summaryrefslogtreecommitdiffstats
path: root/sys/netinet
Commit message (Collapse)AuthorAgeFilesLines
* Make the default value of net.inet.ip.maxfragpackets andjesper2001-06-101-2/+3
| | | | | | | | net.inet6.ip6.maxfragpackets dependent on nmbclusters, defaulting to nmbclusters / 4 Reviewed by: bde MFC after: 1 week
* "Fix" the previous initial attempt at fixing TUNABLE_INT(). This timepeter2001-06-082-2/+2
| | | | | | | around, use a common function for looking up and extracting the tunables from the kernel environment. This saves duplicating the same function over and over again. This way typically has an overhead of 8 bytes + the path string, versus about 26 bytes + the path string.
* Move IPFilter into contrib.jlemon2001-06-0720-14535/+0
|
* Back out part of my previous commit. This was a last minute changepeter2001-06-072-2/+2
| | | | | and I botched testing. This is a perfect example of how NOT to do this sort of thing. :-(
* Make the TUNABLE_*() macros look and behave more consistantly like thepeter2001-06-062-4/+4
| | | | | SYSCTL_*() macros. TUNABLE_INT_DECL() was an odd name because it didn't actually declare the int, which is what the name suggests it would do.
* Silby's take one on increasing FreeBSD's resistance to SYN floods:jesper2001-06-062-2/+28
| | | | | | | | | | | | | | | | | | | One way we can reduce the amount of traffic we send in response to a SYN flood is to eliminate the RST we send when removing a connection from the listen queue. Since we are being flooded, we can assume that the majority of connections in the queue are bogus. Our RST is unwanted by these hosts, just as our SYN-ACK was. Genuine connection attempts will result in hosts responding to our SYN-ACK with an ACK packet. We will automatically return a RST response to their ACK when it gets to us if the connection has been dropped, so the early RST doesn't serve the genuine class of connections much. In summary, we can reduce the number of packets we send by a factor of two without any loss in functionality by ensuring that RST packets are not sent when dropping a connection from the listen queue. Submitted by: Mike Silbersack <silby@silby.com> Reviewed by: jesper MFC after: 2 weeks
* Add BSD-style copyright headersbrian2001-06-049-17/+253
| | | | Approved by: Charles Mott <cmott@scientech.com>
* Change to a standard BSD-style copyrightbrian2001-06-041-13/+22
| | | | Approved by: Atsushi Murai <amurai@spec.co.jp>
* Prevent denial of service using bogus fragmented IPv4 packets.jesper2001-06-031-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | A attacker sending a lot of bogus fragmented packets to the target (with different IPv4 identification field - ip_id), may be able to put the target machine into mbuf starvation state. By setting a upper limit on the number of reassembly queues we prevent this situation. This upper limit is controlled by the new sysctl net.inet.ip.maxfragpackets which defaults to 200, as the IPv6 case, this should be sufficient for most systmes, but you might want to increase it if you have lots of TCP sessions. I'm working on making the default value dependent on nmbclusters. If you want old behaviour (no upper limit) set this sysctl to a negative value. If you don't want to accept any fragments (not recommended) set the sysctl to 0 (zero). Obtained from: NetBSD MFC after: 1 week
* Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.kris2001-06-016-0/+234
| | | | | | | | | This closes a minor information leak which allows a remote observer to determine the rate at which the machine is generating packets, since the default behaviour is to increment a counter for each packet sent. Reviewed by: -net Obtained from: OpenBSD
* Back out jesper's 2001/05/31 14:58:11 PDT commit. It does not compile.obrien2001-06-011-31/+0
|
* Prevent denial of service using bogus fragmented IPv4 packets.jesper2001-05-311-0/+31
| | | | | | | | | | | | | | | | | | | | | A attacker sending a lot of bogus fragmented packets to the target (with different IPv4 identification field - ip_id), may be able to put the target machine into mbuf starvation state. By setting a upper limit on the number of reassembly queues we prevent this situation. This upper limit is controlled by the new sysctl net.inet.ip.maxfragpackets which defaults to NMBCLUSTERS/4 If you want old behaviour (no upper limit) set this sysctl to a negative value. If you don't want to accept any fragments (not recommended) set the sysctl to 0 (zero) Obtained from: NetBSD (partially) MFC after: 1 week
