Commit Graph

7724 Commits

Author SHA1 Message Date
Hiroki Sato
b021de9cd7 Add -x waittime and -X timeout options for feature parity. These are
equivalent to -W and -t options of ping(8).  Different letters are used
because both have already been used for another purposes in ping6(8).
2014-10-17 09:33:09 +00:00
Alexander V. Chernikov
6ca0dd05f4 Show error when deleting non-existing rule number.
Found by:	Oleg Ginzburg
2014-10-13 12:49:04 +00:00
Alexander V. Chernikov
60f485ca9f * Fix zeroing individual entries via ipfw(8).
* Report error and return non-zero exit code if zeroing non-matched entries

Found by:	Oleg Ginzburg
2014-10-13 11:26:17 +00:00
Edward Tomasz Napierala
d32789d95c Mark iscontrol(8) and iscsi_initiator(4) obsolete.
Differential Revision:	https://reviews.freebsd.org/D931
Reviewed by:	wblock@
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2014-10-11 05:18:22 +00:00
Alexander V. Chernikov
9fe15d0612 Partially fix build on !amd64
Pointed by:	bz
2014-10-10 17:24:56 +00:00
Hiroki Sato
1482f98247 Do not add late flag when file= is specified because it has a bad
side-effect.  The specified file should exist before the fstab line.

Reported by:	wblock (long time ago)
MFC after:	1 day
2014-10-10 03:20:12 +00:00
Alexander V. Chernikov
779b53d008 Sync to HEAD@r272825. 2014-10-09 15:35:28 +00:00
Alexander V. Chernikov
68bde59ebe * Fix use-after-free in table printing code.
* Fix showing human-readable error in table cmds code.
2014-10-09 12:54:56 +00:00
Andrey V. Elsukov
a62c8c6a99 Revert r156046. We support setting dumpdev via loader tunable again.
Also change default disk name to ada.

MFC after:	3 weeks
2014-10-08 12:19:48 +00:00
Alexander V. Chernikov
a5fedf11fc Sync to HEAD@r272609. 2014-10-06 11:29:50 +00:00
Alexander V. Chernikov
9bb47e7068 Improve "reserved keywords" hack:
we can't easily predict (in current parsing model)
if the keyword is ipfw(8) reserved keyword or port name.
Checking proto database via getprotobyname() consumes a lot of
CPU and leads to tens of seconds for parsing large ruleset.
Use list of reserved keywords and check them as pre-requisite
before doing getprotobyname().

Obtained from:	Yandex LLC
2014-10-06 11:00:47 +00:00
Alexander V. Chernikov
4deb9c9287 Fix tracked interface list retrieval. 2014-10-05 10:20:47 +00:00
Hiroki Sato
7eb756fab1 Use printb() for boolean flags in ro_opts and actor_state for LACP. 2014-10-05 02:37:01 +00:00
Alexander V. Chernikov
d91c61c364 Fix GCC wardnings. 2014-10-04 17:21:30 +00:00
Alexander V. Chernikov
1ce4b35740 Sync to HEAD@r272516. 2014-10-04 12:42:37 +00:00
Alexander V. Chernikov
5371ab1408 Document new table values.
Sponsored by:	Yandex LLC
2014-10-03 15:36:58 +00:00
Hiroki Sato
4f7bf7a846 Revert r272390.
Pointed out by:	glebius
2014-10-02 20:17:16 +00:00
Hiroki Sato
9732189ca9 Separate option handling from SIOC[SG]LAGG to SIOC[SG]LAGGOPTS for
backward compatibility with old ifconfig(8).
2014-10-02 20:01:13 +00:00
Hiroki Sato
394c813d06 Add IFCAP_HWSTATS. 2014-10-02 00:19:24 +00:00
Hiroki Sato
939a050ad9 Virtualize lagg(4) cloner. This change fixes a panic when tearing down
if_lagg(4) interfaces which were cloned in a vnet jail.

Sysctl nodes which are dynamically generated for each cloned interface
(net.link.lagg.N.*) have been removed, and use_flowid and flowid_shift
ifconfig(8) parameters have been added instead.  Flags and per-interface
statistics counters are displayed in "ifconfig -v".

