summaryrefslogtreecommitdiffstats
path: root/sys/net
Commit message (Collapse)AuthorAgeFilesLines
* Add sysctls to if_enc(4) to control whether the firewalls orbz2007-11-281-11/+74
| | | | | | | | | | | | | | | | | | | bpf will see inner and outer headers or just inner or outer headers for incoming and outgoing IPsec packets. This is useful in bpf to not have over long lines for debugging or selcting packets based on the inner headers. It also properly defines the behavior of what the firewalls see. Last but not least it gives you if_enc(4) for IPv6 as well. [ As some auxiliary state was not available in the later input path we save it in the tdbi. That way tcpdump can give a consistent view of either of (authentic,confidential) for both before and after states. ] Discussed with: thompsa (2007-04-25, basic idea of unifying paths) Reviewed by: thompsa, gnn
* pfil(9) locking take 3: Switch to rmlock(9)mlaier2007-11-252-11/+15
| | | | | | | | | This has the benefit that rmlocks have proper support for reader recursion (in contrast to rwlock(9) which could potential lead to writer stravation). It also means a significant performance gain, eventhough only visible in microbenchmarks at the moment. Discussed on: -arch, -net
* Have the lagg interface generate link up/down events, the interface is markedthompsa2007-11-251-0/+20
| | | | | | | | as up if at least one of its ports also has a link up. This fixes using carp+lagg together and any other system that relies on linkstate events. PR: kern/113956 MFC after: 3 days
* Use the safer callout_init_rw() to allow the softclock to grab thethompsa2007-11-211-5/+2
| | | | rwlock for us.
* 1) dummynet_io() declaration has changed.oleg2007-11-062-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | 2) Alter packet flow inside dummynet: allow certain packets to bypass dummynet scheduler. Benefits are: - lower latency: if packet flow does not exceed pipe bandwidth, packets will not be (up to tick) delayed (due to dummynet's scheduler granularity). - lower overhead: if packet avoids dummynet scheduler it shouldn't reenter ip stack later. Such packets can be fastforwarded. - recursion (which can lead to kernel stack exhaution) eliminated. This fix long existed panic, which can be triggered this way: kldload dummynet sysctl net.inet.ip.fw.one_pass=0 ipfw pipe 1 config bw 0 for i in `jot 30`; do ipfw add 1 pipe 1 icmp from any to any; done ping -c 1 localhost 3) Three new sysctl nodes are added: net.inet.ip.dummynet.io_pkt - packets passed to dummynet net.inet.ip.dummynet.io_pkt_fast - packets avoided dummynet scheduler net.inet.ip.dummynet.io_pkt_drop - packets dropped by dummynet P.S. Above comments are true only for layer 3 packets. Layer 2 packet flow is not changed yet. MFC after: 3 month
* Add an option to limit the number of source MACs that can be behind a bridgethompsa2007-11-042-23/+91
| | | | | | | | interface. Once the limit is reached packets with unknown source addresses are dropped until an existing host cache entry expires or is removed. Useful to use with the STICKY cache option. Sponsored by: miniSuperHappyDevHouse NZ
* Add a comment explaining why disc(4) bears the IFF_LOOPBACK flag.yar2007-10-271-0/+10
| | | | | It should be the final follow-up to an old yet unfinished discussion on whether IFF_LOOPBACK is necessary for disc(4) and why.
* if_loop doesn't need to keep the list of lo(4) interfaces. Todayyar2007-10-271-12/+0
| | | | | | | a private softc list is needed neither for tracking clones in general nor for destroying all clones before the module unload -- if_clone takes care of all that. (Note that some other interface drivers do need a softc list to be able to scan it for their private purposes.)
