The NetBSD Project

CVS log for src/sys/net/pfkeyv2.h

[BACK] Up to [cvs.NetBSD.org] / src / sys / net

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.34.2.1 / (download) - annotate - [select for diffs], Wed Jan 4 12:17:08 2023 UTC (4 weeks, 1 day ago) by martin
Branch: netbsd-10
Changes since 1.34: +2 -1 lines
Diff to previous 1.34 (colored) next main 1.35 (colored)

Pull up following revision(s) (requested by knakahara in ticket #36):

	sys/net/pfkeyv2.h: revision 1.35

Fix libreswan build failure.  Pointed out by Andrew Cagney, thanks.

Revision 1.35 / (download) - annotate - [select for diffs], Wed Jan 4 01:58:33 2023 UTC (4 weeks, 2 days ago) by knakahara
Branch: MAIN
CVS Tags: HEAD
Changes since 1.34: +2 -1 lines
Diff to previous 1.34 (colored)

Fix libreswan build failure.  Pointed out by Andrew Cagney, thanks.

Revision 1.34 / (download) - annotate - [select for diffs], Tue Oct 11 09:51:47 2022 UTC (3 months, 3 weeks ago) by knakahara
Branch: MAIN
CVS Tags: netbsd-10-base
Branch point for: netbsd-10
Changes since 1.33: +3 -2 lines
Diff to previous 1.33 (colored)

Add sadb_x_policy_flags to inform SP origination.

This extension(struct sadb_x_policy) is *not* defined by RFC2367.

OpenBSD does not have reserved fields in struct sadb_x_policy.
Linux does not use this field yet.
FreeBSD uses this field as "sadb_x_policy_scope"; the value range is
from 0x00 to 0x04.

We use from most significant bit to avoid the above usage.

Revision 1.33 / (download) - annotate - [select for diffs], Sat Apr 16 18:15:22 2022 UTC (9 months, 2 weeks ago) by andvar
Branch: MAIN
CVS Tags: bouyer-sunxi-drm-base, bouyer-sunxi-drm
Changes since 1.32: +2 -2 lines
Diff to previous 1.32 (colored)

fix various typos in comments and log messages.

Revision 1.30.12.1 / (download) - annotate - [select for diffs], Sun Dec 3 11:39:02 2017 UTC (5 years, 2 months ago) by jdolecek
Branch: tls-maxphys
Changes since 1.30: +101 -1 lines
Diff to previous 1.30 (colored) next main 1.31 (colored)

update from HEAD

Revision 1.31.4.1 / (download) - annotate - [select for diffs], Sat Oct 21 19:43:54 2017 UTC (5 years, 3 months ago) by snj
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, matt-nb8-mediatek-base, matt-nb8-mediatek
Changes since 1.31: +4 -1 lines
Diff to previous 1.31 (colored) next main 1.32 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #300):
	crypto/dist/ipsec-tools/src/setkey/parse.y: 1.19
	crypto/dist/ipsec-tools/src/setkey/token.l: 1.20
	distrib/sets/lists/tests/mi: 1.754, 1.757, 1.759
	doc/TODO.smpnet: 1.12-1.13
	sys/net/pfkeyv2.h: 1.32
	sys/net/raw_cb.c: 1.23-1.24, 1.28
	sys/net/raw_cb.h: 1.28
	sys/net/raw_usrreq.c: 1.57-1.58
	sys/net/rtsock.c: 1.228-1.229
	sys/netinet/in_proto.c: 1.125
	sys/netinet/ip_input.c: 1.359-1.361
	sys/netinet/tcp_input.c: 1.359-1.360
	sys/netinet/tcp_output.c: 1.197
	sys/netinet/tcp_var.h: 1.178
	sys/netinet6/icmp6.c: 1.213
	sys/netinet6/in6_proto.c: 1.119
	sys/netinet6/ip6_forward.c: 1.88
	sys/netinet6/ip6_input.c: 1.181-1.182
	sys/netinet6/ip6_output.c: 1.193
	sys/netinet6/ip6protosw.h: 1.26
	sys/netipsec/ipsec.c: 1.100-1.122
	sys/netipsec/ipsec.h: 1.51-1.61
	sys/netipsec/ipsec6.h: 1.18-1.20
	sys/netipsec/ipsec_input.c: 1.44-1.51
	sys/netipsec/ipsec_netbsd.c: 1.41-1.45
	sys/netipsec/ipsec_output.c: 1.49-1.64
	sys/netipsec/ipsec_private.h: 1.5
	sys/netipsec/key.c: 1.164-1.234
	sys/netipsec/key.h: 1.20-1.32
	sys/netipsec/key_debug.c: 1.18-1.21
	sys/netipsec/key_debug.h: 1.9
	sys/netipsec/keydb.h: 1.16-1.20
	sys/netipsec/keysock.c: 1.59-1.62
	sys/netipsec/keysock.h: 1.10
	sys/netipsec/xform.h: 1.9-1.12
	sys/netipsec/xform_ah.c: 1.55-1.74
	sys/netipsec/xform_esp.c: 1.56-1.72
	sys/netipsec/xform_ipcomp.c: 1.39-1.53
	sys/netipsec/xform_ipip.c: 1.50-1.54
	sys/netipsec/xform_tcp.c: 1.12-1.16
	sys/rump/librump/rumpkern/Makefile.rumpkern: 1.170
	sys/rump/librump/rumpnet/net_stub.c: 1.27
	sys/sys/protosw.h: 1.67-1.68
	tests/net/carp/t_basic.sh: 1.7
	tests/net/if_gif/t_gif.sh: 1.11
	tests/net/if_l2tp/t_l2tp.sh: 1.3
	tests/net/ipsec/Makefile: 1.7-1.9
	tests/net/ipsec/algorithms.sh: 1.5
	tests/net/ipsec/common.sh: 1.4-1.6
	tests/net/ipsec/t_ipsec_ah_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_esp_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_gif.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_l2tp.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_misc.sh: 1.8-1.18
	tests/net/ipsec/t_ipsec_sockopt.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tcp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_transport.sh: 1.5-1.6
	tests/net/ipsec/t_ipsec_tunnel.sh: 1.9
	tests/net/ipsec/t_ipsec_tunnel_ipcomp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tunnel_odd.sh: 1.3
	tests/net/mcast/t_mcast.sh: 1.6
	tests/net/net/t_ipaddress.sh: 1.11
	tests/net/net_common.sh: 1.20
	tests/net/npf/t_npf.sh: 1.3
	tests/net/route/t_flags.sh: 1.20
	tests/net/route/t_flags6.sh: 1.16
	usr.bin/netstat/fast_ipsec.c: 1.22
Do m_pullup before mtod

It may fix panicks of some tests on anita/sparc and anita/GuruPlug.
---
KNF
---
Enable DEBUG for babylon5
---
Apply C99-style struct initialization to xformsw
---
Tweak outputs of netstat -s for IPsec

- Get rid of "Fast"
- Use ipsec and ipsec6 for titles to clarify protocol
- Indent outputs of sub protocols

Original outputs were organized like this:

(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:
(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:

New outputs are organized like this:

ipsec:
	ah:
	esp:
	ipip:
	ipcomp:
ipsec6:
	ah:
	esp:
	ipip:
	ipcomp:
---
Add test cases for IPComp
---
Simplify IPSEC_OSTAT macro (NFC)
---
KNF; replace leading whitespaces with hard tabs
---
Introduce and use SADB_SASTATE_USABLE_P
---
KNF
---
Add update command for testing

Updating an SA (SADB_UPDATE) requires that a process issuing
SADB_UPDATE is the same as a process issued SADB_ADD (or SADB_GETSPI).
This means that update command must be used with add command in a
configuration of setkey. This usage is normally meaningless but
useful for testing (and debugging) purposes.
---
Add test cases for updating SA/SP

The tests require newly-added udpate command of setkey.
---
PR/52346: Frank Kardel: Fix checksumming for NAT-T
See XXX for improvements.
---
Remove codes for PACKET_TAG_IPSEC_IN_CRYPTO_DONE

It seems that PACKET_TAG_IPSEC_IN_CRYPTO_DONE is for network adapters
that have IPsec accelerators; a driver sets the mtag to a packet
when its device has already encrypted the packet.

