summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_input.c
Commit message (Collapse)AuthorAgeFilesLines
* Link ALTQ to the build and break with ABI for struct ifnet. Please recompilemlaier2004-06-131-0/+6
| | | | | | | | | | | | your (network) modules as well as any userland that might make sense of sizeof(struct ifnet). This does not change the queueing yet. These changes will follow in a seperate commit. Same with the driver changes, which need case by case evaluation. __FreeBSD_version bump will follow. Tested-by: (i386)LINT
* Provide the sysctl net.inet.ip.process_options to control the processingandre2004-05-061-0/+13
| | | | | | | | | | | | | | | | | | of IP options. net.inet.ip.process_options=0 Ignore IP options and pass packets unmodified. net.inet.ip.process_options=1 Process all IP options (default). net.inet.ip.process_options=2 Reject all packets with IP options with ICMP filter prohibited message. This sysctl affects packets destined for the local host as well as those only transiting through the host (routing). IP options do not have any legitimate purpose anymore and are only used to circumvent firewalls or to exploit certain behaviours or bugs in TCP/IP stacks. Reviewed by: sam (mentor)
* Rename m_claim_next_hop() to m_claim_next(), as suggested by Max Laier.darrenr2004-05-021-1/+1
|
* Rename ip_claim_next_hop() to m_claim_next_hop(), give it an extra argdarrenr2004-05-021-1/+1
| | | | | (the type of tag to claim) and push it out of ip_var.h into mbuf.h alongside all of the other macros that work ok mbuf's and tag's.
* Remove advertising clause from University of California Regent'simp2004-04-071-4/+0
| | | | | | | license, per letter dated July 22, 1999 and email from Peter Wemm, Alan Cox and Robert Watson. Approved by: core, peter, alc, rwatson
* Invert the logic of NET_LOCK_GIANT(), and remove the one reference to it.rwatson2004-03-281-2/+0
| | | | | | | | Previously, Giant would be grabbed at entry to the IP local delivery code when debug.mpsafenet was set to true, as that implied Giant wouldn't be grabbed in the driver path. Now, we will use this primitive to conditionally grab Giant in the event the entire network stack isn't running MPSAFE (debug.mpsafenet == 0).
* Rename NET_PICKUP_GIANT() to NET_LOCK_GIANT(), and NET_DROP_GIANT()rwatson2004-03-011-2/+2
| | | | | | | | | | | to NET_UNLOCK_GIANT(). While they are used in similar ways, the semantics are quite different -- NET_LOCK_GIANT() and NET_UNLOCK_GIANT() directly wrap mutex lock and unlock operations, whereas drop/pickup special case the handling of Giant recursion. Add a comment saying as much. Add NET_ASSERT_GIANT(), which conditionally asserts Giant based on the value of debug_mpsafenet.
* Remove unneeded {} originally used to hold local variables for dummynetrwatson2004-02-281-2/+0
| | | | | | in a code block, as the variable is now gone. Submitted by: sam
* Re-remove MT_TAGs. The problems with dummynet have been fixed now.mlaier2004-02-251-115/+52
| | | | | Tested by: -current, bms(mentor), me Approved by: bms(mentor), sam
* Backout MT_TAG removal (i.e. bring back MT_TAGs) for now, as dummynet ismlaier2004-02-181-60/+122
| | | | | | not working properly with the patch in place. Approved by: bms(mentor)
* Do not check receive interface when pfil(9) hook changed address.mlaier2004-02-131-1/+1
| | | | Approved by: bms(mentor)
* This set of changes eliminates the use of MT_TAG "pseudo mbufs", replacingmlaier2004-02-131-118/+56
| | | | | | | | | | | them mostly with packet tags (one case is handled by using an mbuf flag since the linkage between "caller" and "callee" is direct and there's no need to incur the overhead of a packet tag). This is (mostly) work from: sam Silence from: -arch Approved by: bms(mentor), sam, rwatson
* Introduce the SO_BINTIME option which takes a high-resolution timestampphk2004-01-311-8/+19
| | | | | | | | | | | | at packet arrival. For benchmarking purposes SO_BINTIME is preferable to SO_TIMEVAL since it has higher resolution and lower overhead. Simultaneous use of the two options is possible and they will return consistent timestamps. This introduces an extra test and a function call for SO_TIMEVAL, but I have not been able to measure that.
