Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/sys/netinet/files.netinet

46 lines
1.4 KiB
Plaintext
Raw Normal View History

Here are various changes designed to protect against bad IPv4 routing caused by stale route caches (struct route). Route caches are sprinkled throughout PCBs, the IP fast-forwarding table, and IP tunnel interfaces (gre, gif, stf). Stale IPv6 and ISO route caches will be treated by separate patches. Thank you to Christoph Badura for suggesting the general approach to invalidating route caches that I take here. Here are the details: Add hooks to struct domain for tracking and for invalidating each domain's route caches: dom_rtcache, dom_rtflush, and dom_rtflushall. Introduce helper subroutines, rtflush(ro) for invalidating a route cache, rtflushall(family) for invalidating all route caches in a routing domain, and rtcache(ro) for notifying the domain of a new cached route. Chain together all IPv4 route caches where ro_rt != NULL. Provide in_rtcache() for adding a route to the chain. Provide in_rtflush() and in_rtflushall() for invalidating IPv4 route caches. In in_rtflush(), set ro_rt to NULL, and remove the route from the chain. In in_rtflushall(), walk the chain and remove every route cache. In rtrequest1(), call rtflushall() to invalidate route caches when a route is added. In gif(4), discard the workaround for stale caches that involves expiring them every so often. Replace the pattern 'RTFREE(ro->ro_rt); ro->ro_rt = NULL;' with a call to rtflush(ro). Update ipflow_fastforward() and all other users of route caches so that they expect a cached route, ro->ro_rt, to turn to NULL. Take care when moving a 'struct route' to rtflush() the source and to rtcache() the destination. In domain initializers, use .dom_xxx tags. KNF here and there.
2006-12-09 08:33:04 +03:00
# $NetBSD: files.netinet,v 1.17 2006/12/09 05:33:04 dyoung Exp $
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
defflag opt_tcp_debug.h TCP_DEBUG
Here are various changes designed to protect against bad IPv4 routing caused by stale route caches (struct route). Route caches are sprinkled throughout PCBs, the IP fast-forwarding table, and IP tunnel interfaces (gre, gif, stf). Stale IPv6 and ISO route caches will be treated by separate patches. Thank you to Christoph Badura for suggesting the general approach to invalidating route caches that I take here. Here are the details: Add hooks to struct domain for tracking and for invalidating each domain's route caches: dom_rtcache, dom_rtflush, and dom_rtflushall. Introduce helper subroutines, rtflush(ro) for invalidating a route cache, rtflushall(family) for invalidating all route caches in a routing domain, and rtcache(ro) for notifying the domain of a new cached route. Chain together all IPv4 route caches where ro_rt != NULL. Provide in_rtcache() for adding a route to the chain. Provide in_rtflush() and in_rtflushall() for invalidating IPv4 route caches. In in_rtflush(), set ro_rt to NULL, and remove the route from the chain. In in_rtflushall(), walk the chain and remove every route cache. In rtrequest1(), call rtflushall() to invalidate route caches when a route is added. In gif(4), discard the workaround for stale caches that involves expiring them every so often. Replace the pattern 'RTFREE(ro->ro_rt); ro->ro_rt = NULL;' with a call to rtflush(ro). Update ipflow_fastforward() and all other users of route caches so that they expect a cached route, ro->ro_rt, to turn to NULL. Take care when moving a 'struct route' to rtflush() the source and to rtcache() the destination. In domain initializers, use .dom_xxx tags. KNF here and there.
2006-12-09 08:33:04 +03:00
defflag opt_in_route.h IN_RTFLUSH_DEBUG
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
defparam opt_tcp_debug.h TCP_NDEBUG
Initial commit of a port of the FreeBSD implementation of RFC 2385 (MD5 signatures for TCP, as used with BGP). Credit for original FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship credited to sentex.net. Shortening of the setsockopt() name attributed to Vincent Jardin. This commit is a minimal, working version of the FreeBSD code, as MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp modified to set the TCP-MD5 option; BMS's additions to tcpdump-current (tcpdump -M) confirm that the MD5 signatures are correct. Committed as-is for further testing between a NetBSD BGP speaker (e.g., quagga) and industry-standard BGP speakers (e.g., Cisco, Juniper). NOTE: This version has two potential flaws. First, I do see any code that verifies recieved TCP-MD5 signatures. Second, the TCP-MD5 options are internally padded and assumed to be 32-bit aligned. A more space-efficient scheme is to pack all TCP options densely (and possibly unaligned) into the TCP header ; then do one final padding to a 4-byte boundary. Pre-existing comments note that accounting for TCP-option space when we add SACK is yet to be done. For now, I'm punting on that; we can solve it properly, in a way that will handle SACK blocks, as a separate exercise. In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c ,and modifies: sys/net/pfkeyv2.h,v 1.15 sys/netinet/files.netinet,v 1.5 sys/netinet/ip.h,v 1.25 sys/netinet/tcp.h,v 1.15 sys/netinet/tcp_input.c,v 1.200 sys/netinet/tcp_output.c,v 1.109 sys/netinet/tcp_subr.c,v 1.165 sys/netinet/tcp_usrreq.c,v 1.89 sys/netinet/tcp_var.h,v 1.109 sys/netipsec/files.netipsec,v 1.3 sys/netipsec/ipsec.c,v 1.11 sys/netipsec/ipsec.h,v 1.7 sys/netipsec/key.c,v 1.11 share/man/man4/tcp.4,v 1.16 lib/libipsec/pfkey.c,v 1.20 lib/libipsec/pfkey_dump.c,v 1.17 lib/libipsec/policy_token.l,v 1.8 sbin/setkey/parse.y,v 1.14 sbin/setkey/setkey.8,v 1.27 sbin/setkey/token.l,v 1.15 Note that the preceding two revisions to tcp.4 will be required to cleanly apply this diff.
