The NetBSD Project

CVS log for src/sys/netipsec/ipsec.h

[BACK] Up to [cvs.NetBSD.org] / src / sys / netipsec

Request diff between arbitrary revisions


Default branch: MAIN
Current tag: MAIN


Revision 1.93 / (download) - annotate - [select for diffs], Fri Oct 28 05:23:09 2022 UTC (17 months ago) by ozaki-r
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-altq-separation-base, thorpej-altq-separation, netbsd-10-base, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, HEAD
Changes since 1.92: +1 -2 lines
Diff to previous 1.92 (colored)

Remove in_pcb_hdr.h

Revision 1.92 / (download) - annotate - [select for diffs], Fri Oct 28 05:18:39 2022 UTC (17 months ago) by ozaki-r
Branch: MAIN
Changes since 1.91: +9 -8 lines
Diff to previous 1.91 (colored)

inpcb: integrate data structures of PCB into one

Data structures of network protocol control blocks (PCBs), i.e.,
struct inpcb, in6pcb and inpcb_hdr, are not organized well.  Users of
the data structures have to handle them separately and thus the code
is cluttered and duplicated.

The commit integrates the data structures into one, struct inpcb.  As a
result, users of PCBs only have to handle just one data structure, so
the code becomes simple.

One drawback is that the data size of PCB for IPv4 increases by 40 bytes
(from 248 bytes to 288 bytes).

Revision 1.91 / (download) - annotate - [select for diffs], Fri Aug 28 06:20:44 2020 UTC (3 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-sunxi-drm-base, bouyer-sunxi-drm
Changes since 1.90: +2 -2 lines
Diff to previous 1.90 (colored)

ipsec: rename ipsec_ip_input to ipsec_ip_input_checkpolicy

Because it just checks if a packet passes security policies.

Revision 1.90 / (download) - annotate - [select for diffs], Fri Aug 28 06:19:13 2020 UTC (3 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.89: +2 -2 lines
Diff to previous 1.89 (colored)

inet, inet6: count packets dropped by IPsec

The counters count packets dropped due to security policy checks.

Revision 1.89 / (download) - annotate - [select for diffs], Fri Nov 1 04:23:21 2019 UTC (4 years, 4 months ago) by knakahara
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Changes since 1.88: +2 -2 lines
Diff to previous 1.88 (colored)

Fix ipsecif(4) IPV6_MINMTU does not work correctly.

Revision 1.88 / (download) - annotate - [select for diffs], Wed Jun 12 22:23:50 2019 UTC (4 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9
Changes since 1.87: +7 -3 lines
Diff to previous 1.87 (colored)

make DPRINTF use varyadic cpp macros, and merge with IPSECLOG.

Revision 1.87 / (download) - annotate - [select for diffs], Thu Jan 17 02:47:15 2019 UTC (5 years, 2 months ago) by knakahara
Branch: MAIN
CVS Tags: phil-wifi-20190609, pgoyette-compat-20190127, pgoyette-compat-20190118, isaki-audio2-base, isaki-audio2
Changes since 1.86: +17 -1 lines
Diff to previous 1.86 (colored)

Fix ipsecif(4) cannot apply input direction packet filter. Reviewed by ozaki-r@n.o and ryo@n.o.

Add ATF later.

Revision 1.86 / (download) - annotate - [select for diffs], Thu Nov 22 04:48:34 2018 UTC (5 years, 4 months ago) by knakahara
Branch: MAIN
CVS Tags: pgoyette-compat-1226, pgoyette-compat-1126
Changes since 1.85: +4 -1 lines
Diff to previous 1.85 (colored)

Support IPv6 NAT-T. Implemented by hsuenaga@IIJ and ohishi@IIJ.

Add ATF later.

Revision 1.85 / (download) - annotate - [select for diffs], Thu Nov 15 10:23:56 2018 UTC (5 years, 4 months ago) by maxv
Branch: MAIN
Changes since 1.84: +2 -2 lines
Diff to previous 1.84 (colored)

Remove the 't' argument from m_tag_find().

Revision 1.84 / (download) - annotate - [select for diffs], Sat Oct 27 05:42:23 2018 UTC (5 years, 5 months ago) by maxv
Branch: MAIN
Changes since 1.83: +1 -3 lines
Diff to previous 1.83 (colored)

Localify one function, and switch to C99 types while here.

Revision 1.83 / (download) - annotate - [select for diffs], Fri Sep 14 05:09:51 2018 UTC (5 years, 6 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-1020, pgoyette-compat-0930
Changes since 1.82: +2 -2 lines
Diff to previous 1.82 (colored)

Use non-variadic function pointer in protosw::pr_input.

Revision 1.82 / (download) - annotate - [select for diffs], Mon May 14 17:34:26 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521
Branch point for: phil-wifi
Changes since 1.81: +2 -2 lines
Diff to previous 1.81 (colored)

Merge ipsec4_input and ipsec6_input into ipsec_ip_input. Make the argument
a bool for clarity. Optimize the function: if M_CANFASTFWD is not there
(because already removed by the firewall) leave now.

Makes it easier to see that M_CANFASTFWD is not removed on IPv6.

Revision 1.81 / (download) - annotate - [select for diffs], Thu May 10 05:08:53 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
Changes since 1.80: +3 -2 lines
Diff to previous 1.80 (colored)

Rename ipsec4_forward -> ipsec_mtu, and switch to void.

Revision 1.80 / (download) - annotate - [select for diffs], Tue May 1 08:34:08 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0502
Changes since 1.79: +1 -7 lines
Diff to previous 1.79 (colored)

Remove some more dead code.

Revision 1.79 / (download) - annotate - [select for diffs], Sun Apr 29 11:51:08 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.78: +2 -2 lines
Diff to previous 1.78 (colored)

Remove unused and misleading argument from ipsec_set_policy.

