summaryrefslogtreecommitdiffstats
path: root/sys/netinet6
Commit message (Collapse)AuthorAgeFilesLines
* Fix our version of IPv6 address representation.alfred2010-05-191-2/+19
| | | | | | | | | | | | | | | | | | | | | | We do not respect rules 3 and 4 in the required list: 1. omit leading zeros 2. "::" used to their maximum extent whenever possible 3. "::" used where shortens address the most 4. "::" used in the former part in case of a tie breaker 5. do not shorten one 16 bit 0 field 6. use lower case http://tools.ietf.org/html/draft-ietf-6man-text-addr-representation-04.html Submitted by: Kalluru Abhiram @ Juniper Networks Obtained from: Juniper Networks Reviewed by: hrs, dougb
* allocate ipv6 flows from the ipv6 flow zonekmacy2010-05-161-1/+1
| | | | | | reported by: rrs@ MFC after: 3 days
* do a proper fixkmacy2010-05-131-1/+1
| | | | | | Pointed out by: np@ MFC after: 3 days
* fix compile error on some builds by doing the equivalent ofkmacy2010-05-131-1/+1
| | | | | | an "extern VNET_DEFINE" without "__used" MFC after: 3 days
* try working around panic by validating rt and llekmacy2010-05-121-1/+2
| | | | MFC after: 3 days
* boot time size the flowtablekmacy2010-05-101-3/+15
| | | | MFC after: 3 days
* Add flowtable support to IPv6kmacy2010-05-094-6/+60
| | | | | | | Tested by: qingli@ Reviewed by: qingli@ MFC after: 3 days
* MFP4: @176978-176982, 176984, 176990-176994, 177441bz2010-04-2917-295/+175
| | | | | | | | | | | | | | | | | | | | | | | | | | "Whitspace" churn after the VIMAGE/VNET whirls. Remove the need for some "init" functions within the network stack, like pim6_init(), icmp_init() or significantly shorten others like ip6_init() and nd6_init(), using static initialization again where possible and formerly missed. Move (most) variables back to the place they used to be before the container structs and VIMAGE_GLOABLS (before r185088) and try to reduce the diff to stable/7 and earlier as good as possible, to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9. This also removes some header file pollution for putatively static global variables. Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are no longer needed. Reviewed by: jhb Discussed with: rwatson Sponsored by: The FreeBSD Foundation Sponsored by: CK Software GmbH MFC after: 6 days
* Enhance the historic behaviour of raw sockets and jails in a waybz2010-04-271-1/+1
| | | | | | | | | | | | | | that we allow all possible jail IPs as source address rather than forcing the "primary". While IPv6 naturally has source address selection, for legacy IP we do not go through the pain in case IP_HDRINCL was not set. People should bind(2) for that. This will, for example, allow ping(|6) -S to work correctly for non-primary addresses. Reported by: (ten 211.ru) Tested by: (ten 211.ru) MFC after: 4 days
* Make sure IPv6 source address selection does not change interfacebz2010-04-271-5/+20
| | | | | | | | | addresses while walking the IPv6 address list if in the jail case something is connecting to ::1. Reported by: Pieter de Boer (pieter thedarkside.nl) Tested by: Pieter de Boer (pieter thedarkside.nl) MFC after: 4 days
* Provide 32bit compat for SIOCGDEFIFACE_IN6.kib2010-04-271-0/+25
| | | | | | Based on submission by: pluknet gmail com Reviewed by: emaste MFC after: 2 weeks
* Plug reference leaks in the link-layer code ("new-arp") that previouslybz2010-04-112-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | prevented the link-layer entry from being freed. In both in.c and in6.c (though that code path seems to be basically dead) plug a reference leak in case of a pending callout being drained. In if_ether.c consistently add a reference before resetting the callout and in case we canceled a pending one remove the reference for that. In the final case in arptimer, before freeing the expired entry, remove the reference again and explicitly call callout_stop() to clear the active flag. In nd6.c:nd6_free() we are only ever called from the callout function and thus need to remove the reference there as well before calling into llentry_free(). In if_llatbl.c when freeing entire tables make sure that in case we cancel a pending callout to remove the reference as well. Reviewed by: qingli (earlier version) MFC after: 10 days Problem observed, patch tested by: simon on ipv6gw.f.o, Christian Kratzer (ck cksoft.de), Evgenii Davidov (dado korolev-net.ru) PR: kern/144564 Configurations still affected: with options FLOWTABLE
* When embedding the scope ID in MLDv1 output, check if the scope of the addressbms2010-04-101-2/+4
| | | | | | | | | | | being embedded is in fact link-local, before attempting to embed it. Note that this operation is a side-effect of trying to avoid recursion on the IN6 scope lock. PR: 144560 Submitted by: Petr Lampa MFC after: 3 days
* * Fix some race condition in SACK/NR-SACK processing.tuexen2010-04-031-1/+1
| | | | | | | | * Fix handling of mapping arrays when draining mbufs or processing FORWARD-TSN chunks. * Cleanup code (no duplicate code anymore for SACKs and NR-SACKs). Part of this code was developed together with rrs. MFC after: 2 weeks.
