summaryrefslogtreecommitdiffstats
path: root/sys/netinet/in_pcb.h
Commit message (Collapse)AuthorAgeFilesLines
* Abstract inpcb drop logic, previously just setting of INP_DROPPED in TCP,rwatson2006-04-251-0/+1
| | | | | | | | | | into in_pcbdrop(). Expand logic to detach the inpcb from its bound address/port so that dropping a TCP connection releases the inpcb resource reservation, which since the introduction of socket/pcb reference count updates, has been persisting until the socket closed rather than being released implicitly due to prior freeing of the inpcb on TCP drop. MFC after: 3 months
* Change inp_ppcb from caddr_t to void *, fix/remove associated relatedrwatson2006-04-031-1/+1
| | | | | | | | | | | | | | | | | | casts. Consistently use intotw() to cast inp_ppcb pointers to struct tcptw * pointers. Consistently use intotcpcb() to cast inp_ppcb pointers to struct tcpcb * pointers. Don't assign tp to the results to intotcpcb() during variable declation at the top of functions, as that is before the asserts relating to locking have been performed. Do this later in the function after appropriate assertions have run to allow that operation to be conisdered safe. MFC after: 3 months
* Break out in_pcbdetach() into two functions:rwatson2006-04-011-0/+1
| | | | | | | | | | | | | | | | | | - in_pcbdetach(), which removes the link between an inpcb and its socket. - in_pcbfree(), which frees a detached pcb. Unlike the previous in_pcbdetach(), neither of these functions will attempt to conditionally free the socket, as they are responsible only for managing in_pcb memory. Mirror these changes into in6_pcbdetach() by breaking it into in6_pcbdetach() and in6_pcbfree(). While here, eliminate undesired checks for NULL inpcb pointers in sockets, as we will now have as an invariant that sockets will always have valid so_pcb pointers. MFC after: 3 months
* Define two new inpcb flags in the inp_vflag field, which for whateverrwatson2006-03-261-0/+2
| | | | | | | | | | | | | | | | | reason, seems to be where new flags are getting defined: INP_DROPPED - The protocol has terminated this connection and the socket is not reusable: when the socket code enters the protocol, an error is immediately returned. This will substitute for NULLing the so_pcb socket field, helping to implement the invariant that all valid sockets have valid pcb's in TCP. INP_SOCKREF - The protocol has become the owner of the socket reference, and will need to free it when freeing the pcb, which will be used when a TCP socket is closed but still has queued data. MFC after: 1 month
* Minor style tweak: tab after #define, not space.rwatson2006-03-261-4/+4
| | | | MFC after: 1 month
* Make net.inet.ip.portrange.reservedhigh anddwmalone2006-03-191-0/+2
| | | | | | | | | | | | | | net.inet.ip.portrange.reservedlow apply to IPv6 aswell as IPv4. We could have made new sysctls for IPv6, but that potentially makes things complicated for mapped addresses. This seems like the least confusing option and least likely to cause obscure problems in the future. This change makes the mac_portacl module useful with IPv6 apps. Reviewed by: ume MFC after: 1 month
* Implement IP_DONTFRAG IP socket option enabling the Don't Fragmentandre2005-09-261-0/+1
| | | | | | | | | | | | flag on IP packets. Currently this option is only repected on udp and raw ip sockets. On tcp sockets the DF flag is controlled by the path MTU discovery option. Sending a packet larger than the MTU size of the egress interface returns an EMSGSIZE error. Discussed with: rwatson Sponsored by: TCP/IP Optimization Fundraise 2005
