src/sys/netinet, branch stable/3

MFS

2001-08-06T09:20:57+00:00

src/sys/netinet/ip_input.c      rev 1.130.2.22
src/sys/netinet6/frag6.c        rev 1.2.2.4
src/sys/netinet6/in6_proto.c    rev 1.6.2.4

  Prevent denial of service using bogus fragmented IPv4 packets.

  A attacker sending a lot of bogus fragmented packets to the target
  (with different IPv4 identification field - ip_id), may be able
  to put the target machine into mbuf starvation state.

  By setting a upper limit on the number of reassembly queues we
  prevent this situation.

  This upper limit is controlled by the new sysctl
  net.inet.ip.maxfragpackets which defaults to nmbclusters/4

  If you want old behaviour (no upper limit) set this sysctl
  to a negative value.

  If you don't want to accept any fragments (not recommended)
  set the sysctl to 0 (zero)

Obtained from:	NetBSD (partially)

MFC: Better TCP ISN randomization

2001-05-02T20:48:34+00:00

MFC:

2001-02-24T20:09:22+00:00

src/sys/netinet/in_pcb.c     rev 1.78
src/sys/netinet/in_pcb.h     rev 1.36
src/sys/netinet/tcp_subr.c   rev 1.91
src/sys/netinet/udp_usrreq.c rev 1.86

Without this a attacker sending ICMP messages, where the attached
IP header (+ 8 bytes) has the address and port numbers == 0, would
have the ICMP message applied to all sessions.

Approved by:    kris
Inspired by:    NetBSD

MFC: ECN flag handling fixes in IPFW

2001-01-13T02:44:21+00:00

MFC: Use stronger randomness for TCP_ISSINCR and tcp_iss

2000-09-29T08:49:56+00:00

MFC (rev.1.46: fixed a missing splx() in if_addmulti()).

2000-08-19T22:16:13+00:00

MFC rev 1.60: fix comment for TCPCTL_KEEPINIT .

2000-07-18T16:50:10+00:00

MFC: (rev 1.133) do not call icmp_error() if ipfirewall(4) denied packet.

2000-06-13T07:12:34+00:00

MFC: r1.34, LAST_ACK problem. (slightly different patch)

2000-06-08T15:37:39+00:00

Submitted by:	Mike Silbersack

MFC: correct boundary checks against IP options

2000-06-08T15:11:50+00:00