upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-04-26 08:37:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
174756 commits 29 branches 224 tags 2.1 GiB
Commit graph

1178 commits

Author SHA1 Message Date
Andrey V. Elsukov
35e692dc0e Remove opt_inet.h, it isn't required here. 
MFC after:	1 week
 2012-11-20 14:09:37 +00:00
Hiroki Sato
3829d13564 Check if an extracted zoneid is equal to the non-zero sin6_scope_id only when 
it is link-local or MC interface-local.
 2012-11-18 16:06:51 +00:00
Michael Tuexen
3a51a2647a Add support for SCTP/UDP/IPV6. 
This completes the support of
http://tools.ietf.org/html/draft-ietf-tsvwg-sctp-udp-encaps

MFC after: 1 week
 2012-11-17 20:04:04 +00:00
Andrey V. Elsukov
73cb2f38f2 Reduce the overhead of locking, use IF_AFDATA_RLOCK() when we are doing 
simple lookups.

Sponsored by:	Yandex LLC
MFC after:	1 week
 2012-11-16 12:12:02 +00:00
Andrey V. Elsukov
5cf7ec13f7 if_afdata lock was converted from mutex to rwlock a long ago, so we can 
replace IF_AFDATA_LOCK() macro depending to the access type.

Sponsored by:	Yandex LLC
MFC after:	1 week
 2012-11-14 17:36:06 +00:00
Andrey V. Elsukov
862a3e1227 SCOPE6_LOCK protects V_sid_default, no need to acquire it without 
any access to V_sid_default.

Sponsored by:	Yandex LLC
MFC after:	1 week
 2012-11-14 17:23:48 +00:00
Andrey V. Elsukov
f062401329 zoneid has unsigned type. 
MFC after:	1 week
 2012-11-14 17:14:03 +00:00
David E. O'Brien
f1e0de695c Use consistent style. 2012-11-13 01:48:00 +00:00
Andrey V. Elsukov
ffdbf9da3b Remove the recently added sysctl variable net.pfil.forward. 
Instead, add protocol specific mbuf flags M_IP_NEXTHOP and
M_IP6_NEXTHOP. Use them to indicate that the mbuf's chain
contains the PACKET_TAG_IPFORWARD tag. And do a tag lookup
only when this flag is set.

Suggested by:	andre
 2012-11-02 01:20:55 +00:00
Michael Tuexen
21f67da7c4 Whitespace changes due to upstream integration of SCTP changes in the 
FreeBSD code base.
 2012-10-29 20:47:32 +00:00
Andrey V. Elsukov
c1de64a495 Remove the IPFIREWALL_FORWARD kernel option and make possible to turn 
on the related functionality in the runtime via the sysctl variable
net.pfil.forward. It is turned off by default.

Sponsored by:	Yandex LLC
Discussed with:	net@
MFC after:	2 weeks
 2012-10-25 09:39:14 +00:00
Xin LI
6f56329a25 Remove __P. 
Submitted by:	kevlo
Reviewed by:	md5(1)
MFC after:	2 months
 2012-10-22 21:49:56 +00:00
Gleb Smirnoff
8f134647ca Switch the entire IPv4 stack to keep the IP packet header 
in network byte order. Any host byte order processing is
done in local variables and host byte order values are
never[1] written to a packet.

  After this change a packet processed by the stack isn't
modified at all[2] except for TTL.

  After this change a network stack hacker doesn't need to
scratch his head trying to figure out what is the byte order
at the given place in the stack.

[1] One exception still remains. The raw sockets convert host
byte order before pass a packet to an application. Probably
this would remain for ages for compatibility.

[2] The ip_input() still subtructs header len from ip->ip_len,
but this is planned to be fixed soon.

Reviewed by:	luigi, Maxim Dounin <mdounin mdounin.ru>
Tested by:	ray, Olivier Cochard-Labbe <olivier cochard.me>
 2012-10-22 21:09:03 +00:00
Alexander V. Chernikov
7994d24f0c Eliminate code checking if found IPv6 rte is dynamic. IPv6 redirects 
are using (different) ND-based approach described in RFC 4861. This change
is similar to r241406 which conditionally skips the same check in IPv4.

This change is part of bigger patch eliminating rte locking.