* Make sure all uses of stack allocated struct route's are properlyandre2003-11-261-2/+2
| | | | | | | | zeroed. Doing a bzero on the entire struct route is not more expensive than assigning NULL to ro.ro_rt and bzero of ro.ro_dst. Reviewed by: sam (mentor) Approved by: re (scottl)
* Introduce tcp_hostcache and remove the tcp specific metrics fromandre2003-11-201-8/+8
| | | | | | | | | | | | | | | | | | | | | | | the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Remove RTF_PRCLONING from routing table and adjust users of itandre2003-11-201-2/+2
| | | | | | | | | | | | accordingly. The define is left intact for ABI compatibility with userland. This is a pre-step for the introduction of tcp_hostcache. The network stack remains fully useable with this change. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Fix a few cases where MT_TAG-type "fake mbufs" are created on the stack, butgreen2003-11-171-0/+2
| | | | | | | | | do not have mh_nextpkt initialized. Somtimes what's there is "1", and the ip_input() code pukes trying to m_free() it, rendering divert sockets and such broken. This really underscores the need to get rid of MT_TAG. Reviewed by: rwatson
* Make ipstealth global as we need it in ip_fastforward too.andre2003-11-151-1/+1
|
* Remove the global one-level rtcache variable and associatedandre2003-11-141-201/+90
| | | | | | | | complex locking and rework ip_rtaddr() to do its own rtlookup. Adopt all its callers to this and make ip_output() callable with NULL rt pointer. Reviewed by: sam (mentor)
* Introduce ip_fastforward and remove ip_flow.andre2003-11-141-8/+29
| | | | | | | | | | | | | | | Short description of ip_fastforward: o adds full direct process-to-completion IPv4 forwarding code o handles ip fragmentation incl. hw support (ip_flow did not) o sends icmp needfrag to source if DF is set (ip_flow did not) o supports ipfw and ipfilter (ip_flow did not) o supports divert, ipfw fwd and ipfilter nat (ip_flow did not) o returns anything it can't handle back to normal ip_input Enable with sysctl -w net.inet.ip.fastforwarding=1 Reviewed by: sam (mentor)
* replace explicit changes to rt_refcnt by RT_ADDREF and RT_REMREFsam2003-11-081-1/+1
| | | | | | | macros that expand to include assertions when the system is built with INVARIANTS Supported by: FreeBSD Foundation
* o add a flags parameter to netisr_register that is used to specifysam2003-11-081-1/+3
| | | | | | | | | | | | | | | | whether or not the isr needs to hold Giant when running; Giant-less operation is also controlled by the setting of debug_mpsafenet o mark all netisr's except NETISR_IP as needing Giant o add a GIANT_REQUIRED assertion to the top of netisr's that need Giant o pickup Giant (when debug_mpsafenet is 1) inside ip_input before calling up with a packet o change netisr handling so swi_net runs w/o Giant; instead we grab Giant before invoking handlers based on whether the handler needs Giant o change netisr handling so that netisr's that are marked MPSAFE may have multiple instances active at a time o add netisr statistics for packets dropped because the isr is inactive Supported by: FreeBSD Foundation
* Fix locking of the ip forwarding cache. We were holding a referencesam2003-11-071-11/+21
| | | | | | | | | | | | to a routing table entry w/o bumping the reference count or locking against the entry being free'd. This caused major havoc (for some reason it appeared most frequently for folks running natd). Fix is to bump the reference count whenever we copy the route cache contents into a private copy so the entry cannot be reclaimed out from under us. This is a short term fix as the forthcoming routing table changes will eliminate this cache entirely. Supported by: FreeBSD Foundation
