summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_output.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Replace INADDR_TO_IFP() by in_iawithaddr() and kill the macro.mpi2013-11-271-5/+11
| | | | ok mikeb@, ports@, henning@
* Don't let in_proto_cksum_out() assume that the ICMP checksum field islteo2013-10-251-9/+6
| | | | | | | | | | | always in the first mbuf of an mbuf chain. Thanks to henning@ and bluhm@ for their work on checksums at b2k13, which allowed this fix to be very straightforward compared to earlier versions. help/feedback bluhm@ henning@ OK henning@ naddy@
* no need to make the icmp cksum "offloading" case special insofar that thehenning2013-10-201-2/+1
| | | | | | cksum needs to be 0'd before, pf does that now (just like in the tcp/udp case) and nothing else uses the icmp "offloading" yet. with & ok bluhm
* make in_proto_cksum_out not rely on the pseudo header checksum to behenning2013-10-191-1/+20
| | | | | | | | | | already there, just compute it - it's dirt cheap. since that happens very late in ip_output, the rest of the stack doesn't have to care about checksums at all any more, if something needs to be checksummed, just set the flag on the pkthdr mbuf to indicate so. stop pre-computing the pseudo header checksum and incrementally updating it in the tcp and udp stacks. ok lteo florian
* Abstract the fact that IPv4 muticast records are linked to thempi2013-10-181-3/+3
| | | | | | | | | interface descriptor throught the first configured address in the global list, this will help reducing the size of future diffs. No object change. ok sthen@
* Change MTU discovery functions to not abuse the global icmpsrc variablempi2013-08-081-5/+2
| | | | | | to pass the destination address of the route to clone. ok markus@, mikeb@
* Make use of IFP_TO_IA() instead of rolling our own copy, no functionalmpi2013-08-081-8/+4
| | | | | | change. ok mikeb@, henning@
* Move bridge_broadcast and subsequently all IPsec SPD lookup code outmikeb2013-07-311-19/+1
| | | | | | | | of the IPL_NET. pf_test should be no longer called under IPL_NET as well. The problem became evident after the related issue was brought up by David Hill <dhill at mindcry ! org>. With input from and OK mpi. Tested by David and me.
* format string fixes: size_t and uint16_tsf2013-07-041-2/+2
| | | | ok bluhm@
* put the cksum diff back, of course with the bug fixed where we couldhenning2013-06-261-3/+3
| | | | | | | | | | | | | | | | | | | | | under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
* Replace all ovbcopy with memmove; swap the src and dst arguments tooderaadt2013-06-111-6/+6
| | | | ok otto
* Calculate ICMP checksums with in4_cksum() which lets us get rid of thelteo2013-06-051-7/+4
| | | | | | | | | | | | | clunky m_data/m_len dance needed by in_cksum(). Tested on amd64, hppa, i386, loongson, macppc, sgi, and sparc64. Thanks to blambert@, bluhm@, and henning@ for help and feedback; abieber@ for testing this diff independently on macppc; krw@ for access to his hppa, sgi, and sparc64 test systems at t2k13; nick@ for helping me figure out Ken's hppa so that I can test this diff. :) ok blambert bluhm henning mikeb
* ansify.mpi2013-04-241-35/+9
| | | | | ok mikeb@, haesbaert@ jajaja miod@
* Remove the extern keyword from function declarations, documentmpi2013-04-111-9/+1
| | | | | | | sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
* Remove various external variable declaration from sources files andmpi2013-04-101-3/+1
| | | | | | | move them to the corresponding header with an appropriate comment if necessary. ok guenther@
* Remove read-only ipsec variables and directly use defines instead.mpi2013-04-091-9/+5
| | | | ok mikeb@, markus@
* backout csum diff for the moment, requested by theohenning2012-11-061-3/+3
|
* Make sure that in[6]_proto_cksum_out() is called unconditinally and notclaudio2012-11-051-3/+3
| | | | | inside the NPF block. Fixes checksum issues seen on ramdisk kernels. Initial diff by naddy@, tested and OK by many
* redo most of the protocol (tcp/udp/...) checksum handlinghenning2012-11-011-3/+3
| | | | | | | | | | | | | | | | | | -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers. ok camield sthen claudio, testing by many, thanks!
