summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2011-05-04Collapse m_pullup and m_pullup2 into a single function, as they'reBret Lambert
essentially identical; the only difference being that m_pullup2 is capable of handling mbuf clusters, but called m_pullup for shorter lengths (!). testing dlg@ ok claudio@
2011-05-04Clean up gotos for listening sockets to make it obvious when packetsBret Lambert
are dropped and when normal program flow occurs. Change error return value of syn_cache_add() from 0 to -1 in order to clearly communicate intent. ok claudio@
2011-05-02recognize SO_RTABLE socket option at the SOL_SOCKET level;Mike Belopuhov
discussed with and ok claudio
2011-04-29The previous reconfiguration change broke IPv6 only setups.Marco Pfatschbacher
The address hook was only registered for v4 addresses. We now call hook_establish at interface creation time. The hook is now disestablished upon interface destroy, which plugs a tiny memleak. While there remove redundancy in carp_set_addr6 and sync it with carp_set_addr. Bug noticed by todd@. OK sthen, mikeb (on an earlier version) OK and some hints by camield@
2011-04-29In certain failure cases, a RST would be sent out on rdomain 0,Bret Lambert
regardless of the rdomain the packet was received on. Explicitly pass the rdomain to the tcp_respond() monstrosity to compensate for said monstricism which led to this behavior. ok claudio@
2011-04-28Make in_broadcast() rdomain aware. Mostly mechanical change.Claudio Jeker
This fixes the problem of binding sockets to broadcast IPs in other rdomains. OK henning@
2011-04-28Similar to the in_pcb.c change allow raw sockets to be bound to theClaudio Jeker
local network boradcast. While there kill some leftover AF_IMPLINK checks. OK henning@, sthen@
2011-04-28Allow SOCK_DGRAM sockets to be bound to the local network broadcast addr.Claudio Jeker
These sockets will only see broadcast sent to that particular address. Some applications like samba use this feature. Problem found and initial version by sthen@, OK sthen@, henning@
2011-04-26In ipsec_common_input() the packet can be either IPv4 or IPv6. SoAlexander Bluhm
pass it to the correct raw ip input function if IPsec is disabled. ok todd@ mpf@ mikeb@ blambert@ matthew@ deraadt@
2011-04-24Double link between pf states and sockets. Henning has alreadyAlexander Bluhm
implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
2011-04-19reintroduce using the RB tree for local address lookups. this isDavid Gwynne
confusing because both addresses and broadcast addresses are put into the tree. there are two types of local address lookup. the first is when the socket layer wants a local address, the second is in ip_input when the kernel is figuring out the packet is for it to process or forward. ip_input considers local addresses and broadcast addresses as local, however, the handling of broadcast addresses is different depending on whether ip_directedbcast is set. if if ip_directbcast is unset then a packet coming in on any interface to any of the systems broadcast addresses is considered local, otherwise the broadcast packet must exist on the interface it was received on. the code also needs to consider classful broadcast addresses so we can continue some legacy applications (eg, netbooting old sparcs that use rarp and bootparam requests to classful broadcast addresses as per PR6382). this diff maintains that support, but restricts it to packets that are broadcast on the link layer (eg, ethernet broadcasted packets), and it only looks up addresses on the local interface. we now only support classful broadcast addresses on local interfaces to avoid weird side effects with packets routed to us. the ip4 socket layer does lookups for local addresses with a wrapper around the global address tree that rejects matches against broadcast addresses. we now no longer support bind sockets to broadcast addresses, no matter what the value of ip_directedbcast is. ok henning@ testing (and possibly ok) claudio@
2011-04-14Backout the in_iawithaddr() -> ifa_ifwithaddr() change.Claudio Jeker
There is a massive issue with broadcast addrs because ifa_ifwithaddr() handles them differently then in_iawithaddr().
2011-04-13add missing #include "pf.h" for NPF; ok mikeb, claudio, mpfMarkus Friedl
2011-04-12put the accepted socket of a diverted connection into the routing domainMike Belopuhov
of a connection originator. this allows one to query the source rdomain with a SO_RTABLE socket option. figured out with reyk, ok claudio.
