summaryrefslogtreecommitdiffstats
path: root/sys/netinet6
Commit message (Collapse)AuthorAgeFilesLines
* To ease changes to underlying mbuf structure and the mbuf allocator, reducerwatson2015-01-053-5/+5
| | | | | | | | | | | | | | | | | | | | | the knowledge of mbuf layout, and in particular constants such as M_EXT, MLEN, MHLEN, and so on, in mbuf consumers by unifying various alignment utility functions (M_ALIGN(), MH_ALIGN(), MEXT_ALIGN() in a single M_ALIGN() macro, implemented by a now-inlined m_align() function: - Move m_align() from uipc_mbuf.c to mbuf.h; mark as __inline. - Reimplement M_ALIGN(), MH_ALIGN(), and MEXT_ALIGN() using m_align(). - Update consumers around the tree to simply use M_ALIGN(). This change eliminates a number of cases where mbuf consumers must be aware of whether or not mbufs returned by the allocator use external storage, but also assumptions about the size of the returned mbuf. This will make it easier to introduce changes in how we use external storage, as well as features such as variable-size mbufs. Differential Revision: https://reviews.freebsd.org/D1436 Reviewed by: glebius, trasz, gnn, bz Sponsored by: EMC / Isilon Storage Division
* Migrate the RSS IPv6 hash code to use pointers to the v6 addressesadrian2014-12-312-3/+3
| | | | | | | | | | | | | | | | rather than passing them in by value. The eventual aim is to do incremental hash construction rather than all of the memcpy()'ing into a contiguous buffer for the hash function, which does show up as taking quite a bit of CPU during profiling. Tested: * a variety of laptops/desktop setups I have, with v6 connectivity Differential Revision: D1404 Reviewed by: bz, rpaulo
* Extern declarations in C files loses compile-time checking thatae2014-12-252-9/+0
| | | | | | the functions' calls match their definitions. Move them to header files. Reviewed by: jilles (previous version)
* Remove in_gif.h and in6_gif.h files. They only contain functionae2014-12-232-48/+9
| | | | | declarations used by gif(4). Instead declare these functions in C files. Also make some variables static.
* Plug a memory leak in an error code path.tuexen2014-12-171-1/+4
| | | | | | Reported by: Coverity CID: 1018936 MFC after: 3 days
* Do not count security policy violation twice.ae2014-12-112-3/+0
| | | | | | | ipsec*_in_reject() do this by their own. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Use ipsec6_in_reject() to simplify ip6_ipsec_fwd() and ip6_ipsec_input().ae2014-12-112-49/+20
| | | | | | | | | | | ipsec6_in_reject() does the same things, also it counts policy violation errors. Do IPSEC check in the ip6_forward() after addresses checks. Also use ip6_ipsec_fwd() to make code similar to IPv4 implementation. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove flag/flags argument from the following functions:ae2014-12-114-12/+8
| | | | | | | | | | | | ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Move ip_ipsec_fwd() from ip_input() into ip_forward().ae2014-12-111-24/+11
| | | | | | | | | | | | | | | | | Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is already handled by IPSEC code. This means that before IPSEC processing it was destined to our address and security policy was checked in the ip_ipsec_input(). After IPSEC processing packet has new IP addresses and destination address isn't our own. So, anyway we can't check security policy from the mbuf tag, because it corresponds to different addresses. We should check security policy that corresponds to packet attributes in both cases - when it has a mbuf tag and when it has not. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of itsae2014-12-111-21/+5
