src/sys/netinet/ip_input.c, branch releng/8.3

MFC r222845:

2012-02-08T17:54:02Z

Correct comments and debug logging in ipsec to better match reality.

MFC r218909:

2011-02-24T10:23:22Z

Fix typos - remove duplicate "the". PR: bin/154928 Submitted by: Eitan Adler

MFC r211157, r211193, r212265, r212266: make it possible to load carp(4) as

2010-09-11T22:02:36Z

a kld using function pointer hooks and {pf_,ip,ip6}proto_{un,}register(). Reviewed by: bz Approved by: ken (mentor)

MFC r212155:

2010-09-09T06:43:18Z

MFp4 CH=183052 183053 183258: In protosw we define pr_protocol as short, while on the wire it is an uint8_t. That way we can have "internal" protocols like DIVERT, SEND or gaps for modules (PROTO_SPACER). Switch ipproto_{un,}register to accept a short protocol number(*) and do an upfront check for valid boundries. With this we also consistently report EPROTONOSUPPORT for out of bounds protocols, as we did for proto == 0. This allows a caller to not error for this case, which is especially important if we want to automatically call these from domain handling. (*) the functions have been without any in-tree consumer since the initial introducation, so this is considered save. Implement ip6proto_{un,}register() similarly to their legacy IP counter parts to allow modules to hook up dynamically. Reviewed by: philip, will

MFC r207369:

2010-05-06T06:44:19Z

MFP4: @176978-176982, 176984, 176990-176994, 177441 "Whitspace" churn after the VIMAGE/VNET whirls. Remove the need for some "init" functions within the network stack, like pim6_init(), icmp_init() or significantly shorten others like ip6_init() and nd6_init(), using static initialization again where possible and formerly missed. Move (most) variables back to the place they used to be before the container structs and VIMAGE_GLOABLS (before r185088) and try to reduce the diff to stable/7 and earlier as good as possible, to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9. This also removes some header file pollution for putatively static global variables. Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are no longer needed. Reviewed by: jhb Discussed with: rwatson Sponsored by: The FreeBSD Foundation Sponsored by: CK Software GmbH

MFC r206989:

2010-05-02T15:55:29Z

Avoid memory access after free. Use the (shortend) copy for the ipsec mtu lookup as well. PR: kern/145736 Submitted by: Peter Molnar (peter molnar.cc)

MFC 205066, 205069, 205093, 205097, 205488:

2010-04-01T00:36:40Z

r205066: Log: - restructure flowtable to support ipv6 - add a name argument to flowtable_alloc for printing with ddb commands - extend ddb commands to print destination address or 4-tuples - don't parse ports in ulp header if FL_HASH_ALL is not passed - add kern_flowtable_insert to enable more generic use of flowtable (e.g. system calls for adding entries) - don't hash loopback addresses - cleanup whitespace - keep statistics per-cpu for per-cpu flowtables to avoid cache line contention - add sysctls to accumulate stats and report aggregate r205069: Log: fix stats reporting sysctl r205093: Log: re-update copyright to 2010 pointed out by danfe@ r205097: Log: flowtable_get_hashkey is only used by a DDB function - move under #ifdef DDB pointed out by jkim@ r205488: Log: - boot-time size the ipv4 flowtable and the maximum number of flows - increase flow cleaning frequency and decrease flow caching time when near the flow limit - stop allocating new flows when within 3% of maxflows don't start allocating again until below 12.5%

MFC r204140:

2010-03-27T17:34:57Z

Split up ip_drain() into an outer lock and iterator part and a "locked" version that will only handle a single network stack instance. The latter is called directly from ip_destroy(). Hook up an ip_destroy() function to release resources from the legacy IP network layer upon virtual network stack teardown. Reviewed by: rwatson

MFC of 197952 and 198075

2010-02-07T09:00:22Z

Virtualize the pfil hooks so that different jails may chose different packet filters. ALso allows ipfw to be enabled on on ejail and disabled on another. In 8.0 it's a global setting. and Unbreak the VIMAGE build with IPSEC, broken with r197952 by virtualizing the pfil hooks. For consistency add the V_ to virtualize the pfil hooks in here as well.

Merge r198438 from head to stable/8:

2009-12-14T11:53:02Z

Correct spelling typo in ip_input comment. Pointed out by: N.J. Mann , John Nielsen , julian (!), lstewart