Remove svn:mergeinfo from the releng/10.0 branch.

After branch creation from stable/10, the stable/10 branch mergeinfo
was moved to the root of the branch.

Since there have not been any merges from stable/10 to releng/10.0
yet, we do not need to track any of the existing mergeinfo here.

Merges to releng/10.0 should now be done to the root of the branch.

For future branches during the release cycle, unless otherwise noted,
this change will be done as part of the stable/ and releng/ branch
creation.

Discussed with: peter
Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Change the cap_rights_t type from uint64_t to a structure that we can extend
in the future in a backward compatible (API and ABI) way.

The cap_rights_t represents capability rights. We used to use one bit to
represent one right, but we are running out of spare bits. Currently the new
structure provides place for 114 rights (so 50 more than the previous
cap_rights_t), but it is possible to grow the structure to hold at least 285
rights, although we can make it even larger if 285 rights won't be enough.

The structure definition looks like this:

struct cap_rights {
uint64_t cr_rights[CAP_RIGHTS_VERSION + 2];
};

The initial CAP_RIGHTS_VERSION is 0.

The top two bits in the first element of the cr_rights[] array contain total
number of elements in the array - 2. This means if those two bits are equal to
0, we have 2 array elements.

The top two bits in all remaining array elements should be 0.
The next five bits in all array elements contain array index. Only one bit is
used and bit position in this five-bits range defines array index. This means
there can be at most five array elements in the future.

To define new right the CAPRIGHT() macro must be used. The macro takes two
arguments - an array index and a bit to set, eg.

#define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL)

We still support aliases that combine few rights, but the rights have to belong
to the same array element, eg:

#define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL)
#define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL)

#define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP)

There is new API to manage the new cap_rights_t structure:

cap_rights_t *cap_rights_init(cap_rights_t *rights, ...);
void cap_rights_set(cap_rights_t *rights, ...);
void cap_rights_clear(cap_rights_t *rights, ...);
bool cap_rights_is_set(const cap_rights_t *rights, ...);

bool cap_rights_is_valid(const cap_rights_t *rights);
void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little);

Capability rights to the cap_rights_init(), cap_rights_set(),
cap_rights_clear() and cap_rights_is_set() functions are provided by
separating them with commas, eg:

cap_rights_t rights;

cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT);

There is no need to terminate the list of rights, as those functions are
actually macros that take care of the termination, eg:

#define cap_rights_set(rights, ...) \
__cap_rights_set((rights), __VA_ARGS__, 0ULL)
void __cap_rights_set(cap_rights_t *rights, ...);

Thanks to using one bit as an array index we can assert in those functions that
there are no two rights belonging to different array elements provided
together. For example this is illegal and will be detected, because CAP_LOOKUP
belongs to element 0 and CAP_PDKILL to element 1:

cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL);

Providing several rights that belongs to the same array's element this way is
correct, but is not advised. It should only be used for aliases definition.

This commit also breaks compatibility with some existing Capsicum system calls,
but I see no other way to do that. This should be fine as Capsicum is still
experimental and this change is not going to 9.x.

Sponsored by: The FreeBSD Foundation

When using tcpdump -I -i wlanN and wlanN is not a monitor mode VAP,
tcpdump will print an error message saying rfmon is not supported.
Give a concise explanation as to how one might solve this problem by
creating a monitor mode VAP.

Sandbox tcpdump(8) using Capsicum's capability mode and capabilities.
For now, sandboxing is done only if -n option was specified and neither -z nor
-V options were given. Because it is very common to run tcpdump(8) with the -n
option for speed, I decided to commit sandboxing now. To also support
sandboxing when -n option wasn't specified, we need Casper daemon and its
services that are not available in FreeBSD yet.

- Limit file descriptors of a file specified by -r option or files specified
via -V option to CAP_READ only.

- If neither -r nor -V options were specified, we operate on /dev/bpf.
Limit its descriptor to CAP_READ and CAP_IOCTL plus limit allowed ioctls to
BIOCGSTATS only.

- Limit file descriptor of a file specified by -w option to CAP_SEEK and
CAP_WRITE.

