| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
so this at least compiles on big-endian machines.
|
|
|
|
|
|
| |
Move to "struct disk *" centered API.
Fix some minor nits.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Security improvements:
- Increase the size of each syncookie secret from 32 to 128 bits
in order to make brute force attacks on the secrets much more
difficult.
- Always return the lowest order dword from the MD5 hash; this
allows us to expose 2 more bits of the cookie and makes ACK
floods which seek to guess the cookie value more difficult.
Performance improvements:
- Increase the lifetime of each syncookie from 4 seconds to 16
seconds. This increases the usefulness of syncookies during
an attack.
- From Yahoo!: Reduce the number of calls to MD5Update; this
results in a ~17% increase in cookie generation time here.
Reviewed by: hsu, jayanth, jlemon, nectar
MFC After: 15 seconds
|
|
|
|
|
|
| |
Move ida driver to "struct disk *" centric api.
Retire major number 109.
|
|
|
|
| |
during attach.
|
| |
|
| |
|
|
|
|
|
|
|
| |
in massive locking issues on diskless systems.
It is also not clear that this sysctl is non-dangerous in its
requirements for locked down memory on large RAM systems.
|
| |
|
| |
|
|
|
|
| |
Pointy hat provided by: sam
|
| |
|
|
|
|
|
|
|
|
|
| |
type M_STRING, now defined in malloc.h. Useful when string parsing
must occur using the kernel strsep() and we want to avoid toasting
the source string.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
|
| |
|
|
|
|
| |
Pointy hat over here!
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
in locore.
- Removed the macros PTESIZE and PDESIZE, use sizeof instead in C.
Sponsored by: DARPA, Network Associates Laboratories
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
should be done in crypto_done rather than in the callback thread
o use this flag to mark operations from /dev/crypto since the callback
routine just does a wakeup; this eliminates the last unneeded ctx switch
o change CRYPTO_F_NODELAY to CRYPTO_F_BATCH with an inverted meaning
so "0" becomes the default/desired setting (needed for user-mode
compatibility with openbsd)
o change crypto_dispatch to honor CRYPTO_F_BATCH instead of always
dispatching immediately
o remove uses of CRYPTO_F_NODELAY
o define COP_F_BATCH for ops submitted through /dev/crypto and pass
this on to the op that is submitted
Similar changes and more eventually coming for asymmetric ops.
MFC if re gives approval.
|
|
|
|
|
|
|
|
|
|
|
| |
branch targets that are too far apart for the BRADDR relocation.
This is caused by the branch prediction optimizationi in the atomic
inlines here, because they jump across sections.
The workaround is to suppress jumping to a different section when
compiling LINT. To generate correct code in that case, the section
directives are replaced by a branch and a label to deal with the
fall-through case. Reasonably good C compilers will optimize this
away anyway, so the end result isn't really that bad.
|
|
|
|
| |
compilation yielded definitions that we're used.
|
|
|
|
|
|
| |
ppc developers for a while.
OK'd by: phk
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
packets coming out of a GIF tunnel are re-processed by ipfw, et. al.
By default they are not reprocessed. With the option they are.
This reverts 1.214. Prior to that change packets were not re-processed.
After they were which caused problems because packets do not have
distinguishing characteristics (like a special network if) that allows
them to be filtered specially.
This is really a stopgap measure designed for immediate MFC so that
4.8 has consistent handling to what was in 4.7.
PR: 48159
Reviewed by: Guido van Rooij <guido@gvr.org>
MFC after: 1 day
|
|
|
|
|
| |
to the last accessed pte page. Thus, the pm_ptphint is redundant and can
be removed.
|
|
|
|
| |
Sponsored by: DARPA, Network Associates Laboratories
|
|
|
|
|
| |
buffer without stopping. Useful if you just want to capture the output but
can't run ktrdump.
|
|
|
|
|
|
|
|
| |
o Make DXS3 the primary playback channel. It may be the only
universally supported channel with the assorted revisions of this
chipset.
o Add sysctl and handler for enabling s/pdif output from DXS3.
|
|
|
|
| |
this may go away in the future.
|
|
|
|
|
|
|
|
| |
tcp_input(). This unbreaks delack handling, while still preserving
correct T/TCP behavior
Tested by: maxim
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
| |
nodes.
Submitted by: green, Hiten Pandya <hiten@unixdaemons.com>
|
|
|
|
|
|
|
|
|
|
|
|
| |
as opposed to one after the other. This is faster in both -CURRENT
and -STABLE. Additionally, there is less code duplication for
error-checking.
One thing to note is that this code seems to return(1) when no buffers
are available; perhaps ENOBUFS should be the correct return value?
Partially submitted & tested by: Hiten Pandya <hiten@unixdaemons.com>
MFC after: 1 week
|
|
|
|
|
| |
to the Attic from where it can be picked up again, should it ever again
become fashionable to run an alpha simulator.
|
|
|
|
| |
Use nullclose() rather than now empty twed_close().
|
| |
|
| |
|
|
|
|
| |
Use noclose() instead now that our close method is empty.
|
| |
|
| |
|
|
|
|
|
|
| |
Move to "struct disk *" centric use of disk_* API.
Remove NOOP ioctl, spl*() and some debug printfs.
|
|
|
|
|
|
|
|
|
|
|
| |
and enable it by default, with a limit of 16.
At the same time, tweak maxfragpackets downward so that in the worst
possible case, IP reassembly can use only 1/2 of all mbuf clusters.
MFC after: 3 days
Reviewed by: hsu
Liked by: bmah
|
|
|
|
| |
Approved by: jhb, markm (mentor)(implicit)
|