| | | | | | | | | | | | | | | | | security policy. The changed block of code in ip*_ipsec_input() is called when packet has ESP/AH header. Presence of PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that packet was already handled by IPSEC and reinjected in the netisr, and it has another ESP/AH headers (encrypted twice?). Since it was already processed by IPSEC code, the AH/ESP headers was already stripped (and probably outer IP header was stripped too) and security policy from the tdb_ident was applied to those headers. It is incorrect to apply this security policy to current headers. Also make ip_ipsec_input() prototype similar to ip6_ipsec_input(). Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove check for presence of PACKET_TAG_IPSEC_PENDING_TDB andae2014-12-111-47/+16
| | | | | | | | | | | | | | | PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED mbuf tags. They aren't used in FreeBSD. Instead check presence of PACKET_TAG_IPSEC_OUT_DONE mbuf tag. If it is found, bypass security policy lookup as described in the comment. PACKET_TAG_IPSEC_OUT_DONE tag added to mbuf when IPSEC code finishes ESP/AH processing. Since it was already finished, this means the security policy placed in the tdb_ident was already checked. And there is no reason to check it again here. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Revert r275695: nd6_dad_find() was already correct.markj2014-12-111-3/+2
| | | | | Reported by: ae, kib Pointy hat to: markj
* Fix a bug in r266857: nd6_dad_find() must return NULL if it doesn't findmarkj2014-12-111-2/+3
| | | | | | | a matching element in the DAD queue. Reported by: Holger Hans Peter Freyther <holger@freyther.de> MFC after: 3 days
* Add refcounting to IPv6 DAD objects and simplify the DAD code to fix amarkj2014-12-083-90/+64
| | | | | | | | | | | number of races which could cause double frees or use-after-frees when performing DAD on an address. In particular, an IPv6 address can now only be marked as a duplicate from the DAD callout. Differential Revision: https://reviews.freebsd.org/D1258 Reviewed by: ae, hrs Reported by: rstone MFC after: 1 month
* This is the SCTP specific companion oftuexen2014-12-041-9/+4
| | | | | https://svnweb.freebsd.org/changeset/base/275358 which was provided by Hans Petter Selasky.
* Remove unneded check. No need to do m_pullup to the size that we prepended.ae2014-12-021-2/+0
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Remove route chaching support from ipsec code. It isn't used for some time.ae2014-12-022-10/+0
| | | | | | | | | * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>; Sponsored by: Yandex LLC
* Start process of removing the use of the deprecated "M_FLOWID" flaghselasky2014-12-013-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from the FreeBSD network code. The flag is still kept around in the "sys/mbuf.h" header file, but does no longer have any users. Instead the "m_pkthdr.rsstype" field in the mbuf structure is now used to decide the meaning of the "m_pkthdr.flowid" field. To modify the "m_pkthdr.rsstype" field please use the existing "M_HASHTYPE_XXX" macros as defined in the "sys/mbuf.h" header file. This patch introduces new behaviour in the transmit direction. Previously network drivers checked if "M_FLOWID" was set in "m_flags" before using the "m_pkthdr.flowid" field. This check has now now been replaced by checking if "M_HASHTYPE_GET(m)" is different from "M_HASHTYPE_NONE". In the future more hashtypes will be added, for example hashtypes for hardware dedicated flows. "M_HASHTYPE_OPAQUE" indicates that the "m_pkthdr.flowid" value is valid and has no particular type. This change removes the need for an "if" statement in TCP transmit code checking for the presence of a valid flowid value. The "if" statement mentioned above is now a direct variable assignment which is then later checked by the respective network drivers like before. Additional notes: - The SCTP code changes will be committed as a separate patch. - Removal of the "M_FLOWID" flag will also be done separately. - The FreeBSD version has been bumped. MFC after: 1 month Sponsored by: Mellanox Technologies
* Do not return unlocked/unreferenced lle in arpresolve/nd6_storelladdr -melifaro2014-11-272-4/+6
| | | | | return lle flags IFF needed. Do not pass rte to arpresolve - pass is_gateway flag instead.
