61908 Commits

Author SHA1 Message Date
Paolo Pisati
61c0e134f5 Wrap ipfw nat support in a new kernel config option named
"IPFIREWALL_NAT": this way nat is turned off by default and
POLA is preserved.

Reviewed by: rwatson
2007-01-03 11:12:54 +00:00
Luigi Rizzo
d64492c407 protect against multiple inclusion (this is useful when you
start working with third party usb modules, where sometimes it
is not easy to set the inclusion order so that there are no multiple
inclusions, yet you want to compile with high WARNS levels).

I am not sure if there is a standard for having a leading and/or trailing _
in the macro name, the usb code seems to use both.

There are still several unprotected headers here so it might be useful
to do the same thing on other files as well as the need arises.

MFC After: 3 days
2007-01-03 10:50:03 +00:00
Jeff Roberson
b1c00b13d6 - Fix schedgraph output with KSE threads. Call thread_switchout() after
calling CTR() so we don't confuse a new kse thread with a real preemption.
2007-01-03 02:38:41 +00:00
Hiroki Sato
9235ff6373 The nfsm_srvpathsiz() macro in nfsrv_symlink() in nfs_serv.c should
check length of the pathname in the range 0<=n<=NFS_MAXPATHLEN,
not 0<n<=NFS_MAXPATHLEN.  This fixes a minor interoperability problem
that the FreeBSD NFS server did not allow a symlink pointing the empty
pathname.

MFC after:	1 week
2007-01-02 20:42:08 +00:00
Julian Elischer
3b62120e87 Remove a bunch of dependencies in the IP header being the first thing in the
mbuf. First moves toward being able to cope better with having layer 2 (or
other encapsulation data) before the IP header in the packet being examined.
More commits to come to round out this functionality. This commit should
have no practical effect but clears the way for what is coming.
Revirewed by: luigi, yar
MFC After: 2 weeks
2007-01-02 19:57:31 +00:00
John Baldwin
b082761327 Use the vnode interlock to close a race where pfs_vncache_alloc() could
attempt to vn_lock() a destroyed vnode resulting in a hang.

MFC after:	1 week
Submitted by:	ups
Reviewed by:	des
2007-01-02 17:27:52 +00:00
David Xu
fe1a9506fa Fix compiling. 2007-01-02 04:14:01 +00:00
Scott Long
a91d6dab2e Make sure that all of the fields in the header are clean. It was possible for
unsafe flags to leak from one command to another.
2007-01-02 04:12:34 +00:00
Christian S.J. Peron
8d8d78c23d style(9) nit. Prefer struct[space]name[space]{ to make grep searches more
in line with that we find in the rest of the tree.
2007-01-01 21:49:39 +00:00
Max Laier
191c6e1310 Clean up pfr_kentry_pl2 as well. This fixes a kernel panic in the vm.zone
sysctl after unloading pf.

Submitted by:	Earl Lapus
MFC after:	3 days
2007-01-01 16:51:11 +00:00
Xin LI
59038483f5 Fix amd64 build.
Submitted by:	Divacky Roman <xdivac02 stud fit vutbr cz>
2007-01-01 14:47:45 +00:00
Christian S.J. Peron
17870c0627 Teach the stub policy about some of the more recent entry points that have
been introduced to the MAC framework:

mpo_associate_nfsd_label
mpo_create_mbuf_from_firewall
mpo_check_system_nfsd
mpo_check_vnode_mmap_downgrade
mpo_check_vnode_mprotect
mpo_init_syncache_label
mpo_destroy_syncache_label
mpo_init_syncache_from_inpcb
mpo_create_mbuf_from_syncache

MFC after:	2 weeks [1]

[1] The syncache related entry points will NOT be MFCed as the changes in
    the syncache subsystem are not present in RELENG_6 yet.
2007-01-01 01:47:18 +00:00
Christian S.J. Peron
22a0de89ff Remove conditional return of 1. For the MAC_STATIC case at this point in
the code, one being returned is invariant.

Discussed with:	rwatson
MFC after:	1 week
2007-01-01 01:40:29 +00:00
Warner Losh
e79c6a301d MFp4: Fix bit name for SPI SR register 2007-01-01 00:50:25 +00:00
Warner Losh
5434a91804 MFp4: Remove watchdog timeout that appears to be unused. 2007-01-01 00:48:25 +00:00
Warner Losh
c36172be39 Merge from FreeBSD-tsf-6 by way of p4:
correct values for PIO registers

	submitted by: patrick schweiger
2007-01-01 00:46:54 +00:00
Warner Losh
6796a2d434 Fix typo in comment.
Submitted by: remko
2007-01-01 00:35:34 +00:00
Warner Losh
74eb3236c7 Add comment about udp checksums being off in BSD 4.2 compatibility mode.
Submitted by: Dr. Markus Waldeck
PR: kern/106657
2006-12-31 21:34:53 +00:00
Robert Watson
989d409801 Only signal the CV indicating that the MAC Framework is available for
exclusive access if there is at least one thread waiting for it to
become available.  This may significantly reduce overhead by reducing
the number of unnecessary wakeups issued whenever the framework becomes
idle.