CR:	D842
2014-10-01 21:37:32 +00:00
Yoshihiro Takahashi
3754eb026e Merged from r183296.
Add missing library dependencies.
2014-09-28 08:23:26 +00:00
Xin LI
e267e00eef Refactor the code a little bit to reduce duplicated code.
Reviewed by:	mjg
MFC after:	2 weeks
2014-09-26 05:05:34 +00:00
Xin LI
4b8740cd0a Explicitly set errno to 0 before calling strto*.
Suggested by:	mjg
MFC after:	2 weeks
2014-09-25 22:47:19 +00:00
Xin LI
9e4ed37219 The strtol(3) family of functions would set errno when it hits one.
Check errno and handle it as invalid input.

Obtained from:	HardenedBSD
Submitted by:	David CARLIER <devnexen@gmail.com>
MFC after:	2 weeks
2014-09-25 22:37:27 +00:00
Xin LI
c58f8df6e7 Constify a parameter of name2oid. No functional change.
MFC after:	2 months
2014-09-23 22:15:00 +00:00
Hiroki Sato
ebb03f0b57 Fix a typo. 2014-09-21 05:03:04 +00:00
Hiroki Sato
b9f70ced25 Fix a bug which could make routed(8) daemon exit by sending a special RIP
query from a remote machine, and disable accepting it by default.  This
requests a routed(8) daemon to dump routing information base for debugging
purpose.  An -i flag to enable it has been added.
2014-09-21 04:00:28 +00:00
Hiroki Sato
0ecaa7ed05 Fix a problem that reply packets are not received when -i T option is set
and (T < RTT).

- Use select(2) for timeout instead of interval timer. Remove poll(2) support.
- Use sigaction(2) instead of signal(3).
- Exit in SIGINT handler when two signals are received and doing reverse DNS
  lookup as ping(8) does.
- Remove redundant variables used for getaddrinfo(3).

PR:	151023
2014-09-20 19:54:19 +00:00
Hiroki Sato
58da716138 Revert changes in r269180. It could cause -c N option to enter an
infinite loop if no reply packet is received.

PR:	151023
2014-09-20 18:48:50 +00:00
Marcelo Araujo
44a9271b49 The lagg(4) interface is based on trunk(4) interface from OpenBSD.
The FreeBSD is the only system that has the FEC protocol, that is a simple alias
to loadbalance protocol and does not implement the ancient Cisco FEC standard.

From now on, we remove the fec protocol from the documentation and keep the FEC
code only for compatibility.

Phabric:	D539
Reviewed by:	glebius, thompsa
Approved by:	glebius
Sponsored by:	QNAP Systems Inc.
2014-09-18 02:22:02 +00:00
Marcelo Araujo
99cdd96163 Add laggproto broadcast, it allows sends frames to all ports of the lagg(4) group
and receives frames on any port of the lagg(4).

Phabric:	D549
Reviewed by:	glebius, thompsa
Approved by:	glebius
Obtained from:	OpenBSD
Sponsored by:	QNAP Systems Inc.
2014-09-18 02:12:48 +00:00
Bryan Drewery
5e93a4b46b If fgets(3) fails in getbounds(), show strerror(3) if not an EOF. Also fix
a FILE* leak in getbounds().

Submitted by:	Conrad Meyer <conrad.meyer@isilon.com>
PR:		192032
Sponsored by:	EMC / Isilon Storage Division
MFC after:	1 week
2014-09-17 19:09:58 +00:00
Bryan Venteicher
759e01ce9a Add DEF_CLONE_CMD_ARG2
This will be used in the forthcoming vxlan import.

Reviewed by:	gnn
Phabric:	https://reviews.freebsd.org/D382
2014-09-14 22:10:35 +00:00
Alexander Motin
959ec2581b Update CAM CCB accounting for the new status quo.
devq_openings counter lost its meaning after allocation queues has gone.
held counter is still meaningful, but problematic to update due to separate
locking of CCB allocation and queuing.

