summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* - most all includes (#include <>) migrate to the sctp_os_bsd.h filerrs2007-01-1826-777/+175
| | | | | | | | | | | | | | | - Finally all splxx() are removed - Count error fixed in mapping array which might cause a wrong cumack generation. - Invariants around panic for case D + printf when no invariants. - one-to-one model race condition fixed by using a pre-formed connection and then completing the work so accept won't happen on a non-formed association. - Some additional paranoia checks in sctp_output. - Locks that were missing in the accept code. Approved by: gnn
* - Macroizes the V6ONLY flag check.rrs2007-01-1516-227/+392
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Added a short time wait (not used yet) constant - Corrected the type of the crc32c table (it was unsigned long and really is a uint32_t - Got rid of the user of MHeaders until they are truely needed by lower layers. - Fixed an initialization problem in the readq structure (ordering was off). - Found yet another collision bug when the random number generator returns two numbers on one side (during a collision) that are the same. Also added some tracking of cookies that will go away when we know that we have the last collision bug gone. - Fixed an init bug for book_size_scale, that was causing Early FR code to run when it should not. - Fixed a flight size tracking bug that was associated with Early FR but due to above bug also effected all FR's - Fixed it so Max Burst also will apply to Fast Retransmit. - Fixed a bug in the temporary logging code that allowed a static log array overflow - hashinit_flags is now used. - Two last mcopym's were converted to the macro sctp_m_copym that has always been used by all other places - macro sctp_m_copym was converted to upper case. - We now validate sinfo_flags on input (we did not before). - Fixed a bug that prevented a user from sending data and immediately shuting down with one send operation. - Moved to use hashdestroy instead of free() in our macros. - Fixed an init problem in our timed_wait vtag where we did not fully initialize our time-wait blocks. - Timer stops were re-positioned. - A pcb cleanup method was added, however this probably will not be used in BSD.. unless we make module loadable protocols - I think this fixes the mysterious timer bug.. it was a ordering of locks problem in the way we did timers. It now conforms to the timeout(9) manual (except for the _drain part, we had to do this a different way due to locks). - Fixed error return code so we get either CONNREUSED or CONNRESET depending on where one is in progression - Purged an unused clone macro. - Fixed a read erro code issue where we were NOT getting the proper error when the connection was reset. - Purged an unused clone macro. - Fixed a read erro code issue where we were NOT getting the proper error when the connection was reset. Approved by: gnn
* o Increment requests counter right before send out an ARP query actually.maxim2007-01-141-1/+2
| | | | | | | | Otherwise the code could lead to the spurious EHOSTDOWN errors. PR: kern/107807 Submitted by: Dmitrij Tejblum MFC after: 1 month
* Marking this as __packed was needed to get the alignment and offset ofimp2007-01-121-1/+1
| | | | | | | | | | members right. However, it also said it was aligned(1), which meant that gcc generated really bad code. Mark this as aligned(4). This makes things a little faster on arm (a couple percent), but also saves about 30k on the size of the kernel for arm. I talked about doing this with bde, but didn't check with him before the commit, so I'm hesitant say 'reviewed by: bde'.
