From nobody Sat Aug 27 07:01:20 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MF70Y6dVtz4ZjC0; Sat, 27 Aug 2022 07:01:33 +0000 (UTC) (envelope-from hps@selasky.org) Received: from mail.turbocat.net (turbocat.net [IPv6:2a01:4f8:c17:6c4b::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4MF70X1HCsz3bkQ; Sat, 27 Aug 2022 07:01:31 +0000 (UTC) (envelope-from hps@selasky.org) Received: from [10.36.2.165] (unknown [178.232.223.95]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.turbocat.net (Postfix) with ESMTPSA id BFCD926012D; Sat, 27 Aug 2022 09:01:23 +0200 (CEST) Message-ID: <546ecdcf-06f5-1e93-82f7-e145ea11edc5@selasky.org> Date: Sat, 27 Aug 2022 09:01:20 +0200 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:91.0) Gecko/20100101 Thunderbird/91.13.0 Subject: Re: git: efe58855f3ea - main - IPv4: experimental changes to allow net 0/8, 240/4, part of 127/8 Content-Language: en-US To: Mike Karels , src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org References: <202207131449.26DEnh0G089612@gitrepo.freebsd.org> From: Hans Petter Selasky In-Reply-To: <202207131449.26DEnh0G089612@gitrepo.freebsd.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4MF70X1HCsz3bkQ X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of hps@selasky.org designates 2a01:4f8:c17:6c4b::2 as permitted sender) smtp.mailfrom=hps@selasky.org X-Spamd-Result: default: False [-3.30 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.999]; R_SPF_ALLOW(-0.20)[+a:mail.turbocat.net]; MIME_GOOD(-0.10)[text/plain]; MLMMJ_DEST(0.00)[dev-commits-src-all@FreeBSD.org,dev-commits-src-main@FreeBSD.org]; R_DKIM_NA(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; ASN(0.00)[asn:24940, ipnet:2a01:4f8::/32, country:DE]; MIME_TRACE(0.00)[0:+]; TO_DN_SOME(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; DMARC_NA(0.00)[selasky.org]; MID_RHS_MATCH_FROM(0.00)[]; ARC_NA(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; RCVD_TLS_ALL(0.00)[] X-ThisMailContainsUnwantedMimeParts: N On 7/13/22 16:49, Mike Karels wrote: > The branch main has been updated by karels: > > URL: https://cgit.FreeBSD.org/src/commit/?id=efe58855f3ea2cfc24cb705aabce3bc0fe1fb6d5 > > commit efe58855f3ea2cfc24cb705aabce3bc0fe1fb6d5 > Author: Mike Karels > AuthorDate: 2022-05-24 19:26:25 +0000 > Commit: Mike Karels > CommitDate: 2022-07-13 14:46:05 +0000 > > IPv4: experimental changes to allow net 0/8, 240/4, part of 127/8 > > Combined changes to allow experimentation with net 0/8 (network 0), > 240/4 (Experimental/"Class E"), and part of the loopback net 127/8 > (all but 127.0/16). All changes are disabled by default, and can be > enabled by the following sysctls: > > net.inet.ip.allow_net0=1 > net.inet.ip.allow_net240=1 > net.inet.ip.loopback_prefixlen=16 > > When enabled, the corresponding addresses can be used as normal > unicast IP addresses, both as endpoints and when forwarding. > > Add descriptions of the new sysctls to inet.4. > > Add to vnet.h, as CACHE_LINE_SIZE is undefined in > various C files when in.h includes vnet.h. > > The proposals motivating this experimentation can be found in > > https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-0 > https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-240 > https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-127 > > Reviewed by: rgrimes, pauamma_gundo.com; previous versions melifaro, glebius > Differential Revision: https://reviews.freebsd.org/D35741 > --- > share/man/man4/inet.4 | 11 +++++++++++ > sys/net/vnet.h | 1 + > sys/netinet/in.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++-- > sys/netinet/in.h | 18 ++++++++++++++++++ > sys/netinet/ip_icmp.c | 4 ++-- > 5 files changed, 80 insertions(+), 4 deletions(-) > > diff --git a/share/man/man4/inet.4 b/share/man/man4/inet.4 > index dbab301302b1..60b2e588500d 100644 > --- a/share/man/man4/inet.4 > +++ b/share/man/man4/inet.4 > @@ -284,6 +284,17 @@ Integer: maximum number of fragments the host will accept and hold > in the reassembly queue for a packet. > 0 means that the host will not accept any fragmented packets for the VNET. > This is a per-VNET limit. > +.It Va ip.allow_net0 > +Boolean: allow experimental use of addresses in 0.0.0.0/8 as endpoints, > +and allow forwarding of packets