aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Slightly rearrange a code in rev. 1.164:Maxim Konovalov2002-09-231-4/+8
| | | | | | | | | | | | | o Move len initialization closer to place of its first usage. o Compare len with 0 to improve readability. o Explicitly zero out phlen in ip_insertoptions() in failure case. Suggested by: jhb Reviewed by: jhb MFC after: 2 weeks Notes: svn path=/head/; revision=103852
* s/__attribute__((__packed__))/__packed/gAlfred Perlstein2002-09-232-26/+26
| | | | Notes: svn path=/head/; revision=103842
* Fix issue where shutdown(socket, SHUT_RD) was effectivelyMike Silbersack2002-09-222-6/+20
| | | | | | | | | | | ignored for TCP sockets. NetBSD PR: 18185 Submitted by: Sean Boudreau <seanb@qnx.com> MFC after: 3 days Notes: svn path=/head/; revision=103776
* Use m_fixhdr() rather than roll our own.Poul-Henning Kamp2002-09-181-6/+2
| | | | Notes: svn path=/head/; revision=103553
* Guido reported an interesting bug where an FTP connection between aMatthew Dillon2002-09-172-10/+46
| | | | | | | | | | | | | | | | | | | | | | Windows 2000 box and a FreeBSD box could stall. The problem turned out to be a timestamp reply bug in the W2K TCP stack. FreeBSD sends a timestamp with the SYN, W2K returns a timestamp of 0 in the SYN+ACK causing FreeBSD to calculate an insane SRTT and RTT, resulting in a maximal retransmit timeout (60 seconds). If there is any packet loss on the connection for the first six or so packets the retransmit case may be hit (the window will still be too small for fast-retransmit), causing a 60+ second pause. The W2K box gives up and closes the connection. This commit works around the W2K bug. 15:04:59.374588 FREEBSD.20 > W2K.1036: S 1420807004:1420807004(0) win 65535 <mss 1460,nop,wscale 2,nop,nop,timestamp 188297344 0> (DF) [tos 0x8] 15:04:59.377558 W2K.1036 > FREEBSD.20: S 4134611565:4134611565(0) ack 1420807005 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0> (DF) Bug reported by: Guido van Rooij <guido@gvr.org> Notes: svn path=/head/; revision=103505
* Remove __RCSID().Maxim Sobolev2002-09-171-3/+0
| | | | | | | Submitted by: bde Notes: svn path=/head/; revision=103481
* Explicitly clear M_FRAG flag on a mbuf with the last fragment to unbreakMaxim Konovalov2002-09-171-1/+2
| | | | | | | | | | | ip fragments reassembling for loopback interface. Discussed with: bde, jlemon Reviewed by: silence on -net MFC after: 2 weeks Notes: svn path=/head/; revision=103479
* In rare cases when there is no room for ip options ip_insertoptions()Maxim Konovalov2002-09-171-1/+3
| | | | | | | | | | | can fail and corrupt a header length. Initialize len and check what ip_insertoptions() returns. Reviewed by: archie, silence on -net MFC after: 5 days Notes: svn path=/head/; revision=103478
* Tempary fix for inet6. The final fix is to change in6_pcbnotify to take ↵Jennifer Yang2002-09-171-0/+2
| | | | | | | | | pcbinfo instead of pcbhead. It is on the way. Notes: svn path=/head/; revision=103444
* Remove superfluous break.Maxim Sobolev2002-09-101-1/+0
| | | | Notes: svn path=/head/; revision=103176
* Since from now on encap_input() also catches IPPROTO_MOBILE and IPPROTO_GREMaxim Sobolev2002-09-091-1/+1
| | | | | | | | | | | packets in addition to IPPROTO_IPV4 and IPPROTO_IPV6, explicitly specify IPPROTO_IPV4 or IPPROTO_IPV6 instead of -1 when calling encap_attach(). MFC after: 28 days (along with other if_gre changes) Notes: svn path=/head/; revision=103124
* Reduce namespace pollution by staticizing everything, which doesn't need toMaxim Sobolev2002-09-061-4/+4
| | | | | | | be visible from outside of the module. Notes: svn path=/head/; revision=103032
* Add a new gre(4) driver, which could be used to create GRE (RFC1701)Maxim Sobolev2002-09-063-0/+415
| | | | | | | | | and MOBILE (RFC2004) IP tunnels. Obrained from: NetBSD Notes: svn path=/head/; revision=103026
* Fixed namespace pollution in uma changes:Bruce Evans2002-09-051-2/+3
| | | | | | | | | | | | | | | - use `struct uma_zone *' instead of uma_zone_t, so that <sys/uma.h> isn't a prerequisite. - don't include <sys/uma.h>. Namespace pollution makes "opaque" types like uma_zone_t perfectly non-opaque. Such types should never be used (see style(9)). Fixed subsequently grwon dependencies of this header on its own pollution: - include <sys/_mutex.h> and its prerequisite <sys/_lock.h> instead of depending on namespace pollution 2 layers deep in <sys/uma.h>. Notes: svn path=/head/; revision=102981
