The NetBSD Project

CVS log for src/sys/netipsec/key.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / netipsec

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.280.2.1 / (download) - annotate - [select for diffs], Mon Oct 2 12:58:51 2023 UTC (4 months, 3 weeks ago) by martin
Branch: netbsd-10
CVS Tags: netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1
Changes since 1.280: +8 -8 lines
Diff to previous 1.280 (colored) next main 1.281 (colored)

Pull up following revision(s) (requested by knakahara in ticket #378):

	tests/net/if_ipsec/t_ipsec_unnumbered.sh: revision 1.2
	sys/net/if_ipsec.c: revision 1.35
	sys/netipsec/key.c: revision 1.281

Use kmem_free instead of kmem_intr_free, as key_freesaval() is not called in softint after key.c:r1.223.
E.g. key_freesaval() was called the following call path before SAD MP-ify.
   esp_input_cb()
     KEY_FREESAV()
       key_freesav()
         key_delsav()
           key_freesaval()
ok'ed by ozaki-r@n.o.

Use unit id instead of if_index to reduce fixed_reqid space.

Update for sys/net/if_ipsec.c:r1.35

Revision 1.282 / (download) - annotate - [select for diffs], Thu Aug 10 06:44:12 2023 UTC (6 months, 2 weeks ago) by andvar
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-altq-separation-base, thorpej-altq-separation, HEAD
Changes since 1.281: +3 -3 lines
Diff to previous 1.281 (colored)

fix typos in comments s/iton/tion/ or s/ton/tion/.

Revision 1.281 / (download) - annotate - [select for diffs], Fri Jul 21 00:44:38 2023 UTC (7 months, 1 week ago) by knakahara
Branch: MAIN
Changes since 1.280: +8 -8 lines
Diff to previous 1.280 (colored)

Use kmem_free instead of kmem_intr_free, as key_freesaval() is not called in softint after key.c:r1.223.

E.g. key_freesaval() was called the following call path before SAD MP-ify.
  esp_input_cb()
    KEY_FREESAV()
      key_freesav()
        key_delsav()
          key_freesaval()

ok'ed by ozaki-r@n.o.

Revision 1.280 / (download) - annotate - [select for diffs], Thu Dec 8 08:07:07 2022 UTC (14 months, 3 weeks ago) by knakahara
Branch: MAIN
CVS Tags: netbsd-10-base
Branch point for: netbsd-10
Changes since 1.279: +4 -4 lines
Diff to previous 1.279 (colored)

Fix: sp->lastused should be updated by time_uptime, and refactor a little.

Revision 1.279 / (download) - annotate - [select for diffs], Thu Dec 8 08:05:03 2022 UTC (14 months, 3 weeks ago) by knakahara
Branch: MAIN
Changes since 1.278: +9 -2 lines
Diff to previous 1.278 (colored)

Fix: update lastused of ipsecif(4) IPv6 out SP.

Revision 1.278 / (download) - annotate - [select for diffs], Wed Oct 19 21:28:02 2022 UTC (16 months, 1 week ago) by christos
Branch: MAIN
Changes since 1.277: +3 -6 lines
Diff to previous 1.277 (colored)

PR/56836: Andrew Cagney: IPv6 ESN tunneling IPcomp has corrupt header

Always always send / expect CPI in IPcomp header

Fixes kern/56836 where an IPsec interop combining compression and
ESP|AH would fail.

Since fast ipsec, the outgoing IPcomp header has contained the
compression algorithm instead of the CPI.  Adding the
SADB_X_EXT_RAWCPI flag worked around this but ...

The IPcomp's SADB was unconditionally hashed using the compression
algorithm instead of the CPI.  This meant that an incoming packet with
a valid CPI could never match its SADB.

Revision 1.277 / (download) - annotate - [select for diffs], Tue Oct 11 09:51:47 2022 UTC (16 months, 2 weeks ago) by knakahara
Branch: MAIN
Changes since 1.276: +4 -2 lines
Diff to previous 1.276 (colored)

Add sadb_x_policy_flags to inform SP origination.

This extension(struct sadb_x_policy) is *not* defined by RFC2367.

OpenBSD does not have reserved fields in struct sadb_x_policy.
Linux does not use this field yet.
FreeBSD uses this field as "sadb_x_policy_scope"; the value range is
from 0x00 to 0x04.

We use from most significant bit to avoid the above usage.

Revision 1.276 / (download) - annotate - [select for diffs], Tue Aug 9 08:03:22 2022 UTC (18 months, 3 weeks ago) by knakahara
Branch: MAIN
CVS Tags: bouyer-sunxi-drm-base, bouyer-sunxi-drm
Changes since 1.275: +16 -3 lines
Diff to previous 1.275 (colored)

Add sysctl entry to improve interconnectivity to some VPN appliances, pointed out by seil-team@IIJ.

If we want to allow different identifier types on IDii and IDir, set
net.key.allow_different_idtype=1.  Default(=0) is the same as before.

Revision 1.275 / (download) - annotate - [select for diffs], Tue May 24 20:50:20 2022 UTC (21 months ago) by andvar
Branch: MAIN
Changes since 1.274: +3 -3 lines
Diff to previous 1.274 (colored)

fix various typos in comment, documentation and log messages.

Revision 1.274 / (download) - annotate - [select for diffs], Wed May 18 15:20:18 2022 UTC (21 months, 1 week ago) by christos
Branch: MAIN
Changes since 1.273: +61 -25 lines
Diff to previous 1.273 (colored)

PR/56841: Andrew Cagney: debug-log IPcomp CPI lookups:
    - debug-logs why an SPI is rejected
    - adds missing __VA_OPT__(,) to some printf macros
    - debug-log SPI+proto when adding/updating entry

Revision 1.273 / (download) - annotate - [select for diffs], Sun Jan 2 20:28:53 2022 UTC (2 years, 1 month ago) by andvar
Branch: MAIN
Changes since 1.272: +3 -3 lines
Diff to previous 1.272 (colored)

fix few more typos in comments.

Revision 1.272 / (download) - annotate - [select for diffs], Fri Dec 3 13:27:39 2021 UTC (2 years, 2 months ago) by andvar
Branch: MAIN
Changes since 1.271: +3 -3 lines
Diff to previous 1.271 (colored)

fix various typos in comments, log messages and documentation.

Revision 1.255.2.3 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:17 2020 UTC (3 years, 10 months ago) by martin
Branch: phil-wifi
Changes since 1.255.2.2: +140 -57 lines
Diff to previous 1.255.2.2 (colored) to branchpoint 1.255 (colored) next main 1.256 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.255.2.2 / (download) - annotate - [select for diffs], Wed Apr 8 14:08:58 2020 UTC (3 years, 10 months ago) by martin
Branch: phil-wifi
Changes since 1.255.2.1: +14 -10 lines
Diff to previous 1.255.2.1 (colored) to branchpoint 1.255 (colored)

Merge changes from current as of 20200406

Revision 1.163.2.15 / (download) - annotate - [select for diffs], Fri Mar 13 08:35:26 2020 UTC (3 years, 11 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE
Changes since 1.163.2.14: +5 -5 lines
Diff to previous 1.163.2.14 (colored) to branchpoint 1.163 (colored) next main 1.164 (colored)

Pull up following revision(s) (requested by knakahara in ticket #1520):

	sys/netipsec/key.c: revision 1.271
	sys/net/if_ipsec.c: revision 1.28
	sys/net/if_ipsec.c: revision 1.29

Fix ipsecif(4) SPDADD pfkey message has garbage.  Pointed out by ohishi@IIJ.

