Commit Graph

4380 Commits

Author SHA1 Message Date
Oleg Bulyzhin
f35f35c976 - Refresh dynamic tcp rule only if both sides answered keepalive packets.
- Remove some useless assignments.

MFC after:	1 month
2012-02-28 22:00:41 +00:00
Oleg Bulyzhin
8ac1bb0495 lookup_dyn_rule_locked(): style(9) cleanup
MFC after:	1 month
2012-02-28 21:53:39 +00:00
Kip Macy
a93cda789a When using flowtable llentrys can outlive the interface with which they're associated
at which the lle_tbl pointer points to freed memory and the llt_free pointer is no longer
valid.

Move the free pointer in to the llentry itself and update the initalization sites.

MFC after:	2 weeks
2012-02-23 18:21:37 +00:00
Andrey V. Elsukov
313157dead Don't use `m' after m_megapullup.
PR:		kern/165373
MFC after:	3 days
2012-02-22 04:19:33 +00:00
Michael Tuexen
310a027788 Remove two clang warnings.
MFC after: 1 month.
2012-02-18 16:06:15 +00:00
Bjoern A. Zeeb
9dba179d5e IFC @231845
Sponsored by:	Cisco Systems, Inc.
2012-02-17 00:27:48 +00:00
Bjoern A. Zeeb
d8951c8a2f Fix PAWS (Protect Against Wrapped Sequence numbers) in cases when
hz >> 1000 and thus getting outside the timestamp clock frequenceny of
1ms < x < 1s per tick as mandated by RFC1323, leading to connection
resets on idle connections.

Always use a granularity of 1ms using getmicrouptime() making all but
relevant callouts independent of hz.

Use getmicrouptime(), not getmicrotime() as the latter may make a jump
possibly breaking TCP nfsroot mounts having our timestamps move forward
for more than 24.8 days in a second without having been idle for that
long.

PR:		kern/61404
Reviewed by:	jhb, mav, rrs
Discussed with:	silby, lstewart
Sponsored by:	Sandvine Incorporated (originally in 2011)
MFC after:	6 weeks
2012-02-15 16:09:56 +00:00
Michael Tuexen
9b1246ca38 Fix a bug where the wrong protocol overhead was used. This can lead
to a deadlock of an association when an IPv6 socket was used to
communcate with IPv4 and an ICMPv4 fragmentation needed message
was received.
While there, simplify the code a bit.

MFC after: 3 days.
2012-02-14 12:00:34 +00:00
Gleb Smirnoff
afdbac98df Set vnet context in callouts and taskqueues.
PR:		164696
2012-02-08 13:39:38 +00:00
Gleb Smirnoff
23ccd3d976 Make the 'tcpwin' option of ipfw(8) accept ranges and lists.
Submitted by:	sem
2012-02-06 11:35:29 +00:00
Michael Tuexen
f1cf024599 Fix a typo which was already fixed by eadler in r227489. We missed
to integrate this fix in our code base, so it was removed in r227755.

MFC after: 3 days.
2012-02-06 10:47:12 +00:00
Gleb Smirnoff
9077f38738 Add new socket options: TCP_KEEPINIT, TCP_KEEPIDLE, TCP_KEEPINTVL and
TCP_KEEPCNT, that allow to control initial timeout, idle time, idle
re-send interval and idle send count on a per-socket basis.

Reviewed by:	andre, bz, lstewart
2012-02-05 16:53:02 +00:00
Bjoern A. Zeeb
9836132cd1 Document the fact that multi-FIB support for SCTP had been backed out
in r179783 as (ab)using the concept of VRFs for this had not worked.
At this point SCTP in FreeBSD does not support multi-FIB, neither for
IPv4 nor for IPv6.

Discussed with:	rrs
Sponsored by:	Cisco Systems, Inc.
2012-02-03 15:39:13 +00:00
Bjoern A. Zeeb
cebf3b1b6a Make ipfw verify_path6() multi-FIB aware.
The "fib" and "setfib" keywords implementations need no adjustments.

Sponsored by:	Cisco Systems, Inc.
2012-02-03 13:12:42 +00:00
Bjoern A. Zeeb
81d5d46b3c Add multi-FIB IPv6 support to the core network stack supplementing
the original IPv4 implementation from r178888:

- Use RT_DEFAULT_FIB in the IPv4 implementation where noticed.
- Use rt*fib() KPI with explicit RT_DEFAULT_FIB where applicable in
  the NFS code.
- Use the new in6_rt* KPI in TCP, gif(4), and the IPv6 network stack
  where applicable.
- Split in6_rtqtimo() and in6_mtutimo() as done in IPv4 and equally
  prevent multiple initializations of callouts in in6_inithead().
- Use wrapper functions where needed to preserve the current KPI to
  ease MFCs.  Use BURN_BRIDGES to indicate expected future cleanup.
- Fix (related) comments (both technical or style).
- Convert to rtinit() where applicable and only use custom loops where
  currently not possible otherwise.
- Multicast group, most neighbor discovery address actions and faith(4)
  are locked to the default FIB.  Individual IPv6 addresses will only
  appear in the default FIB, however redirect information and prefixes
  of connected subnets are automatically propagated to all FIBs by
  default (mimicking IPv4 behavior as closely as possible).

Sponsored by:	Cisco Systems, Inc.
2012-02-03 13:08:44 +00:00
Gleb Smirnoff
2512b096a2 o Provide functions carp_ifa_addroute()/carp_ifa_delroute()
to cleanup routes from a single ifa.
o Implement carp_addroute()/carp_delroute() via above functions.
o Call carp_ifa_delroute() in the carp_detach() to avoid
  junk routes left in routing table, in case if user
  removes an address in a MASTER state. [1]

Reported by:	az [1]
2012-02-01 11:07:41 +00:00
Luigi Rizzo
7dec311e83 a variable was erroneously declared as 32 bit instead of 64.
MFC after:	3 days
2012-01-27 13:26:25 +00:00
Gleb Smirnoff
3660e7b0da Remove unused variable. 2012-01-24 14:27:14 +00:00
Bjoern A. Zeeb
08adfbbf62 Make #error messages string-literals and remove punctuation.
Reported by:	bde (for ip_divert)
Reviewed by:	bde
MFC after:	3 days
2012-01-22 10:41:58 +00:00
Bjoern A. Zeeb
aa57e971bc Fix ip_divert handling of inet and inet6 and module building some more.
Properly sort the "carp" case in modules/Makefile after it was renamed.

