Commit Graph

1853 Commits

Author SHA1 Message Date
Gleb Smirnoff
93a69f5703 No direct call to carp_ifdetach() anymore. It is called by
event handler.

PR:		kern/82908
Submitted by:	Dan Lukes <dan obluda.cz>
2006-03-21 14:31:18 +00:00
Maksim Yevmenkin
a9e17e2e05 Add kqueue(2) support on if_tap(4) interfaces. While I'm here, replace
K&R style function declarations with ANSI style. Also fix endian bugs
accessing ioctl arguments that are passed by value.

PR:		kern/93897
Submitted by:	Vilmos Nebehaj < vili at huwico dot hu >
MFC after:	1 week
2006-03-16 18:22:01 +00:00
Andre Oppermann
e4bd8f103e Add link status descriptions and related structures for userland
applications.

Open[BGP|OSPF]D make use of this to determine the link status of
interfaces to make the right routing descisions.

Obtained from:	OpenBSD
MFC after:	3 days
2006-03-15 19:43:25 +00:00
Andre Oppermann
22cafcf0b8 - Fill in the correct rtm_index for RTM_ADD and RTM_CHANGE messages.
- Allow RTM_CHANGE to change a number of route flags as specified by
  RTF_FMASK.

- The unused rtm_use field in struct rt_msghdr is redesignated as
  rtm_fmask field to communicate route flag changes in RTM_CHANGE
  messages from userland.  The use count of a route was moved to
  rtm_rmx a long time ago.  For source code compatibility reasons
  a define of rtm_use to rtm_fmask is provided.

These changes faciliate running of multiple cooperating routing
daemons at the same time without causing undesired interference.
Open[BGP|OSPF]D make use of these features to have IGP routes
override EGP ones.

Obtained from:	OpenBSD (claudio@)
MFC after:	3 days
2006-03-15 19:39:09 +00:00
Ruslan Ermilov
ceec92fe5d Don't acquire a lock before calling vlan_unconfig().
This fixes a panic when doing "ifconfig ... -vlandev".

OK'ed by:	glebius
2006-03-09 14:42:51 +00:00
Andrew Thompson
e1457c3eb1 If we miss the LINK_UP event from the network interface then the bridge port
will remain in the disabled state until another link event happens in the
future (if at all). Add a timer to periodically check the interface state and
recover.

Reported by:	Nik Lam <freebsdnik j2d.lam.net.au>
MFC after:	3 days
2006-03-06 02:28:41 +00:00
Christian S.J. Peron
de572b371b Unbreak byte counters when network interfaces are in monitor mode by
re-organizing the monitor return logic. We perform interface monitoring
checks after we have determined if the CRC is still on the packet, if
it is, m_adj() is called which will adjust the packet length. This
ensures that we are not including CRC lengths in the byte counters for
each packet.

Discussed with:	andre, glebius
2006-03-03 17:21:08 +00:00
Andrew Thompson
158a726c96 Since we are using random ethernet addresses for the bridge, it is possible
that we might have address collisions, so make sure that this hardware address
isn't already in use on another bridge.

Submitted by:	csjp
MFC after:	1 month
2006-03-03 09:12:21 +00:00
Christian S.J. Peron
6f75ef188b Slightly re-worked bpf(4) code associated with bridging: if we have a
destination interface as a member of our bridge or this is a unicast packet,
push it through the bpf(4) machinery.

For broadcast or multicast packets, don't bother with the bpf(4) because it will
be re-injected into ether_input. We do this before we pass the packets through
the pfil(9) framework, as it is possible that pfil(9) will drop the packet or
possibly modify it, making it very difficult to debug firewall issues on the
bridge.

Further, implemented IFF_MONITOR for bridge interfaces. This does much the same
thing that it does for regular network interfaces: it pushes the packet to any
bpf(4) peers and then returns. This bypasses all of the bridge machinery,
saving mutex acquisitions, list traversals, and other operations performed by
the bridging code.