* Disable rfc1323 and rfc1644 TCP extensions if we havn't gotjesper2001-05-311-0/+9
| | | | | | | | | | | | any response to our third SYN to work-around some broken terminal servers (most of which have hopefully been retired) that have bad VJ header compression code which trashes TCP segments containing unknown-to-them TCP options. PR: kern/1689 Submitted by: jesper Reviewed by: wollman MFC after: 2 weeks
* Add an integer field to keep protocol-specific flags with links.ru2001-05-303-15/+20
| | | | | | | | | | For FTP control connection, keep the CRLF end-of-line termination status in there. Fixed the bug when the first FTP command in a session was ignored. PR: 24048 MFC after: 1 week
* Inline TCP_REASS() in the single location where it's used,jesper2001-05-292-66/+60
| | | | | | | | just as OpenBSD and NetBSD has done. No functional difference. MFC after: 2 weeks
* properly delay acks in half-closed TCP connectionsjesper2001-05-292-2/+2
| | | | | | PR: 24962 Submitted by: Tony Finch <dot@dotat.at> MFC after: 2 weeks
* In in_ifadown(), differentiate between whether the interface goesru2001-05-114-11/+15
| | | | | | | down or interface address is deleted. Only delete static routes in the latter case. Reported by: Alexander Leidinger <Alexander@leidinger.net>
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-2/+4
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Say goodbye to TCP_COMPAT_42jesper2001-04-207-73/+0
| | | | | Reviewed by: wollman Requested by: wollman
* Randomize the TCP initial sequence numbers more thoroughly.kris2001-04-178-8/+161
| | | | | Obtained from: OpenBSD Reviewed by: jesper, peter, -developers
* fix security hole created by fragment cachedarrenr2001-04-065-10/+36
|
* pipe/queue are the only consumers of flow_id, so only set it in those casesbillf2001-04-061-1/+1
|
* MFC candidate.jesper2001-03-283-3/+5
| | | | | | | | | | | | | Change code from PRC_UNREACH_ADMIN_PROHIB to PRC_UNREACH_PORT for ICMP_UNREACH_PROTOCOL and ICMP_UNREACH_PORT And let TCP treat PRC_UNREACH_PORT like PRC_UNREACH_ADMIN_PROHIB This should fix the case where port unreachables for udp returned ENETRESET instead of ECONNREFUSED Problem found by: Bill Fenner <fenner@research.att.com> Reviewed by: jlemon
* MAN[1-9] -> MAN.ru2001-03-271-1/+1
|
* Add a missing m_pullup() before a mtod() in in_arpinput().yar2001-03-271-0/+6
| | | | | PR: kern/22177 Reviewed by: wollman
* Replace dyn_fin_lifetime with dyn_ack_lifetime for half-closed state.simokawa2001-03-271-1/+1
| | | | | | | Half-closed state could last long for some connections and fin_lifetime (default 20sec) is too short for that. OK'ed by: luigi
* Send the remains (such as I have located) of "block major numbers" tophk2001-03-261-1/+0
| | | | the bit-bucket.
* Make header files conform to style(9).brian2001-03-256-326/+311
| | | | | | Reviewed by (*): bde (*) alias_local.h only got a cursory glance.
* Remove an extraneous declaration.brian2001-03-251-1/+0
|
* IPv4 address is not unsigned int. This change introduces in_addr_t.ume2001-03-231-1/+1
| | | | | | | PR: 9982 Adviced by: des Reviewed by: -alpha and -net (no objection) Obtained from: OpenBSD
* Remove (non-protected) variable names from function prototypes.brian2001-03-221-7/+5
|
* Only flush rules that have a rule number above that set by a newpaul2001-03-211-8/+17
| | | | | | | | | | | sysctl, net.inet.ip.fw.permanent_rules. This allows you to install rules that are persistent across flushes, which is very useful if you want a default set of rules that maintains your access to remote machines while you're reconfiguring the other rules. Reviewed by: Mark Murray <markm@FreeBSD.org>
* Axe TCP_RESTRICT_RST. It was never a particularly good idea except for a fewdes2001-03-192-24/+2
| | | | | | | very specific scenarios, and now that we have had net.inet.tcp.blackhole for quite some time there is really no reason to use it any more. (last of three commits)
* Invalidate cached forwarding route (ipforward_rt) whenever a new routeru2001-03-193-1/+14
| | | | | | | | is added to the routing table, otherwise we may end up using the wrong route when forwarding. PR: kern/10778 Reviewed by: silence on -net
