mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-06 13:09:50 +00:00
Code Issues Releases Activity
172,964 Commits 339 Branches 3,562 Tags 2.1 GiB
dcb68fba2d
Commit Graph

4447 Commits

Author SHA1 Message Date
Michael Tuexen
dcb68fba2d Small cleanups. No functional change. 
MFC after:	10 days
 2012-09-14 18:32:20 +00:00
Gleb Smirnoff
3b3a8eb937 o Create directory sys/netpfil, where all packet filters should 
reside, and move there ipfw(4) and pf(4).

o Move most modified parts of pf out of contrib.

Actual movements:

sys/contrib/pf/net/*.c		-> sys/netpfil/pf/
sys/contrib/pf/net/*.h		-> sys/net/
contrib/pf/pfctl/*.c		-> sbin/pfctl
contrib/pf/pfctl/*.h		-> sbin/pfctl
contrib/pf/pfctl/pfctl.8	-> sbin/pfctl
contrib/pf/pfctl/*.4		-> share/man/man4
contrib/pf/pfctl/*.5		-> share/man/man5

sys/netinet/ipfw		-> sys/netpfil/ipfw

The arguable movement is pf/net/*.h -> sys/net. There are
future plans to refactor pf includes, so I decided not to
break things twice.

Not modified bits of pf left in contrib: authpf, ftp-proxy,
tftp-proxy, pflogd.

The ipfw(4) movement is planned to be merged to stable/9,
to make head and stable match.

Discussed with:		bz, luigi
 2012-09-14 11:51:49 +00:00
Michael Tuexen
8225a9bc85 Whitespace changes. 
MFC after: 10 days
 2012-09-09 08:14:04 +00:00
Michael Tuexen
fe6bb0a788 Whitespace cleanup. 
MFC after: 10 days
 2012-09-08 20:54:54 +00:00
Gleb Smirnoff
d6d3f01e0a Merge the projects/pf/head branch, that was worked on for last six months, 
into head. The most significant achievements in the new code:

 o Fine grained locking, thus much better performance.
 o Fixes to many problems in pf, that were specific to FreeBSD port.

New code doesn't have that many ifdefs and much less OpenBSDisms, thus
is more attractive to our developers.

  Those interested in details, can browse through SVN log of the
projects/pf/head branch. And for reference, here is exact list of
revisions merged:

r232043, r232044, r232062, r232148, r232149, r232150, r232298, r232330,
r232332, r232340, r232386, r232390, r232391, r232605, r232655, r232656,
r232661, r232662, r232663, r232664, r232673, r232691, r233309, r233782,
r233829, r233830, r233834, r233835, r233836, r233865, r233866, r233868,
r233873, r234056, r234096, r234100, r234108, r234175, r234187, r234223,
r234271, r234272, r234282, r234307, r234309, r234382, r234384, r234456,
r234486, r234606, r234640, r234641, r234642, r234644, r234651, r235505,
r235506, r235535, r235605, r235606, r235826, r235991, r235993, r236168,
r236173, r236179, r236180, r236181, r236186, r236223, r236227, r236230,
r236252, r236254, r236298, r236299, r236300, r236301, r236397, r236398,
r236399, r236499, r236512, r236513, r236525, r236526, r236545, r236548,
r236553, r236554, r236556, r236557, r236561, r236570, r236630, r236672,
r236673, r236679, r236706, r236710, r236718, r237154, r237155, r237169,
r237314, r237363, r237364, r237368, r237369, r237376, r237440, r237442,
r237751, r237783, r237784, r237785, r237788, r237791, r238421, r238522,
r238523, r238524, r238525, r239173, r239186, r239644, r239652, r239661,
r239773, r240125, r240130, r240131, r240136, r240186, r240196, r240212.

I'd like to thank people who participated in early testing:

Tested by:	Florian Smeets <flo freebsd.org>
Tested by:	Chekaluk Vitaly <artemrts ukr.net>
Tested by:	Ben Wilber <ben desync.com>
Tested by:	Ian FREISLICH <ianf cloudseed.co.za>
 2012-09-08 06:41:54 +00:00
Michael Tuexen
a169d6ec2b Don't include a structure containing a flexible array in another 
structure.

MFC after:	10 days
 2012-09-07 13:36:42 +00:00
Michael Tuexen
12780a595e Get rid of a gcc'ism. 
MFC after: 10 days
 2012-09-06 07:03:56 +00:00
Michael Tuexen
dd294dcec6 Using %p in a format string requires a void *. 
MFC after: 10 days
 2012-09-05 18:52:01 +00:00
Michael Tuexen
2899aa8f65 Use the consistenly the size of a variable. This helps to keep the code 
simpler for the userland implementation.

