Copy stable/11@r303970 to releng/11.0 as part of the 11.0-RELEASE
cycle.

Prune svn:mergeinfo from the new branch, and rename it to RC1.

Update __FreeBSD_version.

Use the quarterly branch for the default FreeBSD.conf pkg(8) repo and
the dvd1.iso packages population.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

sys/netgraph: spelling fixes in comments.

No functional change.

- Use counter(9) for node stats updated at a high rate.
- Use simple ++ for rare events.
- Use uma_zone_get_cur() to get knowledge about space left in cache.
- Convert many fields of struct ng_netflow_info to 64 bit.

Tested by: Viktor Velichkin <avisom yandex.ru>
Sponsored by: Nginx, Inc.

Make default cache size more modern.

Requested by: Slawa Olhovchenkov <slw zxy.spb.ru>

Attempt to clean up spacing and long lines.

Add NG_NETFLOW_V9INFO_TYPE command to be able to request netflowv9-specific
data.

Submitted by: Dmitry Luhtionov <dmitryluhtionov at gmail.com>
MFC after: 2 weeks

Make radix lookup on src and dst flow addresses optional
and configurable on per-interface basis.
Remove __inline__ for several functions being called once per
flow (e.g once per 10-20 packets on common traffic flows).
Update manual page to simplify search for BPF data link types.

Sponsored by Yandex LLC

Reviewed by: glebius
Approved by: ae(mentor)
MFC after: 2 weeks

Use rt_numfibs variable instead of compile-time RT_NUMFIBS.

Reviewed by: glebius (previous version)
Approved by: kib(mentor), ae(mentor)

o Eliminate flow6_hash_entry in favor of flow_hash_entry. We don't need
a separate struct to start a slist of semi-opaque structs. This
makes some code more compact.
o Rewrite ng_netflow_flow_show() and its API/ABI:
- Support for IPv6 is added.
- Request and response now use same struct. Structure specifies
version (6 or 4), index of last retrieved hash, and also index
of last retrieved entry in the hash entry.

ng_netflow_cache_init() can be void.

Add support for NetFlow version 9 into ng_netflow(4) node.

Submitted by: Alexander V. Chernikov <melifaro ipfw.ru>

Add ability to generate egress netflow instead or in addition to ingress.
Use mbuf tagging for accounted packets to not account packets twice when
both ingress and egress netflow enabled.
To keep compatibility new "setconfig" message added to control new
functionality. By default node works as before, doing only ingress
accounting without using mbuf tags.

Reviewed by: glebius

Bump maximum number of interface hooks to the maximum possible value.
This will increase the memory consumption for more than 1 Mb, but this
is required for operation on multiinterface access concentrators running
mpd.

Requested by: Alexander Motin

- Increase maximum number of interfaces to 2048.
- Regroup softc so that frequently used elements are
grouped in the beginning, while the interfaces
array is at the end.

Mark appropriate commands with NGM_READONLY and NGM_HASREPLY and
bump type cookie.

- Gather statistics about failed mbuf+cluster+ng_item allocations.
- Adjust comments and variables names in nfinfo.

A new version of NetFlow node.

The most significant changes are:
- Use UMA zone instead of own chunk of memory.
- Lock each hash entry separately.
- Expire items "actively" - interrupt method can expire flows
from hash slot, when it searches through it.
- Remove global tailqueue. Make callout thread search through
every hash slot.
- Export datagram is detached from private data and filled. If
it is incomplete, it is attached back. Another thread will
continue working with it.

Lesser, but also important speedups:
- Flows in hash slot are stored in tailqueue. Whenever a flow is
hit, it is moved to the begging, so it can be located quicker.
- When callout thread works with hash slot it bails out if
slot mutex is contested.

Add a possibility to bypass unmodified accounted data to special
hook(s). Data received on these hook(s) is sent back to ifaceX hook(s).

Refactor node so that it does not modify mbuf contents. Next step would
be pass-thru mode, when traffic is not copied by ng_tee, but passed thru
ng_netflow.

Changes made:

- In ng_netflow_rcvdata() do all necessary pulluping: Ethernet header,
IP header, and TCP/UDP header.
- Pass only pointer to struct ip to ng_netflow_flow_add(). Any TCP/UDP
headers are guaranteed to by after it.
- Merge make_flow_rec() function into ng_netflow_flow_add().

- Use uint16_t to pass argument for NGM_NETFLOW_IFINFO, bump cookie.
- Always check that index number passed from userland
is <= NG_NETFLOW_MAXIFACES. [1]
- Increase NG_NETFLOW_MAXIFACES up to 512. [2]

Noticed by: Roman Palagin [1]
Requested by: Yuri Y. Bushmelev [2]
MFC after: 1 week

- Remove advertising clause from copyright [1]
- Change my email to glebius@FreeBSD.org

Requested by: ru [1]

A netgraph node implementing Netflow version 5.

Supported by: Bestcom ISP, Rinet ISP
Approved by: julian (mentor)