summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_input.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'origin/stable/10' into develLuiz Otavio O Souza2016-05-231-2/+1
|\
| * MFC r297985:loos2016-05-231-2/+1
| | | | | | | | | | | | | | | | | | | | Do not overwrite the dchg variable. It does not cause any real issues because the variable is overwritten only when the packet is forwarded (and the variable is not used anymore). Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)
* | Revert "Importing pfSense patch ip_dstchng_fix.diff"Luiz Otavio O Souza2016-05-231-1/+2
| | | | | | | | This reverts commit 314d8ade559c0d51dccfa6a8c6980d2abc82f3bf.
* | Revive the sysctl net.inet.ip.fastforward to control the tryforward use.Luiz Otavio O Souza2016-05-031-2/+7
| | | | | | | | | | | | This is mainly provided for debug aid and should not be used in common cases. The fastforward sysctl is enabled by default.
* | Revert "Revert 295285 which was an MFC of the tryforward work ↵Renato Botelho2016-02-221-0/+12
| | | | | | | | | | | | | | | | | | (r290383,295282,295283)" We are keeping tryforward enabled on pfSense since we do not use IPFW + NAT This reverts commit b899cad3faf3673f41a3fcf021164dcd7ee19a7e.
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-02-221-12/+0
|\ \ | |/
| * Revert 295285 which was an MFC of the tryforward work (r290383,295282,295283)gnn2016-02-221-12/+0
| | | | | | | | | | | | | | In the IPFW+NAT+divergent MTU case there is a bug in sening ICMP MTU updates. Approved by: re (marius, gjb) Sponsored by: Rubicon Communications (Netgate)
* | Merge remote-tracking branch 'origin/stable/10' into develRenato Botelho2016-02-051-0/+12
|\ \ | |/
| * MFC: r290383,295282,295283gnn2016-02-041-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | Replace the fastforward path with tryforward which does not require a sysctl and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. Differential Revision: https://reviews.freebsd.org/D4042 Reviewed by: ae, melifaro, olivier, rwatson Approved by: re (glebius) Sponsored by: Rubicon Communications (Netgate)
* | Revert "MFC r290383:"Renato Botelho2016-02-051-13/+0
| | | | | | | | This reverts commit 5e6268df600406a1570e822ac652576059d820e3.
* | MFC r290383:Luiz Otavio O Souza2015-11-061-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace the fastforward path with tryforward which does not require a sysctl and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. Differential Revision: https://reviews.freebsd.org/D4042 Reviewed by: ae, melifaro, olivier, rwatson MFC after: 1 month Sponsored by: Rubicon Communications (Netgate) TAG: tryforward
* | Revert "Replace the fastforward path with tryforward which does not require ↵Luiz Otavio O Souza2015-11-061-4/+0
| | | | | | | | | | | | | | | | a sysctl and will always be on." This reverts commit c58873dc9abc56028cc3435f692fd3583bd143af. TAG: tryforward
* | Revert "If there are any IPSEC security policies skip the tryforward step."Luiz Otavio O Souza2015-11-061-9/+0
| | | | | | | | | | | | This reverts commit de3b422781821f809b436ced1af4fc3dd4dc0c1a. TAG: tryforward
* | If there are any IPSEC security policies skip the tryforward step.Luiz Otavio O Souza2015-10-261-0/+9
| | | | | | | | | | TAG: tryforward Obtained from: https://github.com/gvnn3/freebsd/commit/a2e67b29464bbf822f3da313ae2de817c4faa401
* | Replace the fastforward path with tryforward which does not require a sysctl ↵Luiz Otavio O Souza2015-10-261-0/+4
