summaryrefslogtreecommitdiffstats
path: root/sys/netinet6
Commit message (Collapse)AuthorAgeFilesLines
* o Fix invalid TCP checksums with pf(4). [EN-16:02.pf]glebius2016-01-143-2/+6
| | | | | | | | | | | | | | | | | | | | o Fix YP/NIS client library critical bug. [EN-16:03.yplib] o Fix SCTP ICMPv6 error message vulnerability. [SA-16:01.sctp] o Fix ntp panic threshold bypass vulnerability. [SA-16:02.ntp] o Fix Linux compatibility layer incorrect futex handling. [SA-16:03.linux] o Fix Linux compatibility layer setgroups(2) system call. [SA-16:04.linux] o Fix TCP MD5 signature denial of service. [SA-16:05.tcp] o Fix insecure default bsnmpd.conf permissions. [SA-16:06.bsnmpd] Errata: FreeBSD-EN-16:02.pf Errata: FreeBSD-EN-16:03.yplib Security: FreeBSD-SA-16:01.sctp, CVE-2016-1879 Security: FreeBSD-SA-16:02.ntp, CVE-2015-5300 Security: FreeBSD-SA-16:03.linux, CVE-2016-1880 Security: FreeBSD-SA-16:04.linux, CVE-2016-1881 Security: FreeBSD-SA-16:05.tcp, CVE-2016-1882 Security: FreeBSD-SA-16:06.bsnmpd, CVE-2015-5677 Approved by: so
* Improve patch for SA-15:04.igmp to solve a potential buffer overflow.delphij2015-04-071-2/+10
| | | | | | | | | | Fix multiple vulnerabilities of ntp. [SA-15:07] Fix bsdinstall(8) insecure default GELI keyfile permissions. [SA-15:08] Fix Denial of Service with IPv6 Router Advertisements. [SA-15:09] Approved by: so
* MFS r272855, 266846:hrs2014-10-162-12/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Do not override sin6_scope_id in LLA when it is already set to non-zero. This fixes destination list in output of netstat -r. - Plug a memory leak. - Add RTM_VERSION check. - Fix a bug which can make sysctl() fail when -F is specified. - Increase WID_IF_DEFAULT() from 6 to 8 (the default for AF_INET6) because we have interfaces with longer names than 6 chars like epairN{a,b}. - Style fixes. MFS r272847: - Add rwlock to struct dadq. A panic could occur when a large number of addresses performed DAD at the same time. MFS r272850: - Replace Sun RPC license in TI-RPC library with a 3-clause BSD license, with the explicit permission of Sun Microsystems in 2009. - Replace Sun Industry Standards Source License for Sun RPC code with a 3-clause BSD license as specified by Oracle America, Inc. in 2010. This license change was approved by Wim Coekaerts, Senior Vice President, Linux and Virtualization at Oracle Corporation. - Replace Sun RPC license with a 3-clause BSD license. This license change was approved in 2010 by Wim Coekaerts, Senior Vice President, Linux and Virtualization at Oracle Corporation. - Replace Sun RPC license for TI-RPC library with a 3-clause BSD license, with the explicit permission of Sun Microsystems in 2009. The code in question in this file was copied from lib/libc/rpc/pmap_getport.c. MFS r272852,r272853: - Add relative specification in expiration time. - Add proto3 option for RTF_PROTO3. - Use %lu for members of struct rt_metrics. - Use long explicitly for the time difference. MFS r272854: - Return 0 if: 1. "-u N" specified, no -f, and mdN found, 2. no -u, "-f /pathname" specified, and mdN associated with /pathname found, 3. "-u N" specified, "-f /pathname" specified, and both of them found, 4. "-l" specified and no -f, 5. "-l" specified, "-f /pathname" specified, and /pathname found. otherwise return -1. MFS r272856: - Move configuration of IPv6 NDP flags to a point before handling ifconfig_IF. This fixes a race that a non-IPv4 interface can get an EUI64 LLA even if it has IFDISABLED nd6 flag at boot time. MFS r272857: - Cancel DAD for an ifa when the ifp has ND6_IFF_IFDISABLED as early as possible and do not clear IN6_IFF_TENTATIVE. If IFDISABLED was accidentally set after a DAD started, TENTATIVE could be cleared because no NA was received due to IFDISABLED, and as a result it could prevent DAD when manually clearing IFDISABLED after that. MFS r272858: - Fix an issue in