Commit Graph

2208 Commits

Author SHA1 Message Date
Bruce M Simpson
217f71d80c Use int instead of u_int for the 'extra' argument to the
clone_create() KPI.
This fixes a signedness bug in unit number comparisons.

Submitted by:	imp, Landon Fuller
PR:		kern/105228
MFC after:	2 weeks
2007-02-02 22:27:45 +00:00
Robert Watson
6d38c5ad80 Update comment for struct bpf_d: we now store buffered packets for BPF
in malloc'd storage, not in mbuf clusters.
2007-01-29 14:41:03 +00:00
Robert Watson
5d1f828354 Remove slightly dubious comment; add descriptive strings for several
sysctls.

MFC after:	3 days
2007-01-28 16:38:44 +00:00
Robert Watson
a85614b42b Remove BSD < 199103 compatibility entries in the bpf_d structure: they are
not used in any of our code.  Also remove explicit padding variable that
kept the bpf_d structure the same size before and after the change in
select implementation, since binary compatibility is not required for this
data structure on 7-CURRENT.
2007-01-27 18:12:50 +00:00
Robert Watson
b6957b8597 Remove now unused bpf_compat.h. This compatibility file emulates malloc(9)
using the mbuf allocator.
2007-01-27 17:32:12 +00:00
Andrew Thompson
98b81793ed Set topology change propagation on all ports _except_ the caller. 2007-01-18 07:13:01 +00:00
Christian S.J. Peron
8d8d78c23d style(9) nit. Prefer struct[space]name[space]{ to make grep searches more
in line with that we find in the rest of the tree.
2007-01-01 21:49:39 +00:00
Yaroslav Tykhiy
2dc879b337 - Don't defer the removal of an 802.1q header for no real reason.
- Micro-optimize the addition of an 802.1q header to match the removal code.
- Consistently check for interfaces being up and running.
- Consistently use NULL instead of 0 with pointers.
2006-12-30 21:10:25 +00:00
John Baldwin
0dea849ae9 Various bpf(4) related fixes to catch places up to the new bpf(4)
semantics.
- Stop testing bpf pointers for NULL.  In some cases use
  bpf_peers_present() and then call the function directly inside the
  conditional block instead of the macro.
- For places where the entire conditional block is the macro, remove the
  test and make the macro unconditional.
- Use BPF_MTAP() in if_pfsync on FreeBSD instead of an expanded version of
  the old semantics.

Reviewed by:	csjp (older version)
2006-12-29 13:59:50 +00:00
Sam Leffler
41b3c790eb First cut at half/quarter-rate 11a channel support (e.g. for use
in the Public Safety Band):
o add channel flags to identify half/quarter-rate operation
o add rate sets (need to check spec on 4Mb/s in 1/4 rate)
o add if_media definitions for new rates
o split net80211 channel setup out into ieee80211_chan_init
o fixup ieee80211_mhz2ieee and ieee80211_ieee2mhz to understand half/quarter
  rate channels: note we temporarily use a nonstandard/hack numbering that
  avoids overlap with 2.4G channels because we don't (yet) have enough
  state to identify and/or map overlapping channel sets
o fixup ieee80211_ifmedia_init so it can be called post attach and will
  recalculate the channel list and associated state; this enables changing
  channel-related state like the regulatory domain after attach (will be
  needed for 802.11d support too)
o add ieee80211_get_suprates to return a reference to the supported rate
  set for a given channel
o add 3, 4.5, and 27 MB/s tx rates to rate <-> media conversion routines
o const-poison channel arg to ieee80211_chan2mode
2006-12-27 18:46:18 +00:00
Yaroslav Tykhiy
9983b3c02d Note that rev. 1.221 introduced a local workaround for a general problem.
Add a pointer to the relevant PR for future reference.  The whole comment
will be OK to remove as soon as the general solution is applied.

PR:	kern/105943
2006-12-24 08:52:13 +00:00
Bjoern A. Zeeb
1d54aa3ba9 MFp4: 92972, 98913 + one more change
In ip6_sprintf no longer use and return one of eight static buffers
for printing/logging ipv6 addresses.
The caller now has to hand in a sufficiently large buffer as first
argument.
2006-12-12 12:17:58 +00:00
Andrew Thompson
787096051b These days P2P means peer-2-peer (also well known from serveral filesharing
protocols) while PointToPoint has been PtP links. Change the variables
accordingly while the code is still fresh and undocumented.

Requested by:	bz
2006-12-11 23:46:40 +00:00
Luigi Rizzo
294dd290c6 Fix an oscure bug triggered by a recent change in kern_socket.c.
The symptoms were that outgoing DHCP requests for diskless kernels
had the IP header corrupt. After long investigations, the source of
the problem was found in ether_output() - for SIMPLEX interfaces
and broadcast traffic, a copy of the packet is passed back to the kernel
through if_simloop(). However if_simloop() modifies the mbuf, while
the copy obtained through m_copym() is a readonly one.

The bug has been there forever, but it has been triggered only recently
by a change in sosend_dgram() which passed down mbufs with sufficient
space to prepend the header.

This fix is trivial - use m_dup() instead of m_copy() to create
the copy. As an alternative, we could try and modify if_simloop()
to play safely with readonly mbufs, but i don't think it is worthwhile
because 1) this is a relatively infrequent code path so we do not need
to worry too much about performance, and 2) the cost of doing an
extra m_pullup in if_simloop() is probably the same as doing the
copy of the cluster, anyways.

MFC after: 1 week
2006-12-08 10:36:45 +00:00
Hajimu UMEMOTO
61e5d30af7 Use callout mechanism instead of timeout()/untimeout().
MFC after:	1 week
2006-12-05 18:54:21 +00:00
Shteryana Shopova
daacddcac8 Add two new flags to if_bridge(4) indicating whether the edge flag
of the bridge port and path cost have been administratively set or
calculated automatically by RSTP.

Make sure to transition from non-edge to edge when the port goes down
and the edge flag was manually set before.
This is needed to comply with the condition
	((!portEnabled && AdminEdge) || ....)
in the Bridge Detection State Machine (IEE802.1D-2004, p. 171).

Reviewed by:	thompsa
Approved by:	bz (mentor)
2006-12-04 14:45:02 +00:00
Shteryana Shopova
b8f45801b0 Fix SIOCGDRVSPEC/BRDGGIFSSTP ioctl: make it copyin() the user
provided buffer length before trying to use it.

Reviewed by:	thompsa
Approved by:	bz (mentor)
MFC after:	3 days
2006-12-03 21:50:57 +00:00
Robert Watson
d95fcd8db7 Remove obfuscating OpenBSD/NetBSD/BSDI/FreeBSD 2.x/FreeBSD 5.x ifdefs
from around printfs and address list iteration.
2006-12-01 22:45:43 +00:00
Warner Losh
48f395a6c2 fix typo in last commit 2006-12-01 18:25:18 +00:00
Warner Losh
a0858e10ac Use FreeBDS standard __packed as opposed to the gcc centric
__attribute__(__packed__).
2006-12-01 18:18:35 +00:00
Warner Losh
ff4323418b Move the __packed declarations. This makes sizeof(struct llc) 8 again
on the arm.  Add an assert to ensure that the size is 8 to prefent others
from falling into this trap (we should have more of these).

Why the construct:

	struct foo {
		union bar {
			struct {
				...
			} __packed fred;
			...
		} __packed wilma;
	} __packed;

has a different packing than:

	struct foo {
		union bar {
			struct {
				...
			} fred __packed;
			...
		} wilma __packed;
	} __packed;

is beyond my ability to ferret out of the gcc documentation.  Most
likely some subtle binding issue (eg before it says the struct itself
is packed, while after it means that the whole struct is packed into
the thing it is in).  Pointers to relevant documentation would be
appreciated.
2006-12-01 17:50:11 +00:00
Warner Losh
a20538a08a Use CTASSERT to make sure:
sizeof ether_header is 2 * ETHER_ADDR_LEN + 2 (14) bytes long
	sizeof ether_addr is ETHER_ADDR_LEN bytes long

On arm, this shows that struct ether_addr needs to be __packed.

The first condition muts be true for the bridging code to not dump core.
The second one appears to be implicitly relied upon by wi (but many
of the rids it sends down likely need __packed too to be safe) and
maybe others.  It appears to not hurt anything.
2006-12-01 07:06:35 +00:00
Gleb Smirnoff
c18ffdc87d The recent issues with em(4) interface has shown that the old 4.4BSD
if_watchdog/if_timer interface doesn't fit modern SMP network
stack design.

Device drivers that need watchdog to monitor their hardware should
implement it theirselves.

Eventually the if_watchdog/if_timer API will be removed. For now,
warn that driver uses it.

Reviewed by:	scottl
2006-11-30 15:02:01 +00:00
Robert Watson
1f87450e8b Change net.isr.direct from defaulting to 0 to 1 in 7-CURRENT. This
enables direct dispatch of the network stack from the device driver
ithread, enabling input path parallelism by default when multiple
interfaces are present.

The strategy for network stack parallelism is something being actively
discussed, and this is just one of several possible (and perfectly
reasonable) strategies, but has the distinct advantage of reducing the
number of context switches and preemptions significantly, resulting in
higher efficiency in many cases.  In some caes, this may reduce
network stack parallelism due to work not being deferred from the
ithread to the netisr.  Therefore, the strategy may change in the
future, but this offers a reasonable first pass and enabling
parallelism while maintaining strong ordering.

Hopefully this will trigger lots of nice new bugs.

This change is not intended for MFC.
2006-11-28 11:19:36 +00:00
Andrew Thompson
6c32e05ca3 Sync with the OpenBSD port of RSTP
- use flags rather than sperate ioctls for edge, p2p
 - implement p2p and autop2p flags
 - define large pathcost constant as ULL
 - show bridgeid and rootid in ifconfig

Obtained from:	Reyk Floeter <reyk@openbsd.org>
2006-11-27 00:35:40 +00:00
Andrew Thompson
ebd4a4ba14 Initialize the port info, this shouldnt have been removed in r1.28 2006-11-26 20:33:29 +00:00
Andrew Thompson
cc864f0c3f Remove redundant setting of port state. 2006-11-26 19:49:34 +00:00
Andrew Thompson
071fff62be use two stage creation of stp ports, this means that the stp variables can be
set before the port is marked STP and they will no longer be overwrittten
2006-11-26 18:43:48 +00:00
Bruce Evans
6f5967c087 Initialize a local variable in 2 places just before it is used, not always
at the start of rtalloc1().  This backs out part of revs 1.83 and 1.85.

