wireguard-openbsd/sys/netinet6, branch jd/queueboostsWireGuard implementation for the OpenBSD kernelhttps://git.zx2c4.com/wireguard-openbsd/atom/sys/netinet6?h=jd%2Fqueueboosts2020-06-22T11:30:23ZDon't pass a pointer to an uninitialized variable as plenp to2020-06-22T11:30:23Zkrwkrw@openbsd.org2020-06-22T11:30:23Zurn:sha1:dfec937e4b11c739b114bd6b95c37ea6ed457aa9
ip6_hopopts(). The value is tested and non-zero values could cause a
packet to be discarded.
Initialize the pointed at variable to 0, tweaking variable names and
associated comments.
COVERITY 1453098
ok deraadt@ mpi@
wireguard can do ipv6, but doesnt do link local addresses.2020-06-21T11:32:34Zdlgdlg@openbsd.org2020-06-21T11:32:34Zurn:sha1:8cdd649513bf906e105019216d5d5fc9c59cf957
i feel like i should add IFT_L3IPVLAN here so mgre(4) can take
advantage of this too.
from Matt Dunwoodie and Jason A. Donenfeld
ok deraadt@
Document the various flavors of NET_LOCK() and rename the reader version.2020-05-27T11:19:28Zmpimpi@openbsd.org2020-05-27T11:19:28Zurn:sha1:4d5cbc65b3f249a15784c3b64c2933d8466f7caa
Since our last concurrency mistake only ioctl(2) ans sysctl(2) code path
take the reader lock. This is mostly for documentation purpose as long as
the softnet thread is converted back to use a read lock.
dlg@ said that comments should be good enough.
ok sashan@
Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).2020-05-06T07:08:53Zmpimpi@openbsd.org2020-05-06T07:08:53Zurn:sha1:574b3a4fa98da815e768e03fe0bc92c34e9a638c
An invalid/corrupted hop6 option in rip6_input()/ip6_savecontrol() could
lead m_copydata(9)s' check to trigger a panic.
Fix from maxv@NetBSD where the problem was also reported by syzkaller.
Reported-by: syzbot+3b07b3511b4ceb8bf1e2@syzkaller.appspotmail.com
Reported-by: syzbot+7ee0eb2691d507fcad2e@syzkaller.appspotmail.com
ok sashan@, dlg@, claudio@, deraadt@
Assert that ND6 timer is never set for RTF_LOCAL routes.2020-04-22T07:51:38Zmpimpi@openbsd.org2020-04-22T07:51:38Zurn:sha1:9a2314e5247f1b2f9fb5b0b1c1ea3a8aa76addc2
Such routes have a valid link-local entry that should not be overwritten.
The current assert in the timeout routine doesn't give enough information
to know where the bug is, if there is still one.
This should play better with syzkaller.
ok claudio@, visa@ as part of a larger diff
Never update the ND entry (cache) corresponding to a RTF_LOCAL route.2020-04-22T07:45:31Zmpimpi@openbsd.org2020-04-22T07:45:31Zurn:sha1:8e6c5245c1d8f965e35007eaa0f907a64f392378
Such route correspond to a locally configured address and the ND6
subsystem expect its link-local address to be always present.
Fix an issue reported by Julian Brost.
ok claudio@, visa@
Stop processing packets under non-exclusive (read) netlock.2020-04-12T11:56:52Zmpimpi@openbsd.org2020-04-12T11:56:52Zurn:sha1:3c6c39936460d119f3d0d08761b69e36164ad920
Prevent concurrency in the socket layer which is not ready for that.
Two recent data corruptions in pfsync(4) and the socket layer pointed
out that, at least, tun(4) was incorrectly using NET_RUNLOCK(). Until
we find a way in software to avoid future mistakes and to make sure that
only the softnet thread and some ioctls are safe to use a read version
of the lock, put everything back to the exclusive version.
ok stsp@, visa@
Move ND6_PRIV_* constants from nd6.h to slaacd the only place where2020-03-28T16:15:45Zflorianflorian@openbsd.org2020-03-28T16:15:45Zurn:sha1:4fec1b251c8baa22ae58faaf4d543e8324c13eaf
they are used. Nobody in the wider eco system uses these.
While here reduce temporary address valid lifetime to 2 days as per
draft-ietf-6man-rfc4941bis. This should considerably reduce the amount
of addresses configured on an interface - a common complaint.
Original diff from Fernando Gont (fernando AT gont.com.ar), thanks!
Ports tree scanning by sthen@
Use strlcpy instead of strncpy to ensure results are NUL terminated.2020-03-17T09:53:59Ztobhetobhe@openbsd.org2020-03-17T09:53:59Zurn:sha1:5c33a6a2c10ae8c83a679a77534448cd35aadfa5
ok mpi@
Guard SIOCDELMULTI if_ioctl calls with KERNEL_LOCK() where the call is2020-03-15T05:34:13Zvisavisa@openbsd.org2020-03-15T05:34:13Zurn:sha1:4b9a5ba9326ab6d121f94de858852467809e146d
made from socket close path. Most device drivers are not MP-safe yet,
and the closing of AF_INET and AF_INET6 sockets is no longer under the
kernel lock.
This fixes a panic seen by jcs@.
OK mpi@