summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-067-210/+202
| | | | ok kettenis@, dhill@, visa@, jca@
* Finish off pr_drain functions, they haven't been used since 2006.florian2017-11-053-19/+3
| | | | OK mpi
* Stop calling ifp->if_ioctl() inside in{,6}_ioctl().mpi2017-11-041-4/+3
| | | | | | | | | Instead return EOPNOTSUPP and call it from ifioctl(). This will help getting per-driver ioctl routines outside of need the NET_LOCK(). While here always return ENXIO when ``ifp'' is NULL. ok visa@, florian@
* Move PRU_DETACH out of pr_usrreq into per proto pr_detachflorian2017-11-029-36/+132
| | | | | | functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
* Fix typo in previous resulting in a NULL dereference.mpi2017-11-011-2/+2
|
* - add one more softnet taskqsashan2017-10-311-2/+2
| | | | | | | NOTE: code still runs with single softnet task. change definition of SOFTNET_TASKS in net/if.c, if you want to have more than one softnet task OK mpi@, OK phessler@
* This doesn't need the NET_LOCK, everything is protected by a mutex.florian2017-10-291-3/+1
| | | | OK mpi, visa
* Move NET_{,UN}LOCK into individual slowtimo functions.florian2017-10-293-7/+16
| | | | | | Direction suggested by mpi OK mpi, visa
* Dump IPsec flows by iterating over the rafdix-tree.mpi2017-10-272-2/+18
| | | | | | This enforces an order and will allow us to get rid of the global list. ok millert@, visa@, markus@
* Stop grabbing the KERNEL_LOCK() in network tasks when `ipsec_in_use'mpi2017-10-262-30/+2
| | | | | | | | | is set. Accesses to IPsec global data structure are now serialized by the NET_LOCK(). Tested by many, ok visa@, bluhm@
* Remove the TCP_FACK option and associated #if{,n}def code.job2017-10-255-173/+6
| | | | | | | | | TCP_FACK was disabled by provos@ in June 1999. TCP_FACK is an algorithm that decides that when something is lost, all not SACKed packets until the most forward SACK are lost. It may be a correct estimate, if network does not reorder packets. OK visa@ mpi@ mikeb@
* Refactor handling of partial TCP acknowledgementsmikeb2017-10-242-96/+82
| | | | With input from Klemens Nanni, OK visa, mpi, bluhm
* Remove some more tests checking for a non-NULL `ifp->if_ioctl'.mpi2017-10-241-5/+4
| | | | if_attach() enforces it is properly defined.
* Remove support for never used ioctls originating from KAME.mpi2017-10-241-200/+6
| | | | ok florian@, claudio@, bluhm@
* Unconditionally enable TCP selective acknowledgements (SACK)mikeb2017-10-226-176/+53
| | | | OK deraadt, mpi, visa, job
* Do not test if if_ioctl is NULL, it isn't.mpi2017-10-201-6/+1
| | | | ok florian@, claudio@, visa@, bluhm@
* When reusing an mbuf at the upper end of the network stack, stripbluhm2017-10-181-4/+7
| | | | | | | | | | off the mbuf properties with m_resethdr(). It is a new packet, especially M_LOOP indicating that it was running through lo(4) should be cleared. Use the ph_loopcnt to prevent looping at the upper end of the stack. Although not strictly necessary in icmp reflect, it is a good idea to increase and check the counter here, like in socket splicing. OK mpi@ sashan@
* Handle the case where the parent of a carp(4) is being destroyedmpi2017-10-161-2/+9
| | | | | | | | while packets where being passed to IPsec tasks. Found the hardway by Hrvoje Popovski. ok phessler@, claudio@
* Last changes before running IPsec w/o KERNEL_LOCK().mpi2017-10-163-15/+55
| | | | | | | | | | Put more NET_ASSERT_LOCK() and document which globals it protects. Add a mutex for pfkeyv2 globals. Convert ipsp_delete_acquire() to timeout_set_proc(). Tested by Hrvoje Popovski, ok bluhm@ visa@
* Remove lie talking about splsoftclock().mpi2017-10-111-4/+1
|
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-0911-124/+257
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* Unfortunately I removed too much in my previous commit and brokebluhm2017-10-061-1/+6
| | | | | divert-packet. Bring back the loop over the global list to find the divert socket.
