Commit Graph

459 Commits

Author SHA1 Message Date
Alexander Langer
3b46e732a4 Bring back part of rev 1.44 which was commented out by rev 1.58.
Reviewed by:	nate
1997-12-27 18:44:56 +00:00
David Greenman
42fa505b7e The spl fixes in in_setsockaddr and in_setpeeraddr that were meant to
fix PR#3618 weren't sufficient since malloc() can block - allowing the
net interrupts in and leading to the same problem mentioned in the
PR (a panic). The order of operations has been changed so that this
is no longer a problem.
Needs to be brought into the 2.2.x branch.
PR:		3618
1997-12-25 06:57:36 +00:00
Alexander Langer
90d0144c05 Removed unnecessary setting of 'error' -- binding to a privileged port
by a non-root user always returns EACCES.
1997-12-23 01:40:40 +00:00
Bruce Evans
c5a1016bf4 Fixed gratuitous ANSIisms. 1997-12-20 00:07:11 +00:00
Bruce Evans
592071e854 Don't use ANSI string concatenation to misformat a string. 1997-12-19 23:46:21 +00:00
Bruce Evans
d342b533eb Removed a stale comment. (We don't declare ip_len and ip_offset as
short.  I guess we depend on bogus ANSI value-preserving extension
of u_short to int to avoid unsigned comparison bugs.)
1997-12-19 23:33:08 +00:00
Julian Elischer
45d6875df6 Fix an incredibly horrible bug in the ipfw code
where if you are using the "reset tcp" firewall command,
the kernel would write ethernet headers onto random kernel stack locations.

Fought to the death by: terry, julian, archie.
fix valid for 2.2 series as well.
1997-12-19 03:36:15 +00:00
David Greenman
744f87ea73 Fixed a missing splx(s) bug in tcp_usr_send(). 1997-12-18 09:50:38 +00:00
David Greenman
86b3ebce35 Call in_pcballoc() at splnet(). As near as I can tell, this won't fix
any instability problems, but it was wrong nonetheless and will be
required in an upcoming round of PCB changes.
1997-12-18 09:13:39 +00:00
Eivind Eklund
430df5f4b7 Throw options IPX, IPXIP and IPTUNNEL into opt_ipx.h.
The #ifdef IPXIP in netipx/ipx_if.h is OK (used from ipx_usrreq.c and
ifconfig.c only).

I also fixed a typo IPXTUNNEL -> IPTUNNEL (and #ifdef'ed out the code
inside, as it never could have compiled - doh.)
1997-12-15 20:31:25 +00:00
Garrett Wollman
76d3eadb53 Add Matt Dillon's quick fix hack for the self-connect DoS.
PR:		5103
1997-11-20 20:04:49 +00:00
Peter Wemm
8ecccc4f64 This commit was generated by cvs2svn to compensate for changes in r31187,
which included commits to RCS files with non-trunk default branches.
1997-11-16 05:55:52 +00:00
Peter Wemm
52aef1787c Import kernel parts of ipfilter-3.2.1 1997-11-16 05:55:52 +00:00
Julian Elischer
79755dc52b Submitted by: Archie cobbs (IPDIVERT author)
close small security hole where an atacker could sendpackets with
IPDIVERT protocol, and select how it would be diverted thus bypassing
the ipfirewall.  Discovered by inspection rather than attack.
(you'd have to know how the firewall was configured (EXACTLY) to
make use of this but..)
1997-11-13 22:57:57 +00:00
Poul-Henning Kamp
0abc78a697 Rename some local variables to avoid shadowing other local variables.
Found by: -Wshadow
1997-11-07 09:21:01 +00:00
Poul-Henning Kamp
4a11ca4e29 Remove a bunch of variables which were unused both in GENERIC and LINT.
Found by:	-Wunused
1997-11-07 08:53:44 +00:00
Joerg Wunsch
fbd1372a0b Make IPDIVERT a supported option. Alas, in_var.h depends on it, i
hope i've found out all files that actually depend on this dependancy.
IMHO, it's not very good practice to change the size of internal
structs depending on kernel options.
1997-11-05 20:17:23 +00:00
Julian Elischer
d314ad7b73 Return the entire if info, rather than just the index number. (at least try)
Interface index numbers are an abomination that should go away
(at least in that form)
1997-11-05 02:51:32 +00:00
Guido van Rooij
bc189bf8f7 Fix bugs from my previous commit
Submitted by:	Bruce Evans
1997-10-28 18:55:21 +00:00
Bruce Evans
55b211e3af Removed unused #includes. 1997-10-28 15:59:26 +00:00
Guido van Rooij
efa4858705 When dosourcerouting is set do not sourceoute.... 1997-10-27 21:07:26 +00:00
Poul-Henning Kamp
a1c995b626 Last major round (Unless Bruce thinks of somthing :-) of malloc changes.
Distribute all but the most fundamental malloc types.  This time I also
remembered the trick to making things static:  Put "static" in front of
them.