Sponsored by:	Yandex LLC.
OK'd by:	hrs
MFC after:	2 weeks
 2012-10-22 12:54:52 +00:00
Andre Oppermann
c9b652e3e8 Mechanically remove the last stray remains of spl* calls from net*/*. 
They have been Noop's for a long time now.
 2012-10-18 13:57:24 +00:00
Alexander V. Chernikov
3bff27cd67 Cleanup documentation: cloning route support has been removed in r186119. 
MFC after:	2 weeks
 2012-10-13 09:31:01 +00:00
Kevin Lo
9823d52705 Revert previous commit... 
Pointyhat to:	kevlo (myself)
 2012-10-10 08:36:38 +00:00
Kevin Lo
a10cee30c9 Prefer NULL over 0 for pointers 2012-10-09 08:27:40 +00:00
Andriy Gapon
ce8b4f7cb9 ip6_ipsec_output: fix a typo in r241344 
Acting as a remote drone of glebius.
 2012-10-08 13:45:40 +00:00
Gleb Smirnoff
23e9c6dc1e After r241245 it appeared that in_delayed_cksum(), which still expects 
host byte order, was sometimes called with net byte order. Since we are
moving towards net byte order throughout the stack, the function was
converted to expect net byte order, and its consumers fixed appropriately:
  - ip_output(), ipfilter(4) not changed, since already call
    in_delayed_cksum() with header in net byte order.
  - divert(4), ng_nat(4), ipfw_nat(4) now don't need to swap byte order
    there and back.
  - mrouting code and IPv6 ipsec now need to switch byte order there and
    back, but I hope, this is temporary solution.
  - In ipsec(4) shifted switch to net byte order prior to in_delayed_cksum().
  - pf_route() catches up on r241245 changes to ip_output().
 2012-10-08 08:03:58 +00:00
Gleb Smirnoff
d6d3f01e0a Merge the projects/pf/head branch, that was worked on for last six months, 
into head. The most significant achievements in the new code:

 o Fine grained locking, thus much better performance.
 o Fixes to many problems in pf, that were specific to FreeBSD port.

New code doesn't have that many ifdefs and much less OpenBSDisms, thus
is more attractive to our developers.

  Those interested in details, can browse through SVN log of the
projects/pf/head branch. And for reference, here is exact list of
revisions merged:

r232043, r232044, r232062, r232148, r232149, r232150, r232298, r232330,
r232332, r232340, r232386, r232390, r232391, r232605, r232655, r232656,
r232661, r232662, r232663, r232664, r232673, r232691, r233309, r233782,
r233829, r233830, r233834, r233835, r233836, r233865, r233866, r233868,
r233873, r234056, r234096, r234100, r234108, r234175, r234187, r234223,
r234271, r234272, r234282, r234307, r234309, r234382, r234384, r234456,
r234486, r234606, r234640, r234641, r234642, r234644, r234651, r235505,
r235506, r235535, r235605, r235606, r235826, r235991, r235993, r236168,
r236173, r236179, r236180, r236181, r236186, r236223, r236227, r236230,
r236252, r236254, r236298, r236299, r236300, r236301, r236397, r236398,
r236399, r236499, r236512, r236513, r236525, r236526, r236545, r236548,
r236553, r236554, r236556, r236557, r236561, r236570, r236630, r236672,
r236673, r236679, r236706, r236710, r236718, r237154, r237155, r237169,
r237314, r237363, r237364, r237368, r237369, r237376, r237440, r237442,
r237751, r237783, r237784, r237785, r237788, r237791, r238421, r238522,
r238523, r238524, r238525, r239173, r239186, r239644, r239652, r239661,
r239773, r240125, r240130, r240131, r240136, r240186, r240196, r240212.