"setkey -x" output is the following.
========== before ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
  len=15 reserved=0 seq=0 pid=0
sadb_ext{ len=56 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
 { len=40 proto=50 mode=1 level=3 reqid=16393
sockaddr{ len=0 family=0  }
sockaddr{ len=0 family=0  }
 }
========== before ==========

========== after ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
  len=11 reserved=0 seq=0 pid=0
sadb_ext{ len=24 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
 { len=8 proto=50 mode=1 level=3 reqid=16393
 }
========== after ==========

reduce unnecessary reqid of NAT-T ipsecif(4), suggested by ohishi@IIJ.

Fix kern/55066.  Pointed out and fixed by Chuck Zmudzinski, thanks.
ok'ed by ozaki-r@n.o

Revision 1.265.2.3 / (download) - annotate - [select for diffs], Fri Mar 13 08:33:32 2020 UTC (3 years, 11 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Changes since 1.265.2.2: +5 -5 lines
Diff to previous 1.265.2.2 (colored) to branchpoint 1.265 (colored) next main 1.266 (colored)

Pull up following revision(s) (requested by knakahara in ticket #780):

	sys/netipsec/key.c: revision 1.271
	sys/net/if_ipsec.c: revision 1.28
	sys/net/if_ipsec.c: revision 1.29

Fix ipsecif(4) SPDADD pfkey message has garbage.  Pointed out by ohishi@IIJ.

"setkey -x" output is the following.
========== before ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
  len=15 reserved=0 seq=0 pid=0
sadb_ext{ len=56 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
 { len=40 proto=50 mode=1 level=3 reqid=16393
sockaddr{ len=0 family=0  }
sockaddr{ len=0 family=0  }
 }
========== before ==========

========== after ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
  len=11 reserved=0 seq=0 pid=0
sadb_ext{ len=24 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
 { len=8 proto=50 mode=1 level=3 reqid=16393
 }
========== after ==========

reduce unnecessary reqid of NAT-T ipsecif(4), suggested by ohishi@IIJ.

Fix kern/55066.  Pointed out and fixed by Chuck Zmudzinski, thanks.
ok'ed by ozaki-r@n.o

Revision 1.271 / (download) - annotate - [select for diffs], Fri Mar 13 06:55:35 2020 UTC (3 years, 11 months ago) by knakahara
Branch: MAIN
CVS Tags: thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh
Changes since 1.270: +5 -5 lines
Diff to previous 1.270 (colored)

Fix kern/55066.  Pointed out and fixed by Chuck Zmudzinski, thanks.

ok'ed by ozaki-r@n.o

Revision 1.269.2.1 / (download) - annotate - [select for diffs], Sat Feb 29 20:21:07 2020 UTC (4 years ago) by ad
Branch: ad-namecache
Changes since 1.269: +11 -7 lines
Diff to previous 1.269 (colored) next main 1.270 (colored)

Sync with head.

Revision 1.270 / (download) - annotate - [select for diffs], Fri Feb 7 12:35:33 2020 UTC (4 years ago) by thorpej
Branch: MAIN
CVS Tags: is-mlppp-base, is-mlppp, ad-namecache-base3
Changes since 1.269: +11 -7 lines
Diff to previous 1.269 (colored)

Use percpu_foreach_xcall() to gather volatile per-cpu counters.  These
must be serialized against the interrupts / soft-interrupts in which
they're manipulated, as well as protected from non-atomic 64-bit memory
loads on 32-bit platforms.

Revision 1.265.2.2 / (download) - annotate - [select for diffs], Thu Nov 14 15:32:32 2019 UTC (4 years, 3 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Changes since 1.265.2.1: +54 -26 lines
Diff to previous 1.265.2.1 (colored) to branchpoint 1.265 (colored)

Pull up following revision(s) (requested by knakahara in ticket #423):

	sys/netipsec/key.c: revision 1.268
	sys/netipsec/key.c: revision 1.269

Fix SA can be expaired wrongly when there are many SPs.

When key_timehandler_spd() spent over one second, the "now" argument of
key_timehandler_sad() could be older than sav->created. That caused SA
was expired immediately.

 -

Reduce load for IKE negotiations when the system has many IPv6 addresses.
e.g. the system has many vlan(4), gif(4) or ipsecif(4) with link local address.

Revision 1.269 / (download) - annotate - [select for diffs], Thu Nov 14 03:17:08 2019 UTC (4 years, 3 months ago) by knakahara
Branch: MAIN
CVS Tags: phil-wifi-20191119, ad-namecache-base2, ad-namecache-base1, ad-namecache-base
Branch point for: ad-namecache
Changes since 1.268: +21 -17 lines
Diff to previous 1.268 (colored)

Reduce load for IKE negotiations when the system has many IPv6 addresses.

e.g. the system has many vlan(4), gif(4) or ipsecif(4) with link local address.

Revision 1.268 / (download) - annotate - [select for diffs], Tue Nov 12 05:13:29 2019 UTC (4 years, 3 months ago) by knakahara
Branch: MAIN
Changes since 1.267: +35 -11 lines
Diff to previous 1.267 (colored)

Fix SA can be expaired wrongly when there are many SPs.

When key_timehandler_spd() spent over one second, the "now" argument of
key_timehandler_sad() could be older than sav->created. That caused SA
was expired immediately.

Revision 1.267 / (download) - annotate - [select for diffs], Wed Sep 25 09:53:38 2019 UTC (4 years, 5 months ago) by ozaki-r
Branch: MAIN
Changes since 1.266: +19 -11 lines
Diff to previous 1.266 (colored)

Make panic messages more informative

Revision 1.163.2.14 / (download) - annotate - [select for diffs], Tue Sep 24 18:27:09 2019 UTC (4 years, 5 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.13: +20 -6 lines
Diff to previous 1.163.2.13 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by knakahara in ticket #1385):

	sys/net/if.c				1.461
	sys/net/if.h				1.277
	sys/net/if_gif.c			1.149
	sys/net/if_gif.h			1.33
	sys/net/if_ipsec.c			1.19,1.20,1.24
	sys/net/if_ipsec.h			1.5
	sys/net/if_l2tp.c			1.33,1.36-1.39
	sys/net/if_l2tp.h			1.7,1.8
	sys/net/route.c				1.220,1.221
	sys/net/route.h				1.125
	sys/netinet/in_gif.c			1.95
	sys/netinet/in_l2tp.c			1.17
	sys/netinet/ip_input.c			1.391,1.392
	sys/netinet/wqinput.c			1.6
	sys/netinet6/in6_gif.c			1.94
	sys/netinet6/in6_l2tp.c			1.18
	sys/netinet6/ip6_forward.c		1.97
	sys/netinet6/ip6_input.c		1.210,1.211
	sys/netipsec/ipsec_output.c		1.82,1.83 (patched)
	sys/netipsec/ipsecif.c			1.12,1.13,1.15,1.17 (patched)
	sys/netipsec/key.c			1.259,1.260

ipsecif(4) support input drop packet counter.

ipsecif(4) should not increment drop counter by errors not related to if_snd. Pointed out by ozaki-r@n.o, thanks.
Remove unnecessary addresses in PF_KEY message.

MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says
====================
5.  SPD Update
// snip
   SADB_X_SPDADD:
// snip
      sadb_x_ipsecrequest_reqid:
         An ID for that SA can be passed to the kernel in the
         sadb_x_ipsecrequest_reqid field.
      If tunnel mode is specified, the sadb_x_ipsecrequest structure is
      followed by two sockaddr structures that define the tunnel
      endpoint addresses.  In the case that transport mode is used, no
      additional addresses are specified.
====================
see: <a  rel="nofollow" href="https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01">https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01</a>

ipsecif(4) uses transport mode, so it should not add addresses.

ipsecif(4) supports multiple peers in the same NAPT.

E.g. ipsec0 connects between NetBSD_A and NetBSD_B, ipsec1 connects
NetBSD_A and NetBSD_C at the following figure.
                                        +----------+
                                   +----| NetBSD_B |
 +----------+           +------+   |    +----------+
 | NetBSD_A |--- ... ---| NAPT |---+
 +----------+           +------+   |    +----------+
                                   +----| NetBSD_C |
                                        +----------+

Add ATF later.

l2tp(4): fix output bytes counter. Pointed by k-goda@IIJ, thanks.
remove a variable which is no longer used.

l2tp: initialize mowner variables for MBUFTRACE

Avoid having a rtcache directly in a percpu storage
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by knakahara@ and yamaguchi@


wqinput: avoid having struct wqinput_worklist directly in a percpu storage
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Input handlers of wqinput normally involves sleepable operations so we must
avoid dereferencing a percpu data (struct wqinput_worklist) after executing
an input handler.  Address this situation by having just a pointer to the data
in a percpu storage instead.

Reviewed by knakahara@ and yamaguchi@

Add missing #include <sys/kmem.h>

Divide Tx context of l2tp(4) to improve performance.
It seems l2tp(4) call path is too long for instruction cache. So, dividing
l2tp(4) Tx context improves CPU use efficiency.

After this commit, l2tp(4) throughput gains 10% on my machine(Atom C3000).

Apply some missing changes lost on the previous commit

Avoid having a rtcache directly in a percpu storage for tunnel protocols.
percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing.  Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

l2tp(4): avoid having struct ifqueue directly in a percpu storage.

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users.  If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.

A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Tx processing of l2tp(4) uses normally involves sleepable operations so we
must avoid dereferencing a percpu data (struct ifqueue) after executing Tx
processing.  Address this situation by having just a pointer to the data in
a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

Revision 1.163.2.13 / (download) - annotate - [select for diffs], Tue Sep 10 16:03:53 2019 UTC (4 years, 5 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.12: +6 -2 lines
Diff to previous 1.163.2.12 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by maxv in ticket #1372):

	sys/netipsec/key.c: revision 1.266

Fix info leaks.

Revision 1.265.2.1 / (download) - annotate - [select for diffs], Sun Sep 1 10:49:37 2019 UTC (4 years, 5 months ago) by martin
Branch: netbsd-9
Changes since 1.265: +6 -2 lines
Diff to previous 1.265 (colored)

Pull up following revision(s) (requested by maxv in ticket #127):

	sys/netipsec/key.c: revision 1.266

Fix info leaks.

Revision 1.266 / (download) - annotate - [select for diffs], Sun Aug 4 14:30:36 2019 UTC (4 years, 6 months ago) by maxv
Branch: MAIN
Changes since 1.265: +6 -2 lines
Diff to previous 1.265 (colored)

Fix info leaks.

Revision 1.163.2.12 / (download) - annotate - [select for diffs], Thu Jul 25 08:58:21 2019 UTC (4 years, 7 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.11: +9 -5 lines
Diff to previous 1.163.2.11 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #1306):

	crypto/dist/ipsec-tools/src/setkey/parse.y: revision 1.23
	sys/netipsec/key.c: revision 1.265
	crypto/dist/ipsec-tools/src/setkey/token.l: revision 1.23
	tests/net/ipsec/t_ipsec_misc.sh: revision 1.23

ipsec: fix a regression of the update API

The update API updates an SA by creating a new SA and removing an existing SA.
The previous change removed a newly added SA wrongly if an existing SA had been
created by the getspi API.

setkey: enable to use the getspi API

If a specified SPI is not zero, tell the kernel to use the SPI by using
SADB_EXT_SPIRANGE.  Otherwise, the kernel picks a random SPI.

It enables to mimic racoon.

tests: add tests for getspi and udpate

Revision 1.265 / (download) - annotate - [select for diffs], Tue Jul 23 04:29:26 2019 UTC (4 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.264: +9 -5 lines
Diff to previous 1.264 (colored)

ipsec: fix a regression of the update API

The update API updates an SA by creating a new SA and removing an existing SA.
The previous change removed a newly added SA wrongly if an existing SA had been
created by the getspi API.

Revision 1.163.2.11 / (download) - annotate - [select for diffs], Mon Jul 22 18:07:07 2019 UTC (4 years, 7 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.10: +58 -22 lines
Diff to previous 1.163.2.10 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #1303):

	sys/netipsec/key.c: revision 1.264

Avoid a race condition between SA (sav) manipulations

An sav can be removed from belonging list(s) twice resulting in an assertion
failure of pslist.  It can occur if the following two operations interleave:

(i) a deletion or a update of an SA via the API, and
(ii) a state change (key_sa_chgstate) of the same SA by the timer.

Note that even (ii) removes an sav once from its list(s) on a update.
The cause of the race condition is that the two operations are not serialized
and (i) doesn't get and remove an sav from belonging list(s) atomically.  So
(ii) can be inserted between an acquisition and a removal of (i).

Avoid the race condition by making (i) atomic.

Revision 1.264 / (download) - annotate - [select for diffs], Wed Jul 17 07:07:59 2019 UTC (4 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.263: +58 -22 lines
Diff to previous 1.263 (colored)

Avoid a race condition between SA (sav) manipulations

An sav can be removed from belonging list(s) twice resulting in an assertion
failure of pslist.  It can occur if the following two operations interleave:
(i) a deletion or a update of an SA via the API, and
(ii) a state change (key_sa_chgstate) of the same SA by the timer.
Note that even (ii) removes an sav once from its list(s) on a update.

The cause of the race condition is that the two operations are not serialized
and (i) doesn't get and remove an sav from belonging list(s) atomically.  So
(ii) can be inserted between an acquisition and a removal of (i).

Avoid the race condition by making (i) atomic.

Revision 1.263 / (download) - annotate - [select for diffs], Wed Jun 12 22:23:06 2019 UTC (4 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.262: +8 -5 lines
Diff to previous 1.262 (colored)

fix typo in comment, improve error message, add default case handling to
set error.

Revision 1.262 / (download) - annotate - [select for diffs], Wed Jun 12 01:32:30 2019 UTC (4 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.261: +3 -3 lines
Diff to previous 1.261 (colored)

Fix double free: key_setsaval() free's newsav by calling key_freesaval()
and key_api_update() calls key_delsav() when key_setsaval() fails which
calls key_freesaval() again...