A couple of finer points by:	bde
1997-10-12 20:26:33 +00:00
Poul-Henning Kamp
55166637cd Distribute and statizice a lot of the malloc M_* types.
Substantial input from:	bde
1997-10-11 18:31:40 +00:00
Bill Fenner
610a2e9ca5 Don't allow the window to be increased beyond what is possible to
represent in the TCP header.  The old code did effectively:
	win = min(win, MAX_ALLOWED);
	win = max(win, what_i_think_i_advertised_last_time);
so if what_i_think_i_advertised_last_time is bigger than can be
represented in the header (e.g. large buffers and no window scaling)
then we stuff a too-big number into a short.  This fix reverses the
order of the comparisons.

PR:		kern/4712
1997-10-07 21:10:06 +00:00
David Greenman
4281faf253 Killed the SYN_RECEIVED addition from rev 1.52. It results in legitimate
RST's being ignored, keeping a connection around until it times out, and
thus has the opposite effect of what was intended (which is to make the
system more robust to DoS attacks).
1997-10-02 02:10:40 +00:00
Bill Fenner
026650e576 Don't consider a SYN/ACK with CC but no CCECHO a proper T/TCP
handshake.

Reviewed by:	Rich Stevens <rstevens@kohala.com>
1997-09-30 16:38:09 +00:00
Garrett Wollman
6fce01c990 Export ipstat via sysctl. Don't understand why this wasn't done before. 1997-09-25 00:34:35 +00:00
Justin T. Gibbs
6c951b4441 Update for new callout interface. 1997-09-21 22:02:25 +00:00
Joerg Wunsch
0cc12cc57e Make TCPDEBUG a new-style option. 1997-09-16 18:36:06 +00:00
Bruce Evans
514ede0953 Fixed gratuitous ANSIisms. 1997-09-16 11:44:05 +00:00
Andrey A. Chernov
194a213eff Prevent overflow with fragmented packets
Reviewed by: wollman
1997-09-15 23:07:01 +00:00
Peter Wemm
f8f6cbba92 Update network code to use poll support. 1997-09-14 03:10:42 +00:00
Peter Wemm
5bfe67ef0a Some mbuf -> sockaddr changes seem to have been missed here. 1997-09-13 15:40:55 +00:00
Peter Wemm
ffdd472de7 Allow a compile-time override of the ipfw deny rule. For a 'firewall'
you don't want this (and the documentation explains why), but if you
use ipfw as an as-needed casual filter as needed which normally runs as
'allow all' then having the kernel and /sbin/ipfw get out of sync is a
*MAJOR* pain in the behind.

PR: 4141
Submitted by: Heikki Suonsivu <hsu@mail.clinet.fi>
1997-09-10 03:07:14 +00:00
Bruce Evans
bea0f0be7b Some staticized variables were still declared to be extern. 1997-09-07 05:27:26 +00:00
Brian Somers
59354a4e8d Upgrade to 2.4 (Fix -PKT_ALIAS_UNREGISTERED_ONLY)
Submitted by:	Charles Mott <cmott@srv.net>