* Skip L2 addresses lookups for p2p interfaces.ae2014-11-241-3/+2
| | | | | Discussed with: melifaro Sponsored by: Yandex LLC
* Finish r274175: do control plane MTU tracking.melifaro2014-11-171-11/+0
| | | | | | | | | | | | | | | | | | | | | | | | | Update route MTU in case of ifnet MTU change. Add new RTF_FIXEDMTU to track explicitly specified MTU. Old behavior: ifconfig em0 mtu 1500->9000 -> all routes traversing em0 do not change MTU. User has to manually update all routes. ifconfig em0 mtu 9000->1500 -> all routes traversing em0 do not change MTU. However, if ip[6]_output finds route with rt_mtu > interface mtu, rt_mtu gets updated. New behavior: ifconfig em0 mtu 1500->9000 -> all interface routes in all fibs gets updated with new MTU unless RTF_FIXEDMTU flag set on them. ifconfig em0 mtu 9000->1500 -> all routes in all fibs gets updated with new MTU unless RTF_FIXEDMTU flag set on them AND rt_mtu is less than ifp mtu. route add ... -mtu XXX automatically sets RTF_FIXEDMTU flag. route change .. -mtu 0 automatically removes RTF_FIXEDMTU flag. PR: 194238 MFC after: 1 month CR: D1125
* We don't return sp pointer, thus NULL assignment isn't needed.ae2014-11-121-4/+0
| | | | | | | And reference to sp will be freed at the end. MFC after: 1 week Sponsored by: Yandex LLC
* Kill custom in_matroute() radix mathing function removing one rte mutex lock.melifaro2014-11-112-22/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Initially in_matrote() in_clsroute() in their current state was introduced by r4105 20 years ago. Instead of deleting inactive routes immediately, we kept them in route table, setting RTPRF_OURS flag and some expire time. After that, either GC came or RTPRF_OURS got removed on first-packet. It was a good solution in that days (and probably another decade after that) to keep TCP metrics. However, after moving metrics to TCP hostcache in r122922, most of in_rmx functionality became unused. It might had been used for flushing icmp-originated routes before rte mutexes/refcounting, but I'm not sure about that. So it looks like this is nearly impossible to make GC do its work nowadays: in_rtkill() ignores non-RTPRF_OURS routes. route can only become RTPRF_OURS after dropping last reference via rtfree() which calls in_clsroute(), which, it turn, ignores UP and non-RTF_DYNAMIC routes. Dynamic routes can still be installed via received redirect, but they have default lifetime (no specific rt_expire) and no one has another trie walker to call RTFREE() on them. So, the changelist: * remove custom rnh_match / rnh_close matching function. * remove all GC functions * partially revert r256695 (proto3 is no more used inside kernel, it is not possible to use rt_expire from user point of view, proto3 support is not complete) * Finish r241884 (similar to this commit) and remove remaining IPv6 parts MFC after: 1 month
* Add sa6_checkzone_ifp() function. It checks correctness of structae2014-11-102-0/+22
| | | | | | | sockaddr_in6, usually obtained from the user level through ioctl. It initializes sin6_scope_id using given interface. Sponsored by: Yandex LLC
* * Make nd6_dad_duplicated() constant.melifaro2014-11-102-35/+32
| | | | | | | | * Simplify refcounting by using nd6_dad_add() / nd6_dad_del(). Reviewed by: ae MFC after: 2 weeks Sponsored by: Yandex LLC
* Remove link-local multicast routes remnants from in6_purgeaddr.ae2014-11-101-39/+5
| | | | | | Also merge in6_purgeaddr_mc with in6_purgeaddr. Sponsored by: Yandex LLC
* Consistently use if_link.glebius2014-11-104-6/+6
| | | | Reviewed by: ae, melifaro
* For now handle only multicast addresses, we still use routes toae2014-11-101-9/+9
| | | | | | LLA unicasts yet. Sponsored by: Yandex LLC
* Use embedded scope zone id to determine outgoing interface for link-localae2014-11-091-1/+13
| | | | and node-local addresses.
