summaryrefslogtreecommitdiffstats
path: root/sys/netipsec/ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* Try to remove/assimilate as much of formerly IPv4/6 specificbz2009-02-081-214/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (duplicate) code in sys/netipsec/ipsec.c and fold it into common, INET/6 independent functions. The file local functions ipsec4_setspidx_inpcb() and ipsec6_setspidx_inpcb() were 1:1 identical after the change in r186528. Rename to ipsec_setspidx_inpcb() and remove the duplicate. Public functions ipsec[46]_get_policy() were 1:1 identical. Remove one copy and merge in the factored out code from ipsec_get_policy() into the other. The public function left is now called ipsec_get_policy() and callers were adapted. Public functions ipsec[46]_set_policy() were 1:1 identical. Rename file local ipsec_set_policy() function to ipsec_set_policy_internal(). Remove one copy of the public functions, rename the other to ipsec_set_policy() and adapt callers. Public functions ipsec[46]_hdrsiz() were logically identical (ignoring one questionable assert in the v6 version). Rename the file local ipsec_hdrsiz() to ipsec_hdrsiz_internal(), the public function to ipsec_hdrsiz(), remove the duplicate copy and adapt the callers. The v6 version had been unused anyway. Cleanup comments. Public functions ipsec[46]_in_reject() were logically identical apart from statistics. Move the common code into a file local ipsec46_in_reject() leaving vimage+statistics in small AF specific wrapper functions. Note: unfortunately we already have a public ipsec_in_reject(). Reviewed by: sam Discussed with: rwatson (renaming to *_internal) MFC after: 26 days X-MFC: keep wrapper functions for public symbols?
* Like in the rest of the file and the network stack use inp asbz2008-12-271-30/+30
| | | | | | | | | | variable name for the inpcb. For consistency with the other *_hdrsiz functions use 'size' instead of 'siz' as variable name. No functional change. MFC after: 4 weeks
* Non-functional (style) changes:bz2008-12-271-206/+208
| | | | | | | | | | - Always use round brackets with return (). - Add empty line to beginning of functions without local variables. - Comments start with a capital letter and end in a '.'. While there adapt a few comments. Reviewed by: rwatson MFC after: 4 weeks
* Convert function definitions to constantly use ANSI-stylebz2008-12-271-98/+34
| | | | | | | parameter declarations. Reviewed by: rwatson MFC after: 4 weeks
* Rewrite ipsec6_setspidx_inpcb() to match the logic in thebz2008-12-271-21/+11
| | | | | | (now) equivalent IPv4 counterpart. MFC after: 4 weeks
* For consistency with ipsec4_setspidx_inpcb() rename file local functionbz2008-12-271-3/+3
| | | | | | ipsec6_setspidx_in6pcb() to ipsec6_setspidx_inpcb(). MFC after: 4 weeks
* Change the in6p variable names to inp to be able to diffbz2008-12-271-16/+16
| | | | | | the v4 to the v6 implementations. MFC after: 4 weeks
* Make ipsec_getpolicybysock() static and no longer export it. It has notbz2008-12-271-6/+2
| | | | | | been used outside this file since about the FAST_IPSEC -> IPSEC change. MFC after: 4 weeks
* Another step assimilating IPv[46] PCB code - directly usebz2008-12-151-20/+20
| | | | | | | | | | | | | | the inpcb names rather than the following IPv6 compat macros: in6pcb,in6p_sp, in6p_ip6_nxt,in6p_flowinfo,in6p_vflag, in6p_flags,in6p_socket,in6p_lport,in6p_fport,in6p_ppcb and sotoin6pcb(). Apart from removing duplicate code in netipsec, this is a pure whitespace, not a functional change. Discussed with: rwatson Reviewed by: rwatson (version before review requested changes) MFC after: 4 weeks (set the timer and see then)
* Conditionally compile out V_ globals while instantiating the appropriatezec2008-12-101-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | container structures, depending on VIMAGE_GLOBALS compile time option. Make VIMAGE_GLOBALS a new compile-time option, which by default will not be defined, resulting in instatiations of global variables selected for V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be effectively compiled out. Instantiate new global container structures to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0, vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0. Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_ macros resolve either to the original globals, or to fields inside container structures, i.e. effectively #ifdef VIMAGE_GLOBALS #define V_rt_tables rt_tables #else #define V_rt_tables vnet_net_0._rt_tables #endif Update SYSCTL_V_*() macros to operate either on globals or on fields inside container structs. Extend the internal kldsym() lookups with the ability to resolve selected fields inside the virtualization container structs. This applies only to the fields which are explicitly registered for kldsym() visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently this is done only in sys/net/if.c. Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code, and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in turn result in proper code being generated depending on VIMAGE_GLOBALS. De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c which were prematurely V_irtualized by automated V_ prepending scripts during earlier merging steps. PF virtualization will be done separately, most probably after next PF import. Convert a few variable initializations at instantiation to initialization in init functions, most notably in ipfw. Also convert TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in initializer functions. Discussed at: devsummit Strassburg Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Unify ipsec[46]_delete_pcbpolicy in ipsec_delete_pcbpolicy.bz2008-11-271-22/+1
| | | | | | | | | Ignoring different names because of macros (in6pcb, in6p_sp) and inp vs. in6p variable name both functions were entirely identical. Reviewed by: rwatson (as part of a larger changeset) MFC after: 6 weeks (*) (*) possibly need to leave a stub wrappers in 7 to keep the symbols.
