summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2012-01-10Implement RFC 5722 and drop all IPv6 fragments that belong to aAlexander Bluhm
packet with overlapping fragments. ok henning@
2012-01-10Flush the cached IPv6 forward route every 500 ms. This preventsAlexander Bluhm
wrong checks for local addresses and wrong packet forwarding in environments with only one communication partner and changing addresses or routes. Remove the #if 0 around the existing code to make IPv6 behave like IPv4. ok henning@
2012-01-09Remove the IPv6 fragment overlapping length adjustment code. ItAlexander Bluhm
was already #if 0 and will never come back. Remove unused fragment struct fields and sort the others. ok henning@
2012-01-09Replace the hand-crafted queue for IPv6 fragments with LIST.Alexander Bluhm
ok henning@
2012-01-05Remove dead code from #if 0: we do not have an ipsrcchk_rt anywhere else.Alexander Bluhm
from FreeBSD; ok henning@
2012-01-05Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.Alexander Bluhm
I forgot the header file containing struct ip6q in the last commit.
2012-01-05Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.Alexander Bluhm
ok henning@
2012-01-03To access the ifaddr of an in_ifaddr or in6_ifaddr struct, it isAlexander Bluhm
cleaner to access the first member via ia_ifa instead of casting. No binary change. ok henning@ krw@
2011-12-27Instead of hand crafted code, use the macros TAILQ_FOREACH(_SAFE)Alexander Bluhm
and TAILQ_EMPTY for accessing the nd_defrouter list. No funtional change. ok stsp@
2011-12-02Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.Christiano F. Haesbaert
ok claudio@ henning@ mikeb@
2011-11-24rdomain support for IPv6sperreault
ok mikeb
2011-10-15dont define proxydl in nd6_na_output when NCARP = 0 as unusedNigel Taylor
OK sthend@
2011-10-14Prevent carp slaves from sending IPv6 neighbour advertisements for carpStefan Sperling
addresses. Fixes "duplicate IP6 address" warnings, appearing since we started accepting IPv6 neighbour discovery packets on carp interfaces. ok henning
2011-10-13Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyClaudio Jeker
"af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
2011-08-08If two carp interfaces on the same physical interface had addressesAlexander Bluhm
with the same prefix, neighbor discovery did not work. When comparing two carp interfaces in in6_ifpprefix(), assume they share the prefix if they have the same parent. sure deraadt@
2011-08-07Several fixes for the IPV6_PKTINFO handling with sendmsg(2)Mike Belopuhov
Verify that the address in the in6_pktinfo structure included in the control message is unicast and configured on the local host. Additional checks prevent from using non-routable addresses and inactive interfaces. Embed the scope identifier into the link local addresses as required by the stack. Do not force users to provide valid interface index in the ipi6_ifindex but look it up in place if needed. ok bluhm, waived by deraadt for the release.
2011-08-07When checking wether a prefix belongs to an interface, also allowAlexander Bluhm
the route to be at the corresponding carp or physical interface or at an interface belonging to a common bridge. This fixes IPv6 neighbor discovery with carp. bug report and tested by Florian Fuessl put it in deraadt@
2011-08-04Move the check that ::1 is not allowed from the wire before pf_test().Alexander Bluhm
Otherwise pf could reroute or redirect such a packet. KAME moved it in rev 1.189 of their ip6_input.c. This also allows rdr or nat to ::1 in pf. bug report and test camield@ ok mikeb@; go for it deraadt@
2011-07-26Accept neighbor discovery packets from source IPv6 addresses forAlexander Bluhm
which we have a cloning or cloned route. The old check was based on configured interface addresses, now we use a route lookup. This allows us to use prefixes for the local network that ospf6d has added. ok claudio@
2011-07-06cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmHenning Brauer
2011-07-04Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.Claudio Jeker
The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
2011-06-17M_WAITOK cleanup of two cases:Michael Knudsen
1) Allocating with M_WAITOK, checking for NULL, and calling panic() is pointless (malloc() will panic if it can't allocate) so remove the check and the call. 2) Allocating with M_WAITOK, checking for NULL, and then gracefully handling failure to allocate is pointless. Instead also pass M_CANFAIL so malloc() doesn't panic so we can actually handle it gracefully. 1) was done using Coccinelle. Input from oga. ok miod.
