summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove some more tests checking for a non-NULL `ifp->if_ioctl'.mpi2017-10-241-2/+1
| | | | if_attach() enforces it is properly defined.
* Remove support for never used ioctls originating from KAME.mpi2017-10-241-248/+2
| | | | ok florian@, claudio@, bluhm@
* Do not test if if_ioctl is NULL, it isn't.mpi2017-10-201-8/+1
| | | | ok florian@, claudio@, visa@, bluhm@
* When reusing an mbuf at the upper end of the network stack, stripbluhm2017-10-181-7/+10
| | | | | | | | | | off the mbuf properties with m_resethdr(). It is a new packet, especially M_LOOP indicating that it was running through lo(4) should be cleared. Use the ph_loopcnt to prevent looping at the upper end of the stack. Although not strictly necessary in icmp reflect, it is a good idea to increase and check the counter here, like in socket splicing. OK mpi@ sashan@
* Setting the IPV6_MINMTU flag in the call to ip6_output() was movedbluhm2017-10-182-8/+9
| | | | | | | from icmp6_reflect() to ip6_send_dispatch() when ip6_send() was introduced. Move the comment that explains this flag also to the place where it is used. from sashan@
* Remove kernel support for the following ioctl(2)s, deprecated since 2001:mpi2017-10-161-4/+1
| | | | | | | | | | | - SIOCSIFPHYADDR - SIOCSIFPHYADDR_IN6 - SIOCGIFPSRCADDR - SIOCGIFPSRCADDR_IN6 - SIOCGIFPDSTADDR - SIOCGIFPDSTADDR_IN6 ok bluhm@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-093-21/+52
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* ramdisks do not contain MROUTING, so the local variable becomes unused.deraadt2017-10-081-1/+3
| | | | wrap it.
* Unfortunately I removed too much in my previous commit and brokebluhm2017-10-061-1/+6
| | | | | divert-packet. Bring back the loop over the global list to find the divert socket.
* Kill the divert-packet socket option IP_DIVERTFL to filter packets.bluhm2017-10-062-47/+3
| | | | | | | | It used a loop over the global list divbtable that would be hard to make MP safe. The port net/dnsfilter does not work without this, it should be converted to divert-to. Neither other ports nor base use this filter feature. ports checked by sthen@; OK mpi@ benno@
* If you use sys/param.h, you don't need sys/types.hderaadt2017-09-081-2/+1
|
* Replace the call to ifa_ifwithaddr() in divert6_output() with abluhm2017-09-061-19/+22
| | | | | | | | route lookup to make it MP safe. Only set the mbuf header fields that are needed. Validate the name input. Also use the same variables in IPv4 and IPv6 functions and avoid unneccessary initialization. OK mpi@
* Replace NET_ASSERT_LOCKED() by soassertlocked() in *_usrreq().mpi2017-09-052-4/+4
| | | | | | Not all of them need the NET_LOCK(). ok bluhm@
* Use in6_get_rand_ifid() instead of get_last_resort_ifid() and delete theflorian2017-09-012-69/+17
| | | | | | | | | | | get_last_resort_ifid() function because eww. Also if your system is so constraint that you end up in in6_get_rand_ifid() you don't deserve a random ifid that stays stable over reboots. Simplify code a bit since get_ifid() can no longer fail. It couldn't fail before either because that code path was #if 0'ed. While here sprinkle in some in6_ prefixes, pointed out by stsp. OK stsp
* Change sosetopt() to no longer free the mbuf it receives and changempi2017-09-013-25/+6
| | | | | | all the callers to call m_freem(9). Support from deraadt@ and tedu@, ok visa@, bluhm@
* Prevent a race against ipsec_in_use.mpi2017-08-221-2/+5
| | | | | | Problem reported and fix tested by Hrvoje Popovski. ok bluhm@, visa@
* Convert hand rolled sockaddr checks to the nam2sin functions.bluhm2017-08-151-17/+12
| | | | | | Especially in tcp_usrreq() connect detect the correct address family based on the inp_flags instead of the sa_family user input. OK mpi@
* After we stopped processing router advertisements in the kernelflorian2017-08-152-29/+2
