summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2018-03-27Use memcpy instead of bcopy when the memory does not overlap.David Hill
OK deraadt@ florian@
2018-03-21In ip6_output() check that the interface of a route is valid. ForAlexander Bluhm
IPv4 we do the same and there are races that triggers it. Increment the statistics counter for both. from markus@; OK mpi@
2018-03-16Consistently spell "IPsec" in comments and debug outputs.Martin Pieuchot
From Raf Czlonka, ok sthen@
2018-03-13Calculate RFC7217 link-local style addresses the same way asFlorian Obser
slaacd(8). RFC 7217 states (section 5, page 9): | The Interface Identifier is finally obtained by taking as many | bits from the RID value (computed in the previous step) as | necessary, starting from the least significant bit. Problem in slaacd pointed out by semarie@. OK sthen, phessler
2018-02-19Remove almost unused `flags' argument of suser().Martin Pieuchot
The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
2018-02-12Use IP6_SOIIKEY_LEN instead of hardcoded value.Martin Pieuchot
from semarie@, ok benno@
2018-02-11add an ipv6 "don't fragment" flag to mbufs for ip6_output to use.David Gwynne
if you need to send an ipv6 packet with ip6_send(), there's no DF bit in an ipv6 packet and no way to pass the ip6 options to ip6_output to tell it to not allow fragmentation. this adds an M_IPV6_DF_OUT "checksum" flag so something creating ipv6 packets a long way from ip6_output can easily tell it to not allow fragmentation. grumbling and ok claudio@
2018-02-10rework gif to be more consistent.David Gwynne
while here, give us support for mpls in gif on ipv6. this moves all the gif handling into if_gif, eg, the mpls handling is no longer in ip_etherip.c. ok claudio@
2018-02-10Implement RFC 7217: "A Method for Generating Semantically OpaqueFlorian Obser
Interface Identifiers with IPv6 Stateless Address Autoconfiguration." "An IPv6 address configured using this method is stable within each subnet, but the corresponding Interface Identifier changes when the host moves from one network to another. This method is meant to be an alternative to generating Interface Identifiers based on hardware addresses." OK naddy, sthen
2018-02-07update the gre driver.David Gwynne
the main new feature is gre keys, supported by the vnetid ioctls. this also adds support for gre over ipv6, the use of hfsc, and allows tx mitigation in the future. this diff removes keepalive support, but i promised claudio@ and patrick@ i would put it back after this goes in. ok claudio@
2018-02-01The function ip6_get_prevhdr() did return a pointer into a mbuf.Alexander Bluhm
It was not guaranteed that the mbuf data was not somewhere else in the chain. So return an offset and do a proper mbuf pulldown. found by Maxime Villard; from NetBSD; with markus@; OK deraadt@
2018-01-23The IPv6 gateway address passed to rt6_flush() comes either from aAlexander Bluhm
packet through ip6_input() or from the routing table. In both cases the KAME hack has added the embeded scope to the address, so it is not necessary to fill the scope id again in rt6_flush(). Assert that it is already there. OK mpi@
2018-01-15There was an issue that dynamic path MTU discovery together withAlexander Bluhm
ARP or ND timeout could delete local routes. Put an assert into arptfree() and nd6_free() so this cannot happen again. OK mpi@
2017-12-14The pf code marks ICMP packets belonging to an TCP or UDP divertAlexander Bluhm
