The NetBSD Project

CVS log for src/sys/netipsec/ipsec.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / netipsec

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.178 / (download) - annotate - [select for diffs], Fri Jan 27 09:33:43 2023 UTC (13 months ago) by ozaki-r
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-altq-separation-base, thorpej-altq-separation, HEAD
Changes since 1.177: +4 -17 lines
Diff to previous 1.177 (colored)

ipsec: remove unnecessary splsoftnet

Because the code of IPsec itself is already MP-safe.

Revision 1.177 / (download) - annotate - [select for diffs], Thu Dec 8 08:07:07 2022 UTC (14 months, 2 weeks ago) by knakahara
Branch: MAIN
CVS Tags: netbsd-10-base, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10
Changes since 1.176: +3 -3 lines
Diff to previous 1.176 (colored)

Fix: sp->lastused should be updated by time_uptime, and refactor a little.

Revision 1.176 / (download) - annotate - [select for diffs], Wed Nov 9 08:18:52 2022 UTC (15 months, 2 weeks ago) by knakahara
Branch: MAIN
Changes since 1.175: +3 -3 lines
Diff to previous 1.175 (colored)

Fix IPv4 security policy with port number does not work for forwarding packets.

Revision 1.175 / (download) - annotate - [select for diffs], Fri Nov 4 09:00:58 2022 UTC (15 months, 3 weeks ago) by ozaki-r
Branch: MAIN
Changes since 1.174: +3 -3 lines
Diff to previous 1.174 (colored)

inpcb: rename functions to inpcb_*

Inspired by rmind-smpnet patches.

Revision 1.174 / (download) - annotate - [select for diffs], Fri Oct 28 05:18:39 2022 UTC (16 months ago) by ozaki-r
Branch: MAIN
Changes since 1.173: +65 -72 lines
Diff to previous 1.173 (colored)

inpcb: integrate data structures of PCB into one

Data structures of network protocol control blocks (PCBs), i.e.,
struct inpcb, in6pcb and inpcb_hdr, are not organized well.  Users of
the data structures have to handle them separately and thus the code
is cluttered and duplicated.

The commit integrates the data structures into one, struct inpcb.  As a
result, users of PCBs only have to handle just one data structure, so
the code becomes simple.

One drawback is that the data size of PCB for IPv4 increases by 40 bytes
(from 248 bytes to 288 bytes).

Revision 1.173 / (download) - annotate - [select for diffs], Wed Dec 8 20:03:26 2021 UTC (2 years, 2 months ago) by andvar
Branch: MAIN
CVS Tags: bouyer-sunxi-drm-base, bouyer-sunxi-drm
Changes since 1.172: +3 -3 lines
Diff to previous 1.172 (colored)

s/speficication/specification/

Revision 1.172 / (download) - annotate - [select for diffs], Fri Aug 28 06:20:44 2020 UTC (3 years, 6 months ago) by ozaki-r
Branch: MAIN
CVS Tags: thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x
Changes since 1.171: +3 -3 lines
Diff to previous 1.171 (colored)

ipsec: rename ipsec_ip_input to ipsec_ip_input_checkpolicy

Because it just checks if a packet passes security policies.

Revision 1.171 / (download) - annotate - [select for diffs], Fri Aug 28 06:19:13 2020 UTC (3 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.170: +4 -3 lines
Diff to previous 1.170 (colored)

inet, inet6: count packets dropped by IPsec

The counters count packets dropped due to security policy checks.

Revision 1.164.2.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:17 2020 UTC (3 years, 10 months ago) by martin
Branch: phil-wifi
Changes since 1.164.2.1: +21 -11 lines
Diff to previous 1.164.2.1 (colored) to branchpoint 1.164 (colored) next main 1.165 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.170 / (download) - annotate - [select for diffs], Wed Aug 7 10:10:00 2019 UTC (4 years, 6 months ago) by knakahara
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Changes since 1.169: +10 -4 lines
Diff to previous 1.169 (colored)

ipsec_getpolicybysock() should also call key_havesp() like ipsec_getpolicybyaddr().

That can reduce KEYDEBUG messages.

Revision 1.169 / (download) - annotate - [select for diffs], Tue Jul 9 16:56:24 2019 UTC (4 years, 7 months ago) by maxv
Branch: MAIN
CVS Tags: netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9
Changes since 1.168: +13 -9 lines
Diff to previous 1.168 (colored)

Fix uninitialized variable: in ipsec_checkpcbcache(), spidx.dir is not
initialized, and the padding of the spidx structure is not initialized
either. This causes the memcmp() to wrongfully fail.

Change ipsec_setspidx() to always initialize spdix.dir and zero out the
padding.

ok ozaki-r@

Revision 1.164.2.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:09:48 2019 UTC (4 years, 8 months ago) by christos
Branch: phil-wifi
Changes since 1.164: +40 -15 lines
Diff to previous 1.164 (colored)

Sync with HEAD

Revision 1.168 / (download) - annotate - [select for diffs], Sun Jan 27 02:08:48 2019 UTC (5 years, 1 month ago) by pgoyette
Branch: MAIN
CVS Tags: phil-wifi-20190609, isaki-audio2-base, isaki-audio2
Changes since 1.167: +2 -2 lines
Diff to previous 1.167 (colored)

Merge the [pgoyette-compat] branch

Revision 1.151.2.6 / (download) - annotate - [select for diffs], Mon Nov 26 01:52:51 2018 UTC (5 years, 3 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.151.2.5: +38 -14 lines
Diff to previous 1.151.2.5 (colored) to branchpoint 1.151 (colored) next main 1.152 (colored)

Sync with HEAD, resolve a couple of conflicts

Revision 1.167 / (download) - annotate - [select for diffs], Thu Nov 22 04:48:34 2018 UTC (5 years, 3 months ago) by knakahara
Branch: MAIN
CVS Tags: pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126
Changes since 1.166: +38 -2 lines
Diff to previous 1.166 (colored)

Support IPv6 NAT-T. Implemented by hsuenaga@IIJ and ohishi@IIJ.

Add ATF later.

Revision 1.166 / (download) - annotate - [select for diffs], Sat Oct 27 05:42:23 2018 UTC (5 years, 4 months ago) by maxv
Branch: MAIN
Changes since 1.165: +2 -14 lines
Diff to previous 1.165 (colored)

Localify one function, and switch to C99 types while here.

Revision 1.151.2.5 / (download) - annotate - [select for diffs], Sat Jul 28 04:38:11 2018 UTC (5 years, 7 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.151.2.4: +4 -3 lines
Diff to previous 1.151.2.4 (colored) to branchpoint 1.151 (colored)

Sync with HEAD

Revision 1.165 / (download) - annotate - [select for diffs], Wed Jul 11 05:25:45 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728
Changes since 1.164: +4 -3 lines
Diff to previous 1.164 (colored)

Rename

	ip_undefer_csum  -> in_undefer_cksum
	in_delayed_cksum -> in_undefer_cksum_tcpudp

The two previous names were inconsistent and misleading.

Put the two functions into in_offload.c. Add comments to explain what
we're doing.

The same could be done for IPv6.

Revision 1.151.2.4 / (download) - annotate - [select for diffs], Mon May 21 04:36:16 2018 UTC (5 years, 9 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.151.2.3: +12 -46 lines
Diff to previous 1.151.2.3 (colored) to branchpoint 1.151 (colored)

Sync with HEAD

Revision 1.164 / (download) - annotate - [select for diffs], Mon May 14 17:34:26 2018 UTC (5 years, 9 months ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-0625, pgoyette-compat-0521
Branch point for: phil-wifi
Changes since 1.163: +7 -21 lines
Diff to previous 1.163 (colored)

Merge ipsec4_input and ipsec6_input into ipsec_ip_input. Make the argument
a bool for clarity. Optimize the function: if M_CANFASTFWD is not there
(because already removed by the firewall) leave now.

Makes it easier to see that M_CANFASTFWD is not removed on IPv6.

Revision 1.163 / (download) - annotate - [select for diffs], Thu May 10 05:15:14 2018 UTC (5 years, 9 months ago) by maxv
Branch: MAIN
Changes since 1.162: +3 -22 lines
Diff to previous 1.162 (colored)

Replace dumb code by M_VERIFY_PACKET. In fact, perhaps we should not even
call M_VERIFY_PACKET here, there is no particular reason for this place to
be more wrong than the rest.

Revision 1.162 / (download) - annotate - [select for diffs], Thu May 10 05:08:53 2018 UTC (5 years, 9 months ago) by maxv
Branch: MAIN
Changes since 1.161: +6 -7 lines
Diff to previous 1.161 (colored)

Rename ipsec4_forward -> ipsec_mtu, and switch to void.

Revision 1.151.2.3 / (download) - annotate - [select for diffs], Wed May 2 07:20:24 2018 UTC (5 years, 9 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.151.2.2: +4 -33 lines
Diff to previous 1.151.2.2 (colored) to branchpoint 1.151 (colored)

Synch with HEAD

Revision 1.161 / (download) - annotate - [select for diffs], Sun Apr 29 11:51:08 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0502
Changes since 1.160: +3 -3 lines
Diff to previous 1.160 (colored)

Remove unused and misleading argument from ipsec_set_policy.

Revision 1.160 / (download) - annotate - [select for diffs], Sat Apr 28 15:45:16 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.159: +2 -6 lines
Diff to previous 1.159 (colored)

Remove IPSEC_SPLASSERT_SOFTNET, it has always been a no-op.

Revision 1.159 / (download) - annotate - [select for diffs], Sat Apr 28 14:21:03 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.158: +3 -4 lines
Diff to previous 1.158 (colored)

Stop using a macro, rename the function to ipsec_init_pcbpolicy directly.

Revision 1.158 / (download) - annotate - [select for diffs], Sat Apr 28 14:01:50 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.157: +2 -26 lines
Diff to previous 1.157 (colored)

Style and remove unused stuff.

Revision 1.151.2.2 / (download) - annotate - [select for diffs], Sun Apr 22 07:20:28 2018 UTC (5 years, 10 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.151.2.1: +24 -20 lines
Diff to previous 1.151.2.1 (colored) to branchpoint 1.151 (colored)

Sync with HEAD

Revision 1.157 / (download) - annotate - [select for diffs], Thu Apr 19 08:27:38 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0422
Changes since 1.156: +3 -3 lines
Diff to previous 1.156 (colored)

Remove extra long file paths from the headers.

Revision 1.156 / (download) - annotate - [select for diffs], Wed Apr 18 06:57:39 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.155: +2 -5 lines
Diff to previous 1.155 (colored)

Remove dead code.

ok ozaki-r@

Revision 1.155 / (download) - annotate - [select for diffs], Tue Apr 17 17:47:05 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.154: +4 -2 lines
Diff to previous 1.154 (colored)

Add XXX. If this code really does something, it should use MCHTYPE.

Revision 1.154 / (download) - annotate - [select for diffs], Tue Apr 17 17:40:38 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.153: +23 -18 lines
Diff to previous 1.153 (colored)

Style, add XXX (about the mtu that goes negative), and remove #ifdef inet.

Revision 1.151.2.1 / (download) - annotate - [select for diffs], Sat Apr 7 04:12:20 2018 UTC (5 years, 10 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.151: +4 -79 lines
Diff to previous 1.151 (colored)

Sync with HEAD.  77 conflicts resolved - all of them $NetBSD$

Revision 1.153 / (download) - annotate - [select for diffs], Tue Apr 3 09:03:59 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0415, pgoyette-compat-0407
Changes since 1.152: +2 -77 lines
Diff to previous 1.152 (colored)

Remove ipsec_copy_policy and ipsec_copy_pcbpolicy. No functional change,
since we used only ipsec_copy_pcbpolicy, and it was a no-op.

Originally we were using ipsec_copy_policy to optimize the IPsec-PCB
cache: when an ACK was received in response to a SYN, we used to copy the
SP cached in the SYN's PCB into the ACK's PCB, so that
ipsec_getpolicybysock could use the cached SP instead of requerying it.

Then we switched to ipsec_copy_pcbpolicy which has always been a no-op. As
a result the SP cached in the SYN was/is not copied in the ACK, and the
first call to ipsec_getpolicybysock had to query the SP and cache it
itself. It's not totally clear to me why this change was made.

But it has been this way for years, and after a conversation with Ryota
Ozaki it turns out the optimization is not valid anymore due to
MP-ification, so it won't be re-enabled.

ok ozaki-r@

Revision 1.152 / (download) - annotate - [select for diffs], Sat Mar 31 19:27:14 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.151: +4 -4 lines
Diff to previous 1.151 (colored)

typo in comments

Revision 1.99.2.5 / (download) - annotate - [select for diffs], Fri Mar 30 11:50:56 2018 UTC (5 years, 11 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1
Changes since 1.99.2.4: +3 -3 lines
Diff to previous 1.99.2.4 (colored) to branchpoint 1.99 (colored) next main 1.100 (colored)

Pull up following revision(s) (requested by maxv in ticket #669):

	sys/netipsec/ipsec.c: revision 1.134

Fix ipsec4_get_ulp(). We should do "goto done" instead of "return",
otherwise the port fields of spidx are uninitialized.

ok mlelstv@

Revision 1.151 / (download) - annotate - [select for diffs], Sat Mar 3 09:54:55 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-base, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: pgoyette-compat
Changes since 1.150: +30 -40 lines
Diff to previous 1.150 (colored)

Reduce the diff between ipsec4_output and ipsec6_check_policy. While here
style.

Revision 1.150 / (download) - annotate - [select for diffs], Sat Mar 3 09:47:01 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.149: +8 -17 lines
Diff to previous 1.149 (colored)

Dedup.

Revision 1.149 / (download) - annotate - [select for diffs], Wed Feb 28 11:29:14 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.148: +3 -3 lines
Diff to previous 1.148 (colored)

add missing static

Revision 1.148 / (download) - annotate - [select for diffs], Wed Feb 28 10:16:19 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.147: +19 -47 lines
Diff to previous 1.147 (colored)

Dedup: merge ipsec4_setspidx_inpcb and ipsec6_setspidx_in6pcb.

Revision 1.147 / (download) - annotate - [select for diffs], Wed Feb 28 10:09:17 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.146: +14 -24 lines
Diff to previous 1.146 (colored)

ipsec6_setspidx_in6pcb: call ipsec_setspidx() only once, just like the
IPv4 code. While here put the correct variable in sizeof.

ok ozaki-r@

Revision 1.146 / (download) - annotate - [select for diffs], Tue Feb 27 15:01:30 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.145: +30 -81 lines
Diff to previous 1.145 (colored)

Dedup: merge ipsec4_set_policy and ipsec6_set_policy. The content of the
original ipsec_set_policy function is inlined into the new one.

Revision 1.145 / (download) - annotate - [select for diffs], Tue Feb 27 14:52:51 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.144: +5 -8 lines
Diff to previous 1.144 (colored)

Remove duplicate checks, and no need to initialize 'newsp' in
ipsec_set_policy.

Revision 1.144 / (download) - annotate - [select for diffs], Tue Feb 27 14:44:10 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.143: +20 -85 lines
Diff to previous 1.143 (colored)

Dedup: merge

	ipsec4_get_policy and ipsec6_get_policy
	ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy

The already-existing ipsec_get_policy() function is inlined in the new
one.

Revision 1.143 / (download) - annotate - [select for diffs], Tue Feb 27 13:36:21 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.142: +43 -37 lines
Diff to previous 1.142 (colored)

Use inpcb_hdr to reduce the diff between

	ipsec4_set_policy and ipsec6_set_policy
	ipsec4_get_policy and ipsec6_get_policy
	ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy

No real functional change.

Revision 1.142 / (download) - annotate - [select for diffs], Tue Feb 27 08:05:19 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.141: +3 -3 lines
Diff to previous 1.141 (colored)

Optimize: use ipsec_sp_hdrsiz instead of ipsec_hdrsiz, not to re-query
the SP.

ok ozaki-r@

Revision 1.141 / (download) - annotate - [select for diffs], Mon Feb 26 10:36:24 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.140: +8 -29 lines
Diff to previous 1.140 (colored)

Dedup: call ipsec_in_reject directly. IPSEC_STAT_IN_POLVIO also gets
increased now.

Revision 1.140 / (download) - annotate - [select for diffs], Mon Feb 26 10:19:13 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.139: +11 -13 lines
Diff to previous 1.139 (colored)

Reduce the diff between ipsec6_input and ipsec4_input.

Revision 1.139 / (download) - annotate - [select for diffs], Mon Feb 26 09:04:29 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.138: +7 -41 lines
Diff to previous 1.138 (colored)

Dedup: merge ipsec4_in_reject and ipsec6_in_reject into ipsec_in_reject.
While here fix misleading comment.

ok ozaki-r@

Revision 1.138 / (download) - annotate - [select for diffs], Mon Feb 26 08:50:25 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.137: +4 -34 lines
Diff to previous 1.137 (colored)

Dedup: merge ipsec4_hdrsiz and ipsec6_hdrsiz into ipsec_hdrsiz.

ok ozaki-r@

Revision 1.137 / (download) - annotate - [select for diffs], Mon Feb 26 08:42:16 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.136: +8 -57 lines
Diff to previous 1.136 (colored)

Dedup: merge ipsec4_checkpolicy and ipsec6_checkpolicy into
ipsec_checkpolicy.

ok ozaki-r@

Revision 1.136 / (download) - annotate - [select for diffs], Mon Feb 26 06:48:01 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.135: +4 -5 lines
Diff to previous 1.135 (colored)

Fix nonsensical checks, neither in6p nor request is allowed to be NULL,
and the former is already dereferenced in a kassert. This code should be
the same as ipsec4_set_policy.

