summaryrefslogtreecommitdiffstats
path: root/sys/netipsec
Commit message (Collapse)AuthorAgeFilesLines
* These files were getting sys/malloc.h and vm/uma.h with header pollutionglebius2016-02-012-1/+2
| | | | via sys/mbuf.h
* Overhaul if_enc(4) and make it loadable in run-time.ae2015-11-254-102/+80
| | | | | | | | Use hhook(9) framework to achieve ability of loading and unloading if_enc(4) kernel module. INET and INET6 code on initialization registers two helper hooks points in the kernel. if_enc(4) module uses these helper hook points and registers its hooks. IPSEC code uses these hhook points to call helper hooks implemented in if_enc(4).
* Implement the sadb_x_policy_priority field as it is done in Linux:fabient2015-11-172-7/+31
| | | | | | | | lower priority policies are inserted first. Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu> Reviewed by: ae Sponsored by: Stormshield
* Use explicitly specified ivsize instead of blocksize when we mean IV size.ae2015-11-162-8/+2
| | | | | | | | Set zero ivsize for enc_xform_null and remove special handling from xform_esp.c. Reviewed by: gnn Differential Revision: https://reviews.freebsd.org/D1503
* Turning on IPSEC used to introduce a slight amount of performancegnn2015-10-271-0/+6
| | | | | | | | | | | | | degradation (7%) for host host TCP connections over 10Gbps links, even when there were no secuirty policies in place. There is no change in performance on 1Gbps network links. Testing GENERIC vs. GENERIC-NOIPSEC vs. GENERIC with this change shows that the new code removes any overhead introduced by having IPSEC always in the kernel. Differential Revision: D3993 MFC after: 1 month Sponsored by: Rubicon Communications (Netgate)
* Take extra reference to security policy before calling crypto_dispatch().ae2015-09-304-14/+5
| | | | | | | | | | | | | Currently we perform crypto requests for IPSEC synchronous for most of crypto providers (software, aesni) and only VIA padlock calls crypto callback asynchronous. In synchronous mode it is possible, that security policy will be removed during the processing crypto request. And crypto callback will release the last reference to SP. Then upon return into ipsec[46]_process_packet() IPSECREQUEST_UNLOCK() will be called to already freed request. To prevent this we will take extra reference to SP. PR: 201876 Sponsored by: Yandex LLC
* Make IPsec work with AES-GCM and AES-ICM (aka CTR) in OCF... IPsecjmg2015-08-044-89/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | defines the keys differently than NIST does, so we have to muck with key lengths and nonce/IVs to be standard compliant... Remove the iv from secasvar as it was unused... Add a counter protected by a mutex to ensure that the counter for GCM and ICM will never be repeated.. This is a requirement for security.. I would use atomics, but we don't have a 64bit one on all platforms.. Fix a bug where IPsec was depending upon the OCF to ensure that the blocksize was always at least 4 bytes to maintain alignment... Move this logic into IPsec so changes to OCF won't break IPsec... In one place, espx was always non-NULL, so don't test that it's non-NULL before doing work.. minor style cleanups... drop setting key and klen as they were not used... Enforce that OCF won't pass invalid key lengths to AES that would panic the machine... This was has been tested by others too... I tested this against NetBSD 6.1.5 using mini-test suite in https://github.com/jmgurney/ipseccfgs and the only things that don't pass are keyed md5 and sha1, and 3des-deriv (setkey syntax error), all other modes listed in setkey's man page... The nice thing is that NetBSD uses setkey, so same config files were used on both... Reviewed by: gnn
* these are comparing authenticators and need to be constant time...jmg2015-07-312-2/+2
| | | | | | | This could be a side channel attack... Now that we have a function for this, use it... jmgurney/ipsecgcm: 24d704cc and 7f37a14
* Clean up this header file...jmg2015-07-311-2/+0
