summaryrefslogtreecommitdiff
path: root/sys/netinet6
AgeCommit message (Collapse)Author
2019-12-08Make sure packet destination address matches interface address,Alexandr Nedvedicky
where such packet is bound to. This check is enforced if and only IP forwarding is disabled. Change discussed with bluhm@, claudio@, deraadt@, markus@, tobhe@ OK bluhm@, claudio@, tobhe@
2019-11-29add __func__ to panic() and printf() calls in sys/netinet6/*Nayden Markatchev
ok benno@ mortimer@
2019-11-18Accept inet6 address with missing sa_len for the get ioctl(2).Alexander Bluhm
dhcpcd from ports uses SIOCGIFAFLAG_IN6 without setting sin6_len. OK deraadt@ millert@
2019-11-11Kernel is missing propper input validation when configuring IPv6Alexander Bluhm
addresses. Implement in6_sa2sin6() to validate inet6 address family and address length. The SIOCGIFDSTADDR_IN6, SIOCGIFNETMASK_IN6, SIOCGIFAFLAG_IN6, SIOCGIFALIFETIME_IN6, and SIOCDIFADDR_IN6 ioctl(2) are safe now. OK visa@
2019-11-08convert interface address change hooks to tasks and a task_list.David Gwynne
this follows what's been done for detach and link state hooks, and makes handling of hooks generally more robust. address hooks are a bit different to detach/link state hooks in that there's only a few things that register hooks (carp, pf, vxlan), but a lot of places to run the hooks (lots of ipv4 and ipv6 address configuration). an address hook cookie was in struct pfi_kif, which is part of the pf abi. rather than break pfctl -sI, this maintains the void * used for the cookie and uses it to store a task, which is then used as intended with the new api.
2019-11-07Avoid NULL dereference in arpinvalidate() and nd6_invalidate() byKenneth R Westerback
making RTM_INVALIDATE code path perform same check as RTM_DELETE does. ok mpi@
2019-10-22Fix white spaces and use __func__ in printf().Alexander Bluhm
2019-10-18Don't check that the ipv6 source address of a neighbor advertisment isSebastian Benoit
from a neighbor's address. Sthen@ dug out RFC 4861 4.4 that says that the source address is "An address assigned to the interface from which the advertisement is sent." -- which can be from a network that the receiver does not know about. Indeed my provider sends such a neighbor advertisment for my default gateway, which breaks my uplink. Claudio@ added this check for symetry with NetBSD code when he added the same check to nd6_ns_input(), where it is needed to fix CVE-2008-2476. See also OpenBSD 4.2 errata 15. ok claudio@, kn@
2019-10-17in6_setsockaddr and in6_setpeeraddr can't fail, so let them return void.David Gwynne
this also brings them in line with the AF_INET equivalents. ok visa@ bluhm@
2019-09-04Add RCS Id.Alexander Bluhm
2019-09-04Fix a route use after free in IPv6 multicast route. Move theAlexander Bluhm
mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
2019-08-26Do not use the flow of the first fragment to store ECN information.Alexander Bluhm
Handle the ECN in the fragment queue. Reported-by: syzbot+0aa80b25e9041001cac8@syzkaller.appspotmail.com fix from FreeBSD; OK claudio@
2019-08-21 Remove support for semantically opace interface identifiers (RFC 7217)Florian Obser
for IPv6 link local addresses. Some hosting and VM providers route customer IPv6 prefixes to link local addresses derived from ethernet MAC addresses (RFC 2464). This leads to hard to debug IPv6 connectivity problems and is probably not worth the effort. RFC 7721 lists 4 weaknesses: 3.1. Correlation of Activities over Time & 3.2. Location Tracking These are still possible with RFC 7217 addresses for an adversary connected to the same layer 2 network (think conference wifi). Since the link local prefix stays the same (fe80::/64) the link local addresses do not change between different networks. An adversary on the same layer 2 network can probably track ethernet MAC addresses via different means, too. 3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation These now become possible, however, as noted above a layer 2 adversary was probably able to do this via different means. People concerned with these weaknesses are advised to use ifconfig lladdr random. OK benno input & OK kn
2019-08-06When we needed the kernel lock for local IP packet delivery, mpi@Alexander Bluhm
introduced a queue to grab the lock for multiple packets. Now we have only netlock for both IP and protocol input. So the queue is not necessary anymore. It just switches CPU and decreases performance. So remove the inet and inet6 ip queue for local packets. To get TCP running on loopback, we have to queue once between TCP input and output of the two sockets. So use the loopback queue in looutput() unconditionally. OK visa@
2019-06-21Prevent recursions by not deleting entries inside rtable_walk(9).Martin Pieuchot
rtable_walk(9) now passes a routing entry back to the caller when a non zero value is returned and if it asked for it. This allows us to call rtdeletemsg()/rtrequest_delete() from the caller without creating a recursion because of rtflushclone(). Multicast code hasn't been adapted and is still possibly creating recursions. However multicast route entries aren't cloned so if a recursion exists it isn't because of rtflushclone(). Fix stack exhaustion triggered by the use of "-msave-args". Issue reported by Dániel Lévai on bugs@ confirmed by and ok bluhm@.
