#
296373 |
|
04-Mar-2016 |
marius |
- Copy stable/10@296371 to releng/10.3 in preparation for 10.3-RC1 builds. - Update newvers.sh to reflect RC1. - Update __FreeBSD_version to reflect 10.3. - Update default pkg(8) configuration to use the quarterly branch.
Approved by: re (implicit) |
#
285614 |
|
15-Jul-2015 |
ae |
MFC r285204: Fill the port and protocol information in the SADB_ACQUIRE message in case when security policy has it as required by RFC 2367.
PR: 192774
Approved by: re (delphij)
|
#
283937 |
|
03-Jun-2015 |
ae |
MFC r283146: In the reply to SADB_X_SPDGET message use the same sequence number that was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour.
PR: 137309
|
#
283903 |
|
02-Jun-2015 |
ae |
MFC r283101: Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARD extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA.
PR: 200282, 200283
MFC r283102: Change SA's state before sending SADB_EXPIRE message. This state will be reported to keying daemon.
|
#
283902 |
|
02-Jun-2015 |
ae |
MFC r275390: Remove unused declartations.
MFC r275437: ANSIfy function declarations.
MFC r275438: Remove __P() macro.
Sponsored by: Yandex LLC
|
#
283901 |
|
02-Jun-2015 |
ae |
MFC r275392: Remove route chaching support from ipsec code. It isn't used for some time. * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>;
Sponsored by: Yandex LLC
|
#
279989 |
|
14-Mar-2015 |
ae |
MFC r279735: Remove extra '&'. sin6 is already a pointer.
PR: 195011
|
#
275822 |
|
16-Dec-2014 |
ae |
MFC r275575: key_getspacq() returns holding the spacq_lock. Unlock it in all cases.
Sponsored by: Yandex LLC
|
#
274468 |
|
13-Nov-2014 |
ae |
MFC r273904: Use in_localip() instead of handmade implementation.
Sponsored by: Yandex LLC
|
#
270053 |
|
16-Aug-2014 |
bz |
MFC r266606:
Only do a ports check if this is a NAT-T SA. Otherwise other lookups providing ports may get unexpected results.
|
#
256281 |
|
10-Oct-2013 |
gjb |
Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.
Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
|
#
252028 |
|
20-Jun-2013 |
ae |
Use corresponding macros to update statistics for AH, ESP, IPIP, IPCOMP, PFKEY.
MFC after: 2 weeks
|
#
248317 |
|
15-Mar-2013 |
glebius |
Use m_get2() + m_align() instead of hand made key_alloc_mbuf(). Code examination shows, that although key_alloc_mbuf() could return chains, the callers never use chains, so m_get2() should suffice.
Sponsored by: Nginx, Inc.
|
#
243882 |
|
05-Dec-2012 |
glebius |
Mechanically substitute flags from historic mbuf allocator with malloc(9) flags within sys.
Exceptions:
- sys/contrib not touched - sys/mbuf.h edited manually
|
#
241686 |
|
18-Oct-2012 |
andre |
Mechanically remove the last stray remains of spl* calls from net*/*. They have been Noop's for a long time now.
|
#
240392 |
|
12-Sep-2012 |
vanhu |
In NAT-T transport mode, allow a client to open a new connection just after closing another. It worked only in tunnel mode before.
Submitted by: Andreas Longwitz <longwitz@incore.de> MFC after: 1M
|
#
239357 |
|
17-Aug-2012 |
jhb |
Unexpand a couple of TAILQ_FOREACH()s.
|
#
226117 |
|
07-Oct-2011 |
brueffer |
Add missing va_end() in an error case to clean up after va_start() (already done in the non-error case).
CID: 4726 Found with: Coverity Prevent(tm) MFC after: 1 week
|
#
221692 |
|
09-May-2011 |
vanhu |
Release SP's refcount in key_get_spdbyid().
PR: 156676 Submitted by: Tobias Brunner (tobias@strongswan.org) MFC after: 1 week
|
#
221129 |
|
27-Apr-2011 |
bz |
Make IPsec compile without INET adding appropriate #ifdef checks.
Unfold the IPSEC_COMMON_INPUT_CB() macro in xform_{ah,esp,ipcomp}.c to not need three different versions depending on INET, INET6 or both.