* Make sure the cached forwarding route (ipforward_rt) is still up beforeru2001-03-181-19/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | using it. Not checking this may have caused the wrong IP address to be used when processing certain IP options (see example below). This also caused the wrong route to be passed to ip_output() when forwarding, but fortunately ip_output() is smart enough to detect this. This example demonstrates the wrong behavior of the Record Route option observed with this bug. Host ``freebsd'' is acting as the gateway for the ``sysv''. 1. On the gateway, we add the route to the destination. The new route will use the primary address of the loopback interface, 127.0.0.1: : freebsd# route add 10.0.0.66 -iface lo0 -reject : add host 10.0.0.66: gateway lo0 2. From the client, we ping the destination. We see the correct replies. Please note that this also causes the relevant route on the ``freebsd'' gateway to be cached in ipforward_rt variable: : sysv# ping -snv 10.0.0.66 : PING 10.0.0.66: 56 data bytes : ICMP Host Unreachable from gateway 192.168.0.115 : ICMP Host Unreachable from gateway 192.168.0.115 : ICMP Host Unreachable from gateway 192.168.0.115 : : ----10.0.0.66 PING Statistics---- : 3 packets transmitted, 0 packets received, 100% packet loss 3. On the gateway, we delete the route to the destination, thus making the destination reachable through the `default' route: : freebsd# route delete 10.0.0.66 : delete host 10.0.0.66 4. From the client, we ping destination again, now with the RR option turned on. The surprise here is the 127.0.0.1 in the first reply. This is caused by the bug in ip_rtaddr() not checking the cached route is still up befor use. The debug code also shows that the wrong (down) route is further passed to ip_output(). The latter detects that the route is down, and replaces the bogus route with the valid one, so we see the correct replies (192.168.0.115) on further probes: : sysv# ping -snRv 10.0.0.66 : PING 10.0.0.66: 56 data bytes : 64 bytes from 10.0.0.66: icmp_seq=0. time=10. ms : IP options: <record route> 127.0.0.1, 10.0.0.65, 10.0.0.66, : 192.168.0.65, 192.168.0.115, 192.168.0.120, : 0.0.0.0(Current), 0.0.0.0, 0.0.0.0 : 64 bytes from 10.0.0.66: icmp_seq=1. time=0. ms : IP options: <record route> 192.168.0.115, 10.0.0.65, 10.0.0.66, : 192.168.0.65, 192.168.0.115, 192.168.0.120, : 0.0.0.0(Current), 0.0.0.0, 0.0.0.0 : 64 bytes from 10.0.0.66: icmp_seq=2. time=0. ms : IP options: <record route> 192.168.0.115, 10.0.0.65, 10.0.0.66, : 192.168.0.65, 192.168.0.115, 192.168.0.120, : 0.0.0.0(Current), 0.0.0.0, 0.0.0.0 : : ----10.0.0.66 PING Statistics---- : 3 packets transmitted, 3 packets received, 0% packet loss : round-trip (ms) min/avg/max = 0/3/10
* <sys/queue.h> makeover.phk2001-03-166-56/+48
|
* Fix a style(9) nit.phk2001-03-161-1/+1
|
* net/route.c:ru2001-03-152-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A route generated from an RTF_CLONING route had the RTF_WASCLONED flag set but did not have a reference to the parent route, as documented in the rtentry(9) manpage. This prevented such routes from being deleted when their parent route is deleted. Now, for example, if you delete an IP address from a network interface, all ARP entries that were cloned from this interface route are flushed. This also has an impact on netstat(1) output. Previously, dynamically created ARP cache entries (RTF_STATIC flag is unset) were displayed as part of the routing table display (-r). Now, they are only printed if the -a option is given. netinet/in.c, netinet/in_rmx.c: When address is removed from an interface, also delete all routes that point to this interface and address. Previously, for example, if you changed the address on an interface, outgoing IP datagrams might still use the old address. The only solution was to delete and re-add some routes. (The problem is easily observed with the route(8) command.) Note, that if the socket was already bound to the local address before this address is removed, new datagrams generated from this socket will still be sent from the old address. PR: kern/20785, kern/21914 Reviewed by: wollman (the idea)
* RFC768 (UDP) requires that "if the computed checksum is zero, itru2001-03-131-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | is transmitted as all ones". This got broken after introduction of delayed checksums as follows. Some guys (including Jonathan) think that it is allowed to transmit all ones in place of a zero checksum for TCP the same way as for UDP. (The discussion still takes place on -net.) Thus, the 0 -> 0xffff checksum fixup was first moved from udp_output() (see udp_usrreq.c, 1.64 -> 1.65) to in_cksum_skip() (see sys/i386/i386/in_cksum.c, 1.17 -> 1.18, INVERT expression). Besides that I disagree that it is valid for TCP, there was no real problem until