Commit Graph

1914 Commits

Author SHA1 Message Date
Brooks Davis
8d832bb5a0 Use TAILQ_FOREACH instead of poking around in the guts of the list
macros.
2006-07-15 02:49:35 +00:00
Brooks Davis
6a51be11da Drop a pointless cast of ifp->if_softc to (struct tap_softc *). 2006-07-15 02:13:05 +00:00
Andrew Thompson
07ed9a88c6 Catch up with the revised network interface cloning which takes an optional
opaque parameter that can specify configuration parameters.
2006-07-10 05:24:06 +00:00
Sam Leffler
6b7330e2d4 Revise network interface cloning to take an optional opaque
parameter that can specify configuration parameters:
o rev cloner api's to add optional parameter block
o add SIOCCREATE2 that accepts parameter data
o rev vlan support to use new api (maintain old code)

Reviewed by:	arch@
2006-07-09 06:04:01 +00:00
Oleg Bulyzhin
e27c3f48fb Adjust rt_(set|get)metrics() to do kernel <-> userland timebase conversion.
We need it since kernel timebase has changed (time_second -> time_uptime).

Approved by:	glebius (mentor)
2006-07-06 00:24:36 +00:00
Andrew Thompson
bac89dcef2 Fix a braino in the last revision, enc_clone_destroy needs return void instead
of int. The clone system will ensure that our first interface is not destroyed
so we dont need the extra checking anyway.

Tested by:	Scott Ullrich
2006-07-04 23:09:11 +00:00
Christian S.J. Peron
4b19419ee7 Adjust descriptor locking to tell the kqueue subsystem that our descriptor is
already locked. The reason to do this is to avoid two lock+unlock operations
in a row. We need the lock here to serialize access to bd_pid for stats
collection purposes.

Drop the locks all together on detach, as they will be picked up by
knlist_remove.

This should fix a failed locking assertion when kqueue is being used with bpf
descriptors.

Discussed with:	jmg
2006-07-03 20:02:06 +00:00
Yaroslav Tykhiy
4b97d7affd There is a consensus that ifaddr.ifa_addr should never be NULL,
except in places dealing with ifaddr creation or destruction; and
in such special places incomplete ifaddrs should never be linked
to system-wide data structures.  Therefore we can eliminate all the
superfluous checks for "ifa->ifa_addr != NULL" and get ready
to the system crashing honestly instead of masking possible bugs.

Suggested by:	glebius, jhb, ru
2006-06-29 19:22:05 +00:00
Yaroslav Tykhiy
e54e7d6dae Use TAILQ_FOREACH in the __FreeBSD__ case, too.
Funnily enough, rev. 1.15 changed the __Net and __Open cases only.
2006-06-29 17:56:21 +00:00
Yaroslav Tykhiy
06dc090fe0 Use TAILQ_FOREACH. 2006-06-29 17:31:43 +00:00
Yaroslav Tykhiy
5aa288f461 Use the nifty TAILQ_FOREACH. 2006-06-29 17:16:13 +00:00
Yaroslav Tykhiy
249f4297db Detach the interface first, do vlan_unconfig() then.
Previously, another thread could get a pointer to the
interface by scanning the system-wide list and sleep
on the global vlan mutex held by vlan_unconfig().
The interface was gone by the time the other thread
woke up.

In order to be able to call vlan_unconfig() on a detached
interface, remove the purely cosmetic bzero'ing of IF_LLADDR
from the function because a detached interface has no addresses.

Noticed by:	a stress-testing script by maxim
Reviewed by:	glebius
2006-06-29 07:52:30 +00:00
Yaroslav Tykhiy
114c608c71 Remove a few unused things.
Fix some style and consistency points.
2006-06-29 07:30:39 +00:00
Yaroslav Tykhiy
185225ff52 Reduce unneeded code duplication. 2006-06-29 07:23:49 +00:00
Andrew Thompson
ae4748ad15 A small race existed where the lock was dropped between when encif was
tested and then set. [1]

Reorganise things to eliminate this, we now ensure that enc0 can not be
destroyed which as the benefit of no longer needing to lock in
ipsec_filter and ipsec_bpf. The cloner will create one interface during the
init so we can guarantee that encif will be valid before any SPD entries are
added to ipsec.

