summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_input.c
AgeCommit message (Collapse)Author
2001-03-28Allow tdbi's to appear in mbufs throughout the stack; this allowsAngelos D. Keromytis
security properties of the packets to be pushed up to the application (not done yet). Eventually, this will be turned into a packet attributes framework. Make sure tdbi's are free'd/cleared properly whenever drivers (or NFS) does weird things with mbufs.
2001-03-25A couple minor fixes to prevent use after free. Thanks to dawson and team ↵Constantine Sapuntzakis
for finding these. Ok angelos@
2001-03-18enable pmtu by defaultNiels Provos
2001-03-03on parse error of timestamp option, set parameter error offset correctly.Jun-ichiro itojun Hagino
2001-03-03drop packets with 127.0.0.0/8 in header field, if the packet is from outside.Jun-ichiro itojun Hagino
under RFC1122 sender rule 127.0.0.8 must not appear on the wire. count incidents by ipstat.ips_badaddr. sync with kame
2000-12-03Fix fastroute-related panic, fixes PR 1541 (cas@trans-nt.com)Angelos D. Keromytis
2000-10-13make sure we don't share external mbuf between m and mcopy, in ip_forward().Jun-ichiro itojun Hagino
NetBSD PR 11201.
2000-09-22fix my bug dating back to february the 14th of 1998,Michael Shalayeff
when those wildcard interfaces came up, which were usefull at the times. on the other hand here it is, one cannot bind to the broadcast address, and angelos says ok.
2000-09-19Lots and lots of changes.Angelos D. Keromytis
2000-09-18Path MTU discovery based on NetBSD but with the decision to use the DFNiels Provos
flag delayed to ip_output(). That halves the code and reduces most of the route lookups. okay deraadt@
2000-05-15parse IPv4 options more carefully. make boundary checks against everyJun-ichiro itojun Hagino
steps (including option type/length field - there were no checks, seems to me 4.4BSD bug)
2000-05-10make sure ip_timestamp is aligned correctlyJason Wright
2000-05-06avoid underflow on unsigned value arithmetic (when optlen < 4).Jun-ichiro itojun Hagino
2nd half of NetBSD Security Advisory 2000-002.
2000-05-06avoid unaligned access in timestamp; ↵Theo de Raadt
http://www.newhackcity.net/advisories/20000504a_0.txt; checked by provos and itojun
2000-04-09Pass ip_off and ip_len in the correct byte order to icmp_error(); thisAngelos D. Keromytis
should fix the crash problems with isic, reported last week.
2000-04-04Verbiage fix.Angelos D. Keromytis
2000-03-27As I threatened a while ago, ingress IPsec ACL-checking is turned onAngelos D. Keromytis
by default. Read the ipsecadm(8) man page for more details on how to specify ingress filters with manual keying. isakmpd has been doing this for a while now.
2000-03-03remove WIDE's experimental ip reass code, mistakingly merged in partially.Jun-ichiro itojun Hagino
NetBSD PR: 9412 Fix from: ho@crt.se
2000-01-10Add 10 new ipsec-related sysctl variables...they are currently underAngelos D. Keromytis
net.inet.ip; perhaps they should be moved under net.inet.ipsec or some such.
2000-01-10Add net.inet.ip.ipsec-invalid-life, default value 60 seconds; theAngelos D. Keromytis
amount of time embryonic SAs will be kept before they have to be initialized by key management (this only affects automated key management).
2000-01-09Rename newly-introduced variable to better reflect use.Angelos D. Keromytis
2000-01-09Add a sysctl for IPsec ingress access control (better explanation on aAngelos D. Keromytis
follow-up commit).
1999-12-08bring in KAME IPv6 code, dated 19991208.Jun-ichiro itojun Hagino
replaces NRL IPv6 layer. reuses NRL pcb layer. no IPsec-on-v6 support. see sys/netinet6/{TODO,IMPLEMENTATION} for more details. GENERIC configuration should work fine as before. GENERIC.v6 works fine as well, but you'll need KAME userland tools to play with IPv6 (will be bringed into soon).
