summaryrefslogtreecommitdiffstats
path: root/sys/netinet6/in6_ifattach.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Clear AUTOCONF6TEMP flag when we detach inet6.florian2021-03-151-3/+3
|
* wireguard can do ipv6, but doesnt do link local addresses.dlg2020-06-211-1/+8
| | | | | | | | | i feel like i should add IFT_L3IPVLAN here so mgre(4) can take advantage of this too. from Matt Dunwoodie and Jason A. Donenfeld ok deraadt@
* Use strlcpy instead of strncpy to ensure results are NUL terminated.tobhe2020-03-171-3/+3
| | | | ok mpi@
* convert interface address change hooks to tasks and a task_list.dlg2019-11-081-4/+4
| | | | | | | | | | | | | | | this follows what's been done for detach and link state hooks, and makes handling of hooks generally more robust. address hooks are a bit different to detach/link state hooks in that there's only a few things that register hooks (carp, pf, vxlan), but a lot of places to run the hooks (lots of ipv4 and ipv6 address configuration). an address hook cookie was in struct pfi_kif, which is part of the pf abi. rather than break pfctl -sI, this maintains the void * used for the cookie and uses it to store a task, which is then used as intended with the new api.
* Remove support for semantically opace interface identifiers (RFC 7217)florian2019-08-211-83/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | for IPv6 link local addresses. Some hosting and VM providers route customer IPv6 prefixes to link local addresses derived from ethernet MAC addresses (RFC 2464). This leads to hard to debug IPv6 connectivity problems and is probably not worth the effort. RFC 7721 lists 4 weaknesses: 3.1. Correlation of Activities over Time & 3.2. Location Tracking These are still possible with RFC 7217 addresses for an adversary connected to the same layer 2 network (think conference wifi). Since the link local prefix stays the same (fe80::/64) the link local addresses do not change between different networks. An adversary on the same layer 2 network can probably track ethernet MAC addresses via different means, too. 3.3. Address Scanning & 3.4. Device-Specific Vulnerability Exploitation These now become possible, however, as noted above a layer 2 adversary was probably able to do this via different means. People concerned with these weaknesses are advised to use ifconfig lladdr random. OK benno input & OK kn
* change rt_ifa_add and rt_ifa_del so they take an rdomain argument.dlg2019-02-131-2/+3
| | | | | | | | | | | | this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
* remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.dlg2019-02-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
* Do not join node information multicast group (RFC 4620).florian2018-10-051-52/+1
| | | | | | | | Benno removed code to answer ICMP queries over 4 years ago. Aham Brahmasmi (aham.brahmasmi AT gmx.com) points out that we still joined the group though. OK sthen, bluhm, kn
* Do not add ::1 on non-default lo(4) as intended.mpi2018-08-261-7/+11
| | | | Reported by and ok sthen@
* When an interface doesn't have a layer 2 address in6_get_soii_ifid()florian2018-07-101-4/+20
| | | | | | | | | | failes and then later on a in in6_get_ifid() a layer 2 address is "borrowed" from from another interface. Do the "borrowing" in in6_get_soii_ifid(), too so that semantically opaque interface identifiers work for these kind of interfaces, too. OK phessler, benno
* When an interface doesn't have a layer 2 address in6_get_ifid()florian2018-07-101-13/+2
| | | | | | | | | | | | | | | | | tries to "borrow" one from another interface. But then it checks if the U bit is set int the generated EUI64 address and rejects it. On the other hand for interfaces that do have a layer 2 address this check is skipped, so relax it for the "borrowing" case, too. With this one gets stable link local addresses on e.g. gre(4) interfaces on certain virtualisation environments depending which mac addresses get picked for the vio(4) interfaces while previously we would end up with a random IP on every reboot. Reported by Aaron A. Glenn via phessler. OK phessler, benno
* Use memcpy instead of bcopy when the memory does not overlap.dhill2018-03-271-4/+4
| | | | OK deraadt@ florian@
* Calculate RFC7217 link-local style addresses the same way asflorian2018-03-131-2/+2
| | | | | | | | | | | | | slaacd(8). RFC 7217 states (section 5, page 9): | The Interface Identifier is finally obtained by taking as many | bits from the RID value (computed in the previous step) as | necessary, starting from the least significant bit. Problem in slaacd pointed out by semarie@. OK sthen, phessler
