aboutsummaryrefslogtreecommitdiff
path: root/sys/netinet6/udp6_usrreq.c
Commit message (Collapse)AuthorAgeFilesLines
* Implement flowid calculation for outbound connections to balanceAlexander V. Chernikov2020-10-181-31/+11
| | | | | | | | | | | | | | | | | | | connections over multiple paths. Multipath routing relies on mbuf flowid data for both transit and outbound traffic. Current code fills mbuf flowid from inp_flowid for connection-oriented sockets. However, inp_flowid is currently not calculated for outbound connections. This change creates simple hashing functions and starts calculating hashes for TCP,UDP/UDP-Lite and raw IP if multipath routes are present in the system. Reviewed by: glebius (previous version),ae Differential Revision: https://reviews.freebsd.org/D26523 Notes: svn path=/head/; revision=366813
* Add a knob to allow zero UDP checksums for UDP/IPv6 traffic on the given UDP ↵Navdeep Parhar2020-09-181-1/+14
| | | | | | | | | | | | | | | | | port. This will be used by some upcoming changes to if_vxlan(4). RFC 7348 (VXLAN) says that the UDP checksum "SHOULD be transmitted as zero. When a packet is received with a UDP checksum of zero, it MUST be accepted for decapsulation." But the original IPv6 RFCs did not allow zero UDP checksum. RFC 6935 attempts to resolve this. Reviewed by: kib@ Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D25873 Notes: svn path=/head/; revision=365869
* net: clean up empty lines in .c and .h filesMateusz Guzik2020-09-011-2/+0
| | | | Notes: svn path=/head/; revision=365071
* IPV6_PKTINFO support for v4-mapped IPv6 socketsBjoern A. Zeeb2020-08-071-1/+1
| | | | | | | | | | | | | | | | When using v4-mapped IPv6 sockets with IPV6_PKTINFO we do not respect the given v4-mapped src address on the IPv4 socket. Implement the needed functionality. This allows single-socket UDP applications (such as OpenVPN) to work better on FreeBSD. Requested by: Gert Doering (gert greenie.net), pfsense Tested by: Gert Doering (gert greenie.net) Reviewed by: melifaro MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D24135 Notes: svn path=/head/; revision=364018
* Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)Pawel Biernacki2020-02-261-2/+4
| | | | | | | | | | | | | | | | | | | r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 Notes: svn path=/head/; revision=358333
* Fix NOINET builds.Navdeep Parhar2020-01-311-0/+2
| | | | Notes: svn path=/head/; revision=357318
* Enter network epoch when calling in_pcbconnect() for IPv6 mapped to IPv4Gleb Smirnoff2020-01-221-0/+3
| | | | | | | | | UDP sockets. This is miss from r356983. Reported by: https://syzkaller.appspot.com/bug?id=73c7a2e3f0783f9947459065e5c2f25fe8f82f54 Notes: svn path=/head/; revision=356988
* vnet: virtualise more network stack sysctls.Bjoern A. Zeeb2020-01-081-1/+1
| | | | | | | | | | | | | | | | | Virtualise tcp_always_keepalive, TCP and UDP log_in_vain. All three are set in the netoptions startup script, which we would love to run for VNETs as well [1]. While virtualising the log_in_vain sysctls seems pointles at first for as long as the kernel message buffer is not virtualised, it at least allows an administrator to debug the base system or an individual jail if needed without turning the logging on for all jails running on a system. PR: 243193 [1] MFC after: 2 weeks Notes: svn path=/head/; revision=356527
* Remove useless NULL checkKristof Provost2019-12-051-2/+1
| | | | | | | | | | | Coverity points out that we've already dereferenced m by the time we check, so there's no reason to keep the check. Moreover, it's safe to pass NULL to m_freem() anyway. CID: 1019092 Notes: svn path=/head/; revision=355425
* Fix m_pullup() problem after removing PULLDOWN_TESTs and KAME EXT_*macros.Bjoern A. Zeeb2019-12-011-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | r354748-354750 replaced the KAME macros with m_pulldown() calls. Contrary to the rest of the network stack m_len checks before m_pulldown() were not put in placed (see r354748). Put these m_len checks in place for now (to go along with the style of the network stack since the initial commits). These are not put in for performance but to avoid an error scenario (even though it also will help performance at the moment as it avoid allocating an extra mbuf; not because of the unconditional function call). The observed error case went like this: (1) an mbuf with M_EXT arrives and we call m_pullup() unconditionally on it. (2) m_pullup() will call m_get() unless the requested length is larger than MHLEN (in which case it'll m_freem() the perfectly fine mbuf) and migrate the requested length of data and pkthdr into the new mbuf. (3) If m_get() succeeds, a further m_pullup() call going over MHLEN will fail. This was observed with failing auto-configuration as an RA packet of 200 bytes exceeded MHLEN and the m_pullup() called from nd6_ra_input() dropped the mbuf. (Re-)adding the m_len checks before m_pullup() calls avoids this problems with mbufs using external storage for now. MFC after: 3 weeks Sponsored by: Netflix Notes: svn path=/head/; revision=355254
