summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Use __packed instead of __attribute__((__packed__)).mux2003-03-221-1/+3
|
* Add a sysctl node allowing the specification of an address mask to usemdodd2003-03-211-2/+9
| | | | when replying to ICMP Address Mask Request packets.
* Add comments regarding the ICMP timestamp fields.mdodd2003-03-211-4/+4
|
* Add a 'verrevpath' option that verifies the interface that a packetcjc2003-03-152-0/+52
| | | | | | | | | comes in on is the same interface that we would route out of to get to the packet's source address. Essentially automates an anti-spoofing check using the information in the routing table. Experimental. The usage and rule format for the feature may still be subject to change.
* Greatly simplify the unlocking logic by holding the TCP protocol lock untilhsu2003-03-132-16/+4
| | | | | | after FIN_WAIT_2 processing. Helped with debugging: Doug Barton
* Add support for RFC 3390, which allows for a variable-sizedhsu2003-03-132-4/+18
| | | | initial congestion window.
* Implement the Limited Transmit algorithm (RFC 3042).hsu2003-03-122-0/+28
|
* correct two more flag misuses; m_tag* use malloc flagssam2003-03-121-1/+1
|
* Remove check for t_state == TCPS_TIME_WAIT and introduce the tw structure.jlemon2003-03-081-13/+15
| | | | Sponsored by: DARPA, NAI Labs
* Remove a panic(); if the zone allocator can't provide more timewaitjlemon2003-03-087-73/+116
| | | | | | | structures, reuse the oldest one. Also move the expiry timer from a per-structure callout to the tcp slow timer. Sponsored by: DARPA, NAI Labs
* Finish driving a stake through the heart of netns and the associatedpeter2003-03-052-24/+0
| | | | | | ifdefs scattered around the place - its dead Jim! The SMB stuff had stolen AF_NS, make it official.
* Update netisr handling; Each SWI now registers its queue, and all queuejlemon2003-03-046-92/+46
| | | | | | | | | | drain routines are done by swi_net, which allows for better queue control at some future point. Packets may also be directly dispatched to a netisr instead of queued, this may be of interest at some installations, but currently defaults to off. Reviewed by: hsu, silby, jayanth, sam Sponsored by: DARPA, NAI Labs
* More low-hanging fruit: kill caddr_t in calls to wakeup(9) / [mt]sleep(9).des2003-03-022-2/+2
|
* In timewait state, if the incoming segment is a pure in-sequence ackjlemon2003-02-262-4/+8
| | | | | | | | | that matches snd_max, then do not respond with an ack, just drop the segment. This fixes a problem where a simultaneous close results in an ack loop between two time-wait states. Test case supplied by: Tim Robbins <tjr@FreeBSD.ORG> Sponsored by: DARPA, NAI Labs
* The TCP protocol lock may still be held if the reassembly queue dropped FIN.jlemon2003-02-262-2/+4
| | | | | | Detect this case and drop the lock accordingly. Sponsored by: DARPA, NAI Labs
* Fix a condition so that ip reassembly queues are emptied immediatelysilby2003-02-261-1/+1
| | | | | | when maxfragpackets is dropped to 0. Noticed by: bmah
* When generating a TCP response to a connection, not only test if therwatson2003-02-252-2/+2
| | | | | | | | | | tcpcb is NULL, but also its connected inpcb, since we now allow elements of a TCP connection to hang around after other state, such as the socket, has been recycled. Tested by: dcs Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* style(9): join lines.maxim2003-02-251-4/+2
|
* Ip reassembly queue structure has ipq_nfrags now. Count a number ofmaxim2003-02-251-7/+15
| | | | | | dropped ip fragments precisely. Reviewed by: silby
* Hold the TCP protocol lock while modifying the connection hash table.hsu2003-02-251-4/+4
|
* Fix a comment which didn't match the new cookie behavior.silby2003-02-241-1/+1
| | | | | Submitted by: Scott Renfro <scott@renfro.org> MFC after: 1 day
* tcp_twstart() need to be called with the TCP protocol lock held to avoidhsu2003-02-242-12/+16
| | | | a race condition with the TCP timer routines.
