summaryrefslogtreecommitdiffstats
path: root/sys/netipsec
Commit message (Collapse)AuthorAgeFilesLines
* MFC r275391:Luiz Otavio O Souza2015-10-201-11/+0
| | | | | | | | | Remove unused structure declarations. Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* MFC r275159:Luiz Otavio O Souza2015-10-201-1/+0
| | | | | | | | | Remove ip4_input() declaration. It was removed in r275133. MFC after: 1 month TAG: IPSEC-HEAD Issue: #4841
* MFC r275133:Luiz Otavio O Souza2015-10-203-432/+6
| | | | | | | | | | | | | | | | | | | | Do not use xform_ipip as decapsulation fallback. xform_ipip was used as fallback with low priority for IPIP encapsulated packets that were decrypted. In some cases it can decapsulate packets, that it shouldn't. This leads to situations, when wrong configurations are magically working. Also it can propagate wrong ingress interface and this can break security. Now we redesigned the IPSEC code and IPIP encapsulation is called directly from ipsec_output, and decapsulation is done in the ipsec_input with m_striphdr. Differential Revision: https://reviews.freebsd.org/D1220 MFC after: 1 month Sponsored by: Yandex LLC TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-204-34/+9
| | | | | | | | | Revert "Importing pfSense patch ipsec_altq.RELENG_10.diff" This reverts commit 5b128f054452e56b96564210c998510e0dd45130. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-202-149/+142
| | | | | | | | | Revert "Importing pfSense patch ipsec_improvement.diff" This reverts commit 29b5f15dd163f4c415bb883fef4a53cf17f9e4e2. TAG: IPSEC-HEAD Issue: #4841
* Revert AESNI patches.Luiz Otavio O Souza2015-10-202-102/+70
| | | | | | | | | Revert "Importing pfSense patch aesgcm.soft.1.patch" This reverts commit 46e99a8858f1c843c1774e472c11d422ca2163ae. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-203-39/+21
| | | | | | | | | Revert "Importing pfSense patch ipsec-oneshot-dump.diff" This reverts commit d3b775b3db2819bebcac765dca33db7f8f5143c7. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-204-17/+2
| | | | | | | | | Revert "Importing pfSense patch ipsec_direct_dispatch.diff" This reverts commit 9ed545f35cdf6da23726dadeb0e999d0d81e62eb. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-201-52/+44
| | | | | | | | | Revert "Importing pfSense patch ipsec_SPD_lock_split.diff" This reverts commit 269a8b44fb6ae59c4ccc4d6f2353f2541547e70a. TAG: IPSEC-HEAD Issue: #4841
* Revert IPSEC patches.Luiz Otavio O Souza2015-10-201-4/+4
| | | | | | | | | Revert "Importing pfSense patch ipsec_transport_filterfix.diff" This reverts commit 924a927559577e9cea5abf4a725e679acad834bf. TAG: IPSEC-HEAD Issue: #4841
* Importing pfSense patch ipsec_transport_filterfix.diffRenato Botelho2015-08-171-4/+4
|
* Importing pfSense patch ipsec_SPD_lock_split.diffRenato Botelho2015-08-171-44/+52
|
* Importing pfSense patch ipsec_direct_dispatch.diffRenato Botelho2015-08-174-2/+17
|
* Importing pfSense patch ipsec-oneshot-dump.diffRenato Botelho2015-08-173-21/+39
|
* Importing pfSense patch aesgcm.soft.1.patchRenato Botelho2015-08-172-70/+102
|
* Importing pfSense patch ipsec_improvement.diffRenato Botelho2015-08-172-142/+149
|
* Importing pfSense patch ipsec_altq.RELENG_10.diffRenato Botelho2015-08-174-9/+34
|
* MFC r285204:ae2015-07-151-8/+60
| | | | | | | | | Fill the port and protocol information in the SADB_ACQUIRE message in case when security policy has it as required by RFC 2367. PR: 192774 Approved by: re (delphij)
* MFC r283146:ae2015-06-031-2/+3
| | | | | | | | In the reply to SADB_X_SPDGET message use the same sequence number that was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour. PR: 137309
* MFC r283101:ae2015-06-021-40/+38
| | | | | | | | | | | | | | | | Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARD extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA. PR: 200282, 200283 MFC r283102: Change SA's state before sending SADB_EXPIRE message. This state will be reported to keying daemon.
