summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_input.c
AgeCommit message (Collapse)Author
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-08-08Increase the limit of the IP protocol queues from 256 to 2048 mbufs.Alexander Bluhm
The interface congestion algorithm kills performance at this place, with the large queues it never triggers. OK mpi@ claudio@
2017-08-04We do have SO_TIMESTAMP since some time and there is other code in theFlorian Obser
kernel that uses it without the #ifdef guard. OK bluhm
2017-07-05Fix RAMDISK build.Visa Hankala
OK bluhm@
2017-07-05The IP in IP input function strips the outer header and reinsertsAlexander Bluhm
the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
2017-06-26Convert ip_input() to a pr_input style function. Goal is to processAlexander Bluhm
IPsec packets without additional enqueueing. OK mpi@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-06-19The IP multicast forward functions return an errno, call the variableAlexander Bluhm
error. Make the ip_mforward() return value consistent. Simplify the caller logic in ipv6_input() like in IPv4. OK mpi@
2017-05-31Move IPv4 & IPv6 incoming/forwarding path, PIPEX ppp processing andMartin Pieuchot
IPv4 & IPv6 dispatch functions outside the KERNEL_LOCK(). We currently rely on the NET_LOCK() serializing access to most global data structures for that. IP input queues are no longer used in the forwarding case. They still exist as boundary between the network and transport layers because TCP/UDP & friends still need the KERNEL_LOCK(). Since we do not want to grab the NET_LOCK() for every packet, the softnet thread will do it once before processing a batch. That means the L2 processing path, which is currently running without lock, will now run with the NET_LOCK(). IPsec isn't ready to run without KERNEL_LOCK(), so the softnet thread will grab the KERNEL_LOCK() as soon as ``ipsec_in_use'' is set. Tested by Hrvoje Popovski. ok visa@, bluhm@, henning@
2017-05-30Carp balancing ip does not work since there is a mac filter infriehm
ether_input(). Now we use mbuf tags instead of modifying the MAC address. ok mpi@
2017-05-30Introduce ipv{4,6}_input(), two wrappers around IP queues.Martin Pieuchot
This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
2017-05-29Per-interface list of addresses, both multicast and unicast, areMartin Pieuchot
currently protected by the NET_LOCK(). They are not accessed in the hot path, so protecting them with a mutex could be an option. However since we're now going to run with a NET_LOCK() for some time, assert that it is held. IPsec is not yet ready to run without KERNEL_LOCK(), so assert it is held, even in the forwarding path. Tested by sthen@, ok visa@, claudio@, bluhm@
2017-05-28clang warns on unused labels. Place a recently introduced label underJonathan Gray
ifdef IPSEC to fix the clang build when IPSEC is not defined. ok deraadt@ bluhm@
2017-05-28Rename ip_local() to ip_deliver() and give it the same parametersAlexander Bluhm
as the pr_input functions. Add an assert that IPv4 delivery ends in IP proto done to assure that IPv4 protocol functions work like IPv6. OK mpi@
2017-05-22Move IPsec forward and local policy check functions to ipsec_input.cAlexander Bluhm
and give them better names. input and OK mikeb@
2017-05-22Use the IPsec policy check from IPv4 also when doing local deliveryAlexander Bluhm
in ip6_local() to our IPv6 stack. OK mikeb@
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-05-12IPsec packets were passed through ip_input() a second time afterAlexander Bluhm
they have been decrypted. That means that all the IP header fields were checked twice. Also fragment reassembly was tried twice. At pf incoming packets in tunnel mode appeared twice on the enc0 interface, once as IP-in-IP and once as the inner packet. In the outgoing path pf only sees the inner packet. Asymmetry is bad for stateful filtering. IPv6 shows that IPsec works without that. After decrypting immediately continue with local delivery. In tunnel mode the IP-in-IP protocol functions pass the inner header to ip6_input(). In transport mode only pf_test() has to be called for the enc0 device. Introduce ip_local() to avoid needless processing and cleaner pf behavior in IPv4 IPsec. OK mikeb@
2017-05-12Use the IPsec policy check from ipv4_input() also when forwardingAlexander Bluhm
in ip6_input(). While there avoid an ugly #ifdef in ipv4_input(). OK mikeb@
2017-05-11Fix white spaces and wrap long line. No binary change.Alexander Bluhm
2017-04-19Use the rt_rmx defines that hide the struct rt_kmetrics indirection.Alexander Bluhm
No binary change. OK mpi@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-04-05When building counter memory in preparation to copy to userland, alwaysTheo de Raadt
zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
2017-02-05Always allocate counters memory using type M_COUNTERS.Jeremie Courreges-Anglas
