summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/net/if_enc.c4
-rw-r--r--sys/net/pfkeyv2.c49
-rw-r--r--sys/netinet/ip_ipsp.c29
-rw-r--r--sys/netinet/ip_ipsp.h3
-rw-r--r--sys/netinet/ip_spd.c38
5 files changed, 93 insertions, 30 deletions
diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c
index 35454fce639..499e8609519 100644
--- a/sys/net/if_enc.c
+++ b/sys/net/if_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: if_enc.c,v 1.69 2017/08/11 21:24:19 mpi Exp $ */
+/* $OpenBSD: if_enc.c,v 1.70 2017/10/16 08:22:25 mpi Exp $ */
/*
* Copyright (c) 2010 Reyk Floeter <reyk@vantronix.net>
@@ -214,6 +214,8 @@ enc_getif(u_int id, u_int unit)
{
struct ifnet *ifp;
+ NET_ASSERT_LOCKED();
+
/* Check if the caller wants to get a non-default enc interface */
if (unit > 0) {
if (unit > enc_max_unit)
diff --git a/sys/net/pfkeyv2.c b/sys/net/pfkeyv2.c
index 76a38551e17..4edfd3df3a9 100644
--- a/sys/net/pfkeyv2.c
+++ b/sys/net/pfkeyv2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pfkeyv2.c,v 1.167 2017/10/09 08:35:38 mpi Exp $ */
+/* $OpenBSD: pfkeyv2.c,v 1.168 2017/10/16 08:22:25 mpi Exp $ */
/*
* @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
@@ -80,6 +80,8 @@
#include <sys/kernel.h>
#include <sys/proc.h>
#include <sys/pool.h>
+#include <sys/mutex.h>
+
#include <net/route.h>
#include <netinet/ip_ipsp.h>
#include <net/pfkeyv2.h>
@@ -148,6 +150,8 @@ struct dump_state {
/* Static globals */
static LIST_HEAD(, keycb) pfkeyv2_sockets = LIST_HEAD_INITIALIZER(keycb);
+
+struct mutex pfkeyv2_mtx = MUTEX_INITIALIZER(IPL_NONE);
static uint32_t pfkeyv2_seq = 1;
static int nregistered = 0;
static int npromisc = 0;
@@ -260,11 +264,16 @@ pfkeyv2_detach(struct socket *so, struct proc *p)
LIST_REMOVE(kp, kcb_list);
- if (kp->flags & PFKEYV2_SOCKETFLAGS_REGISTERED)
- nregistered--;
+ if (kp->flags &
+ (PFKEYV2_SOCKETFLAGS_REGISTERED|PFKEYV2_SOCKETFLAGS_PROMISC)) {
+ mtx_enter(&pfkeyv2_mtx);
+ if (kp->flags & PFKEYV2_SOCKETFLAGS_REGISTERED)
+ nregistered--;
- if (kp->flags & PFKEYV2_SOCKETFLAGS_PROMISC)
- npromisc--;
+ if (kp->flags & PFKEYV2_SOCKETFLAGS_PROMISC)
+ npromisc--;
+ mtx_leave(&pfkeyv2_mtx);
+ }
raw_detach(&kp->rcb);
return (0);
@@ -940,23 +949,22 @@ pfkeyv2_send(struct socket *so, void *message, int len)
struct ipsec_acquire *ipa;
struct radix_node_head *rnh;
struct radix_node *rn = NULL;
-
struct keycb *kp, *bkp;
-
void *freeme = NULL, *bckptr = NULL;
void *headers[SADB_EXT_MAX + 1];
-
union sockaddr_union *sunionp;
-
struct tdb *sa1 = NULL, *sa2 = NULL;
-
struct sadb_msg *smsg;
struct sadb_spirange *sprng;
struct sadb_sa *ssa;
struct sadb_supported *ssup;
struct sadb_ident *sid, *did;
-
u_int rdomain;
+ int promisc;
+
+ mtx_enter(&pfkeyv2_mtx);
+ promisc = npromisc;
+ mtx_leave(&pfkeyv2_mtx);
NET_LOCK();
@@ -972,7 +980,7 @@ pfkeyv2_send(struct socket *so, void *message, int len)
rdomain = kp->rdomain;
/* If we have any promiscuous listeners, send them a copy of the message */
