summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2011-04-05ditch fastroute, an ipf feature that made its way into pf beforeMike Belopuhov
route-to and friends were introduced making it obsolete. one even has to look it up int the ipf manual to get and idea what it's supposed to do. reuse some kernel bits for the upcoming nat64 stuff. "kill it with fire" from mcbride, "what mcbride said" from mpf, "kill kill kill" and ok henning.
2011-04-04m_copyback is no longer a void function, so start using its error returnBret Lambert
instead of coming at it sideways to detect failure. ok claudio@
2011-04-04de-guttenberg our stack a bitHenning Brauer
we don't need 7 f***ing copies of the same code to do the protocol checksums (or not, depending on hw capabilities). claudio ok
2011-04-04previous commit replaced a malloc(new) with malloc(sizeof(*new)) whichBret Lambert
leads to corrupted memory; backout to await a better fix
2011-04-04Don't do crazy address manipulations when looking up the remote endClaudio Jeker
of the gre(4) tunnel. Instead just us a RT_NOCLONING route lookup and be done with it. Makes gre(4) work between systems in the same LAN. This diff was enough long on tech@ and nobody complained.
2011-04-04and stop special casing the bridge for the ip cksum hardware offloadHenning Brauer
decision here too, just like in ip_output, pointless.
2011-04-04stop fiddling with the ip checksum here too, it is always recalculatedHenning Brauer
in all output pathes anyway. even worse than in the rest of pf, here we ran circles to update the ip cksum every time we flip a tiny bit in the header... pretty sure dlg claudio ok'd it and it is damn obvious anyway
2011-04-04stop using the stupid R_Malloc/Bcopy/Free macros, and just start usingBret Lambert
malloc/bcopy/free, the way He Who Must Not Be Named intended. "yes please" claudio@
2011-04-04there is no point at all in updating the ip checksum. it is alwaysHenning Brauer
recalculated in all output pathes anyway (why did it take us 10 years to notice?). ok claudio definate ok dlg
2011-04-04all I wanted is to make the bridge behave like the real stack wrt the ipHenning Brauer
chekcsum. turned out is always recalculates it as long as your kernel does have pf compiled in, as in, always, since compilation of GENERIC without pf explodes in about a hundred ways. so rename bridge_filter -> bridge_ip and always compile it, pf or not, just make the pf_test calls #if NPF, and sync the ip fuckery code with ip_output. as a bonus this lets us use the checksum offloading to the NIC if it is capable of that. ok claudio dlg sthen
2011-04-03Always reserve space in the routing socket for a desync mbuf. This allowsJoel Sing
a desync to be appended when the socket buffer becomes full, rather than continuall retrying until space becomes available (which may be never). ok claudio@
2011-04-03Don't attempt to enqueue mbufs on sockets marked as SS_CANTRCVMORE, asBret Lambert
was done earlier for routing sockets. ok claudio@
2011-04-02dont let pfsync defer packets for states with NOSYNC set.David Gwynne
2011-04-02add a pipex ioctl that lets you specify a description on pppx interfaces byDavid Gwynne
session id. ok claudio@ yasuoka@ as part of a larger diff code from jonathan matthew
2011-04-02configure the addresses on the pppx interface when its created by npppd soDavid Gwynne
it is immediately functional. ok claudio@ yasuoka@ as part of a larger diff code by jonathan matthew
2011-04-02add the local ip address to the session request ioctl so npppd can tell itDavid Gwynne
to the kernel. ok yasuoka@ claudio@ as part of a larger diff
2011-03-31- use nitems(); no binary changeJasper Lievisse Adriaanse
ok claudio@
2011-03-25Include original rdomain in DIOCNATLOOK. This allows userland proxiesClaudio Jeker
to establish cross rdomain proxy sessions. OK henning@, mpf@
2011-03-24Reassemble IPv6 fragments in pf. In the forward case, pf refragmentsAlexander Bluhm
the packets with the same maximum size. This allows the sender to determine the optimal fragment size by Path MTU Discovery. testing sthen@ matthieu@ ok claudio@
2011-03-23Extract the address family independent functions from pf fragmentAlexander Bluhm
reassembly code. This makes it possible to reuse them for IPv6. ok claudio@
2011-03-14fixed a use-after-free bug introduced at 1.7 in pipex_mppe_output().YASUOKA Masahiko
ok dlg@ tested by jono
2011-03-14fix typoYASUOKA Masahiko
patch from Gleydson Soares ok dlg@
2011-03-13Add a way to enable/disable Wake On LAN with ifconfig.Stefan Sperling
ok deraadt
2011-03-07Declare the inline function pf_addr_compare() non-static in pfvar.hAlexander Bluhm
to make it reusable by pf fragment reassembly. No functional change. discussed with henning@, claudio@, deraadt@, kettenis@ ok guenther@
2011-03-05The function pf_tag_packet() never fails. Remove a redundant checkAlexander Bluhm
and make it void. ok henning@, markus@, mcbride@
2011-03-02when sending deferred packets use ip6_output for v6 frames instead ofDavid Gwynne
blindly assuming everything is v4 to be sent with ip_output. problem originally reported by Marco Fretz. fix verified locally. ok henning@ mcbride@
2011-02-24Don't use address and control field on PPPoE, they must not be used asYASUOKA Masahiko
the protocol.