| | | | | | | | | | | | | | | | | | | | | use CTASSERTs now that we have them... Replace a draft w/ RFC that's over 10 years old. Note that _AALG and _EALG do not need to match what the IKE daemons think they should be.. This is part of the KABI... I decided to renumber AESCTR, but since we've never had working AESCTR mode, I'm not really breaking anything.. and it shortens a loop by quite a bit.. remove SKIPJACK IPsec support... SKIPJACK never made it out of draft (in 1999), only has 80bit key, NIST recommended it stop being used after 2010, and setkey nor any of the IKE daemons I checked supported it... jmgurney/ipsecgcm: a357a33, c75808b, e008669, b27b6d6 Reviewed by: gnn (earlier version)
* Correct IPSec SA statistic keepingeri2015-07-301-1/+2
| | | | | | | | | | | The IPsec SA statistic keeping is used even for decision making on expiry/rekeying SAs. When there are multiple transformations being done the statistic keeping might be wrong. This mostly impacts multiple encapsulations on IPsec since the usual scenario it is not noticed due to the code path not taken. Differential Revision: https://reviews.freebsd.org/D3239 Reviewed by: ae, gnn Approved by: gnn(mentor)
* RFC4868 section 2.3 requires that the output be half... This fixesjmg2015-07-293-26/+38
| | | | | | | | problems that was introduced in r285336... I have verified that HMAC-SHA2-256 both ah only and w/ AES-CBC interoperate w/ a NetBSD 6.1.5 vm... Reviewed by: gnn
* IPSEC, remove variable argument function its already due.eri2015-07-212-23/+8
| | | | | | Differential Revision: https://reviews.freebsd.org/D3080 Reviewed by: gnn, ae Approved by: gnn(mentor)
* Summary: Fix LINT build. The names of the new AES modes were notgnn2015-07-101-3/+3
| | | | correctly used under the REGRESSION kernel option.
* Add support for AES modes to IPSec. These modes work both in software onlygnn2015-07-092-73/+99
| | | | | | | | mode and with hardware support on systems that have AESNI instructions. Differential Revision: D2936 Reviewed by: jmg, eri, cognet Sponsored by: Rubicon Communications (Netgate)
* Fill the port and protocol information in the SADB_ACQUIRE messageae2015-07-061-8/+60
| | | | | | | | in case when security policy has it as required by RFC 2367. PR: 192774 Differential Revision: https://reviews.freebsd.org/D2972 MFC after: 1 week
* Reduce overhead of IPSEC for traffic generated from hosteri2015-07-031-0/+6
| | | | | | | | | | | | When IPSEC is enabled on the kernel the forwarding path has an optimization to not enter the code paths for checking security policies but first checks if there is any security policy active at all. The patch introduces the same optimization but for traffic generated from the host itself. This reduces the overhead by 50% on my tests for generated host traffic without and SP active. Differential Revision: https://reviews.freebsd.org/D2980 Reviewed by: ae, gnn Approved by: gnn(mentor)
* drop key_sa_stir_iv as it isn't used...jmg2015-06-112-9/+0
| | | | Reviewed by: eri, ae
* CALLOUT_MPSAFE has lost its meaning since r141428, i.e., for more than tenjkim2015-05-221-1/+1
| | | | | | | | | | years for head. However, it is continuously misused as the mpsafe argument for callout_init(9). Deprecate the flag and clean up callout_init() calls to make them more consistent. Differential Revision: https://reviews.freebsd.org/D2613 Reviewed by: jhb MFC after: 2 weeks
* In the reply to SADB_X_SPDGET message use the same sequence number thatae2015-05-201-2/+3
| | | | | | | | was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour. PR: 137309 MFC after: 2 weeks
* Remove unneded mbuf length adjustment, M_PREPEND() already did that.ae2015-05-191-2/+0
| | | | | PR: 139387 MFC after: 1 week
* Change SA's state before sending SADB_EXPIRE message. This state willae2015-05-191-2/+2
| | | | | | be reported to keying daemon. MFC after: 2 weeks
* Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARDae2015-05-191-40/+38
| | | | | | | | | | | | | extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA. PR: 200282, 200283 Submitted by: Tobias Brunner <tobias at strongswan dot org> MFC after: 2 weeks
* Summary: Remove spurious, extra, next header comments.gnn2015-05-151-4/+2
| | | | Correct the name of the pad length field.
