summaryrefslogtreecommitdiffstats
path: root/sys/net
Commit message (Collapse)AuthorAgeFilesLines
* Backout MT_TAG removal (i.e. bring back MT_TAGs) for now, as dummynet ismlaier2004-02-182-7/+24
| | | | | | not working properly with the patch in place. Approved by: bms(mentor)
* Random style fixes and a comment update. No functional changes.des2004-02-161-4/+4
|
* Return EACCES rather than ENOBUFS if ipfw blocks a packet on thedwmalone2004-02-151-1/+1
| | | | | | | | | way out at layer 2. PR: 62385 Submitted by: Oleg Bulyzhin <oleg@rinet.ru> Approved by: luigi MFC after: 1 week
* This set of changes eliminates the use of MT_TAG "pseudo mbufs", replacingmlaier2004-02-132-24/+7
| | | | | | | | | | | them mostly with packet tags (one case is handled by using an mbuf flag since the linkage between "caller" and "callee" is direct and there's no need to incur the overhead of a packet tag). This is (mostly) work from: sam Silence from: -arch Approved by: bms(mentor), sam, rwatson
* Initial import of RFC 2385 (TCP-MD5) digest support.bms2004-02-111-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the first of two commits; bringing in the kernel support first. This can be enabled by compiling a kernel with options TCP_SIGNATURE and FAST_IPSEC. For the uninitiated, this is a TCP option which provides for a means of authenticating TCP sessions which came into being before IPSEC. It is still relevant today, however, as it is used by many commercial router vendors, particularly with BGP, and as such has become a requirement for interconnect at many major Internet points of presence. Several parts of the TCP and IP headers, including the segment payload, are digested with MD5, including a shared secret. The PF_KEY interface is used to manage the secrets using security associations in the SADB. There is a limitation here in that as there is no way to map a TCP flow per-port back to an SPI without polluting tcpcb or using the SPD; the code to do the latter is unstable at this time. Therefore this code only supports per-host keying granularity. Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6), TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective users of this feature, this will not pose any problem. This implementation is output-only; that is, the option is honoured when responding to a host initiating a TCP session, but no effort is made [yet] to authenticate inbound traffic. This is, however, sufficient to interwork with Cisco equipment. Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with local patches. Patches for tcpdump to validate TCP-MD5 sessions are also available from me upon request. Sponsored by: sentex.net
* Add the kernel side of network interface renaming support.brooks2004-02-041-23/+56
| | | | | | | | | | | | | | | The basic process is to send a routing socket announcement that the interface has departed, change if_xname, update the sockaddr_dl associated with the interface, and announce the arrival of the interface on the routing socket. As part of this change, ifunit() is greatly simplified by testing if_xname directly. if_clone_destroy() now uses if_dname to look up the cloner for the interface and if_dunit to identify the unit number. Reviewed by: ru, sam (concept) Vincent Jardin <vjardin AT free.fr> Max Laier <max AT love2party.net>
* More macro cleanup. Use the system roundup2() macro instead of makingbrooks2004-02-021-3/+1
| | | | | | our own ROUNDUP() macro. Suggested by: bde
* Remove NetBSD'isms (add FreeBSD'isms?), which makes gre(4) working again.sobomax2004-01-301-3/+2
|
* Cleanup malloc() use in if_attach():brooks2004-01-271-22/+20
| | | | | | | - malloc() returns a void* and does not need a cast - when called with M_WAITOK, malloc() can not return NULL so don't check for that case. The result of the check was bogus anyway since it would leave the interface broken.
* Clean up macro usage in if_attach():brooks2004-01-271-2/+2
| | | | | - Use the system offsetof macro rather then making out own. - undef ROUND after we use it rather then polluting the whole file.
* Add support for WCCPv2. It should be enablem manually using link2sobomax2004-01-262-0/+17
| | | | | | | | ifconfig(8) flag since header for version 2 is the same but IP payload is prepended with additional 4-bytes field. Inspired by: Roman Synyuk <roman@univ.kiev.ua> MFC after: 2 weeks
* (whilespace-only)sobomax2004-01-262-11/+11
| | | | Kill trailing spaces.
* Add a device type for virtual interfaces.harti2004-01-261-1/+3
|
* Add an ATM sub-type for virtual interfaces.harti2004-01-261-0/+3
|
* Don't panic if there are more than 255 interfaces in the system.ru2004-01-231-1/+2
|
* Fix definition of IFM_MODE, which should be refrected the change ofonoe2004-01-221-1/+1
| | | | | IFM_IEEE80211_ mode. Also ifconfig(8) must be recompiled. Pointed out by Sam Leffeler.