* Point an interface directly to its bridgeport configuration, insteadcamield2012-10-051-6/+6
| | | | | | | | | | of to the bridge itself. This is ok, since an interface can only be part of one bridge, and the parent bridge is easy to find from the bridgeport. This way we can get rid of a lot of list walks, improving performance and shortening the code. ok henning stsp sthen reyk
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-6/+6
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)markus2012-07-161-2/+12
| | | | | | | can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
* unneccessary casts to unsigned; ok claudioderaadt2012-04-131-5/+5
|
* Bring the rtable sockopt code in line with the setrtable() implementation.claudio2012-04-071-8/+9
| | | | | While there change IP_RTABLE to SO_RTABLE. IP_RTABLE will die soon. With and OK guenther@
* actually store the result of the pmtu-route lookup. otherwise wemarkus2012-03-301-3/+2
| | | | | don't have a MTU to announce in the icmp need fragment packet. this fixes PMTU-discovery for TCP over IPsec; ok mpf@, fries@
* remove IP_JUMBO, SO_JUMBO, and RTF_JUMBO.dlg2012-03-171-9/+1
| | | | no objection from mcbride@ krw@ markus@ deraadt@
* Escape hardware-checksumming if interface is in a bridge, this ishaesbaert2011-12-291-4/+7
| | | | | | | | | | | | | | | | | | already done for UDP/TCP/ICMP. This fixes a problem where checksumming would not be computed if you have a bridge with at least one interface with hardware checksumming and another without. Discussed with sthen@ and henning@, this is somewhat a temporary fix, we should not have these special bridge cases in ip_output, as Henning said, the bridge must behave. But for that to work we need to poke the bridge harder, this problem has been seen by at least two users at: http://marc.info/?l=openbsd-misc&m=132391433319512&w=2 http://marc.info/?l=openbsd-misc&m=132234363030132&w=2 I promised to work on a better diff :-). ok henning@ sthen@ mikeb@
* Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.haesbaert2011-12-021-5/+3
| | | | ok claudio@ henning@ mikeb@
* Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.claudio2011-07-041-3/+3
| | | | | | The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
* Add IP_RECVRTABLE socket option to be used with a IPPROTO_IPmikeb2011-06-151-1/+9
| | | | | | | | level that allows one to retrieve the original routing domain of UDP datagrams diverted by the pf via "divert-to" with a recvmsg(2). ok claudio
* Do not allow traffic to be sent with a destination address in 0/8;weerd2011-05-281-1/+10
| | | | | | | | this is not allowed according to Stevens and RFCs 5735 and 1122. Suggestion to use ENETUNREACH from claudio. OK phessler@, claudio@
* recognize SO_RTABLE socket option at the SOL_SOCKET level;mikeb2011-05-021-2/+2
| | | | discussed with and ok claudio
* Make in_broadcast() rdomain aware. Mostly mechanical change.claudio2011-04-281-2/+3
| | | | | | This fixes the problem of binding sockets to broadcast IPs in other rdomains. OK henning@
* in_proto_csum_out: if M_ICMP_CSUM_OUT is set, do the icmp checksumhenning2011-04-051-1/+15
| | | | ok dlg fondue-kinda-ok claudio
* mechanic rename M_{TCP|UDP}V4_CSUM_OUT -> M_{TCP|UDP}_CSUM_OUThenning2011-04-051-7/+7
| | | | ok claudio krw
* de-guttenberg our stack a bithenning2011-04-041-31/+23
| | | | | we don't need 7 f***ing copies of the same code to do the protocol checksums (or not, depending on hw capabilities). claudio ok
* there is no need to special case the bridge in the ip checksum handlinghenning2011-04-041-7/+4
| | | | ok sthen claudio dlg
* If a caller is requesting to be set to the same rtable that theyphessler2010-09-301-6/+7
| | | | | | | | currently have, let the call succeede. Mirrors the same behaviour as setrtable() OK claudio@
* add a new IP level socket option IP_PIPEX. This option is used for L2TPyasuoka2010-09-231-1/+13
| | | | | support by pipex. OK henning@, "Carry on" blambert@
* Return EACCES when pf_test() blocks a packet in ip_output(). This allowsclaudio2010-09-081-2/+2
| | | | | | | | ip_forward() to know the difference between blocked packets and those that can't be forwarded (EHOSTUNREACH). Only in the latter case an ICMP should be sent. In the other callers of ip_output() change the error back to EHOSTUNREACH since userland may not expect EACCES on a sendto(). OK henning@, markus@
* when sending a fragmented packet, dont check if the interfaces send queuedlg2010-08-131-20/+1
| | | | | | | | | | | | | | has enough space for all the fragments on it. this check was snuck in by itojun under an unrelated commit. it broke when i set the virtual interface send queue depths to 1, which beck had to special case at n2k10. without this code we avoid these dubious checks along with another splnet/splx pair, and it should make future work on manipulating send queues easier. ive been running this in production since n2k10 (~7months ago). ok claudio@ henning@ deraadt@
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-4/+8
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* Fix the naming of interfaces and variables for rdomains and rtablesguenther2010-07-031-16/+15
| | | | | | | | | | | | and make it possible to bind sockets (including listening sockets!) to rtables and not just rdomains. This changes the name of the system calls, socket option, and ioctl. After building with this you should remove the files /usr/share/man/cat2/[gs]etrdomain.0. Since this removes the existing [gs]etrdomain() system calls, the libc major is bumped. Written by claudio@, criticized^Wcritiqued by me
* m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsblambert2010-07-021-3/+3
| | | | | | | | | are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
* Allow to specify an alternative enc(4) interface for an SA. Allreyk2010-07-011-11/+11
| | | | | | | | | | | | | | | | | | | traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
* Replace enc(4) with a new implementation as a cloner device. We stillreyk2010-06-291-3/+6
| | | | | | | | | | create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
* Start cleaning up the mess called rtalloc*. Kill rtalloc2, make rtalloc1claudio2010-05-071-9/+12
| | | | | | | | accept flags for report and nocloning. Move the rtableid into struct route (with a minor twist for now) and make a few more codepathes rdomain aware. Appart from the pf.c and route.c bits the diff is mostly mechanical. More to come... OK michele, henning
* Double and in comment.claudio2010-01-131-2/+2
|
* Allow the queueing of multiple fragments on virtual interfaces with abeck2010-01-121-2/+6
| | | | | | | | | | | queue length of one - i.e. vlans with the forthcoming change from dlg. this allows fragmented frames to be sent on such an interface, hoping that the interface underneath copes correctly - A better fix for this will be forthcoming soon, but this is good enough for now, and will allow the change for vlans to use an ifq length of 1. tested by me and dlg@, ok dlg@, claudio@, deraadt@
* The process's rdomain should be, well, per-process and not per-rthread,guenther2009-12-231-2/+3
| | | | | | | | so put it in struct process instead of struct proc. While at it, move the p_emul member inside struct proc so that it gets copied automatically instead of requiring manual assignment. ok deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.