freebsd-nq

History

Yaroslav Tykhiy a4eb4405e3 Disallow a particular kind of port theft described by the following scenario: Alice is too lazy to write a server application in PF-independent manner. Therefore she knocks up the server using PF_INET6 only and allows the IPv6 socket to accept mapped IPv4 as well. An evil hacker known on IRC as cheshire_cat has an account in the same system. He starts a process listening on the same port as used by Alice's server, but in PF_INET. As a consequence, cheshire_cat will distract all IPv4 traffic supposed to go to Alice's server. Such sort of port theft was initially enabled by copying the code that implemented the RFC 2553 semantics on IPv4/6 sockets (see inet6(4)) for the implied case of the same owner for both connections. After this change, the above scenario will be impossible. In the same setting, the user who attempts to start his server last will get EADDRINUSE. Of course, using IPv4 mapped to IPv6 leads to security complications in the first place, but there is no reason to make it even more unsafe. This change doesn't apply to KAME since it affects a FreeBSD-specific part of the code. It doesn't modify the out-of-box behaviour of the TCP/IP stack either as long as mapping IPv4 to IPv6 is off by default. MFC after: 1 month		2004-07-28 13:03:07 +00:00
..
ah6.h
ah_aesxcbcmac.c
ah_aesxcbcmac.h
ah_core.c
ah_input.c
ah_output.c
ah.h
dest6.c
esp6.h
esp_aesctr.c
esp_aesctr.h
esp_core.c
esp_input.c
esp_output.c
esp_rijndael.c
esp_rijndael.h
esp.h
frag6.c
icmp6.c
icmp6.h
in6_cksum.c
in6_gif.c
in6_gif.h
in6_ifattach.c
in6_ifattach.h
in6_pcb.c	Disallow a particular kind of port theft described by the following scenario:	2004-07-28 13:03:07 +00:00
in6_pcb.h
in6_prefix.c
in6_prefix.h
in6_proto.c
in6_rmx.c
in6_src.c
in6_var.h
in6.c
in6.h
ip6_ecn.h
ip6_forward.c
ip6_fw.c	Do a pass over all modules in the kernel and make them return EOPNOTSUPP	2004-07-15 08:26:07 +00:00
ip6_fw.h
ip6_id.c
ip6_input.c	Link ALTQ to the build and break with ABI for struct ifnet. Please recompile	2004-06-13 17:29:10 +00:00
ip6_mroute.c
ip6_mroute.h
ip6_output.c
ip6_var.h
ip6.h
ip6protosw.h
ipcomp6.h
ipcomp_core.c
ipcomp_input.c
ipcomp_output.c
ipcomp.h
ipsec6.h
ipsec.c
ipsec.h
mld6_var.h
mld6.c
nd6_nbr.c
nd6_rtr.c
nd6.c
nd6.h
pim6_var.h
pim6.h
raw_ip6.c	Commit a first pass at in6pcb and pcbinfo locking for IPv6,	2004-07-27 23:44:03 +00:00
raw_ip6.h
README
route6.c
scope6_var.h
scope6.c
tcp6_var.h
udp6_output.c
udp6_usrreq.c	Commit a first pass at in6pcb and pcbinfo locking for IPv6,	2004-07-27 23:44:03 +00:00
udp6_var.h

README

a note to committers about KAME tree
$FreeBSD$
KAME project


FreeBSD IPv6/IPsec tree is from KAMEproject (http://www.kame.net/).
To synchronize KAME tree and FreeBSD better today and in the future,
please understand the following:

- DO NOT MAKE COSTMETIC CHANGES.
  "Cosmetic changes" here includes tabify, untabify, removal of space at EOL,
  minor KNF items, and whatever adds more output lines on "diff freebsd kame".
  To make future synchronization easier. it is critical to preserve certain
  statements in the code.  Also, as KAME tree supports all 4 BSDs (Free, Open,
  Net, BSD/OS) in single shared tree, it is not always possible to backport
  FreeBSD changes into KAME tree.  So again, please do not make cosmetic
  changes.  Even if you think it a right thing, that will bite KAME guys badly
  during upgrade attempts, and prevent us from synchronizing two trees.
  (you don't usually make cosmetic changes against third-party code, do you?)

- REPORT CHANGES/BUGS TO KAME GUYS.
  It is not always possible for KAME guys to watch all the freebsd mailing
  list traffic, as the traffic is HUGE.  So if possible, please, inform
  kame guys of changes you made in IPv6/IPsec related portion.  Contact
  path would be snap-users@kame.net or KAME PR database on www.kame.net.
  (or to core@kame.net if it is necessary to make it confidential)

Thank you for your cooperation and have a happy IPv6 life!


Note: KAME-origin code is in the following locations.
The above notice applies to corresponding manpages too.
The list may not be complete.  If you see $KAME$ in the code, it is from
KAME distribution.  If you see some file that is IPv6/IPsec related, it is
highly possible that the file is from KAME distribution.

include/ifaddrs.h
lib/libc/net
lib/libc/net/getaddrinfo.c
lib/libc/net/getifaddrs.c
lib/libc/net/getnameinfo.c
lib/libc/net/ifname.c
lib/libc/net/ip6opt.c
lib/libc/net/map_v4v6.c
lib/libc/net/name6.c
lib/libftpio
lib/libipsec
sbin/ip6fw
sbin/ping6
sbin/rtsol
share/doc/IPv6
share/man/man4/ip6.4
share/man/man4/inet6.4
sys/crypto (except sys/crypto/rc4)
sys/kern/uipc_mbuf2.c
sys/net/if_faith.[ch]
sys/net/if_gif.[ch]
sys/net/if_stf.[ch]
sys/net/pfkeyv2.h
sys/netinet/icmp6.h
sys/netinet/in_gif.[ch]
sys/netinet/ip6.h
sys/netinet/ip_encap.[ch]
sys/netinet6
sys/netkey
usr.sbin/faithd
usr.sbin/gifconfig
usr.sbin/ifmcstat
usr.sbin/mld6query
usr.sbin/ndp
usr.sbin/pim6dd
usr.sbin/pim6sd
usr.sbin/prefix
usr.sbin/rip6query
usr.sbin/route6d
usr.sbin/rrenumd
usr.sbin/rtadvd
usr.sbin/rtsold
usr.sbin/scope6config
usr.sbin/setkey
usr.sbin/traceroute6