summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Refactor handling of partial TCP acknowledgementsmikeb2017-10-242-96/+82
| | | | With input from Klemens Nanni, OK visa, mpi, bluhm
* Remove some more tests checking for a non-NULL `ifp->if_ioctl'.mpi2017-10-241-5/+4
| | | | if_attach() enforces it is properly defined.
* Remove support for never used ioctls originating from KAME.mpi2017-10-241-200/+6
| | | | ok florian@, claudio@, bluhm@
* Unconditionally enable TCP selective acknowledgements (SACK)mikeb2017-10-226-176/+53
| | | | OK deraadt, mpi, visa, job
* Do not test if if_ioctl is NULL, it isn't.mpi2017-10-201-6/+1
| | | | ok florian@, claudio@, visa@, bluhm@
* When reusing an mbuf at the upper end of the network stack, stripbluhm2017-10-181-4/+7
| | | | | | | | | | off the mbuf properties with m_resethdr(). It is a new packet, especially M_LOOP indicating that it was running through lo(4) should be cleared. Use the ph_loopcnt to prevent looping at the upper end of the stack. Although not strictly necessary in icmp reflect, it is a good idea to increase and check the counter here, like in socket splicing. OK mpi@ sashan@
* Handle the case where the parent of a carp(4) is being destroyedmpi2017-10-161-2/+9
| | | | | | | | while packets where being passed to IPsec tasks. Found the hardway by Hrvoje Popovski. ok phessler@, claudio@
* Last changes before running IPsec w/o KERNEL_LOCK().mpi2017-10-163-15/+55
| | | | | | | | | | Put more NET_ASSERT_LOCK() and document which globals it protects. Add a mutex for pfkeyv2 globals. Convert ipsp_delete_acquire() to timeout_set_proc(). Tested by Hrvoje Popovski, ok bluhm@ visa@
* Remove lie talking about splsoftclock().mpi2017-10-111-4/+1
|
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-0911-124/+257
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* Unfortunately I removed too much in my previous commit and brokebluhm2017-10-061-1/+6
| | | | | divert-packet. Bring back the loop over the global list to find the divert socket.
* Kill the divert-packet socket option IP_DIVERTFL to filter packets.bluhm2017-10-064-54/+5
| | | | | | | | It used a loop over the global list divbtable that would be hard to make MP safe. The port net/dnsfilter does not work without this, it should be converted to divert-to. Neither other ports nor base use this filter feature. ports checked by sthen@; OK mpi@ benno@
* Use m_copym() instead of m_dup_pkt() to fix a kernel assert whenvisa2017-09-201-2/+2
| | | | | | | setting IP options. Issue reported by Kapetanakis Giannis OK mpi@
* Replace a goto found in the ipq foreach loop with a simple break.bluhm2017-09-071-5/+4
| | | | | This is a common idiom when a list element has been found. OK visa@ mpi@
* Replace the call to ifa_ifwithaddr() in divert6_output() with abluhm2017-09-061-6/+3
| | | | | | | | route lookup to make it MP safe. Only set the mbuf header fields that are needed. Validate the name input. Also use the same variables in IPv4 and IPv6 functions and avoid unneccessary initialization. OK mpi@
* Replace the call to ifa_ifwithaddr() in divert_output() with a routebluhm2017-09-061-17/+21
| | | | | | lookup to make it MP safe. Only set the mbuf header fields that are needed. Validate the name input. OK mpi@
* Replace NET_ASSERT_LOCKED() by soassertlocked() in *_usrreq().mpi2017-09-054-8/+8
| | | | | | Not all of them need the NET_LOCK(). ok bluhm@
* Serialize access to IP reassembly queue with a mutex. This letsvisa2017-09-052-12/+25
| | | | | | | ip_local(), ip_slowtimo() and ip_drain() run without KERNEL_LOCK() and NET_LOCK(). Input and OK mpi@, bluhm@
* Simplify list traversal in ip_freef(), and replace a hand-rolledvisa2017-09-011-7/+5
