summaryrefslogtreecommitdiffstats
path: root/sys/net/route.c
Commit message (Collapse)AuthorAgeFilesLines
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* When a prison is given the ability to create raw sockets (when thecsjp2004-08-211-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | security.jail.allow_raw_sockets sysctl MIB is set to 1) where privileged access to jails is given out, it is possible for prison root to manipulate various network parameters which effect the host environment. This commit plugs a number of security holes associated with the use of raw sockets and prisons. This commit makes the following changes: - Add a comment to rtioctl warning developers that if they add any ioctl commands, they should use super-user checks where necessary, as it is possible for PRISON root to make it this far in execution. - Add super-user checks for the execution of the SIOCGETVIFCNT and SIOCGETSGCNT IP multicast ioctl commands. - Add a super-user check to rip_ctloutput(). If the calling cred is PRISON root, make sure the socket option name is IP_HDRINCL, otherwise deny the request. Although this patch corrects a number of security problems associated with raw sockets and prisons, the warning in jail(8) should still apply, and by default we should keep the default value of security.jail.allow_raw_sockets MIB to 0 (or disabled) until we are certain that we have tracked down all the problems. Looking forward, we will probably want to eliminate the references to curthread. This may be a MFC candidate for RELENG_5. Reviewed by: rwatson Approved by: bmilekic (mentor)
* Convert the routing table to use an UMA zone for rtentries. The zone isandre2004-08-111-4/+10
| | | | | | | | | | called "rtentry". This saves a considerable amount of kernel memory. R_Zmalloc previously used 256 byte blocks (plus kmalloc overhead) whereas UMA only needs 132 bytes. Idea from: OpenBSD
* Avoid casts as lvalues.kan2004-07-281-1/+1
|
* fix one typo and remove one wrong lineluigi2004-04-251-2/+1
|
* Correct and extend the description of the behaviour of rt_check().luigi2004-04-241-7/+27
|
* Clearly comment the assumptions that allow us to cast aluigi2004-04-211-17/+27
| | | | | 'struct radix_node *' to a 'struct rtentry *' in this code, and introduce a macro, RNTORT(), to do this type conversion.
* Fix the initial check for NULL arguments in rtfree (previouslyluigi2004-04-201-126/+82
| | | | | | | | | | | | | it checked for rt == NULL after dereferencing the pointer). We never check for those events elsewhere, so probably these checks might go away here as well. Slightly simplify (and document) the logic for memory allocation in rt_setgate(). The rest is mostly style changes -- replace 0 with NULL where appropriate, remove the macro SA() that was only used once, remove some useless debugging code in rt_fixchange, explain some odd-looking casts.
* replace Bcopy with bcopy as in the rest of the file.luigi2004-04-181-3/+3
|
* make route_init() staticluigi2004-04-171-2/+2
|
* Consistently use ifaddr_byindex() to access the link-level addressluigi2004-04-161-1/+1
| | | | | | | of an interface. No functional change. On passing, comment a likely bug in net/rtsock.c:sysctl_ifmalist() which, if confirmed, would deserve to be fixed and MFC'ed
* route.h: introduce a macro, SA_SIZE(struct sockaddr *) which returnsluigi2004-04-131-4/+2
| | | | | | | | | | the space occupied by a struct sockaddr when passed through a routing socket. Use it to replace the macro ROUNDUP(int), that does the same but is redefined by every file which uses it, courtesy of the School of Cut'n'Paste Programming(TM). (partial) userland changes to follow.
* in rtinit(), remove one useless variable, and move a few othersluigi2004-04-121-9/+9
| | | | within the block where they are used.
* Remove advertising clause from University of California Regent'simp2004-04-071-4/+0
| | | | | | | license, per letter dated July 22, 1999 and email from Peter Wemm, Alan Cox and Robert Watson. Approved by: core, peter, alc, rwatson
* Remove extraneous unlock. This fixes a panic seen when manipulating staticsam2004-01-071-1/+1
| | | | entries in the ARP table.