Profiling on an i386 showed that that for sending tiny packets using
bge, -current takes 7 bzero()s where RELENG_4 takes only 1, and that
bzero()ing is now the dominant overhead (10-12%, up from 1%, but
profiling overestimated this a bit).  This commit backs out 2 of the
6 extra bzero()s (1 in each of 2 calls per packet to rtalloc1()).  They
were the largest ones by byte count (48 bytes each) but perhaps not
by time (small misaligned ones might take longer).
2006-11-23 05:57:15 +00:00
Andrew Thompson
36dac7e26d Do not call bstp_stop() internally as it clears the running flag which causes
the timer to never be restarted.

Reported by:	bz
2006-11-19 23:08:35 +00:00
Christian S.J. Peron
fa5c72f583 Fix typo in comment
Pointed out by:	ru
2006-11-18 23:38:31 +00:00
Christian S.J. Peron
52f1277eea Currently, drivers that support hardware offload of VLAN tag
processing are forced to toggle this functionality when the card
is put in and out of promiscuous mode.  The main reason for this
is because the hardware strips the VLAN tag, making it impossible
for the tag information to show up in network diagnostic tools like
tcpdump(1).

This change introduces ether_vlan_mtap(), which is called if the
mbuf has M_VLANTAG set.  VLAN information is extracted from the
mbuf and inserted into a stack allocated ether vlan header which
is then inserted through the bpf machinery via bpf_mtap2(). The
original mbuf's data pointer and lengths are temporarily adjusted
to eliminate the original Ethernet header for the duration of the
tap operation. This should have no long term effects on the mbuf.

Also, define a new macro, ETHER_BPF_MTAP which should be used
by drivers which support hardware offload of VLAN tag processing.

The fixes for the relevant drivers will follow shortly.

Discussed with:		rwatson, andre, jhb (and others)
Much feedback from:	sam, ru
MFC after:	1 month [1]

[1] The version that is eventually MFCed will be somewhat
    different then this, as there has been significant work
    done to the VLAN code in HEAD.
2006-11-18 23:17:22 +00:00
Sam Leffler
fdc6354580 mark struct ether_header packed so gcc honors alignment
constratins on arm; this fixes bridging when packets are
rx'd so ip headers are 32-bit aligned

Reviewed by:	imp (and discussed elsewhere)
MFC after:	2 weeks
2006-11-18 15:50:24 +00:00
Hajimu UMEMOTO
9f3b75b7b4 Teach an IPv6 to ppp(4).
Obtained from:	NetBSD
MFC after:	1 week
2006-11-11 15:02:04 +00:00
Andrew Thompson
c25789cc22 MFp4
- Each stp port is added sequentially so it was possible for our bridgeid to
   change every time because the new port has a lower MAC address.  Instead
   just find the lowest MAC address from all Ethernet adapters in the machine
   as the value only needs to be unique, this stops a lot of churn on the
   protocol.
 - Update the states after enabling or disabling a port.
 - Keep tabs if we have been stopped or started by our parent bridge.
 - The callout only needs to be drained before destroying the mutex, move it to
   bstp_detach.
2006-11-09 22:50:49 +00:00
Andrew Thompson
3df7fad0cf Add a new address cache type called sticky. On an interface marked sticky any
address learned by the bridge is made permanent, the address will not age out
and most importantly will not migrate to another interface.

This can be used to stop mac address poisoning or clients roaming in much the
same way as static entries without the hassle of preloading the table.
2006-11-09 06:32:38 +00:00
Robert Watson
acd3428b7d Sweep kernel replacing suser(9) calls with priv(9) calls, assigning
specific privilege names to a broad range of privileges.  These may
require some future tweaking.

Sponsored by:           nCircle Network Security, Inc.
Obtained from:          TrustedBSD Project
Discussed on:           arch@
Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
                        Alex Lyashkov <umka at sevcity dot net>,
                        Skip Ford <skip dot ford at verizon dot net>,
                        Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
Christian S.J. Peron
67be76c039 Fix possible leak when bridge is in monitor mode. Use m_freem() which will
free the entire chain, instead of using m_free() which will free just the
mbuf that was passed.

Discussed with:	thompsa
MFC after:	3 days
2006-11-05 17:56:25 +00:00
Christian S.J. Peron
82f4b374d5 Currently, we initialize "error" to zero when it's declared, then
we never initialize it to anything else. However, in the case that
m_uiotombuf fails, we return error (effectively reporting success).

This appears to be a relic of an older revision of this file, where
"error" used to be doing something useful. (See revision 1.1, where
error is used in a loop with uiomove() instead of using m_uiotomubf).

So instead on unconditionally reporting success in the case there is
a failure in m_uiotombuf, explicitly return ENOBUFS. While we are
here, garbage collect the error variable since it's no longer required.

MFC after:	2 weeks
2006-11-04 20:54:37 +00:00
Andrew Thompson
59ee2183e2 When the packet is for the bridge then note which interface to send the reply
to, previously it was always broadcast to all interfaces (a bug). This is
useful when the bridge is the default gateway and vlans are used to isolate
each client, the reply is now kept private to the vlan which the client
resides.

Reported by:	Jon Otterholm
Tested by:	Jon Otterholm
MFC after:	3 days
2006-11-04 10:40:59 +00:00
Randall Stewart
f8829a4a40 Ok, here it is, we finally add SCTP to current. Note that this
work is not just mine, but it is also the works of Peter Lei
and Michael Tuexen. They both are my two key other developers
working on the project.. and they need ata-boy's too:
****
peterlei@cisco.com
tuexen@fh-muenster.de
****
I did do a make sysent which updated the
syscall's and sysproto.. I hope that is correct... without
it you don't build since we have new syscalls for SCTP :-0

So go out and look at the NOTES, add
option SCTP (make sure inet and inet6 are present too)
and play with SCTP.

I will see about comitting some test tools I have after I
figure out where I should place them. I also have a
lib (libsctp.a) that adds some of the missing socketapi
functions that I need to put into lib's.. I will talk
to George about this :-)

There may still be some 64 bit issues in here, none of
us have a 64 bit processor to test with yet.. Michael
may have a MAC but thats another beast too..

If you have a mac and want to use SCTP contact Michael
he maintains a web site with a loadable module with
this code :-)

Reviewed by:	gnn
Approved by:	gnn
2006-11-03 15:23:16 +00:00
Andrew Thompson
f935a26d9f Defer sending the bpdu from bstp_update_info as all code paths will test this
flag anyway.
2006-11-03 03:34:04 +00:00
Andre Oppermann
5e20f43d31 Rename m_getm() to m_getm2() and rewrite it to allocate up to page sized
mbuf clusters.  Add a flags parameter to accept M_PKTHDR and M_EOR mbuf
chain flags.  Provide compatibility macro for m_getm() calling m_getm2()
with M_PKTHDR set.

Rewrite m_uiotombuf() to use m_getm2() for mbuf allocation and do the
uiomove() in a tight loop over the mbuf chain.  Add a flags parameter to
accept mbuf flags to be passed to m_getm2().  Adjust all callers for the
extra parameter.

Sponsored by:	TCP/IP Optimization Fundraise 2005
MFC after:	3 month
2006-11-02 17:37:22 +00:00
Andrew Thompson
2efdffee15 Do not test all the conditions if the port is already forwarding. Also print a
debug message if the port is agreed as it is an important condition of the
protocol.
2006-11-02 08:44:19 +00:00
Andrew Thompson
cd281f6d40 Fix a resource leak when the mbuf pointer changes.
CID:		1564, 1565
Found by:	Coverity Prevent (tm)
2006-11-02 08:04:13 +00:00
Andrew Thompson
edc9f4ae99 If the port is agreed or edge then allow it go go straight to forwarding rather
than waiting another tick (1s) for the states to be checked again.
2006-11-02 00:39:36 +00:00
Andrew Thompson
3fab76690c Bring in support for the Rapid Spanning Tree Protocol (802.1w).
RSTP provides faster spanning tree convergence, the protocol will exchange
information with neighboring switches to quickly transition to forwarding
without creating loops. The code will default to RSTP mode but will downgrade
any port connected to a legacy STP network so is fully backward compatible.

Reviewed by:	syrinx
Tested by:	syrinx
2006-11-01 09:07:47 +00:00
Robert Watson
aed5570872 Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h
begun with a repo-copy of mac.h to mac_framework.h.  sys/mac.h now
contains the userspace and user<->kernel API and definitions, with all
in-kernel interfaces moved to mac_framework.h, which is now included
across most of the kernel instead.

This change is the first step in a larger cleanup and sweep of MAC
Framework interfaces in the kernel, and will not be MFC'd.

Obtained from:	TrustedBSD Project
Sponsored by:	SPARTA
2006-10-22 11:52:19 +00:00
Gleb Smirnoff
2d479ae19b Fix error in rev. 1.68. The intention was to break out the switch(){},
but actually exited from the for(){} loop. This fixes the PPPIOCSCOMPRESS
ioctl.

PR:		kern/101333
Submitted by:	Igor Popov <igorpopov newmail.ru>
2006-10-21 09:44:02 +00:00
Gleb Smirnoff
aad0be7a3b - Update the baudrate every time the parent changes its link state.
- Rearrange the curly braces so that this piece of code is more
  readable.
2006-10-11 10:06:35 +00:00
Andrew Thompson
8408ecd6d8 Use LIST_FOREACH_SAFE instead of a hand rolled version. 2006-10-09 00:49:57 +00:00
Andrew Thompson
f26fc2ad3d Remove licence clauses 3 & 4
OKed by:	Jason L. Wright
2006-10-01 03:48:32 +00:00
Ruslan Ermilov
9fddcc6661 Fix our ioctl(2) implementation when the argument is "int". New
ioctls passing integer arguments should use the _IOWINT() macro.
This fixes a lot of ioctl's not working on sparc64, most notable
being keyboard/syscons ioctls.

Full ABI compatibility is provided, with the bonus of fixing the
handling of old ioctls on sparc64.

Reviewed by:	bde (with contributions)
Tested by:	emax, marius
MFC after:	1 week
2006-09-27 19:57:02 +00:00
Andrew Thompson
0a6f8a5050 Revert r1.80 as the ethernet header was inadvertently stripped from ARP
packets. Reimplement this correctly and use a sysctl that defaults to off so
the user doesnt get any suprises if ipfw blocks the ARP packet.

MFC after:	3 days
2006-09-22 21:57:52 +00:00
SUZUKI Shinsuke
8343821b87 fixed a bug that local IPv6 traffic (to an address configured on an
interface other than lo0) does not show up properly on any bpf.

Reported by: mlaier
Reviewed by: gnn, csjp
MFC after: 1 week
2006-09-22 01:31:22 +00:00
Andre Oppermann
78ba57b9e1 Move ethernet VLAN tags from mtags to its own mbuf packet header field
m_pkthdr.ether_vlan.  The presence of the M_VLANTAG flag on the mbuf
signifies the presence and validity of its content.