Reported by:	bde (most)
Reviewed by:	bde
MFC after:	3 days
2012-01-22 02:16:31 +00:00
Bjoern A. Zeeb
83e521ec73 Clean up some #endif comments removing from short sections. Add #endif
comments to longer, also refining strange ones.

Properly use #ifdef rather than #if defined() where possible.  Four
#if defined(PCBGROUP) occurances (netinet and netinet6) were ignored to
avoid conflicts with eventually upcoming changes for RSS.

Reported by:	bde (most)
Reviewed by:	bde
MFC after:	3 days
2012-01-22 02:13:19 +00:00
Bjoern A. Zeeb
44e489690c Remove a superfluous INET6 check (no opt_inet6.h included anyway).
MFC after:	3 days
2012-01-20 17:18:54 +00:00
Michael Tuexen
c75fdd302b Fix a problem when using the CBAPI.
While there, remove an old comment which does not apply anymore.
2012-01-20 13:26:11 +00:00
Gleb Smirnoff
56cf9dc1f6 Drop support for SIOCSIFADDR, SIOCSIFNETMASK, SIOCSIFBRDADDR, SIOCSIFDSTADDR
ioctl commands.

PR:		163524
Reviewed by:	net
2012-01-16 09:53:24 +00:00
Michael Tuexen
86eef6072b Two cleanups. No functional change. 2012-01-15 13:35:55 +00:00
Michael Tuexen
8de4bcc1f7 Fix two bugs, which result in a panic when calling getsockopt()
using SCTP_RECVINFO or SCTP_NXTINFO.
Reported by Clement Lecigne and forwarded to us by zi@.

MFC after: 3 days.
2012-01-14 09:10:20 +00:00
Gleb Smirnoff
5c39f7bdeb Bunch of fixes to pfsync(4) module load/unload:
o Make the pfsync.ko actually usable. Before this change loading it
  didn't register protosw, so was a nop. However, a module /boot/kernel
  did confused users.
o Rewrite the way we are joining multicast group:
  - Move multicast initialization/destruction to separate functions.
  - Don't allocate memory if we aren't going to join a multicast group.
  - Use modern API for joining/leaving multicast group.
  - Now the utterly wrong pfsync_ifdetach() isn't needed.
o Move module initialization from SYSINIT(9) to moduledata_t method.
o Refuse to unload module, unless asked forcibly.
o Improve a bit some FreeBSD porting code:
  - Use separate malloc type.
  - Simplify swi sheduling.

This change is probably wrong from VIMAGE viewpoint, however pfsync
wasn't VIMAGE-correct before this change, too.

Glanced at by:	bz
2012-01-09 08:50:22 +00:00
Gleb Smirnoff
aa24ae3c5e Make it possible to use alternative source hardware address
in the ARP datagram generated by arprequest(). If caller doesn't
supply the address, then it is either picked from CARP or hardware
address of the interface is taken.

While here, make several minor fixes:

- Hold IF_ADDR_RLOCK(ifp) while traversing address list.
- Remove not true comment.
- Access internet address and mask via in_ifaddr fields,
  rather than ifaddr.
2012-01-08 17:25:15 +00:00
Gleb Smirnoff
d294536082 Provide IA_MASKSIN() macro similar to IA_SIN() and IA_DSTSIN(). 2012-01-08 17:20:29 +00:00
Gleb Smirnoff
94901d5e60 Move arprequest() declaration to if_ether.h. 2012-01-08 13:34:00 +00:00
Michael Tuexen
c58e60be43 Add an SCTP sysctl "blackhole", similar to the one for TCP.
If set to 1, no ABORT is sent back in response to an incoming
INIT. If set to 2, no ABORT is sent back in response to
an out of the blue packet. If set to 0 (the default), ABORTs
are sent.
Discussed with rrs@.

MFC after: 1 month.
2012-01-08 09:56:24 +00:00
Michael Tuexen
ab6174d587 Retire the SCTP sysctl "strict_init". We always perform the validation
and there is no reason to make is configuarable.
Discussed with rrs@.
2012-01-07 14:04:00 +00:00
Michael Tuexen
d68fdc4df6 Improve the handling of received INITs. Send an ABORT when
not accepting the connection. Also fix a crash, which
could happen when the user closed the socket.

MFC after: 1 month.
2012-01-07 13:03:33 +00:00
Eitan Adler
316efdb35f - Fix sysctl description
PR:		163623
Submitted by:	Eugene Grosbein <eugen@eg.sd.rdtc.ru>
Approved by:	bz
2012-01-07 00:11:36 +00:00
Michael Tuexen
aa1808b71f Use NULL instead of 0.
MFC after: 1 month.
2012-01-06 20:20:59 +00:00
Navdeep Parhar
db3cee5170 Always release the inp lock before returning from tcp_detach.
MFC after:	5 days
2012-01-06 18:29:40 +00:00
John Baldwin
0ff93ca524 Tweak the last fix to match what was actually tested.
Pointy hat to:	jhb
2012-01-06 12:49:01 +00:00
Sergey Kandaurov
4f7fca1ca1 Fix a typo.
X-MFC-with:	229665
2012-01-06 00:23:17 +00:00
John Baldwin
1e96ae8193 Remove the assertion from tcp_input() that rcv_nxt is always greater
than or equal to rcv_adv and fix tcp_twstart() to handle this case by
assuming the last window was zero rather than a negative value.

The code in tcp_input() already safely handled this case.  It can happen
due to delayed ACKs along with a remote sender that sends data beyond
the window we previously advertised.  If we have room in our socket buffer
for the extra data beyond the advertised window, we will accept it.
However, if the ACK for that segment is delayed, then we will not
effectively fixup rcv_adv to account for that extra data until the
next segment arrives and forces out an ACK.  When that next segment
arrives, rcv_nxt will be beyond rcv_adv.

Tested by:	pjd
MFC after:	1 week
2012-01-05 22:29:11 +00:00
John Baldwin
137f91e80f Convert all users of IF_ADDR_LOCK to use new locking macros that specify
either a read lock or write lock.

