summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Use m_align() and while there reorder the pkthdr initalisation a bit.claudio2018-12-041-8/+6
| | | | | This also makes the IPv4 and IPv6 code more similar. OK phessler@
* In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter freesclaudio2018-12-031-2/+4
| | | | | | | | | | | | the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
* MH_ALIGN -> m_align. In revarprequest() set the ph_rtableid so thatclaudio2018-11-301-3/+4
| | | | | the function is doing the same initialisation as arprequest(). OK bluhm@
* Further cleanup of icmp_do_error.claudio2018-11-281-19/+13
| | | | | | | | | | - Use m_align() since it handles all cases - Use same rounding logic in the size check as in m_align() so all data will filt always. - consolidate pkthdr initalisation into one place - use m_prepend() instead of direct pointer manipulation (including the panic in case an underflow happens). OK bluhm@
* Retire dom_rtkeylen from struct domain. Nothing is using this anymore.claudio2018-11-191-2/+1
| | | | | It was used by the original patricia tree. OK mpi@
* provide ip_tos_patch() for setting ip_tos and patching the ipv4 cksum.dlg2018-11-143-8/+28
| | | | | | | | | | | | | | | | previously the gif code would patch the tos field and not recalc the cksum, which would cause ip input code to drop the packet due to a cksum failure. the ipip code patched ip_tos and unconditionally recalculated the cksum, making it correct, but also wiping out any errors that may have been present before the recalculation. updating the cksum rather than replacing it lets cksum failures still fire. ip_tos_patch() is provided in the ecn code since it's because of ecn propagation that we need to update the tos field. internally it works like pf_patch_8 and pf_cksum_fixup, but since pf is optional it rolls its own code. procter may fix that in the future... ok claudio@
* Do not translate the EACCES error from pf(4) to EHOSTUNREACH anymore.bluhm2018-11-104-12/+4
| | | | | | It also translated a documented send(2) EACCES case erroneously. This was too much magic and always prone to errors. from Jan Klemkow; man page jmc@; OK claudio@
* M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forclaudio2018-11-091-2/+2
| | | | | | m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-4/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* In icmp_input_if() m_pullup up the maximum size of required data at the start.claudio2018-11-052-13/+5
| | | | | | | | | | | The maximum is ICMP_MINLEN (8) + max IPv4 header size (60) + IPv6 header (40) for the IPv6 over IPv4 transition case. By having up to this amount of data consequtive in an mbuf makes the rest of the code simpler and no more extra m_pullup calls are needed. Only length checks are now required.The maximum size is also big enough for all other ICMP types that don't embed the IP heaader. This ensures that all data has been m_pullup-ed before calling the ctlinput function which can look that deep into the header. OK bluhm@ markus@
* Consider the size of IP header when doing the ICMP length overflowbluhm2018-11-051-3/+3
| | | | | | check. This code was never reached as ICMP length was truncated before, but fix the wrong calculation anyway. OK claudio@
* Fixup the case where an mbuf cluster is used. Correctly offset the data toclaudio2018-11-051-3/+5
| | | | | | | | the end of the cluster (there is no M_ALIGN version for clusters so it is hard coded). Also make the sanity check more general by using m_leadingspace. Not a security issue since the cluster code is not reachable, there is enough space in an mbuf. OK bluhm@
* The change of the sb_mbmax calculation in sbreserve() broke settingbluhm2018-11-041-3/+4
| | | | | | a fixed socket send buffer size for TCP. tcp_update_sndspace() could overwrite the value as the algorithms were not in sync. OK benno@ claudio@
