summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* All places that call carp_lsdrop() use the interface pointer already.bluhm2018-05-212-9/+7
| | | | | | | | It does not make sense to call if_get() again, just pass ifp as parameter. Move the IFT_CARP check into the function instead of doing it everywhere. Replace the inverted match variable logic with simple returns. OK mpi@ friehm@
* Make the code a bit easier on the eye by factoring repeated embeddedtb2018-05-121-53/+44
| | | | | | scope check and clearing of the scope id into separate functions. input & ok visa, mpi
* Nuke unused ia6_createtime struct member.florian2018-05-062-6/+3
| | | | OK tb
* Continue refactoring and cleanup of in6_ioctl().tb2018-05-061-32/+40
| | | | | | | | | Hoist privilege check to the top and split out handling of SIOCAIFADDR_IN6 and SIOCDIFADDR_IN6 into a separate function. Merge tangled switches and simplify the code paths. tested by hrvoje ok visa
* Split handling of SIOCGIF*_IN6 into a separate function in6_ioctl_get()tb2018-05-041-107/+142
| | | | | | | that only needs a read lock. Tested by hrvoje ok visa
* Push the NET_LOCK() down in in6_control() similar to what was donetb2018-05-023-41/+67
| | | | | | | | | for in_control(). Protect mrt6_ioctl() and nd6_ioctl() with a read lock and in6_ioctl with the NET_LOCK() while establishing a single exit point. tested by kn ok florian, mpi, visa
* Make the ramdisks compile again, we don't have MROUTING on them.florian2018-04-241-7/+7
| | | | Found the hard way.
* Push NET_LOCK down in the default ifioctl case.pirofti2018-04-243-9/+17
| | | | | | | For the PRU_CONTROL bit the NET_LOCK surrounds in[6]_control() and on the ENOTSUPP case we guard the driver if_ioctl functions. OK mpi@
* Run duplicate address detection again if an existing address getsflorian2018-04-241-5/+8
| | | | | | | | updated from userland that was marked duplicated or tentative. Otherwise we would just lose the duplicated / tentative state and assume that the address is now unique and usable. OK kn
* Use memcpy instead of bcopy when the memory does not overlap.dhill2018-03-273-14/+14
| | | | OK deraadt@ florian@
* In ip6_output() check that the interface of a route is valid. Forbluhm2018-03-211-1/+12
| | | | | | IPv4 we do the same and there are races that triggers it. Increment the statistics counter for both. from markus@; OK mpi@
* Consistently spell "IPsec" in comments and debug outputs.mpi2018-03-161-2/+2
| | | | From Raf Czlonka, ok sthen@
* Calculate RFC7217 link-local style addresses the same way asflorian2018-03-131-2/+2
| | | | | | | | | | | | | slaacd(8). RFC 7217 states (section 5, page 9): | The Interface Identifier is finally obtained by taking as many | bits from the RID value (computed in the previous step) as | necessary, starting from the least significant bit. Problem in slaacd pointed out by semarie@. OK sthen, phessler
* Remove almost unused `flags' argument of suser().mpi2018-02-192-10/+10
| | | | | | | The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
* Use IP6_SOIIKEY_LEN instead of hardcoded value.mpi2018-02-121-2/+2
| | | | from semarie@, ok benno@
* add an ipv6 "don't fragment" flag to mbufs for ip6_output to use.dlg2018-02-111-2/+5
| | | | | | | | | | if you need to send an ipv6 packet with ip6_send(), there's no DF bit in an ipv6 packet and no way to pass the ip6 options to ip6_output to tell it to not allow fragmentation. this adds an M_IPV6_DF_OUT "checksum" flag so something creating ipv6 packets a long way from ip6_output can easily tell it to not allow fragmentation. grumbling and ok claudio@
* rework gif to be more consistent.dlg2018-02-101-2/+18
| | | | | | | | | while here, give us support for mpls in gif on ipv6. this moves all the gif handling into if_gif, eg, the mpls handling is no longer in ip_etherip.c. ok claudio@
* Implement RFC 7217: "A Method for Generating Semantically Opaqueflorian2018-02-105-7/+113