range specification handling when a "-foo" is specified in ifconfig_IF_aliasN. MFS r272859: - Fix EtherIP. TOS field must be initialized when the inner protocol is PF_LINK, and multicast/broadcast flag should always be dropped because the outer protocol uses unicast even when the inner address is not for unicast. It had been broken since r236951 when gif_output() started to use IFQ_HANDOFF(). MFS r272860: - Recover sin6_scope_id of gateway addresses in riprecv() by using the if_index where a RIP packet was received. This fixes a bug which prevented gateway addresses in fe80::/64 from being added. MFS r272861: - Fix rc.d/gssd script to define the default values in a standard way. - Use a parameter argument in jls(8) instead of doing grep. MFS r272862, r272870: - Restructure rc.d scripts for kerberos5 daemons. MFS r272863: - Return false status only when adding a route is failed. It could erroneously return false due to an afexists() check loop in routing_start(). MFS r272864: - Use ipv6_prefer when at least one ifconfig_IF_ipv6 is configured. MFS r272865: - Fix a bug which prevented mount.fstab parameter from being converted when jail_JID_devfs_enable=NO. MFS r272866: - Fix header output when -P is specified and (ncpus - 1) != maxid. MFS r272867: - Fix a bug which could break extended attributes in a dump output. This occurred when a file was >892kB long and had a large data (>1kB) in the extended attributes. MFS r272868, r272869: - Make net.inet.ip.sourceroute, net.inet.ip.accept_sourceroute, and net.inet.ip.process_options vnet-aware. MFS r272871: - Revert changes in r269180. It could cause -c N option to enter an infinite loop if no reply packet is received. MFS r272874: - Resurrect set_rcvar() as a function to define a rc.conf variable. It defines a variable and its default value in load_rc_config() just after rc.conf is loaded. "rcvar" command shows the current and the default values. MFS r272960: - Do not add late flag when file= is specified because it has a bad side-effect. The specified file should exist before the fstab line. Approved by: re (gjb)
* MFC r272627:tuexen2014-10-123-28/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Checksum coverage values larger than 65535 for UDPLite are invalid. Check for this when the user calls setsockopt using UDPLITE_{SEND,RECV}CSCOV. MFC r272628: When plen != ulen, it should only be checked when this is UDP. MFC r272645: If the checksum coverage field in the UDPLITE header is the length of the complete UDPLITE packet, the packet has full checksum coverage. So fix the condition. MFC r272660: UDPLite requires a checksum. Therefore, discard a received packet if the checksum is 0. MFC r272661: The default for UDPLITE_RECV_CSCOV is zero. RFC 3828 recommend that this means full checksum coverage for received packets. If an application is willing to accept packets with partial coverage, it is expected to use the socket option and provide the minimum coverage it accepts. MFC r272662: Fix the checksum computation for UDPLite/IPv6. This requires the usage of a function computing the checksum only over a part of the function. Therefore introduce in6_cksum_partial() and implement in6_cksum() based on that. While there, ensure that the UDPLite packet contains at least enough bytes to contain the header. MFC r272663: Check for UDP/IPv6 packets that the length in the UDP header is at least the minimum. Make the check similar to the one for UDPLite/IPv6. MFC r272664: UDP/IPv6 and UDPLite/IPv6 require a checksum. So check for it. MFC r272754: Fix a bug introduced in https://svnweb.freebsd.org/base?view=revision&revision=272347 Approved by: re (gjb)
