summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Sort sections.ru2005-01-201-5/+5
|
* - Reduce number of arguments passed to dummynet_io(), we already have cookieglebius2005-01-163-8/+5
| | | | | in struct ip_fw_args itself. - Remove redundant &= 0xffff from dummynet_io().
* o Clean up interface between ip_fw_chk() and its callers:glebius2005-01-143-82/+109
| | | | | | | | | | | | | | | | - ip_fw_chk() returns action as function return value. Field retval is removed from args structure. Action is not flag any more. It is one of integer constants. - Any action-specific cookies are returned either in new "cookie" field in args structure (dummynet, future netgraph glue), or in mbuf tag attached to packet (divert, tee, some future action). o Convert parsing of return value from ip_fw_chk() in ipfw_check_{in,out}() to a switch structure, so that the functions are more readable, and a future actions can be added with less modifications. Approved by: andre MFC after: 2 months
* Fix a TCP SACK related crash resulting from incorrect computationps2005-01-121-6/+16
| | | | | | | | of len in tcp_output(), in the case where the FIN has already been transmitted. The mis-computation of len is because of a gcc optimization issue, which this change works around. Submitted by: Mohan Srinivasan
* include "alias.h", not <alias.h>brian2005-01-101-1/+1
| | | | MFC after: 3 days
* /* -> /*- for license, minor formatting changesimp2005-01-0767-70/+70
|
* Add a sysctl (net.inet.tcp.insecure_rst) which allows one to specifysilby2005-01-032-2/+14
| | | | | | | that the RFC 793 specification for accepting RST packets should be following. When followed, this makes one vulnerable to the attacks described in "slipping in the window", but it may be necessary in some odd circumstances.
* Port randomization leads to extremely fast port reuse at highsilby2005-01-024-4/+69
| | | | | | | | | | | | | | | | | connection rates, which is causing problems for some users. To retain the security advantage of random ports and ensure correct operation for high connection rate users, disable port randomization during periods of high connection rates. Whenever the connection rate exceeds randomcps (10 by default), randomization will be disabled for randomtime (45 by default) seconds. These thresholds may be tuned via sysctl. Many thanks to Igor Sysoev, who proved the necessity of this change and tested many preliminary versions of the patch. MFC After: 20 seconds
* Remove an errant blank line apparently introduced inrwatson2004-12-251-1/+0
| | | | ip_output.c:1.194.
* In the dropafterack case of tcp_input(), it's OK to release the TCPrwatson2004-12-252-2/+2
| | | | | pcbinfo lock before calling tcp_output(), as holding just the inpcb lock is sufficient to prevent garbage collection.
* Revert parts of tcp_input.c:1.255 associated with the header predictedrwatson2004-12-252-4/+14
| | | | | | | | | | | | | cases for tcp_input(): While it is true that the pcbinfo lock provides a pseudo-reference to inpcbs, both the inpcb and pcbinfo locks are required to free an un-referenced inpcb. As such, we can release the pcbinfo lock as long as the inpcb remains locked with the confidence that it will not be garbage-collected. This leads to a less conservative locking strategy that should reduce contention on the TCP pcbinfo lock. Discussed with: sam
* Attempt to consistently use () around return values in calls torwatson2004-12-232-36/+36
| | | | return() in newer code (sysctl, ISN, timewait).
