summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Don't do a double free, sys_getsockopt() will take care of freeing theclaudio2009-10-301-5/+2
| | | | mbuf allocated by the subroutines. OK kettenis@
* *NULL store in IP_AUTH_LEVEL, IP_ESP_TRANS_LEVEL, IP_ESP_NETWORK_LEVEL,deraadt2009-10-281-1/+2
| | | | | | | IP_IPCOMP_LEVEL found by Clement LECIGNE, localhost root exploitable on userland/kernel shared vm machines (ie. i386, amd64, arm, sparc (but not sparc64), sh, ...) on OpenBSD 4.3 or older copy of the ipv4 bug, spotted by claudio
* Redo the route lookup in the output (and IPv6 forwarding) path if theclaudio2009-10-062-5/+49
| | | | | | | | | | | | | | | | | | | | | | destination of a packet was changed by pf. This allows for some evil games with rdr-to or nat-to but is mostly needed for better rdomain/rtable support. This is a first step and more work and cleanup is needed. Here a list of what works and what does not (needs a patched pfctl): pass out rdr-to: from local rdr-to local addr works (if state tracking on lo0 is done) from remote rdr-to local addr does NOT work from local rdr-to remote works from remote rdr-to remote works pass in nat-to: from remote nat-to local addr does NOT work from remote nat-to non-local addr works non-local is an IP that is routed to the FW but is not assigned on the FW. The non working cases need some magic to correctly rewrite the incomming packet since the rewriting would happen outbound which is too late. "time to get it in" deraadt@
* M_DUP_PKTHDR() define -> m_dup_pkthdr() function to properly dealkrw2009-09-131-3/+9
| | | | | | | | | | | | | with m_tag_copy_chain() failures. Use m_defrag() to eliminate hand rolled defragging of mbufs and some uses of M_DUP_PKTHDR(). Original diff from thib@, claudio@'s feedback integrated by me. Tests kevlo@ claudio@, "reads ok" blambert@ ok thib@ claudio@, "m_defrag() bits ok" kettenis@
* no need to cast the return value of m_freem() to voidthib2009-07-261-2/+2
| | | | | | as its a void function. ok claudio@
* Initial support for routing domains. This allows to bind interfaces toclaudio2009-06-053-12/+13
| | | | | | | | | alternate routing table and separate them from other interfaces in distinct routing tables. The same network can now be used in any doamin at the same time without causing conflicts. This diff is mostly mechanical and adds the necessary rdomain checks accross net and netinet. L2 and IPv4 are mostly covered still missing pf and IPv6. input and tested by jsg@, phessler@ and reyk@. "put it in" deraadt@
* allow IPvShit to be turned off completely per-interface.henning2009-06-041-1/+6
| | | | | | | | | ifconfig em0 -inet6 deletes all v6 addresses including link-local and prevents new ones from being added. ifconfig em0 inet6 <addr> re-enables v6, brings the link local back and adds optional <addr> ok theo reyk
* Remove _KERNEL goo from kernel files because we're setting _KERNEL correctly.claudio2009-05-311-6/+0
| | | | OK deraadt@, miod@
* The routing table index rtableid has type unsigned int in the routingbluhm2009-05-182-6/+7
| | | | | | | | | | | code. In pf rtableid == -1 means don't change the rtableid because of this rule. So it has to be signed int there. Before the value is passed from pf to route it is always checked to be >= 0. Change the type to int in pf and to u_int in netinet and netinet6 to make the checks work. Otherwise -1 may be used as an array index and the kernel crashes. ok henning@
* Introduce splsoftassert(), similar to splassert() but for soft interruptmiod2009-03-151-2/+2
| | | | | | levels. This will allow for platforms where soft interrupt levels do not map to real hardware interrupt levels to have soft ipl values overlapping hard ipl values without breaking spl asserts.
* In icmp6_mtudisc_update make sure that the requested MTU is not less thenclaudio2009-02-221-1/+9
| | | | | | the minimal IPv6 MTU minus the size of a frag header (which is needed because of a hack in ip6_output/ip6_setpmtu). Inspired by a similar fix from netbsd. OK markus@, OK deraadt@
* Move goto lables to the beginning of the line. Having them indented likeclaudio2009-02-181-4/+4
| | | | the rest of the switch cases is a good camouflage.
