summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2011-08-03Remove redundant prototype for pf_socket_lookup().Marco Pfatschbacher
It's already in pfvar.h OK mcbride@
2011-08-03someone (*cough*henning*cough*) made pf_state.state_flags a u_int16_tDavid Gwynne
without growing it in pfsync_state too. to keep the wire format compat this uses some of the pad bytes to send all the state flags on the wire as well as maintaining the old state_flags field. after 5.0 we'll deprecate the original field and only use the new one. discussed with mcbride and deraadt and based on a diff from deraadt. tested against an "old" pfsync locally. ok mcbride@ henning@ deraadt@
2011-08-02Replace one byte of padding with sa_family_t af in pfsync_state_key;Ryan Thomas McBride
Reject states with pfsync_state->af == 0 in pfsync_state_import(), in preparation for states which specify an address family in each state key instead (change will take place post-5.0). ok dlg henning mikeb
2011-07-29Make sure we use the right tbl/dyn pointer to check the pfrkt_refcntcost;Ryan Thomas McBride
improved debugging for error cases inside the weighted round-robin loop. original diff from claudio, ok henning
2011-07-28fix set skip group matching: don't match partial strings, i. e. 'set skip onHenning Brauer
lo' must not match a group 'local'. diff from sthen who is not around for a few days, ok me and mpf. I can't find the mail of the guy who initially ran into this problem, sorry for that, thanks for reporting!
2011-07-27Add support for weighted round-robin in load balancing pools and tables.Ryan Thomas McBride
Diff from zinke@ with a some minor cleanup. ok henning claudio deraadt
2011-07-26__arm32__ -> __arm__, since our new compiler isn't defining theMartynas Venckus
former anymore. OK miod@.
2011-07-24OS fingerprinting can only be done on rules that explicitly specify TCPRyan Thomas McBride
now, put it in the IPPROTO_TCP case of the pf_test_rule() inner loop. ok henning sthen
2011-07-23Replace the IPv6 header walking loop in pf_test_state_icmp() withAlexander Bluhm
the common function pf_walk_header6(). For that, pf_walk_header6() can now extract both the information wether it is a fragment and the final protocol if it is the first fragment. This allows to match the icmp6 too big packet of a first fragment to the reassembled packet's state. This is neccesary if a refragmented fragment is to big for the Path-MTU. Note that pd.proto contains the real protocol number for the first fragment and IPPROTO_FRAGMENT for later fragments. pd.virtual_protocol is set to PF_VPROTO_FRAGMENT for all fragments. ok mcbride@
2011-07-22use ifmedia_delete_instance() when destroying a vetherTheo de Raadt
from Martin Pelikan
2011-07-22Sync 'block return' behaviour for ICMP packets with our IP stack:Ryan Thomas McBride
Rather than silently dropping ALL icmp packets, return icmp/icmp6 error for 'informational' message types (but continue dropping ICMP errors unconditionally). ok markus sthen henning
2011-07-22fix typos, martin pelikanHenning Brauer
2011-07-18unbreak set-tos for ipv6; reported by babut at yandex dot ru,Mike Belopuhov
with input and ok from bluhm and claudio
2011-07-12break up a line of code that involved a decrement operator and macrosJonathan Gray
so it evaluates in the order we want. ok claudio@
2011-07-09If ipv4+icmp6 or ipv6+icmp packets were embedded into an icmpAlexander Bluhm
payload, we missed to drop them. While there, also add a reason to the corresponding check in pf_test(). ok mcbride@ claudio@
2011-07-09sned BPDUs at prio 6, just like lacp and carp, ryan zinke mpfHenning Brauer
2011-07-09mark the mgmt pkts for queueing prio 6, mpf okHenning Brauer
2011-07-09honor the net.inet.udp.checksum setting.David Hill
ok claudio henning yasuoka
2011-07-09remove more atalk bitsTheo de Raadt
2011-07-09begone, fucking rotten appletalk shit. ok roomHenning Brauer
2011-07-08ensure that we won't enter an endless loop while iterating overMike Belopuhov
an address pool. problem found and solution tested by claudio. ok claudio, henning, "reads fine" to zinke
2011-07-08Last part of pipex_{pppoe,l2tp,pptp}_input() are almost identical.YASUOKA Masahiko
Integrate them into pipex_common_input(). ok hsuenaga@
2011-07-08surprisingly, we use pf as classifier for the new priority queueingHenning Brauer
implementation. ok ryan mpf sthen and also testing pea and halex looked at it and commented as well
2011-07-08new priority queueing implementation, extremely low overhead, thus fast.Henning Brauer