state as diverted. This is necessary for IP input to accept the packet as ours. But it must not be used to match the ICMP packet to a raw socket. Clear the PF_TAG_DIVERTED mbuf pf flag for the special ICMP and ICMP6 packets in icmp_input_if() and icmp6_input(). The m_tag_delete_chain() caused an inconsistent PF_TAG_DIVERTED mbuf pf flag and PACKET_TAG_PF_DIVERT mbuf tag which triggered an assert in rip_input(). Deleting all mbuf tags can have undesired side effects and is not necessary anymore since icmp_reflect() calls m_resethdr(). Do not touch the mbuf tags and adjust the mbuf pf flags for the correct behavior of rip_input() and rip6_input(). reported by Chris Eidem, James Turner, vicviq, Scott Vanderbilt OK mpi@
2017-12-04Make divert lookup similar for all socket types. If PF_TAG_DIVERTEDAlexander Bluhm
is set, pf_find_divert() cannot fail so put an assert there. Explicitly check all possible divert types, panic in the default case. For raw sockets call pf_find_divert() before of the socket loop. Divert reply should not match on TCP or UDP listen sockets. OK sashan@ visa@
2017-11-28The divert structure was using the port number to indicate thatAlexander Bluhm
divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Adapt the pf rule struct in kernel and pfctl, no functional change. Note that kernel and pfctl have to be updated together. OK sashan@
2017-11-28Fix mbuf leak when an interface is destroyed while forwarding IPv6Martin Pieuchot
packets. Found by Hrvoje Popovski. ok visa@, bluhm@
2017-11-27Use a single timer for all ND6 entries.Martin Pieuchot
This prevents a use-after-free reported by Hrvoje Popovski where the timeout function was already sleeping on the NET_LOCK() when ifconfig(8) removed the enry from the table. By iterating on a global list in the timeout routine we ensure that the items are still valid when we process them. This also reduce differences with ARP. ok bluhm@, visa@
2017-11-23Constify protocol tables and remove an assert now that ip_deliver() isMartin Pieuchot
mp-safe. ok bluhm@, visa@
2017-11-23Replace non mp-safe carp_iamatch6() with mp-safe carp_iamatch().Martin Pieuchot
They have the same functionnality since friehm@ cleaned up balancing code. ok florian@, visa@, patrick@, bluhm@, jmatthew@
2017-11-21Do not assume if_get(9) returns a non NULL ifp when using a routeMartin Pieuchot
interface index. This assumption is true for the moment iff the route lookup *and* the if_get() are done under KERNEL_LOCK(). This is not the case here. Found the hardway by Hrvoje Popovski. ok florian@, visa@, bluhm@
2017-11-20Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningMartin Pieuchot
pr_input handlers without KERNEL_LOCK(). ok visa@
2017-11-17Drop all Ethernet-in-IP support from gif(4)Jeremie Courreges-Anglas
As a result, ip_ether.c now only deals with MPLS-in-IP. The next commits will move & rename stuff to make this clear. ok visa@ mpi@
2017-11-15Remove inet6 etherip sysctl entriesJeremie Courreges-Anglas
The INET6 entries are not needed, not documented (use net.inet.etherip) and do not appear in sysctl(8) output. ok mpi@
2017-11-14Put the net lock around frag6_freef() as it sends ICMP6 errorAlexander Bluhm
messages. Splassert was triggered by regress/sys/netinet6/frag6. OK mpi@ sashan@ visa@
2017-11-13Remove 18 year old #if 0.Martin Pieuchot
ok visa@, benno@
2017-11-10Introduce a reader version of the NET_LOCK().Martin Pieuchot
This will be used to first allow read-only ioctl(2) to be executed while the softnet taskq is running. Then it will allows us to execute multiple softnet taskq in parallel. Tested by Hrvoje Popovski, ok kettenis@, sashan@, visa@, tb@
2017-11-07Serialize access to the IPv6 reassembly queue with a mutex.Visa Hankala
This lets the code run without KERNEL_LOCK() and NET_LOCK(). In addition, this patch reorganizes a part of the code, to move some of the memory release operations outside the critical section. Input and OK mpi@, OK florian@, an earlier version OK bluhm@