* Mark routers internal as uninstalled after deleting the default route.rainer2009-01-302-2/+16
| | | | | | | This makes it possible to get a new default route by router advertisement after the old one got deleted (or timed out). Ok henning@, claudio@, mcbride@
* "XXX: should this be performed under splnet()?"... Yes, yes it should.mcbride2009-01-303-10/+22
| | | | | | | | Interface configuration causes neighbour discoverery, which runs packets through parts of the stack that require at least splsoftnet(), like pf and pfsync. ok dlg
* delay /etc/netstart until IPv6-DAD (dup-address-detection) is completed.markus2008-11-255-6/+18
| | | | ok fries, hshoexer, claudio
* When accessing cached routes make sure the route is actually still valid.claudio2008-11-236-20/+22
| | | | | | | | Before accessing a ro_rt make sure the route is either freshly allocated or RTF_UP is set. If not ro_rt should be freed and reallocated or at least no info from the ro_rt should be considered valid. This seems to solve the crashes seen by Felipe Alfaro Solana. some sort of OK dlg@
* Remove the M_ANYCAST6 mbuf flag by doing the detection all in ip6_input().claudio2008-11-021-4/+15
| | | | | | | M_ANYCAST6 was only used to signal tcp6_input() that it should drop the packet and send back icmp error. This can be done in ip6_input() without the need for a mbuf flag. Gives us back one slot in m_flags for possible future need. Looked at and some input by naddy@ and henning@. OK dlg@
* filter ipv6 ipsec packets on enc0 (in and out), similar to ipv4;markus2008-10-222-2/+30
| | | | ok bluhm, fries, mpf; fixes pr 4188
* Second pass of simple timeout_add -> timeout_add_sec conversionsblambert2008-10-152-6/+6
| | | | | | | This should take care of the simpler ones (i.e., timeout values of integer multiples of hz). ok krw@, art@
* Fix PF state key mismatches that occur when callers of icmp6_reflect()jsing2008-10-021-1/+4
| | | | | | recycle mbufs. Based on an initial diff by henning@, also tested by todd@. ok henning@
* If a neighbor solictation isn't from the unspecified address, make sureclaudio2008-10-013-5/+48
| | | | | that the source address matches one of the interfaces address prefixes. From NetBSD, tested by todd@ and naddy@
* Clear the PF state key before an IP packet exits a gif(4) tunnel, in orderjsing2008-09-281-2/+11
| | | | | | to prevent state key mismatches. ok henning@
* remove dead stores and newly created unused variables.chl2008-09-177-34/+9
| | | | | | Found by LLVM/Clang Static Analyzer. ok henning@ mpf@
* just like v4 icmp, icmp6 recycles mbufs so we need to callhenning2008-09-121-1/+9
| | | | | pf_pkt_addr_changed to clear the recorded pf state information in the hdr claudio ok
* Remove dead code: ip6_copypktopts() is not used anywhere.mpf2008-09-032-22/+2
| | | | OK deraadt@, henning@
* Do not latch the IPSec tdb to the inpcb unconditionally. This hasbluhm2008-08-081-5/+1
| | | | | | | been moved to the protocol layer from ip_output at 2002/05/31. The IPv6 part has been forgotten so packets could get encrypted unintentionally. ok hshoexer markus
* Call ip6_clearpktopts() on error in copypktopts() instead of freeingcanacar2008-07-301-8/+2
| | | | | every field individually. ok claudio@ markus@ henning@ deraadt@
* Do not specify the gateway on RTM_DELETE -- similar fix was done in the arpclaudio2008-07-131-2/+3
| | | | | code. This fixes in6_ifloop_request warnings seen on carp interfaces. OK henning@, found and tested by david@
* ANSIfy to sync with KAME. From Karl Sjodahl <dunceor@gmail.com>.mcbride2008-06-1119-679/+324
| | | | ok todd deraadt naddy bluhm
* From KAME, allow adjustable limits on NDP entries and discovered routes.mcbride2008-06-119-14/+160
| | | | ok mpf naddy
* Introduce a facility to generate unpredictable 32 bit numbers withdjm2008-06-094-24/+26
| | | | | | | | | | | | | | near maximal (2^32) cycle times. These are useful for network IDs in cases where there are negative consequences to ID prediction and/or reuse. Use the idgen32() functions to generate IPv6 IDs and NFS client/server XIDs. Pseudorandom permutation code in crypto/idgen.c based on public domain skip32.c from Greg Rose. feedback & ok thib@ deraadt@
* Remove {tcp/udp}6_usrreq(); Since the normal ones nowthib2008-05-241-3/+3
| | | | | | | take a proc argument, theres no need for these, since they are just wrappers. OK claudio@
* Deal with the situation when TCP nfs mounts timeout and processesthib2008-05-231-4/+4
| | | | | | | | | | | | | get hung in nfs_reconnect() because they do not have the proper privilages to bind to a socket, by adding a struct proc * argument to sobind() (and the *_usrreq() routines, and finally in{6}_pcbbind) and do the sobind() with proc0 in nfs_connect. OK markus@, blambert@. "go ahead" deraadt@. Fixes an issue reported by bernd@ (Tested by bernd@). Fixes PR5135 too.