Reviewed by:	bz
MFC after:	2 weeks
2012-01-05 19:00:36 +00:00
John Baldwin
0f188ebb1d Use a helper variable to wrap a long line. 2012-01-04 13:29:26 +00:00
John Baldwin
56d6e1292d In the handling of the SIOC[DG]LIFADDR icotls in in_lifaddr_ioctl(), add
missing interface address list locking and grab a reference on the
matching interface address after dropping the lock while it is used to
avoid a potential use after free.

Reviewed by:	bz
MFC after:	1 week
2012-01-04 13:26:56 +00:00
John Baldwin
0823c29b81 Fix the SIOC[DG]LIFADDR ioctls in in_lifaddr_ioctl() to work with IPv4
interface address rather than IPv6.

Submitted by:	hrs
Reviewed by:	bz
MFC after:	1 week
2012-01-04 13:23:51 +00:00
John Baldwin
c6f4ea8062 When cancelling multicast timers on an interface, don't release the
reference on a group in the leaving state while iterating over the loop.
Instead, use the same approach used in igmp_ifdetach() and mld_ifdetach()
of placing the groups to free on pending release list and then releasing
the references after dropping the IF_ADDR_LOCK.  This closes an ugly race
where the code was dropping the lock in the middle of iterating over the
list.  It also fixes some additional potential use-after-free bugs since
the cancellation routine also applied other changes to the group after
dropping the reference.  Now those changes are performed before the
reference is dropped and the group is potentially freed.

Prodded to fix by:	glebius
Reviewed by:	bz
MFC after:	1 week
2012-01-03 20:34:52 +00:00
John Baldwin
f5b50e25ec Use TAILQ_FOREACH() instead of TAILQ_FOREACH_SAFE() for some loops that
do not modify the queues they iterate over.

Submitted by:	glebius
2012-01-03 16:22:29 +00:00
Bjoern A. Zeeb
762ad1d614 As I came by and noticed add a comment that inp locking is a bit optistic
(read: non-existent) here and should be fixed.
2012-01-02 09:18:58 +00:00
John Baldwin
c23de1f45b Defer the work of freeing IPv4 multicast options from a socket to an
asychronous task.  This avoids tearing down multicast state including
sending IGMP leave messages and reprogramming MAC filters while holding
the per-protocol global pcbinfo lock that is used in the receive path of
packet processing.

Reviewed by:	rwatson
MFC after:	1 month
2011-12-29 20:41:16 +00:00
John Baldwin
3b0b2840be Use queue(3) macros instead of home-rolled versions in several places in
the INET6 code.  This includes retiring the 'ndpr_next' and 'pfr_next'
macros.

Submitted by:	pluknet (earlier version)
Reviewed by:	pluknet
2011-12-29 18:25:18 +00:00
Gleb Smirnoff
9de96e891c Don't fallback to a CARP address in BACKUP state. 2011-12-29 15:59:14 +00:00
Michael Tuexen
60990c0c06 Address issues found by clang. While there, fix also some style
issues.

MFC after: 3 months.
2011-12-27 10:16:24 +00:00
Gleb Smirnoff
1c435c73a1 Use a better log message for master down event. 2011-12-22 18:48:21 +00:00
Gleb Smirnoff
7121247312 Provide ABI compatibility shim to enable configuring of addresses
with ifconfig(8) prior to r228571.

Requested by:	brooks
2011-12-21 12:39:08 +00:00
Gleb Smirnoff
f08535f872 Restore a feature that was present in 5.x and 6.x, and was cleared in
7.x, 8.x and 9.x with pf(4) imports: pfsync(4) should suppress CARP
preemption, while it is running its bulk update.

However, reimplement the feature in more elegant manner, that is
partially inspired by newer OpenBSD:

- Rename term "suppression" to "demotion", to match with OpenBSD.
- Keep a global demotion factor, that can be raised by several
  conditions, for now these are:
  - interface goes down
  - carp(4) has problems with ip_output() or ip6_output()
  - pfsync performs bulk update
- Unlike in OpenBSD the demotion factor isn't a counter, but
  is actual value added to advskew. The adjustment values for
  particular error conditions are also configurable, and their
  defaults are maximum advskew value, so a single failure bumps
  demotion to maximum. This is for POLA compatibility, and should
  satisfy most users.
- Demotion factor is a writable sysctl, so user can do
  foot shooting, if he desires to.
2011-12-20 13:53:31 +00:00
Michael Tuexen
7215cc1b74 Fix unused parameter warnings.
While there, fix some whitespace issues.

MFC after: 3 months.
2011-12-17 19:21:40 +00:00
Gleb Smirnoff
92ed4e1a24 Since size of struct in_aliasreq has just been changed in r228571,
and thus ifconfig(8) needs recompile, it is a good chance to make
parameter checks on SIOCAIFADDR arguments more strict.
2011-12-16 13:30:17 +00:00
Gleb Smirnoff
08b68b0e4c A major overhaul of the CARP implementation. The ip_carp.c was started
from scratch, copying needed functionality from the old implemenation
on demand, with a thorough review of all code. The main change is that
interface layer has been removed from the CARP. Now redundant addresses
are configured exactly on the interfaces, they run on.

The CARP configuration itself is, as before, configured and read via
SIOCSVH/SIOCGVH ioctls. A new prefix created with SIOCAIFADDR or
SIOCAIFADDR_IN6 may now be configured to a particular virtual host id,
which makes the prefix redundant.

ifconfig(8) semantics has been changed too: now one doesn't need
to clone carpXX interface, he/she should directly configure a vhid
on a Ethernet interface.

To supply vhid data from the kernel to an application the getifaddrs(8)
function had been changed to pass ifam_data with each address. [1]

The new implementation definitely closes all PRs related to carp(4)
being an interface, and may close several others. It also allows
to run a single redundant IP per interface.

Big thanks to Bjoern Zeeb for his help with inet6 part of patch, for
idea on using ifam_data and for several rounds of reviewing!