Unfortunately no driver implements such offload features for long
years and seems unlikely to implement them soon. (Note that neither
FreeBSD nor Linux doesn't have such drivers.) Let's remove related
(unused) codes and simplify the IPsec code.
---
Fix usages of sadb_msg_errno
---
Avoid updating sav directly

On SADB_UPDATE a target sav was updated directly, which was unsafe.
Instead allocate another sav, copy variables of the old sav to
the new one and replace the old one with the new one.
---
Simplify; we can assume sav->tdb_xform cannot be NULL while it's valid
---
Rename key_alloc* functions (NFC)

We shouldn't use the term "alloc" for functions that just look up
data and actually don't allocate memory.
---
Use explicit_memset to surely zero-clear key_auth and key_enc
---
Make sure to clear keys on error paths of key_setsaval
---
Add missing KEY_FREESAV
---
Make sure a sav is inserted to a sah list after its initialization completes
---
Remove unnecessary zero-clearing codes from key_setsaval

key_setsaval is now used only for a newly-allocated sav. (It was
used to reset variables of an existing sav.)
---
Correct wrong assumption of sav->refcnt in key_delsah

A sav in a list is basically not to be sav->refcnt == 0. And also
KEY_FREESAV assumes sav->refcnt > 0.
---
Let key_getsavbyspi take a reference of a returning sav
---
Use time_mono_to_wall (NFC)
---
Separate sending message routine (NFC)
---
Simplify; remove unnecessary zero-clears

key_freesaval is used only when a target sav is being destroyed.
---
Omit NULL checks for sav->lft_c

sav->lft_c can be NULL only when initializing or destroying sav.
---
Omit unnecessary NULL checks for sav->sah
---
Omit unnecessary check of sav->state

key_allocsa_policy picks a sav of either MATURE or DYING so we
don't need to check its state again.
---
Simplify; omit unnecessary saidx passing

- ipsec_nextisr returns a saidx but no caller uses it
- key_checkrequest is passed a saidx but it can be gotton by
  another argument (isr)
---
Fix splx isn't called on some error paths
---
Fix header size calculation of esp where sav is NULL
---
Fix header size calculation of ah in the case sav is NULL

This fix was also needed for esp.
---
Pass sav directly to opencrypto callback

In a callback, use a passed sav as-is by default and look up a sav
only if the passed sav is dead.
---
Avoid examining freshness of sav on packet processing

If a sav list is sorted (by lft_c->sadb_lifetime_addtime) in advance,
we don't need to examine each sav and also don't need to delete one
on the fly and send up a message. Fortunately every sav lists are sorted
as we need.

Added key_validate_savlist validates that each sav list is surely sorted
(run only if DEBUG because it's not cheap).
---
Add test cases for SAs with different SPIs
---
Prepare to stop using isr->sav

isr is a shared resource and using isr->sav as a temporal storage
for each packet processing is racy. And also having a reference from
isr to sav makes the lifetime of sav non-deterministic; such a reference
is removed when a packet is processed and isr->sav is overwritten by
new one. Let's have a sav locally for each packet processing instead of
using shared isr->sav.

However this change doesn't stop using isr->sav yet because there are
some users of isr->sav. isr->sav will be removed after the users find
a way to not use isr->sav.
---
Fix wrong argument handling
---
fix printf format.
---
Don't validate sav lists of LARVAL or DEAD states

We don't sort the lists so the validation will always fail.

Fix PR kern/52405
---
Make sure to sort the list when changing the state by key_sa_chgstate
---
Rename key_allocsa_policy to key_lookup_sa_bysaidx
---
Separate test files
---
Calculate ah_max_authsize on initialization as well as esp_max_ivlen
---
Remove m_tag_find(PACKET_TAG_IPSEC_PENDING_TDB) because nobody sets the tag
---
Restore a comment removed in previous

The comment is valid for the below code.
---
Make tests more stable

sleep command seems to wait longer than expected on anita so
use polling to wait for a state change.
---
Add tests that explicitly delete SAs instead of waiting for expirations
---
Remove invalid M_AUTHIPDGM check on ESP isr->sav

M_AUTHIPDGM flag is set to a mbuf in ah_input_cb. An sav of ESP can
have AH authentication as sav->tdb_authalgxform. However, in that
case esp_input and esp_input_cb are used to do ESP decryption and
AH authentication and M_AUTHIPDGM never be set to a mbuf. So
checking M_AUTHIPDGM of a mbuf on isr->sav of ESP is meaningless.
---
Look up sav instead of relying on unstable sp->req->sav

This code is executed only in an error path so an additional lookup
doesn't matter.
---
Correct a comment
---
Don't release sav if calling crypto_dispatch again
---
Remove extra KEY_FREESAV from ipsec_process_done

It should be done by the caller.
---
Don't bother the case of crp->crp_buf == NULL in callbacks
---
Hold a reference to an SP during opencrypto processing

An SP has a list of isr (ipsecrequest) that represents a sequence
of IPsec encryption/authentication processing. One isr corresponds
to one opencrypto processing. The lifetime of an isr follows its SP.

We pass an isr to a callback function of opencrypto to continue
to a next encryption/authentication processing. However nobody
guaranteed that the isr wasn't freed, i.e., its SP wasn't destroyed.

In order to avoid such unexpected destruction of isr, hold a reference
to its SP during opencrypto processing.
---
Don't make SAs expired on tests that delete SAs explicitly
---
Fix a debug message
---
Dedup error paths (NFC)
---
Use pool to allocate tdb_crypto

For ESP and AH, we need to allocate an extra variable space in addition
to struct tdb_crypto. The fixed size of pool items may be larger than
an actual requisite size of a buffer, but still the performance
improvement by replacing malloc with pool wins.
---
Don't use unstable isr->sav for header size calculations

We may need to optimize to not look up sav here for users that
don't need to know an exact size of headers (e.g., TCP segmemt size
caclulation).
---
Don't use sp->req->sav when handling NAT-T ESP fragmentation

In order to do this we need to look up a sav however an additional
look-up degrades performance. A sav is later looked up in
ipsec4_process_packet so delay the fragmentation check until then
to avoid an extra look-up.
---
Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).
---
Stop setting isr->sav on looking up sav in key_checkrequest
---
Remove ipsecrequest#sav
---
Stop setting mtag of PACKET_TAG_IPSEC_IN_DONE because there is no users anymore
---
Skip ipsec_spi_*_*_preferred_new_timeout when running on qemu

Probably due to PR 43997
---
Add localcount to rump kernels
---
Remove unused macro
---
Fix key_getcomb_setlifetime

The fix adjusts a soft limit to be 80% of a corresponding hard limit.

