summaryrefslogtreecommitdiffstats
path: root/sys/net
Commit message (Collapse)AuthorAgeFilesLines
* - Check if_type of "addm <interface>" before setting thehrs2010-01-311-14/+34
| | | | | | | | | | | | | | | | | | | | | | | | | interface's MTU to the if_bridge(4) interface. This fixes a bug that MTU value of "addm <interface>" is used even when it is invalid for the if_bridge(4) member: # ifconfig bridge0 create # ifconfig bridge0 bridge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500 ... # ifconfig bridge0 addm lo0 ifconfig: BRDGADD lo0: Invalid argument # ifconfig bridge0 bridge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 16384 ... - Do not ignore MTU value of an interface even when if_type == IFT_GIF. This fixes MTU mismatch when an if_bridge(4) interface has a gif(4) interface and no other interface as the member, and it is directly used for L2 communication with EtherIP tunneling enabled. - Implement SIOCSIFMTU ioctl. Changing the MTU is allowed only when all members have the same MTU value.
* Revised revision 199201 (add interface description capability as inspireddelphij2010-01-273-1/+82
| | | | | | | | by OpenBSD), based on comments from many, including rwatson, jhb, brooks and others. Sponsored by: iXsystems, Inc. MFC after: 1 month
* While flushing the multicast filter of an interface, do not zero the relevantsyrinx2010-01-242-3/+20
| | | | | | | | | | ifmultiaddr structures' reference to the parent interface, unless the parent interface is really detaching. While here, program only link layer multicast filters to a wlan's hardware parent interface. PR: kern/142391, kern/142392 Reviewed by: sam, rpaolo, bms MFC after: 1 week
* Do not hold the lock over if_setlladdr() as it calls into the interface driverthompsa2010-01-191-4/+9
| | | | init routine.
* Declare a new EVENTHANDLER called iflladdr_event which signals that the L2thompsa2010-01-185-0/+49
| | | | | | | | | | | | | address on an interface has changed. This lets stacked interfaces such as vlan(4) detect that their lower interface has changed and adjust things in order to keep working. Previously this situation broke at least vlan(4) and lagg(4) configurations. The EVENTHANDLER_INVOKE call was not placed within if_setlladdr() due to the risk of a loop. PR: kern/142927 Submitted by: Nikolay Denev
* Correct a typo.bz2010-01-101-1/+1
| | | | MFC after: 5 days
* Stop GCC from complaining about lagg_port_checkstacking() being unused.trasz2010-01-081-2/+7
|
* Remove extraneous semicolons, no functional changes.mbr2010-01-071-1/+1
| | | | | Submitted by: Marc Balmer <marc@msys.ch> MFC after: 1 week
* put ip_var before ip_fw_private.h as this will be needed inluigi2010-01-071-1/+1
| | | | the near future
* Various cleanup done in ipfw3-head branch including:luigi2010-01-042-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | - use a uniform mtag format for all packets that exit and re-enter the firewall in the middle of a rulechain. On reentry, all tags containing reinject info are renamed to MTAG_IPFW_RULE so the processing is simpler. - make ipfw and dummynet use ip_len and ip_off in network format everywhere. Conversion is done only once instead of tracking the format in every place. - use a macro FREE_PKT to dispose of mbufs. This eases portability. On passing i also removed a few typos, staticise or localise variables, remove useless declarations and other minor things. Overall the code shrinks a bit and is hopefully more readable. I have tested functionality for all but ng_ipfw and if_bridge/if_ethersubr. For ng_ipfw i am actually waiting for feedback from glebius@ because we might have some small changes to make. For if_bridge and if_ethersubr feedback would be welcome (there are still some redundant parts in these two modules that I would like to remove, but first i need to check functionality).