* MFC r275390:ae2015-06-0210-474/+306
| | | | | | | | | | | | Remove unused declartations. MFC r275437: ANSIfy function declarations. MFC r275438: Remove __P() macro. Sponsored by: Yandex LLC
* MFC r275392:ae2015-06-0215-47/+4
| | | | | | | | | | Remove route chaching support from ipsec code. It isn't used for some time. * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>; Sponsored by: Yandex LLC
* MFC r283117:ae2015-05-311-2/+0
| | | | | | Remove unneded mbuf length adjustment, M_PREPEND() already did that. PR: 139387
* MFC r279735:ae2015-03-141-1/+1
| | | | | | Remove extra '&'. sin6 is already a pointer. PR: 195011
* MFC r275393:ae2014-12-161-6/+3
| | | | | | | | | | | Remove unneded check. No need to do m_pullup to the size that we prepended. MFC r275473: Fix style(9) and remove m_freem(NULL). Add XXX comment, it looks incorrect, because m_pkthdr.len is already incremented by M_PREPEND(). Sponsored by: Yandex LLC
* MFC r275575:ae2014-12-161-1/+2
| | | | | | key_getspacq() returns holding the spacq_lock. Unlock it in all cases. Sponsored by: Yandex LLC
* MFC r274230:ae2014-11-211-17/+6
| | | | | Pass mbuf to pfil processing before stripping outer IP header as it is described in if_enc(4).
* MFC r274434:ae2014-11-203-39/+44
| | | | | | | | | | | | | | | | | | | | | | | Fix ips_out_nosa errors accounting. MFC r274454: ipsec6_process_packet is called before ip6_output fixes ip6_plen. Update ip6_plen before bpf processing to be able see correct value. MFC r274455: We don't return sp pointer, thus NULL assignment isn't needed. And reference to sp will be freed at the end. MFC r274465: Remove redundant ip6_plen initialization. MFC r274466: Strip IP header only when we act in tunnel mode. MFC r274467: Count statistics for the specific address family. Sponsored by: Yandex LLC
* MFC r274193:ae2014-11-131-1/+10
| | | | | | | When mode isn't explicitly specified (wildcard) and inner protocol isn't IPv4 or IPv6, assume it is the transport mode. Sponsored by: Yandex LLC
* MFC r273904:ae2014-11-131-21/+2
| | | | | | Use in_localip() instead of handmade implementation. Sponsored by: Yandex LLC
* MFC r266800 by vanhu:ae2014-11-054-342/+221
| | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv4-in-IPv6 and IPv6-in-IPv4 IPsec tunnels. For IPv6-in-IPv4, you may need to do the following command on the tunnel interface if it is configured as IPv4 only: ifconfig <interface> inet6 -ifdisabled Code logic inspired from NetBSD. PR: kern/169438 MC r266822 by bz: Use IPv4 statistics in ipsec4_process_packet() rather than the IPv6 version. This also unbreaks the NOINET6 builds after r266800. MFC r268083 by zec: The assumption in ipsec4_process_packet() that the payload may be only IPv4 is wrong, so check the IP version before mangling the payload header. MFC r272394: Do not strip outer header when operating in transport mode. Instead requeue mbuf back to IPv4 protocol handler. If there is one extra IP-IP encapsulation, it will be handled with tunneling interface. And thus proper interface will be exposed into mbuf's rcvif. Also, tcpdump that listens on tunneling interface will see packets in both directions. PR: 194761
* MFC r263710, r273377, r273378, r273423 and r273455:hselasky2014-10-271-1/+1
| | | | | | | - De-vnet hash sizes and hash masks. - Fix multiple issues related to arguments passed to SYSCTL macros. Sponsored by: Mellanox Technologies
* MFC r266606:bz2014-08-161-6/+20
| | | | | Only do a ports check if this is a NAT-T SA. Otherwise other lookups providing ports may get unexpected results.
