summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Better version of the refactoring attempted in r1.154. Move SIOCSIFADDRtb2018-06-031-35/+78
| | | | | | | | | | | | | to its own function and merge the two switches in in_ioctl_change_ifaddr(). Finally: each ioctl has its own case and privilege check. ok visa As an aside, an audit of the ports tree has shown that we should continue to support the legacy ioctls SIOCSIF{,BRD,DST}ADDR, SIOCSIFNETMASK despite the fact that they have been deprecated for the better part of two decades and FreeBSD dropped support 7 years ago. Too many ports still rely on them. Thanks to sthen and visa for their help with that.
* Move the declarations of the raw ip and ip6 pcb tables into thebluhm2018-06-021-1/+2
| | | | | in_pcb.h header file. OK mpi@ visa@
* Cleanup the in_pcbnotifymiss diagnostic printfs. Always print thebluhm2018-06-021-17/+16
| | | | | rdomain. Move the printf to the end of the pcb lookup functions. OK tb@ mpi@ visa@
* The function in_pcbrehash() does not modify the pcb table queue.bluhm2018-06-021-4/+4
| | | | | | So in in_pcbresize() the variant without _SAFE of the TAILQ_FOREACH macro is sufficient. OK tb@ mpi@ visa@
* zap trailing whitespacetb2018-05-311-3/+3
|
* Re-commit the correct half of revision 1.154:tb2018-05-311-23/+27
| | | | | | | | | Some more code shuffling to get rid of one switch in in_ioctl(). This way there is one case for each of SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK, starting with a privilege check before any global data is modified. ok visa
* Back out previous. The handling of SIOCSIFADDR is now wrong.tb2018-05-311-71/+45
|
* Some more code shuffling to get rid of one switch in each, in_ioctl()tb2018-05-311-45/+71
| | | | | | | | | | and in_ioctl_change_ifaddr(). This way there is one case per ioctl starting with a privilege check before any global data is modified. The code paths are now straightforward. Some code duplication between SIOCSIFADDR and SIOCAIFADDR, but that can be addressed later. tested by hrvoje ok visa
* Next step in disentangling the switches in in_ioctl(). Split out thetb2018-05-281-43/+75
| | | | | | | | handling of SIOCAIFADDR, SIOCDIFADDR, SIOCSIFADDR into a separate function, analogously to what was done in in6_ioctl(). tested by hrvoje ok visa
* Prepare in_ioctl() for further refactoring with the goal of merging thetb2018-05-251-10/+15
| | | | | | | | two big switches in this function. Error out early in the default case without grabbing the NET_LOCK() and move SIOCSIFNETMASK a bit up. This will reduce the noise in an upcoming diff. ok visa
* All places that call carp_lsdrop() use the interface pointer already.bluhm2018-05-214-33/+23
| | | | | | | | It does not make sense to call if_get() again, just pass ifp as parameter. Move the IFT_CARP check into the function instead of doing it everywhere. Replace the inverted match variable logic with simple returns. OK mpi@ friehm@
* Introduce a tdb_reaper() function to prevent a use-after-free when ampi2018-05-191-40/+46
| | | | | | timeout is blocking on the NET_LOCK(). Issue reported by Harald Dunkel, ok visa@, bluhm@
* Fix kernel builds without IPSEC.reyk2018-05-162-2/+6
| | | | OK mikeb@
* When checking the IPsec enable sysctls, ipsec_common_input() hadbluhm2018-05-142-27/+45
| | | | | | | | | | | | switches for protocol and address family. Move this code to the specific functions from where the common function is called. As a consequence the raw ip input functions can never be called from udp_input() anymore. If IPsec is disabled, the functions ah6_input(), esp6_input(), and ipcomp6_input() do not start processing the header chain. The raw ip input functions are called with the mbuf and offset pointers from the protocol walking loop which is the usual behavior. OK mpi@ markus@
* When walking the IPv6 header chain in IPsec output, check that thebluhm2018-05-141-2/+10
| | | | | | next extension header is within the packet length. Also check at the end that the IPv4 headers are not longer than the packet. reported by Maxime Villard; from markus@ via NetBSD; OK mpi@
* Cleanup IPsec common input error handling with consistent goto drop.bluhm2018-05-121-24/+27
| | | | from markus@; OK mpi@
* Cleanup IPsec IPComp error handling with consistent goto drop.bluhm2018-05-121-44/+41
| | | | from markus@; OK mpi@
* TCP debug sockets still had code for old TCP timers that werebluhm2018-05-103-9/+32
| | | | | | implemented as slow and fast protocol user requests. Replace that with a proper timer debug implementation. OK visa@
* Cleanup IPsec ESP error handling with consistent goto drop.bluhm2018-05-091-84/+79