* ipsec: use monotonic clock for SA creation/lookup timestamps; ok dlg@cheloha2018-10-222-5/+5
|
* Partial revert of previous. Only the queue(3) stuff should have gone in.cheloha2018-10-181-38/+7
|
* igmp, struct router_info: use queue(3)cheloha2018-10-182-26/+52
| | | | | | | | | | In particular, use LIST_* to preserve O(n) removal in rti_delete(). While here, clean up two malloc(9) calls. Suggested by mpi@. ok visa@
* Expose net.inet.ip.arpq.drops to help debug what's going on when a lotflorian2018-10-132-4/+13
| | | | | | | of packets are being dropped but non of the other counters are increasing. From Daniel Hokka Zakrisson (daniel AT hozac DOT com), thanks! OK florian, phessler
* RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.reyk2018-10-101-5/+5
| | | | | | | | | | rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
* Revert the inpcb table mutex commit. It triggers a witness panicbluhm2018-10-046-84/+21
| | | | | | | in raw IP delivery and UDP broadcast loops. There inpcbtable_mtx is held and sorwakeup() is called within the loop. As sowakeup() grabs the kernel lock, we have a lock ordering problem. found by Hrvoje Popovski; OK deraadt@ mpi@
* Turn carp_ourether() mp-safe, this is a requirement for taking bridge(4)mpi2018-09-241-16/+15
| | | | | | out of the KERNEL_LOCK(). ok visa@, bluhm@
* As a step towards per inpcb or socket locks, remove the net lockbluhm2018-09-206-22/+85
| | | | | | | | | | | | for netstat -a. Introduce a global mutex that protects the tables and hashes for the internet PCBs. To detect detached PCB, set its inp_socket field to NULL. This has to be protected by a per PCB mutex. The protocol pointer has to be protected by the mutex as netstat uses it. Always take the kernel lock in in_pcbnotifyall() and in6_pcbnotify() before the table mutex to avoid lock ordering problems in the notify functions. OK visa@
* Do not acknowledge a received ack-only tcp packet that we would drop due tofriehm2018-09-171-2/+4
| | | | | | | | | PAWS. Otherwise we could trigger a retransmit of the opposite party with another wrong timestamp and produce loop. I have seen this with a buggy server which messed up tcp timestamps. Suggested by Prof. Jacobson for FreeBSD. ok krw, bluhm, henning, mpi
* Initialize the TDB to NULL in ipsec_common_input() andmestre2018-09-142-5/+5
| | | | | | | | | | ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus mbuf (NULL) we don't end up trying to dereference the TDB, while being an uninitialized pointer, to increase the drops. Coverity IDs 1473312, 1473313 and 1473317. OK mpi@ visa@
* In general it is a bad idea to use one random secret for two things.bluhm2018-09-142-12/+15
| | | | | | | The inet PCB uses one hash with local and foreign addresses, and one with local port numbers. Give both hashes separate keys. Also document the struct fields. OK visa@
* unbreak userland uses of in_pcb.h by including sys/refcnt.hjsg2018-09-141-1/+2
| | | | ok visa@
* Add reference counting for inet pcb, this will be needed when webluhm2018-09-135-9/+40
| | | | | | start locking the socket. An inp can be referenced by the PCB queue and hashes, by a pf mbuf header, or by a pf state key. OK visa@
* Include the size of IPCOMP header when checking for compression.mpi2018-09-131-2/+2
| | | | Problem found and anaylyzed by Romain Gabet, ok markus@
* Convert inetctlerrmap to u_char like inet6ctlerrmap. That is alsobluhm2018-09-112-5/+5
| | | | | what FreeBSD does. Remove old #if 0 version of inet6ctlerrmap. OK mpi@
* Make the distribution of in_ and in6_ functions in in_pcb.c andbluhm2018-09-112-162/+11
| | | | | | | | | in6_pcb.c consistent, to ease comparing the code. Move all inet6 functions to in6_. Bring functions in both source files in same order. Cleanup the include section. Now in_pcb.c is a superset of in6_pcb.c. The latter contains all the special implementations. Just moving arround, no code change intended. OK mpi@