Mark two places preparing for not yet supported functionality with IPv6.
Reviewed by: gnn Sponsored by: The FreeBSD Foundation Sponsored by: iXsystems MFC after: 4 days
|
#
220206 |
|
31-Mar-2011 |
fabient |
Optimisation in IPSEC(4): - Remove contention on ISR during the crypto operation by using rwlock(9). - Remove a second lookup of the SA in the callback.
Gain on 6 cores CPU with SHA1/AES128 can be up to 30%.
Reviewed by: vanhu MFC after: 1 month
|
#
218794 |
|
18-Feb-2011 |
vanhu |
Fixed IPsec's HMAC_SHA256-512 support to be RFC4868 compliant. This will break interoperability with all older versions of FreeBSD for those algorithms.
Reviewed by: bz, gnn Obtained from: NETASQ MFC after: 1w
|
#
215701 |
|
22-Nov-2010 |
dim |
After some off-list discussion, revert a number of changes to the DPCPU_DEFINE and VNET_DEFINE macros, as these cause problems for various people working on the affected files. A better long-term solution is still being considered. This reversal may give some modules empty set_pcpu or set_vnet sections, but these are harmless.
Changes reverted:
------------------------------------------------------------------------ r215318 | dim | 2010-11-14 21:40:55 +0100 (Sun, 14 Nov 2010) | 4 lines
Instead of unconditionally emitting .globl's for the __start_set_xxx and __stop_set_xxx symbols, only emit them when the set_vnet or set_pcpu sections are actually defined.
------------------------------------------------------------------------ r215317 | dim | 2010-11-14 21:38:11 +0100 (Sun, 14 Nov 2010) | 3 lines
Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughout the tree.
------------------------------------------------------------------------ r215316 | dim | 2010-11-14 21:23:02 +0100 (Sun, 14 Nov 2010) | 2 lines
Add macros to define static instances of VNET_DEFINE and DPCPU_DEFINE.
|
#
215317 |
|
14-Nov-2010 |
dim |
Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughout the tree.
|
#
214250 |
|
23-Oct-2010 |
bz |
Make the IPsec SADB embedded route cache a union to be able to hold both the legacy and IPv6 route destination address. Previously in case of IPv6, there was a memory overwrite due to not enough space for the IPv6 address.
PR: kern/122565 MFC After: 2 weeks
|
#
207652 |
|
05-May-2010 |
vanhu |
Set SA's natt_type before calling key_mature() in key_add(), as the SA may be used as soon as key_mature() has been done.
Obtained from: NETASQ MFC after: 1 week
|
#
207651 |
|
05-May-2010 |
vanhu |
Update SA's NAT-T stuff before calling key_mature() in key_update(), as SA may be used as soon as key_mature() has been called.
Obtained from: NETASQ MFC after: 1 week
|
#
207369 |
|
29-Apr-2010 |
bz |
MFP4: @176978-176982, 176984, 176990-176994, 177441
"Whitspace" churn after the VIMAGE/VNET whirls.
Remove the need for some "init" functions within the network stack, like pim6_init(), icmp_init() or significantly shorten others like ip6_init() and nd6_init(), using static initialization again where possible and formerly missed.
Move (most) variables back to the place they used to be before the container structs and VIMAGE_GLOABLS (before r185088) and try to reduce the diff to stable/7 and earlier as good as possible, to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9.
This also removes some header file pollution for putatively static global variables.
Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are no longer needed.
Reviewed by: jhb Discussed with: rwatson Sponsored by: The FreeBSD Foundation Sponsored by: CK Software GmbH MFC after: 6 days
|
#
206659 |
|
15-Apr-2010 |
vanhu |
Locks SPTREE when setting some SP entries to state DEAD. This can prevent kernel panics when updating SPs while there is some traffic for them.
Obtained from: NETASQ MFC after: 1m
|
#
205789 |
|
28-Mar-2010 |
bz |
When tearing down IPsec as part of a (virtual) network stack, do not try to free the same list twice but free both the acquiring list and the security policy acquiring list.
