fd5e7077a3
allocate ipsec policy buffer attached to pcb in in*_pcballoc, before
...
giving anyone accesses to pcb (do not reveal an inconsistent ones).
sync with kame
2001-07-25 23:28:02 +00:00
a21ce80cd6
ifindex2ifnet could return NULL if if_detach() is used (pcmcia card
...
removal and such).
2001-07-25 09:23:46 +00:00
0cd424b3ce
ifidex2ifnet could contain NULL after if_detach(). sync with kame
2001-07-25 06:59:51 +00:00
19392ee73b
fix comment on setsockopt arg size. KAME PR 369
2001-07-24 00:44:36 +00:00
bee33e3d00
repair scoped address handling in PRU_BIND. sync with kame.
2001-07-23 19:29:53 +00:00
a9356936b4
seperate -> separate
2001-07-22 13:33:58 +00:00
7f070caa75
sync rt_ifp check with IPv4 counterpart (see sys/net/if_ethersubr.c 1.27).
...
sync with kame
2001-07-20 20:26:35 +00:00
8c9f492242
do not malloc() during interrupt context for IPv6 multicast kludge table.
...
malloc() during interface initialization. sync with kame
2001-07-18 13:12:27 +00:00
fc35f336c7
sync with draft-ietf-ipngwg-p2p-pingpong-00.txt. apply special behavior
...
only if ip6_dst is "neighbor" within p2p prefix. sync with kame
2001-07-18 09:24:26 +00:00
5e920039c6
have ovbcopy() macro, for cross-BSD compatibility only.
2001-07-07 14:45:46 +00:00
193167b1eb
call in{,6}_pcbpurgeif0() before in{,6}_purgeif().
2001-07-03 08:06:19 +00:00
1ff38f4d03
on interface removal, remove multicast groups joined from pcb, before
...
removing interface addresses. without the change, we may deref
NULL pointer in in_pcbpurgeif(). from jinmei@kame, sync with kame
2001-07-02 15:25:34 +00:00
03927c60a5
call defrouter_select() only if it is autoconfigured host.
2001-06-29 16:01:47 +00:00
02c94ca414
refresh default router list on nd6_detach(), only if we are an
...
autoconfigured host. bug was that, we will lose default route on
"ifconfig gif0 destroy" even if default is not pointing to gif0.
reported by ume@mahoroba.org . sync with kame
2001-06-27 17:36:14 +00:00
9ccf08b3c5
netbsd; on interface removal, force pcbs to leave from multicast groups
...
pointing toward the interface about to be removed. sync with kame
XXX still need more discussions on semantics. the behavior should be safer
2001-06-27 15:53:14 +00:00
77a4124f7d
the documents are out of sync with the latest situation. remove them.
2001-06-24 19:40:35 +00:00
885b74c2be
select default router again, when L2 address of the router changes
2001-06-22 13:36:12 +00:00
0213b76857
remove RFC1885 compatibility code in #ifdef COMPAT_RFC1885, for icmp6
...
reply packet size consideration (obsolete, not used for a long time).
sync with kame
2001-06-22 13:01:49 +00:00
57d1913ebc
do not forward packet back to point-to-point interface, if the packet
...
matches the ipv6 prefix assigned to the p2p interface (= redirect case).
this leads to pingpong, chews bandwidth. bad thing is that bad guy from
remote can chew bandwidth. (follows upcoming internet draft)
2001-06-22 12:33:05 +00:00
ccfe29f3cf
Symmetric has one s and two m's.
2001-06-18 11:23:00 +00:00
5571e920d6
senderr needs only be declared when PFIL_HOOKS is defined
2001-06-12 17:55:52 +00:00
bdbfdf946d
run pfil_hooks for IPv6 forwarding path (note: ip6_forward() does not
...
call ip6_output()).
2001-06-12 15:12:33 +00:00
8b646a5273
remove IPV6FIREWALL case, which is never used
2001-06-11 13:49:18 +00:00
40ac848024
Fix various misspellings of compatible/compatibility.
2001-06-11 01:50:48 +00:00
6a536c0364
fix a IPNOPRIVPORTS unused variable botch. noted by proff.
2001-06-06 06:07:06 +00:00
ad9d3794b0
Implement support for IP/TCP/UDP checksum offloading provided by
...
network interfaces. This works by pre-computing the pseudo-header
checksum and caching it, delaying the actual checksum to ip_output()
if the hardware cannot perform the sum for us. In-bound checksums
can either be fully-checked by hardware, or summed up for final
verification by software. This method was modeled after how this
is done in FreeBSD, although the code is significantly different in
most places.
We don't delay checksums for IPv6/TCP, but we do take advantage of the
cached pseudo-header checksum.
Note: hardware-assisted checksumming defaults to "off". It is
enabled with ifconfig(8). See the manual page for details.
Implement hardware-assisted checksumming on the DP83820 Gigabit Ethernet,
3c90xB/3c90xC 10/100 Ethernet, and Alteon Tigon/Tigon2 Gigabit Ethernet.
2001-06-02 16:17:09 +00:00
781f6920ab
use default hoplimit when incoming interface is not given to icmp6_reflect.
...
sync with kame
2001-06-01 05:54:19 +00:00
67afbd6270
use _KERNEL_OPT
2001-05-30 11:57:16 +00:00
c973d6a0eb
Skip the pseudo-header if nxt == 0. This is already documented
...
in in6_cksum(9) and is also the behavior of the i386 optimized
version.
2001-05-30 03:06:56 +00:00
e91c2ce847
remove debug printfs, which can be too noisy. sync with kame.
2001-05-27 17:36:07 +00:00
fc644273cd
print more diag message on in6_addmulti() failures.
2001-05-24 08:17:22 +00:00
a7596d1912
call icmp6_mtudisc_update(foo, 0) even if ICMPv6 messages are very short.
...
let icmp6 layer decide whether we take PMTUD routes or not.
2001-05-24 07:22:27 +00:00
fc66251bda
plug memory leak on invalid fragment packet. supress noisy log. from kame
2001-05-17 14:01:37 +00:00
498fdebcd7
drop multi destination mode (IFF_LINK0).
