summaryrefslogtreecommitdiffstats
path: root/sys/netipsec
Commit message (Collapse)AuthorAgeFilesLines
...
* Fill the port and protocol information in the SADB_ACQUIRE messageae2015-07-061-8/+60
| | | | | | | | in case when security policy has it as required by RFC 2367. PR: 192774 Differential Revision: https://reviews.freebsd.org/D2972 MFC after: 1 week
* Reduce overhead of IPSEC for traffic generated from hosteri2015-07-031-0/+6
| | | | | | | | | | | | When IPSEC is enabled on the kernel the forwarding path has an optimization to not enter the code paths for checking security policies but first checks if there is any security policy active at all. The patch introduces the same optimization but for traffic generated from the host itself. This reduces the overhead by 50% on my tests for generated host traffic without and SP active. Differential Revision: https://reviews.freebsd.org/D2980 Reviewed by: ae, gnn Approved by: gnn(mentor)
* drop key_sa_stir_iv as it isn't used...jmg2015-06-112-9/+0
| | | | Reviewed by: eri, ae
* CALLOUT_MPSAFE has lost its meaning since r141428, i.e., for more than tenjkim2015-05-221-1/+1
| | | | | | | | | | years for head. However, it is continuously misused as the mpsafe argument for callout_init(9). Deprecate the flag and clean up callout_init() calls to make them more consistent. Differential Revision: https://reviews.freebsd.org/D2613 Reviewed by: jhb MFC after: 2 weeks
* In the reply to SADB_X_SPDGET message use the same sequence number thatae2015-05-201-2/+3
| | | | | | | | was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour. PR: 137309 MFC after: 2 weeks
* Remove unneded mbuf length adjustment, M_PREPEND() already did that.ae2015-05-191-2/+0
| | | | | PR: 139387 MFC after: 1 week
* Change SA's state before sending SADB_EXPIRE message. This state willae2015-05-191-2/+2
| | | | | | be reported to keying daemon. MFC after: 2 weeks
* Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARDae2015-05-191-40/+38
| | | | | | | | | | | | | extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA. PR: 200282, 200283 Submitted by: Tobias Brunner <tobias at strongswan dot org> MFC after: 2 weeks
* Summary: Remove spurious, extra, next header comments.gnn2015-05-151-4/+2
| | | | Correct the name of the pad length field.
* Fix the comment. We will not do SPD lookup again, becauseae2015-04-281-2/+1
| | | | | | ip[6]_ipsec_output() will find PACKET_TAG_IPSEC_OUT_DONE mbuf tag. Sponsored by: Yandex LLC
* Since PFIL can change mbuf pointer, we should update pointers afterae2015-04-282-0/+3
| | | | | | calling ipsec_filter(). Sponsored by: Yandex LLC
* Make ipsec_in_reject() static. We use ipsec[46]_in_reject() instead.ae2015-04-272-2/+2
| | | | Sponsored by: Yandex LLC
* Fix possible use after free due to security policy deletion.ae2015-04-274-8/+30
| | | | | | | | | | | | | | | | When we are passing mbuf to IPSec processing via ipsec[46]_process_packet(), we hold one reference to security policy and release it just after return from this function. But IPSec processing can be deffered and when we release reference to security policy after ipsec[46]_process_packet(), user can delete this security policy from SPDB. And when IPSec processing will be done, xform's callback function will do access to already freed memory. To fix this move KEY_FREESP() into callback function. Now IPSec code will release reference to SP after processing will be finished. Differential Revision: https://reviews.freebsd.org/D2324 No objections from: #network Sponsored by: Yandex LLC