MFC after: 3 days
 2012-09-04 22:45:00 +00:00
Michael Tuexen
c6328f940e Whitespace change. 
MFC after: 3 days
 2012-09-04 22:40:49 +00:00
Alexander V. Chernikov
7d4317bd40 Introduce new link-layer PFIL hook V_link_pfil_hook. 
Merge ether_ipfw_chk() and part of bridge_pfil() into
unified ipfw_check_frame() function called by PFIL.
This change was suggested by rwatson? @ DevSummit.

Remove ipfw headers from ether/bridge code since they are unneeded now.

Note this thange introduce some (temporary) performance penalty since
PFIL read lock has to be acquired for every link-level packet.

MFC after:     3 weeks
 2012-09-04 19:43:26 +00:00
Gleb Smirnoff
478df1d534 Provide a sysctl switch that allows to install ARP entries 
with multicast bit set. FreeBSD refuses to install such
entries since 9.0, and this broke installations running
Microsoft NLB, which are violating standards.

Tested by:	Tarasov Oleg <oleg_tarasov sg-tea.com>
 2012-09-03 14:29:28 +00:00
Michael Tuexen
81eb4e6351 Fix a typo which results in RTT to be off by a factor of 10, if the RTT is 
larger than 1 second.

MFC after:	3 days
 2012-09-02 12:37:30 +00:00
Eitan Adler
64baf9fbe0 Mark the ipfw interface type as not being ether. This fixes an issue 
where uuidgen tried to obtain a ipfw device's mac address which was
    always zero.

    PR:		170460
    Submitted by:	wxs
    Reviewed by:	bdrewery
    Reviewed by:	delphij
    Approved by:	cperciva
    MFC after:	1 week
 2012-09-01 23:33:49 +00:00
Randall Stewart
ec03d5433f This small change takes care of a race condition 
that can occur when both sides close at the same time.
If that occurs, without this fix the connection enters
FIN1 on both sides and they will forever send FIN|ACK at
each other until the connection times out. This is because
we stopped processing the FIN|ACK and thus did not advance
the sequence and so never ACK'd each others FIN. This
fix adjusts it so we *do* process the FIN properly and
the race goes away ;-)

MFC after:	1 month
 2012-08-25 09:26:37 +00:00
Navdeep Parhar
06fd9875aa Correctly handle the case where an inp has already been dropped by the time 
the TOE driver reports that an active open failed.  toe_connect_failed is
supposed to handle this but it should be provided the inpcb instead of the
tcpcb which may no longer be around.
 2012-08-21 18:09:33 +00:00
Randall Stewart
7db496de2c Though I disagree, I conceed to jhb & Rui. Note 
that we still have a problem with this whole structure of
locks and in_input.c [it does not lock which it should not, but
this *can* lead to crashes]. (I have seen it in our SQA
testbed.. besides the one with a refcnt issue that I will
have SQA work on next week ;-)
 2012-08-19 11:54:02 +00:00
Randall Stewart
9424879158 Ok jhb, lets move the ifa_free() down to the bottom to 
assure that *all* tables and such are removed before
we start to free. This won't protect the Hash in ip_input.c
but in theory should protect any other uses that *do* use locks.

MFC after:	1 week (or more)
 2012-08-17 05:51:46 +00:00
Lawrence Stewart
ee24d3b840 The TCP PAWS fix for kernels with fast tick rates (r231767) changed the TCP 
timestamp related stack variables to reference ms directly instead of ticks.
The h_ertt(4) Khelp module relies on TCP timestamp information in order to
calculate its enhanced RTT estimates, but was not updated as part of r231767.

Consequently, h_ertt has not been calculating correct RTT estimates since
r231767 was comitted, which in turn broke all delay-based congestion control
algorithms because they rely on the h_ertt RTT estimates.

Fix the breakage by switching h_ertt to use tcp_ts_getticks() in place of all
previous uses of the ticks variable. This ensures all timestamp related
variables in h_ertt use the same units as the TCP stack and therefore results in
meaningful comparisons and RTT estimate calculations.

Reported & tested by:	Naeem Khademi (naeemk at ifi uio no)
Discussed with:	bz
MFC after:	3 days
 2012-08-17 01:49:51 +00:00
Randall Stewart
184749821f Its never a good idea to double free the same 
address.

