summaryrefslogtreecommitdiffstats
path: root/sys/netinet (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* When processing IPsec AH packets with IP options or IPv6 extensionbluhm2018-02-011-40/+31
| | | | | headers, check all lengths before accessing the values. found by Maxime Villard; from NetBSD; with and OK markus@; OK patrick@
* Use a workaround for detached parent in carp_proto_input_c().mpi2018-01-251-4/+13
| | | | | | | | | | | | | | A NULL dereference can happen since processing protocol layer is deffered to a second task. In other words the NET_LOCK() is released then regrabbed between ip_input() and carp_proto_input(). The same workaround is already in use in carp_output() due to deffered processing in case of IPsec. The real fix is to make carp(4) MP-safe and use if_get(9) there, any taker? Found & fix tested by Hrvoje Popovski.
* The TCP reaper timeout was still imlemented as soft timeout. Sobluhm2018-01-234-22/+30
| | | | | | | | | | | it could run immediately and was not synchronized with the TCP timeouts, although that was the intension when it was introduced in revision 1.85. Convert the reaper to an ordinary TCP timeout so it is scheduled on the same timeout thread after all timeouts have finished. A net lock is not necessary as the process calling tcp_close() will not access the tcpcb after arming the reaper timeout. OK mikeb@
* Although it is a dead store here, always reassign the tcpcb afterbluhm2018-01-231-2/+2
| | | | | | calling tcp_close(), tcp_drop(), and tcp_disconnect(). Then no freed memory can be used after closing a TCP connection. OK mikeb@ mpi@
* Bring back the PRU_ATTACH constant and description. Then trpt(8)bluhm2018-01-231-3/+3
| | | | | prints the ATTACH action for TCP debugging socketes correctly. OK bluhm@
* Fix printf(9) format strings so that a kernel with TCPDEBUG compiles.bluhm2018-01-232-6/+6
| | | | | Mark the string variables with TCP debugging names as constant. OK mpi@
* Bring back the detach messages in trpt(8) for tcp debugging. Theybluhm2018-01-221-15/+11
| | | | | | got lost with the pr_detach conversion. While there, remove some dead code. OK mpi@
* Recycle IFF_NOTRAILERS into IFF_STATICARP and document ownerhsipmpi2018-01-161-2/+2
| | | | | | of IFF* flags. inputs from jmc@, ok bluhm@, visa@
* There was an issue that dynamic path MTU discovery together withbluhm2018-01-151-1/+2
| | | | | | ARP or ND timeout could delete local routes. Put an assert into arptfree() and nd6_free() so this cannot happen again. OK mpi@
* have carp use standard detach hooks instead of getting special handlingdlg2018-01-122-26/+32
| | | | | | | | | | | | | if_deactivate looked for carp parent interfaces and called carp_ifdetach to have children interfaces unplug themselves. this diff has the carp interfaces register detach hooks on the parent instead. the effect is the same, but using the standard every other interface uses. while im here i shuffle the order the hooks carp_set_ifp are estabilshed so it will fail if they arent allocated. ok visa@ mpi@
* unbreak configurations using carppeersdlg2018-01-121-2/+9
| | | | | | | | | | | | | ip_carp.c r1.322 removed the ability to receive carp protocol packets on !IFT_CARP interfaces. however, carppeers cause the carp protocol packets to be directed to a unicast address on another interface, which definitely is not mapped back to a carp interface. this brings back the ability to get carp packets on parent interfaces. it is a bit different to a backout because it only allows carp parents to be ethernet interfaces. mpi@ told me carp regress tests were failing.
