summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Back out my lats commit of locking down a socket, it conflicts with hsu's work.tanimura2002-05-3115-499/+120
| | | | Requested by: hsu
* Avoid unintentional trigraph.wollman2002-05-301-1/+1
|
* - Change the newly turned INVARIANTS #ifdef blocks (they were changed fromarr2002-05-213-24/+16
| | | | | DIAGNOSTIC yesterday) into KASSERT()'s as these help to increase code readability.
* - Turn a few DIAGNOSTIC into INVARIANTS since they are really sanityarr2002-05-201-3/+3
| | | | checks.
* - Turn a DIAGNOSTIC into an INVARIANTS since it's a sanity check. Usearr2002-05-201-2/+3
| | | | proper ``if'' statement style.
* - Turn a #ifdef DIAGNOSTIC to #ifdef INVARIANTS as the code from this linearr2002-05-201-1/+1
| | | | | | through the #endif is really a sanity check. Reviewed by: jake
* Lock down a socket, milestone 1.tanimura2002-05-2015-120/+499
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o Add a mutex (sb_mtx) to struct sockbuf. This protects the data in a socket buffer. The mutex in the receive buffer also protects the data in struct socket. o Determine the lock strategy for each members in struct socket. o Lock down the following members: - so_count - so_options - so_linger - so_state o Remove *_locked() socket APIs. Make the following socket APIs touching the members above now require a locked socket: - sodisconnect() - soisconnected() - soisconnecting() - soisdisconnected() - soisdisconnecting() - sofree() - soref() - sorele() - sorwakeup() - sotryfree() - sowakeup() - sowwakeup() Reviewed by: alfred
* Reset token-ring source routing control field on receipt of ethernet framekbyanc2002-05-151-0/+1
| | | | | without source routing information. This restores the behaviour in this scenario to that of prior to my last commit.
* Modify the arguments to syncache_socket() to include the mbuf (m) thatrwatson2002-05-141-4/+6
| | | | | | | | | | | | results in the syncache entry being turned into a socket. While it's not used in the main tree, this is required in the MAC tree so that labels can be propagated from the mbuf to the socket. This is also useful if you're doing things like transparent IP connection hijacking and you want to use the syncache/cookie mechanism, but we won't go there. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add ipfw hooks to ether_demux() and ether_output_frame().luigi2002-05-132-5/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ipfw processing of frames at layer 2 can be enabled by the sysctl variable net.link.ether.ipfw=1 Consider this feature experimental, because right now, the firewall is invoked in the places indicated below, and controlled by the sysctl variables listed on the right. As a consequence, a packet can be filtered from 1 to 4 times depending on the path it follows, which might make a ruleset a bit hard to follow. I will add an ipfw option to tell if we want a given rule to apply to ether_demux() and ether_output_frame(), but we have run out of flags in the struct ip_fw so i need to think a bit on how to implement this. to upper layers | | +----------->-----------+ ^ V [ip_input] [ip_output] net.inet.ip.fw.enable=1 | | ^ V [ether_demux] [ether_output_frame] net.link.ether.ipfw=1 | | +->- [bdg_forward]-->---+ net.link.ether.bridge_ipfw=1 ^ V | | to devices
* Remove custom definitions (IP_FW_TCPF_SYN etc.) of TCP header flagsluigi2002-05-132-12/+1
| | | | which are the same as the original ones (TH_SYN etc.)
* Add code to match MAC header fields (at the moment supported onluigi2002-05-121-62/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bridged packets only, soon to come also for packets on ordinary ether_input() and ether_output() paths. The syntax is ipfw add <action> MAC dst src type where dst and src can be "any" or a MAC address optionallyfollowed by a mask, e.g. 10:20:30:40:50 10:20:30:40:50/32 10:20:30:40:50&ff:ff:ff:f0:ff:0f and type can be a single ethernet type, a range, or a type followed by a mask (values are always in hexadecimal) e.g. 0800 0800-0806 0800/8 0800&03ff Note, I am still uncertain on what is the best format for inputting these values, having the values in hexadecimal is convenient in most cases but can be confusing sometimes. Suggestions welcome. Implement suggestion from PR 37778 to allow "not me" on destination and source IP. The code in the PR was slightly wrong and interfered with the normal handling of IP addresses. This version hopefully is correct. Minor cleanup of the code, in some places moving the indentation to 4 spaces because the code was becoming too deep. Eventually, in a separate commit, I will move the whole file to 4 space indent.
