summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_input.c
AgeCommit message (Collapse)Author
2018-10-13Expose net.inet.ip.arpq.drops to help debug what's going on when a lotFlorian Obser
of packets are being dropped but non of the other counters are increasing. From Daniel Hokka Zakrisson (daniel AT hozac DOT com), thanks! OK florian, phessler
2018-09-11Convert inetctlerrmap to u_char like inet6ctlerrmap. That is alsoAlexander Bluhm
what FreeBSD does. Remove old #if 0 version of inet6ctlerrmap. OK mpi@
2018-09-10Instead of calculating the mbuf packet header length here and there,Alexander Bluhm
put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
2018-09-10During fragment reassembly, mbuf chains with packet headers wereAlexander Bluhm
created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
2018-07-10Introduce new IPsec (per-CPU) statistics and refactor ESP inputMartin Pieuchot
callbacks to be able to count dropped packet. Having more generic statistics will help troubleshooting problems with specific tunnels. Per-TDB counters are coming once all the refactoring bits are in. ok markus@
2018-05-21All places that call carp_lsdrop() use the interface pointer already.Alexander Bluhm
It does not make sense to call if_get() again, just pass ifp as parameter. Move the IFT_CARP check into the function instead of doing it everywhere. Replace the inverted match variable logic with simple returns. OK mpi@ friehm@
2017-12-29Make the functions which link the pf state keys to mbufs, inpcbs,Alexander Bluhm
or other states more consistent. OK visa@ sashan@ on a previous version
2017-12-04Make divert lookup similar for all socket types. If PF_TAG_DIVERTEDAlexander Bluhm
is set, pf_find_divert() cannot fail so put an assert there. Explicitly check all possible divert types, panic in the default case. For raw sockets call pf_find_divert() before of the socket loop. Divert reply should not match on TCP or UDP listen sockets. OK sashan@ visa@
2017-11-23Constify protocol tables and remove an assert now that ip_deliver() isMartin Pieuchot
mp-safe. ok bluhm@, visa@
2017-11-20Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningMartin Pieuchot
pr_input handlers without KERNEL_LOCK(). ok visa@
2017-11-14Introduce ipsec_sysctl() and move IPsec tunables where they belong.Martin Pieuchot
ok bluhm@, visa@
2017-11-10Introduce a reader version of the NET_LOCK().Martin Pieuchot
This will be used to first allow read-only ioctl(2) to be executed while the softnet taskq is running. Then it will allows us to execute multiple softnet taskq in parallel. Tested by Hrvoje Popovski, ok kettenis@, sashan@, visa@, tb@
2017-11-08Make {ah,esp,ipcomp}stat use percpu counters.Visa Hankala
OK bluhm@, mpi@
2017-11-05Finish off pr_drain functions, they haven't been used since 2006.Florian Obser
OK mpi
2017-11-01Fix typo in previous resulting in a NULL dereference.Martin Pieuchot
2017-10-31- add one more softnet taskqAlexandr Nedvedicky
NOTE: code still runs with single softnet task. change definition of SOFTNET_TASKS in net/if.c, if you want to have more than one softnet task OK mpi@, OK phessler@
2017-10-29This doesn't need the NET_LOCK, everything is protected by a mutex.Florian Obser
OK mpi, visa
2017-10-29Move NET_{,UN}LOCK into individual slowtimo functions.Florian Obser
Direction suggested by mpi OK mpi, visa
2017-10-26Stop grabbing the KERNEL_LOCK() in network tasks when `ipsec_in_use'Martin Pieuchot
is set. Accesses to IPsec global data structure are now serialized by the NET_LOCK(). Tested by many, ok visa@, bluhm@
2017-10-09Reduces the scope of the NET_LOCK() in sysctl(2) path.Martin Pieuchot
Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
2017-09-07Replace a goto found in the ipq foreach loop with a simple break.Alexander Bluhm
This is a common idiom when a list element has been found. OK visa@ mpi@
2017-09-05Serialize access to IP reassembly queue with a mutex. This letsVisa Hankala
ip_local(), ip_slowtimo() and ip_drain() run without KERNEL_LOCK() and NET_LOCK(). Input and OK mpi@, bluhm@
2017-09-01Simplify list traversal in ip_freef(), and replace a hand-rolledVisa Hankala
list traversal with LIST_FOREACH_SAFE(). OK bluhm@, mpi@
2017-08-22Prevent a race against ipsec_in_use.Martin Pieuchot
Problem reported and fix tested by Hrvoje Popovski. ok bluhm@, visa@
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-08-08Increase the limit of the IP protocol queues from 256 to 2048 mbufs.Alexander Bluhm
The interface congestion algorithm kills performance at this place, with the large queues it never triggers. OK mpi@ claudio@
2017-08-04We do have SO_TIMESTAMP since some time and there is other code in theFlorian Obser
kernel that uses it without the #ifdef guard. OK bluhm