To fix that replace devq_openings counter with allocated counter.  held is
now calculated on request as difference between number of allocated, queued
and active CCBs.

MFC after:	1 month
2014-09-14 11:59:49 +00:00
Alexander V. Chernikov
b2100781b8 Do not try to read i2c info when no transceiver is present.
MFC with:	r270064
Sponsored by:	Yandex LLC
2014-09-13 16:04:55 +00:00
John Baldwin
7d8312cc92 Add a sysctl to export the EFI memory map along with a handler in the
sysctl(8) binary to format it.

Reviewed by:	emaste
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D771
2014-09-13 03:10:02 +00:00
John Baldwin
59101c5d95 Pass the length of an structure to the pretty-printer backends as a
size_t instead of an int.
2014-09-12 21:01:39 +00:00
Gleb Smirnoff
b249f3c575 Since r270929 raw sockets expect network byte order.
Submitted by:	avg
2014-09-11 05:48:39 +00:00
Hiroki Sato
adbc0311a3 Fix a bug which could break extended attributes in a dump output.
This occurred when a file was >892kB long and had a large data (>1kB)
in the extended attributes.

Reported by:	Masashi Toriumi
Reviewed by:	mckusick
2014-09-10 22:37:20 +00:00
Andrey V. Elsukov
5dbfa43f65 Add the ability to set `prefer_source' flag to an IPv6 address.
It affects the IPv6 source address selection algorithm (RFC 6724)
and allows override the last rule ("longest matching prefix") for
choosing among equivalent addresses. The address with `prefer_source'
will be preferred source address.

Obtained from:	Yandex LLC
MFC after:	1 month
Sponsored by:	Yandex LLC
2014-09-09 10:52:50 +00:00
Alexander V. Chernikov
d6164b77f8 Make ipfw_nat module use IP_FW3 codes.
Kernel changes:
* Split kernel/userland nat structures eliminating IPFW_INTERNAL hack.
* Add IP_FW_NAT44_* codes resemblin old ones.
* Assume that instances can be named (no kernel support currently).
* Use both UH+WLOCK locks for all configuration changes.
* Provide full ABI support for old sockopts.

Userland changes:
* Use IP_FW_NAT44_* codes for nat operations.
* Remove undocumented ability to show ranges of nat "log" entries.
2014-09-07 18:30:29 +00:00
Alexander V. Chernikov
1a33e79969 Change copyrights to the proper one. 2014-09-05 14:19:02 +00:00
Alexander V. Chernikov
7779879625 Return setsockopt() directly.
Suggested by:	Steven Hartland  at killing@multiplay.co.uk.
2014-09-05 13:56:05 +00:00
Alexander V. Chernikov
c9daea0b86 Sync to HEAD@r271160. 2014-09-05 13:52:39 +00:00
Alexander V. Chernikov
b646288126 Use per-function errno handling instead of global one.
Requested by:	luigi
2014-09-05 11:48:32 +00:00
Alexander V. Chernikov
5c02a66b2b * Unconditionally turn on SIOCGI2C probing for all interfaces
on "ifconfig -v". I've seen no measurable timing difference
    for doing additional SIOCGI2C call for system with 4k vlans.
* Determine appropriate handler (SFP/QSFP) by reading identification
    byte (which is the same for both SFF-8472 and SFF-8436) instead
   of checking driver name.

MFC with:	r270064
Sponsored by:	Yandex LLC
2014-09-03 11:07:49 +00:00
Ed Schouten
974a10854c Add lock annotations to the threading API used by hastd.
Approved by:	pjd@
2014-09-01 18:37:17 +00:00
Stefan Eßer
320098549a Add references to vt(4) to further man-pages.
MFC after:	3 days
2014-09-01 16:25:08 +00:00
Alexander V. Chernikov
0cba2b2802 Add support for multi-field values inside ipfw tables.
This is the last major change in given branch.