* s/demon/daemon/dd2002-05-122-3/+3
|
* Remove some duplicate types that should have been removed as part ofmike2002-05-111-40/+0
| | | | | | the rearranging in the previous revision. Pointy hat to: cvs update (merging), mike (for not noticing)
* Cleanup the interface to ip_fw_chk, two of the input argumentsluigi2002-05-094-104/+108
| | | | | | | | | | | | | | | were totally useless and have been removed. ip_input.c, ip_output.c: Properly initialize the "ip" pointer in case the firewall does an m_pullup() on the packet. Remove some debugging code forgotten long ago. ip_fw.[ch], bridge.c: Prepare the grounds for matching MAC header fields in bridged packets, so we can have 'etherfw' functionality without a lot of kernel and userland bloat.
* Move ISO88025 source routing information into sockaddr_dl's sdl_datakbyanc2002-05-071-8/+7
| | | | | | | | | | | | | | | | | | | | | | | | field. This returns the sdl_data field to a variable-length field. More importantly, this prevents a easily-reproduceable data-corruption bug when the interface name plus the hardware address exceed the sdl_data field's original 12 byte limit. However, token-ring interfaces may still overflow the new sdl_data field's 46 byte limit if the interface name exceeds 6 characters (since 6 characters for interface name plus 6 for hardware address plus 34 for source routing = the size of sdl_data). Further refinements could overcome this limitation but would break binary compatibility; this commit only addresses fixing the bug for commonly-occuring cases without breaking binary compatibility with the intention that the functionality can be MFC'ed to -stable. See message ID's (both send to -arch): 20020421013332.F87395-100000@gateway.posi.net 20020430181359.G11009-300000@gateway.posi.net for a more thorough description of the bug addressed and how to reproduce it. Approved by: silence on -arch and -net Sponsored by: NTT Multimedia Communications Labs MFC after: 1 week
* Revised MLD-related definitionsume2002-05-061-16/+40
| | | | | | | | | | | | - Used mld_xxx and MLD_xxx instead of mld6_xxx and MLD6_xxx according to the official defintions in rfc2292bis (macro definitions for backward compatibility were provided) - Changed the first member of mld_hdr{} from mld_hdr to mld_icmp6_hdr to avoid name space conflict in C++ This change makes ports/net/pchar compilable again under -CURRENT. Obtained from: KAME
* Indentation and comments cleanup, no functional change.luigi2002-05-051-51/+58
| | | | MFC after: 3 days
* Redo the sigio locking.alfred2002-05-014-27/+1
| | | | | | | | | | | Turn the sigio sx into a mutex. Sigio lock is really only needed to protect interrupts from dereferencing the sigio pointer in an object when the sigio itself is being destroyed. In order to do this in the most unintrusive manner change pgsigio's sigio * argument into a **, that way we can lock internally to the function.
* Fix some edge cases where bad string handling could occur.alfred2002-05-011-0/+4
| | | | Submitted by: ps
* cleanup:alfred2002-05-011-37/+46
| | | | fix line wraps, add some comments, fix macro definitions, fix for(;;) loops.
* Enlighten those who read the FINE POINTS of the documentation a bitcjc2002-05-011-2/+6
| | | | | | | | | more on how ipfw(8) deals with tiny fragments. While we're at it, add a quick log message to even let people know we dropped a packet. (Note that the second FINE POINT is somewhat redundant given the first, but since the code is there, leave the docs for it.) MFC after: 1 day
* Revert the change of #includes in sys/filedesc.h and sys/socketvar.h.tanimura2002-04-308-33/+57
| | | | | | | | | | Requested by: bde Since locking sigio_lock is usually followed by calling pgsigio(), move the declaration of sigio_lock and the definitions of SIGIO_*() to sys/signalvar.h. While I am here, sort include files alphabetically, where possible.
