summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2012-04-03According to the RFC 2460 and RFC 5095, ICMP Parameter Problem, Code 0Mike Belopuhov
should be sent in response to an IPv6 packet with RH0. Improve this a bit further by filling in an icmp error pointer. With sperreault, ok sperreault, sthen
2012-04-03bail if redirect destination is not unicast before doing otherMike Belopuhov
expensive checks; ok sperreault, todd, sthen
2012-03-15Direct IPv6 packets with Ethernet encapsulation into the appropriateMike Belopuhov
input routine allowing us to bridge two IPv4 networks over an IPv6 link with gif(4). ok henning, sthen, ok and tests phessler, "lets get this in!" todd
2012-02-14typo in comment.Stuart Henderson
2012-01-24Add a short cut for atomic IPv6 fragments. They will be processedAlexander Bluhm
immediately and not go through the fragment queue. See draft-gont-6man-ipv6-atomic-fragments-00.txt. tested and ok sperreault@
2012-01-23Do not keep state when dropping overlapping IPv6 fragments in pfAlexander Bluhm
and IPv6 stack. ok sperreault@
2012-01-17During IPv6 source address selection, give address scope higher priorityStefan Sperling
than the autoconfprivacy bit, as per by RFC3484. Prevents privacy addresses from being erroneously used as source address if the destination address is in a different scope. Privacy addresses are still preferred over other source addresses from the same scope. Problem found by sthen, fix suggested by sperreault; ok sperreault
2012-01-11Simplify the #if CARP and if (IFT_CARP) dance in nd6_ns_input().Alexander Bluhm
Fix a white space bug while there. No functional change. ok mikeb@ robert@ henning@
2012-01-10Implement RFC 5722 and drop all IPv6 fragments that belong to aAlexander Bluhm
packet with overlapping fragments. ok henning@
2012-01-10Flush the cached IPv6 forward route every 500 ms. This preventsAlexander Bluhm
wrong checks for local addresses and wrong packet forwarding in environments with only one communication partner and changing addresses or routes. Remove the #if 0 around the existing code to make IPv6 behave like IPv4. ok henning@
2012-01-09Remove the IPv6 fragment overlapping length adjustment code. ItAlexander Bluhm
was already #if 0 and will never come back. Remove unused fragment struct fields and sort the others. ok henning@
2012-01-09Replace the hand-crafted queue for IPv6 fragments with LIST.Alexander Bluhm
ok henning@
2012-01-05Remove dead code from #if 0: we do not have an ipsrcchk_rt anywhere else.Alexander Bluhm
from FreeBSD; ok henning@
2012-01-05Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.Alexander Bluhm
I forgot the header file containing struct ip6q in the last commit.
2012-01-05Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.Alexander Bluhm
ok henning@
2012-01-03To access the ifaddr of an in_ifaddr or in6_ifaddr struct, it isAlexander Bluhm
cleaner to access the first member via ia_ifa instead of casting. No binary change. ok henning@ krw@
2011-12-27Instead of hand crafted code, use the macros TAILQ_FOREACH(_SAFE)Alexander Bluhm
and TAILQ_EMPTY for accessing the nd_defrouter list. No funtional change. ok stsp@
2011-12-02Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.Christiano F. Haesbaert
ok claudio@ henning@ mikeb@
2011-11-24rdomain support for IPv6sperreault
ok mikeb
2011-10-15dont define proxydl in nd6_na_output when NCARP = 0 as unusedNigel Taylor
OK sthend@
2011-10-14Prevent carp slaves from sending IPv6 neighbour advertisements for carpStefan Sperling
addresses. Fixes "duplicate IP6 address" warnings, appearing since we started accepting IPv6 neighbour discovery packets on carp interfaces. ok henning
2011-10-13Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyClaudio Jeker
"af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
2011-08-08If two carp interfaces on the same physical interface had addressesAlexander Bluhm
with the same prefix, neighbor discovery did not work. When comparing two carp interfaces in in6_ifpprefix(), assume they share the prefix if they have the same parent. sure deraadt@
2011-08-07Several fixes for the IPV6_PKTINFO handling with sendmsg(2)Mike Belopuhov
Verify that the address in the in6_pktinfo structure included in the control message is unicast and configured on the local host. Additional checks prevent from using non-routable addresses and inactive interfaces. Embed the scope identifier into the link local addresses as required by the stack. Do not force users to provide valid interface index in the ipi6_ifindex but look it up in place if needed. ok bluhm, waived by deraadt for the release.