Reviewed by: anchie MFC after: 3 days
|
#
199398 |
|
17-Nov-2009 |
vanhu |
fixed two race conditions when inserting/removing SAs via PFKey, which can both lead to a kernel panic when adding/removing quickly a lot of SAs.
Obtained from: NETASQ MFC after: 2w (MFC on 8 before 8.0 release ???)
|
#
197250 |
|
16-Sep-2009 |
vanhu |
When checking traffic endpoint's adresses families in key_spdadd(), compare them together instead of comparing each one with respective tunnel endpoint.
PR: kern/138439 Submitted by: aurelien.ansel@netasq.com Obtained from: NETASQ MFC after: 1 m
|
#
196902 |
|
06-Sep-2009 |
pjd |
Silent gcc? Yeah, you wish. What I ment was to silence gcc.
Spotted by: julian
|
#
196896 |
|
06-Sep-2009 |
pjd |
Initialize state_valid and arraysize variable so gcc won't complain.
Reported by: bz
|
#
196883 |
|
06-Sep-2009 |
pjd |
Improve code a bit by eliminating goto and having one unlock per lock.
|
#
196019 |
|
01-Aug-2009 |
rwatson |
Merge the remainder of kern_vimage.c and vimage.h into vnet.c and vnet.h, we now use jails (rather than vimages) as the abstraction for virtualization management, and what remained was specific to virtual network stacks. Minor cleanups are done in the process, and comments updated to reflect these changes.
Reviewed by: bz Approved by: re (vimage blanket)
|
#
195760 |
|
19-Jul-2009 |
rwatson |
Reimplement and/or implement vnet list locking by replacing a mostly unused custom mutex/condvar-based sleep locks with two locks: an rwlock (for non-sleeping use) and sxlock (for sleeping use). Either acquired for read is sufficient to stabilize the vnet list, but both must be acquired for write to modify the list.
Replace previous no-op read locking macros, used in various places in the stack, with actual locking to prevent race conditions. Callers must declare when they may perform unbounded sleeps or not when selecting how to lock.
Refactor vnet sysinits so that the vnet list and locks are initialized before kernel modules are linked, as the kernel linker will use them for modules loaded by the boot loader.
Update various consumers of these KPIs based on whether they may sleep or not.
Reviewed by: bz Approved by: re (kib)
|
#
195727 |
|
16-Jul-2009 |
rwatson |
Remove unused VNET_SET() and related macros; only VNET_GET() is ever actually used. Rename VNET_GET() to VNET() to shorten variable references.
Discussed with: bz, julian Reviewed by: bz Approved by: re (kensmith, kib)
|
#
195699 |
|
14-Jul-2009 |
rwatson |
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator (DPCPU), as suggested by Peter Wemm, and implement a new per-virtual network stack memory allocator. Modify vnet to use the allocator instead of monolithic global container structures (vinet, ...). This change solves many binary compatibility problems associated with VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also once per virtual network stack. Virtualized global variables are tagged at compile-time, placing the in a special linker set, which is loaded into a contiguous region of kernel memory. Virtualized global variables in the base kernel are linked as normal, but those in modules are copied and relocated to a reserved portion of the kernel's vnet region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the network stack instance is created, and are initialized statically from the reference copy. Run-time access occurs via an accessor macro, which converts from the current vnet and requested symbol to a per-vnet address. When "options VIMAGE" is not compiled into the kernel, normal global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global variables, restores support for non-global symbols and types, eliminates the need for many subsystem constructors, eliminates large per-subsystem structures that caused many binary compatibility issues both for monitoring applications (netstat) and kernel modules, removes the per-function INIT_VNET_*() macros throughout the stack, eliminates the need for vnet_symmap ksym(2) munging, and eliminates duplicate definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz Reviewed by: bz, zec Discussed with: gnn, jamie, jeff, jhb, julian, sam Suggested by: peter Approved by: re (kensmith)
|
#
194971 |
|
25-Jun-2009 |
rwatson |
Add address list locking for in6_ifaddrhead/ia_link: as with locking for in_ifaddrhead, we stick with an rwlock for the time being, which we will revisit in the future with a possible move to rmlocks.
Some pieces of code require significant further reworking to be safe from all classes of writer-writer races.