Revision 1.78 / (download) - annotate - [select for diffs], Sun Apr 29 07:24:38 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.77: +1 -2 lines
Diff to previous 1.77 (colored)

Remove duplicate prototype.

Revision 1.77 / (download) - annotate - [select for diffs], Sat Apr 28 14:25:56 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.76: +1 -4 lines
Diff to previous 1.76 (colored)

Move the ipsec6_input prototype into ipsec6.h, and style.

Revision 1.76 / (download) - annotate - [select for diffs], Sat Apr 28 14:21:03 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.75: +2 -3 lines
Diff to previous 1.75 (colored)

Stop using a macro, rename the function to ipsec_init_pcbpolicy directly.

Revision 1.75 / (download) - annotate - [select for diffs], Sat Apr 28 14:01:50 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.74: +10 -26 lines
Diff to previous 1.74 (colored)

Style and remove unused stuff.

Revision 1.74 / (download) - annotate - [select for diffs], Thu Apr 19 21:50:10 2018 UTC (5 years, 11 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-compat-0422
Changes since 1.73: +2 -2 lines
Diff to previous 1.73 (colored)

s/static inline/static __inline/g for consistency.

Revision 1.73 / (download) - annotate - [select for diffs], Thu Apr 19 08:27:38 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.72: +2 -2 lines
Diff to previous 1.72 (colored)

Remove extra long file paths from the headers.

Revision 1.72 / (download) - annotate - [select for diffs], Tue Apr 3 09:03:59 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0415, pgoyette-compat-0407
Changes since 1.71: +1 -8 lines
Diff to previous 1.71 (colored)

Remove ipsec_copy_policy and ipsec_copy_pcbpolicy. No functional change,
since we used only ipsec_copy_pcbpolicy, and it was a no-op.

Originally we were using ipsec_copy_policy to optimize the IPsec-PCB
cache: when an ACK was received in response to a SYN, we used to copy the
SP cached in the SYN's PCB into the ACK's PCB, so that
ipsec_getpolicybysock could use the cached SP instead of requerying it.

Then we switched to ipsec_copy_pcbpolicy which has always been a no-op. As
a result the SP cached in the SYN was/is not copied in the ACK, and the
first call to ipsec_getpolicybysock had to query the SP and cache it
itself. It's not totally clear to me why this change was made.

But it has been this way for years, and after a conversation with Ryota
Ozaki it turns out the optimization is not valid anymore due to
MP-ification, so it won't be re-enabled.

ok ozaki-r@

Revision 1.71 / (download) - annotate - [select for diffs], Tue Feb 27 15:01:30 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-base, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: pgoyette-compat
Changes since 1.70: +2 -2 lines
Diff to previous 1.70 (colored)

Dedup: merge ipsec4_set_policy and ipsec6_set_policy. The content of the
original ipsec_set_policy function is inlined into the new one.

Revision 1.70 / (download) - annotate - [select for diffs], Tue Feb 27 14:44:10 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.69: +3 -3 lines
Diff to previous 1.69 (colored)

Dedup: merge

	ipsec4_get_policy and ipsec6_get_policy
	ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy

The already-existing ipsec_get_policy() function is inlined in the new
one.

Revision 1.69 / (download) - annotate - [select for diffs], Mon Feb 26 09:04:29 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.68: +2 -2 lines
Diff to previous 1.68 (colored)

Dedup: merge ipsec4_in_reject and ipsec6_in_reject into ipsec_in_reject.
While here fix misleading comment.

ok ozaki-r@

Revision 1.68 / (download) - annotate - [select for diffs], Mon Feb 26 08:50:25 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.67: +2 -2 lines
Diff to previous 1.67 (colored)

Dedup: merge ipsec4_hdrsiz and ipsec6_hdrsiz into ipsec_hdrsiz.

ok ozaki-r@

Revision 1.67 / (download) - annotate - [select for diffs], Wed Feb 21 16:18:52 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.66: +1 -2 lines
Diff to previous 1.66 (colored)

Rename:

	ipsec_in_reject -> ipsec_sp_reject
	ipsec_hdrsiz    -> ipsec_sp_hdrsiz

localify the former, and do some cleanup while here.

Revision 1.66 / (download) - annotate - [select for diffs], Fri Feb 16 15:18:41 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.65: +1 -5 lines
Diff to previous 1.65 (colored)

Style, remove unused and misleading macros and comments, localify, and
reduce the diff between similar functions. No functional change.

Revision 1.65 / (download) - annotate - [select for diffs], Fri Feb 16 08:51:28 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.64: +1 -2 lines
Diff to previous 1.64 (colored)

Remove ip4_esp_randpad and ip6_esp_randpad, unused. Discussed with
ozaki-r@.

Revision 1.64 / (download) - annotate - [select for diffs], Wed Feb 14 14:28:40 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.63: +33 -61 lines
Diff to previous 1.63 (colored)

Style, and remove unused prototypes and functions.

Revision 1.63 / (download) - annotate - [select for diffs], Wed Feb 14 14:19:53 2018 UTC (6 years, 1 month ago) by maxv
Branch: MAIN
Changes since 1.62: +1 -2 lines
Diff to previous 1.62 (colored)

Remove m_checkalignment(), unused. This eliminates a reference to
m_getptr().