I'm not sure the fix is really correct though, at least the original
code is wrong. A passed comb is zero-cleared before calling
key_getcomb_setlifetime, so
  comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
is meaningless.
---
Provide and apply key_sp_refcnt (NFC)

It simplifies further changes.
---
Fix indentation

Pointed out by knakahara@
---
Use pslist(9) for sptree
---
Don't acquire global locks for IPsec if NET_MPSAFE

Note that the change is just to make testing easy and IPsec isn't MP-safe yet.
---
Let PF_KEY socks hold their own lock instead of softnet_lock

Operations on SAD and SPD are executed via PF_KEY socks. The operations
include deletions of SAs and SPs that will use synchronization mechanisms
such as pserialize_perform to wait for references to SAs and SPs to be
released. It is known that using such mechanisms with holding softnet_lock
causes a dead lock. We should avoid the situation.
---
Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@
---
Fix updating ipsec_used

- key_update_used wasn't called in key_api_spddelete2 and key_api_spdflush
- key_update_used wasn't called if an SP had been added/deleted but
  a reply to userland failed
---
Fix updating ipsec_used; turn on when SPs on sockets are added
---
Add missing IPsec policy checks to icmp6_rip6_input

icmp6_rip6_input is quite similar to rip6_input and the same checks exist
in rip6_input.
---
Add test cases for setsockopt(IP_IPSEC_POLICY)
---
Don't use KEY_NEWSP for dummy SP entries

By the change KEY_NEWSP is now not called from softint anymore
and we can use kmem_zalloc with KM_SLEEP for KEY_NEWSP.
---
Comment out unused functions
---
Add test cases that there are SPs but no relevant SAs
---
Don't allow sav->lft_c to be NULL

lft_c of an sav that was created by SADB_GETSPI could be NULL.
---
Clean up clunky eval strings

- Remove unnecessary \ at EOL
  - This allows to omit ; too
- Remove unnecessary quotes for arguments of atf_set
- Don't expand $DEBUG in eval
  - We expect it's expanded on execution

Suggested by kre@
---
Remove unnecessary KEY_FREESAV in an error path

sav should be freed (unreferenced) by the caller.
---
Use pslist(9) for sahtree
---
Use pslist(9) for sah->savtree
---
Rename local variable newsah to sah

It may not be new.
---
MP-ify SAD slightly

- Introduce key_sa_mtx and use it for some list operations
- Use pserialize for some list iterations
---
Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never be actually freed in the future

KEY_SA_UNREF is still key_freesav so no functional change for now.

This change reduces diff of further changes.
---
Remove out-of-date log output

Pointed out by riastradh@
---
Use KDASSERT instead of KASSERT for mutex_ownable

Because mutex_ownable is too heavy to run in a fast path
even for DIAGNOSTIC + LOCKDEBUG.

Suggested by riastradh@
---
Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@
---
Move locking notes
---
Update the locking notes

- Add locking order
- Add locking notes for misc lists such as reglist
- Mention pserialize, key_sp_ref and key_sp_unref on SP operations

Requested by riastradh@
---
Describe constraints of key_sp_ref and key_sp_unref

Requested by riastradh@
---
Hold key_sad.lock on SAVLIST_WRITER_INSERT_TAIL
---
Add __read_mostly to key_psz

Suggested by riastradh@
---
Tweak wording (pserialize critical section => pserialize read section)

Suggested by riastradh@
---
Add missing mutex_exit
---
Fix setkey -D -P outputs

The outputs were tweaked (by me), but I forgot updating libipsec
in my local ATF environment...
---
MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.
---
Introduce key_sa_refcnt and replace sav->refcnt with it (NFC)
---
Destroy sav only in the loop for DEAD sav
---
Fix KASSERT(solocked(sb->sb_so)) failure in sbappendaddr that is called eventually from key_sendup_mbuf

If key_sendup_mbuf isn't passed a socket, the assertion fails.
Originally in this case sb->sb_so was softnet_lock and callers
held softnet_lock so the assertion was magically satisfied.
Now sb->sb_so is key_so_mtx and also softnet_lock isn't always
held by callers so the assertion can fail.

Fix it by holding key_so_mtx if key_sendup_mbuf isn't passed a socket.

Reported by knakahara@
Tested by knakahara@ and ozaki-r@
---
Fix locking notes of SAD
---
Fix deadlock between key_sendup_mbuf called from key_acquire and localcount_drain

If we call key_sendup_mbuf from key_acquire that is called on packet
processing, a deadlock can happen like this:
- At key_acquire, a reference to an SP (and an SA) is held
- key_sendup_mbuf will try to take key_so_mtx
- Some other thread may try to localcount_drain to the SP with
  holding key_so_mtx in say key_api_spdflush
- In this case localcount_drain never return because key_sendup_mbuf
  that has stuck on key_so_mtx never release a reference to the SP

Fix the deadlock by deferring key_sendup_mbuf to the timer
(key_timehandler).
---
Fix that prev isn't cleared on retry
---
Limit the number of mbufs queued for deferred key_sendup_mbuf

It's easy to be queued hundreds of mbufs on the list under heavy
network load.
---
MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.
---
Simplify ipsec_reinject_ipstack (NFC)
---
Add per-CPU rtcache to ipsec_reinject_ipstack

It reduces route lookups and also reduces rtcache lock contentions
when NET_MPSAFE is enabled.
---
Use pool_cache(9) instead of pool(9) for tdb_crypto objects

The change improves network throughput especially on multi-core systems.
---
Update

ipsec(4), opencrypto(9) and vlan(4) are now MP-safe.
---
Write known issues on scalability
---
Share a global dummy SP between PCBs

It's never be changed so it can be pre-allocated and shared safely between PCBs.
---
Fix race condition on the rawcb list shared by rtsock and keysock

keysock now protects itself by its own mutex, which means that
the rawcb list is protected by two different mutexes (keysock's one
and softnet_lock for rtsock), of course it's useless.

Fix the situation by having a discrete rawcb list for each.
---
Use a dedicated mutex for rt_rawcb instead of softnet_lock if NET_MPSAFE
---
fix localcount leak in sav. fixed by ozaki-r@n.o.

I commit on behalf of him.
---
remove unnecessary comment.
---
Fix deadlock between pserialize_perform and localcount_drain

A typical ussage of localcount_drain looks like this:

  mutex_enter(&mtx);
  item = remove_from_list();
  pserialize_perform(psz);
  localcount_drain(&item->localcount, &cv, &mtx);
  mutex_exit(&mtx);

This sequence can cause a deadlock which happens for example on the following
situation:

- Thread A calls localcount_drain which calls xc_broadcast after releasing
  a specified mutex
- Thread B enters the sequence and calls pserialize_perform with holding
  the mutex while pserialize_perform also calls xc_broadcast
- Thread C (xc_thread) that calls an xcall callback of localcount_drain tries
  to hold the mutex

xc_broadcast of thread B doesn't start until xc_broadcast of thread A
finishes, which is a feature of xcall(9). This means that pserialize_perform
never complete until xc_broadcast of thread A finishes. On the other hand,
thread C that is a callee of xc_broadcast of thread A sticks on the mutex.
Finally the threads block each other (A blocks B, B blocks C and C blocks A).

A possible fix is to serialize executions of the above sequence by another
mutex, but adding another mutex makes the code complex, so fix the deadlock
by another way; the fix is to release the mutex before pserialize_perform
and instead use a condvar to prevent pserialize_perform from being called
simultaneously.

Note that the deadlock has happened only if NET_MPSAFE is enabled.
---
Add missing ifdef NET_MPSAFE
---
Take softnet_lock on pr_input properly if NET_MPSAFE

Currently softnet_lock is taken unnecessarily in some cases, e.g.,
icmp_input and encap4_input from ip_input, or not taken even if needed,
e.g., udp_input and tcp_input from ipsec4_common_input_cb. Fix them.

NFC if NET_MPSAFE is disabled (default).
---
- sanitize key debugging so that we don't print extra newlines or unassociated
  debugging messages.
- remove unused functions and make internal ones static
- print information in one line per message
---
humanize printing of ip addresses
---
cast reduction, NFC.
---
Fix typo in comment
---
Pull out ipsec_fill_saidx_bymbuf (NFC)
---
Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.
---
Fix SP is broken on transport mode

isr->saidx was modified accidentally in ipsec_nextisr.