Reviewed by: bz MFC after: 6 weeks
|
#
194951 |
|
25-Jun-2009 |
rwatson |
Add a new global rwlock, in_ifaddr_lock, which will synchronize use of the in_ifaddrhead and INADDR_HASH address lists.
Previously, these lists were used unsynchronized as they were effectively never changed in steady state, but we've seen increasing reports of writer-writer races on very busy VPN servers as core count has gone up (and similar configurations where address lists change frequently and concurrently).
For the time being, use rwlocks rather than rmlocks in order to take advantage of their better lock debugging support. As a result, we don't enable ip_input()'s read-locking of INADDR_HASH until an rmlock conversion is complete and a performance analysis has been done. This means that one class of reader-writer races still exists.
MFC after: 6 weeks Reviewed by: bz
|
#
194907 |
|
24-Jun-2009 |
rwatson |
Convert netinet6 to using queue(9) rather than hand-crafted linked lists for the global IPv6 address list (in6_ifaddr -> in6_ifaddrhead). Adopt the code styles and conventions present in netinet where possible.
Reviewed by: gnn, bz MFC after: 6 weeks (possibly not MFCable?)
|
#
194513 |
|
19-Jun-2009 |
bz |
Move setting of ports from NAT-T below key_getsah() and actually below key_setsaval(). Without that, the lookup for the SA had failed as we were looking for a SA with the new, updated port numbers instead of the old ones and were comparing the ports in key_cmpsaidx(). This makes updating the remote -> local SA on the initiator work again.
Problem introduced with: p4 changeset 152114
|
#
194062 |
|
12-Jun-2009 |
vanhu |
Added support for NAT-Traversal (RFC 3948) in IPsec stack.
Thanks to (no special order) Emmanuel Dreyfus (manu@netbsd.org), Larry Baird (lab@gta.com), gnn, bz, and other FreeBSD devs, Julien Vanherzeele (julien.vanherzeele@netasq.com, for years of bug reporting), the PFSense team, and all people who used / tried the NAT-T patch for years and reported bugs, patches, etc...
X-MFC: never
Reviewed by: bz Approved by: gnn(mentor) Obtained from: NETASQ
|
#
193731 |
|
08-Jun-2009 |
zec |
Introduce an infrastructure for dismantling vnet instances.
Vnet modules and protocol domains may now register destructor functions to clean up and release per-module state. The destructor mechanisms can be triggered by invoking "vimage -d", or a future equivalent command which will be provided via the new jail framework.
While this patch introduces numerous placeholder destructor functions, many of those are currently incomplete, thus leaking memory or (even worse) failing to stop all running timers. Many of such issues are already known and will be incrementaly fixed over the next weeks in smaller incremental commits.
Apart from introducing new fields in structs ifnet, domain, protosw and vnet_net, which requires the kernel and modules to be rebuilt, this change should have no impact on nooptions VIMAGE builds, since vnet destructors can only be called in VIMAGE kernels. Moreover, destructor functions should be in general compiled in only in options VIMAGE builds, except for kernel modules which can be safely kldunloaded at run time.
Bump __FreeBSD_version to 800097. Reviewed by: bz, julian Approved by: rwatson, kib (re), julian (mentor)
|
#
192882 |
|
27-May-2009 |
vanhu |
Lock SPTREE before parsing it in key_spddump()
Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 2 weeks
|
#
192880 |
|
27-May-2009 |
vanhu |
Only decrease refcnt once when flushing SPD entries, to avoid flushing entries which are still used.
Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
|
#
191663 |
|
29-Apr-2009 |
bms |
Stub out IN6_LOOKUP_MULTI() for GETSPI requests, for now.
This has the effect that IPv6 multicast traffic won't trigger an SPI allocation when IPSEC is in use, however, this obviously needs to stomp on locks, and IN6_LOOKUP_MULTI() is about to go away.
This definitely needs to be revisited before 8.x is branched as a release branch.
|
#
191599 |
|
27-Apr-2009 |
bz |
key_gettunnel() has been unsued with FAST_IPSEC (now IPSEC). KAME had explicit checks at one point using it, so just hide it behind #if 0 for now until we are sure if we can completely dump it or not.
