summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2013-10-20no need to make the icmp cksum "offloading" case special insofar that theHenning Brauer
cksum needs to be 0'd before, pf does that now (just like in the tcp/udp case) and nothing else uses the icmp "offloading" yet. with & ok bluhm
2013-10-20Put a large chunk of the IPv6 rdomain support in-tree.Peter Hessler
Still some important missing pieces, and this is not yet enabled. OK bluhm@
2013-10-19Our IPv6 stack was scanning all extension headers for routing headerAlexander Bluhm
type 0 and dropped the packet if it found one. RFC 5095 demands to handle a routing header type 0 like an unrecognised routing type. This is enough to protect the own machine. To protect a network as a firewall, we have pf which does the same full scan in pf_walk_header6(). As pf is enabled by default, nothing changes for most users. If you turn off pf on your router, you should not expect extra protection. Get rid of the double scanning in ip6_input() and and the older disabled code in route6_input(). No more special treatment of routing header type 0 in the IPv6 stack. OK henning@ mikeb@
2013-10-17The header file netinet/in_var.h included netinet6/in6_var.h. ThisAlexander Bluhm
created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
2013-10-14Change the macros used to iterate over the multicast records of anMartin Pieuchot
interface to not depend on the global list of addresses. For IPv4 the IP_TO_IA() macro still depends on the global list of addresses because we want to be sure to grab the first configured address of an interface, where the records are linked. Tested by sthen@, ok henning@
2013-10-09Fix a possible mbuf leak, from NetBSD via Loganaden Velvindron.Martin Pieuchot
ok claudio@, henning@
2013-10-01Do not pass the SIOCSIF{DSTADDR,BRDADDR,NETMASK} ioctls down to theMartin Pieuchot
driver when using an AF_INET6 socket without checking for permission. From Loganaden Velvindron, ok bluhm@
2013-08-28Remove unused argument from *rtrequest()Martin Pieuchot
ok krw@, mikeb@
2013-08-27Sync comment with reality, the draft is now an RFC and OpenBSD followsMartin Pieuchot
it since bluhm@ implemented it in 2012. From Loganaden Velvindron, ok claudio@
2013-08-26No one uses the obsolete IPv6 ioctls SIOCGDRLST_IN6, SIOCGPRLST_IN6,Alexander Bluhm
OSIOCGIFINFO_IN6 anymore. Remove them together with the structs in6_drlist, in6_oprlist, in6_prlist, in6_ondireq and the kernel implementation. OK mikeb@ henning@
2013-08-13Switch time_t, ino_t, clock_t, and struct kevent's ident and dataPhilip Guenther
members to 64bit types. Assign new syscall numbers for (almost all) the syscalls that involve the affected types, including anything with time_t, timeval, itimerval, timespec, rusage, dirent, stat, or kevent arguments. Add a d_off member to struct dirent and replace getdirentries() with getdents(), thus immensely simplifying and accelerating telldir/seekdir. Build perl with -DBIG_TIME. Bump the major on every single base library: the compat bits included here are only good enough to make the transition; the T32 compat option will be burned as soon as we've reached the new world are are happy with the snapshots for all architectures. DANGER: ABI incompatibility. Updating to this kernel requires extra work or you won't be able to login: install a snapshot instead. Much assistance in fixing userland issues from deraadt@ and tedu@ and build assistance from todd@ and otto@
2013-08-11To control the lifetime of IPv6 addresses, prefixes and defaultAlexander Bluhm
routers, the kernel and ndp use a bunch of expire fields. Before they were int or u_long, convert expire to time_t in all structs. Move vltime and pltime to u_int32_t everywhere. Sort struct fields by size. Struct inet6_ndpr_msghdr is not used at all, so remove it. Binary compatibility of rtsold and ndp break with this change as rtsold uses in6_drlist and ndp uses in6_defrouter and in6_prefix to interact with the kernel. OK mpi@
2013-07-31Move bridge_broadcast and subsequently all IPsec SPD lookup code outMike Belopuhov
of the IPL_NET. pf_test should be no longer called under IPL_NET as well. The problem became evident after the related issue was brought up by David Hill <dhill at mindcry ! org>. With input from and OK mpi. Tested by David and me.
