summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2016-09-02Drop non-encapulated ESP packets using a UDP-encapsulating TDB, and addVincent Gross
the relevant counters. Ok mikeb@
2016-08-31Use 'sc_route{4,6}' directly instead of casting them to 'struct route *'.Martin Pieuchot
This is another little step towards deprecating 'struct route{,_in6}'. ok florian@
2016-08-22Make the ``rt_gwroute'' pointer of RTF_GATEWAY entries immutable.Martin Pieuchot
This means that no protection is needed to guarantee that the next hop route wont be modified by CPU1 while CPU0 is dereferencing it in a L2 resolution functions. While here also fix an ``ifa'' leak resulting in RTF_GATEWAY being always invalid. dlg@ likes it, inputs and ok bluhm@
2016-08-22Do not dereference ``rt->rt_ifa'' after calling rtfree(9).Martin Pieuchot
This could result in a use after free if the route entry was holding the last reference of the address descriptor. ok jca@, bluhm@, claudio@
2016-08-18fix panics caused by replacing m_copym2 with m_dup_pkt.David Gwynne
m_copym2 is fine duplicating an arbitrary chain of mbufs, while m_dup_pkt wants to dup a packet with proper headers in the first mbuf. ipsec copied the tail of an mbuf if any of the clusters are shared or readonly, and swapped that tail with the result of m_copym2. m_dup_pkt panics cos of that. this makes ipsec duplicate the whole packet if any of the chain is readonly. found by naddy@ and mlarkin@ this fix is from visa@ who told me to commit it cos he's afk (sleeping) tested by naddy@
2016-08-16Add IP_SENDSRCADDR cmsg for UDP sockets. As suggested by sthen@,Vincent Gross
IP_SENDSRCADDR == IP_RECVDSTADDR. OK sthen@ jca@ bluhm@
2016-08-15replace the last uses of m_copym2 with m_dup_pkt.David Gwynne
ok mpi@ visa@
2016-08-04Commit in6_selectsrc() split again, with missing assignment fixed.Vincent Gross
2016-07-25fix revision 1.290 of sys/netinet/ip_carp.c.Sebastian Benoit
diff from jsg@ ok deraadt@, benno@
2016-07-22Revert in_selectsrc() refactoring, it breaks IPv6.Martin Pieuchot
Reported by Heiko on bugs@. ok stsp@, claudio@
2016-07-22Fix a double rtfree(9) triggered when IPSEC inserts a more specificMartin Pieuchot
route because of PMTU. otto@ reported the issue and helped me tracking it down during more than one month, he is the man! mikeb@ figured out the bug was in the forwarding path. ok mikeb@, deraadt@, claudio@
2016-07-20To tune the TCP SYN cache we need more information. Print theAlexander Bluhm
relevant counters with netstat -s -p tcp. OK henning@
2016-07-20Split in6_selectsrc() into a low-level part and a pcb-level part, andVincent Gross
convert in_selectsrc() prototype to match. Ok bluhm@ mpi@.