* Remove #ifdef for ancient source FreeBSD compat.phk2004-01-211-11/+0
|
* Don't leak softc's when destroying interfaces.brooks2004-01-211-0/+3
| | | | | | Init the softc list when loaded. Noticed by: Maurycy Pawlowski-Wieronski <maurycy at fouk dot org>
* A network interface driver can support IFCAP_VLAN_MTU only,yar2004-01-181-3/+3
| | | | | | | without IFCAP_VLAN_HWTAGGING. The previous version of the leading comment in this file could lead to the opposite conclusion. Fix some typos in the comment as well.
* Add support for FH phy, which will be used by awi driver.onoe2004-01-151-3/+7
| | | | | Also some if_media constants to indicate operational mode are changed to bitmasks to reduce diffs from NetBSD.
* Fix a warning when NATM is not defined. In this case s is not used.harti2004-01-091-0/+2
|
* Remove extraneous unlock. This fixes a panic seen when manipulating staticsam2004-01-071-1/+1
| | | | entries in the ARP table.
* backout the switch to use a zone for vlan tags; this requiressam2004-01-032-29/+6
| | | | vlans be present if any driver with h/w vlan tagging is configured
* switch vlan packet tag allocation to use a private zonesam2004-01-022-6/+29
|
* Sync with NetBSD:sobomax2003-12-302-15/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | if_gre.c rev.1.41-1.49 o Spell output with two ts. o Remove assigned-to but not used variable. o fix grammatical error in a diagnostic message. o u_short -> u_int16_t. o gi_len is ip_len, so it has to be network byteorder. if_gre.h rev.1.11-1.13 o prototype must not have variable name. o u_short -> u_int16_t. o Spell address with two d's. ip_gre.c rev.1.22-1.29 o KNF - return is not a function. o The "osrc" variable in gre_mobile_input() is only ever set but not referenced; remove it. o correct (false) assumptions on mbuf chain. not sure if it really helps, but anyways, it is necessary to perform m_pullup. o correct arg to m_pullup (need to count IP header size as well). o remove redundant adjustment of m->m_pkthdr.len. o clear m_flags just for safety. o tabify. o u_short -> u_int16_t. MFC after: 2 weeks
* Unbreak build of bpf-free kernels.tjr2003-12-291-1/+1
|
* o eliminate widespread on-stack mbuf use for bpf by introducingsam2003-12-2810-138/+83
| | | | | | | | | | | | | a new bpf_mtap2 routine that does the right thing for an mbuf and a variable-length chunk of data that should be prepended. o while we're sweeping the drivers, use u_int32_t uniformly when when prepending the address family (several places were assuming sizeof(int) was 4) o return M_ASSERTVALID to BPF_MTAP* now that all stack-allocated mbufs have been eliminated; this may better be moved to the bpf routines Reviewed by: arch@ and several others
* Don't truncate the interface name in ifunit(). It's now possible to querygreen2003-12-261-2/+2
| | | | | "very long interface names", e.g.: ndis_atheros0: flags=8847<UP,BROADCAST,DEBUG,RUNNING,SIMPLEX,MULTICAST> mtu 1500
* correct bridge_version: replace unexpanded RCS keywords by a fixed stringsam2003-12-241-1/+1
| | | | PR: kern/60251
* Declare gre(4) as being of IFT_TUNNEL, Like God Intended.bms2003-12-091-2/+2
| | | | Suggested by: fenner
* bandaid LOR in rt_setgate; a proper fix requires code refactoringsam2003-12-071-4/+7
|
* Make the if_broadcastaddr const. All the drivers in the tree whichimp2003-12-071-1/+1
| | | | | | violated the constness were corrected before the freeze. This was suggested by mdodd@, I think, and sam@ and others have signed off on this if I recall my conversations with them correctly.