* Add a global sx sigio_lock to protect the pointer to the sigio objecttanimura2002-04-274-6/+23
| | | | | | | | | | of a socket. This avoids lock order reversal caused by locking a process in pgsigio(). sowakeup() and the callers of it (sowwakeup, soisconnected, etc.) now require sigio_lock to be locked. Provide sowwakeup_locked(), soisconnected_locked(), and so on in case where we have to modify a socket and wake up a process atomically.
* Rearrange <netinet/in.h> so that it is easier to conditionalizemike2002-04-241-48/+96
| | | | | | sections for various standards. Conditionalize sections for various standards. Use standards conforming spelling for types in the sockaddr_in structure.
* Add sa_family_t type to <sys/_types.h> and typedefs to <netinet/in.h>mike2002-04-201-0/+5
| | | | | and <sys/socket.h>. Previously, sa_family_t was only typedef'd in <sys/socket.h>.
* just merged cosmetic changes from KAME to ease sync between KAME and FreeBSD.suz2002-04-195-6/+15
| | | | | | | (based on freebsd4-snap-20020128) Reviewed by: ume MFC after: 1 week
* initialize local variable explicitlysuz2002-04-111-0/+2
| | | | | | Reviewed by: ume Obtained from: Fujitsu guys MFC after: 1 week
* Remove some ISN generation code which has been unused since thesilby2002-04-104-58/+6
| | | | | | syncache went in. MFC after: 3 days
* Totally nuke IPPORT_USERRESERVED, it is no longer used anywhere, updatesilby2002-04-101-4/+2
| | | | | | | remaining comments to reflect new ephemeral port range. Reminded by: Maxim Konovalov <maxim@macomnet.ru> MFC after: 3 days
* Unconditionalize the definition of INET_ADDRSTRLEN andmike2002-04-101-2/+0
| | | | | INET6_ADDRSTRLEN. Doing this helps expose bogus redefinitions in 3rd party software.
* Remove the code that masks an EEXIST returned from rtinit() whenbrian2002-04-101-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | calling ioctl(SIOC[AS]IFADDR). This allows the following: ifconfig xx0 inet 1.2.3.1 netmask 0xffffff00 ifconfig xx0 inet 1.2.3.17 netmask 0xfffffff0 alias ifconfig xx0 inet 1.2.3.25 netmask 0xfffffff8 alias ifconfig xx0 inet 1.2.3.26 netmask 0xffffffff alias but would (given the above) reject this: ifconfig xx0 inet 1.2.3.27 netmask 0xfffffff8 alias due to the conflicting netmasks. I would assert that it's wrong to mask the EEXIST returned from rtinit() as in the above scenario, the deletion of the 1.2.3.25 address will leave the 1.2.3.27 address as unroutable as it was in the first place. Offered for review on: -arch, -net Discussed with: stephen macmanus <stephenm@bayarea.net> MFC after: 3 weeks
* Don't add host routes for interface addresses of 0.0.0.0/8 -> 0.255.255.255.brian2002-04-101-6/+18
| | | | | | | | | | This change allows bootp to work with more than one interface, at the expense of some rather ``wrong'' looking code. I plan to MFC this in place of luigi's recent #ifdef BOOTP stuff that was committed to this file in -stable, as that's slightly more wrong that this is. Offered for review on: -arch, -net MFC after: 2 weeks
* Change the first argument of prison_xinpcb() to be a thread pointer insteadjhb2002-04-093-6/+5
| | | | of a proc pointer so that prison_xinpcb() can use td_ucred.
* Update comments to reflect the recent ephemeral port rangesilby2002-04-091-3/+4
| | | | | | | change. Noticed by: ru MFC After: 1 day
* Retire this copy; it now lives in sys/net/fddi.h.mdodd2002-04-051-87/+0
|
* Change callers of mtx_init() to pass in an appropriate lock type name. Injhb2002-04-042-2/+2
| | | | | | | most cases NULL is passed, but in some cases such as network driver locks (which use the MTX_NETWORK_LOCK macro) and UMA zone locks, a name is used. Tested on: i386, alpha, sparc64
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-018-15/+14
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* o Implement <sys/_types.h>, a new header for storing types that aremike2002-04-011-10/+27
| | | | | | | | | | | | | | | MI, not required to be a fixed size, and used in multiple headers. This will grow in time, as more things move here from <sys/types.h> and <machine/ansi.h>. o Add missing type definitions (uint16_t and uint32_t) to <arpa/inet.h> and <netinet/in.h>. o Reduce pollution in <sys/types.h> by using `#if _FOO_T_DECLARED' widgets to avoid including <sys/stdint.h>. o Add some missing type definitions to <unistd.h> and note the ones that still need to be added. o Make use of <sys/_types.h> primitives in <grp.h> and <sys/types.h>. Reviewed by: bde
* Fixed some style bugs in the removal of __P(()). Continuation linesbde2002-03-248-15/+14
| | | | | were not outdented to preserve non-KNF lining up of code with parentheses. Switch to KNF formatting.
