summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_ipip.c
AgeCommit message (Collapse)Author
2024-08-22Unlock unlock ipip_sysctl().Vitaliy Makkoveev
- IPIPCTL_ALLOW - atomically accessed integer; - IPIPCTL_STATS - per-CPU counters; In ipip_input() load `ipip_allow' value to `ipip_allow_local' and pass it down to ipip_input_if() as `allow' arg. ok bluhm
2024-08-21Revert previous. It was committed mistakenly.Vitaliy Makkoveev
2024-08-21Unlock ipip_sysctl().Vitaliy Makkoveev
- IPIPCTL_ALLOW - atomically accessed integer; - IPIPCTL_STATS - per-CPU counters; ok bluhm
2024-05-17IPv6 has to use ip6_defhlim, not ip_defttl.Alexander Bluhm
OK claudio@
2024-02-11Remove include netinet6/ip6_var.h from netinet/in_pcb.h.Alexander Bluhm
OK mvs@
2023-11-28Remove struct inpcb from in6_embedscope() parameters.Alexander Bluhm
rip6_output() did modify inp_outputopts6 temporarily to provide different ip6_pktopts to in6_embedscope(). Better pass inp_outputopts6 and inp_moptions6 as separate arguments to in6_embedscope(). Simplify the code that deals with these options in in6_embedscope(). Doucument inp_moptions and inp_moptions6 as protected by net lock. OK kn@
2023-09-16Allow counters_read(9) to take an optional scratch buffer.Martin Pieuchot
Using a scratch buffer makes it possible to take a consistent snapshot of per-CPU counters without having to allocate memory. Makes ddb(4) show uvmexp command work in OOM situations. ok kn@, mvs@, cheloha@
2022-01-02spellingJonathan Gray
ok jmc@ reads ok tb@
2021-10-23There is an m_pullup() down in AH input. As it may free or changeAlexander Bluhm
the mbuf, the callers must be careful. Although there is no bug, use the common pattern to handle this. Pass down an mbuf pointer mp and let m_pullup() update the pointer in all callers. It looks like the tcp signature functions should not be called. Avoid an mbuf leak and return an error. OK mvs@
2021-10-22Make error handling in IPsec consistent. Pass errors to the callers.Alexander Bluhm
OK tobhe@
2021-10-13The function ipip_output() was registered as .xf_output() xformAlexander Bluhm
function. But was is never called via this pointer. It would have immediatley crashed as mp is always NULL when called via .xf_output(). Do not set .xf_output to ipip_output. This allows to pass only the parameters which are actually needed and the control flow is clearer. OK mpi@
2021-10-05Cleanup the error handling in ipsec ipip_output() and consistentlyAlexander Bluhm
goto drop instead of return. An ENOBUFS should be EINVAL in IPv6 case. Also use combined packet and byte counter. OK sthen@ dlg@
2021-07-08The xformsw array never changes. Declare struct xformsw constantAlexander Bluhm
and map data read only. OK deraadt@ mvs@ mpi@
2021-07-08Debug printfs in encdebug were inconsistent, some missing newlinesAlexander Bluhm
produced ugly output. Move the function name and the newline into the DPRINTF macro. This simplifies the debug statements. OK tobhe@
2021-07-07Fix whitespaces in IPsec code.Alexander Bluhm
2021-01-09Enforce range with sysctl_int_bounded in ipip_sysctlgnezdo
OK millert@
2018-11-14provide ip_tos_patch() for setting ip_tos and patching the ipv4 cksum.David Gwynne
previously the gif code would patch the tos field and not recalc the cksum, which would cause ip input code to drop the packet due to a cksum failure. the ipip code patched ip_tos and unconditionally recalculated the cksum, making it correct, but also wiping out any errors that may have been present before the recalculation. updating the cksum rather than replacing it lets cksum failures still fire. ip_tos_patch() is provided in the ecn code since it's because of ecn propagation that we need to update the tos field. internally it works like pf_patch_8 and pf_cksum_fixup, but since pf is optional it rolls its own code. procter may fix that in the future... ok claudio@
2018-08-28Add per-TDB counters and a new SADB extension to export them toMartin Pieuchot
userland. Inputs from markus@, ok sthen@
2017-10-09Reduces the scope of the NET_LOCK() in sysctl(2) path.Martin Pieuchot
Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
2017-07-05The IP in IP input function strips the outer header and reinsertsAlexander Bluhm
the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
2017-06-20Do not use the interface pointer after if_put(). Rename ipip_input_gif()Alexander Bluhm
to ipip_input_if() and always pass the ifp. Only dump the packet to bpf if we are called with a gif(4) interface. OK mpi@
2017-06-19When dealing with mbuf pointers passed down as function parameters,Alexander Bluhm
bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
2017-06-11Use a common 'goto bad' style and set mp to NULL after freeing itAlexander Bluhm
in ipip_input_gif(). This prevents a use-after-free if there is a bug in the IP input functions. OK mpi@