* - cleanup SP refcnt issue.ume2003-11-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - share policy-on-socket for listening socket. - don't copy policy-on-socket at all. secpolicy no longer contain spidx, which saves a lot of memory. - deep-copy pcb policy if it is an ipsec policy. assign ID field to all SPD entries. make it possible for racoon to grab SPD entry on pcb. - fixed the order of searching SA table for packets. - fixed to get a security association header. a mode is always needed to compare them. - fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime. - disallow port spec for tunnel mode policy (as we don't reassemble). - an user can define a policy-id. - clear enc/auth key before freeing. - fixed that the kernel crashed when key_spdacquire() was called because key_spdacquire() had been implemented imcopletely. - preparation for 64bit sequence number. - maintain ordered list of SA, based on SA id. - cleanup secasvar management; refcnt is key.c responsibility; alloc/free is keydb.c responsibility. - cleanup, avoid double-loop. - use hash for spi-based lookup. - mark persistent SP "persistent". XXX in theory refcnt should do the right thing, however, we have "spdflush" which would touch all SPs. another solution would be to de-register persistent SPs from sptree. - u_short -> u_int16_t - reduce kernel stack usage by auto variable secasindex. - clarify function name confusion. ipsec_*_policy -> ipsec_*_pcbpolicy. - avoid variable name confusion. (struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct secpolicy *) - count number of ipsec encapsulations on ipsec4_output, so that we can tell ip_output() how to handle the packet further. - When the value of the ul_proto is ICMP or ICMPV6, the port field in "src" of the spidx specifies ICMP type, and the port field in "dst" of the spidx specifies ICMP code. - avoid from applying IPsec transport mode to the packets when the kernel forwards the packets. Tested by: nork Obtained from: KAME
* Remove comment about desire for eventual explicit labeling of ICMPrwatson2003-11-031-4/+0
| | | | | | | header copy made on input path: this is now handled differently. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* add ECN support in layer-3.ume2003-10-291-0/+17
| | | | | | | | | - implement the tunnel egress rule in ip_ecn_egress() in ip_ecn.c. make ip{,6}_ecn_egress() return integer to tell the caller that this packet should be dropped. - handle ECN at fragment reassembly in ip_input.c and frag6.c. Obtained from: KAME
* pfil hooks can modify packet contents so check if the destinationsam2003-10-161-1/+11
| | | | | | | | address has been changed when PFIL_HOOKS is enabled and, if it has, arrange for the proper action by ip*_forward. Supported by: FreeBSD Foundation Submitted by: Pyun YongHyeon
* purge extraneous ';'ssam2003-10-151-3/+3
| | | | | Supported by: FreeBSD Foundation Noticed by: bde
* Lock ip forwarding route cache. While we're at it, remove the globalsam2003-10-141-30/+91
| | | | | | | variable ipforward_rt by introducing an ip_forward_cacheinval() call to use to invalidate the cache. Supported by: FreeBSD Foundation
* remove dangling ';'s` that were harmlesssam2003-10-141-2/+2
| | | | Supported by: FreeBSD Foundation
* o update PFIL_HOOKS support to current API used by netbsdsam2003-09-231-23/+18
| | | | | | | | | | | o revamp IPv4+IPv6+bridge usage to match API changes o remove pfil_head instances from protosw entries (no longer used) o add locking o bump FreeBSD version for 3rd party modules Heavy lifting by: "Max Laier" <max@love2party.net> Supported by: FreeBSD Foundation Obtained from: NetBSD (bits of pfil.h and pfil.c)
* lock ip fragment queuessam2003-09-051-0/+18
| | | | | Submitted by: Robert Watson <rwatson@freebsd.org> Obtained from: BSD/OS
* add IPSEC_FILTERGIF suport for FAST_IPSECsam2003-07-221-0/+7
| | | | | | PR: kern/51922 Submitted by: Eric Masson <e-masson@kisoft-services.com> MFC after: 1 week
* Map icmp time exceeded responses to EHOSTUNREACH rather than 0 (no error);silby2003-06-171-1/+1
| | | | | | | | | this makes connect act more sensibly in these cases. PR: 50839 Submitted by: Barney Wolff <barney@pit.databus.com> Patch delayed by laziness of: silby MFC after: 1 week
* When setting fragment queue pointers to NULL, or comparing them withrwatson2003-06-061-3/+3
| | | | NULL, use NULL rather than 0 to improve readability.
