Commit Graph

302 Commits

Author SHA1 Message Date
Bruce Evans
7472e2e0f8 Use IPFIREWALL_MODULE instead of ACTUALLY_LKM_NOT_KERNEL to indicate
LKM'ness.  ACTUALLY_LKM_NOT_KERNEL is supposed to be so ugly that it
only gets used until <machine/conf.h> goes away.  bsd.kmod.mk should
define a better-named general macro for this.  Some places use
PSEUDO_LKM.  This is another bad name.

Makefile:
Added IPFIREWALL_VERBOSE_LIMIT option (commented out).
1996-06-23 14:28:02 +00:00
Peter Wemm
51a109a174 Set the rmx.rmx_expire to 0 when creating fake ethernet addresses for the
broadcast and multicast routes, otherwise they will be expired by
arptimeout after a few minutes, reverting to " (incomplete)". This makes
the work done by rev 1.27 stay around until the route itself is deleted.
This is mainly cosmetic for 'arp' and 'netstat -r'.
1996-06-21 21:45:58 +00:00
Bill Fenner
94334d8fc4 Use the route that's guaranteed to exist when picking a source address
for ARP requests.

The NetBSD version of this patch (see NetBSD PR kern/2381) has this change
already.  This should close our PR kern/1140 .

Although it's not quite what he submitted, I got the idea from him so
Submitted by:	Jin Guojun <jin@george.lbl.gov>
1996-06-20 22:53:08 +00:00
Bill Fenner
d7e74838d6 Remove one last rip_output from inetsw (gpalmer missed it in rev 1.30) 1996-06-20 17:52:32 +00:00
Nate Williams
17040b78cd Put the 'debug' messages of the type:
/kernel: in_rtqtimo: adjusted rtq_reallyold to 1066
  /kernel: in_rtqtimo: adjusted rtq_reallyold to 710
inside of #ifdef DIAGNOSTIC to avoid the support questions from folks
asking what this means.
1996-06-20 15:41:23 +00:00
Alexander Langer
6875d5c1b3 Fix chain numbering bug when the highest line number installed >= 65435
and the rule being added has no explicit line number set.

Submitted by:	Archie Cobbs <archie@whistle.com>
1996-06-17 00:00:35 +00:00
Garrett Wollman
51fb392203 Better selection of initial retransmit timeout when no cached
RTT information is available.

Submitted by: kbracey@art.acorn.co.uk (Kevin Bracey)
(slightly modified by me)
1996-06-14 17:17:32 +00:00
Gary Palmer
5d2541dab0 Don't try to include opt_ipfw.h in LKMs
Submitted by:	Ollivier Robert <roberto@keltia.freenix.fr>
1996-06-13 17:35:28 +00:00
David Greenman
34bed8b0ee Keep ether_type in network order for BPF to be consistent with other
systems.

Submitted by:	Ted Lemon, Matt Thomas, and others. Retrofitted for
		-current by me.
1996-06-13 02:54:19 +00:00
Gary Palmer
74a9466cc2 Convert ipfw to use opt_ipfw.h 1996-06-12 19:34:33 +00:00
Gary Palmer
c23670e294 Clean up -Wunused warnings.
Reviewed by:		bde
1996-06-12 05:11:41 +00:00
Alexander Langer
7a99108603 Big sweep over ipfw, picking up where Poul left off:
- Log ICMP type during verbose output.
  - Added IPFIREWALL_VERBOSE_LIMIT option to prevent denial of service
    attacks via syslog flooding.
  - Filter based on ICMP type.
  - Timestamp chain entries when they are matched.
  - Interfaces can now be matched with a wildcard specification (i.e.
    will match any interface unit for a given name).
  - Prevent the firewall chain from being manipulated when securelevel
    is greater than 2.
  - Fixed bug that allowed the default policy to be deleted.
  - Ability to zero individual accounting entries.
  - Remove definitions of old_chk_ptr and old_ctl_ptr when compiling
    ipfw as a lkm.
  - Remove some redundant code shared between ip_fw_init and ipfw_load.

Closes PRs: 1192, 1219, and 1267.
1996-06-09 23:46:21 +00:00
Bruce Evans
0453d3cbb3 Changed some memcpy()'s back to bcopy()'s.
gcc only inlines memcpy()'s whose count is constant and didn't inline
these.  I want memcpy() in the kernel go away so that it's obvious that
it doesn't need to be optimized.  Now it is only used for one struct
copy in si.c.
1996-06-08 08:19:03 +00:00
Garrett Wollman
c611d82e64 Instrument UDP PCB hashing to see how often the hash lookup is effective
for incoming packets.
1996-06-05 17:20:35 +00:00
Garrett Wollman
6da5712b60 Correct formula for TCP RTO calculation. Also try to do a better job in
filling in a new PCB's rttvar (but this is not the last word on the subject).
And get rid of `#ifdef RTV_RTT', it's been true for four years now...
1996-06-05 16:57:38 +00:00
John Polstra
588c92252f Fix a bug in the handling of the "persist" state which, under certain
circumstances, caused perfectly good connections to be dropped.  This
happened for connections over a LAN, where the retransmit timer
calculation TCP_REXMTVAL(tp) returned 0.  If sending was blocked by flow
control for long enough, the old code dropped the connection, even
though timely replies were being received for all window probes.

