summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_icmp.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Further cleanup of icmp_do_error.claudio2018-11-281-19/+13
| | | | | | | | | | - Use m_align() since it handles all cases - Use same rounding logic in the size check as in m_align() so all data will filt always. - consolidate pkthdr initalisation into one place - use m_prepend() instead of direct pointer manipulation (including the panic in case an underflow happens). OK bluhm@
* In icmp_input_if() m_pullup up the maximum size of required data at the start.claudio2018-11-051-12/+3
| | | | | | | | | | | The maximum is ICMP_MINLEN (8) + max IPv4 header size (60) + IPv6 header (40) for the IPv6 over IPv4 transition case. By having up to this amount of data consequtive in an mbuf makes the rest of the code simpler and no more extra m_pullup calls are needed. Only length checks are now required.The maximum size is also big enough for all other ICMP types that don't embed the IP heaader. This ensures that all data has been m_pullup-ed before calling the ctlinput function which can look that deep into the header. OK bluhm@ markus@
* Consider the size of IP header when doing the ICMP length overflowbluhm2018-11-051-3/+3
| | | | | | check. This code was never reached as ICMP length was truncated before, but fix the wrong calculation anyway. OK claudio@
* Fixup the case where an mbuf cluster is used. Correctly offset the data toclaudio2018-11-051-3/+5
| | | | | | | | the end of the cluster (there is no M_ALIGN version for clusters so it is hard coded). Also make the sanity check more general by using m_leadingspace. Not a security issue since the cluster code is not reachable, there is enough space in an mbuf. OK bluhm@
* sync icmp_mtudisc_clone() with icmp6_mtudisc_clone(); prompted by bluhm@miko2018-09-061-17/+12
|
* rtm_send() the cloned routes because of ICMP mtu changes. Until nowclaudio2018-07-111-1/+2
| | | | | | | these changes to the routing table have not been visible whereas the RTM_DELETE of those routes have been. Remove this inconsistency. Input and OK mpi@ OK henning@
* All places that call carp_lsdrop() use the interface pointer already.bluhm2018-05-211-7/+4
| | | | | | | | It does not make sense to call if_get() again, just pass ifp as parameter. Move the IFT_CARP check into the function instead of doing it everywhere. Replace the inverted match variable logic with simple returns. OK mpi@ friehm@
* The pf code marks ICMP packets belonging to an TCP or UDP divertbluhm2017-12-141-18/+12
| | | | | | | | | | | | | | | | | state as diverted. This is necessary for IP input to accept the packet as ours. But it must not be used to match the ICMP packet to a raw socket. Clear the PF_TAG_DIVERTED mbuf pf flag for the special ICMP and ICMP6 packets in icmp_input_if() and icmp6_input(). The m_tag_delete_chain() caused an inconsistent PF_TAG_DIVERTED mbuf pf flag and PACKET_TAG_PF_DIVERT mbuf tag which triggered an assert in rip_input(). Deleting all mbuf tags can have undesired side effects and is not necessary anymore since icmp_reflect() calls m_resethdr(). Do not touch the mbuf tags and adjust the mbuf pf flags for the correct behavior of rip_input() and rip6_input(). reported by Chris Eidem, James Turner, vicviq, Scott Vanderbilt OK mpi@
* When reusing an mbuf at the upper end of the network stack, stripbluhm2017-10-181-4/+7
| | | | | | | | | | off the mbuf properties with m_resethdr(). It is a new packet, especially M_LOOP indicating that it was running through lo(4) should be cleared. Use the ph_loopcnt to prevent looping at the upper end of the stack. Although not strictly necessary in icmp reflect, it is a good idea to increase and check the counter here, like in socket splicing. OK mpi@ sashan@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-091-3/+5
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* icmp_mtudisc() might be called by TCP even on loopback after abluhm2017-08-101-1/+11
| | | | | | | | retransmit timeout. Do not run path MTU discovery on local routes as we never want that on loopback. For permanent ARP or ND entries disable path MTU discovery as they use the same rt_expire field. This prevents that permanent routes and entries disappear. bug analysis friehm@; OK mpi@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-191-2/+2
