summaryrefslogtreecommitdiffstats
path: root/usr.bin/netstat
Commit message (Collapse)AuthorAgeFilesLines
* MFC r323016:bapt2017-12-261-3/+2
| | | | | | | | | | | | | | Don't call kresolv_list() if using netstat on live kernel kresolve_list() is calling many kldsym(2). Removing that call on when collecting stats for the running kernel improves the startup time and CPU usage. Submitted by: Nikita Kozlov (nikita.kozlov@blade-group.com) Reviewed by: cem Sponsored by: blade Differential Revision: https://reviews.freebsd.org/D12151 (cherry picked from commit aa98cc7cdb93fdc3a50701017b337926acf32e58)
* MFC 318996: Add descriptions for AES-GCM IPSec authentication (AH) counters.jhb2017-06-201-0/+9
| | | | | Approved by: re (gjb) Sponsored by: Chelsio Communications
* MFC r316610:asomers2017-04-281-2/+2
| | | | | | | | usr.bin/netstat: strcpy -> strlcpy Reported by: Coverity CID: 1006741, 1006744 Sponsored by: Spectra Logic Corp
* MFC r304572 (by bz):ae2017-03-181-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the kernel optoion for IPSEC_FILTERTUNNEL, which was deprecated more than 7 years ago in favour of a sysctl in r192648. MFC r305122: Remove redundant sanity checks from ipsec[46]_common_input_cb(). This check already has been done in the each protocol callback. MFC r309144,309174,309201 (by fabient): IPsec RFC6479 support for replay window sizes up to 2^32 - 32 packets. Since the previous algorithm, based on bit shifting, does not scale with large replay windows, the algorithm used here is based on RFC 6479: IPsec Anti-Replay Algorithm without Bit Shifting. The replay window will be fast to be updated, but will cost as many bits in RAM as its size. The previous implementation did not provide a lock on the replay window, which may lead to replay issues. Obtained from: emeric.poupon@stormshield.eu Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D8468 MFC r309143,309146 (by fabient): In a dual processor system (2*6 cores) during IPSec throughput tests, we see a lot of contention on the arc4 lock, used to generate the IV of the ESP output packets. The idea of this patch is to split this mutex in order to reduce the contention on this lock. Update r309143 to prevent false sharing. Reviewed by: delphij, markm, ache Approved by: so Obtained from: emeric.poupon@stormshield.eu Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D8130 MFC r313330: Merge projects/ipsec into head/. Small summary ------------- o Almost all IPsec releated code was moved into sys/netipsec. o New kernel modules added: ipsec.ko and tcpmd5.ko. New kernel option IPSEC_SUPPORT added. It enables support for loading and unloading of ipsec.ko and tcpmd5.ko kernel modules. o IPSEC_NAT_T option was removed. Now NAT-T support is enabled by default. The UDP_ENCAP_ESPINUDP_NON_IKE encapsulation type support was removed. Added TCP/UDP checksum handling for inbound packets that were decapsulated by transport mode SAs. setkey(8) modified to show run-time NAT-T configuration of SA. o New network pseudo interface if_ipsec(4) added. For now it is build as part of ipsec.ko module (or with IPSEC kernel). It implements IPsec virtual tunnels to create route-based VPNs. o The network stack now invokes IPsec functions using special methods. The only one header file <netipsec/ipsec_support.h> should be included to declare all the needed things to work with IPsec. o All IPsec protocols handlers (ESP/AH/IPCOMP protosw) were removed. Now these protocols are handled directly via IPsec methods. o TCP_SIGNATURE support was reworked to be more close to RFC. o PF_KEY SADB was reworked: - now all security associations stored in the single SPI namespace, and all SAs MUST have unique SPI. - several hash tables added to speed up lookups in SADB. - SADB now uses rmlock to protect access, and concurrent threads can do SA lookups in the same time. - many PF_KEY message handlers were reworked to reflect changes in SADB. - SADB_UPDATE message was extended to support new PF_KEY headers: SADB_X_EXT_NEW_ADDRESS_SRC and SADB_X_EXT_NEW_ADDRESS_DST. They can be used by IKE daemon to change SA addresses. o ipsecrequest and secpolicy structures were cardinally changed to avoid locking protection for ipsecrequest. Now we support only limited number (4) of bundled SAs, but they are supported for both INET and INET6. o INPCB security policy cache was introduced. Each PCB now caches used security policies to avoid SP lookup for each packet. o For inbound security policies added the mode, when the kernel does check for full history of applied IPsec transforms. o References counting rules for security policies and security associations were changed. The proper SA locking added into xform code. o xform code was also changed. Now it is possible to unregister xforms. tdb_xxx structures were changed and renamed to reflect changes in SADB/SPDB, and changed rules for locking and refcounting. Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9352 MFC r313331: Add removed headers into the ObsoleteFiles.inc. MFC r313561 (by glebius): Move tcp_fields_to_net() static inline into tcp_var.h, just below its friend tcp_fields_to_host(). There is third party code that also uses this inline. MFC r313697: Remove IPsec related PCB code from SCTP. The inpcb structure has inp_sp pointer that is initialized by ipsec_init_pcbpolicy() function. This pointer keeps strorage for IPsec security policies associated with a specific socket. An application can use IP_IPSEC_POLICY and IPV6_IPSEC_POLICY socket options to configure these security policies. Then ip[6]_output() uses inpcb pointer to specify that an outgoing packet is associated with some socket. And IPSEC_OUTPUT() method can use a security policy stored in the inp_sp. For inbound packet the protocol-specific input routine uses IPSEC_CHECK_POLICY() method to check that a packet conforms to inbound security policy configured in the inpcb. SCTP protocol doesn't specify inpcb for ip[6]_output() when it sends packets. Thus IPSEC_OUTPUT() method does not consider such packets as associated with some socket and can not apply security policies from inpcb, even if they are configured. Since IPSEC_CHECK_POLICY() method is called from protocol-specific input routine, it can specify inpcb pointer and associated with socket inbound policy will be checked. But there are two problems: 1. Such check is asymmetric, becasue we can not apply security policy from inpcb for outgoing packet. 2. IPSEC_CHECK_POLICY() expects that caller holds INPCB lock and access to inp_sp is protected. But for SCTP this is not correct, becasue SCTP uses own locks to protect inpcb. To fix these problems remove IPsec related PCB code from SCTP. This imply that IP_IPSEC_POLICY and IPV6_IPSEC_POLICY socket options will be not applicable to SCTP sockets. To be able correctly check inbound security policies for SCTP, mark its protocol header with the PR_LASTHDR flag. Differential Revision: https://reviews.freebsd.org/D9538 MFC r313746: Add missing check to fix the build with IPSEC_SUPPORT and without MAC. MFC r313805: Fix LINT build for powerpc. Build kernel modules support only when both IPSEC and TCP_SIGNATURE are not defined. MFC r313922: For translated packets do not adjust UDP checksum if it is zero. In case when decrypted and decapsulated packet is an UDP datagram, check that its checksum is not zero before doing incremental checksum adjustment. MFC r314339: Document that the size of AH ICV for HMAC-SHA2-NNN should be half of NNN bits as described in RFC4868. PR: 215978 MFC r314812: Introduce the concept of IPsec security policies scope. Currently are defined three scopes: global, ifnet, and pcb. Generic security policies that IKE daemon can add via PF_KEY interface or an administrator creates with setkey(8) utility have GLOBAL scope. Such policies can be applied by the kernel to outgoing packets and checked agains inbound packets after IPsec processing. Security policies created by if_ipsec(4) interfaces have IFNET scope. Such policies are applied to packets that are passed through if_ipsec(4) interface. And security policies created by application using setsockopt() IP_IPSEC_POLICY option have PCB scope. Such policies are applied to packets related to specific socket. Currently there is no way to list PCB policies via setkey(8) utility. Modify setkey(8) and libipsec(3) to be able distinguish the scope of security policies in the `setkey -DP` listing. Add two optional flags: '-t' to list only policies related to virtual *tunneling* interfaces, i.e. policies with IFNET scope, and '-g' to list only policies with GLOBAL scope. By default policies from all scopes are listed. To implement this PF_KEY's sadb_x_policy structure was modified. sadb_x_policy_reserved field is used to pass the policy scope from the kernel to userland. SADB_SPDDUMP message extended to support filtering by scope: sadb_msg_satype field is used to specify bit mask of requested scopes. For IFNET policies the sadb_x_policy_priority field of struct sadb_x_policy is used to pass if_ipsec's interface if_index to the userland. For GLOBAL policies sadb_x_policy_priority is used only to manage order of security policies in the SPDB. For IFNET policies it is not used, so it can be used to keep if_index. After this change the output of `setkey -DP` now looks like: # setkey -DPt 0.0.0.0/0[any] 0.0.0.0/0[any] any in ipsec esp/tunnel/87.250.242.144-87.250.242.145/unique:145 spid=7 seq=3 pid=58025 scope=ifnet ifname=ipsec0 refcnt=1 # setkey -DPg ::/0 ::/0 icmp6 135,0 out none spid=5 seq=1 pid=872 scope=global refcnt=1 Obtained from: Yandex LLC Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9805 PR: 212018 Relnotes: yes Sponsored by: Yandex LLC
* MFC r310698:araujo2017-01-271-0/+6
| | | | | | | | Print hostcache usage counts with TCP statistics. PR: 196252 Submitted by: Anton Yuzhaninov <citrin+pr@citrin.ru> MFC after: 3 weeks.