Reviewed by:	W. Richard Stevens <rstevens@noao.edu>
1996-06-03 15:37:52 +00:00
Gary Palmer
b750974745 Correct spelling error in comment 1996-06-02 00:15:19 +00:00
Peter Wemm
62d2e87ec1 More closely preserve the original operation of rresvport() when using
IP_PORTRANGE_LOW.
1996-05-31 05:11:22 +00:00
Garrett Wollman
f9493383fc Conditionalize calls to IPFW code on COMPAT_IPFW. This is done slightly
unconventionally:
	If COMPAT_IPFW is not defined, or if it is defined to 1, enable;
otherwise, disable.

This means that these changes actually have no effect on anyone at the
moment.  (It just makes it easier for me to keep my code in sync.)
In the future, the `not defined' part of the hack should be eliminated,
but doing this now would require everyone to change their config files.

The same conditionals need to be made in ip_input.c as well for this to
ave any useful effect, but I'm not ready to do that right now.
1996-05-22 17:23:09 +00:00
Peter Wemm
ce8c72b147 Fix an embarresing error on my part that made the IP_PORTRANGE options
return a failure code (even though it worked).
This commit brought to you by the 'C' keyword "break".. :-)
1996-05-21 20:47:31 +00:00
Garrett Wollman
82dab6ce62 Make it possible to return more than one piece of control information
(PR #1178).
Define a new SO_TIMESTAMP socket option for datagram sockets to return
packet-arrival timestamps  as control information (PR #1179).

Submitted by:	Louis Mamakos <loiue@TransSys.com>
1996-05-09 20:15:26 +00:00
Gary Palmer
b1e8a2c542 Remove useless entries from the inetsw structure initiliser which
only produced compile-time warnings.

Reviewed/Tested by: Bill Fenner <fenner@parc.xerox.com>
1996-05-08 04:34:03 +00:00
Gary Palmer
6ddbf1e299 Clean up various compiler warnings. Most (if not all) were benign
Reviewed by:	bde
1996-05-08 04:29:08 +00:00
Poul-Henning Kamp
83606d2247 Several locations in sys/netinet/ip_fw.c are lacking or incorrectly
use spl() functions.

Reviewed by:	phk
Submitted by:	Alex Nash <alex@zen.nash.org>
1996-05-06 20:31:04 +00:00
Garrett Wollman
9f9b3dc4ae Add three new route flags to help determine what sort of address
the destination represents.  For IP:

- Iff it is a host route, RTF_LOCAL and RTF_BROADCAST indicate local
  (belongs to this host) and broadcast addresses, respectively.

- For all routes, RTF_MULTICAST is set if the destination is multicast.

The RTF_BROADCAST flag is used by ip_output() to eliminate a call to
in_broadcast() in a common case; this gives about 1% in our packet-generation
experiments.  All three flags might be used (although they aren't now)
to determine whether a packet can be forwarded; a given host route can
represent a forwardable address if:

	(rt->rt_flags & (RTF_HOST | RTF_LOCAL | RTF_BROADCAST | RTF_MULTICAST))
	== RTF_HOST

Obviously, one still has to do all the work if a host route is not present,
but this code allows one to cache the results of such a lookup if rtalloc1()
is called without masking RTF_PRCLONING.
1996-05-06 17:42:13 +00:00
Bill Fenner
df5c0b8a7a Back out my stupid braino; I was thinking strlen and not sizeof. 1996-05-02 05:54:14 +00:00
Bill Fenner
af00f8007c Size temp var correctly; buf[4*sizeof "123"] is not long enough
to store "192.252.119.189\0".
1996-05-02 05:31:13 +00:00
Andrey A. Chernov
75cfc95fe2 inet_ntoa buffer was evaluated twice in log_in_vain, fix it.
Thanx to: jdp
1996-04-27 18:19:12 +00:00
Garrett Wollman
a2352fc148 Delete #ifdef notdef blocks containing old method of srtt calculation.
Requested by: davidg
1996-04-26 18:32:58 +00:00
Garrett Wollman
93902408b8 Delete #if 0 block containing remnants of pre-MTU discovery rmx_mtu
initialization.
1996-04-26 18:31:41 +00:00
Garrett Wollman
7c1c2d7ebd Delete #if 0 block containing unused definitions for ARPANET/DDN IMP
and HYPERchannel link layers.
1996-04-26 18:30:52 +00:00
Bruce Evans
e2184122c5 Fixed in-line IP header checksumming. It was performed on the wrong header
in one case.
1996-04-21 13:47:43 +00:00
Garrett Wollman
9c9137ea6c Three speed-ups in the output path (two small, one substantial):
1) Require all callers to pass a valid route pointer to ip_output()
   so that we don't have to check and allocate one off the stack
   as was done before.  This eliminates one test and some stack
    bloat from the common (UDP and TCP) case.