2001-05-14 13:35:20 +00:00
f4d5905544
there's no need to #if NFAITH here. IN6P_FAITH can be set even on
...
NFAITH == 0 kernel, it is safer to always check the condition.
sync with kame.
2001-05-11 18:38:03 +00:00
63181d71c1
correct ecn consideration on tunnel encap/decap. sync with kame.
2001-05-10 01:37:42 +00:00
1bec764d78
correct faith prefix determination. use sys/netinet/if_faith.c:faithprefix()
...
to determine. sync with kame.
(without this change, non-faith socket may mistakenly accept for-faith traffic)
2001-05-08 10:15:13 +00:00
d1b6307b88
do not copy TTL field on ipsec tunnel mode encapsulation. sync with kame
2001-04-15 01:55:49 +00:00
bf2dcec4f5
Remove the use of splimp() from the NetBSD kernel. splnet()
...
and only splnet() is allowed for the protection of data structures
used by network devices.
2001-04-13 23:29:55 +00:00
f4e4c674a7
disallow userland programs from specifying addresses with IPV6_PKTINFO
...
setsockopt, if:
- the address is not verified by DAD (= not ready)
- the address is an anycast address (= not permitted as source)
sync with kame
2001-04-11 04:57:53 +00:00
5ed8fd262b
suppress RS/RA log messages (can be re-enabled by net.inet6.icmp6.nd6_debug),
...
as they may fill up /var. sync with kame.
2001-04-04 06:28:41 +00:00
2abaa8eae5
make sure rcvif is sane on call to icmp6_reflect
2001-04-04 06:28:40 +00:00
92969654c0
enable FAKE_LOOPBACK_IF case by default.
...
now traffic on loopback interface will be presented to bpf as normal wire
format packet (without KAME scopeid in s6_addr16[1]).
fix KAME PR 250 (host mistakenly accepts packets to fe80::x%lo0).
sync with kame.
2001-03-30 11:08:56 +00:00
dbcd4b8d03
fix constness of IN6_{IS,ARE}_xx with RFC2553. sync with kame.
2001-03-30 05:53:52 +00:00
2fb1887b31
re-initialize mopt in ip6_insert_jumboopt(). sync with kame
...
From: csapuntz@stanford.edu
2001-03-25 09:58:43 +00:00
0c8d8ae7a0
couple of missing splx. sync with kame.
...
From: csapuntz@play-doh.stanford.edu (Constantine Sapuntzakis)
2001-03-25 09:06:03 +00:00
3e898c9239
in nd6_cache_lladdr(), set nd6_gctimer to ln_expire just after the state
...
transition to STALE. fixes tahi test breakage. sync with kame.
2001-03-21 21:56:29 +00:00
20fe4e2d96
Add a protosw flag, PR_ABRTACPTDIS (Abort on Accept of Disconnected
...
Socket), and add it to the protocols that use that behavior (all
PR_LISTEN protocols except for PF_LOCAL stream sockets).
2001-03-21 19:22:27 +00:00
4ce63adb1e
do not inject packets to ipfilter, if the packet went through IPsec tunnel.
...
http://www.netbsd.org/Documentation/network/ipsec/#ipf-interaction
2001-03-21 19:12:56 +00:00
93b8b31feb
set rmx_mtu to L2 interface mtu, instead of 0, on mtudisc timeout.
...
ip6_output() change is for safety. sync with kame
2001-03-21 07:52:13 +00:00
e4ecd03f2a
drop packets with link-local addresses,
...
if (internally-used) interface ID portion is already filled. sync with kame
2001-03-16 12:22:34 +00:00
27a0af5865
nd6_storelladdr() was not consistent about m_freem() policy.
...
do not touch RTF_STATIC entries (static ND entries) on ND cache update.
couple of costmetic sync. sync with kame
2001-03-08 10:49:32 +00:00
7695280d34
more missing splx. from kame
2001-03-08 10:48:40 +00:00
912f42ecda
remove bogus rtfree. sync with kame. inspired by openbsd PR 1706.
2001-03-08 00:19:03 +00:00
4e45315377
missing splx. from aaron@openbsd. sync with kame
2001-03-07 22:50:14 +00:00
c9e08725bc
avoid possible alignment issue. sync with kame
2001-03-04 16:49:17 +00:00
dc3424f555
pass key to rijndael logic as binary, not hexadecimal string.
...
sync with kame
2001-03-02 15:42:39 +00:00
f03176a0a8
have comment that refers to kame COVERAGE document. sync with kame
2001-03-02 04:55:40 +00:00
8c8c2f71a4
the date string in KAME version is getting very meaningless, remove.
2001-03-02 04:52:54 +00:00
2d6047cff9
make sure to enforce inbound ipsec policy checking, for any protocols on top
...
of ip (check it when final header is visited). sync with kame.
XXX kame team will need to re-check policy engine code
2001-03-01 16:31:37 +00:00
233e3963ed
make sure to validate packet against ipsec policy.
2001-02-26 07:20:44 +00:00
023e9f0649
C requires that labels be followed by statements.
2001-02-24 00:01:22 +00:00
f2a66201fc
garbage-collect stale ND entries (default: 1 day).
...
RFC 2461 5.3. sync with kame.
2001-02-23 08:02:41 +00:00
e1196a8f6e
remove unnecessary state, ND6_LLINFO_WAITDELETE, from neighbor cache
...
state machine.
no need for RTF_REJECT on neighbor cache entires, they are leftover from
ARP code.
sync with kame.
2001-02-23 06:41:50 +00:00
2df943e652
correct handling of upper limitation to # of reass queue.
2001-02-22 05:04:42 +00:00
49889b3afd
be more more picky about option length parsing. sync with kame
2001-02-22 01:40:25 +00:00
e1e316562b
make validation code more strict for ND6/dest6 variable length headers.
...
check duplicated nd6_ifinfo table initialization in a better way.
sync with kame
2001-02-21 17:23:09 +00:00
96413230d1
style, to make kame sync easier
2001-02-21 16:28:43 +00:00
52f2cece9f
tighten AH IPv4 option chasing more. drop too short (< 2) option.
...
sync with kame.