| | | | | | list traversal with LIST_FOREACH_SAFE(). OK bluhm@, mpi@
* Change sosetopt() to no longer free the mbuf it receives and changempi2017-09-015-37/+19
| | | | | | all the callers to call m_freem(9). Support from deraadt@ and tedu@, ok visa@, bluhm@
* Prevent a race against ipsec_in_use.mpi2017-08-221-2/+5
| | | | | | Problem reported and fix tested by Hrvoje Popovski. ok bluhm@, visa@
* Convert hand rolled sockaddr checks to the nam2sin functions.bluhm2017-08-152-33/+23
| | | | | | Especially in tcp_usrreq() connect detect the correct address family based on the inp_flags instead of the sa_family user input. OK mpi@
* Remove NET_LOCK()'s argument.mpi2017-08-119-96/+76
| | | | Tested by Hrvoje Popovski, ok bluhm@
* Validate sockaddr from userland in central functions. This resultsbluhm2017-08-115-50/+41
| | | | | | | in common checks for unix, inet, inet6 instead of partial checks here and there. Some checks are already done at a higher layer, but better be paranoid with user input. OK claudio@ millert@
* icmp_mtudisc() might be called by TCP even on loopback after abluhm2017-08-101-1/+11
| | | | | | | | retransmit timeout. Do not run path MTU discovery on local routes as we never want that on loopback. For permanent ARP or ND entries disable path MTU discovery as they use the same rt_expire field. This prevents that permanent routes and entries disappear. bug analysis friehm@; OK mpi@
* fix typo in previous commit.tj2017-08-081-2/+2
|
* Stop running nd6_expire every second.florian2017-08-081-4/+3
| | | | | We know when pltime or vltime decrease to zero. Run nd6_expire then. Input & OK mpi, bluhm
* Increase the limit of the IP protocol queues from 256 to 2048 mbufs.bluhm2017-08-082-3/+7
| | | | | | The interface congestion algorithm kills performance at this place, with the large queues it never triggers. OK mpi@ claudio@
* The in_pcbhashlookup() in in_pcbconnect() enforces that the 4 tupelbluhm2017-08-041-5/+13
| | | | | | | | | | | | | of src/dst ip/port is unique for TCP. But if the socket is not bound, the automatic bind by connect happens after the check. If the socket has the SO_REUSEADDR flag, in_pcbbind() may select an existing local port. Then we had two colliding TCP PCBs. This resulted in a packet storm of ACK packets on loopback. The softnet task was constantly holding the netlock and has a high priority, so the system hung. Do the in_pcbhashlookup() again after in_pcbbind(). This creates sporadic "connect: Address already in use" errors instead of a hang. bug report and testing Olivier Antoine; OK mpi@
* We do have SO_TIMESTAMP since some time and there is other code in theflorian2017-08-041-3/+2
| | | | | kernel that uses it without the #ifdef guard. OK bluhm
* Since nearly 20 years the correct spelling offlorian2017-08-031-2/+1
| | | | | | | ICMP6_DST_UNREACH_NOTNEIGHBOR is ICMP6_DST_UNREACH_BEYONDSCOPE (RFC 1885 was obsoleted). sthen grepped the ports sources to make sure nothing uses it. OK millert, jca
* Switch installer to Allotment Routing Table (ART).florian2017-07-301-3/+1
| | | | | | Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken in the installer. OK mpi, "go for it" deraadt
* Add an error argument to rtm_send() instead of rerolling it insidempi2017-07-281-2/+2
| | | | | | rtdeletemsg(). ok bluhm@
* Grab the KERNEL_LOCK() before calling sorwakeup().mpi2017-07-271-2/+5
| | | | | | | | In the forwarding path, pf_test() is executed w/o KERNEL_LOCK() and in case of divert end up calling sowakup(). However selwakup() and csignal() are not yet ready to be executed w/o KERNEL_LOCK(). ok bluhm@
* kernels don't build without MROUTING because ip_var.h only sometimestedu2017-07-141-4/+5