* MFC r311769:smh2017-01-161-3/+3
| | | | | | Fix rstat: symbol not in namelist from netstat Sponsored by: Multiplay
* MFC r311762: Fix typo.delphij2017-01-121-1/+1
|
* MFC r311426:ume2017-01-081-1/+1
| | | | | | | | When displaying netstat details with libxo in JSON or XML modes, the value conversion for tcp6 and udp6 port numbers drops last digit. PR: 215682
* MFC r311392:delphij2017-01-088-70/+101
| | | | | | | | | Use strlcpy and snprintf in netstat(1). Expand inet6name() line buffer to NI_MAXHOST and use strlcpy/snprintf in various places. Reported by: Anton Yuzhaninov <citrin citrin ru>
* MFC r303541, r303542, r303543, r303545, r303546, r303547, r304225, r304226, ↵araujo2016-10-211-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r304605, r304676, r305212, r305863: r303541: Use nitems() from sys/param.h. Sponsored by: gandi.net (BSD Day Taiwan) MFC after: 2 weeks. r303542: Use nitems() from sys/param.h. MFC after: 2 weeks. Sponsored by: gandi.net (BSD Day Taiwan) r303543: Use nitems() from sys/param.h. MFC after: 2 weeks. Sponsored by: gandi.net (BSD Day Taiwan) r303545: Use nitems() from sys/param.h. MFC after: 2 weeks. Sponsored by: gandi.net (BSD Day Taiwan) r303546: Use nitems() from sys/param.h. MFC after: 2 weeks. Sponsored by: gandi.net (BSD Day Taiwan) r303547: Use nitems() from sys/param.h. MFC after: 2 weeks. Sponsored by: gandi.net (BSD Day Taiwan) r304225: Use nitems() from sys/param.h. MFC after: 2 weeks. r304226: Use nitems() from sys/param.h. MFC after: 2 weeks. r304605: Fix calloc(3) argument order. Reviewed by: trasz MFC after: 4 weeks. Differential Revision: https://reviews.freebsd.org/D7532 r304676: Fix calloc(3) argument order. MFC after: 4 weeks. r305212: - Invert calloc(3) argument order. MFC after: 4 weeks r305863: Invert calloc(3) argument order. Reviewed by: ed. MFC after: 4 weeks. Differential Revision: https://reviews.freebsd.org/D7902
* MFC r304292:tuexen2016-08-201-4/+4
| | | | | | | Use names for SCTP and UDPLite when reporting the input histogram. MFC r304295: Fix the output for scope statistics.
* MFC r302904:tuexen2016-07-242-90/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a bug which results in a core dump when running netstat with the -W option and having a listening SCTP socket. The bug was introduced in r279122 when adding support for libxo. MFC r302907: When calling netstat -Laptcp the local address values are not aligned with the corresponding entry in the table header. r295136 increased the value width from 14 to 32 without the corresponding change to the table header. This commit adds the change to the table header width. MFC r302917: Ensure that the -a, -W, -L options for SCTP behave similar as for TCP. MFC r302928: Address a potential memory leak found a the clang static code analyzer running on the userland stack. MFC r302930: Don't free a data chunk twice. Found by the clang static code analyzer running for the userland stack. MFC r302935: Deal with a portential memory allocation failure, which was reported by the clang static code analyzer. Joint work with rrs@. MFC r302942: Add missing sctps_reasmusrmsgs counter. Joint work with rrs@. MFC r302945: Don't duplicate code for SCTP, just use the ones used for UDP and TCP. This fixes a bug with link local addresses. This will require and upcoming change in the kernel to bring SCTP to the same behaviour as UDP and TCP. MFC r302949: Fix the PR-SCTP behaviour. This is done by rrs@. MFC r302950: Add a constant required by RFC 7496. MFC r303024: netstat and sockstat expect the IPv6 link local addresses to have an embedded scope. So don't recover. MFC r303025: Use correct order of conditions to avoid NULL deref. MFC r303073: Fix a bug in deferred stream reset processing which results in using a length field before it is set. Thanks to Taylor Brandstetter for reporting the issue and providing a fix. Approved by: re (kib)
* Use macro MAX() from sys/param.h.araujo2016-04-221-1/+1
| | | | MFC after: 2 weeks.
