summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
* In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag isclaudio2019-06-131-2/+3
| | | | | | | | set. These mpls routes use the rt_llinfo structure to store the MPLS label and would confuse the arp and nd6 code. OK bluhm@ anton@ Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com
* Copy the user provided sockaddr into a normalized sockaddr in rtrequest()claudio2019-06-131-1/+2
| | | | | | | | | | before adding it to the routing table. The rtable code is doing memcmp() of those rt_dest sockaddrs so it is important that they are stored in a canonical form. To do this struct domain is extended to include the sockaddr size for this address family. OK bluhm@ anton@ Reported-by: syzbot+10fe9cd8d0211c562ead@syzkaller.appspotmail.com
* use m_microtime instead of microtime for SO_TIMESTAMP socketopt handlingdlg2019-06-101-2/+2
| | | | | | drivers can set ph_timestamp when packets are received by the hardware, which should be more accurate and cheaper than getting the clock when the packet is queued on the socket.
* Use mallocarray(9) & put some free(9) sizes for M_IPMOPTS allocations.mpi2019-06-102-13/+13
| | | | ok semarie@, visa@
* Add missing NULL check for the protocol control block (pcb) pointer inanton2019-06-041-1/+4
| | | | | | | | | | mrt{6,}_ioctl. Calling shutdown(2) on the socket prior to the ioctl command can cause it to be NULL. ok bluhm@ claudio@ Reported-by: syzbot+bdc489ecb509995a21ed@syzkaller.appspotmail.com Reported-by: syzbot+156405fdea9f2ab15d40@syzkaller.appspotmail.com
* unbreak the build without IPSEC.benno2019-05-111-1/+5
| | | | ok claudio@ deraadt@
* Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.mpi2019-04-281-6/+6
| | | | | | | | This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
* a first cut at converting some virtual ethernet interfaces to if_vinputdlg2019-04-231-8/+4
| | | | | | | | | | this let's input processing bypass ifiqs. there's a performance benefit from this, and it will let me tweak the backpressure detection mechanism that ifiqs use without impacting on a stack of virtual interfaces. ive tested all of these except mpw, which i will end up testing soon anyway.
* In in_cksum() and in6_cksum() convert types to C99 style and makebluhm2019-04-221-15/+14
| | | | | | | both functions consistent. In in_cksum() panic if len is longer than mbuf, but in in6_cksum() do not panic if off and len match exactly to the end of mbuf. OK claudio@
* In debug mode print TCP flag names to console correctly.bluhm2019-04-051-2/+2
| | | | from Mitchell Krome
* change rt_ifa_add and rt_ifa_del so they take an rdomain argument.dlg2019-02-132-11/+18
| | | | | | | | | | | | this allows mpls interfaces (mpe, mpw) to pass the rdomain they wish the local label to be in, rather than have it implicitly forced to 0 by these functions. right now they'll pass 0, but it will soon be possible to have them rx packets in other rdomains. previously the functions used ifp->if_rdomain for the rdomain. everything other than mpls still passes ifp->if_rdomain. ok mpi@
* remove the implict RTF_MPATH flag that rt_ifa_add() sets on new routes.dlg2019-02-102-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | MPLS interfaces (ab)use rt_ifa_add for adding the local MPLS label that they listen on for incoming packets, while every other use of rt_ifa_add is for adding addresses on local interfaces. MPLS does this cos the addresses involved are in basically the same shape as ones used for setting up local addresses. It is appropriate for interfaces to want RTF_MPATH on local addresses, but in the MPLS case it means you can have multiple local things listening on the same label, which doesn't actually work. mpe in particular keeps track of in use labels to it can handle collisions, however, mpw does not. It is currently possible to have multiple mpw interfaces on the same local label, and sharing the same label as mpe or possible normal forwarding labels. Moving the RTF_MPATH flag out of rt_ifa_add means all the callers that still want it need to pass it themselves. The mpe and mpw callers are left alone without the flag, and will now get EEXIST from rt_ifa_add when a label is already in use. ok (and a huge amount of patience and help) mpi@ claudio@ is ok with the idea, but saw a much much earlier solution to the problem
