summaryrefslogtreecommitdiffstats
path: root/sys/netipsec/key.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Locks SPTREE when setting some SP entries to state DEAD.vanhu2010-04-151-0/+6
| | | | | | | | This can prevent kernel panics when updating SPs while there is some traffic for them. Obtained from: NETASQ MFC after: 1m
* When tearing down IPsec as part of a (virtual) network stack,bz2010-03-281-7/+9
| | | | | | | | do not try to free the same list twice but free both the acquiring list and the security policy acquiring list. Reviewed by: anchie MFC after: 3 days
* fixed two race conditions when inserting/removing SAs via PFKey,vanhu2009-11-171-2/+3
| | | | | | | | which can both lead to a kernel panic when adding/removing quickly a lot of SAs. Obtained from: NETASQ MFC after: 2w (MFC on 8 before 8.0 release ???)
* When checking traffic endpoint's adresses families in key_spdadd(),vanhu2009-09-161-12/+2
| | | | | | | | | | compare them together instead of comparing each one with respective tunnel endpoint. PR: kern/138439 Submitted by: aurelien.ansel@netasq.com Obtained from: NETASQ MFC after: 1 m
* Silent gcc? Yeah, you wish. What I ment was to silence gcc.pjd2009-09-061-2/+2
| | | | Spotted by: julian
* Initialize state_valid and arraysize variable so gcc won't complain.pjd2009-09-061-1/+3
| | | | Reported by: bz
* Improve code a bit by eliminating goto and having one unlock per lock.pjd2009-09-061-4/+3
|
* Merge the remainder of kern_vimage.c and vimage.h into vnet.c andrwatson2009-08-011-1/+0
| | | | | | | | | | vnet.h, we now use jails (rather than vimages) as the abstraction for virtualization management, and what remained was specific to virtual network stacks. Minor cleanups are done in the process, and comments updated to reflect these changes. Reviewed by: bz Approved by: re (vimage blanket)
* Reimplement and/or implement vnet list locking by replacing a mostlyrwatson2009-07-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | unused custom mutex/condvar-based sleep locks with two locks: an rwlock (for non-sleeping use) and sxlock (for sleeping use). Either acquired for read is sufficient to stabilize the vnet list, but both must be acquired for write to modify the list. Replace previous no-op read locking macros, used in various places in the stack, with actual locking to prevent race conditions. Callers must declare when they may perform unbounded sleeps or not when selecting how to lock. Refactor vnet sysinits so that the vnet list and locks are initialized before kernel modules are linked, as the kernel linker will use them for modules loaded by the boot loader. Update various consumers of these KPIs based on whether they may sleep or not. Reviewed by: bz Approved by: re (kib)
* Remove unused VNET_SET() and related macros; only VNET_GET() isrwatson2009-07-161-18/+18
| | | | | | | | | ever actually used. Rename VNET_GET() to VNET() to shorten variable references. Discussed with: bz, julian Reviewed by: bz Approved by: re (kensmith, kib)
* Build on Jeff Roberson's linker-set based dynamic per-CPU allocatorrwatson2009-07-141-137/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (DPCPU), as suggested by Peter Wemm, and implement a new per-virtual network stack memory allocator. Modify vnet to use the allocator instead of monolithic global container structures (vinet, ...). This change solves many binary compatibility problems associated with VIMAGE, and restores ELF symbols for virtualized global variables. Each virtualized global variable exists as a "reference copy", and also once per virtual network stack. Virtualized global variables are tagged at compile-time, placing the in a special linker set, which is loaded into a contiguous region of kernel memory. Virtualized global variables in the base kernel are linked as normal, but those in modules are copied and relocated to a reserved portion of the kernel's vnet region with the help of a the kernel linker. Virtualized global variables exist in per-vnet memory set up when the network stack instance is created, and are initialized statically from the reference copy. Run-time access occurs via an accessor macro, which converts from the current vnet and requested symbol to a per-vnet address. When "options VIMAGE" is not compiled into the kernel, normal global ELF symbols will be used instead and indirection is avoided. This change restores static initialization for network stack global variables, restores support for non-global symbols and types, eliminates the need for many subsystem constructors, eliminates large per-subsystem structures that caused many binary compatibility issues both for monitoring applications (netstat) and kernel modules, removes the per-function INIT_VNET_*() macros throughout the stack, eliminates the need for vnet_symmap ksym(2) munging, and eliminates duplicate definitions of virtualized globals under VIMAGE_GLOBALS. Bump __FreeBSD_version and update UPDATING. Portions submitted by: bz Reviewed by: bz, zec Discussed with: gnn, jamie, jeff, jhb, julian, sam Suggested by: peter Approved by: re (kensmith)
* Add address list locking for in6_ifaddrhead/ia_link: as with lockingrwatson2009-06-251-2/+8
| | | | | | | | | | | for in_ifaddrhead, we stick with an rwlock for the time being, which we will revisit in the future with a possible move to rmlocks. Some pieces of code require significant further reworking to be safe from all classes of writer-writer races. Reviewed by: bz MFC after: 6 weeks
* Add a new global rwlock, in_ifaddr_lock, which will synchronize use of therwatson2009-06-251-0/+3
| | | | | | | | | | | | | | | | | | | in_ifaddrhead and INADDR_HASH address lists. Previously, these lists were used unsynchronized as they were effectively never changed in steady state, but we've seen increasing reports of writer-writer races on very busy VPN servers as core count has gone up (and similar configurations where address lists change frequently and concurrently). For the time being, use rwlocks rather than rmlocks in order to take advantage of their better lock debugging support. As a result, we don't enable ip_input()'s read-locking of INADDR_HASH until an rmlock conversion is complete and a performance analysis has been done. This means that one class of reader-writer races still exists. MFC after: 6 weeks Reviewed by: bz
* Convert netinet6 to using queue(9) rather than hand-crafted linked listsrwatson2009-06-241-1/+1
| | | | | | | | for the global IPv6 address list (in6_ifaddr -> in6_ifaddrhead). Adopt the code styles and conventions present in netinet where possible. Reviewed by: gnn, bz MFC after: 6 weeks (possibly not MFCable?)
