| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
|
| |
ifpp - XXX: just for statistics
ifpp is always NULL in all callers so that statistic confirms ifpp is
dying
OK mpi@
|
|
|
|
| |
From David Hill; OK mpi@; tested kspillner@; tweaks bluhm@
|
|
|
|
|
| |
global variables should also live there.
OK markus@
|
|
|
|
|
|
|
|
| |
same prefix for all variables. Convert the counter type to int,
the limit is also int. Before searching the cache, check that it
is not empty. Do not access the counter outside of the syn cache
from tcp_ctlinput(), let the syn_cache_lookup() function handle it.
OK dlg@
|
|
|
|
| |
ok guenther@, henning@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
receiving interface in the packet header of every mbuf.
The interface pointer should now be retrieved when necessary with
if_get(). If a NULL pointer is returned by if_get(), the interface
has probably been destroy/removed and the mbuf should be freed.
Such mechanism will simplify garbage collection of mbufs and limit
problems with dangling ifp pointers.
Tested by jmatthew@ and krw@, discussed with many.
ok mikeb@, bluhm@, dlg@
|
|
|
|
| |
ok krw@ miod@
|
|
|
|
|
|
|
|
|
|
| |
According to RFC 7323 "once TSopt has been successfully negotiated,
... [it] MUST be sent in every non-<RST> segment for the duration
of the connection." Which means that keep alives which are just
ACK packets must include that too.
Pointed out and tested by Lauri Tirkkonen <lotheac at iki ! fi>, thanks!
ok mpi
|
|
|
|
|
|
|
| |
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.
ok tedu@ deraadt@
|
|
|
|
|
| |
long live the one true internet.
ok henning mikeb
|
|
|
|
| |
to include that than rdnvar.h. ok deraadt dlg
|
| |
|
|
|
|
| |
ok dlg@
|
|
|
|
| |
ok tedu@ claudio@
|
|
|
|
| |
ok dlg@, uebayasi@, mikeb@
|
| |
|
| |
|
|
|
|
|
|
| |
when the number of the hash entries reaches 75% of the table size.
ok dlg henning, 'commit in' claudio
|
|
|
|
| |
after discussions with beck deraadt kettenis.
|
|
|
|
|
|
| |
ever used to pass on uint32 (for ipsec). stop that madness and just pass
the uint32, 0 in all cases but the two that pass the ipsec flowinfo.
ok deraadt reyk guenther
|
|
|
|
| |
ok gcc & md5 (alas, no binary change)
|
|
|
|
| |
manually, ok naddy (in january)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Avoid the confusion by using an appropriate name for the variable.
Note that since routing domain IDs are a subset of the set of routing
table IDs, the following idiom is correct:
rtableid = rdomain
But to get the routing domain ID corresponding to a given routing table
ID, you must call rtable_l2(9).
claudio@ likes it, ok mikeb@
|
|
|
|
|
|
| |
global variables to in6.h.
ok deraadt@
|
|
|
|
|
|
| |
global variables to in.h.
ok mikeb@, deraadt@
|
|
|
|
|
|
|
|
|
| |
Mostly mechanical, setting and passing the rdomain and rtable correctly.
Not yet enabled.
Lots of help and hints from claudio and bluhm
OK claudio@, bluhm@
|
|
|
|
|
|
| |
Still some important missing pieces, and this is not yet enabled.
OK bluhm@
|
|
|
|
|
|
|
|
|
|
| |
already there, just compute it - it's dirt cheap. since that happens
very late in ip_output, the rest of the stack doesn't have to care about
checksums at all any more, if something needs to be checksummed, just
set the flag on the pkthdr mbuf to indicate so.
stop pre-computing the pseudo header checksum and incrementally updating it
in the tcp and udp stacks.
ok lteo florian
|
|
|
|
| |
OK claudio@
|
|
|
|
|
|
|
|
|
|
| |
allow the assingment of &sa6_any. But rip6_ctlinput() could not
guarantee that as it casted away the const attribute when it passes
the pointer to in6_pcbnotify(). Replace sockaddr with const
sockaddr_in6 in the in6_pcbnotify() parameters. This reduces the
number of casts. Also adjust in6_pcbhashlookup() to handle the
const attribute correctly.
Input and OK claudio@
|
|
|
|
|
|
|
| |
move them to the corresponding header with an appropriate comment if
necessary.
ok guenther@
|
|
|
|
|
| |
instead of 0 for pointers. No binary change.
OK mpi@
|
|
|
|
|
| |
slipped by on i386, but the zaurus doesn't automagically pick it up.
spotted by patrick
|
| |
|
| |
|
|
|
|
|
|
| |
draft-ietf-tcpm-initcwnd. net.inet.tcp.rfc3390 defaults to 2 now which
uses the 10*MSS, setting it back to 1 brings back the old default of 4*MSS.
OK sperreault@, henning@, sthen@, markus@
|
|
|
|
|
| |
explicit_bzero() where required
ok markus mikeb
|
|
|
|
|
|
|
|
|
|
|
|
| |
and make it possible to bind sockets (including listening sockets!)
to rtables and not just rdomains. This changes the name of the
system calls, socket option, and ioctl. After building with this
you should remove the files /usr/share/man/cat2/[gs]etrdomain.0.
Since this removes the existing [gs]etrdomain() system calls, the
libc major is bumped.
Written by claudio@, criticized^Wcritiqued by me
|
|
|
|
|
|
| |
With input from oga@ and krw@
ok oga@ krw@ thib@ markus@ mk@
|
|
|
|
|
|
|
|
| |
needed so that the route and inp lookups done in TCP and UDP know where
to look. Additionally in_pcbnotifyall() and tcp_respond() got a rdomain
argument as well for similar reasons. With this tcp seems to be now
fully rdomain save and no longer leaks single packets into the main domain.
Looks good markus@, henning@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
tables on top of a rdomain) but until now our code was a crazy mix so that
it was impossible to correctly use rtables in that case. Additionally pf(4)
only knows about rtables and not about rdomains. This is especially bad when
tracking (possibly conflicting) states in various domains.
This diff fixes all or most of these issues. It adds a lookup function to
get the rdomain id based on a rtable id. Makes pf understand rdomains and
allows pf to move packets between rdomains (it is similar to NAT).
Because pf states now track the rdomain id as well it is necessary to modify
the pfsync wire format. So old and new systems will not sync up.
A lot of help by dlg@, tested by sthen@, jsg@ and probably more
OK dlg@, mpf@, deraadt@
|
|
|
|
|
|
|
| |
therefore. Inherit the rdomain through the syncache.
There are some interactions that need some more work (ctlinput) so this
can be improved but is good enough for now.
OK markus@
|
|
|
|
|
|
|
|
|
| |
alternate routing table and separate them from other interfaces in distinct
routing tables. The same network can now be used in any doamin at the same
time without causing conflicts.
This diff is mostly mechanical and adds the necessary rdomain checks accross
net and netinet. L2 and IPv4 are mostly covered still missing pf and IPv6.
input and tested by jsg@, phessler@ and reyk@. "put it in" deraadt@
|
|
|
|
| |
ok deraadt@
|
| |
|
| |
|
|
|
|
| |
relying on the mbuf chain layout; with claudio@ and krw@; ok henning@
|
|
|
|
| |
ok millert
|
|
|
|
| |
"looks ok" markus@
|