summaryrefslogtreecommitdiff
path: root/sys/net/pfkeyv2.c
AgeCommit message (Collapse)Author
2017-11-20Flush flows using the radix-tree instead of a global list.Martin Pieuchot
This will allows us to get rid of the list. ok visa@
2017-11-13Grab the KERNEL_LOCK() to iterate on the global list of PF_KEY sockets.Martin Pieuchot
It isn't safe to manipulate PF_KEY sockets without KERNEL_LOCK() because they aren't protected by the NET_LOCK(). I missed this in my previous audit and neither my tests, the regression tests nor the IPsec performance tests exposed the problem. Hopefully I added the right check to soassertlocked() a while back. Found the hardway by and ok sthen@
2017-11-12Only use a single taskq to process incoming network packets as soon asMartin Pieuchot
IPsec is enabled. This is currently a no-op since we still use a single taskq. But it will allows us to experiment with multiple forwarding threads and the PF_LOCK() without having to fix IPsec at the same time. ok sashan@, visa@
2017-11-03After inlining of raw_detach we know the sizes for free; pointed outFlorian Obser
by & OK mpi, input & OK visa
2017-11-03Inline trivial functions from raw_cb.c and tedu it.Florian Obser
Suggested by and OK mpi, OK visa
2017-11-02Move PRU_DETACH out of pr_usrreq into per proto pr_detachFlorian Obser
functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
2017-10-27Dump IPsec flows by iterating over the rafdix-tree.Martin Pieuchot
This enforces an order and will allow us to get rid of the global list. ok millert@, visa@, markus@
2017-10-16Last changes before running IPsec w/o KERNEL_LOCK().Martin Pieuchot
Put more NET_ASSERT_LOCK() and document which globals it protects. Add a mutex for pfkeyv2 globals. Convert ipsp_delete_acquire() to timeout_set_proc(). Tested by Hrvoje Popovski, ok bluhm@ visa@
2017-10-09Reduces the scope of the NET_LOCK() in sysctl(2) path.Martin Pieuchot
Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
2017-09-08If you use sys/param.h, you don't need sys/types.hTheo de Raadt
2017-08-11Remove NET_LOCK()'s argument.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2017-07-26Consistantly use kp as the var name for struct keycb.Claudio Jeker
Suggested by and OK bluhm@ OK mpi@
2017-07-03Both PF_ROUTE and PF_KEY need to start to take care of their own PCB listClaudio Jeker
to simplify the locking of those lists. For now move the LIST_ENTRY from rawcb into routecb and in the pfkey case a new keycb. Do some cleanup and renaming in the pfkey code but more to come. OK bluhm@ mpi@
2017-06-26Assert that the corresponding socket is locked when manipulating socketMartin Pieuchot
buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
2017-06-26Allow updating the destination address of an existing TDB. Since thePatrick Wildt
destination address is used as an index when looking for a TDB, we need to supply the new destination address in a different member. For this, re-use the proxy address, that so far no one else has been using. It would make sense to rename this member in the future. ok claudio@
2017-05-29Replace handrolled list with LIST_* macros. OK mpi@Claudio Jeker
2017-05-29Kill struct pfkey_version and move struct pfkeyv2_socket & dump_stateClaudio Jeker
to pfkeyv2.c. These structs are nowhere else needed. OK gcc
2017-05-29PFKEY version 2 is the only pfkey version supported. No need for extraClaudio Jeker
abstraction. First step of making PF_KEY a bit more like PF_ROUTE. OK mpi@
2017-05-27Push the NET_LOCK down into PF_KEY so that it can be treated like PF_ROUTE.Claudio Jeker
Only pfkeyv2_send() needs the NET_LOCK() so grab it at the start and release at the end. This should allow to push the locks down in other places. OK mpi@, bluhm@
2017-05-26There is only one version of pfkey in OpenBSD and this will not change anyClaudio Jeker
time soon so remove all the code to support multiple pfkey versions. OK mpi@
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-05-05Expand SA_LEN(), there is no benefit for using the macro in theAlexander Bluhm
kernel. It was only used in IPsec sources. No binary change OK deraadt@
2017-02-28Depending on the addresses, ipsecctl(8) automatically groups saAlexander Bluhm
bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
2017-02-24Avoid some casts by using the sa field of union sockaddr_union.Alexander Bluhm
OK millert@
2017-02-14Replace two recursive splsoftnet()/splx() dances with a splsoftassert().Martin Pieuchot
ok mikeb@, bluhm@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2017-01-13Remove recursive splsoftnet() but use splsoftassert() instead.Martin Pieuchot
Tested by Hrvoje Popovski, ok bluhm@
2016-09-15all pools have their ipl set via pool_setipl, so fold it into pool_init.David Gwynne
the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
2016-08-30pool_setiplDavid Gwynne
ok markus@
2015-12-09Remove plain DES encryption from IPsec.Christian Weisgerber
DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
2015-07-17manage spd entries by using the radix api directly instead ofBret Lambert
reaching around through the routing table original diff by myself, much improved by mikeb@ and mpi@ ok and testing mikeb@ mpi@
2015-05-23introduce ipsec-id bundles and use them for ipsecflowinfo,Markus Friedl
fixes rekeying for l2tp/ipsec against multiple windows clients and saves memory (for many SAs to same peers); feedback and ok mikeb@
2015-04-16remove unfinished/unused support for socket-attached ipsec-policiesMarkus Friedl
ok mikeb
2015-04-16change {import,export}_identity so it can be used for policies; ok mikebMarkus Friedl
(fixes sadb_ident_type conversion for policies)
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-04-13Now that if_input() set the receiving interface pointer on mbufs for usMartin Pieuchot
there's no need to do it in m_devget(9). Stop passing an ``ifp'' will help for upcoming interface pointer -> index conversion. While here remove unused ``ifp'' argument from m_clget(9) and kill two birds^W layer violations in one commit. ok henning@
2015-03-26Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?Mike Belopuhov
ok markus, hshoexer
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-11-25The proliferation of "struct route" in all its flavors didn't makeMartin Pieuchot
any good to our network stack. The most visible effect is the maze of #ifdef's and casts. But the real problem is the very fragile way of checking if a (cached) route entry is still valid or not. What should we do if the route jumped to another ifaddr or if its gateway has been changed? This change start the dance of "struct route" & friends removal by sending the completly useless "struct route_enc" to the bucket. Tweak & ok claudio@
2014-11-01Rename rtalloc1() into rtalloc(9) and convert its flags to only enableMartin Pieuchot
functionnality instead of a mix of enable/disable. ok bluhm@, jca@
2014-10-14Use rtfree() instead of RTFREE(), NULLify some free'd route pointers andMartin Pieuchot
kill the macro. ok mikeb@, henning@
2014-09-27Kill rtalloc() and update rtalloc1() and rtalloc_mpath() to no longerMartin Pieuchot
rely on "struct route" that should die. ok claudio@
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-01-08Perform manual malloc/free of a large object in pfkeyv2_send() toTheo de Raadt
reduce stack space requirements. ok mikeb mpi
2013-08-21get rid of the copy argument in m_devget that let you provide anDavid Gwynne
alternative to bcopy since noone uses it. while there use memcpy instead of bcopy because we know the memory cannot overlap. ok henning@ matthew@ mikeb@ deraadt@
2013-03-09re-arrange the pre-accounting of the objects in the buffer so itTheo de Raadt
is clearer; ok sthen
2013-02-26Reserve space for source and destination addresses unconditionally ratherStuart Henderson
than checking if they're zero - export_address() is always called for these. Fixes memory corruption when doing ipsecctl -ssa with md5sig. Debugging hints from deraadt@, ok kettenis@ deraadt@
2012-12-28change the malloc(9) flags from M_DONTWAIT to M_NOWAIT; OK millert@Gleydson Soares
2012-09-26add M_ZEROIZE as an mbuf flag, so copied PFKEY messages (with embedded keys)Markus Friedl
are cleared as well; from hshoexer@, feedback and ok bluhm@, ok claudio@
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 20:15:36 +0000