Commit Graph

131 Commits

Author SHA1 Message Date
Bosko Milekic
86fea6be59 o Untangle the confusion with the malloc flags {M_WAITOK, M_NOWAIT} and
the mbuf allocator flags {M_TRYWAIT, M_DONTWAIT}.
o Fix a bpf_compat issue where malloc() was defined to just call
  bpf_alloc() and pass the 'canwait' flag(s) along.  It's been changed
  to call bpf_alloc() but pass the corresponding M_TRYWAIT or M_DONTWAIT
  flag (and only one of those two).

Submitted by: Hiten Pandya <hiten@unixdaemons.com> (hiten->commit_count++)
2002-12-19 22:58:27 +00:00
Luigi Rizzo
97850a5dd9 Move fw_one_pass from ip_fw2.c to ip_input.c so that neither
bridge.c nor if_ethersubr.c depend on IPFIREWALL.
Restore the use of fw_one_pass in if_ethersubr.c

ipfw.8 will be updated with a separate commit.

Approved by: re
2002-11-20 19:07:27 +00:00
Sam Leffler
c1d93b0588 o change input packet handling to eliminate the pointer to the struct
ether_header; instead drivers are to leave the Ethernet header at the
  front of the packet
o add declarations for netgraph and vlan hooks that were removed from ethernet.h
o change various in-file calling conventions to track change in input API
o fixup bridge support to handle Ethernet header no longer being stripped
o add consistency checks to ether_input to catch problems with the change
  in the API; some of these may want to be moved to #ifdef DIAGNOSTIC at a
  later time (though they are not too expensive to leave as is)
o change ether_demux to eliminate the passing of the Ethernet header; it is
  now expected at the front of the packet a la ether_input
o add ether_sprintf compatibility shim
o change ether_ifattach API to remove "bpf supported param" and add a pointer
  to the MAC address to be installed for the LL address (this is for future
  changes to divest struct arpcom from struct ifnet)
o change ether_ifdetach API to remove "bpf support param"

Reviewed by:	many
Approved by:	re
2002-11-14 23:35:06 +00:00
Brooks Davis
29e1b85f97 Use if_printf(ifp, "blah") instead of
printf("%s%d: blah", ifp->if_name, ifp->if_xname).
2002-10-21 02:51:56 +00:00
Poul-Henning Kamp
c694310048 FIx misindentation.
Spotted by:	FlexeLint.
2002-10-16 09:00:53 +00:00
Crist J. Clark
232a880278 Unconditionally restore the pointer to the saved Ethernet header after
going to bridge.c:bdg_forward(). The header can be munged even if the
mbuf does not /appear/ to change.

PR:		kern/42465
MFC after:	4 days
2002-10-14 05:27:00 +00:00
Poul-Henning Kamp
8d3574c7a4 Fix some harmless mis-indents.
Spotted by:	FlexeLint
2002-10-01 15:48:31 +00:00
Poul-Henning Kamp
37c841831f Be consistent about "static" functions: if the function is marked
static in its prototype, mark it static at the definition too.

Inspired by:    FlexeLint warning #512
2002-09-28 17:15:38 +00:00
Poul-Henning Kamp
afbe3a0f81 Add the "Monitor" interface flag.
Setting this flag on an ethernet interface blocks transmission of packets
and discards incoming packets after BPF processing.

This is useful if you want to monitor network trafic but not interact
with the network in question.

Sponsored by:	http://www.babeltech.dk
2002-09-27 18:57:47 +00:00
Poul-Henning Kamp
a6ddbff039 Be a bit more technical:
Technically junk may have low entropy.
2002-09-26 14:01:50 +00:00
Poul-Henning Kamp
2201e1b039 Optimize the way we call BPF a tiny bit: If we chop the ether-header off
ourselves, call bpf before we do so, rather than re-construct the entire
thing afterwards.

Sponsored:	http://www.babeltech.dk/
2002-09-18 19:50:48 +00:00
David E. O'Brien
5908354455 Fix the GENERIC build. Don't refer to the non-existant fw_one_pass. 2002-09-12 15:36:13 +00:00
Luigi Rizzo
015d72e0c9 Make bridging and layer2-ipfw obey net.inet.ip.fw.one_pass.
I should have committed this ages ago.