Revision 1.135 / (download) - annotate - [select for diffs], Mon Feb 26 06:17:01 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.134: +17 -13 lines
Diff to previous 1.134 (colored)

Merge some minor (mostly stylistic) changes from last week.

Revision 1.134 / (download) - annotate - [select for diffs], Wed Feb 21 16:42:33 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.133: +3 -3 lines
Diff to previous 1.133 (colored)

Fix ipsec4_get_ulp(). We should do "goto done" instead of "return",
otherwise the port fields of spidx are uninitialized.

ok mlelstv@

Revision 1.133 / (download) - annotate - [select for diffs], Wed Feb 21 16:38:15 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.132: +25 -20 lines
Diff to previous 1.132 (colored)

Use inpcb_hdr to reduce the diff between:

	ipsec4_hdrsiz      and ipsec6_hdrsiz
	ipsec4_in_reject   and ipsec6_in_reject
	ipsec4_checkpolicy and ipsec4_checkpolicy

The members of these couples are now identical, and could be merged,
giving only three functions instead of six...

Revision 1.132 / (download) - annotate - [select for diffs], Wed Feb 21 16:18:52 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.131: +19 -22 lines
Diff to previous 1.131 (colored)

Rename:

	ipsec_in_reject -> ipsec_sp_reject
	ipsec_hdrsiz    -> ipsec_sp_hdrsiz

localify the former, and do some cleanup while here.

Revision 1.55.12.1 / (download) - annotate - [select for diffs], Fri Feb 16 18:12:47 2018 UTC (6 years ago) by martin
Branch: netbsd-6-0
Changes since 1.55: +3 -3 lines
Diff to previous 1.55 (colored) next main 1.56 (colored)

Pull up following revision(s) (requested by maxv in ticket #1531):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.55.14.1 / (download) - annotate - [select for diffs], Fri Feb 16 18:11:27 2018 UTC (6 years ago) by martin
Branch: netbsd-6-1
Changes since 1.55: +3 -3 lines
Diff to previous 1.55 (colored) next main 1.56 (colored)

Pull up following revision(s) (requested by maxv in ticket #1531):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.55.8.1 / (download) - annotate - [select for diffs], Fri Feb 16 18:10:09 2018 UTC (6 years ago) by martin
Branch: netbsd-6
Changes since 1.55: +3 -3 lines
Diff to previous 1.55 (colored) next main 1.56 (colored)

Pull up following revision(s) (requested by maxv in ticket #1531):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.63.4.1 / (download) - annotate - [select for diffs], Fri Feb 16 16:42:18 2018 UTC (6 years ago) by martin
Branch: netbsd-7-0
Changes since 1.63: +3 -3 lines
Diff to previous 1.63 (colored) next main 1.64 (colored)

Pull up following revision(s) (requested by maxv in ticket #1570):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.63.8.1 / (download) - annotate - [select for diffs], Fri Feb 16 16:40:39 2018 UTC (6 years ago) by martin
Branch: netbsd-7-1
CVS Tags: netbsd-7-1-2-RELEASE
Changes since 1.63: +3 -3 lines
Diff to previous 1.63 (colored) next main 1.64 (colored)

Pull up following revision(s) (requested by maxv in ticket #1570):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.63.2.1 / (download) - annotate - [select for diffs], Fri Feb 16 16:39:05 2018 UTC (6 years ago) by martin
Branch: netbsd-7
CVS Tags: netbsd-7-2-RELEASE
Changes since 1.63: +3 -3 lines
Diff to previous 1.63 (colored) next main 1.64 (colored)

Pull up following revision(s) (requested by maxv in ticket #1570):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.99.2.4 / (download) - annotate - [select for diffs], Fri Feb 16 16:35:18 2018 UTC (6 years ago) by martin
Branch: netbsd-8
Changes since 1.99.2.3: +3 -3 lines
Diff to previous 1.99.2.3 (colored) to branchpoint 1.99 (colored)

Pull up following revision(s) (requested by maxv in ticket #559):

	sys/netipsec/ipsec.c: revision 1.130

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.131 / (download) - annotate - [select for diffs], Fri Feb 16 15:18:41 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.130: +25 -49 lines
Diff to previous 1.130 (colored)

Style, remove unused and misleading macros and comments, localify, and
reduce the diff between similar functions. No functional change.

Revision 1.130 / (download) - annotate - [select for diffs], Fri Feb 16 11:25:16 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.129: +3 -3 lines
Diff to previous 1.129 (colored)

Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.

Revision 1.129 / (download) - annotate - [select for diffs], Fri Feb 16 11:07:44 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.128: +69 -72 lines
Diff to previous 1.128 (colored)

Style a bit, no functional change.

Revision 1.128 / (download) - annotate - [select for diffs], Fri Feb 16 09:07:50 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.127: +2 -8 lines
Diff to previous 1.127 (colored)

Remove some more FreeBSD sysctl declarations that already have NetBSD
counterparts. Discussed with ozaki-r@.

Revision 1.127 / (download) - annotate - [select for diffs], Fri Feb 16 08:56:50 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.126: +2 -6 lines
Diff to previous 1.126 (colored)

Remove ipsec_replay and ipsec_integrity from this place, they are already
declared as sysctls. Discussed with ozaki-r@.

Revision 1.126 / (download) - annotate - [select for diffs], Fri Feb 16 08:51:28 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.125: +2 -13 lines
Diff to previous 1.125 (colored)

Remove ip4_esp_randpad and ip6_esp_randpad, unused. Discussed with
ozaki-r@.

Revision 1.125 / (download) - annotate - [select for diffs], Thu Feb 8 20:57:41 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.124: +2 -4 lines
Diff to previous 1.124 (colored)

Remove unused net_osdep.h include.

Revision 1.99.2.3 / (download) - annotate - [select for diffs], Mon Feb 5 14:55:16 2018 UTC (6 years ago) by martin
Branch: netbsd-8
Changes since 1.99.2.2: +4 -5 lines
Diff to previous 1.99.2.2 (colored) to branchpoint 1.99 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #528):
	sys/net/agr/if_agr.c: revision 1.42
	sys/netinet6/nd6_rtr.c: revision 1.137
	sys/netinet6/nd6_rtr.c: revision 1.138
	sys/net/agr/if_agr.c: revision 1.46
	sys/net/route.c: revision 1.206
	sys/net/if.c: revision 1.419
	sys/net/agr/if_agrether.c: revision 1.10
	sys/netinet6/nd6.c: revision 1.241
	sys/netinet6/nd6.c: revision 1.242
	sys/netinet6/nd6.c: revision 1.243
	sys/netinet6/nd6.c: revision 1.244
	sys/netinet6/nd6.c: revision 1.245
	sys/netipsec/ipsec_input.c: revision 1.52
	sys/netipsec/ipsec_input.c: revision 1.53
	sys/net/agr/if_agrsubr.h: revision 1.5
	sys/kern/subr_workqueue.c: revision 1.35
	sys/netipsec/ipsec.c: revision 1.124
	sys/net/agr/if_agrsubr.c: revision 1.11
	sys/net/agr/if_agrsubr.c: revision 1.12
Simplify; share agr_vlan_add and agr_vlan_del (NFCI)
Fix late NULL-checking (CID 1427782: Null pointer dereferences (REVERSE_INULL))
KNF: replace soft tabs with hard tabs
Add missing NULL-checking for m_pullup (CID 1427770: Null pointer dereferences (NULL_RETURNS))
Add locking.
Revert "Get rid of unnecessary splsoftnet" (v1.133)
It's not always true that softnet_lock is held these places.
See PR kern/52947.
Get rid of unnecessary splsoftnet (redo)
Unless NET_MPSAFE, splsoftnet is still needed for rt_* functions.
Use existing fill_[pd]rlist() functions to calculate size of buffer to
allocate, rather than relying on an arbitrary length passed in from
userland.
Allow copyout() of partial results if the user buffer is too small, to
be consistent with the way sysctl(3) is documented.
Garbage-collect now-unused third parrameter in the fill_[pd]rlist()
functions.
As discussed on IRC.
OK kamil@ and christos@
XXX Needs pull-up to netbsd-8 branch.
Simplify, from christos@
More simplification, this time from ozaki-r@
No need to break after return.
One more from christos@
No need to initialize fill_func
more cleanup (don't allow oldlenp == NULL)
Destroy ifq_lock at the end of if_detach
It still can be used in if_detach.
Prevent rt_free_global.wk from being enqueued to workqueue doubly
Check if a queued work is tried to be enqueued again, which is not allowed

Revision 1.124 / (download) - annotate - [select for diffs], Tue Jan 23 02:17:32 2018 UTC (6 years, 1 month ago) by ozaki-r
Branch: MAIN
Changes since 1.123: +4 -5 lines
Diff to previous 1.123 (colored)

Fix late NULL-checking (CID 1427782: Null pointer dereferences (REVERSE_INULL))

Revision 1.56.2.4 / (download) - annotate - [select for diffs], Sun Dec 3 11:39:05 2017 UTC (6 years, 2 months ago) by jdolecek
Branch: tls-maxphys
Changes since 1.56.2.3: +421 -523 lines
Diff to previous 1.56.2.3 (colored) to branchpoint 1.56 (colored) next main 1.57 (colored)

update from HEAD

Revision 1.99.2.2 / (download) - annotate - [select for diffs], Thu Nov 30 14:57:34 2017 UTC (6 years, 2 months ago) by martin
Branch: netbsd-8
Changes since 1.99.2.1: +3 -3 lines
Diff to previous 1.99.2.1 (colored) to branchpoint 1.99 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #406):
	sys/netipsec/key.c: revision 1.239
	sys/netipsec/key.c: revision 1.240
	sys/netipsec/key.c: revision 1.241
	sys/netipsec/key.c: revision 1.242
	sys/netipsec/key.h: revision 1.33
	sys/netipsec/ipsec.c: revision 1.123
	sys/netipsec/key.c: revision 1.236
	sys/netipsec/key.c: revision 1.237
	sys/netipsec/key.c: revision 1.238
Provide a function to call MGETHDR and MCLGET
The change fixes two usages of MGETHDR that don't check whether a mbuf is really
allocated before passing it to MCLGET.
Fix error handling of MCLGET in key_alloc_mbuf
Add missing splx to key_spdexpire
Use M_WAITOK to allocate mbufs wherever sleepable
Further changes will get rid of unnecessary NULL checks then.
Get rid of unnecessary NULL checks that are obsoleted by M_WAITOK
Simply the code by avoiding unnecessary error checks
- Remove unnecessary m_pullup for self-allocated mbufs
- Replace some if-fails-return sanity checks with KASSERT
Call key_sendup_mbuf immediately unless key_acquire is called in softint
We need to defer it only if it's called in softint to avoid deadlock.

Revision 1.123 / (download) - annotate - [select for diffs], Tue Nov 21 07:03:08 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202
Changes since 1.122: +3 -3 lines
Diff to previous 1.122 (colored)

Use M_WAITOK to allocate mbufs wherever sleepable

Further changes will get rid of unnecessary NULL checks then.

Revision 1.99.2.1 / (download) - annotate - [select for diffs], Sat Oct 21 19:43:54 2017 UTC (6 years, 4 months ago) by snj
Branch: netbsd-8
CVS Tags: matt-nb8-mediatek-base, matt-nb8-mediatek
Changes since 1.99: +172 -208 lines
Diff to previous 1.99 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #300):
	crypto/dist/ipsec-tools/src/setkey/parse.y: 1.19
	crypto/dist/ipsec-tools/src/setkey/token.l: 1.20
	distrib/sets/lists/tests/mi: 1.754, 1.757, 1.759
	doc/TODO.smpnet: 1.12-1.13
	sys/net/pfkeyv2.h: 1.32
	sys/net/raw_cb.c: 1.23-1.24, 1.28
	sys/net/raw_cb.h: 1.28
	sys/net/raw_usrreq.c: 1.57-1.58
	sys/net/rtsock.c: 1.228-1.229
	sys/netinet/in_proto.c: 1.125
	sys/netinet/ip_input.c: 1.359-1.361
	sys/netinet/tcp_input.c: 1.359-1.360
	sys/netinet/tcp_output.c: 1.197
	sys/netinet/tcp_var.h: 1.178
	sys/netinet6/icmp6.c: 1.213
	sys/netinet6/in6_proto.c: 1.119
	sys/netinet6/ip6_forward.c: 1.88
	sys/netinet6/ip6_input.c: 1.181-1.182
	sys/netinet6/ip6_output.c: 1.193
	sys/netinet6/ip6protosw.h: 1.26
	sys/netipsec/ipsec.c: 1.100-1.122
	sys/netipsec/ipsec.h: 1.51-1.61
	sys/netipsec/ipsec6.h: 1.18-1.20
	sys/netipsec/ipsec_input.c: 1.44-1.51
	sys/netipsec/ipsec_netbsd.c: 1.41-1.45
	sys/netipsec/ipsec_output.c: 1.49-1.64
	sys/netipsec/ipsec_private.h: 1.5
	sys/netipsec/key.c: 1.164-1.234
	sys/netipsec/key.h: 1.20-1.32
	sys/netipsec/key_debug.c: 1.18-1.21
	sys/netipsec/key_debug.h: 1.9
	sys/netipsec/keydb.h: 1.16-1.20
	sys/netipsec/keysock.c: 1.59-1.62
	sys/netipsec/keysock.h: 1.10
	sys/netipsec/xform.h: 1.9-1.12
	sys/netipsec/xform_ah.c: 1.55-1.74
	sys/netipsec/xform_esp.c: 1.56-1.72
	sys/netipsec/xform_ipcomp.c: 1.39-1.53
	sys/netipsec/xform_ipip.c: 1.50-1.54
	sys/netipsec/xform_tcp.c: 1.12-1.16
	sys/rump/librump/rumpkern/Makefile.rumpkern: 1.170
	sys/rump/librump/rumpnet/net_stub.c: 1.27
	sys/sys/protosw.h: 1.67-1.68
	tests/net/carp/t_basic.sh: 1.7
	tests/net/if_gif/t_gif.sh: 1.11
	tests/net/if_l2tp/t_l2tp.sh: 1.3
	tests/net/ipsec/Makefile: 1.7-1.9
	tests/net/ipsec/algorithms.sh: 1.5
	tests/net/ipsec/common.sh: 1.4-1.6
	tests/net/ipsec/t_ipsec_ah_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_esp_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_gif.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_l2tp.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_misc.sh: 1.8-1.18
	tests/net/ipsec/t_ipsec_sockopt.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tcp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_transport.sh: 1.5-1.6
	tests/net/ipsec/t_ipsec_tunnel.sh: 1.9
	tests/net/ipsec/t_ipsec_tunnel_ipcomp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tunnel_odd.sh: 1.3
	tests/net/mcast/t_mcast.sh: 1.6
	tests/net/net/t_ipaddress.sh: 1.11
	tests/net/net_common.sh: 1.20
	tests/net/npf/t_npf.sh: 1.3
	tests/net/route/t_flags.sh: 1.20
	tests/net/route/t_flags6.sh: 1.16
	usr.bin/netstat/fast_ipsec.c: 1.22
Do m_pullup before mtod

It may fix panicks of some tests on anita/sparc and anita/GuruPlug.
---
KNF
---
Enable DEBUG for babylon5
---
Apply C99-style struct initialization to xformsw
---
Tweak outputs of netstat -s for IPsec

- Get rid of "Fast"
- Use ipsec and ipsec6 for titles to clarify protocol
- Indent outputs of sub protocols

Original outputs were organized like this:

(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:
(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:

New outputs are organized like this:

ipsec:
	ah:
	esp:
	ipip:
	ipcomp:
ipsec6:
	ah:
	esp:
	ipip:
	ipcomp:
---
Add test cases for IPComp
---
Simplify IPSEC_OSTAT macro (NFC)
---
KNF; replace leading whitespaces with hard tabs
---
Introduce and use SADB_SASTATE_USABLE_P
---
KNF
---
Add update command for testing

Updating an SA (SADB_UPDATE) requires that a process issuing
SADB_UPDATE is the same as a process issued SADB_ADD (or SADB_GETSPI).
This means that update command must be used with add command in a
configuration of setkey. This usage is normally meaningless but
useful for testing (and debugging) purposes.
---
Add test cases for updating SA/SP

The tests require newly-added udpate command of setkey.
---
PR/52346: Frank Kardel: Fix checksumming for NAT-T
See XXX for improvements.
---
Remove codes for PACKET_TAG_IPSEC_IN_CRYPTO_DONE

It seems that PACKET_TAG_IPSEC_IN_CRYPTO_DONE is for network adapters
that have IPsec accelerators; a driver sets the mtag to a packet
when its device has already encrypted the packet.