Reported by christos@
Helped investigations by christos@ and knakahara@
---
Constify isr at many places (NFC)
---
Include socketvar.h for softnet_lock
---
Fix buffer length for ipsec_logsastr

Revision 1.30.30.1 / (download) - annotate - [select for diffs], Mon Aug 28 17:53:11 2017 UTC (5 years, 5 months ago) by skrll
Branch: nick-nhusb
Changes since 1.30: +101 -1 lines
Diff to previous 1.30 (colored) next main 1.31 (colored)

Sync with HEAD

Revision 1.32 / (download) - annotate - [select for diffs], Tue Jul 4 08:11:32 2017 UTC (5 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202, thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, phil-wifi-base, phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, phil-wifi-20190609, phil-wifi, pgoyette-compat-merge-20190127, pgoyette-compat-base, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, pgoyette-compat, perseant-stdc-iso10646-base, perseant-stdc-iso10646, nick-nhusb-base-20170825, netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9, isaki-audio2-base, isaki-audio2, is-mlppp-base, is-mlppp, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Changes since 1.31: +4 -1 lines
Diff to previous 1.31 (colored)

Introduce and use SADB_SASTATE_USABLE_P

Revision 1.30.34.1 / (download) - annotate - [select for diffs], Wed Apr 26 02:53:29 2017 UTC (5 years, 9 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.30: +98 -1 lines
Diff to previous 1.30 (colored) next main 1.31 (colored)

Sync with HEAD

Revision 1.30.38.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:05 2017 UTC (5 years, 9 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.30: +98 -1 lines
Diff to previous 1.30 (colored) next main 1.31 (colored)

Sync with HEAD

Revision 1.31 / (download) - annotate - [select for diffs], Thu Apr 13 16:38:31 2017 UTC (5 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-20170426, netbsd-8-base, bouyer-socketcan-base1
Branch point for: netbsd-8
Changes since 1.30: +98 -1 lines
Diff to previous 1.30 (colored)

Redo the statistics through an indirection array and put the definitions
of the arrays in pfkeyv2.h so that they are next to the index definitions.
Remove "bogus" comment about compressing the statistics which is now fixed.

Revision 1.29.2.1 / (download) - annotate - [select for diffs], Thu Jun 23 14:20:25 2011 UTC (11 years, 7 months ago) by cherry
Branch: cherry-xenmp
Changes since 1.29: +4 -4 lines
Diff to previous 1.29 (colored) next main 1.30 (colored)

Catchup with rmind-uvmplock merge.

Revision 1.26.32.3 / (download) - annotate - [select for diffs], Sun Jun 12 00:24:30 2011 UTC (11 years, 7 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.26.32.2: +3 -3 lines
Diff to previous 1.26.32.2 (colored) to branchpoint 1.26 (colored) next main 1.27 (colored)

sync with head

Revision 1.30 / (download) - annotate - [select for diffs], Thu Jun 9 19:54:18 2011 UTC (11 years, 7 months ago) by drochner
Branch: MAIN
CVS Tags: yamt-pagecache-tag8, yamt-pagecache-base9, yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, yamt-pagecache-base5, yamt-pagecache-base4, yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, yamt-pagecache, tls-maxphys-base, tls-earlyentropy-base, tls-earlyentropy, rmind-uvmplock-nbase, rmind-uvmplock-base, rmind-smpnet-nbase, rmind-smpnet-base, rmind-smpnet, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2, pgoyette-localcount-base, pgoyette-localcount-20170320, pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20170204, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, netbsd-6, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, localcount-20160914, khorben-n900, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3, jmcneill-usbmp-base2, jmcneill-usbmp-base10, jmcneill-usbmp-base, jmcneill-usbmp, jmcneill-audiomp3-base, jmcneill-audiomp3, jdolecek-ncq-base, jdolecek-ncq, bouyer-socketcan-base, agc-symver-base, agc-symver
Branch point for: tls-maxphys, pgoyette-localcount, nick-nhusb, bouyer-socketcan
Changes since 1.29: +4 -4 lines
Diff to previous 1.29 (colored)

more "const"

Revision 1.27.2.1 / (download) - annotate - [select for diffs], Mon Jun 6 09:09:53 2011 UTC (11 years, 8 months ago) by jruoho
Branch: jruoho-x86intr
Changes since 1.27: +11 -3 lines
Diff to previous 1.27 (colored) next main 1.28 (colored)

Sync with HEAD.

Revision 1.26.32.2 / (download) - annotate - [select for diffs], Tue May 31 03:05:06 2011 UTC (11 years, 8 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.26.32.1: +10 -2 lines
Diff to previous 1.26.32.1 (colored) to branchpoint 1.26 (colored)

sync with head

Revision 1.29 / (download) - annotate - [select for diffs], Thu May 26 21:50:02 2011 UTC (11 years, 8 months ago) by drochner
Branch: MAIN
CVS Tags: cherry-xenmp-base
Branch point for: cherry-xenmp
Changes since 1.28: +11 -5 lines
Diff to previous 1.28 (colored)

pull in AES-GCM/GMAC support from OpenBSD
This is still somewhat experimental. Tested between 2 similar boxes
so far. There is much potential for performance improvement. For now,
I've changed the gmac code to accept any data alignment, as the "char *"
pointer suggests. As the code is practically used, 32-bit alignment
can be assumed, at the cost of data copies. I don't know whether
bytewise access or copies are worse performance-wise. For efficient
implementations using SSE2 instructions on x86, even stricter
alignment requirements might arise.

Revision 1.28 / (download) - annotate - [select for diffs], Thu May 5 17:46:48 2011 UTC (11 years, 9 months ago) by drochner
Branch: MAIN
Changes since 1.27: +3 -1 lines
Diff to previous 1.27 (colored)

add IANA number for camellia-cbc, copied from FreeBSD

Revision 1.26.32.1 / (download) - annotate - [select for diffs], Sat Mar 5 20:55:53 2011 UTC (11 years, 11 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.26: +6 -4 lines
Diff to previous 1.26 (colored)

sync with head

Revision 1.26.30.1 / (download) - annotate - [select for diffs], Fri Oct 22 07:22:38 2010 UTC (12 years, 3 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.26: +6 -4 lines
Diff to previous 1.26 (colored) next main 1.27 (colored)

Sync with HEAD (-D20101022).

Revision 1.26.10.1 / (download) - annotate - [select for diffs], Sat Oct 9 03:32:36 2010 UTC (12 years, 3 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.26: +6 -4 lines
Diff to previous 1.26 (colored) next main 1.27 (colored)

sync with head

Revision 1.27 / (download) - annotate - [select for diffs], Sun Sep 5 06:52:53 2010 UTC (12 years, 5 months ago) by spz
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, uebayasi-xip-base4, uebayasi-xip-base3, matt-mips64-premerge-20101231, jruoho-x86intr-base, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2
Branch point for: jruoho-x86intr
Changes since 1.26: +6 -4 lines
Diff to previous 1.26 (colored)

fix two bugs in the PFKEY interface:

1) RFC2367 says in 2.3.3 Address Extension: "All non-address
   information in the sockaddrs, such as sin_zero for AF_INET sockaddrs,
   and sin6_flowinfo for AF_INET6 sockaddrs, MUST be zeroed out."
   the IPSEC_NAT_T code was expecting the port information it needs
   to be conveyed in the sockaddr instead of exclusively by
   SADB_X_EXT_NAT_T_SPORT and SADB_X_EXT_NAT_T_DPORT,
   and was not zeroing out the port information in the non-nat-traversal
   case.
   Since it was expecting the port information to reside in the sockaddr
   it could get away with (re)setting the ports after starting to use them.
   -> Set the natt ports before setting the SA mature.

2) RFC3947 has two Original Address fields, initiator and responder,
   so we need SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR and not just
   SADB_X_EXT_NAT_T_OA

The change has been created using vanhu's patch for FreeBSD as reference.