* bandaid LOR in rt_setgate; a proper fix requires code refactoringsam2003-12-071-4/+7
|
* workaround LOR in rt_setgatesam2003-11-251-1/+3
| | | | | Reviewed by: andre Approved by: re (rwatson)
* Remove RTF_PRCLONING from routing table and adjust users of itandre2003-11-201-13/+14
| | | | | | | | | | | | accordingly. The define is left intact for ABI compatibility with userland. This is a pre-step for the introduction of tcp_hostcache. The network stack remains fully useable with this change. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* replace explicit changes to rt_refcnt by RT_ADDREF and RT_REMREFsam2003-11-081-8/+9
| | | | | | | macros that expand to include assertions when the system is built with INVARIANTS Supported by: FreeBSD Foundation
* Overhaul routing table entry cleanup by introducing a new rtexpungesam2003-10-301-9/+104
| | | | | | | | | | | | routine that takes a locked routing table reference and removes all references to the entry in the various data structures. This eliminates instances of recursive locking and also closes races where the lock on the entry had to be dropped prior to calling rtrequest(RTM_DELETE). This also cleans up confusion where the caller held a reference to an entry that might have been reclaimed (and in some cases used that reference). Supported by: FreeBSD Foundation
* avoid recursive lock panic by unlocking before calling rtrequest;sam2003-10-291-1/+2
| | | | | | | | this is consistent with other places but will be replaced shortly by a "proper fix" Supported by: FreeBSD Foundation Pain felt by: Jiri Mikulas
* Correct handling of cloning loop avoidance: rtalloc1 may return a nullsam2003-10-161-1/+2
| | | | | | pointer in which case we should not do the unlock. Supported by: FreeBSD Foundatin
* fix braino: null the pointer who's memory we just free'd, not some othersam2003-10-111-1/+1
| | | | pointers that are (potentially) used later
* insure local variable is initialized prior to usesam2003-10-071-1/+1
|
* fix typo that caused a panic when processing an ICMP redirectsam2003-10-051-1/+1
| | | | Sponsored by: FreeBSD Foundation
* Locking for updates to routing table entries. Each rtentry gets a mutexsam2003-10-041-170/+203
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that covers updates to the contents. Note this is separate from holding a reference and/or locking the routing table itself. Other/related changes: o rtredirect loses the final parameter by which an rtentry reference may be returned; this was never used and added unwarranted complexity for locking. o minor style cleanups to routing code (e.g. ansi-fy function decls) o remove the logic to bump the refcnt on the parent of cloned routes, we assume the parent will remain as long as the clone; doing this avoids a circularity in locking during delete o convert some timeouts to MPSAFE callouts Notes: 1. rt_mtx in struct rtentry is guarded by #ifdef _KERNEL as user-level applications cannot/do-no know about mutex's. Doing this requires that the mutex be the last element in the structure. A better solution is to introduce an externalized version of struct rtentry but this is a major task because of the intertwining of rtentry and other data structures that are visible to user applications. 2. There are known LOR's that are expected to go away with forthcoming work to eliminate many held references. If not these will be resolved prior to release. 3. ATM changes are untested. Sponsored by: FreeBSD Foundation Obtained from: BSD/OS (partly)
* cleanups prior to adding locking (and in some cases to eliminate locking):sam2003-10-031-1/+0
| | | | | | | | | | | | | o move route_cb to be private to rtsock.c o replace global static route_proto by locals o eliminate global #define shorthands for info references o remove some register decls o ansi-fy function decls o move items to be close in scope to their usage o add rt_dispatch function for dispatching the actual message o cleanup tangled logic for doing all-but-me msg send Support by: FreeBSD Foundation
* No need to unlock if error detected before locking.hsu2003-04-131-2/+4
| | | | Submitted by: harti
* Reduce code duplication. This adds the function rt_check() to route.c.mdodd2003-03-021-0/+51
| | | | Approved by: sam (in principle)
* Back out M_* changes, per decision of the TRB.imp2003-02-191-1/+1
| | | | Approved by: trb
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-1/+1
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* I'm not sure what was the problem at the time of revision 1.37ru2002-12-251-11/+0
| | | | | | | | when julian@ added it, but the commented out code had at least one bug -- not freeing the allocated mbuf. Anyway, this comment no longer applies as of revision 1.67, so remove it.