I'd like to thank people who participated in early testing:

Tested by:	Florian Smeets <flo freebsd.org>
Tested by:	Chekaluk Vitaly <artemrts ukr.net>
Tested by:	Ben Wilber <ben desync.com>
Tested by:	Ian FREISLICH <ianf cloudseed.co.za>
 2012-09-08 06:41:54 +00:00
Mikolaj Golub
ab16a5bd08 In ip6_ctloutput() guard inp_flags modifications with INP_WLOCK. 
MFC after:	2 weeks
 2012-08-19 08:16:13 +00:00
Gleb Smirnoff
ea53792942 Fix races between in_lltable_prefix_free(), lla_lookup(), 
llentry_free() and arptimer():

o Use callout_init_rw() for lle timeout, this allows us safely
  disestablish them.
  - This allows us to simplify the arptimer() and make it
    race safe.
o Consistently use ifp->if_afdata_lock to lock access to
  linked lists in the lle hashes.
o Introduce new lle flag LLE_LINKED, which marks an entry that
  is attached to the hash.
  - Use LLE_LINKED to avoid double unlinking via consequent
    calls to llentry_free().
  - Mark lle with LLE_DELETED via |= operation istead of =,
    so that other flags won't be lost.
o Make LLE_ADDREF(), LLE_REMREF() and LLE_FREE_LOCKED() more
  consistent and provide more informative KASSERTs.

The patch is a collaborative work of all submitters and myself.

PR:		kern/165863
Submitted by:	Andrey Zonov <andrey zonov.org>
Submitted by:	Ryan Stone <rysto32 gmail.com>
Submitted by:	Eric van Gyzen <eric_van_gyzen dell.com>
 2012-08-02 13:57:49 +00:00
Gleb Smirnoff
b9aee262e5 Some more whitespace cleanup. 2012-08-01 09:00:26 +00:00
Bjoern A. Zeeb
3b43b78342 In case of IPsec he have to do delayed checksum calculations before 
adding any extension header, or rather before calling into IPsec
processing as we may send the packet and not return to IPv6 output
processing here.

PR:		kern/170116
MFC After:	3 days
 2012-07-31 23:34:06 +00:00
Gleb Smirnoff
ea50c13ebe Some style(9) and whitespace changes. 
Together with:	Andrey Zonov <andrey zonov.org>
 2012-07-31 11:31:12 +00:00
Bjoern A. Zeeb
d2ed798615 Properly apply #ifdef INET and leave a comment that we are (will) apply 
delayed IPv6 checksum processing in ip6_output.c when doing IPsec.

PR:		kern/170116
MFC after:	3 days
 2012-07-31 05:44:03 +00:00
Bjoern A. Zeeb
68c99a6023 Improve the should-never-hit printf to ease debugging in case we'd ever hit 
it again when doing the delayed IPv6 checksum calculations.

MFC after:	3 days
 2012-07-31 05:34:54 +00:00
Bjoern A. Zeeb
5dbbe4fdd2 For consistency put the IPsec comment iside the #fidef section. 
MFC after:	3 days
 2012-07-29 00:45:24 +00:00
Bjoern A. Zeeb
c50ffbdf4b Fix a comment that we do not have an SA yet but need to acquire one. 
MFC after:	3 days
 2012-07-29 00:44:41 +00:00
Michael Tuexen
5e20b91dbe Changes which improve compilation if neither INET nor INET6 is defined. 
MFC after: 3 days
 2012-07-15 20:16:17 +00:00
Michael Tuexen
e0e00a4d0f #ifdef INET and INET6 consistently. This also fixes a bug, where 
it was done wrong.

MFC after: 3 days
 2012-07-15 11:04:49 +00:00
Hiroki Sato
f6c336fe66 Remove "prefer_source" address selection option. FreeBSD has had an 
implementation of RFC 3484 for this purpose for a long time and "prefer_source"
was never implemented actually.  ND6_IFF_PREFER_SOURCE macro is left intact.
 2012-07-09 06:21:46 +00:00
Bjoern A. Zeeb
4018ea9a2b Implement handling of "atomic fragements" as outlined in 
draft-gont-6man-ipv6-atomic-fragments to mitigate one class of
possible fragmentation-based attacks.

MFC after:	5 days
 2012-07-08 15:30:24 +00:00
Bjoern A. Zeeb
8dcc26febe As mentioned in the commit message of r237571 (copied from a prototype 
patch of mine) also check if the 2nd in6_setscope() failed and return
the error in that case.