* Fix a possible mbuf leak in tcp_usrreq(). Make the error handlingbluhm2019-02-061-13/+13
| | | | | more consistent to the other protocols' usrreq functions. OK visa@ claudio@
* Avoid an mbuf double free in the oob soreceive() path. In thebluhm2019-02-043-24/+24
| | | | | | | | | | usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
* Refresh arp entries that are about to expire. Once their life time is lessclaudio2019-01-201-32/+32
| | | | | | | | then 1/8 of net.inet.ip.arptimeout the system will send out a arp request about every 30 seconds until either the entry is updated or expired. Not refreshing arp entries will result in packet drop every time a entry expires which is not ideal for important gateway entries. Came up with this after a discussion with deraadt@. OK benno@ deraadt@
* Bring back the ip_pcbopts() refactor. Pad the option buffer and thereforclaudio2019-01-181-39/+54
| | | | | | the mbuf to the next word length as it is required by the standard. Also use the correct offset from the input mbuf. OK visa@, input & OK bluhm@
* Revert Rev 1.351, the change is not quite right yet.claudio2019-01-181-49/+36
|
* Botched up an if conditional in the last commit. The IP length needs toclaudio2019-01-081-2/+2
| | | | bigger than the IP header len to be valid. With this I can traceroute again.
* Validate the version, and all length fields of IP packets passed to a raw socketclaudio2019-01-071-16/+82
| | | | | | | | | | with INP_HDRINCL. There is no reason to allow badly constructed packets through our network stack. Especially since they may trigger diagnostic checks further down the stack. Now EINVAL is returned instead which was already used for some checks that happened before. OK florian@ Reported-by: syzbot+0361ed02deed123667cb@syzkaller.appspotmail.com
* Rewrite ip_pcbopts() to fill a fresh mbuf with the ip options insteadclaudio2019-01-061-36/+49
| | | | | of fiddling with the user supplied mbuf and then copy it at the end. OK visa@
* Replace a funky 'else switch' construct into something that is equal butclaudio2019-01-031-4/+5
| | | | | | a lot easier to read. The if can simply return the error and so the else branch is no longer needed. Input and OK dhill@
* rework icmp6_error() to be closer to icmp_error()denis2018-12-251-11/+12
| | | | input & OK mpi@
* Replace a wrong poor mans m_trailingspace() with the real thing. The mbufclaudio2018-12-201-2/+2
| | | | | | | | passed to ip_pcbopts could be a cluster and so the size check is all wrong. found by Greg Steuck; OK bluhm@ Reported-by: syzbot+c2543ae6b6692a5843e3@syzkaller.appspotmail.com eVS: ----------------------------------------------------------------------
* Switch from timeout_add with tvtohz to just timeout_add_tv. Now this changeclaudio2018-12-171-7/+7
| | | | | | | will reduce the sleep time by one tick which doesn't matter in the common case. The code never passes a true 0 timeval to timeout_add_tv so the code will always sleep for at least 1 tick which is good enough. OK kn@, florian@, visa@, cheloha@
* split ether_output into resolution, encapsulation, and output functionsdlg2018-12-111-3/+8
| | | | | | | | | | | | | | | | | | | if if_output can be overridden on ethernet interfaces, it will allow things like vlan to do it's packet encapsulation during output before putting the packet directly on the underlying interface for output. this has two benefits. first, it can avoid having ether_output on pseudo interfaces recurse, which makes profiling of the network stack a lot clearer. secondly, and more importantly, it allows pseudo ethernet interface packet encapsulation to by run concurrently by the stack, rather than having packets unnecessarily serialied by an ifq. this diff just splits ether_output up, it doesnt have any interface take advantage of it yet. tweaks and ok claudio@