* Revision 1.67 changes correspond to CSRG revision 8.3.1.1 changes.ru2002-12-251-1/+1
|
* If the caller of rtrequest*(RTM_DELETE, ...) asked for a copy ofru2002-12-251-17/+5
| | | | | | the entry being removed (ret_nrt != NULL), increment the entry's rt_refcnt like we do it for RTM_ADD and RTM_RESOLVE, rather than messing around with 1->0 transitions for rtfree() all over.
* SMP locking for radix nodes.hsu2002-12-241-10/+27
|
* rn_walktree*() compute the next leaf before applying a functionru2002-12-231-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to current leaves because function may vanish the current node. If parent RTA_GENMASK route has a clone (a "cloning clone"), an rn_walktree_from() starting from parent will cause another walk starting from clone. If a function is either rt_fixdelete() or rt_fixchange(), this recursive walk may vanish the leaf that is remembered by an outer walk (the "next leaf" above), panicing a system when it resumes with an outer walk. The following script paniced my single-user mode booted system: : sysctl net.inet.ip.forwarding=1 : ipfw add 1 allow ip from any to any : ifconfig lo0 127.1 : route add -net 10 -genmask 255.255.255.0 127.1 : telnet 10.1 # rt_fixchange() panic : telnet 10.2 : telnet 10.1 : route delete -net 10 # rt_fixdelete() panic For the time being, avoid these races by disallowing recursive walks in rt_fixchange() and rt_fixdelete(). Also, make a slight optimization in the rtrequest(RTM_RESOLVE) case: there is no reason to call rt_fixchange() in this case. PR: kern/37606 MFC after: 5 days
* Lock up ifaddr reference counts.hsu2002-12-181-21/+8
|
* Massive cleanup of the ip_mroute code.luigi2002-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No functional changes, but: + the mrouting module now should behave the same as the compiled-in version (it did not before, some of the rsvp code was not loaded properly); + netinet/ip_mroute.c is now truly optional; + removed some redundant/unused code; + changed many instances of '0' to NULL and INADDR_ANY as appropriate; + removed several static variables to make the code more SMP-friendly; + fixed some minor bugs in the mrouting code (mostly, incorrect return values from functions). This commit is also a prerequisite to the addition of support for PIM, which i would like to put in before DP2 (it does not change any of the existing APIs, anyways). Note, in the process we found out that some device drivers fail to properly handle changes in IFF_ALLMULTI, leading to interesting behaviour when a multicast router is started. This bug is not corrected by this commit, and will be fixed with a separate commit. Detailed changes: -------------------- netinet/ip_mroute.c all the above. conf/files make ip_mroute.c optional net/route.c fix mrt_ioctl hook netinet/ip_input.c fix ip_mforward hook, move rsvp_input() here together with other rsvp code, and a couple of indentation fixes. netinet/ip_output.c fix ip_mforward and ip_mcast_src hooks netinet/ip_var.h rsvp function hooks netinet/raw_ip.c hooks for mrouting and rsvp functions, plus interface cleanup. netinet/ip_mroute.h remove an unused and optional field from a struct Most of the code is from Pavlin Radoslavov and the XORP project Reviewed by: sam MFC after: 1 week
* Ensure that packet counts are always reset to 0 whensilby2002-05-311-0/+1
| | | | | | | | a route is cloned. Previously, they took on the count of their parent route (which was sometimes nonzero.) Submitted by: Andre Oppermann <oppermann@pipeline.ch> MFC after: 5 days
* Remove __P.alfred2002-03-191-5/+5
|
* Fix a typo in a commentbrian2001-11-281-1/+1
|
* Pull post-4.4BSD change to sys/net/route.c from BSD/OS 4.2.ru2001-10-171-103/+153
| | | | | | | | | | | | | | | | | | | | Have sys/net/route.c:rtrequest1(), which takes ``rt_addrinfo *'' as the argument. Pass rt_addrinfo all the way down to rtrequest1 and ifa->ifa_rtrequest. 3rd argument of ifa->ifa_rtrequest is now ``rt_addrinfo *'' instead of ``sockaddr *'' (almost noone is using it anyways). Benefit: the following command now works. Previously we needed two route(8) invocations, "add" then "change". # route add -inet6 default ::1 -ifp gif0 Remove unsafe typecast in rtrequest(), from ``rtentry *'' to ``sockaddr *''. It was introduced by 4.3BSD-Reno and never corrected. Obtained from: BSD/OS, NetBSD MFC after: 1 month PR: kern/28360
