summaryrefslogtreecommitdiffstats
path: root/sys/netkey/key_debug.c
Commit message (Collapse)AuthorAgeFilesLines
* Removing old, dead, KAME IPsec files as part of the move to thegnn2007-07-021-843/+0
| | | | | | | new FAST_IPSEC based IPsec stack. Approved by: re Reviewed by: bz
* Fix -Wundef from compiling the amd64 LINT.ru2005-12-041-1/+1
|
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* - cleanup SP refcnt issue.ume2003-11-041-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - share policy-on-socket for listening socket. - don't copy policy-on-socket at all. secpolicy no longer contain spidx, which saves a lot of memory. - deep-copy pcb policy if it is an ipsec policy. assign ID field to all SPD entries. make it possible for racoon to grab SPD entry on pcb. - fixed the order of searching SA table for packets. - fixed to get a security association header. a mode is always needed to compare them. - fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime. - disallow port spec for tunnel mode policy (as we don't reassemble). - an user can define a policy-id. - clear enc/auth key before freeing. - fixed that the kernel crashed when key_spdacquire() was called because key_spdacquire() had been implemented imcopletely. - preparation for 64bit sequence number. - maintain ordered list of SA, based on SA id. - cleanup secasvar management; refcnt is key.c responsibility; alloc/free is keydb.c responsibility. - cleanup, avoid double-loop. - use hash for spi-based lookup. - mark persistent SP "persistent". XXX in theory refcnt should do the right thing, however, we have "spdflush" which would touch all SPs. another solution would be to de-register persistent SPs from sptree. - u_short -> u_int16_t - reduce kernel stack usage by auto variable secasindex. - clarify function name confusion. ipsec_*_policy -> ipsec_*_pcbpolicy. - avoid variable name confusion. (struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct secpolicy *) - count number of ipsec encapsulations on ipsec4_output, so that we can tell ip_output() how to handle the packet further. - When the value of the ul_proto is ICMP or ICMPV6, the port field in "src" of the spidx specifies ICMP type, and the port field in "dst" of the spidx specifies ICMP code. - avoid from applying IPsec transport mode to the packets when the kernel forwards the packets. Tested by: nork Obtained from: KAME
* correct %d/%u mismatch.ume2003-11-021-4/+4
| | | | Obtained from: KAME
* exit(3) with negative value does not make sense'ume2003-11-021-1/+1
| | | | Obtained from: KAME
* make debugging with "setkey -x" a lot easier.ume2003-11-021-4/+97
| | | | Obtained from: KAME
* panic() doesn't need `\n'.ume2003-09-251-16/+16
| | | | Obtained from: KAME
* Use __FBSDID().obrien2003-06-111-1/+3
|
* just merged cosmetic changes from KAME to ease sync between KAME and FreeBSD.suz2002-04-191-4/+4
| | | | | | | (based on freebsd4-snap-20020128) Reviewed by: ume MFC after: 1 week
* Remove __P.alfred2002-03-201-9/+9
|
* - net.inet.ipsec.esp_auth hasn't been thereume2001-11-051-4/+0
| | | | | | | | | | | - nuke all debug printfs, which are unneeded by now. - get rid of #ifdef IPSEC_DEBUG in headers - now that key_debug_level is always defined, there's no need for #ifdef IPSEC_DEBUG around sysctl MIB code (net.key.debug). - switch all debug printf() to ipseclog(). Obtained from: KAME MFC after: 1 week
* printed current sequence number of the SA. accordingly, changedume2001-08-061-4/+4
| | | | | | | | into sadb_x_sa2_sequence from sadb_x_sa2_reserved3 in the sadb_x_sa2 structure. Also the output of setkey is changed. sequence number of the sadb is replaced to the end of the output. Obtained from: KAME
* Sync with recent KAME.ume2001-06-111-5/+2
| | | | | | | | | | | | | | | | | | This work was based on kame-20010528-freebsd43-snap.tgz and some critical problem after the snap was out were fixed. There are many many changes since last KAME merge. TODO: - The definitions of SADB_* in sys/net/pfkeyv2.h are still different from RFC2407/IANA assignment because of binary compatibility issue. It should be fixed under 5-CURRENT. - ip6po_m member of struct ip6_pktopts is no longer used. But, it is still there because of binary compatibility issue. It should be removed under 5-CURRENT. Reviewed by: itojun Obtained from: KAME MFC after: 3 weeks