* Use m_align() and while there reorder the pkthdr initalisation a bit.claudio2018-12-041-8/+6
| | | | | This also makes the IPv4 and IPv6 code more similar. OK phessler@
* In PRU_DISCONNECT don't fall through into PRU_ABORT since the latter freesclaudio2018-12-031-2/+4
| | | | | | | | | | | | the inpcb apart from the disconnect. Just call soisdisconnected() and clear the inp->inp_faddr since the socket is still valid after a disconnect. Problem found by syzkaller via Greg Steuck OK visa@ Fixes: Reported-by: syzbot+2cd350dfe5c96f6469f2@syzkaller.appspotmail.com Reported-by: syzbot+139ac2d7d3d60162334b@syzkaller.appspotmail.com Reported-by: syzbot+02168317bd0156c13b69@syzkaller.appspotmail.com Reported-by: syzbot+de8d2459ecf4cdc576a1@syzkaller.appspotmail.com
* MH_ALIGN -> m_align. In revarprequest() set the ph_rtableid so thatclaudio2018-11-301-3/+4
| | | | | the function is doing the same initialisation as arprequest(). OK bluhm@
* Further cleanup of icmp_do_error.claudio2018-11-281-19/+13
| | | | | | | | | | - Use m_align() since it handles all cases - Use same rounding logic in the size check as in m_align() so all data will filt always. - consolidate pkthdr initalisation into one place - use m_prepend() instead of direct pointer manipulation (including the panic in case an underflow happens). OK bluhm@
* Retire dom_rtkeylen from struct domain. Nothing is using this anymore.claudio2018-11-191-2/+1
| | | | | It was used by the original patricia tree. OK mpi@
* provide ip_tos_patch() for setting ip_tos and patching the ipv4 cksum.dlg2018-11-143-8/+28
| | | | | | | | | | | | | | | | previously the gif code would patch the tos field and not recalc the cksum, which would cause ip input code to drop the packet due to a cksum failure. the ipip code patched ip_tos and unconditionally recalculated the cksum, making it correct, but also wiping out any errors that may have been present before the recalculation. updating the cksum rather than replacing it lets cksum failures still fire. ip_tos_patch() is provided in the ecn code since it's because of ecn propagation that we need to update the tos field. internally it works like pf_patch_8 and pf_cksum_fixup, but since pf is optional it rolls its own code. procter may fix that in the future... ok claudio@
* Do not translate the EACCES error from pf(4) to EHOSTUNREACH anymore.bluhm2018-11-104-12/+4
| | | | | | It also translated a documented send(2) EACCES case erroneously. This was too much magic and always prone to errors. from Jan Klemkow; man page jmc@; OK claudio@
* M_LEADINGSPACE() and M_TRAILINGSPACE() are just wrappers forclaudio2018-11-091-2/+2
| | | | | | m_leadingspace() and m_trailingspace(). Convert all callers to call directly the functions and remove the defines. OK krw@, mpi@
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-4/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* In icmp_input_if() m_pullup up the maximum size of required data at the start.claudio2018-11-052-13/+5
| | | | | | | | | | | The maximum is ICMP_MINLEN (8) + max IPv4 header size (60) + IPv6 header (40) for the IPv6 over IPv4 transition case. By having up to this amount of data consequtive in an mbuf makes the rest of the code simpler and no more extra m_pullup calls are needed. Only length checks are now required.The maximum size is also big enough for all other ICMP types that don't embed the IP heaader. This ensures that all data has been m_pullup-ed before calling the ctlinput function which can look that deep into the header. OK bluhm@ markus@
* Consider the size of IP header when doing the ICMP length overflowbluhm2018-11-051-3/+3
| | | | | | check. This code was never reached as ICMP length was truncated before, but fix the wrong calculation anyway. OK claudio@