Note that establishing actual nat-t sessions has not yet been tested.

Likely fixes the following:
PR bin/41757
PR net/42592
PR net/42606

Revision 1.25.46.1 / (download) - annotate - [select for diffs], Sun Mar 23 02:05:05 2008 UTC (14 years, 10 months ago) by matt
Branch: matt-armv6
Changes since 1.25: +115 -115 lines
Diff to previous 1.25 (colored) next main 1.26 (colored)

sync with HEAD

Revision 1.22.2.2 / (download) - annotate - [select for diffs], Wed Feb 27 08:37:01 2008 UTC (14 years, 11 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.22.2.1: +115 -115 lines
Diff to previous 1.22.2.1 (colored) to branchpoint 1.22 (colored) next main 1.23 (colored)

sync with head.

Revision 1.26.2.1 / (download) - annotate - [select for diffs], Fri Feb 22 02:53:33 2008 UTC (14 years, 11 months ago) by keiichi
Branch: keiichi-mipv6
Changes since 1.26: +2 -4 lines
Diff to previous 1.26 (colored) next main 1.27 (colored)

imported Mobile IPv6 code developed by the SHISA project
(http://www.mobileip.jp/).

Revision 1.26 / (download) - annotate - [select for diffs], Wed Feb 20 17:05:53 2008 UTC (14 years, 11 months ago) by matt
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-pf42-base, yamt-pf42, yamt-nfs-mp-base9, yamt-nfs-mp-base8, yamt-nfs-mp-base7, yamt-nfs-mp-base6, yamt-nfs-mp-base5, yamt-nfs-mp-base4, yamt-nfs-mp-base3, yamt-nfs-mp-base2, yamt-nfs-mp-base10, yamt-nfs-mp-base, yamt-lazymbuf-base15, yamt-lazymbuf-base14, wrstuden-revivesa-base-4, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, wrstuden-revivesa, uebayasi-xip-base2, uebayasi-xip-base1, uebayasi-xip-base, simonb-wapbl-nbase, simonb-wapbl-base, simonb-wapbl, nick-net80211-sync-base, nick-net80211-sync, nick-hppapmap-base4, nick-hppapmap-base3, nick-hppapmap-base2, nick-hppapmap-base, nick-hppapmap, netbsd-5-base, netbsd-5-2-RELEASE, netbsd-5-2-RC1, netbsd-5-2-3-RELEASE, netbsd-5-2-2-RELEASE, netbsd-5-2-1-RELEASE, netbsd-5-2, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-5-RELEASE, netbsd-5-1-4-RELEASE, netbsd-5-1-3-RELEASE, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, netbsd-5, mjf-devfs2-base, mjf-devfs2, matt-premerge-20091211, matt-nb5-pq3-base, matt-nb5-pq3, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-premerge-20091211, matt-nb5-mips64-k15, matt-nb5-mips64, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, matt-armv6-nbase, keiichi-mipv6-nbase, keiichi-mipv6-base, jymxensuspend-base, jym-xensuspend-nbase, jym-xensuspend-base, jym-xensuspend, hpcarm-cleanup-nbase, hpcarm-cleanup-base, haad-nbase2, haad-dm-base2, haad-dm-base1, haad-dm-base, haad-dm, ad-socklock-base1, ad-audiomp2-base, ad-audiomp2
Branch point for: yamt-nfs-mp, uebayasi-xip, rmind-uvmplock, keiichi-mipv6
Changes since 1.25: +115 -115 lines
Diff to previous 1.25 (colored)

s/u_\(int[0-9]*_t\)/u\1/g
(change u_int*_t to uint*_t)

Revision 1.22.2.1 / (download) - annotate - [select for diffs], Wed Jun 21 15:10:27 2006 UTC (16 years, 7 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.22: +10 -2 lines
Diff to previous 1.22 (colored)

sync with head.

Revision 1.12.20.9 / (download) - annotate - [select for diffs], Sun Dec 11 10:29:19 2005 UTC (17 years, 1 month ago) by christos
Branch: ktrace-lwp
Changes since 1.12.20.8: +2 -2 lines
Diff to previous 1.12.20.8 (colored) to branchpoint 1.12 (colored) next main 1.13 (colored)

Sync with head.

Revision 1.25 / (download) - annotate - [select for diffs], Sat Dec 10 23:21:39 2005 UTC (17 years, 1 month ago) by elad
Branch: MAIN
CVS Tags: yamt-x86pmap-base4, yamt-x86pmap-base3, yamt-x86pmap-base2, yamt-x86pmap-base, yamt-x86pmap, yamt-uio_vmspace-base5, yamt-uio_vmspace, yamt-splraiseipl-base5, yamt-splraiseipl-base4, yamt-splraiseipl-base3, yamt-splraiseipl-base2, yamt-splraiseipl-base, yamt-splraiseipl, yamt-pdpolicy-base9, yamt-pdpolicy-base8, yamt-pdpolicy-base7, yamt-pdpolicy-base6, yamt-pdpolicy-base5, yamt-pdpolicy-base4, yamt-pdpolicy-base3, yamt-pdpolicy-base2, yamt-pdpolicy-base, yamt-pdpolicy, yamt-kmem-base3, yamt-kmem-base2, yamt-kmem-base, yamt-kmem, yamt-idlelwp-base8, yamt-idlelwp, wrstuden-fixsa-newbase, wrstuden-fixsa-base-1, wrstuden-fixsa-base, wrstuden-fixsa, vmlocking2-base3, vmlocking2-base2, vmlocking2-base1, vmlocking2, vmlocking-nbase, vmlocking-base, vmlocking, thorpej-atomic-base, thorpej-atomic, simonb-timecounters-base, simonb-timecounters, simonb-timcounters-final, rpaulo-netinet-merge-pcb-base, rpaulo-netinet-merge-pcb, reinoud-bufcleanup-nbase, reinoud-bufcleanup-base, reinoud-bufcleanup, post-newlock2-merge, peter-altq-base, peter-altq, nick-csl-alignment-base5, nick-csl-alignment-base, nick-csl-alignment, newlock2-nbase, newlock2-base, newlock2, netbsd-4-base, netbsd-4-0-RELEASE, netbsd-4-0-RC5, netbsd-4-0-RC4, netbsd-4-0-RC3, netbsd-4-0-RC2, netbsd-4-0-RC1, netbsd-4-0-1-RELEASE, netbsd-4-0, netbsd-4, mjf-ufs-trans-base, mjf-ufs-trans, mjf-devfs-base, mjf-devfs, matt-nb4-arm-base, matt-nb4-arm, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, matt-armv6-base, ktrace-lwp-base, jmcneill-pm-base, jmcneill-pm, jmcneill-base, hpcarm-cleanup, gdamore-uart-base, gdamore-uart, elad-kernelauth-base, elad-kernelauth, cube-autoconf-base, cube-autoconf, chap-midi-nbase, chap-midi-base, chap-midi, bouyer-xeni386-nbase, bouyer-xeni386-merge1, bouyer-xeni386-base, bouyer-xeni386, bouyer-xenamd64-base2, bouyer-xenamd64-base, bouyer-xenamd64, ad-audiomp-base, ad-audiomp, abandoned-netbsd-4-base, abandoned-netbsd-4
Branch point for: matt-armv6
Changes since 1.24: +2 -2 lines
Diff to previous 1.24 (colored)

Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

Revision 1.12.20.8 / (download) - annotate - [select for diffs], Thu Nov 10 14:10:33 2005 UTC (17 years, 2 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.7: +14 -5 lines
Diff to previous 1.12.20.7 (colored) to branchpoint 1.12 (colored)

Sync with HEAD. Here we go again...