2011-04-06uncompress a packet with an IPcomp header only once; this preventsMarkus Friedl
endless loops by IPcomp-quine attacks as discovered by Tavis Ormandy; it also prevents nested IPcomp-IPIP-IPcomp attacks provied by matthew@; feedback and ok matthew@, deraadt@, djm@, claudio@
2011-04-05in_proto_csum_out: if M_ICMP_CSUM_OUT is set, do the icmp checksumHenning Brauer
ok dlg fondue-kinda-ok claudio
2011-04-05Replace if/else ladder with much more legible switch statement forBret Lambert
testing tcp flags. ok henning@ claudio@
2011-04-05mechanic rename M_{TCP|UDP}V4_CSUM_OUT -> M_{TCP|UDP}_CSUM_OUTHenning Brauer
ok claudio krw
2011-04-05Remove unused macro.Bret Lambert
ok henning@ claudio@
2011-04-04turn some macros into functions; saves 1400+ bytes from the kernelBret Lambert
on amd64 ok claudio@
2011-04-04Instead of calling tcp_reass (tcp reassembly) with magic argumentsBret Lambert
in order to skip most of the reassembly logic and try to flush available tcp segments to the socket, just split it off into its own function and use it where appropriate. ok claudio@ henning@
2011-04-04Correctly inherit and set the watermarks on socketbuffers.Claudio Jeker
This fixes the NFS problems reported on the mailing list and ensures that accepted sockets have correct socketbuffer setting. OK blambert@, henning@
2011-04-04de-guttenberg our stack a bitHenning Brauer
we don't need 7 f***ing copies of the same code to do the protocol checksums (or not, depending on hw capabilities). claudio ok
2011-04-04The forced IP header pullup in the multicast case is only needed whenClaudio Jeker
the system is a multicast forwarder so move the code into that block and save a few unneeded m_pullups. Found by dlg a long time ago. OK dlg@
2011-04-04Do not accept ICMP redirects when acting as router (ipforwarding = 1).Claudio Jeker
Same logic is already implemented in netinet6 OK henning@ deraadt@
2011-04-04install an additional bpf hook in the carp_input so that multicastMike Belopuhov
and broadcast packets will be caught too; also we need to increment the incoming packet counter as reminded by claudio. ok claudio mpf
2011-04-04there is no need to special case the bridge in the ip checksum handlingHenning Brauer
ok sthen claudio dlg
2011-04-04change an if statement to a switch to reduce eye bleedageBret Lambert
no change in .o md5 "ok gcc" claudio@
2011-04-04make in_iawithaddr a wrapper for ifa_ifwithaddr plus a hack for old ancientHenning Brauer
classful broadcast so we can still netboot sparc and the like. compat hack untested, i will deal with the fallout if there is any later at the same time stop exporting in_iawithaddr, everything but ip_input should (and now does) use ifa_ifwithaddr directly ok dlg sthen and agreement from many
2011-04-04in_iawithaddr -> ifawithaddrHenning Brauer
the latter is now much faster and the former becomes a wrapper + compat hacks around the latter in a bit. ok dlg sthen and "ah hai" from various in various bars here
2011-04-03Don't attempt to enqueue mbufs on sockets marked as SS_CANTRCVMORE, asBret Lambert
was done earlier for routing sockets. ok claudio@
2011-04-03don't rely on implict net/route.h inclusion via pf, claudio okHenning Brauer
2011-04-02rmeove the link1 hack, it is in the way, it is only half-baked and doesn'tHenning Brauer
work as you think it does, and the same can easily be achieved using pf ok claudio dlg sthen theo
2011-03-31- use nitems(); no binary changeJasper Lievisse Adriaanse
ok claudio@
2011-03-08Fix a subtle carp reconfiguration problem.Marco Pfatschbacher
Updating the HMAC from the carp_ioctl call does not see the newly set IP address in the if_addrlist. The only chance for carp to see the new address is via the address-hook callback. This change moves the detection of address changes entirely into carp_addr_updated. Furthermore, only call carp_hmac_prepare for the SIOCSVH case. This second bug was the reason why the first one went unnoticed for such a long time. Problem found and debugging help by camield@. OK camield@
2011-03-05The function pf_tag_packet() never fails. Remove a redundant checkAlexander Bluhm
and make it void. ok henning@, markus@, mcbride@
2011-02-11In ip_forward() free the mbuf chain mcopy with m_freem() insteadAlexander Bluhm
of m_free(). The was no leak before as m_copym() and m_pullup() are always called with the same length. But it is better to use the correct function anyway. ok henning@ mpf@ markus@
2011-02-03ip_ttl is u_int8_t, not u_char so adjust sizeof for consistency.Todd C. Miller
No binary change. OK otto@
2011-01-11for key material that is being being discarded, convert bzero() toTheo de Raadt
explicit_bzero() where required ok markus mikeb
2011-01-07Add socket option SO_SPLICE to splice together two TCP sockets.Alexander Bluhm
The data received on the source socket will automatically be sent on the drain socket. This allows to write relay daemons with zero data copy. ok markus@
2010-12-21don't leak short packets; ok mikeb@Markus Friedl
2010-12-21Doh! Forgot to set the rdomain when sending out carp announcements.Claudio Jeker
With and OK phessler@
2010-12-21don't leak mbuf if padding failes; ok mikeb@Markus Friedl
2010-11-28Only call ifa_del() when no error happend previously. Do the same thingClaudio Jeker
for dohooks() since it makes no sense to call the if_addrhooks when the address assignment failed. Additionally only call ifa_add() in in_ifinit() when no error happend. Fixes a carp(4) panic seen by dhill and dlg. OK henning@, dlg@
2010-11-26more useful logging level for demotion adjustmentsOtto Moerbeek
ok mcbide@ claudio@ henning@
2010-11-17an extra parameter for in_ifinit, indicating wether the ifaddr passed to itHenning Brauer
is new or an already existing one. for existing ones, call ifa_del first tested by many as part of a larger diff, ok claudio dlg krw sthen
2010-11-17use ifa_update_broadaddr and make sure bcast address is set before callingHenning Brauer
in_ifinit tested by many as part of a larger diff, ok claudio dlg krw sthen
2010-11-17move the ifa_add call to in_ifinit() so it is called AFTER the ifaddrHenning Brauer
structure is fully set up tested by many as part of a larger diff, ok claudio dlg sthen krw
2010-10-28Normalize mbuf after prepending space for the header since the dataClaudio Jeker
in the mbuf my be improperly aligned. Whenever a function is reinjecting packets from low level output functions into high level output functions (like ip_output) it must be guaranteed that the mbuf data is properliy aligned. OK blambert@, deraadt@
2010-10-23Fix pr 6192: make netinet/tcp.h follow SUSv4 namespace rules byPhilip Guenthe
hiding everything but the TCP_* options unless __BSD_VISIBLE. While we're here, change the structure to use u_int32_t instead of u_int to cut-off the types discussion. ok tedu@, mikeb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 07:05:43 +0000