summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Store the data used to generate an ICMP error message on a stackmikeb2012-08-071-12/+21
| | | | | | | | | | | | | | | | | instead of allocating a new mbuf. This is a third or fourth attempt to incorporate a change like this meaning a handful of people have lost their hair trying to make it work, namely dlg@, henning@, deraadt@, and thib@. Unfortunately the fixed version was never put back which is exceptionally unfortunate since the impact on performance is huge: it nearly doubles the forwarding performance on selected hardware in simple setups. So after being beaten in test and production environments on several architectures it's ready to be put back again. We're doing it early in the release cycle so that it will receive a good test exposure. ok derradt, henning
* use IPsec flowinfo on pipex(4) to select the IPsec tunnel for sendingyasuoka2012-07-171-9/+14
| | | | | | L2TP packets. ok markus henning
* add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)markus2012-07-169-21/+102
| | | | | | | can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
* 3 line diff to fix divert using connections from local system.claudio2012-07-131-1/+4
| | | | OK henning@
* Be way more careful when accessing a possibly cached route in_selectsrc()claudio2012-07-121-9/+8
| | | | | since it may already been gone. Fixes panic seen by stsp@ when unplugging a used USB interface. Tested and OK stsp@
* Instead of <arpa/inet.h> pulling in <netinet/in.h>, just copy in theguenther2012-07-101-1/+6
| | | | | | | three things that it needed from there: INET_ADDRSTRLEN, INET6_ADDRSTRLEN, and struct in_addr. Add protecting #ifndefs to netinet6?/in6?.h for those. ok deraadt@
* in_scrubprefix needs the same netmask checking as in_addprefix (which wasclaudio2012-07-101-9/+12
| | | | | | added in 1.40). This fixes a pathological case where in_scrubprefix would do the wrong thing. Found and reported by glebius@FreeBSD OK bluhm@
* Instead of casting interface address pointers, use the macros NULLbluhm2012-07-081-6/+6
| | | | | and ifatoia(). No binary diff. OK blambert@ henning@ claudio@
* Add support for advertising dns servers and search paths in routerphessler2012-07-081-1/+19
| | | | | | | | advertisements, according to RFC 6106. original diff from Stephane A. Sezer on tech@, many thanks! OK phessler@, todd@
* Add support for the Extended (64-bit) Sequence Number as definedmikeb2012-06-293-63/+180
| | | | | | | | | | | | in RFC4302 and RFC4303. Right now only software crypto engine is capable of doing it. Replay check was rewritten to implement algorithm described in the Appendix A of RFC4303 and the window size was increased to 64. Tested against OpenBSD, Linux (strongswan) and Windows. No objection from the usual suspects.
* Improve compliance for <arpa/inet.h> and <netinet/in.h> to define/declareguenther2012-06-261-3/+18
| | | | | | | | all the symbols that POSIX says they must and fewer that they can't and, most importantly, to not require a specific ordering of headers. ports testing by naddy@ ok millert@ deraadt@
* Fix tcpdump for etherip packets.mpf2012-05-121-1/+3
| | | | | | bpf_mtap() needs to be called without the etherip_header. Idea to use a forward declaration for struct tdb by claudio. OK claudio@
* unneccessary casts to unsigned; ok claudioderaadt2012-04-132-7/+7
|
* fix all the suser calls which pass an incorrect p_acflag argument;mikeb2012-04-111-3/+3
| | | | figured out by and ok guenther
* Bring the rtable sockopt code in line with the setrtable() implementation.claudio2012-04-071-8/+9
| | | | | While there change IP_RTABLE to SO_RTABLE. IP_RTABLE will die soon. With and OK guenther@
* pipex hook in udp_usrreq() mistakenly assumed that `inp' is connected.yasuoka2012-04-041-1/+7
