summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2016-04-29Do not allow to change the routing table of a bound socket. ThisAlexander Bluhm
is not intended and will behave unexpectedly if the address is already used in another domain. It did not work anyway, as the PCB ended in the wrong hash bucket after changing the rtable. Fail with EBUSY if the socket is already bound and rehash the PCB if its rtable changes. input claudio@; OK mpi@
2016-04-27Remove unused arguments from rt_checkgate().Martin Pieuchot
Since the rtalloc(9) rewrite no route lookup is done in this function so there's no need for a destination or a rtable ID.
2016-04-25Remove the single cache route for forwarding.Martin Pieuchot
Testing help from Hrvoje Popovski. ok mikeb@, henning@, claudio@
2016-04-19Use the correct byte-order when checking against baddynamic ports,Stuart Henderson
restoring pre-1.190 behaviour. ok millert@ mpi@
2016-04-19Instead of freeing a cached RTF_MPATH route after using it, free itMartin Pieuchot
when the next packet needs to be forwarded, just like if the route was invalid. ok mikeb@, claudio@
2016-04-18Unbreak RAMDISK, found by deraadt@Martin Pieuchot
2016-04-18Put a KERNEL_LOCK/UNLOCK dance around sections that still need someMartin Pieuchot
work in the forwarding path. Tested by Hrvoje Popovski, ok dlg@
2016-04-15Kill in_rtaddr() and use rtalloc(9) directly in ip_dooptions().Martin Pieuchot
This brings ip_dooptions() closer to mp-safeness by ensuring that ``ifa'' is dereferenced before calling rtfree(9). ok mikeb@
2016-04-13We're always ready! So send IFQ_SET_READY() to the bitbucket.Martin Pieuchot
2016-04-13Remove extra parenthesis around comparison.Vincent Gross
Found by David Hill <dhill@mindcry.org> with clang.
2016-04-12Unbreak tree. Put 'laddr6' declaration inside #ifdef INET6/#endif.Kenneth R Westerback
2016-04-11Simplify in_pcblookup_local() logic.Vincent Gross
ok mpi@
2016-04-11Rename in_pcblookup() to in_pcblookup_local() and change its prototypeVincent Gross
to get rid of the now useless foreign address and ports parameters. ok mpi@
2016-04-08We must always check if the socket is already bound, and always setVincent Gross
INPLOOKUP_IPV6 when applicable. Bug introduced in revision 1.197 by yours truly. Ok bluhm@
2016-04-05Move reserved port checks from in(6)_pcbaddrisavail() to in_pcbbind().Vincent Gross
Kill old comments while at it. Ok mpi@ bluhm@
2016-04-05Move inp_laddr assignment after in_pcbpickport(), extend in_pcbpickport()Vincent Gross
as needed. Ok bluhm@
2016-03-31If one of the TCP syn cache buckets overflow, it might be a collisionAlexander Bluhm
attack against our hash function. In this case, switch to the passive syn cache as soon as possible. It will start with a new random seed for the hash. input and OK mpi@
2016-03-30Implement proxy ARP for ART based on mpath support.Martin Pieuchot
Since mpath is not enabled in RAMDISK, proxy ARP won't work there either. ok bluhm@
2016-03-29Allow to adjust tcp_syn_use_limit with sysctl net.inet.tcp.synuselimit.Alexander Bluhm
This is convenient to test the feature and may be useful to defend against syn flooding in a denial of service condition. It is consistent to the existing syn cache sysctls. Move some declarations to tcp_var.h to access the syn cache sets from tcp_sysctl(). OK mpi@
2016-03-29- packet must keep reference to statekeyAlexandr Nedvedicky
this is the second attempt to get it in, the first attempt got backed out on Jan 31 2016 the change also contains fixes contributed by Stefan Kempf in earlier iteration. OK srhen@
2016-03-27To prevent attacks on the hash buckets of the syn cache, our TCPAlexander Bluhm
stack reseeds the hash function every time the cache is empty. Unfortunatly the attacker can prevent the reseeding by sending unanswered SYN packes periodically. Fix this by having an active syn cache that gets new entries and a passive one that is idling out. When the passive one is empty and the active one has been used 100000 times, they switch roles and the hash function is reseeded with new random. tedu@ agrees; OK mpi@
2016-03-26Always include the route priority in routing messages.Martin Pieuchot
From Florian Riehm, ok bluhm@
2016-03-24Ensure that a found proxy ARP entry has the correct flag.Martin Pieuchot
ok bluhm@
2016-03-23Merge in_pcbbind() and in6_pcbbind(), and change every call toVincent Gross
in6_pcbbind() into in_pcbbind(). Ok jca@ mpi@
2016-03-23Extract in_pcbaddrisavail() from in_pcbbind().Vincent Gross
ok jca@
2016-03-21Extract in6_pcbaddrisavail() from in6_pcbbind(), and use it whenVincent Gross
checking for source availability in udp6_output(); This time with all the files. Ok jca@ bluhm@
2016-03-21Add a tcps_sc_seedrandom counter in TCP SYN cache and netstat -s.Alexander Bluhm