* Include <sys/mutex.h> and its prerequisite <sys/lock.h> instead of dependingBruce Evans2002-09-051-8/+6
| | | | | | | | | on namespace pollution 4 layers deep in <netinet/in_pcb.h>. Removed unused includes. Sorted includes. Notes: svn path=/head/; revision=102967
* Add in_hosteq() and in_nullhost() macros to make life of developersMaxim Sobolev2002-09-041-0/+3
| | | | | | | | | porting NetBSD code a little bit easier. Obtained from: NetBSD Notes: svn path=/head/; revision=102925
* some ipfilter files that accidently got imported hereDarren Reed2002-08-293-696/+0
| | | | Notes: svn path=/head/; revision=102575
* This commit was generated by cvs2svn to compensate for changes in r102514,Darren Reed2002-08-283-0/+696
|\ | | | | | | | | | | | | which included commits to RCS files with non-trunk default branches. Notes: svn path=/head/; revision=102515
| * Update IP Filter kernel sourcevendor/ipfilter-sys/v3-4-16Darren Reed2001-02-0422-15110/+0
| | | | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=72001 svn path=/vendor-sys/ipfilter/v3-4-16/; revision=72002; tag=vendor/ipfilter-sys/v3-4-16
| * Import IP filter 3.4.13Darren Reed2000-10-298-48/+58
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=67851
| * Import IP Filter 3.4.12 into kernel source treeDarren Reed2000-10-2614-192/+613
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=67611
| * Import IP Filter 3.4.9 bits into the kernelDarren Reed2000-08-1310-102/+367
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=64578
| * import ipfilter 3.4.8Darren Reed2000-07-1913-112/+226
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=63521
| * Import IP Filter 3.4.4 into the kernelDarren Reed2000-05-2420-2497/+6853
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=60848
| * This commit was manufactured by cvs2svn to create branch 'DARRENR'.cvs2svn1999-12-063-0/+612
| | | | | | | | Notes: svn path=/vendor-sys/ipfilter/dist-old/; revision=54222
* | Replace various spelling with FALLTHROUGH which is lint()ablePhilippe Charnier2002-08-253-3/+3
| | | | | | | | Notes: svn path=/head/; revision=102412
* | Lock the sysctl(8) knobs that turn ip{,6}fw(8) firewalling andCrist J. Clark2002-08-251-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | firewall logging on and off when at elevated securelevel(8). It would be nice to be able to only lock these at securelevel >= 3, like rules are, but there is no such functionality at present. I don't see reason to be adding features to securelevel(8) with MAC being merged into 5.0. PR: kern/39396 Reviewed by: luigi MFC after: 1 week Notes: svn path=/head/; revision=102397
* | Correct bug in t_bw_rtttime rollover, #undef USERTTMatthew Dillon2002-08-242-2/+10
| | | | | | | | Notes: svn path=/head/; revision=102368
* | Replace (ab)uses of "NULL" where "0" is really meant.Archie Cobbs2002-08-221-2/+2
| | | | | | | | Notes: svn path=/head/; revision=102291
* | o Merge <machine/ansi.h> and <machine/types.h> into a new headerMike Barcroft2002-08-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | called <machine/_types.h>. o <machine/ansi.h> will continue to live so it can define MD clock macros, which are only MD because of gratuitous differences between architectures. o Change all headers to make use of this. This mainly involves changing: #ifdef _BSD_FOO_T_ typedef _BSD_FOO_T_ foo_t; #undef _BSD_FOO_T_ #endif to: #ifndef _FOO_T_DECLARED typedef __foo_t foo_t; #define _FOO_T_DECLARED #endif Concept by: bde Reviewed by: jake, obrien Notes: svn path=/head/; revision=102227
* | Create new functions in_sockaddr(), in6_sockaddr(), andDon Lewis2002-08-213-46/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in6_v4mapsin6_sockaddr() which allocate the appropriate sockaddr_in* structure and initialize it with the address and port information passed as arguments. Use calls to these new functions to replace code that is replicated multiple times in in_setsockaddr(), in_setpeeraddr(), in6_setsockaddr(), in6_setpeeraddr(), in6_mapped_sockaddr(), and in6_mapped_peeraddr(). Inline COMMON_END in tcp_usr_accept() so that we can call in_sockaddr() with temporary copies of the address and port after the PCB is unlocked. Fix the lock violation in tcp6_usr_accept() (caused by calling MALLOC() inside in6_mapped_peeraddr() while the PCB is locked) by changing the implementation of tcp6_usr_accept() to match tcp_usr_accept(). Reviewed by: suz Notes: svn path=/head/; revision=102218
