summaryrefslogtreecommitdiffstats
path: root/sys/net
Commit message (Collapse)AuthorAgeFilesLines
* Persistently store NIC's hardware MAC address, and add a way to retrive itrpokala2017-05-191-2/+2
| | | | | | | | | | | | | | | | jhb pointed out that (struct ifnet) is part of the network driver KBI, and thus the offsets of internal fields must not change. Therefore, move the new "if_hw_addr" field to the end, and consume one of the "if_pspare"s; that's what they're there for. Because netmap on stable/10 uses "if_pspare[0]", the new field replaces the *last* element of that array; that way, offsetof(if_pspare) is unchanged compared to before r318430. PR: 194386 Reviewed by: jhb Pointyhat to: rpokala Sponsored by: Panasas (cherry picked from commit 2f103d239c07e4f88b9852f3b8689f100d7a31d0)
* MFC r318160, 318176: Persistently store NIC's hardware MAC address, and addrpokala2017-05-183-0/+39
| | | | | | | | | | | | | | | | | | | | | a way to retrive it NOTE: Due to restructuring, the merges didn't apply cleanly; the resulting change is almost identical to what went into stable/11, but in some cases in different locations. The MAC address reported by `ifconfig ${nic} ether' does not always match the address in the hardware, as reported by the driver during attach. In particular, NICs which are components of a lagg(4) interface all report the same MAC. When attaching, the NIC driver passes the MAC address it read from the hardware as an argument to ether_ifattach(). Keep a second copy of it, and create ioctl(SIOCGHWADDR) to return it. Teach `ifconfig' to report it along with the active MAC address. PR: 194386 (cherry picked from commit 2ce46e31d62424593e08c3853efe8c1e9283aba2)
* bridge: Fix fragment handling and memory leakkp2016-09-261-31/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fragmented UDP and ICMP packets were corrupted if a firewall with reassembling feature (like pf'scrub) is enabled on the bridge. This patch fixes corrupted packet problem and the panic (triggered easly with low RAM) as explain in PR 185633. bridge_pfil and bridge_fragment relationship: bridge_pfil() receive (IN direction) packets and sent it to the firewall The firewall can be configured for reassembling fragmented packet (like pf'scrubing) in one mbuf chain when bridge_pfil() need to send this reassembled packet to the outgoing interface, it needs to re-fragment it by using bridge_fragment() bridge_fragment() had to split this mbuf (using ip_fragment) first then had to M_PREPEND each packet in the mbuf chain for adding Ethernet header. But M_PREPEND can sometime create a new mbuf on the begining of the mbuf chain, then the "main" pointer of this mbuf chain should be updated and this case is tottaly forgotten. The original bridge_fragment code (Revision 158140, 2006 April 29) came from OpenBSD, and the call to bridge_enqueue was embedded. But on FreeBSD, bridge_enqueue() is done after bridge_fragment(), then the original OpenBSD code can't work as-it of FreeBSD. PR: 185633 Submitted by: Olivier Cochard-Labbé Differential Revision: https://reviews.freebsd.org/D7780 (cherry picked from commit a8a1202774e288fb88de8422397f7ff398f7e3fb)
* MFC r290982:Luiz Otavio O Souza2016-05-121-1/+1
| | | | | | | | | | | | Implement the sadb_x_policy_priority field as it is done in Linux: lower priority policies are inserted first. Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu> Reviewed by: ae Sponsored by: Stormshield TAG: IPSEC-HEAD (cherry picked from commit 25996276a907484d8fc26a6a9a79827367bfcfc0)
* Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-02-281-2/+3
|\
| * MFH 295796 (based on)araujo2016-02-251-2/+3
| | | | | | | | | | | | | | | | | | | | | | Fix regression introduced on 272446r. lagg(4) supports the protocol none, where it disables any traffic without disabling the lagg(4) interface itself. PR: 206478 Submitted by: Erin Clark <erin.clark.ix@gmail.com> Reviewed by: rpokala, bapt Approved by: re (glebius) Differential Revision: https://reviews.freebsd.org/D5188
* | Revert "Revert 295285 which was an MFC of the tryforward work ↵Renato Botelho2016-02-226-14/+0
| | | | | | | | | | | | | | | | | | (r290383,295282,295283)" We are keeping tryforward enabled on pfSense since we do not use IPFW + NAT This reverts commit b899cad3faf3673f41a3fcf021164dcd7ee19a7e.