2017-07-05Fix RAMDISK build.Visa Hankala
OK bluhm@
2017-07-05The IP in IP input function strips the outer header and reinsertsAlexander Bluhm
the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
2017-06-26Convert ip_input() to a pr_input style function. Goal is to processAlexander Bluhm
IPsec packets without additional enqueueing. OK mpi@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-06-19The IP multicast forward functions return an errno, call the variableAlexander Bluhm
error. Make the ip_mforward() return value consistent. Simplify the caller logic in ipv6_input() like in IPv4. OK mpi@
2017-05-31Move IPv4 & IPv6 incoming/forwarding path, PIPEX ppp processing andMartin Pieuchot
IPv4 & IPv6 dispatch functions outside the KERNEL_LOCK(). We currently rely on the NET_LOCK() serializing access to most global data structures for that. IP input queues are no longer used in the forwarding case. They still exist as boundary between the network and transport layers because TCP/UDP & friends still need the KERNEL_LOCK(). Since we do not want to grab the NET_LOCK() for every packet, the softnet thread will do it once before processing a batch. That means the L2 processing path, which is currently running without lock, will now run with the NET_LOCK(). IPsec isn't ready to run without KERNEL_LOCK(), so the softnet thread will grab the KERNEL_LOCK() as soon as ``ipsec_in_use'' is set. Tested by Hrvoje Popovski. ok visa@, bluhm@, henning@
2017-05-30Carp balancing ip does not work since there is a mac filter infriehm
ether_input(). Now we use mbuf tags instead of modifying the MAC address. ok mpi@
2017-05-30Introduce ipv{4,6}_input(), two wrappers around IP queues.Martin Pieuchot
This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
2017-05-29Per-interface list of addresses, both multicast and unicast, areMartin Pieuchot
currently protected by the NET_LOCK(). They are not accessed in the hot path, so protecting them with a mutex could be an option. However since we're now going to run with a NET_LOCK() for some time, assert that it is held. IPsec is not yet ready to run without KERNEL_LOCK(), so assert it is held, even in the forwarding path. Tested by sthen@, ok visa@, claudio@, bluhm@
2017-05-28clang warns on unused labels. Place a recently introduced label underJonathan Gray
ifdef IPSEC to fix the clang build when IPSEC is not defined. ok deraadt@ bluhm@
2017-05-28Rename ip_local() to ip_deliver() and give it the same parametersAlexander Bluhm
as the pr_input functions. Add an assert that IPv4 delivery ends in IP proto done to assure that IPv4 protocol functions work like IPv6. OK mpi@
2017-05-22Move IPsec forward and local policy check functions to ipsec_input.cAlexander Bluhm
and give them better names. input and OK mikeb@
2017-05-22Use the IPsec policy check from IPv4 also when doing local deliveryAlexander Bluhm
in ip6_local() to our IPv6 stack. OK mikeb@
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-05-12IPsec packets were passed through ip_input() a second time afterAlexander Bluhm
they have been decrypted. That means that all the IP header fields were checked twice. Also fragment reassembly was tried twice. At pf incoming packets in tunnel mode appeared twice on the enc0 interface, once as IP-in-IP and once as the inner packet. In the outgoing path pf only sees the inner packet. Asymmetry is bad for stateful filtering. IPv6 shows that IPsec works without that. After decrypting immediately continue with local delivery. In tunnel mode the IP-in-IP protocol functions pass the inner header to ip6_input(). In transport mode only pf_test() has to be called for the enc0 device. Introduce ip_local() to avoid needless processing and cleaner pf behavior in IPv4 IPsec. OK mikeb@
2017-05-12Use the IPsec policy check from ipv4_input() also when forwardingAlexander Bluhm
in ip6_input(). While there avoid an ugly #ifdef in ipv4_input(). OK mikeb@
2017-05-11Fix white spaces and wrap long line. No binary change.Alexander Bluhm
2017-04-19Use the rt_rmx defines that hide the struct rt_kmetrics indirection.Alexander Bluhm
No binary change. OK mpi@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-04-05When building counter memory in preparation to copy to userland, alwaysTheo de Raadt
zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
2017-02-05Always allocate counters memory using type M_COUNTERS.Jeremie Courreges-Anglas
This makes the API simpler, and is probably more useful than spreading counters memory other several types, making it harder to track. Prodded by mpi, ok mpi@ stsp@
2017-01-31Use CTASSERT instead of KASSERT for a few sysctl that use the counters APIJeremie Courreges-Anglas
ok dlg@ mpi@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 11:10:54 +0000