* Add socketoption IP_MINTTL. May be used to set the minimum acceptableandre2005-08-221-0/+1
| | | | | | | | | | | | | | | | | TTL a packet must have when received on a socket. All packets with a lower TTL are silently dropped. Works on already connected/connecting and listening sockets for RAW/UDP/TCP. This option is only really useful when set to 255 preventing packets from outside the directly connected networks reaching local listeners on sockets. Allows userland implementation of 'The Generalized TTL Security Mechanism (GTSM)' according to RFC3682. Examples of such use include the Cisco IOS BGP implementation command "neighbor ttl-security". MFC after: 2 weeks Sponsored by: TCP/IP Optimization Fundraise 2005
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Port randomization leads to extremely fast port reuse at highsilby2005-01-021-0/+2
| | | | | | | | | | | | | | | | | connection rates, which is causing problems for some users. To retain the security advantage of random ports and ensure correct operation for high connection rate users, disable port randomization during periods of high connection rates. Whenever the connection rate exceeds randomcps (10 by default), randomization will be disabled for randomtime (45 by default) seconds. These thresholds may be tuned via sysctl. Many thanks to Igor Sysoev, who proved the necessity of this change and tested many preliminary versions of the patch. MFC After: 20 seconds
* Define INP_UNLOCK_ASSERT() to assert that an inpcb is unlocked.rwatson2004-12-051-0/+1
| | | | MFC after: 2 weeks
* Add a macro for the destruction of INP_INFO_LOCK's used by loadable modules.andre2004-10-191-0/+1
|
* White space cleanup for netinet before branch:rwatson2004-08-161-1/+1
| | | | | | | | | | | - Trailing tab/space cleanup - Remove spurious spaces between or before tabs This change avoids touching files that Andre likely has in his working set for PFIL hooks changes for IPFW/DUMMYNET. Approved by: re (scottl) Submitted by: Xin LI <delphij@frontfree.net>
* Now that IPv6 performs basic in6pcb and inpcb locking, enable inpcbrwatson2004-08-041-15/+0
| | | | | | lock assertions even if IPv6 is compiled into the kernel. Previously, inclusion of IPv6 and locking assertions would result in a rapid assertion failure as IPv6 was not properly locking inpcbs.
* Remove erroneous semicolons.stefanf2004-07-131-1/+1
|
* When asserting non-Giant locks in the network stack, also assertrwatson2004-06-241-6/+21
| | | | | | | | | | Giant if debug.mpsafenet=0, as any points that require synchronization in the SMPng world also required it in the Giant-world: - inpcb locks (including IPv6) - inpcbinfo locks (including IPv6) - dummynet subsystem lock - ipfw2 subsystem lock
* Remove advertising clause from University of California Regent'simp2004-04-071-4/+0
| | | | | | | license, per letter dated July 22, 1999 and email from Peter Wemm, Alan Cox and Robert Watson. Approved by: core, peter, alc, rwatson
* Reduce 'td' argument to 'cred' (struct ucred) argument in those functions:pjd2004-03-271-4/+4
| | | | | | | | | | | | | | - in_pcbbind(), - in_pcbbind_setup(), - in_pcbconnect(), - in_pcbconnect_setup(), - in6_pcbbind(), - in6_pcbconnect(), - in6_pcbsetport(). "It should simplify/clarify things a great deal." --rwatson Requested by: rwatson Reviewed by: rwatson, ume
* Remove unused argument.pjd2004-03-271-2/+1
| | | | Reviewed by: ume
* Remove unused function.pjd2004-03-251-1/+0
| | | | It was used in FreeBSD 4.x, but now we're using cr_canseesocket().
