summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_ipsp.c
AgeCommit message (Collapse)Author
2016-12-19Introduce the NET_LOCK() a rwlock used to serialize accesses to the partsMartin Pieuchot
of the network stack that are not yet ready to be executed in parallel or where new sleeping points are not possible. This first pass replace all the entry points leading to ip_output(). This is done to not introduce new sleeping points when trying to acquire ART's write lock, needed when a new L2 entry is created via the RT_RESOLVE. Inputs from and ok bluhm@, ok dlg@
2016-11-15TDB timers need a context process, so convert them to timeout_set_proc(9).Martin Pieuchot
ok phessler@, bluhm@ as part of a larger diff
2016-09-20Sprinkle splsoftnets in TDB timeout callbacks; ok bluhmMike Belopuhov
2016-09-19convert bcopy to memcpy. from david hill.Ted Unangst
2016-09-15move from RB macros to RBT functionsDavid Gwynne
shaves a bunch of bytes off kernels
2015-05-23introduce ipsec-id bundles and use them for ipsecflowinfo,Markus Friedl
fixes rekeying for l2tp/ipsec against multiple windows clients and saves memory (for many SAs to same peers); feedback and ok mikeb@
2015-04-17Stubs and support code for NIC-enabled IPsec bite the dust.Mike Belopuhov
No objection from reyk@, OK markus, hshoexer
2015-04-17Remove unused ipsp_parse_headers that was supposed to parse packetsMike Belopuhov
returned by IPsec-enabled NICs; OK markus, hshoexer
2015-04-16remove unfinished/unused support for socket-attached ipsec-policiesMarkus Friedl
ok mikeb
2015-04-14make ipsp_address thread safe; ok mpiMike Belopuhov
2015-04-14Remove support for storing credentials and auth information in the kernel.Mike Belopuhov
This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
2015-04-13Make filter argument to ipsp_aux_match optional like the rest of them.Mike Belopuhov
OK markus, hshoexer
2015-04-13Rename gettdbbyaddr to gettdbbydst; OK markus, hshoexer, mpiMike Belopuhov
2015-04-13Remove unused arguments from gettdb* functions; OK markus, hshoexer, mpiMike Belopuhov
2015-04-10replace the guts of tdb_hash with SipHash24David Gwynne
tested by (including some statistical measurement) and ok mikeb@
2015-03-14Remove some includes include-what-you-use claims don'tJonathan Gray
have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
2015-01-24Userland (base & ports) was adapted to always include <netinet/in.h>Theo de Raadt
before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
2014-12-19unifdef INET in net code as a precursor to removing the pretend option.Ted Unangst
long live the one true internet. ok henning mikeb
2014-12-09More malloc() -> mallocarray() in the kernel.Doug Hogan
ok deraadt@ tedu@
2014-11-18move arc4random prototype to systm.h. more appropriate for most codeTed Unangst
to include that than rdnvar.h. ok deraadt dlg
2014-09-14remove uneeded proc.h includesJonathan Gray
ok mpi@ kspillner@
2014-09-08remove uneeded route.h includesJonathan Gray
ok miod@ mpi@
2014-07-22Fewer <netinet/in_systm.h> !Martin Pieuchot
2014-07-12add a size argument to free. will be used soon, but for now default to 0.Ted Unangst
after discussions with beck deraadt kettenis.
2014-07-08decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.hTheo de Raadt
don't need to be married. ok guenther miod beck jsing kettenis
2014-04-14"struct pkthdr" holds a routing table ID, not a routing domain one.Martin Pieuchot
Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
2014-01-09bzero/bcmp -> memset/memcmp. ok matthewTed Unangst
2013-11-11Replace most of our formating functions to convert IPv4/6 addresses fromMartin Pieuchot
network to presentation format to inet_ntop(). The few remaining functions will be soon converted. ok mikeb@, deraadt@ and moral support from henning@
2013-10-24Remove the number of in6_var.h inclusions by moving some functions andMartin Pieuchot
global variables to in6.h. ok deraadt@
2013-07-04These functions are only used in debug code, so put them underMartin Pieuchot
ifdef ENCDEBUG to make sure we don't use them elsewhere.
2013-04-11Remove the extern keyword from function declarations, documentMartin Pieuchot
sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
2013-04-10Remove various external variable declaration from sources files andMartin Pieuchot
move them to the corresponding header with an appropriate comment if necessary. ok guenther@
2013-04-09Remove read-only ipsec variables and directly use defines instead.Martin Pieuchot
ok mikeb@, markus@
2013-03-28code that calls timeout functions should include timeout.hTed Unangst
slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
2012-09-20spltdb() was really just #define'd to be splsoftnet(); replace the formerBret Lambert
with the latter no change in md5 checksum of generated files ok claudio@ henning@
2012-09-18remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setMarkus Friedl
anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
2011-05-11Pre-allocate memory to avoid sleeping after performing a lookup, whichBret Lambert
may lead to a race. ok markus@ mikeb@
2011-03-31- use nitems(); no binary changeJasper Lievisse Adriaanse
ok claudio@
2010-07-09Add support for using IPsec in multiple rdomains.Reyk Floeter
This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
2010-04-20remove proc.h include from uvm_map.h. This has far reaching effects, asTed Unangst
sysctl.h was reliant on this particular include, and many drivers included sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed. ok deraadt
2010-01-10Fix two bugs in IPsec/HMAC-SHA2:Markus Friedl
(1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt
2009-08-12don't confuse chars with strings; ok oga@Martynas Venckus
2009-06-02Shuffle function declarations a bit; ipsp_kern doesn't actually exist,Bret Lambert
and tdb_hash is only used in ip_ipsp.c, so there's no need to declare it as extern in ip_ipsp.h ok claudio@ henning@
2009-06-02Fix an off-by-one in the ddb-only debugging function tdb_hashstats.Owain Ainsworth
when we check if a hash chain is over 15 long, we would access one past the end of the array. change the static array size to a define because it makes this checking easier to verify. Found by Parfait. ok deraadt@.
2009-02-16pfsync v5, mostly written at n2k9, but based on work done at n2k8.David Gwynne
WARNING: THIS BREAKS COMPATIBILITY WITH THE PREVIOUS VERSION OF PFSYNC this is a new variant of the protocol and a large reworking of the pfsync code to address some performance issues. the single largest benefit comes from having multiple pfsync messages of different types handled in a single packet. pfsyncs handling of pf states is highly optimised now, along with packet parsing and construction. huggz for beck@ for testing. huge thanks to mcbride@ for his help during development and for finding all the bugs during the initial tests. thanks to peter sutton for letting me get credit for this work. ok beck@ mcbride@ "good." deraadt@
2008-10-22#if INET => #ifdef INETMarco Pfatschbacher
#if INET6 => #ifdef INET6
2008-09-15remove dead stores and newly created unused variables.Charles Longeau
Found by LLVM/Clang Static Analyzer. ok mpf@ looks good mk@ ok henning@
2008-09-10Convert timeout_add() calls using multiples of hz to timeout_add_sec()Bret Lambert
Really just the low-hanging fruit of (hopefully) forthcoming timeout conversions. ok art@, krw@
2008-04-18use arc4random_uniform() for random number requests that are not aDamien Miller
power of two. use arc4random_bytes() when requesting more than a word of PRNG output. ok deraadt@
2007-10-29MALLOC/FREE -> malloc/freeCharles Longeau
ok krw@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-26 20:47:30 +0000