| | | | | | | | | It could not use the destination address properly, so it failed to find the pipex session. This bug caused LCP keepalive failures on some clients. found and tested by sebastia@ and mxb at alumni.chalmers.se. ok sthen
* actually store the result of the pmtu-route lookup. otherwise wemarkus2012-03-301-3/+2
| | | | | don't have a MTU to announce in the icmp need fragment packet. this fixes PMTU-discovery for TCP over IPsec; ok mpf@, fries@
* remove IP_JUMBO, SO_JUMBO, and RTF_JUMBO.dlg2012-03-174-16/+6
| | | | no objection from mcbride@ krw@ markus@ deraadt@
* improve IPsec/ENC interaction:markus2012-03-153-57/+35
| | | | | | | | | | | - ipip_input() recalculate the IP header checksum if the tos bits are changed after decapsulation. Otherwise these packets are dropped later in the stack. - ip_ecn_egress(): do not drop packets for IPsec if the outter packet of a Tunnel has the ECN-CE bit set (Congestion Experienced) and the inner packet does not indicate support ECN. - remove unused ip6_ecn_ingress(), ip6_ecn_egress() code ok mikeb@
* Increase TCP's initial window to 10 * MSS or 14600 bytes as proposed inclaudio2012-03-102-3/+6
| | | | | | draft-ietf-tcpm-initcwnd. net.inet.tcp.rfc3390 defaults to 2 now which uses the 10*MSS, setting it back to 1 brings back the old default of 4*MSS. OK sperreault@, henning@, sthen@, markus@
* Check if route is still valid when getting the cached rt entry of a pcb.claudio2012-03-061-1/+8
| | | | | While there make sure we do the lookup in the correct routing table. OK mikeb, henning and phessler
* Correct the spelling of "transferred" and "transferring"guenther2012-02-241-3/+3
| | | | from Tobias Ulmer (tobiasu at tmux.org); ok jmc@, krw@
* Put an splsoftassert(IPL_SOFTNET) into in_pcbdetach().bluhm2012-01-111-1/+3
| | | | ok mikeb@
* To access the ifaddr of an in_ifaddr or in6_ifaddr struct, it isbluhm2012-01-031-8/+7
| | | | | | cleaner to access the first member via ia_ifa instead of casting. No binary change. ok henning@ krw@
* When used with socket splicing, tcp_usrreq() might get called withbluhm2012-01-031-2/+6
| | | | | | | | a socket that has an inp but tp is NULL. The call stack for that is tcp_input() tcp_close() soisdisconnected() sorwakeup() somove() tcp_usrreq(PRU_RCVD). To avoid a NULL dereference, just return in that case. ok henning@
* Escape hardware-checksumming if interface is in a bridge, this ishaesbaert2011-12-291-4/+7
| | | | | | | | | | | | | | | | | | already done for UDP/TCP/ICMP. This fixes a problem where checksumming would not be computed if you have a bridge with at least one interface with hardware checksumming and another without. Discussed with sthen@ and henning@, this is somewhat a temporary fix, we should not have these special bridge cases in ip_output, as Henning said, the bridge must behave. But for that to work we need to poke the bridge harder, this problem has been seen by at least two users at: http://marc.info/?l=openbsd-misc&m=132391433319512&w=2 http://marc.info/?l=openbsd-misc&m=132234363030132&w=2 I promised to work on a better diff :-). ok henning@ sthen@ mikeb@
* Fix RFC reference sectionsperreault2011-12-221-2/+2
| | | | spotted by bluhm@, ok yasuoka@
* Compute mandatory UDP checksum for IPv6 packetssperreault2011-12-211-1/+9
| | | | ok yasuoka@ bluhm@
* Fix checksum of UDP/TCP packets following RFC 3948. This is required foryasuoka2011-12-191-1/+48
| | | | | | transport mode IPsec NAT-T. ok markus
* Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.haesbaert2011-12-021-5/+3
| | | | ok claudio@ henning@ mikeb@
* Select a routing table according to the rdomain. Allows onemikeb2011-11-191-2/+3
| | | | | | | to connect to the carp address when the carpdev interface has an ip address too in the non-default rdomain. ok claudio
* In the advbase 0 case, we have to use three timesmpf2011-10-301-1/+3
| | | | | the advskew as the master down timeout. OK henning.