* We are holding a write lock here so avoid aquiring it twice callingbz2010-03-251-1/+1
| | | | | | the "locked" version rather than the wrapper function. MFC after: 6 days
* The proper fix for the delayed SCTP checksum is torrs2010-03-121-1/+1
| | | | | | | | | | have the delayed function take an argument as to the offset to the SCTP header. This allows it to work for V4 and V6. This of course means changing all callers of the function to either pass the header len, if they have it, or create it (ip_hl << 2 or sizeof(ip6_hdr)). PR: 144529 MFC after: 2 weeks
* With the recent change of the sctp checksum to support offload,rrs2010-03-121-0/+19
| | | | | | | | | | | no delayed checksum was added to the ip6 output code. This causes cards that do not support SCTP checksum offload to have SCTP packets that are IPv6 NOT have the sctp checksum performed. Thus you could not communicate with a peer. This adds the missing bits to make the checksum happen for these cards. PR: 144529 MFC after: 2 weeks
* Use reference counting instead of locking to secure an address whileqingli2010-02-271-3/+6
| | | | | | | that address is being used to generate temporary IPv6 address. This approach is sufficient and avoids recursive locking. MFC after: 3 days
* No need to include security/mac/mac_framework.h here.pjd2010-02-181-2/+0
|
* Correct a typo.bz2010-01-241-1/+1
| | | | | Submitted by: kensmith MFC after: 3 days
* Garbage collect references to the no longer implemented tcp_fasttimo().bz2010-01-171-1/+0
| | | | | Discussed with: rwatson MFC after: 5 days
* Add ip4.saddrsel/ip4.nosaddrsel (and equivalent for ip6) to controlbz2010-01-171-0/+7
| | | | | | | | | | | | | | | | | | | | whether to use source address selection (default) or the primary jail address for unbound outgoing connections. This is intended to be used by people upgrading from single-IP jails to multi-IP jails but not having to change firewall rules, application ACLs, ... but to force their connections (unless otherwise changed) to the primry jail IP they had been used for years, as well as for people prefering to implement similar policies. Note that for IPv6, if configured incorrectly, this might lead to scope violations, which single-IPv6 jails could as well, as by the design of jails. [1] Reviewed by: jamie, hrs (ipv6 part) Pointed out by: hrs [1] MFC After: 2 weeks Asked for by: Jase Thew (bazerka beardz.net)
* Replace several instances of 'if (!a & b)' with 'if (!(a &b))' in ordertrasz2010-01-081-1/+1
| | | | to silence newer GCC versions.