2016-07-20Make the size for the syn cache hash array tunable. As we areAlexander Bluhm
swapping between two syn caches for random reseeding anyway, this feature can be added easily. When the cache is empty, there is an opportunity to change the hash size. This allows an admin under SYN flood attack to defend his machine. Suggested by claudio@; OK jung@ claudio@ jmc@
2016-07-19Plug an mbuf leak in the error path of tcp signature in tcp_output().Alexander Bluhm
OK claudio@ henning@
2016-07-19Fix the check supposed to prevent 'ip' and 'ip-stealth' balancing modesMartin Pieuchot
from leaking the multicast address. beck@ found the hard way that this made his second CARP master use a wrong MAC address. This is part of a bigger diff from Florian Riehm who is currently working on a proper solution to fix balancing modes. ok beck@, bluhm@
2016-07-19NULLify a route pointer after calling rtfree(9).Martin Pieuchot
This should theoretically be a no-op because we're freeing the PCB right after, but it helps us debug a reference count problem found by otto@. ok mikeb@
2016-07-18Hide pf internals by moving code from in_ouraddr() to pf_ouraddr().Alexander Bluhm
OK mpi@ sashan@
2016-07-14Prevent a use-after-free by not updating an ARP entry that has beenMartin Pieuchot
removed from the table. Currently the storage for L2 addresses is freed when an entry is removed from the table. That means that we cannot access this chunk of memory between RTM_DELETE and rtfree(9). Note that this doesn't apply to MPLS because the associated storage is currently released by the last rtfree(9). ok mikeb@
2016-07-13Move ARP processing back to the KERNEL_LOCK()ed task until the raceMartin Pieuchot
triggered by updating a cached, but removed from the table, entry is properly fixed. Diff from dlg@, prodding deraadt@
2016-07-13Introduce RTF_MULTICAST and flag corresponding IPv6 routes as suchMartin Pieuchot
instead of abusing RTF_CLONING. Fix a leak reporeted by Aaron Riekenberg on misc@, ok sthen@
2016-07-11Do not increase the size of the socket buffer under memory pressure.Martin Pieuchot
From Simon Mages, ok beck@, claudio@, bluhm@
2016-07-11Revert the introduction of ``rt_addr''.Martin Pieuchot
Being able to add route entries without configured addresses is a nice feature but this is not my fight. So I'd rather no add another pointer to ``struct rtentry'' if I'm not removing another one.
2016-07-05Do not use ``rt_addr'' in in{6,}_selectsrc() it doesn't work with magicMartin Pieuchot
addresses set on p2p interfaces. Found the hardway by naddy@
2016-07-01Make accepted sockets inherit IP_TTL from the listening socket.Jeremie Courreges-Anglas
This is consistent with the IPV6_UNICAST_HOPS behavior, and is the only way to allow applications to completely control the TTL of outgoing packets (else an application could temporariy send packets with the default TTL, until it sets again IP_TTL ; this is harmful eg for GTSM). ok bluhm@
2016-07-01Allow resetting the IP_TTL and IP_MINTTL sockoptsJeremie Courreges-Anglas
IP_TTL can be reset by passing -1, IP_MINTTL can be reset by passing 0. This is consistent with what Linux does and IPV6_UNICAST_HOPS/IPV6_MINHOPCOUNT. ok bluhm@
2016-06-30Use ``rt_addr'' rather than ``rt_ifa'' to get the source addressMartin Pieuchot
corresponding to a route. ok florian@ on a previous version, input and ok bluhm@
2016-06-28Add sysctl for arp timers: net.inet.ip.arptimeout (expire timer for resolvedChris Cappuccio
entries) and net.inet.ip.arpdown (expire timer for unresolved entries) ok mpi@
2016-06-28Add UDP unicast and multicast support for IP_MINTTL/IPV6_MINHOPCOUNTJeremie Courreges-Anglas
Requested by renato@, ok blumh@
2016-06-27Missing "break;" in switch statement; repairs IP_MINTTL.Jeremie Courreges-Anglas
2016-06-27Implement IPV6_MINHOPCOUNT support.Jeremie Courreges-Anglas
Useful to implement GTSM support in daemons such as bgpd(8). Diff from 2013 revived by renato@. Input from bluhm@, ok bluhm@ deraadt@
2016-06-27Copy inp_hops from the listening socket to the accepted one and useAlexander Bluhm
its value for the SYN+ACK packet. This makes the IPV6_UNICAST_HOPS socket option usable for incoming TCP connections. tested by renato@; OK jca@
