Commit Graph

304 Commits

Author SHA1 Message Date
christos 27fe772ddc IPSEC has not come in two speeds for a long time now (IPSEC == kame,
FAST_IPSEC). Make everything refer to IPSEC to avoid confusion.
2013-06-05 19:01:26 +00:00
christos cbf1f72b20 Add a new sysctl to mark ports as reserved, so that they are not used in
the anonymous or reserved port allocation.
2012-11-29 02:07:20 +00:00
christos 84f52095ad rename rfc6056 -> portalgo, requested by yamt 2012-06-25 15:28:38 +00:00
christos 40114b997c PR/46602: Move the rfc6056 port randomization to the IP layer. 2012-06-22 14:54:34 +00:00
dsl e21a34c25e Add some pre-processor magic to verify that the type of the data item
passed to sysctl_createv() actually matches the declared type for
  the item itself.
In the places where the caller specifies a function and a structure
  address (typically the 'softc') an explicit (void *) cast is now needed.
Fixes bugs in sys/dev/acpi/asus_acpi.c sys/dev/bluetooth/bcsp.c
  sys/kern/vfs_bio.c sys/miscfs/syncfs/sync_subr.c and setting
  AcpiGbl_EnableAmlDebugObject.
(mostly passing the address of a uint64_t when typed as CTLTYPE_INT).
I've test built quite a few kernels, but there may be some unfixed MD
  fallout. Most likely passing &char[] to char *.
Also add CTLFLAG_UNSIGNED for unsiged decimals - not set yet.
2012-06-02 21:36:41 +00:00
drochner 364a06bb29 remove KAME IPSEC, replaced by FAST_IPSEC 2012-03-22 20:34:37 +00:00
liamjfoy 24612de5fe check against NULL 2012-01-09 14:31:21 +00:00
drochner 23e5beaef1 rename the IPSEC in-kernel CPP variable and config(8) option to
KAME_IPSEC, and make IPSEC define it so that existing kernel
config files work as before
Now the default can be easily be changed to FAST_IPSEC just by
setting the IPSEC alias to FAST_IPSEC.
2011-12-19 11:59:56 +00:00
plunky 7f3d4048d7 NULL does not need a cast 2011-08-31 18:31:02 +00:00
dyoung ac162b774b *_drain() routines may be called with locks held, so instead of doing
any work in *_drain(), set a drain-needed flag.  Do the work in the
fasttimo handler.

Contributed by Coyote Point Systems, Inc.
2011-05-03 17:44:30 +00:00
dyoung b34b1e2f1f In ipintr(), don't overwrite ipintrq.ifq_maxlen with IFQ_MAXLEN.
Initialize ipintrq.ifq_maxlen using IFQ_MAXLEN directly instead of using
the global ipqmaxlen.  Get rid of the global ipqmaxlen.

Now it works again to override the maximum IP queue length with, for
example, sysctl -w net.inet.ip.ifq.maxlen=5.
2011-04-14 20:32:04 +00:00
matt 2c1217a227 Back out rev that shouldn't have been committed. 2010-12-13 14:18:50 +00:00
matt ebb2d31714 Add routines to calculate a checkesum if the driver concludes that the
h/w can't do it.
2010-12-11 22:37:46 +00:00
rmind c40af51a1a ip_randomid: make mechanism MP-safe and more modular.
OK matt@
2010-11-05 01:35:57 +00:00
rmind aa7dc4aa25 ip_reass_packet: finish abstraction; some clean-up.
Discussed some time ago with matt@.
2010-11-05 00:21:51 +00:00
rmind 2f196e2fd9 Abstract IP reassembly into single generic routine - ip_reass_packet().
Make struct ipq private and struct ipqent not visible to userland.
Push ip_len adjustment into reassembly layer.

OK matt@
2010-07-19 14:09:44 +00:00
rmind bcc65ff09f Split-off IPv4 re-assembly mechanism into a separate module. Abstract
into ip_reass_init(), ip_reass_lookup(), etc (note: abstraction is not
yet complete).  No functional changes to the actual mechanism.