Revision 1.255.2.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:09:48 2019 UTC (4 years, 8 months ago) by christos
Branch: phil-wifi
Changes since 1.255: +99 -64 lines
Diff to previous 1.255 (colored)

Sync with HEAD

Revision 1.261 / (download) - annotate - [select for diffs], Sun Jan 27 02:08:48 2019 UTC (5 years, 1 month ago) by pgoyette
Branch: MAIN
CVS Tags: phil-wifi-20190609, isaki-audio2-base, isaki-audio2
Changes since 1.260: +2 -2 lines
Diff to previous 1.260 (colored)

Merge the [pgoyette-compat] branch

Revision 1.249.2.7 / (download) - annotate - [select for diffs], Fri Jan 18 08:50:58 2019 UTC (5 years, 1 month ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.249.2.6: +20 -6 lines
Diff to previous 1.249.2.6 (colored) to branchpoint 1.249 (colored) next main 1.250 (colored)

Synch with HEAD

Revision 1.249.2.6 / (download) - annotate - [select for diffs], Wed Dec 26 14:02:05 2018 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249.2.5: +5 -5 lines
Diff to previous 1.249.2.5 (colored) to branchpoint 1.249 (colored)

Sync with HEAD, resolve a few conflicts

Revision 1.260 / (download) - annotate - [select for diffs], Wed Dec 26 08:58:51 2018 UTC (5 years, 2 months ago) by knakahara
Branch: MAIN
CVS Tags: pgoyette-compat-20190127, pgoyette-compat-20190118
Changes since 1.259: +6 -6 lines
Diff to previous 1.259 (colored)

ipsecif(4) supports multiple peers in the same NAPT.

E.g. ipsec0 connects between NetBSD_A and NetBSD_B, ipsec1 connects
NetBSD_A and NetBSD_C at the following figure.

                                        +----------+
                                   +----| NetBSD_B |
 +----------+           +------+   |    +----------+
 | NetBSD_A |--- ... ---| NAPT |---+
 +----------+           +------+   |    +----------+
                                   +----| NetBSD_C |
                                        +----------+

Add ATF later.

Revision 1.259 / (download) - annotate - [select for diffs], Wed Dec 26 08:55:14 2018 UTC (5 years, 2 months ago) by knakahara
Branch: MAIN
Changes since 1.258: +16 -2 lines
Diff to previous 1.258 (colored)

Remove unnecessary addresses in PF_KEY message.

MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says
====================
5.  SPD Update
// snip
   SADB_X_SPDADD:
// snip
      sadb_x_ipsecrequest_reqid:

         An ID for that SA can be passed to the kernel in the
         sadb_x_ipsecrequest_reqid field.


      If tunnel mode is specified, the sadb_x_ipsecrequest structure is
      followed by two sockaddr structures that define the tunnel
      endpoint addresses.  In the case that transport mode is used, no
      additional addresses are specified.
====================
see: https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01

ipsecif(4) uses transport mode, so it should not add addresses.

Revision 1.258 / (download) - annotate - [select for diffs], Sat Dec 22 14:28:57 2018 UTC (5 years, 2 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-1226
Changes since 1.257: +5 -5 lines
Diff to previous 1.257 (colored)

Replace M_ALIGN and MH_ALIGN by m_align.

Revision 1.249.2.5 / (download) - annotate - [select for diffs], Thu Sep 6 06:56:45 2018 UTC (5 years, 5 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249.2.4: +7 -7 lines
Diff to previous 1.249.2.4 (colored) to branchpoint 1.249 (colored)

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Revision 1.163.2.10 / (download) - annotate - [select for diffs], Sat Aug 25 14:35:21 2018 UTC (5 years, 6 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-1-RELEASE, netbsd-8-1-RC1
Changes since 1.163.2.9: +7 -7 lines
Diff to previous 1.163.2.9 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #986):

	sys/netipsec/key.c: revision 1.257

Don't call key_ismyaddr, which may sleep, in a pserialize read section

Use mutex here instead of pserialize because using mutex is simpler than
using psz+ref, which is another solution, and key_checkspidup isn't called in
any performance-sensitive paths.

Revision 1.257 / (download) - annotate - [select for diffs], Thu Aug 23 01:55:38 2018 UTC (5 years, 6 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906
Changes since 1.256: +7 -7 lines
Diff to previous 1.256 (colored)

Don't call key_ismyaddr, which may sleep, in a pserialize read section

Use mutex here instead of pserialize because using mutex is simpler than
using psz+ref, which is another solution, and key_checkspidup isn't called in
any performance-sensitive paths.

Revision 1.249.2.4 / (download) - annotate - [select for diffs], Sat Jul 28 04:38:11 2018 UTC (5 years, 7 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249.2.3: +73 -52 lines
Diff to previous 1.249.2.3 (colored) to branchpoint 1.249 (colored)

Sync with HEAD

Revision 1.256 / (download) - annotate - [select for diffs], Wed Jul 4 19:20:25 2018 UTC (5 years, 7 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-compat-0728
Changes since 1.255: +73 -52 lines
Diff to previous 1.255 (colored)

merge duplicated code, more informative debugging.

Revision 1.249.2.3 / (download) - annotate - [select for diffs], Wed May 2 07:20:24 2018 UTC (5 years, 9 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249.2.2: +2 -3 lines
Diff to previous 1.249.2.2 (colored) to branchpoint 1.249 (colored)

Synch with HEAD

Revision 1.255 / (download) - annotate - [select for diffs], Sat Apr 28 15:45:16 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502
Branch point for: phil-wifi
Changes since 1.254: +2 -3 lines
Diff to previous 1.254 (colored)

Remove IPSEC_SPLASSERT_SOFTNET, it has always been a no-op.

Revision 1.249.2.2 / (download) - annotate - [select for diffs], Sun Apr 22 07:20:28 2018 UTC (5 years, 10 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249.2.1: +215 -67 lines
Diff to previous 1.249.2.1 (colored) to branchpoint 1.249 (colored)

Sync with HEAD

Revision 1.254 / (download) - annotate - [select for diffs], Thu Apr 19 08:27:38 2018 UTC (5 years, 10 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0422
Changes since 1.253: +3 -3 lines
Diff to previous 1.253 (colored)

Remove extra long file paths from the headers.

Revision 1.163.2.9 / (download) - annotate - [select for diffs], Wed Apr 18 14:06:24 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1
Changes since 1.163.2.8: +214 -66 lines
Diff to previous 1.163.2.8 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by yamaguchi in ticket #776):

	sys/netipsec/key.c: revision 1.251-1.253
	sys/netipsec/keydb.h: revision 1.22

Introduced a hash table to sahlist

An saidx of sah included in the list is unique so that
the search can use a hash list whose hash is calculated by
the saidx to find an sah quickly.

The hash list of the sahlits is used in FreeBSD, too.
reviewed by ozaki-r@n.o, thanks.

Added a lookup table to find an sav quickly
key_sad.sahlists doesn't work well for inbound packets because
its key includes source address. For the reason, the
look-up-table for the inbound packets is newly added.
The table has all sav whose state is MATURE or DYING and uses a
key calculated by destination address, protocol, and spi instead
of saidx.

reviewd ozaki-r@n.o, thanks.

Fix panic of SADB when the state of sav is changed in timeout
pointed out by ozaki-r@n.o, thanks

Revision 1.253 / (download) - annotate - [select for diffs], Tue Apr 17 04:22:58 2018 UTC (5 years, 10 months ago) by yamaguchi
Branch: MAIN
Changes since 1.252: +5 -2 lines
Diff to previous 1.252 (colored)

Fix panic of SADB when the state of sav is changed in timeout

pointed out by ozaki-r@n.o, thanks

Revision 1.163.2.8 / (download) - annotate - [select for diffs], Mon Apr 16 14:31:44 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.7: +11 -14 lines
Diff to previous 1.163.2.7 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by yamaguchi in ticket #766):

	sys/netipsec/key.c: revision 1.250

Removed the unnecessary order check of key_lookup_sa

key_prefered_oldsa flag can change the sa to use if an sah
has multiple sav. However the multiple saves whose protocol
is ah, esp, or tcp cannot exist because their duplications
are checked by the spi value. Although the multiple saves
can exist in the case of ipcomp, the values using in the
post processing are same between the saves.