The MFC for if_ethersubr.c could be done in the usual few days (only
ipfw2 uses it), the one for bridge.c should probably wait until
after 4.7 because it changes an existing though mostly undocumented
behaviour (on which i hope nobody relies). All in all, i'll wait for
both things unless there is demand.

MFC after: 35 days
2002-09-12 01:05:46 +00:00
Maxim Sobolev
25faf49d12 Fix a silly typo in user-setable promisc mode code.
Pointed out by:	Yann Berthier <yb@sainte-barbe.org>
MFC after:	1 day
2002-08-30 13:37:13 +00:00
Maxim Sobolev
ffb079be0c Implement user-setable promiscuous mode (a new `promisc' flag for ifconfig(8)).
Also, for all interfaces in this mode pass all ethernet frames to upper layer,
even those not addressed to our own MAC, which allows packets encapsulated
in those frames be processed with packet filters (ipfw(8) et al).

Emphatically requested by:	Anton Turygin <pa3op@ukr-link.net>
Valuable suggestions by:	fenner
2002-08-19 15:16:38 +00:00
Luigi Rizzo
c939f1aee7 Extend the interface to ether_input(): a NULL eh pointer means that
the mbuf contains the ethernet header (eh) as well, which ether_input()
will strip off as needed.

This permits the removal (in a backward compatible way) of the
header removal code which right now is replicated in all drivers,
sometimes in an inconsistent way. Also, because many functions
called after ether_input() require the eh in the mbuf, eventually
we can propagate the interface and handle outdated drivers just
in ether_input().

Individual driver changes to use the new interface will follow as
we have a chance to touch them.

NOTE THAT THIS CHANGE IS FULLY BACKWARD COMPATIBLE AND DOES NOT BREAK
BINARY COMPATIBILITY FOR DRIVERS.

MFC after: 3 days
2002-08-04 23:55:06 +00:00
Robert Watson
43b2936963 Introduce support for Mandatory Access Control and extensible
kernel access control.

Label mbufs received via ethernet-based interfaces by invoking
appropriate MAC framework entry points.

Perform access control checks on out-going mbufs delivered via
ethernet-based interfaces by invoking appropriate MAC entry
points.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs
2002-07-31 16:22:02 +00:00
Luigi Rizzo
9961e27d73 Remove one useless variable. 2002-06-30 08:02:38 +00:00
Luigi Rizzo
2f8ebbf49f fix indentation, whitespace and a few comments. 2002-06-23 11:19:53 +00:00
Luigi Rizzo
2b25acc158 Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.

The variables removed by this change are:

        ip_divert_cookie        used by divert sockets
        ip_fw_fwd_addr          used for transparent ip redirection
        last_pkt                used by dynamic pipes in dummynet

Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().

On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.

Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.

option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.

NOTES:
 * there is at least one global variable left, sro_fwd, in ip_output().
   I am not sure if/how this can be removed.

 * I have deliberately avoided gratuitous style changes in this commit
   to avoid cluttering the diffs. Minor stule cleanup will likely be
   necessary

 * this commit only focused on the IP layer. I am sure there is a
   number of global variables used in the TCP and maybe UDP stack.

 * despite the number of files touched, there are absolutely no API's
   or data structures changed by this commit (except the interfaces of
   ip_fw_chk() and dummynet_io(), which are internal anyways), so
   an MFC is quite safe and unintrusive (and desirable, given the
   improved readability of the code).

MFC after: 10 days
2002-06-22 11:51:02 +00:00
Luigi Rizzo
4b9840932d Add ipfw hooks to ether_demux() and ether_output_frame().
Ipfw processing of frames at layer 2 can be enabled by the sysctl variable

	net.link.ether.ipfw=1

Consider this feature experimental, because right now, the firewall
is invoked in the places indicated below, and controlled by the
sysctl variables listed on the right.  As a consequence, a packet
can be filtered from 1 to 4 times depending on the path it follows,
which might make a ruleset a bit hard to follow.