2019-06-13In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag isClaudio Jeker
set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@ Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com
2019-06-13Copy the user provided sockaddr into a normalized sockaddr in rtrequest()Claudio Jeker
before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@ Reported-by: syzbot+10fe9cd8d0211c562ead@syzkaller.appspotmail.com
2019-06-10use m_microtime instead of microtime for SO_TIMESTAMP socketopt handlingDavid Gwynne
drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.
2019-06-10Use mallocarray(9) & put some free(9) sizes for M_IPMOPTS allocations.Martin Pieuchot
ok semarie@, visa@
2019-06-04Add missing NULL check for the protocol control block (pcb) pointer inanton
mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL. ok bluhm@ claudio@ Reported-by: syzbot+bdc489ecb509995a21ed@syzkaller.appspotmail.com Reported-by: syzbot+156405fdea9f2ab15d40@syzkaller.appspotmail.com
2019-04-28Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.Martin Pieuchot
This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
2019-04-23For raw IPv6 sockets userland may specify an offset where theAlexander Bluhm
checksum field is located. During rip6 input and output make sure that this field is within the packet. The offset my be -1 to disable the feature, otherwise it must be non-negative and aligned. Do a stricter check during setsockopt(2). from FreeBSD; OK claudio@
2019-04-22In in_cksum() and in6_cksum() convert types to C99 style and makeAlexander Bluhm
both functions consistent. In in_cksum() panic if len is longer than mbuf, but in in6_cksum() do not panic if off and len match exactly to the end of mbuf. OK claudio@
2019-04-20Statistics of "netstat -s -f inet6 -p rip6" did not work. InAlexander Bluhm
rip6_sysctl_rip6stat() copy out rip6counters, not ip6counters. OK deraadt@ claudio@
2019-02-13change rt_ifa_add and rt_ifa_del so they take an rdomain argument.David Gwynne
this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
2019-02-10remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.David Gwynne
MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
2019-02-04Avoid an mbuf double free in the oob soreceive() path. In theAlexander Bluhm
usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
2018-12-25rework icmp6_error() to be closer to icmp_error()denis
input & OK mpi@
2018-12-20The timeouts in nd6 are in msec so just use timeout_add_msec() insteadClaudio Jeker
of some complicated match to convert them to ticks. OK visa@ bluhm@ kn@
2018-12-10When forwarding IPv6 packets, generated ICMP6 packets used theAlexander Bluhm
interface address of the route as source address. To avoid using link-local addresses in ICMP6 packets sent into networks where they are out of scope, use the regular IPv6 source selection algorithm also in this icmp6_reflect() case. reported by sthen@; fix from Arnaud BRAND; OK claudio@
2018-12-07We are not going to send a neighbor advertisement from a non-masterFlorian Obser
carp interface. Move the check to the beginning of the function to make it clear that there are no other side effects happening. OK claudio
2018-12-06When building ND packets use m_align() to pack the mbuf as optimal asClaudio Jeker
possible. Because of an optional payload maxlen bytes are used on the m_align so that there is always enough space. OK florian@
2018-12-03Convert more MH_ALIGN() to m_align(). Also switch from m_gethdr/M_GETHDRClaudio Jeker
calls to m_get/M_GET calls because M_MOVE_PKTHDR() is initialising the pkthdr and so it is not needed when allocation the header. OK bluhm@
2018-11-30MH_ALIGN -> m_alignClaudio Jeker