* Remove two lines that somehow snuck back in after testing.julian2007-01-091-2/+0
| | | | ip is now an argument to the function ipfw_log()
* o One more typo in the comment.maxim2007-01-061-1/+1
| | | | | PR: kern/107609 Submitted by: Dr. Markus Waldeck
* Prevent adding a rule with a nat action in case IPFIREWALL_NAT was not defined.piso2007-01-051-0/+4
| | | | Reviewed: luigi
* Wrap ipfw nat support in a new kernel config option namedpiso2007-01-031-1/+16
| | | | | | | "IPFIREWALL_NAT": this way nat is turned off by default and POLA is preserved. Reviewed by: rwatson
* Remove a bunch of dependencies in the IP header being the first thing in thejulian2007-01-021-57/+94
| | | | | | | | | mbuf. First moves toward being able to cope better with having layer 2 (or other encapsulation data) before the IP header in the packet being examined. More commits to come to round out this functionality. This commit should have no practical effect but clears the way for what is coming. Revirewed by: luigi, yar MFC After: 2 weeks
* Fix typo in comment.imp2007-01-011-1/+1
| | | | Submitted by: remko
* Add comment about udp checksums being off in BSD 4.2 compatibility mode.imp2006-12-311-1/+8
| | | | | Submitted by: Dr. Markus Waldeck PR: kern/106657
* Whitespace fix and remove an extra cast.jhb2006-12-302-2/+4
|
* Summer of Code 2005: improve libalias - part 2 of 2piso2006-12-295-2/+621
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With the second (and last) part of my previous Summer of Code work, we get: -ipfw's in kernel nat -redirect_* and LSNAT support General information about nat syntax and some examples are available in the ipfw (8) man page. The redirect and LSNAT syntax are identical to natd, so please refer to natd (8) man page. To enable in kernel nat in rc.conf, two options were added: o firewall_nat_enable: equivalent to natd_enable o firewall_nat_interface: equivalent to natd_interface Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet to continue being checked by the firewall ruleset after being (de)aliased. NOTA BENE: due to some problems with libalias architecture, in kernel nat won't work with TSO enabled nic, thus you have to disable TSO via ifconfig (ifconfig foo0 -tso). Approved by: glebius (mentor)
* a) macro-ization of all mbuf and random numberrrs2006-12-2916-1315/+1208
| | | | | | | | | | | | | | | | | | access plus timers. This makes the code more portable and able to change out the mbuf or timer system used more easily ;-) b) removal of all use of pkt-hdr's until only the places we need them (before ip_output routines). c) remove a bunch of code not needed due to <b> aka worrying about pkthdr's :-) d) There was one last reorder problem it looks where if a restart occur's and we release and relock (at the point where we setup our alias vtag) we would end up possibly getting the wrong TSN in place. The code that fixed the TSN's just needed to be shifted around BEFORE the release of the lock.. also code that set the state (since this also could contribute). Approved by: gnn
* Some whitespace nits and remove a few casts.jhb2006-12-294-7/+11
|
* o made in kernel libalias mpsafepiso2006-12-156-94/+327
| | | | | | | | o fixed a comment o made in kernel libalias a bit less verbose (disabled automatic logging everytime a new link is added or deleted) Approved by: glebius (mentor)
* 1) Fixes on a number of different collision case LOR's.rrs2006-12-1416-403/+1075
| | | | | | | | 2) Fix all "magic numbers" to be constants. 3) A collision case that would generate two associations to the same peer due to a missing lock is fixed. 4) Added tracking of where timers are stopped. Approved by: gnn
* Fix LOR between the syncache and inpcb locks when MAC is present in thecsjp2006-12-131-43/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes
* In ip6_sprintf no longer use and return one of eight static buffersbz2006-12-121-1/+3
| | | | | | | | | | | for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument. This is the "+ one more change" missed in the original commit. Noticed by: tinderbox Pointy hat to: me (#1)
* MFp4: 92972, 98913 + one more changebz2006-12-124-11/+24
| | | | | | | In ip6_sprintf no longer use and return one of eight static buffers for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument.
* Back out revision 1.264.bms2006-12-101-12/+5
| | | | | | | Fixing the IP accounting issue, if we plan to do so, needs to be better thought out; the 'fix' introduces a hash lookup and a possible kernel panic. Reported by: Mark Tinguely
* Improve style(9) conformance of igmp.c.rwatson2006-12-041-45/+43
|
* Make sure that carp_header is 36 bytes longimp2006-12-011-0/+4
|
* Make libalias.conf parsing a bit smarter.piso2006-12-011-10/+18
| | | | | | | | This closes PR kern/106112. While here, add mbuf's #includes i forgot in the previous commit. Approved by: gleb
* Remove m_megapullup from ng_nat and put it under libalias.piso2006-12-012-0/+41
| | | | Approved by: gleb
* Consistently use #ifdef INET6 rather than mixing and matching withrwatson2006-11-301-21/+19
| | | | | | | | | | #if defined(INET6). Don't comment the end of short #ifdef blocks. Comment cleanup. Line wrap.
