summaryrefslogtreecommitdiff
path: root/sys/net
AgeCommit message (Collapse)Author
2017-08-10Prevent userland to modify RTF_LOCAL route entries.Martin Pieuchot
In particular setting an expiration timer on a route entry which would confuse L2 state machines. ok bluhm@
2017-08-06Reduce contention on the NET_LOCK() by moving the logic of the pfpurgeMartin Pieuchot
thread to a task running on the `softnettq`. Tested and inputs from Hrvoje Popovski. ok visa@, sashan@
2017-08-04When we disable INET6 on an interface that also removes the autoconf6Florian Obser
flag. Notify userland about this via the route socket, otherwise slaacd gets confused about the state the interface is in. OK on a previous version sthen input & OK bluhm
2017-08-02Fix rtable regression tests.Martin Pieuchot
2017-08-02Move a sanity check that only makes sense for userland where it belongs.Martin Pieuchot
ok bluhm@, florian@
2017-08-01rt_if_track() is needed even on ramdisk kernels, because of MPATHTheo de Raadt
ok mpi
2017-08-01Add missing splx().Martin Pieuchot
I introduced this bug in 2015 but the splsoftnet()/splx() dance in the upper layer masked it. Pseudo drivers generally don't need any splnet() protection. Found by Mark Patruck and Andrei-Marius Radu since the NET_LOCK() no longer raise any IPL. Strangely jsg@ confirmed that cppcheck nor coccinelle found the missing splx(). ok kettenis@, sthen@, deraadt@
2017-07-30Enable mpath support in the Allotment Routing Table (ART) on the ramdisk.Florian Obser
OK mpi
2017-07-30Switch installer to Allotment Routing Table (ART).Florian Obser
Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken in the installer. OK mpi, "go for it" deraadt
2017-07-28Add an error argument to rtm_send() instead of rerolling it insideMartin Pieuchot
rtdeletemsg(). ok bluhm@
2017-07-27Export RTAX_IFP, RTAX_IFA and RTAX_LABEL to userland in rtdeletemsg().Martin Pieuchot
Reduce differences with rtm_miss(). ok claudio@, bluhm@
2017-07-27For pf the anchor is a C string so ensure that the value passed in via ioctlClaudio Jeker
is correctly NUL terminated. Reported by Ilja Van Sprundel With and OK bluhm@
2017-07-27SEQ16_* macros weren't able to compare properly if one of the sequences isYASUOKA Masahiko
wrapped around. Fix them to cast the proper width of integer when comparison. found goda@
2017-07-26Consistantly use kp as the var name for struct keycb.Claudio Jeker
Suggested by and OK bluhm@ OK mpi@
2017-07-26Fix typo in comment, ok deraadt@anton
2017-07-24Don't attempt to deactivate a class that doesn't have any packets in itMike Belopuhov
Classes are considered "active" when they have packets assigned to them. Active classes are tracked on various lists and during the purge operation must be dissociated from them. During factoring out of the HFSC internal FIFO operations, the check for whether the class is empty got lost. Issue reported and fix tested by abieber@ and myself.
2017-07-24Reduce NET_LOCK() contention by moving the linktstate and watchdogMartin Pieuchot
tasks from `systq' to `softnettq'. ok kettenis@, visa@
2017-07-24rt_getifa() is only needed for routing commands submited by userland.Martin Pieuchot
So rename it to rtm_getifa(), move it where it belongs and stop calling it from rtrequest(9). Route entries created by the kernel must always specify the corresponding `ifa'. ok claudio@
2017-07-24Fixup free list handling in fqcodel_deq_beginMike Belopuhov
We're growing an mbuf free list while iterating over flow queues and need to adjust our internal statistics on every iteration by using a portion of the free list corresponding to the current iteration.