2001-02-21 01:27:58 +00:00
c9928e0ab1
need PR_ADDR|PR_ATOMIC for IPPROTO_EON. fix typo. from chopps, sync with kame
2001-02-21 00:11:53 +00:00
da8a3f0179
add AF_ISO case to output. from chopps.
2001-02-20 10:41:47 +00:00
176db3e930
ISO over IPv4/v6 by EON encapsulation. from chopps, sync with kame.
2001-02-20 08:49:15 +00:00
5bc3f3ff96
correct IPv4 option handling.
2001-02-19 04:24:27 +00:00
26a76076be
correct IPv4 option header chasing. the old code may overrun the buffer
...
if the option header is truncated. sync with kame
2001-02-19 03:47:01 +00:00
e6dbed9659
wording in comment.
...
is contradict -> "is contradictory", or "contradicts".
2001-02-16 15:13:40 +00:00
f99a50f858
protect router list management by splsoftnet properly. sync with kame
2001-02-11 07:12:01 +00:00
1bc6ca28a1
make sure to clean ln_byhint on reachability confirmation.
2001-02-11 07:00:03 +00:00
1442c06fae
wrap kernel-only #define (kame cross-bsd portability) into _KERNEL.
2001-02-11 06:50:59 +00:00
bc5a6e2482
pull latest kame pcbnotify code. synchronizes ICMPv6 path mtu discovery
...
behavior with other protocols (i.e. validation, use of hiwat/lowat).
2001-02-11 06:49:49 +00:00
2390806e17
whitespace sync with kame
2001-02-11 05:25:04 +00:00
5318e0ee0f
remove #ifdef __FreeBSD__.
2001-02-11 05:24:21 +00:00
37bb4bf58b
set frag6_doing_reass properly (for frag6_drain). sync with kame.
2001-02-11 05:05:27 +00:00
7781d63a92
recover $NetBSD$ (removed by mistake)
2001-02-11 04:53:49 +00:00
9a9c998cc7
add missing IFAFREE() in error recovery case.
2001-02-11 04:29:30 +00:00
e1f4f77960
to sync with kame better, (1) remove register declaration for variables,
...
(2) sync whitespaces, (3) update comments. (4) bring in some of portability
and logging enhancements. no functional changes here.
2001-02-10 04:14:26 +00:00
4cd9449e34
initialize "mbz" member. kame 1.35 -> 1.36
2001-02-10 03:06:39 +00:00
7f548573d5
cosmetic changes to sync with kame. tabify and minor local variable renames
2001-02-10 02:19:57 +00:00
20e2452579
fix if_set for architectures with sizeof(long) != 4. IF_xxx behaved badly.
...
(no fear of overrun, since index was mistakenly computed to too small value)
2001-02-10 02:10:14 +00:00
6b9104e0f7
sync with kame better. cosmetic/stat changes only.
2001-02-08 18:43:17 +00:00
ae819d9324
move udp6_output() to separate file. (sync better with kame)
2001-02-08 16:48:01 +00:00
109fcc5522
implement upper limit to icmp6 redirects (experimental, turned off)
...
negative value to {mtudisc,redirect}_{hi,lo}wat will turn off the limitation.
sync with kame.
2001-02-08 16:07:39 +00:00
179a7e0d7b
send up dst_unreach_admin error to local node, if transport-mode
...
ipsec key is not found. rather experimental. kame 1.83 -> 1.84
nuke IPSEC_SRCSEL which does not do the right thing.
adjust state->ro if the tunnel endpoint is offlink. KAME PR 233.
kame 1.84 -> 1.85
2001-02-08 15:04:26 +00:00
574214f10a
amove in6_{embed,recover}scope prototypes to in6_var.h (kernel only).
...
add in6_clearscope. sync with kame
2001-02-08 14:56:15 +00:00
a1d89972c7
when chasing nd6_llinfo chain, make sure we do not touch dangling
...
pointer (due to RTM_DELETE during default router list management).
from kame
2001-02-08 12:57:54 +00:00
c8e86cc06a
remove bogus DIAGNOSTIC. sync with kame
2001-02-07 10:56:38 +00:00
22b473e0f6
during ip6/icmp6 inbound packet processing, do not call log() nor printf() in
...
normal operation (/var can get filled up by flodding bogus packets).
sysctl net.inet6.icmp6.nd6_debug will turn on diagnostic messages.
(#define ND6_DEBUG will turn it on by default)
improve stats in ND6 code.
lots of synchronziation with kame (including comments and cometic ones).
2001-02-07 08:59:47 +00:00
172e802b90
bad semicolon after "if" conditional. sync with kame
2001-02-06 01:27:29 +00:00
09cb38f22b
expose the definitions of MIN() and MAX() in sys/param.h to the kernel
...
and use those in favor of a dozen copies scattered around the source tree.
2001-02-05 10:42:40 +00:00
d17dfd2fc0
avoid panic when a packet with nonexistent link-local address is issued.
...
kame 1.151 -> 1.152.
2001-02-02 15:54:56 +00:00
617b3fab7e
- record IPsec packet history into m_aux structure.
...
- let ipfilter look at wire-format packet only (not the decapsulated ones),
so that VPN setting can work with NAT/ipfilter settings.
sync with kame.
TODO: use header history for stricter inbound validation
2001-01-24 09:04:15 +00:00
8b3234d2f2
minimize diff with the latest kame tree.
2001-01-23 05:21:23 +00:00
a836499e32
make it possible to turn off ingress filter on gif/stf tunnel egress,
...
by using IFF_LINK2. (part of) PR 11163 from Ken Raeburn.
2001-01-22 07:51:01 +00:00
60240f3ab9
workaround to avoid EMSGSIZE when ND6 table for the outgoing interface
...
is not initialized (should result in "interface down").
2001-01-18 06:50:12 +00:00
43950f6d05
on interface removal (ifconfig destroy) do not remove default route by mistake
2001-01-18 06:49:11 +00:00
4dbe2a5a97
wrap noisy ND6 debugging messages with ND6_DEBUG. sync with kame
2001-01-17 11:26:52 +00:00
df9784d749
pull post-4.4BSD change to sys/net/route.c from BSD/OS 4.2 (UCB copyrighted).
