summaryrefslogtreecommitdiff
path: root/sys/netinet
AgeCommit message (Collapse)Author
2016-07-25fix revision 1.290 of sys/netinet/ip_carp.c.Sebastian Benoit
diff from jsg@ ok deraadt@, benno@
2016-07-22Revert in_selectsrc() refactoring, it breaks IPv6.Martin Pieuchot
Reported by Heiko on bugs@. ok stsp@, claudio@
2016-07-22Fix a double rtfree(9) triggered when IPSEC inserts a more specificMartin Pieuchot
route because of PMTU. otto@ reported the issue and helped me tracking it down during more than one month, he is the man! mikeb@ figured out the bug was in the forwarding path. ok mikeb@, deraadt@, claudio@
2016-07-20To tune the TCP SYN cache we need more information. Print theAlexander Bluhm
relevant counters with netstat -s -p tcp. OK henning@
2016-07-20Split in6_selectsrc() into a low-level part and a pcb-level part, andVincent Gross
convert in_selectsrc() prototype to match. Ok bluhm@ mpi@.
2016-07-20Make the size for the syn cache hash array tunable. As we areAlexander Bluhm
swapping between two syn caches for random reseeding anyway, this feature can be added easily. When the cache is empty, there is an opportunity to change the hash size. This allows an admin under SYN flood attack to defend his machine. Suggested by claudio@; OK jung@ claudio@ jmc@
2016-07-19Plug an mbuf leak in the error path of tcp signature in tcp_output().Alexander Bluhm
OK claudio@ henning@
2016-07-19Fix the check supposed to prevent 'ip' and 'ip-stealth' balancing modesMartin Pieuchot
from leaking the multicast address. beck@ found the hard way that this made his second CARP master use a wrong MAC address. This is part of a bigger diff from Florian Riehm who is currently working on a proper solution to fix balancing modes. ok beck@, bluhm@
2016-07-19NULLify a route pointer after calling rtfree(9).Martin Pieuchot
This should theoretically be a no-op because we're freeing the PCB right after, but it helps us debug a reference count problem found by otto@. ok mikeb@
2016-07-18Hide pf internals by moving code from in_ouraddr() to pf_ouraddr().Alexander Bluhm
OK mpi@ sashan@
2016-07-14Prevent a use-after-free by not updating an ARP entry that has beenMartin Pieuchot
removed from the table. Currently the storage for L2 addresses is freed when an entry is removed from the table. That means that we cannot access this chunk of memory between RTM_DELETE and rtfree(9). Note that this doesn't apply to MPLS because the associated storage is currently released by the last rtfree(9). ok mikeb@
2016-07-13Move ARP processing back to the KERNEL_LOCK()ed task until the raceMartin Pieuchot
triggered by updating a cached, but removed from the table, entry is properly fixed. Diff from dlg@, prodding deraadt@
2016-07-13Introduce RTF_MULTICAST and flag corresponding IPv6 routes as suchMartin Pieuchot
instead of abusing RTF_CLONING. Fix a leak reporeted by Aaron Riekenberg on misc@, ok sthen@
2016-07-11Do not increase the size of the socket buffer under memory pressure.Martin Pieuchot
From Simon Mages, ok beck@, claudio@, bluhm@
2016-07-11Revert the introduction of ``rt_addr''.Martin Pieuchot
Being able to add route entries without configured addresses is a nice feature but this is not my fight. So I'd rather no add another pointer to ``struct rtentry'' if I'm not removing another one.