- If either -C or -G options were specified, we open directory containing
destination file and we limit directory descriptor to CAP_CREATE, CAP_FCNTL,
CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK and CAP_WRITE. Newly opened/created
files are limited to CAP_SEEK and CAP_WRITE only.

- Enter capability mode if -n option was specified and neither -z nor -V
options were specified.

Approved by: delphij, wxs
Sponsored by: The FreeBSD Foundation

MFV: Redo the fixup using the submitted version accepted by upstream.

Diff reduction against tcpdump revision 949a22064d3534eddeb8aa2b9c36a50e45fe16fa.

MFV: tcpdump 4.4.0.

MFC after: 4 weeks

Clean some 'svn:executable' properties in the tree.

Submitted by: Christoph Mallon
MFC after: 3 days

Clean up hardcoded ar(1) flags in the tree to use the global ARFLAGS in
share/mk/sys.mk instead.

This is part of a medium term project to permit deterministic builds of
FreeBSD.

Submitted by: Erik Cederstrand <erik@cederstrand.dk>
Reviewed by: imp, toolchain@
Approved by: cperciva
MFC after: 2 weeks

MFV: tcpdump 4.3.0.

MFC after: 4 weeks

Provide ability for printing and decoding pfsync(4) traffic. This
doesn't mean supporting IFT_PFSYNC (which I hope will eventually
die). This means decoding packets with IP protocol of 240 caught
on any normal interface like Ethernet.

The code is based on couple of files from OpenBSD, significantly
modified by myself.

Parser differentiates for four levels of verbosity: no -v, -v,
-vv and -vvv.

We don't yet forward this code upstream, because currently it
strongly relies on if_pfsync.h and even on pfvar.h. I hope that
this can be fixed in future.

Reviewed by: gnn, delphij

Merge tcpdump 4.2.1.

MFC after: 2 weeks

Fix incorrect uses of sizeof().

The details of the fix can be found in the tcpdump git repository:
commit 684955d58611ee94eccdc34e82b32e676337188c

In contrib/tcpdump/print-icmp6.c, fix a problem where the comparison
against icmp6_hdr::icmp6_type is done incorrectly. (This fix has
already been applied upstream, but we do not have the latest version of
tcpdump.)

MFC after: 1 week

With retirement of cpumask_t and usage of cpuset_t for representing a
mask of CPUs, pc_other_cpus and pc_cpumask become highly inefficient.

Remove them and replace their usage with custom pc_cpuid magic (as,
atm, pc_cpumask can be easilly represented by (1 << pc_cpuid) and
pc_other_cpus by (all_cpus & ~(1 << pc_cpuid))).

This change is not targeted for MFC because of struct pcpu members
removal and dependency by cpumask_t retirement.

MD review by: marcel, marius, alc
Tested by: pluknet
MD testing by: marcel, marius, gonzo, andreast

etire the cpumask_t type and replace it with cpuset_t usage.

This is intended to fix the bug where cpu mask objects are
capped to 32. MAXCPU, then, can now arbitrarely bumped to whatever
value. Anyway, as long as several structures in the kernel are
statically allocated and sized as MAXCPU, it is suggested to keep it
as low as possible for the time being.

Technical notes on this commit itself:
- More functions to handle with cpuset_t objects are introduced.
The most notable are cpusetobj_ffs() (which calculates a ffs(3)
for a cpuset_t object), cpusetobj_strprint() (which prepares a string
representing a cpuset_t object) and cpusetobj_strscan() (which
creates a valid cpuset_t starting from a string representation).
- pc_cpumask and pc_other_cpus are target to be removed soon.
With the moving from cpumask_t to cpuset_t they are now inefficient
and not really useful. Anyway, for the time being, please note that
access to pcpu datas is protected by sched_pin() in order to avoid
migrating the CPU while reading more than one (possible) word
- Please note that size of cpuset_t objects may differ between kernel
and userland. While this is not directly related to the patch itself,
it is good to understand that concept and possibly use the patch
as a reference on how to deal with cpuset_t objects in userland, when
accessing kernland members.
- KTR_CPUMASK is changed and now is represented through a string, to be
set as the example reported in NOTES.

