Yaroslav Tykhiy a4eb4405e3 Disallow a particular kind of port theft described by the following scenario: ... Alice is too lazy to write a server application in PF-independent manner. Therefore she knocks up the server using PF_INET6 only and allows the IPv6 socket to accept mapped IPv4 as well. An evil hacker known on IRC as cheshire_cat has an account in the same system. He starts a process listening on the same port as used by Alice's server, but in PF_INET. As a consequence, cheshire_cat will distract all IPv4 traffic supposed to go to Alice's server. Such sort of port theft was initially enabled by copying the code that implemented the RFC 2553 semantics on IPv4/6 sockets (see inet6(4)) for the implied case of the same owner for both connections. After this change, the above scenario will be impossible. In the same setting, the user who attempts to start his server last will get EADDRINUSE. Of course, using IPv4 mapped to IPv6 leads to security complications in the first place, but there is no reason to make it even more unsafe. This change doesn't apply to KAME since it affects a FreeBSD-specific part of the code. It doesn't modify the out-of-box behaviour of the TCP/IP stack either as long as mapping IPv4 to IPv6 is off by default. MFC after: 1 month		2004-07-28 13:03:07 +00:00
..
libalias	Push WARNS back up to 6, but define NO_WERROR; I want the warts out in the	2004-07-06 12:15:24 +00:00
accf_data.c
accf_http.c
icmp6.h
icmp_var.h
if_atm.c
if_atm.h
if_ether.c
if_ether.h
igmp_var.h
igmp.c
igmp.h
in_cksum.c
in_gif.c
in_gif.h
in_pcb.c	Disallow a particular kind of port theft described by the following scenario:	2004-07-28 13:03:07 +00:00
in_pcb.h	Remove erroneous semicolons.	2004-07-13 16:06:19 +00:00
in_proto.c
in_rmx.c
in_systm.h
in_var.h
in.c
in.h
ip6.h
ip_divert.c
ip_divert.h
ip_dummynet.c	Do a pass over all modules in the kernel and make them return EOPNOTSUPP	2004-07-15 08:26:07 +00:00
ip_dummynet.h
ip_ecn.c
ip_ecn.h
ip_encap.c
ip_encap.h
ip_fastfwd.c
ip_fw2.c	Extend versrcreach by checking against the rt_flags for RTF_REJECT and	2004-07-21 19:55:14 +00:00
ip_fw.h
ip_gre.c
ip_gre.h
ip_icmp.c	Define semantic of M_SKIP_FIREWALL more precisely, i.e. also pass associated	2004-07-17 05:10:06 +00:00
ip_icmp.h
ip_id.c
ip_input.c	Change the following environment variables to kernel options:	2004-07-08 22:35:36 +00:00
ip_mroute.c	Do a pass over all modules in the kernel and make them return EOPNOTSUPP	2004-07-15 08:26:07 +00:00
ip_mroute.h
ip_output.c
ip_var.h
ip.h
ipprotosw.h
pim_var.h
pim.h
raw_ip.c	Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This is	2004-07-26 07:24:04 +00:00
tcp_debug.c
tcp_debug.h
tcp_fsm.h
tcp_hostcache.c
tcp_input.c	After each label in tcp_input(), assert the inpcbinfo and inpcb lock	2004-07-12 19:28:07 +00:00
tcp_output.c	Fix a bug in the sack code that was causing data to be retransmitted	2004-07-28 02:15:14 +00:00
tcp_reass.c	After each label in tcp_input(), assert the inpcbinfo and inpcb lock	2004-07-12 19:28:07 +00:00
tcp_sack.c
tcp_seq.h
tcp_subr.c	Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This is	2004-07-26 07:24:04 +00:00
tcp_syncache.c	Fix the !INET6 build.	2004-07-17 21:40:14 +00:00
tcp_timer.c
tcp_timer.h
tcp_timewait.c	Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This is	2004-07-26 07:24:04 +00:00
tcp_usrreq.c	compare pointer against NULL, not 0	2004-07-26 21:29:56 +00:00
tcp_var.h	The tcp syncache code was leaving the IPv6 flowlabel uninitialised	2004-07-17 19:44:13 +00:00
tcp.h
tcpip.h
udp_usrreq.c	Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This is	2004-07-26 07:24:04 +00:00
udp_var.h
udp.h