| | | | | | | | introduces a forward decl for socket. turns out the affected file doesn't need ip_var.h, so remove it. then move the decl to the bottom to prevent the problem from recurring. bug report by Nick Briggs ok mpi
* Get rid of ICMPV6CTL_ND6_DRLIST and ICMPV6CTL_ND6_PRLIST sysctlsflorian2017-07-121-8/+2
| | | | | | | With this we can also get rid of in6_prefix and in6_defrouter. They are meaningless, the kernel no longer tracks this information. Pointed out by & OK mpi
* Fix RAMDISK build.visa2017-07-051-3/+1
| | | | OK bluhm@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-053-38/+112
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* Convert ip_input() to a pr_input style function. Goal is to processbluhm2017-06-262-41/+67
| | | | | IPsec packets without additional enqueueing. OK mpi@
* Assert that the corresponding socket is locked when manipulating socketmpi2017-06-268-38/+41
| | | | | | | | | | | | | | | | buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
* Split a part of tdb_delete() into tdb_unlink() so that we can removepatrick2017-06-262-4/+13
| | | | | | | a TDB from the hash table without actually free()ing it. That way we can modify the TDB and then put it back in using puttdb(). ok claudio@
* Fix the remaining ';;'s in sys/tom2017-06-221-2/+2
|
* Do not use the interface pointer after if_put(). Rename ipip_input_gif()bluhm2017-06-202-23/+26
| | | | | | to ipip_input_if() and always pass the ifp. Only dump the packet to bpf if we are called with a gif(4) interface. OK mpi@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-197-29/+22
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* The IP multicast forward functions return an errno, call the variablebluhm2017-06-192-7/+6
| | | | | | error. Make the ip_mforward() return value consistent. Simplify the caller logic in ipv6_input() like in IPv4. OK mpi@
* Use a common 'goto bad' style and set mp to NULL after freeing itbluhm2017-06-111-18/+15
| | | | | | in ipip_input_gif(). This prevents a use-after-free if there is a bug in the IP input functions. OK mpi@
* Replace rtrequest(RTM_DELETE...) rtrequest_delete() and do not evenmpi2017-06-091-4/+17
| | | | | | | | | try to remove a route from the table if it is and invalid cache. This is a step towards decoupling code dealing with userland and kernel inserted routes. ok bluhm@
* Grab the KERNEL_LOCK() around rtm*() functions. Routing sockets globalsmpi2017-06-071-1/+4
| | | | | | | | | | | aren't protected by the NET_LOCK(). While here change lock assertions in rt_{set,put}gwroute(), the NET_LOCK() is enough. Tested by Hrvoje Popovski. ok jmatthew@, claudio@
* Move IPv4 & IPv6 incoming/forwarding path, PIPEX ppp processing andmpi2017-05-312-21/+39
| | | | | | | | | | | | | | | | | | | | | IPv4 & IPv6 dispatch functions outside the KERNEL_LOCK(). We currently rely on the NET_LOCK() serializing access to most global data structures for that. IP input queues are no longer used in the forwarding case. They still exist as boundary between the network and transport layers because TCP/UDP & friends still need the KERNEL_LOCK(). Since we do not want to grab the NET_LOCK() for every packet, the softnet thread will do it once before processing a batch. That means the L2 processing path, which is currently running without lock, will now run with the NET_LOCK(). IPsec isn't ready to run without KERNEL_LOCK(), so the softnet thread will grab the KERNEL_LOCK() as soon as ``ipsec_in_use'' is set. Tested by Hrvoje Popovski. ok visa@, bluhm@, henning@
* add sizes to free() callsderaadt2017-05-302-5/+5
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.