Drivers that support hardware VLAN tag stripping fill in the received
VLAN tag (containing both vlan and priority information) into the
ether_vtag mbuf packet header field:

	m->m_pkthdr.ether_vtag = vlan_id;	/* ntohs()? */
	m->m_flags |= M_VLANTAG;

to mark the packet m with the specified VLAN tag.

On output the driver should check the mbuf for the M_VLANTAG flag to
see if a VLAN tag is present and valid:

	if (m->m_flags & M_VLANTAG) {
		... = m->m_pkthdr.ether_vtag;	/* htons()? */
		... pass tag to hardware ...
	}

VLAN tags are stored in host byte order.  Byte swapping may be necessary.

(Note: This driver conversion was mechanic and did not add or remove any
byte swapping in the drivers.)

Remove zone_mtag_vlan UMA zone and MTAG_VLAN definition.  No more tag
memory allocation have to be done.

Reviewed by:	thompsa, yar
Sponsored by:	TCP/IP Optimization Fundraise 2005
2006-09-17 13:33:30 +00:00
Andrew Thompson
781dd9ae05 Rearrange things so that ARP packets can be filtered or rate limited with IPFW.
Requested by:	Jon Otterholm
Tested by:	Jon Otterholm
2006-09-17 08:20:56 +00:00
Andre Oppermann
233dcce118 First step of TSO (TCP segmentation offload) support in our network stack.
o add IFCAP_TSO[46] for drivers to announce this capability for IPv4 and IPv6
 o add CSUM_TSO flag to mbuf pkthdr csum_flags field
 o add tso_segsz field to mbuf pkthdr
 o enhance ip_output() packet length check to allow for large TSO packets
 o extend tcp_maxmtu[46]() with a flag pointer to pass interface capabilities
 o adjust all callers of tcp_maxmtu[46]() accordingly

Discussed on:	-current, -net
Sponsored by:	TCP/IP Optimization Fundraise 2005
2006-09-06 21:51:59 +00:00
Andre Oppermann
60d4ab7abb Improve description of if_capabilities, if_capenable and ifi_hwassist.
Sponsored by:	TCP/IP Optimization Fundraise 2005
2006-09-06 18:06:04 +00:00
Andre Oppermann
773725a255 Fix the socket option IP_ONESBCAST by giving it its own case in ip_output()
and skip over the normal IP processing.

Add a supporting function ifa_ifwithbroadaddr() to verify and validate the
supplied subnet broadcast address.

PR:		kern/99558
Tested by:	Andrey V. Elsukov <bu7cher-at-yandex.ru>
Sponsored by:	TCP/IP Optimization Fundraise 2005
MFC after:	3 days
2006-09-06 17:12:10 +00:00
Sam Leffler
f09c8c4a46 more juniper dlt's
MFC after:	1 month
2006-09-04 19:24:34 +00:00
Andrew Thompson
3f7d13964e Move the bridge hook after the loopback check so that IFF_SIMPLEX is honoured
on member interfaces. This makes us the same as OpenBSD/NetBSD.

MFC after:	3 days
2006-08-25 20:16:39 +00:00
Andrew Thompson
4ec528c7a4 The bridge cant hear its own transmissions so set IFF_SIMPLEX.
PR:		kern/102361
Tested by:	Radim Kolar <hsn@netmag.cz>
MFC after:	3 days
2006-08-25 20:11:56 +00:00
Andrew Thompson
ad38702878 Fix spelling. 2006-08-25 08:25:35 +00:00
Colin Percival
6aa3bc96a6 Correct buffer overflow in the handling of LCP options in ppp(4)
Security:	FreeBSD-SA-06:18.ppp
2006-08-23 22:06:08 +00:00
Andrew Thompson
705e3bd63b Remove unneeded asserts from bridge_ioctl_* since these are just
extensions of bridge_ioctl() which has the correct locking.
2006-08-17 11:16:02 +00:00
Andrew Thompson
ff2cdcff19 Remove two lock asserts that are unneeded due to subsequent unlocks. 2006-08-17 10:52:36 +00:00
Andrew Thompson
b34b8d6783 Call bridge_span before dropping the lock.
MFC after:	5 days
2006-08-17 10:18:31 +00:00
Yaroslav Tykhiy
aabf994053 This XXX remark was rendered false by rev. 103, which made the
VLAN_ARRAY case subject to rw locking, too.
2006-08-15 17:29:52 +00:00
Yaroslav Tykhiy
73f2233d9d Make it a tad easier to base other encapsulation schemes on this driver
by restoring the ifv_proto field in the vlan softc and putting it to use
this time.  It's a good companion for ifv_encaplen, which has already been
used throughout this driver.
2006-08-15 16:56:43 +00:00
Yaroslav Tykhiy
2ada974770 Set IFF_DRV_RUNNING on vlan(4) once in vlan_config(),
not at many places after each call to vlan_config().
This is consistent with IFF_DRV_RUNNING being unset
in vlan_unconfig().
2006-08-15 16:40:27 +00:00
Andrew Thompson
65a963b762 Add the module version to fix the loading with if_bridge.
Reported by:	keramida
Tested by:	keramida
2006-08-12 20:30:58 +00:00
Yaroslav Tykhiy
f6e5e0ad77 Optionally pad outgoing frames to the minimum of 60 bytes (excl. FCS)
before tagging them.  This can help to work around brain-damage in some
switches that fail to pad a frame after untagging it if its length drops
below the minimum.  This option is blessed by IEEE Std 802.1Q (2003 Ed.),
paragraph C.4.4.3.b.  It's controlled by sysctl net.link.vlan.soft_pad.

Idea by:	az
MFC after:	1 week
2006-08-11 17:09:27 +00:00
Robert Watson
a359443290 Since bpf_allocbufs() uses malloc() with M_WAITOK, don't check return
values for NULL or return an error state.  Assert that all three bpf
buffer pointers are NULL before starting.

MFC after:	1 week
2006-08-09 16:30:26 +00:00
Robert Watson
ae476dd78f Add kqueue support to if_tun. Loosely based on if_tap changes.
Two almost identical patches based on the if_tap work were submitted
via GNATS; I started out with the patch in 100796 from David Gilbert,
but could have easily started with the patch from Vilmos Nebehaj which
I found only later.

MFC after:	1 week
PR:		93976, 100796
2006-08-08 19:22:25 +00:00
Brooks Davis
43bc7a9c62 With exception of the if_name() macro, all definitions in net_osdep.h
were unused or already in if_var.h so add if_name() to if_var.h and
remove net_osdep.h along with all references to it.

Longer term we may want to kill off if_name() entierly since all modern
BSDs have if_xname variables rendering it unnecessicary.
2006-08-04 21:27:40 +00:00
Yaroslav Tykhiy
60c6061882 Should vlan_input() ever be called with ifp pointing to a non-Ethernet
interface, do not just assign -1 to tag because it breaks the logic of
the code to follow.  The better way is to handle this case as an unsupported
protocol and return unless INVARIANTS is in effect and we can panic.
Panic is good there because the scenario can happen only because of a
coding error elsewhere.

We also should show the interface name in the panic message for easier
debugging of the problem, should it ever emerge.

Submitted by:	qingli (initially)
2006-08-03 09:59:08 +00:00
Yaroslav Tykhiy
db8b5973e7 Back out rev. 1.107 because it introduced as many problems
as it tried to solve:

- it smuggled hidden 802.1q details into otherwise protocol-neutral code;
- it put an important code consistency check under DEBUG, which was never
  defined by anyone but a developer hacking this file for the moment;
- lastly, the former bcopy() call had been correct as long as the "dead"
  code was there.

(A new version of the fix for tag of -1 to come in the next commit.)

Agreed by:	qingli
2006-08-03 09:50:15 +00:00
Andrew Thompson
73d480ae4c - Use the new bridgestp callback to once again flush our bridge routes when an
interface is disabled.
- Log port changes to syslog, defaulting to off
2006-08-02 03:54:28 +00:00
Andrew Thompson
fc5b6202ab Tell bridgestp that we are about to free the memory so it can cleanup. 2006-08-02 02:59:24 +00:00
Andrew Thompson
516b37d308 Fix style in the last commit, the variable declaration goes at the top of the
function.
2006-08-02 02:51:42 +00:00
Andrew Thompson
6f2abce0b3 Add a callback so we can notify the parent bridge that a port state change has
occured, we need to do this from a taskqueue to avoid a LOR with the if_bridge
mutex.
2006-08-02 02:47:27 +00:00
Andrew Thompson
df6e8892dc Be sure to disable the port when removing it from STP. 2006-08-02 01:36:40 +00:00
Qing Li
0d024885b9 In vlan_input(), if the network interface does not perform h/w based
vlan tag processing, the code will use bcopy() to remove the vlan
tag field but the code copies 2 bytes too many, which essentially
overwrites the protocol type field.

Also, a tag value of -1 is generated for unrecognized interface type,
which would cause an invalid memory access in the vlans[] array.

In addition, removed a line of dead code and its associated comments.

Reviewed by:	sam
2006-08-01 17:28:10 +00:00
Andrew Thompson
51383c37cd Add some statistics that are needed to support RFC4188 as part of the SoC2006
work on a bridge monitoring module for BSNMP.

Submitted by:	shteryana (SoC 2006)
2006-07-31 20:24:46 +00:00
Andrew Thompson
9674cf0e27 Remove the dependency of bridgestp.h on if_bridgevar.h by moving a couple of
private structures to if_bridge.c.
2006-07-27 21:01:48 +00:00
Tai-hwa Liang
da87ff8633 Fixing compilation bustage: net/if_bridgevar.h depends on net/bridgestp.h. 2006-07-27 03:50:38 +00:00
Andrew Thompson
a4eb85b6ac bridgestp is now a seperate module. 2006-07-26 22:15:15 +00:00
Andrew Thompson
7d4a207cba Remove stp variables that are already initialised in bstp_attach(). 2006-07-26 20:56:02 +00:00
Andrew Thompson
96e47153ea /tmp/cvsuusTrc 2006-07-26 10:43:02 +00:00
Andrew Thompson
e61a82f3e3 Remove variables that are overridden by ether_ifattach(). This clears up any
confusion especially as *if_output was pointed to a different function.
2006-07-26 09:41:04 +00:00
Sam Leffler
246b546762 add support for 802.11 packet injection via bpf
Together with:	Andrea Bittau <a.bittau@cs.ucl.ac.uk>
Reviewed by:	arch@
MFC after:	1 month
2006-07-26 03:15:16 +00:00
David Malone
91433904b5 Rather than calling mircotime() in catchpacket(), make catchpacket()
take a timeval indicating when the packet was captured. Move
microtime() to the calling functions and grab the timestamp as soon
as we know that we're going to call catchpacket at least once.

