summaryrefslogtreecommitdiffstats
path: root/sys/netipsec/key.c
Commit message (Collapse)AuthorAgeFilesLines
* MFC r266606:bz2014-08-161-6/+20
| | | | | Only do a ports check if this is a NAT-T SA. Otherwise other lookups providing ports may get unexpected results.
* Use corresponding macros to update statistics for AH, ESP, IPIP, IPCOMP,ae2013-06-201-19/+19
| | | | | | PFKEY. MFC after: 2 weeks
* Use m_get2() + m_align() instead of hand made key_alloc_mbuf(). Codeglebius2013-03-151-104/+50
| | | | | | | examination shows, that although key_alloc_mbuf() could return chains, the callers never use chains, so m_get2() should suffice. Sponsored by: Nginx, Inc.
* Mechanically substitute flags from historic mbuf allocator withglebius2012-12-051-21/+21
| | | | | | | | | malloc(9) flags within sys. Exceptions: - sys/contrib not touched - sys/mbuf.h edited manually
* Mechanically remove the last stray remains of spl* calls from net*/*.andre2012-10-181-6/+0
| | | | They have been Noop's for a long time now.
* In NAT-T transport mode, allow a client to open a new connection just aftervanhu2012-09-121-3/+5
| | | | | | | | closing another. It worked only in tunnel mode before. Submitted by: Andreas Longwitz <longwitz@incore.de> MFC after: 1M
* Unexpand a couple of TAILQ_FOREACH()s.jhb2012-08-171-2/+1
|
* Add missing va_end() in an error case to clean up after va_start()brueffer2011-10-071-0/+1
| | | | | | | | (already done in the non-error case). CID: 4726 Found with: Coverity Prevent(tm) MFC after: 1 week
* Release SP's refcount in key_get_spdbyid().vanhu2011-05-091-0/+1
| | | | | | PR: 156676 Submitted by: Tobias Brunner (tobias@strongswan.org) MFC after: 1 week
* Make IPsec compile without INET adding appropriate #ifdef checks.bz2011-04-271-1/+1
| | | | | | | | | | | | Unfold the IPSEC_COMMON_INPUT_CB() macro in xform_{ah,esp,ipcomp}.c to not need three different versions depending on INET, INET6 or both. Mark two places preparing for not yet supported functionality with IPv6. Reviewed by: gnn Sponsored by: The FreeBSD Foundation Sponsored by: iXsystems MFC after: 4 days
* Optimisation in IPSEC(4):fabient2011-03-311-30/+27
| | | | | | | | | | - Remove contention on ISR during the crypto operation by using rwlock(9). - Remove a second lookup of the SA in the callback. Gain on 6 cores CPU with SHA1/AES128 can be up to 30%. Reviewed by: vanhu MFC after: 1 month
* Fixed IPsec's HMAC_SHA256-512 support to be RFC4868 compliant.vanhu2011-02-181-1/+8
| | | | | | | | | This will break interoperability with all older versions of FreeBSD for those algorithms. Reviewed by: bz, gnn Obtained from: NETASQ MFC after: 1w
* After some off-list discussion, revert a number of changes to thedim2010-11-221-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | DPCPU_DEFINE and VNET_DEFINE macros, as these cause problems for various people working on the affected files. A better long-term solution is still being considered. This reversal may give some modules empty set_pcpu or set_vnet sections, but these are harmless. Changes reverted: ------------------------------------------------------------------------ r215318 | dim | 2010-11-14 21:40:55 +0100 (Sun, 14 Nov 2010) | 4 lines Instead of unconditionally emitting .globl's for the __start_set_xxx and __stop_set_xxx symbols, only emit them when the set_vnet or set_pcpu sections are actually defined. ------------------------------------------------------------------------ r215317 | dim | 2010-11-14 21:38:11 +0100 (Sun, 14 Nov 2010) | 3 lines Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughout the tree. ------------------------------------------------------------------------ r215316 | dim | 2010-11-14 21:23:02 +0100 (Sun, 14 Nov 2010) | 2 lines Add macros to define static instances of VNET_DEFINE and DPCPU_DEFINE.
* Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughoutdim2010-11-141-18/+18
| | | | the tree.
