summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2019-07-17Introduce ETHER_IS_BROADCAST/ANYADDR/EQ() and use them where appropriate.Martin Pieuchot
ok dlg@, sthen@, millert@
2019-07-15Initialize struct inpcb pool not on demand, but during initialization.Alexander Bluhm
Removes a global variable and avoids MP problems. OK mpi@ visa@
2019-07-12Count the number of TCP SACK options that were dropped due to theAlexander Bluhm
sack hole list length or pool limit. OK claudio@
2019-07-10Received SACK options are managed by a linked list at the TCP socket.Alexander Bluhm
There is a global tunable limit net.inet.tcp.sackholelimit, default is 32768. If an attacker manages to attach all these sack holes to a few TCP connections, the lists may grow long. Traversing them might cause higher CPU consumption on the victim machine. In practice such a situation is hard to create as the TCP retransmit and 2*msl timer flush the list periodically. For additional protection, enforce a per connection limit of 128 SACK holes in the list. reported by Reuven Plevinsky and Tal Vainshtein discussed with claudio@ and procter@; OK deraadt@
2019-07-08free(9) sizes for M_RTABLE.Martin Pieuchot
ok kn@
2019-07-05add ac_trunkport to arpcom so trunks can coordinate owning an interfaceDavid Gwynne
Ethernet interfaces can be used by trunk(4), and i'm about to commit a new aggr(4) driver which should not be able to use an interface while trunk owns it and visa versa.
2019-06-21Prevent recursions by not deleting entries inside rtable_walk(9).Martin Pieuchot
rtable_walk(9) now passes a routing entry back to the caller when a non zero value is returned and if it asked for it. This allows us to call rtdeletemsg()/rtrequest_delete() from the caller without creating a recursion because of rtflushclone(). Multicast code hasn't been adapted and is still possibly creating recursions. However multicast route entries aren't cloned so if a recursion exists it isn't because of rtflushclone(). Fix stack exhaustion triggered by the use of "-msave-args". Issue reported by Dániel Lévai on bugs@ confirmed by and ok bluhm@.
2019-06-13In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag isClaudio Jeker
set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@ Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com
2019-06-13Copy the user provided sockaddr into a normalized sockaddr in rtrequest()Claudio Jeker
before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@ Reported-by: syzbot+10fe9cd8d0211c562ead@syzkaller.appspotmail.com
2019-06-10use m_microtime instead of microtime for SO_TIMESTAMP socketopt handlingDavid Gwynne
drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.
2019-06-10Use mallocarray(9) & put some free(9) sizes for M_IPMOPTS allocations.Martin Pieuchot
ok semarie@, visa@
2019-06-04Add missing NULL check for the protocol control block (pcb) pointer inanton
mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL. ok bluhm@ claudio@ Reported-by: syzbot+bdc489ecb509995a21ed@syzkaller.appspotmail.com Reported-by: syzbot+156405fdea9f2ab15d40@syzkaller.appspotmail.com
2019-05-11unbreak the build without IPSEC.Sebastian Benoit
ok claudio@ deraadt@
2019-04-28Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.Martin Pieuchot
This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
2019-04-23a first cut at converting some virtual ethernet interfaces to if_vinputDavid Gwynne
this let's input processing bypass ifiqs. there's a performance benefit from this, and it will let me tweak the backpressure detection mechanism that ifiqs use without impacting on a stack of virtual interfaces. ive tested all of these except mpw, which i will end up testing soon anyway.
2019-04-22In in_cksum() and in6_cksum() convert types to C99 style and makeAlexander Bluhm
both functions consistent. In in_cksum() panic if len is longer than mbuf, but in in6_cksum() do not panic if off and len match exactly to the end of mbuf. OK claudio@
2019-04-05In debug mode print TCP flag names to console correctly.Alexander Bluhm
from Mitchell Krome
2019-02-13change rt_ifa_add and rt_ifa_del so they take an rdomain argument.David Gwynne
this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
2019-02-10remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.David Gwynne
MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
2019-02-06Fix a possible mbuf leak in tcp_usrreq(). Make the error handlingAlexander Bluhm
more consistent to the other protocols' usrreq functions. OK visa@ claudio@
2019-02-04Avoid an mbuf double free in the oob soreceive() path. In theAlexander Bluhm
usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
2019-01-20Refresh arp entries that are about to expire. Once their life time is lessClaudio Jeker
then 1/8 of net.inet.ip.arptimeout the system will send out a arp request about every 30 seconds until either the entry is updated or expired. Not refreshing arp entries will result in packet drop every time a entry expires which is not ideal for important gateway entries. Came up with this after a discussion with deraadt@. OK benno@ deraadt@
2019-01-18Bring back the ip_pcbopts() refactor. Pad the option buffer and thereforClaudio Jeker
the mbuf to the next word length as it is required by the standard. Also use the correct offset from the input mbuf. OK visa@, input & OK bluhm@
2019-01-18Revert Rev 1.351, the change is not quite right yet.Claudio Jeker
2019-01-08Botched up an if conditional in the last commit. The IP length needs toClaudio Jeker
bigger than the IP header len to be valid. With this I can traceroute again.
