src/sys/netinet/ip_input.c, branch release/8.1.0

MFC r207369:

2010-05-06T06:44:19Z

MFP4: @176978-176982, 176984, 176990-176994, 177441 "Whitspace" churn after the VIMAGE/VNET whirls. Remove the need for some "init" functions within the network stack, like pim6_init(), icmp_init() or significantly shorten others like ip6_init() and nd6_init(), using static initialization again where possible and formerly missed. Move (most) variables back to the place they used to be before the container structs and VIMAGE_GLOABLS (before r185088) and try to reduce the diff to stable/7 and earlier as good as possible, to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9. This also removes some header file pollution for putatively static global variables. Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are no longer needed. Reviewed by: jhb Discussed with: rwatson Sponsored by: The FreeBSD Foundation Sponsored by: CK Software GmbH

MFC r206989:

2010-05-02T15:55:29Z

Avoid memory access after free. Use the (shortend) copy for the ipsec mtu lookup as well. PR: kern/145736 Submitted by: Peter Molnar (peter molnar.cc)

MFC 205066, 205069, 205093, 205097, 205488:

2010-04-01T00:36:40Z

r205066: Log: - restructure flowtable to support ipv6 - add a name argument to flowtable_alloc for printing with ddb commands - extend ddb commands to print destination address or 4-tuples - don't parse ports in ulp header if FL_HASH_ALL is not passed - add kern_flowtable_insert to enable more generic use of flowtable (e.g. system calls for adding entries) - don't hash loopback addresses - cleanup whitespace - keep statistics per-cpu for per-cpu flowtables to avoid cache line contention - add sysctls to accumulate stats and report aggregate r205069: Log: fix stats reporting sysctl r205093: Log: re-update copyright to 2010 pointed out by danfe@ r205097: Log: flowtable_get_hashkey is only used by a DDB function - move under #ifdef DDB pointed out by jkim@ r205488: Log: - boot-time size the ipv4 flowtable and the maximum number of flows - increase flow cleaning frequency and decrease flow caching time when near the flow limit - stop allocating new flows when within 3% of maxflows don't start allocating again until below 12.5%

MFC r204140:

2010-03-27T17:34:57Z

Split up ip_drain() into an outer lock and iterator part and a "locked" version that will only handle a single network stack instance. The latter is called directly from ip_destroy(). Hook up an ip_destroy() function to release resources from the legacy IP network layer upon virtual network stack teardown. Reviewed by: rwatson

MFC of 197952 and 198075

2010-02-07T09:00:22Z

Virtualize the pfil hooks so that different jails may chose different packet filters. ALso allows ipfw to be enabled on on ejail and disabled on another. In 8.0 it's a global setting. and Unbreak the VIMAGE build with IPSEC, broken with r197952 by virtualizing the pfil hooks. For consistency add the V_ to virtualize the pfil hooks in here as well.

Merge r198438 from head to stable/8:

2009-12-14T11:53:02Z

Correct spelling typo in ip_input comment. Pointed out by: N.J. Mann , John Nielsen , julian (!), lstewart

Merge r198393 from head to stable/8:

2009-12-14T11:15:47Z

Improve grammar in ip_input comment while attempting to maintain what might be its meaning. (Note, merge of the revision correcting a spelling error in this commit will follow as well!)

Merge r198196 from head to stable/8:

2009-10-20T16:22:31Z

Rewrap ip_input() comment so that it prints more nicely. Approved by: re (kib)

Many network stack subsystems use a single global data structure to hold

2009-08-02T19:43:32Z

all pertinent statatistics for the subsystem. These structures are sometimes "borrowed" by kernel modules that require a place to store statistics for similar events. Add KPI accessor functions for statistics structures referenced by kernel modules so that they no longer encode certain specifics of how the data structures are named and stored. This change is intended to make it easier to move to per-CPU network stats following 8.0-RELEASE. The following modules are affected by this change: if_bridge if_cxgb if_gif ip_mroute ipdivert pf In practice, most of these statistics consumers should, in fact, maintain their own statistics data structures rather than borrowing structures from the base network stack. However, that change is too agressive for this point in the release cycle. Reviewed by: bz Approved by: re (kib)

Merge the remainder of kern_vimage.c and vimage.h into vnet.c and

2009-08-01T19:26:27Z

vnet.h, we now use jails (rather than vimages) as the abstraction for virtualization management, and what remained was specific to virtual network stacks. Minor cleanups are done in the process, and comments updated to reflect these changes. Reviewed by: bz Approved by: re (vimage blanket)