summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2013-05-03Document which gobal variables are used for sysctl(8), add static toMartin Pieuchot
gobals used only in this file and explain that the printf/debug variable must be settable by ddb. ok henning@, sthen@
2013-05-02tedu broken Resource Reservation Protocol code that was ifdef RSVP_ISI.Martin Pieuchot
ok deraadt@, tedu@ (implicit)
2013-04-24ansify.Martin Pieuchot
ok mikeb@, haesbaert@ jajaja miod@
2013-04-24Instead of having various extern declarations for protocol variables,Martin Pieuchot
declare them once in their corresponding header file.
2013-04-17Replace some casts by ifatoia() and sintosa().Martin Pieuchot
ok krw@, mikeb@
2013-04-17Simplify the check to call in_ifinit() by merging two conditionalMartin Pieuchot
viariables. ok mikeb@
2013-04-11Remove the extern keyword from function declarations, documentMartin Pieuchot
sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
2013-04-10Remove various external variable declaration from sources files andMartin Pieuchot
move them to the corresponding header with an appropriate comment if necessary. ok guenther@
2013-04-09Remove read-only ipsec variables and directly use defines instead.Martin Pieuchot
ok mikeb@, markus@
2013-04-08Recalculate the IP and protocol checksums of packets (re)injected viaLawrence Teo
divert(4) sockets. Recalculation of these checksums is necessary because (1) PF no longer updates IP checksums as of pf.c rev 1.731, so translated packets that are diverted to userspace (e.g. divert-packet with nat-to/rdr-to) will have bad IP checksums and will be reinjected with bad IP checksums if the userspace program doesn't correct the checksums; (2) the userspace program may modify the packets, which would invalidate the checksums; and (3) the divert(4) man page states that checksums are supposed to be recalculated on reinjection. This diff has been tested on a public webserver serving both IPv4/IPv6 for more than four weeks. It has also been tested on a firewall with divert-packet and nat-to/rdr-to where it transferred over 60GB of FTP/HTTP/HTTPS/SSH/DNS/ICMP/ICMPv6 data correctly, using IPv4/IPv6 userspace programs that intentionally break the IP and protocol checksums to confirm that recalculation is done correctly on reinjection. IPv6 extension headers were tested with Scapy. Thanks to florian@ for testing the original version of the diff with dnsfilter and Justin Mayes for testing the original version with Snort inline. Thanks also to todd@ for helping me in my search for the cause of this bug. I would especially like to thank blambert@ for reviewing many versions of this diff, and providing guidance and tons of helpful feedback. no objections from florian@ help/ok blambert@, ok henning@
2013-04-04Merge the duplicate IPv4 and IPv6 checksum checking code in udp_input()Alexander Bluhm
into one block. OK mpi@
2013-04-02Use macros sotoinpcb() and intotcpcb() instead of casts. Use NULLAlexander Bluhm
instead of 0 for pointers. No binary change. OK mpi@
2013-03-31The call to in_pcballoc() in user request attach was handled inAlexander Bluhm
three different ways. Use the same code in udp_usrreq() and rip_usrreq() and rip6_usrreq(). This also fixes a pcb and socket leak in udp_usrreq() in case soreserve() fails. Put an splsoftassert() into in_pcballoc() for safety. OK mpi@
2013-03-31Do not transfer diverted packets into IPsec processing. They shouldAlexander Bluhm
reach the socket that the user has specified in pf.conf. OK reyk@
2013-03-30Restrict protocol numbers for raw sockets to the range from 0 to 255.Alexander Bluhm
OK deraadt@ guenther@
2013-03-29Declare struct pf_state_key in the mbuf and in_pcb header files toAlexander Bluhm
avoid ugly casts. OK krw@ tedu@
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2013-03-28do not include machine/cpu.h from a .c file; it is the responsibility ofTheo de Raadt
.h files to pull it in, if needed ok tedu
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-28Convert the satosin, sintosa, ifatoia, satosin6, sin6tosa, ifatoia6Alexander Bluhm
defines into static inline functions. This allows the compiler to check the source type before casting. liked by many; OK mpi@ haesbaert@
2013-03-28Replace some casts to struct in_ifaddr pointer by ifatoia() or NULL.Martin Pieuchot
ok millert@, haesbaert@, bluhm@
2013-03-28Unfortunately the satosin, sintosa, ifatoia, satosin6, sin6tosa,Alexander Bluhm
ifatoia6 macros do not check the source type. They just cast anything. Remove needless casts and do not use those macros if the source type does not match. Remove duplicate defines. No binary change. OK kettenis@ krw@
2013-03-26Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.Martin Pieuchot
ok beck@, mikeb@
2013-03-25Substitute the handcrafted list of IPv6 addresses by a proper TAILQ.Martin Pieuchot