Kernel changes:
* Use 64-bytes structures to hold multi-value variables.
* Use shared array to hold values from all tables (assume
  each table algo is capable of holding 32-byte variables).
* Add some placeholders to support per-table value arrays in future.
* Use simple eventhandler-style API to ease the process of adding new
  table items. Currently table addition may required multiple UH drops/
  acquires which is quite tricky due to atomic table modificatio/swap
  support, shared array resize, etc. Deal with it by calling special
  notifier capable of rolling back state before actually performing
  swap/resize operations. Original operation then restarts itself after
  acquiring UH lock.
* Bump all objhash users default values to at least 64
* Fix custom hashing inside objhash.

Userland changes:
* Add support for dumping shared value array via "vlist" internal cmd.
* Some small print/fill_flags dixes to support u32 values.
* valtype is now bitmask of
  <skipto|pipe|fib|nat|dscp|tag|divert|netgraph|limit|ipv4|ipv6>.
  New values can hold distinct values for each of this types.
* Provide special "legacy" type which assumes all values are the same.
* More helpers/docs following..

Some examples:

3:41 [1] zfscurr0# ipfw table mimimi create valtype skipto,limit,ipv4,ipv6
3:41 [1] zfscurr0# ipfw table mimimi info
+++ table(mimimi), set(0) +++
 kindex: 2, type: addr
 references: 0, valtype: skipto,limit,ipv4,ipv6
 algorithm: addr:radix
 items: 0, size: 296
3:42 [1] zfscurr0# ipfw table mimimi add 10.0.0.5 3000,10,10.0.0.1,2a02:978:2::1
added: 10.0.0.5/32 3000,10,10.0.0.1,2a02:978:2::1
3:42 [1] zfscurr0# ipfw table mimimi list
+++ table(mimimi), set(0) +++
10.0.0.5/32 3000,0,10.0.0.1,2a02:978:2::1
2014-08-31 23:51:09 +00:00
Gavin Atkinson
91804910e2 Fix character case in examples for "camcontrol security" - should be
"-U user" not "-u user".

PR:		193179
Submitted by:	milios ccsys com
MFC after:	3 days
2014-08-31 10:28:31 +00:00
John Baldwin
89871cdeb6 - Add a new structure type for the ACPI 3.0 SMAP entry that includes the
optional attributes field.
- Add a 'machdep.smap' sysctl that exports the SMAP table of the running
  system as an array of the ACPI 3.0 structure.  (On older systems, the
  attributes are given a value of zero.)  Note that the sysctl only
  exports the SMAP table if it is available via the metadata passed from
  the loader to the kernel.  If an SMAP is not available, an empty array
  is returned.
- Add a format handler for the ACPI 3.0 SMAP structure to the sysctl(8)
  binary to format the SMAP structures in a readable format similar to
  the format found in boot messages.

MFC after:	2 weeks
2014-08-29 21:25:47 +00:00
Alexander V. Chernikov
ea463f2dc0 * Add SIOCGI2C driver ioctl used to retrieve i2c info.
* Convert ixgbe to use this ioctl
* Convert ifconfig to use generic i2c handler for  "ix" interfaces.

Approved by:	Eric Joyner (ixgbe part)
MFC after:	2 weeks
Sponsored by:	Yandex LLC
2014-08-29 18:02:58 +00:00
John Baldwin
3419bf0107 Correct the destroy example. The -n argument is not needed (and is not
valid).

Reported by:	mwlucas
Reviewed by:	phk
MFC after:	1 week
2014-08-27 17:44:59 +00:00
Enji Cooper
acc1741c58 Garbage collect libl dependency
The application links and runs without libl

Approved by: rpaulo (mentor)
Phabric: D673
X-MFC with: r270117
Submitted by: trociny
2014-08-23 20:45:00 +00:00
Alexander V. Chernikov
e86bb35d63 Whitespace/style changes merged from projects/ipfw. 2014-08-23 17:57:06 +00:00
Alexander V. Chernikov
912430f6f0 Merge buffer-printing changes from from projects/ipfw as preparation
for branch merge.

