summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Compensate for decreasing the minimum retransmit timeout.hsu2003-06-041-2/+2
| | | | Reviewed by: jlemon
* Change handling to support strong alignment architectures such as alpha andticso2003-06-043-11/+40
| | | | | | | | sparc64. PR: alpha/50658 Submitted by: rizzo Tested on: alpha
* Account for packets processed at layer-2 (i.e. net.link.ether.ipfw=1).kbyanc2003-06-021-3/+6
| | | | MFC after: 2 weeks
* A new API function PacketAliasRedirectDynamic() can be usedru2003-06-013-1/+36
| | | | | to mark a fully specified static link as dynamic; i.e. make it a one-time link.
* Make the PacketAliasSetAddress() function call optional. If itru2003-06-012-11/+18
| | | | | | is not called, and no static rules match an outgoing packet, the latter retains its source IP address. This is in support of the "static NAT only" mode.
* Remove unused variables.phk2003-06-011-15/+3
| | | | Found by: FlexeLint
* Add /* FALLTHROUGH */phk2003-05-312-0/+2
| | | | Found by: FlexeLint
* Don't generate an ip_id for packets with the DF bit set; ip_id iswollman2003-05-311-4/+17
| | | | | | | | | | | | only meaningful for fragments. Also don't bother to byte-swap the ip_id when we do generate it; it is only used at the receiver as a nonce. I tried several different permutations of this code with no measurable difference to each other or to the unmodified version, so I've settled on the one for which gcc seems to generate the best code. (If anyone cares to microoptimize this differently for an architecture where it actually matters, feel free.) Suggested by: Steve Bellovin's paper in IMW'02
* Correct a bug introduced with reduced TCP state handling; makerwatson2003-05-075-9/+39
| | | | | | | | | | | | | | | | | | | sure that the MAC label on TCP responses during TIMEWAIT is properly set from either the socket (if available), or the mbuf that it's responding to. Unfortunately, this is made somewhat difficult by the TCP code, as tcp_twstart() calls tcp_twrespond() after discarding the socket but without a reference to the mbuf that causes the "response". Passing both the socket and the mbuf works arounds this--eventually it might be good to make sure the mbuf always gets passed in in "response" scenarios but working through this provided to complicate things too much. Approved by: re (scottl) Reviewed by: hsu Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Trim a call to mac_create_mbuf_from_mbuf() since m_tag meta-datarwatson2003-05-061-5/+2
| | | | | | | | | copying for mbuf headers now works properly in m_dup_pkthdr(), so we don't need to do an explicit copy. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add definitions for IN6ADDR_LINKLOCAL_ALLMDNS_INIT and INADDR_ALLMDNS_GROUP.mdodd2003-04-291-0/+1
|
* IP_RECVTTL socket option.mdodd2003-04-294-1/+20
| | | | Reviewed by: Stuart Cheshire <cheshire@apple.com>
* Deprecate machine/limits.h in favor of new sys/limits.h.kan2003-04-291-2/+1
| | | | | | | Change all in-tree consumers to include <sys/limits.h> Discussed on: standards@ Partially submitted by: Craig Rodrigues <rodrigc@attbi.com>
* Explicitly declare 'int' parameters.obrien2003-04-212-0/+2
|
* style.Makefile(5)obrien2003-04-201-7/+6
|
* Rename MBUF_FRAG_TEST to MBUF_STRESS_TEST as it will be extendedsilby2003-04-121-3/+3
| | | | to include more than just frag tests.
* Remove a potential panic condition introduced by reduced TCP waitrwatson2003-04-102-10/+30
| | | | | | | | | | | | | | | | | | state. Those changed attempted to work around the changed invariant that inp->in_socket was sometimes now NULL, but the logic wasn't quite right, meaning that inp->in_socket would be dereferenced by cr_canseesocket() if security.bsd.see_other_uids, jail, or MAC were in use. Attempt to clarify and correct the logic. Note: the work-around originally introduced with the reduced TCP wait state handling to use cr_cansee() instead of cr_canseesocket() in this case isn't really right, although it "Does the right thing" for most of the cases in the base system. We'll need to address this at some point in the future. Pointed out by: dcs Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce an M_ASSERTPKTHDR() macro which performs the very common taskdes2003-04-084-6/+4
| | | | | | | of asserting that an mbuf has a packet header. Use it instead of hand- rolled versions wherever applicable. Submitted by: Hiten Pandya <hiten@unixdaemons.com>
* Replace memcpy() and ovbcopy() with bcopy(); ditch some caddr_t usage.des2003-04-041-7/+6
|
* Back out support for RFC3514.mdodd2003-04-026-49/+1
| | | | RFC3514 poses an unacceptale risk to compliant systems.
