter value is in range. previously, we only
allowed +/- 1. ok mpf mcbride deraadt
|
|
and drop such bad packets. Also remove some redundant mallocs.
This fixes possible heap overflows when forming replys to such bad
packets as discovered by Martin Husemann and Pavel Cahyna.
reported by NetBSD, initial diff from markus@,
additional comments by claudio@, ok markus@
|
|
|
|
but third-party tools). a rule must have a non-empty replacement address
list when it's a translation rule but not an anchor call (i.e. "nat ... ->"
needs a replacement address, but "nat-anchor ..." doesn't). the check
confused "rule is an anchor call" with "rule is defined within an anchor".
report from Michal Mertl, Max Laier.
|
|
code. however, it is still cluttering up the kernel namespace a bit. it is
better gone.
ok claudio@
|
|
|
|
Affects devices using the sppp layer (pppoe, art, san, lmc)
ok deraadt@
|
|
Also cleanup error message device name printing.
Based on diff from NetBSD via Andrey Matveev
Also, use log when printing error messages, and syslog will
handle any nonprintable characters, discussed with deraadt@
|
|
|
|
matching that rule so that the forwarding code later can use the
alternate routing table fo lookups (not implemented yet).
the tagging is "sticky", every matching rule modifies, just like the
regular "tag". ok claudio hshoexer, hacked at r2k6
|
|
dmesg printf everytime they came up, would that be a better world?
|
|
the "pppoe0: up" message is annoying when one is on console and the
system has been configured to recall the ISP every minute or so.
Moving the printf() to a log() fixes this and the "pppoe0: up"
message is still seen in logs and dmesg.
ok canacar@
|
|
|
|
|
|
of 1Gbps, until the size of the baudrate field has been increased.
|
|
routes did not carefully check if the route lookup succeded or not and so
rn_mpath_next(rn) blowed up because rn was NULL. Check if rnh_lookup succeded
before touching rn in anyway. OK norby@ initial diff by hshoexer@
|
|
|
|
To minimise path disruptions, this implements recommendations made in RFC2992 -
the hash-threshold mechanism to select paths based on source/destination IP
address pairs, and inserts multipath routes in the middle of the route table.
To enable multipath distribution, use:
sysctl net.inet.ip.multipath=1
and/or:
sysctl net.inet6.ip6.multipath=1
testing norby@
ok claudio@ henning@ hshoexer@
|
|
previous route that may not have been inserted with the -mpath flag.
Similarly, when removing a multipath route and leaving only one route,
clear the RTF_MPATH flag so this is clear.
ok claudio@
|
|
|
|
|
|
(NET_RT_DUMP & friends) too. keep supporting the old form (and imply id 0)
of course. claudio ok
|
|
manipulate alternate tables from userland. new tables are created
implicitely when an RTM_ADD for that table is seen.
ok norby claudio hshoexer
|
|
parameter so they can work on alternate tables. table 0 hardcoded for
many callers yet, that will be adapted step by step.
input + ok claudio norby hshoexer
|
|
remove the ugly routed hacks. OK henning@, hshoexer@
|
|
problem before: with this, we are no longer using the address family as
array index directly, since only 3 of 31 address fanilies actually attach
a table, but we're using an address family to array index translation (just
another array). there, 0 meant "does not attach a table", thus rt_gettable
has to return a null pointer. unfortunately we were using array index 0 for
whatever af attaches first, and since the list is backwards,, that used to
be ipsec - execpt on ipsec-less ramdisks, where it was inet6, and since
route show blindly iterates over all address families, and all those
without a table pointed to index 0, we got 28 or 29 copies of the v6 table.
i had that right initally, and then i borked it later... re-spotted by
claudio.
ok norby hshoexer claudio
|
|
'route show' dump out repeated copies of the v6 routing table on ramdisks.
on some architectures it spins forever doing this, on others it just
goes for a long time printing the v6 routes over and over before terminating.
spotted by jmc and krw, backout diff tested by beck.
|
|
As a first user, move the global carp(4) demotion counter
into the interface group. Thus we have the possibility
to define which carp interfaces are demoted together.
Put the demotion counter into the reserved field of the carp header.
With this, we can have carp act smarter if multiple errors occur.
It now always takes over other carp peers, that are advertising
with a higher demote count. As a side effect, we can also have
group failovers without the need of running in preempt mode.
The protocol change does not break compability with older
implementations.
Collaborative work with mcbride@
OK mcbride@, henning@
|
|
.. fixes proto display for the non zero case
ok claudio@
|
|
we trade higher memory consumption if the user doesn't use continous table
IDs, but in the worst case (table IDs 0 and 255, 64bit machine) that is 2KB
ok claudio ryan
|
|
|
|
-instead of staticaly declaring the heads, allocate memory for them
-add second dimension to the routing table head array, table ID
-space saver: do not use the AF as array index directly, but have an
AF->index translation array and only account for AFs actually attaching
a routing table
note that whil ethat allows for multiple routing table heads, nothing uses
taht yet.
tested by many, ok claudio reyk norby mcbride
|
|
OK henning@ norby@
|
|
msf@'s assistance with hexdumping, this bug was found.
do NOT access the wrong union member (sockaddr_in) when using v6 addresses
this fixes output errors when displaying v6 encap routes for ipsecctl, route,
and recently netstat
ok hshoexer@ markus@ claudio@ naddy@
|
|
mbuf flags so that the packet is sent out with a normal link local address
instead of a multicast or broadcast address. OK brad@
|
|
state limit and adaptive.end of 120% of the state limit.
Explicitly setting the adaptive timeouts will override the default,
and it can be disabled by setting both adaptive.start and adaptive.end to 0.
ok henning@
|
|
Another ipsec failover fix from nathanael at polymorpheus dot com.
ok hshoexer@
|
|
drivers report an active link state even if the interface is DOWN.
this should fix trunk with various ethernet devices.
ok brad@
|
|
|
|
more drivers.
ok reyk@
|
|
|
|
|
|
|
|
the establish calls were bypassed or failed.
ok mpf@
|
|
|
|
error counter. just silently drop them...
figured out by todd@, ok brad@
|