Unfortunately no driver implements such offload features for long
years and seems unlikely to implement them soon. (Note that neither
FreeBSD nor Linux doesn't have such drivers.) Let's remove related
(unused) codes and simplify the IPsec code.
---
Fix usages of sadb_msg_errno
---
Avoid updating sav directly

On SADB_UPDATE a target sav was updated directly, which was unsafe.
Instead allocate another sav, copy variables of the old sav to
the new one and replace the old one with the new one.
---
Simplify; we can assume sav->tdb_xform cannot be NULL while it's valid
---
Rename key_alloc* functions (NFC)

We shouldn't use the term "alloc" for functions that just look up
data and actually don't allocate memory.
---
Use explicit_memset to surely zero-clear key_auth and key_enc
---
Make sure to clear keys on error paths of key_setsaval
---
Add missing KEY_FREESAV
---
Make sure a sav is inserted to a sah list after its initialization completes
---
Remove unnecessary zero-clearing codes from key_setsaval

key_setsaval is now used only for a newly-allocated sav. (It was
used to reset variables of an existing sav.)
---
Correct wrong assumption of sav->refcnt in key_delsah

A sav in a list is basically not to be sav->refcnt == 0. And also
KEY_FREESAV assumes sav->refcnt > 0.
---
Let key_getsavbyspi take a reference of a returning sav
---
Use time_mono_to_wall (NFC)
---
Separate sending message routine (NFC)
---
Simplify; remove unnecessary zero-clears

key_freesaval is used only when a target sav is being destroyed.
---
Omit NULL checks for sav->lft_c

sav->lft_c can be NULL only when initializing or destroying sav.
---
Omit unnecessary NULL checks for sav->sah
---
Omit unnecessary check of sav->state

key_allocsa_policy picks a sav of either MATURE or DYING so we
don't need to check its state again.
---
Simplify; omit unnecessary saidx passing

- ipsec_nextisr returns a saidx but no caller uses it
- key_checkrequest is passed a saidx but it can be gotton by
  another argument (isr)
---
Fix splx isn't called on some error paths
---
Fix header size calculation of esp where sav is NULL
---
Fix header size calculation of ah in the case sav is NULL

This fix was also needed for esp.
---
Pass sav directly to opencrypto callback

In a callback, use a passed sav as-is by default and look up a sav
only if the passed sav is dead.
---
Avoid examining freshness of sav on packet processing

If a sav list is sorted (by lft_c->sadb_lifetime_addtime) in advance,
we don't need to examine each sav and also don't need to delete one
on the fly and send up a message. Fortunately every sav lists are sorted
as we need.

Added key_validate_savlist validates that each sav list is surely sorted
(run only if DEBUG because it's not cheap).
---
Add test cases for SAs with different SPIs
---
Prepare to stop using isr->sav

isr is a shared resource and using isr->sav as a temporal storage
for each packet processing is racy. And also having a reference from
isr to sav makes the lifetime of sav non-deterministic; such a reference
is removed when a packet is processed and isr->sav is overwritten by
new one. Let's have a sav locally for each packet processing instead of
using shared isr->sav.

However this change doesn't stop using isr->sav yet because there are
some users of isr->sav. isr->sav will be removed after the users find
a way to not use isr->sav.
---
Fix wrong argument handling
---
fix printf format.
---
Don't validate sav lists of LARVAL or DEAD states

We don't sort the lists so the validation will always fail.

Fix PR kern/52405
---
Make sure to sort the list when changing the state by key_sa_chgstate
---
Rename key_allocsa_policy to key_lookup_sa_bysaidx
---
Separate test files
---
Calculate ah_max_authsize on initialization as well as esp_max_ivlen
---
Remove m_tag_find(PACKET_TAG_IPSEC_PENDING_TDB) because nobody sets the tag
---
Restore a comment removed in previous

The comment is valid for the below code.
---
Make tests more stable

sleep command seems to wait longer than expected on anita so
use polling to wait for a state change.
---
Add tests that explicitly delete SAs instead of waiting for expirations
---
Remove invalid M_AUTHIPDGM check on ESP isr->sav

M_AUTHIPDGM flag is set to a mbuf in ah_input_cb. An sav of ESP can
have AH authentication as sav->tdb_authalgxform. However, in that
case esp_input and esp_input_cb are used to do ESP decryption and
AH authentication and M_AUTHIPDGM never be set to a mbuf. So
checking M_AUTHIPDGM of a mbuf on isr->sav of ESP is meaningless.
---
Look up sav instead of relying on unstable sp->req->sav

This code is executed only in an error path so an additional lookup
doesn't matter.
---
Correct a comment
---
Don't release sav if calling crypto_dispatch again
---
Remove extra KEY_FREESAV from ipsec_process_done

It should be done by the caller.
---
Don't bother the case of crp->crp_buf == NULL in callbacks
---
Hold a reference to an SP during opencrypto processing

An SP has a list of isr (ipsecrequest) that represents a sequence
of IPsec encryption/authentication processing. One isr corresponds
to one opencrypto processing. The lifetime of an isr follows its SP.

We pass an isr to a callback function of opencrypto to continue
to a next encryption/authentication processing. However nobody
guaranteed that the isr wasn't freed, i.e., its SP wasn't destroyed.

In order to avoid such unexpected destruction of isr, hold a reference
to its SP during opencrypto processing.
---
Don't make SAs expired on tests that delete SAs explicitly
---
Fix a debug message
---
Dedup error paths (NFC)
---
Use pool to allocate tdb_crypto

For ESP and AH, we need to allocate an extra variable space in addition
to struct tdb_crypto. The fixed size of pool items may be larger than
an actual requisite size of a buffer, but still the performance
improvement by replacing malloc with pool wins.
---
Don't use unstable isr->sav for header size calculations

We may need to optimize to not look up sav here for users that
don't need to know an exact size of headers (e.g., TCP segmemt size
caclulation).
---
Don't use sp->req->sav when handling NAT-T ESP fragmentation

In order to do this we need to look up a sav however an additional
look-up degrades performance. A sav is later looked up in
ipsec4_process_packet so delay the fragmentation check until then
to avoid an extra look-up.
---
Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).
---
Stop setting isr->sav on looking up sav in key_checkrequest
---
Remove ipsecrequest#sav
---
Stop setting mtag of PACKET_TAG_IPSEC_IN_DONE because there is no users anymore
---
Skip ipsec_spi_*_*_preferred_new_timeout when running on qemu

Probably due to PR 43997
---
Add localcount to rump kernels
---
Remove unused macro
---
Fix key_getcomb_setlifetime

The fix adjusts a soft limit to be 80% of a corresponding hard limit.

I'm not sure the fix is really correct though, at least the original
code is wrong. A passed comb is zero-cleared before calling
key_getcomb_setlifetime, so
  comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
is meaningless.
---
Provide and apply key_sp_refcnt (NFC)

It simplifies further changes.
---
Fix indentation

Pointed out by knakahara@
---
Use pslist(9) for sptree
---
Don't acquire global locks for IPsec if NET_MPSAFE

Note that the change is just to make testing easy and IPsec isn't MP-safe yet.
---
Let PF_KEY socks hold their own lock instead of softnet_lock

Operations on SAD and SPD are executed via PF_KEY socks. The operations
include deletions of SAs and SPs that will use synchronization mechanisms
such as pserialize_perform to wait for references to SAs and SPs to be
released. It is known that using such mechanisms with holding softnet_lock
causes a dead lock. We should avoid the situation.
---
Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@
---
Fix updating ipsec_used

- key_update_used wasn't called in key_api_spddelete2 and key_api_spdflush
- key_update_used wasn't called if an SP had been added/deleted but
  a reply to userland failed
---
Fix updating ipsec_used; turn on when SPs on sockets are added
---
Add missing IPsec policy checks to icmp6_rip6_input

icmp6_rip6_input is quite similar to rip6_input and the same checks exist
in rip6_input.
---
Add test cases for setsockopt(IP_IPSEC_POLICY)
---
Don't use KEY_NEWSP for dummy SP entries

By the change KEY_NEWSP is now not called from softint anymore
and we can use kmem_zalloc with KM_SLEEP for KEY_NEWSP.
---
Comment out unused functions
---
Add test cases that there are SPs but no relevant SAs
---
Don't allow sav->lft_c to be NULL

lft_c of an sav that was created by SADB_GETSPI could be NULL.
---
Clean up clunky eval strings

- Remove unnecessary \ at EOL
  - This allows to omit ; too
- Remove unnecessary quotes for arguments of atf_set
- Don't expand $DEBUG in eval
  - We expect it's expanded on execution

Suggested by kre@
---
Remove unnecessary KEY_FREESAV in an error path

sav should be freed (unreferenced) by the caller.
---
Use pslist(9) for sahtree
---
Use pslist(9) for sah->savtree
---
Rename local variable newsah to sah

It may not be new.
---
MP-ify SAD slightly

- Introduce key_sa_mtx and use it for some list operations
- Use pserialize for some list iterations
---
Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never be actually freed in the future

KEY_SA_UNREF is still key_freesav so no functional change for now.

This change reduces diff of further changes.
---
Remove out-of-date log output

Pointed out by riastradh@
---
Use KDASSERT instead of KASSERT for mutex_ownable

Because mutex_ownable is too heavy to run in a fast path
even for DIAGNOSTIC + LOCKDEBUG.

Suggested by riastradh@
---
Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@
---
Move locking notes
---
Update the locking notes

- Add locking order
- Add locking notes for misc lists such as reglist
- Mention pserialize, key_sp_ref and key_sp_unref on SP operations

Requested by riastradh@
---
Describe constraints of key_sp_ref and key_sp_unref

Requested by riastradh@
---
Hold key_sad.lock on SAVLIST_WRITER_INSERT_TAIL
---
Add __read_mostly to key_psz

Suggested by riastradh@
---
Tweak wording (pserialize critical section => pserialize read section)

Suggested by riastradh@
---
Add missing mutex_exit
---
Fix setkey -D -P outputs

The outputs were tweaked (by me), but I forgot updating libipsec
in my local ATF environment...
---
MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.
---
Introduce key_sa_refcnt and replace sav->refcnt with it (NFC)
---
Destroy sav only in the loop for DEAD sav
---
Fix KASSERT(solocked(sb->sb_so)) failure in sbappendaddr that is called eventually from key_sendup_mbuf

If key_sendup_mbuf isn't passed a socket, the assertion fails.
Originally in this case sb->sb_so was softnet_lock and callers
held softnet_lock so the assertion was magically satisfied.
Now sb->sb_so is key_so_mtx and also softnet_lock isn't always
held by callers so the assertion can fail.

Fix it by holding key_so_mtx if key_sendup_mbuf isn't passed a socket.

Reported by knakahara@
Tested by knakahara@ and ozaki-r@
---
Fix locking notes of SAD
---
Fix deadlock between key_sendup_mbuf called from key_acquire and localcount_drain

If we call key_sendup_mbuf from key_acquire that is called on packet
processing, a deadlock can happen like this:
- At key_acquire, a reference to an SP (and an SA) is held
- key_sendup_mbuf will try to take key_so_mtx
- Some other thread may try to localcount_drain to the SP with
  holding key_so_mtx in say key_api_spdflush
- In this case localcount_drain never return because key_sendup_mbuf
  that has stuck on key_so_mtx never release a reference to the SP

Fix the deadlock by deferring key_sendup_mbuf to the timer
(key_timehandler).
---
Fix that prev isn't cleared on retry
---
Limit the number of mbufs queued for deferred key_sendup_mbuf

It's easy to be queued hundreds of mbufs on the list under heavy
network load.
---
MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.
---
Simplify ipsec_reinject_ipstack (NFC)
---
Add per-CPU rtcache to ipsec_reinject_ipstack

It reduces route lookups and also reduces rtcache lock contentions
when NET_MPSAFE is enabled.
---
Use pool_cache(9) instead of pool(9) for tdb_crypto objects

The change improves network throughput especially on multi-core systems.
---
Update

ipsec(4), opencrypto(9) and vlan(4) are now MP-safe.
---
Write known issues on scalability
---
Share a global dummy SP between PCBs

It's never be changed so it can be pre-allocated and shared safely between PCBs.
---
Fix race condition on the rawcb list shared by rtsock and keysock

keysock now protects itself by its own mutex, which means that
the rawcb list is protected by two different mutexes (keysock's one
and softnet_lock for rtsock), of course it's useless.

Fix the situation by having a discrete rawcb list for each.
---
Use a dedicated mutex for rt_rawcb instead of softnet_lock if NET_MPSAFE
---
fix localcount leak in sav. fixed by ozaki-r@n.o.

I commit on behalf of him.
---
remove unnecessary comment.
---
Fix deadlock between pserialize_perform and localcount_drain

A typical ussage of localcount_drain looks like this:

  mutex_enter(&mtx);
  item = remove_from_list();
  pserialize_perform(psz);
  localcount_drain(&item->localcount, &cv, &mtx);
  mutex_exit(&mtx);

This sequence can cause a deadlock which happens for example on the following
situation:

- Thread A calls localcount_drain which calls xc_broadcast after releasing
  a specified mutex
- Thread B enters the sequence and calls pserialize_perform with holding
  the mutex while pserialize_perform also calls xc_broadcast
- Thread C (xc_thread) that calls an xcall callback of localcount_drain tries
  to hold the mutex

xc_broadcast of thread B doesn't start until xc_broadcast of thread A
finishes, which is a feature of xcall(9). This means that pserialize_perform
never complete until xc_broadcast of thread A finishes. On the other hand,
thread C that is a callee of xc_broadcast of thread A sticks on the mutex.
Finally the threads block each other (A blocks B, B blocks C and C blocks A).

A possible fix is to serialize executions of the above sequence by another
mutex, but adding another mutex makes the code complex, so fix the deadlock
by another way; the fix is to release the mutex before pserialize_perform
and instead use a condvar to prevent pserialize_perform from being called
simultaneously.

Note that the deadlock has happened only if NET_MPSAFE is enabled.
---
Add missing ifdef NET_MPSAFE
---
Take softnet_lock on pr_input properly if NET_MPSAFE

Currently softnet_lock is taken unnecessarily in some cases, e.g.,
icmp_input and encap4_input from ip_input, or not taken even if needed,
e.g., udp_input and tcp_input from ipsec4_common_input_cb. Fix them.

NFC if NET_MPSAFE is disabled (default).
---
- sanitize key debugging so that we don't print extra newlines or unassociated
  debugging messages.
- remove unused functions and make internal ones static
- print information in one line per message
---
humanize printing of ip addresses
---
cast reduction, NFC.
---
Fix typo in comment
---
Pull out ipsec_fill_saidx_bymbuf (NFC)
---
Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.
---
Fix SP is broken on transport mode

isr->saidx was modified accidentally in ipsec_nextisr.

Reported by christos@
Helped investigations by christos@ and knakahara@
---
Constify isr at many places (NFC)
---
Include socketvar.h for softnet_lock
---
Fix buffer length for ipsec_logsastr

Revision 1.122 / (download) - annotate - [select for diffs], Tue Oct 17 07:23:08 2017 UTC (6 years, 4 months ago) by ozaki-r
Branch: MAIN
Changes since 1.121: +3 -3 lines
Diff to previous 1.121 (colored)

Fix buffer length for ipsec_logsastr

Revision 1.121 / (download) - annotate - [select for diffs], Tue Oct 3 08:25:21 2017 UTC (6 years, 4 months ago) by ozaki-r
Branch: MAIN
Changes since 1.120: +26 -26 lines
Diff to previous 1.120 (colored)

Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.

Revision 1.120 / (download) - annotate - [select for diffs], Thu Sep 28 17:21:42 2017 UTC (6 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.119: +5 -8 lines
Diff to previous 1.119 (colored)

- sanitize key debugging so that we don't print extra newlines or unassociated
  debugging messages.
- remove unused functions and make internal ones static
- print information in one line per message

Revision 1.119 / (download) - annotate - [select for diffs], Tue Sep 19 02:44:14 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
Changes since 1.118: +13 -25 lines
Diff to previous 1.118 (colored)

Share a global dummy SP between PCBs

It's never be changed so it can be pre-allocated and shared safely between PCBs.

Revision 1.64.2.3 / (download) - annotate - [select for diffs], Mon Aug 28 17:53:13 2017 UTC (6 years, 6 months ago) by skrll
Branch: nick-nhusb
Changes since 1.64.2.2: +388 -525 lines
Diff to previous 1.64.2.2 (colored) to branchpoint 1.64 (colored) next main 1.65 (colored)

Sync with HEAD

Revision 1.118 / (download) - annotate - [select for diffs], Thu Aug 10 06:11:24 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
CVS Tags: nick-nhusb-base-20170825
Changes since 1.117: +4 -2 lines
Diff to previous 1.117 (colored)

Add per-CPU rtcache to ipsec_reinject_ipstack

It reduces route lookups and also reduces rtcache lock contentions
when NET_MPSAFE is enabled.

Revision 1.117 / (download) - annotate - [select for diffs], Mon Aug 7 03:18:32 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.116: +2 -7 lines
Diff to previous 1.116 (colored)

Remove out-of-date log output

Pointed out by riastradh@

Revision 1.116 / (download) - annotate - [select for diffs], Thu Aug 3 06:32:51 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.115: +5 -5 lines
Diff to previous 1.115 (colored)

Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never be actually freed in the future

KEY_SA_UNREF is still key_freesav so no functional change for now.

This change reduces diff of further changes.

