summaryrefslogtreecommitdiffstats
path: root/sys/netipsec/key.c
Commit message (Collapse)AuthorAgeFilesLines
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Remove extraneous SECPOLICY_LOCK_DESTROY calls that cause the mutex to besam2004-10-021-2/+0
| | | | | | destroyed twice. Submitted by: Roselyn Lee
* Add missing locking for secpolicy refcnt manipulations.sam2004-09-301-0/+12
| | | | Submitted by: Roselyn Lee
* Correct handling of SADB_UPDATE and SADB_ADD requests. key_align may splitsam2004-09-261-5/+0
| | | | | | | | | the mbuf due to use of m_pulldown. Discarding the result because of this does not make sense as no subsequent code depends on the entire msg being linearized (only the individual pieces). It's likely something else is wrong here but for now this appears to get things back to a working state. Submitted by: Roselyn Lee
* Fix a paste-o in key_cmpspidx_withmask().bms2004-06-221-2/+2
| | | | | PR: misc/67013 Submitted by: Zhenmin <zli4@cs.uiuc.edu>
* use correct address for SADB_EXT_ADDRESS_DST in key_do_allocsa_policysam2004-05-031-2/+2
| | | | | | | | (was using src instead of dst) Submitted by: Bjoern A. Zeeb Obtained from: KAME MFC after: 1 day
* correct behaviour of key_getsavbyspi broken in rev 1.7; corrects problems withsam2004-05-031-2/+2
| | | | | | removing specific SPIs Submitted by: Bjoern A. Zeeb
* add support to prefer old SA to new SA during allocationsam2004-05-031-18/+27
| | | | | | | | (makes net.key.preferred_oldsa work as for KAME) Submitted by: gabor@sentex.net Reviewed by: Bjoern A. Zeeb MFC after: 1 day
* Unbreak FAST_IPSEC build on 64 bit archs with INVARIANTS.pjd2004-04-071-1/+1
| | | | Approved by: sam
* Fix type in a sysctl. It used to be: net.key.prefered_oldsaguido2004-02-161-5/+5
| | | | | | | and is corrected to net.key.preferred_oldsa This makes it consistent with the KAME IPsec implementation. Approved by: sam
* Initial import of RFC 2385 (TCP-MD5) digest support.bms2004-02-111-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the first of two commits; bringing in the kernel support first. This can be enabled by compiling a kernel with options TCP_SIGNATURE and FAST_IPSEC. For the uninitiated, this is a TCP option which provides for a means of authenticating TCP sessions which came into being before IPSEC. It is still relevant today, however, as it is used by many commercial router vendors, particularly with BGP, and as such has become a requirement for interconnect at many major Internet points of presence. Several parts of the TCP and IP headers, including the segment payload, are digested with MD5, including a shared secret. The PF_KEY interface is used to manage the secrets using security associations in the SADB. There is a limitation here in that as there is no way to map a TCP flow per-port back to an SPI without polluting tcpcb or using the SPD; the code to do the latter is unstable at this time. Therefore this code only supports per-host keying granularity. Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6), TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective users of this feature, this will not pose any problem. This implementation is output-only; that is, the option is honoured when responding to a host initiating a TCP session, but no effort is made [yet] to authenticate inbound traffic. This is, however, sufficient to interwork with Cisco equipment. Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with local patches. Patches for tcpdump to validate TCP-MD5 sessions are also available from me upon request. Sponsored by: sentex.net
* must convert protocol to sa type when preparing a DELETE messagesam2004-02-051-1/+7
| | | | | Submitted by: Roselyn Lee <rosel@verniernetworks.com> MFC after: 1 week
* MFp4: portability work, general cleanup, locking fixessam2003-09-291-562/+574
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | change 38496 o add ipsec_osdep.h that holds os-specific definitions for portability o s/KASSERT/IPSEC_ASSERT/ for portability o s/SPLASSERT/IPSEC_SPLASSERT/ for portability o remove function names from ASSERT strings since line#+file pinpints the location o use __func__ uniformly to reduce string storage o convert some random #ifdef DIAGNOSTIC code to assertions o remove some debuggging assertions no longer needed change 38498 o replace numerous bogus panic's with equally bogus assertions that at least go away on a production system change 38502 + 38530 o change explicit mtx operations to #defines to simplify future changes to a different lock type change 38531 o hookup ipv4 ctlinput paths to a noop routine; we should be handling path mtu changes at least o correct potential null pointer deref in ipsec4_common_input_cb chnage 38685 o fix locking for bundled SA's and for when key exchange is required change 38770 o eliminate recursion on the SAHTREE lock change 38804 o cleanup some types: long -> time_t o remove refrence to dead #define change 38805 o correct some types: long -> time_t o add scan generation # to secpolicy to deal with locking issues change 38806 o use LIST_FOREACH_SAFE instead of handrolled code o change key_flush_spd to drop the sptree lock before purging an entry to avoid lock recursion and to avoid holding the lock over a long-running operation o misc cleanups of tangled and twisty code There is still much to do here but for now things look to be working again. Supported by: FreeBSD Foundation
* Locking and misc cleanups; most of which I've been running for >4 months:sam2003-09-011-422/+288
| | | | | | | | | | o add locking o strip irrelevant spl's o split malloc types to better account for memory use o remove unused IPSEC_NONBLOCK_ACQUIRE code o remove dead code Sponsored by: FreeBSD Foundation
* plug xform memory leaks:sam2003-06-291-2/+13
| | | | | | | | o add missing zeroize op when deleting an SA o don't re-initialize an xform for an SA that already has one Submitted by: Doug Ambrisko <ambrisko@verniernetworks.com> MFC after: 1 day
* Back out M_* changes, per decision of the TRB.imp2003-02-191-22/+22
| | | | Approved by: trb
* Comment out srandom():ache2003-02-051-0/+2
| | | | | 1) Already called in init_main.c:proc0_post() 2) Seed is bad
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-22/+22
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,schweikh2003-01-011-5/+5
| | | | especially in troff files.
* "Fast IPsec": this is an experimental IPsec implementation that is derivedsam2002-10-161-0/+7287
from the KAME IPsec implementation, but with heavy borrowing and influence of openbsd. A key feature of this implementation is that it uses the kernel crypto framework to do all crypto work so when h/w crypto support is present IPsec operation is automatically accelerated. Otherwise the protocol implementations are rather differet while the SADB and policy management code is very similar to KAME (for the moment). Note that this implementation is enabled with a FAST_IPSEC option. With this you get all protocols; i.e. there is no FAST_IPSEC_ESP option. FAST_IPSEC and IPSEC are mutually exclusive; you cannot build both into a single system. This software is well tested with IPv4 but should be considered very experimental (i.e. do not deploy in production environments). This software does NOT currently support IPv6. In fact do not configure FAST_IPSEC and INET6 in the same system. Obtained from: KAME + openbsd Supported by: Vernier Networks
OpenPOWER on IntegriCloud