summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2013-09-17Change vlan(4) detach procedure to not use a hook but a list of vlansMartin Pieuchot
on the parent interface. This is similar to what bridge(4), trunk(4) or carp(4) are doing and allows us to get rid of the detachhook. ok reyk@, mikeb@
2013-09-13Don't send flows if flowsrc is not set. Packages had a brokenFlorian Obser
checksum. Since no one seems to have a use case for sending flows from INADDR_ANY disallow this. Pointed out by Nathanael Rensen on tech@, thanks. While there make the SIOCSIFFLAGS and SIOCSETPFLOW cases symmetric by only sending templates if the interface is running. OK benno@
2013-09-12Revert previous diff to always increment the interface index, tun_switch()Martin Pieuchot
depends on this feature, discussed with claudio@.
2013-08-30Missing splx on return path.Christiano F. Haesbaert
ok bluhm@
2013-08-28When we attach an interface, do not try to reuse the last index to limitMartin Pieuchot
the possible races related to unscheduled task relying on an unique index. I say "limit" here because a race can still occurs if you run out of indexes and jump back to 1. ok krw@, mikeb@
2013-08-28Remove unused argument from *rtrequest()Martin Pieuchot
ok krw@, mikeb@
2013-08-21No need to include if_vlan_var.h twice.Martin Pieuchot
2013-08-21get rid of the copy argument in m_devget that let you provide anDavid Gwynne
alternative to bcopy since noone uses it. while there use memcpy instead of bcopy because we know the memory cannot overlap. ok henning@ matthew@ mikeb@ deraadt@
2013-08-20tedu netnatm and ueagle(4).Martin Pieuchot
ok mikeb@, sthen@, tedu@ (implied), doc bits ok jmc@
2013-08-19in pf_test_rule, when dealing with a match rule, obey the match rule's quickHenning Brauer
flag to decide wether to abort ruleset eval instead of the last matching rule's one. makes "match quick" abort ruleset evaluation with the current block/pass state. from Maxim Khitrov <max at mxcrypt.com>, ok bluhm mikeb
2013-08-16Replace the misleading SIOC{G,S}IFGENERIC ioctls by SIOCG{G,S}PPPPARAMS.Martin Pieuchot
This is another ABI break but no port rely on them as verified by naddy@. ok claudio@, mikeb@, henning@
2013-08-15Stop defining SIOC{S,G}ETVLAN as SIOC{S,G}IFGENERIC because theyMartin Pieuchot
are two differents ioctls manipulating structures of a different size. In particular this prevents vlan(4) to handle pppoe(4)-specific ioctls and vice versa, that could lead to smashing the stack of the caller. Issue originally found by David Hill when compiling ifconfig with clang. Note that this is an ABI break but we're riding a biger dragon right now. ok mikeb@, kettenis@, sthen@
2013-08-13Split pflow version 9 and version 10 to be able to send 64 bitFlorian Obser
time values for version 10. While there mark places which will blow up in 2038. OK benno@
2013-08-10Cancel timeouts on pflow interface destruction.Florian Obser
OK benno@
2013-08-08Insert new IPv4 addresses in only one place, no functional change.Martin Pieuchot
ok mikeb@, henning@
2013-08-07states learnt via pfsync from a peer with the same ruleset checksum wereDavid Gwynne
not getting assigned to rules like they should cos pfsync_in_upd() wasnt passing the PFSYNC_SI_CKSUM flag along to pfsync_state_import. found and fixed by pedro
2013-08-05sync the bridge_broadcast comment with realityMike Belopuhov
2013-07-31Move bridge_broadcast and subsequently all IPsec SPD lookup code outMike Belopuhov
of the IPL_NET. pf_test should be no longer called under IPL_NET as well. The problem became evident after the related issue was brought up by David Hill <dhill at mindcry ! org>. With input from and OK mpi. Tested by David and me.
2013-07-23Do not reset the fragment timeout each time a fragment arrives.Alexander Bluhm
Start the expire counter when the queue is created by the first fragment and drop it if the packet could not be reassembled within 60 seconds. Reported by Antonios Atlasis; OK henning@ deraadt@
2013-07-15Remove a comment which is no longer true.Martin Pieuchot
2013-07-10Change the structure used in the SPPPIOSDEFS and SPPPIOGDEFS ioctlsMartin Pieuchot
to only include what is really needed. In particular stop including a "struct ifnet" and move kernel-only definition into the proper #if dance. While here remove the unused spppinfo() from ifconfig. ok guenther@, sthen@, mikeb@
2013-07-05bring back pflow v10; broken in previous commit, sorry.Florian Obser
ok benno@
2013-07-05Collect and display 'match' counters for pf tables.Bret Lambert
While here, fix pf table displays to fit within 80 chars. Manpage input jmc@ ok henning@ reyk@
2013-07-04Re-commit: use time_t for storing time_t values. This is an ABIPhilip Guenther
change for pf, but that's fine at this time. You'll need to rebuild pf userland after updating your kernel. change to 'since' member ok henning@ rest ok henning@ deraadt@
2013-07-03Switch times in the SLIP softc to time_t and reorder slightlyPhilip Guenther
ok mpi@ deraadt@
2013-07-02Revert previous: sizeof(time_t) != sizeof(long) on LP64, so there wasPhilip Guenther
an ABI change involved.