- if (npromisc) {
+ if (promisc) {
struct mbuf *packet;
if (!(freeme = malloc(sizeof(struct sadb_msg) + len, M_PFKEY,
@@ -1392,7 +1400,9 @@ pfkeyv2_send(struct socket *so, void *message, int len)
case SADB_REGISTER:
if (!(kp->flags & PFKEYV2_SOCKETFLAGS_REGISTERED)) {
kp->flags |= PFKEYV2_SOCKETFLAGS_REGISTERED;
+ mtx_enter(&pfkeyv2_mtx);
nregistered++;
+ mtx_leave(&pfkeyv2_mtx);
}
i = sizeof(struct sadb_supported) + sizeof(ealgs);
@@ -1788,11 +1798,15 @@ pfkeyv2_send(struct socket *so, void *message, int len)
if (j) {
kp->flags |=
PFKEYV2_SOCKETFLAGS_PROMISC;
+ mtx_enter(&pfkeyv2_mtx);
npromisc++;
+ mtx_leave(&pfkeyv2_mtx);
} else {
kp->flags &=
~PFKEYV2_SOCKETFLAGS_PROMISC;
+ mtx_enter(&pfkeyv2_mtx);
npromisc--;
+ mtx_leave(&pfkeyv2_mtx);
}
}
}
@@ -1859,11 +1873,15 @@ pfkeyv2_acquire(struct ipsec_policy *ipo, union sockaddr_union *gw,
struct sadb_prop *sa_prop;
struct sadb_msg *smsg;
int rval = 0;
- int i, j;
+ int i, j, registered;
+ mtx_enter(&pfkeyv2_mtx);
*seq = pfkeyv2_seq++;
- if (!nregistered) {
+ registered = nregistered;
+ mtx_leave(&pfkeyv2_mtx);
+
+ if (!registered) {
rval = ESRCH;
goto ret;
}
@@ -2100,7 +2118,10 @@ pfkeyv2_expire(struct tdb *sa, u_int16_t type)
smsg->sadb_msg_type = SADB_EXPIRE;
smsg->sadb_msg_satype = sa->tdb_satype;
smsg->sadb_msg_len = i / sizeof(uint64_t);
+
+ mtx_enter(&pfkeyv2_mtx);
smsg->sadb_msg_seq = pfkeyv2_seq++;
+ mtx_leave(&pfkeyv2_mtx);
headers[SADB_EXT_SA] = p;
export_sa(&p, sa);
diff --git a/sys/netinet/ip_ipsp.c b/sys/netinet/ip_ipsp.c
index 0dc50de6219..6fa11ee087d 100644
--- a/sys/netinet/ip_ipsp.c
+++ b/sys/netinet/ip_ipsp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ipsp.c,v 1.227 2017/10/11 13:44:49 mpi Exp $ */
+/* $OpenBSD: ip_ipsp.c,v 1.228 2017/10/16 08:22:25 mpi Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
* Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -87,16 +87,14 @@ int tdb_hash(u_int, u_int32_t, union sockaddr_union *, u_int8_t);
int ipsec_in_use = 0;
u_int64_t ipsec_last_added = 0;
+int ipsec_ids_idle = 100; /* keep free ids for 100s */
-struct ipsec_policy_head ipsec_policy_head =
- TAILQ_HEAD_INITIALIZER(ipsec_policy_head);
-struct ipsec_acquire_head ipsec_acquire_head =
- TAILQ_HEAD_INITIALIZER(ipsec_acquire_head);
-
+/* Protected by the NET_LOCK(). */
u_int32_t ipsec_ids_next_flow = 1; /* may not be zero */
-int ipsec_ids_idle = 100; /* keep free ids for 100s */
struct ipsec_ids_tree ipsec_ids_tree;
struct ipsec_ids_flows ipsec_ids_flows;
+struct ipsec_policy_head ipsec_policy_head =
+ TAILQ_HEAD_INITIALIZER(ipsec_policy_head);
void ipsp_ids_timeout(void *);
static inline int ipsp_ids_cmp(const struct ipsec_ids *,
@@ -173,6 +171,7 @@ struct xformsw *xformswNXFORMSW = &xformsw[nitems(xformsw)];
#define TDB_HASHSIZE_INIT 32
+/* Protected by the NET_LOCK(). */
static SIPHASH_KEY tdbkey;
static struct tdb **tdbh = NULL;
static struct tdb **tdbdst = NULL;
@@ -190,6 +189,8 @@ tdb_hash(u_int rdomain, u_int32_t spi, union sockaddr_union *dst,