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-02-226-0/+14
|\ \ | |/
| * Revert 295285 which was an MFC of the tryforward work (r290383,295282,295283)gnn2016-02-226-0/+14
| | | | | | | | | | | | | | In the IPFW+NAT+divergent MTU case there is a bug in sening ICMP MTU updates. Approved by: re (marius, gjb) Sponsored by: Rubicon Communications (Netgate)
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-02-056-14/+0
|\ \ | |/
| * MFC: r290383,295282,295283gnn2016-02-046-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | Replace the fastforward path with tryforward which does not require a sysctl and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. Differential Revision: https://reviews.freebsd.org/D4042 Reviewed by: ae, melifaro, olivier, rwatson Approved by: re (glebius) Sponsored by: Rubicon Communications (Netgate)
* | Revert "MFC r290383:"Renato Botelho2016-02-056-0/+14
| | | | | | | | This reverts commit 5e6268df600406a1570e822ac652576059d820e3.
* | Importing pfSense patch pf_static_tracker.diffLuiz Otavio O Souza2016-01-282-0/+10
| | | | | | | | This version fixes the issue with 'State Creations' in pfctl -vvsr.
* | Revert "Importing pfSense patch pf_static_tracker.diff"Luiz Otavio O Souza2016-01-282-10/+0
| | | | | | | | This reverts commit 9068fb423dfecae0f8b611d4bc558dd6cb2e2bd7.
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-01-254-17/+21
|\ \ | |/
| * MFC r292604:bz2016-01-211-3/+17
| | | | | | | | | | | | | | | | | | | | | | If vnets are torn down while ifconfig runs an ioctl to say, destroy an epair(4), we may hit if_detach_internal() without holding a lock and by the time we aquire it the interface might be gone. We should not panic() in this case as it is our fault for not holding the lock all the way. It is not ideal to return silently without error to user space, but other callers will all ignore the return values so do not change the entire KPI for little benefit for now. The ifp will be dealt with one way or another still.
| * MFC r292603:bz2016-01-211-1/+1
| | | | | | | | | | | | | | | | | | If bootverbose is enabled every vnet startup and virtual interface creation will print extra lines on the console. We are generally not interested in this (repeated) information for each VNET. Thus only print it for the default VNET. Virtual interfaces on the base system will remain printing information, but e.g. each loopback in each vnet will no longer cause a "bpf attached" line.