| | | | | | | | | | | | | | | | | | and will always be on. The former split between default and fast forwarding is removed by this commit while preserving the ability to use all network stack features. TAG: tryforward Differential Revision: https://reviews.freebsd.org/D3737
* | MFC r275704:Luiz Otavio O Souza2015-10-201-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move ip_ipsec_fwd() from ip_input() into ip_forward(). Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is already handled by IPSEC code. This means that before IPSEC processing it was destined to our address and security policy was checked in the ip_ipsec_input(). After IPSEC processing packet has new IP addresses and destination address isn't our own. So, anyway we can't check security policy from the mbuf tag, because it corresponds to different addresses. We should check security policy that corresponds to packet attributes in both cases - when it has a mbuf tag and when it has not. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* | MFC r275703:Luiz Otavio O Souza2015-10-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of its security policy. The changed block of code in ip*_ipsec_input() is called when packet has ESP/AH header. Presence of PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that packet was already handled by IPSEC and reinjected in the netisr, and it has another ESP/AH headers (encrypted twice?). Since it was already processed by IPSEC code, the AH/ESP headers was already stripped (and probably outer IP header was stripped too) and security policy from the tdb_ident was applied to those headers. It is incorrect to apply this security policy to current headers. Also make ip_ipsec_input() prototype similar to ip6_ipsec_input(). Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* | Revert IPSEC patches.Luiz Otavio O Souza2015-10-201-10/+4
| | | | | | | | | | | | | | | | | | Revert "Importing pfSense patch IPSEC_sysctl.RELENG_10.diff" This reverts commit 1a5bcc816de96758225aa0a4d2b5ddc7b88b6b58. TAG: IPSEC-HEAD Issue: #4841
* | Revert "Importing pfSense patch ipsec_fwd_check.diff"Luiz Otavio O Souza2015-08-201-1/+1
| | | | | | | | | | | | | | This reverts commit 2fb6d009cccdaf8b780594600da81d5910168a3e. Until we get some facts about this change, let's remove it and reduce our differences with FreeBSD.
* | Importing pfSense patch ipsec_fwd_check.diffRenato Botelho2015-08-171-1/+1
| |
* | Importing pfSense patch ip_dstchng_fix.diffRenato Botelho2015-08-171-2/+1
| |
* | Importing pfSense patch IPSEC_sysctl.RELENG_10.diffRenato Botelho2015-08-171-4/+10
| |
* | Importing pfSense patch pfil.RELENG_10.diffRenato Botelho2015-08-171-0/+3
|/
* MFC 285325eri2015-07-291-1/+2
| | | | | | Correct issue presented in r285051 by properly initializing variable. Differential Revision: https://reviews.freebsd.org/D3036
* MFC r285051eri2015-07-291-17/+18
| | | | | | Avoid doing multiple route lookups for the same destination IP during forwarding. Differential Revision: https://reviews.freebsd.org/D2964
* MFC r265942:yongari2014-05-161-2/+3
| | | | Fix checksum computation. Previously it didn't include carry.
* Merge r262763, r262767, r262771, r262806 from head:glebius2014-03-211-1/+1
| | | | | | | | | | - Remove rt_metrics_lite and simply put its members into rtentry. - Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This removes another cache trashing ++ from packet forwarding path. - Create zini/fini methods for the rtentry UMA zone. Via initialize mutex and counter in them. - Fix reporting of rmx_pksent to routing socket. - Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode.