* Pass the right function to callout_reset() for a compressedhsu2003-02-242-2/+2
| | | | TIME-WAIT control block.
* Improve the security and performance of syncookies:silby2003-02-231-26/+47
| | | | | | | | | | | | | | | | | | | | Security improvements: - Increase the size of each syncookie secret from 32 to 128 bits in order to make brute force attacks on the secrets much more difficult. - Always return the lowest order dword from the MD5 hash; this allows us to expose 2 more bits of the cookie and makes ACK floods which seek to guess the cookie value more difficult. Performance improvements: - Increase the lifetime of each syncookie from 4 seconds to 16 seconds. This increases the usefulness of syncookies during an attack. - From Yahoo!: Reduce the number of calls to MD5Update; this results in a ~17% increase in cookie generation time here. Reviewed by: hsu, jayanth, jlemon, nectar MFC After: 15 seconds
* Yesterday just wasn't my day. Remove testing delta that crept into the diff.jlemon2003-02-232-2/+2
| | | | Pointy hat provided by: sam
* Add a new config option IPSEC_FILTERGIF to control whether or notsam2003-02-231-0/+7
| | | | | | | | | | | | | | | | | packets coming out of a GIF tunnel are re-processed by ipfw, et. al. By default they are not reprocessed. With the option they are. This reverts 1.214. Prior to that change packets were not re-processed. After they were which caused problems because packets do not have distinguishing characteristics (like a special network if) that allows them to be filtered specially. This is really a stopgap measure designed for immediate MFC so that 4.8 has consistent handling to what was in 4.7. PR: 48159 Reviewed by: Guido van Rooij <guido@gvr.org> MFC after: 1 day
* Check to see if the TF_DELACK flag is set before returning fromjlemon2003-02-222-16/+14
| | | | | | | | tcp_input(). This unbreaks delack handling, while still preserving correct T/TCP behavior Tested by: maxim Sponsored by: DARPA, NAI Labs
* Add the ability to limit the number of IP fragments allowed per packet,silby2003-02-222-4/+29
| | | | | | | | | | | and enable it by default, with a limit of 16. At the same time, tweak maxfragpackets downward so that in the worst possible case, IP reassembly can use only 1/2 of all mbuf clusters. MFC after: 3 days Reviewed by: hsu Liked by: bmah
* - m = m_gethdr(M_NOWAIT, MT_HEADER);phk2003-02-212-2/+2
| | | | | | + m = m_gethdr(M_DONTWAIT, MT_HEADER); 'nuff said.
* The ancient and outdated concept of "privileged ports" in UNIX-typecjc2003-02-211-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | OSes has probably caused more problems than it ever solved. Allow the user to retire the old behavior by specifying their own privileged range with, net.inet.ip.portrange.reservedhigh default = IPPORT_RESERVED - 1 net.inet.ip.portrange.reservedlo default = 0 Now you can run that webserver without ever needing root at all. Or just imagine, an ftpd that can really drop privileges, rather than just set the euid, and still do PORT data transfers from 20/tcp. Two edge cases to note, # sysctl net.inet.ip.portrange.reservedhigh=0 Opens all ports to everyone, and, # sysctl net.inet.ip.portrange.reservedhigh=65535 Locks all network activity to root only (which could actually have been achieved before with ipfw(8), but is somewhat more complicated). For those who stick to the old religion that 0-1023 belong to root and root alone, don't touch the knobs (or even lock them by raising securelevel(8)), and nothing changes.
