summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2021-05-04Initialize `ipsec_policy_pool' within pfkey_init() instead of doing thatmvs
in runtime within pfkeyv2_send(). Also set it's interrupt protection level to IPL_SOFTNET. ok bluhm@ mpi@
2021-04-30Rearrange the implementation of bounded sysctl. The primitiveAlexander Bluhm
functions are sysctl_int() and sysctl_rdint(). This brings us back the 4.4BSD implementation. Then sysctl_int_bounded() builds the magic for range checks on top. sysctl_bounded_arr() is a wrapper around it to support multiple variables. Introduce macros that describe the meaning of the magic boundary values. Use these macros in obvious places. input and OK gnezdo@ mvs@
2021-04-28Use mq_delist() to fetch the ARP mbuf hold queue once and feed theAlexander Bluhm
mbuf list to if_output(). OK sashan@ mvs@
2021-04-28Document the locking mechanism of the global variables in ARP code.Alexander Bluhm
The global list of ARP llinfo is protected by net lock. This is not sufficent when we switch to shared netlock. Add a mutex for insertion and removal when net lock is not exclusive. This is needed if we want run IP output on multiple CPU. Put an assertion for shared net lock into arp_rtrequest. input mvs@; OK sashan@
2021-04-26Convert the ARP packet hold queue from mbuf list to mbuf queue whichAlexander Bluhm
contins a mutex. Update la_hold_total with atomic operations. OK sashan@
2021-04-23Setting variable arpinit_done is not MP save if we want to executeAlexander Bluhm
arp_rtrequest() in parallel. Move initialization to arpinit() function. OK kettenis@ mvs@
2021-04-23The variable la_hold_total contains the number of packets currentlyAlexander Bluhm
in the arp queue. So the sysctl net.inet.ip.arpqueued must be read only. In if_ether.c include the header with the declaration of la_hold_total to ensure that the definition matches. OK mvs@
2021-04-16Turn on the direct ACK on every other segment.Alexander Bluhm
This is a backout of rev 1.366 which turned this feature off. Although sending less ACKs makes TCP faster if the CPU is busy with processing packets, there are corner cases where TCP gets slower. Especially OpenBSD 6.8 and older has a maxbust limitiation that scales badly if the other side sends too few ACKs. Also regress test relayd run-args-http-slow-consumer.pl uses strange socket buffer sizes that triggers slow performance with the new algorithm. For OpenBSD 6.9 release switch back to 6.8 delayed ACK behavior. discussed with deraadt@ benno@ claudio@ jan@
2021-03-30[ICMP] IP options lead to malformed replyAlexandr Nedvedicky
icmp_send() must update IP header length if IP optaions are appended. Such packet also has to be dispatched with IP_RAWOUTPUT flags. Bug reported and fix co-designed by Dominik Schreilechner _at_ siemens _dot_ com OK bluhm@
2021-03-20use m_dup_pkthdr in ip_fragment to copy pkthdr info to fragments.David Gwynne
this ensures more stuff is copied, in particular the flowid information. this is also how v6 does it, which makes things more consistent. ok bluhm@
2021-03-10spellingJonathan Gray
ok gnezdo@ semarie@ mpi@
2021-03-07use uint64_t ethernet addresses for compares in carp.David Gwynne
pass the uint64_t that ether_input has already converted from a real ethernet address into carp_input so it can use it without having to do its own conversion. tested by hrvoje popovski tested by me on amd64 and sparc64 ok patrick@ jmatthew@
2021-03-05pass the uint64_t dst ethernet address from ether_input to bridges.David Gwynne
tested on amd64 and sparc64.
