summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Carp balancing ip does not work since there is a mac filter infriehm2017-05-304-20/+54
| | | | | | | ether_input(). Now we use mbuf tags instead of modifying the MAC address. ok mpi@
* Introduce ipv{4,6}_input(), two wrappers around IP queues.mpi2017-05-306-25/+37
| | | | | | | This will help transitionning to an un-KERNEL_LOCK()ed IP forwarding path. Disucssed with bluhm@, ok claudio@
* Per-interface list of addresses, both multicast and unicast, arempi2017-05-294-20/+11
| | | | | | | | | | | | | currently protected by the NET_LOCK(). They are not accessed in the hot path, so protecting them with a mutex could be an option. However since we're now going to run with a NET_LOCK() for some time, assert that it is held. IPsec is not yet ready to run without KERNEL_LOCK(), so assert it is held, even in the forwarding path. Tested by sthen@, ok visa@, claudio@, bluhm@
* Call bpf_mtap_af() a bit earlier in ipip_input(). This preparesbluhm2017-05-281-11/+11
| | | | | upcoming diffs, no functional change. OK mpi@
* Leaving IP multicast group requires the NET_LOCK().mpi2017-05-281-1/+5
| | | | | | Grab the lock before calling carpdetach(). ok bluhm@
* clang warns on unused labels. Place a recently introduced label underjsg2017-05-281-1/+3
| | | | | | ifdef IPSEC to fix the clang build when IPSEC is not defined. ok deraadt@ bluhm@
* Rename ip_local() to ip_deliver() and give it the same parametersbluhm2017-05-283-14/+17
| | | | | | | as the pr_input functions. Add an assert that IPv4 delivery ends in IP proto done to assure that IPv4 protocol functions work like IPv6. OK mpi@
* Fix the carp mode 'balancing ip-stealth'. Set the link state UPbluhm2017-05-271-14/+15
| | | | | if at least one vhid is in state MASTER. from Florian Riehm; OK florian@
* In IPIP input rename the variable ipo to ip as it is used for innerbluhm2017-05-261-34/+33
| | | | | | | | | | and outer header. Reset values depending on the the mbuf when the mbuf is adjusted. Check the length of the inner IP header with the correct size in case of IPv6. Check the IPv4 header size including IP options. For the IPIP statistics the inner header length has to be subtracted from the packet size as the outer header has already been stripped off. OK mpi@
* Instead of looking at the IP version of the header, use the outerbluhm2017-05-261-16/+8
| | | | | address family passed to ipip_input(). OK mpi@
* Move IPsec forward and local policy check functions to ipsec_input.cbluhm2017-05-224-105/+103
| | | | | and give them better names. input and OK mikeb@
* Use the IPsec policy check from IPv4 also when doing local deliverybluhm2017-05-222-13/+19
| | | | | in ip6_local() to our IPv6 stack. OK mikeb@
* Fix a mbuf leak when reflecting an ICMP packet with IP options.bluhm2017-05-221-2/+4
| | | | | | | Free the options in icmp_input_if() after a successful call to icmp_reflect(). bug report and analysis by Hendrik Gerlach OK krw@ claudio@ phessler@
* Merge the content of <netinet/tcpip.h> and <netinet6/tcpipv6.h> inmpi2017-05-187-73/+47
| | | | | | | | | <netinet/tcp_debug.h>. The IPv6 variant was always included and the IPv4 version is not present on all systems. Most of the offending ports are already fixed, thanks to sthen@!