* Merge more of currently non-functional (i.e. resolving tozec2008-11-261-1/+1
| | | | | | | | | | | | | | | | | whitespace) macros from p4/vimage branch. Do a better job at enclosing all instantiations of globals scheduled for virtualization in #ifdef VIMAGE_GLOBALS blocks. De-virtualize and mark as const saorder_state_alive and saorder_state_any arrays from ipsec code, given that they are never updated at runtime, so virtualizing them would be pointless. Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Unbreak the build without INET6.bz2008-11-251-0/+2
|
* Change the initialization methodology for global variables scheduledzec2008-11-191-22/+57
| | | | | | | | | | | | | | | | | | | | | | | | for virtualization. Instead of initializing the affected global variables at instatiation, assign initial values to them in initializer functions. As a rule, initialization at instatiation for such variables should never be introduced again from now on. Furthermore, enclose all instantiations of such global variables in #ifdef VIMAGE_GLOBALS blocks. Essentialy, this change should have zero functional impact. In the next phase of merging network stack virtualization infrastructure from p4/vimage branch, the new initialization methology will allow us to switch between using global variables and their counterparts residing in virtualization containers with minimum code churn, and in the long run allow us to intialize multiple instances of such container structures. Discussed at: devsummit Strassburg Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Step 1.5 of importing the network stack virtualization infrastructurezec2008-10-021-52/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from the vimage project, as per plan established at devsummit 08/08: http://wiki.freebsd.org/Image/Notes200808DevSummit Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator macros, and CURVNET_SET() context setting macros, all currently resolving to NOPs. Prepare for virtualization of selected SYSCTL objects by introducing a family of SYSCTL_V_*() macros, currently resolving to their global counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT(). Move selected #defines from sys/sys/vimage.h to newly introduced header files specific to virtualized subsystems (sys/net/vnet.h, sys/netinet/vinet.h etc.). All the changes are verified to have zero functional impact at this point in time by doing MD5 comparision between pre- and post-change object files(*). (*) netipsec/keysock.c did not validate depending on compile time options. Implemented by: julian, bz, brooks, zec Reviewed by: julian, bz, brooks, kris, rwatson, ... Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Commit step 1 of the vimage project, (network stack)bz2008-08-171-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | virtualization work done by Marko Zec (zec@). This is the first in a series of commits over the course of the next few weeks. Mark all uses of global variables to be virtualized with a V_ prefix. Use macros to map them back to their global names for now, so this is a NOP change only. We hope to have caught at least 85-90% of what is needed so we do not invalidate a lot of outstanding patches again. Obtained from: //depot/projects/vimage-commit2/... Reviewed by: brooks, des, ed, mav, julian, jamie, kris, rwatson, zec, ... (various people I forgot, different versions) md5 (with a bit of help) Sponsored by: NLnet Foundation, The FreeBSD Foundation X-MFC after: never V_Commit_Message_Reviewed_By: more people than the patch
* Fill in a few sysctl descriptions.trhodes2008-07-261-24/+29
| | | | Approved by: rwatson
* Document a few sysctls. While here, remove dead codetrhodes2008-07-201-26/+24
| | | | | | | | related to ip4_esp_randpad. Reviewed by: gnn, bz (older version) Approved by: gnn Tested with: make universe
* In addition to the ipsec_osdep.h removal a week ago, now also eliminatebz2008-05-241-4/+0
| | | | IPSEC_SPLASSERT_SOFTNET which has been 'unused' since FreeBSD 5.0.
