summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2017-06-12have the timeout call if qstart via the serialiser isntead of directlyDavid Gwynne
hfsc schedules a timeout to keep traffic moving if somethings has been delayed an no other tx activity has occurred. that timeout was calling (*ifp->if_qstart)(ifq) rather than ifq_start. the latter prevents concurrent calls to if_qstart. without this change bjorn ketelaars on misc@ was experiencing weird pauses in traffic and lockups because the tx ring was corrupted because re_start was run concurrently, once from the stack and once from hfsc. thanks to bjorn ketelaars for debugging, and mikeb@ for most of the legwork in diagnosing the problem. ok mikeb@
2017-06-09- pfsync_input() must grab PF_LOCKAlexandr Nedvedicky
reported and patch tested by Hrvoje Popovski O.K. bluhm@
2017-06-09Replace rtrequest(RTM_DELETE...) rtrequest_delete() and do not evenMartin Pieuchot
try to remove a route from the table if it is and invalid cache. This is a step towards decoupling code dealing with userland and kernel inserted routes. ok bluhm@
2017-06-07Grab the KERNEL_LOCK() around rtm*() functions. Routing sockets globalsMartin Pieuchot
aren't protected by the NET_LOCK(). While here change lock assertions in rt_{set,put}gwroute(), the NET_LOCK() is enough. Tested by Hrvoje Popovski. ok jmatthew@, claudio@
2017-06-06Update panic strings, pipex no longer use rn_inithead0().Martin Pieuchot
2017-06-06Do not rely on <net/rtable.h> beeing included by other headers.Martin Pieuchot
Fix build without PF, PIPEX nor IPSEC.
2017-06-06Fix build without PF.Martin Pieuchot
2017-06-05- let's add PF_LOCK()Alexandr Nedvedicky
to enable PF_LOCK(), you must add 'option WITH_PF_LOCK' to your kernel configuration. The code does not do much currently it's just the very small step towards MP. O.K. henning@, mikeb@, mpi@
2017-06-03Add missing NET_LOCK().Martin Pieuchot
Found by jmc@
2017-06-02be less tricky about when ifq_free is handled.David Gwynne
instead of assuming start routines only run inside the ifq serialiser, only rely on the serialisation provided by the ifq mtx which is explicitly used during ifq_deq ops. ie, free the mbufs in ifq_free at the end of ifq_deq ops instead of in the ifq_serialiser loop. ifq deq ops arent necessarily called within the serialiser. this should fix panics caused by fq codel on top of bce (which calls bce_start from it's tx completion path instead of ifq_restart). ok mikeb@
2017-06-01Return time_uptime as value for when pf was enabled instead ofPatrick Wildt
time_second. Since time_second changes depending on the wall- clock time, time_second is not a reliable source for the status. We can even end up with a negative time delta. Thus, use the monotonically growing time_uptime and export it to userland. ok bluhm@ mikeb@
2017-05-31Use mbuf_queue to properly serialize access to pflow output queue.Visa Hankala
Input from mpi@, jmatthew@; OK mpi@, henning@, benno@
2017-05-31Block IPv6 packets in pf(4) that have hop-by-hop options header orAlexander Bluhm
destination options header. Such packets can be passed by adding "allow-opts" to the rule. So IPv6 options are handled like their counterpart in IPv4 now. tested by benno@; OK henning@
2017-05-31Move IPv4 & IPv6 incoming/forwarding path, PIPEX ppp processing andMartin Pieuchot
IPv4 & IPv6 dispatch functions outside the KERNEL_LOCK(). We currently rely on the NET_LOCK() serializing access to most global data structures for that. IP input queues are no longer used in the forwarding case. They still exist as boundary between the network and transport layers because TCP/UDP & friends still need the KERNEL_LOCK(). Since we do not want to grab the NET_LOCK() for every packet, the softnet thread will do it once before processing a batch. That means the L2 processing path, which is currently running without lock, will now run with the NET_LOCK(). IPsec isn't ready to run without KERNEL_LOCK(), so the softnet thread will grab the KERNEL_LOCK() as soon as ``ipsec_in_use'' is set. Tested by Hrvoje Popovski. ok visa@, bluhm@, henning@
2017-05-31make vlan use their parents lladdr all the time, not just when theyre up.David Gwynne
krw@ has been having issues with dhclient on vlan interfaces because i made them only configure the lladdr when they were brought up. dhclient likes to read the mac address and then bring them up. this makes vlan copy the parents lladdr onto the vlan interface when the parent is configured. this probably helps with v6 addresses on vlan interfaces too. the new code still supports configuring a custom lladdr on a vlan interface. this can be done both before and after a parent is configured, and if a parent is removed. while here, if the parent is reconfigured while the vlan is up, dont error if the new parent is the same as the current one. this should make running netstart again less noisy. ok krw@
2017-05-30remove no longer needed splnet/splx.Sebastian Benoit
ok florian@
2017-05-30sizes for free()Theo de Raadt
ok henning
2017-05-30remove XXX from the comments marking "holes" in the ioctls. I see veryHenning Brauer
