summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* restrict carp to configuring ethernet interfaces as carpdevs.dlg2018-01-121-5/+5
| | | | | | | | previously the driver only cared that a carp interface wasnt configured as a carpdev. because the code only really works on ethernet, it makes sense to restrict it. ok visa@ mpi@
* carp_ourether gets passed the parent interface, not the carp interface.dlg2018-01-111-2/+2
|
* get rid of struct carp_if by moving the srpl into struct ifnet if_carp.dlg2018-01-102-74/+57
| | | | | | | | | | | | | currently carp uses a struct carp_if to hold an srp list head, which is accessed by both if_carp in struct ifnet, and via the if input handlers list. this gets rid of some indirection by making if_carp itself the list head, rather than a pointer to the list head via a struct carp_if. it also makes accessing the list consistent by only using if_carp to get to it. ok mpi@
* simplify the input interface type check in carp_proto_input_if.dlg2018-01-101-3/+2
| | | | | | | | | carp6_proto_input_if only handles packets "received" on real carp interfaces, which the ethernet stack goes to a lot of trouble to provide. since carp assumes ethernet, carp_proto_input_if can assume the packets will come in right too. ok mpi@
* Creating a cloned interface could return ENOMEM due to temporarybluhm2018-01-091-5/+2
| | | | | | memory shortage. As it is invoked from a system call, it should not fail and wait instead. OK visa@ mpi@
* Change `so_state' and `so_error' to unsigned int such that they canmpi2018-01-091-2/+2
| | | | | | be atomically read from any context. ok bluhm@, visa@
* make mpls_input take a struct ifnet *ifp argument.dlg2018-01-092-4/+4
| | | | | | | | | | | this makes it like all our other protocol family input functions. mpls_input always looks up the interface the mbuf was received on, but it's always called by code that already has a reference to that interface anyway. the result of this is a few less if_get/if_put calls. ok mpi@ bluhm@ visa@ claudio@
* Make the functions which link the pf state keys to mbufs, inpcbs,bluhm2017-12-291-2/+2
| | | | | or other states more consistent. OK visa@ sashan@ on a previous version
* The pf code marks ICMP packets belonging to an TCP or UDP divertbluhm2017-12-141-18/+12
| | | | | | | | | | | | | | | | | state as diverted. This is necessary for IP input to accept the packet as ours. But it must not be used to match the ICMP packet to a raw socket. Clear the PF_TAG_DIVERTED mbuf pf flag for the special ICMP and ICMP6 packets in icmp_input_if() and icmp6_input(). The m_tag_delete_chain() caused an inconsistent PF_TAG_DIVERTED mbuf pf flag and PACKET_TAG_PF_DIVERT mbuf tag which triggered an assert in rip_input(). Deleting all mbuf tags can have undesired side effects and is not necessary anymore since icmp_reflect() calls m_resethdr(). Do not touch the mbuf tags and adjust the mbuf pf flags for the correct behavior of rip_input() and rip6_input(). reported by Chris Eidem, James Turner, vicviq, Scott Vanderbilt OK mpi@
* Initialize tcp_secret in tcp_initmikeb2017-12-071-10/+8
| | | | | | | | | The initialization of a secret SHA256 context for generating TCP initial sequence numbers is moved out of tcp_set_iss_tsm used to set up ISN for new connections and into tcp_init, sparing the need for a global flag. OK deraadt, visa, mpi
* Make divert lookup similar for all socket types. If PF_TAG_DIVERTEDbluhm2017-12-044-34/+61
| | | | | | | | is set, pf_find_divert() cannot fail so put an assert there. Explicitly check all possible divert types, panic in the default case. For raw sockets call pf_find_divert() before of the socket loop. Divert reply should not match on TCP or UDP listen sockets. OK sashan@ visa@
