summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2021-12-20Use per-CPU counters for tunnel descriptor block (TDB) statistics.Vitaliy Makkoveev
'tdb_data' struct became unused and was removed. Tested by Hrvoje Popovski. ok bluhm@
2021-12-15structure pads can leak uninitialized memory to userland via copyout,Theo de Raadt
therefore the mandatory idiom is completely clearing structs before building them for copyout -- that means ALMOST ALL STRUCTS, because we never know when some architecture will pad a struct.. In two more cases, the clearing wasn't performed. from Reno Robert ZDI ok millert bluhm
2021-12-13nd6_dad_ns_input() could trigger a NULL deref in nd6_dad_duplicated().Alexander Bluhm
It checks dp in two of three places. One check got lost in revision 1.83. Do a dp == NULL once at the beginning. OK jsg@ Reported-by: syzbot+88c0ce914a0b10b7e1c8@syzkaller.appspotmail.com
2021-12-03Add TDB reference counting to ipsp_spd_lookup(). If an outputAlexander Bluhm
pointer is passed to the function, it will return a refcounted TDB. The ref happens when ipsp_spd_inp() copies the pointer from ipo->ipo_tdb. The caller of ipsp_spd_lookup() has to unref after using it. tested by Hrvoje Popovski; OK mvs@ tobhe@
2021-12-01Let ipsp_spd_lookup() return an error instead of a TDB. The TDBAlexander Bluhm
is not always needed, but the error value is necessary for the caller. As TDB should be refcounted, it makes not sense to always return it. Pass an output pointer for the TDB which can be NULL. OK mvs@ tobhe@
2021-11-24When sending ICMP packets for IPsec path MTU discovery, the firstAlexander Bluhm
ICMP packet could be wrong. The mtu was taken from the loopback interface as the tdb mtu was copied to the route too late. Without crypto task, ipsp_process_packet() returns the EMSGSIZE error earlier. Immediately update tdb and route mtu. IPv4 part from markus@; OK tobhe@
2021-11-22Copy code from ip_forward() to ip6_forward() to fix Path MTU discoveryAlexander Bluhm
in IPsec IPv6 tunnel. Implement sending ICMP6 packet too big messages. Also implement the pf error case in ip6_forward(). While there, do some cleanup and make the IPv4 and IPv6 code look similar. OK tobhe@
2021-11-07net.inet6.icmp6.nd6_debug doesn't need to warn about RDNSS/DNSSL optionsStuart Henderson
ok phessler@
2021-10-24Remove code duplication by merging the v4 and v6 input functionsAlexander Bluhm
for ah, esp, and ipcomp. Move common code into ipsec_protoff() which finds the offset of the next protocol field in the previous header. OK tobhe@
2021-10-14ip6_output_ipsec_send() may change the route embeded in struct roAlexander Bluhm
during path MTU discovery. ip6_forward() has to update its rt variable to the new route in ro. Otherwise it could operate on a freed route. from markus@
2021-07-27Revert "Use per-CPU counters for tunnel descriptor block" diff.mvs
Panic reported by Hrvoje Popovski.
2021-07-26Use per-CPU counters for tunnel descriptor block (tdb) statistics.mvs
'tdb_data' struct became unused and was removed. ok bluhm@
2021-07-26The mbuf header cleanup in revision 1.173 of ip_icmp.c was tooAlexander Bluhm
strict. ICMP error packets generated by pf were not passed immediately, but could be blocked. Preserve PF_TAG_GENERATED flag in icmp_reflect() and icmp6_reflect(). reported by sf@; OK patrick@ kn@
2021-07-08Debug printfs in encdebug were inconsistent, some missing newlinesAlexander Bluhm
produced ugly output. Move the function name and the newline into the DPRINTF macro. This simplifies the debug statements. OK tobhe@
2021-06-03ip6_input_if used the ip6_hdr pointer uninitted after i refactored it.David Gwynne
i did test this, but i guess i was lucky. very lucky. Coverity CID 1505114
2021-06-02don't init a pointer just to immediately set it again.David Gwynne
this is in ip6_input_if just before ipv6_check returns the pointer we end up using. pointed out by bluhm@
2021-06-02factor out the code that does sanity checks on ipv6 headers and addresses.David Gwynne
this will allow these checks to be reused for ip packet inspection in bridge, veb, and tpmr. ok bluhm@ sashan@
2021-05-25As network features are not added dynamically, the domain structuresAlexander Bluhm
are constant. Having more const makes MP review easier. More pointers are mapped read-only in the kernel image. OK deraadt@ mvs@
2021-05-17Stop setting IPV6_MINMTU in ip6_send() which is used by the ICMP code.Claudio Jeker
Because of this large ping packets where fragmented even if the MTU did not indicate the need for it. This causes some trouble when system do not expect to receive a fragmented answer from a system. One such case is the automated link test from google routers before allowing to establish a BGP peering session with them. In general PMTU problems should be an issue from the past and if not it may be better to also break on ping packets and not only for UDP and TCP. ICMP ping is normaly the first tool in the admins toolbox to figure out network issues. OK phessler@ florian@ bluhm@