* MFC r270673:tuexen2014-09-181-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Announce SCTP support in the kern.features sysctl variables. MFC r270859: Enable SCTP support. It runs perfectly fine on a Wandboard quad. MFC r271204 with manual intervention: Fix the handling of sysctl variables when used with VIMAGE. While there do some cleanup of the code. MFC r271209: Fix a leak of an address, if the address is scheduled for removal and the stack is torn down. Thanks to Peter Bostroem and Jiayang Liu from Google for reporting the issue. MFC r271219: Use SYSCTL_PROC instead of SYSCTL_VNET_PROC. Suggested by: glebius@ MFC r271221: Use union sctp_sockstore instead of struct sockaddr_storage. This eliminates some warnings when building in userland. Thanks to Patrick Laimbock for reporting this issue. Remove also some unnecessary casts. There should be no functional change. MFC r271228: Address another warnings reported by Patrick Laimbock when compiling in userspace. While there, improve consistency. MFC r271230: Address warnings generated by the clang analyzer. Approved by: re (kib)
* MFC r270927:ae2014-09-081-0/+2
| | | | | | | Add the reverse part to rule #9. Also change its description in the netstat(8) output. Approved by: re (gjb)
* MFC r262351:rodrigc2014-09-071-2/+0
| | | | | | | | | | | Remove KASSERT from in6p_lookup_mcast_ifp(). When the devel/jenkins port, version 1.551 was started, the kernel would panic if INVARIANTS was enabled in the kernel config. Suggested by: bms Approved by: re (gjb)
* MFC r270348:markj2014-09-063-20/+41
| | | | | | | | | | | | | | Add some missing checks for unsupported interfaces (e.g. pflog(4)) when handling ioctls. While here, remove duplicated checks for a NULL ifp in in6_control(): this check is already done near the beginning of the function. MFC r270349: Suppress warnings when retrieving protocol stats from interfaces that don't support IPv6 (e.g. pflog(4)). PR: 189117 Approved by: re (gjb)
* MFC r257985:ae2014-09-011-25/+12
| | | | | | | | Fix panic with RADIX_MPATH, when RTFREE_LOCKED() called for already unlocked route. Use in6_rtalloc() instead of in6_rtalloc1. This helps simplify the code and remove several now unused variables. PR: 156283
* MFC r259884:bz2014-08-161-4/+3
| | | | | | Correct warnings comparing unsigned variables < 0 constantly reported while building kernels. All instances removed are indeed unsigned so the expressions could not be true.
* MFC r269306:ae2014-08-131-0/+6
| | | | | | | Add new rule to source address selection algorithm. It prefers address with better virtual status. Use ifa_preferred() to choose better address. PR: 187341
* MFC r267801: Make nd6_gctimer tunable.ume2014-06-301-0/+2
|
* MFC r264212,r264213,r264248,r265776,r265811,r265909:kevlo2014-05-134-45/+140
| | | | | | | | | | | | | | - Add support for UDP-Lite protocol (RFC 3828) to IPv4 and IPv6 stacks. Tested with vlc and a test suite [1]. [1] http://www.erg.abdn.ac.uk/~gerrit/udp-lite/files/udplite_linux.tar.gz Reviewed by: jhb, glebius, adrian - Fix a logic bug which prevented the sending of UDP packet with 0 checksum. - Disable TX checksum offload for UDP-Lite completely. It wasn't used for partial checksum coverage, but even for full checksum coverage it doesn't work.
* MFC r264582:ae2014-04-241-3/+0
| | | | | | Remove unused variable. PR: 173521
* MFC r264364:ae2014-04-211-36/+29
| | | | | | Properly release the in6_multi lock. Sponsored by: Yandex LLC
* MFC r263969,263971:ae2014-04-071-5/+2
| | | | | | | Don't generate an ICMPv6 error message if packet was consumed by filter. Remove unused label. Sponsored by: Yandex LLC
* Merge r262763, r262767, r262771, r262806 from head:glebius2014-03-213-15/+12
| | | | | | | | | | - Remove rt_metrics_lite and simply put its members into rtentry. - Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This removes another cache trashing ++ from packet forwarding path. - Create zini/fini methods for the rtentry UMA zone. Via initialize mutex and counter in them. - Fix reporting of rmx_pksent to routing socket. - Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode.