2011-05-13Revert the pf->socket linking diff.Owain Ainsworth
at least krw@, pirofti@ and todd@ have been seeing panics (todd and krw with xxxterm not sure about pirofti) involving pool corruption while using this commit. krw and todd confirm that this backout fixes the problem. ok blambert@ krw@, todd@ henning@ and kettenis@ Double link between pf states and sockets. Henning has already implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
2011-05-02Fix potential null dereference.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok henning@ claudio@ krw@
2011-05-02Fix potential null dereference.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok claudio@ henning@
2011-05-02recognize SO_RTABLE socket option at the SOL_SOCKET level;Mike Belopuhov
discussed with and ok claudio
2011-04-24Double link between pf states and sockets. Henning has alreadyAlexander Bluhm
implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
2011-04-15Remove dead assignment.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok claudio@
2011-04-06comment typoStuart Henderson
2011-04-05Passing M_WAITOK to mbuf functions is supposed to be a contract betweenBret Lambert
the caller and the function that the function will not fail to allocate memory and return a NULL pointer. However, m_dup_pkthdr() violates this contract, making it possible for functions that pass M_WAITOK to be surprised in ways that hurt. Fix this by passing the wait flag all the way down the functions that actually do the allocation for m_dup_pkthdr() so that we won't be surprised. man page update forthcoming ok claudio@
2011-04-04Add the same SS_CANTRCVMORE check as was done in the other inputClaudio Jeker
functions. OK blambert@
2011-04-03fix typos in commentsStefan Sperling
ok deraadt henning sthen thib (though thib says he can't spell)
2011-04-03As of r1.54 of nd6_rtr.c we don't add addresses from interrupt contextStefan Sperling
anymore so the allocation in in6_update_ifa() can now wait. ok deraadt henning
2011-04-03Kill redundant offsetof definitions; ok deraadt henning sthen thibStefan Sperling
2011-03-31- use nitems(); no binary changeJasper Lievisse Adriaanse
ok claudio@
2011-03-24Reassemble IPv6 fragments in pf. In the forward case, pf refragmentsAlexander Bluhm
the packets with the same maximum size. This allows the sender to determine the optimal fragment size by Path MTU Discovery. testing sthen@ matthieu@ ok claudio@
2011-03-23Don't process ICMP6 redirects by default anymore. This is in line withClaudio Jeker
what we do for IPv4. rtsol will turn it back on if -F is used. After discussion with bluhm@, fgsch@, sthen@ and deraadt@ OK sthen@
2011-03-23With pf IPv6 fragment reassembly, a large packet gets refragmentedAlexander Bluhm
by pf in the forward path. To avoid dropping the unfragmented packet in ip6_forward(), move the MTU size check behind pf_test6(). ok claudio@
2011-03-22Extract the new function ip6_fragment() from ip6_output() to makeAlexander Bluhm
it reusable by pf. ok claudio@
2011-03-09Log MAC address changes in the IPv6 neighbor discovery protocolAlexander Bluhm
cache as "ndp info overwritten". This makes the behavior similar to ARP. ok todd@, deraadt@, henning@, giovanni@, claudio@
2011-03-06Extract the new function frag6_deletefraghdr() from frag6_input()Alexander Bluhm
to make it reusable by pf. No functional change. ok henning@, claudio@
2011-02-24Prevent the nd6_addr_add() work queue task from adding multiple addressesStefan Sperling
for the same prefix. Tested by giovanni@, steven@, Dennis den Brok. ok dlg miod claudio
2011-01-13In frag6_input() there was an mbuf length calculation error. IfAlexander Bluhm
you want to move "offset" bytes forward by "sizeof(struct ip6_frag)" bytes within an mbuf, you must have at least "offset + sizeof(struct ip6_frag)" bytes space in that mbuf. Fix from KAME, FreeBSD also has it. ok claudio@ markus@
2011-01-09In ip6_forward() only one call to icmp6_error() was not protectedAlexander Bluhm
by an if (mcopy). The variable mcopy comes from m_copy() and could be NULL. Bring this call in line with all the other icmp6_error() calls. ok henning@, claudio@, markus@, mpf@
2011-01-07Add socket option SO_SPLICE to splice together two TCP sockets.Alexander Bluhm
The data received on the source socket will automatically be sent on the drain socket. This allows to write relay daemons with zero data copy. ok markus@
2010-12-21Remove the no longer used ip6s_exthdrtoolong field.Claudio Jeker
OK mikeb@, henning@, deraadt@
2010-10-07Also call addrhooks for IPv6 addresses with a 128 bit prefixlen.Marco Pfatschbacher
I overlooked that one case in rev. 1.69. Fix from Pedro Martelletto. OK mcbride, claudio, henning.
2010-09-24When processing IPv6 RA messages we may end up adding a new IPv6 addressJoel Sing
from interrupt context. This results in problems if the process of adding a new address makes use of pools that use PR_WAITOK (or anything else that may sleep). To avoid this problem, create a workq task so that the new IPv6 address is added from within process context. ok dlg@ henning@
2010-09-23add a new IP level socket option IP_PIPEX. This option is used for L2TPYASUOKA Masahiko
support by pipex. OK henning@, "Carry on" blambert@
2010-09-09Why ip6_input.c includes netinet/ip_icmp.h is beyond my imagination.Claudio Jeker
Compiles fine without it so remove it.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-29 17:25:08 +0000