PR:		kern/117000, kern/126945, kern/126714, kern/120130, kern/117448
Reviewed by:	bz
Submitted by:	bz [1]
2011-12-16 12:16:56 +00:00
Gleb Smirnoff
55174c34ef Belatedly catch up with r151555. in_scrubprefix() also needs this fix. We
should compare not only addresses, but their masks, too, when searching
for matching prefix.
2011-12-13 06:56:43 +00:00
Michael Tuexen
972478a4c0 Fix a bug reported by Irene Ruengeler which resulted in not sending
out HEARTBEATs when requested by the user. The HEARTBEATs were only
queued, but not actually sent out.

MFC after: 2 months.
2011-12-10 10:52:54 +00:00
Gleb Smirnoff
f769e5b0fa Fix a very special case when SIOCAIFADDR supplies mask of 0.0.0.0,
don't overwrite the mask with autoguessing based on classes.
2011-12-06 20:55:20 +00:00
Michael Tuexen
a56569ba55 Remove debug code.
MFC after: 1 month.
2011-11-28 20:48:35 +00:00
Gleb Smirnoff
89b9325530 Fix one more fallout from r227791: do not overwrite trimmed sa_len
on the ia_sockmask when doing SIOCSIFNETMASK.

Reported by:	Stefan Bethke <stb lassitu.de>, gonzo
Pointy hat to:	glebius
2011-11-28 13:30:14 +00:00
Michael Tuexen
70acddf158 Fix a warning reported by arundel@.
Fix a bug where the parameter length of a supported address types
parameter is set to a wrong value if the kernel is built with
with either INET or INET6, but not both.

MFC after: 3 days.
2011-11-27 17:51:13 +00:00
Lawrence Stewart
a26fef3a21 Plug a TCP reassembly UMA zone leak introduced in r226113 by only using the
backup stack queue entry when the zone is exhausted, otherwise we leak a zone
allocation each time we plug a hole in the reassembly queue.

Reported by:	many on freebsd-stable@ (thread: "TCP Reassembly Issues")
Tested by:	many on freebsd-stable@ (thread: "TCP Reassembly Issues")
Reviewed by:	bz (very brief sanity check)
MFC after:	3 days
2011-11-27 02:32:08 +00:00
Gleb Smirnoff
c6e5c71116 Remove superfluous check: SIOCAIFADDR must have ifra_addr supplied. 2011-11-24 22:46:11 +00:00
Gleb Smirnoff
bd47ae58a6 Fix stupid typo in r227830.
PR:		162806
Pointy hat to:	glebius
2011-11-24 22:43:48 +00:00
Michael Tuexen
052230f978 Move up the address to the top of the sctp_udencaps structure
like in all other structures. This avoids alignment problems.

MFC after: 3 months.
2011-11-24 10:58:48 +00:00
Michael Tuexen
ec9925ed78 Move up the address to the top of the sctp_paddrthlds structure
like in all other structures. This avoids alignment problems.

MFC after: 3 days.
2011-11-24 10:54:30 +00:00
Gleb Smirnoff
e278f44bb5 style(9) nit 2011-11-22 19:39:27 +00:00
Gleb Smirnoff
bbaa3f944e Fix SIOCDIFADDR semantics: if no address is specified, then delete first one. 2011-11-22 19:37:57 +00:00
Gleb Smirnoff
cf00e5c6b7 This check isn't needed now, sanity checking done in the beginning.
Missed it in last commit.
2011-11-21 20:07:12 +00:00
Gleb Smirnoff
6d00fd9c2d Historically in_control() did not check sockaddrs supplied with
structs ifreq/in_aliasreq and there've been several panics due
to that problem. All these panics were fixed just a couple of
lines above the panicing code.

Take a more general approach: sanity check sockaddrs supplied
with SIOCAIFADDR and SIOCSIF*ADDR at the beggining of the
function and drop all checks below.

One check is now disabled due to strange code in ifconfig(8)
that I've removed recently. I'm going to enable it with next
__FreeBSD_version bump.

Historically in_ifinit() was able to recover from an error
and restore old address. Nowadays this feature isn't working
for all error cases, but for some of them. I suppose no software
relies on this behavior, so I'd like to remove it, since this
simplifies code a lot.

Also, move if_scrub() earlier in the in_ifinit(). It is more
correct to wipe routes before removing address from local
address list, and interface address list.

Silence from:	bz, brooks, andre, rwatson, 3 weeks
2011-11-21 14:10:13 +00:00
Gleb Smirnoff
619051718c Be more informative for "unknown hardware address format" message.
Submitted by:	Andrzej Tobola <ato iem.pw.edu.pl>
2011-11-21 13:40:35 +00:00
Gleb Smirnoff
c9168718ca - Reduce severity for all ARP events, that can be triggered from remote
machine to LOG_NOTICE. Exception left to "using my IP address".
- Fix multicast ARP warning: add newline and also log the bad MAC address.

Tested by:	Alexander Wittig <wittigal msu.edu>
2011-11-21 12:07:18 +00:00
Michael Tuexen
c9c5805975 Add support for the SCTP_REMOTE_UDP_ENCAPS_PORT socket option.
Retire the the now unused sctp_udp_tunneling_for_client_enable
sysctl variable.

MFC after: 3 months.
2011-11-20 15:00:45 +00:00
Michael Tuexen
363114118b Cleanup comparison of interface names.
MFC after: 1 month.
2011-11-18 09:01:08 +00:00
Michael Tuexen
a62e467ac3 Set the MTU of an path to an approriate value if the interface MTU
can't be determined.

MFC after: 3 days.
2011-11-15 20:41:50 +00:00
Eitan Adler
3b6dc18ef5 - fix duplicate "a a" in some comments
Submitted by:	eadler
Approved by:	simon
MFC after:	3 days
2011-11-13 17:06:33 +00:00
Michael Tuexen
eb20220e9b Don't copy uninitialized memory. Also simplify the comparison
of interface names.

MFC after: 3 days.
2011-11-13 11:53:18 +00:00
Brooks Davis
4b22573a89 In r191367 the need for if_free_type() was removed and a new member
if_alloctype was used to store the origional interface type.  Take
advantage of this change by removing all existing uses of if_free_type()
in favor of if_free().