* Change error codes returned by protocol operations when an inpcb issam2006-11-221-6/+6
| | | | | | | | | | | | | | | | | | | | marked INP_DROPPED or INP_TIMEWAIT: o return ECONNRESET instead of EINVAL for close, disconnect, shutdown, rcvd, rcvoob, and send operations o return ECONNABORTED instead of EINVAL for accept These changes should reduce confusion in applications since EINVAL is normally interpreted to mean an invalid file descriptor. This change does not conflict with POSIX or other standards I checked. The return of EINVAL has always been possible but rare; it's become more common with recent changes to the socket/inpcb handling and with finer-grained locking and preemption. Note: there are other instances of EINVAL for this state that were left unchanged; they should be reviewed. Reviewed by: rwatson, andre, ru MFC after: 1 month
* Add SCTP as a known upper layer protocol over v6.bz2006-11-131-0/+8
| | | | | | | | We are not yet aware of the protocol internals but this way SCTP traffic over v6 will not be discarded. Reported by: Peter Lei via rrs Tested by: Peter Lei <peterlei cisco.com>
* In a true restart case, the send_lock wasrrs2006-11-115-20/+62
| | | | | | | | | | | | | | | | | | | | | | not being aquired. This meant that when we cleanup the outbound we may have one in transit to be added with the old sequence number. This is bad since then we loose a message :( Also the report_outbound needed to have the right lock when its called which it did not.. I added the lock with of course a flag since we want to have the lock before we call it in the restart case. This also fixed the FIX ME case where, in the cookie collision case, we mark for retransmit any that were bundled with the cookie that was dropped. This also means changes to the output routine so we can assure getting the COOKIE-ACK sent BEFORE we retransmit the Data. Approved by: gnn
* Turns out we would reset the TSN seq counter duringrrs2006-11-117-20/+50
| | | | | | | | | | | | | | | | | | | | | | | a colliding INIT. This if fine except when we have data outstanding... we basically reset it to the previous value it was.. so then we end up assigning the same TSN to two different data chunks. This patch: 1) Finds a missing lock for when we change the stream numbers during COOKIE and INIT-ACK processing.. we were NOT locking the send_buffer.. which COULD cause problems (found by inspection looking for <2>) 2) Fixes a case during a colliding INIT where we incorrectly reset the sending Sequence thus in some cases duplicately assigning a TSN. 3) Additional enhancments to logging so we can see strm/tsn in the receiver AND new tracking to watch what the sender is doing with TSN and STRM seq's. Approved by: gnn
* This patch fixes a LOR that happens during INIT-ACK collision.rrs2006-11-102-9/+17
| | | | | | | | | | | | We were calling select_a_tag() inside sctp_send_initate_ack(). During collision cases we have a stcb and thus a SCTP_LOCK. When we call select_a_tag it (below it) locks the INFO lock. We now 1) pre-select the nonce-tie-tags in sctputil.c during setup of a tcb. 2) In the other case where we have to select tags, we unlock after incr the ref cnt (so assoc won't go away0 and then do the tag selection followed by a relock and decr the refcnt. Approved by: gnn
* Fixes an issue with handling of stream reset. When arrs2006-11-092-4/+3
| | | | | | | | | | reset comes in we need to calculate the length and therefore the number of listed streams (if any) based on the TLV type. Otherwise if we get a retran we could in theory panic by sending a notification to a user with a incorrect list and thus no memory listing the streams. Found in IOS by devtest :-) Approved by: gnn
* -Fixes first of all the getcred on IPv6 and V4. Therrs2006-11-089-167/+138
| | | | | | | | | | | | copy's were incorrect and so was the locking. -A bug was also found that would create a race and panic when an abort arrived on a socket being read from. -Also fix the reader to get MSG_TRUNC when a partial delivery is aborted. -Also addresses a couple of coverity caught error path memory leaks and a couple of other valid complaints Approved by: gnn
* Fix TFTP NAT support by making sure the appropriate fingerprinting checksmarcus2006-11-071-2/+4
| | | | | | are done. Reviewed by: piso
* Convert three new suser(9) calls introduced between when the priv(9)rwatson2006-11-062-4/+11
| | | | | | | | | patch was prepared and committed to priv(9) calls. Add XXX comments as, in each case, the semantics appear to differ from the TCP/UDP versions of the calls with respect to jail, and because cr_canseecred() is not used to validate the query. Obtained from: TrustedBSD Project
* This changes tracks down the EEOR->NonEEOR mode failurerrs2006-11-061-56/+66
| | | | | | | | | | | to wakeup on close of the sender. It basically moves the return (when the asoc has a reader/writer) further down and gets the wakeup and assoc appending (of the PD-API event) moved up before the return. It also moves the flag set right before the return so we can assure only once adding the PD-API events. Approved by: gnn
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-0611-32/+101
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Revert previous commit, and instead make the expression in rev. 1.2ru2006-11-051-1/+1
| | | | | | match the style of this file. OK'ed by: rrs
* Tons of fixes to get all the 64bit issues removed.rrs2006-11-0510-69/+86
| | | | | | | | | This also moves two 16 bit int's to become 32 bit values so we do not have to use atomic_add_16. Most of the changes are %p, casts and other various nasty's that were in the orignal code base. With this commit my machine will now do a build universe.. however I as yet have not tested on a 64bit machine .. it may not work :-(
* Fix pointer arithmetic to be 64-bit friendly.ru2006-11-041-1/+1
|
* Remove bogus casts that Randall for some reason didn't borrowru2006-11-042-2/+2
| | | | from my supplied patch.
