summaryrefslogtreecommitdiffstats
path: root/sys/netinet6/ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* Remove manual assignment of m_pkthdr from one mbuf to another inrwatson2006-03-281-9/+0
| | | | | | | | | | | ipsec_copypkt(), as this is already handled by the call to M_MOVE_PKTHDR(), which also knows how to correctly handle MAC m_tags. This corrects a panic when running with MAC and KAME IPSEC. PR: kern/94599 Submitted by: zhouyi zhou <zhouyi04 at ios dot cn> Reviewed by: bz MFC after: 3 days
* scope cleanup. with this changeume2005-07-251-8/+18
| | | | | | | | | | | | | | | | | | | - most of the kernel code will not care about the actual encoding of scope zone IDs and won't touch "s6_addr16[1]" directly. - similarly, most of the kernel code will not care about link-local scoped addresses as a special case. - scope boundary check will be stricter. For example, the current *BSD code allows a packet with src=::1 and dst=(some global IPv6 address) to be sent outside of the node, if the application do: s = socket(AF_INET6); bind(s, "::1"); sendto(s, some_global_IPv6_addr); This is clearly wrong, since ::1 is only meaningful within a single node, but the current implementation of the *BSD kernel cannot reject this attempt. Submitted by: JINMEI Tatuya <jinmei__at__isl.rdc.toshiba.co.jp> Obtained from: KAME
* reported from VANHULLEBUS Yvan [remote kernel crash may result]ume2005-03-091-1/+1
| | | | | | Submitted by: itojun Obtained from: KAME MFC after: 1 day
* remove dead codesam2005-02-251-3/+3
| | | | Noticed by: Coverity Prevent analysis tool
* eliminate dead codesam2005-02-231-6/+6
| | | | Noticed by: Coverity Prevent analysis tool
* /* -> /*- for license, minor formatting changes, separate for KAMEimp2005-01-071-1/+1
|
* fixed a bug that incorrect IPsec request level may be returned for proto AHsuz2004-10-281-0/+1
| | | | Obtained from: KAME
* Mark Netgraph TTY, KAME IPSEC, and IPX/SPX as requiring Giant for correctrwatson2004-08-281-0/+2
| | | | | | | operation using NET_NEEDS_GIANT(). This will result in a boot-time restoration of Giant-enabled network operation, or run-time warning on dynamic load (applicable only to the Netgraph component). Additional components will likely need to be marked with this in the future.
* Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSDdwmalone2004-08-141-6/+1
| | | | | | | | | | | | | | | | | | | | | have already done this, so I have styled the patch on their work: 1) introduce a ip_newid() static inline function that checks the sysctl and then decides if it should return a sequential or random IP ID. 2) named the sysctl net.inet.ip.random_id 3) IPv6 flow IDs and fragment IDs are now always random. Flow IDs and frag IDs are significantly less common in the IPv6 world (ie. rarely generated per-packet), so there should be smaller performance concerns. The sysctl defaults to 0 (sequential IP IDs). Reviewed by: andre, silby, mlaier, ume Based on: NetBSD MFC after: 2 months
* correct function name in comment.ume2004-02-161-18/+18
| | | | Submitted by: "Bjoern A. Zeeb" <bzeeb+freebsd@zabbadoz.net>
* nuke unused functions.ume2004-02-161-46/+0
| | | | Submitted by: "Bjoern A. Zeeb" <bzeeb+freebsd@zabbadoz.net>
* pass pcb rather than so. it is expected that per socket policyume2004-02-031-84/+64
| | | | works again.