* Remove useless INPCBHASH() macros. Just expand them.bluhm2018-09-101-31/+24
| | | | OK stsp@
* Instead of calculating the mbuf packet header length here and there,bluhm2018-09-101-9/+2
| | | | | | put the algorithm into a new function m_calchdrlen(). Also set an uninitialized m_len to 0 in NFS code. OK claudio@
* During fragment reassembly, mbuf chains with packet headers werebluhm2018-09-101-3/+5
| | | | | | | created. Add a new function m_removehdr() do convert packet header mbufs within the chain to regular mbufs. Assert that the mbuf at the beginning of the chain has a packet header. found by Maxime Villard in NetBSD; from markus@; OK claudio@
* Explain the special case for redirect to localhost in a comment.bluhm2018-09-071-1/+14
| | | | input and OK claudio@
* sync icmp_mtudisc_clone() with icmp6_mtudisc_clone(); prompted by bluhm@miko2018-09-061-17/+12
|
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-289-34/+97
| | | | | | userland. Inputs from markus@, ok sthen@
* Coverity CID 1470233 complainst that the m != NULL check inbluhm2018-07-231-4/+3
| | | | | | syn_cache_get() is not neccessary. Also make the abort label consistent to resetandabort and free the mbuf there. OK mpi@
* Fix for uninitialized variables.mpi2018-07-161-4/+4
| | | | Found by and ok jsg@, ok markus@
* Introduce ipsec_output_cb() to merge duplicate code and account formpi2018-07-126-176/+135
| | | | | | | | dropped packets in the output path. While here fix a memory leak when compression is not needed w/ IPcomp. ok markus@
* Disambiguate the source of panics in sys/net* by adding __func__nayden2018-07-111-4/+4
| | | | | magic constant to panic() calls. ok benno@ henning@ tb@
* Retire RTM_LOSING, it no longer makes sense and on busy servers theclaudio2018-07-111-18/+6
| | | | | | | route socket is flooded with those messages. Instead maek sure that the removal of the dynamic route that can happen is actually also sent to the routing socket. OK mpi@ henning@
* rtm_send() the cloned routes because of ICMP mtu changes. Until nowclaudio2018-07-111-1/+2
| | | | | | | these changes to the routing table have not been visible whereas the RTM_DELETE of those routes have been. Remove this inconsistency. Input and OK mpi@ OK henning@
* Convert AH & IPcomp to ipsec_input_cb() and count drops on input.mpi2018-07-115-119/+37
| | | | ok markus@
* Introduce new IPsec (per-CPU) statistics and refactor ESP inputmpi2018-07-105-73/+181
| | | | | | | | | | callbacks to be able to count dropped packet. Having more generic statistics will help troubleshooting problems with specific tunnels. Per-TDB counters are coming once all the refactoring bits are in. ok markus@
* Remove DELAY(1000) from carp_send_arp() / carp_send_na() since it is not clearfriehm2018-07-101-3/+1
| | | | | | | why it was necessary. OK bluhm@ 'ok but watch for fallouts' mpi@
* It was possible to leak the control mbuf in raw ip user requestbluhm2018-07-052-4/+5
| | | | | | with sendmsg(2) and MSG_OOB. Sync the code in udp, rip, and rip6_usrreq. Add an inp NULL check in rip6_usrreq for consistency. OK benno@ mpi@
* Prevent a mbuf double free by not freeing it along the error-path inanton2018-07-041-3/+5
| | | | | | rip{6,}_usrreq() since soreceive() will free it. ok bluhm@
* Assert that the NET_LOCK() is held when iterating over `ipsec_acquire_head'.mpi2018-06-251-1/+3
| | | | ok visa@ as part of a larger bigger diff
* In in_pcballoc() finish the inp initialization before adding it tobluhm2018-06-141-12/+13
| | | | | the global inpcb queue and hashes. OK visa@ mpi@ as part of a larger diff
* Assert that the INP_IPV6 in in6_pcbconnect() is correct. Just callbluhm2018-06-142-25/+6
| | | | | in_pcbconnect() to avoid the address family maze in syn_cache_get(). input claudio@; OK mpi@
* Use mbuf (not cluster) always for t_template of tcpcb.yasuoka2018-06-141-14/+4
| | | | ok bluhm
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.