summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2015-04-28Make sure to overwrite sdl_type after calling ether_ifattach().Martin Pieuchot
Fix a problem found by Johan Huldtgren, ok phessler@
2015-04-22Add the necessary glue to keep carp(4) working while other pseudo-driversMartin Pieuchot
are converted to if_input(), this time without breaking parent-less setup. ok sthen@, dlg@
2015-04-22Init rt to NULL in arpresolve(). Not a problem in practiceJonathan Gray
as la will be NULL when rt is uninitialised which should cause the function to return, but makes the code easier to follow. ok mpi@ miod@
2015-04-21Revert previous. Packets going through carp_input() but not destinatedMartin Pieuchot
to the carp interface would end up enqueued without being decapsulated. Found the hard way by shten@
2015-04-17Stubs and support code for NIC-enabled IPsec bite the dust.Mike Belopuhov
No objection from reyk@, OK markus, hshoexer
2015-04-17Remove unused ipsp_parse_headers that was supposed to parse packetsMike Belopuhov
returned by IPsec-enabled NICs; OK markus, hshoexer
2015-04-17Remove unsupported SADB_X_IDENTTYPE_CONNECTION; OK markus, hshoexerMike Belopuhov
2015-04-16ipa_inp_next is unused; via mikeb@Markus Friedl
2015-04-16remove unfinished/unused support for socket-attached ipsec-policiesMarkus Friedl
ok mikeb
2015-04-15Add the necessary glue to keep carp(4) working while other pseudo-driversMartin Pieuchot
are converted to if_input(). ok dlg@, claudio@
2015-04-15Use ether_ifattach() and ether_ifdetach() when cloning/destroying anMartin Pieuchot
interface instead of rewritting most of them. This change is also needed for upcoming if_input() conversion. As a bonus pseudo-driver attached on top of carp are now detached in the right order. ok claudio@, henning@
2015-04-14make ipsp_address thread safe; ok mpiMike Belopuhov
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-04-13Make filter argument to ipsp_aux_match optional like the rest of them.Mike Belopuhov
OK markus, hshoexer
2015-04-13Perform IPsec bypass check on a socket before performing TDB lookups.Mike Belopuhov
OK markus, hshoexer
2015-04-13Rename gettdbbyaddr to gettdbbydst; OK markus, hshoexer, mpiMike Belopuhov
2015-04-13Remove unused arguments from gettdb* functions; OK markus, hshoexer, mpiMike Belopuhov
2015-04-10replace the use of ifqueues for most input queues serviced by netisrDavid Gwynne
with niqueues. this change is so big because there's a lot of code that takes pointers to different input queues (eg, ether_input picks between ipv4, ipv6, pppoe, arp, and mpls input queues) and falls through to code to enqueue packets against the pointer. if i changed only one of the input queues id have to add sepearate code paths, one for ifqueues and one for niqueues in each of these places by flipping all these input queues at once i can keep the currently common code common. testing by mpi@ sthen@ and rafael zalamena ok mpi@ sthen@ claudio@ henning@
2015-04-10replace the guts of tdb_hash with SipHash24David Gwynne
tested by (including some statistical measurement) and ok mikeb@
2015-04-07Do not pass an `ifp' argument to interface input handlers since itMartin Pieuchot
might be overwritten by pseudo-drivers. ok dlg@, henning@
2015-03-26Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?Mike Belopuhov
ok markus, hshoexer
2015-03-24Convert hand-rolled mbuf list used to store packets until ARPMartin Pieuchot
resolution is completed to ml_init(9) API. Tested by kspillner@, inputs & ok dlg@
2015-03-18"handle" wccp2 packets if net.inet.gre.wccp is set to 2 by truncatingRyan Thomas McBride
skipping the wccp 2 header. Tested with Cisco ASA. "looks correct" claudio ok yasuoka
2015-03-14Check for the size of the supposed destination address when constructingMartin Pieuchot
the Ethernet frame. Prevent an overflow reported by Henk Jan Agteresch on bugs@.
