Jesper Skriver 690a6055ff Prevent denial of service using bogus fragmented IPv4 packets. ... A attacker sending a lot of bogus fragmented packets to the target (with different IPv4 identification field - ip_id), may be able to put the target machine into mbuf starvation state. By setting a upper limit on the number of reassembly queues we prevent this situation. This upper limit is controlled by the new sysctl net.inet.ip.maxfragpackets which defaults to 200, as the IPv6 case, this should be sufficient for most systmes, but you might want to increase it if you have lots of TCP sessions. I'm working on making the default value dependent on nmbclusters. If you want old behaviour (no upper limit) set this sysctl to a negative value. If you don't want to accept any fragments (not recommended) set the sysctl to 0 (zero). Obtained from: NetBSD MFC after: 1 week		2001-06-03 23:33:23 +00:00
..
libalias	Add an integer field to keep protocol-specific flags with links.	2001-05-30 14:24:35 +00:00
accf_data.c
accf_http.c
fil.c
icmp6.h
icmp_var.h
if_atm.c
if_atm.h
if_ether.c	Add a missing m_pullup() before a mtod() in in_arpinput().	2001-03-27 12:34:58 +00:00
if_ether.h
if_fddi.h
igmp_var.h
igmp.c
igmp.h
in_cksum.c
in_gif.c
in_gif.h
in_hostcache.c
in_hostcache.h
in_pcb.c	Fix a style(9) nit.	2001-03-16 19:36:23 +00:00
in_pcb.h	Remove in_pcbnotify and use in_pcblookup_hash to find the cb directly.	2001-02-26 21:19:47 +00:00
in_proto.c
in_rmx.c	In in_ifadown(), differentiate between whether the interface goes	2001-05-11 14:37:34 +00:00
in_systm.h
in_var.h	In in_ifadown(), differentiate between whether the interface goes	2001-05-11 14:37:34 +00:00
in.c	In in_ifadown(), differentiate between whether the interface goes	2001-05-11 14:37:34 +00:00
in.h	IPv4 address is not unsigned int. This change introduces in_addr_t.	2001-03-23 18:59:31 +00:00
ip6.h
ip_auth.c
ip_auth.h
ip_compat.h
ip_divert.c
ip_dummynet.c
ip_dummynet.h
ip_ecn.c
ip_ecn.h
ip_encap.c
ip_encap.h
ip_fil.c
ip_fil.h
ip_flow.c
ip_flow.h
ip_frag.c	fix security hole created by fragment cache	2001-04-06 15:52:28 +00:00
ip_frag.h	fix security hole created by fragment cache	2001-04-06 15:52:28 +00:00
ip_ftp_pxy.c
ip_fw.c	pipe/queue are the only consumers of flow_id, so only set it in those cases	2001-04-06 06:52:25 +00:00
ip_fw.h
ip_icmp.c	MFC candidate.	2001-03-28 14:13:19 +00:00
ip_icmp.h
ip_id.c	Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.	2001-06-01 10:02:28 +00:00
ip_input.c	Prevent denial of service using bogus fragmented IPv4 packets.	2001-06-03 23:33:23 +00:00
ip_log.c
ip_mroute.c	Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.	2001-06-01 10:02:28 +00:00
ip_mroute.h
ip_nat.c	fix security hole created by fragment cache	2001-04-06 15:52:28 +00:00
ip_nat.h	fix security hole created by fragment cache	2001-04-06 15:52:28 +00:00
ip_output.c	Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.	2001-06-01 10:02:28 +00:00
ip_proxy.c
ip_proxy.h
ip_raudio_pxy.c
ip_rcmd_pxy.c
ip_state.c	fix security hole created by fragment cache	2001-04-06 15:52:28 +00:00
ip_state.h
ip_var.h	Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.	2001-06-01 10:02:28 +00:00
ip.h
ipl.h
ipprotosw.h
mlfk_ipl.c	Send the remains (such as I have located) of "block major numbers" to	2001-03-26 12:41:29 +00:00
raw_ip.c	Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.	2001-06-01 10:02:28 +00:00
tcp_debug.c
tcp_debug.h
tcp_fsm.h
tcp_input.c	Inline TCP_REASS() in the single location where it's used,	2001-05-29 19:54:45 +00:00
tcp_output.c	Undo part of the tangle of having sys/lock.h and sys/mutex.h included in	2001-05-01 08:13:21 +00:00
tcp_reass.c	Inline TCP_REASS() in the single location where it's used,	2001-05-29 19:54:45 +00:00
tcp_seq.h	Say goodbye to TCP_COMPAT_42	2001-04-20 11:58:56 +00:00
tcp_subr.c	Say goodbye to TCP_COMPAT_42	2001-04-20 11:58:56 +00:00
tcp_timer.c	Disable rfc1323 and rfc1644 TCP extensions if we havn't got	2001-05-31 19:24:49 +00:00
tcp_timer.h
tcp_timewait.c	Say goodbye to TCP_COMPAT_42	2001-04-20 11:58:56 +00:00
tcp_usrreq.c	Say goodbye to TCP_COMPAT_42	2001-04-20 11:58:56 +00:00
tcp_var.h	Randomize the TCP initial sequence numbers more thoroughly.	2001-04-17 18:08:01 +00:00
tcp.h
tcpip.h	Remove struct full_tcpiphdr{}.	2001-02-26 20:10:16 +00:00
udp_usrreq.c	Count and show incoming UDP datagrams with no checksum.	2001-03-13 13:26:06 +00:00
udp_var.h
udp.h