summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Kill redundant offsetof definitions; ok deraadt henning sthen thibstsp2011-04-033-14/+3
|
* - use nitems(); no binary changejasper2011-03-311-2/+2
| | | | ok claudio@
* Reassemble IPv6 fragments in pf. In the forward case, pf refragmentsbluhm2011-03-241-3/+3
| | | | | | | the packets with the same maximum size. This allows the sender to determine the optimal fragment size by Path MTU Discovery. testing sthen@ matthieu@ ok claudio@
* Don't process ICMP6 redirects by default anymore. This is in line withclaudio2011-03-231-2/+2
| | | | | | what we do for IPv4. rtsol will turn it back on if -F is used. After discussion with bluhm@, fgsch@, sthen@ and deraadt@ OK sthen@
* With pf IPv6 fragment reassembly, a large packet gets refragmentedbluhm2011-03-231-14/+15
| | | | | | by pf in the forward path. To avoid dropping the unfragmented packet in ip6_forward(), move the MTU size check behind pf_test6(). ok claudio@
* Extract the new function ip6_fragment() from ip6_output() to makebluhm2011-03-222-68/+80
| | | | | it reusable by pf. ok claudio@
* Log MAC address changes in the IPv6 neighbor discovery protocolbluhm2011-03-092-2/+11
| | | | | | cache as "ndp info overwritten". This makes the behavior similar to ARP. ok todd@, deraadt@, henning@, giovanni@, claudio@
* Extract the new function frag6_deletefraghdr() from frag6_input()bluhm2011-03-062-19/+33
| | | | | to make it reusable by pf. No functional change. ok henning@, claudio@
* Prevent the nd6_addr_add() work queue task from adding multiple addressesstsp2011-02-241-1/+37
| | | | | for the same prefix. Tested by giovanni@, steven@, Dennis den Brok. ok dlg miod claudio
* In frag6_input() there was an mbuf length calculation error. Ifbluhm2011-01-131-6/+5
| | | | | | | | you want to move "offset" bytes forward by "sizeof(struct ip6_frag)" bytes within an mbuf, you must have at least "offset + sizeof(struct ip6_frag)" bytes space in that mbuf. Fix from KAME, FreeBSD also has it. ok claudio@ markus@
* In ip6_forward() only one call to icmp6_error() was not protectedbluhm2011-01-091-2/+3
| | | | | | | by an if (mcopy). The variable mcopy comes from m_copy() and could be NULL. Bring this call in line with all the other icmp6_error() calls. ok henning@, claudio@, markus@, mpf@
* Add socket option SO_SPLICE to splice together two TCP sockets.bluhm2011-01-071-2/+2
| | | | | | | The data received on the source socket will automatically be sent on the drain socket. This allows to write relay daemons with zero data copy. ok markus@
* Remove the no longer used ip6s_exthdrtoolong field.claudio2010-12-211-2/+1
| | | | OK mikeb@, henning@, deraadt@
* Also call addrhooks for IPv6 addresses with a 128 bit prefixlen.mpf2010-10-071-1/+2
| | | | | I overlooked that one case in rev. 1.69. Fix from Pedro Martelletto. OK mcbride, claudio, henning.
* When processing IPv6 RA messages we may end up adding a new IPv6 addressjsing2010-09-241-20/+28
| | | | | | | | | from interrupt context. This results in problems if the process of adding a new address makes use of pools that use PR_WAITOK (or anything else that may sleep). To avoid this problem, create a workq task so that the new IPv6 address is added from within process context. ok dlg@ henning@
* add a new IP level socket option IP_PIPEX. This option is used for L2TPyasuoka2010-09-232-2/+14
| | | | | support by pipex. OK henning@, "Carry on" blambert@
* Why ip6_input.c includes netinet/ip_icmp.h is beyond my imagination.claudio2010-09-091-3/+2
| | | | Compiles fine without it so remove it.
* No "\n" needed at the end of panic() strings.krw2010-08-071-2/+2
| | | | | | | Bogus chunks pointed out by matthew@ and miod@. No cookies for marco@ and jasper@. ok deraadt@ miod@ matthew@ jasper@ macro@
* Add support for using IPsec in multiple rdomains.reyk2010-07-092-10/+19
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* Add the rtableid to struct rttimer and therefor make it available toclaudio2010-07-091-5/+7
| | | | | | | the callback functions. This fixes a problem where dynamic routes in different tables would not get deleted because the callback was doing the remove on the wrong table. OK henning@
* remove some unused netinet6 codejsg2010-07-087-165/+7
| | | | ok stsp@ henning@ claudio@
* Fix the naming of interfaces and variables for rdomains and rtablesguenther2010-07-031-2/+2
| | | | | | | | | | | | and make it possible to bind sockets (including listening sockets!) to rtables and not just rdomains. This changes the name of the system calls, socket option, and ioctl. After building with this you should remove the files /usr/share/man/cat2/[gs]etrdomain.0. Since this removes the existing [gs]etrdomain() system calls, the libc major is bumped. Written by claudio@, criticized^Wcritiqued by me
* Allow to specify an alternative enc(4) interface for an SA. Allreyk2010-07-012-23/+25
| | | | | | | | | | | | | | | | | | | traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
* Replace enc(4) with a new implementation as a cloner device. We stillreyk2010-06-292-4/+12
| | | | | | | | | | create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
* Add the rtable id as an argument to rn_walktree(). Functions likeclaudio2010-06-281-4/+4
| | | | | | | rt_if_remove_rtdelete() need to know the table id to be able to correctly remove nodes. Problem found by Andrea Parazzini and analyzed by Martin Pelikán. OK henning@
* Allow neighbor discovery for prefixes on interfaces without matchingbluhm2010-06-281-13/+11
| | | | | | | | address. This is necessary when ospf6d has learned a prefix for a directly connected link which is not configured localy. Now neighbor discovery is solely based on the cloning route and not on the address neigborship anymore. ok claudio@
* Massiv cleanup of the gif(4) mess. Move encapsulation into gif_output()claudio2010-05-112-50/+26
| | | | | | | | | | | where it is not necessary to guess protocols by looking at the first nibble. in_gif_output() will encapsulate the packet but not send it. Because of etherip support and the way the bridge works a minimal hack is needed in gif_start() to ensure that the bridged packets are encapsulated as well. This actually started with the idea to add MPLS support but that turned out to be not as simple as in the gre(4) case. Tested by myself (IP, IPv6, etherip, MPLS), sthen@ (IP, IPv6), naddy (IPv6) OK sthen@
* During IPv6 source address selection, prefer RFC 4941 temporary addressesstsp2010-05-081-2/+18
| | | | | | | | over other addresses configured on the same interface. Facilitates peaceful coexistence of temporary addresses for outgoing connections and static addresses for incoming connections. Fix typo in comment while here. ok claudio@
* Start cleaning up the mess called rtalloc*. Kill rtalloc2, make rtalloc1claudio2010-05-079-45/+41
| | | | | | | | accept flags for report and nocloning. Move the rtableid into struct route (with a minor twist for now) and make a few more codepathes rdomain aware. Appart from the pf.c and route.c bits the diff is mostly mechanical. More to come... OK michele, henning
* remove proc.h include from uvm_map.h. This has far reaching effects, astedu2010-04-204-3/+7
| | | | | | sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
* Simple implementation of RFC4941, "Privacy Extensions for Statelessstsp2010-04-065-19/+89
| | | | | | | | | Address Autoconfiguration in IPv6". For those among us who are paranoid about broadcasting their MAC address to the IPv6 internet. Man page help from jmc, testing by weerd, arc4random API hints from djm. ok deraadt, claudio
* fix rcs id, from bradjsg2010-03-221-1/+1
|
* Add some MLDv2 definitions from FreeBSD.jsg2010-03-222-14/+116
|
* Use correct routing domain when doing address lookups.jsing2010-03-091-2/+2
| | | | ok claudio@ "approved" deraadt@
* Use properly initialised sockaddr_in/sockaddr_in6 struct when performingjsing2010-03-081-2/+5
| | | | | | address lookups. Found whilst investigating address lookup failures. ok michele@
* More destatic and ansification.jsing2010-02-084-85/+82
| | | | ok claudio@ naddy@
* More destatic and ansification.jsing2010-02-083-65/+48
| | | | ok claudio@ naddy@
* Destatic and ansify.jsing2010-02-084-78/+73
| | | | ok claudio@ naddy@
* Destatic.jsing2010-01-141-37/+37
| | | | ok kettenis@ claudio@ naddy@
* instead of fiddling with the per-interface address lists directly inhenning2010-01-132-6/+5
| | | | | many places create a proper API (ifa_add / ifa_del) and use it. ok theo ryan dlg
* adding an empty ifaddr struct to the per-interface ifaddr list andhenning2010-01-131-8/+5
| | | | | somewhen later eventually filling the address in is NOT nice. set address first, then insert. ok dlg theo ryan
* - properly spell "packet".jasper2010-01-051-2/+2
|
* - obvious typo in comment, from holger mikolonjasper2009-12-271-2/+2
|
* typo in comment; Holger Mikolonsthen2009-12-211-2/+2
|
* - instead of rolling a macro that is functional equivalent to nitems(),jasper2009-12-151-4/+2
| | | | | | just use nitems(). (this leaves NENTS() alone for now) ok deraadt@ krw@
* Small cleanup for setsockopt IPSEC6_OUTSA:mpf2009-11-251-11/+12
| | | | | | No need to wrap input validation inside spltdb(). Simplify code by using a break instead of an else-block. OK guenther@
* NULL dereference in IPV6_PORTRANGE and IP_IPSEC_*, found by Clement LECIGNE,guenther2009-11-202-15/+12
| | | | | | | localhost DoS everywhere. To help minimize further issues, make the mbuf != NULL test explicit instead of implicit in a length test. Suggestions and initial work by mpf@ and miod@ ok henning@, mpf@, claudio@,
* avoid overflow since protos > IPPROTO_MAX exist. From FreeBSD withotto2009-11-191-2/+3
| | | | a twist; ok millert@ kettenis@
* IPv6 support for divert sockets.michele2009-11-054-5/+464
| | | | | | tested by phessler@ pyr@ ok claudio@ "go ahead" deraadt@
* rtables are stacked on rdomains (it is possible to have multiple routingclaudio2009-11-032-4/+4
| | | | | | | | | | | | | | tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.