Please additively note that no MAXCPU is bumped in this patch, but
private testing has been done until to MAXCPU=128 on a real 8x8x2(htt)
machine (amd64).

Please note that the FreeBSD version is not yet bumped because of
the upcoming pcpu changes. However, note that this patch is not
targeted for MFC.

People to thank for the time spent on this patch:
- sbruno, pluknet and Nicholas Esborn (nick AT desert DOT net) tested
several revision of the patches and really helped in improving
stability of this work.
- marius fixed several bugs in the sparc64 implementation and reviewed
patches related to ktr.
- jeff and jhb discussed the basic approach followed.
- kib and marcel made targeted review on some specific part of the
patch.
- marius, art, nwhitehorn and andreast reviewed MD specific part of
the patch.
- marius, andreast, gonzo, nwhitehorn and jceel tested MD specific
implementations of the patch.
- Other people have made contributions on other patches that have been
already committed and have been listed separately.

Companies that should be mentioned for having participated at several
degrees:
- Yahoo! for having offered the machines used for testing on big
count of CPUs.
- The FreeBSD Foundation for having sponsored my devsummit attendance,
which has been instrumental.
- Sandvine for having offered offices and infrastructure during
development.

(I really hope I didn't forget anyone, if it happened I apologize in
advance).

Remove useless stuff.

Merge tcpdump-4.1.1.

Merger of the quota64 project into head.

This joint work of Dag-Erling Smørgrav and myself updates the
FFS quota system to support both traditional 32-bit and new 64-bit
quotas (for those of you who want to put 2+Tb quotas on your users).

By default quotas are not compiled into the kernel. To include them
in your kernel configuration you need to specify:

options QUOTA # Enable FFS quotas

If you are already running with the current 32-bit quotas, they
should continue to work just as they have in the past. If you
wish to convert to using 64-bit quotas, use `quotacheck -c 64';
if you wish to revert from 64-bit quotas back to 32-bit quotas,
use `quotacheck -c 32'.

There is a new library of functions to simplify the use of the
quota system, do `man quotafile' for details. If your application
is currently using the quotactl(2), it is highly recommended that
you convert your application to use the quotafile interface.
Note that existing binaries will continue to work.

Special thanks to John Kozubik of rsync.net for getting me
interested in pursuing 64-bit quota support and for funding
part of my development time on this project.

Add parsing code for TCP UTO (User Timeout Option).

Submitted by: fangwang@
Obtained from: //depot/projects/soc2009/tcputo/

correct IEEE80211_RADIOTAP_XCHANNEL to match system

Submitted by: Guy Harris
Approved by: re (kib)

Updates, mostly to add 802.11s support:
o add missing Status and Reason codes
o parse/display Action frames
o parse/display Mesh data frames
o parse/display BA frames

Reviewed by: rpaulo
Approved by: re (kib)

Expand $FreeBSD$

Fix WITHOUT_IPV6=yes build.

Reported by: Andrzej Tobola ato at iem.pw.edu.pl

Add svn:keywords.

Merge tcpdump 4.0.0 from the vendor branch.

Fix incorrect path of the svn:mergeinfo property.

Fix a path.

Exclude list for tcpdump imports.

Bootstrap mergeinfo.

unbreak printing 802.11 tx/rx rates

MFC after: 3 days

Avoid excessive error message printout.

PR: bin/118150
Reported by: keramida
MFC after: 3 days

Resolve merge conflicts

Approved by: re (kensmith)
Obtained from: tcpdump.org

This commit was generated by cvs2svn to compensate for changes in r172683,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r171682,
which included commits to RCS files with non-trunk default branches.

o add minimal radiotap support for 11n

This commit was generated by cvs2svn to compensate for changes in r168371,
which included commits to RCS files with non-trunk default branches.

resolve merge conflicts

MFC after: 1 month

This commit was generated by cvs2svn to compensate for changes in r162017,
which included commits to RCS files with non-trunk default branches.