* Move setting of ports from NAT-T below key_getsah() and actuallybz2009-06-191-8/+9
| | | | | | | | | | below key_setsaval(). Without that, the lookup for the SA had failed as we were looking for a SA with the new, updated port numbers instead of the old ones and were comparing the ports in key_cmpsaidx(). This makes updating the remote -> local SA on the initiator work again. Problem introduced with: p4 changeset 152114
* Added support for NAT-Traversal (RFC 3948) in IPsec stack.vanhu2009-06-121-5/+616
| | | | | | | | | | | | | | Thanks to (no special order) Emmanuel Dreyfus (manu@netbsd.org), Larry Baird (lab@gta.com), gnn, bz, and other FreeBSD devs, Julien Vanherzeele (julien.vanherzeele@netasq.com, for years of bug reporting), the PFSense team, and all people who used / tried the NAT-T patch for years and reported bugs, patches, etc... X-MFC: never Reviewed by: bz Approved by: gnn(mentor) Obtained from: NETASQ
* Introduce an infrastructure for dismantling vnet instances.zec2009-06-081-1/+67
| | | | | | | | | | | | | | | | | | | | | | | | | Vnet modules and protocol domains may now register destructor functions to clean up and release per-module state. The destructor mechanisms can be triggered by invoking "vimage -d", or a future equivalent command which will be provided via the new jail framework. While this patch introduces numerous placeholder destructor functions, many of those are currently incomplete, thus leaking memory or (even worse) failing to stop all running timers. Many of such issues are already known and will be incrementaly fixed over the next weeks in smaller incremental commits. Apart from introducing new fields in structs ifnet, domain, protosw and vnet_net, which requires the kernel and modules to be rebuilt, this change should have no impact on nooptions VIMAGE builds, since vnet destructors can only be called in VIMAGE kernels. Moreover, destructor functions should be in general compiled in only in options VIMAGE builds, except for kernel modules which can be safely kldunloaded at run time. Bump __FreeBSD_version to 800097. Reviewed by: bz, julian Approved by: rwatson, kib (re), julian (mentor)
* Lock SPTREE before parsing it in key_spddump()vanhu2009-05-271-1/+5
| | | | | | Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 2 weeks
* Only decrease refcnt once when flushing SPD entries, tovanhu2009-05-271-4/+14
| | | | | | | | avoid flushing entries which are still used. Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
* Stub out IN6_LOOKUP_MULTI() for GETSPI requests, for now.bms2009-04-291-0/+4
| | | | | | | | | This has the effect that IPv6 multicast traffic won't trigger an SPI allocation when IPSEC is in use, however, this obviously needs to stomp on locks, and IN6_LOOKUP_MULTI() is about to go away. This definitely needs to be revisited before 8.x is branched as a release branch.