* Change ipsec_address() and ipsec_logsastr() functions to take twoae2015-04-187-132/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | additional arguments - buffer and size of this buffer. ipsec_address() is used to convert sockaddr structure to presentation format. The IPv6 part of this function returns pointer to the on-stack buffer and at the moment when it will be used by caller, it becames invalid. IPv4 version uses 4 static buffers and returns pointer to new buffer each time when it called. But anyway it is still possible to get corrupted data when several threads will use this function. ipsec_logsastr() is used to format string about SA entry. It also uses static buffer and has the same problem with concurrent threads. To fix these problems add the buffer pointer and size of this buffer to arguments. Now each caller will pass buffer and its size to these functions. Also convert all places where these functions are used (except disabled code). And now ipsec_address() uses inet_ntop() function from libkern. PR: 185996 Differential Revision: https://reviews.freebsd.org/D2321 Reviewed by: gnn Sponsored by: Yandex LLC
* Requeue mbuf via netisr when we use IPSec tunnel mode and IPv6.ae2015-04-181-1/+30
| | | | | | | | | | | | | | | | | | | ipsec6_common_input_cb() uses partial copy of ip6_input() to parse headers. But this isn't correct, when we use tunnel mode IPSec. When we stripped outer IPv6 header from the decrypted packet, it can become IPv4 packet and should be handled by ip_input. Also when we use tunnel mode IPSec with IPv6 traffic, we should pass decrypted packet with inner IPv6 header to ip6_input, it will correctly handle it and also can decide to forward it. The "skip" variable points to offset where payload starts. In tunnel mode we reset it to zero after stripping the outer header. So, when it is zero, we should requeue mbuf via netisr. Differential Revision: https://reviews.freebsd.org/D2306 Reviewed by: adrian, gnn Sponsored by: Yandex LLC
* Fix handling of scoped IPv6 addresses in IPSec code.ae2015-04-183-36/+21
| | | | | | | | | | | | | | | | | | | | | * in ipsec_encap() embed scope zone ids into link-local addresses in the new IPv6 header, this helps ip6_output() disambiguate the scope; * teach key_ismyaddr6() use in6_localip(). in6_localip() is less strict than key_sockaddrcmp(). It doesn't compare all fileds of struct sockaddr_in6, but it is faster and it should be safe, because all SA's data was checked for correctness. Also, since IPv6 link-local addresses in the &V_in6_ifaddrhead are stored in kernel-internal form, we need to embed scope zone id from SA into the address before calling in6_localip. * in ipsec_common_input() take scope zone id embedded in the address and use it to initialize sin6_scope_id, then use this sockaddr structure to lookup SA, because we keep addresses in the SADB without embedded scope zone id. Differential Revision: https://reviews.freebsd.org/D2304 Reviewed by: gnn Sponsored by: Yandex LLC
* Remove xform_ipip.c and code related to XF_IP4.ae2015-04-183-404/+129
| | | | | | | | | | | | | | | | | | | | | | | | The only thing is used from this code is ipip_output() function, that does IPIP encapsulation. Other parts of XF_IP4 code were removed in r275133. Also it isn't possible to configure the use of XF_IP4, nor from userland via setkey(8), nor from the kernel. Simplify the ipip_output() function and rename it to ipsec_encap(). * move IP_DF handling from ipsec4_process_packet() into ipsec_encap(); * since ipsec_encap() called from ipsec[64]_process_packet(), it is safe to assume that mbuf is contiguous at least to IP header for used IP version. Remove all unneeded m_pullup(), m_copydata and related checks. * use V_ip_defttl and V_ip6_defhlim for outer headers; * use V_ip4_ipsec_ecn and V_ip6_ipsec_ecn for outer headers; * move all diagnostic messages to the ipsec_encap() callers; * simplify handling of ipsec_encap() results: if it returns non zero value, print diagnostic message and free mbuf. * some style(9) fixes. Differential Revision: https://reviews.freebsd.org/D2303 Reviewed by: glebius Sponsored by: Yandex LLC
* o Use new function ip_fillid() in all places throughout the kernel,glebius2015-04-011-3/+1
| | | | | | | | | | | | | | | | | where we want to create a new IP datagram. o Add support for RFC6864, which allows to set IP ID for atomic IP datagrams to any value, to improve performance. The behaviour is controlled by net.inet.ip.rfc6864 sysctl knob, which is enabled by default. o In case if we generate IP ID, use counter(9) to improve performance. o Gather all code related to IP ID into ip_id.c. Differential Revision: https://reviews.freebsd.org/D2177 Reviewed by: adrian, cy, rpaulo Tested by: Emeric POUPON <emeric.poupon stormshield.eu> Sponsored by: Netflix Sponsored by: Nginx, Inc. Relnotes: yes