2004-04-26 02:25:03 +04:00
defflag opt_inet.h INET INET6 INET6_MD_CKSUM TCP_SIGNATURE
Add a source-address selection policy mechanism to the kernel. Also, add ioctls SIOCGIFADDRPREF/SIOCSIFADDRPREF to get/set preference numbers for addresses. Make ifconfig(8) set/display preference numbers. To activate source-address selection policies in your kernel, add 'options IPSELSRC' to your kernel configuration. Miscellaneous changes in support of source-address selection: 1 Factor out some common code, producing rt_replace_ifa(). 2 Abbreviate a for-loop with TAILQ_FOREACH(). 3 Add the predicates on IPv4 addresses IN_LINKLOCAL() and IN_PRIVATE(), that are true for link-local unicast (169.254/16) and RFC1918 private addresses, respectively. Add the predicate IN_ANY_LOCAL() that is true for link-local unicast and multicast. 4 Add IPv4-specific interface attach/detach routines, in_domifattach and in_domifdetach, which build #ifdef IPSELSRC. See in_getifa(9) for a more thorough description of source-address selection policy.
2006-11-13 08:13:38 +03:00
TCP_OUTPUT_COUNTERS TCP_REASS_COUNTERS IPSELSRC
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
defparam opt_inet_conf.h SUBNETSARELOCAL HOSTZEROBROADCAST
defflag MROUTING
IPv4 PIM support, based on a submission from Pavlin Radoslavov posted on tech-net@
2004-09-05 03:29:44 +04:00
defflag PIM
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
defflag TCP_COMPAT_42
defparam opt_tcp_space.h TCP_RECVSPACE TCP_SENDSPACE
defflag opt_inet_csum.h INET_CSUM_COUNTERS TCP_CSUM_COUNTERS
UDP_CSUM_COUNTERS
Modular (I tried ;-) TCP congestion control API. Whenever certain conditions happen in the TCP stack, this interface calls the specified callback to handle the situation according to the currently selected congestion control algorithm. A new sysctl node was created: net.inet.tcp.congctl.{available,selected} with obvious meanings. The old net.inet.tcp.newreno MIB was removed. The API is discussed in tcp_congctl(9). In the near future, it will be possible to selected a congestion control algorithm on a per-socket basis. Discussed on tech-net and reviewed by <yamt>.
2006-10-09 20:27:07 +04:00
defparam opt_tcp_congctl.h TCP_CONGCTL_DEFAULT
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/igmp.c inet
file netinet/in.c inet
move tso-by-software code to their own files. no functional changes.
2006-11-25 21:41:36 +03:00
file netinet/in_offload.c inet
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/in_pcb.c inet
file netinet/in_proto.c inet
Here are various changes designed to protect against bad IPv4 routing caused by stale route caches (struct route). Route caches are sprinkled throughout PCBs, the IP fast-forwarding table, and IP tunnel interfaces (gre, gif, stf). Stale IPv6 and ISO route caches will be treated by separate patches. Thank you to Christoph Badura for suggesting the general approach to invalidating route caches that I take here. Here are the details: Add hooks to struct domain for tracking and for invalidating each domain's route caches: dom_rtcache, dom_rtflush, and dom_rtflushall. Introduce helper subroutines, rtflush(ro) for invalidating a route cache, rtflushall(family) for invalidating all route caches in a routing domain, and rtcache(ro) for notifying the domain of a new cached route. Chain together all IPv4 route caches where ro_rt != NULL. Provide in_rtcache() for adding a route to the chain. Provide in_rtflush() and in_rtflushall() for invalidating IPv4 route caches. In in_rtflush(), set ro_rt to NULL, and remove the route from the chain. In in_rtflushall(), walk the chain and remove every route cache. In rtrequest1(), call rtflushall() to invalidate route caches when a route is added. In gif(4), discard the workaround for stale caches that involves expiring them every so often. Replace the pattern 'RTFREE(ro->ro_rt); ro->ro_rt = NULL;' with a call to rtflush(ro). Update ipflow_fastforward() and all other users of route caches so that they expect a cached route, ro->ro_rt, to turn to NULL. Take care when moving a 'struct route' to rtflush() the source and to rtcache() the destination. In domain initializers, use .dom_xxx tags. KNF here and there.