Revision 1.62 / (download) - annotate - [select for diffs], Wed Jan 10 10:56:30 2018 UTC (6 years, 2 months ago) by knakahara
Branch: MAIN
Changes since 1.61: +5 -1 lines
Diff to previous 1.61 (colored)

add ipsec(4) interface, which is used for route-based VPN.

man and ATF are added later, please see man for details.

reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks.
https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html

Revision 1.61 / (download) - annotate - [select for diffs], Tue Oct 3 08:56:52 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202
Changes since 1.60: +4 -3 lines
Diff to previous 1.60 (colored)

Constify isr at many places (NFC)

Revision 1.60 / (download) - annotate - [select for diffs], Tue Oct 3 08:25:21 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
Changes since 1.59: +3 -1 lines
Diff to previous 1.59 (colored)

Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.

Revision 1.59 / (download) - annotate - [select for diffs], Thu Aug 10 06:11:24 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: nick-nhusb-base-20170825
Changes since 1.58: +2 -1 lines
Diff to previous 1.58 (colored)

Add per-CPU rtcache to ipsec_reinject_ipstack

It reduces route lookups and also reduces rtcache lock contentions
when NET_MPSAFE is enabled.

Revision 1.58 / (download) - annotate - [select for diffs], Wed Aug 2 01:28:03 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.57: +3 -2 lines
Diff to previous 1.57 (colored)

Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@

Revision 1.57 / (download) - annotate - [select for diffs], Wed Jul 26 09:18:15 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.56: +2 -2 lines
Diff to previous 1.56 (colored)

Use pslist(9) for sptree

Revision 1.56 / (download) - annotate - [select for diffs], Fri Jul 21 04:55:36 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.55: +2 -2 lines
Diff to previous 1.55 (colored)

Stop setting mtag of PACKET_TAG_IPSEC_IN_DONE because there is no users anymore

Revision 1.55 / (download) - annotate - [select for diffs], Fri Jul 21 04:50:11 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.54: +1 -2 lines
Diff to previous 1.54 (colored)

Remove ipsecrequest#sav

Revision 1.54 / (download) - annotate - [select for diffs], Fri Jul 21 04:39:08 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.53: +1 -3 lines
Diff to previous 1.53 (colored)

Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).

Revision 1.53 / (download) - annotate - [select for diffs], Fri Jul 21 03:08:10 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.52: +2 -2 lines
Diff to previous 1.52 (colored)

Don't use sp->req->sav when handling NAT-T ESP fragmentation

In order to do this we need to look up a sav however an additional
look-up degrades performance. A sav is later looked up in
ipsec4_process_packet so delay the fragmentation check until then
to avoid an extra look-up.

Revision 1.52 / (download) - annotate - [select for diffs], Fri Jul 14 12:26:26 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
CVS Tags: perseant-stdc-iso10646-base, perseant-stdc-iso10646
Changes since 1.51: +2 -2 lines
Diff to previous 1.51 (colored)

Prepare to stop using isr->sav

isr is a shared resource and using isr->sav as a temporal storage
for each packet processing is racy. And also having a reference from
isr to sav makes the lifetime of sav non-deterministic; such a reference
is removed when a packet is processed and isr->sav is overwritten by
new one. Let's have a sav locally for each packet processing instead of
using shared isr->sav.

However this change doesn't stop using isr->sav yet because there are
some users of isr->sav. isr->sav will be removed after the users find
a way to not use isr->sav.

Revision 1.51 / (download) - annotate - [select for diffs], Wed Jul 5 03:44:59 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.50: +2 -2 lines
Diff to previous 1.50 (colored)

Remove codes for PACKET_TAG_IPSEC_IN_CRYPTO_DONE

It seems that PACKET_TAG_IPSEC_IN_CRYPTO_DONE is for network adapters
that have IPsec accelerators; a driver sets the mtag to a packet
when its device has already encrypted the packet.

Unfortunately no driver implements such offload features for long
years and seems unlikely to implement them soon. (Note that neither
FreeBSD nor Linux doesn't have such drivers.) Let's remove related
(unused) codes and simplify the IPsec code.

Revision 1.50 / (download) - annotate - [select for diffs], Fri Jun 2 03:41:20 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
CVS Tags: netbsd-8-base
Branch point for: netbsd-8
Changes since 1.49: +14 -6 lines
Diff to previous 1.49 (colored)

Assert inph_locked on ipsec_pcb_skip_ipsec (was IPSEC_PCB_SKIP_IPSEC)

The assertion confirms SP caches are accessed under inph lock (solock).

Revision 1.49 / (download) - annotate - [select for diffs], Fri Jun 2 03:39:28 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.48: +2 -2 lines
Diff to previous 1.48 (colored)

Rename IPSEC_PCBHINT_MAYBE to IPSEC_PCBHINT_UNKNOWN

MAYBE is maybe unclear.

Revision 1.48 / (download) - annotate - [select for diffs], Fri May 19 04:34:09 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.47: +8 -1 lines
Diff to previous 1.47 (colored)

Introduce IPSECLOG and replace ipseclog and DPRINTF with it

Revision 1.47 / (download) - annotate - [select for diffs], Thu May 11 05:55:14 2017 UTC (6 years, 10 months ago) by ryo
Branch: MAIN
CVS Tags: prg-localcount2-base3
Changes since 1.46: +8 -3 lines
Diff to previous 1.46 (colored)

Make ipsec_address() and ipsec_logsastr() mpsafe.

Revision 1.46 / (download) - annotate - [select for diffs], Wed May 10 09:34:52 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base2
Changes since 1.45: +2 -2 lines
Diff to previous 1.45 (colored)

Stop ipsec4_output returning SP to the caller

SP isn't used by the caller (ip_output) and also holding its
reference looks unnecessary.

Revision 1.45 / (download) - annotate - [select for diffs], Mon May 8 06:39:23 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.44: +2 -3 lines
Diff to previous 1.44 (colored)

Omit two arguments of ipsec4_process_packet

flags is unused and tunalready is always 0. So NFC.