Add __libalias_version so that ppp can derive the
correct library name for dlopen()
1997-09-06 11:11:43 +00:00
Bruce Evans
4d1d4912ae Added used #include - don't depend on <sys/mbuf.h> including
<sys/malloc.h> (unless we only use the bogusly shared M*WAIT flags).
1997-09-02 01:19:47 +00:00
Garrett Wollman
fe0fb8abd0 ICMP Timestamp Request messages could have harbored the same sort of
problem as Echo Requests when broad/multicast.  When multicast echo responses
are disabled, also do the same for timestamp responses.
1997-08-25 16:29:27 +00:00
Garrett Wollman
7022ea0a0c Configurably don't reply to broadcast or multicast echos. There are still
potential problems with other automatic-reply ICMPs, but some of them may
depend on broadcast/multicast to operate.  (This code can simply be
moved to the `reflect' label to generalize it.)
1997-08-25 01:25:31 +00:00
Alexander Langer
643811317c Fixed logging of verbose limited packets.
PR:		4351
Submitted by:	Ron Bickers <rbickers@intercenter.net>
1997-08-23 14:28:22 +00:00
Garrett Wollman
57bf258e3d Fix all areas of the system (or at least all those in LINT) to avoid storing
socket addresses in mbufs.  (Socket buffers are the one exception.)  A number
of kernel APIs needed to get fixed in order to make this happen.  Also,
fix three protocol families which kept PCBs in mbufs to not malloc them
instead.  Delete some old compatibility cruft while we're at it, and add
some new routines in the in_cksum family.
1997-08-16 19:16:27 +00:00
Brian Somers
4fe071a9f7 Fix file descriptor leak.
Submitted by:	Charles Mott <cmott@srv.net>
Identified by:	Gordon Burditt
1997-08-11 22:05:10 +00:00
Alexander Langer
750f6aad7b Support interface names up to 15 characters in length. In order to
accommodate the expanded name, the ICMP types bitmap has been
reduced from 256 bits to 32.

A recompile of kernel and user level ipfw is required.

To be merged into 2.2 after a brief period in -current.

PR:		bin/4209
Reviewed by:	Archie Cobbs <archie@whistle.com>
1997-08-08 14:36:29 +00:00
Alexander Langer
37d06d64cd Ensure that the interface name is terminated. 1997-08-06 00:19:05 +00:00
Brian Somers
3efa11bb71 Update to version 2.2. Only the PacketAlias*()
functions should now be used.  The old 2.1 stuff is
there for backwards compatability.
Submitted by:	Charles Mott <cmott@snake.srv.net>
1997-08-03 18:20:03 +00:00
Bruce Evans
1fd0b0588f Removed unused #includes. 1997-08-02 14:33:27 +00:00
Brian Somers
af782f1c59 Recalculate ip_sum before passing a
re-assembled packet to a divert port.
Pointed-out by:	Ari Suutari <ari@suutari.iki.fi>
VS:   then name the system in this line, otherwise delete it.
1997-07-25 03:58:21 +00:00
Bill Fenner
407529c04f Remove crufty LBL ifdef that only applies to Suns.
Submitted by:	Craig Leres <leres@ee.lbl.gov>
1997-07-19 20:07:07 +00:00
John Polstra
66e39adc7c Fix a bug (apparently very old) that can cause a TCP connection to
be dropped when it has an unusual traffic pattern.  For full details
as well as a test case that demonstrates the failure, see the
referenced PR.

Under certain circumstances involving the persist state, it is
possible for the receive side's tp->rcv_nxt to advance beyond its
tp->rcv_adv.  This causes (tp->rcv_adv - tp->rcv_nxt) to become
negative.  However, in the code affected by this fix, that difference
was interpreted as an unsigned number by max().  Since it was
negative, it was taken as a huge unsigned number.  The effect was
to cause the receiver to believe that its receive window had negative
size, thereby rejecting all received segments including ACKs.  As
the test case shows, this led to fruitless retransmissions and
eventually to a dropped connection.  Even connections using the
loopback interface could be dropped.  The fix substitutes the signed
imax() for the unsigned max() function.

PR:		closes kern/3998
Reviewed by:	davidg, fenner, wollman
1997-07-01 05:42:16 +00:00
Garrett Wollman
131d416032 Add for public examination the beginnings of the per-host cache support
which will for the basis of RTF_PRCLONING's more efficient, better-
designed replacement.
1997-06-18 01:24:28 +00:00