Spotted by:	glebius [1]
2006-06-28 21:57:35 +00:00
Andrew Thompson
f0ac1eedd5 Simplify ipsec_bpf by using bpf_mtap2(). 2006-06-27 01:53:12 +00:00
Andrew Thompson
bdea400f3b Add a pseudo interface for packet filtering IPSec connections before or after
encryption. There are two functions, a bpf tap which has a basic header with
the SPI number which our current tcpdump knows how to display, and handoff to
pfil(9) for packet filtering.

Obtained from:	OpenBSD
Based on:	kern/94829
No objections:	arch, net
MFC after:	1 month
2006-06-26 22:30:08 +00:00
Yaroslav Tykhiy
15ed2fa1f1 Fix the VLAN_ARRAY case, mostly regarding improper use of atomic(9)
in place of conventional rw locking.  Alas, atomic(9) can't buy us
lockless operation so easily.
2006-06-21 13:48:34 +00:00
Yaroslav Tykhiy
5cb8c31af1 Track interface department events and detach vlans from
departing trunk so that we don't get into trouble later
by dereferencing a stale pointer to dead trunk's things.

Prodded by:	oleg
Sponsored by:	RiNet (Cronyx Plus LLC)
MFC after:	1 week
2006-06-21 07:29:44 +00:00
Gleb Smirnoff
457f48e65c - First initialize ifnet, and then insert it into global
list.
- First remove from global list, then start destroying.

PR:		kern/97679
Submitted by:	Alex Lyashkov <shadow itt.net.ru>
Reviewed by:	rwatson, brooks
2006-06-21 06:02:35 +00:00
Andrew Thompson
690d79381a Allow gif interfaces to be added as span ports, the user may want to send a
copy of all packets to the other side of the world.
2006-06-20 21:28:18 +00:00
Max Laier
0dad3f0e15 Import interface groups from OpenBSD. This allows to group interfaces in
order to - for example - apply firewall rules to a whole group of
interfaces.  This is required for importing pf from OpenBSD 3.9

Obtained from:	OpenBSD (with changes)
Discussed on:	-net (back in April)
2006-06-19 22:20:45 +00:00
Andrew Thompson
615fccc52b Fix spelling mistake in comment. 2006-06-19 02:25:11 +00:00
Christian S.J. Peron
19ba8395e1 Since we are doing some bpf(4) clean up, change a couple of function prototypes
to be consistent. Also, ANSI'fy function definitions. There is no functional
change here.
2006-06-15 15:39:12 +00:00
Christian S.J. Peron
7eae78a419 If bpf(4) has not been compiled into the kernel, initialize the bpf interface
pointer to a zeroed, statically allocated bpf_if structure. This way the
LIST_EMPTY() macro will always return true. This allows us to remove the
additional unconditional memory reference for each packet in the fast path.

Discussed with:	sam
2006-06-14 02:23:28 +00:00
Andrew Thompson
80829fccd7 Use bit operations to get a locally administered address rather than using a
hardcoded OUI code.
2006-06-12 22:43:37 +00:00
Max Khon
affcaf7871 Fix KASSERT conditions in if_deregister_com_alloc(). 2006-06-11 22:09:28 +00:00
Andrew Thompson
b3a1f9373a Allow bridge and carp to play nicely together by returning the packet if its
destined for a carp interface.

Obtained from:	OpenBSD
MFC after:	2 weeks
2006-06-08 23:40:16 +00:00
Qing Li
1a41f91052 Assuming the interface has an address of x.x.x.195, a mask of
255.255.255.0, and a default route with gateway x.x.x.1. Now if
the address mask is changed to something more specific, e.g.,
255.255.255.128, then after the mask change the default gateway
is no longer reachable.