* Correct a typo.bz2010-01-061-1/+1
| | | | | Submitted by: sn_ (sn_ gmx.net) on hackers@ MFC after: 3 days
* The IFA_RTSELF address flag marks a loopback route has been installedqingli2010-01-041-1/+1
| | | | | | | | | | | | for the interface address. This marker is necessary to properly support PPP types of links where multiple links can have the same local end IP address. The IFA_RTSELF flag bit maps to the RTF_HOST value, which was combined into the route flag bits during prefix installation in IPv6. This inclusion causing the prefix route to be unusable. This patch fixes this bug by excluding the IFA_RTSELF flag during route installation. MFC after: 5 days
* Multiple IPv6 addresses of the same prefix can be installed on theqingli2009-12-301-2/+22
| | | | | | | | | | | | | | same interface. The first address will install the prefix route into the kernel routing table and that prefix will be marked as on-link. Without RADIX_MPATH enabled, the other address aliases of the same prefix will update the prefix reference count but no other routes will be installed. Consequently the prefixes associated with these addresses would not be marked as on-link. As such, incoming packets destined to these address aliases will fail the ND6 on-link check on input. This patch fixes the above problem by searching the kernel routing table and try to find an on-link prefix on the given interface. MFC after: 5 days
* The proxy arp entries could not be added into the system over theqingli2009-12-301-4/+12
| | | | | | | | | | | | | | | | | | IFF_POINTOPOINT link types. The reason was due to the routing entry returned from the kernel covering the remote end is of an interface type that does not support ARP. This patch fixes this problem by providing a hint to the kernel routing code, which indicates the prefix route instead of the PPP host route should be returned to the caller. Since a host route to the local end point is also added into the routing table, and there could be multiple such instantiations due to multiple PPP links can be created with the same local end IP address, this patch also fixes the loopback route installation failure problem observed prior to this patch. The reference count of loopback route to local end would be either incremented or decremented. The first instantiation would create the entry and the last removal would delete the route entry. MFC after: 5 days
* Use ALLOW_NEW_SOURCES and BLOCK_OLD_SOURCES to signal a join or leavebms2009-12-222-16/+60
| | | | | | | | | | | with SSM MLDv2 by default. This is current practice and complies with RFC 4604, as well as being required by production IPv6 networks in Japan. The behaviour may be disabled by setting the net.inet6.mld.use_allow sysctl/tunable to 0. Requested by: Hideki Yamamoto MFC after: 1 week
* Add missing #include <sys/ktr.h>.bms2009-12-151-0/+1
| | | | | Submitted by: Hideki Yamamoto MFC after: 1 week
* Throughout the network stack we have a few places ofbz2009-12-131-1/+1
| | | | | | | | | | | | | | | | | | if (jailed(cred)) left. If you are running with a vnet (virtual network stack) those will return true and defer you to classic IP-jails handling and thus things will be "denied" or returned with an error. Work around this problem by introducing another "jailed()" function, jailed_without_vnet(), that also takes vnets into account, and permits the calls, should the jail from the given cred have its own virtual network stack. We cannot change the classic jailed() call to do that, as it is used outside the network stack as well. Discussed with: julian, zec, jamie, rwatson (back in Sept) MFC after: 5 days
* Adapt r197136 to IPv6 stack:bms2009-11-191-2/+21
| | | | | | | Comment some flawed assumptions in in6p_join_group() about mixing SSM full-state and delta-based APIs. MFC after: 1 day
* Adapt r197135 to IPv6 stack:bms2009-11-191-8/+14
| | | | | | | | | | | | | Don't allow joins w/o source on an existing group. This is almost always pilot error. We don't need to check for group filter UNDEFINED state at t1, because we only ever allocate filters with their groups, so we unconditionally reject such calls with EINVAL. Trying to change the active filter mode w/o going through IPV6_MSFILTER is also disallowed. MFC after: 1 day
* Adapt r197132 to IPv6 stack:bms2009-11-191-15/+35
| | | | | | | | | | | | | | | | | Tighten input checking in in6p_join_group(): * Don't try to use the source address, when its family is unspecified. * If we get a join without a source, on an existing inclusive mode group, this is an error, as it would change the filter mode. Fix a problem with the handling of in6_mfilter for new memberships: * Do not rely on im6f being NULL; it is explicitly initialized to a non-NULL pointer when constructing a membership. * Explicitly initialize *im6f to EX mode when the source address is unspecified. This fixes a problem with in_mfilter slot recycling in the join path. MFC after: 1 day