* Fixup the case where an mbuf cluster is used. Correctly offset the data toclaudio2018-11-051-3/+5
| | | | | | | | the end of the cluster (there is no M_ALIGN version for clusters so it is hard coded). Also make the sanity check more general by using m_leadingspace. Not a security issue since the cluster code is not reachable, there is enough space in an mbuf. OK bluhm@
* The change of the sb_mbmax calculation in sbreserve() broke settingbluhm2018-11-041-3/+4
| | | | | | a fixed socket send buffer size for TCP. tcp_update_sndspace() could overwrite the value as the algorithms were not in sync. OK benno@ claudio@
* ipsec: use monotonic clock for SA creation/lookup timestamps; ok dlg@cheloha2018-10-222-5/+5
|
* Partial revert of previous. Only the queue(3) stuff should have gone in.cheloha2018-10-181-38/+7
|
* igmp, struct router_info: use queue(3)cheloha2018-10-182-26/+52
| | | | | | | | | | In particular, use LIST_* to preserve O(n) removal in rti_delete(). While here, clean up two malloc(9) calls. Suggested by mpi@. ok visa@
* Expose net.inet.ip.arpq.drops to help debug what's going on when a lotflorian2018-10-132-4/+13
| | | | | | | of packets are being dropped but non of the other counters are increasing. From Daniel Hokka Zakrisson (daniel AT hozac DOT com), thanks! OK florian, phessler
* RT_TABLEID_MAX is 255, fix places that assumed that it is less than 255.reyk2018-10-101-5/+5
| | | | | | | | | | rtable 255 is a valid routing table or domain id that wasn't handled by the ip[6]_mroute code or by snmpd. The arrays in the ip[6]_mroute code where off by one and didn't allocate space for rtable 255; snmpd simply ignored rtable 255. All other places in the tree seem to handle RT_TABLEID_MAX correctly. OK florian@ benno@ henning@ deraadt@
* Revert the inpcb table mutex commit. It triggers a witness panicbluhm2018-10-046-84/+21
| | | | | | | in raw IP delivery and UDP broadcast loops. There inpcbtable_mtx is held and sorwakeup() is called within the loop. As sowakeup() grabs the kernel lock, we have a lock ordering problem. found by Hrvoje Popovski; OK deraadt@ mpi@
* Turn carp_ourether() mp-safe, this is a requirement for taking bridge(4)mpi2018-09-241-16/+15
| | | | | | out of the KERNEL_LOCK(). ok visa@, bluhm@
* As a step towards per inpcb or socket locks, remove the net lockbluhm2018-09-206-22/+85
| | | | | | | | | | | | for netstat -a. Introduce a global mutex that protects the tables and hashes for the internet PCBs. To detect detached PCB, set its inp_socket field to NULL. This has to be protected by a per PCB mutex. The protocol pointer has to be protected by the mutex as netstat uses it. Always take the kernel lock in in_pcbnotifyall() and in6_pcbnotify() before the table mutex to avoid lock ordering problems in the notify functions. OK visa@
* Do not acknowledge a received ack-only tcp packet that we would drop due tofriehm2018-09-171-2/+4
| | | | | | | | | PAWS. Otherwise we could trigger a retransmit of the opposite party with another wrong timestamp and produce loop. I have seen this with a buggy server which messed up tcp timestamps. Suggested by Prof. Jacobson for FreeBSD. ok krw, bluhm, henning, mpi
* Initialize the TDB to NULL in ipsec_common_input() andmestre2018-09-142-5/+5
| | | | | | | | | | ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus mbuf (NULL) we don't end up trying to dereference the TDB, while being an uninitialized pointer, to increase the drops. Coverity IDs 1473312, 1473313 and 1473317. OK mpi@ visa@
* In general it is a bad idea to use one random secret for two things.bluhm2018-09-142-12/+15
| | | | | | | The inet PCB uses one hash with local and foreign addresses, and one with local port numbers. Give both hashes separate keys. Also document the struct fields. OK visa@
* unbreak userland uses of in_pcb.h by including sys/refcnt.hjsg2018-09-141-1/+2
| | | | ok visa@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.