MFC after:	1 week (after the other commits ahead of this gets MFC'd)
 2012-08-16 17:55:16 +00:00
Luigi Rizzo
e5813a3bce s/lenght/length/ in comments 2012-08-07 07:52:25 +00:00
Luigi Rizzo
17369272e4 move functions outside the SYSBEGIN/SYSEND block 
(SYSBEGIN/SYSEND are specific to ipfw/dummynet and are used to
emulate sysctl on platforms that do not have them, and they work
by creating an array which contains all the sysctl-ed symbols.)
 2012-08-06 11:02:23 +00:00
Luigi Rizzo
00c4633285 use FREE_PKT instead of m_freem to free an mbuf. 
The former is the standard form used in ipfw/dummynet, so that
it is easier to remap it to different memory managers depending
on the platform.
 2012-08-06 10:50:43 +00:00
Michael Tuexen
55b175e747 Fix a bug found by dim@: 
Don't use an uninitilized variable, if INVARIANTS is on and an illegal
packet with destination 0 is received.

MFC after:	3 days
X-MFC with:	238003
 2012-08-06 10:50:23 +00:00
Mikolaj Golub
655f934b78 In tcp timers, check INP_DROPPED flag a little later, after 
callout_deactivate(), so if INP_DROPPED is set we return with the
timer active flag cleared.

For me this fixes negative keep timer values reported by `netstat -x'
for connections in CLOSE state.

Approved by:	net (silence)
MFC after:	2 weeks
 2012-08-05 17:30:17 +00:00
Michael Tuexen
63c6726e05 Fix a refcount issue. The called only decrements is stcb is NULL. 
MFC after:	3 days
Discussed with:	rrs
 2012-08-05 10:47:18 +00:00
Michael Tuexen
832208514f Fix a bug reported by Simon L. B. Nielsen: 
If an SCTP endpoint receives an ASCONF with a wildcard
lookup address and incorrect verification tag, the system
crashes.

MFC after:	3 days.
 2012-08-04 20:40:36 +00:00
Michael Tuexen
173be2b6cd Testing an interface property should depend on the interface, not 
on an address.

MFC after:	3 days
 2012-08-04 08:03:30 +00:00
Gleb Smirnoff
ea53792942 Fix races between in_lltable_prefix_free(), lla_lookup(), 
llentry_free() and arptimer():

o Use callout_init_rw() for lle timeout, this allows us safely
  disestablish them.
  - This allows us to simplify the arptimer() and make it
    race safe.
o Consistently use ifp->if_afdata_lock to lock access to
  linked lists in the lle hashes.
o Introduce new lle flag LLE_LINKED, which marks an entry that
  is attached to the hash.
  - Use LLE_LINKED to avoid double unlinking via consequent
    calls to llentry_free().
  - Mark lle with LLE_DELETED via |= operation istead of =,
    so that other flags won't be lost.
o Make LLE_ADDREF(), LLE_REMREF() and LLE_FREE_LOCKED() more
  consistent and provide more informative KASSERTs.

The patch is a collaborative work of all submitters and myself.

PR:		kern/165863
Submitted by:	Andrey Zonov <andrey zonov.org>
Submitted by:	Ryan Stone <rysto32 gmail.com>
Submitted by:	Eric van Gyzen <eric_van_gyzen dell.com>
 2012-08-02 13:57:49 +00:00
Luigi Rizzo
46f2f751e1 replace __unused with a portable construct; 
fix a couple of signed/unsigned warnings.
 2012-08-02 12:45:13 +00:00
Luigi Rizzo
f5705b527d replace inet_ntoa_r with the more standard inet_ntop(). 
As discussed on -current, inet_ntoa_r() is non standard,
has different arguments in userspace and kernel, and
almost unused (no clients in userspace, only
net/flowtable.c, net/if_llatbl.c, netinet/in_pcb.c, netinet/tcp_subr.c
in the kernel)
 2012-08-01 18:52:07 +00:00
Luigi Rizzo
71ca24f182 add a cast to avoid a signed/unsigned warning (to be removed 
when we will have TUNABLE_UINT constructors)
 2012-08-01 18:49:00 +00:00
Gleb Smirnoff
b9aee262e5 Some more whitespace cleanup. 2012-08-01 09:00:26 +00:00
Gleb Smirnoff
ea50c13ebe Some style(9) and whitespace changes. 
Together with:	Andrey Zonov <andrey zonov.org>
 2012-07-31 11:31:12 +00:00
Luigi Rizzo
9df9e62789 nobody uses this file except the userspace ipfw code, but the cast 
of a pointer to an integer needs a cast to prevent a warning for
size mismatch.