MFC after: 1 month
|
#
190787 |
|
06-Apr-2009 |
zec |
First pass at separating per-vnet initializer functions from existing functions for initializing global state.
At this stage, the new per-vnet initializer functions are directly called from the existing global initialization code, which should in most cases result in compiler inlining those new functions, hence yielding a near-zero functional change.
Modify the existing initializer functions which are invoked via protosw, like ip_init() et. al., to allow them to be invoked multiple times, i.e. per each vnet. Global state, if any, is initialized only if such functions are called within the context of vnet0, which will be determined via the IS_DEFAULT_VNET(curvnet) check (currently always true).
While here, V_irtualize a few remaining global UMA zones used by net/netinet/netipsec networking code. While it is not yet clear to me or anybody else whether this is the right thing to do, at this stage this makes the code more readable, and makes it easier to track uncollected UMA-zone-backed objects on vnet removal. In the long run, it's quite possible that some form of shared use of UMA zone pools among multiple vnets should be considered.
Bump __FreeBSD_version due to changes in layout of structs vnet_ipfw, vnet_inet and vnet_net.
Approved by: julian (mentor)
|
#
190323 |
|
23-Mar-2009 |
vanhu |
Fixed comments so it stays in 80 chars by line with hard tabs of 8 chars....
Approved by: gnn(mentor)
|
#
190138 |
|
20-Mar-2009 |
vanhu |
Spelling fix in a comment
Approved by: gnn(mentor)
|
#
190075 |
|
19-Mar-2009 |
vanhu |
Fixed style for some comments
Approved by: gnn(mentor)
|
#
190071 |
|
19-Mar-2009 |
vanhu |
Fixed style for some comments
Approved by: gnn(mentor)
|
#
189962 |
|
18-Mar-2009 |
vanhu |
Fixed deletion of sav entries in key_delsah()
Approved by: gnn(mentor) Obtained from: NETASQ MFC after: 1 month
|
#
189406 |
|
05-Mar-2009 |
vanhu |
SAs are valid (but dying) when they reached soft lifetime, even if they have never been used.
Approved by: gnn(mentor) MFC after: 2 weeks
|
#
189004 |
|
24-Feb-2009 |
rdivacky |
Change the functions to ANSI in those cases where it breaks promotion to int rule. See ISO C Standard: SS6.7.5.3:15.
Approved by: kib (mentor) Reviewed by: warner Tested by: silence on -current
|
#
186141 |
|
15-Dec-2008 |
bz |
Another step assimilating IPv[46] PCB code - directly use the inpcb names rather than the following IPv6 compat macros: in6pcb,in6p_sp, in6p_ip6_nxt,in6p_flowinfo,in6p_vflag, in6p_flags,in6p_socket,in6p_lport,in6p_fport,in6p_ppcb and sotoin6pcb().
Apart from removing duplicate code in netipsec, this is a pure whitespace, not a functional change.
Discussed with: rwatson Reviewed by: rwatson (version before review requested changes) MFC after: 4 weeks (set the timer and see then)
|
#
185571 |
|
02-Dec-2008 |
bz |
Rather than using hidden includes (with cicular dependencies), directly include only the header files needed. This reduces the unneeded spamming of various headers into lots of files.
For now, this leaves us with very few modules including vnet.h and thus needing to depend on opt_route.h.
Reviewed by: brooks, gnn, des, zec, imp Sponsored by: The FreeBSD Foundation
|
#
185348 |
|
26-Nov-2008 |
zec |
Merge more of currently non-functional (i.e. resolving to whitespace) macros from p4/vimage branch.
Do a better job at enclosing all instantiations of globals scheduled for virtualization in #ifdef VIMAGE_GLOBALS blocks.
De-virtualize and mark as const saorder_state_alive and saorder_state_any arrays from ipsec code, given that they are never updated at runtime, so virtualizing them would be pointless.
Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
|
#
185088 |
|
19-Nov-2008 |
zec |
Change the initialization methodology for global variables scheduled for virtualization.
Instead of initializing the affected global variables at instatiation, assign initial values to them in initializer functions. As a rule, initialization at instatiation for such variables should never be introduced again from now on. Furthermore, enclose all instantiations of such global variables in #ifdef VIMAGE_GLOBALS blocks.