* Remove extra '&'. sin6 is already a pointer.ae2015-03-071-1/+1
| | | | | PR: 195011 MFC after: 1 week
* Fix possible memory leak and several races in the IPsec policy managementae2015-02-242-1/+18
| | | | | | | | | | | | | | | | | | | | | code. Resurrect the state field in the struct secpolicy, it has IPSEC_SPSTATE_ALIVE value when security policy linked in the chain, and IPSEC_SPSTATE_DEAD value in all other cases. This field protects from trying to unlink one security policy several times from the different threads. Take additional reference in the key_flush_spd() to be sure that policy won't be freed from the different thread while we are sending SPDEXPIRE message. Add KEY_FREESP() call to the key_unlink() to release additional reference that we take when use key_getsp*() functions. Differential Revision: https://reviews.freebsd.org/D1914 Tested by: Emeric POUPON <emeric.poupon at stormshield dot eu> Reviewed by: hrs Sponsored by: Yandex LLC
* key_spdget uses key_setdumpsp() without SPTREE_RLOCK held (it usesae2015-01-271-2/+0
| | | | | | | | | referenced pointer to sp). Remove SPTREE_RLOCK_ASSERT from key_setdumpsp() to fix wrong assertion. Reported by: Emeric POUPON Obtained from: Yandex LLC Sponsored by: Yandex LLC
* In order to reduce use of M_EXT outside of the mbuf allocator andrwatson2015-01-062-12/+6
| | | | | | | | | | | | | | | | | | | | | socket-buffer implementations, introduce a return value for MCLGET() (and m_cljget() that underlies it) to allow the caller to avoid testing M_EXT itself. Update all callers to use the return value. With this change, very few network device drivers remain aware of M_EXT; the primary exceptions lie in mbuf-chain pretty printers for debugging, and in a few cases, custom mbuf and cluster allocation implementations. NB: This is a difficult-to-test change as it touches many drivers for which I don't have physical devices. Instead we've gone for intensive review, but further post-commit review would definitely be appreciated to spot errors where changes could not easily be made mechanically, but were largely mechanical in nature. Differential Revision: https://reviews.freebsd.org/D1440 Reviewed by: adrian, bz, gnn Sponsored by: EMC / Isilon Storage Division
* Fix VIMAGE build.ae2014-12-251-1/+1
|
* Rename ip4_def_policy variable to def_policy. It is used by both IPv4 andae2014-12-244-209/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6. Initialize it only once in def_policy_init(). Remove its initialization from key_init() and make it static. Remove several fields from struct secpolicy: * lock - it isn't so useful having mutex in the structure, but the only thing we do with it is initialization and destroying. * state - it has only two values - DEAD and ALIVE. Instead of take a lock and change the state to DEAD, then take lock again in GC function and delete policy from the chain - keep in the chain only ALIVE policies. * scangen - it was used in GC function to protect from sending several SADB_SPDEXPIRE messages for one SPD entry. Now we don't keep DEAD entries in the chain and there is no need to have scangen variable. Use TAILQ to implement SPD entries chain. Use rmlock to protect access to SPD entries chain. Protect all SP lookup with RLOCK, and use WLOCK when we are inserting (or removing) SP entry in the chain. Instead of using pattern "LOCK(); refcnt++; UNLOCK();", use refcount(9) API to implement refcounting in SPD. Merge code from key_delsp() and _key_delsp() into _key_freesp(). And use KEY_FREESP() macro in all cases when we want to release reference or just delete SP entry. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Treat errors when retrieving security policy as policy violation.ae2014-12-111-2/+4
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Initialize error variable.ae2014-12-111-0/+1
