src-test2/sys/netinet6, branch releng/6.3

Prevent integer overflow in direct pipe write code from circumventing

2009-06-10T10:31:11Z

virtual-to-physical page lookups. [09:09] Add missing permissions check for SIOCSIFINFO_IN6 ioctl. [09:10] Fix buffer overflow in "autokey" negotiation in ntpd(8). [09:11] Approved by: so (cperciva) Approved by: re (not really, but SVN wants this...) Security: FreeBSD-SA-09:09.pipe Security: FreeBSD-SA-09:10.ipv6 Security: FreeBSD-SA-09:11.ntpd

Default to ignoring potentially evil IPv6 Neighbor Solicitation

2008-10-02T00:32:59Z

messages. Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-08:10.nd6 Thanks to: jinmei, bz

- Fix amd64 local privilege escalation. [08:07]

2008-09-03T19:09:47Z

- Fix nmount(2) local privilege escalation. [08:08] - Fix IPv6 remote kernel panics. [08:09] Fix for [08:07] is merge of r181823. Submitted by: kib [08:07], csjp [08:08], bz [08:09] Reviewed by: peter [08:07], jhb [08:07] Reviewed by: jinmei [08:09], rwatson [08:09] Approved by: re (SA blanket) Approved by: so (simon) Security: FreeBSD-SA-08:07.amd64 Security: FreeBSD-SA-08:08.nmount Security: FreeBSD-SA-08:09.icmp6

Merge in6_pcb.c:1.62.2.6 from RELENG_6 to RELENG_6_3:

2007-12-22T16:49:20Z

Fix leaking MAC labels for IPv6 inpcbs by adding missing MAC label destroy call; this transpired because the inpcb alloc path for IPv4/IPv6 is the same code, but IPv6 has a separate free path. The results was that as new IPv6 TCP connections were created, kernel memory would gradually leak. Reported by: tanyong , zhouzhouyi Approved by: re (kensmith)

MFC: Revision 1.117 of route.c as well as the fixes to close a race when

2007-10-30T18:07:55Z

trying to lookup a gateway route in rt_check().

Backport of optimized sx locks and rwlocks from FreeBSD 7.0.

2007-09-04T22:40:40Z

Reviewed by: attilio, jhb Obtained from: Juniper Networks

MFC:

2007-06-11T17:04:10Z

cleanup about the reassembly structures and routine: - removed unused structure members - fixed a minor bug that the ECN code point may not be restored correctly Approved by: ume (mentor) src/sys/netinet6/frag6.c: 1.31 src/sys/netinet6/ip6_var.h: 1.38

MFC:

2007-06-10T17:17:55Z

fixed memory leak for IPv6 multicast membership information associated with interface addresses. Approved by: gnn (mentor) src/sys/netinet6/in6.c: 1.71 src/sys/netinet6/in6_ifattach.c: 1.36 src/sys/netinet6/in6_var.h: 1.31

MFC:

2007-05-25T06:35:46Z

- Disabled responding to NI queries from a global address by default as specified in RFC4620. A new flag for icmp6_nodeinfo was added to enable the feature. - Also cleaned up the code so that the semantics of the icmp6_nodeinfo flags is clearer (i.e., defined specific macro names instead of using hard-coded values). Approved by: gnn (mentor) src/sys/netinet/icmp6.h: 1.21 src/sys/netinet6/icmp6.c: 1.76 src/sys/netinet6/in6_proto.c: 1.43

MFC nd6.c Rev.1.76-77 and nd6_nbr.c Rev.1.43-44.

2007-05-14T02:50:03Z

Fixed a memory leak in unresolved ND queue processing.