s/assocciation/association/ in comment.

Remove extra long file paths from the headers.

Added a lookup table to find an sav quickly

key_sad.sahlists doesn't work well for inbound packets because
its key includes source address. For the reason, the
look-up-table for the inbound packets is newly added.
The table has all sav whose state is MATURE or DYING and uses a
key calculated by destination address, protocol, and spi instead
of saidx.

reviewd ozaki-r@n.o, thanks.

branches: 1.21.2;
Avoid data races on lifetime counters by using percpu(9)

We don't make them percpu(9) directly because the structure is exposed to
userland and we don't want to break ABI. So we add another member variable
for percpu(9) and use it internally. When we export them to userland, they
are converted to the original format.

MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.

MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

branches: 1.15.2;
Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

Remove extra long file paths from the headers.

Added a lookup table to find an sav quickly

key_sad.sahlists doesn't work well for inbound packets because
its key includes source address. For the reason, the
look-up-table for the inbound packets is newly added.
The table has all sav whose state is MATURE or DYING and uses a
key calculated by destination address, protocol, and spi instead
of saidx.

reviewd ozaki-r@n.o, thanks.

branches: 1.21.2;
Avoid data races on lifetime counters by using percpu(9)

We don't make them percpu(9) directly because the structure is exposed to
userland and we don't want to break ABI. So we add another member variable
for percpu(9) and use it internally. When we export them to userland, they
are converted to the original format.

MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.

MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

branches: 1.15.2;
Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.

MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

Use pslist(9) for sah->savtree

Use pslist(9) for sahtree

Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

branches: 1.14.8;
Tidy up opt_ipsec.h inclusions

Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary.
Add inclusions to some C files for IPSEC_DEBUG.

branches: 1.13.10;
PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

branches: 1.12.2;
g/c unused struct member

protect "union sockaddr_union" from being defined twice by a CPP symbol
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf

branches: 1.10.4; 1.10.8;
g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

use time_t rather than long for timestamps

more "const"

branches: 1.7.2; 1.7.4;
trivial comment typo

branches: 1.6.32; 1.6.54; 1.6.56;
Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

branches: 1.4.2; 1.4.4;
Fix fallout from caddr_t changes

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.2.26;
Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

branches: 1.1.4; 1.1.18;
Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source. For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.