* Remove an XXXRW comment relating to whether or not the TCP timers arerwatson2004-12-232-12/+2
| | | | | | | | MPSAFE: they are now believed to be. Correct a typo in a second comment. MFC after: 2 weeks
* Remove the now unused tcp_canceltimers() function. tcpcb timers arerwatson2004-12-232-16/+0
| | | | | | now stopped as part of tcp_discardcb(). MFC after: 2 weeks
* Remove an annotation of a minor race relating to the update ofrwatson2004-12-231-7/+0
| | | | | | | | | multiple MIB entries using sysctl in short order, which might result in unexpected values for tcp_maxidle being generated by tcp_slowtimo. In practice, this will not happen, or at least, doesn't require an explicit comment. MFC after: 2 weeks
* In certain cases ip_output() can free our route, so checkglebius2004-12-101-1/+2
| | | | | | for its presence before RTFREE(). Noticed by: ru
* Revert last change.glebius2004-12-101-4/+4
| | | | | | | | | Andre: First lets get major new features into the kernel in a clean and nice way, and then start optimizing. In this case we don't have any obfusication that makes later profiling and/or optimizing difficult in any way. Requested by: csjp, sam
* This commit adds a shared locking mechanism very similar to thecsjp2004-12-101-29/+69
| | | | | | | | | | | | | | | | | | | | mechanism used by pfil. This shared locking mechanism will remove a nasty lock order reversal which occurs when ucred based rules are used which results in hard locks while mpsafenet=1. So this removes the debug.mpsafenet=0 requirement when using ucred based rules with IPFW. It should be noted that this locking mechanism does not guarantee fairness between read and write locks, and that it will favor firewall chain readers over writers. This seemed acceptable since write operations to firewall chains protected by this lock tend to be less frequent than reads. Reviewed by: andre, rwatson Tested by: myself, seanc Silence on: ipfw@ MFC after: 1 month
* Check that DUMMYNET_LOADED before seeking dummynet m_tag.glebius2004-12-091-4/+4
| | | | | Reviewed by: andre MFC after: 1 week
* More fixing of multiple addresses in the same prefix. This time do not trymlaier2004-12-091-2/+20
| | | | | | | | to arp resolve "secondary" local addresses. Found and submitted by: ru With additions from: OpenBSD (rev. 1.47) Reviewed by: ru
* Time out routes created by redirect.ru2004-12-061-1/+4
|
* - Make route cacheing optional, configurable via IFF_LINK0 flag.glebius2004-12-061-0/+6
| | | | | | | | | - Turn it off by default. Requested by: many Reviewed by: andre Approved by: julian (mentor) MFC after: 3 days
* Assert the tcptw inpcb lock in tcp_timer_2msl_reset(), as fields inrwatson2004-12-051-0/+1
| | | | | | the tcptw undergo non-atomic read-modify-writes. MFC after: 2 weeks
* Assert inpcb lock in:rwatson2004-12-052-2/+24
| | | | | | | | | | | | | | tcpip_fillheaders() tcp_discardcb() tcp_close() tcp_notify() tcp_new_isn() tcp_xmit_bandwidth_limit() Fix a locking comment in tcp_twstart(): the pcbinfo will be locked (and is asserted). MFC after: 2 weeks
* Minor grammer fix in comment.rwatson2004-12-051-1/+2
|
* Pass the inpcb reference into ip_getmoptions() rather than just therwatson2004-12-051-6/+14
| | | | | | | | | | inp->inp_moptions pointer, so that ip_getmoptions() can perform necessary locking when doing non-atomic reads. Lock the inpcb by default to copy any data to local variables, then unlock before performing sooptcopyout(). MFC after: 2 weeks
* Define INP_UNLOCK_ASSERT() to assert that an inpcb is unlocked.rwatson2004-12-051-0/+1
| | | | MFC after: 2 weeks
* Push the inpcb argument into ip_setmoptions() when setting IP multicastrwatson2004-12-051-10/+8
| | | | socket options, so that it is available for locking.
* Start working through inpcb locking for ip_ctloutput() by cleaning uprwatson2004-12-051-10/+13
| | | | | | | | | | | | modifications to the inpcb IP options mbuf: - Lock the inpcb before passing it into ip_pcbopts() in order to prevent simulatenous reads and read-modify-writes that could result in races. - Pass the inpcb reference into ip_pcbopts() instead of the option chain pointer in the inpcb. - Assert the inpcb lock in ip_pcbots. - Convert one or two uses of a pointer as a boolean or an integer comparison to a comparison with NULL for readability.
* Fixes a bug in SACK causing us to send data beyond the receive window.ps2004-11-291-2/+4
| | | | | Found by: Pawel Worach and Daniel Hartmeier Submitted by: Mohan Srinivasan mohans at yahoo-inc dot com
* Assert the inpcb lock in tcp_xmit_timer() as it performs read-modify-rwatson2004-11-282-0/+4
| | | | write of various time/rtt-related fields in the tcpcb.