* In keeping with style(9)'s recommendations on macros, use a ';'rwatson2008-03-161-1/+1
| | | | | | | | | after each SYSINIT() macro invocation. This makes a number of lightweight C parsers much happier with the FreeBSD kernel source, including cflow's prcc and lxr. MFC after: 1 month Discussed with: imp, rink
* Rather than passing around a cached 'priv', pass in an ucred tobz2008-02-021-11/+14
| | | | | | | | ipsec*_set_policy and do the privilege check only if needed. Try to assimilate both ip*_ctloutput code blocks calling ipsec*_set_policy. Reviewed by: rwatson
* Adjust a comment that suggest that we might consider a panic.bz2007-11-281-1/+3
| | | | | | Make clear that this is not a good idea when called from tcp_output()->ipsec_hdrsiz_tcp()->ipsec4_hdrsize_tcp() as we do not know if IPsec processing is needed at that point.
* Commit IPv6 support for FAST_IPSEC to the tree.gnn2007-07-011-7/+11
| | | | | | | | | This commit includes only the kernel files, the rest of the files will follow in a second commit. Reviewed by: bz Approved by: re Supported by: Secure Computing
* Implement ICMPv6 support in ipsec6_get_ulp().bz2007-05-291-0/+10
| | | | | This is needed to make security policies work correctly if ICMPv6 type and/or code are given. See setkey(8) 'upperspec' para. for details.
* add include now required for crypto flagssam2007-03-221-0/+2
|
* Overhaul driver/subsystem api's:sam2007-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o make all crypto drivers have a device_t; pseudo drivers like the s/w crypto driver synthesize one o change the api between the crypto subsystem and drivers to use kobj; cryptodev_if.m defines this api o use the fact that all crypto drivers now have a device_t to add support for specifying which of several potential devices to use when doing crypto operations o add new ioctls that allow user apps to select a specific crypto device to use (previous ioctls maintained for compatibility) o overhaul crypto subsystem code to eliminate lots of cruft and hide implementation details from drivers o bring in numerous fixes from Michale Richardson/hifn; mostly for 795x parts o add an optional mechanism for mmap'ing the hifn 795x public key h/w to user space for use by openssl (not enabled by default) o update crypto test tools to use new ioctl's and add cmd line options to specify a device to use for tests These changes will also enable much future work on improving the core crypto subsystem; including proper load balancing and interposing code between the core and drivers to dispatch small operations to the s/w driver as appropriate. These changes were instigated by the work of Michael Richardson. Reviewed by: pjd Approved by: re
* s,#if INET6,#ifdef INET6,bz2006-12-141-1/+1
| | | | | | This unbreaks the build for FAST_IPSEC && !INET6 and was wrong anyway. Reported by: Dmitry Pryanishnikov <dmitry atlantis.dp.ua>
* MFp4: 92972, 98913 + one more changebz2006-12-121-1/+5
| | | | | | | In ip6_sprintf no longer use and return one of eight static buffers for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument.
* Add priv.h include required to build FAST_IPSEC, which is not present inrwatson2006-11-071-0/+1
| | | | | | LINT due to a conflict with KAME IPSEC. Submitted by: Pawel Worach <pawel dot worach at gmail dot com>
* Change '#if INET' and '#if INET6' to '#ifdef INET' and '#ifdef INET6'.pjd2006-06-041-2/+2
| | | | This unbreaks compiling a kernel with FAST_IPSEC and no INET6.
* Hide net.inet.ipsec.test_{replay,integrity} sysctls under #ifdef REGRESSION.pjd2006-04-101-0/+2
| | | | Requested by: sam, rwatson
* Introduce two new sysctls:pjd2006-04-091-0/+15
| | | | | | | | | | | | | net.inet.ipsec.test_replay - When set to 1, IPsec will send packets with the same sequence number. This allows to verify if the other side has proper replay attacks detection. net.inet.ipsec.test_integrity - When set 1, IPsec will send packets with corrupted HMAC. This allows to verify if the other side properly detects modified packets. I used the first one to discover that we don't have proper replay attacks detection in ESP (in fast_ipsec(4)).