{
SIPHASH_CTX ctx;
+ NET_ASSERT_LOCKED();
+
SipHash24_Init(&ctx, &tdbkey);
SipHash24_Update(&ctx, &rdomain, sizeof(rdomain));
SipHash24_Update(&ctx, &spi, sizeof(spi));
@@ -336,6 +337,8 @@ gettdbbysrcdst(u_int rdomain, u_int32_t spi, union sockaddr_union *src,
struct tdb *tdbp;
union sockaddr_union su_null;
+ NET_ASSERT_LOCKED();
+
if (tdbsrc == NULL)
return (struct tdb *) NULL;
@@ -420,6 +423,8 @@ gettdbbydst(u_int rdomain, union sockaddr_union *dst, u_int8_t sproto,
u_int32_t hashval;
struct tdb *tdbp;
+ NET_ASSERT_LOCKED();
+
if (tdbdst == NULL)
return (struct tdb *) NULL;
@@ -451,6 +456,8 @@ gettdbbysrc(u_int rdomain, union sockaddr_union *src, u_int8_t sproto,
u_int32_t hashval;
struct tdb *tdbp;
+ NET_ASSERT_LOCKED();
+
if (tdbsrc == NULL)
return (struct tdb *) NULL;
@@ -788,6 +795,8 @@ tdb_alloc(u_int rdomain)
{
struct tdb *tdbp;
+ NET_ASSERT_LOCKED();
+
tdbp = malloc(sizeof(*tdbp), M_TDB, M_WAITOK | M_ZERO);
TAILQ_INIT(&tdbp->tdb_policy_head);
@@ -812,6 +821,8 @@ tdb_free(struct tdb *tdbp)
{
struct ipsec_policy *ipo;
+ NET_ASSERT_LOCKED();
+
if (tdbp->tdb_xform) {
(*(tdbp->tdb_xform->xf_zeroize))(tdbp);
tdbp->tdb_xform = NULL;
@@ -944,6 +955,8 @@ ipsp_ids_insert(struct ipsec_ids *ids)
struct ipsec_ids *found;
u_int32_t start_flow;
+ NET_ASSERT_LOCKED();
+
found = RBT_INSERT(ipsec_ids_tree, &ipsec_ids_tree, ids);
if (found) {
/* if refcount was zero, then timeout is running */
@@ -977,6 +990,8 @@ ipsp_ids_lookup(u_int32_t ipsecflowinfo)
{
struct ipsec_ids key;
+ NET_ASSERT_LOCKED();
+
key.id_flow = ipsecflowinfo;
return RBT_FIND(ipsec_ids_flows, &ipsec_ids_flows, &key);
}
diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h
index df145de2b64..cd6d58e9d8f 100644
--- a/sys/netinet/ip_ipsp.h
+++ b/sys/netinet/ip_ipsp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ipsp.h,v 1.183 2017/06/26 09:08:00 patrick Exp $ */
+/* $OpenBSD: ip_ipsp.h,v 1.184 2017/10/16 08:22:25 mpi Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
* Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -440,7 +440,6 @@ extern struct auth_hash auth_hash_hmac_ripemd_160_96;
extern struct comp_algo comp_algo_deflate;
extern TAILQ_HEAD(ipsec_policy_head, ipsec_policy) ipsec_policy_head;
-extern TAILQ_HEAD(ipsec_acquire_head, ipsec_acquire) ipsec_acquire_head;
/* Misc. */
#ifdef ENCDEBUG
diff --git a/sys/netinet/ip_spd.c b/sys/netinet/ip_spd.c
index 5d8b3a7b19e..8a26e990b6c 100644
--- a/sys/netinet/ip_spd.c
+++ b/sys/netinet/ip_spd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_spd.c,v 1.92 2017/04/06 14:25:18 dhill Exp $ */
+/* $OpenBSD: ip_spd.c,v 1.93 2017/10/16 08:22:25 mpi Exp $ */
/*
* The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
*
@@ -45,7 +45,8 @@ int ipsp_acquire_sa(struct ipsec_policy *, union sockaddr_union *,
union sockaddr_union *, struct sockaddr_encap *, struct mbuf *);
struct ipsec_acquire *ipsp_pending_acquire(struct ipsec_policy *,
union sockaddr_union *);