MFC after:	1 Month
2011-11-11 22:57:52 +00:00
Eitan Adler
14517324d0 - add a missing "be" and "in"
- fix other errors introduced when committing r226436
- add 'function' to a sentence where it makes sense

Submitted by:	delphij
Submitted by:	dougb
Submitted by:	jhb
Approved by:	dougb
Approved by:	jhb
2011-11-11 22:27:09 +00:00
Michael Tuexen
dc81ec897e When loading addresses from INITs, always use the correct
local address.

MFC after: 3 days.
2011-11-07 22:30:19 +00:00
Ed Schouten
6472ac3d8a Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs.
The SYSCTL_NODE macro defines a list that stores all child-elements of
that node. If there's no SYSCTL_DECL macro anywhere else, there's no
reason why it shouldn't be static.
2011-11-07 15:43:11 +00:00
Ed Schouten
d745c852be Mark MALLOC_DEFINEs static that have no corresponding MALLOC_DECLAREs.
This means that their use is restricted to a single C file.
2011-11-07 06:44:47 +00:00
Michael Tuexen
7dd1259f73 Initialize all components of the sent COOKIE.
MFC after: 3 days.
2011-11-06 20:09:22 +00:00
Mikolaj Golub
fc06cd427e Cache SO_REUSEPORT socket option in inpcb-layer in order to avoid
inp_socket->so_options dereference when we may not acquire the lock on
the inpcb.

This fixes the crash due to NULL pointer dereference in
in_pcbbind_setup() when inp_socket->so_options in a pcb returned by
in_pcblookup_local() was checked.

Reported by:	dave jones <s.dave.jones@gmail.com>, Arnaud Lacombe <lacombar@gmail.com>
Suggested by:	rwatson
Glanced by:	rwatson
Tested by:	dave jones <s.dave.jones@gmail.com>
2011-11-06 10:47:20 +00:00
Mikolaj Golub
ec95b70995 Fix the typo made in r157474.
MFC after:	3 days
2011-11-06 09:17:48 +00:00
Bjoern A. Zeeb
8813217a67 Always use the opt_*.h options for ipfw.ko, not just when
compiled into the kernel.
Do not try to build the module in case of no INET support but
keep #error calls for now in case we would compile it into the
kernel.

This should fix an issue where the module would fail to enable
IPv6 support from the rc framework, but also other INET and INET6
parts being silently compiled out without giving a warning in the
module case.

While here garbage collect unneeded opt_*.h includes.
opt_ipdn.h is not used anywhere but we need to leave the DUMMYNET
entry in options for conditional inclusion in kernel so keep the
file with the same name.

Reported by:	pluknet
Reviewed by:	plunket, jhb
MFC After:	3 days
2011-11-04 16:24:19 +00:00
Sergey Kandaurov
ddd0c4a969 Restore sysctl names for tcp_sendspace/tcp_recvspace.
They seem to be changed unintentionally in r226437, and there were no
any mentions of renaming in commit log message.

Reported by:	Anton Yuzhaninov <citrin citrin ru>
2011-11-02 20:58:47 +00:00
Michael Tuexen
7ffa229018 When add a new remote address using sctp_add_remote_addr(),
return the correct net if requested.

MFC after: 3 days.
2011-10-27 22:38:48 +00:00
Michael Tuexen
a0fe4c5b36 Send out control chunks which have no specific destination.
MFC after: 3 days.
2011-10-27 22:37:59 +00:00
Qing Li
b3664a14cc Exclude host routes when checking for prefix coverage on multiple
interfaces. A host route has a NULL mask so check for that condition.
I have also been told by developers who customize the packet output
path with direct manipulation of the route entry (or the outgoing
interface to be specific). This patch checks for the route mask
explicitly to make sure custom code will not panic.

PR:		kern/161805
MFC after:	3 days
2011-10-25 04:06:29 +00:00
Ed Schouten
cf05e311ea Add missing #includes.
According to POSIX, these two header files should be able to be included
by themselves, not depending on other headers. The <net/if.h> header
uses struct sockaddr when __BSD_VISIBLE=1, while <netinet/tcp.h> uses
integer datatypes (u_int32_t, u_short, etc).

MFC after:	2 months
2011-10-21 12:58:34 +00:00
Bjoern A. Zeeb
fba0cea143 Add syntactic sugar missed in r226437 and then not added either when moving
things around in r226448 but desperately needed to always make things
compile successfully.

MFC after:	1 week
2011-10-17 00:05:31 +00:00
Andre Oppermann
873789cb0f Move the tcp_sendspace and tcp_recvspace sysctl's from
the middle of tcp_usrreq.c to the top of tcp_output.c
and tcp_input.c respectively next to the socket buffer
autosizing controls.

MFC after:	1 week
2011-10-16 20:18:39 +00:00
Andre Oppermann
9ec4a4cca5 Remove the ss_fltsz and ss_fltsz_local sysctl's which have
long been superseded by the RFC3390 initial CWND sizing.

Also remove the remnants of TCP_METRICS_CWND which used the
TCP hostcache to set the initial CWND in a non-RFC compliant
way.

MFC after:	1 week
2011-10-16 20:06:44 +00:00
Andre Oppermann
e233e2acb3 VNET virtualize tcp_sendspace/tcp_recvspace and change the
type to INT.  A long is not necessary as the TCP window is
limited to 2**30.  A larger initial window isn't useful.

MFC after:	1 week
2011-10-16 15:08:43 +00:00
Eitan Adler
36daf0495a - change "is is" to "is" or "it is"
- change "the the" to "the"

Approved by:	lstewart
Approved by:	sahil (mentor)
MFC after:	3 days
2011-10-16 14:30:28 +00:00
Andre Oppermann
c8360ae220 Update the comment and description of tcp_sendspace and tcp_recvspace
to better reflect their purpose.
MFC after:	1 week
2011-10-16 13:54:46 +00:00
Ed Schouten
3fa417554b Forward declare mbuf and inpcb.
This fixes a compiler warning at WARNS=6 when including the header files
as follows:

	#include <sys/types.h>
	#include <netinet/in.h>
	#include <netinet/ip_var.h>
	#include <netinet/udp.h>
	#include <netinet/udp_var.h>
2011-10-16 10:58:00 +00:00
Gleb Smirnoff
53883e0c24 Add support for IPv4 /31 prefixes, as described in RFC3021.
To run a /31 network, participating hosts MUST drop support
for directed broadcasts, and treat the first and last addresses
on subnet as unicast. The broadcast address for the prefix
should be the link local broadcast address, INADDR_BROADCAST.
2011-10-15 18:41:25 +00:00
Gleb Smirnoff
b365d954cc Remove last remnants of classful addressing:
- Remove ia_net, ia_netmask, ia_netbroadcast from struct in_ifaddr.
- Remove net.inet.ip.subnetsarelocal, I bet no one need it in 2011.
- fix bug when we were not forwarding to a host which matches classful
  net address. For example router having 192.168.x.y/16 network attached,
  would not forward traffic to 192.168.*.0, which are legal IPs in
  CIDR world.
- For compatibility, leave autoguessing of mask based on class.