Revision 1.44 / (download) - annotate - [select for diffs], Tue Apr 25 05:44:11 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base1, prg-localcount2-base, pgoyette-localcount-20170426
Branch point for: prg-localcount2
Changes since 1.43: +2 -1 lines
Diff to previous 1.43 (colored)

Check if solock of PCB is held when SP caches in the PCB are accessed

To this end, a back pointer from inpcbpolicy to inpcb_hdr is added.

Revision 1.43 / (download) - annotate - [select for diffs], Thu Apr 20 08:46:07 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: bouyer-socketcan-base1
Changes since 1.42: +1 -6 lines
Diff to previous 1.42 (colored)

Remove unnecessary NULL checks for inp_socket and in6p_socket

They cannot be NULL except for programming errors.

Revision 1.42 / (download) - annotate - [select for diffs], Thu Apr 20 03:41:47 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
Changes since 1.41: +5 -1 lines
Diff to previous 1.41 (colored)

Provide IPSEC_DIR_* validation macros

Revision 1.41 / (download) - annotate - [select for diffs], Wed Apr 19 03:39:14 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
Changes since 1.40: +7 -8 lines
Diff to previous 1.40 (colored)

Retire ipsec_osdep.h

We don't need to care other OSes (FreeBSD) anymore.

Some macros are alive in ipsec_private.h.

Revision 1.40 / (download) - annotate - [select for diffs], Tue Apr 18 05:25:32 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
Changes since 1.39: +1 -11 lines
Diff to previous 1.39 (colored)

Remove __FreeBSD__ and __NetBSD__ switches

No functional changes (except for a debug printf).

Note that there remain some __FreeBSD__ for sysctl knobs which counerparts
to NetBSD don't exist. And ipsec_osdep.h isn't touched yet; tidying it up
requires actual code changes.

Revision 1.39 / (download) - annotate - [select for diffs], Thu Apr 6 09:20:07 2017 UTC (6 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: jdolecek-ncq-base, jdolecek-ncq
Changes since 1.38: +8 -2 lines
Diff to previous 1.38 (colored)

Prepare netipsec for rump-ification

- Include "opt_*.h" only if _KERNEL_OPT is defined
- Allow encapinit to be called twice (by ifinit and ipe4_attach)
  - ifinit didn't call encapinit if IPSEC is enabled (ipe4_attach called
    it instead), however, on a rump kernel ipe4_attach may not be called
    even if IPSEC is enabled. So we need to allow ifinit to call it anyway
- Setup sysctls in ipsec_attach explicitly instead of using SYSCTL_SETUP
- Call ip6flow_invalidate_all in key_spdadd only if in6_present
  - It's possible that a rump kernel loads the ipsec library but not
    the inet6 library

Revision 1.38 / (download) - annotate - [select for diffs], Fri Mar 3 07:13:06 2017 UTC (7 years ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170320
Changes since 1.37: +2 -2 lines
Diff to previous 1.37 (colored)

Pass inpcb/in6pcb instead of socket to ip_output/ip6_output

- Passing a socket to Layer 3 is layer violation and even unnecessary
- The change makes codes of callers and IPsec a bit simple

Revision 1.37 / (download) - annotate - [select for diffs], Wed Apr 1 02:49:44 2015 UTC (8 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20170204, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, localcount-20160914, bouyer-socketcan-base
Branch point for: pgoyette-localcount, bouyer-socketcan
Changes since 1.36: +4 -1 lines
Diff to previous 1.36 (colored)

Pull out ipsec routines from ip6_input

This change reduces symbol references from netinet6 to netipsec
and improves modularity of netipsec.

No functional change is intended.

Revision 1.36 / (download) - annotate - [select for diffs], Fri Sep 5 09:26:44 2014 UTC (9 years, 6 months ago) by matt
Branch: MAIN
CVS Tags: nick-nhusb-base
Branch point for: nick-nhusb
Changes since 1.35: +3 -3 lines
Diff to previous 1.35 (colored)

Don't use C++ keyword new

Revision 1.35 / (download) - annotate - [select for diffs], Fri May 30 01:39:03 2014 UTC (9 years, 10 months ago) by christos
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7
Changes since 1.34: +2 -1 lines
Diff to previous 1.34 (colored)

Introduce 2 new variables: ipsec_enabled and ipsec_used.
Ipsec enabled is controlled by sysctl and determines if is allowed.
ipsec_used is set automatically based on ipsec being enabled, and
rules existing.

Revision 1.34 / (download) - annotate - [select for diffs], Sat Jun 8 13:50:22 2013 UTC (10 years, 9 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, rmind-smpnet, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Branch point for: tls-earlyentropy
Changes since 1.33: +3 -1 lines
Diff to previous 1.33 (colored)

Split IPsec code in ip_input() and ip_forward() into the separate routines
ipsec4_input() and ipsec4_forward().  Tested by christos@.

Revision 1.33 / (download) - annotate - [select for diffs], Sat Jun 8 03:26:05 2013 UTC (10 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.32: +3 -2 lines
Diff to previous 1.32 (colored)

Split IPSec logic from ip_output() into a separate routine - ipsec4_output().
No change to the mechanism intended.  Tested by christos@.

