src/sys/netinet, branch stable/13

inpcb: Ignore SO_REUSEPORT_LB on connected sockets

2025-10-22T15:49:11Z

While TCP disallows connect()ing a socket with SO_REUSEPORT_LB, UDP does not. As a result, a connected UDP socket can be placed in the lbgroup hash and thus receive datagrams from sources other than the connected host. Reported by: Amit Klein Reported by: Omer Ben Simhon Reviewed by: glebius Approved by: so Security: FreeBSD-SA-25:09.netinet Security: CVE-2025-24934 (cherry picked from commit 320ad3dec5ff1b37f6907a47961c18b9d77e6a53)

tcp: Add CTLFLAG_VNET flag to some sysctls

2025-10-04T16:43:26Z

The two sysctls net.inet.tcp.hostcache.list and net.inet.tcp.hostcache.histo are readonly and are to operate hostcache of vnet jails. Add CTLFLAG_VNET flag to them since they are per-vnet sysctls. This change does not have any impact on reading the two sysctls, but `sysctl -ANV net.inet.tcp.hostcache` will report them correctly. Reviewed by: tuexen, #transport, #network MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D52693 (cherry picked from commit b1f96169cfb50a7b65aee115b2c9ad2f00797bbf) (cherry picked from commit 032918dfd155936a79847f17ac355439e6b59027) (cherry picked from commit ccbc722a19450df2981049777d4930deae94a840)

tcp: Fix expiring and purging hostcache entries of vnet jails

2025-10-04T16:43:25Z

A jailed process, `sysctl -j foo` or `jexec foo sysctl`, do not have privilege to write to non-vnet sysctls but only to those marked as jail writable, aka sysctls those marked with CTLFLAG_VNET flag. Without this change we will get EPERM when trying to expire and purge hostcache entries of vnet jails via the net.inet.tcp.hostcache.purgenow sysctl. Fix that by adding a CTLFLAG_VNET flag. Reviewed by: tuexen, #transport, #network Fixes: 264563806496 Add a new sysctl net.inet.tcp.hostcache.purgenow=1 to expire ... MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D52692 (cherry picked from commit 33ceb31e256e386da5a42cc7ca2ef8d4b81b6eda) (cherry picked from commit fa30199a3dbfe1d4994e7e4e63ad9c582c6f8a1a) (cherry picked from commit 79d114544fabd5a80198e925e4dc34f47a9f9e3a)

netinet: Make ip.h self-contained

2025-04-24T13:23:38Z

In general we are working towards making public headers self-contained. cdefs.h is included for __packed; just assume that types.h includes cdefs.h as that's a very common assumption. PR: 285924 Reviewed by: emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D49735 (cherry picked from commit 31d3a94bdda4a9ca4c4d7d4e8e8a0ba1b05c7f18)

icmp: use per rate limit randomized jitter

2025-02-12T14:07:19Z

Using the same random jitter for multiple rate limits allows an attacker to use one rate limiter to figure out the current jitter and then use this knowledge to de-randomize the other rate limiters. This can be mitigated by using a separate randomized jitter for each rate limiter. This issue was reported as issue number 10 in Keyu Man et al.: SCAD: Towards a Universal and Automated Network Side-Channel Vulnerability Detection Reviewed by: rrs, Peter Lei, glebius MFC after: 3 days Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D48804 (cherry picked from commit 923c223f27e792e51ca13c476428adbbf6887551)

icmp: improve INVARIANTS check

2025-02-12T14:06:14Z

Actually check the conditions that are enforced by the error checking code instead of a condition which is * checking a number to be non-negative instead of positive * depending on a random number Perform the checks consistently for ICMPv4 and ICMPv6. Reviewed by: glebius, rrs, cc MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D48001 (cherry picked from commit c9febea3dc8ac8e308e8fc5a2e74dd0313fdc5d2)

icmp: correct the assertion that checks limit + jitter

2025-02-12T14:05:14Z

Fixes: 4399e055ea610cdefa1470ad1ee614dd81ba5e56 (cherry picked from commit f7c4d12bcd5bd7f7fbf6bf9fa601c47e7f97bc5f)

icmp: allow zero value for ICMP limits

2025-02-12T14:03:22Z

Zero means limit is disabled, so the value doesn't need to be checked against jitter value. Fixes: ac44739fd834f51cacb26485a4140fd482e20150 Fixes: a03aff88a14448c3084a0384082ec996d7213897 (cherry picked from commit 4399e055ea610cdefa1470ad1ee614dd81ba5e56)

icmp: improve ICMP limit jitter

2025-02-12T10:23:36Z

Instead of fixing up invalid values set by a user in badport_bandlim() which is a fast path function, provide a sysctl handler sysctl_icmplim_and_jitter(), that will check that jitter is less than the limit. Provide jitter initilization function icmplim_new_jitter() used at boot, in the sysctl handler and when we actually hit the limit. This also fixes no jitter on a fresh booted system until first limit hit. Instead of CVE number provide link the the actual paper that explains what and why we are doing here. The CVE number isn't very informative, it will just tell you what RedHat version you need to upgrade to. Reviewed by: kp, tuexen, zlei Differential Revision: https://reviews.freebsd.org/D44478 (cherry picked from commit ac44739fd834f51cacb26485a4140fd482e20150)

icmp: when logging ICMP ratelimiting message use correct jitter value

2025-02-12T10:22:14Z

The limiting of the very last second has been done using certain jitter value. We update the jitter for the next second. But the logging should report the jitter before the change. Reviewed by: kp, tuexen, zlei Differential Revision: https://reviews.freebsd.org/D44477 (cherry picked from commit b508545ce044dbfdd83da772e73f969a3713d59d)