This means that we call microtime() once per matched packet, as
opposed to once per matched packet per bpf listener. It also means
that we return the same timestamp to all bpf listeners, rather than
slightly different ones.

It would be more accurate to call microtime() even earlier for all
packets, as you have to grab (1+#listener) locks before you can
determine if the packet will be logged. You could always grab a
timestamp before the locks, but microtime() can be costly, so this
didn't seem like a good idea.

(I guess most ethernet interfaces will have a bpf listener these
days because of dhclient. That means that we could be doing two bpf
locks on most packets going through the interface.)

PR:		71711
2006-07-24 15:42:04 +00:00
Robert Watson
a152f8a361 Change semantics of socket close and detach. Add a new protocol switch
function, pru_close, to notify protocols that the file descriptor or
other consumer of a socket is closing the socket.  pru_abort is now a
notification of close also, and no longer detaches.  pru_detach is no
longer used to notify of close, and will be called during socket
tear-down by sofree() when all references to a socket evaporate after
an earlier call to abort or close the socket.  This means detach is now
an unconditional teardown of a socket, whereas previously sockets could
persist after detach of the protocol retained a reference.

This faciliates sharing mutexes between layers of the network stack as
the mutex is required during the checking and removal of references at
the head of sofree().  With this change, pru_detach can now assume that
the mutex will no longer be required by the socket layer after
completion, whereas before this was not necessarily true.

Reviewed by:	gnn
2006-07-21 17:11:15 +00:00
Brooks Davis
8d832bb5a0 Use TAILQ_FOREACH instead of poking around in the guts of the list
macros.
2006-07-15 02:49:35 +00:00
Brooks Davis
6a51be11da Drop a pointless cast of ifp->if_softc to (struct tap_softc *). 2006-07-15 02:13:05 +00:00
Andrew Thompson
07ed9a88c6 Catch up with the revised network interface cloning which takes an optional
opaque parameter that can specify configuration parameters.
2006-07-10 05:24:06 +00:00
Sam Leffler
6b7330e2d4 Revise network interface cloning to take an optional opaque
parameter that can specify configuration parameters:
o rev cloner api's to add optional parameter block
o add SIOCCREATE2 that accepts parameter data
o rev vlan support to use new api (maintain old code)

Reviewed by:	arch@
2006-07-09 06:04:01 +00:00
Oleg Bulyzhin
e27c3f48fb Adjust rt_(set|get)metrics() to do kernel <-> userland timebase conversion.
We need it since kernel timebase has changed (time_second -> time_uptime).

Approved by:	glebius (mentor)
2006-07-06 00:24:36 +00:00
Andrew Thompson
bac89dcef2 Fix a braino in the last revision, enc_clone_destroy needs return void instead
of int. The clone system will ensure that our first interface is not destroyed
so we dont need the extra checking anyway.

Tested by:	Scott Ullrich
2006-07-04 23:09:11 +00:00
Christian S.J. Peron
4b19419ee7 Adjust descriptor locking to tell the kqueue subsystem that our descriptor is
already locked. The reason to do this is to avoid two lock+unlock operations
in a row. We need the lock here to serialize access to bd_pid for stats
collection purposes.

Drop the locks all together on detach, as they will be picked up by
knlist_remove.

This should fix a failed locking assertion when kqueue is being used with bpf
descriptors.

Discussed with:	jmg
2006-07-03 20:02:06 +00:00
Yaroslav Tykhiy
4b97d7affd There is a consensus that ifaddr.ifa_addr should never be NULL,
except in places dealing with ifaddr creation or destruction; and
in such special places incomplete ifaddrs should never be linked
to system-wide data structures.  Therefore we can eliminate all the
superfluous checks for "ifa->ifa_addr != NULL" and get ready
to the system crashing honestly instead of masking possible bugs.

Suggested by:	glebius, jhb, ru
2006-06-29 19:22:05 +00:00
Yaroslav Tykhiy
e54e7d6dae Use TAILQ_FOREACH in the __FreeBSD__ case, too.
Funnily enough, rev. 1.15 changed the __Net and __Open cases only.
2006-06-29 17:56:21 +00:00
Yaroslav Tykhiy
06dc090fe0 Use TAILQ_FOREACH. 2006-06-29 17:31:43 +00:00
Yaroslav Tykhiy
5aa288f461 Use the nifty TAILQ_FOREACH. 2006-06-29 17:16:13 +00:00
Yaroslav Tykhiy
249f4297db Detach the interface first, do vlan_unconfig() then.
Previously, another thread could get a pointer to the
interface by scanning the system-wide list and sleep
on the global vlan mutex held by vlan_unconfig().
The interface was gone by the time the other thread
woke up.

In order to be able to call vlan_unconfig() on a detached
interface, remove the purely cosmetic bzero'ing of IF_LLADDR
from the function because a detached interface has no addresses.

Noticed by:	a stress-testing script by maxim
Reviewed by:	glebius
2006-06-29 07:52:30 +00:00
Yaroslav Tykhiy
114c608c71 Remove a few unused things.
Fix some style and consistency points.
2006-06-29 07:30:39 +00:00
Yaroslav Tykhiy
185225ff52 Reduce unneeded code duplication. 2006-06-29 07:23:49 +00:00
Andrew Thompson
ae4748ad15 A small race existed where the lock was dropped between when encif was
tested and then set. [1]

Reorganise things to eliminate this, we now ensure that enc0 can not be
destroyed which as the benefit of no longer needing to lock in
ipsec_filter and ipsec_bpf. The cloner will create one interface during the
init so we can guarantee that encif will be valid before any SPD entries are
added to ipsec.

Spotted by:	glebius [1]
2006-06-28 21:57:35 +00:00
Andrew Thompson
f0ac1eedd5 Simplify ipsec_bpf by using bpf_mtap2(). 2006-06-27 01:53:12 +00:00
Andrew Thompson
bdea400f3b Add a pseudo interface for packet filtering IPSec connections before or after
encryption. There are two functions, a bpf tap which has a basic header with
the SPI number which our current tcpdump knows how to display, and handoff to
pfil(9) for packet filtering.

Obtained from:	OpenBSD
Based on:	kern/94829
No objections:	arch, net
MFC after:	1 month
2006-06-26 22:30:08 +00:00
Yaroslav Tykhiy
15ed2fa1f1 Fix the VLAN_ARRAY case, mostly regarding improper use of atomic(9)
in place of conventional rw locking.  Alas, atomic(9) can't buy us
lockless operation so easily.
2006-06-21 13:48:34 +00:00
Yaroslav Tykhiy
5cb8c31af1 Track interface department events and detach vlans from
departing trunk so that we don't get into trouble later
by dereferencing a stale pointer to dead trunk's things.

Prodded by:	oleg
Sponsored by:	RiNet (Cronyx Plus LLC)
MFC after:	1 week
2006-06-21 07:29:44 +00:00
Gleb Smirnoff
457f48e65c - First initialize ifnet, and then insert it into global
list.
- First remove from global list, then start destroying.

PR:		kern/97679
Submitted by:	Alex Lyashkov <shadow itt.net.ru>
Reviewed by:	rwatson, brooks
2006-06-21 06:02:35 +00:00
Andrew Thompson
690d79381a Allow gif interfaces to be added as span ports, the user may want to send a
copy of all packets to the other side of the world.
2006-06-20 21:28:18 +00:00
Max Laier
0dad3f0e15 Import interface groups from OpenBSD. This allows to group interfaces in
order to - for example - apply firewall rules to a whole group of
interfaces.  This is required for importing pf from OpenBSD 3.9

Obtained from:	OpenBSD (with changes)
Discussed on:	-net (back in April)
2006-06-19 22:20:45 +00:00
Andrew Thompson
615fccc52b Fix spelling mistake in comment. 2006-06-19 02:25:11 +00:00
Christian S.J. Peron
19ba8395e1 Since we are doing some bpf(4) clean up, change a couple of function prototypes
to be consistent. Also, ANSI'fy function definitions. There is no functional
change here.
2006-06-15 15:39:12 +00:00
Christian S.J. Peron
7eae78a419 If bpf(4) has not been compiled into the kernel, initialize the bpf interface
pointer to a zeroed, statically allocated bpf_if structure. This way the
LIST_EMPTY() macro will always return true. This allows us to remove the
additional unconditional memory reference for each packet in the fast path.

Discussed with:	sam
2006-06-14 02:23:28 +00:00
Andrew Thompson
80829fccd7 Use bit operations to get a locally administered address rather than using a
hardcoded OUI code.
2006-06-12 22:43:37 +00:00
Max Khon
affcaf7871 Fix KASSERT conditions in if_deregister_com_alloc(). 2006-06-11 22:09:28 +00:00
Andrew Thompson
b3a1f9373a Allow bridge and carp to play nicely together by returning the packet if its
destined for a carp interface.

Obtained from:	OpenBSD
MFC after:	2 weeks
2006-06-08 23:40:16 +00:00
Qing Li
1a41f91052 Assuming the interface has an address of x.x.x.195, a mask of
255.255.255.0, and a default route with gateway x.x.x.1. Now if
the address mask is changed to something more specific, e.g.,
255.255.255.128, then after the mask change the default gateway
is no longer reachable.

Since the default route is still present in the routing table,
when the output code tries to resolve the address of the default
gateway in function rt_check(), again, the default route will be
returned by rtalloc1(). Because the lock is currently held on the
rtentry structure, one more attempt to hold the lock will trigger
a crash due to "lock recursed on non-recursive mutex ..."

This is a general problem. The fix checks for the above condition
so that an existing route entry is not mistaken for a new cloned
route. Approriately, an ENETUNREACH error is returned back to the
caller

Approved by:	andre
2006-06-05 21:20:21 +00:00
Christian S.J. Peron
ffdc0471d4 Back out previous two commits, this caused some problems in the namespace
resulting in some build failures. Instead, to fix the problem of bpf not
being present, check the pointer before dereferencing it.

This is a temporary bandaid until we can decide on how we want to handle
the bpf code not being present. This will be fixed shortly.
2006-06-03 18:48:14 +00:00
Christian S.J. Peron
727b73816c Temporarily include files so that our macro checks do something useful. 2006-06-03 18:16:54 +00:00
Christian S.J. Peron
5255290c9c Make sure we don't try to dereference the the if_bpf pointer when bpf has
not been compiled into the the kernel.