2013-07-04format string fixes: size_t and uint16_tStefan Fritsch
ok bluhm@
2013-07-01Do not access queue fields directly, use FOREACH() macro instead.Alexander Bluhm
No binary change. OK mikeb@ mpi@
2013-07-01Use the LIST_FOREACH() macro when looping over advertising routers.Alexander Bluhm
No binary change. OK mikeb@ mpi@
2013-06-26put the cksum diff back, of course with the bug fixed where we couldHenning Brauer
under some circumstances repair broken checksums on the way. ok ryan naddy mikeb . redo most of the protocol (tcp/udp/...) checksum handling -assume we have hardware checksum offloading. stop mucking with the checksum in most of the stack -stop checksum mucking in pf, just set a "needs checksumming" flag if needed -in all output pathes, very late, if we figure out the outbound interface doesn't have hw cksum offloading, do the cksum in software. this especially makes the bridge path behave like a regular output path -little special casing for bridge still required until the broadcast path loses its disgusting shortcut hacks, but at least it's in one place now and not all over the stack in6_proto_cksum_out mostly written by krw@ started at k2k11 in iceland more than 1.5 years ago - yes it took that long, this stuff is everything but easy. this happens to fix the infamous pf rdr bug that made us turn off proto cksum offloading on almost all interface drivers.
2013-06-20Revert previous and unbreak asr, the new include should be protected.Martin Pieuchot
Reported by naddy@
2013-06-20Allocate the various hook head descriptors as part of the ifnetMartin Pieuchot
structure rather than doing various M_WAITOK allocations during the *attach() functions, we always rely on them anyway. ok mikeb@, uebayasi@
2013-06-17Remove unused field ia_plen from struct in6_ifaddr. The prefixAlexander Bluhm
length is always calculated on demand from ia_prefixmask. OK claudio@ mpi@ henning@
2013-06-16If the prefixlen is 128, SIOCAIFADDR_IN6 does not add a prefix. InAlexander Bluhm
this case, in6_unlink_ifa() must not complain about a missing prefix. To avoid a false log message, check the prefixmask when the interface address gets deleted. OK mpi@
2013-06-13As it is correct that the loopback address has no prefix, do notAlexander Bluhm
complain about a missing prefix for ::1 in in6_unlink_ifa(). Also log the actual IPv6 address in the error message instead of the kernel pointer of the interface address. OK sthen@ mpi@
2013-06-13Merge two blocks where we drop the packet to reduce the differences withMartin Pieuchot
ipv4_inpu(), no functional change. ok bluhm@
2013-06-11Replace all ovbcopy with memmove; swap the src and dst arguments tooTheo de Raadt
ok otto
2013-06-05If an ICMP packet gets diverted to a raw IP socket, if must not beAlexander Bluhm
consumed by icmp_input(). As an exception, control packets that belong to a connection to a local socket must go to pr_ctlinput(). Add a switch over the ICMP type to handle that. OK markus@ henning@
2013-06-04Implement pf divert-to and divert-reply also for IPv6 raw sockets.Alexander Bluhm
OK henning@ markus@
2013-06-01Pass the routing domain to IPv6 pr_ctlinput() like in IPv4.Alexander Bluhm
OK claudio@
2013-05-31Remove a bunch of sockaddr_in6 pointer casts and replace othersAlexander Bluhm
with sin6tosa() or satosin6() inline functions. This allows the compiler to check the types more strictly. OK mpi@
2013-05-31The function rip6_ctlinput() claims that sa6_src is constant toAlexander Bluhm
allow the assingment of &sa6_any. But rip6_ctlinput() could not guarantee that as it casted away the const attribute when it passes the pointer to in6_pcbnotify(). Replace sockaddr with const sockaddr_in6 in the in6_pcbnotify() parameters. This reduces the number of casts. Also adjust in6_pcbhashlookup() to handle the const attribute correctly. Input and OK claudio@
2013-05-30Do not allow SIOCSIFADDR on AF_INET6 sockets. The ioctl is handled downClaudio Jeker
to the driver where uninitialized data will be accessed. Problem reported by hugh@, OK and input deraadt@, henning@
2013-05-14Fix build with MRT6DEBUG defined.Martin Pieuchot
2013-05-02tedu broken Resource Reservation Protocol code that was ifdef RSVP_ISI.Martin Pieuchot
ok deraadt@, tedu@ (implicit)
2013-04-24Instead of having various extern declarations for protocol variables,Martin Pieuchot
declare them once in their corresponding header file.