* Merge r263091: fix mbuf flags clash that lead to failure of operationglebius2014-03-182-14/+12
| | | | | | | of IPSEC and packet filters. PR: kern/185876 PR: kern/186755
* MFC: r261710brueffer2014-03-121-1/+1
| | | | | | | | Only count table lookups when we're actually processing packets. PR: 183462 Submitted by: Sven-Thorsten Dietrich <thebigcorporation at gmail.com> Reviewed by: bms
* Merge r261582, r261601, r261610, r261613, r261627, r261640, r261641, r261823,glebius2014-03-043-51/+2
| | | | | | | | | | r261825, r261859, r261875, r261883, r261911, r262027, r262028, r262029, r262030, r262162 from head. Large flowtable revamp. See commit messages for merged revisions for details. Sponsored by: Netflix
* MFC r261835:ae2014-02-201-1/+12
| | | | | | | Drop packets to multicast address whose scop field contains the reserved value 0. Sponsored by: Yandex LLC
* MFC r261400:ae2014-02-101-1/+2
| | | | | | | | | | Take exclusive lock only when lle isn't NULL. We don't need write access to lle in most cases. MFC r261583: Unlock entry before retry. Sponsored by: Yandex LLC
* MFC r260485,260496:ae2014-01-282-165/+146
| | | | | | | Remove extra nesting from X_ip6_mforward() function. Also remove disabled definitions from ip6_mroute.h. PR: 185148
* MFC r260481:ae2014-01-161-198/+96
| | | | | Add MRT6_DLOG() macro for debugging. Reduce number of MRT6DEBUG ifdefs and fix some broken format strings.
* MFC r260151 (by adrian):ae2014-01-103-9/+10
| | | | | | | | | | | | | | | | | Use an RLOCK here instead of an RWLOCK - matching all the other calls to lla_lookup(). This drastically reduces the very high lock contention when doing parallel TCP throughput tests (> 1024 sockets) with IPv6. MFC r260187: lla_lookup() does modification only when LLE_CREATE is specified. Thus we can use IF_AFDATA_RLOCK() instead of IF_AFDATA_LOCK() when doing lla_lookup() without LLE_CREATE flag. MFC r260217: Add IF_AFDATA_WLOCK_ASSERT() in case lla_lookup() is called with LLE_CREATE flag.
* MFC r259840:dim2013-12-281-0/+4
| | | | | | In sys/netinet6/in6_mcast.c, in6m_is_ifp_detached() is only used whenever KTR is defined, so put it between #ifdef KTR guards. This avoids a warning about a unused function if KTR is not enabled.
* MFC r256556:tuexen2013-11-211-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove a buggy comparision when setting manually the path MTU. After fixing, the comparision would have become redundant. Thanks to Andrew Galante for reporting the issue. MFC r257272: Fix compilation if SCTP_DONT_DO_PRIVADDR_SCOPE is defined. The issue was reported by Andrew Galante. MFC r257274: Fix the value of *optlen when calling getsockopt() for SCTP_REMOTE_UDP_ENCAPS_PORT. This issue was reported by Andrew Galante. MFC r257359: Terminate a debug output with a \n. MFC r257555: Changes from upstream to improve compilation when INET or INET6 or none of them is defined. MFC r257574: Unlock the lock before destroying it. This issue was reported by Andrew Galante. MFC r257800: Use htons()/ntohs() appropriately. These issues were reported by Andrew Galante. MFC r257803: Make sure that we don't try to build an ASCONF-ACK chunk larger than what fits in the the mbuf cluster. This issue was reported by Andrew Galante. MFC r257804: Get rid of the artification limitation enforced by SCTP_AUTH_RANDOM_SIZE_MAX. This was suggested by Andrew Galante. MFC r258221: Cleanups which result in fixes which have been made upstream and where partially suggested by Andrew Galante. There is no functional change in FreeBSD. MFC r258224: When determining if an address belongs to an stcb, take the address family into account for wildcard bound endpoints. MFC r258228: Remove a stray write operation. MFC r258235: Use SCTP_PR_SCTP_TTL when the user provides a positive timetolive in sctp_sendmsg(). Approved by: re@
* MFC r257084:ae2013-11-111-0/+1