| | | | with and OK markus@
* Cleanup IPsec AH error handling with consistent goto drop.bluhm2018-05-091-90/+79
| | | | with and OK markus@; input mpi@
* Historically there were slow and fast tcp timeouts. That is whybluhm2018-05-086-50/+33
| | | | | | the delack timer had a different implementation. Use the same mechanism for all TCP timer. OK mpi@ visa@
* Do not assume that mbufs within a chain do not have M_PKTHDR set.bluhm2018-05-023-23/+60
| | | | | | | | | | This could happen during fragment reassembly. Better check if we are dealing with the first mbuf of the chain. m_adj() changes the length of the mbuf, obviously. So when using this length to calulate the amount of adjustment, do not calculate it again after m_adj() with wrong input. Use a temporary variable to save the value. from Maxime Villard, NetBSD; OK markus@ claudio@
* Split out the handling of SIOCGIF* into a new function, in_ioctl_get(),tb2018-05-021-32/+77
| | | | | | that only needs the read lock. ok visa, mpi
* Reduce the scope of the NET_LOCK() in in_control(). Two functions weretb2018-04-302-33/+55
| | | | | | | | | | protected: mrt_ioctl() and in_ioctl(). The former has no other callers and only needs a read lock. The latter will need refactoring to reduce the lock's scope further. In a first step, establish a single exit point and protect most of the function body with the NET_LOCK() while removing the NET_LOCK() from a handful of callers. suggested by & ok mpi, ok visa
* Make the ramdisks compile again, we don't have MROUTING on them.florian2018-04-241-7/+7
| | | | Found the hard way.
* Push NET_LOCK down in the default ifioctl case.pirofti2018-04-245-15/+24
| | | | | | | For the PRU_CONTROL bit the NET_LOCK surrounds in[6]_control() and on the ENOTSUPP case we guard the driver if_ioctl functions. OK mpi@
* Use the existing pf state to speed up UDP socket lookup. This wasbluhm2018-04-061-2/+2
| | | | | | | | disabled as there were some stability issues. It seems that the crashes were fixed when reference counting for pf states was implemented. Se reenable this code. Apart from the performance improvement it also makes corner cases for pf divert-to more reliable. OK henning@
* Use memcpy on freshly allocated memory and add the free size.dhill2018-04-021-3/+3
| | | | OK millert@
* When reusing an mbuf to send an ARP response, don't forget to clearstsp2018-03-311-4/+9
| | | | | | | | | | | | | | | | | the mbuf packet header. Otherwise, stale mbuf state related to the ARP request packet might affect the fate of the ARP reply packet. For example, I observed that for an ARP request to a carp IP, where the underlying carpdev interface is part of a bridge, ARP replies were always sent out on the carpdev interface, even if the corresponding ARP request was received not on the carpdev but on a different bridge member interface. This happened because the M_PROTO1 mbuf flag was set on the ARP request mbuf when it left the bridge towards carp, and was still set on the ARP reply, which reused the same mbuf, sent back towards the bridge. The bridge's loop detection saw the M_PROTO1 flag and prevented the ARP reply from entering the bridge, so the reply was instead sent out directly on the carpdev... ok bluhm@ mpi@
* Store the allocation size in inpcbhead for free().dhill2018-03-302-11/+14
| | | | OK visa@
* The function carp_prepare_ad() never fails. The error handling inbluhm2018-03-211-9/+5
| | | | | | the caller would leak a mbuf. Convert carp_prepare_ad() to a void function and remove the error check. reported by Maxime Villard; OK mpi@
* In ip6_output() check that the interface of a route is valid. Forbluhm2018-03-211-1/+8
| | | | | | IPv4 we do the same and there are races that triggers it. Increment the statistics counter for both. from markus@; OK mpi@
* Refactor tcp_mtudisc() like NetBSD did. Do the route lookup onlybluhm2018-03-181-21/+24
| | | | | if the tcpcb exits. OK mpi@
* When processing IPsec AH packets check that the header fits intobluhm2018-03-141-2/+11
| | | | | the packet length. found by Maxime Villard; from FreeBSD; OK procter@ markus@
* Mbuf data is used as struct ether_header before it has been madebluhm2018-03-131-31/+25
| | | | | | | | continuous. The length of the hardware and protocol address are provided in the network packet and have to be checked first. So enforce that we only deal with internet over ethernet arp headers with the address length filled correctly. found by Maxime Villard; OK claudio@
* Revert all the bits of the autocreate 127.0.0.1 on lo(4) creation for now.claudio2018-03-022-59/+2
| | | | This needs to go back to the drawing board.