* Remove unintended DEBUG flag setting.gnn2006-04-041-1/+0
|
* First steps towards IPSec cleanup.gnn2006-03-251-0/+1
| | | | | | | | | Make the kernel side of FAST_IPSEC not depend on the shared structures defined in /usr/include/net/pfkeyv2.h The kernel now defines all the necessary in kernel structures in sys/netipsec/keydb.h and does the proper massaging when moving messages around. Sponsored By: Secure Computing
* Correct typo in a comment describing vshiftl().hmp2005-06-021-1/+1
|
* correct space checksam2005-03-091-1/+1
| | | | Submitted by: ume
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Add missing locking for secpolicy refcnt manipulations.sam2004-09-301-3/+3
| | | | Submitted by: Roselyn Lee
* o add missing breaksam2004-01-271-1/+10
| | | | | | | | o remove extraneous bzero o add SYSINIT to properly initialize ip4_def_policy Submitted by: "Bjoern A. Zeeb" <bzeeb+freebsd@zabbadoz.net> Submitted by: gnn@neville-neil.com
* MFp4: portability work, general cleanup, locking fixessam2003-09-291-129/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | change 38496 o add ipsec_osdep.h that holds os-specific definitions for portability o s/KASSERT/IPSEC_ASSERT/ for portability o s/SPLASSERT/IPSEC_SPLASSERT/ for portability o remove function names from ASSERT strings since line#+file pinpints the location o use __func__ uniformly to reduce string storage o convert some random #ifdef DIAGNOSTIC code to assertions o remove some debuggging assertions no longer needed change 38498 o replace numerous bogus panic's with equally bogus assertions that at least go away on a production system change 38502 + 38530 o change explicit mtx operations to #defines to simplify future changes to a different lock type change 38531 o hookup ipv4 ctlinput paths to a noop routine; we should be handling path mtu changes at least o correct potential null pointer deref in ipsec4_common_input_cb chnage 38685 o fix locking for bundled SA's and for when key exchange is required change 38770 o eliminate recursion on the SAHTREE lock change 38804 o cleanup some types: long -> time_t o remove refrence to dead #define change 38805 o correct some types: long -> time_t o add scan generation # to secpolicy to deal with locking issues change 38806 o use LIST_FOREACH_SAFE instead of handrolled code o change key_flush_spd to drop the sptree lock before purging an entry to avoid lock recursion and to avoid holding the lock over a long-running operation o misc cleanups of tangled and twisty code There is still much to do here but for now things look to be working again. Supported by: FreeBSD Foundation
* Locking and misc cleanups; most of which I've been running for >4 months:sam2003-09-011-9/+24
| | | | | | | | | | o add locking o strip irrelevant spl's o split malloc types to better account for memory use o remove unused IPSEC_NONBLOCK_ACQUIRE code o remove dead code Sponsored by: FreeBSD Foundation
* plug xform memory leaks:sam2003-06-291-0/+2
| | | | | | | | o add missing zeroize op when deleting an SA o don't re-initialize an xform for an SA that already has one Submitted by: Doug Ambrisko <ambrisko@verniernetworks.com> MFC after: 1 day
* fix compilation w/o INET6sam2003-02-281-0/+4
| | | | Noticed by: "James E. Flemer" <jflemer@acm.jhu.edu>
* Update to work with the new timewait state.jlemon2003-02-241-21/+5
| | | | Reviewed by: sam
* Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,schweikh2003-01-011-1/+1
| | | | especially in troff files.
* "Fast IPsec": this is an experimental IPsec implementation that is derivedsam2002-10-161-0/+1941
from the KAME IPsec implementation, but with heavy borrowing and influence of openbsd. A key feature of this implementation is that it uses the kernel crypto framework to do all crypto work so when h/w crypto support is present IPsec operation is automatically accelerated. Otherwise the protocol implementations are rather differet while the SADB and policy management code is very similar to KAME (for the moment). Note that this implementation is enabled with a FAST_IPSEC option. With this you get all protocols; i.e. there is no FAST_IPSEC_ESP option. FAST_IPSEC and IPSEC are mutually exclusive; you cannot build both into a single system. This software is well tested with IPv4 but should be considered very experimental (i.e. do not deploy in production environments). This software does NOT currently support IPv6. In fact do not configure FAST_IPSEC and INET6 in the same system. Obtained from: KAME + openbsd Supported by: Vernier Networks
OpenPOWER on IntegriCloud