* Replace the mbuf external reference counting code with somethingdwmalone2000-08-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that should be better. The old code counted references to mbuf clusters by using the offset of the cluster from the start of memory allocated for mbufs and clusters as an index into an array of chars, which did the reference counting. If the external storage was not a cluster then reference counting had to be done by the code using that external storage. NetBSD's system of linked lists of mbufs was cosidered, but Alfred felt it would have locking issues when the kernel was made more SMP friendly. The system implimented uses a pool of unions to track external storage. The union contains an int for counting the references and a pointer for forming a free list. The reference counts are incremented and decremented atomically and so should be SMP friendly. This system can track reference counts for any sort of external storage. Access to the reference counting stuff is now through macros defined in mbuf.h, so it should be easier to make changes to the system in the future. The possibility of storing the reference count in one of the referencing mbufs was considered, but was rejected 'cos it would often leave extra mbufs allocated. Storing the reference count in the cluster was also considered, but because the external storage may not be a cluster this isn't an option. The size of the pool of reference counters is available in the stats provided by "netstat -m". PR: 19866 Submitted by: Bosko Milekic <bmilekic@dsuper.net> Reviewed by: alfred (glanced at by others on -net)
* Add missing #include to unbreak IPSEC_DEBUG buildskris2000-07-071-0/+1
| | | | Submitted by: Jim Bloom <bloom@reyim.ne.mediaone.net>
* sync with kame tree as of july00. tons of bug fixes/improvements.itojun2000-07-041-57/+127
| | | | | | | API changes: - additional IPv6 ioctls - IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8). (also syntax change)
* Change struct sockaddr_storage member name, because following changeshin2000-01-131-4/+4
| | | | | | | | | | | | is very likely to become consensus as recent ietf/ipng mailing list discussion. Also recent KAME repository and other KAME patched BSDs also applied it. s/__ss_family/ss_family/ s/__ss_len/ss_len/ Makeworld is confirmed, and no application should be affected by this change yet.
* Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL"peter1999-12-291-16/+10
| | | | | | is an application space macro and the applications are supposed to be free to use it as they please (but cannot). This is consistant with the other BSD's who made this change quite some time ago. More commits to come.
* IPSEC support in the kernel.shin1999-12-221-666/+596
| | | | | | | | pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project
* Fix a printf(3) formatter to match its variable.billf1999-08-171-1/+1
| | | | Reviewed by: bde
* The "easy" fixes for compiling the kernel -Wunused: remove unreferenced staticarchie1998-12-071-1/+0
| | | | and local variables, goto labels, and functions declared but not defined.
* Fixed printf format errors.bde1998-08-171-14/+16
|
* Removed unused #includes.bde1998-03-281-2/+0
|
* polish the code.itojun1998-02-271-2/+2
| | | | use tradictional decls. tabify. remove bogus #defines. prototypes.
* make sys/netkey/key{,_debug}.c compile. I believe it works but not tested.itojun1998-02-271-98/+128
| | | | I'll polish the code later on.
* This is the `netkey' kernel key-management service (the PF_KEY analoguewollman1996-06-141-0/+730
to PF_ROUTE) from NRL's IPv6 distribution, heavily modified by me for better source layout, formatting, and textual conventions. I am told that this code is no longer under active development, but it's a useful hack for those interested in doing work on network security, key management, etc. This code has only been tested twice, so it should be considered highly experimental. Obtained from: ftp.ripe.net
OpenPOWER on IntegriCloud