Submitted by:	benno
2006-06-03 06:37:00 +00:00
Sam Leffler
ff046a6c6b add missed calls to bpf_peers_present 2006-06-02 23:14:40 +00:00
Christian S.J. Peron
16d878cc99 Fix the following bpf(4) race condition which can result in a panic:
(1) bpf peer attaches to interface netif0
	(2) Packet is received by netif0
	(3) ifp->if_bpf pointer is checked and handed off to bpf
	(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
	    initialized to NULL.
	(5) ifp->if_bpf is dereferenced by bpf machinery
	(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
  bpf interface structure. Once this is done, ifp->if_bpf should never be
  NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
  a lockless read bpf peer list associated with the interface. It should
  be noted that the bpf code will pickup the bpf_interface lock before adding
  or removing bpf peers. This should serialize the access to the bpf descriptor
  list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
  can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

	(1) Packet is received by netif0
	(2) Check to see if bpf descriptor list is empty
	(3) Pickup the bpf interface lock
	(4) Hand packet off to process

From the attach/detach side:

	(1) Pickup the bpf interface lock
	(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
    not we have any bpf peers that might be interested in receiving packets.

In collaboration with:	sam@
MFC after:	1 month
2006-06-02 19:59:33 +00:00
Gleb Smirnoff
6e86062956 Fix gif_output() so that GIF_UNLOCK() is performed only in case
we have locked the softc.

PR:		kern/98298
Submitted by:	Eugene Grosbein
2006-06-02 14:10:52 +00:00
Robert Watson
4421f50dbc raw_disconnect() now disconnects but does not detach the raw pcb. As a
result, raw_uabort() now needs to call raw_detach() directly.  As
raw_uabort() is never called, and raw_disconnect() is probably not ever
actually called in practice, this is likely not a functional change, but
improves congruence between protocols, and avoids a NULL raw cb pointer
after disconnect, which could result in a panic.

MFC after:	1 month
2006-06-02 08:27:15 +00:00
Gleb Smirnoff
4ec449ae88 - Add definition for IFM_10G_CX4.
- Put IFM_10G_CX4 and IFM_10G_SR into IFMEDIA_BAUDRATE array.

Requested by:	Jack Vogel <jfvogel gmail.com>
2006-06-02 07:50:58 +00:00
Andrew Thompson
f3b90d48bb Announce all interfaces to devd on attach/detach. This adds a new devctl
notification so all interfaces including pseudo are reported. When netif
creates the clones at startup devctl_disable has not been turned off yet so the
interfaces will not be initialised twice, enforce this by adding an explicit
order between rc.d/netif and rc.d/devd.

This change allows actions to taken in userland when an interface is cloned
and the pseudo interface will be automatically configured if a ifconfig_<int>=""
line exists in rc.conf.

Reviewed by:		brooks
No objections on:	net
2006-06-01 00:41:07 +00:00
Marius Strobl
fa67ebf9bb Revert the (int *) -> (intptr_t *) conversion done as part of rev. 1.59
for IOCTLs where casting data to intptr_t * isn't the right thing to do
as _IO() isn't used for them but _IOR(..., int)/_IOW(..., int) are (i.e.
for all IOCTLs except VMIO_SIOCSIFFLAGS), fixing tap(4) on big-endian
LP64 machines.

PR:		sparc64/98084
OK'ed by:	emax
MFC after:	1 week
2006-05-30 20:08:12 +00:00
Ruslan Ermilov
293c06a186 Fix -Wundef warnings. 2006-05-30 19:24:01 +00:00
David Malone
a58327bd09 Avoid unwanted sign extension of indexed byte load in bpf code.
PR:		89748
Submitted by:	Guy Harris <guy@alum.mit.edu>
Obtained from:	NetBSD via OpenBSD
MFC after:	2 weeks
2006-05-28 20:00:02 +00:00
Maksim Yevmenkin
7a9adfdd85 Do not call knlist_destroy() in tapclose(). Instead call it when device is
actually destroyed. Also move call to knlist_init() into tapcreate(). This
should fix panic described in kern/95357.

PR:			kern/95357
No response from:	freebsd-current@
MFC after:		3 days
2006-05-17 17:05:02 +00:00
Andrew Thompson
dc1b1b7b6a Fix style(9) nits, whitespace and parentheses. 2006-05-16 22:50:41 +00:00
Qing Li
e034e82c56 The current routing code allows insertion of indirect routes that have
gateways which are unreachable except through the default router. For
example, assuming there is a default route configured, and inserting
a route

	"route add 64.102.54.0/24 60.80.1.1"

is currently allowed even when 60.80.1.1 is only reachable through
the default route. However, an error is thrown when this route is
utilized, say,

	"ping 64.102.54.1"  will return an error

This type of route insertion should be disallowed becasue:

1) Let's say that somehow our code allowed this packet to flow to
   the default router, and the default router knows the next hop is
   60.80.1.1, then the question is why bother inserting this route in
   the 1st place, just simply use the default route.

2) Since we're not talking about source routing here, the default
   router could very well choose a different path than using 60.80.1.1
   for the next hop, again it defeats the purpose of adding this route.

Reviewed by:	ru, gnn, bz
Approved by:	andre
2006-05-16 19:11:11 +00:00
Daniel Hartmeier
2557a639a5 Recalculate IP checksum after running pfil hooks.
Reviewed by:	thompsa
Tested by:	Adam McDougall <mcdouga9@egr.msu.edu>
2006-05-15 11:49:01 +00:00
Max Laier
656faadcb8 Remove ip6fw. Since ipfw has full functional IPv6 support now and - in
contrast to ip6fw - is properly lockes, it is time to retire ip6fw.
2006-05-12 20:39:23 +00:00
John Baldwin
73dbd3da73 Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
Jeffrey Hsu
a393a28afa Correct test for fragmented packet. 2006-05-11 00:53:43 +00:00
Christian S.J. Peron
1fc9e38706 Pickup locks for the BPF interface structure. It's quite possible that
bpf(4) descriptors can be added and removed on this interface while we
are processing stats.

MFC after:	2 weeks
2006-05-07 03:21:43 +00:00
Bjoern A. Zeeb
ac4a76ebc9 In rtrequest and rtinit check for sa_len != 0 for the given
destination. These checks are needed so we do not install
a route looking like this:
(0)                192.0.2.200        UH       tun0 =>

When removing this route  the kernel will start to walk
the address space which looks like a hang on 64bit platforms
because it'll take ages while on 32bit you should see a panic
when kernel debugging options are turned on.

The problem is in rtrequest1:
	if (netmask) {
		rt_maskedcopy(dst, ndst, netmask);
	} else
		bcopy(dst, ndst, dst->sa_len);

In both cases the len might be 0 if the application forgot to
set it.  If so ndst will be all-zero  leading to above
mentioned strange routes.

This is an application error but we must not fail/hang/panic
because of this.

Looks ok:	gnn
No objections:	net@ (silence)
MFC after:	8 weeks
2006-05-04 18:33:37 +00:00
Andrew Thompson
7f87a57ca3 Add support for fragmenting ipv4 packets.
The packet filter may reassemble the ip fragments and return a packet that is
larger than the MTU of the sending interface. There is no check for DF or icmp
replies as we can only get a large packet to fragment by reassembling a
previous fragment, and this only happens after a call to pfil(9).

Obtained from:	OpenBSD (mostly)
Glanced at by:	mlaier
MFC after:	1 month
2006-04-29 05:37:25 +00:00
Robert Watson
e0cf89fc53 Use ANSI C function protypes and declarations for if_arcsubr.
MFC after:	1 month
2006-04-12 07:44:31 +00:00
Robert Watson
9d20951479 Correct an assertion in raw_uattach(): this is a library call that other
protocols invoke after allocating a PCB, so so_pcb should be non-NULL.
It is only used by the two IPSEC implementations, so I didn't hit it in
my testing.

Reported by:	pjd
MFC after:	3 months
2006-04-09 15:15:28 +00:00
Andre Oppermann
d214ccb6ba Undo damage from wrong MFC to HEAD.
Pointed out by:	jkim, remko
2006-04-04 20:20:51 +00:00
Andre Oppermann
bedf8e3354 MFC rev. 1.32: Add link status descriptions and related structures for userland
applications.

Approved by:	re
2006-04-04 20:02:51 +00:00
Robert Watson
0154484bef In raw and raw-derived socket types, maintain and enforce invariant that
the so_pcb pointer on the socket is always non-NULL.  This eliminates
countless unnecessary error checks, replacing them with assertions.

MFC after:	3 months
2006-04-01 15:55:44 +00:00
Robert Watson
bc725eafc7 Chance protocol switch method pru_detach() so that it returns void
rather than an error.  Detaches do not "fail", they other occur or
the protocol flags SS_PROTOREF to take ownership of the socket.

soclose() no longer looks at so_pcb to see if it's NULL, relying
entirely on the protocol to decide whether it's time to free the
socket or not using SS_PROTOREF.  so_pcb is now entirely owned and
managed by the protocol code.  Likewise, no longer test so_pcb in
other socket functions, such as soreceive(), which have no business
digging into protocol internals.

Protocol detach routines no longer try to free the socket on detach,
this is performed in the socket code if the protocol permits it.

In rts_detach(), no longer test for rp != NULL in detach, and
likewise in other protocols that don't permit a NULL so_pcb, reduce
the incidence of testing for it during detach.

netinet and netinet6 are not fully updated to this change, which
will be in an upcoming commit.  In their current state they may leak
memory or panic.

MFC after:	3 months
2006-04-01 15:42:02 +00:00
Robert Watson
ac45e92ff2 Change protocol switch pru_abort() API so that it returns void rather
than an int, as an error here is not meaningful.  Modify soabort() to
unconditionally free the socket on the return of pru_abort(), and
modify most protocols to no longer conditionally free the socket,
since the caller will do this.

This commit likely leaves parts of netinet and netinet6 in a situation
where they may panic or leak memory, as they have not are not fully
updated by this commit.  This will be corrected shortly in followup
commits to these components.

MFC after:      3 months
2006-04-01 15:15:05 +00:00
Robert Watson
a260bd4131 Add IFF_NEEDSGIANT to kernel PPP support. I have no idea why this wasn't
here, but it should have been.

MFC after:	3 days
2006-03-30 08:18:27 +00:00
Andrew Thompson
64cb85059e Assert that the mbuf is not shared to ensure problems like the last commit are
not reintroduced.
2006-03-26 20:52:47 +00:00
Roman Kurakin
5cb7f13aee m_dup () packet not m_copypacket () since we will modify it. For more
details see PR kern/94448.

PR:     kern/94448

Original patch: Eygene A. Ryabinkin <rea-fbsd at rea dot mbslab dot kiae dot ru>Final patch:    thompsa@
Tested by:      thompsa@, Eygene A. Ryabinkin

MFC after:      7 days
2006-03-23 22:57:10 +00:00
Gleb Smirnoff
93a69f5703 No direct call to carp_ifdetach() anymore. It is called by
event handler.