| | | | | | | | | | | | Interface Identifiers with IPv6 Stateless Address Autoconfiguration." "An IPv6 address configured using this method is stable within each subnet, but the corresponding Interface Identifier changes when the host moves from one network to another. This method is meant to be an alternative to generating Interface Identifiers based on hardware addresses." OK naddy, sthen
* update the gre driver.dlg2018-02-071-1/+19
| | | | | | | | | | | the main new feature is gre keys, supported by the vnetid ioctls. this also adds support for gre over ipv6, the use of hfsc, and allows tx mitigation in the future. this diff removes keepalive support, but i promised claudio@ and patrick@ i would put it back after this goes in. ok claudio@
* The function ip6_get_prevhdr() did return a pointer into a mbuf.bluhm2018-02-014-40/+40
| | | | | | It was not guaranteed that the mbuf data was not somewhere else in the chain. So return an offset and do a proper mbuf pulldown. found by Maxime Villard; from NetBSD; with markus@; OK deraadt@
* The IPv6 gateway address passed to rt6_flush() comes either from abluhm2018-01-231-3/+3
| | | | | | | | packet through ip6_input() or from the routing table. In both cases the KAME hack has added the embeded scope to the address, so it is not necessary to fill the scope id again in rt6_flush(). Assert that it is already there. OK mpi@
* There was an issue that dynamic path MTU discovery together withbluhm2018-01-151-1/+2
| | | | | | ARP or ND timeout could delete local routes. Put an assert into arptfree() and nd6_free() so this cannot happen again. OK mpi@
* The pf code marks ICMP packets belonging to an TCP or UDP divertbluhm2017-12-141-1/+6
| | | | | | | | | | | | | | | | | state as diverted. This is necessary for IP input to accept the packet as ours. But it must not be used to match the ICMP packet to a raw socket. Clear the PF_TAG_DIVERTED mbuf pf flag for the special ICMP and ICMP6 packets in icmp_input_if() and icmp6_input(). The m_tag_delete_chain() caused an inconsistent PF_TAG_DIVERTED mbuf pf flag and PACKET_TAG_PF_DIVERT mbuf tag which triggered an assert in rip_input(). Deleting all mbuf tags can have undesired side effects and is not necessary anymore since icmp_reflect() calls m_resethdr(). Do not touch the mbuf tags and adjust the mbuf pf flags for the correct behavior of rip_input() and rip6_input(). reported by Chris Eidem, James Turner, vicviq, Scott Vanderbilt OK mpi@
* Make divert lookup similar for all socket types. If PF_TAG_DIVERTEDbluhm2017-12-041-17/+23
| | | | | | | | is set, pf_find_divert() cannot fail so put an assert there. Explicitly check all possible divert types, panic in the default case. For raw sockets call pf_find_divert() before of the socket loop. Divert reply should not match on TCP or UDP listen sockets. OK sashan@ visa@
* The divert structure was using the port number to indicate thatbluhm2017-11-281-2/+2
| | | | | | | | | | divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Adapt the pf rule struct in kernel and pfctl, no functional change. Note that kernel and pfctl have to be updated together. OK sashan@
* Fix mbuf leak when an interface is destroyed while forwarding IPv6mpi2017-11-281-2/+4
| | | | | | | | packets. Found by Hrvoje Popovski. ok visa@, bluhm@
* Use a single timer for all ND6 entries.mpi2017-11-272-46/+68
| | | | | | | | | | | | This prevents a use-after-free reported by Hrvoje Popovski where the timeout function was already sleeping on the NET_LOCK() when ifconfig(8) removed the enry from the table. By iterating on a global list in the timeout routine we ensure that the items are still valid when we process them. This also reduce differences with ARP. ok bluhm@, visa@
* Constify protocol tables and remove an assert now that ip_deliver() ismpi2017-11-233-6/+6
| | | | | | mp-safe. ok bluhm@, visa@
* Replace non mp-safe carp_iamatch6() with mp-safe carp_iamatch().mpi2017-11-232-6/+6
| | | | | | | They have the same functionnality since friehm@ cleaned up balancing code. ok florian@, visa@, patrick@, bluhm@, jmatthew@