Reviewed by:	andre, bz, rwatson
2011-10-15 16:28:06 +00:00
Gleb Smirnoff
2a2e6f0aeb Never switch directly from INIT to MASTER, since this produces
nasty status flaps.

PR:		kern/161123
Submitted by:	Damien Fleuriot <dam my.gd>
OpenBSD:	ip_carp.c, rev. 1.115
2011-10-14 19:05:26 +00:00
Gleb Smirnoff
a0b5928b29 De-spl(9). 2011-10-13 13:30:41 +00:00
Navdeep Parhar
aa4b09c5c7 Make sure the inp wasn't dropped when rexmt let go of the inp and
pcbinfo locks.

Reviewed by:	andre@
MFC after:	7 days
2011-10-12 19:52:23 +00:00
Michael Tuexen
7906f59a29 Use the most significant 6 bits of the dscp instead of the least
significant ones.
This has changed in the latest version of the socket API ID and
provides backwards compatibility and gets it in syn with the
usage of the IP_TOS socket option.

MFC after: 3 days.
2011-10-11 13:24:37 +00:00
Qing Li
15d2521975 All indirect routes will fail the rtcheck, except for a special host
route where the destination IP and the gateway IP is the same. This
special case handling is only meant for backward compatibility reason.
The last commit introduced a bug in the route check logic, where a
valid special case is treated as an error. This patch fixes that bug
along with some code cleanup.

Suggested by:	gleb
Reviewed by:	kmacy, discussed with gleb
MFC after:	1 day
2011-10-10 17:41:11 +00:00
Michael Tuexen
69c59f8ba2 Get struct sctp_net_route in tune with struct route.
struct route was changed in
http://svn.freebsd.org/changeset/base/225698
and since then SCTP support was broken.
This needs to be MFCed to stable/9 to unbreak SCTP support in 9.0
MFC after: 3 days.
2011-10-10 16:31:18 +00:00
Michael Tuexen
3d2443cc84 When moving an stcb to a new inp and we copy over the list of
bound addresses, update the last used address pointer.
If not, it might result in a crash if the old inp goes away.

MFC after: 3 days.
2011-10-10 12:28:47 +00:00
Michael Tuexen
629749b60c Update the inp stored in a HB-timer when moving an stcb to a new inp.
Use only this stored inp when processing a HB timeout.
This fixes a bug which results in a crash.

MFC after: 3 days.
2011-10-09 14:12:17 +00:00
Qing Li
6703e7ea10 Do not try removing an ARP entry associated with a given interface
address if that interface does not support ARP. Otherwise the
system will generate error messages unnecessarily due to the missing
entry.

PR:		kern/159602
Submitted by:	pluknet
MFC after:	3 days
2011-10-07 22:22:19 +00:00
Qing Li
41b210c6f6 Remove the reference held on the loopback route when the interface
address is being deleted. Only the last reference holder deletes the
loopback route. All other delete operations just clear the IFA_RTSELF
flag.

PR:		kern/159601
Submitted by:	pluknet
Reviewed by:	discussed on net@
MFC after:	3 days
2011-10-07 18:01:34 +00:00
Andre Oppermann
1593dcd025 Prevent TCP sessions from stalling indefinitely in reassembly
when reaching the zone limit of reassembly queue entries.

When the zone limit was reached not even the missing segment
that would complete the sequence space could be processed
preventing the TCP session forever from making any further
progress.

Solve this deadlock by using a temporary on-stack queue entry
for the missing segment followed by an immediate dequeue again
by delivering the contiguous sequence space to the socket.

Add logging under net.inet.tcp.log_debug for reassembly queue
issues.

Reviewed by:	lsteward (previous version)
Tested by: 	Steven Hartland <killing-at-multiplay.co.uk>
MFC after:	3 days
2011-10-07 16:39:03 +00:00
Andre Oppermann
50b1479e65 Add back the IP header length to the total packet length field on
raw IP sockets.  It was deducted in ip_input() in preparation for
protocols interested only in the payload.

On raw sockets the IP header should be delivered as it at came in
from the network except for the byte order swaps in some fields.

This brings us in line with all other OS'es that provide raw
IP sockets.

Reported by: Matthew Cini Sarreo <mcins1-at-gmail.com>
MFC after: 3 days
2011-10-07 13:43:01 +00:00
Attilio Rao
4af309c810 For the INP_TIMEWAIT case, there is no valid tcpcb object tied to the
inpcb object.
Skip the TCP_SIGNATURE check in that case as it is consistent with the
output path (no TCP_SIGNATURE for outcoming packets in TIMEWAIT state)
and also because for TIMEWAIT state the verify may be less effective.

Sponsored by:		Sandvine Incorporated
Reported by:		rwatson
No objections by:	rwatson
MFC after:		3 days
2011-10-06 14:29:38 +00:00
Qing Li
db92413e6a A system may have multiple physical interfaces, all of which are on the
same prefix. Since a single route entry is installed for the prefix
(without RADIX_MPATH), incoming packets on the interfaces that are not
associated with the prefix route may trigger an error message about
unable to allocation LLE entry, and fails L2. This patch makes sure a
valid route is present in the system, and allow the aforementioned
condition to exist and treats as valid.

Reviewed by:	bz
MFC after:	5 days
2011-10-03 19:51:18 +00:00
Qing Li
6cf8e3300e This patch allows ARP to work properly in the presence of
self-referencing routes. This patch is a rework of r223862.