Revision 1.32 / (download) - annotate - [select for diffs], Tue Jun 4 22:47:37 2013 UTC (10 years, 9 months ago) by christos
Branch: MAIN
Changes since 1.31: +3 -1 lines
Diff to previous 1.31 (colored)

PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

Revision 1.31 / (download) - annotate - [select for diffs], Fri Jan 6 14:17:11 2012 UTC (12 years, 2 months ago) by drochner
Branch: MAIN
CVS Tags: yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, yamt-pagecache-base5, yamt-pagecache-base4, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, netbsd-6, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, khorben-n900, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3, jmcneill-usbmp-base2, jmcneill-usbmp-base10, agc-symver-base, agc-symver
Branch point for: tls-maxphys
Changes since 1.30: +2 -2 lines
Diff to previous 1.30 (colored)

more IPSEC header cleanup: don't install unneeded headers to userland,
and remove some differences berween KAME and FAST_IPSEC

Revision 1.30 / (download) - annotate - [select for diffs], Wed Jan 4 15:55:36 2012 UTC (12 years, 2 months ago) by drochner
Branch: MAIN
Changes since 1.29: +6 -5 lines
Diff to previous 1.29 (colored)

-consistently use "char *" for the compiled policy buffer in the
 ipsec_*_policy() functions, as it was documented and used by clients
-remove "ipsec_policy_t" which was undocumented and only present
 in the KAME version of the ipsec.h header
-misc cleanup of historical artefacts, and to remove unnecessary
 differences between KAME ans FAST_IPSEC

Revision 1.29 / (download) - annotate - [select for diffs], Thu Jun 9 19:54:18 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, rmind-uvmplock-nbase, rmind-uvmplock-base, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base, jmcneill-audiomp3-base, jmcneill-audiomp3
Branch point for: yamt-pagecache, jmcneill-usbmp
Changes since 1.28: +4 -4 lines
Diff to previous 1.28 (colored)

more "const"

Revision 1.28 / (download) - annotate - [select for diffs], Wed Jun 8 16:24:50 2011 UTC (12 years, 9 months ago) by dyoung
Branch: MAIN
Changes since 1.27: +2 -2 lines
Diff to previous 1.27 (colored)

Fiddle a bit with const's to make FAST_IPSEC compile.

Revision 1.27 / (download) - annotate - [select for diffs], Sun Jun 5 01:40:40 2011 UTC (12 years, 9 months ago) by christos
Branch: MAIN
Changes since 1.26: +3 -3 lines
Diff to previous 1.26 (colored)

- sprinkle const
- malloc style

Revision 1.26 / (download) - annotate - [select for diffs], Mon May 16 10:02:30 2011 UTC (12 years, 10 months ago) by drochner
Branch: MAIN
CVS Tags: cherry-xenmp-base
Branch point for: cherry-xenmp
Changes since 1.25: +6 -6 lines
Diff to previous 1.25 (colored)

use time_t rather than long for timestamps

Revision 1.25 / (download) - annotate - [select for diffs], Fri Feb 18 19:06:45 2011 UTC (13 years, 1 month ago) by drochner
Branch: MAIN
CVS Tags: bouyer-quota2-nbase
Changes since 1.24: +5 -5 lines
Diff to previous 1.24 (colored)

sprinkle some "const", documenting that the SA is not supposed to
change during an xform operation

Revision 1.24 / (download) - annotate - [select for diffs], Sun May 10 02:13:07 2009 UTC (14 years, 10 months ago) by elad
Branch: MAIN
CVS Tags: yamt-nfs-mp-base9, yamt-nfs-mp-base8, yamt-nfs-mp-base7, yamt-nfs-mp-base6, yamt-nfs-mp-base5, yamt-nfs-mp-base4, yamt-nfs-mp-base11, yamt-nfs-mp-base10, uebayasi-xip-base4, uebayasi-xip-base3, uebayasi-xip-base2, uebayasi-xip-base1, uebayasi-xip-base, uebayasi-xip, matt-premerge-20091211, matt-mips64-premerge-20101231, jymxensuspend-base, jym-xensuspend-nbase, jym-xensuspend-base, jruoho-x86intr-base, bouyer-quota2-base
Branch point for: rmind-uvmplock, jruoho-x86intr, bouyer-quota2
Changes since 1.23: +2 -2 lines
Diff to previous 1.23 (colored)

Adapt FAST_IPSEC to recent KPI changes.

Pointed out by dyoung@ on tech-kern@, thanks!

Revision 1.23 / (download) - annotate - [select for diffs], Wed Nov 12 12:36:28 2008 UTC (15 years, 4 months ago) by ad
Branch: MAIN
CVS Tags: yamt-nfs-mp-base3, nick-hppapmap-base4, nick-hppapmap-base3, nick-hppapmap-base2, nick-hppapmap-base, mjf-devfs2-base, haad-nbase2, haad-dm-base2, haad-dm-base, ad-audiomp2-base, ad-audiomp2
Branch point for: jym-xensuspend
Changes since 1.22: +2 -2 lines
Diff to previous 1.22 (colored)

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

Revision 1.22 / (download) - annotate - [select for diffs], Wed Apr 23 06:09:05 2008 UTC (15 years, 11 months ago) by thorpej
Branch: MAIN
CVS Tags: yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-nfs-mp-base2, yamt-nfs-mp-base, wrstuden-revivesa-base-4, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, wrstuden-revivesa, simonb-wapbl-nbase, simonb-wapbl-base, simonb-wapbl, netbsd-5-base, netbsd-5-2-RELEASE, netbsd-5-2-RC1, netbsd-5-2-3-RELEASE, netbsd-5-2-2-RELEASE, netbsd-5-2-1-RELEASE, netbsd-5-2, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-5-RELEASE, netbsd-5-1-4-RELEASE, netbsd-5-1-3-RELEASE, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, netbsd-5, matt-nb5-pq3-base, matt-nb5-pq3, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-premerge-20091211, matt-nb5-mips64-k15, matt-nb5-mips64, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, hpcarm-cleanup-nbase, haad-dm-base1
Branch point for: yamt-nfs-mp, nick-hppapmap, haad-dm
Changes since 1.21: +1 -2 lines
Diff to previous 1.21 (colored)

Make IPSEC and FAST_IPSEC stats per-cpu.  Use <net/net_stats.h> and
netstat_sysctl().

