d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
freebsd-nq/sys/netinet
History
Andre Oppermann 1aedbd9c80 Move Path MTU discovery ICMP processing from icmp_input() to 
tcp_ctlinput() and subject it to active tcpcb and sequence
number checking.  Previously any ICMP unreachable/needfrag
message would cause an update to the TCP hostcache.  Now only
ICMP PMTU messages belonging to an active TCP session with
the correct src/dst/port and sequence number will update the
hostcache and complete the path MTU discovery process.

Note that we don't entirely implement the recommended counter
measures of Section 7.2 of the paper.  However we close down
the possible degradation vector from trivially easy to really
complex and resource intensive.  In addition we have limited
the smallest acceptable MTU with net.inet.tcp.minmss sysctl
for some time already, further reducing the effect of any
degradation due to an attack.

Security:	draft-gont-tcpm-icmp-attacks-03.txt Section 7.2
MFC after:	3 days
2005-04-21 14:29:34 +00:00
..
libalias
natd core dumps when -reverse switch is used because of a bug in
2005-04-05 13:04:35 +00:00
accf_data.c
add missing #include <sys/module.h>
2004-05-30 20:27:19 +00:00
accf_http.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
icmp6.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
icmp_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
if_atm.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
if_atm.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
if_ether.c
Embrace with #ifdef DEV_CARP carp-related code.
2005-03-13 11:23:22 +00:00
if_ether.h
Add CARP (Common Address Redundancy Protocol), which allows multiple
2005-02-22 13:04:05 +00:00
igmp_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
igmp.c
deal with malloc failures
2005-03-26 22:20:22 +00:00
igmp.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_cksum.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_gif.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_gif.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_pcb.c
o Tweak the comment a bit.
2005-04-08 08:43:21 +00:00
in_pcb.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_proto.c
Add CARP (Common Address Redundancy Protocol), which allows multiple
2005-02-22 13:04:05 +00:00
in_rmx.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_systm.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
in.c
ifma_protospec is a pointer. Use NULL when assigning or compating it.
2005-03-20 14:31:45 +00:00
in.h
Add CARP (Common Address Redundancy Protocol), which allows multiple
2005-02-22 13:04:05 +00:00
ip6.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_carp.c
Remove anti-LOR bandaid, it is not needed now.
2005-04-20 09:32:05 +00:00
ip_carp.h
Add CARP (Common Address Redundancy Protocol), which allows multiple
2005-02-22 13:04:05 +00:00
ip_divert.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_divert.h
Convert IPDIVERT into a loadable module. This makes use of the dynamic loadability
2004-10-19 21:14:57 +00:00
ip_dummynet.c
Make DUMMYNET compile without INET6
2005-04-19 10:12:21 +00:00
ip_dummynet.h
Add IPv6 support to IPFW and Dummynet.
2005-04-18 18:35:05 +00:00
ip_ecn.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_ecn.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_encap.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_encap.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_fastfwd.c
- Don't free mbuf, passed to interface output method if the latter
2005-03-29 13:43:09 +00:00
ip_fw2.c
typo
2005-04-19 10:04:38 +00:00
ip_fw_pfil.c
Add IPv6 support to IPFW and Dummynet.
2005-04-18 18:35:05 +00:00
ip_fw.h
Add IPv6 support to IPFW and Dummynet.
2005-04-18 18:35:05 +00:00
ip_gre.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_gre.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_icmp.c
Move Path MTU discovery ICMP processing from icmp_input() to
2005-04-21 14:29:34 +00:00
ip_icmp.h
Move Path MTU discovery ICMP processing from icmp_input() to
2005-04-21 14:29:34 +00:00
ip_id.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_input.c
o Nano optimize ip_reass() code path for the first fragment: do not
2005-04-08 10:25:13 +00:00
ip_mroute.c
Use NET_CALLOUT_MPSAFE macro.
2005-03-01 12:01:17 +00:00
ip_mroute.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip_output.c
Bring back the full packet destination manipulation for 'ipfw fwd'
2005-02-22 17:40:40 +00:00
ip_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ip.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
ipprotosw.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
pim_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
pim.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
raw_ip.c
eliminate extraneous null ptr checks
2005-03-29 01:10:46 +00:00
tcp_debug.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_debug.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_fsm.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_hostcache.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_input.c
Fix for a TCP SACK bug where more than (win/2) bytes could have been
2005-04-14 20:09:52 +00:00
tcp_output.c
Ignore ICMP Source Quench messages for TCP sessions. Source Quench is
2005-04-21 12:37:12 +00:00
tcp_reass.c
Fix for a TCP SACK bug where more than (win/2) bytes could have been
2005-04-14 20:09:52 +00:00
tcp_sack.c
Rewrite of tcp_update_sack_list() to make it simpler and more readable
2005-04-18 18:10:56 +00:00
tcp_seq.h
- Tighten up the Timestamp checks to prevent a spoofed segment from
2005-04-10 05:24:59 +00:00
tcp_subr.c
Move Path MTU discovery ICMP processing from icmp_input() to
2005-04-21 14:29:34 +00:00
tcp_syncache.c
Use NET_CALLOUT_MPSAFE macro.
2005-03-01 12:01:17 +00:00
tcp_timer.c
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_timer.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcp_timewait.c
Move Path MTU discovery ICMP processing from icmp_input() to
2005-04-21 14:29:34 +00:00
tcp_usrreq.c
eliminate extraneous null ptr checks
2005-03-29 01:10:46 +00:00
tcp_var.h
Ignore ICMP Source Quench messages for TCP sessions. Source Quench is
2005-04-21 12:37:12 +00:00
tcp.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
tcpip.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
udp_usrreq.c
eliminate extraneous null ptr checks
2005-03-29 01:10:46 +00:00
udp_var.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00
udp.h
/* -> /*- for license, minor formatting changes
2005-01-07 01:45:51 +00:00