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* Carp balancing ip does not work since there is a mac filter infriehm2017-05-301-4/+4
| | | | | | | ether_input(). Now we use mbuf tags instead of modifying the MAC address. ok mpi@
* Fix a mbuf leak when reflecting an ICMP packet with IP options.bluhm2017-05-221-2/+4
| | | | | | | Free the options in icmp_input_if() after a successful call to icmp_reflect(). bug report and analysis by Hendrik Gerlach OK krw@ claudio@ phessler@
* If m is not a continuous mbuf cluster, m_pullup() in pr_input maybluhm2017-05-041-3/+3
| | | | | | | change the pointer. Then *mp keeps the invalid pointer and it might be used. Fix the potential use after free and also reset *mp in other places to have less dangling pointers to freed mbufs. OK mpi@ mikeb@
* Use the rt_rmx defines that hide the struct rt_kmetrics indirection.bluhm2017-04-191-9/+9
| | | | | No binary change. OK mpi@
* Pass down the address family through the pr_input calls. Thisbluhm2017-04-141-6/+6
| | | | | allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
* When building counter memory in preparation to copy to userland, alwaysderaadt2017-04-051-2/+2
| | | | | | zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
* Use percpu counters for icmpjmatthew2017-02-071-27/+42
| | | | | ok dlg@ a while ago some input from jca@ who wrote the same diff
* Change the IPv4 pr_input function to the way IPv6 is implemented,bluhm2017-01-291-15/+18
| | | | | | | to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
* Reduce the difference between struct protosw and ip6protosw. Thebluhm2017-01-261-3/+3
| | | | | | IPv4 pr_ctlinput functions did return a void pointer that was always NULL and never used. Make all functions void like in the IPv6 case. OK mpi@
* Since raw_input() and route_input() are gone from pr_input, we canbluhm2017-01-251-12/+6
| | | | | | make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
* A NET_LOCK() was is missing in tcp_sysctl() which shows up as splbluhm2016-12-201-4/+4
| | | | | | | | | | softnet assert failures. It is better to place the lock into net_sysctl() where all the protocol sysctls are called via pr_sysctl. As calling sysctl(2) is in the slow path, doing fine grained locking has no benefit. Many sysctl cases copy out a struct. Having a lock around that keeps the struct consistent. Put assertions in the protocol sysctls that need it. OK mpi@
* Introduce the NET_LOCK() a rwlock used to serialize accesses to the partsmpi2016-12-191-5/+5
| | | | | | | | | | | of the network stack that are not yet ready to be executed in parallel or where new sleeping points are not possible. This first pass replace all the entry points leading to ip_output(). This is done to not introduce new sleeping points when trying to acquire ART's write lock, needed when a new L2 entry is created via the RT_RESOLVE. Inputs from and ok bluhm@, ok dlg@
* Explicitly initialize rti_ifa when automagically adding a route.mpi2016-11-281-1/+2
| | | | | | This will allow to strengthen checks when userland adds a route. ok phessler@, bluhm@
* Bring icmp6_mtudisc_clone() in line with icmp_mtudisc_clone(). Thebluhm2016-11-161-2/+3
| | | | | | | IPv4 dynamic route inherits the priority. Only clone from a valid IPv6 route. Do not use splsoftnet() in IPv6. Some stylistic changes to make the functions similar. OK mpi@
* Inherit route label when creating dynamic routes for path MTU.bluhm2016-11-161-2/+5
| | | | From Rivo Nurges; OK claudio@ mpi@ phessler@
* turn ipstat into a set of percpu counters.dlg2016-11-141-2/+2
| | | | | | | | | | | | each counter is identified by an enum value which correspond to the original members of the ipstat struct. ipstat_inc(ips_foo) replaces ipstat.ips_foo++ for the actual updates. ipstat_inc is a thin wrapper around counters_inc. counters are still returned to userland via the ipstat struct for now. ok mpi@ mikeb@
* Do not call splsoftnet() recursively, this won't work with a lock.mpi2016-11-091-7/+5
| | | | | | | Timers configured via rt_timer_add(9) always run at IPL_SOFTNET, so assert that rather than calling splsoftnet(). ok bluhm@
* Do not dereference ``rt->rt_ifa'' after calling rtfree(9).mpi2016-08-221-5/+8