* 64-bit fixes from CSRG.ru2001-10-171-2/+2
|
* Don't even attempt to clone host routes.ru2001-10-151-2/+4
| | | | MFC after: 1 week
* Don't bother passing p to rtioctl just so it can fail to pass it to mrt_ioctlfenner2001-07-251-6/+1
|
* As commented in defined in sys/net/route.c, rt_fixchange() has a badume2001-07-251-5/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | effect, which would cause unnecessary route deletion: * Unfortunately, this has the obnoxious * property of also triggering for insertion /above/ a pre-existing network * route and clones. Sigh. This may be fixed some day. The effect has been even worse, because recent versions of route.c set the parent rtentry for cloned routes from an interface-direct route. For example, suppose that we have an interface "ne0" that has an IPv4 subnet "10.0.0.0/24". Then we may have a cloned route like 10.0.0.1 on the interface, whose parent route is 10.0.0.0/24 (to the interface ne0). Now, when we add the default route (i.e. 0.0.0.0/0), rt_fixchange() will remove the cloned route 10.0.0.1. The (bad) effect also prevents rt_setgate from configuring rt_gwroute, which would not be an intended behavior. As suggested in the comments to rt_fixchange(), we need stricter check in the function, to prevent unintentional route deletion. This fix also solve the "IPV6 panic?" problem in nd6_timer(). Submitted by: JINMEI Tatuya <jinmei@isl.rdc.toshiba.co.jp> MFC after: 4 days
* When looking for an interface appropriate for the (new or changing)ru2001-06-041-1/+1
| | | | | | | | | route in ifa_ifwithroute(), as the last resort, look up the route to the gateway, not destination (to derive the interface from). PR: kern/27852 Submitted by: Iasen Kostoff <tbyte@tbyte.org> MFC after: 2 weeks
* net/route.c:ru2001-03-151-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A route generated from an RTF_CLONING route had the RTF_WASCLONED flag set but did not have a reference to the parent route, as documented in the rtentry(9) manpage. This prevented such routes from being deleted when their parent route is deleted. Now, for example, if you delete an IP address from a network interface, all ARP entries that were cloned from this interface route are flushed. This also has an impact on netstat(1) output. Previously, dynamically created ARP cache entries (RTF_STATIC flag is unset) were displayed as part of the routing table display (-r). Now, they are only printed if the -a option is given. netinet/in.c, netinet/in_rmx.c: When address is removed from an interface, also delete all routes that point to this interface and address. Previously, for example, if you changed the address on an interface, outgoing IP datagrams might still use the old address. The only solution was to delete and re-add some routes. (The problem is easily observed with the route(8) command.) Note, that if the socket was already bound to the local address before this address is removed, new datagrams generated from this socket will still be sent from the old address. PR: kern/20785, kern/21914 Reviewed by: wollman (the idea)
* A couple months ago, Kirk and I were doing a walkthrough of the radix-treewollman2000-04-231-1/+1
| | | | | | | | search routine, and scratching our heads over why it was so obfuscated. This delta fixes a number of confusing style bugs and renames several structure members to have more meaningful names. There remain a number of odd control-flow structures. These changes do not affect the generated code.
* Clear ro->ro_rt just after RTFREE().shin2000-01-151-0/+1
| | | | | | | | | Pleases let me make sure that no one touch the invalid ro_rt pointer, after splx(s) and before next ro_rt initialization. Though usually this seems to be already called at splnet, I still sometime experience kernel crash at rtfree() in my INET6 enabled environment where IPv6 connection is frequently used. (Off-course, it might be just due to another bug.)
OpenPOWER on IntegriCloud