Revision 1.22.4.2 / (download) - annotate - [select for diffs], Wed Nov 2 11:58:11 2005 UTC (17 years, 3 months ago) by yamt
Branch: yamt-vop
Changes since 1.22.4.1: +2 -2 lines
Diff to previous 1.22.4.1 (colored) to branchpoint 1.22 (colored) next main 1.23 (colored)

sync with head.

Revision 1.24 / (download) - annotate - [select for diffs], Sat Oct 29 15:05:13 2005 UTC (17 years, 3 months ago) by yamt
Branch: MAIN
CVS Tags: yamt-vop-base3, yamt-readahead-pervnode, yamt-readahead-perfile, yamt-readahead-base3, yamt-readahead-base2, yamt-readahead-base, yamt-readahead
Changes since 1.23: +2 -2 lines
Diff to previous 1.23 (colored)

correct SADB_X_MIGRATE.  pointed by Francis Dupont.

Revision 1.22.4.1 / (download) - annotate - [select for diffs], Wed Oct 26 08:32:51 2005 UTC (17 years, 3 months ago) by yamt
Branch: yamt-vop
Changes since 1.22: +9 -1 lines
Diff to previous 1.22 (colored)

sync with head

Revision 1.23 / (download) - annotate - [select for diffs], Tue Oct 25 06:12:49 2005 UTC (17 years, 3 months ago) by yamt
Branch: MAIN
CVS Tags: yamt-vop-base2
Changes since 1.22: +9 -1 lines
Diff to previous 1.22 (colored)

add some #if 0'ed out SADB_X_* definitions found in kame tree
to avoid conflicting numbers.

Revision 1.22 / (download) - annotate - [select for diffs], Tue Jun 28 15:33:27 2005 UTC (17 years, 7 months ago) by christos
Branch: MAIN
CVS Tags: yamt-vop-base, thorpej-vnode-attr-base, thorpej-vnode-attr
Branch point for: yamt-vop, yamt-lazymbuf
Changes since 1.21: +3 -2 lines
Diff to previous 1.21 (colored)

Add some casts to appease lint

Revision 1.21 / (download) - annotate - [select for diffs], Sun Jun 26 20:55:44 2005 UTC (17 years, 7 months ago) by christos
Branch: MAIN
Changes since 1.20: +5 -5 lines
Diff to previous 1.20 (colored)

de-lint some pointer casts.

Revision 1.18.2.1 / (download) - annotate - [select for diffs], Fri Apr 29 11:29:32 2005 UTC (17 years, 9 months ago) by kent
Branch: kent-audio2
Changes since 1.18: +37 -3 lines
Diff to previous 1.18 (colored) next main 1.19 (colored)

sync with -current

Revision 1.18.4.2 / (download) - annotate - [select for diffs], Sat Mar 19 08:36:32 2005 UTC (17 years, 10 months ago) by yamt
Branch: yamt-km
Changes since 1.18.4.1: +2 -2 lines
Diff to previous 1.18.4.1 (colored) to branchpoint 1.18 (colored) next main 1.19 (colored)

sync with head.  xen and whitespace.  xen part is not finished.

Revision 1.12.20.7 / (download) - annotate - [select for diffs], Fri Mar 4 16:52:59 2005 UTC (17 years, 11 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.6: +2 -2 lines
Diff to previous 1.12.20.6 (colored) to branchpoint 1.12 (colored)

Sync with HEAD.

Hi Perry!

Revision 1.20 / (download) - annotate - [select for diffs], Sat Feb 26 22:45:09 2005 UTC (17 years, 11 months ago) by perry
Branch: MAIN
CVS Tags: yamt-km-base4, yamt-km-base3, netbsd-3-base, netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-1, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, netbsd-3-0, netbsd-3, kent-audio2-base
Changes since 1.19: +2 -2 lines
Diff to previous 1.19 (colored)

nuke trailing whitespace

Revision 1.12.20.6 / (download) - annotate - [select for diffs], Tue Feb 15 21:33:30 2005 UTC (17 years, 11 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.5: +37 -3 lines
Diff to previous 1.12.20.5 (colored) to branchpoint 1.12 (colored)

Sync with HEAD.

Revision 1.18.4.1 / (download) - annotate - [select for diffs], Sat Feb 12 18:17:53 2005 UTC (17 years, 11 months ago) by yamt
Branch: yamt-km
Changes since 1.18: +37 -3 lines
Diff to previous 1.18 (colored)

sync with head.

Revision 1.19 / (download) - annotate - [select for diffs], Sat Feb 12 12:31:07 2005 UTC (17 years, 11 months ago) by manu
Branch: MAIN
CVS Tags: yamt-km-base2
Changes since 1.18: +37 -3 lines
Diff to previous 1.18 (colored)

Add support for IPsec Network Address Translator traversal (NAT-T), as
described by RFC 3947 and 3948.

Revision 1.12.20.5 / (download) - annotate - [select for diffs], Mon Jan 17 19:32:38 2005 UTC (18 years ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.4: +2 -2 lines
Diff to previous 1.12.20.4 (colored) to branchpoint 1.12 (colored)

Sync with HEAD.

Revision 1.18 / (download) - annotate - [select for diffs], Fri Jan 14 04:11:55 2005 UTC (18 years ago) by itojun
Branch: MAIN
CVS Tags: yamt-km-base
Branch point for: yamt-km, kent-audio2
Changes since 1.17: +2 -2 lines
Diff to previous 1.17 (colored)

ESP AESCTR got an official protocol number
http://www.iana.org/assignments/isakmp-registry

Revision 1.12.20.4 / (download) - annotate - [select for diffs], Sat Dec 18 09:32:51 2004 UTC (18 years, 1 month ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.3: +2 -2 lines
Diff to previous 1.12.20.3 (colored) to branchpoint 1.12 (colored)

Sync with HEAD.

Revision 1.17 / (download) - annotate - [select for diffs], Mon Dec 6 08:05:26 2004 UTC (18 years, 2 months ago) by itojun
Branch: MAIN
CVS Tags: kent-audio1-beforemerge, kent-audio1-base, kent-audio1
Changes since 1.16: +2 -2 lines
Diff to previous 1.16 (colored)

reqid (for unique policy) is u_int16_t quantity.  from markus@openbsd

Revision 1.12.20.3 / (download) - annotate - [select for diffs], Tue Sep 21 13:36:41 2004 UTC (18 years, 4 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.2: +1 -1 lines
Diff to previous 1.12.20.2 (colored) to branchpoint 1.12 (colored)

Fix the sync with head I botched.

Revision 1.12.20.2 / (download) - annotate - [select for diffs], Sat Sep 18 14:54:16 2004 UTC (18 years, 4 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12.20.1: +0 -0 lines
Diff to previous 1.12.20.1 (colored) to branchpoint 1.12 (colored)

Sync with HEAD.

Revision 1.12.20.1 / (download) - annotate - [select for diffs], Tue Aug 3 10:54:19 2004 UTC (18 years, 6 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.12: +16 -9 lines
Diff to previous 1.12 (colored)

Sync with HEAD

Revision 1.16 / (download) - annotate - [select for diffs], Sun Apr 25 22:25:03 2004 UTC (18 years, 9 months ago) by jonathan
Branch: MAIN
Changes since 1.15: +4 -2 lines
Diff to previous 1.15 (colored)

Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).


NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.