* netinet6: Remove PULLDOWN_TESTs.Bjoern A. Zeeb2019-11-151-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Remove the KAME introduced PULLDOWN_TESTs which did not even have a compile-time option in sys/conf to turn them on for a custom kernel build. They made the code a lot harder to read or more complicated in a few cases. Convert the IP6_EXTHDR_CHECK() calls into FreeBSD looking code. Rather than throwing the packet away if it would not fit the KAME mbuf expectations, convert the macros to m_pullup() calls. Do not do any extra manual conditional checks upfront as to whether the m_len would suffice (*), simply let m_pullup() do its work (incl. an early check). Remove extra m_pullup() calls where earlier in the function or the only caller has already done the pullup. Discussed with: rwatson (*) Reviewed by: ae MFC after: 8 weeks Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D22334 Notes: svn path=/head/; revision=354748
* netinet*: update *mp to pass the proper value backBjoern A. Zeeb2019-11-121-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | In ip6_[direct_]input() we are looping over the extension headers to deal with the next header. We pass a pointer to an mbuf pointer to the handling functions. In certain cases the mbuf can be updated there and we need to pass the new one back. That missing in dest6_input() and route6_input(). In tcp6_input() we should also update it before we call tcp_input(). In addition to that mark the mbuf NULL all the times when we return that we are done with handling the packet and no next header should be checked (IPPROTO_DONE). This will eventually allow us to assert proper behaviour and catch the above kind of errors more easily, expecting *mp to always be set. This change is extracted from a larger patch and not an exhaustive change across the entire stack yet. PR: 240135 Reported by: prabhakar.lakhera gmail.com MFC after: 3 weeks Sponsored by: Netflix Notes: svn path=/head/; revision=354643
* Now with epoch synchronized PCB lookup tables we can greatly simplifyGleb Smirnoff2019-11-071-76/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | locking in udp_output() and udp6_output(). First, we select if we need read or write lock in PCB itself, we take the lock and enter network epoch. Then, we proceed for the rest of the function. In case if we need to modify PCB hash, we would take write lock on it for a short piece of code. We could exit the epoch before allocating an mbuf, but with this patch we are keeping it all the way into ip_output()/ip6_output(). Today this creates an epoch recursion, since ip_output() enters epoch itself. However, once all protocols are reviewed, ip_output() and ip6_output() would require epoch instead of entering it. Note: I'm not 100% sure that in udp6_output() the epoch is required. We don't do PCB hash lookup for a bound socket. And all branches of in6_select_src() don't require epoch, at least they lack assertions. Today inet6 address list is protected by rmlock, although it is CKLIST. AFAIU, the future plan is to protect it by network epoch. That would require epoch in in6_select_src(). Anyway, in future ip6_output() would require epoch, udp6_output() would need to enter it. Notes: svn path=/head/; revision=354479
* Since r353292 on input path we are always in network epoch, whenGleb Smirnoff2019-11-071-0/+3
| | | | | | | | | | | | | | we lookup PCBs. Thus, do not enter epoch recursively in in_pcblookup_hash() and in6_pcblookup_hash(). Same applies to tcp_ctlinput() and tcp6_ctlinput(). This leaves several sysctl(9) handlers that return PCB credentials unprotected. Add epoch enter/exit to all of them. Differential Revision: https://reviews.freebsd.org/D22197 Notes: svn path=/head/; revision=354477
* Remove unnecessary recursive epoch enter via INP_INFO_RLOCKGleb Smirnoff2019-11-071-8/+4
| | | | | | | macro in udp6_input(). It shall always run in the network epoch. Notes: svn path=/head/; revision=354473
* Ensure that the flags indicating IPv4/IPv6 are not changed by failingMichael Tuexen2019-10-241-4/+27