This change to the bridging code is useful in situations where individuals use a
bridge to multiplex RX/TX signals from two interfaces, as is required by some
network taps for de-multiplexing links and transmitting the RX/TX signals
out through two separate interfaces. This behaviour is quite common for network
taps monitoring links, especially for certain manufacturers.

Reviewed by:	thompsa
MFC after:	1 month
Sponsored by:	Seccuris Labs
2006-03-03 05:58:18 +00:00
Andrew Thompson
43dc0e8c41 Fix up the Bridge Identifier field in the BPDU packet.
- use the cu_bridge_id rather than the cu_rootid for the bridge address [1]
 - the memcmp return value is not signed so the wrong interface may have been
   selected
 - fix up the calculation of sc_bridge_id

PR:		kern/93909 [1]
MFC after:	3 days
2006-02-28 00:13:24 +00:00
Wojciech A. Koszek
51b4ccb464 This patch fixes a problem, which exists if you have IPSEC in your kernel
and want to have crypto support loaded as KLD. By moving zlib to separate
module and adding MODULE_DEPEND directives, it is possible to use such
configuration without complication. Otherwise, since IPSEC is linked with
zlib (just like crypto.ko) you'll get following error:

	interface zlib.1 already present in the KLD 'kernel'!

Approved by:	cognet (mentor)
2006-02-27 16:56:22 +00:00
Yaroslav Tykhiy
33499e2ae5 Don't to forget to unlock the rwlock on trunk before destroying it.
This should fix panic on "kldunload if_vlan" while vlanX are still there.

Reviewed by:	glebius
2006-02-24 17:25:16 +00:00
Gleb Smirnoff
a7c959fe18 Fix build. 2006-02-15 08:25:40 +00:00
Gleb Smirnoff
efd19b8fd0 - Introduce ifmedia_baudrate(), which returns correct baudrate of the
given media status. [1]
- Utilize ifmedia_baudrate() in miibus_statchg() to update ifp->if_baudrate.

Obtained from:	NetBSD [1]
2006-02-14 12:10:03 +00:00
Ed Maste
11edc47706 Bump the MODULE_VERSION for HEAD, as the vlan(4) API is different in
RELENG_6, and would require a lower version number.

Requested by:	glebius
Approved by:	rwatson (mentor)
2006-02-10 18:38:33 +00:00
Yaroslav Tykhiy
802dadcfeb Avoid frobbing IFF_UP at any cost (which is close to
zero in this case.)  A kernel driver has IFF_DRV_RUNNING
at its full disposal while IFF_UP may be toggled only by
humans or their daemonic deputies from the userland.

MFC after:	3 days
2006-02-10 11:01:10 +00:00
Ed Maste
7f8b993473 Add a MODULE_VERSION so that other modules (perhaps third-party) can
depend on this one.

Approved by:	rwatson (mentor)
2006-02-09 22:11:58 +00:00
Qing Li
6b7b44acd9 The code in rn_walktree_from() that checks if we backed up too far
did not stop at the right node. Change the backtracking check from
smaller-than to smaller-or-equal to prevent this from happening.
While here fix one additional problem where the insertion of the
default route traversed the entire tree.

PR:		kern/38752
Submitted by:	qingli (before I became committer)
Reviewed by:	andre
MFC after:	3 days
2006-02-07 20:25:39 +00:00
Qing Li
d03e5467a4 Remove two unnecessary type casts, of which both had a typo in
it anyways.

Approved by: andre
MFC after: 3 days
2006-02-07 20:09:02 +00:00
Oleg Bulyzhin
3ecf1851df Properly initialize args structure before passing it to ipfw_chk(): having
uninitialized args.inp is unhealthy for uid/gid/jail ipfw rules.