* | Enclose IPv6 addresses in brackets when they are displayed printable with aJuli Mallett2002-08-192-6/+14
| | | | | | | | | | | | | | | | | | | | | | TCP/UDP port seperated by a colon. This is for the log_in_vain facility. Pointed out by: Edward J. M. Brocklesby Reviewed by: ume MFC after: 2 weeks Notes: svn path=/head/; revision=102131
* | Raise limit for port lists to 30 entries/ranges.Luigi Rizzo2002-08-191-6/+4
| | | | | | | | | | | | | | | | Remove a duplicate "logging" message, and identify the firewall as ipfw2 in the boot message. Notes: svn path=/head/; revision=102086
* | Implement TCP bandwidth delay product window limiting, similar to (butMatthew Dillon2002-08-177-0/+338
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | not meant to duplicate) TCP/Vegas. Add four sysctls and default the implementation to 'off'. net.inet.tcp.inflight_enable enable algorithm (defaults to 0=off) net.inet.tcp.inflight_debug debugging (defaults to 1=on) net.inet.tcp.inflight_min minimum window limit net.inet.tcp.inflight_max maximum window limit MFC after: 1 week Notes: svn path=/head/; revision=102017
* | Cosmetic-only changes for readability.Jeffrey Hsu2002-08-172-652/+556
| | | | | | | | | | | | | | | | Reviewed by: (early form passed by) bde Approved by: itojun (from core@kame.net) Notes: svn path=/head/; revision=102002
* | sys/netinet/ip_fw2.c:Luigi Rizzo2002-08-161-47/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the M_SKIP_FIREWALL bit in m_flags to avoid loops for firewall-generated packets (the constant has to go in sys/mbuf.h). Better comments on keepalive generation, and enforce dyn_rst_lifetime and dyn_fin_lifetime to be less than dyn_keepalive_period. Enforce limits (up to 64k) on the number of dynamic buckets, and retry allocation with smaller sizes. Raise default number of dynamic rules to 4096. Improved handling of set of rules -- now you can atomically enable/disable multiple sets, move rules from one set to another, and swap sets. sbin/ipfw/ipfw2.c: userland support for "noerror" pipe attribute. userland support for sets of rules. minor improvements on rule parsing and printing. sbin/ipfw/ipfw.8: more documentation on ipfw2 extensions, differences from ipfw1 (so we can use the same manpage for both), stateful rules, and some additional examples. Feedback and more examples needed here. Notes: svn path=/head/; revision=101978
* | make the strings for tcptimers, tanames and prurequests const to silenceAlfred Perlstein2002-08-162-2/+2
| | | | | | | | | | | | | | warnings. Notes: svn path=/head/; revision=101975
* | Code formatting sync to trustedbsd_mac: don't perform an assignmentRobert Watson2002-08-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | in an if clause. PR: Submitted by: Reviewed by: Approved by: Obtained from: MFC after: Notes: svn path=/head/; revision=101948
* | Rename mac_check_socket_receive() to mac_check_socket_deliver() so thatRobert Watson2002-08-154-6/+6
| | | | | | | | | | | | | | | | | | | | | | we can use the names _receive() and _send() for the receive() and send() checks. Rename related constants, policy implementations, etc. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101934
* | Reset dupack count in header prediction.Jeffrey Hsu2002-08-152-0/+2
| | | | | | | | | | | | | | | | | | Follow-on to rev 1.39. Reviewed by: jayanth, Thomas R Henderson <thomas.r.henderson@boeing.com>, silby, dillon Notes: svn path=/head/; revision=101928
* | Kernel support for a dummynet option:Luigi Rizzo2002-08-152-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a pipe or queue has the "noerror" attribute, do not report drops to the caller (ip_output() and friends). (2 lines to implement it, 2 lines to document it.) This will let you simulate losses on the sender side as if they happened in the middle of the network, i.e. with no explicit feedback to the sender. manpage and ipfw2.c changes to follow shortly, together with other ipfw2 changes. Requested by: silby MFC after: 3 days Notes: svn path=/head/; revision=101927
