summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* MFC r275716:Luiz Otavio O Souza2015-10-203-5/+0
| | | | | | | | | | | Do not count security policy violation twice. ipsec*_in_reject() do this by their own. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275713:Luiz Otavio O Souza2015-10-201-31/+3
| | | | | | | | | | | | Use ipsec4_in_reject() to simplify ip_ipsec_fwd() and ip_ipsec_input(). ipsec4_in_reject() does the same things, also it counts policy violation errors. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275710:Luiz Otavio O Souza2015-10-203-8/+6
| | | | | | | | | | | | | | | | Remove flag/flags argument from the following functions: ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275708:Luiz Otavio O Souza2015-10-201-1/+1
| | | | | | | | | | | | Remove flags and tunalready arguments from ipsec4_process_packet() and make its prototype similar to ipsec6_process_packet. The flags argument isn't used here, tunalready is always zero. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275704:Luiz Otavio O Souza2015-10-202-30/+19
| | | | | | | | | | | | | | | | | | | | | | Move ip_ipsec_fwd() from ip_input() into ip_forward(). Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is already handled by IPSEC code. This means that before IPSEC processing it was destined to our address and security policy was checked in the ip_ipsec_input(). After IPSEC processing packet has new IP addresses and destination address isn't our own. So, anyway we can't check security policy from the mbuf tag, because it corresponds to different addresses. We should check security policy that corresponds to packet attributes in both cases - when it has a mbuf tag and when it has not. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275703:Luiz Otavio O Souza2015-10-203-25/+9
| | | | | | | | | | | | | | | | | | | | | Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of its security policy. The changed block of code in ip*_ipsec_input() is called when packet has ESP/AH header. Presence of PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that packet was already handled by IPSEC and reinjected in the netisr, and it has another ESP/AH headers (encrypted twice?). Since it was already processed by IPSEC code, the AH/ESP headers was already stripped (and probably outer IP header was stripped too) and security policy from the tdb_ident was applied to those headers. It is incorrect to apply this security policy to current headers. Also make ip_ipsec_input() prototype similar to ip6_ipsec_input(). Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275702:Luiz Otavio O Souza2015-10-201-49/+6
| | | | | | | | | | | | | | | | | | | Remove check for presence of PACKET_TAG_IPSEC_PENDING_TDB and PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED mbuf tags. They aren't used in FreeBSD. Instead check presence of PACKET_TAG_IPSEC_OUT_DONE mbuf tag. If it is found, bypass security policy lookup as described in the comment. PACKET_TAG_IPSEC_OUT_DONE tag added to mbuf when IPSEC code finishes ESP/AH processing. Since it was already finished, this means the security policy placed in the tdb_ident was already checked. And there is no reason to check it again here. Obtained from: Yandex LLC Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r272177:Luiz Otavio O Souza2015-10-201-13/+0
| | | | | | | | | | | | drop unnecessary ifdef IPSEC's. This file is only compiled when IPSEC is defined... Differential Revision: D839 Reviewed by: bz, glebius, gnn Sponsered by: EuroBSDCon DevSummit TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-204-27/+16
| | | | | | | | | Revert "Importing pfSense patch IPSEC_sysctl.RELENG_10.diff" This reverts commit 1a5bcc816de96758225aa0a4d2b5ddc7b88b6b58. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-201-4/+20
| | | | | | | | | Revert "Importing pfSense patch ipsec_improvement.diff" This reverts commit 29b5f15dd163f4c415bb883fef4a53cf17f9e4e2. TAG: IPSEC-HEAD Issue: #4841
* Merge branch 'stable/10' into develRenato Botelho2015-10-131-1/+11
|\
| * MFC r287775:hselasky2015-10-081-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Update TSO limits to include all headers. To make driver programming easier the TSO limits are changed to reflect the values used in the BUSDMA tag a network adapter driver is using. The TCP/IP network stack will subtract space for all linklevel and protocol level headers and ensure that the full mbuf chain passed to the network adapter fits within the given limits. See r287775 for a more detailed description. Differential Revision: https://reviews.freebsd.org/D3477 Reviewed by: rmacklem
* | Merge branch 'stable/10' into develRenato Botelho2015-10-071-1/+1
|\ \ | |/
| * MFC r287830hiren2015-10-021-1/+1
| | | | | | | | Remove unnecessary tcp state transition call.