Since the default route is still present in the routing table,
when the output code tries to resolve the address of the default
gateway in function rt_check(), again, the default route will be
returned by rtalloc1(). Because the lock is currently held on the
rtentry structure, one more attempt to hold the lock will trigger
a crash due to "lock recursed on non-recursive mutex ..."

This is a general problem. The fix checks for the above condition
so that an existing route entry is not mistaken for a new cloned
route. Approriately, an ENETUNREACH error is returned back to the
caller

Approved by:	andre
2006-06-05 21:20:21 +00:00
Christian S.J. Peron
ffdc0471d4 Back out previous two commits, this caused some problems in the namespace
resulting in some build failures. Instead, to fix the problem of bpf not
being present, check the pointer before dereferencing it.

This is a temporary bandaid until we can decide on how we want to handle
the bpf code not being present. This will be fixed shortly.
2006-06-03 18:48:14 +00:00
Christian S.J. Peron
727b73816c Temporarily include files so that our macro checks do something useful. 2006-06-03 18:16:54 +00:00
Christian S.J. Peron
5255290c9c Make sure we don't try to dereference the the if_bpf pointer when bpf has
not been compiled into the the kernel.

Submitted by:	benno
2006-06-03 06:37:00 +00:00
Sam Leffler
ff046a6c6b add missed calls to bpf_peers_present 2006-06-02 23:14:40 +00:00
Christian S.J. Peron
16d878cc99 Fix the following bpf(4) race condition which can result in a panic:
(1) bpf peer attaches to interface netif0
	(2) Packet is received by netif0
	(3) ifp->if_bpf pointer is checked and handed off to bpf
	(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
	    initialized to NULL.
	(5) ifp->if_bpf is dereferenced by bpf machinery
	(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
  bpf interface structure. Once this is done, ifp->if_bpf should never be
  NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
  a lockless read bpf peer list associated with the interface. It should
  be noted that the bpf code will pickup the bpf_interface lock before adding
  or removing bpf peers. This should serialize the access to the bpf descriptor
  list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
  can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

	(1) Packet is received by netif0
	(2) Check to see if bpf descriptor list is empty
	(3) Pickup the bpf interface lock
	(4) Hand packet off to process

From the attach/detach side:

	(1) Pickup the bpf interface lock
	(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
    not we have any bpf peers that might be interested in receiving packets.

In collaboration with:	sam@
MFC after:	1 month
2006-06-02 19:59:33 +00:00
Gleb Smirnoff
6e86062956 Fix gif_output() so that GIF_UNLOCK() is performed only in case
we have locked the softc.

PR:		kern/98298
Submitted by:	Eugene Grosbein
2006-06-02 14:10:52 +00:00
Robert Watson
4421f50dbc raw_disconnect() now disconnects but does not detach the raw pcb. As a
result, raw_uabort() now needs to call raw_detach() directly.  As
raw_uabort() is never called, and raw_disconnect() is probably not ever
actually called in practice, this is likely not a functional change, but
improves congruence between protocols, and avoids a NULL raw cb pointer
after disconnect, which could result in a panic.

MFC after:	1 month
2006-06-02 08:27:15 +00:00
Gleb Smirnoff
4ec449ae88 - Add definition for IFM_10G_CX4.
- Put IFM_10G_CX4 and IFM_10G_SR into IFMEDIA_BAUDRATE array.

Requested by:	Jack Vogel <jfvogel gmail.com>
2006-06-02 07:50:58 +00:00
Andrew Thompson
f3b90d48bb Announce all interfaces to devd on attach/detach. This adds a new devctl
notification so all interfaces including pseudo are reported. When netif
creates the clones at startup devctl_disable has not been turned off yet so the
interfaces will not be initialised twice, enforce this by adding an explicit
order between rc.d/netif and rc.d/devd.

This change allows actions to taken in userland when an interface is cloned
and the pseudo interface will be automatically configured if a ifconfig_<int>=""
line exists in rc.conf.