* Do not assume if_get(9) returns a non NULL ifp when using a routempi2017-11-211-1/+3
| | | | | | | | | | | interface index. This assumption is true for the moment iff the route lookup *and* the if_get() are done under KERNEL_LOCK(). This is not the case here. Found the hardway by Hrvoje Popovski. ok florian@, visa@, bluhm@
* Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningmpi2017-11-203-7/+10
| | | | | | pr_input handlers without KERNEL_LOCK(). ok visa@
* Drop all Ethernet-in-IP support from gif(4)jca2017-11-171-14/+1
| | | | | As a result, ip_ether.c now only deals with MPLS-in-IP. The next commits will move & rename stuff to make this clear. ok visa@ mpi@
* Remove inet6 etherip sysctl entriesjca2017-11-151-3/+1
| | | | | | | The INET6 entries are not needed, not documented (use net.inet.etherip) and do not appear in sysctl(8) output. ok mpi@
* Put the net lock around frag6_freef() as it sends ICMP6 errorbluhm2017-11-141-4/+8
| | | | | messages. Splassert was triggered by regress/sys/netinet6/frag6. OK mpi@ sashan@ visa@
* Remove 18 year old #if 0.mpi2017-11-131-26/+3
| | | | ok visa@, benno@
* Introduce a reader version of the NET_LOCK().mpi2017-11-101-3/+3
| | | | | | | | This will be used to first allow read-only ioctl(2) to be executed while the softnet taskq is running. Then it will allows us to execute multiple softnet taskq in parallel. Tested by Hrvoje Popovski, ok kettenis@, sashan@, visa@, tb@
* Serialize access to the IPv6 reassembly queue with a mutex.visa2017-11-071-83/+71
| | | | | | | | | This lets the code run without KERNEL_LOCK() and NET_LOCK(). In addition, this patch reorganizes a part of the code, to move some of the memory release operations outside the critical section. Input and OK mpi@, OK florian@, an earlier version OK bluhm@
* Finish off pr_drain functions, they haven't been used since 2006.florian2017-11-053-22/+3
| | | | OK mpi
* Stop calling ifp->if_ioctl() inside in{,6}_ioctl().mpi2017-11-041-7/+6
| | | | | | | | | Instead return EOPNOTSUPP and call it from ifioctl(). This will help getting per-driver ioctl routines outside of need the NET_LOCK(). While here always return ENXIO when ``ifp'' is NULL. ok visa@, florian@
* We are processing Router Solicitation / Advertisement messages onlyflorian2017-11-033-142/+63
| | | | | | | | for the Source Link-layer Address Options. Merge nd6_rs_input() and nd6_ra_input() into one generic function that does just that. input & OK mpi
* Move PRU_DETACH out of pr_usrreq into per proto pr_detachflorian2017-11-025-12/+58
| | | | | | functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
* Over 17 years is probably 'a while...'florian2017-11-021-4/+1
| | | | | Also it does not change behaviour. OK jca
* Fix typo in previous resulting in a NULL dereference.mpi2017-11-011-2/+2
|
* - add one more softnet taskqsashan2017-10-312-4/+4
| | | | | | | NOTE: code still runs with single softnet task. change definition of SOFTNET_TASKS in net/if.c, if you want to have more than one softnet task OK mpi@, OK phessler@
* Move NET_{,UN}LOCK into individual slowtimo functions.florian2017-10-292-4/+11
| | | | | | Direction suggested by mpi OK mpi, visa
* Allocate IPv6 reassembly structs using pools instead of malloc(),visa2017-10-271-18/+25
| | | | | | and drop the now redundant allocation type M_FTABLE. OK mikeb@, bluhm@, mpi@
* Replace macro `IP6_REASS_MBUF' with direct use of field `ip6af_m'.visa2017-10-262-10/+8
| | | | OK bluhm@, mpi@
* Stop grabbing the KERNEL_LOCK() in network tasks when `ipsec_in_use'mpi2017-10-261-26/+1
| | | | | | | | | is set. Accesses to IPsec global data structure are now serialized by the NET_LOCK(). Tested by many, ok visa@, bluhm@
* Kill deprecated IPv6 ioctl(2)s.mpi2017-10-263-69/+13
| | | | ok florian@, sthen@, jsg@
* remove defines for ioctls the kernel doesn't recognisejsg2017-10-241-5/+1
| | | | ok mpi@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.