PR:		kern/92589
Approved by:	glebius (mentor)
MFC after:	1 week
2006-02-03 23:03:07 +00:00
Gleb Smirnoff
05a2398f32 In vlan_config() first call vlan_inithash(), then lock mutex, because
vlan_inithash() calls malloc(M_WAITOK).
2006-02-02 22:11:38 +00:00
Christian S.J. Peron
fa918e1ef7 define lock.h before rwlock.h for DEBUG_LOCKS 2006-02-02 20:33:10 +00:00
Paul Saab
19cf04981a Implement SIOCGIFCONF for 32bit binaries. 2006-02-02 19:58:37 +00:00
Christian S.J. Peron
f5cdbcf14c Use PFIL_HOOKED macros in if_bridge and pass the right argument to
rw_assert. This un-breaks the build.

Submitted by:	Kostik Belousov
Pointy hat to:	csjp
2006-02-02 16:41:20 +00:00
Christian S.J. Peron
604afec496 Somewhat re-factor the read/write locking mechanism associated with the packet
filtering mechanisms to use the new rwlock(9) locking API:

- Drop the variables stored in the phil_head structure which were specific to
  conditions and the home rolled read/write locking mechanism.
- Drop some includes which were used for condition variables
- Drop the inline functions, and convert them to macros. Also, move these
  macros into pfil.h
- Move pfil list locking macros intp phil.h as well
- Rename ph_busy_count to ph_nhooks. This variable will represent the number
  of IN/OUT hooks registered with the pfil head structure
- Define PFIL_HOOKED macro which evaluates to true if there are any
  hooks to be ran by pfil_run_hooks
- In the IP/IP6 stacks, change the ph_busy_count comparison to use the new
  PFIL_HOOKED macro.
- Drop optimization in pfil_run_hooks which checks to see if there are any
  hooks to be ran, and returns if not. This check is already performed by the
  IP stacks when they call:

        if (!PFIL_HOOKED(ph))
                goto skip_hooks;

- Drop in assertion which makes sure that the number of hooks never drops
  below 0 for good measure. This in theory should never happen, and if it
  does than there are problems somewhere
- Drop special logic around PFIL_WAITOK because rw_wlock(9) does not sleep
- Drop variables which support home rolled read/write locking mechanism from
  the IPFW firewall chain structure.
- Swap out the read/write firewall chain lock internal to use the rwlock(9)
  API instead of our home rolled version
- Convert the inlined functions to macros

Reviewed by:	mlaier, andre, glebius
Thanks to:	jhb for the new locking API
2006-02-02 03:13:16 +00:00
Andrew Thompson
6637e0f390 Fix two bugs with the bridge
- code expects memcmp() to return a signed value, our memcmp() returns 0 if
   args are equal and > 0 if not.

 - It's possible to hijack interface for static entry. If bridge recieves
   packet from interface marked as learning it will replace the bridge_rtnode
   entry for the source address even if such entry marked as static.

Submitted by:	Gleb Kurtsov <k-gleb yandex.ru>
MFC after:	3 days
2006-01-31 21:21:28 +00:00
Yaroslav Tykhiy
64a17d2e86 Set IFF_BROADCAST and IFF_MULTICAST on vlan interfaces from the
beginning and simply refuse to attach to a parent without either
flag.

Our network stack cannot handle well IFF_BROADCAST or IFF_MULTICAST
on an interface changing on the fly.  E.g., IP will or won't assign
a broadcast address to an interface and join the all-hosts multicast
group on it depending on its IFF_BROADCAST and IFF_MULTICAST settings.
Should the flags alter later, IP will miss the change and keep using
bogus settings.  This can lead to evil things like supplying an
invalid broadcast address or trying to leave a multicast group that
hasn't been joined.  So just avoid touching the flags since an
interface was created.  This has no practical purpose.

Discussed with:	-net, glebius, oleg
MFC after:	1 week
2006-01-31 16:41:05 +00:00
Gleb Smirnoff
75ee267c22 Merge the //depot/user/yar/vlan branch into CVS. It contains some collective
work by yar, thompsa and myself. The checksum offloading part also involves
work done by Mihail Balikov.