* Merge r263091: fix mbuf flags clash that lead to failure of operationglebius2014-03-181-0/+3
| | | | | | | of IPSEC and packet filters. PR: kern/185876 PR: kern/186755
* Merge r261582, r261601, r261610, r261613, r261627, r261640, r261641, r261823,glebius2014-03-041-29/+0
| | | | | | | | | | r261825, r261859, r261875, r261883, r261911, r262027, r262028, r262029, r262030, r262162 from head. Large flowtable revamp. See commit messages for merged revisions for details. Sponsored by: Netflix
* Unregister inet/inet6 pfil hooks on vnet destroy.trociny2013-09-131-0/+5
| | | | | Discussed with: andre Approved by: re (rodrigc)
* Implement the ip, tcp, and udp DTrace providers. The probe definitions usemarkj2013-08-251-0/+5
| | | | | | | | | dynamic translation so that their arguments match the definitions for these providers in Solaris and illumos. Thus, existing scripts for these providers should work unmodified on FreeBSD. Tested by: gnn, hiren MFC after: 1 month
* Restructure the mbuf pkthdr to make it fit for upcoming capabilities andandre2013-08-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | features. The changes in particular are: o Remove rarely used "header" pointer and replace it with a 64bit protocol/ layer specific union PH_loc for local use. Protocols can flexibly overlay their own 8 to 64 bit fields to store information while the packet is worked on. o Mechanically convert IP reassembly, IGMP/MLD and ATM to use pkthdr.PH_loc instead of pkthdr.header. o Extend csum_flags to 64bits to allow for additional future offload information to be carried (e.g. iSCSI, IPsec offload, and others). o Move the RSS hash type enumerator from abusing m_flags to its own 8bit rsstype field. Adjust accessor macros. o Add cosqos field to store Class of Service / Quality of Service information with the packet. It is not yet supported in any drivers but allows us to get on par with Cisco/Juniper in routing applications (plus MPLS QoS) with a modernized ALTQ. o Add four 8 bit fields l[2-5]hlen to store the relative header offsets from the start of the packet. This is important for various offload capabilities and to relieve the drivers from having to parse the packet and protocol headers to find out location of checksums and other information. Header parsing in drivers is a lot of copy-paste and unhandled corner cases which we want to avoid. o Add another flexible 64bit union to map various additional persistent packet information, like ether_vtag, tso_segsz and csum fields. Depending on the csum_flags settings some fields may have different usage making it very flexible and adaptable to future capabilities. o Restructure the CSUM flags to better signify their outbound (down the stack) and inbound (up the stack) use. The CSUM flags used to be a bit chaotic and rather poorly documented leading to incorrect use in many places. Bring clarity into their use through better naming. Compatibility mappings are provided to preserve the API. The drivers can be corrected one by one and MFC'd without issue. o The size of pkthdr stays the same at 48/56bytes (32/64bit architectures). Sponsored by: The FreeBSD Foundation
* Move ip_reassemble()'s use of the global M_FRAG mbuf flag to a protocol layerandre2013-08-191-3/+3
| | | | | | | specific flag instead. The flag is only relevant while the packet stays in the IP reassembly queue. Discussed with: trociny, glebius
* Use new macros to implement ipstat and tcpstat using PCPU counters.ae2013-07-091-64/+8
| | | | Change interface of kread_counters() similar ot kread() in the netstat(1).
* Fix kmod_*stat_inc() after r249276. The incorrect code actuallyglebius2013-06-211-2/+2
| | | | | | | | increased the pointer, not the memory it points to. In collaboration with: kib Reported & tested by: Ian FREISLICH <ianf clue.co.za> Sponsored by: Nginx, Inc.
* Back out r249318, r249320 and r249327 due to a heisenbug mostandre2013-05-061-2/+2
| | | | | likely related to a race condition in the ipi_hash_lock with the exact cause currently unknown but under investigation.
* Change certain heavily used network related mutexes and rwlocks toandre2013-04-091-2/+2
| | | | | | | | | | reside on their own cache line to prevent false sharing with other nearby structures, especially for those in the .bss segment. NB: Those mutexes and rwlocks with variables next to them that get changed on every invocation do not benefit from their own cache line. Actually it may be net negative because two cache misses would be incurred in those cases.
* Merge from projects/counters: TCP/IP stats.glebius2013-04-081-11/+71
| | | | | | | | | Convert 'struct ipstat' and 'struct tcpstat' to counter(9). This speeds up IP forwarding at extreme packet rates, and makes accounting more precise. Sponsored by: Nginx, Inc.
* Use m_get/m_gethdr instead of compat macros.glebius2013-03-151-1/+1
| | | | Sponsored by: Nginx, Inc.
