inpcb: fix a panic with SO_REUSEPORT_LB + connect(2) misuse

This combination doesn't make any sense. This socket option makes sense
only on a socket that is going to be a listening one. There are

inpcb: fix a panic with SO_REUSEPORT_LB + connect(2) misuse

This combination doesn't make any sense. This socket option makes sense
only on a socket that is going to be a listening one. There are two
options here: refuse connect(2) on a socket that has the option set
previously, or ignore (and clear) the option. After some discussion on
phabricator, we have chosen the former, for safety and consistency
reasons. Any programmer that runs this sequence is doing something wrong
and should be informed of that with appropriate error code.

Since connect(2) is a SUS API that has a defined set of error codes, none
of which corresponds to "a socket has non-standard incompatible socket
option set", we decided to return the same error that an already listening
socket would return.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D49150

show more ...

tests: Require python3 when using Scapy

python3 is a symbolic link that points to the current python 3.X
version.

It is possible for a system to have python (python 3.X) without the
python3 (symlin

tests: Require python3 when using Scapy

python3 is a symbolic link that points to the current python 3.X
version.

It is possible for a system to have python (python 3.X) without the
python3 (symlink) package.

Test scripts that use Scapy are invoked using python3, so add it as a
required program.

Reviewed by: ngie, asomers
Approved by: emaste (mentor)
Differential Revision: https://reviews.freebsd.org/D49007

show more ...

inpcb: Fix reuseport lbgroup array resizing

in_pcblisten() moves an inpcb from the per-group list into the array, at
which point it becomes visible to inpcb lookups in the datapath. It
assumes that

inpcb: Fix reuseport lbgroup array resizing

in_pcblisten() moves an inpcb from the per-group list into the array, at
which point it becomes visible to inpcb lookups in the datapath. It
assumes that there is space in the array for this, but that's not
guaranteed, since in_pcbinslbgrouphash() doesn't reserve space in the
array if the inpcb isn't associated with a listening socket.

We could resize the array in in_pcblisten(), but that would introduce a
failure case where there currently is none. Instead, keep track of the
number of pending inpcbs as well, and modify in_pcbinslbgrouphash() to
reserve space for each pending (i.e., not-yet-listening) inpcb.

Add a regression test.

Reviewed by: glebius
Reported by: netchild
Fixes: 7cbb6b6e28db ("inpcb: Close some SO_REUSEPORT_LB races, part 2")
Differential Revision: https://reviews.freebsd.org/D49100

show more ...

tests: carp: Update test case unicast_v4 to catch PR 284872

In the current test case unicast_v4, host one acts as a router, but it
uses if_bridge(4) to verify the reachability to CARP master.
Unfort

tests: carp: Update test case unicast_v4 to catch PR 284872

In the current test case unicast_v4, host one acts as a router, but it
uses if_bridge(4) to verify the reachability to CARP master.
Unfortunately, if_bridge(4) brings the two CARP hosts into the same
broadcast domain, thus with an unusual (undocumented) setup, one host
is in unicast mode but another one in multicast, or two hosts are both
in multicast mode, the test case can falsely report success.

Fix that by propagating route via routed(8).

PR 284872 shows that CARP(4) happens to send packets with multicast
destination when the unicast peer address is in the range x.x.x.224 ~
x.x.x.239. Update the peer address in test case to catch that bug.

PR: 284872
Reviewed by: kp
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D49076

show more ...

tests/netinet: add few tests for sending a broadcast packet

1) Set SO_BROADCAST and send to INADDR_BROADCAST.
2) Set SO_BROADCAST, set IP_ONESBCAST and cycle through broadcast capable
interfaces

tests/netinet: add few tests for sending a broadcast packet

1) Set SO_BROADCAST and send to INADDR_BROADCAST.
2) Set SO_BROADCAST, set IP_ONESBCAST and cycle through broadcast capable
interfaces sending a datagram on each.
3) Set SO_BROADCAST and send to local broadcast address.

For each test we bind a second socket to check whether the broadcast
is actually received.

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D49040

show more ...

tests/netinet: add few tests for unconnected UDP socket

1) Test that getsockname() on a socket that experienced a sendto(2)
returns allocated port.
2) Same as 1), but jailed. Make sure IP addres

tests/netinet: add few tests for unconnected UDP socket

1) Test that getsockname() on a socket that experienced a sendto(2)
returns allocated port.
2) Same as 1), but jailed. Make sure IP address was also selected.
3) Test that IP_SENDSRCADDR/IP_RECVDSTADDR work.
4) Regression test for bug 274009.

show more ...

sys tests: Add scapy as a required program

These atf-python tests rely on scapy to run.
Add it as a required program.

Reported by: glebius, kp
Reviewed by: kp
Approved by: emaste (mentor)
MFC after

sys tests: Add scapy as a required program

These atf-python tests rely on scapy to run.
Add it as a required program.

Reported by: glebius, kp
Reviewed by: kp
Approved by: emaste (mentor)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D48946

show more ...

netinet tests: Move import

Move the import of 'Sniffer', which depends on scapy into the test so we
don't try (and fail) to import it unless scapy is installed.