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-2412-34/+34
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Close a race when trying to lookup a gateway route in rt_check().jhb2007-10-221-1/+3
| | | | | | | | | | | | | | | | | | | | | Specifically, if two threads were doing concurrent lookups and the existing gateway was marked down, the the first thread would drop a reference on the gateway route and then unlock the "root" route while it tried to allocate a new route. The second thread could then also drop a reference on the same gateway route resulting in a reference underflow. Fix this by clearing the gateway route pointer after dropping the reference count but before dropping the lock. Secondly, in this same case, the second thread would overwrite the gateway route pointer w/o free'ing a reference to the route installed by the first thread. In practice this would probably just fix a lost reference that would result in a route never being freed. This fixes panics observed in rt_check() and rtexpunge(). MFC after: 1 week PR: kern/112490 Insight from: mehuljv at yahoo.com Reviewed by: ru (found the "not-setting it to NULL" part) Tested by: several
* Additions from libpcap 0.9.8 unbreak the build.mlaier2007-10-211-0/+134
| | | | | Pointy hat to: mlaier X-MFC after: RELENG_7 buildworld
* Use ETHER_BPF_MTAP so that the vlan tags are visible to bpf(4) when stackedthompsa2007-10-201-2/+2
| | | | | | under a vlan. MFC after: 3 days
* Use ETHER_BPF_MTAP so that the vlan tags are visible to bpf(4) when bridging athompsa2007-10-201-4/+4
| | | | | | | vlan trunk. Discussed with: csjp MFC after: 3 days
* Use a uint16_t type for the vlan tag rather an int.thompsa2007-10-182-2/+2
|
* The bridging output function puts the mbuf directly on the interfaces sendthompsa2007-10-184-29/+47
| | | | | | | | | | | | | | | | queue so the output network card must support the same tagging mechanism as how the frame was input (prepended Ethernet header tag or stripped HW mflag). Now the vlan Ethernet header is _always_ stripped in ether_input and the mbuf flagged, only only network cards with VLAN_HWTAGGING enabled would properly re-tag any outgoing vlan frames. If the outgoing interface does not support hardware tagging then readd the vlan header to the front of the frame. Move the common vlan encapsulation in to ether_vlanencap(). Reported by: Erik Osterholm, Jon Otterholm MFC after: 1 week
* Make sure that we refresh the PID on read(2) and write(2) operations.csjp2007-10-121-0/+2
| | | | | | | | | | | | | This fixes the process portion of the bpf(4) stats if the peer forks into the background after it's opened the descriptor. This bug results in the following behavior for netstat -B: # netstat -B Pid Netif Flags Recv Drop Match Sblen Hblen Command netstat: kern.proc.pid failed: No such process 78023 em0 p--s-- 2237404 43119 2237404 13986 0 ?????? MFC after: 1 week
* Fix two panics in lagg.thompsa2007-10-122-36/+34
| | | | | | | | | | | | | 1. The locking was changed to shared but roundrobin mode still updated a pointer in the softc with the next tx interface to use. This will panic under high load. Change this to an atomically incremented sequence number in order to choose the tx port in round robin. 2. IFQ_HANDOFF will free the mbuf if the queue is full, this will then be freed again by lagg_start() and panic. Reorganised the error handling and freeing to fix this. MFC after: 3 days
* Certain consumers of rtalloc like gif(4) and if_stf(4) lookup thecsjp2007-09-231-2/+2
| | | | | | | | | | | | | | | | route and once they are done with it, call rtfree(). rtfree() should only be used when we are certain we hold the last reference to the route. This bug results in console messages like the following: rtfree: 0xc40f7000 has 1 refs This patch switches the rtfree() to use RTFREE_LOCKED() instead, which should handle the reference counting on the route better. Approved by: re@ (gnn) Reviewed by: bms Reported by: many via net@ and current@ Tested by: many
* remove IFM_IEEE80211_HT40PLUS and IFM_IEEE80211_HT40MINUS; theysam2007-09-181-4/+0
| | | | | | never got used so nuke 'em before we branch Approved by: re (blanket wireless)
* Allow additional packet filtering on the physical interface for locallythompsa2007-09-161-0/+20
| | | | | | | | | destined packets, disabled by default. PR: kern/116051 Submitted by: Eygene Ryabinkin Approved by: re (bmah) MFC after: 2 weeks
