summaryrefslogtreecommitdiff
path: root/sys/netinet/tcp_input.c
AgeCommit message (Collapse)Author
2020-09-13Pull up following revision(s) (requested by kardel in ticket #1081):martin
sys/netinet/tcp_input.c: revision 1.420 PR/kern 55567 fix the data-only fast path. RCV.UP and SND.WL1 could be left behind on long sequences of data only packets. pull them along to avoid relative sequence wraps. consistent with FreeBSD addresses second failure mode of PR/kern 55567. pullup to netbsd-8 pullup to netbsd-9
2020-09-03Pull up following revision(s) (requested by kardel in ticket #1074):martin
sys/netinet/tcp_input.c: revision 1.419 Fix fast path for uni directional transfers pure ACK case: drag snd_wl2 along so only newer ACKs can update the window size. also avoids the state where snd_wl2 is eventually larger than th_ack and thus blocking the window update mechanism and the connection gets stuck for a loooong time in the zero sized send window state. see PR/kern 55567 ok thorpej@, also found in FreeBSD
2020-07-07Pull up following revision(s) (requested by christos in ticket #985):martin
sys/netinet/tcp_input.c: revision 1.418 - always set both ip and ip6, otherwise a kernel assertion can be triggered - move alignment early so that we do less work
2019-09-10Pull up following revision(s) (requested by maxv in ticket #193):martin
sys/netinet/tcp_timer.h: revision 1.30 sys/netinet/tcp_input.c: revision 1.415 sys/netinet/tcp_usrreq.c: revision 1.225 sys/netinet/tcp_subr.c: revision 1.283 Clamp tcp timer quantities to reasonable ranges.
2019-06-01Replace potentially misaligned pointer dereference + htonl() with be32dec()kamil
Reported by kUBSan.
2018-11-08"s/ an an / an /" in comment. No functional change.msaitoh
2018-09-14Use non-variadic function pointer in protosw::pr_input.maxv
2018-09-14rename toff -> offmaxv
2018-09-14rename off -> thlenmaxv
2018-09-03Rename min/max -> uimin/uimax for better honesty.riastradh
These functions are defined on unsigned int. The generic name min/max should not silently truncate to 32 bits on 64-bit systems. This is purely a name change -- no functional change intended. HOWEVER! Some subsystems have #define min(a, b) ((a) < (b) ? (a) : (b)) #define max(a, b) ((a) > (b) ? (a) : (b)) even though our standard name for that is MIN/MAX. Although these may invite multiple evaluation bugs, these do _not_ cause integer truncation. To avoid `fixing' these cases, I first changed the name in libkern, and then compile-tested every file where min/max occurred in order to confirm that it failed -- and thus confirm that nothing shadowed min/max -- before changing it. I have left a handful of bootloaders that are too annoying to compile-test, and some dead code: cobalt ews4800mips hp300 hppa ia64 luna68k vax acorn32/if_ie.c (not included in any kernels) macppc/if_gm.c (superseded by gem(4)) It should be easy to fix the fallout once identified -- this way of doing things fails safe, and the goal here, after all, is to _avoid_ silent integer truncations, not introduce them. Maybe one day we can reintroduce min/max as type-generic things that never silently truncate. But we should avoid doing that for a while, so that existing code has a chance to be detected by the compiler for conversion to uimin/uimax without changing the semantics until we can properly audit it all. (Who knows, maybe in some cases integer truncation is actually intended!)
2018-05-18IP6_EXTHDR_GET -> M_REGION_GET, no functional change.maxv
2018-05-03Remove now unused tcpip.h includes. Some were already unused before.maxv
2018-04-28Remove unused ipsec_var.h includes.maxv
2018-04-08Remove the ipre_mlast field and the TRAVERSE macro.maxv
The goal was to store in ipre_mlast the last mbuf of the chain, so that m_cat could be called on it. But it's not needed, since m_cat already does the equivalent of TRAVERSE itself. If it were needed, there would be a bug, since we don't call TRAVERSE on ipre_mlast when creating a new reassembly entry.
2018-04-03Remove ipsec_copy_policy and ipsec_copy_pcbpolicy. No functional change,maxv
since we used only ipsec_copy_pcbpolicy, and it was a no-op. Originally we were using ipsec_copy_policy to optimize the IPsec-PCB cache: when an ACK was received in response to a SYN, we used to copy the SP cached in the SYN's PCB into the ACK's PCB, so that ipsec_getpolicybysock could use the cached SP instead of requerying it. Then we switched to ipsec_copy_pcbpolicy which has always been a no-op. As a result the SP cached in the SYN was/is not copied in the ACK, and the first call to ipsec_getpolicybysock had to query the SP and cache it itself. It's not totally clear to me why this change was made. But it has been this way for years, and after a conversation with Ryota Ozaki it turns out the optimization is not valid anymore due to MP-ification, so it won't be re-enabled. ok ozaki-r@
2018-03-30Fix the log. mtod never returns NULL, so 'ip' is always non-NULL, and themaxv
'ip6' branch is never taken. As a result we log garbage on IPv6 packets. Use ip_v instead.
2018-03-30Use consttime_memequal instead of memcmp, to prevent side channels. Thismaxv
functions returns 1 when the buffers are equal, contrary to memcmp, hence the !.