* Merge from TrustedBSD MAC branch:rwatson2002-03-224-13/+13
| | | | | | | | | | | | | | Move the network code from using cr_cansee() to check whether a socket is visible to a requesting credential to using a new function, cr_canseesocket(), which accepts a subject credential and object socket. Implement cr_canseesocket() so that it does a prison check, a uid check, and add a comment where shortly a MAC hook will go. This will allow MAC policies to seperately instrument the visibility of sockets from the visibility of processes. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Prevent icmp_reflect() from calling ip_output() with a NULL routeru2002-03-223-9/+8
| | | | | | | | | | | | | | pointer which will then result in the allocated route's reference count never being decremented. Just flood ping the localhost and watch refcnt of the 127.0.0.1 route with netstat(1). Submitted by: jayanth Back out ip_output.c,v 1.143 and ip_mroute.c,v 1.69 that allowed ip_output() to be called with a NULL route pointer. The previous paragraph shows why this was a bad idea in the first place. MFC after: 0 days
* Change the ephemeral port range from 1024-5000 to 49152-65535.silby2002-03-221-2/+2
| | | | | | | | | This increases the number of concurrent outgoing connections from ~4000 to ~16000. Other OSes (Solaris, OS X, NetBSD) and many other NAT products have already made this change without ill effects, so we should not run into any problems. MFC after: 1 week
* Send periodic ARP requests when ARP entries for hosts we are sendingorion2002-03-201-0/+15
| | | | | | | | | | to are about to expire. This prevents high packet rate flows from experiencing packet drops at the sender following ARP cache entry timeout. PR: kern/25517 Reviewed by: luigi MFC after: 7 days
* Switch vm_zone.h with uma.h. Change over to uma interfaces.jeff2002-03-208-35/+35
|
* Remove __P.alfred2002-03-1938-261/+260
|
* This is the first part of the new kernel memory allocator. This replacesjeff2002-03-192-2/+3
| | | | | | malloc(9) and vm_zone with a slab like allocator. Reviewed by: arch@
* NAI DBA updaterwatson2002-03-141-1/+1
|
* o Add INET_ADDRSTRLEN and INET6_ADDRSTRLEN defines to <arpa/inet.h>mike2002-03-101-0/+2
| | | | | | | for POSIX.1-2001 conformance. o Add magic to <netinet/in.h> and <netinet6/in6.h> to prevent redefining INET_ADDRSTRLEN and INET6_ADDRSTRLEN. o Add a note about missing typedefs in <arpa/inet.h>.
* o Don't require long long support in bswap64() functions.mike2002-03-091-7/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | o In i386's <machine/endian.h>, macros have some advantages over inlines, so change some inlines to macros. o In i386's <machine/endian.h>, ungarbage collect word_swap_int() (previously __uint16_swap_uint32), it has some uses on i386's with PDP endianness. Submitted by: bde o Move a comment up in <machine/endian.h> that was accidentially moved down a few revisions ago. o Reenable userland's use of optimized inline-asm versions of byteorder(3) functions. o Fix ordering of prototypes vs. redefinition of byteorder(3) functions, so that the non-GCC (libc asm) case has proper prototypes. o Add proper prototypes for byteorder(3) functions in <sys/param.h>. o Prevent redundant duplicate prototypes by making use of the _BYTEORDER_PROTOTYPED define. o Move the bswap16(), bswap32(), bswap64() C functions into MD space for platforms in which asm versions don't exist. This significantly reduces the complexity of some things at the cost of duplicate code. Reviewed by: bde
OpenPOWER on IntegriCloud