2021-05-12Use local copy of `ps_rtableid' in ip{,6}_ctloutput() and markmvs
`ps_rtableid' as atomic. This allows us to unlock setrtable(2). ok claudio@ mpi@
2021-04-30Rearrange the implementation of bounded sysctl. The primitiveAlexander Bluhm
functions are sysctl_int() and sysctl_rdint(). This brings us back the 4.4BSD implementation. Then sysctl_int_bounded() builds the magic for range checks on top. sysctl_bounded_arr() is a wrapper around it to support multiple variables. Introduce macros that describe the meaning of the magic boundary values. Use these macros in obvious places. input and OK gnezdo@ mvs@
2021-03-15Clear AUTOCONF6TEMP flag when we detach inet6.Florian Obser
2021-03-10spellingJonathan Gray
ok gnezdo@ semarie@ mpi@
2021-03-08We no longer "accept" RAs in the kernel, delete misleading comment.Florian Obser
2021-03-01Refactor ip_fragment() and ip6_fragment(). Use a mbuf list toAlexander Bluhm
simplify the handling of the fragment list. Now the functions ip_fragment() and ip6_fragment() always consume the mbuf. They free the mbuf and mbuf list in case of an error and take care about the counter. Adjust the code a bit to make v4 and v6 look similar. Fixes a potential mbuf leak when pf_route6() called pf_refragment6() and it failed. Now the mbuf is always freed by ip6_fragment(). OK dlg@ mvs@
2021-02-25we don't have to cast to caddr_t when calling m_copydata anymore.David Gwynne
the first cut of this diff was made with coccinelle using this spatch: @rule@ type caddr_t; expression m, off, len, cp; @@ -m_copydata(m, off, len, (caddr_t)cp) +m_copydata(m, off, len, cp) i had fix it's opinionated idea of formatting by hand though, so i'm not sure it was worth it. ok deraadt@ bluhm@
2021-02-23Use NULL instead of 0 in `m_nextpkt' assignment.mvs
ok deraadt@ dlg@
2021-02-11Swap faddr/laddr and fport/lport arguments in call to stoeplitz_ipXport().Patrick Wildt
Technically the whole point of the stoeplitz API is that it's symmetric, meaning that the order of addresses and ports doesn't matter and will produce the same hash value. Coverity CID 1501717 ok dlg@
2021-02-02As done for the AF_INET multicast case, ensure that passed interfaceClaudio Jeker
via index is actually in the right rdomain for the socket. OK bluhm@ mvs@
2021-02-02KNF, move { up to if () statementClaudio Jeker
2021-02-01Fix path MTU discovery for ESP tunneled in IPv6. We always wantAlexander Bluhm
short TCP segments or fragments encapsulated in ESP instead of fragmented ESP packets. Pass the don't fragment flag down along the stack so that dynamic routes with MTU are created eventually. with and OK markus@; OK tobhe@
2021-02-01Fix white spaces and wrap long lines.Alexander Bluhm
2021-01-25if stoeplitz is enabled, use it to provide a flowid for tcp packets.David Gwynne
drivers that implement rss and multiple rings depend on the symmetric toeplitz code, and use it to generate a key that decides with rx ring a packet lands on. if the toeplitz code is enabled, this diff has the pcb and tcp layer use the toeplitz code to generate a flowid for packets they send, which in turn is used to pick a tx ring. because the nic and the stack use the same key, the tx and rx sides end up with the same hash/flowid. at the very least this means that the same rx and tx queue pair on a particular nic are used for both sides of the connection. as the stack becomes more parallel, it will also help keep both sides of the tcp connection processing in the one place.
2021-01-11Create a path MTU host route for IPsec over IPv6. Basically theAlexander Bluhm
code is copied from IPv4 and adapted. Some things are changed in v4 to make it look similar. - ip6_forward increases the noroute error counter, do that in ip_forward, too. - Pass more specific sockaddr_in6 to icmp6_mtudisc_clone(). - IPv6 may also use reject routes for IPsec PMTU clones. - To pass a route_in6 to ip6_output_ipsec_send() introduce one in ip6_forward(). That is the same what IPv4 does. Note that dst and sin6 switch roles. - Copy comments from ip_output_ipsec_send() to ip6_output_ipsec_send() to make code similar. - Implement dynamic IPv6 IPsec PMTU routes. OK tobhe@
2021-01-06Mark a layer 2 address as expired by setting the length to 0 when theFlorian Obser
associated IPv6 NDP entry is invalidated. Otherwise we end up with an INCOMPLETE entry that can't be updated to STALE and REACHABLE by neighbor advertisements and thus interrupting communication. This is the same as arpinvalidate() for IPv4. Guidance bluhm & claudio, fix proposed by claudio OK claudio
2020-12-22For a while the kerrnel reports EACCES to userland if pf blocks aAlexander Bluhm
packet. IPv6 still had the old EHOSTUNREACH code. Use the same errno for dropped IPv6 packets as in IPv4. OK kn@ phessler@ claudio@ florian@ sashan@
2020-11-26fix typo in log message: inteface -> interfaceTheo Buehler
ok florian
2020-11-16Replace sysctl_rdint with sysctl_bounded_args entries in net.inet*gnezdo
2020-11-16Remove the cases folded into sysctl_bounded_args but left behindgnezdo
divert_sysctl and divert6_sysctl get a tiny bit slimmer.