* Use NULL instead of 0 for pointers.araujo2016-04-183-7/+7
| | | | | | Also malloc will return NULL if it cannot allocate memory. MFC after: 2 weeks.
* netstat: avoid returning uninitialized value in p_sockaddr().pfg2016-03-271-0/+1
| | | | | | | | In the case the width is less than 0, we are returning an uninitialized value. For practical purposes the return value is ignored but initialize it to avoid trouble. CID: 1341619
* Print running TCP connection counts with TCP statistics.glebius2016-03-154-6/+54
|
* DIRDEPS_BUILD: Regenerate without local dependencies.bdrewery2016-02-241-10/+0
| | | | | | | | These are no longer needed after the recent 'beforebuild: depend' changes and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports skipping 'make depend'. Sponsored by: EMC / Isilon Storage Division
* Increase max allowed backlog for listen socketsalfred2016-02-023-9/+10
| | | | | | | | from short to int. PR: 203922 Submitted by: White Knight <white_knight@2ch.net> MFC After: 4 weeks
* New sendfile(2) syscall. A joint effort of NGINX and Netflix from 2013 andglebius2016-01-081-3/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | up to now. The new sendfile is the code that Netflix uses to send their multiple tens of gigabits of data per second. The new implementation features asynchronous I/O, when I/O operations are launched, but not awaited to be complete. An explanation of why such behavior is beneficial compared to old one is going to be too long for a commit message, so we will skip it here. Additional features of new syscall are extra flags, which provide an application more control over data sent. The SF_NOCACHE flag tells kernel that data shouldn't be cached after it was sent. The SF_READAHEAD() macro allows to specify readahead size in pages. The new syscalls is a drop in replacement. No modifications are required to applications. One can take nginx binary for stable/10 and run it successfully on head. Although SF_NODISKIO lost its original sense, as now sendfile doesn't block, and now means something completely different (tm), using the new sendfile the old way is absolutely safe. Celebrates: Netflix global launch! Sponsored by: Nginx, Inc. Sponsored by: Netflix Relnotes: yes
* Switch the IPsec related statistics to using the built in sysctlgnn2015-12-172-14/+24
| | | | | | | | | variable set rather than reading from kernel memory. This also makes the -z (zero) flag work correctly MFC after: 1 week Sponsored by: Rubicon Communications, LLC (Netgate) Differential Revision: https://reviews.freebsd.org/D4591
* Add more text to explain --libxo flag.rodrigc2015-12-011-1/+8
|
* At the time a destination or a gateway of `netstat -r'ume2015-12-011-6/+14
| | | | | protrudes its field, narrow the next field to raise readability bit.
* Update dependencies after r291406 added libelf to libkvm.bdrewery2015-12-011-0/+1
| | | | | | | | Unfortunately filemon/meta mode tracks all indirect dependencies here since ld(1) is reading libelf when linking in libkvm. Churn would be reduced if this was able to be limited to direct dependencies. Sponsored by: EMC / Isilon Storage Division
* Replace DPSRCS that work fine in SRCS.bdrewery2015-11-251-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is so that 'make depend' is not a required build step in these files. DPSRCS is overall unneeded. DPSRCS already contains SRCS, so anything which can safely be in SRCS should be. DPSRCS is mostly just a way to generate files that should not be linked into the final PROG/LIB. For headers and grammars it is safe for them to be in SRCS since they will be excluded during linking and installation. The only remaining uses of DPSRCS are for generating .c or .o files that must be built before 'make depend' can run 'mkdep' on the SRCS c files list. A semi-proper example is in tests/sys/kern/acct/Makefile where a checked-in .c file has an #include on a generated .c file. The generated .c file should not be linked into the final PROG though since it is #include'd. The more proper way here is just to build/link it in though without DPSRCS. Another example is in sys/modules/linux/Makefile where a shell script runs to parse a DPSRCS .o file that should not be linked into the module. Beyond those, the need for DPSRCS is largely