* The function name ip4_input() is confusing as it also handles IPv6bluhm2017-05-186-40/+39
| | | | | | | | | | packets. This is the IP in IP protocol input function, so call it ipip_input(). Rename the existing ipip_input() to ipip_input_gif() as it is the input function used by the gif interface. Pass the address family to make it consistent with pr_input. Use __func__ in debug print and panic messages. Move all ipip prototypes to the ip_ipip.h header file. OK dhill@ mpi@
* The large and nested GIF #ifdef in protosw made it hard to figurebluhm2017-05-171-35/+19
| | | | | | out what is going on. There were also some inconsistencies that seem to be oversights. Use more specific the #ifdefs. OK mpi@
* Sync three changes that were caught by IPv6 multicast routing review:rzalamena2017-05-161-4/+13
| | | | | | | | * use a variable to allow disabling debugs on run-time * fix a potential memory leak on copyout() failure * don't just blindly use the first address provided by ifalist ok bluhm@
* Make return values more meaningful by using errno instead of -1 or 1.rzalamena2017-05-161-10/+6
| | | | ok bluhm@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-169-34/+34
| | | | ok visa@
* Let malloc() block when the caller of the add route function isrzalamena2017-05-161-12/+13
| | | | | | | setsockopt(), otherwise use non-blocking malloc() for network stack calls. ok bluhm@
* Call rtfree() after each use of routes and make sure the route is validrzalamena2017-05-161-15/+50
| | | | | | | | when finding one. Since rtfree() is being called and rt_llinfo being removed, add checks everywhere to make sure we are using a route that is not being removed. ok bluhm@
* Do not check for mapped addresses in tcp_usrreq(PRU_CONNECT),bluhm2017-05-131-3/+2
| | | | | this is done in in6_pcbconnect(). OK mpi@
* IPsec packets were passed through ip_input() a second time afterbluhm2017-05-123-44/+48
| | | | | | | | | | | | | | | | they have been decrypted. That means that all the IP header fields were checked twice. Also fragment reassembly was tried twice. At pf incoming packets in tunnel mode appeared twice on the enc0 interface, once as IP-in-IP and once as the inner packet. In the outgoing path pf only sees the inner packet. Asymmetry is bad for stateful filtering. IPv6 shows that IPsec works without that. After decrypting immediately continue with local delivery. In tunnel mode the IP-in-IP protocol functions pass the inner header to ip6_input(). In transport mode only pf_test() has to be called for the enc0 device. Introduce ip_local() to avoid needless processing and cleaner pf behavior in IPv4 IPsec. OK mikeb@
* Use the common switch(af) construct for address family specificbluhm2017-05-121-20/+27
| | | | | | | code in tcp_usrreq(PRU_CONNECT). Do not access sockaddr_in before checking the address family. Return EAFNOSUPPORT error in the default case. OK mikeb@
* Instead of printing a debug message at the end of processing, panicbluhm2017-05-121-19/+21
| | | | | | | early if the IPsec security protocol is unknown. ipsec_common_input() and ipsec_common_input_cb() can only be called with the IP protocols ESP, AH, or IPComp. Everything else is a programming mistake. OK claudio@
* Use the IPsec policy check from ipv4_input() also when forwardingbluhm2017-05-122-10/+10
| | | | | in ip6_input(). While there avoid an ugly #ifdef in ipv4_input(). OK mikeb@
* IPv6 IPsec transport mode did not work if pf is enabled. Thebluhm2017-05-111-1/+27
| | | | | | | | decrypted packets in the input path were not checked with pf. So with stateful filtering on enc0, direction aware protocols like ping or TCP did not pass. Add an explicit pf_test() in ipsec_common_input_cb() for IPv6 transport mode to fix this. OK mikeb@
* Fix white spaces and wrap long line. No binary change.bluhm2017-05-111-11/+12
|
* Remove rip_output() and rip6_output() from inetsw and inet6sw. Thebluhm2017-05-091-19/+1
| | | | | | | rip_output() function is never called via the pr_output pointer. rip_usrreq(PRU_SEND) calls rip_output() directly. raw_usrreq() is never called from inetsw. Situation in inet and inet6 is analog. OK claudio@ mikeb@