For those reasons, it is no need to select an sav by its
lifetime.

In addition, FreeBSD has already remove this.
reviewed by ozaki-r@n.o, thanks.

Revision 1.252 / (download) - annotate - [select for diffs], Mon Apr 16 08:56:08 2018 UTC (5 years, 10 months ago) by yamaguchi
Branch: MAIN
Changes since 1.251: +141 -54 lines
Diff to previous 1.251 (colored)

Added a lookup table to find an sav quickly

key_sad.sahlists doesn't work well for inbound packets because
its key includes source address. For the reason, the
look-up-table for the inbound packets is newly added.
The table has all sav whose state is MATURE or DYING and uses a
key calculated by destination address, protocol, and spi instead
of saidx.

reviewd ozaki-r@n.o, thanks.

Revision 1.251 / (download) - annotate - [select for diffs], Mon Apr 16 08:52:09 2018 UTC (5 years, 10 months ago) by yamaguchi
Branch: MAIN
Changes since 1.250: +74 -16 lines
Diff to previous 1.250 (colored)

Introduced a hash table to sahlist

An saidx of sah included in the list is unique so that
the search can use a hash list whose hash is calculated by
the saidx to find an sah quickly.
The hash list of the sahlits is used in FreeBSD, too.

reviewed by ozaki-r@n.o, thanks.

Revision 1.249.2.1 / (download) - annotate - [select for diffs], Mon Apr 16 02:00:09 2018 UTC (5 years, 10 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.249: +11 -14 lines
Diff to previous 1.249 (colored)

Sync with HEAD, resolve some conflicts

Revision 1.250 / (download) - annotate - [select for diffs], Mon Apr 9 06:26:05 2018 UTC (5 years, 10 months ago) by yamaguchi
Branch: MAIN
CVS Tags: pgoyette-compat-0415
Changes since 1.249: +11 -14 lines
Diff to previous 1.249 (colored)

Removed the unnecessary order check of key_lookup_sa

key_prefered_oldsa flag can change the sa to use if an sah
has multiple sav. However the multiple saves whose protocol
is ah, esp, or tcp cannot exist because their duplications
are checked by the spi value. Although the multiple saves
can exist in the case of ipcomp, the values using in the
post processing are same between the saves.

For those reasons, it is no need to select an sav by its
lifetime.
In addition, FreeBSD has already remove this.

reviewed by ozaki-r@n.o, thanks.

Revision 1.163.2.7 / (download) - annotate - [select for diffs], Wed Mar 7 13:46:41 2018 UTC (5 years, 11 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.6: +75 -13 lines
Diff to previous 1.163.2.6 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #609):
	sys/netipsec/key.c: revision 1.249
	sys/netipsec/keydb.h: revision 1.21
Avoid data races on lifetime counters by using percpu(9)
We don't make them percpu(9) directly because the structure is exposed to
userland and we don't want to break ABI.  So we add another member variable
for percpu(9) and use it internally.  When we export them to userland, they
are converted to the original format.

Revision 1.249 / (download) - annotate - [select for diffs], Fri Mar 2 07:37:13 2018 UTC (5 years, 11 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-compat-base, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: pgoyette-compat
Changes since 1.248: +75 -13 lines
Diff to previous 1.248 (colored)

Avoid data races on lifetime counters by using percpu(9)

We don't make them percpu(9) directly because the structure is exposed to
userland and we don't want to break ABI.  So we add another member variable
for percpu(9) and use it internally.  When we export them to userland, they
are converted to the original format.

Revision 1.163.2.6 / (download) - annotate - [select for diffs], Sun Feb 11 21:17:34 2018 UTC (6 years ago) by snj
Branch: netbsd-8
Changes since 1.163.2.5: +189 -46 lines
Diff to previous 1.163.2.5 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #536):
	distrib/sets/lists/base/shl.mi: 1.825
	distrib/sets/lists/comp/mi: 1.2168-1.2169
	distrib/sets/lists/comp/shl.mi: 1.310
	distrib/sets/lists/debug/mi: 1.234
	distrib/sets/lists/debug/shl.mi: 1.188
	distrib/sets/lists/man/mi: 1.1570
	distrib/sets/lists/tests/mi: 1.772
	etc/mtree/NetBSD.dist.tests: 1.150
	share/man/man4/Makefile: 1.650
	share/man/man4/ipsec.4: 1.42-1.43
	share/man/man4/ipsecif.4: 1.1-1.5
	sys/arch/amd64/conf/ALL: 1.77
	sys/arch/amd64/conf/GENERIC: 1.480
	sys/conf/files: 1.1191
	sys/net/Makefile: 1.34
	sys/net/files.net: 1.14
	sys/net/if.c: 1.404
	sys/net/if.h: 1.248
	sys/net/if_gif.c: 1.135
	sys/net/if_ipsec.c: 1.1-1.3
	sys/net/if_ipsec.h: 1.1
	sys/net/if_l2tp.c: 1.16
	sys/net/if_types.h: 1.28
	sys/netinet/in.c: 1.214
	sys/netinet/in.h: 1.103
	sys/netinet/in_gif.c: 1.92
	sys/netinet/ip_var.h: 1.122
	sys/netinet6/in6.c: 1.257
	sys/netinet6/in6.h: 1.88
	sys/netinet6/in6_gif.c: 1.90
	sys/netinet6/ip6_var.h: 1.75
	sys/netipsec/Makefile: 1.6
	sys/netipsec/files.netipsec: 1.13
	sys/netipsec/ipsec.h: 1.62
	sys/netipsec/ipsecif.c: 1.1
	sys/netipsec/ipsecif.h: 1.1
	sys/netipsec/key.c: 1.246-1.247
	sys/netipsec/key.h: 1.34
	sys/rump/net/Makefile.rumpnetcomp: 1.20
	sys/rump/net/lib/libipsec/IPSEC.ioconf: 1.1
	sys/rump/net/lib/libipsec/Makefile: 1.1
	sys/rump/net/lib/libipsec/ipsec_component.c: 1.1
	tests/net/Makefile: 1.34
	tests/net/if_ipsec/Makefile: 1.1
	tests/net/if_ipsec/t_ipsec.sh: 1.1-1.2
Don't touch an SP without a reference to it
unify processing to check nesting count for some tunnel protocols.
add ipsec(4) interface, which is used for route-based VPN.
man and ATF are added later, please see man for details.
reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks.
https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html
ipsec(4) interface supports rump now.
add ipsec(4) interface ATF.
add ipsec(4) interface man as ipsecif.4.
add ipsec(4) interface to amd64/GENERIC and amd64/ALL configs.
apply in{,6}_tunnel_validate() to gif(4).
Spell IPsec that way. Simplify macro usage. Sort SEE ALSO. Bump
date for previous.
Improve wording and macro use.
Some parts are not clear to me, so someone with knowledge of ipsecif(4)
should improve this some more.
Improve ipsecif.4. Default port ipsec(4) NAT-T is tested now.
pointed out by wiz@n.o and suggested by ozaki-r@n.o, thanks.
Change the prefix of test names to ipsecif_ to distinguish from tests for ipsec(4)
New sentence, new line. Remove empty macro.
Fix PR kern/52920. Pointed out by David Binderman, thanks.
Improve wording, and put a new drawing, from me and Kengo Nakahara.
apply a little more #ifdef INET/INET6.  fixes !INET6 builds.