Revision 1.115 / (download) - annotate - [select for diffs], Wed Aug 2 04:03:28 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.114: +6 -2 lines
Diff to previous 1.114 (colored)

Comment out unused functions

Revision 1.114 / (download) - annotate - [select for diffs], Wed Aug 2 03:45:57 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.113: +8 -6 lines
Diff to previous 1.113 (colored)

Don't use KEY_NEWSP for dummy SP entries

By the change KEY_NEWSP is now not called from softint anymore
and we can use kmem_zalloc with KM_SLEEP for KEY_NEWSP.

Revision 1.113 / (download) - annotate - [select for diffs], Wed Aug 2 01:28:03 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.112: +88 -45 lines
Diff to previous 1.112 (colored)

Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@

Revision 1.112 / (download) - annotate - [select for diffs], Wed Jul 26 07:39:54 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.111: +3 -3 lines
Diff to previous 1.111 (colored)

Fix indentation

Pointed out by knakahara@

Revision 1.111 / (download) - annotate - [select for diffs], Wed Jul 26 03:59:59 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.110: +6 -6 lines
Diff to previous 1.110 (colored)

Provide and apply key_sp_refcnt (NFC)

It simplifies further changes.

Revision 1.110 / (download) - annotate - [select for diffs], Fri Jul 21 04:50:11 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.109: +2 -3 lines
Diff to previous 1.109 (colored)

Remove ipsecrequest#sav

Revision 1.109 / (download) - annotate - [select for diffs], Fri Jul 21 04:39:08 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.108: +4 -65 lines
Diff to previous 1.108 (colored)

Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).

Revision 1.108 / (download) - annotate - [select for diffs], Fri Jul 21 03:08:10 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.107: +19 -19 lines
Diff to previous 1.107 (colored)

Don't use sp->req->sav when handling NAT-T ESP fragmentation

In order to do this we need to look up a sav however an additional
look-up degrades performance. A sav is later looked up in
ipsec4_process_packet so delay the fragmentation check until then
to avoid an extra look-up.

Revision 1.107 / (download) - annotate - [select for diffs], Fri Jul 21 02:51:12 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.106: +17 -5 lines
Diff to previous 1.106 (colored)

Don't use unstable isr->sav for header size calculations

We may need to optimize to not look up sav here for users that
don't need to know an exact size of headers (e.g., TCP segmemt size
caclulation).

Revision 1.106 / (download) - annotate - [select for diffs], Wed Jul 19 06:31:54 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.105: +9 -4 lines
Diff to previous 1.105 (colored)

Look up sav instead of relying on unstable sp->req->sav

This code is executed only in an error path so an additional lookup
doesn't matter.

Revision 1.105 / (download) - annotate - [select for diffs], Wed Jul 19 06:30:32 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.104: +2 -14 lines
Diff to previous 1.104 (colored)

Remove invalid M_AUTHIPDGM check on ESP isr->sav

M_AUTHIPDGM flag is set to a mbuf in ah_input_cb. An sav of ESP can
have AH authentication as sav->tdb_authalgxform. However, in that
case esp_input and esp_input_cb are used to do ESP decryption and
AH authentication and M_AUTHIPDGM never be set to a mbuf. So
checking M_AUTHIPDGM of a mbuf on isr->sav of ESP is meaningless.

Revision 1.104 / (download) - annotate - [select for diffs], Tue Jul 18 09:00:55 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.103: +6 -2 lines
Diff to previous 1.103 (colored)

Restore a comment removed in previous

The comment is valid for the below code.

Revision 1.103 / (download) - annotate - [select for diffs], Tue Jul 18 08:55:10 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.102: +2 -12 lines
Diff to previous 1.102 (colored)

Remove m_tag_find(PACKET_TAG_IPSEC_PENDING_TDB) because nobody sets the tag

Revision 1.102 / (download) - annotate - [select for diffs], Wed Jul 12 07:00:40 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: perseant-stdc-iso10646-base, perseant-stdc-iso10646
Changes since 1.101: +3 -3 lines
Diff to previous 1.101 (colored)

Omit unnecessary NULL checks for sav->sah

Revision 1.101 / (download) - annotate - [select for diffs], Fri Jul 7 01:37:34 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.100: +13 -13 lines
Diff to previous 1.100 (colored)

Rename key_alloc* functions (NFC)

We shouldn't use the term "alloc" for functions that just look up
data and actually don't allocate memory.

Revision 1.100 / (download) - annotate - [select for diffs], Wed Jun 14 02:00:43 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.99: +9 -13 lines
Diff to previous 1.99 (colored)

KNF

Revision 1.99 / (download) - annotate - [select for diffs], Fri Jun 2 03:41:20 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
CVS Tags: netbsd-8-base
Branch point for: netbsd-8
Changes since 1.98: +4 -4 lines
Diff to previous 1.98 (colored)

Assert inph_locked on ipsec_pcb_skip_ipsec (was IPSEC_PCB_SKIP_IPSEC)

The assertion confirms SP caches are accessed under inph lock (solock).

Revision 1.98 / (download) - annotate - [select for diffs], Fri Jun 2 03:39:28 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.97: +4 -4 lines
Diff to previous 1.97 (colored)

Rename IPSEC_PCBHINT_MAYBE to IPSEC_PCBHINT_UNKNOWN

MAYBE is maybe unclear.

Revision 1.97 / (download) - annotate - [select for diffs], Fri Jun 2 03:34:10 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.96: +2 -4 lines
Diff to previous 1.96 (colored)

Get rid of redundant NULL check (NFC)

Revision 1.96 / (download) - annotate - [select for diffs], Thu Jun 1 02:45:14 2017 UTC (6 years, 8 months ago) by chs
Branch: MAIN
Changes since 1.95: +2 -12 lines
Diff to previous 1.95 (colored)

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Revision 1.95 / (download) - annotate - [select for diffs], Tue May 30 01:31:07 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.94: +7 -7 lines
Diff to previous 1.94 (colored)

Make refcnt operations of SA and SP atomic

Using atomic opeartions isn't optimal and should be optimized somehow
in the future though, the change allows a kernel with NET_MPSAFE to
run out a benchmark, which is useful to know performance improvement
and degradation by code changes.

Revision 1.94 / (download) - annotate - [select for diffs], Tue May 23 09:08:45 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.93: +4 -4 lines
Diff to previous 1.93 (colored)

Use __arraycount (NFC)

Revision 1.93 / (download) - annotate - [select for diffs], Tue May 23 04:26:08 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.92: +4 -6 lines
Diff to previous 1.92 (colored)

Disable secspacq stuffs that are now unused

The stuffs are used only if sp->policy == IPSEC_POLICY_IPSEC
&& sp->req == NULL (see ipsec{4,6}_checkpolicy). However, in the
current implementation, sp->req never be NULL (except for the
moments of SP allocation and deallocation) if sp->policy is
IPSEC_POLICY_IPSEC.

It seems that the facility was partially implemented in the KAME
era and wasn't completed. Make it clear that the facility is
unused for now by #ifdef notyet. Eventually we should complete
the implementation or remove it entirely.

Revision 1.92 / (download) - annotate - [select for diffs], Fri May 19 04:34:09 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.91: +31 -32 lines
Diff to previous 1.91 (colored)

Introduce IPSECLOG and replace ipseclog and DPRINTF with it

Revision 1.84.2.3 / (download) - annotate - [select for diffs], Fri May 19 00:22:58 2017 UTC (6 years, 9 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.84.2.2: +29 -44 lines
Diff to previous 1.84.2.2 (colored) to branchpoint 1.84 (colored) next main 1.85 (colored)

Resolve conflicts from previous merge (all resulting from $NetBSD
keywork expansion)

Revision 1.91 / (download) - annotate - [select for diffs], Tue May 16 07:25:57 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base3
Changes since 1.90: +8 -5 lines
Diff to previous 1.90 (colored)

Fix diagnostic assertion failure in ipsec_init_policy

  panic: kernel diagnostic assertion "!cpu_softintr_p()" failed: file "../../../../netipsec/ipsec.c", line 1277
  cpu7: Begin traceback...
  vpanic() at netbsd:vpanic+0x140
  ch_voltag_convert_in() at netbsd:ch_voltag_convert_in
  ipsec_init_policy() at netbsd:ipsec_init_policy+0x149
  in_pcballoc() at netbsd:in_pcballoc+0x1c5
  tcp_attach_wrapper() at netbsd:tcp_attach_wrapper+0x1e1
  sonewconn() at netbsd:sonewconn+0x1ea
  syn_cache_get() at netbsd:syn_cache_get+0x15f
  tcp_input() at netbsd:tcp_input+0x1689
  ipintr() at netbsd:ipintr+0xa88
  softint_dispatch() at netbsd:softint_dispatch+0xd3
  DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe811d337ff0
  Xsoftintr() at netbsd:Xsoftintr+0x4f

Reported by msaitoh@

Revision 1.90 / (download) - annotate - [select for diffs], Tue May 16 03:05:28 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.89: +16 -11 lines
Diff to previous 1.89 (colored)

Use kmem(9) instead of malloc/free

Some of non-sleepable allocations can be replaced with sleepable ones.
To make it clear that the replacements are possible, some assertions
are addded.

Revision 1.89 / (download) - annotate - [select for diffs], Mon May 15 09:55:29 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.88: +3 -3 lines
Diff to previous 1.88 (colored)

Show __func__ instead of __FILE__ in debug log messages

__func__ is shorter and more useful than __FILE__.

Revision 1.88 / (download) - annotate - [select for diffs], Thu May 11 05:55:14 2017 UTC (6 years, 9 months ago) by ryo
Branch: MAIN
Changes since 1.87: +15 -38 lines
Diff to previous 1.87 (colored)

Make ipsec_address() and ipsec_logsastr() mpsafe.

Revision 1.84.2.2 / (download) - annotate - [select for diffs], Thu May 11 02:58:41 2017 UTC (6 years, 9 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.84.2.1: +6 -5 lines
Diff to previous 1.84.2.1 (colored) to branchpoint 1.84 (colored)

Sync with HEAD

Revision 1.87 / (download) - annotate - [select for diffs], Wed May 10 09:34:52 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base2
Changes since 1.86: +5 -4 lines
Diff to previous 1.86 (colored)

Stop ipsec4_output returning SP to the caller

SP isn't used by the caller (ip_output) and also holding its
reference looks unnecessary.

Revision 1.86 / (download) - annotate - [select for diffs], Mon May 8 06:39:23 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.85: +3 -3 lines
Diff to previous 1.85 (colored)

Omit two arguments of ipsec4_process_packet

flags is unused and tunalready is always 0. So NFC.

Revision 1.84.2.1 / (download) - annotate - [select for diffs], Tue May 2 03:19:22 2017 UTC (6 years, 9 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.84: +3 -4 lines
Diff to previous 1.84 (colored)

Sync with HEAD - tag prg-localcount2-base1

Revision 1.85 / (download) - annotate - [select for diffs], Fri Apr 28 02:29:38 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base1
Changes since 1.84: +3 -4 lines
Diff to previous 1.84 (colored)

Fix function name in log message

Revision 1.66.2.3 / (download) - annotate - [select for diffs], Wed Apr 26 02:53:29 2017 UTC (6 years, 10 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.66.2.2: +181 -259 lines
Diff to previous 1.66.2.2 (colored) to branchpoint 1.66 (colored) next main 1.67 (colored)

Sync with HEAD

Revision 1.84 / (download) - annotate - [select for diffs], Tue Apr 25 05:44:11 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base, pgoyette-localcount-20170426
Branch point for: prg-localcount2
Changes since 1.83: +11 -2 lines
Diff to previous 1.83 (colored)

Check if solock of PCB is held when SP caches in the PCB are accessed

To this end, a back pointer from inpcbpolicy to inpcb_hdr is added.

Revision 1.67.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:06 2017 UTC (6 years, 10 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.67: +179 -270 lines
Diff to previous 1.67 (colored) next main 1.68 (colored)

Sync with HEAD

Revision 1.83 / (download) - annotate - [select for diffs], Fri Apr 21 08:39:06 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: bouyer-socketcan-base1
Changes since 1.82: +10 -10 lines
Diff to previous 1.82 (colored)

Use inph for variable name of struct inpcb_hdr (NFC)

Revision 1.82 / (download) - annotate - [select for diffs], Thu Apr 20 08:46:07 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.81: +10 -10 lines
Diff to previous 1.81 (colored)

Remove unnecessary NULL checks for inp_socket and in6p_socket

They cannot be NULL except for programming errors.

Revision 1.81 / (download) - annotate - [select for diffs], Thu Apr 20 03:41:47 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.80: +7 -25 lines
Diff to previous 1.80 (colored)

Provide IPSEC_DIR_* validation macros

Revision 1.80 / (download) - annotate - [select for diffs], Wed Apr 19 07:19:46 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.79: +6 -11 lines
Diff to previous 1.79 (colored)

Use KASSERT for sanity checks of function arguments

Revision 1.79 / (download) - annotate - [select for diffs], Wed Apr 19 07:14:45 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.78: +4 -6 lines
Diff to previous 1.78 (colored)

Change ifdef DIAGNOSTIC + panic to KASSERT

Revision 1.78 / (download) - annotate - [select for diffs], Wed Apr 19 03:43:34 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.77: +12 -12 lines
Diff to previous 1.77 (colored)

Fix indentations (NFC)

Revision 1.77 / (download) - annotate - [select for diffs], Wed Apr 19 03:42:11 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.76: +59 -53 lines
Diff to previous 1.76 (colored)

Tweak KEYDEBUG macros

Let's avoid passing statements to a macro.

Revision 1.76 / (download) - annotate - [select for diffs], Wed Apr 19 03:40:58 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.75: +5 -13 lines
Diff to previous 1.75 (colored)

Change panic if DIAGNOSTIC to KASSERT

One can be changed to CTASSERT.

Revision 1.75 / (download) - annotate - [select for diffs], Wed Apr 19 03:39:14 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.74: +17 -18 lines
Diff to previous 1.74 (colored)

Retire ipsec_osdep.h

We don't need to care other OSes (FreeBSD) anymore.

Some macros are alive in ipsec_private.h.

Revision 1.74 / (download) - annotate - [select for diffs], Wed Apr 19 03:28:19 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.73: +5 -3 lines
Diff to previous 1.73 (colored)

Improve message on assertion failure

Revision 1.73 / (download) - annotate - [select for diffs], Tue Apr 18 05:26:41 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.72: +67 -74 lines
Diff to previous 1.72 (colored)

Convert IPSEC_ASSERT to KASSERT or KASSERTMSG

IPSEC_ASSERT just discarded specified message...

Revision 1.72 / (download) - annotate - [select for diffs], Tue Apr 18 05:25:32 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.71: +2 -63 lines
Diff to previous 1.71 (colored)

Remove __FreeBSD__ and __NetBSD__ switches

No functional changes (except for a debug printf).

Note that there remain some __FreeBSD__ for sysctl knobs which counerparts
to NetBSD don't exist. And ipsec_osdep.h isn't touched yet; tidying it up
requires actual code changes.

Revision 1.71 / (download) - annotate - [select for diffs], Thu Apr 6 09:20:07 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: jdolecek-ncq-base, jdolecek-ncq
Changes since 1.70: +9 -2 lines
Diff to previous 1.70 (colored)

Prepare netipsec for rump-ification

- Include "opt_*.h" only if _KERNEL_OPT is defined
- Allow encapinit to be called twice (by ifinit and ipe4_attach)
  - ifinit didn't call encapinit if IPSEC is enabled (ipe4_attach called
    it instead), however, on a rump kernel ipe4_attach may not be called
    even if IPSEC is enabled. So we need to allow ifinit to call it anyway
- Setup sysctls in ipsec_attach explicitly instead of using SYSCTL_SETUP
- Call ip6flow_invalidate_all in key_spdadd only if in6_present
  - It's possible that a rump kernel loads the ipsec library but not
    the inet6 library

Revision 1.66.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:57:51 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.66.2.1: +9 -13 lines
Diff to previous 1.66.2.1 (colored) to branchpoint 1.66 (colored)

Sync with HEAD

Revision 1.70 / (download) - annotate - [select for diffs], Fri Mar 3 07:13:06 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170320
Changes since 1.69: +4 -12 lines
Diff to previous 1.69 (colored)

Pass inpcb/in6pcb instead of socket to ip_output/ip6_output

- Passing a socket to Layer 3 is layer violation and even unnecessary
- The change makes codes of callers and IPsec a bit simple

Revision 1.64.2.2 / (download) - annotate - [select for diffs], Sun Feb 5 13:41:00 2017 UTC (7 years ago) by skrll
Branch: nick-nhusb
Changes since 1.64.2.1: +8 -3 lines
Diff to previous 1.64.2.1 (colored) to branchpoint 1.64 (colored)

Sync with HEAD

Revision 1.69 / (download) - annotate - [select for diffs], Mon Jan 16 15:44:47 2017 UTC (7 years, 1 month ago) by christos
Branch: MAIN
CVS Tags: nick-nhusb-base-20170204
Changes since 1.68: +3 -3 lines
Diff to previous 1.68 (colored)

ip6_sprintf -> IN6_PRINT so that we pass the size.

Revision 1.68 / (download) - annotate - [select for diffs], Mon Jan 16 07:33:36 2017 UTC (7 years, 1 month ago) by ryo
Branch: MAIN
Changes since 1.67: +7 -3 lines
Diff to previous 1.67 (colored)

Make ip6_sprintf(), in_fmtaddr(), lla_snprintf() and icmp6_redirect_diag() mpsafe.