Reviewed by:	bz, zec
MFC after:	5 days
2011-10-03 19:06:55 +00:00
Bjoern A. Zeeb
75e54d6017 Unbreak no-ip and no-inet6 module builds with ipfw. For now continue to
build the ip_fw_pfil.c hooks and ipfw even in case of no-ip under the
assumption that the private L2 hook (which hopefully eventually will be a
pfil hook as well) can still be useful.

Allow building the module without inet as well.

Glanced at by:	jhb
MFC after:	3 days
2011-09-27 13:27:17 +00:00
Michael Tuexen
87eac1ceb9 Cleanup the iterator code, remove code that is never executed.
Approved by: re
MFC after: 1 month.
2011-09-19 21:47:20 +00:00
Michael Tuexen
80c79bbe7a Fix the enabling/disabling of Heartbeats and path MTU
discovery when using the SCTP_PEER_ADDR_PARAMS socket option.
Approved by: re
MFC after: 1 month.
2011-09-17 08:50:29 +00:00
Michael Tuexen
3657c405e3 Fix a typo introduced in
http://svn.freebsd.org/changeset/base/225571
Reported by Ilya A. Arkhipov.

Approved by: re
MFC after: 1 month.
2011-09-15 12:20:52 +00:00
Michael Tuexen
92776dfd5a Make sure that SCTP rejects broadcast, multicast and wildcard addresses
as remote addresses.

Approved by: re
MFC after: 1 month.
2011-09-15 08:49:54 +00:00
Michael Tuexen
c55b70cef6 Ensure that 1-to-1 style SCTP sockets can only be connected once.
Allow implicit setup also for 1-to-1 style sockets as described
in the latest version of the socket API ID.

Approved by: re
MFC after: 1 month
2011-09-14 19:10:13 +00:00
Michael Tuexen
58bdb69150 Fix the handling of the flowlabel and DSCP value in the SCTP_PEER_ADDR_PARAMS
socket option.
Honor the net.inet6.ip6.auto_flowlabel sysctl setting.

Approved by: re (bz)
MFC after: 1 month.
2011-09-14 08:15:21 +00:00
John Baldwin
5bb3652f05 Allow the ipfw.ko module built with a kernel to honor any IPFIREWALL_*
options defined in the kernel config.  This more closely matches the
behavior of other modules which inherit configuration settings from the
kernel configuration during a kernel + modules build.

Reviewed by:	luigi
Approved by:	re (kib)
MFC after:	1 week
2011-09-12 21:09:56 +00:00
Michael Tuexen
e4f820b3c6 Improve implementation of the Nagle algorithm for SCTP:
Don't delay the final fragment of a fragmented user message.

Approved by: re
MFC after: 4 weeks
2011-09-09 13:52:37 +00:00
Qing Li
1184509858 When an interface address route is removed from the system, another
route with the same prefix is searched for as a replacement. The
current code did not bypass routes that have non-operational
interfaces. This patch fixes that bug and will find a replacement
route with an active interface.

PR:		kern/159603
Submitted by:	pluknet, ambrisko at ambrisko dot com
Reviewed by:	discussed on net@
Approved by:	re (bz)
MFC after:	3 days
2011-08-28 00:14:40 +00:00
Bjoern A. Zeeb
b233773bb9 Increase the defaults for the maximum socket buffer limit,
and the maximum TCP send and receive buffer limits from 256kB
to 2MB.

For sb_max_adj we need to add the cast as already used in the sysctl
handler to not overflow the type doing the maths.

Note that this is just the defaults.  They will allow more memory
to be consumed per socket/connection if needed but not change the
default "idle" memory consumption.   All values are still tunable
by sysctls.

Suggested by:	gnn
Discussed on:	arch (Mar and Aug 2011)
MFC after:	3 weeks
Approved by:	re (kib)
2011-08-25 09:20:13 +00:00
Bjoern A. Zeeb
6f69742441 Fix compilation in case of defined(INET) && defined(IPFIREWALL_FORWARD)
but no INET6.

Reported by:	avg
Tested by:	avg
MFC after:	4 weeks
X-MFC with:	r225044
Approved by:	re (kib)
2011-08-20 18:45:38 +00:00
Bjoern A. Zeeb
8a006adb24 Add support for IPv6 to ipfw fwd:
Distinguish IPv4 and IPv6 addresses and optional port numbers in
user space to set the option for the correct protocol family.
Add support in the kernel for carrying the new IPv6 destination
address and port.
Add support to TCP and UDP for IPv6 and fix UDP IPv4 to not change
the address in the IP header.
Add support for IPv6 forwarding to a non-local destination.
Add a regession test uitilizing VIMAGE to check all 20 possible
combinations I could think of.

Obtained from:	David Dolson at Sandvine Incorporated
		(original version for ipfw fwd IPv6 support)
Sponsored by:	Sandvine Incorporated
PR:		bin/117214
MFC after:	4 weeks
Approved by:	re (kib)
2011-08-20 17:05:11 +00:00
Bjoern A. Zeeb
f76fdd221b Hide IPv6 next header parsing warnings under the verbose sysctl
so people can possibly disable it when their consoles are flooded,
or enabled it for debugging.

MFC after:	2 weeks
Approved by:	re (kib)
2011-08-20 14:20:36 +00:00
Bjoern A. Zeeb
0c4dbd5af7 After r225032 fix logging in a similar way masking the the IPv6
more fragments flag off so that offset == 0 checks work properly.

PR:		kern/145733
Submitted by:	Matthew Luckie (mjl luckie.org.nz)
MFC after:	2 weeks
X-MFC with:	r225032
Approved by:	re (kib)
2011-08-20 13:47:08 +00:00
Bjoern A. Zeeb
49239b28da If we detect an IPv6 fragment header and it is not the first fragment,
then terminate the loop as we will not find any further headers and
for short fragments this could otherwise lead to a pullup error
discarding the fragment.

PR:		kern/145733
Submitted by:	Matthew Luckie (mjl luckie.org.nz)
MFC after:	2 weeks
Approved by:	re (kib)
2011-08-20 13:46:19 +00:00
Bjoern A. Zeeb
720fee0674 ipfw internally checks for offset == 0 to determine whether the
packet is a/the first fragment or not.  For IPv6 we have added the
"more fragments" flag as well to be able to determine on whether
there will be more as we do not have the fragment header avaialble
for logging, while for IPv4 this information can be derived directly
from the IPv4 header.  This allowed fragmented packets to bypass
normal rules as proper masking was not done when checking offset.
Split variables to not need masking for IPv6 to avoid further errors.