OK matt@
2010-07-13 22:16:10 +00:00
rmind 419f3b11a1 ip_input: move lookup for fragment queue a little bit further. OK matt@. 2010-07-09 18:42:46 +00:00
tls 04c7bc4215 As suggested by at least 3 different people (the guilty parties know who
they are) avoid repeated kernel_lock/unlock by using an intrq on the stack.

About 5%-10% better from run to run, on my *very* simpleminded test.  Can't
possibly be worse.
2010-04-01 01:23:32 +00:00
tls 4e65861033 Don't hold kernel lock across call to ip_input() -- it blocked *all*
hardware interrupts for the length of time it took for all dequeued
packets to flow up the stack (on multiprocessors only).  Initial testing
shows performance impact is minimal -- since this temporary fix actually
means taking/releasing the kernel lock per-packet, that seems
acceptable.

Holding the kernel lock across the ip_input() call duplicated the
exclusion intended to be provided by the socket locks/softnet lock
(same lock, for INET/INET6 sockets) and could mask serious bugs.  Several
hours' testing didn't turn any up but I'd be surprised if some don't now
appear.

Damon Permezel noticed the problem.  Temporary fix suggested by matt@.
2010-03-31 07:31:15 +00:00
pooka 11281f01a0 Replace a large number of link set based sysctl node creations with
calls from subsystem constructors.  Benefits both future kernel
modules and rump.

no change to sysctl nodes on i386/MONOLITHIC & build tested i386/ALL
2009-09-16 15:23:04 +00:00
minskim 5731aa1460 Delete trailing whitespace. 2009-07-17 18:09:25 +00:00
minskim ca28940e0e Add the IP_RECVTTL option support.
If the IP_RECVTTL option is enabled on a SOCK_DGRAM socket, the
recvmsg(2) call will return the TTL of the received datagram.  The
msg_control field in the msghdr structure points to a buffer that
contains a cmsghdr structure followed by the TTL value.

Modeled after FreeBSD implementation.
2009-07-16 04:09:51 +00:00
tsutsui d779b85d3e Remove extra whitespace added by a stupid tool.
XXX: more in src/sys/arch
2009-04-18 14:58:02 +00:00
elad 2d1c968399 Remove a few KAUTH_GENERIC_ISSUSER in favor of more descriptive
alternatives.

Discussed on tech-kern:

	http://mail-index.netbsd.org/tech-kern/2009/04/11/msg004798.html

Input from ad@, christos@, dyoung@, tsutsui@.

Okay ad@.
2009-04-15 20:44:24 +00:00
cegger e2cb85904d bcopy -> memcpy 2009-03-18 17:06:41 +00:00
christos 14ba6c67a5 Provide compatibility to the old timeval SCM_TIMESTAMP messages. 2009-01-19 02:27:57 +00:00
cegger 9b87d582bd kill MALLOC and FREE macros. 2008-12-17 20:51:31 +00:00
rmind f2828c5040 ip_input: fix an IPQ "lock" leak. (hi <matt>!) 2008-11-23 19:52:38 +00:00
pooka 308b8af180 POOL_INIT -> pool_init 2008-10-04 00:09:34 +00:00
seanb f36e2df47a Wrong route being consulted in one place
in ip_forward() after change to rtcache_*().
Restore previous behaviour.
2008-09-05 13:39:12 +00:00
matt 34cedfb2bf Make the sysctl routines take out softnet_lock before dealing with
any data structures.

Change inet6ctlerrmap and zeroin6_addr to const.
2008-08-20 18:35:20 +00:00
ad e071d39c84 - Convert hashinit() to use kmem_alloc(). The hash tables can be large
and it's better to not have them in kmem_map.
- Convert a couple of minor items along the way to kmem_alloc().
- Fix some memory leaks.
2008-05-05 17:11:16 +00:00
thorpej b129a80c20 Simplify the interface to netstat_sysctl() and allocate space for
the collated counters using kmem_alloc().