PR:		kern/82908
Submitted by:	Dan Lukes <dan obluda.cz>
2006-03-21 14:31:18 +00:00
Maksim Yevmenkin
a9e17e2e05 Add kqueue(2) support on if_tap(4) interfaces. While I'm here, replace
K&R style function declarations with ANSI style. Also fix endian bugs
accessing ioctl arguments that are passed by value.

PR:		kern/93897
Submitted by:	Vilmos Nebehaj < vili at huwico dot hu >
MFC after:	1 week
2006-03-16 18:22:01 +00:00
Andre Oppermann
e4bd8f103e Add link status descriptions and related structures for userland
applications.

Open[BGP|OSPF]D make use of this to determine the link status of
interfaces to make the right routing descisions.

Obtained from:	OpenBSD
MFC after:	3 days
2006-03-15 19:43:25 +00:00
Andre Oppermann
22cafcf0b8 - Fill in the correct rtm_index for RTM_ADD and RTM_CHANGE messages.
- Allow RTM_CHANGE to change a number of route flags as specified by
  RTF_FMASK.

- The unused rtm_use field in struct rt_msghdr is redesignated as
  rtm_fmask field to communicate route flag changes in RTM_CHANGE
  messages from userland.  The use count of a route was moved to
  rtm_rmx a long time ago.  For source code compatibility reasons
  a define of rtm_use to rtm_fmask is provided.

These changes faciliate running of multiple cooperating routing
daemons at the same time without causing undesired interference.
Open[BGP|OSPF]D make use of these features to have IGP routes
override EGP ones.

Obtained from:	OpenBSD (claudio@)
MFC after:	3 days
2006-03-15 19:39:09 +00:00
Ruslan Ermilov
ceec92fe5d Don't acquire a lock before calling vlan_unconfig().
This fixes a panic when doing "ifconfig ... -vlandev".

OK'ed by:	glebius
2006-03-09 14:42:51 +00:00
Andrew Thompson
e1457c3eb1 If we miss the LINK_UP event from the network interface then the bridge port
will remain in the disabled state until another link event happens in the
future (if at all). Add a timer to periodically check the interface state and
recover.

Reported by:	Nik Lam <freebsdnik j2d.lam.net.au>
MFC after:	3 days
2006-03-06 02:28:41 +00:00
Christian S.J. Peron
de572b371b Unbreak byte counters when network interfaces are in monitor mode by
re-organizing the monitor return logic. We perform interface monitoring
checks after we have determined if the CRC is still on the packet, if
it is, m_adj() is called which will adjust the packet length. This
ensures that we are not including CRC lengths in the byte counters for
each packet.

Discussed with:	andre, glebius
2006-03-03 17:21:08 +00:00
Andrew Thompson
158a726c96 Since we are using random ethernet addresses for the bridge, it is possible
that we might have address collisions, so make sure that this hardware address
isn't already in use on another bridge.

Submitted by:	csjp
MFC after:	1 month
2006-03-03 09:12:21 +00:00
Christian S.J. Peron
6f75ef188b Slightly re-worked bpf(4) code associated with bridging: if we have a
destination interface as a member of our bridge or this is a unicast packet,
push it through the bpf(4) machinery.

For broadcast or multicast packets, don't bother with the bpf(4) because it will
be re-injected into ether_input. We do this before we pass the packets through
the pfil(9) framework, as it is possible that pfil(9) will drop the packet or
possibly modify it, making it very difficult to debug firewall issues on the
bridge.

Further, implemented IFF_MONITOR for bridge interfaces. This does much the same
thing that it does for regular network interfaces: it pushes the packet to any
bpf(4) peers and then returns. This bypasses all of the bridge machinery,
saving mutex acquisitions, list traversals, and other operations performed by
the bridging code.

This change to the bridging code is useful in situations where individuals use a
bridge to multiplex RX/TX signals from two interfaces, as is required by some
network taps for de-multiplexing links and transmitting the RX/TX signals
out through two separate interfaces. This behaviour is quite common for network
taps monitoring links, especially for certain manufacturers.

Reviewed by:	thompsa
MFC after:	1 month
Sponsored by:	Seccuris Labs
2006-03-03 05:58:18 +00:00
Andrew Thompson
43dc0e8c41 Fix up the Bridge Identifier field in the BPDU packet.
- use the cu_bridge_id rather than the cu_rootid for the bridge address [1]
 - the memcmp return value is not signed so the wrong interface may have been
   selected
 - fix up the calculation of sc_bridge_id

PR:		kern/93909 [1]
MFC after:	3 days
2006-02-28 00:13:24 +00:00
Wojciech A. Koszek
51b4ccb464 This patch fixes a problem, which exists if you have IPSEC in your kernel
and want to have crypto support loaded as KLD. By moving zlib to separate
module and adding MODULE_DEPEND directives, it is possible to use such
configuration without complication. Otherwise, since IPSEC is linked with
zlib (just like crypto.ko) you'll get following error:

	interface zlib.1 already present in the KLD 'kernel'!

Approved by:	cognet (mentor)
2006-02-27 16:56:22 +00:00
Yaroslav Tykhiy
33499e2ae5 Don't to forget to unlock the rwlock on trunk before destroying it.
This should fix panic on "kldunload if_vlan" while vlanX are still there.

Reviewed by:	glebius
2006-02-24 17:25:16 +00:00
Gleb Smirnoff
a7c959fe18 Fix build. 2006-02-15 08:25:40 +00:00
Gleb Smirnoff
efd19b8fd0 - Introduce ifmedia_baudrate(), which returns correct baudrate of the
given media status. [1]
- Utilize ifmedia_baudrate() in miibus_statchg() to update ifp->if_baudrate.

Obtained from:	NetBSD [1]
2006-02-14 12:10:03 +00:00
Ed Maste
11edc47706 Bump the MODULE_VERSION for HEAD, as the vlan(4) API is different in
RELENG_6, and would require a lower version number.

Requested by:	glebius
Approved by:	rwatson (mentor)
2006-02-10 18:38:33 +00:00
Yaroslav Tykhiy
802dadcfeb Avoid frobbing IFF_UP at any cost (which is close to
zero in this case.)  A kernel driver has IFF_DRV_RUNNING
at its full disposal while IFF_UP may be toggled only by
humans or their daemonic deputies from the userland.

MFC after:	3 days
2006-02-10 11:01:10 +00:00
Ed Maste
7f8b993473 Add a MODULE_VERSION so that other modules (perhaps third-party) can
depend on this one.

Approved by:	rwatson (mentor)
2006-02-09 22:11:58 +00:00
Qing Li
6b7b44acd9 The code in rn_walktree_from() that checks if we backed up too far
did not stop at the right node. Change the backtracking check from
smaller-than to smaller-or-equal to prevent this from happening.
While here fix one additional problem where the insertion of the
default route traversed the entire tree.

PR:		kern/38752
Submitted by:	qingli (before I became committer)
Reviewed by:	andre
MFC after:	3 days
2006-02-07 20:25:39 +00:00
Qing Li
d03e5467a4 Remove two unnecessary type casts, of which both had a typo in
it anyways.

Approved by: andre
MFC after: 3 days
2006-02-07 20:09:02 +00:00
Oleg Bulyzhin
3ecf1851df Properly initialize args structure before passing it to ipfw_chk(): having
uninitialized args.inp is unhealthy for uid/gid/jail ipfw rules.

PR:		kern/92589
Approved by:	glebius (mentor)
MFC after:	1 week
2006-02-03 23:03:07 +00:00
Gleb Smirnoff
05a2398f32 In vlan_config() first call vlan_inithash(), then lock mutex, because
vlan_inithash() calls malloc(M_WAITOK).
2006-02-02 22:11:38 +00:00
Christian S.J. Peron
fa918e1ef7 define lock.h before rwlock.h for DEBUG_LOCKS 2006-02-02 20:33:10 +00:00
Paul Saab
19cf04981a Implement SIOCGIFCONF for 32bit binaries. 2006-02-02 19:58:37 +00:00
Christian S.J. Peron
f5cdbcf14c Use PFIL_HOOKED macros in if_bridge and pass the right argument to
rw_assert. This un-breaks the build.

Submitted by:	Kostik Belousov
Pointy hat to:	csjp
2006-02-02 16:41:20 +00:00
Christian S.J. Peron
604afec496 Somewhat re-factor the read/write locking mechanism associated with the packet
filtering mechanisms to use the new rwlock(9) locking API:

- Drop the variables stored in the phil_head structure which were specific to
  conditions and the home rolled read/write locking mechanism.
- Drop some includes which were used for condition variables
- Drop the inline functions, and convert them to macros. Also, move these
  macros into pfil.h
- Move pfil list locking macros intp phil.h as well
- Rename ph_busy_count to ph_nhooks. This variable will represent the number
  of IN/OUT hooks registered with the pfil head structure
- Define PFIL_HOOKED macro which evaluates to true if there are any
  hooks to be ran by pfil_run_hooks
- In the IP/IP6 stacks, change the ph_busy_count comparison to use the new
  PFIL_HOOKED macro.
- Drop optimization in pfil_run_hooks which checks to see if there are any
  hooks to be ran, and returns if not. This check is already performed by the
  IP stacks when they call:

        if (!PFIL_HOOKED(ph))
                goto skip_hooks;

- Drop in assertion which makes sure that the number of hooks never drops
  below 0 for good measure. This in theory should never happen, and if it
  does than there are problems somewhere
- Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep
- Drop variables which support home rolled read/write locking mechanism from
  the IPFW firewall chain structure.
- Swap out the read/write firewall chain lock internal to use the rwlock(9)
  API instead of our home rolled version
- Convert the inlined functions to macros

Reviewed by:	mlaier, andre, glebius
Thanks to:	jhb for the new locking API
2006-02-02 03:13:16 +00:00
Andrew Thompson
6637e0f390 Fix two bugs with the bridge
- code expects memcmp() to return a signed value, our memcmp() returns 0 if
   args are equal and > 0 if not.

 - It's possible to hijack interface for static entry. If bridge recieves
   packet from interface marked as learning it will replace the bridge_rtnode
   entry for the source address even if such entry marked as static.

Submitted by:	Gleb Kurtsov <k-gleb yandex.ru>
MFC after:	3 days
2006-01-31 21:21:28 +00:00
Yaroslav Tykhiy
64a17d2e86 Set IFF_BROADCAST and IFF_MULTICAST on vlan interfaces from the
beginning and simply refuse to attach to a parent without either
flag.