Revision 1.15 / (download) - annotate - [select for diffs], Fri Aug 15 03:42:00 2003 UTC (19 years, 5 months ago) by jonathan
Branch: MAIN
CVS Tags: netbsd-2-base, netbsd-2-1-RELEASE, netbsd-2-1-RC6, netbsd-2-1-RC5, netbsd-2-1-RC4, netbsd-2-1-RC3, netbsd-2-1-RC2, netbsd-2-1-RC1, netbsd-2-1, netbsd-2-0-base, netbsd-2-0-RELEASE, netbsd-2-0-RC5, netbsd-2-0-RC4, netbsd-2-0-RC3, netbsd-2-0-RC2, netbsd-2-0-RC1, netbsd-2-0-3-RELEASE, netbsd-2-0-2-RELEASE, netbsd-2-0-1-RELEASE, netbsd-2-0, netbsd-2
Changes since 1.14: +3 -2 lines
Diff to previous 1.14 (colored)

(fast-ipsec): Add hooks to pass IPv4 IPsec traffic into fast-ipsec, if
configured with ``options FAST_IPSEC''.  Kernels with KAME IPsec or
with no IPsec should work as before.

All calls to ip_output() now always pass an additional compulsory
argument: the inpcb associated with the packet being sent,
or 0 if no inpcb is available.

Fast-ipsec tested with ICMP or UDP over ESP. TCP doesn't work, yet.

Revision 1.14 / (download) - annotate - [select for diffs], Fri Jul 25 10:00:49 2003 UTC (19 years, 6 months ago) by itojun
Branch: MAIN
Changes since 1.13: +6 -3 lines
Diff to previous 1.13 (colored)

add AH/ESP algorithms: hmac-ripemd160 (AH), AES XCBC MAC (AH),
AES counter mode (ESP)

Revision 1.13 / (download) - annotate - [select for diffs], Tue Jul 22 03:24:25 2003 UTC (19 years, 6 months ago) by itojun
Branch: MAIN
Changes since 1.12: +7 -6 lines
Diff to previous 1.12 (colored)

add hmac-sha2 support.  various cleanups (like avoid hardcoding '16').
from kame

Revision 1.11.2.1 / (download) - annotate - [select for diffs], Fri Aug 24 00:12:17 2001 UTC (21 years, 5 months ago) by nathanw
Branch: nathanw_sa
CVS Tags: nathanw_sa_end
Changes since 1.11: +3 -3 lines
Diff to previous 1.11 (colored) next main 1.12 (colored)

Catch up with -current.

Revision 1.11.4.1 / (download) - annotate - [select for diffs], Fri Aug 3 04:13:52 2001 UTC (21 years, 6 months ago) by lukem
Branch: kqueue
Changes since 1.11: +3 -3 lines
Diff to previous 1.11 (colored) next main 1.12 (colored)

update to -current

Revision 1.12 / (download) - annotate - [select for diffs], Thu Aug 2 12:10:14 2001 UTC (21 years, 6 months ago) by itojun
Branch: MAIN
CVS Tags: thorpej-mips-cache-base, thorpej-mips-cache, thorpej-devvp-base3, thorpej-devvp-base2, thorpej-devvp-base, thorpej-devvp, pre-chs-ubcperf, post-chs-ubcperf, newlock-base, newlock, netbsd-1-6-base, netbsd-1-6-RELEASE, netbsd-1-6-RC3, netbsd-1-6-RC2, netbsd-1-6-RC1, netbsd-1-6-PATCH002-RELEASE, netbsd-1-6-PATCH002-RC4, netbsd-1-6-PATCH002-RC3, netbsd-1-6-PATCH002-RC2, netbsd-1-6-PATCH002-RC1, netbsd-1-6-PATCH002, netbsd-1-6-PATCH001-RELEASE, netbsd-1-6-PATCH001-RC3, netbsd-1-6-PATCH001-RC2, netbsd-1-6-PATCH001-RC1, netbsd-1-6-PATCH001, netbsd-1-6, nathanw_sa_before_merge, nathanw_sa_base, kqueue-beforemerge, kqueue-base, kqueue-aftermerge, ifpoll-base, gmcgarry_ucred_base, gmcgarry_ucred, gmcgarry_ctxsw_base, gmcgarry_ctxsw, gehenna-devsw-base, gehenna-devsw, fvdl_fs64_base, eeh-devprop-base, eeh-devprop
Branch point for: ktrace-lwp
Changes since 1.11: +3 -3 lines
Diff to previous 1.11 (colored)

pass replay sequence number on sadb_x_sa2 (it's outside of PF_KEY standard
anyways).

Revision 1.3.2.1 / (download) - annotate - [select for diffs], Mon Nov 20 18:10:10 2000 UTC (22 years, 2 months ago) by bouyer
Branch: thorpej_scsipi
Changes since 1.3: +355 -4 lines
Diff to previous 1.3 (colored) next main 1.4 (colored)

Update thorpej_scsipi to -current as of a month ago

Revision 1.5.2.3 / (download) - annotate - [select for diffs], Wed Oct 4 17:39:36 2000 UTC (22 years, 4 months ago) by itojun
Branch: netbsd-1-5
CVS Tags: netbsd-1-5-RELEASE, netbsd-1-5-PATCH003, netbsd-1-5-PATCH002, netbsd-1-5-PATCH001, netbsd-1-5-BETA2, netbsd-1-5-BETA
Changes since 1.5.2.2: +7 -8 lines
Diff to previous 1.5.2.2 (colored) to branchpoint 1.5 (colored) next main 1.6 (colored)

pullup (approved by releng-1-5)
rijndael-cbc kernel support.

sys/crypto/rijndael/*		add tag for latest
sys/netinet6/esp_rijndael.[ch]	add tag for latest
sys/netinet6/esp_core.c		1.9 -> 1.11
sys/conf/files			1.389 -> 1.390, 1.395 -> 1.396
sys/net/pfkeyv2.h		1.7 -> 1.11

Revision 1.11 / (download) - annotate - [select for diffs], Tue Oct 3 22:46:21 2000 UTC (22 years, 4 months ago) by itojun
Branch: MAIN
CVS Tags: thorpej_scsipi_nbase, thorpej_scsipi_beforemerge, thorpej_scsipi_base
Branch point for: nathanw_sa, kqueue
Changes since 1.10: +2 -2 lines
Diff to previous 1.10 (colored)

typo

Revision 1.10 / (download) - annotate - [select for diffs], Tue Oct 3 22:43:52 2000 UTC (22 years, 4 months ago) by itojun
Branch: MAIN
Changes since 1.9: +3 -3 lines
Diff to previous 1.9 (colored)

forgot to update maximum number of algorithms

Revision 1.9 / (download) - annotate - [select for diffs], Tue Oct 3 21:45:44 2000 UTC (22 years, 4 months ago) by itojun
Branch: MAIN
Changes since 1.8: +5 -3 lines
Diff to previous 1.8 (colored)

add official # for AES (12), and make it equal to rijndael.
Note that:
- IANA assignment was made for AES
- we still have some time window till AES gets finalized, so until it gets
  finalized, we are not certain if AES == rijndael
but it should now be okay.

Revision 1.8 / (download) - annotate - [select for diffs], Tue Oct 3 06:36:31 2000 UTC (22 years, 4 months ago) by itojun
Branch: MAIN
Changes since 1.7: +3 -6 lines
Diff to previous 1.7 (colored)

get rid of RC5 algorithm # completely (#if 0'ed for a long time)
sync with kame.

Revision 1.5.2.2 / (download) - annotate - [select for diffs], Tue Jul 25 04:24:45 2000 UTC (22 years, 6 months ago) by itojun
Branch: netbsd-1-5
CVS Tags: netbsd-1-5-ALPHA2
Changes since 1.5.2.1: +24 -21 lines
Diff to previous 1.5.2.1 (colored) to branchpoint 1.5 (colored)

pullup from main trunc (approved by releng-1-5)

correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).
sync from kame.

WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon.
(no ipsec-ready netbsd was released as official release, so binary backward
compatibility is less big issue)

(sys/netinet6/esp.h only, 1.10 -> 1.11)
wrap kernel function prototype by #ifdef _KERNEL.