2017-11-05Finish off pr_drain functions, they haven't been used since 2006.Florian Obser
OK mpi
2017-11-04Stop calling ifp->if_ioctl() inside in{,6}_ioctl().Martin Pieuchot
Instead return EOPNOTSUPP and call it from ifioctl(). This will help getting per-driver ioctl routines outside of need the NET_LOCK(). While here always return ENXIO when ``ifp'' is NULL. ok visa@, florian@
2017-11-03We are processing Router Solicitation / Advertisement messages onlyFlorian Obser
for the Source Link-layer Address Options. Merge nd6_rs_input() and nd6_ra_input() into one generic function that does just that. input & OK mpi
2017-11-02Move PRU_DETACH out of pr_usrreq into per proto pr_detachFlorian Obser
functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
2017-11-02Over 17 years is probably 'a while...'Florian Obser
Also it does not change behaviour. OK jca
2017-11-01Fix typo in previous resulting in a NULL dereference.Martin Pieuchot
2017-10-31- add one more softnet taskqAlexandr Nedvedicky
NOTE: code still runs with single softnet task. change definition of SOFTNET_TASKS in net/if.c, if you want to have more than one softnet task OK mpi@, OK phessler@
2017-10-29Move NET_{,UN}LOCK into individual slowtimo functions.Florian Obser
Direction suggested by mpi OK mpi, visa
2017-10-27Allocate IPv6 reassembly structs using pools instead of malloc(),Visa Hankala
and drop the now redundant allocation type M_FTABLE. OK mikeb@, bluhm@, mpi@
2017-10-26Replace macro `IP6_REASS_MBUF' with direct use of field `ip6af_m'.Visa Hankala
OK bluhm@, mpi@
2017-10-26Stop grabbing the KERNEL_LOCK() in network tasks when `ipsec_in_use'Martin Pieuchot
is set. Accesses to IPsec global data structure are now serialized by the NET_LOCK(). Tested by many, ok visa@, bluhm@
2017-10-26Kill deprecated IPv6 ioctl(2)s.Martin Pieuchot
ok florian@, sthen@, jsg@
2017-10-24remove defines for ioctls the kernel doesn't recogniseJonathan Gray
ok mpi@
2017-10-24Remove some more tests checking for a non-NULL `ifp->if_ioctl'.Martin Pieuchot
if_attach() enforces it is properly defined.
2017-10-24Remove support for never used ioctls originating from KAME.Martin Pieuchot
ok florian@, claudio@, bluhm@
2017-10-20Do not test if if_ioctl is NULL, it isn't.Martin Pieuchot
ok florian@, claudio@, visa@, bluhm@
2017-10-18When reusing an mbuf at the upper end of the network stack, stripAlexander Bluhm
off the mbuf properties with m_resethdr(). It is a new packet, especially M_LOOP indicating that it was running through lo(4) should be cleared. Use the ph_loopcnt to prevent looping at the upper end of the stack. Although not strictly necessary in icmp reflect, it is a good idea to increase and check the counter here, like in socket splicing. OK mpi@ sashan@
2017-10-18Setting the IPV6_MINMTU flag in the call to ip6_output() was movedAlexander Bluhm
from icmp6_reflect() to ip6_send_dispatch() when ip6_send() was introduced. Move the comment that explains this flag also to the place where it is used. from sashan@
2017-10-16Remove kernel support for the following ioctl(2)s, deprecated since 2001:Martin Pieuchot
- SIOCSIFPHYADDR - SIOCSIFPHYADDR_IN6 - SIOCGIFPSRCADDR - SIOCGIFPSRCADDR_IN6 - SIOCGIFPDSTADDR - SIOCGIFPDSTADDR_IN6 ok bluhm@
2017-10-09Reduces the scope of the NET_LOCK() in sysctl(2) path.Martin Pieuchot
Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
2017-10-08ramdisks do not contain MROUTING, so the local variable becomes unused.Theo de Raadt
wrap it.
2017-10-06Unfortunately I removed too much in my previous commit and brokeAlexander Bluhm
divert-packet. Bring back the loop over the global list to find the divert socket.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-14 20:28:13 +0000