2) Perform the IP header checksum in-line if it's of the usual length.
    This results in about a 5% speed-up in my packet-generation test.

3) Use ip_vhl field rather than ip_v and ip_hl bitfields.
1996-04-18 15:49:06 +00:00
Garrett Wollman
61e5033f0a Define a few macros useful in the _IP_VHL case. 1996-04-18 15:42:50 +00:00
Garrett Wollman
dbe4b3f026 Fix a warning by not referencing ip_output() as a pr_output() member. 1996-04-18 15:41:51 +00:00
Garrett Wollman
2eba88186e Always call ip_output() with a valid route pointer. For igmp, also get the
multicast option structure off the stack rather than malloc.
1996-04-18 15:41:11 +00:00
David Greenman
2d8266af5c Two fixes from Rich Stevens:
1) Set the persist timer to help time-out connections in the CLOSING state.
2) Honor the keep-alive timer in the CLOSING state.

   This fixes problems with connections getting "stuck" due to incompletion
of the final connection shutdown which can be a BIG problem on busy WWW
servers.
1996-04-15 03:46:33 +00:00
Bruce Evans
c5294719c3 Eliminated sloppy common-style declarations. Now there are no duplicated
common labels for LINT.  There are still some common declarations for the
!KERNEL case in tcp_debug.h and spx_debug.h.  trpt depends on the ones in
tcp_debug.h.
1996-04-13 12:45:57 +00:00
Poul-Henning Kamp
539e53bad3 Fix a bogon I introduced with my last change.
Submitted by:	Andreas Klemm <andreas@knobel.gun.de>
1996-04-12 09:24:22 +00:00
Paul Traina
d78a37ad5a Logging UDP and TCP connection attempts should not be enabled by default.
It's trivial to create a denial of service attack on a box so enabled.

These messages, if enabled at all, must be rate-limited. (!)
1996-04-09 07:01:53 +00:00
David Greenman
c655b7c4f4 Added proper splnet protection while modifying the interface address list.
This fixes a panic that occurs when ifconfig ioctl(s) were interrupted
by IP traffic at the wrong time - resulting in a NULL pointer dereference.
This was originally noticed on a FreeBSD 1.0 system, but the problem still
exists in current sources.
1996-04-07 06:59:52 +00:00
Poul-Henning Kamp
34be9bf3ce Add a sysctl (net.inet.tcp.always_keepalive: 0) that when set will force
keepalive on all tcp sessions.  Setsockopt(2) cannot override this setting.
Maybe another one is needed that just changes the default for SO_KEEPALIVE ?
Requested by: Joe Greco <jgreco@brasil.moneng.mei.com>
1996-04-04 11:17:04 +00:00
Poul-Henning Kamp
816a3d836e Log TCP syn packets for ports we don't listen on.
Controlled by: sysctl net.inet.tcp.log_in_vain: 1

Log UDP syn packets for ports we don't listen on.
Controlled by: sysctl net.inet.udp.log_in_vain: 1

Suggested by:	Warren Toomey <wkt@cs.adfa.oz.au>
1996-04-04 10:46:44 +00:00
Garrett Wollman
d3d20ad196 Always pass a route structure when calling ip_output(). 1996-04-03 18:52:22 +00:00
Poul-Henning Kamp
23bf99538c Add feature for tcp "established".
Change interface between netinet and ip_fw to be more general, and thus
hopefully also support other ip filtering implementations.
1996-04-03 13:52:20 +00:00
Poul-Henning Kamp
7e6f7714ce Fix two cases where ia->ia_ifp could be NULL. 1996-04-02 12:26:10 +00:00
Garrett Wollman
ebcae94e4f In tcp_respond(), check that ro->ro_rt is non-null before RTFREEing
it.
1996-03-27 18:23:16 +00:00
Bill Fenner
e62b8c4939 Make rip_input() take the header length
Move ipip_input() and rsvp_input() prototypes to ip_var.h
Remove unused prototype for rip_ip_input() from ip_var.h
Remove unused variable *opts from rip_output()
1996-03-26 19:16:46 +00:00
Bill Fenner
fbc6ab006d Add missing splx(s) in IP_MULTICAST_IF
Submitted by:	Jim Binkley <jrb@cs.pdx.edu>
1996-03-26 18:56:51 +00:00
Garrett Wollman
9e2874b067 Slight modification of RTO floor calculation. 1996-03-25 20:13:21 +00:00