* Remove DIAG code that discards oversized packets.julian2007-09-141-14/+0
| | | | | | There has been general consensus that this was a bad idea/ Approved by: re (bmah)
* Make the type of the memory used by the BPF filter unsigned, so itdwmalone2007-09-131-1/+1
| | | | | | | | | | | matches the BPF registers (which are the only thing that is assigned to/from BPF memory). This is a pedantic change that shouldn't change any behaviour. PR: 115931 Submitted by: Matthew Luckie <mjl@luckie.org.nz> Approved by: re (bmah) MFC after: 3 weeks
* Check for multicast destination on bpf injected packets and update the M_*CASTthompsa2007-09-101-4/+19
| | | | | | | | | | flags, the absense of these flags causes problems in other areas such as bridging which expect them to be correct. At the moment only Ethernet DLTs are checked. Reviewed by: bms, csjp, sam Approved by: re (bmah)
* Do not set the RTF_GATEWAY flag if RTF_LLINFO is set, it doesn't make muchcognet2007-09-081-1/+2
| | | | | | | | | sense in that context, and leads to unusable routes. This should unbreak bootpd. Discussed with: glebius Submitted by: bms Approved by: re (bmah)
* Show the ACTIVE flag in ifconfig for the single interface that is actaullythompsa2007-08-301-1/+5
| | | | | | | | active in failover mode rather than all interfaces with a link. This makes it clear if the master interface is in use or one of the backup links. Found by: Writing the Handbook section Approved by: re (kensmith)
* If the STP state machine is stopped then clear the bridge-id and root-id.thompsa2007-08-181-8/+13
| | | | Approved by: re (kensmith)
* Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, whichrwatson2007-08-063-15/+3
| | | | | | | | | | | | | | | previously conditionally acquired Giant based on debug.mpsafenet. As that has now been removed, they are no longer required. Removing them significantly simplifies error-handling in the socket layer, eliminated quite a bit of unwinding of locking in error cases. While here clean up the now unneeded opt_net.h, which previously was used for the NET_WITH_GIANT kernel option. Clean up some related gotos for consistency. Reviewed by: bz, csjp Tested by: kris Approved by: re (kensmith)
* - Ensure the path cost does not exceed 65535 in legacy STP mode.thompsa2007-08-042-2/+31
| | | | | | | | | - If the path cost is calculated when the link is down, set a pending flag so it is calculated again when it comes back up. - To not use 00:00:00:00:00:00 as the bridge id, all interfaces are scanned and the lowest number wins. All zeros is too low. Approved by: re (rwatson)
* Add a bridge interface flag called PRIVATE where any private port can notthompsa2007-08-012-34/+40
| | | | | | | | | | | | | | | communicate with another private port. All unicast/broadcast/multicast layer2 traffic is blocked so it works much the same way as using firewall rules but scales better and is generally easier as firewall packages usually do not allow ARP blocking. An example usage would be having a number of customers on separate vlans bridged with a server network. All the vlans are marked private, they can all communicate with the server network unhindered, but can not exchange any traffic whatsoever with each other. Approved by: re (rwatson)
* - Propagate the largest set of interface capabilities supported by all laggthompsa2007-07-302-16/+57
| | | | | | | | | | | ports to the lagg interface. - Use the MTU from the first interface as the lagg MTU, all extra interfaces must be the same. This fixes using a lagg interface for a vlan or enabling jumbo frames, etc. Approved by: re (kensmith) MFC After: 3 days
* Replace references to NET_CALLOUT_MPSAFE with CALLOUT_MPSAFE, and removerwatson2007-07-281-1/+1
| | | | | | | | definition of NET_CALLOUT_MPSAFE, which is no longer required now that debug.mpsafenet has been removed. The once over: bz Approved by: re (kensmith)
* First in a series of changes to remove the now-unused Giant compatibilityrwatson2007-07-273-101/+2