Revision 1.248 / (download) - annotate - [select for diffs], Thu Feb 8 20:57:41 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.247: +2 -5 lines
Diff to previous 1.247 (colored)

Remove unused net_osdep.h include.

Revision 1.247 / (download) - annotate - [select for diffs], Wed Jan 10 10:56:30 2018 UTC (6 years, 1 month ago) by knakahara
Branch: MAIN
Changes since 1.246: +180 -45 lines
Diff to previous 1.246 (colored)

add ipsec(4) interface, which is used for route-based VPN.

man and ATF are added later, please see man for details.

reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks.
https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html

Revision 1.78.2.4 / (download) - annotate - [select for diffs], Sun Dec 3 11:39:05 2017 UTC (6 years, 2 months ago) by jdolecek
Branch: tls-maxphys
Changes since 1.78.2.3: +2783 -2557 lines
Diff to previous 1.78.2.3 (colored) next main 1.79 (colored)

update from HEAD

Revision 1.163.2.5 / (download) - annotate - [select for diffs], Fri Dec 1 09:21:15 2017 UTC (6 years, 2 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.4: +6 -22 lines
Diff to previous 1.163.2.4 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by christos in ticket #415):
	sys/netipsec/key.c: revision 1.244
	sys/netipsec/key.c: revision 1.245
Use KDASSERT for mutex_ownable
Because mutex_ownable is not cheap.
Fix a deadlock happening if !NET_MPSAFE
If NET_MPSAFE isn't set, key_timehandler_work is executed with holding
softnet_lock. This means that localcount_drain can be called with holding
softnet_lock resulting in a deadlock that localcount_drain waits for packet
processing to release a reference to SP/SA while network processing is prevented
by softnet_lock.
Fix the deadlock by not taking softnet_lock in key_timehandler_work. It's okay
because IPsec is MP-safe even if !NET_MPSAFE. Note that the change also needs
to enable pserialize_perform because the IPsec code can be run in parallel now.
Reported by christos@

Revision 1.246 / (download) - annotate - [select for diffs], Fri Dec 1 06:34:14 2017 UTC (6 years, 2 months ago) by ozaki-r
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202
Changes since 1.245: +11 -3 lines
Diff to previous 1.245 (colored)

Don't touch an SP without a reference to it

Revision 1.163.2.4 / (download) - annotate - [select for diffs], Thu Nov 30 15:57:37 2017 UTC (6 years, 3 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.3: +3 -3 lines
Diff to previous 1.163.2.3 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #407):
	sys/compat/linux32/common/linux32_socket.c: revision 1.28
	sys/net/if.c: revision 1.400
	sys/netipsec/key.c: revision 1.243
	sys/compat/linux/common/linux_socket.c: revision 1.139
	sys/netinet/ip_carp.c: revision 1.93
	sys/netinet6/in6.c: revision 1.252
	sys/netinet6/in6.c: revision 1.253
	sys/netinet6/in6.c: revision 1.254
	sys/net/if_spppsubr.c: revision 1.173
	sys/net/if_spppsubr.c: revision 1.174
	sys/compat/common/uipc_syscalls_40.c: revision 1.14
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref
Fix usage of FOREACH macro
key_sad.lock is held there so SAVLIST_WRITER_FOREACH is enough.
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref
Protect IFADDR_READER_FOREACH and obtained ifa with psz/psref (more)
Fix and make consistent of usages of psz/psref in ifconf variants
Remove unnecessary goto because there is no cleanup code to share (NFC)
Tweak a condition; we don't need to care ifacount to be negative
Fix a race condition of in6_ifinit
in6_ifinit checks the number of IPv6 addresses on a given interface and
if it's zero (i.e., an IPv6 address being assigned to the interface
is the first one), call if_addr_init. However, the actual assignment of
the address (ifa_insert) is out of in6_ifinit. The check and the
assignment must be done atomically.
Fix it by holding in6_ifaddr_lock during in6_ifinit and ifa_insert.
And also add missing pserialize to IFADDR_READER_FOREACH.

Revision 1.163.2.3 / (download) - annotate - [select for diffs], Thu Nov 30 14:57:34 2017 UTC (6 years, 3 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.2: +166 -378 lines
Diff to previous 1.163.2.2 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #406):
	sys/netipsec/key.c: revision 1.239
	sys/netipsec/key.c: revision 1.240
	sys/netipsec/key.c: revision 1.241
	sys/netipsec/key.c: revision 1.242
	sys/netipsec/key.h: revision 1.33
	sys/netipsec/ipsec.c: revision 1.123
	sys/netipsec/key.c: revision 1.236
	sys/netipsec/key.c: revision 1.237
	sys/netipsec/key.c: revision 1.238
Provide a function to call MGETHDR and MCLGET
The change fixes two usages of MGETHDR that don't check whether a mbuf is really
allocated before passing it to MCLGET.
Fix error handling of MCLGET in key_alloc_mbuf
Add missing splx to key_spdexpire
Use M_WAITOK to allocate mbufs wherever sleepable
Further changes will get rid of unnecessary NULL checks then.
Get rid of unnecessary NULL checks that are obsoleted by M_WAITOK
Simply the code by avoiding unnecessary error checks
- Remove unnecessary m_pullup for self-allocated mbufs
- Replace some if-fails-return sanity checks with KASSERT
Call key_sendup_mbuf immediately unless key_acquire is called in softint
We need to defer it only if it's called in softint to avoid deadlock.

Revision 1.245 / (download) - annotate - [select for diffs], Thu Nov 30 02:45:12 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.244: +2 -18 lines
Diff to previous 1.244 (colored)

Fix a deadlock happening if !NET_MPSAFE

If NET_MPSAFE isn't set, key_timehandler_work is executed with holding
softnet_lock. This means that localcount_drain can be called with holding
softnet_lock resulting in a deadlock that localcount_drain waits for packet
processing to release a reference to SP/SA while network processing is prevented
by softnet_lock.

Fix the deadlock by not taking softnet_lock in key_timehandler_work. It's okay
because IPsec is MP-safe even if !NET_MPSAFE. Note that the change also needs
to enable pserialize_perform because the IPsec code can be run in parallel now.

Reported by christos@

Revision 1.244 / (download) - annotate - [select for diffs], Thu Nov 30 02:43:49 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.243: +6 -6 lines
Diff to previous 1.243 (colored)

Use KDASSERT for mutex_ownable

Because mutex_ownable is not cheap.

Revision 1.243 / (download) - annotate - [select for diffs], Wed Nov 22 05:43:28 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.242: +3 -3 lines
Diff to previous 1.242 (colored)

Fix usage of FOREACH macro

key_sad.lock is held there so SAVLIST_WRITER_FOREACH is enough.

Revision 1.163.2.2 / (download) - annotate - [select for diffs], Tue Nov 21 11:11:20 2017 UTC (6 years, 3 months ago) by martin
Branch: netbsd-8
Changes since 1.163.2.1: +3 -3 lines
Diff to previous 1.163.2.1 (colored) to branchpoint 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #360):
	tests/net/ipsec/t_ipsec_misc.sh: revision 1.21
	tests/net/ipsec/t_ipsec_misc.sh: revision 1.22
	sys/netipsec/key.c: revision 1.235
Mark key_timehandler_ch callout as MP-safe (just forgot to do so)
"Mark key_timehandler_ch callout as MP-safe" change needs one more sec to make lifetime tests stable
Dedup some checks
And the change a bit optimizes checks of SA expirations, which
may shorten testing time.