...
have sys/net/route.c:rtrequest1(), which takes rt_addrinfo * as the argument.
pass rt_addrinfo all the way down to rtrequest, and ifa->ifa_rtrequest.
3rd arg of ifa->ifa_rtrequest is now rt_addrinfo * instead of sockaddr *
(almost noone is using it anyways).
benefit: the follwoing command now works. previously we need two route(8)
invocations, "add" then "change".
# route add -inet6 default ::1 -ifp gif0
remove unsafe typecast in rtrequest(), from rtentry * to sockaddr *. it was
introduced by 4.3BSD-reno and never corrected.
XXX is eon_rtrequest() change correct regarding to 3rd arg?
eon_rtrequest() and rtrequest() were incorrect since 4.3BSD-reno,
so i do not have correct answer in the source code.
someone with more clue about netiso-over-ip, please help.
2001-01-17 04:05:41 +00:00
039777e3c8
s/ND6DEBUG/ND6_DEBUG/ to meet other places
2001-01-16 06:16:37 +00:00
9f119cbf91
wrap icmp6 checksum error printf() into #ifdef ND6DEBUG.
...
sync with kame, NetBSD PR 11911.
2001-01-08 06:12:46 +00:00
6562709f3a
typo fix. PR 11889
2001-01-04 11:48:44 +00:00
ad5b855ef0
Back out the sledgehammer damage applied by wiz while I was out for
...
the holiday.
2000-12-28 21:40:59 +00:00
8b9fb822b0
do not touch ra_addr if it is NULL. from IIJ SEIL team
2000-12-28 21:23:00 +00:00
32e20d8993
Back out previous change. It causes NAT to fail, and was CLEARLY
...
NOT TESTED before it was committed.
2000-12-25 02:00:46 +00:00
d0357bdb4f
Slight adjustment to how pfil_head's are registered. Instead of a
...
"key" and a "dlt", use a "type" (PFIL_TYPE_{AF,IFNET} for now) and
a val/ptr appropriate for that type. This allows for more future
flexibility with the pfil_hook mechanism.
2000-12-22 20:01:17 +00:00
b05acc70f8
make sure we notify of routing changes, even if we have net route pointed
...
to by inpcb.
2000-12-21 00:46:20 +00:00
d9a9544a2f
Add ALTQ glue. XXX Temporary until ALTQ is changed to use a pfil hook.
2000-12-14 17:36:44 +00:00
1101f217b5
no need to rtalloc1() twice in pmtud. from kame
2000-12-11 19:28:47 +00:00
5eae50d991
update icmp6 too big validation. the change is necessary since pmtud is
...
mandatory for IPv6 (so we can't just validate by using connected pcb - we need
to allow traffic from unconnected pcb to do pmtud).
- if the traffic is validated by xx_ctlinput, allow up to "hiwat" pmtud
route entries.
- if the traffic was not validated by xx_ctlinput, allow up to "lowat" pmtud
route entries (there's upper limit, so bad guys cannot blow up our routing
table).
sync with kame
XXX need to think again about default hiwat/lowat value.
XXX victim selection to help starvation case
2000-12-09 01:29:45 +00:00
fe5bd7125e
make sure we don't touch uninitialized pointer. from: fvdl
2000-12-04 12:11:49 +00:00
65fd25ea82
Restructure the PFIL_HOOKS mechanism a bit:
...
- All packets are passed to PFIL_HOOKS as they come off the wire, i.e.
fields in protocol headers in network order, etc.
- Allow for multiple hooks to be registered, using a "key" and a "dlt".
The "dlt" is a BPF data link type, indicating what type of header is
present.
- INET and INET6 register with key == AF_INET or AF_INET6, and
dlt == DLT_RAW.
- PFIL_HOOKS now take an argument for the filter hook, and mbuf **,
an ifnet *, and a direction (PFIL_IN or PFIL_OUT), thus making them
less IP (really, IP Filter) centric.
Maintain compatibility with IP Filter by adding wrapper functions for
IP Filter.
2000-11-11 00:52:36 +00:00
a21e536042
improve spec conformance of node information query (07).
...
sync with kame.
2000-11-11 00:46:36 +00:00
970a75f808
fix KAME PR 296 again, for transport-mode SA only
...
(shortterm workaround - need revisit for ANY SA)
2000-11-10 01:10:36 +00:00
8c411160ec
backout KAME PR 296. "any" mode SA should be able to be used for tunnel mode.
2000-11-09 17:36:11 +00:00
e452bf6c6b
save a little bit of CPU time (avoid computing CBC IV we do not use).
...
sync with kame.
2000-11-08 04:57:57 +00:00
47bce75f00
check IPsec SA type (tunnel/transport/any) when we try to decapsulate IPsec
...
tunnel mode packet. decapsulate only if we got a tunnel mode SA.
KAME PR 296.
2000-11-06 00:58:34 +00:00
ef8a34f5c3
fix IPv4 TTL selection with AF_INET6 API. sync with kame. From: jdc
2000-11-06 00:50:12 +00:00
e83458422f
First Prototype implementation of network interface part for IEEE1394 (if_fw).
...
Current status:
Only OHCI chip is supported (fwohci).
ping (IPv4) works with Sony's implementation (SmartConnect) on Win98.
sometimes works but not stable.
Not implemented yet:
IRM (Isochronous Resource Manager) functionality.
Link layer fragmentation.
Topology map.
More to do:
clean ups
MCAP
charactor device part
dhcp
There is no entry in GENERIC config file yet.
Follow sys/dev/ieee1394/IMPLEMENTATION to enable if_fw.
2000-11-05 17:17:12 +00:00
731744bcc2
avoid possible align issue
2000-11-02 12:28:45 +00:00
9b55c15642
[13]des fix for big endian machines. from: shigeru@iij.ad.jp
2000-11-02 12:25:01 +00:00
73b4766cf2
do not panic on "ifconfig inet6 fe80::1 -alias". from Todd Fries.
...
KAME PR 295.
2000-10-28 03:46:21 +00:00
cb1745c4f9
make IFA_STATS really work on IPv6.
