summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2013-07-04format string fixes: size_t and uint16_tStefan Fritsch
ok bluhm@
2013-07-04These functions are only used in debug code, so put them underMartin Pieuchot
ifdef ENCDEBUG to make sure we don't use them elsewhere.
2013-07-04Rewrite the function used to determine if we do proxy ARP for one ofMartin Pieuchot
our addresses to reuse arplookup() and do only one list iteration. Looks ok to claudio@, ok mikeb@
2013-07-01The reverse parameter of in_pcblookup_listen() is a boolean and notAlexander Bluhm
a flag. Rename the variable inpl_flags in tcp_input() to inpl_reverse like in udp_input(). No binary change. OK mikeb@
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-06-23Revert r1.78 for now, it breaks ipv4 on carp. As found the hard way byStuart Henderson
Jeff Ross and later by myself, both on remote systems..
2013-06-20Always make sure that the temporary TCP protocol control blockMike Belopuhov
structure is zeroed out before use. From David Hill <dhill at mindcry ! org>; ok blambert claudio henning
2013-06-20Revert previous and unbreak asr, the new include should be protected.Martin Pieuchot
Reported by naddy@
2013-06-20Allocate the various hook head descriptors as part of the ifnetMartin Pieuchot
structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
2013-06-18Use TAILQ_FOREACH() instead of handrolling our own version and stopMartin Pieuchot
iterating once we found a matching address. ok mpf@, yasuoka@, henning@
2013-06-17Always add/remove IPv4 addresses consistently from the global list and tree.Martin Pieuchot
ok bluhm@, mikeb@
2013-06-17In icmp_do_exthdr(), calculate the ICMP extension header checksums withLawrence Teo
in4_cksum() instead of in_cksum(). This gets rid of the clunky m_data/m_len dance, which was described as "disgusting" in the original comments. :) Tested on a small MPLS test network (since icmp_do_exthdr() is currently only used by MPLS code, specifically mpls_do_error()). ok bluhm henning mikeb
2013-06-13Move the local delivery code from ipv4_input() into its own function andMartin Pieuchot
unify some return statements while here. ok bluhm@, henning@
2013-06-11Replace all ovbcopy with memmove; swap the src and dst arguments tooTheo de Raadt
ok otto
2013-06-09Increment udpstat.udps_nosec and tcpstat.tcps_rcvnosec in case packet isYASUOKA Masahiko
dropped by IPsec security policy. input from and ok mikeb
2013-06-05If an ICMP packet gets diverted to a raw IP socket, if must not beAlexander Bluhm
consumed by icmp_input(). As an exception, control packets that belong to a connection to a local socket must go to pr_ctlinput(). Add a switch over the ICMP type to handle that. OK markus@ henning@
2013-06-05Calculate ICMP checksums with in4_cksum() which lets us get rid of theLawrence Teo
clunky m_data/m_len dance needed by in_cksum(). Tested on amd64, hppa, i386, loongson, macppc, sgi, and sparc64. Thanks to blambert@, bluhm@, and henning@ for help and feedback; abieber@ for testing this diff independently on macppc; krw@ for access to his hppa, sgi, and sparc64 test systems at t2k13; nick@ for helping me figure out Ken's hppa so that I can test this diff. :) ok blambert bluhm henning mikeb
2013-06-03fix typo in commentYASUOKA Masahiko
2013-06-03Link pf states and socket inpcbs together more tightly. The linkingAlexander Bluhm
was only done when a packet traveled up the stack from pf to tcp_input(). Now also link the state and inpcb when the packet is going down from tcp_output() to pf. As a consequence, divert-reply states where the initial SYN does not get an answer, can be handled more correctly. This change is part of a larger diff that has been backed out in 2011. Bring the feature back in small steps to see when bad things start to happen. OK henning deraadt
2013-06-03Merge the duplicate IPv4 and IPv6 checksum checking code in tcp_input()Alexander Bluhm
into one block. OK mpi@
2013-06-02increase heat in the hackathon room by making sure everybody has to recompileHenning Brauer
even more of the kernel fix formatting ugliness, whitespace only, obviously a copy & pasto ok ryan
2013-06-02Exclude the mac address for the HMAC calculation if lladdr is the realYASUOKA Masahiko
one so that we can use the real MAC address for carp(4) like an example following. ifconfig carp0 carpdev REALIF lladdr <real interface's lladdr> ok reyk mcbride
2013-06-01Fix typo backswards -> backwards.Alexander Bluhm
2013-06-01Pass the routing domain to IPv6 pr_ctlinput() like in IPv4.Alexander Bluhm
OK claudio@
2013-06-01Remove redundant call to splsoftnet(). There is aAlexander Bluhm
splsoftassert(IPL_SOFTNET) at the start of in_pcbdetach(). From David Hill
2013-06-01Add support for advertising route information (RFC 4191).Brad Smith
From FreeBSD via UMEZAWA Takeshi ok bluhm@
2013-05-31Remove the scrub argument from in_ifinit() and simply call in_ifscrub()Martin Pieuchot
unconditionally for SIOCSIFADDR. ok bluhm@, henning@