* Expand coverage of the receive socket buffer lock when handling urgentrwatson2004-11-282-4/+6
| | | | | | | | pointer updates: test available space while holding the socket buffer mutex, and continue to hold until until the pointer update has been performed. MFC after: 2 weeks
* Do export the advertised receive window via the tcpi_rcv_space field ofrwatson2004-11-272-1/+2
| | | | struct tcp_info.
* Implement parts of the TCP_INFO socket option as found in Linux 2.6.rwatson2004-11-262-2/+120
| | | | | | | | | | | | | | | This socket option allows processes query a TCP socket for some low level transmission details, such as the current send, bandwidth, and congestion windows. Linux provides a 'struct tcpinfo' structure containing various variables, rather than separate socket options; this makes the API somewhat fragile as it makes it dificult to add new entries of interest as requirements and implementation evolve. As such, I've included a large pad at the end of the structure. Right now, relatively few of the Linux API fields are filled in, and some contain no logical equivilent on FreeBSD. I've include __'d entries in the structure to make it easier to figure ou what is and isn't omitted. This API/ABI should be considered unstable for the time being.
* Fix a problem where our TCP stack would ignore RST packets if the receivesilby2004-11-252-4/+6
| | | | | | | | | | | window was 0 bytes in size. This may have been the cause of unsolved "connection not closing" reports over the years. Thanks to Michiel Boland for providing the fix and providing a concise test program for the problem. Submitted by: Michiel Boland MFC after: 2 weeks
* In tcp_reass(), assert the inpcb lock on the passed tcpcb, since therwatson2004-11-232-24/+38
| | | | | | | | | | | | | contents of the tcpcb are read and modified in volume. In tcp_input(), replace th comparison with 0 with a comparison with NULL. At the 'findpcb', 'dropafterack', and 'dropwithreset' labels in tcp_input(), assert 'headlocked'. Try to improve consistency between various assertions regarding headlocked to be more informative. MFC after: 2 weeks
* tcp_timewait() performs multiple non-atomic reads on the tcptwrwatson2004-11-235-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structure, so assert the inpcb lock associated with the tcptw. Also assert the tcbinfo lock, as tcp_timewait() may call tcp_twclose() or tcp_2msl_rest(), which require it. Since tcp_timewait() is already called with that lock from tcp_input(), this doesn't change current locking, merely documents reasons for it. In tcp_twstart(), assert the tcbinfo lock, as tcp_timer_2msl_rest() is called, which requires that lock. In tcp_twclose(), assert the tcbinfo lock, as tcp_timer_2msl_stop() is called, which requires that lock. Document the locking strategy for the time wait queues in tcp_timer.c, which consists of protecting the time wait queues in the same manner as the tcbinfo structure (using the tcbinfo lock). In tcp_timer_2msl_reset(), assert the tcbinfo lock, as the time wait queues are modified. In tcp_timer_2msl_stop(), assert the tcbinfo lock, as the time wait queues may be modified. In tcp_timer_2msl_tw(), assert the tcbinfo lock, as the time wait queues may be modified. MFC after: 2 weeks
* De-spl tcp_slowtimo; tcp_maxidle assignment is subject to possiblerwatson2004-11-231-15/+11
| | | | | | | | | | | | | | | but unlikely races that could be corrected by having tcp_keepcnt and tcp_keepintvl modifications go through handler functions via sysctl, but probably is not worth doing. Updates to multiple sysctls within evaluation of a single addition are unlikely. Annotate that tcp_canceltimers() is currently unused. De-spl tcp_timer_delack(). De-spl tcp_timer_2msl(). MFC after: 2 weeks
* Assert the inpcb lock in tcp_twstart(), which does both read-modify-writerwatson2004-11-232-0/+20