Essentialy, this change should have zero functional impact. In the next phase of merging network stack virtualization infrastructure from p4/vimage branch, the new initialization methology will allow us to switch between using global variables and their counterparts residing in virtualization containers with minimum code churn, and in the long run allow us to intialize multiple instances of such container structures.
Discussed at: devsummit Strassburg Reviewed by: bz, julian Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
|
#
183550 |
|
02-Oct-2008 |
zec |
Step 1.5 of importing the network stack virtualization infrastructure from the vimage project, as per plan established at devsummit 08/08: http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator macros, and CURVNET_SET() context setting macros, all currently resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a family of SYSCTL_V_*() macros, currently resolving to their global counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header files specific to virtualized subsystems (sys/net/vnet.h, sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this point in time by doing MD5 comparision between pre- and post-change object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec Reviewed by: julian, bz, brooks, kris, rwatson, ... Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation
|
#
181803 |
|
17-Aug-2008 |
bz |
Commit step 1 of the vimage project, (network stack) virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course of the next few weeks.
Mark all uses of global variables to be virtualized with a V_ prefix. Use macros to map them back to their global names for now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/... Reviewed by: brooks, des, ed, mav, julian, jamie, kris, rwatson, zec, ... (various people I forgot, different versions) md5 (with a bit of help) Sponsored by: NLnet Foundation, The FreeBSD Foundation X-MFC after: never V_Commit_Message_Reviewed_By: more people than the patch
|
#
181330 |
|
05-Aug-2008 |
vanhu |
Add lifetime informations to generated SPD entries when SPDDUMP
Approved by: gnn (mentor) MFC after: 4 weeks
|
#
180086 |
|
29-Jun-2008 |
julian |
Enter the 1990s. Use real function declaration.
|
#
177554 |
|
24-Mar-2008 |
bz |
Fix a bug that when getting/dumping the soft lifetime we reported the hard lifetime instead.
MFC after: 3 days
|
#
177553 |
|
24-Mar-2008 |
bz |
Import change from KAME, rev. 1.362 kame/kame/sys/netkey/key.c
In case of "new SA", we must check the hard lifetime of the old SA to find out if it is not permanent and we can delete it.
Submitted by: sakane via gnn MFC after: 3 days
|
#
177173 |
|
14-Mar-2008 |
bz |
Remove the "Fast " from the "Fast IPsec: Initialized Security Association Processing." printf. People kept asking questions about this after the IPsec shuffle.
This still is the Fast IPsec implementation so no worries that it would be any slower now. There are no functional changes.
Discussed with: sam MFC after: 4 days
|
#
176743 |
|
02-Mar-2008 |
bz |
Fix bugs when allocating and passing information of current lifetime and soft lifetime [1] introduced in rev. 1.21 of key.c.
Along with that, fix a related problem in key_debug printing the correct data. While there replace a printf by panic in a sanity check.
PR: 120751 Submitted by: Kazuaki ODA (kazuaki aliceblue.jp) [1] MFC after: 5 days
|
#
171133 |
|
01-Jul-2007 |
gnn |
Commit IPv6 support for FAST_IPSEC to the tree. This commit includes only the kernel files, the rest of the files will follow in a second commit.
Reviewed by: bz Approved by: re Supported by: Secure Computing
|
#
170823 |
|
16-Jun-2007 |
bz |
'spi' and the return value of ntohl are unsigned. Remove the extra >=0 check which was always true. Document the special meaning of spi values of 0 and 1-255 with a comment.
Found with: Coverity Prevent(tm) CID: 2047
|
#
170805 |
|
16-Jun-2007 |
bz |
In case of failure we can directly return ENOBUFS because 'result' is still NULL and we do not need to free anything. That allows us to gc the entire goto parts and a now unused variable.
Found with: Coverity Prevent(tm) CID: 2519
|
#
170803 |
|
15-Jun-2007 |
bz |
Add a missing return so that we drop out in case of an error and do not continue with a NULL pointer. [1]
While here change the return of the error handling code path above. I cannot see why we should always return 0 there. Neither does KAME nor do we in here for the similar check in all the other functions.