| | | | | | | | | | | | | | | bind() calls. This would lead to inconsistent state resulting in a panic. A fix for stable/11 was committed in https://svnweb.freebsd.org/base?view=revision&revision=338986 An accelerated MFC is planned as discussed with emaste@. Reported by: syzbot+2609a378d89264ff5a42@syzkaller.appspotmail.com Obtained from: jtl@ MFC after: 1 day Sponsored by: Netflix, Inc. Notes: svn path=/head/; revision=354044
* r348494 fixes a race in udp_output(). The same race exists inMichael Tuexen2019-07-131-0/+15
| | | | | | | | | | | | | udp_output6(), therefore apply a similar patch to IPv6. Reported by: syzbot+c5ffbc8f14294c7b0e54@syzkaller.appspotmail.com Reviewed by: bz@, markj@ MFC after: 2 weeks Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D20936 Notes: svn path=/head/; revision=349968
* There are three places where we return from a function which entered anJonathan T. Looney2018-10-091-1/+1
| | | | | | | | | | | | | | | | epoch section without exiting that epoch section. This is bad for two reasons: the epoch section won't exit, and we will leave the epoch tracker from the stack on the epoch list. Fix the epoch leak by making sure we exit epoch sections before returning. Reviewed by: ae, gallatin, mmacy Approved by: re (gjb, kib) Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D17450 Notes: svn path=/head/; revision=339251
* After r338257 is was possible to trigger a KASSERT() in ud6_output()Bjoern A. Zeeb2018-10-021-1/+13
| | | | | | | | | | | | | | | | using an application trying to use a v4mapped destination address on a kernel without INET support or on a v6only socket. Catch this case and prevent the packet from going anywhere; else, without the KASSERT() armed, a v4mapped destination address might go out on the wire or other undefined behaviour might happen, while with the KASSERT() we panic. PR: 231728 Reported by: Jeremy Faulkner (gldisater gmail.com) Approved by: re (kib) Notes: svn path=/head/; revision=339091
* Update udp6_output() inp locking to avoid concurrency issues withBjoern A. Zeeb2018-09-191-13/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | route cache updates. Bring over locking changes applied to udp_output() for the route cache in r297225 and fixed in r306559 which achieve multiple things: (1) acquire an exclusive inp lock earlier depending on the expected conditions; we add a comment explaining this in udp6, (2) having acquired the exclusive lock earlier eliminates a slight possible chance for a race condition which was present in v4 for multiple years as well and is now gone, and (3) only pass the inp_route6 to ip6_output() if we are holding an exclusive inp lock, so that possible route cache updates in case of routing table generation number changes can happen safely. In addition this change (as the legacy IP counterpart) decomposes the tracking of inp and pcbinfo lock and adds extra assertions, that the two together are acquired correctly. PR: 230950 Reviewed by: karels, markj Approved by: re (gjb) Pointyhat to: bz (for completely missing this bit) Differential Revision: https://reviews.freebsd.org/D17230 Notes: svn path=/head/; revision=338804
* Unbreak RSS builds after r338257. Folding both RSS blocks togetherBjoern A. Zeeb2018-08-241-0/+1
| | | | | | | | | | | I missed the closing } of the new combined block. Pointyhat to: bz Reported by: np Approved by: re (kib) Notes: svn path=/head/; revision=338306
* MFp4 bz_ipv6_fast:Bjoern A. Zeeb2018-08-231-204/+200
| | | | | | | | | | | | | | | | | Migrate udp6_send() v4mapped code to udp6_output() saving us a re-lock and further simplifying the address-family handling code by eliminating AF_INET checks and almost all v4mapped handling right after the start as cases could actually not happen anymore. Rework output path locking similar to UDP4 allowing for better parallelism (see r222488, and later versions). Sponsored by: The FreeBSD Foundation (2012) Sponsored by: iXsystems (2012) Differential Revision: https://reviews.freebsd.org/D3721 Notes: svn path=/head/; revision=338257
* Add a dtrace provider for UDP-Lite.Michael Tuexen2018-07-311-6/+22
| | | | | | | | | | | | | | The dtrace provider for UDP-Lite is modeled after the UDP provider. This fixes the bug that UDP-Lite packets were triggering the UDP provider. Thanks to dteske@ for providing the dwatch module. Reviewed by: dteske@, markj@, rrs@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16377 Notes: svn path=/head/; revision=337018
* Add missing dtrace probes for received UDP packets.Michael Tuexen2018-07-201-0/+1