Reviewed by ozaki-r@

Revision 1.66.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:56:52 2017 UTC (7 years, 1 month ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.66: +3 -2 lines
Diff to previous 1.66 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.67 / (download) - annotate - [select for diffs], Thu Dec 8 05:16:34 2016 UTC (7 years, 2 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.66: +3 -2 lines
Diff to previous 1.66 (colored)

Add rtcache_unref to release points of rtentry stemming from rtcache

In the MP-safe world, a rtentry stemming from a rtcache can be freed at any
points. So we need to protect rtentries somehow say by reference couting or
passive references. Regardless of the method, we need to call some release
function of a rtentry after using it.

The change adds a new function rtcache_unref to release a rtentry. At this
point, this function does nothing because for now we don't add a reference
to a rtentry when we get one from a rtcache. We will add something useful
in a further commit.

This change is a part of changes for MP-safe routing table. It is separated
to avoid one big change that makes difficult to debug by bisecting.

Revision 1.64.2.1 / (download) - annotate - [select for diffs], Mon Apr 6 15:18:23 2015 UTC (8 years, 10 months ago) by skrll
Branch: nick-nhusb
Changes since 1.64: +49 -4 lines
Diff to previous 1.64 (colored)

Sync with HEAD

Revision 1.66 / (download) - annotate - [select for diffs], Wed Apr 1 02:49:44 2015 UTC (8 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.65: +48 -3 lines
Diff to previous 1.65 (colored)

Pull out ipsec routines from ip6_input

This change reduces symbol references from netinet6 to netipsec
and improves modularity of netipsec.

No functional change is intended.

Revision 1.65 / (download) - annotate - [select for diffs], Wed Apr 1 01:44:56 2015 UTC (8 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.64: +3 -3 lines
Diff to previous 1.64 (colored)

Fix wrong comments

Revision 1.56.2.3 / (download) - annotate - [select for diffs], Wed Aug 20 00:04:36 2014 UTC (9 years, 6 months ago) by tls
Branch: tls-maxphys
Changes since 1.56.2.2: +151 -165 lines
Diff to previous 1.56.2.2 (colored) to branchpoint 1.56 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.64 / (download) - annotate - [select for diffs], Wed Aug 13 19:43:47 2014 UTC (9 years, 6 months ago) by plunky
Branch: MAIN
CVS Tags: nick-nhusb-base
Branch point for: nick-nhusb
Changes since 1.63: +3 -3 lines
Diff to previous 1.63 (colored)

C99 6.5.15 Conditional operator note 3 states that the second and
third operators of a ?: operation shoud (amongst other conditions)
either both be integer type, or both void type. cast the second
to (void) then, as log() is already a void and no result is desired.

Revision 1.62.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 06:56:34 2014 UTC (9 years, 6 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.62: +5 -2 lines
Diff to previous 1.62 (colored) next main 1.63 (colored)

Rebase.

Revision 1.63 / (download) - annotate - [select for diffs], Fri May 30 01:39:03 2014 UTC (9 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-1-RELEASE, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE
Branch point for: netbsd-7-1, netbsd-7-0, netbsd-7
Changes since 1.62: +5 -2 lines
Diff to previous 1.62 (colored)

Introduce 2 new variables: ipsec_enabled and ipsec_used.
Ipsec enabled is controlled by sysctl and determines if is allowed.
ipsec_used is set automatically based on ipsec being enabled, and
rules existing.

Revision 1.55.2.3 / (download) - annotate - [select for diffs], Thu May 22 11:41:10 2014 UTC (9 years, 9 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.55.2.2: +362 -167 lines
Diff to previous 1.55.2.2 (colored) to branchpoint 1.55 (colored) next main 1.56 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.60.2.2 / (download) - annotate - [select for diffs], Sun May 18 17:46:13 2014 UTC (9 years, 9 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.60.2.1: +150 -167 lines
Diff to previous 1.60.2.1 (colored) to branchpoint 1.60 (colored) next main 1.61 (colored)

sync with head

Revision 1.62 / (download) - annotate - [select for diffs], Tue Dec 24 15:48:53 2013 UTC (10 years, 2 months ago) by christos
Branch: MAIN
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.61: +150 -167 lines
Diff to previous 1.61 (colored)

fix debugging output printfs to use __func__ so they print the correct names.

Revision 1.61 / (download) - annotate - [select for diffs], Tue Dec 24 13:57:06 2013 UTC (10 years, 2 months ago) by degroote
Branch: MAIN
Changes since 1.60: +3 -3 lines
Diff to previous 1.60 (colored)

fix a typo in the log ouput of ipsec4_get_policy

Revision 1.60.2.1 / (download) - annotate - [select for diffs], Wed Jul 17 03:16:31 2013 UTC (10 years, 7 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.60: +12 -11 lines
Diff to previous 1.60 (colored)

Checkpoint work in progress:
- Move PCB structures under __INPCB_PRIVATE, adjust most of the callers
  and thus make IPv4 PCB structures mostly opaque.  Any volunteers for
  merging in6pcb with inpcb (see rpaulo-netinet-merge-pcb branch)?
- Move various global vars to the modules where they belong, make them static.
- Some preliminary work for IPv4 PCB locking scheme.
- Make raw IP code mostly MP-safe.  Simplify some of it.
- Rework "fast" IP forwarding (ipflow) code to be mostly MP-safe.  It should
  run from a software interrupt, rather than hard.
- Rework tun(4) pseudo interface to be MP-safe.
- Work towards making some other interfaces more strict.

Revision 1.56.2.2 / (download) - annotate - [select for diffs], Sun Jun 23 06:20:26 2013 UTC (10 years, 8 months ago) by tls
Branch: tls-maxphys
Changes since 1.56.2.1: +214 -2 lines
Diff to previous 1.56.2.1 (colored) to branchpoint 1.56 (colored)

resync from head

Revision 1.60 / (download) - annotate - [select for diffs], Sat Jun 8 13:50:22 2013 UTC (10 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Branch point for: rmind-smpnet
Changes since 1.59: +107 -2 lines
Diff to previous 1.59 (colored)

Split IPsec code in ip_input() and ip_forward() into the separate routines
ipsec4_input() and ipsec4_forward().  Tested by christos@.

Revision 1.59 / (download) - annotate - [select for diffs], Sat Jun 8 03:26:05 2013 UTC (10 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.58: +98 -2 lines
Diff to previous 1.58 (colored)

Split IPSec logic from ip_output() into a separate routine - ipsec4_output().
No change to the mechanism intended.  Tested by christos@.

Revision 1.58 / (download) - annotate - [select for diffs], Tue Jun 4 22:47:37 2013 UTC (10 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.57: +13 -2 lines
Diff to previous 1.57 (colored)

PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

Revision 1.56.2.1 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:06 2013 UTC (11 years ago) by tls
Branch: tls-maxphys
Changes since 1.56: +28 -28 lines
Diff to previous 1.56 (colored)

resync with head

Revision 1.55.2.2 / (download) - annotate - [select for diffs], Wed Jan 16 05:33:50 2013 UTC (11 years, 1 month ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.55.2.1: +28 -28 lines
Diff to previous 1.55.2.1 (colored) to branchpoint 1.55 (colored)

sync with (a bit old) head

Revision 1.57 / (download) - annotate - [select for diffs], Fri Dec 7 15:29:38 2012 UTC (11 years, 2 months ago) by christos
Branch: MAIN
CVS Tags: yamt-pagecache-base8, yamt-pagecache-base7, khorben-n900, agc-symver-base, agc-symver
Changes since 1.56: +28 -28 lines
Diff to previous 1.56 (colored)

rename pcb_sp to policy to avoid:
$SRC/arch/arm/include/pcb.h:#define     pcb_sp          pcb_un.un_32.pcb32_sp
$SRC/arch/arm/include/pcb.h:#define     pcb_sp          pcb_sf.sf_r13

Revision 1.55.2.1 / (download) - annotate - [select for diffs], Tue Apr 17 00:08:46 2012 UTC (11 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.55: +4 -4 lines
Diff to previous 1.55 (colored)

sync with head

Revision 1.55.6.1 / (download) - annotate - [select for diffs], Thu Apr 5 21:33:48 2012 UTC (11 years, 10 months ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.55: +4 -4 lines
Diff to previous 1.55 (colored) next main 1.56 (colored)

sync to latest -current.

Revision 1.56 / (download) - annotate - [select for diffs], Tue Mar 13 18:41:00 2012 UTC (11 years, 11 months ago) by elad
Branch: MAIN
CVS Tags: yamt-pagecache-base6, yamt-pagecache-base5, yamt-pagecache-base4, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base10
Branch point for: tls-maxphys
Changes since 1.55: +4 -4 lines
Diff to previous 1.55 (colored)

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

    http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
    http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
    http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

Revision 1.51.2.1 / (download) - annotate - [select for diffs], Thu Jun 23 14:20:26 2011 UTC (12 years, 8 months ago) by cherry
Branch: cherry-xenmp
Changes since 1.51: +37 -41 lines
Diff to previous 1.51 (colored) next main 1.52 (colored)

Catchup with rmind-uvmplock merge.

Revision 1.47.4.3 / (download) - annotate - [select for diffs], Sun Jun 12 00:24:30 2011 UTC (12 years, 8 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.47.4.2: +35 -39 lines
Diff to previous 1.47.4.2 (colored) to branchpoint 1.47 (colored) next main 1.48 (colored)

sync with head

Revision 1.55 / (download) - annotate - [select for diffs], Thu Jun 9 19:54:18 2011 UTC (12 years, 8 months ago) by drochner
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, rmind-uvmplock-nbase, rmind-uvmplock-base, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3, jmcneill-usbmp-base2, jmcneill-usbmp-base, jmcneill-audiomp3-base, jmcneill-audiomp3
Branch point for: yamt-pagecache, netbsd-6-1, netbsd-6-0, netbsd-6, jmcneill-usbmp
Changes since 1.54: +30 -31 lines
Diff to previous 1.54 (colored)

more "const"

Revision 1.54 / (download) - annotate - [select for diffs], Wed Jun 8 16:24:50 2011 UTC (12 years, 8 months ago) by dyoung
Branch: MAIN
Changes since 1.53: +3 -3 lines
Diff to previous 1.53 (colored)

Fiddle a bit with const's to make FAST_IPSEC compile.

Revision 1.48.2.1 / (download) - annotate - [select for diffs], Mon Jun 6 09:10:01 2011 UTC (12 years, 8 months ago) by jruoho
Branch: jruoho-x86intr
Changes since 1.48: +28 -23 lines
Diff to previous 1.48 (colored) next main 1.49 (colored)

Sync with HEAD.

Revision 1.53 / (download) - annotate - [select for diffs], Sun Jun 5 01:45:37 2011 UTC (12 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.52: +4 -6 lines
Diff to previous 1.52 (colored)

more malloc style.

Revision 1.52 / (download) - annotate - [select for diffs], Sun Jun 5 01:40:40 2011 UTC (12 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.51: +9 -10 lines
Diff to previous 1.51 (colored)

- sprinkle const
- malloc style

Revision 1.47.4.2 / (download) - annotate - [select for diffs], Tue May 31 03:05:09 2011 UTC (12 years, 9 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.47.4.1: +6 -6 lines
Diff to previous 1.47.4.1 (colored) to branchpoint 1.47 (colored)

sync with head

Revision 1.51 / (download) - annotate - [select for diffs], Mon May 16 10:00:32 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
CVS Tags: cherry-xenmp-base
Branch point for: cherry-xenmp
Changes since 1.50: +8 -8 lines
Diff to previous 1.50 (colored)

cosmetical whitespace changes

Revision 1.47.4.1 / (download) - annotate - [select for diffs], Sat Mar 5 20:55:59 2011 UTC (12 years, 11 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.47: +15 -9 lines
Diff to previous 1.47 (colored)

sync with head

Revision 1.48.4.2 / (download) - annotate - [select for diffs], Sat Mar 5 15:10:47 2011 UTC (12 years, 11 months ago) by bouyer
Branch: bouyer-quota2
Changes since 1.48.4.1: +7 -7 lines
Diff to previous 1.48.4.1 (colored) to branchpoint 1.48 (colored) next main 1.49 (colored)

Sync with HEAD

Revision 1.50 / (download) - annotate - [select for diffs], Fri Feb 18 19:06:45 2011 UTC (13 years ago) by drochner
Branch: MAIN
CVS Tags: bouyer-quota2-nbase
Changes since 1.49: +7 -7 lines
Diff to previous 1.49 (colored)

sprinkle some "const", documenting that the SA is not supposed to
change during an xform operation

Revision 1.48.4.1 / (download) - annotate - [select for diffs], Thu Feb 17 12:00:49 2011 UTC (13 years ago) by bouyer
Branch: bouyer-quota2
Changes since 1.48: +10 -2 lines
Diff to previous 1.48 (colored)

Sync with HEAD

Revision 1.49 / (download) - annotate - [select for diffs], Fri Feb 11 17:53:35 2011 UTC (13 years ago) by drochner
Branch: MAIN
CVS Tags: bouyer-quota2-base
Changes since 1.48: +10 -2 lines
Diff to previous 1.48 (colored)

invalidate the secpolicy cache bin the PCB before destroying, so that
the refcount in the (global) policies gets decremented
(This apparently was missed when the policy cache code was copied
over from KAME IPSEC.)
From Wolfgang Stukenbrock per PR kern/44410, just fixed differently
to avoid unecessary differences to KAME.

Revision 1.47.2.1 / (download) - annotate - [select for diffs], Tue Aug 17 06:47:48 2010 UTC (13 years, 6 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.47: +2 -4 lines
Diff to previous 1.47 (colored) next main 1.48 (colored)

Sync with HEAD.

Revision 1.37.2.6 / (download) - annotate - [select for diffs], Wed Aug 11 22:54:57 2010 UTC (13 years, 6 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37.2.5: +2 -4 lines
Diff to previous 1.37.2.5 (colored) to branchpoint 1.37 (colored) next main 1.38 (colored)

sync with head.

Revision 1.48 / (download) - annotate - [select for diffs], Wed Jul 21 20:41:31 2010 UTC (13 years, 7 months ago) by jakllsch
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, yamt-nfs-mp-base10, uebayasi-xip-base4, uebayasi-xip-base3, uebayasi-xip-base2, matt-mips64-premerge-20101231, jruoho-x86intr-base
Branch point for: jruoho-x86intr, bouyer-quota2
Changes since 1.47: +2 -4 lines
Diff to previous 1.47 (colored)

Further silence ipsec_attach().
"initializing IPsec..."" done" is of somewhat limited value.
(I normally wouldn't care; but on my box the (root) uhub(4)s attach
between the first and last portion of the line.)

Revision 1.39.14.1 / (download) - annotate - [select for diffs], Wed Apr 21 00:28:23 2010 UTC (13 years, 10 months ago) by matt
Branch: matt-nb5-mips64
CVS Tags: matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-k15
Changes since 1.39: +7 -5 lines
Diff to previous 1.39 (colored) next main 1.40 (colored)

sync to netbsd-5

Revision 1.37.2.5 / (download) - annotate - [select for diffs], Thu Mar 11 15:04:30 2010 UTC (13 years, 11 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37.2.4: +4 -4 lines
Diff to previous 1.37.2.4 (colored) to branchpoint 1.37 (colored)

sync with head

Revision 1.39.6.2 / (download) - annotate - [select for diffs], Sun Feb 14 13:35:44 2010 UTC (14 years ago) by bouyer
Branch: netbsd-5
CVS Tags: netbsd-5-2-RELEASE, netbsd-5-2-RC1, netbsd-5-2-3-RELEASE, netbsd-5-2-2-RELEASE, netbsd-5-2-1-RELEASE, netbsd-5-2, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-5-RELEASE, netbsd-5-1-4-RELEASE, netbsd-5-1-3-RELEASE, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, matt-nb5-pq3-base, matt-nb5-pq3
Changes since 1.39.6.1: +4 -4 lines
Diff to previous 1.39.6.1 (colored) to branchpoint 1.39 (colored) next main 1.40 (colored)

Pull up following revision(s) (requested by hubertf in ticket #1290):
	sys/kern/kern_ksyms.c: revision 1.53
	sys/dev/pci/agp_via.c: revision 1.18
	sys/netipsec/key.c: revision 1.63
	sys/arch/x86/x86/x86_autoconf.c: revision 1.49
	sys/kern/init_main.c: revision 1.415
	sys/kern/cnmagic.c: revision 1.11
	sys/netipsec/ipsec.c: revision 1.47
	sys/arch/x86/x86/pmap.c: revision 1.100
	sys/netkey/key.c: revision 1.176
Replace more printfs with aprint_normal / aprint_verbose
Makes "boot -z" go mostly silent for me.

Revision 1.47 / (download) - annotate - [select for diffs], Sun Jan 31 00:43:38 2010 UTC (14 years ago) by hubertf
Branch: MAIN
CVS Tags: yamt-nfs-mp-base9, uebayasi-xip-base1, uebayasi-xip-base
Branch point for: uebayasi-xip, rmind-uvmplock
Changes since 1.46: +4 -4 lines
Diff to previous 1.46 (colored)

Replace more printfs with aprint_normal / aprint_verbose
Makes "boot -z" go mostly silent for me.