* | It's now sufficient to rely on a nested include of _label.h to make sureRobert Watson2002-08-151-1/+0
| | | | | | | | | | | | | | | | | | | | all structures in ip_var.h are defined, so remove include of mac.h. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101921
* | Perform a nested include of _label.h if #ifdef _KERNEL. This willRobert Watson2002-08-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | satisfy consumers of ip_var.h that need a complete definition of struct ipq and don't include mac.h. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101920
* | Add mac.h -- raw_ip.c was depending on nested inclusion of mac.h whichRobert Watson2002-08-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | is no longer present. Pointed out by: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101919
* | remove spurious printfPoul-Henning Kamp2002-08-131-1/+1
| | | | | | | | Notes: svn path=/head/; revision=101843
* | Assert that the inpcb lock is held when calling tcp_output().Jennifer Yang2002-08-121-0/+2
| | | | | | | | | | | | | | Approved by: hsu Notes: svn path=/head/; revision=101713
* | One bugfix and one new feature.Luigi Rizzo2002-08-102-21/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bugfix (ipfw2.c) makes the handling of port numbers with a dash in the name, e.g. ftp-data, consistent with old ipfw: use \\ before the - to consider it as part of the name and not a range separator. The new feature (all this description will go in the manpage): each rule now belongs to one of 32 different sets, which can be optionally specified in the following form: ipfw add 100 set 23 allow ip from any to any If "set N" is not specified, the rule belongs to set 0. Individual sets can be disabled, enabled, and deleted with the commands: ipfw disable set N ipfw enable set N ipfw delete set N Enabling/disabling of a set is atomic. Rules belonging to a disabled set are skipped during packet matching, and they are not listed unless you use the '-S' flag in the show/list commands. Note that dynamic rules, once created, are always active until they expire or their parent rule is deleted. Set 31 is reserved for the default rule and cannot be disabled. All sets are enabled by default. The enable/disable status of the sets can be shown with the command ipfw show sets Hopefully, this feature will make life easier to those who want to have atomic ruleset addition/deletion/tests. Examples: To add a set of rules atomically: ipfw disable set 18 ipfw add ... set 18 ... # repeat as needed ipfw enable set 18 To delete a set of rules atomically ipfw disable set 18 ipfw delete set 18 ipfw enable set 18 To test a ruleset and disable it and regain control if something goes wrong: ipfw disable set 18 ipfw add ... set 18 ... # repeat as needed ipfw enable set 18 ; echo "done "; sleep 30 && ipfw disable set 18 here if everything goes well, you press control-C before the "sleep" terminates, and your ruleset will be left active. Otherwise, e.g. if you cannot access your box, the ruleset will be disabled after the sleep terminates. I think there is only one more thing that one might want, namely a command to assign all rules in set X to set Y, so one can test a ruleset using the above mechanisms, and once it is considered acceptable, make it part of an existing ruleset. Notes: svn path=/head/; revision=101628
* | Handle PMTU discovery in syn-ack packets slightly differently;Mike Silbersack2002-08-051-8/+6
| | | | | | | | | | | | | | | | | | | | rely on syncache flags instead of directly accessing the route entry. MFC after: 3 days Notes: svn path=/head/; revision=101405
* | bugfix: move check for udp_blackhole before the one for icmp_bandlim.Luigi Rizzo2002-08-041-2/+2
| | | | | | | | | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=101335
* | Fix handling of packets which matched an "ipfw fwd" rule on the input side.Luigi Rizzo2002-08-031-0/+13
| | | | | | | | Notes: svn path=/head/; revision=101268
generated by cgit v1.3 (git 2.53.0) at 2026-08-02 19:19:24 +0000