Our network stack cannot handle well IFF_BROADCAST or IFF_MULTICAST
on an interface changing on the fly.  E.g., IP will or won't assign
a broadcast address to an interface and join the all-hosts multicast
group on it depending on its IFF_BROADCAST and IFF_MULTICAST settings.
Should the flags alter later, IP will miss the change and keep using
bogus settings.  This can lead to evil things like supplying an
invalid broadcast address or trying to leave a multicast group that
hasn't been joined.  So just avoid touching the flags since an
interface was created.  This has no practical purpose.

Discussed with:	-net, glebius, oleg
MFC after:	1 week
2006-01-31 16:41:05 +00:00
Gleb Smirnoff
75ee267c22 Merge the //depot/user/yar/vlan branch into CVS. It contains some collective
work by yar, thompsa and myself. The checksum offloading part also involves
work done by Mihail Balikov.

The most important changes:

o   Instead of global linked list of all vlan softc use a per-trunk
  hash. The size of hash is dynamically adjusted, depending on
  number of entries. This changes struct ifnet, replacing counter
  of vlans with a pointer to trunk structure. This change is an
  improvement for setups with big number of VLANs, several interfaces
  and several CPUs. It is a small regression for a setup with a single
  VLAN interface.
    An alternative to dynamic hash is a per-trunk static array with
  4096 entries, which is a compile time option - VLAN_ARRAY. In my
  experiments the array is not an improvement, probably because such
  a big trunk structure doesn't fit into CPU cache.
o   Introduce an UMA zone for VLAN tags. Since drivers depend on it,
  the zone is declared in kern_mbuf.c, not in optional vlan(4) driver.
  This change is a big improvement for any setup utilizing vlan(4).
o   Use rwlock(9) instead of mutex(9) for locking. We are the first
  ones to do this! :)
o   Some drivers can do hardware VLAN tagging + hardware checksum
  offloading. Add an infrastructure for this. Whenever vlan(4) is
  attached to a parent or parent configuration is changed, the flags
  on vlan(4) interface are updated.

In collaboration with:	yar, thompsa
In collaboration with:	Mihail Balikov <mihail.balikov interbgc.com>
2006-01-30 13:45:15 +00:00
Gleb Smirnoff
25af0bb50e Add some initial locking to gif(4). It doesn't covers the whole driver,
however IPv4-in-IPv4 tunnels are now stable on SMP. Details:

- Add per-softc mutex.
- Hold the mutex on output.

The main problem was the rtentry, placed in softc. It could be
freed by ip_output(). Meanwhile, another thread being in
in_gif_output() can read and write this rtentry.

Reported by:	many
Tested by:	Alexander Shiryaev <aixp mail.ru>
2006-01-30 08:39:09 +00:00
Colin Percival
02d4ab93fb Make sure buffers in if_bridge are fully initialized before copying
them to userland.

Security:	FreeBSD-SA-06:06.kmem
2006-01-25 10:00:40 +00:00
Yaroslav Tykhiy
83ec464f61 Be consistent in checking ifa->ifa_addr for NULL.
Found by:	Coverity Prevent (tm)
MFC after:	3 days
2006-01-23 10:30:34 +00:00
Bjoern A. Zeeb
3f2e28fe9f Fix stack corruptions on amd64.
Vararg functions have a different calling convention than regular
functions on amd64. Casting a varag function to a regular one to
match the function pointer declaration will hide the varargs from
the caller and we will end up with an incorrectly setup stack.

Entirely remove the varargs from these functions and change the
functions to match the declaration of the function pointers.
Remove the now unnecessary casts.

Lots of explanations and help from:     peter
Reviewed by:                            peter
PR:                                     amd64/89261
MFC after:                              6 days
2006-01-21 10:44:34 +00:00
Andre Oppermann
5d691e6da8 Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer
may have changed by m_pullup() during fastforward processing.

While this is a bug it is actually never triggered in real world
situations and it is not remotely exploitable.

Found by:	Coverity Prevent(tm)
Coverity ID:	CID780
Sponsored by:	TCP/IP Optimization Fundraise 2005
2006-01-18 14:24:39 +00:00
Andrew Thompson
7c2fb83a0b Add code that clears certain capabilities from the member interface, these are
restored when its removed from the bridge.

At the moment we only clear IFCAP_TXCSUM. Since a locally generated packet on
the bridge may be sent out any one or more interfaces it cant be assumed that
every card does hardware csums. Most bridges don't generate a lot of traffic
themselves so turning off offloading won't hurt, bridged packets are
unaffected.

Tested by:	Bruce Walker (bmw borderware.com)
MFC after:	5 days
2006-01-14 03:51:31 +00:00
Robert Watson
3208581a15 Check the right ifnet pointer to see if if_alloc() failed or not in
ef_clone(); we were testing the original ifnet, not the one allocated.

When aborting ef_clone() due to if_alloc() failing, free the allocated
efnet structure rather than leaking it.

Noticed by:	Coverity Prevent analysis tool
MFC after:	3 days
2006-01-13 23:24:09 +00:00
Robert Watson
ae7c484e82 When freeing the chain of if_ef devices on an aborted load, use
SLIST_FOREACH_SAFE() rather than SLIST_FOREACH(), as elements are
freed on each iteration of the loop.  This prevents use-after-free.

Noticed by:	Coverity Prevent analysis tool
MFC after:	3 days
2006-01-13 23:20:46 +00:00
Brooks Davis
118b438d73 Get rid of the bogus IFP2FC() macro and use IFP2FWC(). IFP2FC()
attempted to cast a struct ifnet to a struct fw_com which resulted in
data corruption.

PR:		kern/91307
Submitted by:	Alex Semenyaka <alex at semenyaka do ru>
MFC After:	6 days
2006-01-11 05:37:21 +00:00
Hartmut Brandt
154508976b Add a new leaf to the net.link.generic.ifdata.%d sysctl to retrieve
the name and unit number assigned by the driver. This is needed by
SNMP to find interfaces after they have been renamed.

MFC after:	4 weeks
2006-01-04 12:57:09 +00:00
Jung-uk Kim
142f81c25d Correctly check the filter length. I committed the wrong version.
Pointy hat to me.
2006-01-03 20:34:41 +00:00
Jung-uk Kim
dccb7faff6 - Explicitly validate an empty filter to match bpf_filter() comment[1].
- Do not use BPF JIT compiler for an empty filter.

[1] Pointed out by:	darrenr
2006-01-03 20:26:03 +00:00
Andrew Thompson
f0feaf4f19 Fix a brain-o in the last commit, the conditional was always false. 2006-01-02 23:02:43 +00:00
Andrew Thompson
94e45ae5e8 Reorganise bridge_rtupdate slightly to reduce duplication. 2006-01-02 22:44:54 +00:00
Andrew Thompson
ef9ac7c49a Reset the route expiry time on each update rather than always letting them get
GC'd and recreated.
2006-01-02 22:29:41 +00:00
Andrew Thompson
bc9f74c7cb It is better to use time_uptime here since it is monotonic.
Pointed out by:	glebius
2006-01-02 22:23:03 +00:00
Andrew Thompson
ec311647fb Minor whitespace cleanup. 2006-01-02 09:50:34 +00:00
Andrew Thompson
f595d62759 Read time_second directly rather than calling getmicrotime().
Obtained from:	DragonflyBSD
2006-01-02 09:36:53 +00:00
Andrew Thompson
a47f91cdc4 When pfil(9) is enabled the bridge only considers ETHERTYPE_ARP, ETHERTYPE_IP and
ETHERTYPE_IPV6 frames. Change this to be a sysctl knob so that is able to still
bridge non-IP packets if desired.

Also return early if all pfil_* sysctls are turned off, the user obviously does
not want to filter on the bridge.
2005-12-29 09:39:15 +00:00
Sam Leffler
a8af2cc7ce add a sysctl to turn debug msgs on/off when built with IFMEDIA_DEBUG 2005-12-25 23:28:23 +00:00
Oleg Bulyzhin
c54c76cc2f 1) remove useless check of loop_copy - corresponding code was removed in
rev. 1.70 five years ago.
2) convert loop_copy to "non-negative" flag

Approved by:	glebius (mentor)
MFC after:	2 weeks
2005-12-22 12:16:20 +00:00
Andrew Thompson
73ff045c57 Add RFC 3378 EtherIP support. This change makes it possible to add gif
interfaces to bridges, which will then send and receive IP protocol 97 packets.
Packets are Ethernet frames with an EtherIP header prepended.

Obtained from:	NetBSD
MFC after:	2 weeks
2005-12-21 21:29:45 +00:00
Andrew Thompson
1e4200620a As of r1.21 all broadcast packets are reprocessed by ether_input as arriving on
the bridge, this caused these packets to show up twice via bpf. Do not process
them twice with BPF_TAP.

MFC after:	3 days
2005-12-21 09:39:59 +00:00
Gleb Smirnoff
d147662cd3 - Fix VLAN_INPUT_TAG() macro, so that it doesn't touch mtag in
case if memory allocation failed.
- Remove fourth argument from VLAN_INPUT_TAG(), that was used
  incorrectly in almost all drivers. Indicate failure with
  mbuf value of NULL.

In collaboration with:	yongari, ru, sam
2005-12-18 18:24:27 +00:00
Andrew Thompson
9d5e4aa8b1 Use M_ZERO for the bridge_iflist to ensure there are no unexpected suprises. 2005-12-17 10:12:20 +00:00
Andrew Thompson
6b74382014 Minor whitespace cleanup. 2005-12-17 10:03:48 +00:00
Andrew Thompson
e0a87e8acd Change from a callback in if_ethersubr to using EVENTHANDLER in order to detach
span ports when they disappear. The span port does not have a pointer to the
softc so revert r1.31 and bring back the softc linked-list.

MFC after:	2 weeks
2005-12-17 06:33:51 +00:00
Andrew Thompson
7536320f62 It is not safe to use m_copypacket() here as the returned mbuf is readonly,
change to m_dup and keep the alignment on the layer3 header.

MFC after:	1 week
2005-12-15 19:34:39 +00:00
Andrew Thompson
91f6764e93 Add support for creating span ports so that one can snoop bridged traffic
from another interface/machine/network.

Obtained from:	OpenBSD
MFC after:	2 weeks
2005-12-14 02:52:13 +00:00
Jung-uk Kim
200bc1f049 Do not accept an empty bpf program. 2005-12-08 00:05:03 +00:00
Jung-uk Kim
848c454cc1 Add BPF Just-In-Time compiler support for ng_bpf(4).
The sysctl is changed from net.bpf.jitter.enable to net.bpf_jitter.enable
and this controls both bpf(4) and ng_bpf(4) now.
2005-12-07 21:30:47 +00:00
Jung-uk Kim
6a96c4832f s/M_WAITOK/M_NOWAIT/ while mutex is held.
Pointed out by:	csjp
2005-12-06 07:22:01 +00:00
Jung-uk Kim
ae275efcae Add experimental BPF Just-In-Time compiler for amd64 and i386.
Use the following kernel configuration option to enable:

	options BPF_JITTER

If you want to use bpf_filter() instead (e. g., debugging), do:

	sysctl net.bpf.jitter.enable=0

to turn it off.