ok bluhm@, mikeb@
2013-03-22simple replacement of LIST_END with NULL. ok mpiTed Unangst
2013-03-17Add the router preference defines to the icmp6.h header and remove theBrad Smith
defines that were part of rtadvd's code. ok bluhm@
2013-03-14tedu faith(4), suggested by todd@ some weeks ago after a submission byMartin Pieuchot
dhill. ok krw@, mikeb@, tedu@ (implicit)
2013-03-07Remove the IFAFREE() macro, the ifafree() function it was calling alreadyMartin Pieuchot
check for the reference counter. ok mikeb@, miod@, pelikan@, kettenis@, krw@
2013-02-16Fix a bug in udp socket splicing in case a packet gets diverted andAlexander Bluhm
spliced and routed to loopback. The content of the pf header in the mbuf was keeping the divert information on its way. Reinitialize the whole packet header of the mbuf and remove the mbuf tags when the packet gets spliced. OK claudio@ markus@
2013-02-14Merge of an original work by markus@ and gerhard@ to increaseMike Belopuhov
the anti-replay window size to 2100 entries; plus small ESN related improvements. ok markus
2013-02-05Make the inet6 and inet cases in in_pcbrtentry() look similar.Alexander Bluhm
No functional change. OK millert@
2013-02-04Set sa_len correctly for PF_INET (and be consistent with the PF_INET6Todd C. Miller
case). On our platforms, sizeof(struct sockaddr) matches sizeof(struct sockaddr_in) so this hasn't caused problems but it is still incorrect. From Anthony Low. OK martynas@ bluhm@
2013-01-17Expand the socket splicing functionality from TCP to UDP. MergeAlexander Bluhm
the code relevant for UDP from sosend() and soreceive() into somove(). That allows the kernel to directly transfer the UDP data from one socket to another. OK claudio@
2013-01-17After finding the socket's inp by using the pf's statekey, resetAlexander Bluhm
the pointer to the statekey in the mbuf. When an UDP socket is spliced, pf would use this key during ip_output() although the packet went through two sockets in the meantime. Reset the mbuf's statekey in tcp_input() and udp_input() to eliminate the pointer to pf lingering in the socket buffers. OK claudio@
2013-01-17first or second coming, commie or not commie, one m in coming is sufficientHenning Brauer
ok claudio
2013-01-16Pass struct inpcb pointer to in_pcb...() functions instead of voidAlexander Bluhm
pointer. Allows stricter type checking. No functional change. OK claudio@
2013-01-14after OpenBSD requested a etherip rev 3 to solve a byte order weakness, andTheo de Raadt
worked with them to define a specific format, ietf quietly changed their mind and did something different. First step of transitioning over two release -- accept both types, but continue sending old format. pointed out by david.dahlberg@fkie.fraunhofer.de ok claudio
2012-12-28change the malloc(9) flags from M_DONTWAIT to M_NOWAIT; OK millert@Gleydson Soares
2012-11-11align ifaliasreq.ifra_addr similar to the way that ifreq is fixed --Theo de Raadt
a gruesome union, to block the compiler from placing the struct incorrectly aligned on stack frames ok guenther
2012-11-06backout csum diff for the moment, requested by theoHenning Brauer
2012-11-05Make sure that in[6]_proto_cksum_out() is called unconditinally and notClaudio Jeker
inside the NPF block. Fixes checksum issues seen on ramdisk kernels. Initial diff by naddy@, tested and OK by many
2012-11-01redo most of the protocol (tcp/udp/...) checksum handlingHenning Brauer
-assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
2012-10-21Add the IP_DIVERTFL socket option on divert(4) sockets to controlSebastian Benoit
which packets (as in direction) of the traffic will be diverted through the divert socket. ok claudio@, henning@
2012-10-18simplify checkreplaywindow() API; make call/return code handling consistentMarkus Friedl
ok mikeb@
2012-10-18Move revarp code into #ifdef NFSCLIENT; saving space on some media.Theo de Raadt
Resurrect the rather silly "unplug my network device while I am doing nfs diskless revarp" safety code which was disabled due to a missing "ether.h" include, found by jsg ok jsg
2012-10-15Another 'notyet' is being promoted to 'notever'.Mike Belopuhov
An NSC HYPERchannel remnant from the CSRG times bites the dust. ok deraadt, reyk
2012-10-08Make carp_ourether() shorter and more generic. Only a mac addressCamiel Dobbelaar
is really needed, instead of an ethernet header and selector. ok mikeb henning mpf
2012-10-08Forward declare struct m_tag in netinet/ip_ipsp.h so we don't need toCamiel Dobbelaar
include sys/mbuf.h in net/pfvar.h. Flagged by and ok guenther@
2012-10-05Point an interface directly to its bridgeport configuration, insteadCamiel Dobbelaar
of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
2012-10-05missing NCARP define and fix indentCamiel Dobbelaar
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 11:13:57 +0000