unconditional, always on. 8 priority levels, as every better switch, the vlan header etc etc. ok ryan mpf sthen, pea tested as well
2011-07-08Include PIPEX in kernel by default. And add new sysctl variableYASUOKA Masahiko
`net.pipex.enable' to enable PIPEX. By default, pipex is disabled and it will not process packets from wire. Update man pages and update HOWTO_PIPEX_NPPPD.txt for testers. discussed with dlg@, ok deraadt@ mcbride@ claudio@
2011-07-08Increase sdl_data so that more then IFNAMSIZ bytes are available.Claudio Jeker
Additionally round the sizeof(struct sockaddr_dl) to a power of 2. OK guenther@ deraadt@
2011-07-07We should not have any direct initialization of ifq structures.Ryan Thomas McBride
(in this case it's unnecessary, bss is initialized to zero at boot) ok henning
2011-07-07There were two loops in pf_setup_pdesc() and pf_normalize_ip6()Alexander Bluhm
walking over the IPv6 header chain. Merge them into one loop, adjust some length checks and fix IPv6 jumbo option handling. Also allow strange but legal IPv6 packets with plen=0 passing through pf. IPv6 jumbo packets still get dropped. testing dhill@; ok mcbride@ henning@
2011-07-07use IF_LEN/IFQ_LEN to access and ifqueue's length field. ryan okHenning Brauer
with this nothing in the tree fiddles if ifqueue internals any more, of course except if.c and if.h (and some altq)
2011-07-07provide IF_LEN and IFQ_LEN to access ifq_len on an ifqueue, ryan okHenning Brauer
2011-07-07Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzTheo de Raadt
code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
2011-07-07Fold pf_test_fragment() into pf_test_rule(), reduce code and fixesRyan Thomas McBride
a bunch of bugs with fragment handling not being in sync with the rest of the ruleset. Much feedback from mpf, bluhm & markus Thanks to Tony Sarendal for help with testing ok bluhm; various previous versions ok henning, claudio, mpf, markus
2011-07-07another case of "clever" fiddling with ifq internals, just stumbled overHenning Brauer
this in my monster diff and wondered that i hadn't put that in already... claudio ryan ok
2011-07-06ppp_ifstart unconditionally. depending on ALTQ for this is ridiculous.Henning Brauer
one tree less in my forest (for a few seconds)! ok claudio
2011-07-06and make sppp_qflush a wrapper around IF_PURGE instead of handrollingHenning Brauer
the same, ok'd with IFQ_PURGE with happens to break on altq kernels by claudio, ryan and bluhm
2011-07-06use IF_IS_EMPTY istead of mucking if ifqueue internalsHenning Brauer
2011-07-06second trial: stop messing with ifq internals, this time use IF_IS_EMPTYHenning Brauer
and not IFQ_IS_EMPTY, the former doesn't get overloaded with altq-specific stuffz. original oks from claudio and ryan and bluhm, i take the liberty to assume the oks for this fixed version
2011-07-06cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmHenning Brauer
2011-07-05Explicitly reserve space for special ICMP6 headers in pf_hdrs, likeAlexander Bluhm
it was done for pf_headers in pf.c. ok mcbride@ henning@
2011-07-05Instead of passing the ip header and mbuf to pf_reassemble(), lookupAlexander Bluhm
the header address in the mbuf. ok henning@
2011-07-05Revert henning's commit-n-run that broke the treePhilip Guenthe
2011-07-05IFQ_IS_EMPTY instead of fiddling with ifqueue internalsHenning Brauer
isn't it awesome that 5 out of 6 cases of this crap were in the various ppp implementations? ok claudio ryan the 6th to be fixed when we return from MEC
2011-07-052 cases of IFQ_IS_EMPTY instead of mucking with ifqueue internalsHenning Brauer
make sppp_flush use IFQ_PURGE instead of handrolling the same making assumptions about ifqueue internals. ok ryan claudio
2011-07-05ifqueues in BSS don't need NULL init, especially not absolutely incorrectHenning Brauer
ones that make assumptions about ifqueue internals... ok ryan claudio
2011-07-05use IFQ_IS_EMPTY instead of fiddling with ifqueue internals - 3 casesHenning Brauer
why bother with APIs when you can muck with internals directly, it's obvious there'll NEVER be changes, right. ok claudio ryan
2011-07-05add missing ifdefs for INET6; diff from form, ok henning, bluhm, claudioMike Belopuhov
2011-07-05now of course I only noticed if_qflush is completely unused afterHenning Brauer
adjusting it to the new world order in my tree... remove it, ok ryan claudio
2011-07-04Say no to hand-rolled m_adj(). It also kills three XXX.Claudio Jeker
OK dlg@ henning@
2011-07-04remove compat_svr4 support. ok deraadtTed Unangst
2011-07-04use mtod.David Hill
no change in binary "Sure" claudio@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 21:56:52 +0000