| | | | | | | | Initialize inc_fibnum for properly handling ICMP6_PACKET_TOO_BIG errors in multifib environment. PR: 183265 Approved by: re (hrs)
* Do not try to detach if the interface does not support IPv6.hrs2013-10-101-0/+3
| | | | | | Tested by: hselasky PR: usb/182820 Approved by: re (glebius)
* Fix mbuf leak.glebius2013-10-071-1/+1
| | | | | | Submitted by: Loganaden Velvindron <logan elandsys.com> Obtained from: NetBSD Approved by: re (kib)
* Update comment from draft to RFC number.bz2013-09-221-3/+2
| | | | | | Submitted by: Loganaden Velvindron (logan elandsys.com) Approved by: re (gjb) MFC after: 6 days
* Unregister inet/inet6 pfil hooks on vnet destroy.trociny2013-09-131-0/+4
| | | | | Discussed with: andre Approved by: re (rodrigc)
* Fix the length calculation for the final block of a sendfile(2)des2013-09-101-0/+12
| | | | | | | | | | | | | | | | | | | | transmission which could be tricked into rounding up to the nearest page size, leaking up to a page of kernel memory. [13:11] In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK at the socket layer rather than pass them on to the link layer without validation or credential checks. [SA-13:12] Prevent cross-mount hardlinks between different nullfs mounts of the same underlying filesystem. [SA-13:13] Security: CVE-2013-5666 Security: FreeBSD-SA-13:11.sendfile Security: CVE-2013-5691 Security: FreeBSD-SA-13:12.ifioctl Security: CVE-2013-5710 Security: FreeBSD-SA-13:13.nullfs Approved by: re
* Use an unsigned long when indexing into mfchashtbl[] and mf6ctable[]. Thisjhb2013-09-051-2/+2
| | | | | | | | | matches the types used when computing hash indices and the type of the maximum size of mfchashtbl[]. PR: kern/181821 Submitted by: Sven-Thorsten Dietrich <sven@vyatta.com> (IPv4) MFC after: 1 week
* Remove most of the remaining sysctl name list macros. They were onlyjhb2013-08-261-4/+0
| | | | | | | | ever intended for use in sysctl(8) and it has not used them for many years. Reviewed by: bde Tested by: exp-run by bdrewery
* Implement the ip, tcp, and udp DTrace providers. The probe definitions usemarkj2013-08-255-2/+27
| | | | | | | | | dynamic translation so that their arguments match the definitions for these providers in Solaris and illumos. Thus, existing scripts for these providers should work unmodified on FreeBSD. Tested by: gnn, hiren MFC after: 1 month
* Provide human readable debug output.tuexen2013-08-251-2/+2
|
* For now limit printf(9) %x of the 64bit pkthdr.csum_flags field to 32bits.andre2013-08-251-1/+1
| | | | | | The upper 32bits are not occupied for now. Sponsored by: The FreeBSD Foundation
* Restructure the mbuf pkthdr to make it fit for upcoming capabilities andandre2013-08-242-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | features. The changes in particular are: o Remove rarely used "header" pointer and replace it with a 64bit protocol/ layer specific union PH_loc for local use. Protocols can flexibly overlay their own 8 to 64 bit fields to store information while the packet is worked on. o Mechanically convert IP reassembly, IGMP/MLD and ATM to use pkthdr.PH_loc instead of pkthdr.header. o Extend csum_flags to 64bits to allow for additional future offload information to be carried (e.g. iSCSI, IPsec offload, and others). o Move the RSS hash type enumerator from abusing m_flags to its own 8bit rsstype field. Adjust accessor macros. o Add cosqos field to store Class of Service / Quality of Service information with the packet. It is not yet supported in any drivers but allows us to get on par with Cisco/Juniper in routing applications (plus MPLS QoS) with a modernized ALTQ. o Add four 8 bit fields l[2-5]hlen to store the relative header offsets from the start of the packet. This is important for various offload capabilities and to relieve the drivers from having to parse the packet and protocol headers to find out location