* Make the IPsec SADB embedded route cache a union to be able to hold both thebz2010-10-231-4/+4
| | | | | | | | | legacy and IPv6 route destination address. Previously in case of IPv6, there was a memory overwrite due to not enough space for the IPv6 address. PR: kern/122565 MFC After: 2 weeks
* Set SA's natt_type before calling key_mature() in key_add(),vanhu2010-05-051-6/+6
| | | | | | | as the SA may be used as soon as key_mature() has been done. Obtained from: NETASQ MFC after: 1 week
* Update SA's NAT-T stuff before calling key_mature() in key_update(),vanhu2010-05-051-6/+6
| | | | | | | as SA may be used as soon as key_mature() has been called. Obtained from: NETASQ MFC after: 1 week
* MFP4: @176978-176982, 176984, 176990-176994, 177441bz2010-04-291-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | "Whitspace" churn after the VIMAGE/VNET whirls. Remove the need for some "init" functions within the network stack, like pim6_init(), icmp_init() or significantly shorten others like ip6_init() and nd6_init(), using static initialization again where possible and formerly missed. Move (most) variables back to the place they used to be before the container structs and VIMAGE_GLOABLS (before r185088) and try to reduce the diff to stable/7 and earlier as good as possible, to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9. This also removes some header file pollution for putatively static global variables. Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are no longer needed. Reviewed by: jhb Discussed with: rwatson Sponsored by: The FreeBSD Foundation Sponsored by: CK Software GmbH MFC after: 6 days
* Locks SPTREE when setting some SP entries to state DEAD.vanhu2010-04-151-0/+6
| | | | | | | | This can prevent kernel panics when updating SPs while there is some traffic for them. Obtained from: NETASQ MFC after: 1m
* When tearing down IPsec as part of a (virtual) network stack,bz2010-03-281-7/+9
| | | | | | | | do not try to free the same list twice but free both the acquiring list and the security policy acquiring list. Reviewed by: anchie MFC after: 3 days
* fixed two race conditions when inserting/removing SAs via PFKey,vanhu2009-11-171-2/+3
| | | | | | | | which can both lead to a kernel panic when adding/removing quickly a lot of SAs. Obtained from: NETASQ MFC after: 2w (MFC on 8 before 8.0 release ???)
* When checking traffic endpoint's adresses families in key_spdadd(),vanhu2009-09-161-12/+2
| | | | | | | | | | compare them together instead of comparing each one with respective tunnel endpoint. PR: kern/138439 Submitted by: aurelien.ansel@netasq.com Obtained from: NETASQ MFC after: 1 m
* Silent gcc? Yeah, you wish. What I ment was to silence gcc.pjd2009-09-061-2/+2
| | | | Spotted by: julian
* Initialize state_valid and arraysize variable so gcc won't complain.pjd2009-09-061-1/+3
| | | | Reported by: bz
* Improve code a bit by eliminating goto and having one unlock per lock.pjd2009-09-061-4/+3
|
* Merge the remainder of kern_vimage.c and vimage.h into vnet.c andrwatson2009-08-011-1/+0
| | | | | | | | | | vnet.h, we now use jails (rather than vimages) as the abstraction for virtualization management, and what remained was specific to virtual network stacks. Minor cleanups are done in the process, and comments updated to reflect these changes. Reviewed by: bz Approved by: re (vimage blanket)
* Reimplement and/or implement vnet list locking by replacing a mostlyrwatson2009-07-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | unused custom mutex/condvar-based sleep locks with two locks: an rwlock (for non-sleeping use) and sxlock (for sleeping use). Either acquired for read is sufficient to stabilize the vnet list, but both must be acquired for write to modify the list. Replace previous no-op read locking macros, used in various places in the stack, with actual locking to prevent race conditions. Callers must declare when they may perform unbounded sleeps or not when selecting how to lock. Refactor vnet sysinits so that the vnet list and locks are initialized before kernel modules are linked, as the kernel linker will use them for modules loaded by the boot loader. Update various consumers of these KPIs based on whether they may sleep or not. Reviewed by: bz Approved by: re (kib)
* Remove unused VNET_SET() and related macros; only VNET_GET() isrwatson2009-07-161-18/+18
| | | | | | | | | ever actually used. Rename VNET_GET() to VNET() to shorten variable references. Discussed with: bz, julian Reviewed by: bz Approved by: re (kensmith, kib)
* Build on Jeff Roberson's linker-set based dynamic per-CPU allocatorrwatson2009-07-141-137/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (DPCPU), as suggested by Peter Wemm, and implement a new per-virtual network stack memory allocator. Modify vnet to use the allocator instead of monolithic global container structures (vinet, ...). This change solves many binary compatibility problems associated with VIMAGE, and restores ELF symbols for virtualized global variables. Each virtualized global variable exists as a "reference copy", and also once per virtual network stack. Virtualized global variables are tagged at compile-time, placing the in a special linker set, which is loaded into a contiguous region of kernel memory. Virtualized global variables in the base kernel are linked as normal, but those in modules are copied and relocated to a reserved portion of the kernel's vnet region with the help of a the kernel linker. Virtualized global variables exist in per-vnet