MFC after:	1 week
 2012-07-31 08:04:49 +00:00
Michael Tuexen
77db9ed99e Fix the sctp_sockstore union such that userland programs don't depend 
on INET and/or INET6 to be defined and in-tune with how the kernel
was compiled.

MFC after:	3 days
Discussed with:	rrs
 2012-07-26 08:10:29 +00:00
Bjoern A. Zeeb
8253dcabe7 Fix a problem when CARP is enabled on the interface for IPv4 
but not for IPv6.  The current checks in nd6_nbr.c along with the
old version will result in ifa being NULL and subsequently the
packet will be dropped.  This prevented NS/NA, from working and
with that IPv6.

Now return the ifa from the carp lookup function in two cases:
1) if the address matches, is a carp address, and we are MASTER
   (as before),
2) if the address matches but it is not a carp address at all (new).

Reported by:	Peter Wemm (new Y! FreeBSD cluster, eating our own dogfood)
Tested on:	New Y! FreeBSD cluster machines
Reviewed by:	glebius
 2012-07-25 12:14:39 +00:00
Robert Watson
0989f56cff Update some stale comments regarding tcbinfo locking in the TCP input 
path: read locks on tcbinfo are no longer used, so won't happen.  No
functional change.

MFC after:	3 days
 2012-07-22 17:31:36 +00:00
Gleb Smirnoff
3c73180f55 Plug a reference leak: before doing 'goto again' we need to unref 
ia->ia_ifa if there is any.

Submitted by:	Andrey Zonov <andrey zonov.org>
 2012-07-18 08:58:30 +00:00
Gleb Smirnoff
b9abeb9d99 When traversing global in_ifaddr list in the IFP_TO_IA() macro, we need 
to obtain IN_IFADDR_RLOCK().
 2012-07-18 08:41:00 +00:00
Michael Tuexen
d07b2ac6c6 Fix a refcount bug when freeing an association. 
While there: Change code to be consistent.
Discussed with rrs@.
MFC after: 3 days
 2012-07-17 13:03:47 +00:00
Gleb Smirnoff
df0633a145 If ip_output() returns EMSGSIZE to tcp_output(), then the latter calls 
tcp_mtudisc(), which in its turn may call tcp_output(). Under certain
conditions (must admit they are very special) an infinite recursion can
happen.

To avoid recursion we can pass struct route to ip_output() and obtain
correct mtu. This allows us not to use tcp_mtudisc() but call tcp_mss_update()
directly.

PR:		kern/155585
Submitted by:	Andrey Zonov <andrey zonov.org> (original version of patch)
 2012-07-16 07:08:34 +00:00
Michael Tuexen
5e20b91dbe Changes which improve compilation if neither INET nor INET6 is defined. 
MFC after: 3 days
 2012-07-15 20:16:17 +00:00
Michael Tuexen
e0e00a4d0f #ifdef INET and INET6 consistently. This also fixes a bug, where 
it was done wrong.

MFC after: 3 days
 2012-07-15 11:04:49 +00:00
Michael Tuexen
ad83c8a5a5 Provide the correct notification type (SCTP_SEND_FAILED_EVENT) 
for unsent messages.

MFC after: 3 days
 2012-07-14 21:25:14 +00:00
Michael Tuexen
b5e0cd79c2 Use case for selecting the address family (as in other places). 
MFC after: 3 days
 2012-07-14 20:08:03 +00:00
Michael Tuexen
c9afdc3aa9 Use case for selecting the address family (as in other places). 
MFC after: 3 days
 2012-07-14 19:44:39 +00:00
Michael Tuexen
5db75fc724 Fix a bug introduced in r237715. 
MFC after:i 3 days.
 2012-07-09 10:59:39 +00:00
Hiroki Sato
8efbd296e0 Make ipfw0 logging pseudo-interface clonable. It can be created automatically 
by $firewall_logif rc.conf(5) variable at boot time or manually by ifconfig(8)
after a boot.

Discussed on:	freebsd-ipfw@
 2012-07-09 07:16:19 +00:00
Alexander V. Chernikov
30835e6d50 Finally fix lookup (account remaining '\0') and deletion 
(provide valid key length for radix lookup).

Submitted by:    Ihor Kaharlichenko<madkinder at gmail.com>  (prev version)
Approved by:     kib(mentor)
MFC after:       3 days

Sponsored by:    Shtorm ISP
 2012-07-08 21:13:04 +00:00