very little value in these comments at all, but the XXX is just wrong and in the way when looking for real XXXs. phessler agrees
2017-05-30g/c DIOCCLRRULECTRSHenning Brauer
kinda deprecated for a decade now, nothing in base uses it, nothing in ports uses it (thanks sthen) ok phessler sashan
2017-05-30sizes for free()Theo de Raadt
2017-05-30teach pf_build_tcp() about SACK, ok & with sashanHenning Brauer
2017-05-30Introduce ipv{4,6}_input(), two wrappers around IP queues.Martin Pieuchot
This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
2017-05-30Clear the internal table used by if_get(9) and sleep until allMartin Pieuchot
remaining ifp references are released *without* the NET_LOCK(). It's safe to do so because the KERNEL_LOCK() serializes accesses to ``if_map''. More importantly this fix possible deadlocks between if_get() and the NET_LOCK(). It is now possible to call them in whatever order. ok visa@, dlg@
2017-05-29Replace handrolled list with LIST_* macros. OK mpi@Claudio Jeker
2017-05-29Kill struct pfkey_version and move struct pfkeyv2_socket & dump_stateClaudio Jeker
to pfkeyv2.c. These structs are nowhere else needed. OK gcc
2017-05-29export_pflow() is no longer grabbing the NET_LOCK(), so no need toMartin Pieuchot
release it beforehand. ok henning@, benno@
2017-05-29PFKEY version 2 is the only pfkey version supported. No need for extraClaudio Jeker
abstraction. First step of making PF_KEY a bit more like PF_ROUTE. OK mpi@
2017-05-29Pass SIOCGIFMEDIA to vlan's parent interface.Martin Pieuchot
ok krw@, dlg@
2017-05-29Do not try to grab the NET_LOCK() while holding an ifp reference.Martin Pieuchot
Fix a deadlock with a thread trying to detach the corresponding interface. ok sashan@, bluhm@
2017-05-28fix broken include on previous pipex commitMike Larkin
ok deraadt
2017-05-28Process packets immediately without queuing since pipex is believed MP safeYASUOKA Masahiko
already, for PPPoE case as first step. ok mpi
2017-05-28Check also whether the interfaces is matched when pipex check PPPoEYASUOKA Masahiko
packets. This fixes the problem when pipex connects with pppoe(4) through pair(4).
2017-05-28Use interface index and if_{put,get} instead of ifnet pointer.YASUOKA Masahiko
2017-05-28Use interface index instead of ifnet pointer.YASUOKA Masahiko
2017-05-28Limit the nested header chain for IPv6 extensions headers and forAlexander Bluhm
authentication headers in the IPv4 case. This prevents spending excessive cpu time on crafted packets. OK henning@
2017-05-28Fix bad white spaces, wrap long lines, kill some empty lines.Alexander Bluhm
2017-05-28Add missing NET_UNLOCK() in error path.Martin Pieuchot
Spotted by sashan@
2017-05-28Pf was handling IPv4 and IPv6 differently regarding AH extensionAlexander Bluhm
headers. pf_walk_header6() steps over it and detects the real protocol. So to implement a minimal header walking function pf_walk_header() for IPv4. It does the header checks and jumps over AH. Then pf does not understand AH as a protocol, it is just an extension that authenticates the packet. Move some header and option checks to pf_walk_header() for consistency with IPv6. This also improves the header check for IPv4 packets in ICMP payload. OK henning@
2017-05-28trunk_port_destroy() needs the NET_LOCK().Martin Pieuchot
It brings the interface down and restore the original lladdr. Found by Hrvoje Popovski
2017-05-28Remove all splnet/splx from pipex(4) and pppx(4) and replace some ofYASUOKA Masahiko
them by NET_LOCK/NET_UNLOCK. Also make the timeout for pipex_timer run with a thread context and replace pipex softintr by NETISR_PIPEX. ok mpi
2017-05-28Leaving IP multicast group requires the NET_LOCK().Martin Pieuchot
Grab the lock before calling carpdetach(). ok bluhm@
2017-05-28Remove useless splnet()/splx() dances.Martin Pieuchot
Data structures modified in the ioctl path are protected by the NET_LOCK(). ok sashan@
2017-05-28Protect the global array of interfaces with the NET_LOCK().Martin Pieuchot
ok sashan@
2017-05-27fix previous as noted by mpi, thx florianSebastian Benoit
2017-05-27move sending of pflow packet into a task, seperated from the dataSebastian Benoit
collection by a mbuf queue. with help from mpi@ ok florian@
2017-05-27Push the NET_LOCK down into PF_KEY so that it can be treated like PF_ROUTE.Claudio Jeker
Only pfkeyv2_send() needs the NET_LOCK() so grab it at the start and release at the end. This should allow to push the locks down in other places. OK mpi@, bluhm@
2017-05-27Protect the global list of softc with the NET_LOCK().Martin Pieuchot
ok sashan@
2017-05-27Protect the global list of softc with the NET_LOCK().Martin Pieuchot
While here remove superfluous splnet()/splx() in the ioctl routine. ok sashan@
2017-05-27Remove useless splnet()/splx() dances.Martin Pieuchot
pfsyncioctl() is executed with the NET_LOCK() held which is enough. ok sashan@
2017-05-27Use rn_inithead() instead of rn_inithead0(). Since rn_inithead0()YASUOKA Masahiko
doesn't trigger rn_initmask() and first session had caused panics. Reported by VOblezov at mtsbank.ru.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 16:00:56 +0000