* Use stricter checking to match possible vlan clones by not allowing extrajhb2009-12-311-6/+8
| | | | | | | garbage characters around or within the tag. Reviewed by: brooks MFC after: 3 days
* The devices that supported EVFILT_NETDEV kqueue filters were removed inbrooks2009-12-312-12/+5
| | | | | | | | | | | | r195175. Remove all definitions, documentation, and usage. fifo_misc.c: Remove all kqueue tests as fifo_io.c performs all those that would have remained. Reviewed by: rwatson MFC after: 3 weeks X-MFC note: don't change vlan_link_state() function signature
* Remove a deleted comment line that was brought back byqingli2009-12-311-1/+0
| | | | | | my previous commit. MFC after: 5 days
* The proxy arp entries could not be added into the system over theqingli2009-12-306-5/+30
| | | | | | | | | | | | | | | | | | IFF_POINTOPOINT link types. The reason was due to the routing entry returned from the kernel covering the remote end is of an interface type that does not support ARP. This patch fixes this problem by providing a hint to the kernel routing code, which indicates the prefix route instead of the PPP host route should be returned to the caller. Since a host route to the local end point is also added into the routing table, and there could be multiple such instantiations due to multiple PPP links can be created with the same local end IP address, this patch also fixes the loopback route installation failure problem observed prior to this patch. The reference count of loopback route to local end would be either incremented or decremented. The first instantiation would create the entry and the last removal would delete the route entry. MFC after: 5 days
* Change vlan interfaces to cope more usefully with the parent interface beingjhb2009-12-293-1/+17
| | | | | | | | | | | | | | renamed. Previously the vlan interfaces would lose their configuration as if the parent interface had been physically removed. Now vlan interfaces ignore rename events. - Add a new ifnet flag (IFF_RENAMING) that is set while an ifnet is being renamed. This flag can be checked in ifnet departure/arrival event handlers to treat rename events differently. - Change the ifnet departure event handler in the if_vlan(4) driver to ignore departure events due to a trunk interface being renamed. Reviewed by: brooks, rwatson MFC after: 1 week
* bring in several cleanups tested in ipfw3-head branch, namely:luigi2009-12-282-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r201011 - move most of ng_ipfw.h into ip_fw_private.h, as this code is ipfw-specific. This removes a dependency on ng_ipfw.h from some files. - move many equivalent definitions of direction (IN, OUT) for reinjected packets into ip_fw_private.h - document the structure of the packet tags used for dummynet and netgraph; r201049 - merge some common code to attach/detach hooks into a single function. r201055 - remove some duplicated code in ip_fw_pfil. The input and output processing uses almost exactly the same code so there is no need to use two separate hooks. ip_fw_pfil.o goes from 2096 to 1382 bytes of .text r201057 (see the svn log for full details) - macros to make the conversion of ip_len and ip_off between host and network format more explicit r201113 (the remaining parts) - readability fixes -- put braces around some large for() blocks, localize variables so the compiler does not think they are uninitialized, do not insist on precise allocation size if we have more than we need. r201119 - when doing a lookup, keys must be in big endian format because this is what the radix code expects (this fixes a bug in the recently-introduced 'lookup' option) No ABI changes in this commit. MFC after: 1 week
* When warning about possible netisr configuration problems during boot,rwatson2009-12-231-4/+4
| | | | | | | report using "netisr_init" rather than "netisr2", which was the development name for the project. MFC after: 3 days
* Refine netisr.c comments a bit.rwatson2009-12-231-20/+28
|
* merge code from ipfw3-head to reduce contention on the ipfw lockluigi2009-12-222-11/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and remove all O(N) sequences from kernel critical sections in ipfw. In detail: 1. introduce a IPFW_UH_LOCK to arbitrate requests from the upper half of the kernel. Some things, such as 'ipfw show', can be done holding this lock in read mode, whereas insert and delete require IPFW_UH_WLOCK. 2. introduce a mapping structure to keep rules together. This replaces the 'next' chain currently used in ipfw rules. At the moment the map is a simple array (sorted by rule number and then rule_id), so we can find a rule quickly instead of having to scan the list. This reduces many expensive lookups from O(N) to O(log N). 3. when an expensive operation (such as insert or delete) is done by userland, we grab IPFW_UH_WLOCK, create a new copy of the map without blocking the bottom half of the kernel, then acquire IPFW_WLOCK and quickly update pointers to the map and related info. After dropping IPFW_LOCK we can then continue the cleanup protected by IPFW_UH_LOCK. So userland still costs O(N) but the kernel side is only blocked for O(1). 4. do not pass pointers to rules through dummynet, netgraph, divert etc, but rather pass a <slot, chain_id, rulenum, rule_id> tuple. We validate the slot index (in the array of #2) with chain_id, and if successful do a O(1) dereference; otherwise, we can find the rule in O(log N) through <rulenum, rule_id> All the above does not change the userland/kernel ABI, though there are some disgusting casts between pointers and uint32_t Operation costs now are as follows: Function Old Now Planned ------------------------------------------------------------------- + skipto X, non cached O(N) O(log N) + skipto X, cached O(1) O(1) XXX dynamic rule lookup O(1) O(log N) O(1) + skipto tablearg O(N) O(1) + reinject, non cached O(N) O(log N) + reinject, cached O(1) O(1) + kernel blocked during setsockopt() O(N) O(1) ------------------------------------------------------------------- The only (very small) regression is on dynamic rule lookup and this will be fixed in a day or two, without changing the userland/kernel ABI Supported by: Valeria Paoli MFC after: 1 month
* Remove commented out prototype for ifinit(). This prototype has beenjhb2009-12-211-1/+0
| | | | | commented out since 1.1 and has not been present in <sys/systm.h> since at least 1.1 of that file. It is also not needed in FreeBSD due to SYSINIT().