Annotate that we still signal the CV more than necessary and should
fix this.

Obtained from:	TrustedBSD Project
Reviewed by:	csjp
Tested by:	csjp
2006-12-31 20:26:20 +00:00
John-Mark Gurney
5afbb3a8b1 remove delays that have been unnecessary since 2002... The iicbb driver
has the proper delays...
2006-12-31 19:42:47 +00:00
Xin LI
0660f55828 Welcome to 2007 2006-12-31 16:35:29 +00:00
Robert Watson
2da78e3862 Prefer a more traditional spelling of inhibited in comments and panic
messages.
2006-12-31 15:56:04 +00:00
Alexander Leidinger
99e9dcf022 regen after addition of linux_utimes and linux_rt_sigtimedwait 2006-12-31 13:20:31 +00:00
Alexander Leidinger
c9447c7551 MFp4 (111746, 108671, 108945, 112352):
- add linux utimes syscall [1]
 - add linux rt_sigtimedwait syscall [2]

Submitted by:	"Scot Hetzel" <swhetzel@gmail.com> [1]
Submitted by:	Bruce Becker <hostmaster@whois.gts.net> [2]
PR:		93199 [2]
2006-12-31 13:16:00 +00:00
Alexander Leidinger
a628609ee9 MFp4:
- semi-automatic style fixes
2006-12-31 12:42:55 +00:00
Alexander Leidinger
9ce8f9bcdd MFp4 (111746+):
Redo the checking for 2.6 emulation. We now cache the value of
  use26 and replace calls to linux_get_osrelease() + parsing with
  a call to linux_use26(). Typical path is lockless now.

  Pointed out by: kib

This allows to ship RELENG_7_0 with a default osrelease of 2.4.2 and the
possibility to enable 2.6.x emulation without the possible performance
impact of the previous version of the check.

Submitted by:	rdivacky
2006-12-31 12:39:10 +00:00
Alexander Leidinger
ef95cfeab9 MFp4:
- semi-automatic style fixes
 - spelling fixes in comments
 - add some comments
2006-12-31 11:56:16 +00:00
Christian S.J. Peron
90339ccb12 Invert the logic inside of two KASSERTS which resulted in two kernel panics
for circumstances which are quite normal.

Discussed with:	kmacy
2006-12-31 02:50:07 +00:00
Yaroslav Tykhiy
2dc879b337 - Don't defer the removal of an 802.1q header for no real reason.
- Micro-optimize the addition of an 802.1q header to match the removal code.
- Consistently check for interfaces being up and running.
- Consistently use NULL instead of 0 with pointers.
2006-12-30 21:10:25 +00:00
John-Mark Gurney
83616b3aff now that MFS_IMAGE is in the FULLKERNEL section, use FULLKERNEL instead of
KERNEL_KO, this fixes MFS_IMAGE on a debugging kernel...

Submitted by:	Neelkanth Natu
2006-12-30 20:27:24 +00:00
John Baldwin
54e3607de6 Whitespace fix and remove an extra cast. 2006-12-30 17:53:28 +00:00
Ceri Davies
18929073b9 Be consistent with the spelling of "dependent" in user-visible places.
PR:		kern/27429
Submitted by:	T. William Wells
2006-12-30 11:55:47 +00:00
Paolo Pisati
ff2f6fe80f Summer of Code 2005: improve libalias - part 2 of 2
With the second (and last) part of my previous Summer of Code work, we get:

-ipfw's in kernel nat

-redirect_* and LSNAT support

General information about nat syntax and some examples are available
in the ipfw (8) man page. The redirect and LSNAT syntax are identical
to natd, so please refer to natd (8) man page.

To enable in kernel nat in rc.conf, two options were added:

o firewall_nat_enable: equivalent to natd_enable

o firewall_nat_interface: equivalent to natd_interface

Remember to set net.inet.ip.fw.one_pass to 0, if you want the packet
to continue being checked by the firewall ruleset after being
(de)aliased.

NOTA BENE: due to some problems with libalias architecture, in kernel
nat won't work with TSO enabled nic, thus you have to disable TSO via
ifconfig (ifconfig foo0 -tso).