This shows how often the hash function is reseeded and the random bucket distribution changes. OK mpi@ claudio@
2016-03-16macros for the null, min, and max vlan ids.David Gwynne
ok mpi@ and tweaks from sthen@
2016-03-14move the vlan protocol definitions to the same places as the ethernet onesDavid Gwynne
ok mpi@
2016-03-07http -> https for IETF/IANA URLs in commentsmmcc
2016-03-07Sync no-argument function declaration and definition by adding (void).Christian Weisgerber
ok mpi@ millert@
2016-03-07Do not remove RTF_STATIC L2 entries from the routing table.Martin Pieuchot
This restore the previous behavior without looking at the reference counter of route entries. Static entries might not have a cloning route to re-create them and when their timer expires they were completly gone as found the hardway by matthieu@. ok matthieu@
2016-03-04- putting back KASSERT(), which I've backed out on Jan 31Alexandr Nedvedicky
We don't expect inbound packets to come to PF with statekey attached. - I've also found missing call to pf_pkt_addr_changed() at various places, which needs to get fixed to prevent KASSERT() from firing. OK mpi@, sthen@
2016-03-01enm_ac in ether_multi is set but never used. so we dont need it.David Gwynne
2016-02-28When IPsec UDP encapsulation is used for IPv6, the stack shouldMike Belopuhov
construct an IPv6 packet instead of an IPv4. Diff from Patrick Wildt <patrick at blueri ! se> with input from bluhm@; ok mpi, bluhm
2016-02-23provide m_dup_pkt() for doing fast deep mbuf copies with a specified alignmentDavid Gwynne
if a physical interface receives a multicast/broadcast packet and has carp interfaces on it, that packet needs to be copied for reception by each of those carp interfaces. previously it was using m_copym2, but that doesn't respect the alignment of the source packet. this meant the ip header in the copies were aligned incorrectly for the network stack, which breaks strict alignment archs. m_dup_pkt lets carp specify that the payload needs an ETHER_ALIGN adjustment, so the ip header inside will be aligned correctly. reported and tested by anthony eden who hit this on armv7 i reproduced the problem on sparc64 and verified the fix on amd64 and sparc64 ok mpi@ mikeb@ deraadt@
2016-02-11Return ENOBUFS when bumping in the multicast max group membershipsJeremie Courreges-Anglas
This removes the only use of ETOOMANYREFS in our code, making intro(2) match reality. No software out there explicitely checks for ETOOMANYREFS in multicast code. Discussed with millert@ and mpi@ (who suggested using ENOBUFS)
2016-01-31- m_pkthdr.pf.statekey changes are not ready for 5.9, I must back them outAlexandr Nedvedicky
OK sthen@
2016-01-25- plugging massive pf_state_key leakAlexandr Nedvedicky
OK mpi@ dlg@ sthen@
2016-01-22add a missing if_put() to ipip_input()Jonathan Gray
ok mpi@
2016-01-22fix a missing if_put() in the default af path of tcp_mss()Jonathan Gray
ok mpi@
2016-01-21Introduce in{,6}_hasmulti(), two functions to check in the hot path ifMartin Pieuchot
an interface joined a specific multicast group. ok phessler@, visa@, dlg@
2016-01-21remove the arp_inuse and arp_allocated countersDavid Gwynne
we can get the same info from the arp pool: # vmstat -m | grep -e ^arp -e ^Name Name Size Requests Fail InUse Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 56 84 0 6 1 0 1 1 0 8 0 Requests and InUse end up being the same: # pstat -d d arp_allocated arp_allocated at 0xffffffff81942084: 84 # pstat -d d arp_inuse arp_inuse at 0xffffffff81942098: 6 ok bluhm@ claudio@ mpi@
2016-01-14Grab the KERNEL_LOCK before delivering a message to the routing socketMartin Pieuchot
when an ARP resolution has been done. Should hopefully fix the "receive 1" panic reported by benno@ on bugs@. ok claudio@, phessler@, benno@, bluhm@
2016-01-13Prevent a double if_put().Martin Pieuchot
ok mikeb@, bluhm@
2016-01-12Prevent a NULL-reference if SIOCGVH is issued without carpdev argument.Martin Pieuchot
Problem reported by and diff tested by Fabian Raetz, thanks! ok benno@, bluhm@
2016-01-08Get rid of the arp and revarp input queues.Martin Pieuchot
Packets of types ARP and REVARP are now processed in the softnet task, directly from ether_input() and without holding the KERNEL_LOCK. Tested by many, ok dlg@
2015-12-19Make carp_output() mpsafe.Martin Pieuchot
This is needed in order to fully unlock ARP processing with carp(4) interfaces as found the hardway by sthen@. ok sthen@, dlg@
2015-12-18Fix SO_REUSE* flags effects when binding multicast addresses. NoVincent Gross
regression observed on avahi. ok benno@
2015-12-17rm a bit more trailers code. no longer accept them as alias for ethernet.Ted Unangst
ok mpi
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-23 20:16:23 +0000