* restrict carp to configuring ethernet interfaces as carpdevs.dlg2018-01-121-5/+5
| | | | | | | | previously the driver only cared that a carp interface wasnt configured as a carpdev. because the code only really works on ethernet, it makes sense to restrict it. ok visa@ mpi@
* carp_ourether gets passed the parent interface, not the carp interface.dlg2018-01-111-2/+2
|
* get rid of struct carp_if by moving the srpl into struct ifnet if_carp.dlg2018-01-102-74/+57
| | | | | | | | | | | | | currently carp uses a struct carp_if to hold an srp list head, which is accessed by both if_carp in struct ifnet, and via the if input handlers list. this gets rid of some indirection by making if_carp itself the list head, rather than a pointer to the list head via a struct carp_if. it also makes accessing the list consistent by only using if_carp to get to it. ok mpi@
* simplify the input interface type check in carp_proto_input_if.dlg2018-01-101-3/+2
| | | | | | | | | carp6_proto_input_if only handles packets "received" on real carp interfaces, which the ethernet stack goes to a lot of trouble to provide. since carp assumes ethernet, carp_proto_input_if can assume the packets will come in right too. ok mpi@
* Creating a cloned interface could return ENOMEM due to temporarybluhm2018-01-091-5/+2
| | | | | | memory shortage. As it is invoked from a system call, it should not fail and wait instead. OK visa@ mpi@
* Change `so_state' and `so_error' to unsigned int such that they canmpi2018-01-091-2/+2
| | | | | | be atomically read from any context. ok bluhm@, visa@
* make mpls_input take a struct ifnet *ifp argument.dlg2018-01-092-4/+4
| | | | | | | | | | | this makes it like all our other protocol family input functions. mpls_input always looks up the interface the mbuf was received on, but it's always called by code that already has a reference to that interface anyway. the result of this is a few less if_get/if_put calls. ok mpi@ bluhm@ visa@ claudio@
* Make the functions which link the pf state keys to mbufs, inpcbs,bluhm2017-12-291-2/+2
| | | | | or other states more consistent. OK visa@ sashan@ on a previous version
* The pf code marks ICMP packets belonging to an TCP or UDP divertbluhm2017-12-141-18/+12
| | | | | | | | | | | | | | | | | state as diverted. This is necessary for IP input to accept the packet as ours. But it must not be used to match the ICMP packet to a raw socket. Clear the PF_TAG_DIVERTED mbuf pf flag for the special ICMP and ICMP6 packets in icmp_input_if() and icmp6_input(). The m_tag_delete_chain() caused an inconsistent PF_TAG_DIVERTED mbuf pf flag and PACKET_TAG_PF_DIVERT mbuf tag which triggered an assert in rip_input(). Deleting all mbuf tags can have undesired side effects and is not necessary anymore since icmp_reflect() calls m_resethdr(). Do not touch the mbuf tags and adjust the mbuf pf flags for the correct behavior of rip_input() and rip6_input(). reported by Chris Eidem, James Turner, vicviq, Scott Vanderbilt OK mpi@
* Initialize tcp_secret in tcp_initmikeb2017-12-071-10/+8
| | | | | | | | | The initialization of a secret SHA256 context for generating TCP initial sequence numbers is moved out of tcp_set_iss_tsm used to set up ISN for new connections and into tcp_init, sparing the need for a global flag. OK deraadt, visa, mpi
* Make divert lookup similar for all socket types. If PF_TAG_DIVERTEDbluhm2017-12-044-34/+61
| | | | | | | | is set, pf_find_divert() cannot fail so put an assert there. Explicitly check all possible divert types, panic in the default case. For raw sockets call pf_find_divert() before of the socket loop. Divert reply should not match on TCP or UDP listen sockets. OK sashan@ visa@
* Fix white spaces and shorten long line.bluhm2017-12-011-10/+10
|
* Simplify the reverse PCB lookup logic. The PF_TAG_TRANSLATE_LOCALHOSTbluhm2017-12-015-44/+29
| | | | | | | | security check prevents that the user accidentally configures redirect where a divert-to would be appropriate. Instead of spreading the logic into tcp and udp input, check the flag during PCB listen lookup. This also reduces parameters of in_pcblookup_listen(). OK visa@
* Fix typos in comments.nayden2017-11-301-3/+3
| | | | OK florian@
* The divert structure was using the port number to indicate thatbluhm2017-11-281-2/+2
| | | | | | | | | | divert-to or divert-reply was active. If the address was also set, it meant divert-to. Divert packet used a separate structure. This is confusing and makes it hard to add new features. It is better to have a divert type that explicitly says what is configured. Adapt the pf rule struct in kernel and pfctl, no functional change. Note that kernel and pfctl have to be updated together. OK sashan@