Found with: Coverity Prevent(tm) [1] CID: 2521
|
#
170799 |
|
15-Jun-2007 |
bz |
With the current code 'src' is never NULL. Nevertheless move the check for NULL before dereferencing the pointer.
Found with: Coverity Prevent(tm) CID: 2528
|
#
170120 |
|
29-May-2007 |
bz |
Add missing break; so when comparing AF_INET6 addresses, scope and ports we do not run into the default case and return 'no match' instead of 'match'.
|
#
158767 |
|
20-May-2006 |
pjd |
Prevent disappearing SAD entries by implementing MPsafe refcounting. "Why didn't he use SECASVAR_LOCK()/SECASVAR_UNLOCK() macros to synchronize access to the secasvar structure's fields?" one may ask. There were two reasons: 1. refcount(9) is faster then mutex(9) synchronization (one atomic operation instead of two). 2. Those macros are not used now at all, so at some point we may decide to remove them entirely.
OK'ed by: gnn MFC after: 2 weeks
|
#
157123 |
|
25-Mar-2006 |
gnn |
First steps towards IPSec cleanup.
Make the kernel side of FAST_IPSEC not depend on the shared structures defined in /usr/include/net/pfkeyv2.h The kernel now defines all the necessary in kernel structures in sys/netipsec/keydb.h and does the proper massaging when moving messages around.
Sponsored By: Secure Computing
|
#
139823 |
|
07-Jan-2005 |
imp |
/* -> /*- for license, minor formatting changes
|
#
136041 |
|
02-Oct-2004 |
sam |
Remove extraneous SECPOLICY_LOCK_DESTROY calls that cause the mutex to be destroyed twice.
Submitted by: Roselyn Lee
|
#
135947 |
|
30-Sep-2004 |
sam |
Add missing locking for secpolicy refcnt manipulations.
Submitted by: Roselyn Lee
|
#
135801 |
|
26-Sep-2004 |
sam |
Correct handling of SADB_UPDATE and SADB_ADD requests. key_align may split the mbuf due to use of m_pulldown. Discarding the result because of this does not make sense as no subsequent code depends on the entire msg being linearized (only the individual pieces). It's likely something else is wrong here but for now this appears to get things back to a working state.
Submitted by: Roselyn Lee
|
#
130928 |
|
22-Jun-2004 |
bms |
Fix a paste-o in key_cmpspidx_withmask().
PR: misc/67013 Submitted by: Zhenmin <zli4@cs.uiuc.edu>
|
#
128860 |
|
03-May-2004 |
sam |
use correct address for SADB_EXT_ADDRESS_DST in key_do_allocsa_policy (was using src instead of dst)
Submitted by: Bjoern A. Zeeb Obtained from: KAME MFC after: 1 day
|
#
128859 |
|
03-May-2004 |
sam |
correct behaviour of key_getsavbyspi broken in rev 1.7; corrects problems with removing specific SPIs
Submitted by: Bjoern A. Zeeb
|
#
128856 |
|
03-May-2004 |
sam |
add support to prefer old SA to new SA during allocation (makes net.key.preferred_oldsa work as for KAME)
Submitted by: gabor@sentex.net Reviewed by: Bjoern A. Zeeb MFC after: 1 day
|
#
127972 |
|
07-Apr-2004 |
pjd |
Unbreak FAST_IPSEC build on 64 bit archs with INVARIANTS.
Approved by: sam
|
#
125876 |
|
16-Feb-2004 |
guido |
Fix type in a sysctl. It used to be: net.key.prefered_oldsa and is corrected to net.key.preferred_oldsa This makes it consistent with the KAME IPsec implementation.
Approved by: sam
|
#
125680 |
|
11-Feb-2004 |
bms |
Initial import of RFC 2385 (TCP-MD5) digest support.
This is the first of two commits; bringing in the kernel support first. This can be enabled by compiling a kernel with options TCP_SIGNATURE and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of authenticating TCP sessions which came into being before IPSEC. It is still relevant today, however, as it is used by many commercial router vendors, particularly with BGP, and as such has become a requirement for interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload, are digested with MD5, including a shared secret. The PF_KEY interface is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow per-port back to an SPI without polluting tcpcb or using the SPD; the code to do the latter is unstable at this time. Therefore this code only supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6), TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when responding to a host initiating a TCP session, but no effort is made [yet] to authenticate inbound traffic. This is, however, sufficient to interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with local patches. Patches for tcpdump to validate TCP-MD5 sessions are also available from me upon request.