2006-12-09 08:33:04 +03:00
file netinet/in_route.c inet
Add a source-address selection policy mechanism to the kernel. Also, add ioctls SIOCGIFADDRPREF/SIOCSIFADDRPREF to get/set preference numbers for addresses. Make ifconfig(8) set/display preference numbers. To activate source-address selection policies in your kernel, add 'options IPSELSRC' to your kernel configuration. Miscellaneous changes in support of source-address selection: 1 Factor out some common code, producing rt_replace_ifa(). 2 Abbreviate a for-loop with TAILQ_FOREACH(). 3 Add the predicates on IPv4 addresses IN_LINKLOCAL() and IN_PRIVATE(), that are true for link-local unicast (169.254/16) and RFC1918 private addresses, respectively. Add the predicate IN_ANY_LOCAL() that is true for link-local unicast and multicast. 4 Add IPv4-specific interface attach/detach routines, in_domifattach and in_domifdetach, which build #ifdef IPSELSRC. See in_getifa(9) for a more thorough description of source-address selection policy.
2006-11-13 08:13:38 +03:00
file netinet/in_selsrc.c inet & ipselsrc
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/ip_flow.c inet & gateway
file netinet/ip_icmp.c inet
always compile ip_id.c
2003-11-27 00:26:56 +03:00
file netinet/ip_id.c inet
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/ip_input.c inet
file netinet/ip_mroute.c inet & mrouting
file netinet/ip_output.c inet
file netinet/raw_ip.c inet
compile tcp_debug.c only if the TCP_DEBUG option is set, and remove the "#ifdef TCP_DEBUG" around everything
2005-01-13 22:09:40 +03:00
file netinet/tcp_debug.c (inet | inet6) & tcp_debug
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/tcp_input.c inet | inet6
file netinet/tcp_output.c inet | inet6
Commit TCP SACK patches from Kentaro A. Karahone's patch at: http://www.sigusr1.org/~kurahone/tcp-sack-netbsd-02152005.diff.gz Fixes in that patch for pre-existing TCP pcb initializations were already committed to NetBSD-current, so are not included in this commit. The SACK patch has been observed to correctly negotiate and respond, to SACKs in wide-area traffic. There are two indepenently-observed, as-yet-unresolved anomalies: First, seeing unexplained delays between in fast retransmission (potentially explainable by an 0.2sec RTT between adjacent ethernet/wifi NICs); and second, peculiar and unepxlained TCP retransmits observed over an ath0 card. After discussion with several interested developers, I'm committing this now, as-is, for more eyes to use and look over. Current hypothesis is that the anomalies above may in fact be due to link/level (hardware, driver, HAL, firmware) abberations in the test setup, affecting both Kentaro's wired-Ethernet NIC and in my two (different) WiFi NICs.
2005-02-28 19:20:59 +03:00
file netinet/tcp_sack.c inet | inet6
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/tcp_subr.c inet | inet6
file netinet/tcp_timer.c inet | inet6
file netinet/tcp_usrreq.c inet | inet6
Modular (I tried ;-) TCP congestion control API. Whenever certain conditions happen in the TCP stack, this interface calls the specified callback to handle the situation according to the currently selected congestion control algorithm. A new sysctl node was created: net.inet.tcp.congctl.{available,selected} with obvious meanings. The old net.inet.tcp.newreno MIB was removed. The API is discussed in tcp_congctl(9). In the near future, it will be possible to selected a congestion control algorithm on a per-socket basis. Discussed on tech-net and reviewed by <yamt>.
2006-10-09 20:27:07 +04:00
file netinet/tcp_congctl.c inet | inet6
Move netinet, netinet6, ipsec, and ipfilter config defns to netinet/files.ipfilter, etinet/files.netinet, netinet6/files.netinet6, and netinet6/files.netipsec. XXX There are still a few stragglers in conf/files, which are entangled with other network protocols.
2002-10-11 02:45:45 +04:00
file netinet/udp_usrreq.c inet | inet6