* Adapt r197314 to IPv6 stack:bms2009-11-191-3/+5
| | | | | | | Return ENOBUFS consistently if user attempts to exceed in_mcast_maxsocksrc resource limit. MFC after: 1 day
* Adapt r197130 to IPv6 stack:bms2009-11-191-1/+3
| | | | | | | Fix an obvious logic error in the IPv4 multicast leave processing, where the filter mode vector was not updated correctly after the leave. MFC after: 1 day
* Adapt the fix for IGMPv2 in r199287 for the IPv6 stack.bms2009-11-191-8/+30
| | | | | | Only multicast routing is affected by the issue. MFC after: 1 day
* - We are not guaranteed that we're not dropping a reference thatume2009-11-121-11/+10
| | | | | | | | | | we did not add. Call LLE_REMREF() only when callout_stop() actually canceled a pending callout. - callout_reset() may cancel a pending callout. When callout_reset() canceled a pending callout, call LLE_REMREF() to drop a reference for the canceled callout. MFC after: 1 week
* CURVNET_RESTORE() was not called in certain cases.ume2009-11-111-1/+1
| | | | MFC after: 3 days
* Make nd6_llinfo_timer() does its job, again. ln->la_expire wasume2009-11-061-1/+1
| | | | | | greater than time_second, in most cases. MFC after: 3 days
* Don't call LLE_FREE() after nd6_free().ume2009-11-061-0/+1
| | | | MFC after: 3 days
* Use the correct option name in the preprocessor command to enableqingli2009-10-231-1/+1
| | | | | | | or disable diagnostic messages. Reviewed by: ru MFC after: 3 days
* Explicitly compare to a return code.bz2009-10-141-1/+1
| | | | | Discussed with: philip (after we both misread the logic there the 1st time) MFC after: 6 weeks
* - Do not assign a link-local address when ND6_IFF_IFDISABLED.hrs2009-10-121-0/+3
| | | | | | | | | | Adding a tentative address is useless. - Comment out a confused warning message when in6_ifattach_linklocal() fails. This can occur when the interface does not support ioctl(SIOCAIFADDR) (interfaces associated with 802.11 wireless network device drivers, for example).
* Virtualize the pfil hooks so that different jails may chose differentjulian2009-10-114-15/+17
| | | | | | | | packet filters. ALso allows ipfw to be enabled on on ejail and disabled on another. In 8.0 it's a global setting. Sitting aroung in tree waiting to commit for: 2 months MFC after: 2 months
* Enable adding a link-local address even if ND6_IFF_IFDISABLED.hrs2009-10-021-1/+0
| | | | | | Note that when the interface has ND6_IFF_IFDISABLED, a newly-added address is always marked as IN6_IFF_TENTATIVE so that the interface can perform DAD after the ND6_IFF_IFDISABLED is cleared.
* Support for VNET in SCTP (hopefully)rrs2009-09-171-4/+4
|
* Self pointing routes are installed for configured interface addressesqingli2009-09-151-39/+5
| | | | | | | | | | and address aliases. After an interface is brought down and brought back up again, those self pointing routes disappeared. This patch ensures after an interface is brought back up, the loopback routes are reinstalled properly. Reviewed by: bz MFC after: immediately
* Improve flexibility of receiving Router Advertisement andhrs2009-09-128-34/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | automatic link-local address configuration: - Convert a sysctl net.inet6.ip6.accept_rtadv to one for the default value of a per-IF flag ND6_IFF_ACCEPT_RTADV, not a global knob. The default value of the sysctl is 0. - Add a new per-IF flag ND6_IFF_AUTO_LINKLOCAL and convert a sysctl net.inet6.ip6.auto_linklocal to one for its default value. The default value of the sysctl is 1. - Make ND6_IFF_IFDISABLED more robust. It can be used to disable IPv6 functionality of an interface now. - Receiving RA is allowed if ip6_forwarding==0 *and* ND6_IFF_ACCEPT_RTADV is set on that interface. The former condition will be revisited later to support a "host + router" box like IPv6 CPE router. The current behavior is compatible with the older releases of FreeBSD. - The ifconfig(8) now supports these ND6 flags as well as "nud", "prefer_source", and "disabled" in ndp(8). The ndp(8) now supports "auto_linklocal". Discussed with: bz and jinmei Reviewed by: bz MFC after: 3 days
* The addresses that are assigned to the loopback interfaceqingli2009-09-051-4/+7
| | | | | | | should be part of the kernel routing table. Reviewed by: bz MFC after: immediately
* This patch fixes an address scope violation. Considering theqingli2009-09-051-0/+4
| | | | | | | | | | | | | | scenario where an anycast address is assigned on one interface, and a global address with the same scope is assigned on another interface. In other words, the interface owns the anycast address has only the link-local address as one other address. Without this patch, "ping6" the anycast address from another station will observe the source address of the returned ICMP6 echo reply has the link-local address, not the global address that exists on the other interface in the same node. Reviewed by: bz MFC after: immediately
OpenPOWER on IntegriCloud