Document that 'bad cksum 0' is expected on NICs with checksum off-loading.

This commit was generated by cvs2svn to compensate for changes in r152390,
which included commits to RCS files with non-trunk default branches.

resolve merge conflicts

Approved by: re (scottl)

This commit was generated by cvs2svn to compensate for changes in r147899,
which included commits to RCS files with non-trunk default branches.

pullup security fix on vendor branch

This commit was generated by cvs2svn to compensate for changes in r147173,
which included commits to RCS files with non-trunk default branches.

resolve merge conflicts and update for proper build; including:

o print-fr.c returned to code on vendor branch
o remove pmap_prot.h include from print-sunrprc.c
o remove gcc/i386-specific ntoh* write-arounds from tcpdump-stdinc.h

Reviewed by: bms

This commit was generated by cvs2svn to compensate for changes in r146775,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r146773,
which included commits to RCS files with non-trunk default branches.

Fix NULL pointer dereference bug when parsing IPV6CP traffic.
This file is already off the vendor branch, and the fix will be
in future tcpdump.org vendor branch imports.

PR: bin/76497
MFC after: 1 week
Obtained from: tcpdump.org rev 1.89.2.4
Discussed with: fenner, keramida

Merge of tcpdump 3.8.3 from tcpdump.org, with the following caveats:

print-atm.c no longer performs special handling for FORE headers; these
can no doubt be re-added at a later date.

print-fr.c is effectively a no-op.

print-llc.c has had the default_print_unaligned() call removed as
tcpdump no longer defines this function, however the prototype is still
present. Suggest we roll in a diff to use print_unknown_data().

This commit was generated by cvs2svn to compensate for changes in r127668,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r124488,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r124486,
which included commits to RCS files with non-trunk default branches.

Merge tcpdump 3.7.2

This commit was generated by cvs2svn to compensate for changes in r111726,
which included commits to RCS files with non-trunk default branches.

Merge Multi-DLT support.

This commit was generated by cvs2svn to compensate for changes in r109839,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r108968,
which included commits to RCS files with non-trunk default branches.

Remove cruft.

Merge tcpdump 3.7.1

MFC after: 2 weeks

This commit was generated by cvs2svn to compensate for changes in r98524,
which included commits to RCS files with non-trunk default branches.

In TTEST2(), check to make sure the "l" argument isn't so large that
"snapend - l" underflows; this fixes a buffer overflow with malformed
NFS packets, and may fix other buffer overflows with malformed packets.

Obtained from: tcpdump.org CVS

Quick hack to print out the non-standard pppoe used by 3com

Merge tcpdump 3.6.3

This commit was generated by cvs2svn to compensate for changes in r80231,
which included commits to RCS files with non-trunk default branches.

This commit was generated by cvs2svn to compensate for changes in r75147,
which included commits to RCS files with non-trunk default branches.

Merge tcpdump 3.6.2

This commit was generated by cvs2svn to compensate for changes in r75115,
which included commits to RCS files with non-trunk default branches.

* Buffer-safe string function cleanup. There are a couple of strcpy()
and strcat()s which would be more difficult to fix, but I think they're
safe anyway.
* Don't crash at runtime by overflowing a buffer with constant data in
print-icmp.c on a long hostname.
* Don't overflow a static buffer by trying to decode an AFS ACL into a buffer
which is way too small for it.

Reviewed by: -audit

Include ip6.h from <netinet/>, not <netinet6/>.

Submitted by: Yoshinobu Inoue <shin@nd.net.fujitsu.co.jp>
Approved by: jkh

Fix nybble-order bug in PIM printer.

Approved by: jkh

Merge tcpdump 3.5

This commit was generated by cvs2svn to compensate for changes in r56893,
which included commits to RCS files with non-trunk default branches.

Document the -X flag.

Add the -X flag to dump the buffer in "emacs-hexl" style,
that is, with ASCII character decoding.

Obtained from: OpenBSD

Pass the pppoe packets into do_ppp_print correctly.

Support PPPoE.
Add a missing comma to the lcp config options table.