I will add an ipfw option to tell if we want a given rule to apply
to ether_demux() and ether_output_frame(), but we have run out of
flags in the struct ip_fw so i need to think a bit on how to implement
this.

		to upper layers
	     |			     |
	     +----------->-----------+
	     ^			     V
	[ip_input]		[ip_output]	net.inet.ip.fw.enable=1
	     |			     |
	     ^			     V
	[ether_demux]      [ether_output_frame]	net.link.ether.ipfw=1
	     |			     |
	     +->- [bdg_forward]-->---+		net.link.ether.bridge_ipfw=1
	     ^			     V
	     |			     |
		 to devices
2002-05-13 10:37:19 +00:00
Luigi Rizzo
7d3e4c6e71 Fix a couple of incorrect m_free() vs. m_freem() usages and related issues.
Reviewed-by: brooks
2002-04-04 05:42:09 +00:00
Bruce Evans
34fe62c776 Fixed some style bugs in the removal of __P(()). The main ones were
not removing tabs before "__P((", and not outdenting continuation lines
to preserve non-KNF lining up of code with parentheses.  Switch to KNF
formatting and/or rewrap the whole prototype in some cases.
2002-03-24 09:34:04 +00:00
Alfred Perlstein
929ddbbb89 Remove __P. 2002-03-19 21:54:18 +00:00
Luigi Rizzo
cad15830dc Remove useless initialization to 0 of a couple of global variables. 2002-02-15 04:57:18 +00:00
Jesper Skriver
3cd675111b It turns out that when a broadcast packet is looped back, the checksums
are checked on the way in even if they were not calculated on the
way out.

This fixes rwhod

PR:			31954
Submitted by:	fenner
Approved by:	fenner
MFC after:	1 week
2002-01-11 16:04:47 +00:00
Jonathan Lemon
64b15424e4 minor style fix. 2001-12-14 19:28:06 +00:00
David Greenman
05463bb58d Moved the updating of if_ibytes from ether_demux() to ether_input() to fix
a bug where the interface input bytes count wasn't updated when bridging
is enabled.

MFC after:	3 days
2001-12-14 04:41:07 +00:00
David E. O'Brien
6e551fb628 Update to C99, s/__FUNCTION__/__func__/,
also don't use ANSI string concatenation.
2001-12-10 08:09:49 +00:00
Brooks Davis
437e48e931 Don't pass an interface pointer to VLAN_INPUT{,_TAG}. Get it from the
mbuf instead.

Suggested by:	fenner
2001-12-03 17:28:27 +00:00
Luigi Rizzo
7b109fa404 MFS: sync the ipfw/dummynet/bridge code with the one recently merged
into stable (mostly , but not only, formatting and comments changes).
2001-11-04 22:56:25 +00:00
Max Khon
322dcb8d3d bring in ARP support for variable length link level addresses
Reviewed by:	jdp
Approved by:	jdp
Obtained from:	NetBSD
MFC after:	6 weeks
2001-10-14 20:17:53 +00:00
Jonathan Lemon
cfeff1b693 Set if_type and if_addrlen before calling if_attach(), so the values are
available for the routine to use.
2001-10-11 05:37:59 +00:00
Paul Saab
db69a05dce Make it so dummynet and bridge can be loaded as modules.
Submitted by:	billf
2001-10-05 05:45:27 +00:00
Peter Wemm
8cdfefbd0c Remove/comment tokens after #endif (#endif NETATALK) 2001-09-10 01:33:03 +00:00
Jonathan Lemon
f9132cebdc Wrap array accesses in macros, which also happen to be lvalues:
ifnet_addrs[i - 1]  -> ifaddr_byindex(i)
        ifindex2ifnet[i]    -> ifnet_byindex(i)

This is intended to ease the conversion to SMPng.
2001-09-06 02:40:43 +00:00
Brooks Davis
9d4fe4b2b0 Make vlan(4) loadable, unloadable, and clonable. As a side effect,
interfaces must now always enable VLAN support.

