summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2010-06-29Replace enc(4) with a new implementation as a cloner device. We stillReyk Floeter
create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
2010-06-28Add the rtable id as an argument to rn_walktree(). Functions likeClaudio Jeker
rt_if_remove_rtdelete() need to know the table id to be able to correctly remove nodes. Problem found by Andrea Parazzini and analyzed by Martin Pelikán. OK henning@
2010-06-26Implement a simple keepalive mechanism in gre(4) that is compatible withClaudio Jeker
the one used by Cisco. It sends a return gre packet inside a gre packet to the other side and expects it to return. OK deraadt, reyk additional testing by sthen
2010-06-07unfortunately classful routing isn't 100% dead, mostly thanks to ancientHenning Brauer
netboot methods using rarp, thus only learning their IP address without mask. And of course the next step is a broadcast - which goes to the broadcast address calculated classful. *sigh*. PR6382 instead of storing a second broadcast address per ifaddr as we used to figure out wether we're dealing with a classful broadcast on the fly. the math is extremely cheap and all my previous profilings showed that cpu cycles are basically free, we're constrained by memory access. excellent analysis by Pascal Lalonde <plalonde at overnet.qc.ca> who also submitted the PR. claudio ok
2010-06-07There is no reason to allow unicast IPv4 mapped IPv6 addresses in tcpClaudio Jeker
connect() calls. Our network stack does not allow any v4 mapped addresses so there is no need to allow them in connect(). Found after discussion with Henning. OK deraadt@
2010-06-04Missed this file in previous commit; previous commit message was:Bret Lambert
rt_timer_queue_destroy() did not actually destroy, leading to a potential memory leak due to misleading nomenclature. Change it to actually destroy, not just clean, the the rt_timer_queue passed to it and adjust the correct caller accordingly (i.e., no need to free the mem on our own now). As a bonus, this gets rid of one of the ridiculous R_Malloc/Bzero/Free cycles, and lets us sneak another bzero -> M_ZERO conversion in. ok claudio@
2010-05-28Make sure the temporary buffer used to generate tcp options is properlyMark Kettenis
aligned, otherwise we lose on strict alignment architecture. Should fix problems with gcc4 compiled bsd.rd's that people see on sparc64. ok millert@, beck@, jsing@
2010-05-11Massiv cleanup of the gif(4) mess. Move encapsulation into gif_output()Claudio Jeker
where it is not necessary to guess protocols by looking at the first nibble. in_gif_output() will encapsulate the packet but not send it. Because of etherip support and the way the bridge works a minimal hack is needed in gif_start() to ensure that the bridged packets are encapsulated as well. This actually started with the idea to add MPLS support but that turned out to be not as simple as in the gre(4) case. Tested by myself (IP, IPv6, etherip, MPLS), sthen@ (IP, IPv6), naddy (IPv6) OK sthen@
2010-05-11Add IPPROTO_MPLS for MPLS in gif(4) encapsulation.Claudio Jeker
OK sthen@
2010-05-11Add support for MPLS in GRE. Fairly trivial and a NOP unless option MPLSClaudio Jeker
is defined.
2010-05-07Start cleaning up the mess called rtalloc*. Kill rtalloc2, make rtalloc1Claudio Jeker
accept flags for report and nocloning. Move the rtableid into struct route (with a minor twist for now) and make a few more codepathes rdomain aware. Appart from the pf.c and route.c bits the diff is mostly mechanical. More to come... OK michele, henning
2010-04-25Properly adjust group demotion counters when groups are added orMarco Pfatschbacher
removed. Extend carp demote logging to also show the reason for the demote. Return EINVAL instead of ERANGE if a carpdemote request is out range. Requested from otto. OK mcbride, henning.
2010-04-20remove proc.h include from uvm_map.h. This has far reaching effects, asTed Unangst
sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
2010-04-06spacingTheo de Raadt
2010-03-22Add some MLDv2 definitions from FreeBSD.Jonathan Gray
2010-03-11unbreak the build with a custom kernel config including "pseudo-deviceStuart Henderson
faith 1", noticed by Andris Kadar. ok kettenis@ beck@
2010-03-09Use correct routing domain when doing address lookups.Joel Sing
ok claudio@ "approved" deraadt@
2010-03-08Use properly initialised sockaddr_in/sockaddr_in6 struct when performingJoel Sing
address lookups. Found whilst investigating address lookup failures. ok michele@
2010-02-09Before cloning a route to change the MTU check that the route we clone fromClaudio Jeker
is valid and usable (reject and blackholes are not conidered usable). TCP has this nasty behaviour to clone routes to disable PMTU and this combined with dynamic routing resulted in dead sessions when there was a default reject route installed. OK henning@, sthen@
2010-02-08arpioctl() is not used sore remove it. Found by Gleydson Soares.Claudio Jeker
2010-01-28Remove dead assignment and newly created unused variable.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok krw@ henning@
2010-01-15Replace pool_get() + bzero() with pool_get(..., PR_ZERO).Charles Longeau
With input from oga@ and krw@ ok oga@ krw@ thib@ markus@ mk@
2010-01-13Double and in comment.Claudio Jeker
2010-01-13remove subnetsarelocal / SUBNETSARELOCAL. it's been off by default sinceHenning Brauer
1996 with no way to enable but kernel config or code mods and is bound to classful adressing anyway.