The most important changes:

o   Instead of global linked list of all vlan softc use a per-trunk
  hash. The size of hash is dynamically adjusted, depending on
  number of entries. This changes struct ifnet, replacing counter
  of vlans with a pointer to trunk structure. This change is an
  improvement for setups with big number of VLANs, several interfaces
  and several CPUs. It is a small regression for a setup with a single
  VLAN interface.
    An alternative to dynamic hash is a per-trunk static array with
  4096 entries, which is a compile time option - VLAN_ARRAY. In my
  experiments the array is not an improvement, probably because such
  a big trunk structure doesn't fit into CPU cache.
o   Introduce an UMA zone for VLAN tags. Since drivers depend on it,
  the zone is declared in kern_mbuf.c, not in optional vlan(4) driver.
  This change is a big improvement for any setup utilizing vlan(4).
o   Use rwlock(9) instead of mutex(9) for locking. We are the first
  ones to do this! :)
o   Some drivers can do hardware VLAN tagging + hardware checksum
  offloading. Add an infrastructure for this. Whenever vlan(4) is
  attached to a parent or parent configuration is changed, the flags
  on vlan(4) interface are updated.

In collaboration with:	yar, thompsa
In collaboration with:	Mihail Balikov <mihail.balikov interbgc.com>
2006-01-30 13:45:15 +00:00
Gleb Smirnoff
25af0bb50e Add some initial locking to gif(4). It doesn't covers the whole driver,
however IPv4-in-IPv4 tunnels are now stable on SMP. Details:

- Add per-softc mutex.
- Hold the mutex on output.

The main problem was the rtentry, placed in softc. It could be
freed by ip_output(). Meanwhile, another thread being in
in_gif_output() can read and write this rtentry.

Reported by:	many
Tested by:	Alexander Shiryaev <aixp mail.ru>
2006-01-30 08:39:09 +00:00
Colin Percival
02d4ab93fb Make sure buffers in if_bridge are fully initialized before copying
them to userland.

Security:	FreeBSD-SA-06:06.kmem
2006-01-25 10:00:40 +00:00
Yaroslav Tykhiy
83ec464f61 Be consistent in checking ifa->ifa_addr for NULL.
Found by:	Coverity Prevent (tm)
MFC after:	3 days
2006-01-23 10:30:34 +00:00
Bjoern A. Zeeb
3f2e28fe9f Fix stack corruptions on amd64.
Vararg functions have a different calling convention than regular
functions on amd64. Casting a varag function to a regular one to
match the function pointer declaration will hide the varargs from
the caller and we will end up with an incorrectly setup stack.

Entirely remove the varargs from these functions and change the
functions to match the declaration of the function pointers.
Remove the now unnecessary casts.

Lots of explanations and help from:     peter
Reviewed by:                            peter
PR:                                     amd64/89261
MFC after:                              6 days
2006-01-21 10:44:34 +00:00
Andre Oppermann
5d691e6da8 Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer
may have changed by m_pullup() during fastforward processing.

While this is a bug it is actually never triggered in real world
situations and it is not remotely exploitable.

Found by:	Coverity Prevent(tm)
Coverity ID:	CID780
Sponsored by:	TCP/IP Optimization Fundraise 2005
2006-01-18 14:24:39 +00:00
Andrew Thompson
7c2fb83a0b Add code that clears certain capabilities from the member interface, these are
restored when its removed from the bridge.

At the moment we only clear IFCAP_TXCSUM. Since a locally generated packet on
the bridge may be sent out any one or more interfaces it cant be assumed that
every card does hardware csums. Most bridges don't generate a lot of traffic
themselves so turning off offloading won't hurt, bridged packets are
unaffected.

Tested by:	Bruce Walker (bmw borderware.com)
MFC after:	5 days
2006-01-14 03:51:31 +00:00
Robert Watson
3208581a15 Check the right ifnet pointer to see if if_alloc() failed or not in
ef_clone(); we were testing the original ifnet, not the one allocated.