--- revisions pulled up:
1.6 -> 1.7	syssrc/sys/net/pfkeyv2.h
1.10 -> 1.11	syssrc/sys/netinet6/ah.h
1.10 -> 1.11	syssrc/sys/netinet6/ah_output.c
1.19 -> 1.20	syssrc/sys/netinet6/ah_core.c
1.15 -> 1.16	syssrc/sys/netinet6/ah_input.c
1.8 -> 1.9	syssrc/sys/netinet6/esp.h
1.10 -> 1.11	syssrc/sys/netinet6/esp.h
1.1 -> 1.2	syssrc/sys/netinet6/esp_core.c
1.1 -> 1.2	syssrc/sys/netinet6/esp_input.c
1.2 -> 1.3	syssrc/sys/netinet6/esp_output.c
1.26 -> 1.27	syssrc/sys/netkey/key.c

Revision 1.7 / (download) - annotate - [select for diffs], Tue Jul 18 14:56:42 2000 UTC (22 years, 6 months ago) by itojun
Branch: MAIN
Changes since 1.6: +24 -21 lines
Diff to previous 1.6 (colored)

correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).
sync from kame.

WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon.
(no ipsec-ready netbsd was released as official release)

Revision 1.5.2.1 / (download) - annotate - [select for diffs], Sat Jul 1 23:45:20 2000 UTC (22 years, 7 months ago) by itojun
Branch: netbsd-1-5
Changes since 1.5: +2 -11 lines
Diff to previous 1.5 (colored)

pullup (approved by releng-1-5)

nuke sadb_x_ident_id, wihich violates pfkey standard.
correct get/set SA handling.
(from kame)

Revision 1.6 / (download) - annotate - [select for diffs], Sat Jul 1 01:01:34 2000 UTC (22 years, 7 months ago) by itojun
Branch: MAIN
Changes since 1.5: +2 -11 lines
Diff to previous 1.5 (colored)

nuke sadb_x_ident_id, wihich violates pfkey standard.
correct get/set SA handling.
(from kame)

Revision 1.4.2.1 / (download) - annotate - [select for diffs], Thu Jun 22 17:09:43 2000 UTC (22 years, 7 months ago) by minoura
Branch: minoura-xpg4dl
Changes since 1.4: +35 -67 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Sync w/ netbsd-1-5-base.

Revision 1.5 / (download) - annotate - [select for diffs], Mon Jun 12 10:40:37 2000 UTC (22 years, 7 months ago) by itojun
Branch: MAIN
CVS Tags: netbsd-1-5-base
Branch point for: netbsd-1-5
Changes since 1.4: +35 -67 lines
Diff to previous 1.4 (colored)

sync with almost-latest KAME IPsec.  full changelog would be too big
to mention here.  notable changes are like below.

kernel:
- make PF_KEY kernel interface more robust against broken input stream.
  it includes complete internal structure change in sys/netkey/key.c.
- remove non-RFC compliant change in PF_KEY API, in particular,
  in struct sadb_msg.  we cannot just change these standard structs.
  sadb_x_sa2 is introduced instead.
- remove prototypes for pfkey_xx functions from /usr/include/net/pfkeyv2.h.
  these functions are not supplied in /usr/lib.

setkey(8):
- get/delete does not require "-m mode" (ignored with warning, if you
  specify it)
- spddelete takes direction specification

Revision 1.4 / (download) - annotate - [select for diffs], Wed Feb 9 03:27:29 2000 UTC (23 years ago) by itojun
Branch: MAIN
CVS Tags: minoura-xpg4dl-base, chs-ubc2-newbase
Branch point for: minoura-xpg4dl
Changes since 1.3: +392 -2 lines
Diff to previous 1.3 (colored)

for more strict rfc2367 conformance, move netkey/keyv2.h into net/pfkeyv2.h
(net/pfkeyv2.h used to just include netkey/keyv2.h).

netkey/keyv2.h includes #error only for several days, to inform
of file path change.  after that I plan to nuke the file.

Revision 1.2.2.3 / (download) - annotate - [select for diffs], Mon Aug 2 22:32:29 1999 UTC (23 years, 6 months ago) by thorpej
Branch: chs-ubc2
Changes since 1.2.2.2: +36 -0 lines
Diff to previous 1.2.2.2 (colored) next main 1.3 (colored)

Update from trunk.

Revision 1.3 / (download) - annotate - [select for diffs], Tue Jul 6 12:23:19 1999 UTC (23 years, 7 months ago) by itojun
Branch: MAIN
CVS Tags: wrstuden-devbsize-base, wrstuden-devbsize-19991221, wrstuden-devbsize, fvdl-softdep-base, fvdl-softdep, comdex-fall-1999-base, comdex-fall-1999, chs-ubc2-base
Branch point for: thorpej_scsipi
Changes since 1.2: +36 -0 lines
Diff to previous 1.2 (colored)

sync with KAME/NetBSD 1.4, SNAP kit 19990705.
key changes are:
- icmp6 redirect fix (dst check)
- revised ip6 multicast check for loopback i/f
- several RCS ID cleanups

Revision 1.2.2.2 / (download) - annotate - [select for diffs], Thu Jul 1 23:45:20 1999 UTC (23 years, 7 months ago) by thorpej
Branch: chs-ubc2
Changes since 1.2.2.1: +1 -0 lines
Diff to previous 1.2.2.1 (colored)

Sync w/ -current.

Revision 1.2.2.1, Thu Jul 1 08:12:49 1999 UTC (23 years, 7 months ago) by thorpej
Branch: chs-ubc2
Changes since 1.2: +0 -1 lines
FILE REMOVED

file pfkeyv2.h was added on branch chs-ubc2 on 1999-07-01 23:45:20 +0000

Revision 1.2 / (download) - annotate - [select for diffs], Thu Jul 1 08:12:49 1999 UTC (23 years, 7 months ago) by itojun
Branch: MAIN
Branch point for: chs-ubc2
Changes since 1.1: +1 -0 lines
Diff to previous 1.1 (colored)

IPv6 kernel code, based on KAME/NetBSD 1.4, SNAP kit 19990628.
(Sorry for a big commit, I can't separate this into several pieces...)
Pls check sys/netinet6/TODO and sys/netinet6/IMPLEMENTATION for details.

- sys/kern: do not assume single mbuf, accept chained mbuf on passing
  data from userland to kernel (or other way round).
- "midway" ATM card: ATM PVC pseudo device support, like those done in ALTQ
  package (ftp://ftp.csl.sony.co.jp/pub/kjc/).
- sys/netinet/tcp*: IPv4/v6 dual stack tcp support.
- sys/netinet/{ip6,icmp6}.h, sys/net/pfkeyv2.h: IETF document assumes those
  file to be there so we patch it up.
- sys/netinet: IPsec additions are here and there.
- sys/netinet6/*: most of IPv6 code sits here.
- sys/netkey: IPsec key management code
- dev/pci/pcidevs: regen

In my understanding no code here is subject to export control so it
should be safe.

Revision 1.1.2.1 / (download) - annotate - [select for diffs], Mon Jun 28 06:36:57 1999 UTC (23 years, 7 months ago) by itojun
Branch: kame
CVS Tags: kame_14_19990705, kame_14_19990628, kame_141_19991130
Changes since 1.1: +1 -0 lines
Diff to previous 1.1 (colored) next main 1.2 (colored)

KAME/NetBSD 1.4 SNAP kit, dated 19990628.

NOTE: this branch (kame) is used just for refernce.  this may not compile
due to multiple reasons.

Revision 1.1, Mon Jun 28 06:36:57 1999 UTC (23 years, 7 months ago) by itojun
Branch: MAIN
Branch point for: kame
FILE REMOVED

file pfkeyv2.h was initially added on branch kame.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>