Commit Graph

208 Commits

Author SHA1 Message Date
thorpej
f5c68c0b9f Change TCP stats from a structure to an array of uint64_t's.
Note: This is ABI-compatible with the old tcpstat structure; old netstat
binaries will continue to work properly.
2008-04-08 01:03:58 +00:00
thorpej
88d65e9212 Change IP stats from a structure to an array of uint64_t's.
Note: This is ABI-compatible with the old ipstat structure; old netstat
binaries will continue to work properly.
2008-04-07 06:31:27 +00:00
thorpej
738aabaf82 Change UDP stats from a structure to an array of uint64_t's.
Note: This is ABI-compatible with the old icmpstat structure; old netstat
binaries will continue to work properly.
2008-04-06 20:17:27 +00:00
thorpej
67b7abb1ce Change ICMP stats from a structure to an array of uint64_t's.
Note: This is ABI-compatible with the old icmpstat structure; old netstat
binaries will continue to work properly.
2008-04-06 19:04:48 +00:00
rmind
c6186face4 Welcome to 4.99.55:
- Add a lot of missing selinit() and seldestroy() calls.

- Merge selwakeup() and selnotify() calls into a single selnotify().

- Add an additional 'events' argument to selnotify() call.  It will
  indicate which event (POLL_IN, POLL_OUT, etc) happen.  If unknown,
  zero may be used.

Note: please pass appropriate value of 'events' where possible.
Proposed on: <tech-kern>
2008-03-01 14:16:49 +00:00
dyoung
f776107987 Use TAILQ_FOREACH(). 2008-02-11 22:11:27 +00:00
matt
c385a82b94 Pass 0 to ip_randomid since we don't know the salt. 2008-02-07 00:11:09 +00:00
mrg
8a519a7389 initialise some variables to appease gcc -O3. 2008-02-04 02:42:52 +00:00
dyoung
ffd53445a3 Convert rtcache_init()+rtcache_getrt() to single rtcache_init()
calls.
2008-01-14 17:17:19 +00:00
dyoung
a5476e2169 Change rtcache_init()+rtcache_getrt() and
rtcache_init_noclone()+rtcache_getrt() to single rtcache_init()
and rtcache_init_clone() calls.
2008-01-14 17:14:21 +00:00
dyoung
72fa642a86 Poison struct route->ro_rt uses in the kernel by changing the name
to _ro_rt.  Use rtcache_getrt() to access a route cache's struct
rtentry *.

Introduce struct ifnet->if_dl that always points at the interface
identifier/link-layer address.  Make code that treated the first
ifaddr on struct ifnet->if_addrlist as the interface address use
if_dl, instead.

Remove stale debugging code from net/route.c.  Move the rtflush()
code into rtcache_clear() and delete rtflush().  Delete rtalloc(),
because nothing uses it any more.

Make ND6_HINT an inline, lowercase subroutine, nd6_hint.

I've done my best to convert IP Filter, the ISO stack, and the
AppleTalk stack to rtcache_getrt().  They compile, but I have not
tested them.  I have given the changes to PF, GRE, IPv4 and IPv6
stacks a lot of exercise.
2007-12-20 19:53:29 +00:00
jmcneill
d41d2435df In AcpiEvGpeDetect, don't attempt to acquire AcpiGbl_GpeLock if
AcpiGbl_SystemAwakeAndRunning is set, as one of our callers may already
be holding the AcpiGbl_GpeLock.
2007-12-13 18:04:50 +00:00
jmcneill
c44d13d630 No longer required after jmcneill-pm merge. 2007-12-11 23:07:30 +00:00
lukem
bf6e75e528 NetBSD RCSID love 2007-12-11 13:16:00 +00:00
lukem
a0dda790c5 use __KERNEL_RCSID() 2007-12-11 11:08:19 +00:00
lukem
6c9202e6d8 Use __KERNEL_RCSID() instead of vendor RCS or SCCS IDs. 2007-12-11 04:55:00 +00:00
jmcneill
4c1d81b2b5 Merge jmcneill-pm branch. 2007-12-09 20:27:42 +00:00
dyoung
5b90d794cb Use IFADDR_FOREACH(). 2007-12-05 01:11:24 +00:00
dyoung
b6995d1653 Bug fix: make pf_route() set M_CSUM_IPV4 before calling ip_fragment().
If you use a route-to rule such as 'pass out quick on ath0 route-to
gre2 all', and the MTU on gre2 is smaller than the MTU on ath0,
then pf_route() will fragment your packet by calling ip_fragment().
Because pf_route() did not set M_CSUM_IPv4, ip_fragment() would
not compute the checksum on the fragments, and PF would send IP
fragments with bad checksums out of gre2.
2007-11-28 04:23:33 +00:00
martti
811a7577e8 Bring some fixes from IPF 4.1.27 in order to fix kern/37037. 2007-10-02 06:15:11 +00:00
martti
abde7e33e0 Fixed IPF bug #1767831
ipflog() & ipmon ignore IPv6 extension headers
2007-09-17 18:02:21 +00:00
martti
05122b2bd9 Fixed IPF bug #1779455
state timer should be reset when retransmission is seen
2007-09-17 06:56:15 +00:00
martti
1f09bebe3d Returning from m_pulldown can leave the first mbut with no data (m_len = 0).
The mbuf chain wasn't being walked and thus fin_m was not updated to point
to the new first mbuf with data in it.