| | | | | | | | sppp_update_ip6_addr() became the last user of n6_are_prefix_equal(). Since it compares /128 prefixes it doesn't need all the bells and whistles and can be converted to a memcmp. Remove the now unused n6_are_prefix_equal(). OK bluhm, mpi
* Remove NET_LOCK()'s argument.mpi2017-08-113-19/+14
| | | | Tested by Hrvoje Popovski, ok bluhm@
* Validate sockaddr from userland in central functions. This resultsbluhm2017-08-115-40/+34
| | | | | | | in common checks for unix, inet, inet6 instead of partial checks here and there. Some checks are already done at a higher layer, but better be paranoid with user input. OK claudio@ millert@
* Do not invalidate ND for local routes, make it consistent like ARP.bluhm2017-08-101-2/+3
| | | | OK mpi@
* icmp_mtudisc() might be called by TCP even on loopback after abluhm2017-08-101-1/+11
| | | | | | | | retransmit timeout. Do not run path MTU discovery on local routes as we never want that on loopback. For permanent ARP or ND entries disable path MTU discovery as they use the same rt_expire field. This prevents that permanent routes and entries disappear. bug analysis friehm@; OK mpi@
* Remove knob and always do neighbor unreachable detection.florian2017-08-092-11/+4
|
* accept_rtadv doesn't do anything since some time.florian2017-08-092-4/+3
| | | | OK mpi
* We are no longer generating privacy addresses in theflorian2017-08-092-9/+2
| | | | | kernel. OK mpi
* We are no longer processing router advertisements in theflorian2017-08-091-3/+1
| | | | | kernel. OK mpi
* Stop running nd6_expire every second.florian2017-08-083-16/+49
| | | | | We know when pltime or vltime decrease to zero. Run nd6_expire then. Input & OK mpi, bluhm
* Increase the limit of the IP protocol queues from 256 to 2048 mbufs.bluhm2017-08-081-2/+2
| | | | | | The interface congestion algorithm kills performance at this place, with the large queues it never triggers. OK mpi@ claudio@
* Reduce contention on the NET_LOCK() by moving the nd6 address expirationmpi2017-08-061-21/+15
| | | | | | | | | task to the `softnettq`. While here update comments and names to reflect reality after the removal of router and prefix lists. ok florian@, bluhm@
* in6_leavegroup can't fail; OK phesslerflorian2017-08-062-5/+4
|
* Since we have TAILQ_FOREACH_SAFE in nd6_purge() it is not necessarybluhm2017-08-041-18/+10
| | | | | | that nd6_free() advances the next pointer itself. Make nd6_free() a void function and remove unused parameter gc. OK florian@ millert@
* The in_pcbhashlookup() in in_pcbconnect() enforces that the 4 tupelbluhm2017-08-041-5/+13
| | | | | | | | | | | | | of src/dst ip/port is unique for TCP. But if the socket is not bound, the automatic bind by connect happens after the check. If the socket has the SO_REUSEADDR flag, in_pcbbind() may select an existing local port. Then we had two colliding TCP PCBs. This resulted in a packet storm of ACK packets on loopback. The softnet task was constantly holding the netlock and has a high priority, so the system hung. Do the in_pcbhashlookup() again after in_pcbbind(). This creates sporadic "connect: Address already in use" errors instead of a hang. bug report and testing Olivier Antoine; OK mpi@
* We do have SO_TIMESTAMP since some time and there is other code in theflorian2017-08-041-3/+1
| | | | | kernel that uses it without the #ifdef guard. OK bluhm
* RFC 1885 was obsoleted nearly 20 years ago by RFC 2463 which was obsoletedflorian2017-08-031-16/+1
| | | | | over 10 years ago by RFC 4443. We are probably not going back. OK deraadt, jca
* Add an error argument to rtm_send() instead of rerolling it insidempi2017-07-281-2/+2
| | | | | | rtdeletemsg(). ok bluhm@
* Grab the KERNEL_LOCK() before calling sorwakeup().mpi2017-07-271-2/+5
| | | | | | | | In the forwarding path, pf_test() is executed w/o KERNEL_LOCK() and in case of divert end up calling sowakup(). However selwakup() and csignal() are not yet ready to be executed w/o KERNEL_LOCK(). ok bluhm@
* Get rid of ip6.maxifprefixes and ip6.maxifdefrouters, the kernel noflorian2017-07-133-13/+7