unneeded, redundant, and forces 'make depend' to be ran. Generally, these Makefiles should avoid the need for DPSRCS and define proper dependencies for their files as well. An example of an improper usage and why this matters is in usr.bin/netstat. nl_defs.h was only in DPSRCS and so was not generated during 'make all', but only during 'make depend'. The files including it lacked proper depenencies on it, which forced running 'make depend' to workaround that bug. The 'make depend' target should mostly be used for incremental build help, not to produce a working build. This specific example was broken in the meta build until r287905 since it does not run 'make depend'. The gnu/lib/libreadline/readline case is fine since bsd.lib.mk has 'OBJS: SRCS:M*.h' when there is no .depend file. Sponsored by: EMC / Isilon Storage Division MFC after: 1 week
* Fix udp entry of `netstat -TW'.ume2015-11-251-0/+2
|
* Correct alignment of the addresses in the `netstat -aW' output.ume2015-11-241-12/+21
|
* Add missing error check after xo_parse_args() in netstat(8).ume2015-11-241-0/+2
| | | | | Submitted by: Oliver Pinter Differential Revision: https://reviews.freebsd.org/D4233
* Don't truncate an interface name when -W option is specified.ume2015-11-201-1/+5
| | | | | Spotted by: Jim Thompson <jim__at__netgate.com> MFC after: 1 week
* Avoid core dump when output style is html.ume2015-11-201-10/+8
|
* JSON doesn't permit a hexadecimal notation of an integer.ume2015-11-171-1/+1
|
* Do not truncate addresses when printing in encoded format.ume2015-11-061-10/+11
|
* - Fix alignment for padding link address.ume2015-11-061-2/+2
| | | | - Trim whitespace of link address.
* Fix compiling netstat after r290367 by substituting sys/types.h forngie2015-11-061-1/+1
| | | | | | | sys/param.h, as sys/param.h defines the MAX(..) macro Reported by: O. Hartmann <ohartman@zedat.fu-berlin.de> Pointyhat to: ume
* Give enough room for addresses when -W option is specified.ume2015-11-051-11/+25
|
* Fix alignment of `Drop' header.ume2015-11-051-1/+1
|
* Use returned network name from getnetbyaddr() correctly.ume2015-11-051-6/+5
|
* Revert previous workaround. This problem was fixedume2015-11-051-4/+0
| | | | by r290318.
* Since sa->sa_len doesn't match sizeof(struct sockaddr_dl),ume2015-11-041-0/+4
| | | | | getnameinfo() fails against sockaddr_dl. This commit is workaround for this problem.
* Fix alignment of AF_LINK address.ume2015-11-041-2/+1
|
* Simplify r290367 using asterisk for a field widthume2015-11-041-8/+3
| | | | and precision.
* Unify AF_INET case and AF_INET6 case.ume2015-11-041-15/+1
|
* Change to not truncate an interface name when -W optionume2015-11-041-11/+24
| | | | is specified.
* Mask an IPv6 network address.ume2015-11-041-1/+8
|
* Restore an interface name field to left align.ume2015-11-041-2/+2
|
* Update META_MODE dependencies.bdrewery2015-09-171-0/+10
|
* Use a common subroutine to fetch and zero protocol stats instead ofmarkj2015-09-1110-242/+119
| | | | | | duplicating roughly similar code for each protocol. MFC after: 2 weeks
* Remove prototypes for undefined functions from netstat.h.markj2015-09-111-15/+0
|
* Simplify kvm symbol resolution and error handling. The symbol tablehrs2015-09-028-241/+151
| | | | | nl_symbols will eventually be organized into several modules depending on MK_* variables.
* Divide statistics in the number of packets with 1000 instead of 1024hrs2015-09-021-21/+25
| | | | | | in human-readable form. PR: 183598
* - Add -W flag support for network column in intpr() (-i flag) andhrs2015-09-019-284/+226
| | | | | | | | | | | | | | | | | | | | | | | | | routepr() (-r flag). It is too narrow to show an IPv6 prefix in most cases. - Accept "local" as a synonym of "unix" in protocol family name. - Show a prefix length in CIDR notation when name resolution failed in netname(). - Make routename() and netname() AF-independent and remove unnecessary typecasting from struct sockaddr. - Use getnameinfo(3) to format L2 addr in intpr(). - Fix a bug which showed "Address" when -A flag is specfied in pr_rthdr(). - Replace cryptic GETSA() macro with SA_SIZE(). - Fix declarations shadowing local variables with the same names. - Add more static, remove unused header files and variables. MFC after: 1 week
OpenPOWER on IntegriCloud