* Fix the comment. We will not do SPD lookup again, becauseae2015-04-281-2/+1
| | | | | | ip[6]_ipsec_output() will find PACKET_TAG_IPSEC_OUT_DONE mbuf tag. Sponsored by: Yandex LLC
* Since PFIL can change mbuf pointer, we should update pointers afterae2015-04-282-0/+3
| | | | | | calling ipsec_filter(). Sponsored by: Yandex LLC
* Make ipsec_in_reject() static. We use ipsec[46]_in_reject() instead.ae2015-04-272-2/+2
| | | | Sponsored by: Yandex LLC
* Fix possible use after free due to security policy deletion.ae2015-04-274-8/+30
| | | | | | | | | | | | | | | | When we are passing mbuf to IPSec processing via ipsec[46]_process_packet(), we hold one reference to security policy and release it just after return from this function. But IPSec processing can be deffered and when we release reference to security policy after ipsec[46]_process_packet(), user can delete this security policy from SPDB. And when IPSec processing will be done, xform's callback function will do access to already freed memory. To fix this move KEY_FREESP() into callback function. Now IPSec code will release reference to SP after processing will be finished. Differential Revision: https://reviews.freebsd.org/D2324 No objections from: #network Sponsored by: Yandex LLC
* Change ipsec_address() and ipsec_logsastr() functions to take twoae2015-04-187-132/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | additional arguments - buffer and size of this buffer. ipsec_address() is used to convert sockaddr structure to presentation format. The IPv6 part of this function returns pointer to the on-stack buffer and at the moment when it will be used by caller, it becames invalid. IPv4 version uses 4 static buffers and returns pointer to new buffer each time when it called. But anyway it is still possible to get corrupted data when several threads will use this function. ipsec_logsastr() is used to format string about SA entry. It also uses static buffer and has the same problem with concurrent threads. To fix these problems add the buffer pointer and size of this buffer to arguments. Now each caller will pass buffer and its size to these functions. Also convert all places where these functions are used (except disabled code). And now ipsec_address() uses inet_ntop() function from libkern. PR: 185996 Differential Revision: https://reviews.freebsd.org/D2321 Reviewed by: gnn Sponsored by: Yandex LLC
* Requeue mbuf via netisr when we use IPSec tunnel mode and IPv6.ae2015-04-181-1/+30
| | | | | | | | | | | | | | | | | | | ipsec6_common_input_cb() uses partial copy of ip6_input() to parse headers. But this isn't correct, when we use tunnel mode IPSec. When we stripped outer IPv6 header from the decrypted packet, it can become IPv4 packet and should be handled by ip_input. Also when we use tunnel mode IPSec with IPv6 traffic, we should pass decrypted packet with inner IPv6 header to ip6_input, it will correctly handle it and also can decide to forward it. The "skip" variable points to offset where payload starts. In tunnel mode we reset it to zero after stripping the outer header. So, when it is zero, we should requeue mbuf via netisr. Differential Revision: https://reviews.freebsd.org/D2306 Reviewed by: adrian, gnn Sponsored by: Yandex LLC
* Fix handling of scoped IPv6 addresses in IPSec code.ae2015-04-183-36/+21
| | | | | | | | | | | | | | | | | | | | | * in ipsec_encap() embed scope zone ids into link-local addresses in the new IPv6 header, this helps ip6_output() disambiguate the scope; * teach key_ismyaddr6() use in6_localip(). in6_localip() is less strict than key_sockaddrcmp(). It doesn't compare all fileds of struct sockaddr_in6, but it is faster and it should be safe, because all SA's data was checked for correctness. Also, since IPv6 link-local addresses in the &V_in6_ifaddrhead are stored in kernel-internal form, we need to embed scope zone id from SA into the address before calling in6_localip. * in ipsec_common_input() take scope zone id embedded in the address and use it to initialize sin6_scope_id, then use this sockaddr structure to lookup SA, because we keep addresses in the SADB without embedded scope zone id. Differential Revision: https://reviews.freebsd.org/D2304 Reviewed by: gnn Sponsored by: Yandex LLC