-void ipsp_delete_acquire(void *);
+void ipsp_delete_acquire_timo(void *);
+void ipsp_delete_acquire(struct ipsec_acquire *);
#ifdef ENCDEBUG
#define DPRINTF(x) if (encdebug) printf x
@@ -56,16 +57,21 @@ void ipsp_delete_acquire(void *);
struct pool ipsec_policy_pool;
struct pool ipsec_acquire_pool;
int ipsec_policy_pool_initialized = 0;
-int ipsec_acquire_pool_initialized = 0;
+/* Protected by the NET_LOCK(). */
+int ipsec_acquire_pool_initialized = 0;
struct radix_node_head **spd_tables;
unsigned int spd_table_max;
+TAILQ_HEAD(ipsec_acquire_head, ipsec_acquire) ipsec_acquire_head =
+ TAILQ_HEAD_INITIALIZER(ipsec_acquire_head);
struct radix_node_head *
spd_table_get(unsigned int rtableid)
{
unsigned int rdomain;
+ NET_ASSERT_LOCKED();
+
if (spd_tables == NULL)
return (NULL);
@@ -83,6 +89,8 @@ spd_table_add(unsigned int rtableid)
unsigned int rdomain;
void *p;
+ NET_ASSERT_LOCKED();
+
rdomain = rtable_l2(rtableid);
if (spd_tables == NULL || rdomain > spd_table_max) {
if ((p = mallocarray(rdomain + 1, sizeof(*rnh),
@@ -135,6 +143,8 @@ ipsp_spd_lookup(struct mbuf *m, int af, int hlen, int *error, int direction,
int signore = 0, dignore = 0;
u_int rdomain = rtable_l2(m->m_pkthdr.ph_rtableid);
+ NET_ASSERT_LOCKED();
+
/*
* If there are no flows in place, there's no point
* continuing with the SPD lookup.
@@ -587,6 +597,8 @@ ipsec_delete_policy(struct ipsec_policy *ipo)
struct radix_node *rn = (struct radix_node *)ipo;
int err = 0;
+ NET_ASSERT_LOCKED();
+
if (--ipo->ipo_ref_count > 0)
return 0;
@@ -614,13 +626,23 @@ ipsec_delete_policy(struct ipsec_policy *ipo)
return err;
}
+void
+ipsp_delete_acquire_timo(void *v)
+{
+ struct ipsec_acquire *ipa = v;
+
+ NET_LOCK();
+ ipsp_delete_acquire(ipa);
+ NET_UNLOCK();
+}
+
/*
* Delete a pending IPsec acquire record.
*/
void
-ipsp_delete_acquire(void *v)
+ipsp_delete_acquire(struct ipsec_acquire *ipa)
{
- struct ipsec_acquire *ipa = v;
+ NET_ASSERT_LOCKED();
timeout_del(&ipa->ipa_timeout);
TAILQ_REMOVE(&ipsec_acquire_head, ipa, ipa_next);
@@ -639,6 +661,8 @@ ipsp_pending_acquire(struct ipsec_policy *ipo, union sockaddr_union *gw)
{
struct ipsec_acquire *ipa;
+ NET_ASSERT_LOCKED();
+
TAILQ_FOREACH (ipa, &ipo->ipo_acquires, ipa_ipo_next) {
if (!memcmp(gw, &ipa->ipa_addr, gw->sa.sa_len))
return ipa;
@@ -657,6 +681,8 @@ ipsp_acquire_sa(struct ipsec_policy *ipo, union sockaddr_union *gw,
{
struct ipsec_acquire *ipa;
+ NET_ASSERT_LOCKED();
+
/* Check whether request has been made already. */
if ((ipa = ipsp_pending_acquire(ipo, gw)) != NULL)
return 0;
@@ -674,7 +700,7 @@ ipsp_acquire_sa(struct ipsec_policy *ipo, union sockaddr_union *gw,
ipa->ipa_addr = *gw;
- timeout_set(&ipa->ipa_timeout, ipsp_delete_acquire, ipa);
+ timeout_set_proc(&ipa->ipa_timeout, ipsp_delete_acquire_timo, ipa);
ipa->ipa_info.sen_len = ipa->ipa_mask.sen_len = SENT_LEN;
ipa->ipa_info.sen_family = ipa->ipa_mask.sen_family = PF_KEY;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 17:48:23 +0000