Requested by:	luigi
2014-08-23 17:37:18 +00:00
Alexander V. Chernikov
832fd78087 Sync to HEAD@r270409. 2014-08-23 14:58:31 +00:00
Neel Natu
f518456fdb Change file permissions for some setuid executables so they are "o+r".
The executable itself doesn't contain any privileged information.

An example of where this is useful is when makefs(8) is creating an image
that includes /sbin/shutdown. This can now be done without root privileges.

Reviewed by:	delphij
Discussed with:	delphij, des
CR:		https://reviews.freebsd.org/D662
2014-08-21 19:04:15 +00:00
Alexander V. Chernikov
c59adfc6a5 * Add new net/sff8436.h containing constants used to access
QSFP+ data via i2c inteface. These constants has been taken
  from SFF-8436 "QSFP+ 10 Gbs 4X PLUGGABLE TRANSCEIVER" standard
  rev 4.8.
* Add support for printing QSFP+ information from 40G NICs
  such as Chelsio T5.

This commit does not contain ioctl changes necessary for this
functionality work, there will be another commit soon.

Example:
cxl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=ec07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,.....>
        ether 00:07:43:28:ad:08
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
        media: Ethernet 40Gbase-LR4 <full-duplex>
        status: active
        plugged: QSFP+ 40GBASE-LR4 (MPO Parallel Optic)
        vendor: OEM PN: OP-QSFP-40G-LR4 SN: 20140318001 DATE: 2014-03-18
        module temperature: 64.06 C voltage: 3.26 Volts
        lane 1: RX: 0.47 mW (-3.21 dBm) TX: 2.78 mW (4.46 dBm)
        lane 2: RX: 0.20 mW (-6.94 dBm) TX: 2.80 mW (4.47 dBm)
        lane 3: RX: 0.18 mW (-7.38 dBm) TX: 2.79 mW (4.47 dBm)
        lane 4: RX: 0.90 mW (-0.45 dBm) TX: 2.80 mW (4.48 dBm)

Tested on:	Chelsio T5
Tested on:	Mellanox/Huawei passive/active cables/transceivers.
MFC after:	2 weeks
Sponsored by:	Yandex LLC
2014-08-21 17:54:42 +00:00
Alan Somers
81ade99c2c Misc fixes suggested by Coverity.
sbin/devd/tests/client_test.c
	* In the event that popen fails, don't dereference its return value.
	* Fix array overwrite in the stream and seqpacket tests.
	* Close sockets at the end of successful ATF tests.

Reported by:	Coverity scan
CID:		1232019, 1232020, 1232029, 1232030
MFC after:	1 week
Sponsored by:	Spectra Logic
2014-08-20 17:04:49 +00:00
Edward Tomasz Napierala
543bed9345 Add description for the "automounted" mount flag.
Reviewed by:	emaste@
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
2014-08-20 13:52:47 +00:00
Bryan Drewery
5608fd23c2 Revert r267233 for now. PIE support needs to be reworked.
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
   build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
   where it never would work anyhow, such as csu or loader. This suggests
   there may be better ways of adding support to the tree. Many of these
   cases can be fixed such that -fPIE will work but there is really no
   reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
   really building libraries but have been using bsd.prog.mk because the code
   is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
   been needed.

We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.

Reported by:	kib
2014-08-19 15:04:32 +00:00
Alexander V. Chernikov
7d6fa255bf Zero buffer before request. 2014-08-18 08:07:50 +00:00
Enji Cooper
ac8edda605 Add LIBUTIL to DPADD
This will fix "make checkdpadd"

MFC after: 5 days
PR: 192759
Approved by: rpaulo (mentor)
2014-08-18 01:21:41 +00:00
Enji Cooper
32529978a7 Add -ll to LDADD to fix "make checkdpadd"
Phabric: D622
MFC after: 2 weeks
Approved by: rpaulo (mentor)
2014-08-18 00:50:09 +00:00
Alexander V. Chernikov
3e0aeae44a Add forgotten DPADD to ifconfig(8).
PR:		192760
Submitted by:	yaneurabeya at gmail.com
MFC after:	2 weeks
2014-08-17 20:06:47 +00:00
Neel Natu
06224a9492 Remove LOG_ODELAY because it does nothing.
Reviewed by:	jilles
CR:		https://reviews.freebsd.org/D611
2014-08-17 19:06:26 +00:00
Edward Tomasz Napierala
3914ddf8a7 Bring in the new automounter, similar to what's provided in most other
UNIX systems, eg. MacOS X and Solaris.  It uses Sun-compatible map format,
has proper kernel support, and LDAP integration.