* | Merge branch 'stable/10' into develRenato Botelho2015-09-221-1/+1
|\ \ | |/
| * MFC r266310melifaro2015-09-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix wrong formatting of 0.0.0.0/X table records in ipfw(8). Add `flags` u16 field to the hole in ipfw_table_xentry structure. Kernel has been guessing address family for supplied record based on xent length size. Userland, however, has been getting fixed-size ipfw_table_xentry structures guessing address family by checking address by IN6_IS_ADDR_V4COMPAT(). Fix this behavior by providing specific IPFW_TCF_INET flag for IPv4 records. PR: bin/189471,kern/200169
* | Revert "Importing pfSense patch ipsec_fwd_check.diff"Luiz Otavio O Souza2015-08-201-1/+1
| | | | | | | | | | | | | | This reverts commit 2fb6d009cccdaf8b780594600da81d5910168a3e. Until we get some facts about this change, let's remove it and reduce our differences with FreeBSD.
* | Importing pfSense patch ipsec_fwd_check.diffRenato Botelho2015-08-171-1/+1
| |
* | Importing pfSense patch redmine_4607.diffRenato Botelho2015-08-171-34/+36
| |
* | Importing pfSense patch set_ifaddr_first.diffRenato Botelho2015-08-171-1/+10
| |
* | Importing pfSense patch ipsec_improvement.diffRenato Botelho2015-08-171-20/+4
| |
* | Importing pfSense patch CP_multi_instance_ipfw.diffRenato Botelho2015-08-171-1/+8
| |
* | Importing pfSense patch CP_speedup.diffRenato Botelho2015-08-171-1/+14
| |
* | Importing pfSense patch divert.RELENG_10.diffRenato Botelho2015-08-171-9/+6
| |
* | Importing pfSense patch if_pfsync.diffRenato Botelho2015-08-171-2/+4
| |
* | Importing pfSense patch ip_dstchng_fix.diffRenato Botelho2015-08-171-2/+1
| |
* | Importing pfSense patch carp_replay_protection.diffRenato Botelho2015-08-171-14/+17
| |
* | Importing pfSense patch IPSEC_sysctl.RELENG_10.diffRenato Botelho2015-08-174-16/+27
| |
* | Importing pfSense patch route-to_without_gw.diffRenato Botelho2015-08-171-15/+21
| |
* | Importing pfSense patch carp_correct_mac.diffRenato Botelho2015-08-171-2/+29
| |
* | Importing pfSense patch pfil.RELENG_10.diffRenato Botelho2015-08-171-0/+3
|/
* MFC r285669:kevlo2015-07-311-10/+11
| | | | | | | | | | | Since the IETF has redefined the meaning of the tos field to accommodate a set of differentiated services, set IPTOS_PREC_* macros using IPTOS_DSCP_* macro definitions. While here, add IPTOS_DSCP_VA macro according to RFC 5865. Differential Revision: https://reviews.freebsd.org/D3119 Reviewed by: gnn
* MFC 285325eri2015-07-291-1/+2
| | | | | | Correct issue presented in r285051 by properly initializing variable. Differential Revision: https://reviews.freebsd.org/D3036
* MFC r285051eri2015-07-291-17/+18
| | | | | | Avoid doing multiple route lookups for the same destination IP during forwarding. Differential Revision: https://reviews.freebsd.org/D2964
* Fix patch(1) shell injection vulnerability. [SA-15:14]delphij2015-07-283-42/+27
| | | | | | Fix resource exhaustion in TCP reassembly. [SA-15:15] Fix OpenSSH multiple vulnerabilities. [SA-15:16]
* MFC r284941:hiren2015-07-221-0/+24
| | | | | | | | | | | Avoid a situation where we do not set persist timer after a zero window condition. If you send a 0-length packet, but there is data is the socket buffer, and neither the rexmt or persist timer is already set, then activate the persist timer. PR: 192599 Approved by: re (delphij)
