summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_esp.c
AgeCommit message (Collapse)Author
2003-12-10de-register. deraadt okJun-ichiro itojun Hagino
2003-08-14m_copyback()'s 4th arg is const void *, nuke (caddr_t) casts.Jason Wright
2003-07-24conform to RFC2367 on SADB_xx naming (local name must be prefixed withJun-ichiro itojun Hagino
SADB_X_xx)
2003-07-24hmac-sha2-{256,384,512} support in AH/ESP auth. markus okJun-ichiro itojun Hagino
2003-07-09fix whitespaceMarkus Friedl
2003-05-03just as a safety measure, set m_flags to 0 for mbufs allocated on stack.Jun-ichiro itojun Hagino
dhartmei ok
2003-04-02o sanity check mbuf earlier.Todd C. Miller
o return errno, not NULL. o add some missing error values o proper crypto_freereq() in ip_ipcomp.c From Patrick Latifi; OK angelos@
2003-03-31Avoid using FREEd data when we get a crypto error; Patrick LatifiTodd C. Miller
Also move the session ID reset into the crp_etype == EAGAIN case (noticed by angelos@). OK jason@ and angelos@
2003-02-28Based on several comments from tedu:Jason Wright
- two variables 'err' and 'error', whacked - missing initialization in the error path for the case where an SA expired while off in crypto land. - a small bit of knf.
2003-02-21kill unused variablesTed Unangst
ok jason@
2003-02-12Remove commons; inspired by netbsd.Jason Wright
2003-02-01m_pad() is expected to have free'd the mbuf if it returns NULL, soDaniel Hartmeier
free it in one (rare) error condition. ok angelos@
2002-11-07Check for invalid payload lengths also for NULL enc. markus@, angelos@ ok.Hakan Olsson
2002-07-30Be sure to check the integrity verifier for packets that didn't have it doneJason Wright
in hardware; from angelos
2002-07-05Free crp_opaque only after we've determined we're not going toAngelos D. Keromytis
re-submit it. From sam@errno.com
2002-06-18KNFAngelos D. Keromytis
2002-06-18Initialize mo to NULL, for good measure -- sam@errno.comAngelos D. Keromytis
2002-06-18Same as with ip_ah.c (fix unreachable reference-after-free)Angelos D. Keromytis
2002-05-31Fix a DoS attack whereby an attacker could cause the replay counter toAngelos D. Keromytis
advance with unauthenticated packets, thereby causing valid packets to be discarded as replays. This has been sitting in my tree for a while, and I've forgotten who it was that pointed out the problem.
2001-06-26KNFAngelos D. Keromytis
2001-06-25Copyright.Angelos D. Keromytis
2001-06-23merge crypto/crypto{dev,}.h to crypto/cryptodev.h, to avoid name conflicts ↵Theo de Raadt
inside OpenSSL codebase
2001-06-13Use blocksize, not ivmaskAngelos D. Keromytis
2001-06-08Trim include files.Angelos D. Keromytis
2001-06-05Add a few DPRINTF()'sAngelos D. Keromytis
2001-06-01The IPsec-aware NIC cards don't pass the ICV for later verificationAngelos D. Keromytis
by the stack; that means, if we have a tag it means the ICV was successfully verified and we don't need to do anything else. As well, we don't need any other status information from the NIC.
2001-05-30Update to match prototypes.Angelos D. Keromytis
2001-05-30Handle TDBF_SKIPCRYPTO on output, and PACKET_TAG_IPSEC_IN_CRYPTO_DONEAngelos D. Keromytis
on input.
2001-05-27Pass a NULL packet tag for now to ipsp_common_input_cb().Angelos D. Keromytis
2001-05-17convert mbuf and cluster allocation to pool, mostly from NetBSDNiels Provos
okay art@ miod@
2001-05-13initial cut at /dev/crypto support. takes original mbuf "try, and discardTheo de Raadt
if we fail" semantics and extends to two varients of data movement: mbuf, or an iovec style block.
2001-05-12Move bzero() after test for correct allocation (jj@wabbitt.org)Angelos D. Keromytis
2001-04-14Minor changes, preparing for real socket-attached TDBs; also, moreAngelos D. Keromytis
information will be stored in the TDB. ok ho@ provos@
2001-04-06Move offsetof define into sys/param.hConstantine Sapuntzakis
2001-03-28Allow tdbi's to appear in mbufs throughout the stack; this allowsAngelos D. Keromytis
security properties of the packets to be pushed up to the application (not done yet). Eventually, this will be turned into a packet attributes framework. Make sure tdbi's are free'd/cleared properly whenever drivers (or NFS) does weird things with mbufs.
2001-03-23Fix slow mbuf leak.Angelos D. Keromytis
2001-03-15convert SA expirations to the new timeouts.Michael Shalayeff
simplifies expirations handling a lot. tdb_exp_timeout and tdb_soft_timeout are made consistant throughout the code to be a relative time offsets, just like first_use timeouts. tested on singlehost isakmpd setup. lots of dangling spaces and tabs removed. angelos@ ok
2000-11-17*HMAC96->*HMACAngelos D. Keromytis
2000-10-09AES support.Angelos D. Keromytis
2000-09-19Lots and lots of changes.Angelos D. Keromytis
2000-06-18Use M_NOWAIT instead of M_DONTWAIT in MALLOC() (even though they'reAngelos D. Keromytis
defined to be the same in mbuf.h)
2000-06-18The callbacks need to set the appropriate spl level now.Angelos D. Keromytis
2000-06-15What was the offending payload length?Angelos D. Keromytis
2000-06-14Initialize tc_ptr to zero if authentication is not used.Angelos D. Keromytis
2000-06-06Get rid of tdb_ref, keep indirect pointer to TDB.Angelos D. Keromytis
2000-06-01Check for invalid TDBs right away in the callbacks.Angelos D. Keromytis
2000-05-15Fix sanity check that caused really short packets (ICMPs with lessAngelos D. Keromytis
than 8 bytes of payload) to be dropped. Did not affect TCP/UDP packets and most ICMP packets.
2000-04-25when fixing up the header, copy from the right sized datatype (fixes IPsecJason Wright
on big-endian machines)
2000-04-06only call get_random_bytes() once in m_pad()Theo de Raadt
2000-03-30Only allocate space for a copy of the authenticator if authenticationAngelos D. Keromytis
is in use.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 22:04:08 +0000