* Fix white spaces and shorten long line.bluhm2017-12-011-10/+10
|
* Simplify the reverse PCB lookup logic. The PF_TAG_TRANSLATE_LOCALHOSTbluhm2017-12-015-44/+29
| | | | | | | | security check prevents that the user accidentally configures redirect where a divert-to would be appropriate. Instead of spreading the logic into tcp and udp input, check the flag during PCB listen lookup. This also reduces parameters of in_pcblookup_listen(). OK visa@
* Fix typos in comments.nayden2017-11-301-3/+3
| | | | OK florian@
* The divert structure was using the port number to indicate thatbluhm2017-11-281-2/+2
| | | | | | | | | | divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Adapt the pf rule struct in kernel and pfctl, no functional change. Note that kernel and pfctl have to be updated together. OK sashan@
* Constify protocol tables and remove an assert now that ip_deliver() ismpi2017-11-232-7/+5
| | | | | | mp-safe. ok bluhm@, visa@
* Replace non mp-safe carp_iamatch6() with mp-safe carp_iamatch().mpi2017-11-232-19/+2
| | | | | | | They have the same functionnality since friehm@ cleaned up balancing code. ok florian@, visa@, patrick@, bluhm@, jmatthew@
* It does not make sense to call pcb lookup from pf during packetbluhm2017-11-221-8/+8
| | | | | | | forwarding. It should never match and would cause MP locking problems. While there remove an useless ifp parameter from ip_output_ipsec_send(). from markus@; OK visa@ sashan@
* Move the addrhook disestablish from carpdetach() to carp_clone_destroy()patrick2017-11-211-4/+3
| | | | | | | | | | to make it symmetric to the addrhook establish which is being done in carp_clone_create(). This fixes the issue that carp does not recognize address changes on the carp after an interface has detached, which could cause issues like carp not recovering or even panics. Unfortunately there are more bugs lurking in carp. ok bluhm@
* Keep kernel defines under #ifdef _KERNEL.mpi2017-11-201-8/+3
| | | | ok bluhm@
* Flush flows using the radix-tree instead of a global list.mpi2017-11-201-4/+9
| | | | | | This will allows us to get rid of the list. ok visa@
* Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningmpi2017-11-2011-19/+38
| | | | | | pr_input handlers without KERNEL_LOCK(). ok visa@
* Rename etherip sysctl handler, there's no conflict with ip_ether.c any morejca2017-11-171-2/+2
| | | | ok visa@ mpi@
* Add ifdef MPLS around all the MPLS-in-IP codejca2017-11-172-8/+6
| | | | ok visa@ mpi@
* Rename functions that now handle only MPLS-in-IPjca2017-11-173-13/+13
| | | | ok visa@ mpi@
* Move etherip_allow where it is usedjca2017-11-172-10/+2
| | | | | While here, drop the declaration in headers, since the variable is used in a single file. ok visa@ mpi@
* Drop etheripstat use in ip_ether.cjca2017-11-171-20/+1
| | | | | Those functions only handle MPLS-in-IP packets, it makes little sense to count those as ethernet-in-IP. ok visa@ mpi@
* Drop all Ethernet-in-IP support from gif(4)jca2017-11-172-138/+2
| | | | | As a result, ip_ether.c now only deals with MPLS-in-IP. The next commits will move & rename stuff to make this clear. ok visa@ mpi@
* Move etherip counters and their allocation to etherip(4)jca2017-11-173-13/+3
| | | | | | | | | gif(4) now depends on etherip(4) but this is a temporary drawback: we can get rid of etherip_init(), called from the protocol switch, and ip_ether.c should stop using etherip counters once it is clear that this file doesn't handle ethernet-in-IP any more. ok visa@ as part of a larger diff, ok mpi@
* etherip(4) now handles etherip sysctls, move/remove code accordingly.jca2017-11-152-43/+2
| | | | ok visa@ as part of a larger diff, ok mpi@
* Make etherip(4) the single driver responsible for etherip sysctl entries.jca2017-11-151-2/+1