2016-07-05Do not use ``rt_addr'' in in{6,}_selectsrc() it doesn't work with magicMartin Pieuchot
addresses set on p2p interfaces. Found the hardway by naddy@
2016-07-01Make accepted sockets inherit IP_TTL from the listening socket.Jeremie Courreges-Anglas
This is consistent with the IPV6_UNICAST_HOPS behavior, and is the only way to allow applications to completely control the TTL of outgoing packets (else an application could temporariy send packets with the default TTL, until it sets again IP_TTL ; this is harmful eg for GTSM). ok bluhm@
2016-07-01Allow resetting the IP_TTL and IP_MINTTL sockoptsJeremie Courreges-Anglas
IP_TTL can be reset by passing -1, IP_MINTTL can be reset by passing 0. This is consistent with what Linux does and IPV6_UNICAST_HOPS/IPV6_MINHOPCOUNT. ok bluhm@
2016-06-30Use ``rt_addr'' rather than ``rt_ifa'' to get the source addressMartin Pieuchot
corresponding to a route. ok florian@ on a previous version, input and ok bluhm@
2016-06-28Add sysctl for arp timers: net.inet.ip.arptimeout (expire timer for resolvedChris Cappuccio
entries) and net.inet.ip.arpdown (expire timer for unresolved entries) ok mpi@
2016-06-28Add UDP unicast and multicast support for IP_MINTTL/IPV6_MINHOPCOUNTJeremie Courreges-Anglas
Requested by renato@, ok blumh@
2016-06-27Missing "break;" in switch statement; repairs IP_MINTTL.Jeremie Courreges-Anglas
2016-06-27Implement IPV6_MINHOPCOUNT support.Jeremie Courreges-Anglas
Useful to implement GTSM support in daemons such as bgpd(8). Diff from 2013 revived by renato@. Input from bluhm@, ok bluhm@ deraadt@
2016-06-27Copy inp_hops from the listening socket to the accepted one and useAlexander Bluhm
its value for the SYN+ACK packet. This makes the IPV6_UNICAST_HOPS socket option usable for incoming TCP connections. tested by renato@; OK jca@
2016-06-27The variable swapping between inp, newinp and oldinpcb in syn_cache_get()Alexander Bluhm
was overly complicated. Simplify the code without functional change. OK jca@
2016-06-23when pf_test returns something but PF_PASS, set error to EACCESHenning Brauer
instead of EHOSTUNREACH. On the latter, ip_forward can generate undesired icmp errors - either pf generates those itself (block return), or there shouldn't be any. Bizarrely enough, ip_forward has EACCES handling with a comment specifically pointing to packets blocked by pf, but the code in ip_output used EHOSTUNREACH from day #1 on. found & analyzed by Kristof Provost <kp at FreeBSD>, discussed at BSDcan ok mpi millert
2016-06-18Add net.inet.{tcp,udp}.rootonly sysctl, to mark which portsVincent Gross
cannot be bound to by non-root users. Ok millert@ bluhm@
2016-06-15Add umb(4) - a driver for the Mobile Broadband Interface Model (MBIM)Gerhard Roth
The umb(4) driver provides support for USB MBIM devices. Those devices establish connections via celluar networks such as GPRS, UMTS, and LTE. ok mpi@ sthen@ additional feedback from deraadt@ jmc@ stsp@ kettenis@
2016-06-15Fix typo from rebase : extra parentheseVincent Gross
2016-06-15Move the cmsg handling code on top of udp_output(), to makeVincent Gross
IP_SENDSRCADDR introduction easier. Ok jca@
2016-06-14Store the source address associated with a route in its own chunk ofMartin Pieuchot
memory. This will allow to unlink 'sruct rtentry' and 'struct ifaddr' to be able to add route entries without needing an address. ok sthen@, visa@, florian@
2016-06-13On localhost a user program may create a socket splicing loop.Alexander Bluhm
After writing data into this loop, it was spinning forever causing a kernel hang. Detect the loop by counting how often the same mbuf is spliced. If that happens 128 times, assume that there is a loop and abort the splicing with ELOOP. Bug found by tedu@; OK tedu@ millert@ benno@
2016-06-13Move the ioctl(2) logic of in{,6}_control() into two new functionsMartin Pieuchot
in{,6}_ioctl() that do not deal with sockets. This will allow to automagically configure interface addresses in the kernel without too many layer violations. Required by upcoming umb(4).