2020-11-07Rework source IP address setting.denis
- Move most of the processing out of rtable.c (reasonnable tb@, ok bluhm@) - Remove memory allocation, store pointer to existing ifaddr - Fix tunnel interface handling looks fine mpi@
2020-11-05Replace wrong cast with satosin.denis
Advised by bluhm@
2020-10-29Add feature to force the selection of source IP addressdenis
Based/previous work on an idea from deraadt@ Input from claudio@, djm@, deraadt@, sthen@ OK deraadt@
2020-10-28When generating the ICMP6 response to an IPv6 packet, the kernelAlexander Bluhm
could use mbuf memory after freeing it. If m_pullup() allocates a new mbuf, the caller uses the old pointer. found and reported by Maxime Villard, thanks OK claudio@ markus@ denis@
2020-09-01Convert icmp6_sysct to sysctl_bounded_argsgnezdo
The best-guessed limits will be tested by trial.
2020-08-24Convert ip6_sysctl to sysctl_bounded_argsgnezdo
Tighter limits and OK by sashan
2020-08-24Convert divert*_sysctl to sysctl_bounded_argsgnezdo
OK sashan
2020-08-08No longer prevent TCP connections to IPv6 anycast addresses.Florian Obser
RFC 4291 dropped this requirement from RFC 3513: o An anycast address must not be used as the source address of an IPv6 packet. And from that requirement draft-itojun-ipv6-tcp-to-anycast rightly concluded that TCP connections must be prevented. The draft also states: The proposed method MUST be removed when one of the following events happens in the future: o Restriction imposed on IPv6 anycast address is loosened, so that anycast address can be placed into source address field of the IPv6 header[...] OK jca
2020-08-07The IPv6 source address selection rewrite had one (known) differenceFlorian Obser
to the previous behavior: In case of a tie the new implementation would keep the current best address while the old implementation replaced the best address. Since IPv6 addresses are stored in a TAILQ this meant that the rewrite would use the "oldest" address while the previous behavior was to use the "newest". RFC 6724 section 5 has no opinion which one is better and leaves the tie break up to implementers. naddy found out the hard way that this breaks his IPv6 connectivity in case of flash renumbering events when the link on his cpe flaps and a new prefix is used since we would always pick an old address. While we could pick the newest address in a tie break this feels too much like an implementation detail, a solution much more in the spirit of IPv6 is to pick the address with the highest preferred lifetime (or valid lifetime in case of another tie). very patient testing naddy@
2020-08-04Validate input given to ioctl(SIOCAIFADDR_IN6) like NetBSD already does.anton
Fixes a bunch of panics reported by syzkaller. ok florian@ Reported-by: syzbot+02f2e07964a89ab65ea4@syzkaller.appspotmail.com Reported-by: syzbot+c26b058a499ce38f689f@syzkaller.appspotmail.com Reported-by: syzbot+62af76d8cb7c09ac017c@syzkaller.appspotmail.com Reported-by: syzbot+d70144b3ae2ec068e318@syzkaller.appspotmail.com Reported-by: syzbot+3c87ca9873bfd0492f5c@syzkaller.appspotmail.com Reported-by: syzbot+323549177062adb80f84@syzkaller.appspotmail.com Reported-by: syzbot+e745c1c29d960337ce14@syzkaller.appspotmail.com Reported-by: syzbot+91da988a445013baf925@syzkaller.appspotmail.com Reported-by: syzbot+747cbcbbed6318542061@syzkaller.appspotmail.com Reported-by: syzbot+ca5efa23e00130bc8000@syzkaller.appspotmail.com Reported-by: syzbot+731ab8c9a0342ace4189@syzkaller.appspotmail.com Reported-by: syzbot+6c80b815a0ff8f09be69@syzkaller.appspotmail.com Reported-by: syzbot+7939d2c4bc9a5dfa707a@syzkaller.appspotmail.com Reported-by: syzbot+e893fb0259640a314d06@syzkaller.appspotmail.com Reported-by: syzbot+b6a3447070ae8ffcb125@syzkaller.appspotmail.com Reported-by: syzbot+23c0824b688f28c79c1b@syzkaller.appspotmail.com Reported-by: syzbot+6cc72412d8ddcf87f8a1@syzkaller.appspotmail.com
2020-08-02Add missing rtable(4) check in rip6_input()kn
Copied over from sys/netinet/raw_ip.c:rip_input() where it appeared with initial support for multiple routing tables. This enforces separation between multiple raw sockets in different routing tables, i.e. one must not see packets from the other if the rtable differs. Observed with ping6(8)'s "-v" showing all ICMPv6 packets on its raw socket including those produced by another ping6 with "-V1". florian reported IPv6 route advertisments in one routing table appearing on raw sockets in other routing tables as well. OK claudio florian
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 04:51:39 +0000