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove flag/flags argument from the following functions:ae2014-12-112-23/+12
| | | | | | | | | | | | ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove flags and tunalready arguments from ipsec4_process_packet()ae2014-12-112-94/+54
| | | | | | | | and make its prototype similar to ipsec6_process_packet. The flags argument isn't used here, tunalready is always zero. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove now unused mtag argument from ipsec*_common_input_cb.ae2014-12-116-31/+16
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove code related to PACKET_TAG_IPSEC_IN_CRYPTO_DONE mbuf tag.ae2014-12-112-153/+71
| | | | | | | It isn't used in FreeBSD. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove unused mtag variable.ae2014-12-111-2/+0
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* key_getspacq() returns holding the spacq_lock. Unlock it in all cases.ae2014-12-071-1/+2
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Fix style(9) and remove m_freem(NULL).ae2014-12-041-4/+3
| | | | | | | Add XXX comment, it looks incorrect, because m_pkthdr.len is already incremented by M_PREPEND(). Sponsored by: Yandex LLC
* Remove __P() macro.ae2014-12-0310-206/+202
| | | | | Suggested by: kevlo Sponsored by: Yandex LLC
* ANSIfy function declarations.ae2014-12-033-257/+103
| | | | Sponsored by: Yandex LLC
* Remove unneded check. No need to do m_pullup to the size that we prepended.ae2014-12-021-2/+0
| | | | Sponsored by: Yandex LLC
* Remove route chaching support from ipsec code. It isn't used for some time.ae2014-12-0215-47/+4
| | | | | | | | | * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>; Sponsored by: Yandex LLC
* Remove unused structure declarations.ae2014-12-021-11/+0
| | | | Sponsored by: Yandex LLC
* Remove unused declartations.ae2014-12-021-10/+0
| | | | Sponsored by: Yandex LLC
* Remove ip4_input() declaration. It was removed in r275133.ae2014-11-271-1/+0
| | | | MFC after: 1 month
* Do not use xform_ipip as decapsulation fallback.ae2014-11-263-433/+6
| | | | | | | | | | | | | | | xform_ipip was used as fallback with low priority for IPIP encapsulated packets that were decrypted. In some cases it can decapsulate packets, that it shouldn't. This leads to situations, when wrong configurations are magically working. Also it can propagate wrong ingress interface and this can break security. Now we redesigned the IPSEC code and IPIP encapsulation is called directly from ipsec_output, and decapsulation is done in the ipsec_input with m_striphdr. Differential Revision: https://reviews.freebsd.org/D1220 MFC after: 1 month Sponsored by: Yandex LLC
* Count statistics for the specific address family.ae2014-11-131-1/+2
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Strip IP header only when we act in tunnel mode.ae2014-11-131-29/+30
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Remove redundant ip6_plen initialization.ae2014-11-131-3/+0
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* ipsec6_process_packet is called before ip6_output fixes ip6_plen.ae2014-11-121-5/+2
| | | | | | | Update ip6_plen before bpf processing to be able see correct value. MFC after: 1 week Sponsored by: Yandex LLC
* Fix ips_out_nosa errors accounting.ae2014-11-121-1/+10
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Pass mbuf to pfil processing before stripping outer IP header as itae2014-11-071-17/+6
| | | | | | | is described in if_enc(4). MFC after: 2 week Sponsored by: Yandex LLC
* Remove SYSCTL_VNET_* macros, and simply put CTLFLAG_VNET where needed.glebius2014-11-076-74/+74
| | | | Sponsored by: Nginx, Inc.
* When mode isn't explicitly specified (wildcard) and inner protocol isn'tae2014-11-061-1/+10
| | | | | | | | IPv4 or IPv6, assume it is the transport mode. Reported by: jmg MFC after: 1 week Sponsored by: Yandex LLC
* Use in_localip() instead of handmade implementation.ae2014-10-311-21/+2
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
OpenPOWER on IntegriCloud