2019-01-07Validate the version, and all length fields of IP packets passed to a raw socketClaudio Jeker
with INP_HDRINCL. There is no reason to allow badly constructed packets through our network stack. Especially since they may trigger diagnostic checks further down the stack. Now EINVAL is returned instead which was already used for some checks that happened before. OK florian@ Reported-by: syzbot+0361ed02deed123667cb@syzkaller.appspotmail.com
2019-01-06Rewrite ip_pcbopts() to fill a fresh mbuf with the ip options insteadClaudio Jeker
of fiddling with the user supplied mbuf and then copy it at the end. OK visa@
2019-01-03Replace a funky 'else switch' construct into something that is equal butClaudio Jeker
a lot easier to read. The if can simply return the error and so the else branch is no longer needed. Input and OK dhill@
2018-12-25rework icmp6_error() to be closer to icmp_error()denis
input & OK mpi@
2018-12-20Replace a wrong poor mans m_trailingspace() with the real thing. The mbufClaudio Jeker
passed to ip_pcbopts could be a cluster and so the size check is all wrong. found by Greg Steuck; OK bluhm@ Reported-by: syzbot+c2543ae6b6692a5843e3@syzkaller.appspotmail.com eVS: ----------------------------------------------------------------------
2018-12-17Switch from timeout_add with tvtohz to just timeout_add_tv. Now this changeClaudio Jeker
will reduce the sleep time by one tick which doesn't matter in the common case. The code never passes a true 0 timeval to timeout_add_tv so the code will always sleep for at least 1 tick which is good enough. OK kn@, florian@, visa@, cheloha@
2018-12-11split ether_output into resolution, encapsulation, and output functionsDavid Gwynne
if if_output can be overridden on ethernet interfaces, it will allow things like vlan to do it's packet encapsulation during output before putting the packet directly on the underlying interface for output. this has two benefits. first, it can avoid having ether_output on pseudo interfaces recurse, which makes profiling of the network stack a lot clearer. secondly, and more importantly, it allows pseudo ethernet interface packet encapsulation to by run concurrently by the stack, rather than having packets unnecessarily serialied by an ifq. this diff just splits ether_output up, it doesnt have any interface take advantage of it yet. tweaks and ok claudio@
2018-12-04Use m_align() and while there reorder the pkthdr initalisation a bit.Claudio Jeker
This also makes the IPv4 and IPv6 code more similar. OK phessler@
2018-12-03In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter freesClaudio Jeker
the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
2018-11-30MH_ALIGN -> m_align. In revarprequest() set the ph_rtableid so thatClaudio Jeker
the function is doing the same initialisation as arprequest(). OK bluhm@
2018-11-28Further cleanup of icmp_do_error.Claudio Jeker
- Use m_align() since it handles all cases - Use same rounding logic in the size check as in m_align() so all data will filt always. - consolidate pkthdr initalisation into one place - use m_prepend() instead of direct pointer manipulation (including the panic in case an underflow happens). OK bluhm@
2018-11-19Retire dom_rtkeylen from struct domain. Nothing is using this anymore.Claudio Jeker
It was used by the original patricia tree. OK mpi@
2018-11-14provide ip_tos_patch() for setting ip_tos and patching the ipv4 cksum.David Gwynne
previously the gif code would patch the tos field and not recalc the cksum, which would cause ip input code to drop the packet due to a cksum failure. the ipip code patched ip_tos and unconditionally recalculated the cksum, making it correct, but also wiping out any errors that may have been present before the recalculation. updating the cksum rather than replacing it lets cksum failures still fire. ip_tos_patch() is provided in the ecn code since it's because of ecn propagation that we need to update the tos field. internally it works like pf_patch_8 and pf_cksum_fixup, but since pf is optional it rolls its own code. procter may fix that in the future... ok claudio@
2018-11-10Do not translate the EACCES error from pf(4) to EHOSTUNREACH anymore.Alexander Bluhm
It also translated a documented send(2) EACCES case erroneously. This was too much magic and always prone to errors. from Jan Klemkow; man page jmc@; OK claudio@
2018-11-09M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forClaudio Jeker
m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
2018-11-09Remove the last few XXX rdomain markers. Even those functions respect theClaudio Jeker
rdomain now and are therefor rdomain save. OK mpi@
2018-11-05In icmp_input_if() m_pullup up the maximum size of required data at the start.Claudio Jeker
The maximum is ICMP_MINLEN (8) + max IPv4 header size (60) + IPv6 header (40) for the IPv6 over IPv4 transition case. By having up to this amount of data consequtive in an mbuf makes the rest of the code simpler and no more extra m_pullup calls are needed. Only length checks are now required.The maximum size is also big enough for all other ICMP types that don't embed the IP heaader. This ensures that all data has been m_pullup-ed before calling the ctlinput function which can look that deep into the header. OK bluhm@ markus@
2018-11-05Consider the size of IP header when doing the ICMP length overflowAlexander Bluhm
check. This code was never reached as ICMP length was truncated before, but fix the wrong calculation anyway. OK claudio@
2018-11-05Fixup the case where an mbuf cluster is used. Correctly offset the data toClaudio Jeker
the end of the cluster (there is no M_ALIGN version for clusters so it is hard coded). Also make the sanity check more general by using m_leadingspace. Not a security issue since the cluster code is not reachable, there is enough space in an mbuf. OK bluhm@
2018-11-04The change of the sb_mbmax calculation in sbreserve() broke settingAlexander Bluhm
a fixed socket send buffer size for TCP. tcp_update_sndspace() could overwrite the value as the algorithms were not in sync. OK benno@ claudio@
2018-10-22ipsec: use monotonic clock for SA creation/lookup timestamps; ok dlg@cheloha
2018-10-18Partial revert of previous. Only the queue(3) stuff should have gone in.cheloha
2018-10-18igmp, struct router_info: use queue(3)cheloha
In particular, use LIST_* to preserve O(n) removal in rti_delete(). While here, clean up two malloc(9) calls. Suggested by mpi@. ok visa@
2018-10-13Expose net.inet.ip.arpq.drops to help debug what's going on when a lotFlorian Obser
of packets are being dropped but non of the other counters are increasing. From Daniel Hokka Zakrisson (daniel AT hozac DOT com), thanks! OK florian, phessler
2018-10-10RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.Reyk Floeter
rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-19 15:17:26 +0000