2021-03-01Refactor ip_fragment() and ip6_fragment(). Use a mbuf list toAlexander Bluhm
simplify the handling of the fragment list. Now the functions ip_fragment() and ip6_fragment() always consume the mbuf. They free the mbuf and mbuf list in case of an error and take care about the counter. Adjust the code a bit to make v4 and v6 look similar. Fixes a potential mbuf leak when pf_route6() called pf_refragment6() and it failed. Now the mbuf is always freed by ip6_fragment(). OK dlg@ mvs@
2021-02-26add some helpers for working with ethernet addresses as uint64_tDavid Gwynne
the main bits are ether_addr_to_e64 and ether_e64_to addr for loading an ethernet address into a uin64_t and visa versa. there's also some macros for testing if an address in a uint64_t is multicast, broadcast, anyaddr, or if it's an 802.1q reserved multicast group address. the reason for this functionality is once you have an ethernet address as a uint64_t, operations like compares, bit tests, and so on are fast and easy. tested on amd64 and sparc64
2021-02-25we don't have to cast to caddr_t when calling m_copydata anymore.David Gwynne
the first cut of this diff was made with coccinelle using this spatch: @rule@ type caddr_t; expression m, off, len, cp; @@ -m_copydata(m, off, len, (caddr_t)cp) +m_copydata(m, off, len, cp) i had fix it's opinionated idea of formatting by hand though, so i'm not sure it was worth it. ok deraadt@ bluhm@
2021-02-23Use pool to allocate tdbs.tobhe
ok patrick@ bluhm@
2021-02-23As ip_insertoptions() may prepend a mbuf, "goto bad" has to freeAlexander Bluhm
the new chain. This fixes a potential memory leak in ip_output(). Also simplify a bunch of "goto done". OK kn@ mvs@
2021-02-23Use NULL instead of 0 in `m_nextpkt' assignment.mvs
ok deraadt@ dlg@
2021-02-11Swap faddr/laddr and fport/lport arguments in call to stoeplitz_ipXport().Patrick Wildt
Technically the whole point of the stoeplitz API is that it's symmetric, meaning that the order of addresses and ports doesn't matter and will produce the same hash value. Coverity CID 1501717 ok dlg@
2021-02-10If pf changes the routing table when sending packets, the kernelAlexander Bluhm
could get stuck in an endless recursion during TCP path MTU discovery. Create a dynamic host route in ip_output() that can be used by tcp_mtudisc() to store the MTU. Reported by Peter Mueller and Sebastian Sturm OK claudio@
2021-02-08Remove maxburst feature from tcp_outputjan
OK bluhm@, claudio@, deraadt@
2021-02-08Start refcounting interface groups with 1. if_creategroup() returnsAlexander Bluhm
a new object that is already refcounted, so carp attach does not reach into internal structures. Add kasserts to detect counter overflow or underflow. OK mvs@
2021-02-06Simplex interface sends packet back without hardware checksumAlexander Bluhm
offloading. The checksum must be calculated in software. Use the same condition in ether_resolve() to send the broadcast packet back to the stack and in in_ifcap_cksum() to force software checksumming. This fixes regress/sys/kern/sosplice/loop. OK procter@
2021-02-03Turns off the direct ACK on every other segmentjan
The kernel uses a huge amount of processing time for sending ACKs to the sender on the receiving interface. After receiving a data segment, we send out two ACKs. The first one in tcp_input() direct after receiving. The second ACK is send out, after the userland or the sosplice task read some data out of the socket buffer. Thus, we save some processing time and improve network performance. Longer tested by sthen@ OK claudio@
2021-02-02If IP_MULTICAST_IF or IP_ADD_MEMBERSHIP pass a interface index to theClaudio Jeker
kernel make sure that the rdomain of that interface is the same as the rdomain of the inpcb. Problem spotted and fix tested by semarie@ OK bluhm@ mvs@
2021-02-01Fix path MTU discovery for ESP tunneled in IPv6. We always wantAlexander Bluhm
short TCP segments or fragments encapsulated in ESP instead of fragmented ESP packets. Pass the don't fragment flag down along the stack so that dynamic routes with MTU are created eventually. with and OK markus@; OK tobhe@
2021-01-28Drop tcp_trace() from SMALL_KERNEL builds to make room on amd64 floppyVisa Hankala
OK deraadt@
2021-01-25if stoeplitz is enabled, use it to provide a flowid for tcp packets.David Gwynne
drivers that implement rss and multiple rings depend on the symmetric toeplitz code, and use it to generate a key that decides with rx ring a packet lands on. if the toeplitz code is enabled, this diff has the pcb and tcp layer use the toeplitz code to generate a flowid for packets they send, which in turn is used to pick a tx ring. because the nic and the stack use the same key, the tx and rx sides end up with the same hash/flowid. at the very least this means that the same rx and tx queue pair on a particular nic are used for both sides of the connection. as the stack becomes more parallel, it will also help keep both sides of the tcp connection processing in the one place.