memory set up when the network stack instance is created, and are initialized statically from the reference copy. Run-time access occurs via an accessor macro, which converts from the current vnet and requested symbol to a per-vnet address. When "options VIMAGE" is not compiled into the kernel, normal global ELF symbols will be used instead and indirection is avoided. This change restores static initialization for network stack global variables, restores support for non-global symbols and types, eliminates the need for many subsystem constructors, eliminates large per-subsystem structures that caused many binary compatibility issues both for monitoring applications (netstat) and kernel modules, removes the per-function INIT_VNET_*() macros throughout the stack, eliminates the need for vnet_symmap ksym(2) munging, and eliminates duplicate definitions of virtualized globals under VIMAGE_GLOBALS. Bump __FreeBSD_version and update UPDATING. Portions submitted by: bz Reviewed by: bz, zec Discussed with: gnn, jamie, jeff, jhb, julian, sam Suggested by: peter Approved by: re (kensmith)
* Add address list locking for in6_ifaddrhead/ia_link: as with lockingrwatson2009-06-251-2/+8
| | | | | | | | | | | for in_ifaddrhead, we stick with an rwlock for the time being, which we will revisit in the future with a possible move to rmlocks. Some pieces of code require significant further reworking to be safe from all classes of writer-writer races. Reviewed by: bz MFC after: 6 weeks
* Add a new global rwlock, in_ifaddr_lock, which will synchronize use of therwatson2009-06-251-0/+3
| | | | | | | | | | | | | | | | | | | in_ifaddrhead and INADDR_HASH address lists. Previously, these lists were used unsynchronized as they were effectively never changed in steady state, but we've seen increasing reports of writer-writer races on very busy VPN servers as core count has gone up (and similar configurations where address lists change frequently and concurrently). For the time being, use rwlocks rather than rmlocks in order to take advantage of their better lock debugging support. As a result, we don't enable ip_input()'s read-locking of INADDR_HASH until an rmlock conversion is complete and a performance analysis has been done. This means that one class of reader-writer races still exists. MFC after: 6 weeks Reviewed by: bz
* Convert netinet6 to using queue(9) rather than hand-crafted linked listsrwatson2009-06-241-1/+1
| | | | | | | | for the global IPv6 address list (in6_ifaddr -> in6_ifaddrhead). Adopt the code styles and conventions present in netinet where possible. Reviewed by: gnn, bz MFC after: 6 weeks (possibly not MFCable?)
* Move setting of ports from NAT-T below key_getsah() and actuallybz2009-06-191-8/+9
| | | | | | | | | | below key_setsaval(). Without that, the lookup for the SA had failed as we were looking for a SA with the new, updated port numbers instead of the old ones and were comparing the ports in key_cmpsaidx(). This makes updating the remote -> local SA on the initiator work again. Problem introduced with: p4 changeset 152114
* Added support for NAT-Traversal (RFC 3948) in IPsec stack.vanhu2009-06-121-5/+616
| | | | | | | | | | | | | | Thanks to (no special order) Emmanuel Dreyfus (manu@netbsd.org), Larry Baird (lab@gta.com), gnn, bz, and other FreeBSD devs, Julien Vanherzeele (julien.vanherzeele@netasq.com, for years of bug reporting), the PFSense team, and all people who used / tried the NAT-T patch for years and reported bugs, patches, etc... X-MFC: never Reviewed by: bz Approved by: gnn(mentor) Obtained from: NETASQ
* Introduce an infrastructure for dismantling vnet instances.zec2009-06-081-1/+67
| | | | | | | | | | | | | | | | | | | | | | | | | Vnet modules and protocol domains may now register destructor functions to clean up and release per-module state. The destructor mechanisms can be triggered by invoking "vimage -d", or a future equivalent command which will be provided via the new jail framework. While this patch introduces numerous placeholder destructor functions, many of those are currently incomplete, thus leaking memory or (even worse) failing to stop all running timers. Many of such issues are already known and will be incrementaly fixed over the next weeks in smaller incremental commits. Apart from introducing new fields in structs ifnet, domain, protosw and vnet_net, which requires the kernel and modules to be rebuilt, this change should have no impact on nooptions VIMAGE builds, since vnet destructors can only be called in VIMAGE kernels. Moreover, destructor functions should be in general compiled in only in options VIMAGE builds, except for kernel modules which can be safely kldunloaded at run time. Bump __FreeBSD_version to 800097. Reviewed by: bz, julian Approved by: rwatson, kib (re), julian (mentor)
* Lock SPTREE before parsing it in key_spddump()vanhu2009-05-271-1/+5
| | | | | | Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 2 weeks
* Only decrease refcnt once when flushing SPD entries, tovanhu2009-05-271-4/+14
| | | | | | | | avoid flushing entries which are still used. Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
* Stub out IN6_LOOKUP_MULTI() for GETSPI requests, for now.bms2009-04-291-0/+4
| | | | | | | | | This has the effect that IPv6 multicast traffic won't trigger an SPI allocation when IPSEC is in use, however, this obviously needs to stomp on locks, and IN6_LOOKUP_MULTI() is about to go away. This definitely needs to be revisited before 8.x is branched as a release branch.