Reviewed by: kp, emaste
Approved by:

netinet tests: Move import

Move the import of 'Sniffer', which depends on scapy into the test so we
don't try (and fail) to import it unless scapy is installed.

Reviewed by: kp, emaste
Approved by: emaste (mentor)
Differential Revision: https://reviews.freebsd.org/D48945

show more ...

fibs_multibind_test: Explicitly cast the checksum value

Otherwise gcc warns about the (intentionall) truncated value and raises
an error.

Fixes: 7034563f8ef3 ("tests: Add some FIB multibind test ca

fibs_multibind_test: Explicitly cast the checksum value

Otherwise gcc warns about the (intentionall) truncated value and raises
an error.

Fixes: 7034563f8ef3 ("tests: Add some FIB multibind test cases")

show more ...

tests: Add some FIB multibind test cases

Reviewed by: glebius
MFC after: 2 weeks
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D48665

netstat: restore printing the "default" keyword, provide -nn option

Avoid POLA breakage and preserve output standard that really predates
the FreeBSD project itself. There are scripts in the wild t

netstat: restore printing the "default" keyword, provide -nn option

Avoid POLA breakage and preserve output standard that really predates
the FreeBSD project itself. There are scripts in the wild that rely
on the behavior.

Provide option to specify -nn twice to have a completely numeric
output of the routing tables.

Fixes: 9206c79961986c2114a9a2cfccf009ac010ad259
This reverts commit e090646d6f5a4a6848ecd4bcb1f2db498ea3b3e2.

Reviewed by: zlei, gallatin, melifaro, allanjude, markj, emaste
Differential Revision: https://reviews.freebsd.org/D48729

show more ...

socket tests: Add a test which calls listen() twice on an lb socket

This exercises commit 06bf119f265c ("sockets/tcp: quick fix for
regression with SO_REUSEPORT_LB")

Reviewed by: glebius
MFC after:

socket tests: Add a test which calls listen() twice on an lb socket

This exercises commit 06bf119f265c ("sockets/tcp: quick fix for
regression with SO_REUSEPORT_LB")

Reviewed by: glebius
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D48702

show more ...

carp: don't unintentionally revert to multicast mode

PR: 284140
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

inpcb: Close some SO_REUSEPORT_LB races, part 2

Suppose a thread is adds a socket to an existing TCP lbgroup that is
actively accepting connections. It has to do the following operations:
1. set SO

inpcb: Close some SO_REUSEPORT_LB races, part 2

Suppose a thread is adds a socket to an existing TCP lbgroup that is
actively accepting connections. It has to do the following operations:
1. set SO_REUSEPORT_LB on the socket
2. bind() the socket to the shared address/port
3. call listen()

Step 2 makes the inpcb visible to incoming connection requests.
However, at this point the inpcb cannot accept new connections. If
in_pcblookup() matches it, the remote end will see ECONNREFUSED even
when other listening sockets are present in the lbgroup. This means
that dynamically adding inpcbs to an lbgroup (e.g., by starting up new
workers) can trigger spurious connection failures for no good reason.
(A similar problem exists when removing inpcbs from an lbgroup, but that
is harder to fix and is not addressed by this patch; see the review for
a bit more commentary.)

Fix this by augmenting each lbgroup with a linked list of inpcbs that
are pending a listen() call. When adding an inpcb to an lbgroup, keep
the inpcb on this list if listen() hasn't been called, so it is not yet
visible to the lookup path. Then, add a new in_pcblisten() routine which
makes the inpcb visible within the lbgroup now that it's safe to let it
handle new connections.

Add a regression test which verifies that we don't get spurious
connection errors while adding sockets to an LB group.

Reviewed by: glebius
MFC after: 1 month
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D48544

show more ...

fibs tests: Fix test failures and simplify

The tests previously expected the invoker to pass a list of FIBs to use.
However, they now run in separate VNET jails, so we can simply expand
the FIB arra

fibs tests: Fix test failures and simplify

The tests previously expected the invoker to pass a list of FIBs to use.
However, they now run in separate VNET jails, so we can simply expand
the FIB array as needed in each test. Modify each test to simply set
net.fibs as needed and grab FIB numbers starting at 1.

A number of tests were also broken by commit 9206c7996198
("usr.bin/netstat: -n should not print symbolic names"), so fix those.

Reviewed by: asomers
Fixes: 9206c7996198 ("usr.bin/netstat: -n should not print symbolic names")
MFC after: 2 weeks
Sponsored by: Klara, Inc.
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D48585

show more ...

netinet tests: basic garp test

Excercise the garp code.
This doesn't actively verify anything, but is sufficient to trigger the
panic reported in PR 284073, so it's a useful test case to keep.

PR:

netinet tests: basic garp test

Excercise the garp code.
This doesn't actively verify anything, but is sufficient to trigger the
panic reported in PR 284073, so it's a useful test case to keep.

PR: 284073
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...