| | | | | | | This could result in a use after free if the route entry was holding the last reference of the address descriptor. ok jca@, bluhm@, claudio@
* Always pass a valid interface pointer to rtdeletemsg().mpi2015-12-091-14/+22
| | | | | | | This will allows for stricter checks inside rtdeletemsg() and it should be up to the caller to decide if the route needs to be deleted or not. ok vgross@
* ip_send()/ip6_send() allow PF to send response packet in ipsoftnet task.sashan2015-12-031-2/+5
| | | | | | | | | | | this avoids current recursion to pf_test() function. the change also switches icmp_error()/icmp6_error() to use ip_send()/ip6_send() so they are safe for PF. The idea comes from Markus Friedl. bluhm, mikeb and mpi helped me a lot to get it into shape. OK bluhm@, mpi@
* When destroying an interface, we have to wait until all referencesbluhm2015-12-021-3/+3
| | | | | | | | | are not used anymore. This has to be done before any interface fields become invalid. As the route delete request cannot call if_get() anymore, pass down the interface. Split rtrequest_delete() into a separate function that may take an existing inteface. OK mpi@
* Kill the RT_REPORT flag to rtalloc() and stop sending RTM_MISS messagesclaudio2015-12-021-3/+3
| | | | | | for failed route lookups. This is something that was maybe useful in the 90is but in this modern times it is just annoying and nothing expect it anyway. OK mpi@, sthen@
* Kill redundant or unused arguments in rtredirect().mpi2015-12-011-4/+3
| | | | ok bluhm@
* Use if_get() rather than dereferencing rt_ifp directly.mpi2015-11-211-6/+12
| | | | Inputs from and ok florian@, ok sthen@, visa@, sashan@
* Rename rtrequest1() to rtrequest().bluhm2015-10-301-2/+2
| | | | OK mpi@
* Do not dereference ``ia_ifp'' when we already have an ``ifp'' pointer.mpi2015-10-221-3/+3
|
* Stop checking for RTF_UP directly, call rtisvalid(9) instead.mpi2015-10-191-6/+2
| | | | | | While here add a missing ``rtableid'' check in in_selectsrc(). ok bluhm@
* Sync rtisvalid(9) check for local route entries with r1.257 ofmpi2015-10-191-6/+5
| | | | net/ip_input.c
* Always increment rt_use inside rtalloc(9) instead of doing it in somempi2015-09-231-2/+1
| | | | | | specific places. ok claudio@, benno@
* When pf modifies a TCP packet, it sets the M_TCP_CSUM_OUT flag inbluhm2015-09-111-2/+2
| | | | | | | | | | | | | | | | | the mbuf packet header. If the packet and is later dropped in ip6_forward(), the TCP mbuf is copied and passed to icmp6_error(). IPv6 uses m_copym() and M_PREPEND() which preserve the packet header. The inherited M_TCP_CSUM_OUT flag generates ICMP6 packets with an incorrect checksum. So reset the csum_flags when packets are generated by icmp6_reflect() or icmp6_redirect_output(). IPv4 does m_copydata() into a fresh mbuf. There m_inithdr() clears the packet header, so the problem does not occur. But setting the csum_flags explicitly also makes sense for icmp_send(). Do not or M_ICMP_CSUM_OUT to a value that is 0 because of some function calls before. OK mpi@ lteo@
* if_put after if_get in icmp input.dlg2015-09-101-10/+22
| | | | | | | | instead of chasing all the ways out of icmp_input, rename it to icmp_input_if and call it from a wrapper that gets the ifp and puts it after icmp_input_if call. ok claudio@
* Replace sockaddr casts with the proper satosin(), ... calls.bluhm2015-09-011-4/+4
| | | | From David Hill; OK mpi@; tested kspillner@; tweaks bluhm@
* Replace sockaddr casts with the proper satosin() or satosin6() calls.bluhm2015-08-141-2/+2
| | | | From David Hill; OK mpi@
* Store a unique ID, an interface index, rather than a pointer to thempi2015-06-161-3/+5
| | | | | | | | | | | | | | | receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
* Replace a bunch of == 0 with == NULL in pointer tests. Nuke somekrw2015-06-071-5/+5
| | | | | | | annoying trailing, leading and embedded whitespace. No change to .o files. ok deraadt@
* Do not leak a rtentry if it is unusable.mpi2015-05-191-2/+4
| | | | Found by The Brainy Code Scanner from Maxime Villard.
* test mbuf pointers against NULL not 0jsg2015-05-131-2/+2
| | | | ok krw@ miod@
* Convert various rtrequest1(RTM_DELETE,...) calls to rtdeletemsg(9).mpi2015-02-051-19/+3
| | | | | | This unify some code and notify userland for free. blambert@ agrees, ok bluhm@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.