* make kernel compile again without INET6benno2018-02-271-3/+3
| | | | ok mpi@
* Remove almost unused `flags' argument of suser().mpi2018-02-193-12/+12
| | | | | | | The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
* Kill unneeded caddr_t cast.claudio2018-02-101-2/+2
|
* rework gif to be more consistent.dlg2018-02-102-286/+3
| | | | | | | | | while here, give us support for mpls in gif on ipv6. this moves all the gif handling into if_gif, eg, the mpls handling is no longer in ip_etherip.c. ok claudio@
* Similar to the IPv6 case create 127.0.0.1/8 on lo(4) interfaces which actclaudio2018-02-102-2/+59
| | | | | | | as loopback interfaces for each rdomain (including lo0). This is done when the interface is brought up. This is now also done by default (either on attach of lo0 or when creating the rdomain). OK mpi@
* comment change only. ok bluhm@procter2018-02-071-3/+3
|
* update the gre driver.dlg2018-02-072-257/+3
| | | | | | | | | | | the main new feature is gre keys, supported by the vnetid ioctls. this also adds support for gre over ipv6, the use of hfsc, and allows tx mitigation in the future. this diff removes keepalive support, but i promised claudio@ and patrick@ i would put it back after this goes in. ok claudio@
* Unbreak carp(4) MAC check in bridge_process().mpi2018-02-071-3/+6
| | | | | | | Introduce bridge_ourether() and move carp(4)-specific SRPL code inside carp_ourether(). ok bluhm@
* split mobileip(4) out from the gre(4) driver.dlg2018-02-072-115/+12
| | | | | | | | having mobileip in gre makes it hard to cut gre up. the current mobileip code is also broken, so this is def and improvement. it also makes it easy to disable and remove mobileip in the future. ok claudio@ henning@
* Historically TCP timeouts were implemented with pr_slowtimo andbluhm2018-02-073-10/+10
| | | | | | | | pr_fasttimo. That is the reason why we have two timeout mechanisms with complicated ticks calculation. Move the delay ACK timeout to milliseconds and remove some ticks and hz mess from the others. This makes it easier to see the actual values. OK florian@ dhill@ dlg@
* There was a race in the TCP timers. As they may sleep to grab thebluhm2018-02-063-12/+37
| | | | | | | | | | | netlock, timers may still run after they have been disarmed. Deleting the timeout is not sufficient to cancel them, but the code from 4.4 BSD is assuming this. The solution is to add a flag for every timer to see whether it has been armed or canceled. Remove the TF_DEAD check as tcp_canceltimers() is called before the reaper timer is fired. Cancelation works reliably now. OK mpi@
* Do some cleanup in ah_massage_headers().bluhm2018-02-061-33/+45
| | | | | | | | | | | | | - Declare global array ipseczeroes containing zeroes constant. - The proto parameter contains the address family, so call it af. - Remove an unused if block, just keep the else. - If m_copyback(M_NOWAIT) fails, return with error instead of working with an inconsistent mbuf. - ip6_nxt is u_int8_t, no need to clear the high bits. - The offset and next protocol are advanced for all extension headers, move it after the switch. - ah_massage_headers() returns an errno, call the variable error. OK procter@
* Remove tcp_acounts, some tcp_usrreq() counting from 1981. Alsobluhm2018-02-052-12/+2
| | | | | remove the #ifdef KPROF which seems to be unused since that year. OK mpi@
* Since tcp_attach() has moved to a separate protocol function, thebluhm2018-02-031-10/+8
| | | | | inp cannot be NULL. Remove the useless if in tcp_usrreq(). OK mpi@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.