of checksums and other information. Header parsing in drivers is a lot of copy-paste and unhandled corner cases which we want to avoid. o Add another flexible 64bit union to map various additional persistent packet information, like ether_vtag, tso_segsz and csum fields. Depending on the csum_flags settings some fields may have different usage making it very flexible and adaptable to future capabilities. o Restructure the CSUM flags to better signify their outbound (down the stack) and inbound (up the stack) use. The CSUM flags used to be a bit chaotic and rather poorly documented leading to incorrect use in many places. Bring clarity into their use through better naming. Compatibility mappings are provided to preserve the API. The drivers can be corrected one by one and MFC'd without issue. o The size of pkthdr stays the same at 48/56bytes (32/64bit architectures). Sponsored by: The FreeBSD Foundation
* Fix an integer overflow in computing the size of a temporary bufferdelphij2013-08-221-0/+2
| | | | | | | | can result in a buffer which is too small for the requested operation. Security: CVE-2013-3077 Security: FreeBSD-SA-13:09.ip_multicast
* Add m_clrprotoflags() to clear protocol specific mbuf flags at up andandre2013-08-194-3/+5
| | | | | | | | downwards layer crossings. Consistently use it within IP, IPv6 and ethernet protocols. Discussed with: trociny, glebius
* Move the global M_SKIP_FIREWALL mbuf flags to a protocol layer specificandre2013-08-191-1/+6
| | | | | | | | | | flag instead. The flag is only used within the IP and IPv6 layer 3 protocols. Because some firewall packages treat IPv4 and IPv6 packets the same the flag should have the same value for both. Discussed with: trociny, glebius
* Return 0 in nbi->expire when la_expire == 0. Conversion from time_uptime tohrs2013-08-171-1/+5
| | | | time_second should not be performed in this case.
* Fix incompatibility in ICMPV6CTL_ND6_PRLIST sysctl, and SIOCGPRLST_IN6,hrs2013-08-061-5/+8
| | | | | SIOCGDRLST_IN6, and SIOCGNBRINFO_IN6 ioctl. These userland interfaces treat expiration times in time_second, not time_uptime.
* - Use time_uptime instead of time_second in data structures forhrs2013-08-058-42/+42
| | | | | | | | | PF_INET6 in kernel. This fixes various malfunction when the wall time clock is changed. Bump __FreeBSD_version to 1000041. - Use clock_gettime(CLOCK_MONOTONIC_FAST) in userland utilities. MFC after: 1 month
* Fix a panic in tmpaddrtimer.hrs2013-08-051-0/+2
|
* Allocate in6_ifextra (ifp->if_afdata[AF_INET6]) only for IPv6-capablehrs2013-07-313-8/+12
| | | | | | | interfaces. This eliminates unnecessary IPv6 processing for non-IPv6 interfaces. MFC after: 3 days
* Remove the large part of struct ipsecstat. Only few fields of thisae2013-07-233-6/+6
| | | | | | | | | | | structure is used, but they already have equal fields in the struct newipsecstat, that was introduced with FAST_IPSEC and then was merged together with old ipsecstat structure. This fixes kernel stack overflow on some architectures after migration ipsecstat to PCPU counters. Reported by: Taku YAMAMOTO, Maciej Milewski
* A complete duplication of binding should be allowed if on both new andtrociny2013-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | duplicated sockets a multicast address is bound and either SO_REUSEPORT or SO_REUSEADDR is set. But actually it works for the following combinations: * SO_REUSEPORT is set for the fist socket and SO_REUSEPORT for the new; * SO_REUSEADDR is set for the fist socket and SO_REUSEADDR for the new; * SO_REUSEPORT is set for the fist socket and SO_REUSEADDR for the new; and fails for this: * SO_REUSEADDR is set for the fist socket and SO_REUSEPORT for the new. Fix the last case. PR: 179901 MFC after: 1 month
* Correct the size of allocated memory to store array of counters.ae2013-07-091-3/+4
|
OpenPOWER on IntegriCloud