2018-03-29tcp_urp_drop: fix a bug introduced in 1.390 rev (hi maxv@).rmind
2018-03-29Remove TCPREASS_DEBUG. It was introduced 20 years ago when the reassemblermaxv
was being developed, but it's irrelevant today. Makes the code clearer.
2018-03-29Reorder/Fix comments to clarify.maxv
2018-03-29Remove two more 'else' branches.maxv
2018-03-29Fix memory leak, we may reallocate 'tcp_saveti' after 'findpcb'. It's notmaxv
a tragic bug, because it happens only on sockets with debug enabled.
2018-03-29Remove 'else', makes it clearer that we leave.maxv
2018-03-29Clarify with KASSERT.maxv
2018-03-29Simplify the computation:maxv
m->m_pkthdr.len - sizeof(struct tcphdr) - optlen - hlen = m->m_pkthdr.len - (sizeof(struct tcphdr) + optlen + hlen) = m->m_pkthdr.len - [tcp_len] = toff
2018-03-28Several changes in syn_cache_respond:maxv
* Replace idiotic diagnostic check by KASSERT. max_linkhdr+tlen<=MCLBYTES is a widespread assumption. * Improve initialization of 'tp'. * Put panics in dead branches. * Merge two switches.
2018-03-28Remove unused variable.maxv
2018-03-28Remove two unused args from syn_cache_get().maxv
2018-03-28Dedup: introduce tcp_urp_drop() and use it.maxv
2018-03-28Minor changes: style, improve comments (and put them at the correct place),maxv
use NULL for pointers, and add {}s to prevent confusion.
2018-03-23Remove #ifdef INET. Nobody is doing that in the kernel, and there aremaxv
even IPv4 places that are not covered here.
2018-03-23Improve a bit here and there. Replace bcopy by memcpy/memmove.maxv
2018-03-22Don't pass a pointer to tcp_reass, otherwise it looks like it can modifymaxv
tlen while it doesn't.
2018-03-22Rearrange a bit. No real functional change.maxv
2018-03-22Don't call tcp_input_checksum again, it was already called earlier, nomaxv
need to checksum twice. Then call tcp_fields_to_host a bit earlier, so that we don't need to call it in each branch.
2018-03-01Revert rev1.183 (2003).maxv
It was intended as an optimization, but it increases the attack surface: the IPsec policy is not enforced on RST packets when the socket is in the LISTEN state, and an (unauthenticated) attacker could jam the connection between two IPsec hosts by sending RST packets between the client's SYN and ACK packets. Discussed with ozaki-r@.
2018-02-28Remove unused ipsec_private.h includes.maxv
2018-02-28Remove duplicate IPSEC_STATINC(IPSEC_STAT_IN_POLVIO), ipsec_in_rejectmaxv
already increases it. IPSEC6_STATINC is now unused, so remove it too.
2018-02-26Dedup: merge ipsec4_in_reject and ipsec6_in_reject into ipsec_in_reject.maxv
While here fix misleading comment. ok ozaki-r@
2018-02-12Remove unused argument from tcp_signature_getsav.maxv
2018-02-12Add a KASSERT.maxv
2018-02-12Remove the 'm' argument from syn_cache_respond(); all it does with it ismaxv
freeing it, so free in the caller instead.
2018-02-12Remove this multicast check. Multicast packets are already dropped atmaxv
the beginning of the function.
2018-02-09Style, and move the 'ip_srcroute' call after 'tcp_dooptions', otherwisemaxv
we're leaking 'ipopts'. (Harmless, since TCP_SIGNATURE is disabled.)
2018-02-08Style, rename a variable, and remove an unreachable case.maxv
2018-02-08Move the IPv4 multicast check earlier; we want to kick multicast packetsmaxv
all the time, and not just when they are SYNs. The IPv6 multicast check is already done earlier, so this block of code can be removed.
2018-02-08Remove the unused 'multicast' argument from tcp_vtw_input, and removemaxv
the now-unused multicast detection code. It couldn't have been correct on IPv6, since multicast packets are kicked at the beginning of the function.
2018-02-08Remove the default case, the beginning of the function already ensuresmaxv
af == AF_INET || af == AF_INET6.
2018-02-08Dedup code.maxv
2018-02-08Remove the IN6_IS_ADDR_V4MAPPED checks in the protocol functions. Theymaxv
are useless, because the IPv6 entry point (ip6_input) already performs them. The checks were first added in the protocol functions: Wed Dec 22 04:03:02 1999 UTC (18 years, 1 month ago) by itojun "drop IPv6 packets with v4 mapped address on src/dst. they are illegal and may be used to fool IPv6 implementations (by using ::ffff:127.0.0.1 as source you may be able to pretend the packet is from local node)" Shortly afterwards they were also added in the IPv6 entry point, but where not removed from the protocol functions: Mon Jan 31 10:33:22 2000 UTC (18 years ago) by itojun "be proactive about malicious packet on the wire. we fear that v4 mapped address to be used as a tool to hose security filters (like bypassing "local host only" filter by using ::ffff:127.0.0.1)." OpenBSD did the same a few months ago. FreeBSD has never had these checks.