Revision 1.21 / (download) - annotate - [select for diffs], Sat Dec 29 14:53:25 2007 UTC (16 years, 3 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base, yamt-lazymbuf-base15, yamt-lazymbuf-base14, nick-net80211-sync-base, nick-net80211-sync, mjf-devfs-base, matt-armv6-nbase, matt-armv6-base, keiichi-mipv6-nbase, keiichi-mipv6-base, keiichi-mipv6, hpcarm-cleanup-base, bouyer-xeni386-nbase, bouyer-xeni386-base, ad-socklock-base1
Branch point for: yamt-pf42, mjf-devfs2
Changes since 1.20: +4 -1 lines
Diff to previous 1.20 (colored)

Simplify the FAST_IPSEC output path
Only record an IPSEC_OUT_DONE tag when we have finished the processing
In ip{,6}_output, check this tag to know if we have already processed this
packet.
Remove some dead code (IPSEC_PENDING_TDB is not used in NetBSD)

Fix pr/36870

Revision 1.20 / (download) - annotate - [select for diffs], Sun Mar 4 06:03:28 2007 UTC (17 years ago) by christos
Branch: MAIN
CVS Tags: yamt-x86pmap-base4, yamt-x86pmap-base3, yamt-x86pmap-base2, yamt-x86pmap-base, yamt-x86pmap, yamt-kmem-base3, yamt-kmem-base2, yamt-kmem-base, yamt-kmem, yamt-idlelwp-base8, vmlocking2-base3, vmlocking2-base2, vmlocking2-base1, vmlocking2, vmlocking-nbase, vmlocking-base, vmlocking, thorpej-atomic-base, thorpej-atomic, reinoud-bufcleanup-nbase, reinoud-bufcleanup-base, reinoud-bufcleanup, nick-csl-alignment-base5, nick-csl-alignment-base, nick-csl-alignment, mjf-ufs-trans-base, mjf-ufs-trans, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, jmcneill-pm-base, jmcneill-pm, jmcneill-base, hpcarm-cleanup, cube-autoconf-base, cube-autoconf, bouyer-xenamd64-base2, bouyer-xenamd64-base, bouyer-xenamd64
Branch point for: mjf-devfs, matt-armv6, bouyer-xeni386
Changes since 1.19: +7 -7 lines
Diff to previous 1.19 (colored)

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Revision 1.19 / (download) - annotate - [select for diffs], Sun Feb 18 13:27:31 2007 UTC (17 years, 1 month ago) by degroote
Branch: MAIN
CVS Tags: ad-audiomp-base, ad-audiomp
Changes since 1.18: +44 -47 lines
Diff to previous 1.18 (colored)

Remove __P
Remove useless extern
Use ansi declaration

Revision 1.18 / (download) - annotate - [select for diffs], Sat Feb 17 22:34:16 2007 UTC (17 years, 1 month ago) by dyoung
Branch: MAIN
Changes since 1.17: +3 -3 lines
Diff to previous 1.17 (colored)

KNF: de-__P, bzero -> memset, bcmp -> memcmp.  Remove extraneous
   parentheses in return statements.

Cosmetic: don't open-code TAILQ_FOREACH().

Cosmetic: change types of variables to avoid oodles of casts: in
   in6_src.c, avoid casts by changing several route_in6 pointers
   to struct route pointers.  Remove unnecessary casts to caddr_t
   elsewhere.

Pave the way for eliminating address family-specific route caches:
   soon, struct route will not embed a sockaddr, but it will hold
   a reference to an external sockaddr, instead.  We will set the
   destination sockaddr using rtcache_setdst().  (I created a stub
   for it, but it isn't used anywhere, yet.)  rtcache_free() will
   free the sockaddr.  I have extracted from rtcache_free() a helper
   subroutine, rtcache_clear().  rtcache_clear() will "forget" a
   cached route, but it will not forget the destination by releasing
   the sockaddr.  I use rtcache_clear() instead of rtcache_free()
   in rtcache_update(), because rtcache_update() is not supposed
   to forget the destination.

Constify:

   1 Introduce const accessor for route->ro_dst, rtcache_getdst().

   2 Constify the 'dst' argument to ifnet->if_output().  This
     led me to constify a lot of code called by output routines.

   3 Constify the sockaddr argument to protosw->pr_ctlinput.  This
     led me to constify a lot of code called by ctlinput routines.

   4 Introduce const macros for converting from a generic sockaddr
     to family-specific sockaddrs, e.g., sockaddr_in: satocsin6,
     satocsin, et cetera.

Revision 1.17 / (download) - annotate - [select for diffs], Thu Nov 16 01:33:49 2006 UTC (17 years, 4 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base5, yamt-splraiseipl-base4, yamt-splraiseipl-base3, wrstuden-fixsa-newbase, wrstuden-fixsa-base-1, wrstuden-fixsa-base, wrstuden-fixsa, post-newlock2-merge, newlock2-nbase, newlock2-base, netbsd-4-base, netbsd-4-0-RELEASE, netbsd-4-0-RC5, netbsd-4-0-RC4, netbsd-4-0-RC3, netbsd-4-0-RC2, netbsd-4-0-RC1, netbsd-4-0-1-RELEASE, netbsd-4-0, netbsd-4, matt-nb4-arm-base, matt-nb4-arm
Branch point for: yamt-idlelwp
Changes since 1.16: +8 -8 lines
Diff to previous 1.16 (colored)