2017-07-19Fix the test condition weakened a recent changeMike Belopuhov
2017-07-19Factor out internal FIFO queue managerMike Belopuhov
HFSC internal queue becomes accessible via pf queueing ops. It will also select an alternative queue manager based on the queue spec. Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-07-19Rework HFSC vs FQ-CoDel checksMike Belopuhov
The selection mechanism introduced in pf_ioctl.c -r1.316 suffers from being too ambiguous and lacks robustness. Instead of relying on composition of multiple flags in the queue specification, it's easier to identify the root class (if it exists) and derive all further checks from it.
2017-07-19The proper way to check for successful allocation of an mbuf cluster isClaudio Jeker
by checking M_EXT flag. m_freem() the mbuf in the errorcase to prevent a mbuf leak. MCLGET does not set the mbuf to NULL on failure. Found by Ilja Van Sprundel OK bluhm@ deraadt@
2017-07-19Fix double free in pppoe_dispatch_disc_pkt(). If m_pulldown() fails m isClaudio Jeker
freed but another m_freem call happens later. Set m to NULL if m_pulldown() fails like in all other cases of this function. Found by Ilja Van Sprundel OK bluhm@
2017-07-14kernels don't build without MROUTING because ip_var.h only sometimesTed Unangst
introduces a forward decl for socket. turns out the affected file doesn't need ip_var.h, so remove it. then move the decl to the bottom to prevent the problem from recurring. bug report by Nick Briggs ok mpi
2017-07-13Set the ipl of pipex pools to IPL_SOFTNET.Martin Pieuchot
Fix floor splassert reported by mlarkin@ and Marko Cupać. ok dlg@, visa@, yasuoka@
2017-07-12Use a 32 bit variable to detect integer overflow when searching forAlexander Bluhm
an unused nat port. Prevents a possible endless loop if high port is 65535 or low port is 0. report and analysis Jingmin Zhou; OK sashan@ visa@
2017-07-11Purging is at last at hand. Day of Doom is here. All that is evilFlorian Obser
shall all be cleansed. Remove sending of router solicitations and processing of router advertisements from the kernel. It's handled by slaacd(8) these days. Input & OK bluhm@, mpi@
2017-07-05Convert pf tagname malloc(9) into pool_get(9) to make it MP safe.Alexander Bluhm
While there use TAILQ_FOREACH macro for traversing tags. OK mpi@
2017-07-04Revert previous, it exposed two edge cases still requiring theMartin Pieuchot
KERNEL_LOCK(). - radix_node_head are still allocated with malloc(9) and pf_table can free(9) some. - pfsync(4) might send some traffic which can exercise IPsec code Found by bluhm@ and Hrvoje Popovski
2017-07-03Both PF_ROUTE and PF_KEY need to start to take care of their own PCB listClaudio Jeker
to simplify the locking of those lists. For now move the LIST_ENTRY from rawcb into routecb and in the pfkey case a new keycb. Do some cleanup and renaming in the pfkey code but more to come. OK bluhm@ mpi@
2017-07-03Drop the KERNEL_LOCK() in pf_purge_thread().Martin Pieuchot
The NET_LOCK() is currently what guarantees that accesses to PF data structures are serialized. While here use rwsleep(9) instead of calling NET_LOCK()/NET_UNLOCK() for every iteration. Tested by Hrvoje Popovski, ok sashan@, visa@
2017-06-28Introduce a simple mechanism to select the appropriate queue managerMike Belopuhov
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-28Tighten up FQ-CoDel vs HFSC checksMike Belopuhov
PFQS_FLOWQUEUE is about to become a flag that HFSC classes may specify as well; thus a better way of telling FQ-CoDel and HFSC apart needs to be found. At the moment its derived from the queue specification. Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-28Provide pf queue manager APIMike Belopuhov
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-28Extend pf queueing ops to include queue manager hooksMike Belopuhov
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-28hfsc.c should depend on pf instead of inetMike Belopuhov
Discussed with and OK henning@ at d2k17 as a part of a larger diff.