| | | | | | | One step needed to completely remove ethernet-in-IP support from gif(4). No functional changes. ok visa@ as part of a larger diff, ok mpi@
* Unbreak ENCDEBUG kernels by declaring `encdebug' in ip_ipsp.hmpi2017-11-152-3/+3
|
* Introduce ipsec_sysctl() and move IPsec tunables where they belong.mpi2017-11-144-53/+139
| | | | ok bluhm@, visa@
* Introduce a reader version of the NET_LOCK().mpi2017-11-101-3/+3
| | | | | | | | This will be used to first allow read-only ioctl(2) to be executed while the softnet taskq is running. Then it will allows us to execute multiple softnet taskq in parallel. Tested by Hrvoje Popovski, ok kettenis@, sashan@, visa@, tb@
* Use percpu counters with etheripstat.visa2017-11-103-34/+89
| | | | Input and OK jca@, OK florian@
* The TF_BLOCKOUTPUT flag is set around all sorwakeup() and sowwakeup()bluhm2017-11-081-1/+13
| | | | | | | | | | | calls in tcp_input(). When I added this code for socket splicing, I have missed that they may be called indirectly through functions. Although not strictly necessary since we have the sosplice thread, put that flag consistently when we want to prevent that tcp_output() is called in the middle of tcp_input(). As soisconnected(), soisdisconnected(), and socantrcvmore() call the wakeup functions from tcp_input(), set the TF_BLOCKOUTPUT flag around them. OK visa@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-0811-197/+347
| | | | OK bluhm@, mpi@
* Convert all the fields of {ah,esp,ipcomp}stat to uint64.visa2017-11-073-63/+66
| | | | | | This is a preliminary step for using percpu counters with the data. OK mpi@
* Remove unused debug macro.mpi2017-11-071-7/+1
|
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-067-210/+202
| | | | ok kettenis@, dhill@, visa@, jca@
* Finish off pr_drain functions, they haven't been used since 2006.florian2017-11-053-19/+3
| | | | OK mpi
* Stop calling ifp->if_ioctl() inside in{,6}_ioctl().mpi2017-11-041-4/+3
| | | | | | | | | Instead return EOPNOTSUPP and call it from ifioctl(). This will help getting per-driver ioctl routines outside of need the NET_LOCK(). While here always return ENXIO when ``ifp'' is NULL. ok visa@, florian@
* Move PRU_DETACH out of pr_usrreq into per proto pr_detachflorian2017-11-029-36/+132
| | | | | | functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
* Fix typo in previous resulting in a NULL dereference.mpi2017-11-011-2/+2
|
* - add one more softnet taskqsashan2017-10-311-2/+2
| | | | | | | NOTE: code still runs with single softnet task. change definition of SOFTNET_TASKS in net/if.c, if you want to have more than one softnet task OK mpi@, OK phessler@
* This doesn't need the NET_LOCK, everything is protected by a mutex.florian2017-10-291-3/+1
| | | | OK mpi, visa
* Move NET_{,UN}LOCK into individual slowtimo functions.florian2017-10-293-7/+16
| | | | | | Direction suggested by mpi OK mpi, visa
* Dump IPsec flows by iterating over the rafdix-tree.mpi2017-10-272-2/+18
| | | | | | This enforces an order and will allow us to get rid of the global list. ok millert@, visa@, markus@
* Stop grabbing the KERNEL_LOCK() in network tasks when `ipsec_in_use'mpi2017-10-262-30/+2
| | | | | | | | | is set. Accesses to IPsec global data structure are now serialized by the NET_LOCK(). Tested by many, ok visa@, bluhm@
* Remove the TCP_FACK option and associated #if{,n}def code.job2017-10-255-173/+6
| | | | | | | | | TCP_FACK was disabled by provos@ in June 1999. TCP_FACK is an algorithm that decides that when something is lost, all not SACKed packets until the most forward SACK are lost. It may be a correct estimate, if network does not reorder packets. OK visa@ mpi@ mikeb@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.