* key_gettunnel() has been unsued with FAST_IPSEC (now IPSEC).bz2009-04-271-0/+2
| | | | | | | KAME had explicit checks at one point using it, so just hide it behind #if 0 for now until we are sure if we can completely dump it or not. MFC after: 1 month
* First pass at separating per-vnet initializer functionszec2009-04-061-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from existing functions for initializing global state. At this stage, the new per-vnet initializer functions are directly called from the existing global initialization code, which should in most cases result in compiler inlining those new functions, hence yielding a near-zero functional change. Modify the existing initializer functions which are invoked via protosw, like ip_init() et. al., to allow them to be invoked multiple times, i.e. per each vnet. Global state, if any, is initialized only if such functions are called within the context of vnet0, which will be determined via the IS_DEFAULT_VNET(curvnet) check (currently always true). While here, V_irtualize a few remaining global UMA zones used by net/netinet/netipsec networking code. While it is not yet clear to me or anybody else whether this is the right thing to do, at this stage this makes the code more readable, and makes it easier to track uncollected UMA-zone-backed objects on vnet removal. In the long run, it's quite possible that some form of shared use of UMA zone pools among multiple vnets should be considered. Bump __FreeBSD_version due to changes in layout of structs vnet_ipfw, vnet_inet and vnet_net. Approved by: julian (mentor)
* Fixed comments so it stays in 80 chars by linevanhu2009-03-231-5/+9
| | | | | | with hard tabs of 8 chars.... Approved by: gnn(mentor)
* Spelling fix in a commentvanhu2009-03-201-1/+1
| | | | Approved by: gnn(mentor)
* Fixed style for some commentsvanhu2009-03-191-1/+2
| | | | Approved by: gnn(mentor)
* Fixed style for some commentsvanhu2009-03-191-3/+4
| | | | Approved by: gnn(mentor)
* Fixed deletion of sav entries in key_delsah()vanhu2009-03-181-1/+6
| | | | | | Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
* SAs are valid (but dying) when they reached soft lifetime,vanhu2009-03-051-14/+7
| | | | | | | even if they have never been used. Approved by: gnn(mentor) MFC after: 2 weeks
* Change the functions to ANSI in those cases where it breaks promotionrdivacky2009-02-241-38/+13
| | | | | | | | to int rule. See ISO C Standard: SS6.7.5.3:15. Approved by: kib (mentor) Reviewed by: warner Tested by: silence on -current
* Another step assimilating IPv[46] PCB code - directly usebz2008-12-151-22/+4
| | | | | | | | | | | | | | the inpcb names rather than the following IPv6 compat macros: in6pcb,in6p_sp, in6p_ip6_nxt,in6p_flowinfo,in6p_vflag, in6p_flags,in6p_socket,in6p_lport,in6p_fport,in6p_ppcb and sotoin6pcb(). Apart from removing duplicate code in netipsec, this is a pure whitespace, not a functional change. Discussed with: rwatson Reviewed by: rwatson (version before review requested changes) MFC after: 4 weeks (set the timer and see then)
* Rather than using hidden includes (with cicular dependencies),bz2008-12-021-0/+2
| | | | | | | | | | | directly include only the header files needed. This reduces the unneeded spamming of various headers into lots of files. For now, this leaves us with very few modules including vnet.h and thus needing to depend on opt_route.h. Reviewed by: brooks, gnn, des, zec, imp Sponsored by: The FreeBSD Foundation
* Merge more of currently non-functional (i.e. resolving tozec2008-11-261-14/+16
| | | | | | | | | | | | | | | | | whitespace) macros from p4/vimage branch. Do a better job at enclosing all instantiations of globals scheduled for virtualization in #ifdef VIMAGE_GLOBALS blocks. De-virtualize and mark as const saorder_state_alive and saorder_state_any arrays from ipsec code, given that they are never updated at runtime, so virtualizing them would be pointless. Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Change the initialization methodology for global variables scheduledzec2008-11-191-20/+40
| | | | | | | | | | | | | | | | | | | | | | | | for virtualization. Instead of initializing the affected global variables at instatiation, assign initial values to them in initializer functions. As a rule, initialization at instatiation for such variables should never be introduced again from now on. Furthermore, enclose all instantiations of such global variables in #ifdef VIMAGE_GLOBALS blocks. Essentialy, this change should have zero functional impact. In the next phase of merging network stack virtualization infrastructure from p4/vimage branch, the new initialization methology will allow us to switch between using global variables and their counterparts residing in virtualization containers with minimum code churn, and in the long run allow us to intialize multiple instances of such container structures. Discussed at: devsummit Strassburg Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Step 1.5 of importing the network stack virtualization infrastructurezec2008-10-021-28/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from the vimage project, as per plan established at devsummit 08/08: http://wiki.freebsd.org/Image/Notes200808DevSummit Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator macros, and CURVNET_SET() context setting macros, all currently resolving to NOPs. Prepare for virtualization of selected SYSCTL objects by introducing a family of SYSCTL_V_*() macros, currently resolving to their global counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT(). Move selected #defines from sys/sys/vimage.h to newly introduced header files specific to virtualized subsystems (sys/net/vnet.h, sys/netinet/vinet.h etc.). All the changes are verified to have zero functional impact at this point in time by doing MD5 comparision between pre- and post-change object files(*). (*) netipsec/keysock.c did not validate depending on compile time options. Implemented by: julian, bz, brooks, zec Reviewed by: julian, bz, brooks, kris, rwatson, ... Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