2017-06-26Fragments for a single connection (a combination of proto,src,dst,af)Alexander Bluhm
may easily reuse the fragment id as it is only 16 bit for IPv4. To avoid that pf reassembles them into the wrong packet, throw away stale fragments. With the default timeout this happens after 12,000 newer fragements have been seen. from markus@; OK sashan@
2017-06-26Assert that the corresponding socket is locked when manipulating socketMartin Pieuchot
buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
2017-06-26Allow updating the destination address of an existing TDB. Since thePatrick Wildt
destination address is used as an index when looking for a TDB, we need to supply the new destination address in a different member. For this, re-use the proxy address, that so far no one else has been using. It would make sense to rename this member in the future. ok claudio@
2017-06-24To avoid packet loss due to reuse of the 16 bit IPv4 fragment id,Alexander Bluhm
we need suitable data structures. Organize the pf fragments with two red-black trees. One is holding the address and protocol information and the other has only the fragment id. This will allow to drop fragemts for specific connections more aggressively. ` from markus@; OK sashan@
2017-06-23Resetting the mbuf header in if_input_local() was stripping off theAlexander Bluhm
M_LOOP flag. This broke IPv6 multicast. Always set M_LOOP when going through if_input_local() and adjust the flag's comment. report rzalamena@; OK mpi@
2017-06-22Fix the remaining ';;'s in sys/Tom Cosgrove
2017-06-21Fix kernel diagnostic assertion "(sk->inp == NULL) || (sk->inp->inp_pf_skAlexander Bluhm
== NULL)". The problem was that setting the inp pointer in the statekey to NULL was delayed until the statekey refcounter reached 0. So the inp could get linked to another statekey while an mbuf in the socket buffer was keeping the refcounter at 1. Set the statekey inp pointer to NULL in pf_state_key_detach() immediately, then the kassert can be even stricter. OK sashan@
2017-06-20Do not use the interface pointer after if_put(). Rename ipip_input_gif()Alexander Bluhm
to ipip_input_if() and always pass the ifp. Only dump the packet to bpf if we are called with a gif(4) interface. OK mpi@
2017-06-20Remove KERNEL_LOCK() asserts.Martin Pieuchot
pf table code iterates on a radix tree and currently relies on the NET_LOCK() to do the serialization. Found the hardway by jasper@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-06-19Make rn_match() and rn_lookup() safe to be used in parrallel, whenMartin Pieuchot
different trees are manipulated: - Stop writting to global variables - Use a buffer on the stack - Anotate read/only arrays as such While here introduce a SALEN() macro and assert that the KERNEL_LOCK() is held when a tree is modified. ok bluhm@
2017-06-16In sppp(4), allow additional 'wildcard' addresses for the destination.Stefan Sperling
Any address within the range 0.0.0.1 - 0.0.0.255 can now be used. This allows for multiple pppoe(4) interfaces with dynamic addresses within the same routing table. Which used to work before OpenBSD 5.8, but since 5.8 only one interface in a routing table can use destination address 0.0.0.1. Problem first reported by Steve (fiverings04 at australian yahoo) on misc@. I ran into it on an EdgeRouter lite which is supposed to serve two ADSL lines. ok sthen@ mpi@ man page help from jmc@ for an earlier variant of this change
2017-06-12have the timeout call if qstart via the serialiser isntead of directlyDavid Gwynne
hfsc schedules a timeout to keep traffic moving if somethings has been delayed an no other tx activity has occurred. that timeout was calling (*ifp->if_qstart)(ifq) rather than ifq_start. the latter prevents concurrent calls to if_qstart. without this change bjorn ketelaars on misc@ was experiencing weird pauses in traffic and lockups because the tx ring was corrupted because re_start was run concurrently, once from the stack and once from hfsc. thanks to bjorn ketelaars for debugging, and mikeb@ for most of the legwork in diagnosing the problem. ok mikeb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 07:45:58 +0000