* correct spellingume2004-01-131-7/+7
| | | | | Submitted by: "Bjoern A. Zeeb" <bzeeb+freebsd@zabbadoz.net> Reviewed by: itojun
* fix potential 'cannot-happen' memory leakume2004-01-131-1/+4
| | | | | Submitted by: "Bjoern A. Zeeb" <bzeeb+freebsd@zabbadoz.net> Reviewed by: itojun
* nuke obsoleted ipsec_gethist(). it just did panic to notify userume2003-11-071-9/+0
| | | | | | | that it was obsoleted. it is better to fail than just hiding use of ipsec_gethist() at build. Sugessted by: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
* - cleanup SP refcnt issue.ume2003-11-041-489/+688
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - share policy-on-socket for listening socket. - don't copy policy-on-socket at all. secpolicy no longer contain spidx, which saves a lot of memory. - deep-copy pcb policy if it is an ipsec policy. assign ID field to all SPD entries. make it possible for racoon to grab SPD entry on pcb. - fixed the order of searching SA table for packets. - fixed to get a security association header. a mode is always needed to compare them. - fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime. - disallow port spec for tunnel mode policy (as we don't reassemble). - an user can define a policy-id. - clear enc/auth key before freeing. - fixed that the kernel crashed when key_spdacquire() was called because key_spdacquire() had been implemented imcopletely. - preparation for 64bit sequence number. - maintain ordered list of SA, based on SA id. - cleanup secasvar management; refcnt is key.c responsibility; alloc/free is keydb.c responsibility. - cleanup, avoid double-loop. - use hash for spi-based lookup. - mark persistent SP "persistent". XXX in theory refcnt should do the right thing, however, we have "spdflush" which would touch all SPs. another solution would be to de-register persistent SPs from sptree. - u_short -> u_int16_t - reduce kernel stack usage by auto variable secasindex. - clarify function name confusion. ipsec_*_policy -> ipsec_*_pcbpolicy. - avoid variable name confusion. (struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct secpolicy *) - count number of ipsec encapsulations on ipsec4_output, so that we can tell ip_output() how to handle the packet further. - When the value of the ul_proto is ICMP or ICMPV6, the port field in "src" of the spidx specifies ICMP type, and the port field in "dst" of the spidx specifies ICMP code. - avoid from applying IPsec transport mode to the packets when the kernel forwards the packets. Tested by: nork Obtained from: KAME
* - change scope to zone.ume2003-10-211-5/+3
| | | | | | | | - change node-local to interface-local. - better error handling of address-to-scope mapping. - use in6_clearscope(). Obtained from: KAME
* - fix typo in comments.ume2003-10-081-56/+61
| | | | | | | | | | - style. - NULL is not 0. - some variables were renamed. - nuke unused logic. (there is no functional change.) Obtained from: KAME
* return(code) -> return (code)ume2003-10-061-2/+2
| | | | (reduce diffs against KAME)
* - include opt_random_ip_id.hume2003-10-011-0/+1
| | | | - we don't need to obtain microtime when using ip6_randomid.
* panic() doesn't need \nsuz2003-04-291-39/+39
| | | | | Obtained from: KAME MFC after: 2 days
* Fix another case for timewait.jlemon2003-02-241-0/+3
|
* Add a TCP TIMEWAIT state which uses less space than a fullblown TCPjlemon2003-02-191-59/+66
| | | | | | | | control block. Allow the socket and tcpcb structures to be freed earlier than inpcb. Update code to understand an inp w/o a socket. Reviewed by: hsu, silby, jayanth Sponsored by: DARPA, NAI Labs
* Back out M_* changes, per decision of the TRB.imp2003-02-191-9/+9
| | | | Approved by: trb
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-9/+9
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* purge extraneous clears of M_PKTHDR since M_MOVE_PKTHDR does this alreadysam2003-01-061-2/+0
|
* Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,schweikh2003-01-011-2/+2
| | | | especially in troff files.
* Correct mbuf packet header propagation. Previously, packet headerssam2002-12-301-11/+5
| | | | | | | | | | | | | | | | | | | | | | were sometimes propagated using M_COPY_PKTHDR which actually did something between a "move" and a "copy" operation. This is replaced by M_MOVE_PKTHDR (which copies the pkthdr contents and "removes" it from the source mbuf) and m_dup_pkthdr which copies the packet header contents including any m_tag chain. This corrects numerous problems whereby mbuf tags could be lost during packet manipulations. These changes also introduce arguments to m_tag_copy and m_tag_copy_chain to specify if the tag copy work should potentially block. This introduces an incompatibility with openbsd which we may want to revisit. Note that move/dup of packet headers does not handle target mbufs that have a cluster bound to them. We may want to support this; for now we watch for it with an assert. Finally, M_COPYFLAGS was updated to include M_FIRSTFRAG|M_LASTFRAG. Supported by: Vernier Networks Reviewed by: Robert Watson <rwatson@FreeBSD.org>
* Replace aux mbufs with packet tags:sam2002-10-161-115/+15
| | | | | | | | | | | | | | | | | | | o instead of a list of mbufs use a list of m_tag structures a la openbsd o for netgraph et. al. extend the stock openbsd m_tag to include a 32-bit ABI/module number cookie o for openbsd compatibility define a well-known cookie MTAG_ABI_COMPAT and use this in defining openbsd-compatible m_tag_find and m_tag_get routines o rewrite KAME use of aux mbufs in terms of packet tags o eliminate the most heavily used aux mbufs by adding an additional struct inpcb parameter to ip_output and ip6_output to allow the IPsec code to locate the security policy to apply to outbound packets o bump __FreeBSD_version so code can be conditionalized o fixup ipfilter's call to ip_output based on __FreeBSD_version Reviewed by: julian, luigi (silent), -arch, -net, darren Approved by: julian, silence from everyone else Obtained from: openbsd (mostly) MFC after: 1 month