Revision 1.242 / (download) - annotate - [select for diffs], Tue Nov 21 07:33:06 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.241: +8 -2 lines
Diff to previous 1.241 (colored)

Call key_sendup_mbuf immediately unless key_acquire is called in softint

We need to defer it only if it's called in softint to avoid deadlock.

Revision 1.241 / (download) - annotate - [select for diffs], Tue Nov 21 07:25:17 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.240: +35 -150 lines
Diff to previous 1.240 (colored)

Simply the code by avoiding unnecessary error checks

- Remove unnecessary m_pullup for self-allocated mbufs
- Replace some if-fails-return sanity checks with KASSERT

Revision 1.240 / (download) - annotate - [select for diffs], Tue Nov 21 07:20:17 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.239: +21 -123 lines
Diff to previous 1.239 (colored)

Get rid of unnecessary NULL checks that are obsoleted by M_WAITOK

Revision 1.239 / (download) - annotate - [select for diffs], Tue Nov 21 07:03:08 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.238: +87 -76 lines
Diff to previous 1.238 (colored)

Use M_WAITOK to allocate mbufs wherever sleepable

Further changes will get rid of unnecessary NULL checks then.

Revision 1.238 / (download) - annotate - [select for diffs], Tue Nov 21 06:52:51 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.237: +4 -3 lines
Diff to previous 1.237 (colored)

Add missing splx to key_spdexpire

Revision 1.237 / (download) - annotate - [select for diffs], Tue Nov 21 06:51:54 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.236: +8 -3 lines
Diff to previous 1.236 (colored)

Fix error handling of MCLGET in key_alloc_mbuf

Revision 1.236 / (download) - annotate - [select for diffs], Tue Nov 21 06:49:56 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.235: +24 -42 lines
Diff to previous 1.235 (colored)

Provide a function to call MGETHDR and MCLGET

The change fixes two usages of MGETHDR that don't check whether a mbuf is really
allocated before passing it to MCLGET.

Revision 1.235 / (download) - annotate - [select for diffs], Wed Nov 8 10:35:30 2017 UTC (6 years, 3 months ago) by ozaki-r
Branch: MAIN
Changes since 1.234: +3 -3 lines
Diff to previous 1.234 (colored)

Mark key_timehandler_ch callout as MP-safe (just forgot to do so)

Revision 1.163.2.1 / (download) - annotate - [select for diffs], Sat Oct 21 19:43:54 2017 UTC (6 years, 4 months ago) by snj
Branch: netbsd-8
CVS Tags: matt-nb8-mediatek-base, matt-nb8-mediatek
Changes since 1.163: +1457 -896 lines
Diff to previous 1.163 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #300):
	crypto/dist/ipsec-tools/src/setkey/parse.y: 1.19
	crypto/dist/ipsec-tools/src/setkey/token.l: 1.20
	distrib/sets/lists/tests/mi: 1.754, 1.757, 1.759
	doc/TODO.smpnet: 1.12-1.13
	sys/net/pfkeyv2.h: 1.32
	sys/net/raw_cb.c: 1.23-1.24, 1.28
	sys/net/raw_cb.h: 1.28
	sys/net/raw_usrreq.c: 1.57-1.58
	sys/net/rtsock.c: 1.228-1.229
	sys/netinet/in_proto.c: 1.125
	sys/netinet/ip_input.c: 1.359-1.361
	sys/netinet/tcp_input.c: 1.359-1.360
	sys/netinet/tcp_output.c: 1.197
	sys/netinet/tcp_var.h: 1.178
	sys/netinet6/icmp6.c: 1.213
	sys/netinet6/in6_proto.c: 1.119
	sys/netinet6/ip6_forward.c: 1.88
	sys/netinet6/ip6_input.c: 1.181-1.182
	sys/netinet6/ip6_output.c: 1.193
	sys/netinet6/ip6protosw.h: 1.26
	sys/netipsec/ipsec.c: 1.100-1.122
	sys/netipsec/ipsec.h: 1.51-1.61
	sys/netipsec/ipsec6.h: 1.18-1.20
	sys/netipsec/ipsec_input.c: 1.44-1.51
	sys/netipsec/ipsec_netbsd.c: 1.41-1.45
	sys/netipsec/ipsec_output.c: 1.49-1.64
	sys/netipsec/ipsec_private.h: 1.5
	sys/netipsec/key.c: 1.164-1.234
	sys/netipsec/key.h: 1.20-1.32
	sys/netipsec/key_debug.c: 1.18-1.21
	sys/netipsec/key_debug.h: 1.9
	sys/netipsec/keydb.h: 1.16-1.20
	sys/netipsec/keysock.c: 1.59-1.62
	sys/netipsec/keysock.h: 1.10
	sys/netipsec/xform.h: 1.9-1.12
	sys/netipsec/xform_ah.c: 1.55-1.74
	sys/netipsec/xform_esp.c: 1.56-1.72
	sys/netipsec/xform_ipcomp.c: 1.39-1.53
	sys/netipsec/xform_ipip.c: 1.50-1.54
	sys/netipsec/xform_tcp.c: 1.12-1.16
	sys/rump/librump/rumpkern/Makefile.rumpkern: 1.170
	sys/rump/librump/rumpnet/net_stub.c: 1.27
	sys/sys/protosw.h: 1.67-1.68
	tests/net/carp/t_basic.sh: 1.7
	tests/net/if_gif/t_gif.sh: 1.11
	tests/net/if_l2tp/t_l2tp.sh: 1.3
	tests/net/ipsec/Makefile: 1.7-1.9
	tests/net/ipsec/algorithms.sh: 1.5
	tests/net/ipsec/common.sh: 1.4-1.6
	tests/net/ipsec/t_ipsec_ah_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_esp_keys.sh: 1.2
	tests/net/ipsec/t_ipsec_gif.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_l2tp.sh: 1.6-1.7
	tests/net/ipsec/t_ipsec_misc.sh: 1.8-1.18
	tests/net/ipsec/t_ipsec_sockopt.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tcp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_transport.sh: 1.5-1.6
	tests/net/ipsec/t_ipsec_tunnel.sh: 1.9
	tests/net/ipsec/t_ipsec_tunnel_ipcomp.sh: 1.1-1.2
	tests/net/ipsec/t_ipsec_tunnel_odd.sh: 1.3
	tests/net/mcast/t_mcast.sh: 1.6
	tests/net/net/t_ipaddress.sh: 1.11
	tests/net/net_common.sh: 1.20
	tests/net/npf/t_npf.sh: 1.3
	tests/net/route/t_flags.sh: 1.20
	tests/net/route/t_flags6.sh: 1.16
	usr.bin/netstat/fast_ipsec.c: 1.22
Do m_pullup before mtod

It may fix panicks of some tests on anita/sparc and anita/GuruPlug.
---
KNF
---
Enable DEBUG for babylon5
---
Apply C99-style struct initialization to xformsw
---
Tweak outputs of netstat -s for IPsec

- Get rid of "Fast"
- Use ipsec and ipsec6 for titles to clarify protocol
- Indent outputs of sub protocols

Original outputs were organized like this:

(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:
(Fast) IPsec:
IPsec ah:
IPsec esp:
IPsec ipip:
IPsec ipcomp:

New outputs are organized like this:

ipsec:
	ah:
	esp:
	ipip:
	ipcomp:
ipsec6:
	ah:
	esp:
	ipip:
	ipcomp:
---
Add test cases for IPComp
---
Simplify IPSEC_OSTAT macro (NFC)
---
KNF; replace leading whitespaces with hard tabs
---
Introduce and use SADB_SASTATE_USABLE_P
---
KNF
---
Add update command for testing

Updating an SA (SADB_UPDATE) requires that a process issuing
SADB_UPDATE is the same as a process issued SADB_ADD (or SADB_GETSPI).
This means that update command must be used with add command in a
configuration of setkey. This usage is normally meaningless but
useful for testing (and debugging) purposes.
---
Add test cases for updating SA/SP

The tests require newly-added udpate command of setkey.
---
PR/52346: Frank Kardel: Fix checksumming for NAT-T
See XXX for improvements.
---
Remove codes for PACKET_TAG_IPSEC_IN_CRYPTO_DONE

It seems that PACKET_TAG_IPSEC_IN_CRYPTO_DONE is for network adapters
that have IPsec accelerators; a driver sets the mtag to a packet
when its device has already encrypted the packet.