* ip_savecontrol() style fixes. No functional changes.pluknet2013-02-201-17/+17
| | | | | | | | | - fix indentation - put the operator at the end of the line for long statements - remove spaces between the type and the variable in a cast - remove excessive parentheses Tested by: md5
* Mechanically substitute flags from historic mbuf allocator withglebius2012-12-051-2/+2
| | | | | | | | | malloc(9) flags within sys. Exceptions: - sys/contrib not touched - sys/mbuf.h edited manually
* Remove the recently added sysctl variable net.pfil.forward.ae2012-11-021-12/+11
| | | | | | | | | Instead, add protocol specific mbuf flags M_IP_NEXTHOP and M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup only when this flag is set. Suggested by: andre
* Remove the IPFIREWALL_FORWARD kernel option and make possible to turnae2012-10-251-2/+3
| | | | | | | | | on the related functionality in the runtime via the sysctl variable net.pfil.forward. It is turned off by default. Sponsored by: Yandex LLC Discussed with: net@ MFC after: 2 weeks
* After r241923 the updated ip_len no longer needed.glebius2012-10-251-1/+0
|
* Fix error in r241913 that had broken fragment reassembly.glebius2012-10-251-1/+1
|
* Do not reduce ip_len by size of IP header in the ip_input()glebius2012-10-231-6/+0
| | | | | | | | | | | before passing a packet to protocol input routines. For several protocols this mean that now protocol needs to do subtraction itself, and for another half this means that we do not need to add header length back to the packet. Make ip_stripoptions() to adjust ip_len, since now we enter this function with a packet header whose ip_len does represent length of entire packet, not payload only.
* Switch the entire IPv4 stack to keep the IP packet headerglebius2012-10-221-37/+26
| | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me>
* A step in resolving mess with byte ordering for AF_INET. After this change:glebius2012-10-061-16/+23
| | | | | | | | | | | | | | | | | | | - All packets in NETISR_IP queue are in net byte order. - ip_input() is entered in net byte order and converts packet to host byte order right _after_ processing pfil(9) hooks. - ip_output() is entered in host byte order and converts packet to net byte order right _before_ processing pfil(9) hooks. - ip_fragment() accepts and emits packet in net byte order. - ip_forward(), ip_mloopback() use host byte order (untouched actually). - ip_fastforward() no longer modifies packet at all (except ip_ttl). - Swapping of byte order there and back removed from the following modules: pf(4), ipfw(4), enc(4), if_bridge(4). - Swapping of byte order added to ipfilter(4), based on __FreeBSD_version - __FreeBSD_version bumped. - pfil(9) manual page updated. Reviewed by: ray, luigi, eri, melifaro Tested by: glebius (LE), ray (BE)
* When ip_output()/ip6_output() is supplied a struct route *ro argument,glebius2012-07-041-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | it skips FLOWTABLE lookup. However, the non-NULL ro has dual meaning here: it may be supplied to provide route, and it may be supplied to store and return to caller the route that ip_output()/ip6_output() finds. In the latter case skipping FLOWTABLE lookup is pessimisation. The difference between struct route filled by FLOWTABLE and filled by rtalloc() family is that the former doesn't hold a reference on its rtentry. Reference is hold by flow entry, and it is about to be released in future. Thus, route filled by FLOWTABLE shouldn't be passed to RTFREE() macro. - Introduce new flag for struct route/route_in6, that marks route not holding a reference on rtentry. - Introduce new macro RO_RTFREE() that cleans up a struct route depending on its kind. - All callers to ip_output()/ip6_output() that do supply non-NULL but empty route should use RO_RTFREE() to free results of lookup. - ip_output()/ip6_output() now do FLOWTABLE lookup always when ro->ro_rt == NULL. Tested by: tuexen (SCTP part)
* Add a IP_RECVTOS socket option to receive for received UDP/IPv4tuexen2012-06-121-0/+6
| | | | | | | | packets a cmsg of type IP_RECVTOS which contains the TOS byte. Much like IP_RECVTTL does for TTL. This allows to implement a protocol on top of UDP and implementing ECN. MFC after: 3 days
OpenPOWER on IntegriCloud