* Remove xform_ipip.c and code related to XF_IP4.ae2015-04-183-404/+129
| | | | | | | | | | | | | | | | | | | | | | | | The only thing is used from this code is ipip_output() function, that does IPIP encapsulation. Other parts of XF_IP4 code were removed in r275133. Also it isn't possible to configure the use of XF_IP4, nor from userland via setkey(8), nor from the kernel. Simplify the ipip_output() function and rename it to ipsec_encap(). * move IP_DF handling from ipsec4_process_packet() into ipsec_encap(); * since ipsec_encap() called from ipsec[64]_process_packet(), it is safe to assume that mbuf is contiguous at least to IP header for used IP version. Remove all unneeded m_pullup(), m_copydata and related checks. * use V_ip_defttl and V_ip6_defhlim for outer headers; * use V_ip4_ipsec_ecn and V_ip6_ipsec_ecn for outer headers; * move all diagnostic messages to the ipsec_encap() callers; * simplify handling of ipsec_encap() results: if it returns non zero value, print diagnostic message and free mbuf. * some style(9) fixes. Differential Revision: https://reviews.freebsd.org/D2303 Reviewed by: glebius Sponsored by: Yandex LLC
* o Use new function ip_fillid() in all places throughout the kernel,glebius2015-04-011-3/+1
| | | | | | | | | | | | | | | | | where we want to create a new IP datagram. o Add support for RFC6864, which allows to set IP ID for atomic IP datagrams to any value, to improve performance. The behaviour is controlled by net.inet.ip.rfc6864 sysctl knob, which is enabled by default. o In case if we generate IP ID, use counter(9) to improve performance. o Gather all code related to IP ID into ip_id.c. Differential Revision: https://reviews.freebsd.org/D2177 Reviewed by: adrian, cy, rpaulo Tested by: Emeric POUPON <emeric.poupon stormshield.eu> Sponsored by: Netflix Sponsored by: Nginx, Inc. Relnotes: yes
* Remove extra '&'. sin6 is already a pointer.ae2015-03-071-1/+1
| | | | | PR: 195011 MFC after: 1 week
* Fix possible memory leak and several races in the IPsec policy managementae2015-02-242-1/+18
| | | | | | | | | | | | | | | | | | | | | code. Resurrect the state field in the struct secpolicy, it has IPSEC_SPSTATE_ALIVE value when security policy linked in the chain, and IPSEC_SPSTATE_DEAD value in all other cases. This field protects from trying to unlink one security policy several times from the different threads. Take additional reference in the key_flush_spd() to be sure that policy won't be freed from the different thread while we are sending SPDEXPIRE message. Add KEY_FREESP() call to the key_unlink() to release additional reference that we take when use key_getsp*() functions. Differential Revision: https://reviews.freebsd.org/D1914 Tested by: Emeric POUPON <emeric.poupon at stormshield dot eu> Reviewed by: hrs Sponsored by: Yandex LLC
* key_spdget uses key_setdumpsp() without SPTREE_RLOCK held (it usesae2015-01-271-2/+0
| | | | | | | | | referenced pointer to sp). Remove SPTREE_RLOCK_ASSERT from key_setdumpsp() to fix wrong assertion. Reported by: Emeric POUPON Obtained from: Yandex LLC Sponsored by: Yandex LLC
* In order to reduce use of M_EXT outside of the mbuf allocator andrwatson2015-01-062-12/+6