* just merged cosmetic changes from KAME to ease sync between KAME and FreeBSD.suz2002-04-191-24/+24
| | | | | | | (based on freebsd4-snap-20020128) Reviewed by: ume MFC after: 1 week
* Fixed the behavior when there is no inbound policy for the ipsecume2001-11-061-0/+8
| | | | | | | | | | | | | tunneled packet. When there is no suitable inbound policy for the packet of the ipsec tunnel mode, the kernel never decapsulate the tunneled packet as the ipsec tunnel mode even when the system wide policy is "none". Then the kernel leaves the generic tunnel module to process this packet. If there is no rule of the generic tunnel, the packet is rejected and the statistics will be counted up. Obtained from: KAME MFC after: 1 week
* Fixed to process a IPv6 packet when ah transport after esp tunnelume2001-10-171-3/+42
| | | | | | | | should be applied. the SA of AH transport could not be selected from the SAD because of this bug. Obtained from: KAME MFC after: 1 week
* Sync with recent KAME.ume2001-06-111-387/+617
| | | | | | | | | | | | | | | | | | This work was based on kame-20010528-freebsd43-snap.tgz and some critical problem after the snap was out were fixed. There are many many changes since last KAME merge. TODO: - The definitions of SADB_* in sys/net/pfkeyv2.h are still different from RFC2407/IANA assignment because of binary compatibility issue. It should be fixed under 5-CURRENT. - ip6po_m member of struct ip6_pktopts is no longer used. But, it is still there because of binary compatibility issue. It should be removed under 5-CURRENT. Reviewed by: itojun Obtained from: KAME MFC after: 3 weeks
* Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets.kris2001-06-011-0/+4
| | | | | | | | | This closes a minor information leak which allows a remote observer to determine the rate at which the machine is generating packets, since the default behaviour is to increment a counter for each packet sent. Reviewed by: -net Obtained from: OpenBSD
* nuke IPSEC_SRCSEL which does not do the right thing.ume2001-03-161-33/+3
| | | | | | | adjust state->ro if the tunnel endpoint is offlink. KAME PR 233. PR: kern/21079
* Change check from mbuf->m_ext.ext_free to use the new ext_type in orderbmilekic2000-11-111-6/+3
| | | | | | | | | | to determine whether the given mbuf has a cluster (or some other type of external storage) attached to it. Note: This code should eventually be made to use M_WRITABLE() to determine whether or not a copy should be made. Reviewed by: jlemon
* backout my previous commit (KAME PR 296). foo != TUNNEL willume2000-11-091-4/+0
| | | | | | forbid "ANY" SA from being used for tnunel mode. Reported by: Chris Cason <casonc@netplex.aussie.org>
* check whether the packet is tunnel mode. reported from <larse@ISI.EDU>ume2000-11-031-0/+4
| | | | Obtained from: KAME
* Replace the mbuf external reference counting code with somethingdwmalone2000-08-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that should be better. The old code counted references to mbuf clusters by using the offset of the cluster from the start of memory allocated for mbufs and clusters as an index into an array of chars, which did the reference counting. If the external storage was not a cluster then reference counting had to be done by the code using that external storage. NetBSD's system of linked lists of mbufs was cosidered, but Alfred felt it would have locking issues when the kernel was made more SMP friendly. The system implimented uses a pool of unions to track external storage. The union contains an int for counting the references and a pointer for forming a free list. The reference counts are incremented and decremented atomically and so should be SMP friendly. This system can track reference counts for any sort of external storage. Access to the reference counting stuff is now through macros defined in mbuf.h, so it should be easier to make changes to the system in the future. The possibility of storing the reference count in one of the referencing mbufs was considered, but was rejected 'cos it would often leave extra mbufs allocated. Storing the reference count in the cluster was also considered, but because the external storage may not be a cluster this isn't an option. The size of the pool of reference counters is available in the stats provided by "netstat -m". PR: 19866 Submitted by: Bosko Milekic <bmilekic@dsuper.net> Reviewed by: alfred (glanced at by others on -net)
* sync with kame tree as of july00. tons of bug fixes/improvements.itojun2000-07-041-324/+617
| | | | | | | API changes: - additional IPv6 ioctls - IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8). (also syntax change)
* Add missing include machine/in_cksum.h.ps2000-05-091-0/+2
| | | | Submitted by: n_hibma
* Fixed the problem that IPsec connection hangs when bigger data is sent.shin2000-01-151-7/+5
| | | | | | | -opt_ipsec.h was missing on some tcp files (sorry for basic mistake) -made buildable as above fix -also added some missing IPv4 mapped IPv6 addr consideration into ipsec4_getpolicybysock
* Change struct sockaddr_storage member name, because following changeshin2000-01-131-26/+26
| | | | | | | | | | | | is very likely to become consensus as recent ietf/ipng mailing list discussion. Also recent KAME repository and other KAME patched BSDs also applied it. s/__ss_family/ss_family/ s/__ss_len/ss_len/ Makeworld is confirmed, and no application should be affected by this change yet.
* IPSEC support in the kernel.shin1999-12-221-0/+3061
pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
OpenPOWER on IntegriCloud