PR kern/38577
2008-05-04 07:22:14 +00:00
ad 2830fe3488 PR kern/38497 Out of memory allocating ksiginfo
Work around: don't acquire softnet_lock in protocol drain routines.
2008-05-02 13:40:32 +00:00
martin ce099b4099 Remove clause 3 and 4 from TNF licenses 2008-04-28 20:22:51 +00:00
ad 15e29e981b Merge the socket locking patch:
- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.
2008-04-24 11:38:36 +00:00
thorpej caf49ea572 Make IPSEC and FAST_IPSEC stats per-cpu. Use <net/net_stats.h> and
netstat_sysctl().
2008-04-23 06:09:04 +00:00
thorpej 7ff8d08aae Make IP, TCP, UDP, and ICMP statistics per-CPU. The stats are collated
when the user requests them via sysctl.
2008-04-12 05:58:22 +00:00
thorpej 04e54b2ef5 - ipflow is not used outside ip_flow.c; move its definition there.
- Make ipflow_reap() private to ip_flow.c, and introduce ipflow_prune()
  for external callers to use (avoids returning an ipflow * that is never
  actually used anyway).
2008-04-09 05:14:20 +00:00
thorpej 88d65e9212 Change IP stats from a structure to an array of uint64_t's.
Note: This is ABI-compatible with the old ipstat structure; old netstat
binaries will continue to work properly.
2008-04-07 06:31:27 +00:00
cube 564b60af35 - Make sure we send a reasonable fragment size when IPSEC is configured.
Otherwise we end up sending a dubious "0" whenever we cannot find a
  proper association for the packet.
- Reset sack_newdata along with snd_nxt to avoid improper integer
  arithmetics that lead to sending data from an incorrect place in the
  stream, making it appear as corrupted.

Patch by Michael Van Elst, based on an analysis by Michael for the IPSEC
stuff and I for the SACK issue.
2008-03-27 00:18:56 +00:00
matt fb71901dbc Add a new ip_id generation scheme based on a Fisher-Yates shuffle over a
sliding window.  XXX replace use of arc4random RSN.
2008-02-06 03:20:50 +00:00
dyoung 2d4e7e5856 Use rtcache_validate() instead of rtcache_getrt(). Shorten staircase
in in_losing().
2008-01-14 04:19:09 +00:00
matt 0ec69f885b Fix offset calculation.
Make sure that all frags use the same TOS.
2007-12-22 15:41:11 +00:00
matt 1f3ca215ea Also make sure the first is at 68 bytes long. 2007-12-21 23:49:09 +00:00
matt 6f23ff186c Prevent TCP blind data attacks by not allowing non-initial fragments to
start at less than 68 bytes (minimal fragment size).
2007-12-21 18:58:55 +00:00
dyoung 72fa642a86 Poison struct route->ro_rt uses in the kernel by changing the name
to _ro_rt.  Use rtcache_getrt() to access a route cache's struct
rtentry *.

Introduce struct ifnet->if_dl that always points at the interface
identifier/link-layer address.  Make code that treated the first
ifaddr on struct ifnet->if_addrlist as the interface address use
if_dl, instead.

Remove stale debugging code from net/route.c.  Move the rtflush()
code into rtcache_clear() and delete rtflush().  Delete rtalloc(),
because nothing uses it any more.

Make ND6_HINT an inline, lowercase subroutine, nd6_hint.

I've done my best to convert IP Filter, the ISO stack, and the
AppleTalk stack to rtcache_getrt().  They compile, but I have not
tested them.  I have given the changes to PF, GRE, IPv4 and IPv6
stacks a lot of exercise.
2007-12-20 19:53:29 +00:00
yamt 8ed07fbf78 inetctlerrmap: use designated initializer. 2007-11-26 08:40:46 +00:00
kefren 9536f25523 Don't MCLAIM in ipintr() because we do it anyway in ip_input() 2007-11-09 06:59:33 +00:00