| * MFC r292602:bz2016-01-211-12/+2
| | | | | | | | | | | | | | Simplify bringup order by removing a SYSINIT making it a static list initialization. Obtained from: p4 @180384,180385
| * MFC r292831: Add SFF-8024 Extended Specification Compliance.melifaro2016-01-171-1/+1
| | | | | | | | | | Submitted by: markb_mellanox.com Differential Revision: https://reviews.freebsd.org/D4666
* | Add patch from FreeBSD PR 206231. Ticket #5748Chris Buechler2016-01-221-0/+1
| |
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-01-151-2/+18
|\ \ | |/
| * [PR 206219] Kernel panic from lagg_ioctl and lagg_port_ioctlrpokala2016-01-151-2/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | r287723 removed some cleanup from lagg(4), which leads to panics when changing configuration. Restore the spirit of the code which was removed. This issue has been refactored out of existence in -HEAD, so this patch is directly against stable/10. PR: 206219 Submitted by: Fred Lewis < flewis @ panasas.com > Reviewed by: hiren, Daniel O'Connor < darius @ dons.net.au > Approved by: jhb Sponsored by: Panasas, Inc. Differential Revision: https://reviews.freebsd.org/D4929
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-01-132-6/+17
|\ \ | |/
| * MFC: r292980araujo2016-01-081-2/+0
| | | | | | | | | | | | | | | | | | Clean up unused-but-set-variable spotted by gcc4.9. Reviewed by: ngie Approved by: rodrigc (mentor) Sponsored by: gandi.net Differential Revision: https://reviews.freebsd.org/D4774
| * MFC: r292972araujo2016-01-081-4/+17
| | | | | | | | | | | | | | | | | | | | | | | | Wrap using #ifdef 'notyet' those variables and statements not yet implemented to lower the compiler warnings. It fix the case of unused-but-set-variable spotted by gcc4.9. Reviewed by: ngie Approved by: rodrigc (mentor) Sponsored by: gandi.net Differential Revision: https://reviews.freebsd.org/D4775
* | Fix a bug in VLAN PCP support where setting a new pcp value would break the ↵Luiz Otavio O Souza2015-11-271-3/+5
| | | | | | | | | | | | | | | | | | VLAN ID setting. Pull Request #1757. Ticket #4133 VLAN PCP should be fully functional now. Obtained from: https://reviews.freebsd.org/D801 Revert with: pf_802.1p.diff
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2015-11-161-2/+7
|\ \ | |/
| * MFC r290450:smh2015-11-131-2/+7
| | | | | | | | | | | | Add sysctl to control LACP strict compliance default Sponsored by: Multiplay
* | import FreeBSD changes in pfvar.hChris Buechler2015-11-111-2/+3
| |
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2015-11-113-4/+28
|\ \ | |/
| * MFC r290116:ae2015-11-041-0/+8
| | | | | | | | | | | | Check the size of data available in mbuf before using it. PR: 202667
| * MFC r288575:hrs2015-11-043-4/+20
| | | | | | | | Add IFCAP_LINKSTATE support.
* | MFC r290383:Luiz Otavio O Souza2015-11-066-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace the fastforward path with tryforward which does not require a sysctl and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. Differential Revision: https://reviews.freebsd.org/D4042 Reviewed by: ae, melifaro, olivier, rwatson MFC after: 1 month Sponsored by: Rubicon Communications (Netgate) TAG: tryforward
* | Revert "Replace the fastforward path with tryforward which does not require ↵Luiz Otavio O Souza2015-11-066-0/+14
| | | | | | | | | | | | | | | | a sysctl and will always be on." This reverts commit c58873dc9abc56028cc3435f692fd3583bd143af. TAG: tryforward
* | Replace the fastforward path with tryforward which does not require a sysctl ↵Luiz Otavio O Souza2015-10-266-14/+0
| | | | | | | | | | | | | | | | | | and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. TAG: tryforward Differential Revision: https://reviews.freebsd.org/D3737
* | Merge branch 'stable/10' into develRenato Botelho2015-10-212-0/+162
|\ \ | |/
| * MFC r289316:kp2015-10-211-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pf: Fix TSO issues In certain configurations (mostly but not exclusively as a VM on Xen) pf produced packets with an invalid TCP checksum. The problem was that pf could only handle packets with a full checksum. The FreeBSD IP stack produces TCP packets with a pseudo-header checksum (only addresses, length and protocol). Certain network interfaces expect to see the pseudo-header checksum, so they end up producing packets with invalid checksums. To fix this stop calculating the full checksum and teach pf to only update TCP checksums if TSO is disabled or the change affects the pseudo-header checksum. PR: 154428, 193579, 198868 Relnotes: yes Sponsored by: RootBSD
| * Add the paravirt.h support from -HEAD.adrian2015-10-151-0/+157
| | | | | | | | | | Submitted by: eric Sponsored by: Norse Corp, Inc.