* - Use the correct constant define.mdodd2003-04-021-2/+3
| | | | - Add a missing break.
* Sync constant define with NetBSD.mdodd2003-04-023-6/+7
| | | | Requested by: Tom Spindler <dogcow@babymeat.com>
* Observe conservation of packets when entering Fast Recovery whilehsu2003-04-013-6/+43
| | | | | | | | | doing Limited Transmit. Only artificially inflate the congestion window by 1 segment instead of the usual 3 to take into account the 2 already sent by Limited Transmit. Approved in principle by: Mark Allman <mallman@grc.nasa.gov>, Hari Balakrishnan <hari@nms.lcs.mit.edu>, Sally Floyd <floyd@icir.org>
* Implement support for RFC 3514 (The Security Flag in the IPv4 Header).mdodd2003-04-016-1/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | (See: ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt) This fulfills the host requirements for userland support by way of the setsockopt() IP_EVIL_INTENT message. There are three sysctl tunables provided to govern system behavior. net.inet.ip.rfc3514: Enables support for rfc3514. As this is an Informational RFC and support is not yet widespread this option is disabled by default. net.inet.ip.hear_no_evil If set the host will discard all received evil packets. net.inet.ip.speak_no_evil If set the host will discard all transmitted evil packets. The IP statistics counter 'ips_evil' (available via 'netstat') provides information on the number of 'evil' packets recieved. For reference, the '-E' option to 'ping' has been provided to demonstrate and test the implementation.
* Fix indentation.maxim2003-03-271-2/+2
|
* o Protect set_fs_param() by splimp(9).maxim2003-03-272-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quote from kern/37573: There is an obvious race in netinet/ip_dummynet.c:config_pipe(). Interrupts are not blocked when changing the params of an existing pipe. The specific crash observed: ... -> config_pipe -> set_fs_parms -> config_red malloc a new w_q_lookup table but take an interrupt before intializing it, interrupt handler does: ... -> dummynet_io -> red_drops red_drops dereferences the uninitialized (zeroed) w_q_lookup table. o Flush accumulated credits for idle pipes. o Flush accumulated credits when change pipe characteristics. o Change dn_flow_queue.numbytes type to unsigned long. Overlapping dn_flow_queue->numbytes in ready_event() leads to numbytes becomes negative and SET_TICKS() macro returns a very big value. heap_insert() overlaps dn_key again and inserts a queue to a ready heap with a sched_time points to the past. That leads to an "infinity" loop. PR: kern/33234, kern/37573, misc/42459, kern/43133, kern/44045, kern/48099 Submitted by: Mike Hibler <mike@cs.utah.edu> (kern/37573) MFC after: 6 weeks
* Modify the mac_init_ipq() MAC Framework entry point to accept anrwatson2003-03-261-1/+4
| | | | | | | | | | | | | additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Try to make the MBUF_FRAG_TEST code work better.mux2003-03-251-12/+10
| | | | | | | | | | | | | | | | - Don't try to fragment the packet if it's smaller than mbuf_frag_size. - Preserve the size of the mbuf chain which is modified by m_split(). - Check that m_split() didn't return NULL. - Make it so we don't end up with two M_PKTHDR mbuf in the chain. - Use m->m_pkthdr.len instead of m->m_len so that we fragment the whole chain and not just the first mbuf. - Fix a nearby style bug and rework the logic of the loops so that it's more clear. This is still not quite right, because we're clearly abusing m_split() to do something it was not designed for, but at least it works now. We should probably move this code into a m_fragment() function when it's correct.