2013-04-11Remove the extern keyword from function declarations, documentMartin Pieuchot
sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
2013-04-10Remove various external variable declaration from sources files andMartin Pieuchot
move them to the corresponding header with an appropriate comment if necessary. ok guenther@
2013-04-10Fix various glitches in queue macro usage.Philip Guenther
ok millert@
2013-04-09Remove read-only ipsec variables and directly use defines instead.Martin Pieuchot
ok mikeb@, markus@
2013-04-08Recalculate the IP and protocol checksums of packets (re)injected viaLawrence Teo
divert(4) sockets. Recalculation of these checksums is necessary because (1) PF no longer updates IP checksums as of pf.c rev 1.731, so translated packets that are diverted to userspace (e.g. divert-packet with nat-to/rdr-to) will have bad IP checksums and will be reinjected with bad IP checksums if the userspace program doesn't correct the checksums; (2) the userspace program may modify the packets, which would invalidate the checksums; and (3) the divert(4) man page states that checksums are supposed to be recalculated on reinjection. This diff has been tested on a public webserver serving both IPv4/IPv6 for more than four weeks. It has also been tested on a firewall with divert-packet and nat-to/rdr-to where it transferred over 60GB of FTP/HTTP/HTTPS/SSH/DNS/ICMP/ICMPv6 data correctly, using IPv4/IPv6 userspace programs that intentionally break the IP and protocol checksums to confirm that recalculation is done correctly on reinjection. IPv6 extension headers were tested with Scapy. Thanks to florian@ for testing the original version of the diff with dnsfilter and Justin Mayes for testing the original version with Snort inline. Thanks also to todd@ for helping me in my search for the cause of this bug. I would especially like to thank blambert@ for reviewing many versions of this diff, and providing guidance and tons of helpful feedback. no objections from florian@ help/ok blambert@, ok henning@
2013-04-07Make the SO_BINDANY socket option also work for raw IPv6 sockets.Alexander Bluhm
OK markus@
2013-04-04Make icmp6 ready for 64 bit time_t by adding a range check and anAlexander Bluhm
explicit cast. OK deraadt@
2013-04-02Use macros sotoinpcb() and intotcpcb() instead of casts. Use NULLAlexander Bluhm
instead of 0 for pointers. No binary change. OK mpi@
2013-04-01Allow raw IPv6 sockets for IPsec protocols. IPv4 does the same.Alexander Bluhm
Ok claudio@
2013-04-01There is no IPv6 default scope in OpenBSD. Remove leftovers.Alexander Bluhm
No binary change. OK claudio@
2013-03-31The call to in_pcballoc() in user request attach was handled inAlexander Bluhm
three different ways. Use the same code in udp_usrreq() and rip_usrreq() and rip6_usrreq(). This also fixes a pcb and socket leak in udp_usrreq() in case soreserve() fails. Put an splsoftassert() into in_pcballoc() for safety. OK mpi@
2013-03-30Restrict protocol numbers for raw sockets to the range from 0 to 255.Alexander Bluhm
OK deraadt@ guenther@
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2013-03-28no need for a lot of code to include proc.hTed Unangst
2013-03-28Convert the satosin, sintosa, ifatoia, satosin6, sin6tosa, ifatoia6Alexander Bluhm
defines into static inline functions. This allows the compiler to check the source type before casting. liked by many; OK mpi@ haesbaert@
2013-03-28Unfortunately the satosin, sintosa, ifatoia, satosin6, sin6tosa,Alexander Bluhm
ifatoia6 macros do not check the source type. They just cast anything. Remove needless casts and do not use those macros if the source type does not match. Remove duplicate defines. No binary change. OK kettenis@ krw@
2013-03-26Remove various read-only *maxlen variables and use IFQ_MAXLEN directly.Martin Pieuchot
ok beck@, mikeb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-02 01:29:54 +0000