* SO_BINDANY for ipv6; ok djm@markus2008-05-191-3/+4
|
* divert for ipv6; ok henning, pyrmarkus2008-05-151-1/+7
|
* rtrequest to rtrequest1 conversion in inet6. With that no rtrequest shouldclaudio2008-05-115-44/+110
| | | | be left over. OK henning@
* Try harder to avoid corrupting the mbuf pool. Stuff any mbuf chain inkrw2008-05-112-7/+23
| | | | | | | | ln_hold or la_hold into temporary storage and null ln_hold or la_hold before manually processing the mbuf chain. Discard the mbuf chain if it is put back in the hold area. ok claudio@ markus@
* Implement routing priorities. Every route inserted has a priority assignedclaudio2008-05-071-3/+5
| | | | | | | | | and the one route with the lowest number wins. This will be used by the routing daemons to resolve the synchronisations issue in case of conflicts. The nasty bits of this are in the multipath code. If no priority is specified the kernel will choose an appropriate priority. Looked at by a few people at n2k8 code is much older
* remove tcp_drain code since it's not longer used; ok henning, feedback thibmarkus2008-05-061-3/+3
|
* the softnet intr handlers check if the input queue has packets ondlg2008-04-241-3/+3
| | | | | | | | | | | | | | | it by reading the queues head pointer. if that pointer is not null then it takes splnet and dequeues a packet for handling. this is bad because the ifqueue head is modified at splnet and the sofnet handlers read it without holding splnet. this removes that check of the head pointer and simply checks if the dequeue gave us a packet or not before proceeding. found while reading mpls code. discussed with norby@ and henning@ ok mcbride@ henning@
* use arc4random_uniform() for random number requests that are not adjm2008-04-184-11/+12
| | | | | | | | | power of two. use arc4random_bytes() when requesting more than a word of PRNG output. ok deraadt@
* strictly interpret msg_controllen to be the exact total length of thederaadt2008-03-311-16/+20
| | | | | | | | | cmsg's, including alignments, ie. the sum of CMSG_SPACE()'s. any other interpretation would be in violation of various unix specifications. RFC3542 section 20.2 is totally and completely wrong -- it is not allowed to over-ride the specification of msg_controllen, since the intent is that one could mix-and-match various types of cmsg's and an exact match is therefore required. ok kettenis, tested by many
* use the right capitalization for platform namessobrado2008-03-091-3/+3
| | | | ok jsing@
* allow a response to icmp6 node information queries where the localsthen2008-03-081-2/+2
| | | | hostname starts with a digit. ok mcbride
* fix use-after-free: pfxlist_onlink_check() might free rt_llinfo formarkus2008-03-041-1/+3
| | | | | the current route, so make sure RTF_LLINFO is still set; fixes pr 5711; with krw@ and claudio@; ok jsing@
* Correctly check that we have a complete rthdr before trying to do m_copydata() on it.mcbride2008-02-241-2/+2
| | | | Bug report and fix from Todd Carson.
* Move carp load balancing (ARP/IP) to a simpler configuration scheme.mpf2008-02-053-7/+4
| | | | | | | | | | | | | | Instead of using the same IP on multiple interfaces, carp has to be configured with the new "carpnodes" and "balancing" options. # ifconfig carp0 carpnodes 1:0,2:100,3:100 balancing ip carpdev sis0 192.168.5.50 Please note, that this is a flag day for anyone using carp balancing. You'll need to adjust your configuration accordingly. Addititionally this diff adds IPv6 NDP balancing support. Tested and OK mcbride@, reyk@. Manpage help by jmc@.
* return with ENOTTY instead of EINVAL for unknown ioctl requests.brad2008-01-021-1/+1
| | | | ok claudio@ krw@ dlg@
* add sysctl entry points into various network layers, in particular toderaadt2007-12-147-11/+100
| | | | provide netstat(1) with data it needs; ok claudio reyk
* take advantage of M_ZEROhshoexer2007-12-093-25/+13
| | | | ok claudio gilles
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.