• Keep the error case freeing loop under the lock.
• Assert before subtracting.

Fix pointer for partial mbuf in peek case.

New version.

In D53564#1223423, @tuexen wrote:

Maybe we want separate counters for:

• syncache_repsonse() failed
• syncache entries are dropped.

I see your logic, but then we need to reformat netstat, too. And that probably shouldn't get MFC-ed to stable/15.

In the third case we also drop. In the first two cases we called syncache_drop() that would unlink and free the entry. In the third case we have already allocated an entry and we were about to link it in, but we resulted in freeing it.

tcp_var.h is not source of truth here! This file and also netstat(1) are. In this file the counter only is updated when we indeed drop. In netstat counter is reported to user as "dropped". This change should be a comment only change.

Note that there are tests that use routed :(

If you have two Giant locked devices, gone_in() will report only the first one.

I did not mean that changing of size of ip6po_tclass in struct ip6_pktopts should be part of this change, of course. Just noticed this thing and suggested an improvement.

Why don't embed this entire block into udp_v4mapped_pktinfo()?

P.S. This actually reminds me that many years ago, I tried to unionize IPv6 specific fields of inpcb with IPv4. This utterly failed for 4-in-6 connections, so I quickly reverted without due analysis. Maybe should be looked at again.

Thanks for the work, Boris! Do you have a public git repo where I would be able to pull commits from to push them to FreeBSD?

Can you please point me to how reproduce the problem? IMHO, we should just provide a KPI to register new sysevent_groups and pre-register them before the events.

Your run on entire IPv4 space suggested an extra test, that would be really nice:

• Rebase the test after the flakyness fix.

In D53081#1212746, @markj wrote:

Do we not block at all when sending on a dgram socket and the receiver has insufficient space?

• Improve test per Alan's review.

In D53070#1212661, @mjg wrote:

This *is* used by pf_rule_counter_u64_periodic. The goal is to sum up the 32 bit values frequently enough(tm) that they don't overflow.

I trust Alan's expertise here. IMHO, given that this patch is analog to fusefs one, should be fine. But not expert in the area.

In pf_krule we got remaining:

In D53045#1212125, @ngie wrote:

The test uses OPENSSL_CONF to specify the test config file.

If it ever existed it existed in lib/libutil/login_ok.c and lib/libutil/login_times.c. Even the original import to FreeBSD does mention ignoretime.

This options plays together with times.allow and times.deny, that are still documented in the login.conf. I think deeper digging is required to see if this is indeed a cruft or actually a functional thing. If it is cruft, then documentation in login.conf on times.allow/times.deny is also cruft.

Does OpenSSL just picks up openssl.conf from current directory?

Maybe put that under DIAGNOSTIC or similar hiding ifdef? Only one or two people in the world would ever need this. Those who do, definitely would be compiling kernels.

• Add a paragraph on non-blocking mode

In D52873#1207907, @jtl wrote:

My main concern about these three revisions is that they are somewhat susceptible of remote manipulation, and that could make it easier to DoS a server. However, I view that as a tradeoff that the user needs to make, and think an appropriate release note should suffice to warn about these issues.

• Added sentence on how to set record boundaries with SOCK_SEQPACKET.

if_vmove bites again? I'm fine with adding more kludges around this problem as long as we all agree that eventually this thing needs to be removed and interfaces shall be fully destroyed and fully instantiated in a different jail.

I agree with Nick that previous comments were better.
You may add assertions that match the checks in the syncookie_expand() case.