MFC after:	5 days
 2012-07-08 08:49:37 +00:00
Gleb Smirnoff
bf9840512a When ip_output()/ip6_output() is supplied a struct route *ro argument, 
it skips FLOWTABLE lookup. However, the non-NULL ro has dual meaning
here: it may be supplied to provide route, and it may be supplied to
store and return to caller the route that ip_output()/ip6_output()
finds. In the latter case skipping FLOWTABLE lookup is pessimisation.

The difference between struct route filled by FLOWTABLE and filled
by rtalloc() family is that the former doesn't hold a reference on
its rtentry. Reference is hold by flow entry, and it is about to
be released in future. Thus, route filled by FLOWTABLE shouldn't
be passed to RTFREE() macro.

- Introduce new flag for struct route/route_in6, that marks route
  not holding a reference on rtentry.
- Introduce new macro RO_RTFREE() that cleans up a struct route
  depending on its kind.
- All callers to ip_output()/ip6_output() that do supply non-NULL
  but empty route should use RO_RTFREE() to free results of
  lookup.
- ip_output()/ip6_output() now do FLOWTABLE lookup always when
  ro->ro_rt == NULL.

Tested by:	tuexen (SCTP part)
 2012-07-04 07:37:53 +00:00
Gleb Smirnoff
3df6468a2d Remove route caching from IP multicast routing code. There is no 
reason to do that, and also, cached route never got unreferenced,
which meant a reference leak.

Reviewed by:	bms
 2012-07-02 19:44:18 +00:00
Michael Tuexen
a8775ad93d Move common code parts to sctp_common_input_processing(). 
MFC after: 3 days
 2012-07-02 16:44:09 +00:00
Bruce M Simpson
df7e35725b Kick the current-state report timer when a V1 group report would 
be triggered.

Submitted by:	rpaulo@
MFC after:	3 days
 2012-06-28 23:48:40 +00:00
Bruce M Simpson
b7d882304b Fix a typo in MLD query exponent processing. 
Submitted by:	rpaulo@
MFC after:	3 days
 2012-06-28 23:45:37 +00:00
Bruce M Simpson
289ca95209 In MLDv2 general query processing, do not enforce the strict check 
on query origins.

Submitted by:	Gu Yong
MFC after:	3 days
 2012-06-28 23:44:47 +00:00
Michael Tuexen
b1754ad17b Pass the src and dst address of a received packet explicitly around. 
MFC after: 3 days
 2012-06-28 16:01:08 +00:00
Xin LI
5b8f1a8676 Fix a LOR acquiring the if_afdata lock while holding an rtentry lock. 
Possibly do some entra work in case we would not get into the
ifa0 != NULL paths later as we already do for the mltaddr before.

XXX We should possibly error in case in6_setscope fails.

Reference: http://lists.freebsd.org/pipermail/freebsd-net/2011-September/029829.html

Submitted by:	bz
MFC after:	1 week
 2012-06-25 20:56:32 +00:00
Michael Tuexen
6dc5aabcb7 Unify sctp_input() and sctp6_input(). 
MFC after: 3 days
 2012-06-25 19:13:43 +00:00
Michael Tuexen
39803b8c58 Whitespace cleanup. 
MFC after: 3 days
 2012-06-25 17:15:09 +00:00
Michael Tuexen
20cc2188f3 Pass the packet length explicitly around. 
MFC after: 3 days
 2012-06-24 23:12:24 +00:00
Michael Tuexen
f938425253 Do packet logging in a consistent way. 
MFC after: 3 days
 2012-06-24 21:25:54 +00:00
Bjoern A. Zeeb
23bc7025c4 Just add a comment to further investigate when being closer to that code 
again next time.  The condition of the 2nd if() is very unlikely ever met.
 2012-06-22 21:26:35 +00:00
Michael Tuexen
f30ac43257 Pass flowid explicitly through the stack instead of taking it from 
the mbuf chain at different places.
While there: Fix several bugs related to VRFs.

MFC after: 3 days
 2012-06-14 06:54:48 +00:00
Michael Tuexen
b36dcb9a39 Deliver IPV6_TCLASS, IPV6_HOPLIMIT and IPV6_PKTINFO cmsgs (if 
requested) on IPV6 sockets, which have been marked to be not IPV6_V6ONLY,
for each received IPV4 packet.

MFC after: 3 days
 2012-06-12 13:57:56 +00:00