| | | | | | | | | | | | | | | | | | | on the tcpcb, but also calls into tcp_close() and tcp_twrespond(). Annotate that tcp_twrecycleable() requires the inpcb lock because it does a series of non-atomic reads of the tcpcb, but is currently called without the inpcb lock by the caller. This is a bug. Assert the inpcb lock in tcp_twclose() as it performs a read-modify-write of the timewait structure/inpcb, and calls in_pcbdetach() which requires the lock. Assert the inpcb lock in tcp_twrespond(), as it performs multiple non-atomic reads of the tcptw and inpcb structures, as well as calling mac_create_mbuf_from_inpcb(), tcpip_fillheaders(), which require the inpcb lock. MFC after: 2 weeks
* Assert inpcb lock in tcp_quench(), tcp_drop_syn_sent(), tcp_mtudisc(),rwatson2004-11-232-0/+8
| | | | | | and tcp_drop(), due to read-modify-write of TCP state variables. MFC after: 2 weeks
* Assert the tcbinfo write lock in tcp_new_isn(), as the tcbinfo lockrwatson2004-11-232-8/+22
| | | | | | | | | | | | protects access to the ISN state variables. Acquire the tcbinfo write lock in tcp_isn_tick() to synchronize timer-driven isn bumping. Staticize internal ISN variables since they're not used outside of tcp_subr.c. MFC after: 2 weeks
* Remove "Unlocked read" annotations associated with previously unlockedrwatson2004-11-222-6/+0
| | | | | | | use of socket buffer fields in the TCP input code. These references are now protected by use of the receive socket buffer lock. MFC after: 1 week
* s/send/sent/ in comment describing TCPS_SYN_RECEIVED.rwatson2004-11-211-1/+1
|
* - Since divert protocol is not connection oriented, remove SS_ISCONNECTED flagglebius2004-11-181-33/+0
| | | | | | | | | | | | | from divert sockets. - Remove div_disconnect() method, since it shouldn't be called now. - Remove div_abort() method. It was never called directly, since protocol doesn't have listen queue. It was called only from div_disconnect(), which is removed now. Reviewed by: rwatson, maxim Approved by: julian (mentor) MT5 after: 1 week MT4 after: 1 month
* Fix host route addition for more than one address to a loopback interfacemlaier2004-11-171-1/+1
| | | | | | | | after allowing more than one address with the same prefix. Reported by: Vladimir Grebenschikov <vova NO fbsd SPAM ru> Submitted by: ru (also NetBSD rev. 1.83) Pointyhat to: mlaier
* Merge copyright notices.mlaier2004-11-131-28/+1
| | | | Requested by: njl
* Fix ng_ksocket(4) operation as a divert socket, which is pretty usefulglebius2004-11-121-11/+12
| | | | | | | | | | | | | | | | | | | | and has been broken twice: - in the beginning of div_output() replace KASSERT with assignment, as it was in rev. 1.83. [1] [to be MFCed] - refactor changes introduced in rev. 1.100: do not prepend a new tag unconditionally. Before doing this check whether we have one. [2] A small note for all hacking in this area: when divert socket is not a real userland, but ng_ksocket(4), we receive _the same_ mbufs, that we transmitted to socket. These mbufs have rcvif, the tags we've put on them. And we should treat them correctly. Discussed with: mlaier [1] Silence from: green [2] Reviewed by: maxim Approved by: julian (mentor) MFC after: 1 week
* Change the way we automatically add prefix routes when adding a new address.mlaier2004-11-121-27/+147
| | | | | | | | | | | | | | | | This makes it possible to have more than one address with the same prefix. The first address added is used for the route. On deletion of an address with IFA_ROUTE set, we try to find a "fallback" address and hand over the route if possible. I plan to MFC this in 4 weeks, hence I keep the - now obsolete - argument to in_ifscrub as it must be considered KAPI as it is not static in in.c. I will clean this after the MFC. Discussed on: arch, net Tested by: many testers of the CARP patches Nits from: ru, Andrea Campi <andrea+freebsd_arch webcom it> Obtained from: WIDE via OpenBSD MFC after: 1 month
* Add missing '='phk2004-11-111-1/+1
| | | | Spotted by: obrien
* Fix a double-free in the 'hlen > m->m_len' sanity check.andre2004-11-091-1/+1
| | | | | Bug report by: <james@towardex.com> MFC after: 2 weeks
OpenPOWER on IntegriCloud