* Start splitting ip_fw2.c and ip_fw.h into smaller components.luigi2009-12-152-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At this time we pull out from ip_fw2.c the logging functions, and support for dynamic rules, and move kernel-only stuff into netinet/ipfw/ip_fw_private.h No ABI change involved in this commit, unless I made some mistake. ip_fw.h has changed, though not in the userland-visible part. Files touched by this commit: conf/files now references the two new source files netinet/ip_fw.h remove kernel-only definitions gone into netinet/ipfw/ip_fw_private.h. netinet/ipfw/ip_fw_private.h new file with kernel-specific ipfw definitions netinet/ipfw/ip_fw_log.c ipfw_log and related functions netinet/ipfw/ip_fw_dynamic.c code related to dynamic rules netinet/ipfw/ip_fw2.c removed the pieces that goes in the new files netinet/ipfw/ip_fw_nat.c minor rearrangement to remove LOOKUP_NAT from the main headers. This require a new function pointer. A bunch of other kernel files that included netinet/ip_fw.h now require netinet/ipfw/ip_fw_private.h as well. Not 100% sure i caught all of them. MFC after: 1 month
* Move the scan for max_keylen into route.c::route_init(),luigi2009-12-143-26/+11
| | | | | | | and make max_keylen an argument for rn_init(). This removes an unnecessary dependency on domain.h from radix.c MFC after: 7 days
* Throughout the network stack we have a few places ofbz2009-12-131-2/+2
| | | | | | | | | | | | | | | | | | if (jailed(cred)) left. If you are running with a vnet (virtual network stack) those will return true and defer you to classic IP-jails handling and thus things will be "denied" or returned with an error. Work around this problem by introducing another "jailed()" function, jailed_without_vnet(), that also takes vnets into account, and permits the calls, should the jail from the given cred have its own virtual network stack. We cannot change the classic jailed() call to do that, as it is used outside the network stack as well. Discussed with: julian, zec, jamie, rwatson (back in Sept) MFC after: 5 days
* Make the code buildable in userland so it is easier to test it:luigi2009-12-121-8/+25
| | | | | | | | | | | | | | this requires a small reordering of headers and a few #defines to map functions not available in userland. Remove a useless #ifndef block at the beginning of the file. Introduce (temporarily) rn_init2(), see the comment in the code for the proper long term change. No ABI or functional change. MFC after: 7 days
* No functional changes (who dares to touch this code!) but:luigi2009-12-101-5/+8
| | | | | | | | | | - cast the result of LEN() to int as this is the main usage. - use LEN() in one place where it was forgotten. - Document the use of a static variable in rw mode. More small changes to follow. MFC after: 7 days
* Remove if_timer/if_watchdog now that they are no longer used. The spacejhb2009-11-303-76/+1
| | | | | | | used by if_timer is reserved for expanding if_index to an int in the future. Reviewed by: rwatson, brooks
* General style cleanup, no functional change.jkim2009-11-201-35/+14
|
* - Allocate scratch memory on stack instead of pre-allocating it withjkim2009-11-202-9/+5
| | | | | | | | | the filter as we do from bpf_filter()[1]. - Revert experimental use of contigmalloc(9)/contigfree(9). It has no performance benefit over malloc(9)/free(9)[2]. Requested by: rwatson[1] Pointed out by: rwatson, jhb, alc[2]
* - Change internal function bpf_jit_compile() to return allocated size ofjkim2009-11-182-8/+8
| | | | | | the generated binary and remove page size limitation for userland. - Use contigmalloc(9)/contigfree(9) instead of malloc(9)/free(9) to make sure the generated binary aligns properly and make it physically contiguous.
* - Make BPF JIT compiler working again in userland. We are limiting size ofjkim2009-11-182-3/+7
| | | | | generated native binary to page size for now. - Update copyright date and fix some style nits.