Patch from the official IPFilter repository.
2007-09-17 06:25:21 +00:00
martti
4a8ab0e43a Fixed IPF bug #1774745
retransmitted ACK may initiate connection state transition
2007-09-14 11:28:45 +00:00
martti
1122544750 Fixed IPF bug #1794544
keep frags does not work with IPv6
2007-09-14 09:57:07 +00:00
martti
61078fef5f Revert to previous, it was not working for me correctly... 2007-09-10 06:28:38 +00:00
martti
fcbc8c046f Fixed IPF bug #1767831
ipflog() & ipmon ignore IPv6 extension headers

Patch fetched from the SourceForge bug report.
2007-09-10 06:12:02 +00:00
martti
20df8bbd24 Fixed IPF bug #1785199
fr_natderef causes lock contention and performance slowdown

Patch fetched from the SourceForge bug report.
2007-09-10 06:07:01 +00:00
martti
2021a17984 Fixed IPF bug #1791241 ("keep frag does not work with keep state for fragments")
Patch fetched from the SourceForge bug report.
2007-09-10 06:03:21 +00:00
yamt
6065343dde reduce diff. 2007-08-07 10:02:40 +00:00
gdt
7143faccbb Avoid casting to "i6addr_t *", because that type requires 64-bit
alignment and nothing guarantees that IPv6 packets in mbufs are 8-byte
aligned.  gcc was coalescing adjacent 32-bit compares into "ldx" on
sparc64, leading to alignment faults when processing icmp6 arriving on
gif with IPv4 outer addresses.

Fix mostly from darrenr@.  Discussed extensively on port-sparc64.
2007-07-19 14:04:34 +00:00
ad
88ab7da936 Merge some of the less invasive changes from the vmlocking branch:
- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements
2007-07-09 20:51:58 +00:00
mlelstv
f9a2fc4868 Avoid use of cached pointers that might be stale due to mbuf operations. 2007-06-24 22:16:35 +00:00
martin
0d8033bf02 (Re-)add a missing cast in an #if part not used in current, but needed
for netbsd-4.
2007-06-17 09:32:34 +00:00
martin
c77a3f5aad Upgraded IPFilter to v4.1.23 2007-06-16 10:52:24 +00:00
dyoung
95edb940c2 Get rid of radix_node_head.rnh_walktree, because it is only ever
set to rn_walktree.

Introduce rt_walktree(), which applies a subroutine to every route
in a particular address family.  Use it instead of rn_walktree()
virtually everywhere.  This helps to hide the routing table
implementation.
2007-06-09 03:07:21 +00:00
martti
fff7fd04df s/iplattach/ipfattach/ and s/ipldetach/ipfdetach/ 2007-06-04 12:38:58 +00:00
darrenr
fade943a7f The wrong condition was being tested for when deciding which fields to
update in ICMP error messages.  In the test case for this, the wrong
input was actually being used (it should be the headers from the previous
packet output) and therefore the expected results were also wildly wrong.

kern/36309
2007-05-31 10:33:54 +00:00
darrenr
5daa30646c the call to ipf_freetoken() free's the structure pointed to by 't' so doing
any sort of dereference of it afterwards is just a bad idea...
2007-05-30 06:27:11 +00:00
martti
6b17040b66 Fix problems with stateful filtering. Patch received from darrenr@. 2007-05-25 06:44:20 +00:00
christos
1425884c9e Coverity CID 3157: remove bogus break. 2007-05-17 17:04:12 +00:00
martin
6718c86598 Merge IP-Filter 4.1.22 2007-05-15 22:52:20 +00:00
dyoung
f7748bc6aa pfctl: extend pf.conf(5) syntax. Let the operator supply an optional
"state lock" flag (if-bound, gr-bound, floating) at the end of a
NAT rule.  The new syntax is backwards-compatbile with the old
syntax.