Add source routing support.

World, I'd like you to meet the first FreeBSD token Ring driver.
This is for various Olicom cards. An IBM driver is following.
This patch also adds support to tcpdump to decode packets on tokenring.
Congratulations to the proud father.. (below)

Submitted by: Larry Lile <lile@stdio.com>

Remove bogus reference.

PR: docs/8430
Submitted by: jkb

PR: 8429
Submitted by: jkb@FreeBSD.ORG
correct typo in example

Merge tcpdump 3.4

PR: bin/7877

This commit was generated by cvs2svn to compensate for changes in r39297,
which included commits to RCS files with non-trunk default branches.

PR: 7741
Submitted by: Hellmuth Michaelis <hm@kts.org>
add LCP/PAP/CHAP/IPCP frame printing functionality

Zap the T_UID,T_GID and T_UINFO stuff, it doesn't exist in the bind8
headers. As I understand it, it was for some really ancient athena stuff
that has long been replaced.

Handle frame relay, decode ATM VP/VC info, and handle ISO over FR.

Add frame-relay decode support.

This is a hack. Decode IEEE 802.1Q VLAN tagging so that we can decode
tagged traffic according to the encapsulated protocol. It needs in
addition modifications to the filter generator which would deal with
checking the ethertype and vlan header as required.

Get rid of the T2CHECK() macro, since it duplicates functionality
available from TCHECK(), TCHECK2(), TTEST() and TTEST2().

Merge tcpdump 3.3.
The print_nfs.c changes are pretty extensive; this is partially because
LBL did a lot of cleanup and partially because I removed lots of
pointless changes away from the LBL style.

PR: 3371
mostly-Submitted by: Chris Timmons <skynyrd@opus.cts.cwu.edu>

This commit was generated by cvs2svn to compensate for changes in r26180,
which included commits to RCS files with non-trunk default branches.

Update to reflect changes in net/if.h.

repair editor damage

Please shut up if asked to be quiet.

LBL chose to use IPPROTO_ENCAP to represent IP proto 4 encapsulation
as performed by the multicast kernel modifications. However, BSD
already had IPPROTO_ENCAP defined as 98 (RFC 1241 encapsulation).

This changes the use of IPPROTO_ENCAP to IPPROTO_IPIP, which is
the BSD name for IP proto 4.

Fix the IGMP printer. A lost pair of parenthesis caused all IGMP
reports to be printed as IGMPv1, and a misapplied patch caused
IGMP Leave messages to be partially interpreted as DVMRP routing
messages.

Make things compile again.

Import NFSv3 support from NetBSD

Obtained from: NetBSD

Fix some typos

Here is a patch to make tcpdump recognise IPX packets that is using
ETHERNET_II framing. It got lost during the tcpdump upgrade.

Submitted by: John.Hay@mikom.csir.co.za

Print appletalk layer 3 addresses as 16 bit unsigned decimal numbers,
not two 8 bit values. This conforms to industry standard.

These changes have been sent back to LBL.

Fix bugs in the ISO (Fletcher) checksum, obey the -q flag, misc cleanup of
ISO based code, and document new options (courtesy of libpcap).
Submitted by: Tony Li <tli@jnx.com>

Upgrade instructions

Print IPX packets over a PPP link.
Always display IPX network number in decimal (industry standard).
Decode other PPP protocol types too.

Submitted by: peter, pst, John Hay <jhay@mikom.csir.co.za>

Improvements to IGMP message decoding.
Add support for the router-alert option.
Submitted by: Bill Fenner <fenner@parc.xerox.com>

Fix bugs in AARP packet handling and fake up a phantom LAP header
since Ethertalk doesn't actually put one out on the wire.

Submitted by: Toshihiro Kanda <candy@fct.kgc.co.jp>

Decode maximumim sized ethernet frames properly

Handle IS-IS IIH messages and print NSAPs in canonical format.
Submitted by: Tony Li <tli@jnx.com>

This commit was generated by cvs2svn to compensate for changes in r17680,
which included commits to RCS files with non-trunk default branches.