with these addresses. > +.It Va ip.allow_net240 > +Boolean: allow experimental use of addresses in 240.0.0.0/4 as endpoints, > +and allow forwarding of packets with these addresses. > +.It Va ip.loopback_prefixlen > +Integer: prefix length of the address space reserved for loopback purposes. > +The default is 8, meaning that 127.0.0.0/8 is reserved for loopback, > +and cannot be sent, received, or forwarded on a non-loopback interface. > +Use of other values is experimental. > .El > .Sh SEE ALSO > .Xr ioctl 2 , > diff --git a/sys/net/vnet.h b/sys/net/vnet.h > index afb6857bbccc..d0ede39c0cb1 100644 > --- a/sys/net/vnet.h > +++ b/sys/net/vnet.h > @@ -65,6 +65,7 @@ > * as required for libkvm. > */ > #if defined(_KERNEL) || defined(_WANT_VNET) > +#include /* for CACHE_LINE_SIZE */ > #include > > struct vnet { > diff --git a/sys/netinet/in.c b/sys/netinet/in.c > index 9e4b677cf7e1..c3880c4ba983 100644 > --- a/sys/netinet/in.c > +++ b/sys/netinet/in.c > @@ -97,6 +97,28 @@ SYSCTL_BOOL(_net_inet_ip, OID_AUTO, broadcast_lowest, CTLFLAG_VNET | CTLFLAG_RW, > &VNET_NAME(broadcast_lowest), 0, > "Treat lowest address on a subnet (host 0) as broadcast"); > > +VNET_DEFINE(bool, ip_allow_net240) = false; > +#define V_ip_allow_net240 VNET(ip_allow_net240) > +SYSCTL_BOOL(_net_inet_ip, OID_AUTO, allow_net240, > + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip_allow_net240), 0, > + "Allow use of Experimental addresses, aka Class E (240/4)"); > +/* see https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-240 */ > + > +VNET_DEFINE(bool, ip_allow_net0) = false; > +SYSCTL_BOOL(_net_inet_ip, OID_AUTO, allow_net0, > + CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(ip_allow_net0), 0, > + "Allow use of addresses in network 0/8"); > +/* see https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-0 */ > + > +VNET_DEFINE(uint32_t, in_loopback_mask) = IN_LOOPBACK_MASK_DFLT; > +#define V_in_loopback_mask VNET(in_loopback_mask) > +static int sysctl_loopback_prefixlen(SYSCTL_HANDLER_ARGS); > +SYSCTL_PROC(_net_inet_ip, OID_AUTO, loopback_prefixlen, > + CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, > + NULL, 0, sysctl_loopback_prefixlen, "I", > + "Prefix length of address space reserved for loopback"); > +/* see https://datatracker.ietf.org/doc/draft-schoen-intarea-unicast-127 */ > + > VNET_DECLARE(struct inpcbinfo, ripcbinfo); > #define V_ripcbinfo VNET(ripcbinfo) > > @@ -251,12 +273,36 @@ in_canforward(struct in_addr in) > { > u_long i = ntohl(in.s_addr); > > - if (IN_EXPERIMENTAL(i) || IN_MULTICAST(i) || IN_LINKLOCAL(i) || > - IN_ZERONET(i) || IN_LOOPBACK(i)) > + if (IN_MULTICAST(i) || IN_LINKLOCAL(i) || IN_LOOPBACK(i)) > + return (0); > + if (IN_EXPERIMENTAL(i) && !V_ip_allow_net240) > + return (0); > + if (IN_ZERONET(i) && !V_ip_allow_net0) > return (0); > return (1); > } > > +/* > + * Sysctl to manage prefix of reserved loopback network; translate > + * to/from mask. The mask is always contiguous high-order 1 bits > + * followed by all 0 bits. > + */ > +static int > +sysctl_loopback_prefixlen(SYSCTL_HANDLER_ARGS) > +{ > + int error, preflen; > + > + /* ffs is 1-based; compensate. */ > + preflen = 33 - ffs(V_in_loopback_mask); > + error = sysctl_handle_int(oidp, &preflen, 0, req); > + if (error || !req->newptr) > + return (error); > + if (preflen < 8 || preflen > 32) > + return (EINVAL); > + V_in_loopback_mask = 0xffffffff << (32 - preflen); > + return (0); > +} > + > /* > * Trim a mask in a sockaddr > */ > diff --git a/sys/netinet/in.h b/sys/netinet/in.h > index 1fc5c173b33c..44d64190ed01 100644 > --- a/sys/netinet/in.h > +++ b/sys/netinet/in.h > @@ -383,7 +383,13 @@ __END_DECLS > #define IN_BADCLASS(i) (((in_addr_t)(i) & 0xf0000000) == 0xf0000000) > > #define IN_LINKLOCAL(i) (((in_addr_t)(i) & 0xffff0000) == 0xa9fe0000) > +#ifdef _KERNEL > +#define IN_LOOPBACK(i) \ > + (((in_addr_t)(i) & V_in_loopback_mask) == 0x7f000000) > +#define IN_LOOPBACK_MASK_DFLT 0xff000000 > +#else > #define IN_LOOPBACK(i) (((in_addr_t)(i) & 0xff000000) == 0x7f000000) > +#endif > #define IN_ZERONET(i) (((in_addr_t)(i) & 0xff000000) == 0) > FYI: ibcore now panics because the VNET is not set when calling IN_LOOPBACK() ! https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266054 --HPS