Approved by: glebius (mentor)
2006-12-29 21:59:17 +00:00
Randall Stewart
139bc87fda a) macro-ization of all mbuf and random number
access plus timers. This makes the code
   more portable and able to change out the
   mbuf or timer system used more easily ;-)
b) removal of all use of pkt-hdr's until only
   the places we need them (before ip_output routines).
c) remove a bunch of code not needed due to <b> aka
   worrying about pkthdr's :-)
d) There was one last reorder problem it looks where
   if a restart occur's and we release and relock (at
   the point where we setup our alias vtag) we would
   end up possibly getting the wrong TSN in place. The
   code that fixed the TSN's just needed to be shifted
   around BEFORE the release of the lock.. also code that
   set the state (since this also could contribute).
Approved by:	gnn
2006-12-29 20:21:42 +00:00
Robert Watson
c441d123ef Slightly resort functions in file so that no forward function prototypes
are required.

Obtained from:	TrustedBSD Project
2006-12-29 20:21:21 +00:00
Robert Watson
39b73a30c0 Re-add include of opt_mac.h in mac_framework.c, which was improperly
removed from this file.  It is required to pick up the definition of
MAC_STATIC.
2006-12-29 20:16:29 +00:00
John Baldwin
5583491044 Fix fat-fingering in previous commit.
Pointy hat to:	jhb
2006-12-29 16:38:22 +00:00
Bruce Evans
0b194ec872 Fix oops in previous commit. 2006-12-29 15:48:18 +00:00
Bruce Evans
f28e1c8f99 Fixed some style bugs (mainly assorted errors in comments, and inconsistent
spelling of `result').
2006-12-29 15:29:49 +00:00
John Baldwin
08651e1f24 Some whitespace nits and remove a few casts. 2006-12-29 14:58:18 +00:00
Bruce Evans
6c296ffa81 Fixed some style bugs (whitespace only). 2006-12-29 14:28:23 +00:00
John Baldwin
0dea849ae9 Various bpf(4) related fixes to catch places up to the new bpf(4)
semantics.
- Stop testing bpf pointers for NULL.  In some cases use
  bpf_peers_present() and then call the function directly inside the
  conditional block instead of the macro.
- For places where the entire conditional block is the macro, remove the
  test and make the macro unconditional.
- Use BPF_MTAP() in if_pfsync on FreeBSD instead of an expanded version of
  the old semantics.

Reviewed by:	csjp (older version)
2006-12-29 13:59:50 +00:00
Max Laier
240589a9fe Work around a long standing LOR with user/group rules by doing the socket
lookup early.  This has some performance implications and should not be
enabled by default, but might help greatly in certain setups.  After some
more testing this could be turned into a sysctl.

Tested by:	avatar
LOR ids:	17, 24, 32, 46, 191 (conceptual)
MFC after:	6 weeks
2006-12-29 13:59:03 +00:00
Bruce Evans
7e4277e591 Try harder to garbage-collect the "LOCORE" (really asm) version of
MPLOCKED.  The cleaning in rev.1.25 was supposed to have been undone
by rev.1.26, but 1.26 could never have actually affected asm files
since atomic.h is full of C declarations so including it in asm files
would just give syntax errors.  The asm MPLOCKED is even less needed
than when misplaced definitions of it were first removed, and is now
unused in any asm file in the src tree except in anachronismns in
sys/i386/i386/support.s.
2006-12-29 13:36:26 +00:00
Gleb Smirnoff
9e6f1d3be4 Build bits for ng_deflate(4) and ng_pred1(4). 2006-12-29 13:16:43 +00:00
Yaroslav Tykhiy
9b3d1b0253 Fix a group of typos:
preceed -> precede,
preceeded -> preceded,
preceeding -> preceding.

Submitted by:	Andre Guibert de Bruet <andy@siliconlandmark.com>
2006-12-29 13:08:46 +00:00
Jeff Roberson
c02bbb43a0 - More search and replace prettying. 2006-12-29 12:55:32 +00:00
Robert Watson
4cfbab605a Remove two XXX comments that no longer apply.
Obtained from:	TrustedBSD Project
2006-12-29 11:03:44 +00:00
Robert Watson
aa6fe97ca3 Use p_cansee() to check that a target process for an audit state
manipulation is visible to the subject process.  Remove XXX comments
suggesting this.

Convert one XXX on a difference from Darwin into a note: it's not a
bug, it's a feature.

Obtained from:	TrustedBSD Project
2006-12-29 10:49:13 +00:00
Robert Watson
dc97e8c70a Add a witness sleep warning to canon_path(), which invokes vput() and hence
may perform an unbounded sleep.  Remove an XXX comment suggesting that one
be added.

Obtained from:	TrustedBSD Project
2006-12-29 10:37:32 +00:00