| | | | | | | | | | | | | | | | | | | | | | | | | framework for non-MPSAFE network protocols: - Remove debug_mpsafenet variable, sysctl, and tunable. - Remove NET_NEEDS_GIANT() and associate SYSINITSs used by it to force debug.mpsafenet=0 if non-MPSAFE protocols are compiled into the kernel. - Remove logic to automatically flag interrupt handlers as non-MPSAFE if debug.mpsafenet is set for an INTR_TYPE_NET handler. - Remove logic to automatically flag netisr handlers as non-MPSAFE if debug.mpsafenet is set. - Remove references in a few subsystems, including NFS and Cronyx drivers, which keyed off debug_mpsafenet to determine various aspects of their own locking behavior. - Convert NET_LOCK_GIANT(), NET_UNLOCK_GIANT(), and NET_ASSERT_GIANT into no-op's, as their entire behavior was determined by the value in debug_mpsafenet. - Alias NET_CALLOUT_MPSAFE to CALLOUT_MPSAFE. Many remaining references to NET_.*_GIANT() and NET_CALLOUT_MPSAFE are still present in subsystems, and will be removed in followup commits. Reviewed by: bz, jhb Approved by: re (kensmith)
* Avoid holding the softc lock when using copyout().thompsa2007-07-263-58/+109
| | | | | Reported by: dfr Approved by: re (rwatson)
* Allow the LACP state to be queried from userland which at the moment is thethompsa2007-07-054-0/+88
| | | | | | | actor and partner peer info. Print out the active aggregator and per port data in verbose mode from ifconfig. Approved by: re (mux)
* Link pf 4.1 to the build:mlaier2007-07-031-1/+3
| | | | | | | | - move ftp-proxy from libexec to usr.sbin - add tftp-proxy - new altq mtag link Approved by: re (kensmith)
* Commit the change from FAST_IPSEC to IPSEC. The FAST_IPSECgnn2007-07-031-1/+1
| | | | | | | | option is now deprecated, as well as the KAME IPsec code. What was FAST_IPSEC is now IPSEC. Approved by: re Sponsored by: Secure Computing
* Continue pre-7.0 privilege cleanup: update suser(9) comments to be priv(9)rwatson2007-07-021-2/+2
| | | | | | comments. Approved by: re (bmah)
* Sync comments to code: we now use priv_check() rather than suser() torwatson2007-06-261-16/+16
| | | | | | determine privilege. Approved by: re (bmah)
* Check the correct port to see if synced is true.thompsa2007-06-221-2/+2
| | | | | | | PR: misc/113958 Submitted by: Aaron Needles Approved by: re (bmah) MFC after: 1 week
* Silence some gcc 4 warnings. It is expected that the bpf_movein() routinecsjp2007-06-171-0/+2
| | | | | | will intialize the the header length and re-initialize the mbuf pointer to reference the mbuf that is allocated after moving user supplied packet data in.
* - Conditionally pickup Giant around the network interfacecsjp2007-06-151-3/+4
| | | | | | | | | | | | | | ioctl routines if we are running with !mpsafenet - Change un-conditional Giant acquisition around ifpromisc to occur only if we are running with !mpsafenet With these locking bits in place, we can now remove the Giant requirement from BPF, so drop the D_NEEDGIANT device flag. This change removes Giant acquisitions around BPF device handlers (read, write, ioctl etc). MFC after: 1 month Discussed with: rwatson
* Add the vlan tag to the bridge route table. This allows a vlan trunk to bethompsa2007-06-132-26/+54
| | | | | | | bridged, previously legitimate traffic was not passed as the bridge could not tell that it was on a different Ethernet segment. All non-tagged traffic is treated as vlan1 as per IEEE 802.1Q-2003
* Remove IPX over IP tunneling support, which allows IPX routing over IPrwatson2007-06-131-1/+1
| | | | | | | | | | tunnels, and was not MPSAFE. The code can be easily restored in the event that someone with an IPX over IP tunnel configuration can work with me to test patches. This removes one of five remaining consumers of NET_NEEDS_GIANT. Approved by: re (kensmith)
* Use if_capenable to allow LRO enabled drivers to bypassgallatin2007-06-121-1/+2
| | | | the MTU check in ether_input().
* non-functional cleanupthompsa2007-06-124-142/+108
| | | | | | | - remove dead code - use consistent variable names - gc unused defines - whitespace cleanup
* Add IFCAP_LRO flag for drivers to announce their TCP Large Receive Offloadandre2007-06-111-0/+1
| | | | capabilities.
* Move the oversize ethernet frame size check into DIAGNOSTIC,gallatin2007-06-111-0/+2
| | | | | | | | as was proposed when it was originally added. This allows LRO to work on non-DIAGNOSTIC kernels without consuming any mbuf flags. Discussed with: sam
* Back out the previous commit which added an M_LRO mbuf flaggallatin2007-06-111-2/+1
| | | | | to defeat the mtu check in ether_input. Mbuf flags are too scarce. Discussed with: sam
* Allow drivers, such as cxgb and mxge, which support LRO to bypassgallatin2007-06-111-1/+2
| | | | | | the MTU check in ether_input() on LRO merged frames. Discussed with: kmacy
* Add missing \n to printfphk2007-06-111-1/+1
|
OpenPOWER on IntegriCloud