* Split the "inp" mutex class into separate classes for each of divert,sam2003-11-261-3/+4
| | | | | | | | raw, tcp, udp, raw6, and udp6 sockets to avoid spurious witness complaints. Reviewed by: rwatson Approved by: re (rwatson)
* Introduce tcp_hostcache and remove the tcp specific metrics fromandre2003-11-201-16/+3
| | | | | | | | | | | | | | | | | | | | | | | the routing table. Move all usage and references in the tcp stack from the routing table metrics to the tcp hostcache. It caches measured parameters of past tcp sessions to provide better initial start values for following connections from or to the same source or destination. Depending on the network parameters to/from the remote host this can lead to significant speedups for new tcp connections after the first one because they inherit and shortcut the learning curve. tcp_hostcache is designed for multiple concurrent access in SMP environments with high contention and is hash indexed by remote ip address. It removes significant locking requirements from the tcp stack with regard to the routing table. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* Introduce a MAC label reference in 'struct inpcb', which cachesrwatson2003-11-181-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* add locking assertions that turn into noops if INET6 is configured;sam2003-11-081-0/+17
| | | | | | | this is necessary because the ipv6 code shares the in_pcb code with ipv4 but (presently) lacks proper locking Supported by: FreeBSD Foundation
* correct tab and order.ume2003-10-241-4/+4
|
* Switch Advanced Sockets API for IPv6 from RFC2292 to RFC3542ume2003-10-241-4/+6
| | | | | | | | | | (aka RFC2292bis). Though I believe this commit doesn't break backward compatibility againt existing binaries, it breaks backward compatibility of API. Now, the applications which use Advanced Sockets API such as telnet, ping6, mld6query and traceroute6 use RFC3542 API. Obtained from: KAME
* Add the IP_ONESBCAST option, to enable undirected IP broadcasts to be sent onbms2003-08-201-0/+1
| | | | | | | | | | specific interfaces. This is required by aodvd, and may in future help us in getting rid of the requirement for BPF from our import of isc-dhcp. Suggested by: fenestro Obtained from: BSD/OS Reviewed by: mini, sam Approved by: jake (mentor)
* IP_RECVTTL socket option.mdodd2003-04-291-1/+2
| | | | Reviewed by: Stuart Cheshire <cheshire@apple.com>
* Back out support for RFC3514.mdodd2003-04-021-1/+0
| | | | RFC3514 poses an unacceptale risk to compliant systems.
* Implement support for RFC 3514 (The Security Flag in the IPv4 Header).mdodd2003-04-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | (See: ftp://ftp.rfc-editor.org/in-notes/rfc3514.txt) This fulfills the host requirements for userland support by way of the setsockopt() IP_EVIL_INTENT message. There are three sysctl tunables provided to govern system behavior. net.inet.ip.rfc3514: Enables support for rfc3514. As this is an Informational RFC and support is not yet widespread this option is disabled by default. net.inet.ip.hear_no_evil If set the host will discard all received evil packets. net.inet.ip.speak_no_evil If set the host will discard all transmitted evil packets. The IP statistics counter 'ips_evil' (available via 'netstat') provides information on the number of 'evil' packets recieved. For reference, the '-E' option to 'ping' has been provided to demonstrate and test the implementation.
* Add a TCP TIMEWAIT state which uses less space than a fullblown TCPjlemon2003-02-191-0/+2
| | | | | | | | control block. Allow the socket and tcpcb structures to be freed earlier than inpcb. Update code to understand an inp w/o a socket. Reviewed by: hsu, silby, jayanth Sponsored by: DARPA, NAI Labs
* Turn off duplicate lock checking for inp locks because udp_input()hsu2002-11-121-1/+1
| | | | intentionally locks two inp records simultaneously.
* Replace in_pcbladdr() with a more generic inner subroutine foriedowse2002-10-211-2/+3
| | | | | | | | | | | | | | | in_pcbconnect() called in_pcbconnect_setup(). This version performs all of the functions of in_pcbconnect() except for the final committing of changes to the PCB. In the case of an EADDRINUSE error it can also provide to the caller the PCB of the duplicate connection, avoiding an extra in_pcblookup_hash() lookup in tcp_connect(). This change will allow the "temporary connect" hack in udp_output() to be removed and is part of the preparation for adding the IP_SENDSRCADDR control message. Discussed on: -net Approved by: re
* Split out most of the logic from in_pcbbind() into a new functioniedowse2002-10-201-0/+2
| | | | | | | | | | | called in_pcbbind_setup() that does everything except commit the changes to the PCB. There should be no functional change here, but in_pcbbind_setup() will be used by the soon-to-appear IP_SENDSRCADDR control message implementation to check or allocate the source address and port. Discussed on: -net Approved by: re
* Tie new "Fast IPsec" code into the build. This involves the usualsam2002-10-161-1/+1
| | | | | | | | | | | | configuration stuff as well as conditional code in the IPv4 and IPv6 areas. Everything is conditional on FAST_IPSEC which is mutually exclusive with IPSEC (KAME IPsec implmentation). As noted previously, don't use FAST_IPSEC with INET6 at the moment. Reviewed by: KAME, rwatson Approved by: silence Supported by: Vernier Networks
* Fixed namespace pollution in uma changes:bde2002-09-051-2/+3
| | | | | | | | | | | | - use `struct uma_zone *' instead of uma_zone_t, so that <sys/uma.h> isn't a prerequisite. - don't include <sys/uma.h>. Namespace pollution makes "opaque" types like uma_zone_t perfectly non-opaque. Such types should never be used (see style(9)). Fixed subsequently grwon dependencies of this header on its own pollution: - include <sys/_mutex.h> and its prerequisite <sys/_lock.h> instead of depending on namespace pollution 2 layers deep in <sys/uma.h>.