* Lower carp demote count on interface detach, fixes a bug introduced by rev 1.175.camield2011-10-241-2/+2
| | | | ok henning mpf
* Use m_pullup() instead of IP6_EXTHDR_GET() to get the carp headermpf2011-10-161-4/+3
| | | | | | | | | in the v6 input path. IP6_EXTHDR_GET() internally uses m_pulldown(), which might return a pointer to a different mbuf in the chain. In this case, carp_cksum() will be called with the wrong mbuf. This fixes occasional checksum mismatches. Problem found and initial fix by stsp@ OK stsp@
* Respect the ToS setting in tcp syn+ack for IPv4, still need to fix forhaesbaert2011-10-151-2/+3
| | | | | | IPv6. ok claudio@
* Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyclaudio2011-10-133-3/+224
| | | | | | | | "af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
* Fix various format string types to as a minimum match the width of themiod2011-09-181-2/+2
| | | | | variables being processed. ok bluhm@ henning@
* Properly initialize struct carp_if (especially vhif_nvrs) with M_ZERO.mpf2011-09-061-2/+2
| | | | | | This lets carp delete IFF_PROMISC on its carpdev upon destroy. Fix from Stefan Rinkes. OK sthen, bluhm, deraadt.
* begone, fucking rotten appletalk shit. ok roomhenning2011-07-091-14/+1
|
* mark carp advertisements to be queued at priority 6. losing them is bad,henning2011-07-081-1/+4
| | | | mkay? ok ryan
* Include PIPEX in kernel by default. And add new sysctl variableyasuoka2011-07-082-9/+9
| | | | | | | | `net.pipex.enable' to enable PIPEX. By default, pipex is disabled and it will not process packets from wire. Update man pages and update HOWTO_PIPEX_NPPPD.txt for testers. discussed with dlg@, ok deraadt@ mcbride@ claudio@
* Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzderaadt2011-07-071-2/+3
| | | | | | | | | | | | code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
* Add sysctl net.inet.tcp.always_keepalive, when this is set the systemsthen2011-07-064-7/+16
| | | | | | | | | | | behaves as if SO_KEEPALIVE was set on all TCP sockets, forcing keepalives to be sent every net.inet.tcp.keepidle half-seconds. In conjunction with a keepidle value greatly reduced from the default, this can be useful for keeping sessions open if you are stuck on a network with short NAT or firewall timeouts. Feedback from various people, ok henning@ claudio@
* cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmhenning2011-07-062-4/+4
|
* allow /31s on broadcast interfaces (eg ethernet) to work as per rfc3021.dlg2011-07-064-10/+27
| | | | | | | | | | | | | | | | | the issue in our kernel was the broadcast address calculated on the /31 caused a ton of checks for use of broadcast addresses to kick in and prevent one of the two addresses on the /31 from being used. this diff basically detects if a /31 has been configured and doesnt configure a broadcast address for it, which makes the ips usable for normal traffic. i wrote this so i could interoperate with "carrier" network gear better, and sthen wants it so he can conserve address space use. the further special casing of broadcast address handling was from claudio@ ok claudio@ markus@ sthen@ henning@
* fix bizarre and mostly useless initialization of an ifqueue in BSS thathenning2011-07-051-2/+3
| | | | again makes assumptions of the ifqueue internals, ok ryan claudio
* ansifydhill2011-07-056-153/+63
| | | | ok claudio@
* No need to check proto == IPPROTO_ETHERIPdhill2011-07-041-5/+4
| | | | fix two typos (protcol -> protocol)
* Fix to be able to bind a raw socket to 0.0.0.0. It had been broken afteryasuoka2011-07-041-6/+5
| | | | | | 1.54. ok claudio@ sosososo henning@
* Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.claudio2011-07-044-11/+11
| | | | | | The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.