* key_gettunnel() has been unsued with FAST_IPSEC (now IPSEC).bz2009-04-271-0/+2
| | | | | | | KAME had explicit checks at one point using it, so just hide it behind #if 0 for now until we are sure if we can completely dump it or not. MFC after: 1 month
* First pass at separating per-vnet initializer functionszec2009-04-061-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from existing functions for initializing global state. At this stage, the new per-vnet initializer functions are directly called from the existing global initialization code, which should in most cases result in compiler inlining those new functions, hence yielding a near-zero functional change. Modify the existing initializer functions which are invoked via protosw, like ip_init() et. al., to allow them to be invoked multiple times, i.e. per each vnet. Global state, if any, is initialized only if such functions are called within the context of vnet0, which will be determined via the IS_DEFAULT_VNET(curvnet) check (currently always true). While here, V_irtualize a few remaining global UMA zones used by net/netinet/netipsec networking code. While it is not yet clear to me or anybody else whether this is the right thing to do, at this stage this makes the code more readable, and makes it easier to track uncollected UMA-zone-backed objects on vnet removal. In the long run, it's quite possible that some form of shared use of UMA zone pools among multiple vnets should be considered. Bump __FreeBSD_version due to changes in layout of structs vnet_ipfw, vnet_inet and vnet_net. Approved by: julian (mentor)
* Fixed comments so it stays in 80 chars by linevanhu2009-03-231-5/+9
| | | | | | with hard tabs of 8 chars.... Approved by: gnn(mentor)
* Spelling fix in a commentvanhu2009-03-201-1/+1
| | | | Approved by: gnn(mentor)
* Fixed style for some commentsvanhu2009-03-191-1/+2
| | | | Approved by: gnn(mentor)
* Fixed style for some commentsvanhu2009-03-191-3/+4
| | | | Approved by: gnn(mentor)
* Fixed deletion of sav entries in key_delsah()vanhu2009-03-181-1/+6
| | | | | | Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
* SAs are valid (but dying) when they reached soft lifetime,vanhu2009-03-051-14/+7
| | | | | | | even if they have never been used. Approved by: gnn(mentor) MFC after: 2 weeks
* Change the functions to ANSI in those cases where it breaks promotionrdivacky2009-02-241-38/+13
| | | | | | | | to int rule. See ISO C Standard: SS6.7.5.3:15. Approved by: kib (mentor) Reviewed by: warner Tested by: silence on -current
* Another step assimilating IPv[46] PCB code - directly usebz2008-12-151-22/+4
| | | | | | | | | | | | | | the inpcb names rather than the following IPv6 compat macros: in6pcb,in6p_sp, in6p_ip6_nxt,in6p_flowinfo,in6p_vflag, in6p_flags,in6p_socket,in6p_lport,in6p_fport,in6p_ppcb and sotoin6pcb(). Apart from removing duplicate code in netipsec, this is a pure whitespace, not a functional change. Discussed with: rwatson Reviewed by: rwatson (version before review requested changes) MFC after: 4 weeks (set the timer and see then)
* Rather than using hidden includes (with cicular dependencies),bz2008-12-021-0/+2
| | | | | | | | | | | directly include only the header files needed. This reduces the unneeded spamming of various headers into lots of files. For now, this leaves us with very few modules including vnet.h and thus needing to depend on opt_route.h. Reviewed by: brooks, gnn, des, zec, imp Sponsored by: The FreeBSD Foundation
* Merge more of currently non-functional (i.e. resolving tozec2008-11-261-14/+16
| | | | | | | | | | | | | | | | | whitespace) macros from p4/vimage branch. Do a better job at enclosing all instantiations of globals scheduled for virtualization in #ifdef VIMAGE_GLOBALS blocks. De-virtualize and mark as const saorder_state_alive and saorder_state_any arrays from ipsec code, given that they are never updated at runtime, so virtualizing them would be pointless. Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
OpenPOWER on IntegriCloud