Currently BIOCSETWF and bpf_mtap2() are unsupported, and bpf_mtap() is
partially supported because 1) no need, 2) avoid expensive m_copydata(9).

Obtained from:	WinPcap 3.1 (for i386)
2005-12-06 02:58:12 +00:00
Ruslan Ermilov
3238c6bd33 Fix -Wundef from compiling the amd64 LINT. 2005-12-04 10:06:06 +00:00
Ruslan Ermilov
f4e9888107 Fix -Wundef. 2005-12-04 02:12:43 +00:00
Andrew Thompson
53b5c4604a The bridge is capable of sending broadcast packets so enable IFF_BROADCAST
Requested by:	des
2005-11-29 20:29:44 +00:00
Gleb Smirnoff
62f0bf3250 Take if_baudrate from the parent. This fixes problem with SNMP
daemons reporting zero speed for vlan(4) interfaces.
2005-11-28 12:46:35 +00:00
Ruslan Ermilov
434dbbb396 Fix the following bugs:
- In ifc_name2unit(), disallow leading zeroes in a unit.

  Exploit: ifconfig lo01 create

- In ifc_name2unit(), properly handle overflows.  Otherwise,
  either of two local panic()'s can occur, either because
  no interface with such a name could be found after it was
  successfully created, or because the code will bogusly
  assume that it's a wildcard (unit < 0 due to overflow).

  Exploit: ifconfig lo<overflowed_integer> create

- Previous revision made the following sequence trigger
  a KASSERT() failure in queue(3):

  Exploit: ifconfig lo0 destroy; ifconfig lo0 destroy

  This is because IFC_IFLIST_REMOVE() is always called
  before ifc->ifc_destroy() has been run, not accounting
  for the fact that the latter can fail and leave the
  interface operating (like is the case for "lo0").
  So we ended up calling LIST_REMOVE() twice.  We cannot
  defer IFC_IFLIST_REMOVE() until after a call to
  ifc->ifc_destroy() because the ifnet may have been
  removed and its memory has been freed, so recover from
  this by re-inserting the ifnet in the cloned interfaces
  list if ifc->ifc_destroy() indicates a failure.
2005-11-24 18:56:14 +00:00
Andre Oppermann
147f74d176 Purge layer specific mbuf flags on layer crossings to avoid confusing
upper or lower layers.

Sponsored by:	TCP/IP Optimization Fundraise 2005
2005-11-18 16:23:26 +00:00
Andrew Thompson
16e7e7d4bc Fix a second missed case where the refcount is not decremented.
MFC after:	3 days
2005-11-13 20:26:19 +00:00
Andrew Thompson
bb4b5f54a5 Fix a mbuf and refcnt leak in the broadcast code.
If the packet is rejected from pfil(9) then continue the loop rather than
returning, this means that we can still try to send it out the remaining
interfaces but more importantly the mbuf is freed and refcount decremented on
exit.
2005-11-13 19:36:59 +00:00
Ruslan Ermilov
4a0d6638b3 - Store pointer to the link-level address right in "struct ifnet"
rather than in ifindex_table[]; all (except one) accesses are
  through ifp anyway.  IF_LLADDR() works faster, and all (except
  one) ifaddr_byindex() users were converted to use ifp->if_addr.

- Stop storing a (pointer to) Ethernet address in "struct arpcom",
  and drop the IFP2ENADDR() macro; all users have been converted
  to use IF_LLADDR() instead.
2005-11-11 16:04:59 +00:00
Ruslan Ermilov
f0a2ef4889 Use the more appropriate ifnet_byindex() instead of ifaddr_byindex(). 2005-11-11 12:32:49 +00:00
Gleb Smirnoff
d314617e8a Force this interface to be RUNNING. 2005-11-11 11:17:57 +00:00
Ruslan Ermilov
d09ed26fd8 - Make IFP2ENADDR() a pointer to IF_LLADDR() rather than another
copy of Ethernet address.

- Change iso88025_ifattach() and fddi_ifattach() to accept MAC
  address as an argument, similar to ether_ifattach(), to make
  this work.
2005-11-11 07:36:14 +00:00
Ruslan Ermilov
303989a2f3 Use sparse initializers for "struct domain" and "struct protosw",
so they are easier to follow for the human being.
2005-11-09 13:29:16 +00:00
Andrew Thompson
4e7e0183e1 Move the cloned interface list management in to if_clone. For some drivers the
softc lists and associated mutex are now unused so these have been removed.

Calling if_clone_detach() will now destroy all the cloned interfaces for the
driver and in most cases is all thats needed to unload.

Idea by:	brooks
Reviewed by:	brooks
2005-11-08 20:08:34 +00:00
Gleb Smirnoff
6d3a3ab735 - Do not raise IFF_DRV_OACTIVE flag in vlan_start, because this
can lead to stalled interface
- Explain this fact in a comment.

Reviewed by:	rwatson, thompsa, yar
2005-11-06 19:43:04 +00:00
Andre Oppermann
34333b16cd Retire MT_HEADER mbuf type and change its users to use MT_DATA.
Having an additional MT_HEADER mbuf type is superfluous and redundant
as nothing depends on it.  It only adds a layer of confusion.  The
distinction between header mbuf's and data mbuf's is solely done
through the m->m_flags M_PKTHDR flag.

Non-native code is not changed in this commit.  For compatibility
MT_HEADER is mapped to MT_DATA.

Sponsored by:	TCP/IP Optimization Fundraise 2005
2005-11-02 13:46:32 +00:00
Andrew Thompson
1a2661371b If we have been called from ether_ifdetach() then do not try and clear the
promisc flag from the member interface, this is a no-op anyway since the
interface is disappearing. The driver may have already released
its resources such as miibus and this is likely to panic the kernel.

Submitted and tested by:	Wojciech A. Koszek
MFC after:			2 weeks
2005-10-23 22:30:07 +00:00
Christian S.J. Peron
57c1493b3a Before we export network interface data through the ifmibdata structure,
OR the flags bits with the driver managed status flags. This fixes an
issue where RUNNING flags would not be reported to processes, which
conflicts with the flags information provided by ifconfig(8).
2005-10-23 01:44:08 +00:00
Poul-Henning Kamp
2cccccddd4 Use new (inline) functions for calls into driver. 2005-10-16 20:44:18 +00:00
Andrew Thompson
4c84347939 Make four more functions static that were missed in the last commit. 2005-10-14 20:57:02 +00:00
Andrew Thompson
6b32f3d3f2 Change most of the bridge and stp funtions to static. This has highlighted
that the following funtions are not used, wrap in '#ifdef noused' for the
moment.

 bstp_enable_change_detection
 bstp_disable_change_detection
 bstp_set_bridge_priority
 bstp_set_port_priority
 bstp_set_path_cost
2005-10-14 10:38:12 +00:00
Andrew Thompson
fd6238a659 Further clean up the bridge hooks in if_ethersubr.c and ng_ether.c
- move the function pointer definitions to if_bridgevar.h
- move most of the logic to the new BRIDGE_INPUT and BRIDGE_OUTPUT macros
- remove unneeded functions from if_bridgevar.h and sort a little.
2005-10-14 02:38:47 +00:00
Andrew Thompson
20a65f37a0 From 101 ways to panic your kernel.
Use bridge_ifdetach() to notify the bridge that a member has been detached. The
bridge can then remove it from its interface list and not try to send out via a
dead pointer.
2005-10-13 23:05:55 +00:00
Julian Elischer
d0a2acd430 Consolidate two adjacent conditional blocks
I actually believe the code in question should be elsewhere (in the preceding
function).

MFC after:	1 week
2005-10-13 21:48:27 +00:00
Ruslan Ermilov
199474fd36 Remove a stale comment. 2005-10-13 17:26:14 +00:00
Andrew Thompson
9cff52f7f6 Clean up the if_bridge hooks a bit in if_ethersubr.c and ng_ether.c, move
the broadcast/multicast test to bridge_input().

Requested by:	glebius
2005-10-13 09:43:30 +00:00
Andrew Thompson
febd0759f3 Change the reference counting to count the number of cloned interfaces for each
cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks
2005-10-12 19:52:16 +00:00
Warner Losh
680d937a4b Be pedantic here: We're converting from network byte order to host
byte order in these cases.  This is a nop in terms of the generated
code, but is logically incorrect.

PR: 73852
2005-10-12 19:12:46 +00:00
Andrew Thompson
8eb8e358a0 Do not unconditionally set a spanning tree port to forwarding as the link may be
down when we attach. We wont get updated until a linkstate change happens.

Go via bstp_ifupdstatus() which checks the media status first.
2005-10-11 02:58:32 +00:00
Gleb Smirnoff
6512768b89 A deja vu of:
http://lists.freebsd.org/pipermail/cvs-src/2004-October/033496.html

The same problem applies to if_bridge(4), too.

- Copy-and-paste the if_bridge(4) related block from
  if_ethersubr.c to ng_ether.c
- Add XXXs, so that copy-and-paste would be noticed by
  any future editors of this code.
- Also add XXXs near if_bridge(4) declarations.

Silence from:	thompsa
2005-10-07 14:14:47 +00:00
Tai-hwa Liang
11e0838887 Fixing a boot time panic(when if_fwip is compiled into kernel) by renaming
module name to something that wouldn't conflict with
sys/dev/firewire/firewire.c.

Submitted by:	Cai, Quanqing <caiquanqing at gmail dot com>
PR:		kern/82727
MFC after:	3 days
2005-10-06 07:09:34 +00:00
Andrew Thompson
64465c6bd3 Fix KASSERT function name in ether_output, use __func__ while I am here. 2005-10-06 01:21:40 +00:00
Gleb Smirnoff
f0796cd26c - Don't pollute opt_global.h with DEVICE_POLLING and introduce
opt_device_polling.h
- Include opt_device_polling.h into appropriate files.
- Embrace with HAVE_KERNEL_OPTION_HEADERS the include in the files that
  can be compiled as loadable modules.

Reviewed by:	bde
2005-10-05 10:09:17 +00:00
Christian S.J. Peron
cb1d4f92ec Protect PID initializations for statistics by the bpf descriptor
locks. Also while we are here, protect the bpf descriptor during
knlist_remove{add} operations.

Discussed with:	rwatson
2005-10-04 15:06:10 +00:00