summaryrefslogtreecommitdiff
path: root/sys/netinet/tcp_input.c
AgeCommit message (Collapse)Author
2017-11-08The TF_BLOCKOUTPUT flag is set around all sorwakeup() and sowwakeup()Alexander Bluhm
calls in tcp_input(). When I added this code for socket splicing, I have missed that they may be called indirectly through functions. Although not strictly necessary since we have the sosplice thread, put that flag consistently when we want to prevent that tcp_output() is called in the middle of tcp_input(). As soisconnected(), soisdisconnected(), and socantrcvmore() call the wakeup functions from tcp_input(), set the TF_BLOCKOUTPUT flag around them. OK visa@
2017-10-25Remove the TCP_FACK option and associated #if{,n}def code.job
TCP_FACK was disabled by provos@ in June 1999. TCP_FACK is an algorithm that decides that when something is lost, all not SACKed packets until the most forward SACK are lost. It may be a correct estimate, if network does not reorder packets. OK visa@ mpi@ mikeb@
2017-10-24Refactor handling of partial TCP acknowledgementsMike Belopuhov
With input from Klemens Nanni, OK visa, mpi, bluhm
2017-10-22Unconditionally enable TCP selective acknowledgements (SACK)Mike Belopuhov
OK deraadt, mpi, visa, job
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-06-26Assert that the corresponding socket is locked when manipulating socketMartin Pieuchot
buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
2017-05-18Merge the content of <netinet/tcpip.h> and <netinet6/tcpipv6.h> inMartin Pieuchot
<netinet/tcp_debug.h>. The IPv6 variant was always included and the IPv4 version is not present on all systems. Most of the offending ports are already fixed, thanks to sthen@!
2017-05-06Checking for IPv4 mapped addreses and dropping the packet is doneAlexander Bluhm
in ip6_input(). Do not check that again in the protocol input functions. OK mpi@
2017-05-04If m is not a continuous mbuf cluster, m_pullup() in pr_input mayAlexander Bluhm
change the pointer. Then *mp keeps the invalid pointer and it might be used. Fix the potential use after free and also reset *mp in other places to have less dangling pointers to freed mbufs. OK mpi@ mikeb@
2017-05-03Back out rev 1.185 (which made the code match the comment) andTodd C. Miller
adjust the comment to match reality (or at least rfc7323) instead. This brings us back in line with the behavior of Net and Free. From Lauri Tirkkonen. OK bluhm@
2017-04-19Use the rt_rmx defines that hide the struct rt_kmetrics indirection.Alexander Bluhm
No binary change. OK mpi@
2017-04-17Use the address family passed down with pr_input to simplifyAlexander Bluhm
tcp_input(). OK florian@
2017-04-14Pass down the address family through the pr_input calls. ThisAlexander Bluhm
allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
2017-02-09percpu counters for TCP statsJeremie Courreges-Anglas
ok mpi@ bluhm@
2017-01-29Change the IPv4 pr_input function to the way IPv6 is implemented,Alexander Bluhm
to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
2017-01-25Since raw_input() and route_input() are gone from pr_input, we canAlexander Bluhm
make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
2017-01-10Remove NULL checks before m_free(9), it deals with it.Martin Pieuchot
ok bluhm@, kettenis@
2016-12-19Introduce the NET_LOCK() a rwlock used to serialize accesses to the partsMartin Pieuchot
of the network stack that are not yet ready to be executed in parallel or where new sleeping points are not possible. This first pass replace all the entry points leading to ip_output(). This is done to not introduce new sleeping points when trying to acquire ART's write lock, needed when a new L2 entry is created via the RT_RESOLVE. Inputs from and ok bluhm@, ok dlg@
2016-11-16Be consistent and do not use braces for single line statements.Martin Pieuchot
Prodded by and ok bluhm@
2016-11-16Kill recursive splsoftnet()s.Martin Pieuchot
While here keep local definitions local. ok bluhm@
2016-11-15Use __func__ in panic strings to reduce noise when grepping.Martin Pieuchot
2016-11-07Use goto for consistently instead of splx() and return.Martin Pieuchot
This will allow to have a single lock/unlock dance per timer.
2016-10-04One more timeout_set_proc(9) conversion.Martin Pieuchot
Found by Chris Jackman, thanks!