| | | | | | | | | | | | | | | Fire UDP receive probes when a packet is received and there is no endpoint consuming it. Fire the probe also if the TTL of the received packet is smaller than the minimum required by the endpoint. Clarify also in the man page, when the probe fires. Reviewed by: dteske@, markj@, rrs@ Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D16046 Notes: svn path=/head/; revision=336551
* fix 335919 - check "last" not "inp" where appropriateMatt Macy2018-07-041-2/+2
| | | | | | | | Submitted by: ae Reported by: cy Notes: svn path=/head/; revision=335958
* epoch(9): allow preemptible epochs to composeMatt Macy2018-07-041-3/+4
| | | | | | | | | | | | | | | | | | | | | | | - Add tracker argument to preemptible epochs - Inline epoch read path in kernel and tied modules - Change in_epoch to take an epoch as argument - Simplify tfb_tcp_do_segment to not take a ti_locked argument, there's no longer any benefit to dropping the pcbinfo lock and trying to do so just adds an error prone branchfest to these functions - Remove cases of same function recursion on the epoch as recursing is no longer free. - Remove the the TAILQ_ENTRY and epoch_section from struct thread as the tracker field is now stack or heap allocated as appropriate. Tested by: pho and Limelight Networks Reviewed by: kbowling at llnw dot com Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D16066 Notes: svn path=/head/; revision=335924
* udp6_input: validate inpcb before useMatt Macy2018-07-031-7/+16
| | | | | | | | When traversing pcbinfo lists (rather than calling lookup) we need to explicitly validate an inpcb before use. Notes: svn path=/head/; revision=335919
* mechanical CK macro conversion of inpcbinfo listsMatt Macy2018-06-121-1/+1
| | | | | | | | This is a dependency for converting the inpcbinfo hash and info rlocks to epoch. Notes: svn path=/head/; revision=335016
* Load balance sockets with new SO_REUSEPORT_LB option.Sean Bruno2018-06-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new socket option, SO_REUSEPORT_LB, which allow multiple programs or threads to bind to the same port and incoming connections will be load balanced using a hash function. Most of the code was copied from a similar patch for DragonflyBSD. However, in DragonflyBSD, load balancing is a global on/off setting and can not be set per socket. This patch allows for simultaneous use of both the current SO_REUSEPORT and the new SO_REUSEPORT_LB options on the same system. Required changes to structures: Globally change so_options from 16 to 32 bit value to allow for more options. Add hashtable in pcbinfo to hold all SO_REUSEPORT_LB sockets. Limitations: As DragonflyBSD, a load balance group is limited to 256 pcbs (256 programs or threads sharing the same socket). This is a substantially different contribution as compared to its original incarnation at svn r332894 and reverted at svn r332967. Thanks to rwatson@ for the substantive feedback that is included in this commit. Submitted by: Johannes Lundberg <johalun0@gmail.com> Obtained from: DragonflyBSD Relnotes: Yes Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D11003 Notes: svn path=/head/; revision=334719
* Revert r332894 at the request of the submitter.Sean Bruno2018-04-241-1/+1
| | | | | | | | Submitted by: Johannes Lundberg <johalun0_gmail.com> Sponsored by: Limelight Networks Notes: svn path=/head/; revision=332967
* Load balance sockets with new SO_REUSEPORT_LB optionSean Bruno2018-04-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new socket option, SO_REUSEPORT_LB, which allow multiple programs or threads to bind to the same port and incoming connections will be load balanced using a hash function. Most of the code was copied from a similar patch for DragonflyBSD. However, in DragonflyBSD, load balancing is a global on/off setting and can not be set per socket. This patch allows for simultaneous use of both the current SO_REUSEPORT and the new SO_REUSEPORT_LB options on the same system. Required changes to structures Globally change so_options from 16 to 32 bit value to allow for more options. Add hashtable in pcbinfo to hold all SO_REUSEPORT_LB sockets. Limitations As DragonflyBSD, a load balance group is limited to 256 pcbs (256 programs or threads sharing the same socket). Submitted by: Johannes Lundberg <johanlun0@gmail.com> Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D11003 Notes: svn path=/head/; revision=332894
* Remove some unneccessary variable sets in IPv6 code, as detected byJonathan T. Looney2018-03-241-1/+1
| | | | | | | | | | | | clang's static analyzer. Reviewed by: bz MFC after: 2 weeks Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D10940 Notes: svn path=/head/; revision=331484
