src/sys/netinet, branch release/4.8.0_cvs

This commit was manufactured by cvs2svn to create tag

2003-04-03T18:49:23Z

'RELENG_4_8_0_RELEASE'. This commit was manufactured to restore the state of the 4.8-RELEASE image. Releases prior to 5.3-RELEASE are omitting the secure/ and crypto/ subdirs.

MFC rev 1.227

2003-03-07T07:01:28Z

Submitted by: maxim Approved by: re

A correct MFC:

2003-02-27T04:50:02Z

ip_input.c revs 1.225, 1.229 ip_var.h rev 1.71 Approved by: re (bmah)

Backout:

2003-02-27T04:12:01Z

ip_input 1.130.2.49 ip_var.h 1.50.2.10 This is not even close to a straight mfc, my mistake.

IP frag per packet limits

2003-02-27T03:55:46Z

MFC ip_input.c rev 1.225 ip_var.h rev 1.71 Approved by: re (bmah)

MFC rev 1.39

2003-02-24T04:02:27Z

Improve the security and performance of syncookies:

2003-02-23T19:04:58Z

Security improvements: - Increase the size of each syncookie secret from 32 to 128 bits in order to make brute force attacks on the secrets much more difficult. - Always return the lowest order dword from the MD5 hash; this allows us to expose 2 more bits of the cookie and makes ACK floods which seek to guess the cookie value more difficult. Performance improvements: - Increase the lifetime of each syncookie from 4 seconds to 16 seconds. This increases the usefulness of syncookies during an attack. - From Yahoo!: Reduce the number of calls to MD5Update; this results in a ~17% increase in cookie generation time here. Reviewed by: hsu, jayanth, jlemon, nectar

MFC: IPSEC_FILTERGIF config option

2003-02-23T17:45:28Z

Add a new config option IPSEC_FILTERGIF to control whether or not packets coming out of a GIF tunnel are re-processed by ipfw, et. al. By default they are not reprocessed. With the option they are. This reverts 1.214. Prior to that change packets were not re-processed. After they were which caused problems because packets do not have distinguishing characteristics (like a special network if) that allows them to be filtered specially. PR: 48159 Reviewed by: Guido van Rooij Approved by: re (jhb, murray)

MFC revs 1.221 -> 1.223

2003-02-06T05:05:38Z

MFC rev 1.35

2003-02-06T04:42:51Z