kernel - Fix auto port assignment collision in network code

* When the SO_REUSEADDR or SO_REUSEPORT socket option is set on a
socket undergoing automatic lport assignment, the auto network port

kernel - Fix auto port assignment collision in network code

* When the SO_REUSEADDR or SO_REUSEPORT socket option is set on a
socket undergoing automatic lport assignment, the auto network port
assignment code in the kernel improperly ignores collisions against
ports assigned to wildcard sockets and may assign the same port. This
causes later connect() calls to fail.

* Can cause gdb services to sometimes fail to connect.

* Fixed by ignoring the options for the purposes of finding an unused
port.

Reported-by: Sergey Zigachev (servik)

show more ...

inet6: require RTF_ANNOUNCE to proxy NS

Otherwise it's impossible for an ip6router to also host IP6
capable VM's as they would fail Duplicate Address Detection.
This mirrors the behaviour of other B

inet6: require RTF_ANNOUNCE to proxy NS

Otherwise it's impossible for an ip6router to also host IP6
capable VM's as they would fail Duplicate Address Detection.
This mirrors the behaviour of other BSD's.

show more ...

inet6: Set net.inet6.icmp6.nd6_onlink_ns_rfc4861 to 0 by default.

This reverts commit dacc7c6d and syncs with other BSD's by using
nd6_is_addr_neighbor() instead of in6ifa_ifplocaladdr() which
is no

inet6: Set net.inet6.icmp6.nd6_onlink_ns_rfc4861 to 0 by default.

This reverts commit dacc7c6d and syncs with other BSD's by using
nd6_is_addr_neighbor() instead of in6ifa_ifplocaladdr() which
is now removed as it was only used here.

We are now protected again against CVE-2008-2476 by default.

show more ...

inet6: only mark autoconf addresses tentative if detached

This really only affects userland (such as dhcpcd) handling autoconf
as this failure path is pretty hard to get to with kernel side RA
handl

inet6: only mark autoconf addresses tentative if detached

This really only affects userland (such as dhcpcd) handling autoconf
as this failure path is pretty hard to get to with kernel side RA
handling.

Syncs with FreeBSD.

show more ...

Whitespace cleanups

sys: Minor fixes to some comments

sys: Minor code cleanups

No functional changes.

stf(4): Set ND6 flags to disable auto link-local and DAD

Clear the 'ND6_IFF_AUTO_LINKLOCAL' flag and set the 'ND6_IFF_NO_DAD'
flag for the stf(4) interface after if_attach(). In this way, the
quirk

stf(4): Set ND6 flags to disable auto link-local and DAD

Clear the 'ND6_IFF_AUTO_LINKLOCAL' flag and set the 'ND6_IFF_NO_DAD'
flag for the stf(4) interface after if_attach(). In this way, the
quirks in in6_ifattach() is removed.

show more ...

netinet6: Improve in6if_do_dad() by checking IFF_MULTICAST

DAD requires multicast support.

Obtained from FreeBSD.

netinet6: Improve flexibility of receiving Router Advertisement

Convert the sysctl 'net.inet6.ip6.accept_rtadv' to be the default value
of the per-interface flag 'ND6_IFF_ACCEPT_RTADV', making it no

netinet6: Improve flexibility of receiving Router Advertisement

Convert the sysctl 'net.inet6.ip6.accept_rtadv' to be the default value
of the per-interface flag 'ND6_IFF_ACCEPT_RTADV', making it no longer a
global knob. Now the receiving RA is allowed if ip6_forwarding==0 *and*
'ND6_IFF_ACCEPT_RTADV' is set on that interface.

ndp(8) already supports to toggle the 'ND6_IFF_ACCEPT_RTADV' flag via
the 'accept_rtadv' option.

Derived from FreeBSD.

show more ...

netinet6: Add per-interface flag ND6_IFF_NO_DAD flag to disable DAD

An interface that has no link-local address should also have DAD
disabled. So this flag is generally set for an interface that ha

netinet6: Add per-interface flag ND6_IFF_NO_DAD flag to disable DAD

An interface that has no link-local address should also have DAD
disabled. So this flag is generally set for an interface that has the
ND6_IFF_AUTO_LINKLOCAL flag cleared.