* Do pass removing some write-only variables from the kernel.Alexander Kabaev2017-12-251-4/+2
| | | | | | | | | | | | This reduces noise when kernel is compiled by newer GCC versions, such as one used by external toolchain ports. Reviewed by: kib, andrew(sys/arm and sys/arm64), emaste(partial), erj(partial) Reviewed by: jhb (sys/dev/pci/* sys/kern/vfs_aio.c and sys/kern/kern_synch.c) Differential Revision: https://reviews.freebsd.org/D10385 Notes: svn path=/head/; revision=327173
* sys: further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-201-0/+2
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326023
* Enforce the limit on ICMP messages before doing work to formulate theJonathan T. Looney2017-05-301-4/+0
| | | | | | | | | | | | | | | | response. Delete an unneeded rate limit for UDP under IPv6. Because ICMP6 messages have their own rate limit, it is unnecessary to apply a second rate limit to UDP messages. Reviewed by: glebius MFC after: 2 weeks Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D10387 Notes: svn path=/head/; revision=319214
* The connect() system call should return -1 and set errno to EAFNOSUPPORTMichael Tuexen2017-05-221-0/+9
| | | | | | | | | | | | | | | | if it is called on a TCP socket * with an IPv6 address and the socket is bound to an IPv4-mapped IPv6 address. * with an IPv4-mapped IPv6 address and the socket is bound to an IPv6 address. Thanks to Jonathan T. Leighton for reporting this issue. Reviewed by: bz gnn MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D9163 Notes: svn path=/head/; revision=318649
* Rework r316770 to make it protocol independent and general, like weAndrey V. Elsukov2017-04-141-3/+0
| | | | | | | | | | | | | | | do for streaming sockets. And do more cleanup in the sbappendaddr_locked_internal() to prevent leak information from existing mbuf to the one, that will be possible created later by netgraph. Suggested by: glebius Tested by: Irina Liakh <spell at itl ua> MFC after: 1 week Notes: svn path=/head/; revision=316822
* Clear h/w csum flags on mbuf handled by UDP.Andrey V. Elsukov2017-04-131-0/+3
| | | | | | | | | | | | | | | | | | | | | | | When checksums of received IP and UDP header already checked, UDP uses sbappendaddr_locked() to pass received data to the socket. sbappendaddr_locked() uses given mbuf as is, and if NIC supports checksum offloading, mbuf contains csum_data and csum_flags that were calculated for already stripped headers. Some NICs support only limited checksums offloading and do not use CSUM_PSEUDO_HDR flag, and csum_data contains some value that UDP/TCP should use for pseudo header checksum calculation. When L2TP is used for tunneling with mpd5, ng_ksocket receives mbuf with filled csum_flags and csum_data, that were calculated for outer headers. When L2TP header is stripped, a packet that was tunneled goes to the IP layer and due to presence of csum_flags (without CSUM_PSEUDO_HDR) and csum_data, the UDP/TCP checksum check fails for this packet. Reported by: Irina Liakh <spell at itl ua> Tested by: Irina Liakh <spell at itl ua> MFC after: 1 week Notes: svn path=/head/; revision=316770
* The patch provides the same socket option as Linux IP_ORIGDSTADDR.Ermal Luçi2017-03-061-10/+24
| | | | | | | | | | | | | | | | Unfortunately they will have different integer value due to Linux value being already assigned in FreeBSD. The patch is similar to IP_RECVDSTADDR but also provides the destination port value to the application. This allows/improves implementation of transparent proxies on UDP sockets due to having the whole information on forwarded packets. Reviewed by: adrian, aw Approved by: ae (mentor) Sponsored by: rsync.net Differential Revision: D9235 Notes: svn path=/head/; revision=314722
* Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* Committed without approval from mentor.Ermal Luçi2017-02-121-24/+10
| | | | | | | Reported by: gnn Notes: svn path=/head/; revision=313675
* Revert r313527Ermal Luçi2017-02-101-10/+5
| | | | | | | Heh svn is not git Notes: svn path=/head/; revision=313528
* Correct missed variable name.Ermal Luçi2017-02-101-5/+10
| | | | | | | Reported-by: ohartmann@walstatt.org Notes: svn path=/head/; revision=313527
* The patch provides the same socket option as Linux IP_ORIGDSTADDR.Ermal Luçi2017-02-101-10/+24