There are still a few outstanding problems; they will be fixed shortly.

Reviewed by:	allanjude@, emaste@, kib@, wblock@ (earlier versions)
Phabric:	D523
MFC after:	2 weeks
Relnotes:	yes
Sponsored by:	The FreeBSD Foundation
2014-08-17 09:44:42 +00:00
Alexander V. Chernikov
46c9382ca3 Clean up unused definitions. 2014-08-16 22:55:58 +00:00
Alexander V. Chernikov
f88c97416e * Use standard net/sff8472.h header for sff bits and offsets.
* Convert sff_8472_id to 'const char *' to please clang.

Pointed by:	np
2014-08-16 21:53:44 +00:00
Alexander V. Chernikov
f732123e6b Add support for reading i2c SFP/SFP+ data from NIC driver and
presenting most interesting fields via ifconfig -v.
This version supports Intel ixgbe driver only.

Tested on:	Cisco,Intel,Mellanox,ModuleTech,Molex transceivers
MFC after:	2 weeks
2014-08-16 19:13:52 +00:00
Peter Wemm
1b31334c64 Use mount protocol version 3 by default for showmount and umount.
mount_nfs effectively uses mount protocol v3 by default already.
v1 mount protocol is being removed along with nfsv2 by a high profile NFS
appliance vendor and our legacy v1 mount protocol usage causes rpc errors.
2014-08-16 14:56:11 +00:00
Enji Cooper
51483c42ed Fix atmconfig compilation when MK_ATM == yes and MK_BSNMP == no
Makefile.inc1:
Always compile gensnmptree with bootstrap-tools when MK_BSNMP != no
instead of depending on a potentially stale tool installed on the build host

sbin/atm/atmconfig/Makefile:
- Always remove oid.h to avoid cluttering up the build/src tree.
- Consolidate all of the RESCUE/MK_BSNMP != no logic under one
conditional to improve readability
- Remove unnecessary ${.OBJDIR} prefixing for oid.h and use ${.TARGET} instead
  of spelling out oid.h
- Add a missing DPADD for ${LIBCRYPTO} when compiled MK_BSNMP == yes and
  MK_OPENSSL == yes and not compiling for /rescue/rescue

sbin/atm/atmconfig/main.c:
Change #ifndef RESCUE to #ifdef WITH_BSNMP in main.c to make it
clear that we're compiling bsnmp support into atmconfig

Approved by: jmmv (mentor)
Phabric: D579
PR: 143830
MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division
2014-08-15 21:22:49 +00:00
Alexander V. Chernikov
4bbd15771b Make room for multi-type values in struct tentry. 2014-08-15 12:58:32 +00:00
Bjoern A. Zeeb
d8e198e6b4 Remove bogus ; at the end of the if condition in order to unbreak gcc builds
after r270004.

MFC after:	4 days
X-MFX with:	r270004
2014-08-15 10:01:33 +00:00
Alan Somers
cdfa64aaeb Convert devd's client socket to type SOCK_SEQPACKET.
This change consists of two merges from projects/zfsd/head along with the
addition of an ATF test case for the new functionality.

sbin/devd/tests/Makefile
sbin/devd/tests/client_test.c
	Add ATF test cases for reading events from both devd socket types.

r266519:
sbin/devd/devd.8
sbin/devd/devd.cc
	Create a new socket, of type SOCK_SEQPACKET, for communicating with
	clients. SOCK_SEQPACKET sockets preserve record boundaries,
	simplying code in the client. The old SOCK_STREAM socket is retained
	for backwards-compatibility with existing clients.

r269993:
sbin/devd/devd.8
	Fix grammar bug.