* Constify protocol tables and remove an assert now that ip_deliver() ismpi2017-11-232-7/+5
| | | | | | mp-safe. ok bluhm@, visa@
* Replace non mp-safe carp_iamatch6() with mp-safe carp_iamatch().mpi2017-11-232-19/+2
| | | | | | | They have the same functionnality since friehm@ cleaned up balancing code. ok florian@, visa@, patrick@, bluhm@, jmatthew@
* It does not make sense to call pcb lookup from pf during packetbluhm2017-11-221-8/+8
| | | | | | | forwarding. It should never match and would cause MP locking problems. While there remove an useless ifp parameter from ip_output_ipsec_send(). from markus@; OK visa@ sashan@
* Move the addrhook disestablish from carpdetach() to carp_clone_destroy()patrick2017-11-211-4/+3
| | | | | | | | | | to make it symmetric to the addrhook establish which is being done in carp_clone_create(). This fixes the issue that carp does not recognize address changes on the carp after an interface has detached, which could cause issues like carp not recovering or even panics. Unfortunately there are more bugs lurking in carp. ok bluhm@
* Keep kernel defines under #ifdef _KERNEL.mpi2017-11-201-8/+3
| | | | ok bluhm@
* Flush flows using the radix-tree instead of a global list.mpi2017-11-201-4/+9
| | | | | | This will allows us to get rid of the list. ok visa@
* Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningmpi2017-11-2011-19/+38
| | | | | | pr_input handlers without KERNEL_LOCK(). ok visa@
* Rename etherip sysctl handler, there's no conflict with ip_ether.c any morejca2017-11-171-2/+2
| | | | ok visa@ mpi@
* Add ifdef MPLS around all the MPLS-in-IP codejca2017-11-172-8/+6
| | | | ok visa@ mpi@
* Rename functions that now handle only MPLS-in-IPjca2017-11-173-13/+13
| | | | ok visa@ mpi@
* Move etherip_allow where it is usedjca2017-11-172-10/+2
| | | | | While here, drop the declaration in headers, since the variable is used in a single file. ok visa@ mpi@
* Drop etheripstat use in ip_ether.cjca2017-11-171-20/+1
| | | | | Those functions only handle MPLS-in-IP packets, it makes little sense to count those as ethernet-in-IP. ok visa@ mpi@
* Drop all Ethernet-in-IP support from gif(4)jca2017-11-172-138/+2
| | | | | As a result, ip_ether.c now only deals with MPLS-in-IP. The next commits will move & rename stuff to make this clear. ok visa@ mpi@
* Move etherip counters and their allocation to etherip(4)jca2017-11-173-13/+3
| | | | | | | | | gif(4) now depends on etherip(4) but this is a temporary drawback: we can get rid of etherip_init(), called from the protocol switch, and ip_ether.c should stop using etherip counters once it is clear that this file doesn't handle ethernet-in-IP any more. ok visa@ as part of a larger diff, ok mpi@
* etherip(4) now handles etherip sysctls, move/remove code accordingly.jca2017-11-152-43/+2
| | | | ok visa@ as part of a larger diff, ok mpi@
* Make etherip(4) the single driver responsible for etherip sysctl entries.jca2017-11-151-2/+1
| | | | | | | One step needed to completely remove ethernet-in-IP support from gif(4). No functional changes. ok visa@ as part of a larger diff, ok mpi@
* Unbreak ENCDEBUG kernels by declaring `encdebug' in ip_ipsp.hmpi2017-11-152-3/+3
|
* Introduce ipsec_sysctl() and move IPsec tunables where they belong.mpi2017-11-144-53/+139
| | | | ok bluhm@, visa@
* Introduce a reader version of the NET_LOCK().mpi2017-11-101-3/+3
| | | | | | | | This will be used to first allow read-only ioctl(2) to be executed while the softnet taskq is running. Then it will allows us to execute multiple softnet taskq in parallel. Tested by Hrvoje Popovski, ok kettenis@, sashan@, visa@, tb@
* Use percpu counters with etheripstat.visa2017-11-103-34/+89
| | | | Input and OK jca@, OK florian@
* The TF_BLOCKOUTPUT flag is set around all sorwakeup() and sowwakeup()bluhm2017-11-081-1/+13
| | | | | | | | | | | calls in tcp_input(). When I added this code for socket splicing, I have missed that they may be called indirectly through functions. Although not strictly necessary since we have the sosplice thread, put that flag consistently when we want to prevent that tcp_output() is called in the middle of tcp_input(). As soisconnected(), soisdisconnected(), and socantrcvmore() call the wakeup functions from tcp_input(), set the TF_BLOCKOUTPUT flag around them. OK visa@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-0811-197/+347
| | | | OK bluhm@, mpi@
* Convert all the fields of {ah,esp,ipcomp}stat to uint64.visa2017-11-073-63/+66
| | | | | | This is a preliminary step for using percpu counters with the data. OK mpi@
* Remove unused debug macro.mpi2017-11-071-7/+1
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.