* Fix resource exhaustion due to sessions stuck in LAST_ACK state.delphij2015-07-211-2/+9
| | | | | | | Security: CVE-2015-5358 Security: SA-15:13.tcp Submitted by: Jonathan Looney (Juniper SIRT) Approved by: re (so blanket)
* MFC r285567:pkelsey2015-07-211-0/+1
| | | | | | | | Check TCP timestamp option flag so that the automatic receive buffer scaling code does not use an uninitialized timestamp echo reply value from the stack when timestamps are not enabled. Approved by: re (gjb)
* MFC r284512: Properly handle locking on the ARP protocol request sending.eri2015-06-241-3/+12
|
* MFC r284596:tuexen2015-06-221-9/+16
| | | | When setting the primary address, return an error whenever it fails.
* MFC r284526:tuexen2015-06-201-3/+6
| | | | | Fix a bug related to flow assignment I introduced in https://svnweb.freebsd.org/base?view=revision&revision=275483
* MFC r284515:tuexen2015-06-2011-45/+62
| | | | | | | Add FIB support for SCTP. This fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=200379 PR: 200379
* MFC r266420 (by adrian)hiren2015-06-192-0/+2
| | | | | | | | Ensure that the flowid hashtype is assigned to the inp if the flowid is also assigned. Spotted by: gallatin Tested by: gallatin
* MFC r284393:tuexen2015-06-171-9/+16
| | | | Correctly detect the case where the last address is removed.
* MFC r284384:tuexen2015-06-171-0/+1
| | | | | | | Stop the heartbeat timer when removing a net. Thanks to the reporter of https://code.google.com/p/sctp-refimpl/issues/detail?id=14 for reporting the issue.
* MFC r280991:hselasky2015-06-171-8/+11
| | | | | | | | | | | | | | | | | | | Extend fixes made in r278103 and r38754 by copying the complete packet header and not only partial flags and fields. Firewalls can attach classification tags to the outgoing mbufs which should be copied to all the new fragments. Else only the first fragment will be let through by the firewall. This can easily be tested by sending a large ping packet through a firewall. It was also discovered that VLAN related flags and fields should be copied for packets traversing through VLANs. This is all handled by "m_dup_pkthdr()". Regarding the MAC policy check in ip_fragment(), the tag provided by the originating mbuf is copied instead of using the default one provided by m_gethdr(). Tested by: Karim Fodil-Lemelin <fodillemlinkarim at gmail.com> Sponsored by: Mellanox Technologies PR: 7802
* MFC r284332:tuexen2015-06-161-2/+2
| | | | Fix the reporting of the PMTUD state for specific paths.
* MFC r284331:tuexen2015-06-161-68/+45
| | | | Code cleanup.
* MFC r284326:tuexen2015-06-161-2/+11
| | | | | | | | | | | | | | | In case of an output error, continue with the next net, don't try to continue sending on the same net. This fixes a bug where an invalid mbuf chain was constructed, if a full size frame of control chunks should be sent and there is a output error. Based on a discussion with rrs@, change move to the next net. This fixes the bug and improves the behaviour. Thanks to Irene Ruengeler for spending a lot of time in narrowing this problem down.
* MFC r284245:jch2015-06-112-15/+45
| | | | | | | Fix a callout race condition introduced in TCP timers callouts with r281599. In TCP timer context, it is not enough to check callout_stop() return value to decide if a callout is still running or not, previous callout_reset() return values have also to be checked.
OpenPOWER on IntegriCloud