* Remove the call to M_ASSERTVALID from BPF_MTAP; some mbufs passed tosilby2003-11-281-1/+0
| | | | | | | | | | mpf are allocated on the stack, which causes this check to falsely trigger. A new check which takes on-stack mbufs into account will be reintroduced after 5.2 is out the door. Approved by: re (watson) Requested by: many
* workaround LOR in rt_setgatesam2003-11-251-1/+3
| | | | | Reviewed by: andre Approved by: re (rwatson)
* Introduce tcp_hostcache and remove the tcp specific metrics fromandre2003-11-204-41/+33
| | | | | | | | | | | | | | | | | | | | | | | the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Remove RTF_PRCLONING from routing table and adjust users of itandre2003-11-202-14/+19
| | | | | | | | | | | | accordingly. The define is left intact for ABI compatibility with userland. This is a pre-step for the introduction of tcp_hostcache. The network stack remains fully useable with this change. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Introduce a MAC label reference in 'struct inpcb', which cachesrwatson2003-11-182-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce ip_fastforward and remove ip_flow.andre2003-11-146-7/+7
| | | | | | | | | | | | | | | Short description of ip_fastforward: o adds full direct process-to-completion IPv4 forwarding code o handles ip fragmentation incl. hw support (ip_flow did not) o sends icmp needfrag to source if DF is set (ip_flow did not) o supports ipfw and ipfilter (ip_flow did not) o supports divert, ipfw fwd and ipfilter nat (ip_flow did not) o returns anything it can't handle back to normal ip_input Enable with sysctl -w net.inet.ip.fastforwarding=1 Reviewed by: sam (mentor)
* Fix a bug whereby the physical endpoints of a gre(4) tunnel would notbms2003-11-141-0/+7
| | | | | | | | | | | | | be printed, if the module were loaded into a kernel which had INET6 enabled. The gre(4) driver does not use INET6, nor is it specified for IPv6. The tunnel_status() function in ifconfig(8) is somewhat overzealous and assumes that all tunnel interfaces speak KAME ifioctls. This fix follows the path of least resistance, by teaching gre(4) about the two KAME ifioctls concerned. PR: bin/56341
* Add a sysctl MIB, NET_RT_IFMALIST, to retrieve multicast group membershipsbms2003-11-141-0/+65
| | | | | | in a protocol-independent way. Submitted by: harti
* fix comments.ume2003-11-141-5/+3
| | | | Obtained from: KAME
* - vlan_start(): Increment the correct interface statistics member.ru2003-11-121-3/+3
| | | | | | Reviewed by: mdodd - vlan_input(): Macroize the VLAN tag extraction from mbuf.
* Modify the MAC Framework so that instead of embedding a (struct label)rwatson2003-11-122-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove the m_defrag call from if_loop; testing with m_fragmentsilby2003-11-111-27/+0
| | | | | | | has shown that the IPv6 stack can clearly handle fragmented mbuf chains without a problem. MFC after: 1 week
* - Implement selwakeuppri() which allows raising the priority of atanimura2003-11-093-5/+5
| | | | | | | | | | | | | thread being waken up. The thread waken up can run at a priority as high as after tsleep(). - Replace selwakeup()s with selwakeuppri()s and pass appropriate priorities. - Add cv_broadcastpri() which raises the priority of the broadcast threads. Used by selwakeuppri() if collision occurs. Not objected in: -arch, -current
* replace explicit changes to rt_refcnt by RT_ADDREF and RT_REMREFsam2003-11-083-22/+36
| | | | | | | macros that expand to include assertions when the system is built with INVARIANTS Supported by: FreeBSD Foundation
* o add a flags parameter to netisr_register that is used to specifysam2003-11-083-41/+50
| | | | | | | | | | | | | | | | whether or not the isr needs to hold Giant when running; Giant-less operation is also controlled by the setting of debug_mpsafenet o mark all netisr's except NETISR_IP as needing Giant o add a GIANT_REQUIRED assertion to the top of netisr's that need Giant o pickup Giant (when debug_mpsafenet is 1) inside ip_input before calling up with a packet o change netisr handling so swi_net runs w/o Giant; instead we grab Giant before invoking handlers based on whether the handler needs Giant o change netisr handling so that netisr's that are marked MPSAFE may have multiple instances active at a time o add netisr statistics for packets dropped because the isr is inactive Supported by: FreeBSD Foundation
* o make debug_mpsafenet globally visiblesam2003-11-051-0/+10
| | | | | | | | o move it from subr_bus.c to netisr.c where it more properly belongs o add NET_PICKUP_GIANT and NET_DROP_GIANT macros that will be used to grab Giant as needed when MPSAFE operation is enabled Supported by: FreeBSD Foundation
* - update comments to refrect recent BSDs.ume2003-11-041-37/+33
| | | | | | | - nuke unused macro PSUEDO_SET(). - I believe our if_xname stuff is nothing strange against other BSDs. Obtained from: KAME
* Replace the if_name and if_unit members of struct ifnet with new membersbrooks2003-10-3127-168/+149
| | | | | | | | | | | | | if_xname, if_dname, and if_dunit. if_xname is the name of the interface and if_dname/unit are the driver name and instance. This change paves the way for interface renaming and enhanced pseudo device creation and configuration symantics. Approved By: re (in principle) Reviewed By: njl, imp Tested On: i386, amd64, sparc64 Obtained From: NetBSD (if_xname)
OpenPOWER on IntegriCloud