* Implement RFC 7217: "A Method for Generating Semantically Opaqueflorian2018-02-101-2/+67
| | | | | | | | | | | | Interface Identifiers with IPv6 Stateless Address Autoconfiguration." "An IPv6 address configured using this method is stable within each subnet, but the corresponding Interface Identifier changes when the host moves from one network to another. This method is meant to be an alternative to generating Interface Identifiers based on hardware addresses." OK naddy, sthen
* Use in6_get_rand_ifid() instead of get_last_resort_ifid() and delete theflorian2017-09-011-67/+16
| | | | | | | | | | | get_last_resort_ifid() function because eww. Also if your system is so constraint that you end up in in6_get_rand_ifid() you don't deserve a random ifid that stays stable over reboots. Simplify code a bit since get_ifid() can no longer fail. It couldn't fail before either because that code path was #if 0'ed. While here sprinkle in some in6_ prefixes, pointed out by stsp. OK stsp
* Purging is at last at hand. Day of Doom is here. All that is evilflorian2017-07-111-7/+2
| | | | | | | | | shall all be cleansed. Remove sending of router solicitations and processing of router advertisements from the kernel. It's handled by slaacd(8) these days. Input & OK bluhm@, mpi@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-2/+2
| | | | ok visa@
* Get rid of recursive splsoftnet() in in6_ifattach_linklocal().mpi2016-12-291-7/+4
| | | | ok visa@
* Restore the automagically added /64 route on p2p interfaces in order tompi2016-06-301-5/+8
| | | | | | send traffic to link-local addresses without default route. Fix a regression reported by Michael Lechtermann, ok stsp@, sthen@
* When destroying an interface, we have to wait until all referencesbluhm2015-12-021-3/+3
| | | | | | | | | are not used anymore. This has to be done before any interface fields become invalid. As the route delete request cannot call if_get() anymore, pass down the interface. Split rtrequest_delete() into a separate function that may take an existing inteface. OK mpi@
* Convert to rt_ifidx.mpi2015-10-241-3/+3
| | | | ok bluhm@
* Inspired by satosin(), use inline functions to convert sockaddr dl.bluhm2015-10-221-2/+2
| | | | | | Instead of casts they check wether the incoming object has the expected type. So introduce satosdl() and sdltosa() in the kernel. OK mpi@
* Now that rtrequest1(9) properly sets RTF_UP for newly added route,mpi2015-09-121-2/+2
| | | | | | stop passing it in every rt_ifa_add(9) calls. ok claudio@
* Change the order of operations for loopback interfaces to havempi2015-09-031-9/+13
| | | | | | | | ::1 configured before fe80::1. (lo0:0) in pf should resolve to 127.0.0.1 ::1. reported by and ok mikeb@
* Do not install connected routes on loopback interfaces.mpi2015-08-311-29/+23
| | | | | | | | Previously loopback connected routes were managed via the global list of prefixes, which mean that systems with AUTOCONF'd addresses did not see them in the routing table. This also makes inet6 route creation coherent with inet.
* Start moving away from the global prefix list by limiting its usage tompi2015-08-241-17/+9
| | | | | | | | | AUTOCONF'd addresses. This prevent the kernel from removing connected (/64) routes as soon as it configures an AUTOCONF'd address based on a RA. Tested by sebastia@, ok sthen@
* Rework the code to decide when to perform DAD to no longer rely on thempi2015-08-241-31/+6
| | | | | | | | | IN6_IFF_NODAD pseudo-flag not being set. This was just a flag for spaghetti code that should not exist in the first place. Tested by sebastia@, ok sthen@
* Remove anoying comment about in6_update_ifa().mpi2015-08-171-13/+1
|
* Merge two identical chunks to add new prefixes to the global datampi2015-07-181-34/+6
| | | | | | structures into a function. ok florian@
* Properly layer Router Solicitation code.mpi2015-07-161-8/+3
| | | | Tweak and ok florian@
* More damned eye searing whitespace. No change to .o files.krw2015-06-081-2/+2
|
* Do not call nd6_purge() before purging the IPv6 addresses of a detachedmpi2015-04-271-10/+3
| | | | | | | | | | interface. Fix a use after free introduced in r1.98 of netinet6/in6.c and recently exposed by a crazy pool/malloc damage finder being currently refined by dlg@ and deraadt@. ok mikeb@, henning@
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* Convert various rtrequest1(RTM_DELETE,...) calls to rtdeletemsg(9).mpi2015-02-051-19/+3
| | | | | | This unify some code and notify userland for free. blambert@ agrees, ok bluhm@
* Revert rtdeletemsg conversion. It was not ok'd, I misunderstood bluhm@'smpi2015-01-281-3/+19
| | | | email.