2011-08-07When checking wether a prefix belongs to an interface, also allowAlexander Bluhm
the route to be at the corresponding carp or physical interface or at an interface belonging to a common bridge. This fixes IPv6 neighbor discovery with carp. bug report and tested by Florian Fuessl put it in deraadt@
2011-08-04Move the check that ::1 is not allowed from the wire before pf_test().Alexander Bluhm
Otherwise pf could reroute or redirect such a packet. KAME moved it in rev 1.189 of their ip6_input.c. This also allows rdr or nat to ::1 in pf. bug report and test camield@ ok mikeb@; go for it deraadt@
2011-07-26Accept neighbor discovery packets from source IPv6 addresses forAlexander Bluhm
which we have a cloning or cloned route. The old check was based on configured interface addresses, now we use a route lookup. This allows us to use prefixes for the local network that ospf6d has added. ok claudio@
2011-07-06cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmHenning Brauer
2011-07-04Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.Claudio Jeker
The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
2011-06-17M_WAITOK cleanup of two cases:Michael Knudsen
1) Allocating with M_WAITOK, checking for NULL, and calling panic() is pointless (malloc() will panic if it can't allocate) so remove the check and the call. 2) Allocating with M_WAITOK, checking for NULL, and then gracefully handling failure to allocate is pointless. Instead also pass M_CANFAIL so malloc() doesn't panic so we can actually handle it gracefully. 1) was done using Coccinelle. Input from oga. ok miod.
2011-05-13Revert the pf->socket linking diff.Owain Ainsworth
at least krw@, pirofti@ and todd@ have been seeing panics (todd and krw with xxxterm not sure about pirofti) involving pool corruption while using this commit. krw and todd confirm that this backout fixes the problem. ok blambert@ krw@, todd@ henning@ and kettenis@ Double link between pf states and sockets. Henning has already implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
2011-05-02Fix potential null dereference.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ claudio@ krw@
2011-05-02Fix potential null dereference.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok claudio@ henning@
2011-05-02recognize SO_RTABLE socket option at the SOL_SOCKET level;Mike Belopuhov
discussed with and ok claudio
2011-04-24Double link between pf states and sockets. Henning has alreadyAlexander Bluhm
implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
2011-04-15Remove dead assignment.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok claudio@
2011-04-06comment typoStuart Henderson
2011-04-05Passing M_WAITOK to mbuf functions is supposed to be a contract betweenBret Lambert
the caller and the function that the function will not fail to allocate memory and return a NULL pointer. However, m_dup_pkthdr() violates this contract, making it possible for functions that pass M_WAITOK to be surprised in ways that hurt. Fix this by passing the wait flag all the way down the functions that actually do the allocation for m_dup_pkthdr() so that we won't be surprised. man page update forthcoming ok claudio@
2011-04-04Add the same SS_CANTRCVMORE check as was done in the other inputClaudio Jeker
functions. OK blambert@
2011-04-03fix typos in commentsStefan Sperling
ok deraadt henning sthen thib (though thib says he can't spell)
2011-04-03As of r1.54 of nd6_rtr.c we don't add addresses from interrupt contextStefan Sperling
anymore so the allocation in in6_update_ifa() can now wait. ok deraadt henning
2011-04-03Kill redundant offsetof definitions; ok deraadt henning sthen thibStefan Sperling
2011-03-31- use nitems(); no binary changeJasper Lievisse Adriaanse
ok claudio@
2011-03-24Reassemble IPv6 fragments in pf. In the forward case, pf refragmentsAlexander Bluhm
the packets with the same maximum size. This allows the sender to determine the optimal fragment size by Path MTU Discovery. testing sthen@ matthieu@ ok claudio@
2011-03-23Don't process ICMP6 redirects by default anymore. This is in line withClaudio Jeker
what we do for IPv4. rtsol will turn it back on if -F is used. After discussion with bluhm@, fgsch@, sthen@ and deraadt@ OK sthen@
2011-03-23With pf IPv6 fragment reassembly, a large packet gets refragmentedAlexander Bluhm
by pf in the forward path. To avoid dropping the unfragmented packet in ip6_forward(), move the MTU size check behind pf_test6(). ok claudio@
2011-03-22Extract the new function ip6_fragment() from ip6_output() to makeAlexander Bluhm
it reusable by pf. ok claudio@
2011-03-09Log MAC address changes in the IPv6 neighbor discovery protocolAlexander Bluhm
cache as "ndp info overwritten". This makes the behavior similar to ARP. ok todd@, deraadt@, henning@, giovanni@, claudio@
2011-03-06Extract the new function frag6_deletefraghdr() from frag6_input()Alexander Bluhm
to make it reusable by pf. No functional change. ok henning@, claudio@
2011-02-24Prevent the nd6_addr_add() work queue task from adding multiple addressesStefan Sperling
for the same prefix. Tested by giovanni@, steven@, Dennis den Brok. ok dlg miod claudio
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-11 16:55:15 +0000