2000-10-23 03:45:25 +00:00
9183e2dc4e
remove #ifdef TCP6. it is not likely for us to bring in sys/netinet6/tcp6*.c
...
(separate TCP/IPv6 stack) into netbsd-current.
2000-10-19 20:22:59 +00:00
d11a1f9bae
kame 1.32 -> 1.33
...
in add_m6fc(), set interface list for all cases.
in response to a report from Hoerdt Mickael.
kame 1.31 -> 1.32
discard PIM register if the version of the inner packet is incorrect (i.e. IPv6)
(according to clarfication of recent discussion in the IETF pim ML)
2000-10-19 03:15:48 +00:00
edd876a35d
validate ICMPv6 too big message.
...
XXX too restrictive given frequent uses of sendto(2)
2000-10-19 01:14:13 +00:00
9288750911
memcpy -> bcopy, for sync with kame tree
2000-10-19 00:40:44 +00:00
23a03329ef
verify ICMPv6 too big messages based on TCP pcbs, and/or IPsec SA.
...
TODO: udp6, and sendto consideration. as pmtud is mandatory for IPv6,
it is rather important for us to support those cases.
TODO: more testing
TODO: kame sync
2000-10-18 21:14:12 +00:00
ea9b5a9106
Restructure the Path MTU Discovery code somewhat to avoid
...
entering rtentry's for hosts we're not actually communicating
with.
Do this by invoking the ctlinput for the protocol, which is
responsible for validating the ICMP message:
* TCP -- Lookup the connection based on the address/port
pairs in the ICMP message.
* AH/ESP -- Lookup the SA based on the SPI in the ICMP message.
If validation succeeds, ctlinput is responsible for calling
icmp_mtudisc(). icmp_mtudisc() then invokes callbacks registered
by protocols (such as TCP) which want to take some sort of special
action when a path's MTU changes. For TCP, this is where we now
refresh cached routes and re-enter slow-start.
As a side-effect, this fixes the problem where TCP would not be
notified when a path's MTU changed if AH/ESP were being used.
XXX Note, this is only a fix for the IPv4 case. For the IPv6
XXX case, we need to wait for the KAME folks.
Reviewed by sommerfeld@netbsd.org and itojun@netbsd.org .
2000-10-18 17:09:14 +00:00
3fe32f0197
use __P() in prototype for non-ansi compilers.
...
From: Michael Shalayeff <mickey@lucifier.remote.dti.net>
(we don't ansify it for kame code sharing)
2000-10-17 21:46:42 +00:00
d7a216bb96
suppress warning on nd6_storelladdr failure. the failure could happen
...
easily when we have routing table with too many entries. sync with kame.
2000-10-15 15:39:11 +00:00
6e3a9bc311
validate mbuf chain length on *_ctlinput. remote node may be able to
...
transmit a truncated icmp6 packet and panic the system. sync with kame.
2000-10-13 17:53:44 +00:00
8fa0e6b9f7
sync with kame ($KAME$)
2000-10-10 16:26:43 +00:00
0b9cbefe70
Don't initialize TCP twice on v4/v6 dual stack kernel.
2000-10-10 13:25:28 +00:00
654a1d9555
remove obsolete handling code for SIOCSIFPHY*. they are now in ifioctl().
...
sync with kame.
2000-10-06 05:07:41 +00:00
a6f9652adf
always use rnd(4) for IPsec random number source. avoid random(9).
...
if there's no rnd(4), random(9) will be used with one-time warning printf(9).
XXX not sure how good rnd_extract_data(RND_EXTRACT_ANY) is, under entropy-
starvation situation
2000-10-05 04:49:17 +00:00
dabed37e1c
correct merge failure in key size validation.
2000-10-02 23:49:02 +00:00
89af64e5e3
remove #ifdef freebsd
2000-10-02 17:23:49 +00:00
e9536f86fa
add ESP rijndael logic. yet to be usable (until algorithm # is assigned)
2000-10-02 17:21:24 +00:00
dcfe05e7c1
fix compilation without INET. fix confusion between ipsecstat and ipsec6stat.
...
sync with kame.
2000-10-02 03:55:41 +00:00
b2366d4898
add missing \n. sync with kame.
2000-10-01 10:56:02 +00:00
8a9f93dc37
update ip compression algorithm lookup.
...
attach sadb_comb for IP compression (not in RFC2367;
discussed on pf_key@inner.net ). sync with kame
2000-09-26 08:40:23 +00:00
78f9775c35
do not hardcode maximum IV length.
2000-09-26 08:37:38 +00:00
2c8b266751
make ip6_ext available for non-IPv6 compilation
...
(needed for header chain parsing). (redo of 1.25 -> 1.26)
2000-09-25 15:00:08 +00:00
4e675359ad
Make kernels with IPSec but without IPv6 compile again.
...
This may break IPPROTO_AH - someone with a clue should double-check
this, please.
2000-09-25 12:35:53 +00:00
89f53512af
use real wallclock (got by microtime) to compute IPsec database lifetimes.
...
previous code used interval timers, and had problem with suspend/resume.
sync with KAME.
2000-09-22 16:55:04 +00:00
e0bb769d4e
on ipsec policy lookup, do not try to lookup port numbers for forwarded packet.
...
sync with kame.
2000-09-22 05:50:23 +00:00
aa5339554d
cleanup ipsec policy lookup. specifically, repair the following cases:
...
- use of IPv4 mapped address on outbound socket
- explicit port numbers via sendto().
old code grabbed port number from inpcb/in6pcb.
in the above case, old code failed to lookup ipsec policy (oops).
sync with kame.
2000-09-22 05:49:46 +00:00
10cc02200a
- repair too strong assumption on mbuf chain.
...
- correct byte lifetime computation to conform to RFC2401 p23 (use
packet BEFORE compression)
- stabilize deflate calls
- present error messages better
2000-09-21 20:28:52 +00:00
9c55bd3b1a
repair infinite loop in ipcomp packet generation. oops.
2000-09-21 06:08:26 +00:00
cb4931c8e7
repair cut-and-paste bug. from: francis dupont. sync with kame
2000-09-20 23:35:51 +00:00
d2c6420404
do not inject empty mbuf to zlib.