* Remove a bogus cast in an attempt to fix the tinderbox builds onjb2006-11-041-2/+2
| | | | lots of arches.
* More 64 bit pointer fun.rrs2006-11-035-7/+7
| | | | | %p changed in multiple prints the mtod() was also fixed.
* Fix two of the 64bit errors on the printfs.rrs2006-11-031-4/+2
|
* Somehow I missed this one. The sys/cdef.h was outrrs2006-11-031-1/+2
| | | | of order with respect to the FSBID..
* Opps... in my fix up of all the $FreeBSD:$-> $FreeBSD$ Irrs2006-11-033-1/+3
| | | | | | | | | | inserted a few to the new files.. but I falied to add the #include <sys/cdef.h> Which causes a compile error.. sorry about that... got it now :-) Approved by:gnn
* Ok, here it is, we finally add SCTP to current. Note that thisrrs2006-11-0333-0/+52679
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | work is not just mine, but it is also the works of Peter Lei and Michael Tuexen. They both are my two key other developers working on the project.. and they need ata-boy's too: **** peterlei@cisco.com tuexen@fh-muenster.de **** I did do a make sysent which updated the syscall's and sysproto.. I hope that is correct... without it you don't build since we have new syscalls for SCTP :-0 So go out and look at the NOTES, add option SCTP (make sure inet and inet6 are present too) and play with SCTP. I will see about comitting some test tools I have after I figure out where I should place them. I also have a lib (libsctp.a) that adds some of the missing socketapi functions that I need to put into lib's.. I will talk to George about this :-) There may still be some 64 bit issues in here, none of us have a 64 bit processor to test with yet.. Michael may have a MAC but thats another beast too.. If you have a mac and want to use SCTP contact Michael he maintains a web site with a loadable module with this code :-) Reviewed by: gnn Approved by: gnn
* - Use non-recursive mutex. MTX_RECURSE is unnecessary since rev. 1.70oleg2006-10-291-34/+31
| | | | | | | | | | | | - Pay respect to net.isr.direct: use netisr_dispatch() instead of ip_input() Reviewed by: glebius, rwatson - purge_flow_set(): - Do not leak memory while purging queues which are not bound to pipe. - style(9) cleanup MFC after: 2 months
* - Convertoleg2006-10-271-5/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | net.inet.ip.dummynet.curr_time net.inet.ip.dummynet.searches net.inet.ip.dummynet.search_steps to SYSCTL_LONG nodes. It will prevent frequent wrap around on 64bit archs. - Implement simple mechanics for dummynet(4) internal time correction. Under certain circumstances (system high load, dummynet lock contention, etc) dummynet's tick counter can be significantly slower than it should be. (I've observed up to 25% difference on one of my production servers). Since this counter used for packet scheduling, it's accuracy is vital for precise bandwidth limitation. Introduce new sysctl nodes: net.inet.ip.dummynet. tick_lost - number of ticks coalesced by taskqueue thread. tick_adjustment - number of time corrections done. tick_diff - adjusted vs non-adjusted tick counter difference tick_delta - last vs 'standard' tick differnece (usec). tick_delta_sum - accumulated (and not corrected yet) time difference (usec). Reviewed by: glebius MFC after: 2 month
* Use separate thread for servicing dummynet(4).oleg2006-10-271-3/+32
| | | | | | | Utilize taskqueue(9) API. Submitted by: glebius MFC after: 2 month
OpenPOWER on IntegriCloud