Reviewed by:	jlemon
MFC after:	3 weeks
2001-09-05 21:10:28 +00:00
Jonathan Lemon
08aadfbb98 Do not perform arp send/resolve on an interface marked NOARP.
PR: 25006
MFC after: 2 weeks
2001-06-15 21:00:32 +00:00
Bill Fenner
26e3096360 Get IP multicast working on VLAN devices:
- Allocate zeroed memory in ether_resolvemulti() to prevent equal() from
  comparing garbage and determining that two otherwise-equal sockaddr_dls
  are different.
- Fill in all required fields of the sockaddr_dl
- Actually copy the multicast address into the sockaddr_dl when calling
  if_addmulti()
- Don't claim that we don't have a way to resolve layer 3 addresses into
  layer 2 addresses; use the ethernet way.
2001-05-02 16:12:58 +00:00
Bosko Milekic
fef5fd2315 Plug several mbuf leaks in error cases (in nd6)
Submitted by: jhay
2001-03-11 05:31:45 +00:00
Mark Murray
10b1fde07f Insert entropy harvesting calls for network traffic. By
default, no entropy will be harvested.
2001-02-18 17:54:52 +00:00
Luigi Rizzo
7e1cd0d23d Sync with the bridge/dummynet/ipfw code already tested in stable.
In ip_fw.[ch] change a couple of variable and field names to
avoid having types, variables and fields with the same name.
2001-02-10 00:10:18 +00:00
Archie Cobbs
cb24f323d0 When we receive an incoming Ethernet frame that was unicast to a
different hardware address, we should drop it (this should only
happen in promiscuous mode). Relocate the code for this check
from before ng_ether(4) processing to after ng_ether(4) processing.
Also fix a compiler warning.

PR:		kern/24465
2001-02-08 17:56:49 +00:00
Luigi Rizzo
507b4b5432 MFS: bridge/ipfw/dummynet fixes (bridge.c will be committed separately) 2001-02-02 00:18:00 +00:00
Luigi Rizzo
02a282ac01 Comment the interface to ether_input() and the way is normally
used by most ethernet drivers.
2001-01-25 23:56:13 +00:00
Bosko Milekic
2a0c503e7a * Rename M_WAIT mbuf subsystem flag to M_TRYWAIT.
This is because calls with M_WAIT (now M_TRYWAIT) may not wait
  forever when nothing is available for allocation, and may end up
  returning NULL. Hopefully we now communicate more of the right thing
  to developers and make it very clear that it's necessary to check whether
  calls with M_(TRY)WAIT also resulted in a failed allocation.
  M_TRYWAIT basically means "try harder, block if necessary, but don't
  necessarily wait forever." The time spent blocking is tunable with
  the kern.ipc.mbuf_wait sysctl.
  M_WAIT is now deprecated but still defined for the next little while.

* Fix a typo in a comment in mbuf.h

* Fix some code that was actually passing the mbuf subsystem's M_WAIT to
  malloc(). Made it pass M_WAITOK instead. If we were ever to redefine the
  value of the M_WAIT flag, this could have became a big problem.
2000-12-21 21:44:31 +00:00
Jonathan Lemon
4851f97cf1 Remove unused variable, spl() manipulation isn't done for the ifq now. 2000-11-25 07:50:27 +00:00
Jonathan Lemon
df5e198723 Lock down the network interface queues. The queue mutex must be obtained
before adding/removing packets from the queue.  Also, the if_obytes and
if_omcasts fields should only be manipulated under protection of the mutex.

IF_ENQUEUE, IF_PREPEND, and IF_DEQUEUE perform all necessary locking on
the queue.  An IF_LOCK macro is provided, as well as the old (mutex-less)
versions of the macros in the form _IF_ENQUEUE, _IF_QFULL, for code which
needs them, but their use is discouraged.

Two new macros are introduced: IF_DRAIN() to drain a queue, and IF_HANDOFF,
which takes care of locking/enqueue, and also statistics updating/start
if necessary.
2000-11-25 07:35:38 +00:00
Boris Popov
2a7e8ece75 Properly setup link level header length for 802.2 and SNAP frames. 2000-09-30 14:33:53 +00:00
Bosko Milekic
ddacb30f2d Get rid of a panic that occurs in ether_demux() by dereferencing a NULL mbuf
pointer, when bridging and bridge_ipfw are enabled, and when bdg_forward()
happens to free the packet and make our pointer NULL. There may be
more similar problems like this one with calls to bdg_forward().

PR: Related to kern/19551
Reviewed by: jlemon
2000-09-24 04:08:38 +00:00