* Kill the divert-packet socket option IP_DIVERTFL to filter packets.bluhm2017-10-064-54/+5
| | | | | | | | It used a loop over the global list divbtable that would be hard to make MP safe. The port net/dnsfilter does not work without this, it should be converted to divert-to. Neither other ports nor base use this filter feature. ports checked by sthen@; OK mpi@ benno@
* Use m_copym() instead of m_dup_pkt() to fix a kernel assert whenvisa2017-09-201-2/+2
| | | | | | | setting IP options. Issue reported by Kapetanakis Giannis OK mpi@
* Replace a goto found in the ipq foreach loop with a simple break.bluhm2017-09-071-5/+4
| | | | | This is a common idiom when a list element has been found. OK visa@ mpi@
* Replace the call to ifa_ifwithaddr() in divert6_output() with abluhm2017-09-061-6/+3
| | | | | | | | route lookup to make it MP safe. Only set the mbuf header fields that are needed. Validate the name input. Also use the same variables in IPv4 and IPv6 functions and avoid unneccessary initialization. OK mpi@
* Replace the call to ifa_ifwithaddr() in divert_output() with a routebluhm2017-09-061-17/+21
| | | | | | lookup to make it MP safe. Only set the mbuf header fields that are needed. Validate the name input. OK mpi@
* Replace NET_ASSERT_LOCKED() by soassertlocked() in *_usrreq().mpi2017-09-054-8/+8
| | | | | | Not all of them need the NET_LOCK(). ok bluhm@
* Serialize access to IP reassembly queue with a mutex. This letsvisa2017-09-052-12/+25
| | | | | | | ip_local(), ip_slowtimo() and ip_drain() run without KERNEL_LOCK() and NET_LOCK(). Input and OK mpi@, bluhm@
* Simplify list traversal in ip_freef(), and replace a hand-rolledvisa2017-09-011-7/+5
| | | | | | list traversal with LIST_FOREACH_SAFE(). OK bluhm@, mpi@
* Change sosetopt() to no longer free the mbuf it receives and changempi2017-09-015-37/+19
| | | | | | all the callers to call m_freem(9). Support from deraadt@ and tedu@, ok visa@, bluhm@
* Prevent a race against ipsec_in_use.mpi2017-08-221-2/+5
| | | | | | Problem reported and fix tested by Hrvoje Popovski. ok bluhm@, visa@
* Convert hand rolled sockaddr checks to the nam2sin functions.bluhm2017-08-152-33/+23
| | | | | | Especially in tcp_usrreq() connect detect the correct address family based on the inp_flags instead of the sa_family user input. OK mpi@
* Remove NET_LOCK()'s argument.mpi2017-08-119-96/+76
| | | | Tested by Hrvoje Popovski, ok bluhm@
* Validate sockaddr from userland in central functions. This resultsbluhm2017-08-115-50/+41
| | | | | | | in common checks for unix, inet, inet6 instead of partial checks here and there. Some checks are already done at a higher layer, but better be paranoid with user input. OK claudio@ millert@
* icmp_mtudisc() might be called by TCP even on loopback after abluhm2017-08-101-1/+11
| | | | | | | | retransmit timeout. Do not run path MTU discovery on local routes as we never want that on loopback. For permanent ARP or ND entries disable path MTU discovery as they use the same rt_expire field. This prevents that permanent routes and entries disappear. bug analysis friehm@; OK mpi@
* fix typo in previous commit.tj2017-08-081-2/+2
|
* Stop running nd6_expire every second.florian2017-08-081-4/+3
| | | | | We know when pltime or vltime decrease to zero. Run nd6_expire then. Input & OK mpi, bluhm
* Increase the limit of the IP protocol queues from 256 to 2048 mbufs.bluhm2017-08-082-3/+7
| | | | | | The interface congestion algorithm kills performance at this place, with the large queues it never triggers. OK mpi@ claudio@
* The in_pcbhashlookup() in in_pcbconnect() enforces that the 4 tupelbluhm2017-08-041-5/+13
| | | | | | | | | | | | | of src/dst ip/port is unique for TCP. But if the socket is not bound, the automatic bind by connect happens after the check. If the socket has the SO_REUSEADDR flag, in_pcbbind() may select an existing local port. Then we had two colliding TCP PCBs. This resulted in a packet storm of ACK packets on loopback. The softnet task was constantly holding the netlock and has a high priority, so the system hung. Do the in_pcbhashlookup() again after in_pcbbind(). This creates sporadic "connect: Address already in use" errors instead of a hang. bug report and testing Olivier Antoine; OK mpi@
* We do have SO_TIMESTAMP since some time and there is other code in theflorian2017-08-041-3/+2
| | | | | kernel that uses it without the #ifdef guard. OK bluhm
* Since nearly 20 years the correct spelling offlorian2017-08-031-2/+1
| | | | | | | ICMP6_DST_UNREACH_NOTNEIGHBOR is ICMP6_DST_UNREACH_BEYONDSCOPE (RFC 1885 was obsoleted). sthen grepped the ports sources to make sure nothing uses it. OK millert, jca
* Switch installer to Allotment Routing Table (ART).florian2017-07-301-3/+1
| | | | | | Prompted by a bugreport by naddy that IPv6 autoconfiguration is broken in the installer. OK mpi, "go for it" deraadt
* Add an error argument to rtm_send() instead of rerolling it insidempi2017-07-281-2/+2
| | | | | | rtdeletemsg(). ok bluhm@
* Grab the KERNEL_LOCK() before calling sorwakeup().mpi2017-07-271-2/+5
| | | | | | | | In the forwarding path, pf_test() is executed w/o KERNEL_LOCK() and in case of divert end up calling sowakup(). However selwakup() and csignal() are not yet ready to be executed w/o KERNEL_LOCK(). ok bluhm@
* kernels don't build without MROUTING because ip_var.h only sometimestedu2017-07-141-4/+5
| | | | | | | | introduces a forward decl for socket. turns out the affected file doesn't need ip_var.h, so remove it. then move the decl to the bottom to prevent the problem from recurring. bug report by Nick Briggs ok mpi
* Get rid of ICMPV6CTL_ND6_DRLIST and ICMPV6CTL_ND6_PRLIST sysctlsflorian2017-07-121-8/+2
| | | | | | | With this we can also get rid of in6_prefix and in6_defrouter. They are meaningless, the kernel no longer tracks this information. Pointed out by & OK mpi
* Fix RAMDISK build.visa2017-07-051-3/+1
| | | | OK bluhm@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-053-38/+112
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* Convert ip_input() to a pr_input style function. Goal is to processbluhm2017-06-262-41/+67
| | | | | IPsec packets without additional enqueueing. OK mpi@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.