1999-11-29Make sure M_BCAST is set for IP broadcasts, even if the packet came in asHakan Olsson
an ethernet unicast. (cmetz@, niklas@ ok.)
1999-09-25line not neededTheo de Raadt
1999-09-23fix same-interface-out-as-in and packet gets corrupted bug noted byTheo de Raadt
james@oaktree.co.uk by re-working icmp embedded-packet code so that ip_forward() m_copy()-aliased packet can be forwarded to ip_output and icmp_error() safely, because no packet tweaking is needed before calling icmp_error()
1999-04-23dont accept packets with the destination address of a down interface;Niels Provos
proff@netbsd.org.
1999-04-12move encdebug to a useful placeTheo de Raadt
1999-04-11Introduce net.inet.{ah,esp}.enable sysctl controls that are off by default.Niklas Hallqvist
If you are going to use either of AH or ESP or both, enable these in /etc/sysctl.conf. Also correct the IPSec debugging sysctl code, it is now named net.inet.ip.encdebug. Some corrected function signatures too.
1999-02-21split ipintr() to create new ipv4_input() for tunnels; NRLTheo de Raadt
1999-02-19ipq lockingTheo de Raadt
1999-02-17add fragment flood protection; configureable using sysctl ip.maxqueueTheo de Raadt
1998-12-28ensure the ip packet embedded inside an icmp packet has correct ip_len,Theo de Raadt
ip_off, ip_id. for udp, also correct uh_sum. ip_sum is still set to 0; (all this debugged using nmap)
1998-12-26make ip_id random but ensure that ids dont repeat for some period.Niels Provos
1998-11-13Recompute ip header length after packet has been reassembled, and alsoNiels Provos
use the actual header length for m_pullup, pointed out by jdb@es2.net and guido@freebsd.org.
1998-05-18first step to the setsockopt/getsockopt interface as described inNiels Provos
draft-mcdonald-simple-ipsec-api, kernel notifies (EMT_REQUESTSA) signal userland key management applications when security services are requested. this is only for outgoing connections at the moment, incoming packets are not yet checked against the selected socket policy.
1998-02-14wildcard ifaces; finally, after HE said it's okMichael Shalayeff
1998-02-03bail out for sourcerouted packets earlier, also do not forwardTheo de Raadt
sourcerouted packets ever if ipforwarding is off; tqbf@secnet.com
1998-02-01undo wildcard loopback stuff; it was not checked by other developersTheo de Raadt
1998-02-01support wildcard loopbacks. that is, setting up lo1 like:Michael Shalayeff
ifconfig lo1 inet 192.168.1.1 netmask 255.255.255.0 link1 would force it to act like all the addresses from net 192.168.1 were added to the interface. todo: man lo
1997-08-09The list of tcp/udp ports not to allocate dynamically is nowTodd C. Miller
a bitmask configurable via sysctl([38]). The default values have not changed. If one wants to change the list it should be done early on in /etc/rc.
1997-02-28IPsec socket API hooks are in.Angelos D. Keromytis
1997-02-22Fixed problem in ip_weadvertise().Angelos D. Keromytis
1997-02-22ICMP redirects will not be sent if we do proxy arp pointing to ourselves.Angelos D. Keromytis
1997-02-13off-by-one-slot for IP timestamp option data inserts, PR#103, ↵Theo de Raadt
andreas.gunnarsson@emw.ericsson.se
1997-02-11ensure ipt->ipt_ptr is right; pr#96, andreas.gunnarsson@emw.ericsson.seTheo de Raadt
1997-01-26Make ip_len and ip_off unsigned values; don't transmit or accept packetsThorsten Lockert
larger than the maximum IP packet size. From NetBSD.
1996-10-27record route is not a problem; thanks bitbltTheo de Raadt
1996-10-18Do not run IP defragmentation routines unneccecarily; NetBSD PR# 2772Thorsten Lockert
1996-09-02Don't drain the protocol queues at interrupt level.dm
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-13 06:45:33 +0000