2013-07-02Use time_t for storing time_t values. No change to the underlyingPhilip Guenther
type**, so no ABI change. ok henning@ deraadt@ ** ...yet
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-06-26Rudimentary counter fix for tables used in match rules.Bret Lambert
Fixes an issue seen by reyk@ ok henning@ reyk@
2013-06-25Protect various driver descriptors by _KERNEL to stop exposing to muchMartin Pieuchot
stuff to userland, especially the "struct ifnet". ok sthen@, henning@, uebayasi@
2013-06-24Revert r1.20 for now, to make sure the newly created address is addedMartin Pieuchot
to the global list, until the issue with carp is addressed.
2013-06-20Revert previous and unbreak asr, the new include should be protected.Martin Pieuchot
Reported by naddy@
2013-06-20Allocate the various hook head descriptors as part of the ifnetMartin Pieuchot
structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
2013-06-18Use malloc(M_WAITOK) in if_attach_common(), because this function mustMasao Uebayashi
succeed, and it's always called in sleepable context. OK mikeb@ yasuoka@
2013-06-18Oops, forgot this file in previous. Should be part of adding/removingMartin Pieuchot
IPv4 addresses consistently from the global list and tree, in.c r1.78 ok bluhm@, mikeb@
2013-06-17Before pulling the TCP options from the mbuf onto the stack, do anAlexander Bluhm
additional length check in pf_modulate_sack() and pf_normalize_mss(). Overflow cannot happen due to the restricted values in the length calculation. As this is not obvious, be better safe than sorry. OK henning@
2013-06-17Instead of bcopy() and bcmp() a single pointer in an mbuf tag,Alexander Bluhm
assign with = and compare with == . This way the compiler will check deeper wether the cast is correct. Alignment is fine, tested on sparc64. OK claudio@
2013-06-16Remove variable sa_family_t family in gif_start() and gif_output().Alexander Bluhm
No functional change. From David Hill; OK claudio@
2013-06-11Replace all ovbcopy with memmove; swap the src and dst arguments tooTheo de Raadt
ok otto
2013-06-08Add new sysctl for pipex packet input/output queue length andYASUOKA Masahiko
counters. ok guenther, feedback jmc
2013-06-05Include sys/timeout.h to make if_gre.c compile without pf.Alexander Bluhm
No binary change. OK henning@
2013-06-05ansi function declarations.David Gwynne
ok sha256
2013-06-05Unbreak the kernel to userspace SADB_X_EXT_TAG message.Reyk Floeter
ok deraadt@
2013-06-05after the pf_test_state folding, in pf_test in the proto switch, theHenning Brauer
udp and the default case are 100% identical, tcp does a little more, but that is easier to add w/ two "if tcp" blocks in the default case, so the udp and tcp cases die. ok bluhm
2013-06-04fold pf_test_state_{tcp,udp,other} into one pf_test_state.Henning Brauer
the _icmp variant stays because it is completely different. factor out the synproxy code into a new pf_synproxy() for readability. pf_setup_pdesc sets us up with access to ports, cksum etc in a protocol independent matter, so we don't need many protocol switches here. tcp and udp were almost identical, the _other case changes significantly - not too unlikely this fixes a subtle bug or two in that case. ok ryan benno bluhm mikeb
2013-06-04add a pointer to the protocol checksum header field to pf_pdesc and setHenning Brauer
it up in pf_setup_pdesc(). ok ryan benno mikeb bluhm
2013-06-04make pf_change_ap() usable without a port. if the port pointer is NULL,Henning Brauer
just return after being done with the address. ok bluhm ryan mikeb
2013-06-03Link pf states and socket inpcbs together more tightly. The linkingAlexander Bluhm
was only done when a packet traveled up the stack from pf to tcp_input(). Now also link the state and inpcb when the packet is going down from tcp_output() to pf. As a consequence, divert-reply states where the initial SYN does not get an answer, can be handled more correctly. This change is part of a larger diff that has been backed out in 2011. Bring the feature back in small steps to see when bad things start to happen. OK henning deraadt
2013-06-03Update o[sd]port whenever n[sd]port is changed. This fixes aAlexander Bluhm
regression introduced with pf.c 1.827 and allows us to create icmp states again. OK henning@
2013-06-03put back the match member to the anchor stack struct - userland (pfctl)Henning Brauer
uses it. that is so incedibly wrong... sorry for the breakage, folks. found by tedu, SMSing me out of my breakfast bob
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-06 03:25:02 +0000