* Ensure that link-local addresses are correctly configured on loopbackmpi2015-01-271-62/+26
| | | | | | | | | | | | | | | | | | | | interfaces. When the kernel automagically configures IPv6 addresses on loopback interfaces, start by assigning a link-local address and then try to assign "::1". Only the first configured loopback interface per rdomain can have the "::1" address. But even if other loopback interfaces failed to get this address, because it is already taken, give them a chance to have a link-local address. While here change in6_ifattach() to return an error value and remove duplicated code. Fix a regression introduced by the NOINET6 flag removal. ok henning@, stsp@, florian@, benno@
* Call rtdeletemsg(9) instead of rerolling its code. As a bonus you'llmpi2015-01-261-19/+3
| | | | | | get userland notification for free. ok blambert@, bluhm@
* Correct some comments and merge in6_if_up() into in6_ifattach() tompi2015-01-101-5/+20
| | | | | | | reflect that IPv6 link-local addresses are no longer automagically configured the first time an interface is brought up. ok henning@, stsp@
* Clear autoconf6 flag after autoconf6 cleanup happened, not before.florian2015-01-081-3/+2
| | | | | Otherwise clean up code will never run. OK mpi@, benno@, henning@
* Remove the NOINET6 interface flag, a left-over from the times when IPv6stsp2015-01-061-1/+3
| | | | | | | | | | | was enabled by default. Add AFATTACH/AFDETACH ioctls which enable/disable an address family for an interface (currently used for IPv6 only). New kernel needs new ifconfig for IPv6 configuration (address assignment still works with old ifconfig making this easy to cross over). Committing on behalf of henning@ who is currently lebensmittelvergiftet. ok stsp, benno, mpi
* replace md5 with sha512. ok deraadttedu2014-12-041-16/+14
|
* What have no need for a variable that holds the maximum MTU size ofmpi2014-11-201-3/+1
| | | | | | interfaces with an IPv6 address. ok henning@, mikeb@, deraadt@
* Nuke yet more obvious #include duplications.krw2014-11-181-2/+1
| | | | ok miod@
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-3/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Rename rtalloc1() into rtalloc(9) and convert its flags to only enablempi2014-11-011-3/+3
| | | | | | functionnality instead of a mix of enable/disable. ok bluhm@, jca@
* Move sending of router solicitations to the kernel; receiving andflorian2014-08-251-1/+10
| | | | | | | | | | | | | | | processing of router advertisements was already in the kernel. With this rtsol{,d}(8) is no longer necessary. The kernel starts sending solicitations with # ifconfig $IF inet6 autoconf or inet6 autoconf in /etc/hostname.$IF. input stsp@ much help & OK mpi@ tweaks & OK bluhm@
* When a carp interface is created with IFXF_NOINET6 flag, no link-localbenno2014-07-011-12/+1
| | | | | | | | | | | | | address will be created when the vhid (and MAC) is set. Depending on the order of the configuration the interface can end up with a ipv6 address, but no v6 link-local and no working neigbor discovery. Removing this case statement will result in the link-local address being configured by "ifconfig up" if the inet6 address was configured before. If you are using inet6 on carp, put an "up" at the end of your hostname.if. I will work on a better solution at g2k14. ok henning, mpi
* Calling in{6,}_purgeaddr() is not enough to remove an address frommpi2014-06-261-1/+2
| | | | | | | | | | | | an interface. Two other operations are performed when issuing a SIOCDIFADDR{_IN6,} ioctl: call the address hook and the per-driver ioctl function. Since carp(4) relies on an address hook to recalculate its hash, make sure to call this hook when IFXF_NOINET6 is set or when the rdomain is changed. ok henning@, mikeb@
* Do not include <sys/malloc.h> where it is not needed.mpi2014-06-031-2/+1
|
* Fix eui64 address generation, broken since the removal of the link-layermpi2014-05-201-17/+4
| | | | | | address from the per-ifp list. Found the hard way by weerd@, florian@ and stsp@, ok florian@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.