Sponsored by: sentex.net
|
#
125508 |
|
05-Feb-2004 |
sam |
must convert protocol to sa type when preparing a DELETE message
Submitted by: Roselyn Lee <rosel@verniernetworks.com> MFC after: 1 week
|
#
120585 |
|
29-Sep-2003 |
sam |
MFp4: portability work, general cleanup, locking fixes
change 38496 o add ipsec_osdep.h that holds os-specific definitions for portability o s/KASSERT/IPSEC_ASSERT/ for portability o s/SPLASSERT/IPSEC_SPLASSERT/ for portability o remove function names from ASSERT strings since line#+file pinpints the location o use __func__ uniformly to reduce string storage o convert some random #ifdef DIAGNOSTIC code to assertions o remove some debuggging assertions no longer needed
change 38498 o replace numerous bogus panic's with equally bogus assertions that at least go away on a production system
change 38502 + 38530 o change explicit mtx operations to #defines to simplify future changes to a different lock type
change 38531 o hookup ipv4 ctlinput paths to a noop routine; we should be handling path mtu changes at least o correct potential null pointer deref in ipsec4_common_input_cb
chnage 38685 o fix locking for bundled SA's and for when key exchange is required
change 38770 o eliminate recursion on the SAHTREE lock
change 38804 o cleanup some types: long -> time_t o remove refrence to dead #define
change 38805 o correct some types: long -> time_t o add scan generation # to secpolicy to deal with locking issues
change 38806 o use LIST_FOREACH_SAFE instead of handrolled code o change key_flush_spd to drop the sptree lock before purging an entry to avoid lock recursion and to avoid holding the lock over a long-running operation o misc cleanups of tangled and twisty code
There is still much to do here but for now things look to be working again.
Supported by: FreeBSD Foundation
|
#
119643 |
|
01-Sep-2003 |
sam |
Locking and misc cleanups; most of which I've been running for >4 months:
o add locking o strip irrelevant spl's o split malloc types to better account for memory use o remove unused IPSEC_NONBLOCK_ACQUIRE code o remove dead code
Sponsored by: FreeBSD Foundation
|
#
117051 |
|
29-Jun-2003 |
sam |
plug xform memory leaks:
o add missing zeroize op when deleting an SA o don't re-initialize an xform for an SA that already has one
Submitted by: Doug Ambrisko <ambrisko@verniernetworks.com> MFC after: 1 day
|
#
111119 |
|
19-Feb-2003 |
imp |
Back out M_* changes, per decision of the TRB.
Approved by: trb
|
#
110403 |
|
05-Feb-2003 |
ache |
Comment out srandom(): 1) Already called in init_main.c:proc0_post() 2) Seed is bad
|
#
109623 |
|
21-Jan-2003 |
alfred |
Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0. Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
|
#
108533 |
|
01-Jan-2003 |
schweikh |
Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup, especially in troff files.
|
#
105197 |
|
16-Oct-2002 |
sam |
"Fast IPsec": this is an experimental IPsec implementation that is derived from the KAME IPsec implementation, but with heavy borrowing and influence of openbsd. A key feature of this implementation is that it uses the kernel crypto framework to do all crypto work so when h/w crypto support is present IPsec operation is automatically accelerated. Otherwise the protocol implementations are rather differet while the SADB and policy management code is very similar to KAME (for the moment).
Note that this implementation is enabled with a FAST_IPSEC option. With this you get all protocols; i.e. there is no FAST_IPSEC_ESP option.
FAST_IPSEC and IPSEC are mutually exclusive; you cannot build both into a single system.
This software is well tested with IPv4 but should be considered very experimental (i.e. do not deploy in production environments). This software does NOT currently support IPv6. In fact do not configure FAST_IPSEC and INET6 in the same system.
Obtained from: KAME + openbsd Supported by: Vernier Networks
|