in_cksum.c,v 1.20, where the in_cksum() was made just a special version of in_cksum_skip(). The side effect was that now every incoming IP datagram failed to pass the checksum test (in_cksum() returned 0xffff when it should actually return zero). It was fixed next day in revision 1.21, by removing the INVERT expression. The latter also broke the 0 -> 0xffff fixup for UDP checksums. Before this change: : tcpdump: listening on lo0 : 127.0.0.1.33005 > 127.0.0.1.33006: udp 0 (ttl 64, id 1) : 4500 001c 0001 0000 4011 7cce 7f00 0001 : 7f00 0001 80ed 80ee 0008 0000 After this change: : tcpdump: listening on lo0 : 127.0.0.1.33005 > 127.0.0.1.33006: udp 0 (ttl 64, id 1) : 4500 001c 0001 0000 4011 7cce 7f00 0001 : 7f00 0001 80ed 80ee 0008 ffff
* Count and show incoming UDP datagrams with no checksum.ru2001-03-131-1/+2
|
* Correctly cleanup in case of failure to bind a pcb.phk2001-03-121-7/+10
| | | | | PR: 25751 Submitted by: <unicorn@Forest.Od.UA>
* Unbreak LINT.jlemon2001-03-121-5/+17
| | | | Pointed out by: phk
* In ip_output(), initialise `ia' in the case where the packet hasiedowse2001-03-111-0/+1
| | | | | | | | | come from a dummynet pipe. Without this, the code which increments the per-ifaddr stats can dereference an uninitialised pointer. This should make dummynet usable again. Reported by: "Dmitry A. Yanko" <fm@astral.ntu-kpi.kiev.ua> Reviewed by: luigi, joe
* Make it possible to use IP_TTL and IP_TOS setsockopt(2) optionsru2001-03-092-3/+4
| | | | | | | | | on certain types of SOCK_RAW sockets. Also, use the ip.ttl MIB variable instead of MAXTTL constant as the default time-to-live value for outgoing IP packets all over the place, as we already do this for TCP and UDP. Reviewed by: wollman
* Push the test for a disconnected socket when accept()ing down to thejlemon2001-03-091-0/+8
| | | | | protocol layer. Not all protocols behave identically. This fixes the brokenness observed with unix-domain sockets (and postfix)
* The TCP sequence number used for sending a RST with the ipfw reset rulejlemon2001-03-091-1/+1
| | | | | | is already in host byte order, so do not swap it again. Reviewed by: bfumerola
* It was possible for ip_forward() to supply to icmp_error()iedowse2001-03-082-8/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | an IP header with ip_len in network byte order. For certain values of ip_len, this could cause icmp_error() to write beyond the end of an mbuf, causing mbuf free-list corruption. This problem was observed during generation of ICMP redirects. We now make quite sure that the copy of the IP header kept for icmp_error() is stored in a non-shared mbuf header so that it will not be modified by ip_output(). Also: - Calculate the correct number of bytes that need to be retained for icmp_error(), instead of assuming that 64 is enough (it's not). - In icmp_error(), use m_copydata instead of bcopy() to copy from the supplied mbuf chain, in case the first 8 bytes of IP payload are not stored directly after the IP header. - Sanity-check ip_len in icmp_error(), and panic if it is less than sizeof(struct ip). Incoming packets with bad ip_len values are discarded in ip_input(), so this should only be triggered by bugs in the code, not by bad packets. This patch results from code and suggestions from Ruslan, Bosko, Jonathan Lemon and Matt Dillon, with important testing by Mike Tancsa, who could reproduce this problem at will. Reported by: Mike Tancsa <mike@sentex.net> Reviewed by: ru, bmilekic, jlemon, dillon
* Modify the comments to more closely resemble the English language.truckman2001-03-051-5/+4
|
* Move the loopback net check closer to the beginning of ip_input() so thattruckman2001-03-051-14/+26
| | | | | | | it doesn't block packets whose destination address has been translated to the loopback net by ipnat. Add warning comments about the ip_checkinterface feature.
* During a flood, we don't call rtfree(), but we remove the entry ourselves.bmilekic2001-03-041-13/+7
| | | | | | | | | | | | | | | However, if the RTF_DELCLONE and RTF_WASCLONED condition passes, but the ref count is > 1, we won't decrement the count at all. This could lead to route entries never being deleted. Here, we call rtfree() not only if the initial two conditions fail, but also if the ref count is > 1 (and we therefore don't immediately delete the route, but let rtfree() handle it). This is an urgent MFC candidate. Thanks go to Mike Silbersack for the fix, once again. :-) Submitted by: Mike Silbersack <silby@silby.com>
OpenPOWER on IntegriCloud