2010-01-13no point in looking for the old "all host bits zero" broadcast address anyHenning Brauer
more here either
2010-01-134.2BSD had the host parts bit of the address all zero as broadcast address.Henning Brauer
4.3BSD (anno 1986) supported the host part bits all one for broadcast as well, since that's what everybody agreed on and RFC919 (anno 1984) proposed. now, roughly a quarter decade later, we can really stop supporting the all zero variant. sorry to you guys still running 4.2BSD. ok theo ryan
2010-01-13we don't need broadcast for the classful network AND broadcast for theHenning Brauer
subnet of the classful network. at least, not since 1992. ok mpf dlg bob
2010-01-13Remove special bridge code in in_arpinput() this is no longer needed sinceClaudio Jeker
we now correctly broadcast packets to all local ports. OK deraadt@
2010-01-13instead of fiddling with the per-interface address lists directly inHenning Brauer
many places create a proper API (ifa_add / ifa_del) and use it. ok theo ryan dlg
2010-01-13let's admit it's not 1992 any more. CIDR is around for a long time, evenHenning Brauer
that router vendor doesn't default to classful routing any more, and there really is no point in having a classful netmask and a subnetmask to split it. we still do classful guesses on the netmask if it isn't supplied by userland, but that's about it. i decided to keep ia_netmask and kill ia_subnetmask which makes this diff bigish, the classful ia_netmask wasn't really used all that much. the real changes are in in.c, the rest is mostly s/ia_subnetmask/ia_netmask. ok claudio dlg ryan
2010-01-12Add input and user protocol hook to handle GRE packets by pipex.YASUOKA Masahiko
ok @dlg
2010-01-12Unify the various fake ethernet generators as ether_fakeaddr() whichTheo de Raadt
is safe for both hardware devices and virtual devices ok mpf, kettenis, moaning and groaning and slow acceptance from mcbride XXX should loop checking for uniqueness after new henning diff goes in
2010-01-12Remove the "bump the advskew to 240 in case of errors" hack.Marco Pfatschbacher
The demote counter can handle that. This lets carp hosts with an identical demote count still know which one is the designated master and prevents them from failing over asymmetrically. Since there is a demote handling bug in all releases prior to 4.6, symmetric failover will only work against 4.6 (and newer) from now on. OK henning@
2010-01-12Allow the queueing of multiple fragments on virtual interfaces with aBob Beck
queue length of one - i.e. vlans with the forthcoming change from dlg. this allows fragmented frames to be sent on such an interface, hoping that the interface underneath copes correctly - A better fix for this will be forthcoming soon, but this is good enough for now, and will allow the change for vlans to use an ifq length of 1. tested by me and dlg@, ok dlg@, claudio@, deraadt@
2010-01-12Use M_ZERO in malloc instead of doing a bzeor right afterwards.Claudio Jeker
From Gleydson Soares, OK beck@
2010-01-10Fix two bugs in IPsec/HMAC-SHA2:Markus Friedl
(1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt
2010-01-02uninitalized protocol version for ipv6; from mickey; ok claudioMarkus Friedl
2009-12-23The process's rdomain should be, well, per-process and not per-rthread,Philip Guenthe
so put it in struct process instead of struct proc. While at it, move the p_emul member inside struct proc so that it gets copied automatically instead of requiring manual assignment. ok deraadt@
2009-12-15Ensure that the interface is valid before trying to access its flags.Joel Sing
ok claudio@
2009-12-15Ansify function declarations.Joel Sing
ok claudio@
2009-12-15Ensure that the interface is not null before trying to access its flags.Joel Sing
Fixes PR6274. ok claudio@
2009-12-11Two cases of IPSEC getsockopt() returning two bytes of uninitialializedTheo de Raadt
kernel stack content instead of proper information; found by Clement LECIGNE
2009-12-07do not forward and drop packets with M_MCAST flag set in ip_forward()Joerg Goltermann
ok henning@, claudio@ "I think this should go in"
2009-11-27Add setrdomain() and getrdomain() system calls. Committing now toPhilip Guenthe
catch the libc major bump per request from deraadt@ Diff by reyk. ok guenther@
2009-11-21Add a way to bind the tunnel endpoint of a gif/gre interface into aClaudio Jeker
different rdomain than the default one. This allows to do MPLS VPNs without the MPLS madness. OK deraadt@, henning@
2009-11-20NULL dereference in IPV6_PORTRANGE and IP_IPSEC_*, found by Clement LECIGNE,Philip Guenthe
localhost DoS everywhere. To help minimize further issues, make the mbuf != NULL test explicit instead of implicit in a length test. Suggestions and initial work by mpf@ and miod@ ok henning@, mpf@, claudio@,
2009-11-19avoid overflow since protos > IPPROTO_MAX exist. From FreeBSD withOtto Moerbeek
a twist; ok millert@ kettenis@
2009-11-13Extend the protosw pr_ctlinput function to include the rdomain. This isClaudio Jeker
needed so that the route and inp lookups done in TCP and UDP know where to look. Additionally in_pcbnotifyall() and tcp_respond() got a rdomain argument as well for similar reasons. With this tcp seems to be now fully rdomain save and no longer leaks single packets into the main domain. Looks good markus@, henning@
2009-11-13Packets generated by ip_fragment() need to inherit the rdomain from theClaudio Jeker
original packet or they will trigger the diagnostic check in the interface output routines. OK jsg@
2009-11-03rtables are stacked on rdomains (it is possible to have multiple routingClaudio Jeker
tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-10 01:34:37 +0000