* | MFC r286213:Luiz Otavio O Souza2015-10-201-2/+0
| | | | | | | | | | | | | | | | | | | | looks like all archs either have clang or cdefs included before.. drop this include as unnecessary.. Requested by: bde TAG: IPSEC-HEAD Issue: #4841
* | MFC r286168:Luiz Otavio O Souza2015-10-201-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | convert to C11's _Static_assert, and pull in sys/cdefs.h for compatibility w/ older non-C11 compilers... passed make tinerdbox.. Suggested by: imp TAG: IPSEC-HEAD Issue: #4841
* | MFC r286110:Luiz Otavio O Souza2015-10-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | temporarily fix build.. This isn't the final fix, and testing is still on going, but it has passed world for mips and powerpc... I know this has an extra semicolon, but this is the patch that is tested... Looks like better fix is to use _Static_assert... TAG: IPSEC-HEAD Issue: #4841
* | MFC r286100:Luiz Otavio O Souza2015-10-201-18/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clean up this header file... use CTASSERTs now that we have them... Replace a draft w/ RFC that's over 10 years old. Note that _AALG and _EALG do not need to match what the IKE daemons think they should be.. This is part of the KABI... I decided to renumber AESCTR, but since we've never had working AESCTR mode, I'm not really breaking anything.. and it shortens a loop by quite a bit.. remove SKIPJACK IPsec support... SKIPJACK never made it out of draft (in 1999), only has 80bit key, NIST recommended it stop being used after 2010, and setkey nor any of the IKE daemons I checked supported it... jmgurney/ipsecgcm: a357a33, c75808b, e008669, b27b6d6 Reviewed by: gnn (earlier version) TAG: IPSEC-HEAD Issue: #4841
* | MFC r285108:Luiz Otavio O Souza2015-10-201-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New AES modes for IPSec, user space components. Update setkey and libipsec to understand aes-gcm-16 as an encryption method. A partial commit of the work in review D2936. Submitted by: eri Reviewed by: jmg MFC after: 2 weeks Sponsored by: Rubicon Communications (Netgate) TAG: IPSEC-HEAD Issue: #4841
* | Revert IPSEC patches.Luiz Otavio O Souza2015-10-201-8/+1
| | | | | | | | | | | | | | | | | | Revert "Importing pfSense patch ipsec_altq.RELENG_10.diff" This reverts commit 5b128f054452e56b96564210c998510e0dd45130. TAG: IPSEC-HEAD Issue: #4841
* | Revert AESNI patches.Luiz Otavio O Souza2015-10-201-7/+0
| | | | | | | | | | | | | | | | | | Revert "Importing pfSense patch aesgcm.soft.1.patch" This reverts commit 46e99a8858f1c843c1774e472c11d422ca2163ae. TAG: IPSEC-HEAD Issue: #4841
* | Merge branch 'stable/10' into develRenato Botelho2015-10-132-6/+7
|\ \ | |/
| * MFC r288529:ae2015-10-121-1/+1
| | | | | | | | Always detach encap handler when reconfiguring tunnel.
| * MFC r287775:hselasky2015-10-081-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Update TSO limits to include all headers. To make driver programming easier the TSO limits are changed to reflect the values used in the BUSDMA tag a network adapter driver is using. The TCP/IP network stack will subtract space for all linklevel and protocol level headers and ensure that the full mbuf chain passed to the network adapter fits within the given limits. See r287775 for a more detailed description. Differential Revision: https://reviews.freebsd.org/D3477 Reviewed by: rmacklem
* | Merge branch 'stable/10' into develRenato Botelho2015-09-226-334/+374
|\ \ | |/
| * Fix a panic in SIOCSLAGG and SIOCGLAGGOPTS. This was caused by ahrs2015-09-211-4/+2
| | | | | | | | | | | | wrongly-MFC'd patch in r287723. Pointy hat to: hrs
OpenPOWER on IntegriCloud