PR:		kern/145733
Submitted by:	Matthew Luckie (mjl luckie.org.nz)
MFC after:	2 weeks
Approved by:	re (kib)
2011-08-20 13:17:47 +00:00
Bjoern A. Zeeb
391255b8a4 While not explicitly allowed by RFC 2460, in case there is no
translation technology involved (and that section is suggested to
be removed by Errata 2843), single packet fragments do not harm.

There is another errata under discussion to clarify and allow this.
Meanwhile add a sysctl to allow disabling this behaviour again.
We will treat single packet fragment (a fragment header added
when not needed) as if there was no fragment header.

PR:		kern/145733
Submitted by:	Matthew Luckie (mjl luckie.org.nz) (original version)
Tested by:	Matthew Luckie (mjl luckie.org.nz)
MFC after:	2 weeks
Approved by:	re (kib)
2011-08-20 12:40:17 +00:00
Michael Tuexen
3900c0936f Fix the handling of [gs]etsockopt() unconnected 1-to-1 style sockets.
While there:
* Fix a locking issue in setsockopt() of SCTP_CMT_ON_OFF.
* Fix a bug in setsockopt() of SCTP_DEFAULT_PRINFO, where the pr_value
  was ignored.

Approved by: re@
MFC after: 2 months.
2011-08-16 21:04:18 +00:00
Michael Tuexen
b10f2dc889 Add support for the spp_dscp field in the SCTP_PEER_ADDR_PARAMS
socket option. Backwards compatibility is provided by still
supporting the spp_ipv4_tos field.

Approved by: re@
MFC after: 2 months.
2011-08-14 20:55:32 +00:00
Kevin Lo
7236660627 If RTF_HOST flag is specified, then we are interested in destination
address.

PR:		kern/159600
Submitted by:	Svatopluk Kraus <onwahe at gmail dot com>
Approved by:	re (hrs)
2011-08-10 06:17:06 +00:00
Michael Tuexen
ca85e9482a The result of a joint work between rrs@ and myself at the IETF:
* Decouple the path supervision using a separate HB timer per path.
* Add support for potentially failed state.
* Bring back RTO.min to 1 second.
* Accept packets on IP-addresses already announced via an ASCONF
* While there: do some cleanups.

Approved by: re@
MFC after: 2 months.
2011-08-03 20:21:00 +00:00
Gleb Smirnoff
217e3abc03 Add missing break; in r223593.
Submitted by:	sem
Pointy hat to:	glebius
Approved by:	re (kib)
2011-08-01 13:41:38 +00:00
Bjoern A. Zeeb
d9a362862c Add spares to the network stack for FreeBSD-9:
- TCP keep* timers
- TCP UTO (adjust from what was there already)
- netmap
- route caching
- user cookie (temporary to allow for the real fix)

Slightly re-shuffle struct ifnet moving fields out of the middle
of spares and to better align.

Discussed with:	rwatson (slightly earlier version)
2011-07-17 21:15:20 +00:00
Bjoern A. Zeeb
dceced71fb Unbreak no-INET kernels after r223839 adding the needed #ifdef INET.
MFC after:	4 weeks
2011-07-14 13:44:48 +00:00
Michael Tuexen
1a3b5ce2b9 Don't check for SOCK_DGRAM anymore. Also remove multicast
related code which is not necessary anymore.
2011-07-12 20:14:03 +00:00
Michael Tuexen
78d9a31d3a The socket API only specifies SCTP for SOCK_SEQPACKET and
SOCK_STREAM, but not SOCK_DGRAM. So don't register it for
SOCK_DGRAM.
While there, fix some indentation.
2011-07-12 19:29:29 +00:00
Marko Zec
13e255fab7 Permit ARP to proceed for IPv4 host routes for which the gateway is the
same as the host address.  This already works fine for INET6 and ND6.

While here, remove two function pointers from struct lltable which are
only initialized but never used.

MFC after:	3 days
2011-07-08 09:38:33 +00:00
Andrey V. Elsukov
4659e09dcb Add again the checking for log_arp_permanent_modify that was by accident
removed in the r186119.

PR:		kern/154831
MFC after:	1 week
2011-07-07 11:59:51 +00:00
Andre Oppermann
1c6e7fa7f1 Remove the TCP_SORECEIVE_STREAM compile time option. The use of
soreceive_stream() for TCP still has to be enabled with the loader
tuneable net.inet.tcp.soreceive_stream.

Suggested by:	trociny and others
2011-07-07 10:37:14 +00:00
Colin Percival
472ea5befb Remove #ifdef notyet code dating back to 4.3BSD Net/2 (and possibly earlier).
I think the benefit of making the code cleaner and easier to understand
outweighs the humour of leaving this intact (or possibly changing it to
#ifdef not_yet_and_probably_never).

MFC after:	2 weeks
2011-07-05 18:49:55 +00:00
Colin Percival
ca7122622b Don't allow lro->len to exceed 65535, as this will result in overflow
when len is inserted back into the synthetic IP packet and cause a
multiple of 2^16 bytes of TCP "packet loss".

This improves Linux->FreeBSD netperf bandwidth by a factor of 300 in
testing on Amazon EC2.

Reviewed by:	jfv
MFC after:	2 weeks
2011-07-05 18:43:54 +00:00
Glen Barber
ff19f85d50 - General grammar and mdoc(7) fixes. [1] [2]
- While here, remove a paragraph about userspace operation that
  has been outdated for some time. [2]

PR:		158623
Submitted by:	Ben Kudak (kaduk % mit!edu) [1]
Reviewed by:	glebius [2]
MFC after:	1 week
2011-07-04 23:00:26 +00:00
Ermal Luçi
e6c90582c7 pf(4) tags now store the state key but tcp_respond tries to reuse a mbuf as an optimization.
This makes pf find the wrong state and cause errors reported with state mismatches.
Clear the cached state link on the pf(4) tag to avoid the state mismatches.

Approved by:	bz
2011-07-04 17:43:04 +00:00