summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_ipip.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* provide ip_tos_patch() for setting ip_tos and patching the ipv4 cksum.dlg2018-11-141-6/+4
| | | | | | | | | | | | | | | | previously the gif code would patch the tos field and not recalc the cksum, which would cause ip input code to drop the packet due to a cksum failure. the ipip code patched ip_tos and unconditionally recalculated the cksum, making it correct, but also wiping out any errors that may have been present before the recalculation. updating the cksum rather than replacing it lets cksum failures still fire. ip_tos_patch() is provided in the ecn code since it's because of ecn propagation that we need to update the tos field. internally it works like pf_patch_8 and pf_cksum_fixup, but since pf is optional it rolls its own code. procter may fix that in the future... ok claudio@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-12/+9
| | | | | | userland. Inputs from markus@, ok sthen@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-091-2/+7
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-051-7/+3
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* Do not use the interface pointer after if_put(). Rename ipip_input_gif()bluhm2017-06-201-21/+24
| | | | | | to ipip_input_if() and always pass the ifp. Only dump the packet to bpf if we are called with a gif(4) interface. OK mpi@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-191-4/+3
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* Use a common 'goto bad' style and set mp to NULL after freeing itbluhm2017-06-111-18/+15
| | | | | | in ipip_input_gif(). This prevents a use-after-free if there is a bug in the IP input functions. OK mpi@
* Introduce ipv{4,6}_input(), two wrappers around IP queues.mpi2017-05-301-9/+3
| | | | | | | This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
* Call bpf_mtap_af() a bit earlier in ipip_input(). This preparesbluhm2017-05-281-11/+11
| | | | | upcoming diffs, no functional change. OK mpi@
* In IPIP input rename the variable ipo to ip as it is used for innerbluhm2017-05-261-34/+33
| | | | | | | | | | and outer header. Reset values depending on the the mbuf when the mbuf is adjusted. Check the length of the inner IP header with the correct size in case of IPv6. Check the IPv4 header size including IP options. For the IPIP statistics the inner header length has to be subtracted from the packet size as the outer header has already been stripped off. OK mpi@
* Instead of looking at the IP version of the header, use the outerbluhm2017-05-261-16/+8
| | | | | address family passed to ipip_input(). OK mpi@
* The function name ip4_input() is confusing as it also handles IPv6bluhm2017-05-181-28/+27
| | | | | | | | | | packets. This is the IP in IP protocol input function, so call it ipip_input(). Rename the existing ipip_input() to ipip_input_gif() as it is the input function used by the gif interface. Pass the address family to make it consistent with pr_input. Use __func__ in debug print and panic messages. Move all ipip prototypes to the ip_ipip.h header file. OK dhill@ mpi@
* Convert the xformsw definition to C99 style initializer. Also fixbluhm2017-05-061-3/+4
| | | | | the function declaration of ipe4_input() and avoid a wrong cast. OK mikeb@ dhill@
* If m is not a continuous mbuf cluster, m_pullup() in pr_input maybluhm2017-05-041-3/+3
| | | | | | | change the pointer. Then *mp keeps the invalid pointer and it might be used. Fix the potential use after free and also reset *mp in other places to have less dangling pointers to freed mbufs. OK mpi@ mikeb@
* Introduce sstosa() for converting sockaddr_storage with a type safebluhm2017-05-041-3/+2
| | | | | | | inline function instead of casting it to sockaddr. While there, use inline instead of __inline for all these conversions. Some struct sockaddr casts can be avoided completely. OK dhill@ mpi@
* Pass down the address family through the pr_input calls. Thisbluhm2017-04-141-2/+2
| | | | | allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
* When building counter memory in preparation to copy to userland, alwaysderaadt2017-04-051-1/+2
| | | | | | zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
* percpu counters for ip_ipip.cjca2017-03-101-29/+43
| | | | ok bluhm@ dhill@ mpi@
* Change the IPv4 pr_input function to the way IPv6 is implemented,bluhm2017-01-291-40/+18
| | | | | | | to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
* Since raw_input() and route_input() are gone from pr_input, we canbluhm2017-01-251-9/+3
| | | | | | make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
* Sync no-argument function declaration and definition by adding (void).naddy2016-03-071-2/+2
| | | | ok mpi@ millert@
* add a missing if_put() to ipip_input()jsg2016-01-221-4/+7
| | | | ok mpi@
* in6_embedscope() needs to lose some weight. Remove the last argument.claudio2015-09-111-3/+3
| | | | | | | | | In all but two calls NULL is passed and in the other 2 cases the ifp is only used to maybe feed it to in6_selecthlim() to select the hoplimit for the link. Since in6_embedscope() only works on link-local addresses it does not matter what hop limit we select since the destination is directly reachable. OK florian@ mpi@
* if_put after if_getdlg2015-09-091-1/+3