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-03-04Do not check if the interface index matches the scope when all we wantMartin Pieuchot
is to clear the damn embedded scope. At this point the receiving interface should not matter and will in the future be cleared to prevent such layer violations. This prevent exporting addresses with embedded scope to userland. Found the hardway by and ok florian@
2015-03-04Explicitly fallback to a carp IP address if the parent does not have anyMartin Pieuchot
configured IP address when sending AD. Previously ip_output() was doing this magic for us and ip6_output() was failing, making it impossible to send AD if the parent did not have an IPv6 address. Fix a regression found the hardway by benno@ introduced by the move to NOINET6 by default. ok benno@, phessler@
2015-02-11Do not store the key and the gateway of a route entry in the same chunkMartin Pieuchot
of memory. The key (destination) is only set once, when the route is inserted in the routing table, and does not need to change afterward. The gateway might change and rt_setgate() will do all the checks for you. ok claudio@
2015-02-11Until carp(4) is converted to call ether_ifattach() and ether_ifdetach(),Martin Pieuchot
reroll the loop to free its Ethernet multicast addresses when destroying an interface. Prevent a panic found the hard way by phessler@ ok henning@, pelikan@, phessler@
2015-02-10bzero -> memset and unify sizeof() usage (no space).Claudio Jeker
Requested by reyk@, dlg@ and OK mpi@, henning@
2015-02-10Nuke sin_zero before passing it on down into the ifa_ifwithaddr() thatClaudio Jeker
way garbage in the pad bytes does not perturb the outcome. This fixes regress/sys/kern/bind. OK mpi@, phessler@, reyk@
2015-02-09Implement 2 sysctl to retrieve the multicast forwarding cache (mfc) and theClaudio Jeker
virtual interface table (vif). Will be used by netstat soon. Looked over by guenther@
2015-02-08Count dropped SYN packets on the tcpstat. They are dropped due to theYASUOKA Masahiko
listen queue (backlog) limit or the memory shortage in syn-cache. ok henning reyk claudio
2015-02-08Just use sysctl_rdstruct() to read out some structs. Only differenceClaudio Jeker
to current code is that you can no longer call this with a NULL oldlenp which does not make any sense. OK phessler, henning Behaviour change pointed out by miod@
2015-02-08De-static to make ddb hangman harder. OK phessler, henningClaudio Jeker
2015-02-07mechanical conversion of this code to using siphash instead of some xors.David Gwynne
ok tedu@ claudio@
2015-02-07Print a different error message if the route entry supposed to containMartin Pieuchot
ARP information is of a different kind. ok sthen@, claudio@
2015-02-05Convert various rtrequest1(RTM_DELETE,...) calls to rtdeletemsg(9).Martin Pieuchot
This unify some code and notify userland for free. blambert@ agrees, ok bluhm@
2015-01-28Revert rtdeletemsg conversion. It was not ok'd, I misunderstood bluhm@'sMartin Pieuchot
email.
2015-01-26Call rtdeletemsg(9) instead of rerolling its code. As a bonus you'llMartin Pieuchot
get userland notification for free. ok blambert@, bluhm@
2015-01-26Do not always try to rtfree(9) route entries inside rtdeletemsg(9).Martin Pieuchot
Instead check the error code returned by this function and let the caller free the route entry when appropriate. ok bluhm@
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2015-01-21To satisfy kernel grovellers and bad (but document) sysctlTheo de Raadt
practice, be pragmatic and #include <sys/timeout.h> for struct tcpb (glorious namespace violation) ok kettenis millert sthen
2015-01-21Remove the code to automagically find a "carpdev".Martin Pieuchot
The half-backed logic to find a parent interface before configuring an address on a carp(4) interface is responsible for too many layers of complexity resulting in various breakages everytime something change in the stack. So make carp(4) a bit less special. It now requires a parent interface like all the other pseudo-devices. ok mikeb@, dlg@, florian@, henning@
2015-01-19mikeb points out that 'struct ipsec_policy' can also be hidden by _KERNELTheo de Raadt
2015-01-19First step of hiding many kernel-only parts of <netinet/ip_ipsp.h>Theo de Raadt
under _KERNEL, and adjust the one consumer (netstat) so that it requests the exposure. Will take a few more rounds to get this right. ok mikeb
2015-01-13Only notify userland about resolved ARP entries if the Ethernet addressMartin Pieuchot
changed or if we asked for it. Should reduce the RTM_RESOLVE storm seeing by claudio@ With inputs from and ok mikeb@
2015-01-12Kill the global list of IPv4 addresses.Martin Pieuchot
ok claudio@, mikeb@, bluhm@
2015-01-08Factorize various duplicated chunks of (old and horrible) code, checkingMartin Pieuchot
for the validity of a given outgoing route entry into a single function. This change is inspired from FreeBSD r111767. The function introduced here, rt_checkgate(), should hopefully die in a near future. Why should it die? Well, it is way too late to do such validity checks: if your kernel can ends up in ether_output() with an invalid route, please do not let it try to find a new one that might do the job. Go read this function if you're wondering why you're getting messages like: "arpresolve: X.X.X.X: route without link local address" Since this horrible logic has survived 20 years of copy & past and small modifications for workarounds without a single clear commit message, let's assume it is full of dragons and try to play safe. This factorization is not intended to change any behavior. With much inputs from bluhm@, tested by weerd@ and florian@ on setups with p2p IPv6 interfaces. ok bluhm@, benno@, florian@
2015-01-08Do not unconditionally set a link-local address.Martin Pieuchot
carp(4) has a hack to update its Ethernet address which was also generating the corresponding IPv6 link-local address. Since the removal of the NOINET6 flag, this link-local address was generated even if no IPv6 address has been configured on the interface. This unbreak carp setup without v6 addresses, found the hard way by sebastia@. ok sebastia@, benno@, stsp@, @phessler
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-19 15:50:04 +0000