* Create new functions in_sockaddr(), in6_sockaddr(), andtruckman2002-08-211-0/+2
| | | | | | | | | | | | | | | | | in6_v4mapsin6_sockaddr() which allocate the appropriate sockaddr_in* structure and initialize it with the address and port information passed as arguments. Use calls to these new functions to replace code that is replicated multiple times in in_setsockaddr(), in_setpeeraddr(), in6_setsockaddr(), in6_setpeeraddr(), in6_mapped_sockaddr(), and in6_mapped_peeraddr(). Inline COMMON_END in tcp_usr_accept() so that we can call in_sockaddr() with temporary copies of the address and port after the PCB is unlocked. Fix the lock violation in tcp6_usr_accept() (caused by calling MALLOC() inside in6_mapped_peeraddr() while the PCB is locked) by changing the implementation of tcp6_usr_accept() to match tcp_usr_accept(). Reviewed by: suz
* do not refer to IN6P_BINDV6ONLY anymore.ume2002-07-221-1/+0
| | | | | Obtained from: KAME MFC after: 1 week
* Notify functions can destroy the pcb, so they have to return anhsu2002-06-141-2/+3
| | | | | | | | indication of whether this happenned so the calling function knows whether or not to unlock the pcb. Submitted by: Jennifer Yang (yangjihui@yahoo.com) Bug reported by: Sid Carter (sidcarter@symonds.net)
* Lock up inpcb.hsu2002-06-101-4/+20
| | | | Submitted by: Jennifer Yang <yangjihui@yahoo.com>
* Change the first argument of prison_xinpcb() to be a thread pointer insteadjhb2002-04-091-1/+1
| | | | of a proc pointer so that prison_xinpcb() can use td_ucred.
* Fixed some style bugs in the removal of __P(()). Continuation linesbde2002-03-241-3/+2
| | | | | were not outdented to preserve non-KNF lining up of code with parentheses. Switch to KNF formatting.
* Switch vm_zone.h with uma.h. Change over to uma interfaces.jeff2002-03-201-8/+2
|
* Remove __P.alfred2002-03-191-22/+22
|
* This is the first part of the new kernel memory allocator. This replacesjeff2002-03-191-1/+2
| | | | | | malloc(9) and vm_zone with a slab like allocator. Reviewed by: arch@
* Document what inpcb->inp_vflag is for.alfred2002-02-251-1/+1
| | | | Submitted by: Marco Molteni <molter@tin.it>
* Add include of net/route.h, as structures moved around due to therwatson2001-11-271-0/+1
| | | | | syncache rely on 'struct route' being defined. This fixes the LINT build some.
* Introduce a syncache, which enables FreeBSD to withstand a SYN floodjlemon2001-11-221-27/+62
| | | | | | | DoS in an improved fashion over the existing code. Reviewed by: silby (in a previous iteration) Sponsored by: DARPA, NAI Labs
* KSE Milestone 2julian2001-09-121-3/+3
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* When running aplication joined multicast address,ume2001-08-041-0/+1
| | | | | | | | | | | | | | removing network card, and kill aplication. imo_membership[].inm_ifp refer interface pointer after removing interface. When kill aplication, release socket,and imo_membership. imo_membership use already not exist interface pointer. Then, kernel panic. PR: 29345 Submitted by: Inoue Yuichi <inoue@nd.net.fujitsu.co.jp> Obtained from: KAME MFC after: 3 days
OpenPOWER on IntegriCloud