2021-01-21carp(4): convert ifunit() to if_unit(9)mvs
ok dlg@ bluhm@
2021-01-18add IPPROTO_SCTP, ok claudio@Stuart Henderson
2021-01-16Extend IP_MULTICAST_IF to take either an address (struct in_addr), aClaudio Jeker
struct ip_mreq or a struct ip_mreqn. Using struct ip_mreqn allows to pass a interface index instead of specifying the multicast interface via its IP address. This is also the API implemented by Linux and FreeBSD and should help porting software. OK bluhm@ phessler@ robert@
2021-01-15As documented in sysctl(2) net.inet.ip.forwarding can be 2.Alexander Bluhm
Relax input validation and use integer comparison. OK kn@ mvs@ sthen@
2021-01-11Create a path MTU host route for IPsec over IPv6. Basically theAlexander Bluhm
code is copied from IPv4 and adapted. Some things are changed in v4 to make it look similar. - ip6_forward increases the noroute error counter, do that in ip_forward, too. - Pass more specific sockaddr_in6 to icmp6_mtudisc_clone(). - IPv6 may also use reject routes for IPsec PMTU clones. - To pass a route_in6 to ip6_output_ipsec_send() introduce one in ip6_forward(). That is the same what IPv4 does. Note that dst and sin6 switch roles. - Copy comments from ip_output_ipsec_send() to ip6_output_ipsec_send() to make code similar. - Implement dynamic IPv6 IPsec PMTU routes. OK tobhe@
2021-01-09Enforce range with sysctl_int_bounded in ipip_sysctlgnezdo
OK millert@
2021-01-09Enforce range with sysctl_int_bounded in tcp_sysctlgnezdo
One case uses the explicit range from the code and the other was inferred from reading the usage. OK millert@
2021-01-07Extend IP_ADD_MEMBERSHIP to also support struct ip_mreqn.Claudio Jeker
struct ip_mreqn allows to use the interface index to select the interface for multicast packets which makes it possible to use this with unnumbered interfaces. OK dlg@ robert@
2021-01-04- fix use after free, when packet gets dropped.Alexandr Nedvedicky
patch submitted by Ralf Horstmann from ackstorm.de OK dlg@
2020-12-20Accept reject and blackhole routes for IPsec PMTU discovery.Alexander Bluhm
Since revision 1.87 of ip_icmp.c icmp_mtudisc_clone() ignored reject routes. Otherwise TCP would clone these routes for PMTU discovery. They will not work, even after dynamic routing has found a better route than the reject route. With IPsec the use case is different. First you need a route, but then the flow handles the packet without routing. Usually this route should be a reject route to avoid sending unencrypted traffic if the flow is missing. But IPsec needs this route for PMTU discovery, so use it for that. OK claudio@ tobhe@
2020-12-18Make sure the first packet of an SA has sequence number 1 (as described intobhe
RFC 4302 and RFC 4303). It seems this was changed by accident when support for 64 bit sequence numbers was added. ok bluhm@ patrick@
2020-12-16Use ESP sequence number as IV for AES-CTR, AES-GCM and Chacha20.tobhe
This eliminates the risk for IV reuse because of random collisions and increases performance a little. ok patrick@ markus@
2020-11-16Replace sysctl_rdint with sysctl_bounded_args entries in net.inet*gnezdo
2020-11-16Remove the cases folded into sysctl_bounded_args but left behindgnezdo
divert_sysctl and divert6_sysctl get a tiny bit slimmer.
2020-11-07Rework source IP address setting.denis
- Move most of the processing out of rtable.c (reasonnable tb@, ok bluhm@) - Remove memory allocation, store pointer to existing ifaddr - Fix tunnel interface handling looks fine mpi@
2020-11-05Enable support for ASN1_DN ipsec identifiers.Peter Hessler
Tested with multiple Window 10 Pro (ver 2004) clients, and OpenBSD+iked as the server. OK tobhe@ sthen@ kn@
2020-11-05Replace wrong cast with satosin.denis
Advised by bluhm@
2020-11-02Move TCPCTL_ALWAYS_KEEPALIVE into tcpctl_varsgnezdo
OK deraadt
2020-10-29Add feature to force the selection of source IP addressdenis
Based/previous work on an idea from deraadt@ Input from claudio@, djm@, deraadt@, sthen@ OK deraadt@
2020-10-28When generating the ICMP6 response to an IPv6 packet, the kernelAlexander Bluhm
could use mbuf memory after freeing it. If m_pullup() allocates a new mbuf, the caller uses the old pointer. found and reported by Maxime Villard, thanks OK claudio@ markus@ denis@
2020-09-22whitespacetobhe
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-20 17:37:37 +0000