2017-05-30Introduce ipv{4,6}_input(), two wrappers around IP queues.Martin Pieuchot
This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
2017-05-28Call bpf_mtap_af() a bit earlier in ipip_input(). This preparesAlexander Bluhm
upcoming diffs, no functional change. OK mpi@
2017-05-26In IPIP input rename the variable ipo to ip as it is used for innerAlexander Bluhm
and outer header. Reset values depending on the the mbuf when the mbuf is adjusted. Check the length of the inner IP header with the correct size in case of IPv6. Check the IPv4 header size including IP options. For the IPIP statistics the inner header length has to be subtracted from the packet size as the outer header has already been stripped off. OK mpi@
2017-05-26Instead of looking at the IP version of the header, use the outerAlexander Bluhm
address family passed to ipip_input(). OK mpi@
2017-05-18The function name ip4_input() is confusing as it also handles IPv6Alexander Bluhm
packets. This is the IP in IP protocol input function, so call it ipip_input(). Rename the existing ipip_input() to ipip_input_gif() as it is the input function used by the gif interface. Pass the address family to make it consistent with pr_input. Use __func__ in debug print and panic messages. Move all ipip prototypes to the ip_ipip.h header file. OK dhill@ mpi@
2017-05-06Convert the xformsw definition to C99 style initializer. Also fixAlexander Bluhm
the function declaration of ipe4_input() and avoid a wrong cast. OK mikeb@ dhill@
2017-05-04If m is not a continuous mbuf cluster, m_pullup() in pr_input mayAlexander Bluhm
change the pointer. Then *mp keeps the invalid pointer and it might be used. Fix the potential use after free and also reset *mp in other places to have less dangling pointers to freed mbufs. OK mpi@ mikeb@
2017-05-04Introduce sstosa() for converting sockaddr_storage with a type safeAlexander Bluhm
inline function instead of casting it to sockaddr. While there, use inline instead of __inline for all these conversions. Some struct sockaddr casts can be avoided completely. OK dhill@ mpi@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-04-05When building counter memory in preparation to copy to userland, alwaysTheo de Raadt
zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
2017-03-10percpu counters for ip_ipip.cJeremie Courreges-Anglas
ok bluhm@ dhill@ mpi@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
2017-01-25Since raw_input() and route_input() are gone from pr_input, we canAlexander Bluhm
make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
2016-03-07Sync no-argument function declaration and definition by adding (void).Christian Weisgerber
ok mpi@ millert@
2016-01-22add a missing if_put() to ipip_input()Jonathan Gray
ok mpi@
2015-09-11in6_embedscope() needs to lose some weight. Remove the last argument.Claudio Jeker
In all but two calls NULL is passed and in the other 2 cases the ifp is only used to maybe feed it to in6_selecthlim() to select the hoplimit for the link. Since in6_embedscope() only works on link-local addresses it does not matter what hop limit we select since the destination is directly reachable. OK florian@ mpi@
2015-09-09if_put after if_getDavid Gwynne
ok mpi@
2015-08-24Check for a RTF_LOCAL entry instead of iterating on the global listMartin Pieuchot
of interfaces. ok bluhm@
2015-08-14Replace sockaddr casts with the proper satosin() or satosin6() calls.Alexander Bluhm
From David Hill; OK mpi@
2015-07-16Expand ancient NTOHL/NTOHS/HTONS/HTONL macros.Martin Pieuchot
ok guenther@, henning@
2015-07-15m_freem() can handle NULL, do not check for this condition beforehands.Theo de Raadt
ok stsp mpi
2015-07-15rename mbuf ** parameter from m to mp, to match other similar codeTheo de Raadt
ok mpi
2015-06-16Store a unique ID, an interface index, rather than a pointer to theMartin Pieuchot
receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
2015-05-13test mbuf pointers against NULL not 0Jonathan Gray
ok krw@ miod@
2015-04-14make ipsp_address thread safe; ok mpiMike Belopuhov
2015-04-10replace the use of ifqueues for most input queues serviced by netisrDavid Gwynne
with niqueues. this change is so big because there's a lot of code that takes pointers to different input queues (eg, ether_input picks between ipv4, ipv6, pppoe, arp, and mpls input queues) and falls through to code to enqueue packets against the pointer. if i changed only one of the input queues id have to add sepearate code paths, one for ifqueues and one for niqueues in each of these places by flipping all these input queues at once i can keep the currently common code common. testing by mpi@ sthen@ and rafael zalamena ok mpi@ sthen@ claudio@ henning@
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-30 15:49:59 +0000