2000-09-20 23:35:16 +00:00
3ad679d8fd
call {de,in}flateEnd on failure, otherwise obsolete state will be kept.
2000-09-20 22:34:24 +00:00
ffb333a57c
plug mbuf leak (error case). need more investigation.
2000-09-20 21:43:52 +00:00
e485f6527e
pullup IPv6 and subsequent headers, on IPv6 IPsec transport mode input.
...
(not normally visited - we have switched to m_pulldown. just for completeness)
2000-09-18 22:18:00 +00:00
303fcdf765
repair blowfish-cbc. BF_encrypt() takes value in host byteorder, yuck!
...
(no effect to 1.5 branch)
2000-09-18 21:57:35 +00:00
691fdbb4f0
kame sys/netinet6/icmp6.c 1.140 -> 1.144
...
> in the check for the incoming redirect message, examine the gateway
> (from the routing table) only when the address family of the gateway is
> AF_INET6.
2000-09-16 10:12:22 +00:00
2192675fb1
move file static variable into auto variable, for better thread safety.
...
(not really required for big lock MP). sync with kame
2000-09-09 16:15:47 +00:00
f8481d085e
add attribute(packed).
...
From: Alfred Perlstein <bright@wintelcom.net>
2000-09-09 11:42:22 +00:00
dc23ec9971
add missing \n on log(). sync with kame
2000-08-31 07:35:44 +00:00
65fbdbe744
repair DES on LP64. past code did not interoperate with non-LP64, due to
...
incorrect computed results.
remove unnecessary #ifdef/#define. sync with kame.
2000-08-31 07:33:04 +00:00
58c93e23cf
LP64 fix (cast to u_long when printing size_t)
2000-08-30 14:58:33 +00:00
2af85c262b
improve code sharing for esp_schedule(). add some diagnostics cases
...
for esp_cbc_{en,de}crypt(). sync with kame.
2000-08-29 11:32:21 +00:00
6fe60cce5f
do not forward packets with unspecified source address (::).
...
this is clarification recently made to RFC2460. sync with kame.
2000-08-29 09:19:43 +00:00
bb8d535cc5
use per-block cipher function + esp_cbc_{de,en}crypt. do not use
...
cbc-over-mbuf functions in sys/crypto.
the change should make it much easier to switch crypto function to
machine-dependent ones (like assembly code under sys/arch/i386/crypto?).
also it should be much easier to import AES algorithms.
XXX: it looks that past blowfish-cbc code was buggy. i ran some test pattern,
and new blowfish-cbc code looks more correct. there's no interoperability
between the old code (before the commit) and the new code (after the commit).
XXX: need serious interop tests before move it into 1.5 branch
2000-08-29 09:08:42 +00:00
3da9705446
add a warning on IPv6 setsockopt number space (*BSD shares the number space
...
so consult KAME for number allocation)
2000-08-27 01:02:48 +00:00
152da24bd9
implement net.inet6.ip6.{anon,low}port{min,max} sysctl variable.
2000-08-26 11:03:45 +00:00
4d40179399
add missing IPNOPRIVPORTS case
2000-08-26 10:40:03 +00:00
5bd1b19b29
Don't use MALLOC() for variable-sized allocations.
2000-08-25 21:22:16 +00:00
cabceaa265
- icmp6 nodeinfo: remove possibility of unaligned pointer access.
...
- jumbo payload output: fix incorrect mbuf manipulation
- pedant: align issues, mbuf assumption
(sync with kame)
2000-08-19 08:15:53 +00:00
e6efb27c84
add missing splx, when outgoing interface queue is full on tunnelled
...
ESP packet output. KAME PR 280.
2000-08-16 09:54:39 +00:00
831a48fd0b
Make this compile without INET6 again.
2000-08-15 21:43:57 +00:00
54aeb79d4c
supress warning (LOG_ERR -> LOG_DEBUG) which occurs in the following situation:
...
- manually configure an address from prefix P (like P::1)
- autoconfigure additional address from the same prefix P (like P::ifid).
- rtrequest fails due to P/plen already exists
more fundamental solution should appear later, when kame side stablizes it.
from thopej.
2000-08-13 23:45:22 +00:00
5e868d1e49
clearifications in icmp6 node query support.
...
XXX previous commit included "supported qtypes" icmp6 node query support.
sorry commit message was mistaken.
2000-08-03 16:30:37 +00:00
afa5315364
correct typo in #define. ICMP6_NI_SUCESS -> SUCCESS (notice missing C).
...
sync with kame.
2000-08-03 14:31:04 +00:00
6574aa66e8
inhibit error code from rtinit(). this happens when we try to assign
...
multiple addresses from same prefix, onto single interface. PR 10427.
more info:
- 4.4BSD did not check return code from in_ifinit() at all.
4.4BSD does not support multiple address from same prefix.
- past KAME change passed in{,6}_ifinit() to upwards, toward ifconfig(8).
the behavior is filed as PR 10427.
- the commit inhibits EEXIST from rtinit(), hence partially recovers old
4.4BSD behavior.
- the right thing to happen is to properly support multiple address assignment
from the same prefix. KAME tree has more extensive change, however, it needs
much more time to get stabilized (rtentry refcnt change can cause serious
issue, we really need to bake it before bring it to netbsd)
2000-08-02 15:03:02 +00:00
32ef6bb0e7
sync comment with reality
2000-07-30 05:30:37 +00:00
0036ac92be
clarify comment. from jhawk. sync with kame.
2000-07-30 04:33:34 +00:00
5e8b5a35e4
make ipsec_strerror(3) to return const char *, not char *. sync with kame.
2000-07-30 02:38:35 +00:00
63de4c2cb9
nuke the following sysctl variables. "ppsratelimit" should work better.
...
need to recompile sbin/sysctl after updating /usr/include.
net.inet.tcp.rstratelimit
net.inet.icmp.errratelimit
net.inet6.icmp6.errratelimit
2000-07-28 04:06:52 +00:00
73a29e35ff
do not forward packet with :: in the source.
