| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Use the new IPsec tags. |   angelos | 2001-05-27 | 1 | -2/+2 | |
| | | ||||||
| * | Use packet tags instead of tdbi. | angelos | 2001-05-20 | 1 | -8/+8 | |
| | | ||||||
| * | Check m_pullup() and m_pullup2() return for NULL, not 0; itojun@ ok |   aaron | 2001-05-11 | 1 | -2/+3 | |
| | | ||||||
| * | Allow tdbi's to appear in mbufs throughout the stack; this allows | angelos | 2001-03-28 | 1 | -33/+2 | |
| | | | | | | | | | | security properties of the packets to be pushed up to the application (not done yet). Eventually, this will be turned into a packet attributes framework. Make sure tdbi's are free'd/cleared properly whenever drivers (or NFS) does weird things with mbufs. | |||||
| * | Move the test for bogus packet length in udp_output() closer to the top of | aaron | 2001-03-06 | 1 | -10/+10 | |
| | | | | | | | the function. Previously it was possible for us to get stuck in splsoftnet() under certain situations. Bug reported by hunter@dg.net.ua, fix by me ok'd by deraadt@, provos@, angelos@. | |||||
| * | remove IPv6 case from udp_output. now we have separate udp6_output. |   itojun | 2001-02-16 | 1 | -185/+34 | |
| | | ||||||
| * | pull in new pcb notification code from kame. better handling of scope address. | itojun | 2001-02-16 | 1 | -47/+101 | |
| | | ||||||
| * | nuke #ifdef TCP6 (no longer supported). | itojun | 2000-12-11 | 1 | -34/+107 | |
| | | | | | | | | validate ICMPv6 too big messages (pmtud) based on pcb. we accept certain amount of non-validated ones, as IPv6 mandates ICMPv6 (so even for traffic from unconnected pcb, we need pmtud). sync with kame | |||||
| * | validate mbuf chain length on *_ctlinput. remote node may be able to | itojun | 2000-10-13 | 1 | -9/+11 | |
| | | | | | transmit a truncated icmp6 packet and panic the system. sync with kame. | |||||
| * | nuke inp_flags bits for controlling IPv4 mapped address. | itojun | 2000-10-11 | 1 | -21/+10 | |
| | | | | | | we don't support IPv4 mapped address, and there are inconsistent bit manipulation code so it's safer to nuke them. | |||||
| * | Move the PI_MAGIC define outside the INET6 ifdef block (doh!) | angelos | 2000-09-22 | 1 | -3/+3 | |
| | | ||||||
| * | Lots and lots of changes. | angelos | 2000-09-19 | 1 | -38/+52 | |
| | | ||||||
| * | raw6/udp6 sockets are okay with :: in src. | itojun | 2000-07-27 | 1 | -14/+1 | |
| | | ||||||
| * | be proactive about unspecified IPv6 source address. pcb layer uses | itojun | 2000-07-27 | 1 | -1/+14 | |
| | | | | | | | | | | | | | | | | | | | | unspecified address (::) to mean "unbounded" or "unconnected", and can be confused by packets from outside. use of :: as source is not documented well in IPv6 specification. not sure if it presents a real threat. the worst case scenario is a DoS against TCP listening socket: - outsider transmit TCP SYN with :: as IPv6 source - receiving side creates TCP control block with: local address = my addres remote address = :: (meaning "unconnected") state = SYN_RCVD note that SYN ACK will not be sent due to ip6_output() filter. this stays until it timeouts. - the TCP control block prevents listening TCP control block from being contacted (DoS). | |||||
| * | sync with KAME udp6_output(). udp output logic is very different between | itojun | 2000-06-18 | 1 | -1/+8 | |
| | | | | | | | | IPv4/v6 so the separation should make more sense. TODO: remove IPv6 case from udp_output() TODO: remove/comment out/#if 0 IPv4 mapped address cases | |||||
| * | comment out flowinfo manipulation on inbound. the spec is not very clear. | itojun | 2000-06-13 | 1 | -13/+9 | |
| | | ||||||
| * | avoid mbuf leak on non-matching ifp/sockaddr | itojun | 2000-06-13 | 1 | -3/+5 | |
| | | ||||||
| * | on UDPv6 sendto, correctly set oifp. | itojun | 2000-06-13 | 1 | -2/+2 | |
| | | ||||||
| * | allow link-local IPv6 addres in in6_pcbbind. | itojun | 2000-06-13 | 1 | -42/+13 | |
| | | ||||||
| * | Pass ip_off and ip_len in the correct byte order to icmp_error(); this | angelos | 2000-04-09 | 1 | -3/+1 | |
| | | | | | should fix the crash problems with isic, reported last week. | |||||
| * | fix alignment problem in ancillary data (alpha). | itojun | 2000-02-18 | 1 | -2/+2 | |
| | | | | | | | only ipv6 tools (which touches ancillary data) are affected. From: =?iso-8859-1?Q?G=F6ran_Bengtson?= <goeran@cdg.chalmers.se> | |||||
| * | fix include file path related to ip6. | itojun | 2000-02-07 | 1 | -3/+3 | |
| | | ||||||
| * | Early check for destination port 0 (itojun@) | angelos | 2000-01-07 | 1 | -1/+7 | |
| | | ||||||
| * | keep paren match. | itojun | 2000-01-04 | 1 | -3/+4 | |
| | | ||||||
| * | remove support for v4 mapped address completely. | itojun | 2000-01-04 | 1 | -47/+1 | |
| | | ||||||
| * | be sure to cleanup "opts" pointer on multicast udp packet reception. | itojun | 1999-12-31 | 1 | -1/+4 | |