2013-05-31The function rip6_ctlinput() claims that sa6_src is constant toAlexander Bluhm
allow the assingment of &sa6_any. But rip6_ctlinput() could not guarantee that as it casted away the const attribute when it passes the pointer to in6_pcbnotify(). Replace sockaddr with const sockaddr_in6 in the in6_pcbnotify() parameters. This reduces the number of casts. Also adjust in6_pcbhashlookup() to handle the const attribute correctly. Input and OK claudio@
2013-05-17Move an extern declaration into its corresponding header file.Martin Pieuchot
2013-05-14Fix build with ENCDEBUG defined.Martin Pieuchot
2013-05-13Make SIOCSIFDSTMASK and SIOCSIFNETMASK fail if there is no previousMartin Pieuchot
address configured on the interface just like SIOCSIFBRDADDR does. This prevent the global IPv4 address list and the per-interface list to be out of sync until one of SIOCAIFADDR or SIOCSIFADDR ioctl(2) is issued. ok mikeb@, sthen@
2013-05-03Document which gobal variables are used for sysctl(8), add static toMartin Pieuchot
gobals used only in this file and explain that the printf/debug variable must be settable by ddb. ok henning@, sthen@
2013-05-02tedu broken Resource Reservation Protocol code that was ifdef RSVP_ISI.Martin Pieuchot
ok deraadt@, tedu@ (implicit)
2013-04-24ansify.Martin Pieuchot
ok mikeb@, haesbaert@ jajaja miod@
2013-04-24Instead of having various extern declarations for protocol variables,Martin Pieuchot
declare them once in their corresponding header file.
2013-04-17Replace some casts by ifatoia() and sintosa().Martin Pieuchot
ok krw@, mikeb@
2013-04-17Simplify the check to call in_ifinit() by merging two conditionalMartin Pieuchot
viariables. ok mikeb@
2013-04-11Remove the extern keyword from function declarations, documentMartin Pieuchot
sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
2013-04-10Remove various external variable declaration from sources files andMartin Pieuchot
move them to the corresponding header with an appropriate comment if necessary. ok guenther@
2013-04-09Remove read-only ipsec variables and directly use defines instead.Martin Pieuchot
ok mikeb@, markus@
2013-04-08Recalculate the IP and protocol checksums of packets (re)injected viaLawrence Teo
divert(4) sockets. Recalculation of these checksums is necessary because (1) PF no longer updates IP checksums as of pf.c rev 1.731, so translated packets that are diverted to userspace (e.g. divert-packet with nat-to/rdr-to) will have bad IP checksums and will be reinjected with bad IP checksums if the userspace program doesn't correct the checksums; (2) the userspace program may modify the packets, which would invalidate the checksums; and (3) the divert(4) man page states that checksums are supposed to be recalculated on reinjection. This diff has been tested on a public webserver serving both IPv4/IPv6 for more than four weeks. It has also been tested on a firewall with divert-packet and nat-to/rdr-to where it transferred over 60GB of FTP/HTTP/HTTPS/SSH/DNS/ICMP/ICMPv6 data correctly, using IPv4/IPv6 userspace programs that intentionally break the IP and protocol checksums to confirm that recalculation is done correctly on reinjection. IPv6 extension headers were tested with Scapy. Thanks to florian@ for testing the original version of the diff with dnsfilter and Justin Mayes for testing the original version with Snort inline. Thanks also to todd@ for helping me in my search for the cause of this bug. I would especially like to thank blambert@ for reviewing many versions of this diff, and providing guidance and tons of helpful feedback. no objections from florian@ help/ok blambert@, ok henning@
2013-04-04Merge the duplicate IPv4 and IPv6 checksum checking code in udp_input()Alexander Bluhm
into one block. OK mpi@
2013-04-02Use macros sotoinpcb() and intotcpcb() instead of casts. Use NULLAlexander Bluhm
instead of 0 for pointers. No binary change. OK mpi@
2013-03-31The call to in_pcballoc() in user request attach was handled inAlexander Bluhm
three different ways. Use the same code in udp_usrreq() and rip_usrreq() and rip6_usrreq(). This also fixes a pcb and socket leak in udp_usrreq() in case soreserve() fails. Put an splsoftassert() into in_pcballoc() for safety. OK mpi@
2013-03-31Do not transfer diverted packets into IPsec processing. They shouldAlexander Bluhm
reach the socket that the user has specified in pf.conf. OK reyk@
2013-03-30Restrict protocol numbers for raw sockets to the range from 0 to 255.Alexander Bluhm
OK deraadt@ guenther@
2013-03-29Declare struct pf_state_key in the mbuf and in_pcb header files toAlexander Bluhm
avoid ugly casts. OK krw@ tedu@
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2013-03-28do not include machine/cpu.h from a .c file; it is the responsibility ofTheo de Raadt
.h files to pull it in, if needed ok tedu
2013-03-28no need for a lot of code to include proc.hTed Unangst
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-13 08:24:23 +0000