OK bluhm@
2018-11-19Retire dom_rtkeylen from struct domain. Nothing is using this anymore.Claudio Jeker
It was used by the original patricia tree. OK mpi@
2018-11-09M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forClaudio Jeker
m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
2018-11-09Remove the last few XXX rdomain markers. Even those functions respect theClaudio Jeker
rdomain now and are therefor rdomain save. OK mpi@
2018-10-10RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.Reyk Floeter
rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
2018-10-05Do not join node information multicast group (RFC 4620).Florian Obser
Benno removed code to answer ICMP queries over 4 years ago. Aham Brahmasmi (aham.brahmasmi AT gmx.com) points out that we still joined the group though. OK sthen, bluhm, kn
2018-10-04Revert the inpcb table mutex commit. It triggers a witness panicAlexander Bluhm
in raw IP delivery and UDP broadcast loops. There inpcbtable_mtx is held and sorwakeup() is called within the loop. As sowakeup() grabs the kernel lock, we have a lock ordering problem. found by Hrvoje Popovski; OK deraadt@ mpi@
2018-09-20As a step towards per inpcb or socket locks, remove the net lockAlexander Bluhm
for netstat -a. Introduce a global mutex that protects the tables and hashes for the internet PCBs. To detect detached PCB, set its inp_socket field to NULL. This has to be protected by a per PCB mutex. The protocol pointer has to be protected by the mutex as netstat uses it. Always take the kernel lock in in_pcbnotifyall() and in6_pcbnotify() before the table mutex to avoid lock ordering problems in the notify functions. OK visa@
2018-09-13Add reference counting for inet pcb, this will be needed when weAlexander Bluhm
start locking the socket. An inp can be referenced by the PCB queue and hashes, by a pf mbuf header, or by a pf state key. OK visa@
2018-09-11Convert inetctlerrmap to u_char like inet6ctlerrmap. That is alsoAlexander Bluhm
what FreeBSD does. Remove old #if 0 version of inet6ctlerrmap. OK mpi@
2018-09-11Make the distribution of in_ and in6_ functions in in_pcb.c andAlexander Bluhm
in6_pcb.c consistent, to ease comparing the code. Move all inet6 functions to in6_. Bring functions in both source files in same order. Cleanup the include section. Now in_pcb.c is a superset of in6_pcb.c. The latter contains all the special implementations. Just moving arround, no code change intended. OK mpi@
2018-09-10Instead of calculating the mbuf packet header length here and there,Alexander Bluhm
put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
2018-09-10During fragment reassembly, mbuf chains with packet headers wereAlexander Bluhm
created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
2018-09-05factor error code in icmp6_mtudisc_clone(); ok kn@ florian@miko
2018-08-28Add per-TDB counters and a new SADB extension to export them toMartin Pieuchot
userland. Inputs from markus@, ok sthen@
2018-08-26Do not add ::1 on non-default lo(4) as intended.Martin Pieuchot
Reported by and ok sthen@
2018-08-22frag6_slowtimo: push NET_LOCK into frag6_freef around icmp6_error.cheloha
icmp6_error() still probably needs the NET_LOCK, as the call chain icmp6_error -> icmp6_reflect -> rt_match -> rt_clone -> rtrequest is possible. The fragment discard loop in frag6_slowtimo and the other cleanup bits in frag6_freef do not require it however. So push the lock down into frag6_freef around icmp6_error. Prompted by mpi. Discussed with bluhm and kn. Regress test help by bluhm. Additional testing by kn. ok kn@ visa@ mpi@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-05 20:44:06 +0000