* Convert diagnostic panic to compile time assert in tcp6_ctlinput().bluhm2017-05-091-5/+2
| | | | | No binary change. OK mpi@
* Checking for IPv4 mapped addreses and dropping the packet is donebluhm2017-05-062-15/+2
| | | | | | in ip6_input(). Do not check that again in the protocol input functions. OK mpi@
* Convert the xformsw definition to C99 style initializer. Also fixbluhm2017-05-063-23/+57
| | | | | the function declaration of ipe4_input() and avoid a wrong cast. OK mikeb@ dhill@
* Expand SA_LEN(), there is no benefit for using the macro in thebluhm2017-05-052-13/+13
| | | | | kernel. It was only used in IPsec sources. No binary change OK deraadt@
* If m is not a continuous mbuf cluster, m_pullup() in pr_input maybluhm2017-05-047-19/+19
| | | | | | | change the pointer. Then *mp keeps the invalid pointer and it might be used. Fix the potential use after free and also reset *mp in other places to have less dangling pointers to freed mbufs. OK mpi@ mikeb@
* Introduce sstosa() for converting sockaddr_storage with a type safebluhm2017-05-044-17/+14
| | | | | | | inline function instead of casting it to sockaddr. While there, use inline instead of __inline for all these conversions. Some struct sockaddr casts can be avoided completely. OK dhill@ mpi@
* Back out rev 1.185 (which made the code match the comment) andmillert2017-05-031-7/+4
| | | | | | adjust the comment to match reality (or at least rfc7323) instead. This brings us back in line with the behavior of Net and Free. From Lauri Tirkkonen. OK bluhm@
* Switch OCF and IPsec over to the new AESmikeb2017-05-021-2/+2
| | | | ok djm
* Use the rt_rmx defines that hide the struct rt_kmetrics indirection.bluhm2017-04-196-29/+29
| | | | | No binary change. OK mpi@
* The raw ip input functions are called from several places. Use thebluhm2017-04-171-1/+3
| | | | | | address family passed down with pr_input to check that the correct one is used. OK florian@
* Use the address family passed down with pr_input to simplifybluhm2017-04-171-48/+4
| | | | | tcp_input(). OK florian@
* Use the address family passed down with pr_input to simplifybluhm2017-04-171-49/+23
| | | | | udp_input(). OK florian@
* Pass down the address family through the pr_input calls. Thisbluhm2017-04-1422-71/+69
| | | | | allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
* Partially revert previous mallocarray conversions that containdhill2017-04-112-6/+6
| | | | | | | | | constants. The consensus is that if both operands are constant, we don't need mallocarray. Reminded by tedu@ ok deraadt@
* Use mallocarray to allocate multicast group memberships.dhill2017-04-092-8/+8
| | | | ok deraadt@
* Convert bcopy to memcpy where the memory does not overlap, otherwise,dhill2017-04-062-10/+11
| | | | | | | use memmove. While here, change some previous conversions to a simple assignment. ok deraadt@
* Replace bcopy with a simple assignment where both variables aredhill2017-04-063-9/+8
| | | | | | | properly aligned and sockaddr_union fields, or with memcpy when the memory doesn't overlap. OK bluhm@
* Replace 2 bcopy()'s with a simple assignment as both variables aredhill2017-04-051-5/+5
| | | | | | | properly aligned malloc(9)d data and sockaddr_union fields. While here, convert the remaining bcopy() to memmove(). with and ok @bluhm
* When building counter memory in preparation to copy to userland, alwaysderaadt2017-04-058-13/+16
| | | | | | zero the buffers first. All the current objects appear to be safe, however future changes might introduce structure pads. Discussed with guenther, ok bluhm
* Fix tcp stats reportingjca2017-04-021-5/+3
| | | | | Return the sum of per-cpu counters instead of the current cpu's counters. Brainfart on my side. Analysis and fix by Andrei-Marius Radu.
* Fix the prefixlen sent by RTM_NEWADDR on new addresses without masks:rzalamena2017-03-271-10/+11
| | | | | | | calculate the prefixlen using the address before sending the RTM_NEWADDR message. ok claudio@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.