2011-02-23fixup source address rewriting for the icmp errors with the rdr-to setup.Mike Belopuhov
problem was reported by babut at yandex dot ru in the pr 6564, tested by the pr originator and me, ok henning mcbride. shaves off a bunch of XXXs.
2011-02-18when changing the vlandev of a running vlan(4) interface, we also need toReyk Floeter
move the configured multicast addresses and preserve the promisc mode settings of the parent. this fixes an issue when carp stopped working on a vlan after the vlandev was manually changed. ok naddy@ phessler@
2011-02-14free mbuf in failure case. fix for pr6562. ok claudio.Ted Unangst
2011-02-14Add missing byte-order swap to pf_match_addr_range. Without this, rulesStuart Henderson
using address ranges (e.g. "10.1.1.1 - 10.1.1.5") did not match addresses correctly on little-endian systems. ok henning@
2011-02-13Unbreak userland as well, since bpf_filter.c is also used in libpcap.Can Erkin Acar
Noticed by robert at openbsd pap st, thanks.
2011-02-12Unbreak previous commit by adding the proper header file.Can Erkin Acar
2011-02-12Clear the filter memory area before using it. Leaving it uninitialized mayCan Erkin Acar
leak previous kernel stack contents through a malicioius BPF filter. Reported by Dan Rosenberg via Alistair Crooks. ok deraadt@, krw@, claudio@
2011-02-06pf_translate() may be called from pflog_packet(). Make sure thatAlexander Bluhm
IPv4-ICMP6 and IPv6-ICMP packets are not rewritten in case they are dropped and logged. spotted by mikeb@; ok henning@
2011-02-06pf_test() and pf_test6() drop IPv4-ICMP6 and IPv6-ICMP packets. DoAlexander Bluhm
not do the same check in pf_test_rule() again. ok henning
2011-02-05When a packet with an unusual protocol number got rewritten, theAlexander Bluhm
header lenght was uninitialized. This resulted in a panic in m_clget(). Initialize hdrlen with 0 and call m_copyback() only if necessary. ok henning@
2011-02-01The check for invalid IPv6 fragment size in pf_normalize_ip6() wasAlexander Bluhm
wrong. As an effect small valid fragmented packets got dropped and some invalid fragmented packets were passed. plen is the payload lenght of the ipv6 packet without the ipv6 header. off is relative to the whole packet including the ipv6 header. Add sizeof(struct ip6_hdr) in the calculation. ok henning@ markus@
2011-01-28Replace another m_free() with m_freem() to plug an mbuf leak in mpe_input().Reyk Floeter
ok gollo@
2011-01-28Fix another memory leak by replacing m_free() with m_freem() in trunk'sReyk Floeter
broadcast mode. ok blambert@ mikeb@
2011-01-28Change an m_free() to m_freem() to free the whole mbuf chain and to preventReyk Floeter
a possible memory leak with bpf's BIOCSFILDROP option which is currently used by dhcpd and dhclient. Found by gollo@
2011-01-28make sure that the size of the addresses userland is trying to configureDavid Gwynne
make sense, not just the family. from jonathan matthew ok yasuoka@
2011-01-25pool is properly spelled pl. makes this one fit in netstat column.Ted Unangst
2011-01-22Pf must not scrub packets which will be dropped anyway.Alexander Bluhm
ok henning@ markus@
2011-01-21make mpls compile w/o errors when inet6 is not definedMike Belopuhov
diff from form@ who's too busy drinking vodka with pelmeni to commit this; ok claudio
2011-01-20The reason accounting in pf_reassemble() was not correct. ChangeAlexander Bluhm
pf_reassemble() to return PF_DROP or PF_PASS and *m0 is NULL or the reassembled packet. In case of PF_DROP, the mbuf must be valid, e.g. for logging, and will be freed later. In case the reassembled packet is too big, use the reassembled mbuf for PF_DROP. ok henning@ markus@
2011-01-19Give pf_normalize_ip() the same 3 way semantics as pf_test().Alexander Bluhm
- PF_DROP, the packet is bad, the mbuf still exists and must be freed. - PF_PASS and *m0 is NULL, the packet has been processed, not an error. - PF_PASS and *m0 is not NULL, continue with packet processing. This fixes a potential mbuf use after free. ok henning@ markus@ mpf@
2011-01-18When changing the ifa_broadaddr broadcast address, ifa_update_broadaddr()Alexander Bluhm
copied the pointer to the sockaddr instead of the content of sockaddr_in. As the source of the data resides on the stack, the pointer got invalid later and the kernel crashed. As only addresses with fixed size are used, sa_len bytes of the sockaddr can be coppied. ok krw@ markus@ mpf@ claudio@ henning@
2011-01-12Never include SADB_X_EXT_REMOTE_AUTH (which is either aMike Belopuhov
passphrase or an RSA key) in the reply message. There's nothing that justifies this behavior and PF_KEY RFC prefers to exclude keys and other sensitive material from replies. Discussed with reyk, no objections from deraadt.
2011-01-11for key material that is being being discarded, convert bzero() toTheo de Raadt
explicit_bzero() where required ok markus mikeb
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-15 17:47:20 +0000