WireGuard implementation for the OpenBSD kernel https://git.zx2c4.com/wireguard-openbsd/atom/sys/netinet6/ip6_input.c?h=jd%2Fqueueboosts 2020-05-06T07:08:53Z 2020-05-06T07:08:53Z mpi mpi@openbsd.org 2020-05-06T07:08:53Z urn:sha1:574b3a4fa98da815e768e03fe0bc92c34e9a638c An invalid/corrupted hop6 option in rip6_input()/ip6_savecontrol() could lead m_copydata(9)s' check to trigger a panic. Fix from maxv@NetBSD where the problem was also reported by syzkaller. Reported-by: syzbot+3b07b3511b4ceb8bf1e2@syzkaller.appspotmail.com Reported-by: syzbot+7ee0eb2691d507fcad2e@syzkaller.appspotmail.com ok sashan@, dlg@, claudio@, deraadt@ 2020-04-12T11:56:52Z mpi mpi@openbsd.org 2020-04-12T11:56:52Z urn:sha1:3c6c39936460d119f3d0d08761b69e36164ad920 Prevent concurrency in the socket layer which is not ready for that. Two recent data corruptions in pfsync(4) and the socket layer pointed out that, at least, tun(4) was incorrectly using NET_RUNLOCK(). Until we find a way in software to avoid future mistakes and to make sure that only the softnet thread and some ioctls are safe to use a read version of the lock, put everything back to the exclusive version. ok stsp@, visa@ 2019-12-30T14:52:00Z bluhm bluhm@openbsd.org 2019-12-30T14:52:00Z urn:sha1:290baf01706c6fefb14f14f8427a9310a2ee3521 address is in the routing table and will be identified as any other local address. There is no reason to handle ::1 source address special. Better use the generic IPv6 input path. Kame has removed the special code in their revision 1.189 commit. OK sashan@ 2019-12-23T23:02:53Z sashan sashan@openbsd.org 2019-12-23T23:02:53Z urn:sha1:fe572d31b990030a9e776db5bc3c1322dbd6e750 2019-12-23T22:33:57Z sashan sashan@openbsd.org 2019-12-23T22:33:57Z urn:sha1:fd4abc02c0bfa4e17134718bec3a3ee471075d51 IP forwarding is disabled. Issue reported by Daniel Jakots (danj@) OK bluhm@ 2019-12-08T11:08:22Z sashan sashan@openbsd.org 2019-12-08T11:08:22Z urn:sha1:144d7e8ec45c41ef58c8b309e276b5f35ab67b6e where such packet is bound to. This check is enforced if and only IP forwarding is disabled. Change discussed with bluhm@, claudio@, deraadt@, markus@, tobhe@ OK bluhm@, claudio@, tobhe@ 2019-11-29T16:41:01Z nayden nayden@openbsd.org 2019-11-29T16:41:01Z urn:sha1:ab0ea4a9132b7411845db22fd23a8aa1c4b246bf ok benno@ mortimer@ 2019-08-21T15:32:18Z florian florian@openbsd.org 2019-08-21T15:32:18Z urn:sha1:5aceba415921b63e83fb083318c9ea40d13c7603 for IPv6 link local addresses. Some hosting and VM providers route customer IPv6 prefixes to link local addresses derived from ethernet MAC addresses (RFC 2464). This leads to hard to debug IPv6 connectivity problems and is probably not worth the effort. RFC 7721 lists 4 weaknesses: 3.1. Correlation of Activities over Time & 3.2. Location Tracking These are still possible with RFC 7217 addresses for an adversary connected to the same layer 2 network (think conference wifi). Since the link local prefix stays the same (fe80::/64) the link local addresses do not change between different networks. An adversary on the same layer 2 network can probably track ethernet MAC addresses via different means, too. 3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation These now become possible, however, as noted above a layer 2 adversary was probably able to do this via different means. People concerned with these weaknesses are advised to use ifconfig lladdr random. OK benno input & OK kn 2019-08-06T22:57:54Z bluhm bluhm@openbsd.org 2019-08-06T22:57:54Z urn:sha1:8f6d2e8bf0b541dc10865826bab4d248a2639690 introduced a queue to grab the lock for multiple packets. Now we have only netlock for both IP and protocol input. So the queue is not necessary anymore. It just switches CPU and decreases performance. So remove the inet and inet6 ip queue for local packets. To get TCP running on loopback, we have to queue once between TCP input and output of the two sockets. So use the loopback queue in looutput() unconditionally. OK visa@ 2019-06-10T23:48:21Z dlg dlg@openbsd.org 2019-06-10T23:48:21Z urn:sha1:9f78c7ff9bbb70b9cc0719cf32120a4d62b8defc drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.