* Add the MBUF_FRAG_TEST option. When compiled in, this optionsilby2003-03-251-0/+30
| | | | | | | | | | allows you to tell ip_output to fragment all outgoing packets into mbuf fragments of size net.inet.ip.mbuf_frag_size bytes. This is an excellent way to test if network drivers can properly handle long mbuf chains being passed to them. net.inet.ip.mbuf_frag_size defaults to 0 (no fragmentation) so that you can at least boot before your network driver dies. :)
* Use __packed instead of __attribute__((__packed__)).mux2003-03-221-1/+3
|
* Add a sysctl node allowing the specification of an address mask to usemdodd2003-03-211-2/+9
| | | | when replying to ICMP Address Mask Request packets.
* Add comments regarding the ICMP timestamp fields.mdodd2003-03-211-4/+4
|
* Add a 'verrevpath' option that verifies the interface that a packetcjc2003-03-152-0/+52
| | | | | | | | | comes in on is the same interface that we would route out of to get to the packet's source address. Essentially automates an anti-spoofing check using the information in the routing table. Experimental. The usage and rule format for the feature may still be subject to change.
* Greatly simplify the unlocking logic by holding the TCP protocol lock untilhsu2003-03-132-16/+4
| | | | | | after FIN_WAIT_2 processing. Helped with debugging: Doug Barton
* Add support for RFC 3390, which allows for a variable-sizedhsu2003-03-132-4/+18
| | | | initial congestion window.
* Implement the Limited Transmit algorithm (RFC 3042).hsu2003-03-122-0/+28
|
* correct two more flag misuses; m_tag* use malloc flagssam2003-03-121-1/+1
|
* Remove check for t_state == TCPS_TIME_WAIT and introduce the tw structure.jlemon2003-03-081-13/+15
| | | | Sponsored by: DARPA, NAI Labs
* Remove a panic(); if the zone allocator can't provide more timewaitjlemon2003-03-087-73/+116
| | | | | | | structures, reuse the oldest one. Also move the expiry timer from a per-structure callout to the tcp slow timer. Sponsored by: DARPA, NAI Labs
* Finish driving a stake through the heart of netns and the associatedpeter2003-03-052-24/+0
| | | | | | ifdefs scattered around the place - its dead Jim! The SMB stuff had stolen AF_NS, make it official.
* Update netisr handling; Each SWI now registers its queue, and all queuejlemon2003-03-046-92/+46
| | | | | | | | | | drain routines are done by swi_net, which allows for better queue control at some future point. Packets may also be directly dispatched to a netisr instead of queued, this may be of interest at some installations, but currently defaults to off. Reviewed by: hsu, silby, jayanth, sam Sponsored by: DARPA, NAI Labs
* More low-hanging fruit: kill caddr_t in calls to wakeup(9) / [mt]sleep(9).des2003-03-022-2/+2
|
* In timewait state, if the incoming segment is a pure in-sequence ackjlemon2003-02-262-4/+8
| | | | | | | | | that matches snd_max, then do not respond with an ack, just drop the segment. This fixes a problem where a simultaneous close results in an ack loop between two time-wait states. Test case supplied by: Tim Robbins <tjr@FreeBSD.ORG> Sponsored by: DARPA, NAI Labs
* The TCP protocol lock may still be held if the reassembly queue dropped FIN.jlemon2003-02-262-2/+4
| | | | | | Detect this case and drop the lock accordingly. Sponsored by: DARPA, NAI Labs
* Fix a condition so that ip reassembly queues are emptied immediatelysilby2003-02-261-1/+1
| | | | | | when maxfragpackets is dropped to 0. Noticed by: bmah
* When generating a TCP response to a connection, not only test if therwatson2003-02-252-2/+2
| | | | | | | | | | tcpcb is NULL, but also its connected inpcb, since we now allow elements of a TCP connection to hang around after other state, such as the socket, has been recycled. Tested by: dcs Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* style(9): join lines.maxim2003-02-251-4/+2
|
* Ip reassembly queue structure has ipq_nfrags now. Count a number ofmaxim2003-02-251-7/+15
| | | | | | dropped ip fragments precisely. Reviewed by: silby
* Hold the TCP protocol lock while modifying the connection hash table.hsu2003-02-251-4/+4
|
* Fix a comment which didn't match the new cookie behavior.silby2003-02-241-1/+1
| | | | | Submitted by: Scott Renfro <scott@renfro.org> MFC after: 1 day
OpenPOWER on IntegriCloud