* Renove faith(4) and faithd(8) from base. It looks like industrymelifaro2014-11-0910-103/+14
| | | | | | | | | have chosen different (and more traditional) stateless/statuful NAT64 as translation mechanism. Last non-trivial commits to both faith(4) and faithd(8) happened more than 12 years ago, so I assume it is time to drop RFC3142 in FreeBSD. No objections from: net@
* Remove unused 'struct route *' argument from nd6_output_flush().melifaro2014-11-093-5/+5
|
* Remove ip6_getdstifaddr() and all functions to work with auxiliary data.ae2014-11-084-391/+40
| | | | | | | | | | | | It isn't safe to keep unreferenced ifaddrs. Use in6ifa_ifwithaddr() to determine ifaddr corresponding to destination address. Since currently we keep addresses with embedded scope zone, in6ifa_ifwithaddr is called with zero zoneid and marked with XXX. Also remove route and lle lookups from ip6_input. Use in6ifa_ifwithaddr() instead. Sponsored by: Yandex LLC
* Overhaul if_gre(4).ae2014-11-072-0/+162
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split it into two modules: if_gre(4) for GRE encapsulation and if_me(4) for minimal encapsulation within IP. gre(4) changes: * convert to if_transmit; * rework locking: protect access to softc with rmlock, protect from concurrent ioctls with sx lock; * correct interface accounting for outgoing datagramms (count only payload size); * implement generic support for using IPv6 as delivery header; * make implementation conform to the RFC 2784 and partially to RFC 2890; * add support for GRE checksums - calculate for outgoing datagramms and check for inconming datagramms; * add support for sending sequence number in GRE header; * remove support of cached routes. This fixes problem, when gre(4) doesn't work at system startup. But this also removes support for having tunnels with the same addresses for inner and outer header. * deprecate support for various GREXXX ioctls, that doesn't used in FreeBSD. Use our standard ioctls for tunnels. me(4): * implementation conform to RFC 2004; * use if_transmit; * use the same locking model as gre(4); PR: 164475 Differential Revision: D1023 No objections from: net@ Relnotes: yes Sponsored by: Yandex LLC
* Remove SYSCTL_VNET_* macros, and simply put CTLFLAG_VNET where needed.glebius2014-11-077-93/+96
| | | | Sponsored by: Nginx, Inc.
* Remove VNET_SYSCTL_ARG(). The generic sysctl(9) code handles that.glebius2014-11-071-4/+0
| | | | | Reviewed by: ae Sponsored by: Nginx, Inc.
* Finish r274118: remove useless fields from struct domain.melifaro2014-11-061-2/+0
| | | | Sponsored by: Yandex LLC
* Make checks for rt_mtu generic:melifaro2014-11-065-4/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some virtual if drivers has (ab)used ifa ifa_rtrequest hook to enforce route MTU to be not bigger that interface MTU. While ifa_rtrequest hooking might be an option in some situation, it is not feasible to do MTU checks there: generic (or per-domain) routing code is perfectly capable of doing this. We currrently have 3 places where MTU is altered: 1) route addition. In this case domain overrides radix _addroute callback (in[6]_addroute) and all necessary checks/fixes are/can be done there. 2) route change (especially, GW change). In this case, there are no explicit per-domain calls, but one can override rte by setting ifa_rtrequest hook to domain handler (inet6 does this). 3) ifconfig ifaceX mtu YYYY In this case, we have no callbacks, but ip[6]_output performes runtime checks and decreases rt_mtu if necessary. Generally, the goals are to be able to handle all MTU changes in control plane, not in runtime part, and properly deal with increased interface MTU. This commit changes the following: * removes hooks setting MTU from drivers side * adds proper per-doman MTU checks for case 1) * adds generic MTU check for case 2) * The latter is done by using new dom_ifmtu callback since if_mtu denotes L3 interface MTU, e.g. maximum trasmitted _packet_ size. However, IPv6 mtu might be different from if_mtu one (e.g. default 1280) for some cases, so we need an abstract way to know maximum MTU size for given interface and domain. * moves rt_setmetrics() before MTU/ifa_rtrequest hooks since it copies user-supplied data which must be checked. * removes RT_LOCK_ASSERT() from other ifa_rtrequest hooks to be able to use this functions on new non-inserted rte. More changes will follow soon. MFC after: 1 month Sponsored by: Yandex LLC