* Commit step 1 of the vimage project, (network stack)bz2008-08-171-98/+99
| | | | | | | | | | | | | | | | | | | | | | | | virtualization work done by Marko Zec (zec@). This is the first in a series of commits over the course of the next few weeks. Mark all uses of global variables to be virtualized with a V_ prefix. Use macros to map them back to their global names for now, so this is a NOP change only. We hope to have caught at least 85-90% of what is needed so we do not invalidate a lot of outstanding patches again. Obtained from: //depot/projects/vimage-commit2/... Reviewed by: brooks, des, ed, mav, julian, jamie, kris, rwatson, zec, ... (various people I forgot, different versions) md5 (with a bit of help) Sponsored by: NLnet Foundation, The FreeBSD Foundation X-MFC after: never V_Commit_Message_Reviewed_By: more people than the patch
* Add lifetime informations to generated SPD entries when SPDDUMPvanhu2008-08-051-0/+17
| | | | | Approved by: gnn (mentor) MFC after: 4 weeks
* Enter the 1990s. Use real function declaration.julian2008-06-291-1/+1
|
* Fix a bug that when getting/dumping the soft lifetime we reportedbz2008-03-241-1/+1
| | | | | | the hard lifetime instead. MFC after: 3 days
* Import change from KAME, rev. 1.362 kame/kame/sys/netkey/key.cbz2008-03-241-1/+1
| | | | | | | | In case of "new SA", we must check the hard lifetime of the old SA to find out if it is not permanent and we can delete it. Submitted by: sakane via gnn MFC after: 3 days
* Remove the "Fast " from thebz2008-03-141-1/+1
| | | | | | | | | | | "Fast IPsec: Initialized Security Association Processing." printf. People kept asking questions about this after the IPsec shuffle. This still is the Fast IPsec implementation so no worries that it would be any slower now. There are no functional changes. Discussed with: sam MFC after: 4 days
* Fix bugs when allocating and passing information of current lifetime andbz2008-03-021-2/+7
| | | | | | | | | | | | soft lifetime [1] introduced in rev. 1.21 of key.c. Along with that, fix a related problem in key_debug printing the correct data. While there replace a printf by panic in a sanity check. PR: 120751 Submitted by: Kazuaki ODA (kazuaki aliceblue.jp) [1] MFC after: 5 days
* Commit IPv6 support for FAST_IPSEC to the tree.gnn2007-07-011-5/+0
| | | | | | | | | This commit includes only the kernel files, the rest of the files will follow in a second commit. Reviewed by: bz Approved by: re Supported by: Secure Computing
* 'spi' and the return value of ntohl are unsigned. Remove the extra >=0bz2007-06-161-1/+6
| | | | | | | | check which was always true. Document the special meaning of spi values of 0 and 1-255 with a comment. Found with: Coverity Prevent(tm) CID: 2047
* In case of failure we can directly return ENOBUFS becausebz2007-06-161-10/+3
| | | | | | | | 'result' is still NULL and we do not need to free anything. That allows us to gc the entire goto parts and a now unused variable. Found with: Coverity Prevent(tm) CID: 2519
* Add a missing return so that we drop out in case of an error andbz2007-06-151-3/+2
| | | | | | | | | | | do not continue with a NULL pointer. [1] While here change the return of the error handling code path above. I cannot see why we should always return 0 there. Neither does KAME nor do we in here for the similar check in all the other functions. Found with: Coverity Prevent(tm) [1] CID: 2521
* With the current code 'src' is never NULL. Nevertheless move the check forbz2007-06-151-1/+3
| | | | | | | NULL before dereferencing the pointer. Found with: Coverity Prevent(tm) CID: 2528
* Add missingbz2007-05-291-0/+1
| | | | | | break; so when comparing AF_INET6 addresses, scope and ports we do not run into the default case and return 'no match' instead of 'match'.
* Prevent disappearing SAD entries by implementing MPsafe refcounting.pjd2006-05-201-20/+33
| | | | | | | | | | | | | "Why didn't he use SECASVAR_LOCK()/SECASVAR_UNLOCK() macros to synchronize access to the secasvar structure's fields?" one may ask. There were two reasons: 1. refcount(9) is faster then mutex(9) synchronization (one atomic operation instead of two). 2. Those macros are not used now at all, so at some point we may decide to remove them entirely. OK'ed by: gnn MFC after: 2 weeks
* First steps towards IPSec cleanup.gnn2006-03-251-85/+211
| | | | | | | | | Make the kernel side of FAST_IPSEC not depend on the shared structures defined in /usr/include/net/pfkeyv2.h The kernel now defines all the necessary in kernel structures in sys/netipsec/keydb.h and does the proper massaging when moving messages around. Sponsored By: Secure Computing
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
OpenPOWER on IntegriCloud