Revision 1.37.2.4 / (download) - annotate - [select for diffs], Wed Aug 19 18:48:25 2009 UTC (14 years, 6 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37.2.3: +5 -3 lines
Diff to previous 1.37.2.3 (colored) to branchpoint 1.37 (colored)

sync with head.

Revision 1.39.12.1 / (download) - annotate - [select for diffs], Fri Aug 7 06:07:14 2009 UTC (14 years, 6 months ago) by snj
Branch: netbsd-5-0
CVS Tags: netbsd-5-0-2-RELEASE
Changes since 1.39: +5 -3 lines
Diff to previous 1.39 (colored) next main 1.40 (colored)

Pull up following revision(s) (requested by jakllsch in ticket #884):
	sys/netipsec/ipsec.c: revision 1.46
As explained in kern/41701 there's a missing splx() here.

Revision 1.39.6.1 / (download) - annotate - [select for diffs], Fri Aug 7 06:05:50 2009 UTC (14 years, 6 months ago) by snj
Branch: netbsd-5
Changes since 1.39: +5 -3 lines
Diff to previous 1.39 (colored)

Pull up following revision(s) (requested by jakllsch in ticket #884):
	sys/netipsec/ipsec.c: revision 1.46
As explained in kern/41701 there's a missing splx() here.

Revision 1.46 / (download) - annotate - [select for diffs], Thu Jul 30 14:41:59 2009 UTC (14 years, 7 months ago) by jakllsch
Branch: MAIN
CVS Tags: yamt-nfs-mp-base8, yamt-nfs-mp-base7, matt-premerge-20091211, jym-xensuspend-nbase
Changes since 1.45: +5 -3 lines
Diff to previous 1.45 (colored)

As explained in kern/41701 there's a missing splx() here.

Revision 1.39.10.2 / (download) - annotate - [select for diffs], Thu Jul 23 23:32:52 2009 UTC (14 years, 7 months ago) by jym
Branch: jym-xensuspend
Changes since 1.39.10.1: +4 -4 lines
Diff to previous 1.39.10.1 (colored) to branchpoint 1.39 (colored) next main 1.40 (colored)

Sync with HEAD.

Revision 1.37.2.3 / (download) - annotate - [select for diffs], Sat Jul 18 14:53:25 2009 UTC (14 years, 7 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37.2.2: +4 -4 lines
Diff to previous 1.37.2.2 (colored) to branchpoint 1.37 (colored)

sync with head.

Revision 1.45 / (download) - annotate - [select for diffs], Thu Jun 25 17:39:51 2009 UTC (14 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: yamt-nfs-mp-base6, jymxensuspend-base
Changes since 1.44: +4 -4 lines
Diff to previous 1.44 (colored)

Only print debugging messages about policy on error.

Revision 1.37.2.2 / (download) - annotate - [select for diffs], Sat May 16 10:41:51 2009 UTC (14 years, 9 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37.2.1: +16 -10 lines
Diff to previous 1.37.2.1 (colored) to branchpoint 1.37 (colored)

sync with head

Revision 1.39.10.1 / (download) - annotate - [select for diffs], Wed May 13 17:22:41 2009 UTC (14 years, 9 months ago) by jym
Branch: jym-xensuspend
Changes since 1.39: +34 -28 lines
Diff to previous 1.39 (colored)

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

Revision 1.44 / (download) - annotate - [select for diffs], Sun May 10 02:13:07 2009 UTC (14 years, 9 months ago) by elad
Branch: MAIN
CVS Tags: yamt-nfs-mp-base5, yamt-nfs-mp-base4, jym-xensuspend-base
Changes since 1.43: +16 -10 lines
Diff to previous 1.43 (colored)

Adapt FAST_IPSEC to recent KPI changes.

Pointed out by dyoung@ on tech-kern@, thanks!

Revision 1.37.2.1 / (download) - annotate - [select for diffs], Mon May 4 08:14:19 2009 UTC (14 years, 9 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.37: +41 -20 lines
Diff to previous 1.37 (colored)

sync with head.

Revision 1.39.4.1 / (download) - annotate - [select for diffs], Tue Apr 28 07:37:34 2009 UTC (14 years, 10 months ago) by skrll
Branch: nick-hppapmap
Changes since 1.39: +20 -20 lines
Diff to previous 1.39 (colored) next main 1.40 (colored)

Sync with HEAD.

Revision 1.43 / (download) - annotate - [select for diffs], Sat Apr 18 14:58:06 2009 UTC (14 years, 10 months ago) by tsutsui
Branch: MAIN
CVS Tags: yamt-nfs-mp-base3, nick-hppapmap-base4, nick-hppapmap-base3, nick-hppapmap-base
Changes since 1.42: +6 -6 lines
Diff to previous 1.42 (colored)

Remove extra whitespace added by a stupid tool.
XXX: more in src/sys/arch

Revision 1.42 / (download) - annotate - [select for diffs], Wed Mar 18 17:06:52 2009 UTC (14 years, 11 months ago) by cegger
Branch: MAIN
Changes since 1.41: +6 -6 lines
Diff to previous 1.41 (colored)

bcopy -> memcpy

Revision 1.41 / (download) - annotate - [select for diffs], Wed Mar 18 16:00:23 2009 UTC (14 years, 11 months ago) by cegger
Branch: MAIN
Changes since 1.40: +15 -15 lines
Diff to previous 1.40 (colored)

bzero -> memset

Revision 1.40 / (download) - annotate - [select for diffs], Wed Mar 18 15:14:32 2009 UTC (14 years, 11 months ago) by cegger
Branch: MAIN
Changes since 1.39: +3 -3 lines
Diff to previous 1.39 (colored)

bcmp -> memcmp

Revision 1.37.4.1 / (download) - annotate - [select for diffs], Thu Sep 18 04:37:01 2008 UTC (15 years, 5 months ago) by wrstuden
Branch: wrstuden-revivesa
Changes since 1.37: +23 -2 lines
Diff to previous 1.37 (colored) next main 1.38 (colored)

Sync with wrstuden-revivesa-base-2.

Revision 1.37.6.2 / (download) - annotate - [select for diffs], Thu Jul 3 18:38:20 2008 UTC (15 years, 7 months ago) by simonb
Branch: simonb-wapbl
Changes since 1.37.6.1: +4 -4 lines
Diff to previous 1.37.6.1 (colored) to branchpoint 1.37 (colored) next main 1.38 (colored)

Sync with head.

Revision 1.36.6.2 / (download) - annotate - [select for diffs], Sun Jun 29 09:33:19 2008 UTC (15 years, 8 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.36.6.1: +21 -0 lines
Diff to previous 1.36.6.1 (colored) to branchpoint 1.36 (colored) next main 1.37 (colored)

Sync with HEAD.

Revision 1.39 / (download) - annotate - [select for diffs], Fri Jun 27 17:28:24 2008 UTC (15 years, 8 months ago) by degroote
Branch: MAIN
CVS Tags: wrstuden-revivesa-base-4, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, simonb-wapbl-nbase, simonb-wapbl-base, nick-hppapmap-base2, netbsd-5-base, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-1-RELEASE, mjf-devfs2-base, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20091211, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, haad-nbase2, haad-dm-base2, haad-dm-base1, haad-dm-base, haad-dm, ad-audiomp2-base, ad-audiomp2
Branch point for: nick-hppapmap, netbsd-5-0, netbsd-5, matt-nb5-mips64, jym-xensuspend
Changes since 1.38: +4 -4 lines
Diff to previous 1.38 (colored)

Kill caddr_t introduced in the previous revision
Fix build with FAST_IPSEC

Revision 1.37.6.1 / (download) - annotate - [select for diffs], Fri Jun 27 15:11:49 2008 UTC (15 years, 8 months ago) by simonb
Branch: simonb-wapbl
Changes since 1.37: +23 -2 lines
Diff to previous 1.37 (colored)

Sync with head.

Revision 1.38 / (download) - annotate - [select for diffs], Fri Jun 27 05:18:58 2008 UTC (15 years, 8 months ago) by mlelstv
Branch: MAIN
Changes since 1.37: +23 -2 lines
Diff to previous 1.37 (colored)

Verify icmp type and code in IPSEC rules.
Fixes PR kern/39018

Revision 1.36.6.1 / (download) - annotate - [select for diffs], Mon Jun 2 13:24:28 2008 UTC (15 years, 8 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.36: +18 -12 lines
Diff to previous 1.36 (colored)

Sync with HEAD.

Revision 1.36.8.1 / (download) - annotate - [select for diffs], Sun May 18 12:35:40 2008 UTC (15 years, 9 months ago) by yamt
Branch: yamt-pf42
Changes since 1.36: +18 -12 lines
Diff to previous 1.36 (colored) next main 1.37 (colored)

sync with head.

Revision 1.37 / (download) - annotate - [select for diffs], Wed Apr 23 06:09:05 2008 UTC (15 years, 10 months ago) by thorpej
Branch: MAIN
CVS Tags: yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-nfs-mp-base2, yamt-nfs-mp-base, wrstuden-revivesa-base-1, wrstuden-revivesa-base, hpcarm-cleanup-nbase
Branch point for: yamt-nfs-mp, wrstuden-revivesa, simonb-wapbl
Changes since 1.36: +18 -12 lines
Diff to previous 1.36 (colored)

Make IPSEC and FAST_IPSEC stats per-cpu.  Use <net/net_stats.h> and
netstat_sysctl().

Revision 1.34.2.1 / (download) - annotate - [select for diffs], Mon Feb 18 21:07:13 2008 UTC (16 years ago) by mjf
Branch: mjf-devfs
Changes since 1.34: +19 -68 lines
Diff to previous 1.34 (colored) next main 1.35 (colored)

Sync with HEAD.

Revision 1.17.2.6 / (download) - annotate - [select for diffs], Mon Jan 21 09:47:25 2008 UTC (16 years, 1 month ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17.2.5: +19 -80 lines
Diff to previous 1.17.2.5 (colored) next main 1.18 (colored)

sync with head

Revision 1.33.8.2 / (download) - annotate - [select for diffs], Wed Jan 9 01:57:41 2008 UTC (16 years, 1 month ago) by matt
Branch: matt-armv6
Changes since 1.33.8.1: +19 -80 lines
Diff to previous 1.33.8.1 (colored) to branchpoint 1.33 (colored) next main 1.34 (colored)

sync with HEAD

Revision 1.25.2.1.2.2 / (download) - annotate - [select for diffs], Sun Jan 6 05:01:14 2008 UTC (16 years, 1 month ago) by wrstuden
Branch: wrstuden-fixsa
Changes since 1.25.2.1.2.1: +4 -4 lines
Diff to previous 1.25.2.1.2.1 (colored) next main 1.25.2.2 (colored)

Catch up to netbsd-4.0 release.

Revision 1.35.2.1 / (download) - annotate - [select for diffs], Wed Jan 2 21:57:33 2008 UTC (16 years, 1 month ago) by bouyer
Branch: bouyer-xeni386
CVS Tags: bouyer-xeni386-merge1
Changes since 1.35: +19 -68 lines
Diff to previous 1.35 (colored) next main 1.36 (colored)

Sync with HEAD

Revision 1.36 / (download) - annotate - [select for diffs], Sat Dec 29 14:53:24 2007 UTC (16 years, 2 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base, yamt-lazymbuf-base15, yamt-lazymbuf-base14, nick-net80211-sync-base, nick-net80211-sync, mjf-devfs-base, matt-armv6-nbase, matt-armv6-base, keiichi-mipv6-nbase, keiichi-mipv6-base, keiichi-mipv6, hpcarm-cleanup-base, bouyer-xeni386-nbase, bouyer-xeni386-base, ad-socklock-base1
Branch point for: yamt-pf42, mjf-devfs2
Changes since 1.35: +19 -68 lines
Diff to previous 1.35 (colored)

Simplify the FAST_IPSEC output path
Only record an IPSEC_OUT_DONE tag when we have finished the processing
In ip{,6}_output, check this tag to know if we have already processed this
packet.
Remove some dead code (IPSEC_PENDING_TDB is not used in NetBSD)

Fix pr/36870

Revision 1.34.4.1 / (download) - annotate - [select for diffs], Wed Dec 26 19:57:48 2007 UTC (16 years, 2 months ago) by ad
Branch: vmlocking2
Changes since 1.34: +2 -14 lines
Diff to previous 1.34 (colored) next main 1.35 (colored)

Sync with head.

Revision 1.34.6.1 / (download) - annotate - [select for diffs], Tue Dec 11 15:45:40 2007 UTC (16 years, 2 months ago) by yamt
Branch: yamt-kmem
Changes since 1.34: +2 -14 lines
Diff to previous 1.34 (colored) next main 1.35 (colored)

sync with head.

Revision 1.35 / (download) - annotate - [select for diffs], Sun Dec 9 18:27:39 2007 UTC (16 years, 2 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-kmem-base3, yamt-kmem-base2, vmlocking2-base3, cube-autoconf-base, cube-autoconf
Branch point for: bouyer-xeni386
Changes since 1.34: +2 -14 lines
Diff to previous 1.34 (colored)

Kill _IP_VHL ifdef (from netinet/ip.h history, it has never been used in NetBSD so ...)

Revision 1.10.2.1.2.1 / (download) - annotate - [select for diffs], Sat Dec 1 17:33:46 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-2
Changes since 1.10.2.1: +4 -4 lines
Diff to previous 1.10.2.1 (colored) next main 1.10.2.2 (colored)

Pull up following revision(s) (requested by adrianp in ticket #11395):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.10.2.2 / (download) - annotate - [select for diffs], Sat Dec 1 17:33:14 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-2-0
Changes since 1.10.2.1: +4 -4 lines
Diff to previous 1.10.2.1 (colored) to branchpoint 1.10 (colored) next main 1.11 (colored)

Pull up following revision(s) (requested by adrianp in ticket #11395):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.10.2.1.4.1 / (download) - annotate - [select for diffs], Sat Dec 1 17:32:29 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-2-1
Changes since 1.10.2.1: +4 -4 lines
Diff to previous 1.10.2.1 (colored) next main 1.10.2.2 (colored)

Pull up following revision(s) (requested by adrianp in ticket #11395):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.15.6.1 / (download) - annotate - [select for diffs], Thu Nov 22 19:02:16 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-3-1
Changes since 1.15: +4 -4 lines
Diff to previous 1.15 (colored) next main 1.16 (colored)

Pull up following revision(s) (requested by adrianp in ticket #1878):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.15.4.1 / (download) - annotate - [select for diffs], Thu Nov 22 19:01:36 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-3-0
Changes since 1.15: +4 -4 lines
Diff to previous 1.15 (colored) next main 1.16 (colored)

Pull up following revision(s) (requested by adrianp in ticket #1878):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.15.2.1 / (download) - annotate - [select for diffs], Thu Nov 22 19:00:52 2007 UTC (16 years, 3 months ago) by bouyer
Branch: netbsd-3
Changes since 1.15: +4 -4 lines
Diff to previous 1.15 (colored) next main 1.16 (colored)

Pull up following revision(s) (requested by adrianp in ticket #1878):
	sys/netipsec/xform_ah.c: revision 1.19 via patch
	sys/netipsec/ipsec.c: revision 1.34 via patch
	sys/netipsec/xform_ipip.c: revision 1.18 via patch
	sys/netipsec/ipsec_output.c: revision 1.23 via patch
	sys/netipsec/ipsec_osdep.h: revision 1.21 via patch
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.17.2.5 / (download) - annotate - [select for diffs], Thu Nov 15 11:45:16 2007 UTC (16 years, 3 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17.2.4: +4 -4 lines
Diff to previous 1.17.2.4 (colored)

sync with head.

Revision 1.33.12.1 / (download) - annotate - [select for diffs], Tue Nov 13 16:03:03 2007 UTC (16 years, 3 months ago) by bouyer
Branch: bouyer-xenamd64
Changes since 1.33: +4 -4 lines
Diff to previous 1.33 (colored) next main 1.34 (colored)

Sync with HEAD

Revision 1.33.8.1 / (download) - annotate - [select for diffs], Tue Nov 6 23:34:12 2007 UTC (16 years, 3 months ago) by matt
Branch: matt-armv6
CVS Tags: matt-armv6-prevmlocking
Changes since 1.33: +4 -4 lines
Diff to previous 1.33 (colored)

sync with HEAD

Revision 1.25.2.3 / (download) - annotate - [select for diffs], Wed Oct 31 12:39:29 2007 UTC (16 years, 4 months ago) by liamjfoy
Branch: netbsd-4
CVS Tags: wrstuden-fixsa-newbase, wrstuden-fixsa-base-1, wrstuden-fixsa-base, netbsd-4-0-RELEASE, netbsd-4-0-RC5, netbsd-4-0-RC4, netbsd-4-0-1-RELEASE, netbsd-4-0, matt-nb4-arm-base, matt-nb4-arm
Changes since 1.25.2.2: +4 -4 lines
Diff to previous 1.25.2.2 (colored) to branchpoint 1.25 (colored) next main 1.26 (colored)

Pull up following revision(s) (requested by adrianp in ticket #964):
	sys/netipsec/xform_ah.c: revision 1.19
	sys/netipsec/ipsec.c: revision 1.34
	sys/netipsec/xform_ipip.c: revision 1.18
	sys/netipsec/ipsec_output.c: revision 1.23
	sys/netipsec/ipsec_osdep.h: revision 1.21
The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.
Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote&#64;

Revision 1.33.6.1 / (download) - annotate - [select for diffs], Sun Oct 28 20:11:14 2007 UTC (16 years, 4 months ago) by joerg
Branch: jmcneill-pm
Changes since 1.33: +4 -4 lines
Diff to previous 1.33 (colored) next main 1.34 (colored)

Sync with HEAD.