__unused removal on arguments; approved by core.

Revision 1.16 / (download) - annotate - [select for diffs], Fri Oct 13 20:53:59 2006 UTC (17 years, 5 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base2
Changes since 1.15: +13 -4 lines
Diff to previous 1.15 (colored)

more __unused

Revision 1.15 / (download) - annotate - [select for diffs], Tue Apr 11 20:21:28 2006 UTC (17 years, 11 months ago) by rpaulo
Branch: MAIN
CVS Tags: yamt-splraiseipl-base, yamt-pdpolicy-base9, yamt-pdpolicy-base8, yamt-pdpolicy-base7, yamt-pdpolicy-base6, yamt-pdpolicy-base5, simonb-timecounters-base, rpaulo-netinet-merge-pcb-base, gdamore-uart-base, gdamore-uart, elad-kernelauth-base, chap-midi-nbase, chap-midi-base, chap-midi, abandoned-netbsd-4-base, abandoned-netbsd-4
Branch point for: yamt-splraiseipl, newlock2
Changes since 1.14: +5 -1 lines
Diff to previous 1.14 (colored)

Add two new sysctls protected under IPSEC_DEBUG:

  net.inet.ipsec.test_replay - When set to 1, IPsec will send packets with
          the same sequence number. This allows to verify if the other side
          has proper replay attacks detection.

  net.inet.ipsec.test_integrity - When set 1, IPsec will send packets with
          corrupted HMAC. This allows to verify if the other side properly
          detects modified packets.

(a message will be printed indicating when these sysctls changed)

By Pawel Jakub Dawidek <pjd@FreeBSD.org>.
Discussed with Christos Zoulas and Jonathan Stone.

Revision 1.14 / (download) - annotate - [select for diffs], Thu Feb 16 20:17:20 2006 UTC (18 years, 1 month ago) by perry
Branch: MAIN
CVS Tags: yamt-uio_vmspace-base5, yamt-pdpolicy-base4, yamt-pdpolicy-base3, yamt-pdpolicy-base2, yamt-pdpolicy-base, peter-altq-base
Branch point for: yamt-pdpolicy, peter-altq, elad-kernelauth
Changes since 1.13: +4 -4 lines
Diff to previous 1.13 (colored)

Change "inline" back to "__inline" in .h files -- C99 is still too
new, and some apps compile things in C89 mode. C89 keywords stay.

As per core@.

Revision 1.13 / (download) - annotate - [select for diffs], Sat Dec 24 20:45:09 2005 UTC (18 years, 3 months ago) by perry
Branch: MAIN
Branch point for: yamt-uio_vmspace, simonb-timecounters, rpaulo-netinet-merge-pcb
Changes since 1.12: +4 -4 lines
Diff to previous 1.12 (colored)

Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.

Revision 1.12 / (download) - annotate - [select for diffs], Sat Dec 10 23:44:08 2005 UTC (18 years, 3 months ago) by elad
Branch: MAIN
CVS Tags: ktrace-lwp-base
Changes since 1.11: +2 -2 lines
Diff to previous 1.11 (colored)

Multiple inclusion protection, as suggested by christos@ on tech-kern@
few days ago.

Revision 1.11 / (download) - annotate - [select for diffs], Fri Jun 10 13:22:42 2005 UTC (18 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: yamt-vop-base3, yamt-vop-base2, yamt-vop-base, yamt-vop, yamt-readahead-pervnode, yamt-readahead-perfile, yamt-readahead-base3, yamt-readahead-base2, yamt-readahead-base, yamt-readahead, thorpej-vnode-attr-base, thorpej-vnode-attr
Branch point for: yamt-lazymbuf
Changes since 1.10: +2 -2 lines
Diff to previous 1.10 (colored)

constify and unshadow.

Revision 1.10 / (download) - annotate - [select for diffs], Fri May 7 00:55:14 2004 UTC (19 years, 10 months ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base4, yamt-km-base3, yamt-km-base2, yamt-km-base, yamt-km, netbsd-3-base, netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-1, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, netbsd-3-0, netbsd-3, kent-audio2-base, kent-audio2, kent-audio1-beforemerge, kent-audio1-base, kent-audio1
Branch point for: ktrace-lwp
Changes since 1.9: +1 -129 lines
Diff to previous 1.9 (colored)

Redo net.inet.* sysctl subtree for fast-ipsec from scratch.
Attach FAST-IPSEC statistics with 64-bit counters to new sysctl MIB.
Rework netstat to show FAST_IPSEC statistics, via sysctl,  for
netstat -p ipsec.

New kernel files:
	sys/netipsec/Makefile		(new file; install *_var.h includes)
	sys/netipsec/ipsec_var.h	(new 64-bit mib counter struct)

Changed kernel files:
	sys/Makefile			(recurse into sys/netipsec/)
	sys/netinet/in.h		(fake IP_PROTO name for fast_ipsec
					sysctl subtree.)
	sys/netipsec/ipsec.h		(minimal userspace inclusion)
	sys/netipsec/ipsec_osdep.h	(minimal userspace inclusion)
	sys/netipsec/ipsec_netbsd.c	(redo sysctl subtree from scratch)
	sys/netipsec/key*.c		(fix broken net.key subtree)

	sys/netipsec/ah_var.h		(increase all counters to 64 bits)
	sys/netipsec/esp_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipip_var.h		(increase all counters to 64 bits)
	sys/netipsec/ipcomp_var.h	(increase all counters to 64 bits)

	sys/netipsec/ipsec.c		(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_mbuf.c	(add #include netipsec/ipsec_var.h)
	sys/netipsec/ipsec_output.c	(add #include netipsec/ipsec_var.h)

	sys/netinet/raw_ip.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/tcp_input.c		(add #include netipsec/ipsec_var.h)
	sys/netinet/udp_usrreq.c	(add #include netipsec/ipsec_var.h)

Changes to usr.bin/netstat to print the new fast-ipsec sysctl tree
for "netstat -s -p ipsec":

New file:
	usr.bin/netstat/fast_ipsec.c	(print fast-ipsec counters)