...
this is not in the spec - we had rough consensus on it in ipngwg,
spec will get updated to include this behavior.
2000-07-27 15:53:51 +00:00
fec624be3f
wrap kernel function prototype by #ifdef _KERNEL.
2000-07-23 08:24:12 +00:00
411ff12b27
pre-compute and cache intermediate crypto key. suggestion from sommerfeld,
...
sync with kame.
loopback, blowfish-cbc transport mode, 128bit key
before: 86588496 bytes received in 00:42 (1.94 MB/s)
after: 86588496 bytes received in 00:31 (2.58 MB/s)
2000-07-23 05:23:04 +00:00
65d37eff7f
correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).
...
sync from kame.
WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon.
(no ipsec-ready netbsd was released as official release)
2000-07-18 14:56:42 +00:00
5f09b77987
s/IPSEC_IPV6FWD/IPSEC/. this should correct strange behavior on ipv6
...
forwarding (even if policy asks for tunnel mode encryption, packets
go out in clear). sync with kame.
2000-07-16 07:57:55 +00:00
a2744a4cf8
do not pull sys/queue.h from netinet6/in6.h. PR10597.
...
some sync with kame.
2000-07-16 01:10:34 +00:00
20964b0c23
fatal bug fix from kame (rtentry refcnt goes negative if we play with IPv6
...
address/routing table too much).
in6_ifloop_request()
not to request rtrequest to return an rtentry except for the ADD
operation, in order to avoid misdecreasing the refcnt (which might
cause leak of rtentry)
2000-07-13 09:56:20 +00:00
f5211e847a
remove m_pulldown statistics code. it is highly experimental and belong
...
to kame tree only (not for *bsd).
2000-07-13 05:34:21 +00:00
d8a9a3cc7b
add ppsratelimit(9), which does event-per-sec rate limitation.
...
use it from icmp6 error rate limitation code.
XXX better name for the function?
2000-07-09 06:44:57 +00:00
ec67eee51f
sync with kame.
...
introduce in6_{recover,embed}scope, for in-kernel scoped-address manipulation.
improve in6_pcbnotify.
2000-07-07 15:54:16 +00:00
2068dee670
elide lint cast type conversion warnings.
2000-07-06 17:42:55 +00:00
210a3e2f80
remove unnecessary #include <netkey/key_debug.h>. from kame.
2000-07-06 12:51:39 +00:00
0a1e211454
- do not use bitfield for router renumbering header.
...
- add protection mechanism against ND cache corruption due to bad NUD hints.
- more stats
- icmp6 pps limitation. TOOD: should implement ppsratecheck(9).
2000-07-06 12:36:18 +00:00
6fff122160
drop packet to tentative/duplicated interface address earlier. sync w/kame
2000-07-02 09:56:39 +00:00
8ff902fca1
repair kernel faithd(8) support. there were two mistakes:
...
(1) tcp6_input dropped packets for translation
(2) in6_pcblookup_connect was too strict
2000-07-02 08:04:10 +00:00
3ade27131a
suppress too noisy warning on forward-over-loopback case. from kame
2000-06-30 19:46:05 +00:00
cf594a3f4d
<vm/vm.h> -> <uvm/uvm_extern.h>
2000-06-28 03:01:16 +00:00
d2787dad27
XNS5.2: define sa_family_t and use it where specified by the standard.
2000-06-26 15:48:19 +00:00
278184a8ab
avoid possible mbuf leaks on ipsec policy violation.(sync with kame)
2000-06-20 02:24:42 +00:00
90ca25568b
remove obsolete sysctl MIB net.inet.ipsec.inbound_call_ike.
...
(sync with kame)
2000-06-15 05:01:06 +00:00
1b8ede9f7c
Import IPsec ESP from netbsd-cryptosrc-intl.
2000-06-14 19:39:42 +00:00
dafb757588
add algorithm name into algorithm table. (commit to crypto-intl will follow)
2000-06-14 11:27:35 +00:00
af9d516560
signedness issue with char, take 2. confirmed with i386 cc -funsigned-char.
2000-06-13 17:31:37 +00:00
c6a8ca266b
workaround to suppress warning on char == unsigned char arch.
2000-06-13 16:34:37 +00:00
0455eac327
do not use cached route if the route becomes !RTF_UP.
...
make the validation for jumbo payload option more strict.
2000-06-13 14:43:44 +00:00
36887242d7
add sanity check on in6_ifaddr.
2000-06-13 04:35:29 +00:00
fa24d1db9b
make sure to link new in6_ifaddr to if_addrlist.
2000-06-13 02:54:11 +00:00
07098cd363
better conformance to draft-ietf-ipngwg-icmp-name-lookups-05.
...
the old code was chimera of 03 and 05 draft.
-n by default, since IPv6 reverse lookup takes too much time.
use -H to enable reverse name lookup.
2000-06-12 16:21:02 +00:00
8f26bbadf9
sync with latest kame tree (tiny update in IPv4 mapped issue)
2000-06-12 10:47:17 +00:00
92e64a4a0d
sync with almost-latest KAME IPsec. full changelog would be too big
...
to mention here. notable changes are like below.
kernel:
- make PF_KEY kernel interface more robust against broken input stream.
it includes complete internal structure change in sys/netkey/key.c.
- remove non-RFC compliant change in PF_KEY API, in particular,
in struct sadb_msg. we cannot just change these standard structs.
sadb_x_sa2 is introduced instead.
- remove prototypes for pfkey_xx functions from /usr/include/net/pfkeyv2.h.
these functions are not supplied in /usr/lib.
setkey(8):
- get/delete does not require "-m mode" (ignored with warning, if you
specify it)
- spddelete takes direction specification
2000-06-12 10:40:37 +00:00
90fb69b2b2
sync with latest kame document.
...
- update 6to4 i-d #.
- update descr on source address selection.
2000-06-10 08:21:11 +00:00
f7d6ee345c
Use _POSIX_SOURCE-safe type names
2000-06-08 19:01:44 +00:00
ffedfcb68d
make sure not to overwrite sockaddr on PRU_SEND/PRU_CONNECT to
...
link-local address. From: frank
2000-06-08 13:51:33 +00:00
8fe589a2ae
fix anycast address determination.