CR:		https://reviews.freebsd.org/rS266519
MFC after:	5 days
Sponsored by:	Spectra Logic
2014-08-14 22:33:56 +00:00
Alexander V. Chernikov
c21034b744 Replace "cidr" table type with "addr" type.
Suggested by:	luigi
2014-08-14 21:43:20 +00:00
Alan Somers
d931b81aeb sbin/devd/devd.8
Fix grammar bug.

Reported by:	ian
Sponsored by:	Spectra Logic Corporation
2014-08-14 18:39:13 +00:00
Alexander V. Chernikov
fd0869d547 * Document internal commands.
* Do not require/set default table type if algo name is specified.
* Add TA_FLAG_READONLY option for algorithms.
2014-08-14 17:31:04 +00:00
Pedro F. Giffuni
69905bdec3 Use "NO NAME" as the default unnamed label.
Microsoft recommends avoiding the use of spaces in the
string structures for FAT. Unfortunately they do just
that by default in the case of unlabeled filesystems.

Follow the default MS behavior to avoid confusion in
common tools like file(1). This was actually the
default behavior before r203868.

Obtained from:	NetBSD (CVS rev. 1.39)
MFC after:	3 days
2014-08-13 21:18:31 +00:00
Alexander V. Chernikov
1b833d535b Sync to HEAD@r269943. 2014-08-13 16:20:41 +00:00
Alexander V. Chernikov
75d794211d Document table set-awareness in ipfw(8). 2014-08-13 15:29:29 +00:00
Alexander V. Chernikov
40e5f498de * Pass proper table set numbers from userland side.
* Ignore them, but honor V_fw_tables_sets value on kernel side.
2014-08-13 12:04:45 +00:00
Alexander V. Chernikov
f18a707efe Update op3 cmds. 2014-08-13 06:39:44 +00:00
Alexander V. Chernikov
35df97d0e2 * Do not crash on incorrect "flow" type inputs.
* Do not auto-create tables for operations other than add.
2014-08-13 06:16:37 +00:00
Alexander V. Chernikov
658331e530 Document most of the changes that have happened. 2014-08-13 00:19:18 +00:00
Alexander V. Chernikov
4df4dada8f Move one step further towards libipfw: convert show_static_rule() to
bpprint-output style, so one can now output human-readable rule
representation to preallocated buffer.
2014-08-12 19:56:26 +00:00
Glen Barber
33640c4a82 Fix a typo in a comment: s/interprete/interpret/
Submitted by:	Sam Fourman Jr.
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2014-08-12 19:37:49 +00:00
Alexander V. Chernikov
be695df9c3 * Update table_handler cmd list
* Implement partial cmd matching inside table handler.
2014-08-12 18:02:10 +00:00
Alexander V. Chernikov
1940fa7727 Change tablearg value to be 0 (try #2).
Most of the tablearg-supported opcodes does not accept 0 as valid value:
 O_TAG, O_TAGGED, O_PIPE, O_QUEUE, O_DIVERT, O_TEE, O_SKIPTO, O_CALLRET,
 O_NETGRAPH, O_NGTEE, O_NAT treats 0 as invalid input.

The rest are O_SETDSCP and O_SETFIB.
'Fix' them by adding high-order bit (0x8000) set for non-tablearg values.
Do translation in kernel for old clients (import_rule0 / export_rule0),
teach current ipfw(8) binary to add/remove given bit.

This change does not affect handling SETDSCP values, but limit
O_SETFIB values to 32767 instead of 65k. Since currently we have either
old (16) or new (2^32) max fibs, this should not be a big deal:
we're definitely OK for former and have to add another opcode to deal
with latter, regardless of tablearg value.
2014-08-12 15:51:48 +00:00
Andrey V. Elsukov
36b16d1f7d Turn off kern.geom.part.mbr.enforce_chs by default. 2014-08-12 10:31:31 +00:00
Andrey V. Elsukov
a327e0b08a Remove duplicate entry. 2014-08-12 09:34:53 +00:00
Andrey V. Elsukov
fb86534cb1 Add sysctl and loader tunable kern.geom.part.mbr.enforce_chs that is set
by default. It can be used to disable automatic alignment to CHS geometry,
that GEOM_PART_MBR does.