Changed files:
	usr.bin/netstat/Makefile	(add fast_ipsec.c)
	usr.bin/netstat/netstat.h	(declarations for fast_ipsec.c)
	usr.bin/netstat/main.c		(call KAME-vs-fast-ipsec dispatcher)

Revision 1.9 / (download) - annotate - [select for diffs], Fri Apr 30 04:12:29 2004 UTC (19 years, 11 months ago) by jonathan
Branch: MAIN
Changes since 1.8: +3 -2 lines
Diff to previous 1.8 (colored)

Minimal cleanup of sys/netipsec/ipsec{,_osdep}.h, to allow compiling
FAST_IPSEC headers (with declarations of stats structures) in
userspace code. I haven't checked for strict POSIX conformance, but
Sam Leffler's FreeBS `ipsecstats' tool will now compile, if you
manually make and populate usr/include/sys/netipsec.

Committed as-is for Andrew Brown to check more of the sys/netipsec sysctls.

Revision 1.8 / (download) - annotate - [select for diffs], Sun Apr 25 22:25:03 2004 UTC (19 years, 11 months ago) by jonathan
Branch: MAIN
Changes since 1.7: +5 -2 lines
Diff to previous 1.7 (colored)

Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).


NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.

Revision 1.7 / (download) - annotate - [select for diffs], Tue Mar 2 02:22:56 2004 UTC (20 years, 1 month ago) by thorpej
Branch: MAIN
CVS Tags: netbsd-2-0-base
Branch point for: netbsd-2-0
Changes since 1.6: +40 -3 lines
Diff to previous 1.6 (colored)

Bring the PCB policy cache over from KAME IPsec, including the "hint"
used to short-circuit IPsec processing in other places.

This is enabled only for NetBSD at the moment; in order for it to function
correctly, ipsec_pcbconn() must be called as appropriate.

Revision 1.6 / (download) - annotate - [select for diffs], Tue Jan 20 22:55:14 2004 UTC (20 years, 2 months ago) by jonathan
Branch: MAIN
Changes since 1.5: +1 -3 lines
Diff to previous 1.5 (colored)

IPv6 mapped adddresses require us to cope with limited polymorphism
(struct in6pcb* versus struct inpcb*) in ipsec_getpolicybysock().

Add new macros (in lieu of an abstract data type) for a ``generic''
PCB_T (points to a struct inpcb* or struct in6pcb*) to ipsec_osdep.h.
Use those new macros in ipsec_getpolicybysock() and elsewhere.

As posted to tech-net for comment/feedback, late  2003.

Revision 1.5 / (download) - annotate - [select for diffs], Thu Dec 4 19:38:24 2003 UTC (20 years, 3 months ago) by atatat
Branch: MAIN
Changes since 1.4: +1 -2 lines
Diff to previous 1.4 (colored)

Dynamic sysctl.

Gone are the old kern_sysctl(), cpu_sysctl(), hw_sysctl(),
vfs_sysctl(), etc, routines, along with sysctl_int() et al.  Now all
nodes are registered with the tree, and nodes can be added (or
removed) easily, and I/O to and from the tree is handled generically.

Since the nodes are registered with the tree, the mapping from name to
number (and back again) can now be discovered, instead of having to be
hard coded.  Adding new nodes to the tree is likewise much simpler --
the new infrastructure handles almost all the work for simple types,
and just about anything else can be done with a small helper function.

All existing nodes are where they were before (numerically speaking),
so all existing consumers of sysctl information should notice no
difference.

PS - I'm sorry, but there's a distinct lack of documentation at the
moment.  I'm working on sysctl(3/8/9) right now, and I promise to
watch out for buses.

Revision 1.4 / (download) - annotate - [select for diffs], Mon Nov 24 20:54:59 2003 UTC (20 years, 4 months ago) by scw
Branch: MAIN
Changes since 1.3: +3 -1 lines
Diff to previous 1.3 (colored)

For FAST_IPSEC, ipfilter gets to see wire-format IPsec-encapsulated packets
only. Decapsulated packets bypass ipfilter. This mimics current behaviour
for Kame IPsec.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Oct 6 22:05:15 2003 UTC (20 years, 5 months ago) by tls
Branch: MAIN
Changes since 1.2: +2 -13 lines
Diff to previous 1.2 (colored)

Reversion of "netkey merge", part 2 (replacement of removed files in the
repository by christos was part 1).  netipsec should now be back as it
was on 2003-09-11, with some very minor changes:

1) Some residual platform-dependent code was moved from ipsec.h to
   ipsec_osdep.h; without this, IPSEC_ASSERT() was multiply defined.  ipsec.h
   now includes ipsec_osdep.h

2) itojun's renaming of netipsec/files.ipsec to netipsec/files.netipsec has
   been left in place (it's arguable which name is less confusing but the
   rename is pretty harmless).

3) Some #endif TOKEN has been replaced by #endif /* TOKEN */; #endif TOKEN
   is invalid and GCC 3 won't compile it.

An i386 kernel with "options FAST_IPSEC" and "options OPENCRYPTO" now
gets through "make depend" but fails to build with errors in ip_input.c.
But it's better than it was (thank heaven for small favors).

Revision 1.2 / (download) - annotate - [select for diffs], Fri Aug 15 03:50:20 2003 UTC (20 years, 7 months ago) by jonathan
Branch: MAIN
Changes since 1.1: +2 -2 lines
Diff to previous 1.1 (colored)

Change ipsec4_common_input() to return void (not int with errno,
as in FreeBSD), to match NetBSD protosw prototype.

Revision 1.1 / (download) - annotate - [select for diffs], Wed Aug 13 20:06:50 2003 UTC (20 years, 7 months ago) by jonathan
Branch: MAIN

Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source.  For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>