sys: Minor fixes to some comments

sys: Minor code cleanups

No functional changes.

stf(4): Set ND6 flags to disable auto link-local and DAD

Clear the 'ND6_IFF_AUTO_LINKLOCAL' flag and set the 'ND6_IFF_NO_DAD'
flag for the stf(4) interface after if_attach(). In this way, the
quirk

stf(4): Set ND6 flags to disable auto link-local and DAD

Clear the 'ND6_IFF_AUTO_LINKLOCAL' flag and set the 'ND6_IFF_NO_DAD'
flag for the stf(4) interface after if_attach(). In this way, the
quirks in in6_ifattach() is removed.

show more ...

netinet6: Improve in6if_do_dad() by checking IFF_MULTICAST

DAD requires multicast support.

Obtained from FreeBSD.

netinet6: Add per-interface flag ND6_IFF_NO_DAD flag to disable DAD

An interface that has no link-local address should also have DAD
disabled. So this flag is generally set for an interface that ha

netinet6: Add per-interface flag ND6_IFF_NO_DAD flag to disable DAD

An interface that has no link-local address should also have DAD
disabled. So this flag is generally set for an interface that has the
ND6_IFF_AUTO_LINKLOCAL flag cleared.

Derived from FreeBSD.

show more ...

netinet6: Remove nonexistent IFT_DUMMY from in6if_do_dad()

Meanwhile, fix typos in the comment.

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restricti

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restrictions
are inherited by sub-processes recursively. Once set, restrictions cannot
be removed.

Basic restrictions that mimic an unadorned jail can be enabled without
creating a jail, but generally speaking real security also requires
creating a chrooted filesystem topology, and a jail is still needed
to really segregate processes from each other. If you do so, however,
you can (for example) disable mount/umount and most global root-only
features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
improve jailess security in the near future, and to optimize the
priv_check code.

show more ...

inet6: Support the ioctl SIOCSIFINFO_IN6

This allows setting hop limit, reachable and retransmit times,
as well as link mtu for the interface.
It's analogous to the SIOCGIFINFO_IN6 ioctl.

Taken fro

inet6: Support the ioctl SIOCSIFINFO_IN6

This allows setting hop limit, reachable and retransmit times,
as well as link mtu for the interface.
It's analogous to the SIOCGIFINFO_IN6 ioctl.

Taken from NetBSD.

show more ...

inet: hookup in6_if_down with rt_purgecloned

route: Remove ref counting around rt_newaddrmsg().

Doesn't seem to be needed anymore.
As proposed by sephe.

inet6: Take route reference before announcing address

This mirrors the behaviour in rtinit_rtrequest_callback.

inet6: emit RTM_NEWADDR messages on address flag changes.

We no longer emit RTM_NEWADDR right away when adding a new address
and starting DAD. Instead the result of the DAD will be emitted.

Some mi

inet6: emit RTM_NEWADDR messages on address flag changes.

We no longer emit RTM_NEWADDR right away when adding a new address
and starting DAD. Instead the result of the DAD will be emitted.

Some minor fixes from NetBSD are also brought in, such as
starting DAD when addresses are no longer detached and the
tentative state not being added when address lifetime is
extended.

Taken-from: NetBSD
Reviewed-by: sephe

show more ...

Remove faith(4) and faithd(8) from the tree.

FreeBSD did that 3 years ago (r274331). Quoting from their commit msg:

-----8<-----
It looks like industry have chosen different (and more traditional)

Remove faith(4) and faithd(8) from the tree.

FreeBSD did that 3 years ago (r274331). Quoting from their commit msg:

-----8<-----
It looks like industry have chosen different (and more traditional)
stateless/stateful NAT64 as translation mechanism. Last non-trivial
commits to both faith(4) and faithd(8) happened more than 12 years
ago, so I assume it is time to drop RFC3142 in FreeBSD.
----->8-----

Some more info here:

https://lists.freebsd.org/pipermail/freebsd-net/2014-October/040224.html

Discussed-with: sephe

show more ...

netisr: Simplify assertion related bits

inet6: Change scope to zone and use in6_clearscope() whenever possible

Obtained-from: KAME via FreeBSD

inet6: Fix linkmtu handling

While I'm here, minor white space cleanup and remove unused code.

Obtained-from: KAME via FreeBSD

inet6: Nuke duplicated function and unused function

Obtained-from: KAME via FreeBSD

net: Factor out ASSERT_IN_NETISR and ASSERT_IS_NETISR

mcast: Use M_INTWAIT for multicast addresses allocation

ifaddr: Use M_INTWAIT for ifaddr allocation

Suggested-by: dillon@

inet6: No need to explicitly avoid calling ioctl(SIOCSADDR)

Rearrange the code a little bit.

inet6: Use M_WAITOK on SIOCAIFADDR_IN6 path.

Addition:
- Use M_ZERO, instead of calling bzero().
- Avoid M_ZERO, if the allocated memory is to be completely over-
written.
- Remove unapplied comme

inet6: Use M_WAITOK on SIOCAIFADDR_IN6 path.

Addition:
- Use M_ZERO, instead of calling bzero().
- Avoid M_ZERO, if the allocated memory is to be completely over-
written.
- Remove unapplied comment.

show more ...

kern: Fix [-Werror=logical-not-parenthesis]

Since the whole point of this error is that logic order can be
ambiguous, I'm not 100% sure confident in these fixes, but they are
required to get the ker

kern: Fix [-Werror=logical-not-parenthesis]

Since the whole point of this error is that logic order can be
ambiguous, I'm not 100% sure confident in these fixes, but they are
required to get the kernel to build with gcc 5.0.

show more ...

ifnet: Make ifnet and ifindex2ifnet MPSAFE

- Accessing to these two global variables from non-netisr threads uses
ifnet lock. This kind of accessing is from
- Accessing to ifindex2ifnet from neti

ifnet: Make ifnet and ifindex2ifnet MPSAFE

- Accessing to these two global variables from non-netisr threads uses
ifnet lock. This kind of accessing is from
- Accessing to ifindex2ifnet from netisrs are lockless MPSAFE.
- Netisrs no longer access ifnet, instead they access ifnet array as of
this commit, which is lockless MPSAFE.

Rules for accessing ifnet and ifindex2ifnet is commented near the
declaration of the related global variables/functions in net/if_var.h.

show more ...

inet6: Dispatch nd6_setmtu0 to netisr0 to run

This function now access ifnet global variable in netisr.