2016-06-27The variable swapping between inp, newinp and oldinpcb in syn_cache_get()Alexander Bluhm
was overly complicated. Simplify the code without functional change. OK jca@
2016-06-23when pf_test returns something but PF_PASS, set error to EACCESHenning Brauer
instead of EHOSTUNREACH. On the latter, ip_forward can generate undesired icmp errors - either pf generates those itself (block return), or there shouldn't be any. Bizarrely enough, ip_forward has EACCES handling with a comment specifically pointing to packets blocked by pf, but the code in ip_output used EHOSTUNREACH from day #1 on. found & analyzed by Kristof Provost <kp at FreeBSD>, discussed at BSDcan ok mpi millert
2016-06-18Add net.inet.{tcp,udp}.rootonly sysctl, to mark which portsVincent Gross
cannot be bound to by non-root users. Ok millert@ bluhm@
2016-06-15Add umb(4) - a driver for the Mobile Broadband Interface Model (MBIM)Gerhard Roth
The umb(4) driver provides support for USB MBIM devices. Those devices establish connections via celluar networks such as GPRS, UMTS, and LTE. ok mpi@ sthen@ additional feedback from deraadt@ jmc@ stsp@ kettenis@
2016-06-15Fix typo from rebase : extra parentheseVincent Gross
2016-06-15Move the cmsg handling code on top of udp_output(), to makeVincent Gross
IP_SENDSRCADDR introduction easier. Ok jca@
2016-06-14Store the source address associated with a route in its own chunk ofMartin Pieuchot
memory. This will allow to unlink 'sruct rtentry' and 'struct ifaddr' to be able to add route entries without needing an address. ok sthen@, visa@, florian@
2016-06-13On localhost a user program may create a socket splicing loop.Alexander Bluhm
After writing data into this loop, it was spinning forever causing a kernel hang. Detect the loop by counting how often the same mbuf is spliced. If that happens 128 times, assume that there is a loop and abort the splicing with ELOOP. Bug found by tedu@; OK tedu@ millert@ benno@
2016-06-13Move the ioctl(2) logic of in{,6}_control() into two new functionsMartin Pieuchot
in{,6}_ioctl() that do not deal with sockets. This will allow to automagically configure interface addresses in the kernel without too many layer violations. Required by upcoming umb(4).
2016-06-10Add the "llprio" field to struct ifnet, and the corresponding keywordVincent Gross
to ifconfig. "llprio" allows one to set the priority of packets that do not go through pf(4), as the case is for arp(4) or bpf(4). ok sthen@ mikeb@
2016-06-09Fix typo in comment. From Kapetanakis GiannisAlexander Bluhm
2016-06-06Move logic to send ARP replies to arpreply().Martin Pieuchot
ok florian@, dlg@
2016-06-06Get rid of the ``enaddr'' argument of carp_iamatch().Martin Pieuchot
It was only checked in balancing mode, which is currently broken, and is no longer needed. Discusssed with bluhm@ and Florian Riehm.
2016-06-03set rt_expire times against time_uptime, not time_second.David Gwynne
time_second is unix time so it can be affected by clock changes. time_uptime is monotonic so it isnt affected by clock changes. that in turn means route expiries wont jump with clock changes if set against time_uptime. the expiry is translated into unix time for export to userland though. ok mpi@
2016-05-31Stop creating and inserting a route entry for ARP and ND automagically.Martin Pieuchot
Callers MUST do a route lookup before sending a packet. Tested by Hrvoje Popovski, ok visa@, bluhm@
2016-05-31Inverse two conditions to not grabe the KERNEL_LOCK for every multicastMartin Pieuchot
packet. ok visa@, stsp@, sthen@
2016-05-30Insert a hack to deal with interfaces removing the VLAN header beforeMartin Pieuchot
the packet has been feed to the pseudo-interfaces input handlers. To fix that without introducing a layer violation we should be able to disable HW-vlan on parent when in use with different pseudo-interfaces. In the case of bridge(4) for example it makes no sense to let the interface remove the VLAN header if the kernel has to add it back for every packet. Fix issues reported by sebastia@ and markus@ From dlg@, ok claudio@
2016-05-23Pass a 'struct in_addr *' to arplookup() instead of always dereferencingMartin Pieuchot
one.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 19:15:29 +0000