* Trim a call to mac_create_mbuf_from_mbuf() since m_tag meta-datarwatson2003-05-061-5/+2
| | | | | | | | | copying for mbuf headers now works properly in m_dup_pkthdr(), so we don't need to do an explicit copy. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* IP_RECVTTL socket option.mdodd2003-04-291-0/+6
| | | | Reviewed by: Stuart Cheshire <cheshire@apple.com>
* Introduce an M_ASSERTPKTHDR() macro which performs the very common taskdes2003-04-081-2/+1
| | | | | | | of asserting that an mbuf has a packet header. Use it instead of hand- rolled versions wherever applicable. Submitted by: Hiten Pandya <hiten@unixdaemons.com>
* Back out support for RFC3514.mdodd2003-04-021-14/+0
| | | | RFC3514 poses an unacceptale risk to compliant systems.
* Sync constant define with NetBSD.mdodd2003-04-021-1/+1
| | | | Requested by: Tom Spindler <dogcow@babymeat.com>
* Implement support for RFC 3514 (The Security Flag in the IPv4 Header).mdodd2003-04-011-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | (See: ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt) This fulfills the host requirements for userland support by way of the setsockopt() IP_EVIL_INTENT message. There are three sysctl tunables provided to govern system behavior. net.inet.ip.rfc3514: Enables support for rfc3514. As this is an Informational RFC and support is not yet widespread this option is disabled by default. net.inet.ip.hear_no_evil If set the host will discard all received evil packets. net.inet.ip.speak_no_evil If set the host will discard all transmitted evil packets. The IP statistics counter 'ips_evil' (available via 'netstat') provides information on the number of 'evil' packets recieved. For reference, the '-E' option to 'ping' has been provided to demonstrate and test the implementation.
* Modify the mac_init_ipq() MAC Framework entry point to accept anrwatson2003-03-261-1/+4
| | | | | | | | | | | | | additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Update netisr handling; Each SWI now registers its queue, and all queuejlemon2003-03-041-21/+2
| | | | | | | | | | drain routines are done by swi_net, which allows for better queue control at some future point. Packets may also be directly dispatched to a netisr instead of queued, this may be of interest at some installations, but currently defaults to off. Reviewed by: hsu, silby, jayanth, sam Sponsored by: DARPA, NAI Labs
* Fix a condition so that ip reassembly queues are emptied immediatelysilby2003-02-261-1/+1
| | | | | | when maxfragpackets is dropped to 0. Noticed by: bmah
* style(9): join lines.maxim2003-02-251-4/+2
|
* Ip reassembly queue structure has ipq_nfrags now. Count a number ofmaxim2003-02-251-7/+15
| | | | | | dropped ip fragments precisely. Reviewed by: silby
* Add a new config option IPSEC_FILTERGIF to control whether or notsam2003-02-231-0/+7
| | | | | | | | | | | | | | | | | packets coming out of a GIF tunnel are re-processed by ipfw, et. al. By default they are not reprocessed. With the option they are. This reverts 1.214. Prior to that change packets were not re-processed. After they were which caused problems because packets do not have distinguishing characteristics (like a special network if) that allows them to be filtered specially. This is really a stopgap measure designed for immediate MFC so that 4.8 has consistent handling to what was in 4.7. PR: 48159 Reviewed by: Guido van Rooij <guido@gvr.org> MFC after: 1 day
* Add the ability to limit the number of IP fragments allowed per packet,silby2003-02-221-4/+28
| | | | | | | | | | | and enable it by default, with a limit of 16. At the same time, tweak maxfragpackets downward so that in the worst possible case, IP reassembly can use only 1/2 of all mbuf clusters. MFC after: 3 days Reviewed by: hsu Liked by: bmah
* Back out M_* changes, per decision of the TRB.imp2003-02-191-5/+5
| | | | Approved by: trb
* Move a comment and optimize the frag timeout code a slight bit.silby2003-02-011-3/+3
| | | | | Submitted by: maxim MFC with: The previous two revisions
OpenPOWER on IntegriCloud