2016-06-10Add the "llprio" field to struct ifnet, and the corresponding keywordVincent Gross
to ifconfig. "llprio" allows one to set the priority of packets that do not go through pf(4), as the case is for arp(4) or bpf(4). ok sthen@ mikeb@
2016-06-09Fix typo in comment. From Kapetanakis GiannisAlexander Bluhm
2016-06-06Move logic to send ARP replies to arpreply().Martin Pieuchot
ok florian@, dlg@
2016-06-06Get rid of the ``enaddr'' argument of carp_iamatch().Martin Pieuchot
It was only checked in balancing mode, which is currently broken, and is no longer needed. Discusssed with bluhm@ and Florian Riehm.
2016-06-03set rt_expire times against time_uptime, not time_second.David Gwynne
time_second is unix time so it can be affected by clock changes. time_uptime is monotonic so it isnt affected by clock changes. that in turn means route expiries wont jump with clock changes if set against time_uptime. the expiry is translated into unix time for export to userland though. ok mpi@
2016-05-31Stop creating and inserting a route entry for ARP and ND automagically.Martin Pieuchot
Callers MUST do a route lookup before sending a packet. Tested by Hrvoje Popovski, ok visa@, bluhm@
2016-05-31Inverse two conditions to not grabe the KERNEL_LOCK for every multicastMartin Pieuchot
packet. ok visa@, stsp@, sthen@
2016-05-30Insert a hack to deal with interfaces removing the VLAN header beforeMartin Pieuchot
the packet has been feed to the pseudo-interfaces input handlers. To fix that without introducing a layer violation we should be able to disable HW-vlan on parent when in use with different pseudo-interfaces. In the case of bridge(4) for example it makes no sense to let the interface remove the VLAN header if the kernel has to add it back for every packet. Fix issues reported by sebastia@ and markus@ From dlg@, ok claudio@
2016-05-23Pass a 'struct in_addr *' to arplookup() instead of always dereferencingMartin Pieuchot
one.
2016-05-23Shorten en error string.Martin Pieuchot
2016-05-18Remove some superflous if_get(9)/if_put(9) dances now that ARP inputMartin Pieuchot
routines are call directly by ether_input(). ok visa@, dlg@
2016-05-18Move the code to update an ARP cache into its own function.Martin Pieuchot
ok visa@
2016-05-18rework the srp api so it takes an srp_ref struct that the caller provides.David Gwynne
the srp_ref struct is used to track the location of the callers hazard pointer so later calls to srp_follow and srp_enter already know what to clear. this in turn means most of the caveats around using srps go away. specifically, you can now: - switch cpus while holding an srp ref - ie, you can sleep while holding an srp ref - you can take and release srp refs in any order the original intent was to simplify use of the api when dealing with complicated data structures. the caller now no longer has to track the location of the srp a value was fetched from, the srp_ref effectively does that for you. srp lists have been refactored to use srp_refs instead of srpl_iter structs. this is in preparation of using srps inside the ART code. ART is a complicated data structure, and lookups require overlapping holds of srp references. ok mpi@ jmatthew@
2016-05-07Use rtalloc_mpath() when checking for local route entries because weMartin Pieuchot
are now using the returned route for forwarding as well. This restore the behavior of r1.274 when using mpath entries for forwarding. ok visa@, henning@
2016-05-04Preserve DiffServ value when fragmenting an ipv4 packet.Vincent Gross
Ok phessler@, henning@
2016-05-03Make ip_forward() use the route entry fetched in in_ouraddr() when it isMartin Pieuchot
possible. This reduce the number of lookups to 1 for non-multicast traffic when PF is disable. Tested by Hrvoje Popovski who confirmed that benchmark numbers are now as good as with a single cache entry. ok visa@, bluhm@
2016-04-29Do not allow to change the routing table of a bound socket. ThisAlexander Bluhm
is not intended and will behave unexpectedly if the address is already used in another domain. It did not work anyway, as the PCB ended in the wrong hash bucket after changing the rtable. Fail with EBUSY if the socket is already bound and rehash the PCB if its rtable changes. input claudio@; OK mpi@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 13:43:27 +0000