2016-09-19For incomming connections keep the TF_NOPUSH flag if TCP_NOPUSH wasAlexander Bluhm
set on the listen socket. From David Hill; OK vgross@
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-08-31Use 'sc_route{4,6}' directly instead of casting them to 'struct route *'.Martin Pieuchot
This is another little step towards deprecating 'struct route{,_in6}'. ok florian@
2016-07-20Make the size for the syn cache hash array tunable. As we areAlexander Bluhm
swapping between two syn caches for random reseeding anyway, this feature can be added easily. When the cache is empty, there is an opportunity to change the hash size. This allows an admin under SYN flood attack to defend his machine. Suggested by claudio@; OK jung@ claudio@ jmc@
2016-07-01Make accepted sockets inherit IP_TTL from the listening socket.Jeremie Courreges-Anglas
This is consistent with the IPV6_UNICAST_HOPS behavior, and is the only way to allow applications to completely control the TTL of outgoing packets (else an application could temporariy send packets with the default TTL, until it sets again IP_TTL ; this is harmful eg for GTSM). ok bluhm@
2016-06-27Missing "break;" in switch statement; repairs IP_MINTTL.Jeremie Courreges-Anglas
2016-06-27Implement IPV6_MINHOPCOUNT support.Jeremie Courreges-Anglas
Useful to implement GTSM support in daemons such as bgpd(8). Diff from 2013 revived by renato@. Input from bluhm@, ok bluhm@ deraadt@
2016-06-27Copy inp_hops from the listening socket to the accepted one and useAlexander Bluhm
its value for the SYN+ACK packet. This makes the IPV6_UNICAST_HOPS socket option usable for incoming TCP connections. tested by renato@; OK jca@
2016-06-27The variable swapping between inp, newinp and oldinpcb in syn_cache_get()Alexander Bluhm
was overly complicated. Simplify the code without functional change. OK jca@
2016-06-09Fix typo in comment. From Kapetanakis GiannisAlexander Bluhm
2016-03-31If one of the TCP syn cache buckets overflow, it might be a collisionAlexander Bluhm
attack against our hash function. In this case, switch to the passive syn cache as soon as possible. It will start with a new random seed for the hash. input and OK mpi@
2016-03-29Allow to adjust tcp_syn_use_limit with sysctl net.inet.tcp.synuselimit.Alexander Bluhm
This is convenient to test the feature and may be useful to defend against syn flooding in a denial of service condition. It is consistent to the existing syn cache sysctls. Move some declarations to tcp_var.h to access the syn cache sets from tcp_sysctl(). OK mpi@
2016-03-27To prevent attacks on the hash buckets of the syn cache, our TCPAlexander Bluhm
stack reseeds the hash function every time the cache is empty. Unfortunatly the attacker can prevent the reseeding by sending unanswered SYN packes periodically. Fix this by having an active syn cache that gets new entries and a passive one that is idling out. When the passive one is empty and the active one has been used 100000 times, they switch roles and the hash function is reseeded with new random. tedu@ agrees; OK mpi@
2016-03-21Add a tcps_sc_seedrandom counter in TCP SYN cache and netstat -s.Alexander Bluhm
This shows how often the hash function is reseeded and the random bucket distribution changes. OK mpi@ claudio@
2016-03-07Sync no-argument function declaration and definition by adding (void).Christian Weisgerber
ok mpi@ millert@
2016-01-22fix a missing if_put() in the default af path of tcp_mss()Jonathan Gray
ok mpi@
2015-12-05upgrade tcp/ip to use the latest in C89 technology: memcpy.Ted Unangst
ok henning
2015-12-03To avoid that the stack manipules the pf statekeys directly, introduceAlexander Bluhm
pf_inp_...() lookup, link and unlink functions as an interface. Locking can be added to them later. Remove the first linking at the beginning of tcp_input() and udp_input() as it is not necessary. It will be done later anyway. That code was a relict, from the time before I had added the second linking. Input from mikeb@ and sashan@; OK sashan@
2015-11-29Fix an hypotetical NULL dereference which might become true once the TCPMartin Pieuchot
layer will be turned mpsafe. We're not there yet. Reported by David Hill, ok florian@
2015-11-20Make use if_get() and get rid of rt_ifp.Martin Pieuchot
Tested by and ok sthen@, ok visa@
2015-11-06Change nd6_nud_hint() to no longer manipulate rt_ifp directly.Martin Pieuchot
While here remove unused argument and convert the route check to rtisvalid(9). ok bluhm@
2015-10-28Remove linkmtu and maxmtu from struct nd_ifinfo. IN6_LINKMTU can nowFlorian Obser
die and ifp->if_mtu is the one true mtu. Suggested by and OK mpi@
2015-10-24Ignore Router Advertisment's current hop limit.Martin Pieuchot
Appart from the usual inet6 axe murdering exercise to keep you fit, this allows us to get rid of a lot of layer violation due to the use of per- ifp variables to store the current hop limit. Imputs from bluhm@, ok phessler@, florian@, bluhm@
2015-09-11Kill yet another argument to functions in IPv6. This time ip6_output'sClaudio Jeker
ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
2015-09-10Only half of the IPv6 source address was used as input for the synAlexander Bluhm
cache hash. That makes it trivial to create syn cache collisions. Take the full address, xor it with random data and put it into the hash function. OK markus@
2015-09-10if_put added to the if_get calls. Reshuffle some code to make this easier.Claudio Jeker
OK dlg@
2015-08-27The syn cache is completely implemented in tcp_input.c. So all itsAlexander Bluhm
global variables should also live there. OK markus@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 06:39:40 +0000