Reviewed by:	wblock
MFC after:	1 week
2014-08-12 09:10:13 +00:00
Alexander V. Chernikov
4f43138ade * Add the abilify to lock/unlock given table from changes.
Example:

# ipfw table si lock
# ipfw table si info
+++ table(si), set(0) +++
 kindex: 0, type: cidr, locked
 valtype: number, references: 0
 algorithm: cidr:radix
 items: 0, size: 288
# ipfw table si add 4.5.6.7
ignored: 4.5.6.7/32 0
ipfw: Adding record failed: table is locked
# ipfw table si unlock
# ipfw table si add 4.5.6.7
added: 4.5.6.7/32 0
# ipfw table si lock
# ipfw table si delete 4.5.6.7
ignored: 4.5.6.7/32 0
ipfw: Deleting record failed: table is locked
# ipfw table si unlock
# ipfw table si delete 4.5.6.7
deleted: 4.5.6.7/32 0
2014-08-11 18:09:37 +00:00
Alexander V. Chernikov
3a845e1076 * Add support for batched add/delete for ipfw tables
* Add support for atomic batches add (all or none).
* Fix panic on deleting non-existing entry in radix algo.

Examples:

# si is empty
# ipfw table si add 1.1.1.1/32 1111 2.2.2.2/32 2222
added: 1.1.1.1/32 1111
added: 2.2.2.2/32 2222
# ipfw table si add 2.2.2.2/32 2200 4.4.4.4/32 4444
exists: 2.2.2.2/32 2200
added: 4.4.4.4/32 4444
ipfw: Adding record failed: record already exists
^^^^^ Returns error but keeps inserted items
# ipfw table si list
+++ table(si), set(0) +++
1.1.1.1/32 1111
2.2.2.2/32 2222
4.4.4.4/32 4444
# ipfw table si atomic add 3.3.3.3/32 3333 4.4.4.4/32 4400 5.5.5.5/32 5555
added(reverted): 3.3.3.3/32 3333
exists: 4.4.4.4/32 4400
ignored: 5.5.5.5/32 5555
ipfw: Adding record failed: record already exists
^^^^^ Returns error and reverts added records
# ipfw table si list
+++ table(si), set(0) +++
1.1.1.1/32 1111
2.2.2.2/32 2222
4.4.4.4/32 4444
2014-08-11 17:34:25 +00:00
Alexander V. Chernikov
720ee730c6 Kernel changes:
* Fix buffer calculation for table dumps
* Fix IPv6 radix entiries addition broken in r269371.

Userland changes:
* Fix bug in retrieving statric ruleset
* Fix several bugs in retrieving table list
2014-08-08 21:09:22 +00:00
Alexander V. Chernikov
8bd1921248 Partially revert previous commit:
"0" value is perfectly valid for O_SETFIB and O_SETDSCP,
  so tablearg remains to be 655535 for now.
2014-08-08 15:33:26 +00:00
Alexander V. Chernikov
2c452b20dd * Switch tablearg value from 65535 to 0.
* Use u16 table kidx instead of integer on for iface opcode.
* Provide compability layer for old clients.
2014-08-08 14:23:20 +00:00
Alexander V. Chernikov
adf3b2b9d8 * Add IP_FW_TABLE_XMODIFY opcode
* Since there seems to be lack of consensus on strict value typing,
  remove non-default value types. Use userland-only "value format type"
  to print values.

Kernel changes:
* Add IP_FW_XMODIFY to permit table run-time modifications.
  Currently we support changing limit and value format type.

Userland changes:
* Support IP_FW_XMODIFY opcode.
* Support specifying value format type (ftype) in tablble create/modify req
* Fine-print value type/value format type.
2014-08-08 09:27:49 +00:00
Alexander V. Chernikov
28ea4fa355 Remove IP_FW_TABLES_XGETSIZE opcode.
It is superseded by IP_FW_TABLES_XLIST.
2014-08-08 06:36:26 +00:00