Revision 1.34 / (download) - annotate - [select for diffs], Sun Oct 28 15:48:23 2007 UTC (16 years, 4 months ago) by adrianp
Branch: MAIN
CVS Tags: yamt-kmem-base, vmlocking2-base2, vmlocking2-base1, vmlocking-nbase, reinoud-bufcleanup-nbase, reinoud-bufcleanup-base, jmcneill-pm-base, jmcneill-base, bouyer-xenamd64-base2, bouyer-xenamd64-base
Branch point for: yamt-kmem, vmlocking2, mjf-devfs
Changes since 1.33: +4 -4 lines
Diff to previous 1.33 (colored)

The function ipsec4_get_ulp assumes that ip_off is in host order. This results
in IPsec processing that is dependent on protocol and/or port can be bypassed.

Bug report, analysis and initial fix from Karl Knutsson.
Final patch and ok from degroote@

Revision 1.17.2.4 / (download) - annotate - [select for diffs], Mon Sep 3 14:43:43 2007 UTC (16 years, 5 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17.2.3: +117 -169 lines
Diff to previous 1.17.2.3 (colored)

sync with head.

Revision 1.28.2.3 / (download) - annotate - [select for diffs], Sun Jul 15 13:28:01 2007 UTC (16 years, 7 months ago) by ad
Branch: vmlocking
Changes since 1.28.2.2: +59 -131 lines
Diff to previous 1.28.2.2 (colored) next main 1.29 (colored)

Sync with head.

Revision 1.28.4.1 / (download) - annotate - [select for diffs], Wed Jul 11 20:11:51 2007 UTC (16 years, 7 months ago) by mjf
Branch: mjf-ufs-trans
Changes since 1.28: +106 -158 lines
Diff to previous 1.28 (colored) next main 1.29 (colored)

Sync with head.

Revision 1.33 / (download) - annotate - [select for diffs], Sat Jul 7 18:38:22 2007 UTC (16 years, 7 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-x86pmap-base4, yamt-x86pmap-base3, yamt-x86pmap-base2, yamt-x86pmap-base, yamt-x86pmap, vmlocking-base, nick-csl-alignment-base5, nick-csl-alignment-base, nick-csl-alignment, mjf-ufs-trans-base, matt-mips64-base, matt-mips64, hpcarm-cleanup
Branch point for: matt-armv6, jmcneill-pm, bouyer-xenamd64
Changes since 1.32: +59 -131 lines
Diff to previous 1.32 (colored)

Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Revision 1.28.2.2 / (download) - annotate - [select for diffs], Fri Jun 8 14:18:00 2007 UTC (16 years, 8 months ago) by ad
Branch: vmlocking
Changes since 1.28.2.1: +38 -21 lines
Diff to previous 1.28.2.1 (colored)

Sync with head.

Revision 1.25.2.1.2.1 / (download) - annotate - [select for diffs], Mon Jun 4 01:54:27 2007 UTC (16 years, 8 months ago) by wrstuden
Branch: wrstuden-fixsa
Changes since 1.25.2.1: +250 -76 lines
Diff to previous 1.25.2.1 (colored)

Update to today's netbsd-4.

Revision 1.25.2.2 / (download) - annotate - [select for diffs], Thu May 24 19:13:11 2007 UTC (16 years, 9 months ago) by pavel
Branch: netbsd-4
CVS Tags: netbsd-4-0-RC3, netbsd-4-0-RC2, netbsd-4-0-RC1
Changes since 1.25.2.1: +248 -74 lines
Diff to previous 1.25.2.1 (colored) to branchpoint 1.25 (colored)

Pull up following revision(s) (requested by degroote in ticket #667):
	sys/netinet/tcp_input.c: revision 1.260
	sys/netinet/tcp_output.c: revision 1.154
	sys/netinet/tcp_subr.c: revision 1.210
	sys/netinet6/icmp6.c: revision 1.129
	sys/netinet6/in6_proto.c: revision 1.70
	sys/netinet6/ip6_forward.c: revision 1.54
	sys/netinet6/ip6_input.c: revision 1.94
	sys/netinet6/ip6_output.c: revision 1.114
	sys/netinet6/raw_ip6.c: revision 1.81
	sys/netipsec/ipcomp_var.h: revision 1.4
	sys/netipsec/ipsec.c: revision 1.26 via patch,1.31-1.32
	sys/netipsec/ipsec6.h: revision 1.5
	sys/netipsec/ipsec_input.c: revision 1.14
	sys/netipsec/ipsec_netbsd.c: revision 1.18,1.26
	sys/netipsec/ipsec_output.c: revision 1.21 via patch
	sys/netipsec/key.c: revision 1.33,1.44
	sys/netipsec/xform_ipcomp.c: revision 1.9
	sys/netipsec/xform_ipip.c: revision 1.15
	sys/opencrypto/deflate.c: revision 1.8
Commit my SoC work
Add ipv6 support for fast_ipsec
Note that currently, packet with extensions headers are not correctly
supported
Change the ipcomp logic

Add sysctl tree to modify the fast_ipsec options related to ipv6. Similar
to the sysctl kame interface.

Choose the good default policy, depending of the adress family of the
desired policy

Increase the refcount for the default ipv6 policy so nobody can reclaim it

Always compute the sp index even if we don't have any sp in spd. It will
let us to choose the right default policy (based on the adress family
requested).
While here, fix an error message

Use dynamic array instead of an static array to decompress. It lets us to
decompress any data, whatever is the radio decompressed data / compressed
data.
It fixes the last issues with fast_ipsec and ipcomp.
While here, bzero -> memset, bcopy -> memcpy, FREE -> free
Reviewed a long time ago by sam@

Revision 1.26.2.4 / (download) - annotate - [select for diffs], Thu May 17 13:41:53 2007 UTC (16 years, 9 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.26.2.3: +16 -14 lines
Diff to previous 1.26.2.3 (colored) to branchpoint 1.26 (colored) next main 1.27 (colored)

sync with head.

Revision 1.25.2.1 / (download) - annotate - [select for diffs], Sat May 12 19:24:49 2007 UTC (16 years, 9 months ago) by pavel
Branch: netbsd-4
Branch point for: wrstuden-fixsa
Changes since 1.25: +12 -9 lines
Diff to previous 1.25 (colored)

Pull up following revision(s) (requested by degroote in ticket #630):
	sys/netipsec/key.c: revision 1.43-1.46
	sys/netinet6/ipsec.c: revision 1.116
	sys/netipsec/ipsec.c: revision 1.29 via patch
	sys/netkey/key.c: revision 1.154-1.155
Call key_checkspidup with spi in network bit order in order to make
comparaison with spi stored into the sadb.
Reported by Karl Knutsson in kern/36038 .

Make an exact match when we are looking for a cached sp for an unconnected
socket. If we don't make an exact match, we may use a cached rule which
has lower priority than a rule that would otherwise have matched the
packet.
Code submitted by Karl Knutsson in PR/36051

Fix a memleak in key_spdget.
Problem was reported by Karl Knutsson by pr/36119.

In spddelete2, if we can't find the sp by this id, return after sending an
error message, don't process the following code with the NULL sp.
Spotted by Matthew Grooms on freebsd-net ML

When we construct an answer for SADB_X_SPDGET, don't use an hardcoded 0 for seq but
the seq used by the request. It will improve consistency with the answer of SADB_GET
request and helps some applications which relies both on seq and pid.
Reported by  Karl Knutsson by pr/36119.

Revision 1.32 / (download) - annotate - [select for diffs], Tue May 8 14:07:42 2007 UTC (16 years, 9 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-idlelwp-base8
Changes since 1.31: +16 -14 lines
Diff to previous 1.31 (colored)

Always compute the sp index even if we don't have any sp in spd. It will
let us to choose the right default policy (based on the adress family
requested).

While here, fix an error message

Revision 1.26.2.3 / (download) - annotate - [select for diffs], Mon May 7 10:56:07 2007 UTC (16 years, 9 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.26.2.2: +25 -10 lines
Diff to previous 1.26.2.2 (colored) to branchpoint 1.26 (colored)

sync with head.

Revision 1.26.2.2 / (download) - annotate - [select for diffs], Sun Apr 15 16:04:01 2007 UTC (16 years, 10 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.26.2.1: +13 -10 lines
Diff to previous 1.26.2.1 (colored) to branchpoint 1.26 (colored)

sync with head.

Revision 1.31 / (download) - annotate - [select for diffs], Sun Apr 15 14:17:12 2007 UTC (16 years, 10 months ago) by degroote
Branch: MAIN
Changes since 1.30: +25 -10 lines
Diff to previous 1.30 (colored)

Choose the good default policy, depending of the adress family of the
desired policy

Revision 1.28.2.1 / (download) - annotate - [select for diffs], Tue Apr 10 13:26:52 2007 UTC (16 years, 10 months ago) by ad
Branch: vmlocking
Changes since 1.28: +13 -10 lines
Diff to previous 1.28 (colored)

Sync with head.

Revision 1.28.6.1 / (download) - annotate - [select for diffs], Thu Mar 29 19:28:01 2007 UTC (16 years, 11 months ago) by reinoud
Branch: reinoud-bufcleanup
Changes since 1.28: +13 -10 lines
Diff to previous 1.28 (colored) next main 1.29 (colored)

Pullup to -current

Revision 1.30 / (download) - annotate - [select for diffs], Sun Mar 25 22:06:33 2007 UTC (16 years, 11 months ago) by degroote
Branch: MAIN
CVS Tags: thorpej-atomic-base, thorpej-atomic
Changes since 1.29: +3 -3 lines
Diff to previous 1.29 (colored)

Use ip4_ah_cleartos instead of ah_cleartos for consistency

Revision 1.29 / (download) - annotate - [select for diffs], Sun Mar 25 12:46:42 2007 UTC (16 years, 11 months ago) by degroote
Branch: MAIN
Changes since 1.28: +12 -9 lines
Diff to previous 1.28 (colored)

Make an exact match when we are looking for a cached sp for an unconnected
socket. If we don't make an exact match, we may use a cached rule which
has lower priority than a rule that would otherwise have matched the
packet.

Code submitted by Karl Knutsson in PR/36051

Revision 1.26.2.1 / (download) - annotate - [select for diffs], Mon Mar 12 06:00:03 2007 UTC (16 years, 11 months ago) by rmind
Branch: yamt-idlelwp
Changes since 1.26: +18 -18 lines
Diff to previous 1.26 (colored)

Sync with HEAD.

Revision 1.28 / (download) - annotate - [select for diffs], Sun Mar 4 21:17:54 2007 UTC (16 years, 11 months ago) by degroote
Branch: MAIN
Branch point for: vmlocking, reinoud-bufcleanup, mjf-ufs-trans
Changes since 1.27: +12 -12 lines
Diff to previous 1.27 (colored)

Remove useless cast
Use NULL instead of (void*) 0

Revision 1.27 / (download) - annotate - [select for diffs], Sun Mar 4 06:03:28 2007 UTC (16 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.26: +18 -18 lines
Diff to previous 1.26 (colored)

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Revision 1.17.2.3 / (download) - annotate - [select for diffs], Mon Feb 26 09:11:56 2007 UTC (17 years ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17.2.2: +215 -58 lines
Diff to previous 1.17.2.2 (colored)

sync with head.

Revision 1.26 / (download) - annotate - [select for diffs], Sat Feb 10 09:43:05 2007 UTC (17 years ago) by degroote
Branch: MAIN
CVS Tags: ad-audiomp-base, ad-audiomp
Branch point for: yamt-idlelwp
Changes since 1.25: +215 -58 lines
Diff to previous 1.25 (colored)

Commit my SoC work
Add ipv6 support for fast_ipsec
Note that currently, packet with extensions headers are not correctly
supported
Change the ipcomp logic

Revision 1.17.2.2 / (download) - annotate - [select for diffs], Sat Dec 30 20:50:44 2006 UTC (17 years, 2 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17.2.1: +9 -8 lines
Diff to previous 1.17.2.1 (colored)

sync with head.

Revision 1.23.8.2 / (download) - annotate - [select for diffs], Sun Dec 10 07:19:19 2006 UTC (17 years, 2 months ago) by yamt
Branch: yamt-splraiseipl
Changes since 1.23.8.1: +3 -3 lines
Diff to previous 1.23.8.1 (colored) to branchpoint 1.23 (colored) next main 1.24 (colored)

sync with head.

Revision 1.23.6.1 / (download) - annotate - [select for diffs], Sat Nov 18 21:39:41 2006 UTC (17 years, 3 months ago) by ad
Branch: newlock2
Changes since 1.23: +9 -8 lines
Diff to previous 1.23 (colored) next main 1.24 (colored)

Sync with head.

Revision 1.25 / (download) - annotate - [select for diffs], Thu Nov 16 01:33:49 2006 UTC (17 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base5, yamt-splraiseipl-base4, yamt-splraiseipl-base3, post-newlock2-merge, newlock2-nbase, newlock2-base, netbsd-4-base
Branch point for: netbsd-4
Changes since 1.24: +3 -3 lines
Diff to previous 1.24 (colored)

__unused removal on arguments; approved by core.

Revision 1.23.8.1 / (download) - annotate - [select for diffs], Sun Oct 22 06:07:38 2006 UTC (17 years, 4 months ago) by yamt
Branch: yamt-splraiseipl
Changes since 1.23: +9 -8 lines
Diff to previous 1.23 (colored)

sync with head

Revision 1.24 / (download) - annotate - [select for diffs], Fri Oct 13 20:53:59 2006 UTC (17 years, 4 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base2
Changes since 1.23: +9 -8 lines
Diff to previous 1.23 (colored)

more __unused

Revision 1.19.4.1 / (download) - annotate - [select for diffs], Sat Sep 9 02:59:08 2006 UTC (17 years, 5 months ago) by rpaulo
Branch: rpaulo-netinet-merge-pcb
Changes since 1.19: +21 -5 lines
Diff to previous 1.19 (colored) next main 1.20 (colored)

sync with head

Revision 1.20.2.2 / (download) - annotate - [select for diffs], Mon Jun 26 12:54:13 2006 UTC (17 years, 8 months ago) by yamt
Branch: yamt-pdpolicy
Changes since 1.20.2.1: +3 -3 lines
Diff to previous 1.20.2.1 (colored) to branchpoint 1.20 (colored) next main 1.21 (colored)

sync with head.

Revision 1.17.2.1 / (download) - annotate - [select for diffs], Wed Jun 21 15:11:24 2006 UTC (17 years, 8 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.17: +22 -6 lines
Diff to previous 1.17 (colored)

sync with head.

Revision 1.21.2.1 / (download) - annotate - [select for diffs], Mon Jun 19 04:10:36 2006 UTC (17 years, 8 months ago) by chap
Branch: chap-midi
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored) next main 1.22 (colored)

Sync with head.

Revision 1.23 / (download) - annotate - [select for diffs], Sat Jun 10 11:30:37 2006 UTC (17 years, 8 months ago) by kardel
Branch: MAIN
CVS Tags: yamt-splraiseipl-base, yamt-pdpolicy-base9, yamt-pdpolicy-base8, yamt-pdpolicy-base7, yamt-pdpolicy-base6, rpaulo-netinet-merge-pcb-base, gdamore-uart-base, gdamore-uart, chap-midi-nbase, chap-midi-base, abandoned-netbsd-4-base, abandoned-netbsd-4
Branch point for: yamt-splraiseipl, newlock2
Changes since 1.22: +1 -1 lines
Diff to previous 1.22 (colored)

reference time.tv_sec in non timecounter case
missing conversion spotted by Geoff Wing
XXX This code need to be checked whether UTC time
is really the right abstraction. I suspect uptime
would be the correct time scale for measuring life times.

Revision 1.22 / (download) - annotate - [select for diffs], Sat Jun 10 11:12:09 2006 UTC (17 years, 8 months ago) by kardel
Branch: MAIN
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored)

fix a missing conversion for a mono_time reference.
detected by Geoff Wing.

Revision 1.20.6.1 / (download) - annotate - [select for diffs], Wed May 24 15:50:45 2006 UTC (17 years, 9 months ago) by tron
Branch: peter-altq
Changes since 1.20: +18 -2 lines
Diff to previous 1.20 (colored) next main 1.21 (colored)

Merge 2006-05-24 NetBSD-current into the "peter-altq" branch.

Revision 1.20.2.1 / (download) - annotate - [select for diffs], Wed May 24 10:59:09 2006 UTC (17 years, 9 months ago) by yamt
Branch: yamt-pdpolicy
Changes since 1.20: +18 -2 lines
Diff to previous 1.20 (colored)

sync with head.

Revision 1.19.6.1 / (download) - annotate - [select for diffs], Sat Apr 22 11:40:13 2006 UTC (17 years, 10 months ago) by simonb
Branch: simonb-timecounters
CVS Tags: simonb-timcounters-final
Changes since 1.19: +20 -4 lines
Diff to previous 1.19 (colored) next main 1.20 (colored)

Sync with head.