* Remove unused variables in the IPSEC case.jlemon2003-02-201-1/+0
| | | | Submitted by: Lars Eggert <larse@ISI.EDU>
* Unbreak non-IPV6 compilation.jlemon2003-02-192-8/+20
| | | | | Caught by: phk Sponsored by: DARPA, NAI Labs
* Add a TCP TIMEWAIT state which uses less space than a fullblown TCPjlemon2003-02-1911-162/+984
| | | | | | | | control block. Allow the socket and tcpcb structures to be freed earlier than inpcb. Update code to understand an inp w/o a socket. Reviewed by: hsu, silby, jayanth Sponsored by: DARPA, NAI Labs
* Convert tcp_fillheaders(tp, ...) -> tcpip_fillheaders(inp, ...) so thejlemon2003-02-195-82/+71
| | | | | | | | routine does not require a tcpcb to operate. Since we no longer keep template mbufs around, move pseudo checksum out of this routine, and merge it with the length update. Sponsored by: DARPA, NAI Labs
* Correct comments.jlemon2003-02-192-14/+8
|
* Clean up delayed acks and T/TCP interactions:jlemon2003-02-193-59/+58
| | | | | | | | - delay acks for T/TCP regardless of delack setting - fix bug where a single pass through tcp_input might not delay acks - use callout_active() instead of callout_pending() Sponsored by: DARPA, NAI Labs
* Back out M_* changes, per decision of the TRB.imp2003-02-1919-43/+43
| | | | Approved by: trb
* o Fix ipfw uid rules: socheckuid() returns 0 when uid matches a socketmaxim2003-02-171-2/+2
| | | | | | | | | | | | cr_uid. Note: we do not have socheckuid() in RELENG_4, ip_fw2.c uses its own macro for a similar purpose that is why ipfw2 in RELENG_4 processes uid rules correctly. I will MFC the diff for code consistency. Reported by: Oleg Baranov <ol@csa.ru> Reviewed by: luigi MFC after: 1 month
* Take advantage of pre-existing lock-free synchronization and type stable memoryhsu2003-02-153-11/+10
| | | | to avoid acquiring SMP locks during expensive copyout process.
* The protocol lock is always held in the dropafterack case, so we don'thsu2003-02-132-4/+4
| | | | need to check for it at runtime.
* in_pcbnotifyall() requires an exclusive protocol lock for notify functionshsu2003-02-121-7/+7
| | | | which modify the connection list, namely, tcp_notify().
* Properly document that syncache timer processing requires anhsu2003-02-121-3/+3
| | | | exclusive TCP protocol lock.
* s/IPSSEC/IPSEC/tanimura2003-02-111-1/+1
|
* Get cosmetic changes out of the way before I add routing table SMP locks.hsu2003-02-101-56/+47
|
* Avoid multiply for preemptive arp calculation since it hits everyorion2003-02-081-6/+7
| | | | | | ethernet packet sent. Prompted by: Jeffrey Hsu <hsu@FreeBSD.org>
* MFS 1.64.2.22: Re-enable non pre-emptive ARP requests.orion2003-02-041-14/+15
| | | | | Submitted by: "Diomidis Spinellis" <dds@aueb.gr> PR: kern/46116
* Add the TCP flags to the log message whenever log_in_vain is 1, notcjc2003-02-022-16/+6
| | | | | | | just when set to 2. PR: kern/43348 MFC after: 5 days
* Move a comment and optimize the frag timeout code a slight bit.silby2003-02-011-3/+3
| | | | | Submitted by: maxim MFC with: The previous two revisions
* FAST_IPSEC bandaid: act like KAME and ignore ENOENT error codes fromsam2003-01-301-0/+9
| | | | | | | ipsec4_process_packet; they happen when a packet is dropped because an SA acquire is initiated Submitted by: Doug Ambrisko <ambrisko@verniernetworks.com>
* remove the restriction on build a kernel with FAST_IPSEC and INET6;sam2003-01-301-3/+0
| | | | | | you still don't want to use the two together, but it's ok to have them in the same kernel (the problem that initiated this bandaid has long since been fixed)
OpenPOWER on IntegriCloud