| | | | | | | | | | | | | | | | | | | | | socket-buffer implementations, introduce a return value for MCLGET() (and m_cljget() that underlies it) to allow the caller to avoid testing M_EXT itself. Update all callers to use the return value. With this change, very few network device drivers remain aware of M_EXT; the primary exceptions lie in mbuf-chain pretty printers for debugging, and in a few cases, custom mbuf and cluster allocation implementations. NB: This is a difficult-to-test change as it touches many drivers for which I don't have physical devices. Instead we've gone for intensive review, but further post-commit review would definitely be appreciated to spot errors where changes could not easily be made mechanically, but were largely mechanical in nature. Differential Revision: https://reviews.freebsd.org/D1440 Reviewed by: adrian, bz, gnn Sponsored by: EMC / Isilon Storage Division
* Fix VIMAGE build.ae2014-12-251-1/+1
|
* Rename ip4_def_policy variable to def_policy. It is used by both IPv4 andae2014-12-244-209/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6. Initialize it only once in def_policy_init(). Remove its initialization from key_init() and make it static. Remove several fields from struct secpolicy: * lock - it isn't so useful having mutex in the structure, but the only thing we do with it is initialization and destroying. * state - it has only two values - DEAD and ALIVE. Instead of take a lock and change the state to DEAD, then take lock again in GC function and delete policy from the chain - keep in the chain only ALIVE policies. * scangen - it was used in GC function to protect from sending several SADB_SPDEXPIRE messages for one SPD entry. Now we don't keep DEAD entries in the chain and there is no need to have scangen variable. Use TAILQ to implement SPD entries chain. Use rmlock to protect access to SPD entries chain. Protect all SP lookup with RLOCK, and use WLOCK when we are inserting (or removing) SP entry in the chain. Instead of using pattern "LOCK(); refcnt++; UNLOCK();", use refcount(9) API to implement refcounting in SPD. Merge code from key_delsp() and _key_delsp() into _key_freesp(). And use KEY_FREESP() macro in all cases when we want to release reference or just delete SP entry. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Treat errors when retrieving security policy as policy violation.ae2014-12-111-2/+4
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Initialize error variable.ae2014-12-111-0/+1
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove flag/flags argument from the following functions:ae2014-12-112-23/+12
| | | | | | | | | | | | ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove flags and tunalready arguments from ipsec4_process_packet()ae2014-12-112-94/+54
| | | | | | | | and make its prototype similar to ipsec6_process_packet. The flags argument isn't used here, tunalready is always zero. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove now unused mtag argument from ipsec*_common_input_cb.ae2014-12-116-31/+16
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove code related to PACKET_TAG_IPSEC_IN_CRYPTO_DONE mbuf tag.ae2014-12-112-153/+71
| | | | | | | It isn't used in FreeBSD. Obtained from: Yandex LLC Sponsored by: Yandex LLC
* Remove unused mtag variable.ae2014-12-111-2/+0
| | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC
* key_getspacq() returns holding the spacq_lock. Unlock it in all cases.ae2014-12-071-1/+2
| | | | | MFC after: 1 week Sponsored by: Yandex LLC
* Fix style(9) and remove m_freem(NULL).ae2014-12-041-4/+3
| | | | | | | Add XXX comment, it looks incorrect, because m_pkthdr.len is already incremented by M_PREPEND(). Sponsored by: Yandex LLC
* Remove __P() macro.ae2014-12-0310-206/+202
| | | | | Suggested by: kevlo Sponsored by: Yandex LLC
* ANSIfy function declarations.ae2014-12-033-257/+103
| | | | Sponsored by: Yandex LLC
* Remove unneded check. No need to do m_pullup to the size that we prepended.ae2014-12-021-2/+0
| | | | Sponsored by: Yandex LLC
OpenPOWER on IntegriCloud