summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag isclaudio2019-06-131-2/+2
| | | | | | | | set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@ Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com
* Copy the user provided sockaddr into a normalized sockaddr in rtrequest()claudio2019-06-131-1/+2
| | | | | | | | | | before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@ Reported-by: syzbot+10fe9cd8d0211c562ead@syzkaller.appspotmail.com
* use m_microtime instead of microtime for SO_TIMESTAMP socketopt handlingdlg2019-06-101-2/+2
| | | | | | drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.
* Use mallocarray(9) & put some free(9) sizes for M_IPMOPTS allocations.mpi2019-06-101-6/+4
| | | | ok semarie@, visa@
* Add missing NULL check for the protocol control block (pcb) pointer inanton2019-06-041-0/+3
| | | | | | | | | | mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL. ok bluhm@ claudio@ Reported-by: syzbot+bdc489ecb509995a21ed@syzkaller.appspotmail.com Reported-by: syzbot+156405fdea9f2ab15d40@syzkaller.appspotmail.com
* Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.mpi2019-04-281-3/+3
| | | | | | | | This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
* For raw IPv6 sockets userland may specify an offset where thebluhm2019-04-232-6/+19
| | | | | | | | checksum field is located. During rip6 input and output make sure that this field is within the packet. The offset my be -1 to disable the feature, otherwise it must be non-negative and aligned. Do a stricter check during setsockopt(2). from FreeBSD; OK claudio@
* In in_cksum() and in6_cksum() convert types to C99 style and makebluhm2019-04-222-29/+35
| | | | | | | both functions consistent. In in_cksum() panic if len is longer than mbuf, but in in6_cksum() do not panic if off and len match exactly to the end of mbuf. OK claudio@
* Statistics of "netstat -s -f inet6 -p rip6" did not work. Inbluhm2019-04-201-2/+2
| | | | | rip6_sysctl_rip6stat() copy out rip6counters, not ip6counters. OK deraadt@ claudio@
* change rt_ifa_add and rt_ifa_del so they take an rdomain argument.dlg2019-02-133-9/+14
| | | | | | | | | | | | this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
* remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.dlg2019-02-103-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
* Avoid an mbuf double free in the oob soreceive() path. In thebluhm2019-02-042-16/+16
| | | | | | | | | | usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
* rework icmp6_error() to be closer to icmp_error()denis2018-12-251-39/+56
| | | | input & OK mpi@
* The timeouts in nd6 are in msec so just use timeout_add_msec() insteadclaudio2018-12-201-7/+5
| | | | | of some complicated match to convert them to ticks. OK visa@ bluhm@ kn@
* When forwarding IPv6 packets, generated ICMP6 packets used thebluhm2018-12-101-2/+8
| | | | | | | | interface address of the route as source address. To avoid using link-local addresses in ICMP6 packets sent into networks where they are out of scope, use the regular IPv6 source selection algorithm also in this icmp6_reflect() case. reported by sthen@; fix from Arnaud BRAND; OK claudio@
* We are not going to send a neighbor advertisement from a non-masterflorian2018-12-071-7/+7
| | | | | | carp interface. Move the check to the beginning of the function to make it clear that there are no other side effects happening. OK claudio
* When building ND packets use m_align() to pack the mbuf as optimal asclaudio2018-12-061-5/+4
| | | | | | possible. Because of an optional payload maxlen bytes are used on the m_align so that there is always enough space. OK florian@
* Convert more MH_ALIGN() to m_align(). Also switch from m_gethdr/M_GETHDRclaudio2018-12-031-3/+3
| | | | | | calls to m_get/M_GET calls because M_MOVE_PKTHDR() is initialising the pkthdr and so it is not needed when allocation the header. OK bluhm@
* MH_ALIGN -> m_alignclaudio2018-11-301-2/+2
| | | | OK bluhm@
* Retire dom_rtkeylen from struct domain. Nothing is using this anymore.claudio2018-11-191-2/+1
| | | | | It was used by the original patricia tree. OK mpi@
* M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forclaudio2018-11-093-7/+7
| | | | | | m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-2/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.reyk2018-10-102-5/+5
| | | | | | | | | | rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
* Do not join node information multicast group (RFC 4620).florian2018-10-053-68/+3
| | | | | | | | Benno removed code to answer ICMP queries over 4 years ago. Aham Brahmasmi (aham.brahmasmi AT gmx.com) points out that we still joined the group though. OK sthen, bluhm, kn
* Revert the inpcb table mutex commit. It triggers a witness panicbluhm2018-10-043-26/+4
| | | | | | | in raw IP delivery and UDP broadcast loops. There inpcbtable_mtx is held and sorwakeup() is called within the loop. As sowakeup() grabs the kernel lock, we have a lock ordering problem. found by Hrvoje Popovski; OK deraadt@ mpi@
* As a step towards per inpcb or socket locks, remove the net lockbluhm2018-09-203-5/+27
| | | | | | | | | | | | for netstat -a. Introduce a global mutex that protects the tables and hashes for the internet PCBs. To detect detached PCB, set its inp_socket field to NULL. This has to be protected by a per PCB mutex. The protocol pointer has to be protected by the mutex as netstat uses it. Always take the kernel lock in in_pcbnotifyall() and in6_pcbnotify() before the table mutex to avoid lock ordering problems in the notify functions. OK visa@
* Add reference counting for inet pcb, this will be needed when webluhm2018-09-132-4/+7