Revision 1.20.4.1 / (download) - annotate - [select for diffs], Wed Apr 19 04:46:19 2006 UTC (17 years, 10 months ago) by elad
Branch: elad-kernelauth
Changes since 1.20: +18 -2 lines
Diff to previous 1.20 (colored) next main 1.21 (colored)

sync with head.

Revision 1.21 / (download) - annotate - [select for diffs], Tue Apr 11 20:21:28 2006 UTC (17 years, 10 months ago) by rpaulo
Branch: MAIN
CVS Tags: yamt-pdpolicy-base5, simonb-timecounters-base, elad-kernelauth-base
Branch point for: chap-midi
Changes since 1.20: +18 -2 lines
Diff to previous 1.20 (colored)

Add two new sysctls protected under IPSEC_DEBUG:

  net.inet.ipsec.test_replay - When set to 1, IPsec will send packets with
          the same sequence number. This allows to verify if the other side
          has proper replay attacks detection.

  net.inet.ipsec.test_integrity - When set 1, IPsec will send packets with
          corrupted HMAC. This allows to verify if the other side properly
          detects modified packets.

(a message will be printed indicating when these sysctls changed)

By Pawel Jakub Dawidek <pjd@FreeBSD.org>.
Discussed with Christos Zoulas and Jonathan Stone.

Revision 1.19.2.1 / (download) - annotate - [select for diffs], Wed Mar 1 09:28:47 2006 UTC (18 years ago) by yamt
Branch: yamt-uio_vmspace
Changes since 1.19: +4 -4 lines
Diff to previous 1.19 (colored) next main 1.20 (colored)

sync with head.

Revision 1.20 / (download) - annotate - [select for diffs], Sat Feb 25 02:28:58 2006 UTC (18 years ago) by wiz
Branch: MAIN
CVS Tags: yamt-uio_vmspace-base5, yamt-pdpolicy-base4, yamt-pdpolicy-base3, yamt-pdpolicy-base2, yamt-pdpolicy-base, peter-altq-base
Branch point for: yamt-pdpolicy, peter-altq, elad-kernelauth
Changes since 1.19: +4 -4 lines
Diff to previous 1.19 (colored)

Fix some typos.

Revision 1.19 / (download) - annotate - [select for diffs], Sun Dec 11 12:25:05 2005 UTC (18 years, 2 months ago) by christos
Branch: MAIN
Branch point for: yamt-uio_vmspace, simonb-timecounters, rpaulo-netinet-merge-pcb
Changes since 1.18: +2 -2 lines
Diff to previous 1.18 (colored)

merge ktrace-lwp.

Revision 1.13.2.7 / (download) - annotate - [select for diffs], Thu Nov 10 14:11:35 2005 UTC (18 years, 3 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.6: +10 -11 lines
Diff to previous 1.13.2.6 (colored) next main 1.14 (colored)

Sync with HEAD. Here we go again...

Revision 1.18 / (download) - annotate - [select for diffs], Wed Oct 5 12:59:24 2005 UTC (18 years, 4 months ago) by christos
Branch: MAIN
CVS Tags: yamt-vop-base3, yamt-vop-base2, yamt-vop-base, yamt-vop, yamt-readahead-pervnode, yamt-readahead-perfile, yamt-readahead-base3, yamt-readahead-base2, yamt-readahead-base, yamt-readahead, thorpej-vnode-attr-base, thorpej-vnode-attr, ktrace-lwp-base
Changes since 1.17: +3 -3 lines
Diff to previous 1.17 (colored)

PR/31478: YOMURA Masanori: Inconsistent default value of net.inet.ipsec.dfbit
Changed to match netinet6 (0->2)

Revision 1.17 / (download) - annotate - [select for diffs], Fri Jun 10 13:22:42 2005 UTC (18 years, 8 months ago) by christos
Branch: MAIN
Branch point for: yamt-lazymbuf
Changes since 1.16: +3 -3 lines
Diff to previous 1.16 (colored)

constify and unshadow.

Revision 1.16 / (download) - annotate - [select for diffs], Sun May 8 18:44:40 2005 UTC (18 years, 9 months ago) by christos
Branch: MAIN
Changes since 1.15: +8 -9 lines
Diff to previous 1.15 (colored)

Panic strings should not end with \n.

Revision 1.14.4.1 / (download) - annotate - [select for diffs], Fri Apr 29 11:29:34 2005 UTC (18 years, 10 months ago) by kent
Branch: kent-audio2
Changes since 1.14: +3 -3 lines
Diff to previous 1.14 (colored) next main 1.15 (colored)

sync with -current

Revision 1.14.6.1 / (download) - annotate - [select for diffs], Sat Mar 19 08:36:41 2005 UTC (18 years, 11 months ago) by yamt
Branch: yamt-km
Changes since 1.14: +3 -3 lines
Diff to previous 1.14 (colored) next main 1.15 (colored)

sync with head.  xen and whitespace.  xen part is not finished.

Revision 1.13.2.6 / (download) - annotate - [select for diffs], Fri Mar 4 16:53:44 2005 UTC (18 years, 11 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.5: +3 -3 lines
Diff to previous 1.13.2.5 (colored)

Sync with HEAD.

Hi Perry!

Revision 1.15 / (download) - annotate - [select for diffs], Sat Feb 26 22:45:13 2005 UTC (19 years ago) by perry
Branch: MAIN
CVS Tags: yamt-km-base4, yamt-km-base3, netbsd-3-base, netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, kent-audio2-base
Branch point for: netbsd-3-1, netbsd-3-0, netbsd-3
Changes since 1.14: +3 -3 lines
Diff to previous 1.14 (colored)

nuke trailing whitespace

Revision 1.13.2.5 / (download) - annotate - [select for diffs], Tue Nov 2 07:53:24 2004 UTC (19 years, 3 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.4: +3 -2 lines
Diff to previous 1.13.2.4 (colored)

Sync with HEAD.

Revision 1.14 / (download) - annotate - [select for diffs], Wed Oct 27 23:10:13 2004 UTC (19 years, 4 months ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base2, yamt-km-base, kent-audio1-beforemerge, kent-audio1-base, kent-audio1
Branch point for: yamt-km, kent-audio2
Changes since 1.13: +3 -2 lines
Diff to previous 1.13 (colored)

Fix missing break; Emmanuel Dreyfus.

C.f. sys/netinet6/ipsec.c rev 1.97 -> 1.98, but does not include the
gratutious change for a case which (the comment says) should not occur.

Revision 1.13.2.4 / (download) - annotate - [select for diffs], Tue Sep 21 13:37:48 2004 UTC (19 years, 5 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.3: +2 -2 lines
Diff to previous 1.13.2.3 (colored)

Fix the sync with head I botched.

Revision 1.13.2.3 / (download) - annotate - [select for diffs], Sat Sep 18 14:55:32 2004 UTC (19 years, 5 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.2: +2 -2 lines
Diff to previous 1.13.2.2 (colored)

Sync with HEAD.

Revision 1.13.2.2 / (download) - annotate - [select for diffs], Tue Aug 3 10:55:29 2004 UTC (19 years, 6 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13.2.1: +2197 -0 lines
Diff to previous 1.13.2.1 (colored)

Sync with HEAD

Revision 1.10.2.1 / (download) - annotate - [select for diffs], Mon May 10 15:02:18 2004 UTC (19 years, 9 months ago) by tron
Branch: netbsd-2-0
CVS Tags: netbsd-2-base, netbsd-2-1-RELEASE, netbsd-2-1-RC6, netbsd-2-1-RC5, netbsd-2-1-RC4, netbsd-2-1-RC3, netbsd-2-1-RC2, netbsd-2-1-RC1, netbsd-2-0-RELEASE, netbsd-2-0-RC5, netbsd-2-0-RC4, netbsd-2-0-RC3, netbsd-2-0-RC2, netbsd-2-0-RC1, netbsd-2-0-3-RELEASE, netbsd-2-0-2-RELEASE, netbsd-2-0-1-RELEASE
Branch point for: netbsd-2-1, netbsd-2
Changes since 1.10: +12 -2 lines
Diff to previous 1.10 (colored)

Pull up revision 1.13 (requested by jonathan in ticket #280):
Redo net.inet.* sysctl subtree for fast-ipsec from scratch.
Attach FAST-IPSEC statistics with 64-bit counters to new sysctl MIB.
Rework netstat to show FAST_IPSEC statistics, via sysctl,  for
netstat -p ipsec.
New kernel files:
	sys/netipsec/Makefile		(new file; install *_var.h includes)
	sys/netipsec/ipsec_var.h	(new 64-bit mib counter struct)
Changed kernel files:
	sys/Makefile			(recurse into sys/netipsec/)
	sys/netinet/in.h		(fake IP_PROTO name for fast_ipsec
					sysctl subtree.)
	sys/netipsec/ipsec.h		(minimal userspace inclusion)
	sys/netipsec/ipsec_osdep.h	(minimal userspace inclusion)
	sys/netipsec/ipsec_netbsd.c	(redo sysctl subtree from scratch)
	sys/netipsec/key*.c		(fix broken net.key subtree)
	sys/netipsec/ah_var.h		(increase all counters to 64 bits)
	sys/netipsec/esp_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipip_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipcomp_var.h	(increase all counters to 64 bits)
	sys/netipsec/ipsec.c		(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_mbuf.c	(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_output.c	(add #include netipsec/ipsec_var.h)
	sys/netinet/raw_ip.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/tcp_input.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/udp_usrreq.c	(add #include netipsec/ipsec_var.h)
Changes to usr.bin/netstat to print the new fast-ipsec sysctl tree
for "netstat -s -p ipsec":
New file:
	usr.bin/netstat/fast_ipsec.c	(print fast-ipsec counters)
Changed files:
	usr.bin/netstat/Makefile	(add fast_ipsec.c)
	usr.bin/netstat/netstat.h	(declarations for fast_ipsec.c)
	usr.bin/netstat/main.c		(call KAME-vs-fast-ipsec dispatcher)

Revision 1.13.2.1, Fri May 7 00:55:14 2004 UTC (19 years, 9 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.13: +0 -2197 lines
FILE REMOVED

file ipsec.c was added on branch ktrace-lwp on 2004-08-03 10:55:29 +0000

Revision 1.13 / (download) - annotate - [select for diffs], Fri May 7 00:55:14 2004 UTC (19 years, 9 months ago) by jonathan
Branch: MAIN
Branch point for: ktrace-lwp
Changes since 1.12: +12 -2 lines
Diff to previous 1.12 (colored)

Redo net.inet.* sysctl subtree for fast-ipsec from scratch.
Attach FAST-IPSEC statistics with 64-bit counters to new sysctl MIB.
Rework netstat to show FAST_IPSEC statistics, via sysctl,  for
netstat -p ipsec.

New kernel files:
	sys/netipsec/Makefile		(new file; install *_var.h includes)
	sys/netipsec/ipsec_var.h	(new 64-bit mib counter struct)

Changed kernel files:
	sys/Makefile			(recurse into sys/netipsec/)
	sys/netinet/in.h		(fake IP_PROTO name for fast_ipsec
					sysctl subtree.)
	sys/netipsec/ipsec.h		(minimal userspace inclusion)
	sys/netipsec/ipsec_osdep.h	(minimal userspace inclusion)
	sys/netipsec/ipsec_netbsd.c	(redo sysctl subtree from scratch)
	sys/netipsec/key*.c		(fix broken net.key subtree)

	sys/netipsec/ah_var.h		(increase all counters to 64 bits)
	sys/netipsec/esp_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipip_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipcomp_var.h	(increase all counters to 64 bits)

	sys/netipsec/ipsec.c		(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_mbuf.c	(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_output.c	(add #include netipsec/ipsec_var.h)

	sys/netinet/raw_ip.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/tcp_input.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/udp_usrreq.c	(add #include netipsec/ipsec_var.h)

Changes to usr.bin/netstat to print the new fast-ipsec sysctl tree
for "netstat -s -p ipsec":

New file:
	usr.bin/netstat/fast_ipsec.c	(print fast-ipsec counters)

Changed files:
	usr.bin/netstat/Makefile	(add fast_ipsec.c)
	usr.bin/netstat/netstat.h	(declarations for fast_ipsec.c)
	usr.bin/netstat/main.c		(call KAME-vs-fast-ipsec dispatcher)

Revision 1.12 / (download) - annotate - [select for diffs], Sun Apr 25 22:25:03 2004 UTC (19 years, 10 months ago) by jonathan
Branch: MAIN
Changes since 1.11: +5 -2 lines
Diff to previous 1.11 (colored)

Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).


NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.

Revision 1.11 / (download) - annotate - [select for diffs], Wed Apr 21 18:40:41 2004 UTC (19 years, 10 months ago) by itojun
Branch: MAIN
Changes since 1.10: +4 -4 lines
Diff to previous 1.10 (colored)

kill sprintf, use snprintf

Revision 1.10 / (download) - annotate - [select for diffs], Tue Mar 2 02:24:02 2004 UTC (20 years ago) by thorpej
Branch: MAIN
CVS Tags: netbsd-2-0-base
Branch point for: netbsd-2-0
Changes since 1.9: +2 -5 lines
Diff to previous 1.9 (colored)

Remove some left-over debugging code.

Revision 1.9 / (download) - annotate - [select for diffs], Tue Mar 2 02:22:56 2004 UTC (20 years ago) by thorpej
Branch: MAIN
Changes since 1.8: +197 -3 lines
Diff to previous 1.8 (colored)

Bring the PCB policy cache over from KAME IPsec, including the "hint"
used to short-circuit IPsec processing in other places.

This is enabled only for NetBSD at the moment; in order for it to function
correctly, ipsec_pcbconn() must be called as appropriate.

Revision 1.8 / (download) - annotate - [select for diffs], Tue Mar 2 00:50:57 2004 UTC (20 years ago) by thorpej
Branch: MAIN
Changes since 1.7: +3 -3 lines
Diff to previous 1.7 (colored)

iipsec4_get_ulp(): Fix a reversed test that would have caused us to access
bogus IP header data if presented with a short mbuf.

Revision 1.7 / (download) - annotate - [select for diffs], Tue Feb 24 15:12:52 2004 UTC (20 years ago) by wiz
Branch: MAIN
Changes since 1.6: +5 -5 lines
Diff to previous 1.6 (colored)

occured -> occurred. From Peter Postma.

Revision 1.6 / (download) - annotate - [select for diffs], Wed Jan 28 01:35:31 2004 UTC (20 years, 1 month ago) by jonathan
Branch: MAIN
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)

Change #endif __FreeBSD__ to #endif /* __FreeBSD__ */

Revision 1.5 / (download) - annotate - [select for diffs], Tue Jan 20 22:55:14 2004 UTC (20 years, 1 month ago) by jonathan
Branch: MAIN
Changes since 1.4: +49 -23 lines
Diff to previous 1.4 (colored)

IPv6 mapped adddresses require us to cope with limited polymorphism
(struct in6pcb* versus struct inpcb*) in ipsec_getpolicybysock().

Add new macros (in lieu of an abstract data type) for a ``generic''
PCB_T (points to a struct inpcb* or struct in6pcb*) to ipsec_osdep.h.
Use those new macros in ipsec_getpolicybysock() and elsewhere.

As posted to tech-net for comment/feedback, late  2003.

Revision 1.4 / (download) - annotate - [select for diffs], Mon Oct 6 22:05:15 2003 UTC (20 years, 4 months ago) by tls
Branch: MAIN
Changes since 1.3: +4 -4 lines
Diff to previous 1.3 (colored)

Reversion of "netkey merge", part 2 (replacement of removed files in the
repository by christos was part 1).  netipsec should now be back as it
was on 2003-09-11, with some very minor changes:

1) Some residual platform-dependent code was moved from ipsec.h to
   ipsec_osdep.h; without this, IPSEC_ASSERT() was multiply defined.  ipsec.h
   now includes ipsec_osdep.h

2) itojun's renaming of netipsec/files.ipsec to netipsec/files.netipsec has
   been left in place (it's arguable which name is less confusing but the
   rename is pretty harmless).

3) Some #endif TOKEN has been replaced by #endif /* TOKEN */; #endif TOKEN
   is invalid and GCC 3 won't compile it.

An i386 kernel with "options FAST_IPSEC" and "options OPENCRYPTO" now
gets through "make depend" but fails to build with errors in ip_input.c.
But it's better than it was (thank heaven for small favors).

Revision 1.3 / (download) - annotate - [select for diffs], Fri Sep 12 11:20:58 2003 UTC (20 years, 5 months ago) by itojun
Branch: MAIN
Changes since 1.2: +5 -5 lines
Diff to previous 1.2 (colored)

merge netipsec/key* into netkey/key*.  no need for both.
change confusing filename

Revision 1.2 / (download) - annotate - [select for diffs], Wed Aug 20 22:33:40 2003 UTC (20 years, 6 months ago) by jonathan
Branch: MAIN
Changes since 1.1: +4 -2 lines
Diff to previous 1.1 (colored)

opt_inet6.h is FreeBSD-specific, so wrap it with #ifdef __FreeBSD__/#endif.

Revision 1.1 / (download) - annotate - [select for diffs], Wed Aug 13 20:06:50 2003 UTC (20 years, 6 months ago) by jonathan
Branch: MAIN

Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source.  For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>