* Fix a LOR showing up with sctp_bsd_addr(): Do not hold a rt locktuexen2009-11-171-0/+4
| | | | | | | | when calling rt_newaddrmsg(). Reviewed by: qingli Approved by: rrs (mentor) MFC after: 1 month
* Revert revision 199201 for now as it has introduced a kernel vulnerabilitydelphij2009-11-123-45/+1
| | | | and requires more polishing.
* Add interface description capability as inspired by OpenBSD.delphij2009-11-113-1/+45
| | | | MFC after: 3 months
* Take a step towards removing if_watchdog/if_timer. Don't explicitly setjhb2009-11-061-1/+0
| | | | | if_watchdog/if_timer to NULL/0 when initializing an ifnet. if_alloc() sets those members to NULL/0 already.
* Remove unneeded blank line from bpf_drvinit().rwatson2009-10-231-1/+0
| | | | MFC after: 3 days
* Check pointer for NULL before dereferencing it, not after.brueffer2009-10-221-2/+2
| | | | | | PR: 138390 Submitted by: Patroklos Argyroudis <argp@census-labs.com> MFC after: 1 week
* Verify "smp_started" is true before callingqingli2009-10-221-6/+10
| | | | | | | sched_bind() and sched_unbind(). Reviewed by: kmacy MFC after: 3 days
* The flow-table function flowtable_route_flush() may be calledqingli2009-10-201-7/+11
| | | | | | | | | | during system initialization time. Since the flow-table is designed to maintain per CPU flow cache, the existing code did not check whether "smp_started" is true before calling sched_bind() and sched_unbind(), which triggers a page fault. Reviewed by: jeff MFC after: immediately
* Clean up comments, white space, and style in pfil.c (especially new VNETrwatson2009-10-191-30/+28
| | | | | | bits). MFC after: 3 days (not VNET bits)
* Remove unused pfil_flags field in packet_filter_hook.rwatson2009-10-181-1/+0
| | | | MFC after: 3 days
* Sort function prototypes in pfil.h, clean up white space, and betterrwatson2009-10-181-6/+6
| | | | | | align fields for printing. MFC after: 3 days
* Line-wrap pfil.c so that it prints more nicely.rwatson2009-10-181-6/+10
| | | | MFC after: 3 days
* Unbreak the VIMAGE build with IPSEC, broken with r197952 bybz2009-10-141-4/+4
| | | | | | | | virtualizing the pfil hooks. For consistency add the V_ to virtualize the pfil hooks in here as well. MFC after: 55 days X-MFC after: julian MFCed r197952.
* Virtualize the pfil hooks so that different jails may chose differentjulian2009-10-113-28/+72
| | | | | | | | packet filters. ALso allows ipfw to be enabled on on ejail and disabled on another. In 8.0 it's a global setting. Sitting aroung in tree waiting to commit for: 2 months MFC after: 2 months
* Put #ifdef INET around parts of the FLOWTABLE code, to unbreakbz2009-10-031-0/+4
| | | | | | | nooptions INET kernel builds. MFC after: 3 days X-MFC: with r197687
* The flow-table associates TCP/UDP flows and IP destinations withqingli2009-10-013-5/+98
| | | | | | | | | | | | | | | | | specific routes. When the routing table changes, for example, when a new route with a more specific prefix is inserted into the routing table, the flow-table is not updated to reflect that change. As such existing connections cannot take advantage of the new path. In some cases the path is broken. This patch will update the affected flow-table entries when a more specific route is added. The route entry is properly marked when a route is deleted from the table. In this case, when the flow-table performs a search, the stale entry is updated automatically. Therefore this patch is not necessary for route deletion. Submitted by: simon, phk Reviewed by: bz, kmacy MFC after: 3 days
* A wrong variable is used when setting up the interfaceqingli2009-09-201-2/+2
| | | | | | | | | address route, which broke source address selection in some code paths. Submitted by: noted by bz Reviewed by: hrs MFC after: immediately
* Style fix - break too long a line in two.zec2009-09-181-1/+2
| | | | | Spotted by: bz MFC after: 3 days
* V_irtualize the lltables list, making ARP and ND reasonablyzec2009-09-171-7/+19
| | | | | | | | usable again with options VIMAGE kernels. Submitted by: bz (the original version, probably identical to this one) Reviewed by: many @ DevSummit Cambridge MFC after: 3 days
* Self pointing routes are installed for configured interface addressesqingli2009-09-152-0/+56
| | | | | | | | | | and address aliases. After an interface is brought down and brought back up again, those self pointing routes disappeared. This patch ensures after an interface is brought back up, the loopback routes are reinstalled properly. Reviewed by: bz MFC after: immediately
OpenPOWER on IntegriCloud