| | | | | | | longer tracks prefixes or default routers from router advertisements. Pointed out by jmc. ports tree grepping sthen, who only found nsh OK mpi, sthen
* Get rid of ICMPV6CTL_ND6_DRLIST and ICMPV6CTL_ND6_PRLIST sysctlsflorian2017-07-123-80/+3
| | | | | | | With this we can also get rid of in6_prefix and in6_defrouter. They are meaningless, the kernel no longer tracks this information. Pointed out by & OK mpi
* Purging is at last at hand. Day of Doom is here. All that is evilflorian2017-07-117-2261/+33
| | | | | | | | | shall all be cleansed. Remove sending of router solicitations and processing of router advertisements from the kernel. It's handled by slaacd(8) these days. Input & OK bluhm@, mpi@
* Enable slaacd on the installer and temporarily neuter routerflorian2017-07-081-5/+1
| | | | | | | | | | advertisement processing and solicitation sending like we already did for the non-install kernels. Next step will be to tedu all that code from the kernel. OK rpe@ for the installer bits move forward deraadt@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-052-68/+20
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* If we are sending a neighbor solicitation for a link local addressflorian2017-07-051-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | send it with a link local source address as well. This helps upstream routers with their own source address selection. A reoccurring scenario is: - gateway on fe80::1%if - the gateway does not have an IP in the same prefix as our global address When we want to talk to the outside world we first need to resolve the gateway. We copy the source address from our outgoing packet to the neighbor solicitation packet (a global address) and ask for layer2 information of a link local address. The upstream router now needs to do source address selection of it's own. Since we are coming from a global address and there is no address from the same prefix the router uses another global address lying around. We then drop this with "ND packet from non-neighbor". Reported over the years by a few people, most recently by Marc Peters on bugs@ who confirmed that this fixes the problem. OK stsp@, mpi@
* In OpenBSD 6.0 we had the check (ip6_forward_rt.ro_tableid !=bluhm2017-06-301-1/+3
| | | | | | | | m->m_pkthdr.ph_rtableid) after going to reroute in ip6_forward(). As this had been lost during refactoring, the old route was used after pf has changed the routing table. Solution is to reset the route, then it is not valid and will be reallocated. from markus@; OK mpi@
* Convert ip6_input() to a pr_input style function. Goal is to processbluhm2017-06-272-41/+68
| | | | | IPsec packets without additional enqueueing. OK mpi@
* When pinging an IPv6 link-local address, the reflected packet hadbluhm2017-06-261-5/+1
| | | | | | | | ::1 as source address. It should be the link-local address of the attached interface. The rtalloc() in icmp6_reflect() did not find the correct local address. The IPv6 routing table does not use sin6_scope_id, but the embedded scope. So do not recover the scope. bug report Harald Dunkel; OK mpi@
* Assert that the corresponding socket is locked when manipulating socketmpi2017-06-263-6/+7
| | | | | | | | | | | | | | | | buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-191-2/+2
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* The IP multicast forward functions return an errno, call the variablebluhm2017-06-191-8/+14
| | | | | | error. Make the ip_mforward() return value consistent. Simplify the caller logic in ipv6_input() like in IPv4. OK mpi@
* Replace rtrequest(RTM_DELETE...) rtrequest_delete() and do not evenmpi2017-06-091-12/+15
| | | | | | | | | try to remove a route from the table if it is and invalid cache. This is a step towards decoupling code dealing with userland and kernel inserted routes. ok bluhm@
* Notify userland when a new ND is reachable.mpi2017-06-081-1/+5
| | | | | | The same notification is already present in ARP. From Jan Klemkow, ok bluhm@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.