* Remove old hack abusing domattach from NFS code.melifaro2014-11-051-9/+2
| | | | | | | | | | | | | | | | | | | | According to IANA RPC uaddr registry, there are no AFs except IPv4 and IPv6, so it's not worth being too abstract here. Remove ne_rtable[AF_MAX+1] and use explicit per-AF radix tries. Use own initialization without relying on domattach code. While I admit that this was one of the rare places in kernel networking code which really was capable of doing multi-AF without any AF-depended code, it is not possible anymore to rely on dom* code. While here, change terrifying "Invalid radix node head, rn:" message, to different non-understandable "netcred already exists for given addr/mask", but less terrifying. Since we know that rn_addaddr() returns NULL if the same record already exists, we should provide more friendly error. MFC after: 1 month
* Fix a bug which prevented ND6_IFF_IFDISABLED flag from clearing whenhrs2014-11-021-26/+24
| | | | | | the newly-added IPv6 address was /128. PR: 188032
* Remove redundant code.ae2014-10-301-65/+4
| | | | | | | | if_detach already did these steps. Also, now we didn't keep routes to link-local addresses. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Move ifq drain into in6m_purge().ae2014-10-301-3/+2
| | | | | | Suggested by: bms MFC after: 1 week Sponsored by: Yandex LLC
* Fix mbuf leak in IPv6 multicast code.ae2014-10-301-0/+3
| | | | | | | | | | | | When multicast capable interface goes away, it leaves multicast groups, this leads to generate MLD reports, but MLD code does deffered send and MLD reports are queued in the in6_multi's in6m_scq ifq. The problem is that in6_multi structures are freed when interface leaves multicast groups and thread that does deffered send will not take these queued packets. PR: 194577 MFC after: 1 week Sponsored by: Yandex LLC
* Do not automatically install routes to link-local and interface-local multicastae2014-10-271-207/+34
| | | | | | | addresses. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove unused function.ae2014-10-272-15/+0
| | | | Sponsored by: Yandex LLC
* Remove redundant check and m_pullup() call.ae2014-10-241-2/+0
|
* Overhaul if_gif(4):ae2014-10-142-267/+47
| | | | | | | | | | | | | | o convert to if_transmit; o use rmlock to protect access to gif_softc; o use sx lock to protect from concurrent ioctls; o remove a lot of unneeded and duplicated code; o remove cached route support (it won't work with concurrent io); o style fixes. Reviewed by: melifaro Obtained from: Yandex LLC MFC after: 1 month Sponsored by: Yandex LLC
* When deciding whether to call m_pullup() even though there is adequaterwatson2014-10-123-9/+8
| | | | | | | | | | | | | | | | data in an mbuf, use M_WRITABLE() instead of a direct test of M_EXT; the latter both unnecessarily exposes mbuf-allocator internals in the protocol stack and is also insufficient to catch all cases of non-writability. (NB: m_pullup() does not actually guarantee that a writable mbuf is returned, so further refinement of all of these code paths continues to be required.) Reviewed by: bz MFC after: 3 days Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D900
* Add context pointer and source address to the UDP tunnel callbackbryanv2014-10-101-1/+2
| | | | | | | | | | | | These are needed for the forthcoming vxlan implementation. The context pointer means we do not have to use a spare pointer field in the inpcb, and the source address is required to populate vxlan's forwarding table. While I highly doubt there is an out of tree consumer of the UDP tunneling callback, this change may be a difficult to eventually MFC. Phabricator: https://reviews.freebsd.org/D383 Reviewed by: gnn
* Add missing UDP multicast receive dtrace probesbryanv2014-10-091-0/+2
| | | | | | Phabricator: https://reviews.freebsd.org/D924 Reviewed by: rpaulo markj MFC after: 1 month
* Move the calls to u_tun_func() into udp6_append()bryanv2014-10-091-32/+12
| | | | | | | | A similar cleanup for UDPv4 was performed in r220620. Phabricator: https://reviews.freebsd.org/D383 Reviewed by: gnn MFC after: 1 month
OpenPOWER on IntegriCloud