| | | | ok mpi@
* Check for a RTF_LOCAL entry instead of iterating on the global listmpi2015-08-241-37/+26
| | | | | | of interfaces. ok bluhm@
* Replace sockaddr casts with the proper satosin() or satosin6() calls.bluhm2015-08-141-5/+3
| | | | From David Hill; OK mpi@
* Expand ancient NTOHL/NTOHS/HTONS/HTONL macros.mpi2015-07-161-3/+3
| | | | ok guenther@, henning@
* m_freem() can handle NULL, do not check for this condition beforehands.deraadt2015-07-151-3/+2
| | | | ok stsp mpi
* rename mbuf ** parameter from m to mp, to match other similar codederaadt2015-07-151-5/+5
| | | | ok mpi
* Store a unique ID, an interface index, rather than a pointer to thempi2015-06-161-6/+6
| | | | | | | | | | | | | | | receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
* test mbuf pointers against NULL not 0jsg2015-05-131-3/+3
| | | | ok krw@ miod@
* make ipsp_address thread safe; ok mpimikeb2015-04-141-3/+8
|
* replace the use of ifqueues for most input queues serviced by netisrdlg2015-04-101-18/+4
| | | | | | | | | | | | | | | | | with niqueues. this change is so big because there's a lot of code that takes pointers to different input queues (eg, ether_input picks between ipv4, ipv6, pppoe, arp, and mpls input queues) and falls through to code to enqueue packets against the pointer. if i changed only one of the input queues id have to add sepearate code paths, one for ifqueues and one for niqueues in each of these places by flipping all these input queues at once i can keep the currently common code common. testing by mpi@ sthen@ and rafael zalamena ok mpi@ sthen@ claudio@ henning@
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-27/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* remove uneeded proc.h includesjsg2014-09-141-2/+1
| | | | ok mpi@ kspillner@
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* "struct pkthdr" holds a routing table ID, not a routing domain one.mpi2014-04-141-2/+2
| | | | | | | | | | | | | | Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
* Remove the number of in6_var.h inclusions by moving some functions andmpi2013-10-241-5/+1
| | | | | | global variables to in6.h. ok deraadt@
* Remove the number of in_var.h inclusions by moving some functions andmpi2013-10-231-2/+1
| | | | | | global variables to in.h. ok mikeb@, deraadt@
* The header file netinet/in_var.h included netinet6/in6_var.h. Thisbluhm2013-10-171-1/+5
| | | | | | | created a bunch of useless dependencies. Remove this implicit inclusion and do an explicit #include <netinet6/in6_var.h> when it is needed. OK mpi@ henning@
* improve IPsec/ENC interaction:markus2012-03-151-5/+19
| | | | | | | | | | | - ipip_input() recalculate the IP header checksum if the tos bits are changed after decapsulation. Otherwise these packets are dropped later in the stack. - ip_ecn_egress(): do not drop packets for IPsec if the outter packet of a Tunnel has the ECN-CE bit set (Congestion Experienced) and the inner packet does not indicate support ECN. - remove unused ip6_ecn_ingress(), ip6_ecn_egress() code ok mikeb@
* Massiv cleanup of the gif(4) mess. Move encapsulation into gif_output()claudio2010-05-111-36/+51
| | | | | | | | | | | where it is not necessary to guess protocols by looking at the first nibble. in_gif_output() will encapsulate the packet but not send it. Because of etherip support and the way the bridge works a minimal hack is needed in gif_start() to ensure that the bridged packets are encapsulated as well. This actually started with the idea to add MPLS support but that turned out to be not as simple as in the gre(4) case. Tested by myself (IP, IPv6, etherip, MPLS), sthen@ (IP, IPv6), naddy (IPv6) OK sthen@
* remove proc.h include from uvm_map.h. This has far reaching effects, astedu2010-04-201-1/+2
| | | | | | sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
* Remove dead assignment and newly created unused variable.chl2010-01-281-4/+1
| | | | | | Found by LLVM/Clang Static Analyzer. ok krw@ henning@
* rtables are stacked on rdomains (it is possible to have multiple routingclaudio2009-11-031-2/+4
| | | | | | | | | | | | | | tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
* Initial support for routing domains. This allows to bind interfaces toclaudio2009-06-051-1/+3
| | | | | | | | | alternate routing table and separate them from other interfaces in distinct routing tables. The same network can now be used in any doamin at the same time without causing conflicts. This diff is mostly mechanical and adds the necessary rdomain checks accross net and netinet. L2 and IPv4 are mostly covered still missing pf and IPv6. input and tested by jsg@, phessler@ and reyk@. "put it in" deraadt@
* call pf_pkt_addr_changed() when we do encapsulatehenning2008-11-261-1/+10
| | | | | fixes v6-over-v4 gifs wrt pf chatter about state linking mismatches ok jsing claudio, tested by Ant La Porte <ant at ukbsd.org>
* encapsulating v4 in v6 IPSec should not be so fun,todd2008-06-101-7/+10
| | | | | do not process v4 headers as v6, 255 TTL + icmp (0x01) = ff01:: suddenly, eww! debugged with bluhm@, verified by grunk@, ok markus@
* add sysctl entry points into various network layers, in particular toderaadt2007-12-141-1/+6
| | | | provide netstat(1) with data it needs; ok claudio reyk
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.