Derived from FreeBSD.

show more ...

netinet6: Improve handling of auto link-local address configuration

Add a new per-interface flag 'ND6_IFF_AUTO_LINKLOCAL' and convert the
sysctl 'net.inet6.ip6.auto_linklocal' to be the default valu

netinet6: Improve handling of auto link-local address configuration

Add a new per-interface flag 'ND6_IFF_AUTO_LINKLOCAL' and convert the
sysctl 'net.inet6.ip6.auto_linklocal' to be the default value of this
new per-interface flag. This allows to fine control the automatic
link-local address configuration on a per-interface basis.

Update ndp(8) to support to toggle the 'ND6_IFF_AUTO_LINKLOCAL' flag by
adding the 'auto_linklocal' option.

Document the 'IPV6CTL_AUTO_LINKLOCAL' option in the inet6(4) man page.

Derived from FreeBSD.

show more ...

netinet6: Remove nonexistent IFT_DUMMY from in6if_do_dad()

Meanwhile, fix typos in the comment.

Various minor whitespace cleanups

Accumulated along the way.

sockbuf: Improve sbcreatecontrol() parameter types to save casts

- Change 'caddr_t p' to 'const void *p' to save casts for the callers.
The 'const' qualifier is also added meanwhile.
- Change 'int

sockbuf: Improve sbcreatecontrol() parameter types to save casts

- Change 'caddr_t p' to 'const void *p' to save casts for the callers.
The 'const' qualifier is also added meanwhile.
- Change 'int size' to 'size_t size', given that callers generally pass
this parameter as sizeof().
- Update all relevant callers.

For the reference, OpenBSD also did this for sbcreatecontrol().

show more ...

kernel: Remove unnecessary casts for updated mbuf(9) functions

kernel: Replace the deprecated m_copy() with m_copym()

Remove no longer needed casts for radix routines

net/radix: Update rn_inithead() parameter type to avoid boring casts

Change to use the proper 'struct radix_node_head **' instead of an
opaque 'void **'.

Update rn_inithead() users to switch to byte offset

net/radix: Add 'const' qualifier to input key/netmask

They're only referenced in the radix tree and wouldn't be modified, so
add 'const' qualifier to make it clear.

Adjust callers for this change a

net/radix: Add 'const' qualifier to input key/netmask

They're only referenced in the radix tree and wouldn't be modified, so
add 'const' qualifier to make it clear.

Adjust callers for this change accordingly.

Referred to FreeBSD.

show more ...

net/radix: Rename Free() to R_Free() to better align with R_Malloc()

Also reduces the chances of conflicting with other macros.

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restricti

kernel - Add per-process capability-based restrictions

* This new system allows userland to set capability restrictions which
turns off numerous kernel features and root accesses. These restrictions
are inherited by sub-processes recursively. Once set, restrictions cannot
be removed.

Basic restrictions that mimic an unadorned jail can be enabled without
creating a jail, but generally speaking real security also requires
creating a chrooted filesystem topology, and a jail is still needed
to really segregate processes from each other. If you do so, however,
you can (for example) disable mount/umount and most global root-only
features.

* Add new system calls and a manual page for syscap_get(2) and syscap_set(2)

* Add sys/caps.h

* Add the "setcaps" userland utility and manual page.

* Remove priv.9 and the priv_check infrastructure, replacing it with
a newly designed caps infrastructure.

* The intention is to add path restriction lists and similar features to
improve jailess security in the near future, and to optimize the
priv_check code.

show more ...

netinet6 - Fix ipv6 mbuf packet type issue causing an NFS panic

* A forwarding case in ip6_input() was allocating an mbuf with
MT_HEADER instead of MT_DATA, causing an NFS case later
on to panic

netinet6 - Fix ipv6 mbuf packet type issue causing an NFS panic

* A forwarding case in ip6_input() was allocating an mbuf with
MT_HEADER instead of MT_DATA, causing an NFS case later
on to panic.

Submitted-by: iteratee (Kyle Butt)

show more ...

netinet6 - MFC freebsd ff3d1a3f9d71e706f320f51bae258e4e1a51b388

MFC fix for possible header packet length integer overflow during
IPV6 fragment reassembly.

Security: FreeBSD-SA-23:06.ipv6
Security

netinet6 - MFC freebsd ff3d1a3f9d71e706f320f51bae258e4e1a51b388

MFC fix for possible header packet length integer overflow during
IPV6 fragment reassembly.

Security: FreeBSD-SA-23:06.ipv6
Security: CVE-2023-3107

show more ...