Reviewed by:		brooks
No objections on:	net
2006-06-01 00:41:07 +00:00
Marius Strobl
fa67ebf9bb Revert the (int *) -> (intptr_t *) conversion done as part of rev. 1.59
for IOCTLs where casting data to intptr_t * isn't the right thing to do
as _IO() isn't used for them but _IOR(..., int)/_IOW(..., int) are (i.e.
for all IOCTLs except VMIO_SIOCSIFFLAGS), fixing tap(4) on big-endian
LP64 machines.

PR:		sparc64/98084
OK'ed by:	emax
MFC after:	1 week
2006-05-30 20:08:12 +00:00
Ruslan Ermilov
293c06a186 Fix -Wundef warnings. 2006-05-30 19:24:01 +00:00
David Malone
a58327bd09 Avoid unwanted sign extension of indexed byte load in bpf code.
PR:		89748
Submitted by:	Guy Harris <guy@alum.mit.edu>
Obtained from:	NetBSD via OpenBSD
MFC after:	2 weeks
2006-05-28 20:00:02 +00:00
Maksim Yevmenkin
7a9adfdd85 Do not call knlist_destroy() in tapclose(). Instead call it when device is
actually destroyed. Also move call to knlist_init() into tapcreate(). This
should fix panic described in kern/95357.

PR:			kern/95357
No response from:	freebsd-current@
MFC after:		3 days
2006-05-17 17:05:02 +00:00
Andrew Thompson
dc1b1b7b6a Fix style(9) nits, whitespace and parentheses. 2006-05-16 22:50:41 +00:00
Qing Li
e034e82c56 The current routing code allows insertion of indirect routes that have
gateways which are unreachable except through the default router. For
example, assuming there is a default route configured, and inserting
a route

	"route add 64.102.54.0/24 60.80.1.1"

is currently allowed even when 60.80.1.1 is only reachable through
the default route. However, an error is thrown when this route is
utilized, say,

	"ping 64.102.54.1"  will return an error

This type of route insertion should be disallowed becasue:

1) Let's say that somehow our code allowed this packet to flow to
   the default router, and the default router knows the next hop is
   60.80.1.1, then the question is why bother inserting this route in
   the 1st place, just simply use the default route.

2) Since we're not talking about source routing here, the default
   router could very well choose a different path than using 60.80.1.1
   for the next hop, again it defeats the purpose of adding this route.

Reviewed by:	ru, gnn, bz
Approved by:	andre
2006-05-16 19:11:11 +00:00
Daniel Hartmeier
2557a639a5 Recalculate IP checksum after running pfil hooks.
Reviewed by:	thompsa
Tested by:	Adam McDougall <mcdouga9@egr.msu.edu>
2006-05-15 11:49:01 +00:00
Max Laier
656faadcb8 Remove ip6fw. Since ipfw has full functional IPv6 support now and - in
contrast to ip6fw - is properly lockes, it is time to retire ip6fw.
2006-05-12 20:39:23 +00:00
John Baldwin
73dbd3da73 Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
Jeffrey Hsu
a393a28afa Correct test for fragmented packet. 2006-05-11 00:53:43 +00:00
Christian S.J. Peron
1fc9e38706 Pickup locks for the BPF interface structure. It's quite possible that
bpf(4) descriptors can be added and removed on this interface while we
are processing stats.

MFC after:	2 weeks
2006-05-07 03:21:43 +00:00
Bjoern A. Zeeb
ac4a76ebc9 In rtrequest and rtinit check for sa_len != 0 for the given
destination. These checks are needed so we do not install
a route looking like this:
(0)                192.0.2.200        UH       tun0 =>

When removing this route  the kernel will start to walk
the address space which looks like a hang on 64bit platforms
because it'll take ages while on 32bit you should see a panic
when kernel debugging options are turned on.

The problem is in rtrequest1:
	if (netmask) {
		rt_maskedcopy(dst, ndst, netmask);
	} else
		bcopy(dst, ndst, dst->sa_len);

In both cases the len might be 0 if the application forgot to
set it.  If so ndst will be all-zero  leading to above
mentioned strange routes.

This is an application error but we must not fail/hang/panic
because of this.

Looks ok:	gnn
No objections:	net@ (silence)
MFC after:	8 weeks
2006-05-04 18:33:37 +00:00