When aborting ef_clone() due to if_alloc() failing, free the allocated
efnet structure rather than leaking it.

Noticed by:	Coverity Prevent analysis tool
MFC after:	3 days
2006-01-13 23:24:09 +00:00
Robert Watson
ae7c484e82 When freeing the chain of if_ef devices on an aborted load, use
SLIST_FOREACH_SAFE() rather than SLIST_FOREACH(), as elements are
freed on each iteration of the loop.  This prevents use-after-free.

Noticed by:	Coverity Prevent analysis tool
MFC after:	3 days
2006-01-13 23:20:46 +00:00
Brooks Davis
118b438d73 Get rid of the bogus IFP2FC() macro and use IFP2FWC(). IFP2FC()
attempted to cast a struct ifnet to a struct fw_com which resulted in
data corruption.

PR:		kern/91307
Submitted by:	Alex Semenyaka <alex at semenyaka do ru>
MFC After:	6 days
2006-01-11 05:37:21 +00:00
Hartmut Brandt
154508976b Add a new leaf to the net.link.generic.ifdata.%d sysctl to retrieve
the name and unit number assigned by the driver. This is needed by
SNMP to find interfaces after they have been renamed.

MFC after:	4 weeks
2006-01-04 12:57:09 +00:00
Jung-uk Kim
142f81c25d Correctly check the filter length. I committed the wrong version.
Pointy hat to me.
2006-01-03 20:34:41 +00:00
Jung-uk Kim
dccb7faff6 - Explicitly validate an empty filter to match bpf_filter() comment[1].
- Do not use BPF JIT compiler for an empty filter.

[1] Pointed out by:	darrenr
2006-01-03 20:26:03 +00:00
Andrew Thompson
f0feaf4f19 Fix a brain-o in the last commit, the conditional was always false. 2006-01-02 23:02:43 +00:00
Andrew Thompson
94e45ae5e8 Reorganise bridge_rtupdate slightly to reduce duplication. 2006-01-02 22:44:54 +00:00
Andrew Thompson
ef9ac7c49a Reset the route expiry time on each update rather than always letting them get
GC'd and recreated.
2006-01-02 22:29:41 +00:00
Andrew Thompson
bc9f74c7cb It is better to use time_uptime here since it is monotonic.
Pointed out by:	glebius
2006-01-02 22:23:03 +00:00
Andrew Thompson
ec311647fb Minor whitespace cleanup. 2006-01-02 09:50:34 +00:00
Andrew Thompson
f595d62759 Read time_second directly rather than calling getmicrotime().
Obtained from:	DragonflyBSD
2006-01-02 09:36:53 +00:00
Andrew Thompson
a47f91cdc4 When pfil(9) is enabled the bridge only considers ETHERTYPE_ARP, ETHERTYPE_IP and
ETHERTYPE_IPV6 frames. Change this to be a sysctl knob so that is able to still
bridge non-IP packets if desired.

Also return early if all pfil_* sysctls are turned off, the user obviously does
not want to filter on the bridge.
2005-12-29 09:39:15 +00:00
Sam Leffler
a8af2cc7ce add a sysctl to turn debug msgs on/off when built with IFMEDIA_DEBUG 2005-12-25 23:28:23 +00:00
Oleg Bulyzhin
c54c76cc2f 1) remove useless check of loop_copy - corresponding code was removed in
rev. 1.70 five years ago.
2) convert loop_copy to "non-negative" flag

Approved by:	glebius (mentor)
MFC after:	2 weeks
2005-12-22 12:16:20 +00:00
Andrew Thompson
73ff045c57 Add RFC 3378 EtherIP support. This change makes it possible to add gif
interfaces to bridges, which will then send and receive IP protocol 97 packets.
Packets are Ethernet frames with an EtherIP header prepended.

Obtained from:	NetBSD
MFC after:	2 weeks
2005-12-21 21:29:45 +00:00