summaryrefslogtreecommitdiffstats
path: root/sys/netinet6/ip6_forward.c
Commit message (Collapse)AuthorAgeFilesLines
* Remove RTF_PRCLONING from routing table and adjust users of itandre2003-11-201-3/+2
| | | | | | | | | | | | accordingly. The define is left intact for ABI compatibility with userland. This is a pre-step for the introduction of tcp_hostcache. The network stack remains fully useable with this change. Reviewed by: sam (mentor), bms Reviewed by: -net, -current, core@kame.net (IPv6 parts) Approved by: re (scottl)
* - cleanup SP refcnt issue.ume2003-11-041-5/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - share policy-on-socket for listening socket. - don't copy policy-on-socket at all. secpolicy no longer contain spidx, which saves a lot of memory. - deep-copy pcb policy if it is an ipsec policy. assign ID field to all SPD entries. make it possible for racoon to grab SPD entry on pcb. - fixed the order of searching SA table for packets. - fixed to get a security association header. a mode is always needed to compare them. - fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime. - disallow port spec for tunnel mode policy (as we don't reassemble). - an user can define a policy-id. - clear enc/auth key before freeing. - fixed that the kernel crashed when key_spdacquire() was called because key_spdacquire() had been implemented imcopletely. - preparation for 64bit sequence number. - maintain ordered list of SA, based on SA id. - cleanup secasvar management; refcnt is key.c responsibility; alloc/free is keydb.c responsibility. - cleanup, avoid double-loop. - use hash for spi-based lookup. - mark persistent SP "persistent". XXX in theory refcnt should do the right thing, however, we have "spdflush" which would touch all SPs. another solution would be to de-register persistent SPs from sptree. - u_short -> u_int16_t - reduce kernel stack usage by auto variable secasindex. - clarify function name confusion. ipsec_*_policy -> ipsec_*_pcbpolicy. - avoid variable name confusion. (struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct secpolicy *) - count number of ipsec encapsulations on ipsec4_output, so that we can tell ip_output() how to handle the packet further. - When the value of the ul_proto is ICMP or ICMPV6, the port field in "src" of the spidx specifies ICMP type, and the port field in "dst" of the spidx specifies ICMP code. - avoid from applying IPsec transport mode to the packets when the kernel forwards the packets. Tested by: nork Obtained from: KAME
* - change scope to zone.ume2003-10-211-2/+4
| | | | | | | | - change node-local to interface-local. - better error handling of address-to-scope mapping. - use in6_clearscope(). Obtained from: KAME
* correct linkmtu handling.ume2003-10-201-2/+2
| | | | Obtained from: KAME
* nuke SCOPEDROUTING. Though it was there for a long time,ume2003-10-101-2/+0
| | | | it was never enabled.
* - fix typo in comments.ume2003-10-081-16/+14
| | | | | | | | | | - style. - NULL is not 0. - some variables were renamed. - nuke unused logic. (there is no functional change.) Obtained from: KAME
* Correct pfil_run_hooks return handling: if the return value is non-zerosam2003-09-301-4/+6
| | | | | | | | | then the mbuf has been consumed by a hook; otherwise beware of a null mbuf return (gack). In particular the bridge was doing the wrong thing. While in the ipv6 code make it's handling of pfil_run_hooks identical to netbsd. Pointed out by: Pyun YongHyeon <yongari@kt-is.co.kr>
* o update PFIL_HOOKS support to current API used by netbsdsam2003-09-231-20/+8
| | | | | | | | | | | o revamp IPv4+IPv6+bridge usage to match API changes o remove pfil_head instances from protosw entries (no longer used) o add locking o bump FreeBSD version for 3rd party modules Heavy lifting by: "Max Laier" <max@love2party.net> Supported by: FreeBSD Foundation Obtained from: NetBSD (bits of pfil.h and pfil.c)
* Tie new "Fast IPsec" code into the build. This involves the usualsam2002-10-161-0/+9
| | | | | | | | | | | | configuration stuff as well as conditional code in the IPv4 and IPv6 areas. Everything is conditional on FAST_IPSEC which is mutually exclusive with IPSEC (KAME IPsec implmentation). As noted previously, don't use FAST_IPSEC with INET6 at the moment. Reviewed by: KAME, rwatson Approved by: silence Supported by: Vernier Networks
* just merged cosmetic changes from KAME to ease sync between KAME and FreeBSD.suz2002-04-191-4/+3
| | | | | | | (based on freebsd4-snap-20020128) Reviewed by: ume MFC after: 1 week
* Remove duplicate extern declarations to silence warnings.alfred2002-03-191-3/+0
|
* Back out cometic changes. This is for easily syncing with KAME in other BSDs.sumikawa2001-12-171-5/+5
|
* catch forwarded ipv6 packets with pfil_hooks for outbound things toodarrenr2001-10-151-0/+34
|
* Sync with recent KAME.ume2001-06-111-37/+54
| | | | | | | | | | | | | | | | | | This work was based on kame-20010528-freebsd43-snap.tgz and some critical problem after the snap was out were fixed. There are many many changes since last KAME merge. TODO: - The definitions of SADB_* in sys/net/pfkeyv2.h are still different from RFC2407/IANA assignment because of binary compatibility issue. It should be fixed under 5-CURRENT. - ip6po_m member of struct ip6_pktopts is no longer used. But, it is still there because of binary compatibility issue. It should be removed under 5-CURRENT. Reviewed by: itojun Obtained from: KAME MFC after: 3 weeks
* Make ip6fw as loadable module.ume2000-09-231-5/+1
|
* s/IPSEC_IPV6FWD/IPSEC/. this avoids unexpected behavior on ipv6 fowarding.itojun2000-07-161-10/+10
| | | | | (even if you ask for tunnel-mode encryption packets will go out in clear) sync with kame.
* correct compilation with IPSEC_IPV6FWD.itojun2000-07-051-0/+1
| | | | From: Ollivier Robert <roberto@keltia.freenix.fr>
* sync with kame tree as of july00. tons of bug fixes/improvements.itojun2000-07-041-37/+200
| | | | | | | API changes: - additional IPv6 ioctls - IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8). (also syntax change)
* Remove unneeded #include <sys/kernel.h>phk2000-04-291-1/+0
|
* Remove ~25 unneeded #include <sys/conf.h>phk2000-04-191-1/+0
| | | | Remove ~60 unneeded #include <sys/malloc.h>
* IPSEC support in the kernel.shin1999-12-221-6/+4
| | | | | | | | pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
* udp IPv6 support, IPv6/IPv4 tunneling support in kernel,shin1999-12-071-6/+0
| | | | | | | | | | packet divert at kernel for IPv6/IPv4 translater daemon This includes queue related patch submitted by jburkhol@home.com. Submitted by: queue related patch from jburkhol@home.com Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
* Removed IPSEC and IPV6FIREWALL because they are not ready yet.shin1999-11-231-2/+0
|
* KAME netinet6 basic part(no IPsec,no V6 Multicast Forwarding, no UDP/TCPshin1999-11-221-0/+391
for IPv6 yet) With this patch, you can assigne IPv6 addr automatically, and can reply to IPv6 ping. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
OpenPOWER on IntegriCloud