* MFC r264124:ae2014-04-233-84/+13
| | | | | | | | | | | | | | | Remove dead code. MFC r264125: Remove unused variable. MFC r264126: The check for local address spoofing lacks ifaddr locking. Remove these loops and use in_localip() and in6_localip() functions instead. MFC r264520: Remove _IP_VHL* macros and related ifdefs.
* MFC r257987:ae2013-12-141-0/+1
| | | | | | Initialize prot variable. PR: 177417
* Remove most of the remaining sysctl name list macros. They were onlyjhb2013-08-262-50/+0
| | | | | | | | ever intended for use in sysctl(8) and it has not used them for many years. Reviewed by: bde Tested by: exp-run by bdrewery
* Remove the large part of struct ipsecstat. Only few fields of thisae2013-07-231-30/+4
| | | | | | | | | | | structure is used, but they already have equal fields in the struct newipsecstat, that was introduced with FAST_IPSEC and then was merged together with old ipsecstat structure. This fixes kernel stack overflow on some architectures after migration ipsecstat to PCPU counters. Reported by: Taku YAMAMOTO, Maciej Milewski
* Migrate structs ahstat, espstat, ipcompstat, ipipstat, pfkeystat,ae2013-07-0913-55/+94
| | | | ipsec4stat, ipsec6stat to PCPU counters.
* Prepare network statistics structures for migration to PCPU counters.ae2013-07-097-135/+131
| | | | | | | | | | Use uint64_t as type for all fields of structures. Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat, in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat, pfkeystat, pim6stat, pimstat, rip6stat, udpstat. Discussed with: arch@
* Use corresponding macros to update statistics for AH, ESP, IPIP, IPCOMP,ae2013-06-2013-202/+194
| | | | | | PFKEY. MFC after: 2 weeks
* Use IPSECSTAT_INC() and IPSEC6STAT_INC() macros for ipsec statisticsae2013-06-205-14/+16
| | | | | | accounting. MFC after: 2 weeks
* Use IP6STAT_INC/IP6STAT_DEC macros to update ip6 stats.ae2013-04-092-3/+3
| | | | MFC after: 1 week
* Use m_get2() + m_align() instead of hand made key_alloc_mbuf(). Codeglebius2013-03-151-104/+50
| | | | | | | examination shows, that although key_alloc_mbuf() could return chains, the callers never use chains, so m_get2() should suffice. Sponsored by: Nginx, Inc.
* Mechanically substitute flags from historic mbuf allocator withglebius2012-12-055-33/+33
| | | | | | | | | malloc(9) flags within sys. Exceptions: - sys/contrib not touched - sys/mbuf.h edited manually
* Do not reduce ip_len by size of IP header in the ip_input()glebius2012-10-231-3/+0
| | | | | | | | | | | before passing a packet to protocol input routines. For several protocols this mean that now protocol needs to do subtraction itself, and for another half this means that we do not need to add header length back to the packet. Make ip_stripoptions() to adjust ip_len, since now we enter this function with a packet header whose ip_len does represent length of entire packet, not payload only.
* - Fix one more miss from r241913.glebius2012-10-231-2/+4
| | | | | - Add XXX comment about necessity of the entire block, that "fixes up" the IP header.
* Couple of changes missed from r241913, which convertedglebius2012-10-222-23/+9
| | | | IPv4 stack to network byte order.
* Switch the entire IPv4 stack to keep the IP packet headerglebius2012-10-221-3/+2
| | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me>
* Mechanically remove the last stray remains of spl* calls from net*/*.andre2012-10-181-6/+0
| | | | They have been Noop's for a long time now.
* Add missing breakkevlo2012-09-181-0/+1
|
OpenPOWER on IntegriCloud