| | | | | | | | | | | | | | | Unfortunately they will have different integer value due to Linux value being already assigned in FreeBSD. The patch is similar to IP_RECVDSTADDR but also provides the destination port value to the application. This allows/improves implementation of transparent proxies on UDP sockets due to having the whole information on forwarded packets. Sponsored-by: rsync.net Differential Revision: D9235 Reviewed-by: adrian Notes: svn path=/head/; revision=313524
* Merge projects/ipsec into head/.Andrey V. Elsukov2017-02-061-8/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Small summary ------------- o Almost all IPsec releated code was moved into sys/netipsec. o New kernel modules added: ipsec.ko and tcpmd5.ko. New kernel option IPSEC_SUPPORT added. It enables support for loading and unloading of ipsec.ko and tcpmd5.ko kernel modules. o IPSEC_NAT_T option was removed. Now NAT-T support is enabled by default. The UDP_ENCAP_ESPINUDP_NON_IKE encapsulation type support was removed. Added TCP/UDP checksum handling for inbound packets that were decapsulated by transport mode SAs. setkey(8) modified to show run-time NAT-T configuration of SA. o New network pseudo interface if_ipsec(4) added. For now it is build as part of ipsec.ko module (or with IPSEC kernel). It implements IPsec virtual tunnels to create route-based VPNs. o The network stack now invokes IPsec functions using special methods. The only one header file <netipsec/ipsec_support.h> should be included to declare all the needed things to work with IPsec. o All IPsec protocols handlers (ESP/AH/IPCOMP protosw) were removed. Now these protocols are handled directly via IPsec methods. o TCP_SIGNATURE support was reworked to be more close to RFC. o PF_KEY SADB was reworked: - now all security associations stored in the single SPI namespace, and all SAs MUST have unique SPI. - several hash tables added to speed up lookups in SADB. - SADB now uses rmlock to protect access, and concurrent threads can do SA lookups in the same time. - many PF_KEY message handlers were reworked to reflect changes in SADB. - SADB_UPDATE message was extended to support new PF_KEY headers: SADB_X_EXT_NEW_ADDRESS_SRC and SADB_X_EXT_NEW_ADDRESS_DST. They can be used by IKE daemon to change SA addresses. o ipsecrequest and secpolicy structures were cardinally changed to avoid locking protection for ipsecrequest. Now we support only limited number (4) of bundled SAs, but they are supported for both INET and INET6. o INPCB security policy cache was introduced. Each PCB now caches used security policies to avoid SP lookup for each packet. o For inbound security policies added the mode, when the kernel does check for full history of applied IPsec transforms. o References counting rules for security policies and security associations were changed. The proper SA locking added into xform code. o xform code was also changed. Now it is possible to unregister xforms. tdb_xxx structures were changed and renamed to reflect changes in SADB/SPDB, and changed rules for locking and refcounting. Reviewed by: gnn, wblock Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9352 Notes: svn path=/head/; revision=313330
* Remove the 4.3BSD compatible macro m_copy(), use m_copym() instead.Kevin Lo2016-09-151-1/+2
| | | | | | | | Reviewed by: gnn Differential Revision: https://reviews.freebsd.org/D7878 Notes: svn path=/head/; revision=305824
* Fix L2 caching for UDP over IPv6Mike Karels2016-08-241-1/+1
| | | | | | | | | | | | | | | | ip6_output() was missing cache invalidation code analougous to ip_output.c. r304545 disabled L2 caching for UDP/IPv6 as a workaround. This change adds the missing cache invalidation code and reverts r304545. Reviewed by: gnn Approved by: gnn (mentor) Tested by: peter@, Mike Andrews MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D7591 Notes: svn path=/head/; revision=304713
* Disable L2 caching for UDP over IPv6Mike Karels2016-08-201-1/+1
| | | | | | | | | | | | | | | The ip6_output routine is missing L2 cache invalication as done in ip_output. Even with that code, some problems with UDP over IPv6 have been reported. Diabling L2 cache for that problem works around the problem for now. PR: 211872 211926 Reviewed by: gnn Approved by: gnn (mentor) MFC after: immediate Notes: svn path=/head/; revision=304545
* Cleanup unneded include "opt_ipfw.h".Andrey V. Elsukov2016-06-091-1/+0
| | | | | | | | It was used for conditional build IPFIREWALL_FORWARD support. But IPFIREWALL_FORWARD option was removed a long time ago. Notes: svn path=/head/; revision=301717
* Use correct order of source and destination address and port.Michael Tuexen2016-04-291-3/+3
| | | | Notes: svn path=/head/; revision=298798
generated by cgit v1.3 (git 2.53.0) at 2026-07-31 17:17:31 +0000