| | | ||||||
| * | be paranoid about malicious use of v4 mapped addr on v6 packet. | itojun | 1999-12-21 | 1 | -1/+8 | |
| | | | | | | | | | | malicious party may try to use v4 mapped addr as source/dest to confuse tcp/udp layer, or to bypass security checks, for example, naive stack can mistakingly think a packet with src = ::ffff:127.0.0.1 is from local node. (sync with kame) | |||||
| * | reject AF mismatch for inbonud multicast traffic. | itojun | 1999-12-19 | 1 | -13/+8 | |
| | | ||||||
| * | do not accept IPv4 traffic by AF_INET6 socket. IPv4 mapped address is | itojun | 1999-12-17 | 1 | -1/+11 | |
| | | | | | | bad for access controls. (quickhack fix, need sysctl/setsockopt knob to enable this functionality) | |||||
| * | fix IPv6 advanced API (RFC2292) for udp socket. | itojun | 1999-12-12 | 1 | -70/+64 | |
| | | | | | TODO: ditto for raw and tcp socket | |||||
| * | bring in KAME IPv6 code, dated 19991208. | itojun | 1999-12-08 | 1 | -61/+265 | |
| | | | | | | | | | | replaces NRL IPv6 layer. reuses NRL pcb layer. no IPsec-on-v6 support. see sys/netinet6/{TODO,IMPLEMENTATION} for more details. GENERIC configuration should work fine as before. GENERIC.v6 works fine as well, but you'll need KAME userland tools to play with IPv6 (will be bringed into soon). | |||||
| * | Add comment about gettdb() and spl level. |   ho | 1999-11-04 | 1 | -1/+3 | |
| | | ||||||
| * | fix same-interface-out-as-in and packet gets corrupted bug noted by |   deraadt | 1999-09-23 | 1 | -3/+1 | |
| | | | | | | | | james@oaktree.co.uk by re-working icmp embedded-packet code so that ip_forward() m_copy()-aliased packet can be forwarded to ip_output and icmp_error() safely, because no packet tweaking is needed before calling icmp_error() | |||||
| * | avoid a future problem inside an #ifdef notyet | deraadt | 1999-06-06 | 1 | -1/+2 | |
| | | ||||||
| * | add SADB_X_BINDSA to pfkey allowing incoming SAs to refer to an outgoing |   provos | 1999-03-27 | 1 | -1/+38 | |
| | | | | | | | | | | SA to be used, use this SA in ip_output if available. allow mobile road warriors for bind SAs with wildcard dst and src addresses. check IPSEC AUTH and ESP level when receiving packets, drop them if protection is insufficient. add stats to show dropped packets because of insufficient IPSEC protection. -- phew. this was all done in canada. dugsong and linh provided the ride and company. | |||||
| * | Reworked udp_output() to minimize the number of if() statements needed to get |   cmetz | 1999-03-24 | 1 | -49/+46 | |
| | | | | | | packets out. Also had the nice side effect of fewer blocks now move around by ifdefs, which makes it more readable. | |||||
| * | inet6 indent | deraadt | 1999-02-17 | 1 | -161/+188 | |
| | | ||||||
| * | report on no udp checksum | deraadt | 1999-02-04 | 1 | -9/+10 | |
| | | ||||||
| * | IN_MULTICAST takes network order addresses |   niklas | 1999-01-15 | 1 | -2/+2 | |
| | | ||||||
| * | Use bzero instead of memset in the kernel | niklas | 1999-01-11 | 1 | -6/+6 | |
| | | ||||||
| * | netinet merge of NRL stuff. some indent and shrinkage needed; NRL/cmetz | deraadt | 1999-01-11 | 1 | -29/+378 | |
| | | ||||||
| * | in_pcblookup() now takes ptr to both ip address arguments | deraadt | 1999-01-07 | 1 | -3/+3 | |
| | | ||||||
| * | mangle uh_sum as before, but recover it for icmp errors | deraadt | 1998-12-31 | 1 | -2/+5 | |
| | | ||||||
| * | ensure the ip packet embedded inside an icmp packet has correct ip_len, | deraadt | 1998-12-28 | 1 | -2/+5 | |
| | | | | | | ip_off, ip_id. for udp, also correct uh_sum. ip_sum is still set to 0; (all this debugged using nmap) | |||||
| * | first step to the setsockopt/getsockopt interface as described in | provos | 1998-05-18 | 1 | -2/+11 | |
| | | | | | | | | draft-mcdonald-simple-ipsec-api, kernel notifies (EMT_REQUESTSA) signal userland key management applications when security services are requested. this is only for outgoing connections at the moment, incoming packets are not yet checked against the selected socket policy. | |||||
| * | sysctl for def sizes for tcp/udp send/recv queues |   mickey | 1998-01-24 | 1 | -3/+7 | |
| | | ||||||
| * | for broadcast/multicast packets, correct m_pkthdr.len on the way up to the socket; drochner@zelz26.zel.kfa-juelich.de | deraadt | 1997-09-07 | 1 | -3/+5 | |
| | | ||||||
| * | The list of tcp/udp ports not to allocate dynamically is now |   millert | 1997-08-09 | 1 | -1/+7 | |
| | | | | | | | a bitmask configurable via sysctl([38]). The default values have not changed. If one wants to change the list it should be done early on in /etc/rc. | |||||
| * | cmd is a u_long | deraadt | 1997-07-24 | 1 | -2/+2 | |
| | | ||||||
| * | udp icmp errors had ip_len 20 bytes too large; stevens p774; koji@math.human.nagoya-u.ac.jp | deraadt | 1997-06-27 | 1 | -2/+1 | |
| | | ||||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |