summaryrefslogtreecommitdiffstats
path: root/sys/netinet6 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Enable IPv6 autoconfprivacy by defaultsperreault2012-08-151-1/+4
| | | | | | | diff originally by stsp@ "please commit it" deraadt@ "don't care" stsp@ "don't like" bluhm@
* add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)markus2012-07-162-4/+4
| | | | | | | can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
* Make IPv6 privacy addresses appear alongside regular SLAAC addresses.sperreault2012-07-142-70/+47
| | | | | | Also fix a memory management problem that was made obvious by this diff. ok bluhm@, previous version ok @stsp
* Instead of <arpa/inet.h> pulling in <netinet/in.h>, just copy in theguenther2012-07-101-1/+3
| | | | | | | three things that it needed from there: INET_ADDRSTRLEN, INET6_ADDRSTRLEN, and struct in_addr. Add protecting #ifndefs to netinet6?/in6?.h for those. ok deraadt@
* Instead of casting interface address pointers, use the macrobluhm2012-07-081-22/+13
| | | | | ifatoia6(). No binary diff. OK henning@
* Improve compliance for <arpa/inet.h> and <netinet/in.h> to define/declareguenther2012-06-261-35/+9
| | | | | | | | all the symbols that POSIX says they must and fewer that they can't and, most importantly, to not require a specific ordering of headers. ports testing by naddy@ ok millert@ deraadt@
* rt6_flush should remove all routes configured via a specified gw,mikeb2012-05-181-4/+7
| | | | | | | | | | not only CONNECTED ones. It should also be called when RA with a RouterLifetime set to 0 is sent to clear a redirect. While here make sure we use correct priorities when installing routes acquired via redirects. comments & ok bluhm
* rfc 4861 mandates that target link local address must be includedmikeb2012-05-161-1/+7
| | | | | with a neighbour advertisment sent to a multicast address; nits & ok bluhm
* unneccessary casts to unsigned; ok claudioderaadt2012-04-131-2/+2
|
* According to the RFC 2460 and RFC 5095, ICMP Parameter Problem, Code 0mikeb2012-04-031-8/+12
| | | | | | | should be sent in response to an IPv6 packet with RH0. Improve this a bit further by filling in an icmp error pointer. With sperreault, ok sperreault, sthen
* bail if redirect destination is not unicast before doing othermikeb2012-04-031-8/+8
| | | | expensive checks; ok sperreault, todd, sthen
* Direct IPv6 packets with Ethernet encapsulation into the appropriatemikeb2012-03-151-2/+8
| | | | | | | input routine allowing us to bridge two IPv4 networks over an IPv6 link with gif(4). ok henning, sthen, ok and tests phessler, "lets get this in!" todd
* typo in comment.sthen2012-02-141-2/+2
|
* Add a short cut for atomic IPv6 fragments. They will be processedbluhm2012-01-241-2/+15
| | | | | | immediately and not go through the fragment queue. See draft-gont-6man-ipv6-atomic-fragments-00.txt. tested and ok sperreault@
* Do not keep state when dropping overlapping IPv6 fragments in pfbluhm2012-01-231-14/+8
| | | | | and IPv6 stack. ok sperreault@
* During IPv6 source address selection, give address scope higher prioritystsp2012-01-171-17/+19
| | | | | | | | than the autoconfprivacy bit, as per by RFC3484. Prevents privacy addresses from being erroneously used as source address if the destination address is in a different scope. Privacy addresses are still preferred over other source addresses from the same scope. Problem found by sthen, fix suggested by sperreault; ok sperreault
* Simplify the #if CARP and if (IFT_CARP) dance in nd6_ns_input().bluhm2012-01-111-11/+6
| | | | | Fix a white space bug while there. No functional change. ok mikeb@ robert@ henning@
* Implement RFC 5722 and drop all IPv6 fragments that belong to abluhm2012-01-101-9/+26
| | | | | packet with overlapping fragments. ok henning@
* Flush the cached IPv6 forward route every 500 ms. This preventsbluhm2012-01-101-3/+2
| | | | | | | | wrong checks for local addresses and wrong packet forwarding in environments with only one communication partner and changing addresses or routes. Remove the #if 0 around the existing code to make IPv6 behave like IPv4. ok henning@
* Remove the IPv6 fragment overlapping length adjustment code. Itbluhm2012-01-092-66/+11
| | | | | | was already #if 0 and will never come back. Remove unused fragment struct fields and sort the others. ok henning@
* Replace the hand-crafted queue for IPv6 fragments with LIST.bluhm2012-01-092-84/+48
| | | | ok henning@
* Remove dead code from #if 0: we do not have an ipsrcchk_rt anywhere else.bluhm2012-01-051-5/+1
| | | | from FreeBSD; ok henning@
* Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.bluhm2012-01-051-3/+2
| | | | I forgot the header file containing struct ip6q in the last commit.
* Replace the hand-crafted queue for fragmented IPv6 packets with TAILQ.bluhm2012-01-051-53/+26
| | | | ok henning@
* To access the ifaddr of an in_ifaddr or in6_ifaddr struct, it isbluhm2012-01-035-20/+20
| | | | | | cleaner to access the first member via ia_ifa instead of casting. No binary change. ok henning@ krw@
* Instead of hand crafted code, use the macros TAILQ_FOREACH(_SAFE)bluhm2011-12-272-42/+21
| | | | | | and TAILQ_EMPTY for accessing the nd_defrouter list. No funtional change. ok stsp@
* Kill unused IFCAP_IPSEC and IFCAP_IPCOMP.haesbaert2011-12-021-7/+4
| | | | ok claudio@ henning@ mikeb@
* rdomain support for IPv6sperreault2011-11-2414-72/+104
| | | | ok mikeb
* dont define proxydl in nd6_na_output when NCARP = 0 as unusednigel2011-10-151-1/+3
| | | | OK sthend@
* Prevent carp slaves from sending IPv6 neighbour advertisements for carpstsp2011-10-141-1/+8
| | | | | | addresses. Fixes "duplicate IP6 address" warnings, appearing since we started accepting IPv6 neighbour discovery packets on carp interfaces. ok henning
* Since the IPv6 madness is not enough introduce NAT64 -- which is actuallyclaudio2011-10-132-3/+3
| | | | | | | | "af-to" a generic IP version translator for pf(4). Not everything perfect yet but lets fix these things in the tree. Insane amount of work done by sperreault@, mikeb@ and reyk@. Looked over by mcbride@ henning@ and myself at eurobsdcon. OK mcbride@ and general put it in from deraadt@
* If two carp interfaces on the same physical interface had addressesbluhm2011-08-081-1/+3
| | | | | | | with the same prefix, neighbor discovery did not work. When comparing two carp interfaces in in6_ifpprefix(), assume they share the prefix if they have the same parent. sure deraadt@
* Several fixes for the IPV6_PKTINFO handling with sendmsg(2)mikeb2011-08-071-3/+78
| | | | | | | | | | | | | | Verify that the address in the in6_pktinfo structure included in the control message is unicast and configured on the local host. Additional checks prevent from using non-routable addresses and inactive interfaces. Embed the scope identifier into the link local addresses as required by the stack. Do not force users to provide valid interface index in the ipi6_ifindex but look it up in place if needed. ok bluhm, waived by deraadt for the release.
* When checking wether a prefix belongs to an interface, also allowbluhm2011-08-071-2/+14
| | | | | | | | the route to be at the corresponding carp or physical interface or at an interface belonging to a common bridge. This fixes IPv6 neighbor discovery with carp. bug report and tested by Florian Fuessl put it in deraadt@
* Move the check that ::1 is not allowed from the wire before pf_test().bluhm2011-08-041-11/+11
| | | | | | | | Otherwise pf could reroute or redirect such a packet. KAME moved it in rev 1.189 of their ip6_input.c. This also allows rdr or nat to ::1 in pf. bug report and test camield@ ok mikeb@; go for it deraadt@
* Accept neighbor discovery packets from source IPv6 addresses forbluhm2011-07-263-24/+26
| | | | | | | | which we have a cloning or cloned route. The old check was based on configured interface addresses, now we use a route lookup. This allows us to use prefixes for the local network that ospf6d has added. ok claudio@
* cosnistently use IFQ_SET_MAXLEN, surfaced in a discussion with + ok bluhmhenning2011-07-061-2/+2
|
* Bye bye pf_test6(). Only one pf_test function for both IPv4 and v6.claudio2011-07-043-10/+10
| | | | | | The functions were 95% identical anyway. While there use struct pf_addr in struct pf_divert instead of some union which is the same. OK bluhm@ mcbride@ and most probably henning@ as well
* M_WAITOK cleanup of two cases:mk2011-06-171-2/+2
| | | | | | | | | | | | | | | | 1) Allocating with M_WAITOK, checking for NULL, and calling panic() is pointless (malloc() will panic if it can't allocate) so remove the check and the call. 2) Allocating with M_WAITOK, checking for NULL, and then gracefully handling failure to allocate is pointless. Instead also pass M_CANFAIL so malloc() doesn't panic so we can actually handle it gracefully. 1) was done using Coccinelle. Input from oga. ok miod.
* Revert the pf->socket linking diff.oga2011-05-131-21/+1
| | | | | | | | | | | | | | | | | | | | | | | | | at least krw@, pirofti@ and todd@ have been seeing panics (todd and krw with xxxterm not sure about pirofti) involving pool corruption while using this commit. krw and todd confirm that this backout fixes the problem. ok blambert@ krw@, todd@ henning@ and kettenis@ Double link between pf states and sockets. Henning has already implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
* Fix potential null dereference.chl2011-05-021-3/+3
| | | | | | Found by LLVM/Clang Static Analyzer. ok henning@ claudio@ krw@
* Fix potential null dereference.chl2011-05-021-3/+5
| | | | | | Found by LLVM/Clang Static Analyzer. ok claudio@ henning@
* recognize SO_RTABLE socket option at the SOL_SOCKET level;mikeb2011-05-021-1/+3
| | | | discussed with and ok claudio
* Double link between pf states and sockets. Henning has alreadybluhm2011-04-241-1/+21
| | | | | | | | | | | | | | | | implemented half of it. The additional part is: - The pf state lookup for outgoing packets is optimized by using mbuf->inp->state. - For incomming tcp, udp, raw, raw6 packets the socket lookup always is optimized by using mbuf->state->inp. - All protocols establish the link for incomming packets. - All protocols set the inp in the mbuf for outgoing packets. This allows the linkage beginning with the first packet for outgoing connections. - In case of divert states, delete the state when the socket closes. Otherwise new connections could match on old states instead of being diverted to the listen socket. ok henning@
* Remove dead assignment.chl2011-04-151-2/+2
| | | | | | Found by LLVM/Clang Static Analyzer. ok claudio@
* comment typosthen2011-04-061-2/+2
|
* Passing M_WAITOK to mbuf functions is supposed to be a contract betweenblambert2011-04-052-5/+5
| | | | | | | | | | | | | | | the caller and the function that the function will not fail to allocate memory and return a NULL pointer. However, m_dup_pkthdr() violates this contract, making it possible for functions that pass M_WAITOK to be surprised in ways that hurt. Fix this by passing the wait flag all the way down the functions that actually do the allocation for m_dup_pkthdr() so that we won't be surprised. man page update forthcoming ok claudio@
* Add the same SS_CANTRCVMORE check as was done in the other inputclaudio2011-04-041-1/+3
| | | | functions. OK blambert@
* fix typos in commentsstsp2011-04-032-5/+5
| | | | ok deraadt henning sthen thib (though thib says he can't spell)
* As of r1.54 of nd6_rtr.c we don't add addresses from interrupt contextstsp2011-04-031-9/+2
| | | | | anymore so the allocation in in6_update_ifa() can now wait. ok deraadt henning
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.