PF (kernel): change the macro BOUND_IFACE() to the inline function
bound_iface(), and add a new argument, the applicable NAT rule.
Use both the flags on the applicable filter rule and on the applicable
NAT rule to decide whether or not to bind a state to the interface
or the group where it is created.
2007-05-10 22:30:54 +00:00
dyoung
a56ad6a493 Use the system's offsetof() definition from sys/systm.h (in kernel)
or stddef.h (out of kernel).  Remove IPF's troublesome offsetof()
definitions.  This lets IPF build on amd64.
2007-05-04 19:50:42 +00:00
dyoung
72f0a6dfb0 Eliminate address family-specific route caches (struct route, struct
route_in6, struct route_iso), replacing all caches with a struct
route.

The principle benefit of this change is that all of the protocol
families can benefit from route cache-invalidation, which is
necessary for correct routing.  Route-cache invalidation fixes an
ancient PR, kern/3508, at long last; it fixes various other PRs,
also.

Discussions with and ideas from Joerg Sonnenberger influenced this
work tremendously.  Of course, all design oversights and bugs are
mine.

DETAILS

1 I added to each address family a pool of sockaddrs.  I have
  introduced routines for allocating, copying, and duplicating,
  and freeing sockaddrs:

        struct sockaddr *sockaddr_alloc(sa_family_t af, int flags);
        struct sockaddr *sockaddr_copy(struct sockaddr *dst,
                                       const struct sockaddr *src);
        struct sockaddr *sockaddr_dup(const struct sockaddr *src, int flags);
        void sockaddr_free(struct sockaddr *sa);

  sockaddr_alloc() returns either a sockaddr from the pool belonging
  to the specified family, or NULL if the pool is exhausted.  The
  returned sockaddr has the right size for that family; sa_family
  and sa_len fields are initialized to the family and sockaddr
  length---e.g., sa_family = AF_INET and sa_len = sizeof(struct
  sockaddr_in).  sockaddr_free() puts the given sockaddr back into
  its family's pool.

  sockaddr_dup() and sockaddr_copy() work analogously to strdup()
  and strcpy(), respectively.  sockaddr_copy() KASSERTs that the
  family of the destination and source sockaddrs are alike.

  The 'flags' argumet for sockaddr_alloc() and sockaddr_dup() is
  passed directly to pool_get(9).

2 I added routines for initializing sockaddrs in each address
  family, sockaddr_in_init(), sockaddr_in6_init(), sockaddr_iso_init(),
  etc.  They are fairly self-explanatory.

3 structs route_in6 and route_iso are no more.  All protocol families
  use struct route.  I have changed the route cache, 'struct route',
  so that it does not contain storage space for a sockaddr.  Instead,
  struct route points to a sockaddr coming from the pool the sockaddr
  belongs to.  I added a new method to struct route, rtcache_setdst(),
  for setting the cache destination:

        int rtcache_setdst(struct route *, const struct sockaddr *);

  rtcache_setdst() returns 0 on success, or ENOMEM if no memory is
  available to create the sockaddr storage.

  It is now possible for rtcache_getdst() to return NULL if, say,
  rtcache_setdst() failed.  I check the return value for NULL
  everywhere in the kernel.

4 Each routing domain (struct domain) has a list of live route
  caches, dom_rtcache.  rtflushall(sa_family_t af) looks up the
  domain indicated by 'af', walks the domain's list of route caches
  and invalidates each one.
2007-05-02 20:40:22 +00:00
dogcow
93c1d76796 Instead of manually multiplying out the magic numbers, use * 15 / 10 instead
of * 1.5; this seems to placate the various compilers into not requiring fp.
2007-05-02 18:47:27 +00:00
martti
69c0a989e5 Sync with official IPF 2007-05-02 09:53:09 +00:00
dogcow
36f6a11c63 gcc is too clueless on some platforms to tell that
(number divisible by 2 * 1.5) is an int, and thus fails spectacularly
at either link or compile time. replace exprs with their int values.
2007-05-02 02:59:54 +00:00
martti
872147fef7 Upgraded IPFilter to 4.1.20 2007-05-01 19:08:03 +00:00
jnemeth
7456457055 Add a define for caddr_t to ip_compat.h and revert most of the
special cases for it.  This is to simplify the code to prepare it
for pullup to netbsd-4 and submitting back upstream.  The change
was requested by martin@.
2007-04-27 10:17:15 +00:00