...
correct interface address addition when link-local is added (check if ifp
matches).
make diff to kame repository easier (breaks some KNF)
sync with kame.
2000-06-07 06:27:43 +00:00
8183434ff7
s/PIMCTL/PIM6CTL/ to avoid future confusion.
2000-06-07 04:40:46 +00:00
af6b403d46
backout change to in6_pcbnotify(). the change seems premature
...
(may cause trouble with advanced API in certain situation).
2000-06-05 08:09:48 +00:00
8987054176
pass struct proc * down to udp6_output and in6_pcbbind.
2000-06-05 06:38:22 +00:00
93b2b4e693
remove include files in nonstandard path
...
(has been #error for couple of months).
2000-06-04 11:52:06 +00:00
d7e34999be
sync with recent kame.
...
avoid use of macros to manipulate sockaddrs (hides error case too much).
correct IPv4 packet handling when ip option is present.
preparations for ipsec policy engine upgrades.
2000-06-03 16:14:02 +00:00
9d853e8a4f
sync with kame.
...
- use latest source address selection code - in6_src.c.
- correct frag header insertion.
- deep copy ip6 header portion in ip6_mloopback to avoid overwrite.
- do not bark when we forward packet to loopback.
- some cosmetics.
2000-06-03 14:36:32 +00:00
e0b65589f1
sync with more recent kame. cope with malloc failure more gracefully
...
some cosmetics.
2000-06-02 18:20:15 +00:00
4308599c5a
disallow bind(2) with IPv4 mapped address for now. port number check is
...
insufficient at this moment and we can bind(2) two sockets listen on same
port number.
for real fix, we need to check inpcb table with in6pcb. we can't
find inpcb chain from particular in6pcb chain (like finding tcbtable from tcb6)
luckily RFC2553 does not talk about bind(2) behavior for IPv4 mapped.
IPv4 mapped brings in too much complexities...
2000-05-29 00:03:18 +00:00
c0ccb49681
sync with reality in netbsd-current.
...
- pcb layer changes
- officially supported net interfaces
- minor typo
- draft # updates
2000-05-28 23:44:30 +00:00
418a734f51
enforce parameter type check for IN6_ARE_ADDR_EQUAL(). (sync with kame)
2000-05-24 14:40:09 +00:00
fa2abf5727
make net.inet6.udp6.* sysctl name meet with IPv4 counterpart.
...
XXX do we need to keep symbols mistakingly added (like UDP6CTL_SENDMAX)
for backward compatibility? I believe not.
2000-05-22 15:22:36 +00:00
5de72de121
disallow negative numbers for ratelimit interval (tcp, icmp, icmp6).
2000-05-22 12:08:43 +00:00
48c5048502
correct manipulation of link-local scoped address on loopback.
...
now "telnet fe80::1%lo0" should work again.
(we have another bug near here - will attack it soon)
2000-05-19 20:09:26 +00:00
41f4d3e2b6
correct MLD API. (binary backward compatibility is kept)
...
commit to usr.sbin/pim6* will follow.
2000-05-19 10:39:43 +00:00
f636538446
NULL != 0
2000-05-19 04:34:39 +00:00
fa5c89d64a
do not mistakingly forward link-local scoped packet (the bug was added
...
with "beyondscope" icmp6 support).
"options FAKE_LOOPBACK_IF" will honor scope on loopback outputs. rcvif will
be real interface, not the loopback, just like when multicast loopback.
(sync with kame)
2000-05-19 01:40:18 +00:00
4f1c7f0bbe
do not try NUD unless the gateway is a real neighbor.
...
real fix to KAME PR 245 (workaround has been implemented).
2000-05-09 11:51:12 +00:00
e0d0cba239
Remove junk at the end of #undef.
2000-05-08 18:31:10 +00:00
b5393f9387
correct in6_ifdetach() (previous code touched dangling pointers).
...
actually the corrected portion was never visited.
2000-05-05 08:03:12 +00:00
57434b944b
misuse of free(ia) in #if 0'ed region.
...
From: Lennart Augustsson <lennart@augustsson.net>
2000-04-27 16:44:19 +00:00
7e72267252
correct in6_ifdetach(). free oia, not ia.
...
From: Lennart Augustsson <augustss@augustsson.net>
2000-04-27 15:39:05 +00:00
b360c656a0
temporary workaround against GIF NUD issue (when you configure globals
...
onto GIF, NUD prevents packet from going out)
KAME PR 245. From: Andreas Wrede <andreas@planix.com>
2000-04-27 00:33:47 +00:00
5393e61dd0
add boundary check for nd6_ifinfo (otherwise ndp -i can make out-of-bound
...
accesses).
2000-04-19 07:13:03 +00:00
3909133548
introduce sys/netinet/ip_encap.c, to dispatch inbound packets
...
to protocol handlers, based on src/dst (for ip proto #4/41).
see comment in ip_encap.c for details of the problem we have.
there are too many protocol specs for ip proto #4/41.
backward compatibility with MROUTING case is now provided in ip_encap.c.
fix ipip to work with gif (using ip_encap.c). sorry for breakage.
gif now uses ip_encap.c.
introduce stf pseudo interface (implements 6to4, another IPv6-over-IPv4 code
with ip proto #41 ).
2000-04-19 06:30:51 +00:00
81e8059dfc
fix endian issue in filling in interface id.
...
better sync with kame (nuke space at EOL).
2000-04-17 16:26:07 +00:00
3e34240544
perform neighbor unreachability detection on p2p links (spec requires
...
it for bidir p2p links).
improve -i in ndp(8) to allow tweaking per-interface ND flag on.
fix ndp(8) infinite loop on certain routing table setup.
2000-04-16 15:27:59 +00:00
30272756a8
better sync with latest kame (cosmetic only).
2000-04-16 15:00:56 +00:00
7716681678
add comment on sdl_alen check (sync with kame)
2000-04-13 16:27:00 +00:00
ff22afe8bf
fix fatal bug in EUI64 generation (0xff -> 0xfe typo)
2000-04-13 16:21:25 +00:00
itojun