| | | | | | start locking the socket. An inp can be referenced by the PCB queue and hashes, by a pf mbuf header, or by a pf state key. OK visa@
* Convert inetctlerrmap to u_char like inet6ctlerrmap. That is alsobluhm2018-09-112-28/+4
| | | | | what FreeBSD does. Remove old #if 0 version of inet6ctlerrmap. OK mpi@
* Make the distribution of in_ and in6_ functions in in_pcb.c andbluhm2018-09-111-47/+182
| | | | | | | | | in6_pcb.c consistent, to ease comparing the code. Move all inet6 functions to in6_. Bring functions in both source files in same order. Cleanup the include section. Now in_pcb.c is a superset of in6_pcb.c. The latter contains all the special implementations. Just moving arround, no code change intended. OK mpi@
* Instead of calculating the mbuf packet header length here and there,bluhm2018-09-101-9/+2
| | | | | | put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
* During fragment reassembly, mbuf chains with packet headers werebluhm2018-09-101-2/+5
| | | | | | | created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
* factor error code in icmp6_mtudisc_clone(); ok kn@ florian@miko2018-09-051-17/+12
|
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-2/+4
| | | | | | userland. Inputs from markus@, ok sthen@
* Do not add ::1 on non-default lo(4) as intended.mpi2018-08-261-7/+11
| | | | Reported by and ok sthen@
* frag6_slowtimo: push NET_LOCK into frag6_freef around icmp6_error.cheloha2018-08-221-8/+6
| | | | | | | | | | | | | | | icmp6_error() still probably needs the NET_LOCK, as the call chain icmp6_error -> icmp6_reflect -> rt_match -> rt_clone -> rtrequest is possible. The fragment discard loop in frag6_slowtimo and the other cleanup bits in frag6_freef do not require it however. So push the lock down into frag6_freef around icmp6_error. Prompted by mpi. Discussed with bluhm and kn. Regress test help by bluhm. Additional testing by kn. ok kn@ visa@ mpi@
* Account when the next nd6_timer_to is scheduled in nd6_timer()florian2018-08-031-2/+4
| | | | | | | | | otherwise nd6_llinfo_settimer() might wrongly assume that a timeout is already scheduled earlier and not schedule one itself. This in turn lead to the neighbor cache no longer updating because neighbor solicitations were not send. Observed by many. OK kn
* Introduce RTM_CHGADDRATTR to inform userland on the route socket whenflorian2018-07-121-1/+9
| | | | | | | | | | an attribute of an address is changed. For now it's used when IPv6 duplicate address detection finishes. With this slaacd(8) can find out if a configured address is not duplicated without the need to poll. OK phessler, benno, claudio
* Introduce ipsec_output_cb() to merge duplicate code and account formpi2018-07-121-2/+6
| | | | | | | | dropped packets in the output path. While here fix a memory leak when compression is not needed w/ IPcomp. ok markus@
* Disambiguate the source of panics in sys/net* by adding __func__nayden2018-07-111-3/+3
| | | | | magic constant to panic() calls. ok benno@ henning@ tb@
* rtm_send() the cloned routes because of ICMP mtu changes. Until nowclaudio2018-07-111-1/+2
| | | | | | | these changes to the routing table have not been visible whereas the RTM_DELETE of those routes have been. Remove this inconsistency. Input and OK mpi@ OK henning@
* When an interface doesn't have a layer 2 address in6_get_soii_ifid()florian2018-07-101-4/+20
| | | | | | | | | | failes and then later on a in in6_get_ifid() a layer 2 address is "borrowed" from from another interface. Do the "borrowing" in in6_get_soii_ifid(), too so that semantically opaque interface identifiers work for these kind of interfaces, too. OK phessler, benno
* When an interface doesn't have a layer 2 address in6_get_ifid()florian2018-07-101-13/+2
| | | | | | | | | | | | | | | | | tries to "borrow" one from another interface. But then it checks if the U bit is set int the generated EUI64 address and rejects it. On the other hand for interfaces that do have a layer 2 address this check is skipped, so relax it for the "borrowing" case, too. With this one gets stable link local addresses on e.g. gre(4) interfaces on certain virtualisation environments depending which mac addresses get picked for the vio(4) interfaces while previously we would end up with a random IP on every reboot. Reported by Aaron A. Glenn via phessler. OK phessler, benno
* It was possible to leak the control mbuf in raw ip user requestbluhm2018-07-051-2/+11
| | | | | | with sendmsg(2) and MSG_OOB. Sync the code in udp, rip, and rip6_usrreq. Add an inp NULL check in rip6_usrreq for consistency. OK benno@ mpi@
* Prevent a mbuf double free by not freeing it along the error-path inanton2018-07-041-3/+5
| | | | | | rip{6,}_usrreq() since soreceive() will free it. ok bluhm@
* Assert that the INP_IPV6 in in6_pcbconnect() is correct. Just callbluhm2018-06-141-1/+3
| | | | | in_pcbconnect() to avoid the address family maze in syn_cache_get(). input claudio@; OK mpi@
* Push the KERNEL_LOCK() inside route_input().mpi2018-06-111-3/+1
| | | | ok visa@, tb@
* The global zero addresses must not change, mark them constant.bluhm2018-06-072-4/+4
| | | | OK tb@ visa@
* Use variable names for rtable and rdomain consistently in the in_pcbbluhm2018-06-031-3/+4
| | | | | functions. discussed with and OK mpi@ visa@
* Consistently call the inpcb table parameter "table" in in6_pcbnotify().bluhm2018-06-031-3/+3
| | | | OK visa@ mpi@
* Move the declarations of the raw ip and ip6 pcb tables into thebluhm2018-06-021-2/+1
| | | | | in_pcb.h header file. OK mpi@ visa@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.