This makes the API simpler, and is probably more useful than spreading counters memory other several types, making it harder to track. Prodded by mpi, ok mpi@ stsp@
2017-01-31Use CTASSERT instead of KASSERT for a few sysctl that use the counters APIJeremie Courreges-Anglas
ok dlg@ mpi@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
2017-01-25Since raw_input() and route_input() are gone from pr_input, we canAlexander Bluhm
make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
2016-12-20A NET_LOCK() was is missing in tcp_sysctl() which shows up as splAlexander Bluhm
softnet assert failures. It is better to place the lock into net_sysctl() where all the protocol sysctls are called via pr_sysctl. As calling sysctl(2) is in the slow path, doing fine grained locking has no benefit. Many sysctl cases copy out a struct. Having a lock around that keeps the struct consistent. Put assertions in the protocol sysctls that need it. OK mpi@
2016-12-19Extend the multicast sockets and multicast hash table support to multipleRafael Zalamena
domains. This is one step towards supporting to run more than one multicast socket in different domains at the same time. ok mpi@
2016-12-19Introduce the NET_LOCK() a rwlock used to serialize accesses to the partsMartin Pieuchot
of the network stack that are not yet ready to be executed in parallel or where new sleeping points are not possible. This first pass replace all the entry points leading to ip_output(). This is done to not introduce new sleeping points when trying to acquire ART's write lock, needed when a new L2 entry is created via the RT_RESOLVE. Inputs from and ok bluhm@, ok dlg@
2016-11-28Path MTU discovery and traceroute did not always work with pf af-to.Alexander Bluhm
If an incoming packet is directly put into the output path, sending the icmp error packet is never done. As this is basically forwarding, calling ip_forward() for such packets does everything that is needed. OK mikeb@
2016-11-28Assert that every slow/fast timeout routine is called at IPL_SOFTNET.Martin Pieuchot
This removes multipe recursive splsoftnet()/splx() dances.
2016-11-23Keep checks for local delivery close to in_ouraddr().Martin Pieuchot
ok claudio@
2016-11-14use M_COUNTERS to allocate counters.David Gwynne
suggested by mpi@ and mikeb@
2016-11-14turn ipstat into a set of percpu counters.David Gwynne
each counter is identified by an enum value which correspond to the original members of the ipstat struct. ipstat_inc(ips_foo) replaces ipstat.ips_foo++ for the actual updates. ipstat_inc is a thin wrapper around counters_inc. counters are still returned to userland via the ipstat struct for now. ok mpi@ mikeb@
2016-11-08Only use the routing table for source address selection when processing IPMartin Pieuchot
options. Make sure the next hop is directly reachable if IPOPT_SSRR is set. Input from and ok vgross@
2016-09-22Fix indentation. No binary change.Jonathan Gray
ok mpi@
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-09-06pool_setipl for various netinet and netinet6 bitsDavid Gwynne
thank you to everyone who helped reviewed these diffs ok mpi@
2016-07-22Fix a double rtfree(9) triggered when IPSEC inserts a more specificMartin Pieuchot
route because of PMTU. otto@ reported the issue and helped me tracking it down during more than one month, he is the man! mikeb@ figured out the bug was in the forwarding path. ok mikeb@, deraadt@, claudio@
2016-07-18Hide pf internals by moving code from in_ouraddr() to pf_ouraddr().Alexander Bluhm
OK mpi@ sashan@
2016-06-18Add net.inet.{tcp,udp}.rootonly sysctl, to mark which portsVincent Gross
cannot be bound to by non-root users. Ok millert@ bluhm@
2016-05-07Use rtalloc_mpath() when checking for local route entries because weMartin Pieuchot
are now using the returned route for forwarding as well. This restore the behavior of r1.274 when using mpath entries for forwarding. ok visa@, henning@
2016-05-03Make ip_forward() use the route entry fetched in in_ouraddr() when it isMartin Pieuchot
possible. This reduce the number of lookups to 1 for non-multicast traffic when PF is disable. Tested by Hrvoje Popovski who confirmed that benchmark numbers are now as good as with a single cache entry. ok visa@, bluhm@
2016-04-25Remove the single cache route for forwarding.Martin Pieuchot
Testing help from Hrvoje Popovski. ok mikeb@, henning@, claudio@
2016-04-19Instead of freeing a cached RTF_MPATH route after using it, free itMartin Pieuchot
when the next packet needs to be forwarded, just like if the route was invalid. ok mikeb@, claudio@
2016-04-18Unbreak RAMDISK, found by deraadt@Martin Pieuchot
2016-04-18Put a KERNEL_LOCK/UNLOCK dance around sections that still need someMartin Pieuchot
work in the forwarding path. Tested by Hrvoje Popovski, ok dlg@
2016-04-15Kill in_rtaddr() and use rtalloc(9) directly in ip_dooptions().Martin Pieuchot
This brings ip_dooptions() closer to mp-safeness by ensuring that ``ifa'' is dereferenced before calling rtfree(9). ok mikeb@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 01:31:05 +0000