Unfortunately no driver implements such offload features for long
years and seems unlikely to implement them soon. (Note that neither
FreeBSD nor Linux doesn't have such drivers.) Let's remove related
(unused) codes and simplify the IPsec code.
---
Fix usages of sadb_msg_errno
---
Avoid updating sav directly

On SADB_UPDATE a target sav was updated directly, which was unsafe.
Instead allocate another sav, copy variables of the old sav to
the new one and replace the old one with the new one.
---
Simplify; we can assume sav->tdb_xform cannot be NULL while it's valid
---
Rename key_alloc* functions (NFC)

We shouldn't use the term "alloc" for functions that just look up
data and actually don't allocate memory.
---
Use explicit_memset to surely zero-clear key_auth and key_enc
---
Make sure to clear keys on error paths of key_setsaval
---
Add missing KEY_FREESAV
---
Make sure a sav is inserted to a sah list after its initialization completes
---
Remove unnecessary zero-clearing codes from key_setsaval

key_setsaval is now used only for a newly-allocated sav. (It was
used to reset variables of an existing sav.)
---
Correct wrong assumption of sav->refcnt in key_delsah

A sav in a list is basically not to be sav->refcnt == 0. And also
KEY_FREESAV assumes sav->refcnt > 0.
---
Let key_getsavbyspi take a reference of a returning sav
---
Use time_mono_to_wall (NFC)
---
Separate sending message routine (NFC)
---
Simplify; remove unnecessary zero-clears

key_freesaval is used only when a target sav is being destroyed.
---
Omit NULL checks for sav->lft_c

sav->lft_c can be NULL only when initializing or destroying sav.
---
Omit unnecessary NULL checks for sav->sah
---
Omit unnecessary check of sav->state

key_allocsa_policy picks a sav of either MATURE or DYING so we
don't need to check its state again.
---
Simplify; omit unnecessary saidx passing

- ipsec_nextisr returns a saidx but no caller uses it
- key_checkrequest is passed a saidx but it can be gotton by
  another argument (isr)
---
Fix splx isn't called on some error paths
---
Fix header size calculation of esp where sav is NULL
---
Fix header size calculation of ah in the case sav is NULL

This fix was also needed for esp.
---
Pass sav directly to opencrypto callback

In a callback, use a passed sav as-is by default and look up a sav
only if the passed sav is dead.
---
Avoid examining freshness of sav on packet processing

If a sav list is sorted (by lft_c->sadb_lifetime_addtime) in advance,
we don't need to examine each sav and also don't need to delete one
on the fly and send up a message. Fortunately every sav lists are sorted
as we need.

Added key_validate_savlist validates that each sav list is surely sorted
(run only if DEBUG because it's not cheap).
---
Add test cases for SAs with different SPIs
---
Prepare to stop using isr->sav

isr is a shared resource and using isr->sav as a temporal storage
for each packet processing is racy. And also having a reference from
isr to sav makes the lifetime of sav non-deterministic; such a reference
is removed when a packet is processed and isr->sav is overwritten by
new one. Let's have a sav locally for each packet processing instead of
using shared isr->sav.

However this change doesn't stop using isr->sav yet because there are
some users of isr->sav. isr->sav will be removed after the users find
a way to not use isr->sav.
---
Fix wrong argument handling
---
fix printf format.
---
Don't validate sav lists of LARVAL or DEAD states

We don't sort the lists so the validation will always fail.

Fix PR kern/52405
---
Make sure to sort the list when changing the state by key_sa_chgstate
---
Rename key_allocsa_policy to key_lookup_sa_bysaidx
---
Separate test files
---
Calculate ah_max_authsize on initialization as well as esp_max_ivlen
---
Remove m_tag_find(PACKET_TAG_IPSEC_PENDING_TDB) because nobody sets the tag
---
Restore a comment removed in previous

The comment is valid for the below code.
---
Make tests more stable

sleep command seems to wait longer than expected on anita so
use polling to wait for a state change.
---
Add tests that explicitly delete SAs instead of waiting for expirations
---
Remove invalid M_AUTHIPDGM check on ESP isr->sav

M_AUTHIPDGM flag is set to a mbuf in ah_input_cb. An sav of ESP can
have AH authentication as sav->tdb_authalgxform. However, in that
case esp_input and esp_input_cb are used to do ESP decryption and
AH authentication and M_AUTHIPDGM never be set to a mbuf. So
checking M_AUTHIPDGM of a mbuf on isr->sav of ESP is meaningless.
---
Look up sav instead of relying on unstable sp->req->sav

This code is executed only in an error path so an additional lookup
doesn't matter.
---
Correct a comment
---
Don't release sav if calling crypto_dispatch again
---
Remove extra KEY_FREESAV from ipsec_process_done

It should be done by the caller.
---
Don't bother the case of crp->crp_buf == NULL in callbacks
---
Hold a reference to an SP during opencrypto processing

An SP has a list of isr (ipsecrequest) that represents a sequence
of IPsec encryption/authentication processing. One isr corresponds
to one opencrypto processing. The lifetime of an isr follows its SP.

We pass an isr to a callback function of opencrypto to continue
to a next encryption/authentication processing. However nobody
guaranteed that the isr wasn't freed, i.e., its SP wasn't destroyed.

In order to avoid such unexpected destruction of isr, hold a reference
to its SP during opencrypto processing.
---
Don't make SAs expired on tests that delete SAs explicitly
---
Fix a debug message
---
Dedup error paths (NFC)
---
Use pool to allocate tdb_crypto

For ESP and AH, we need to allocate an extra variable space in addition
to struct tdb_crypto. The fixed size of pool items may be larger than
an actual requisite size of a buffer, but still the performance
improvement by replacing malloc with pool wins.
---
Don't use unstable isr->sav for header size calculations

We may need to optimize to not look up sav here for users that
don't need to know an exact size of headers (e.g., TCP segmemt size
caclulation).
---
Don't use sp->req->sav when handling NAT-T ESP fragmentation

In order to do this we need to look up a sav however an additional
look-up degrades performance. A sav is later looked up in
ipsec4_process_packet so delay the fragmentation check until then
to avoid an extra look-up.
---
Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).
---
Stop setting isr->sav on looking up sav in key_checkrequest
---
Remove ipsecrequest#sav
---
Stop setting mtag of PACKET_TAG_IPSEC_IN_DONE because there is no users anymore
---
Skip ipsec_spi_*_*_preferred_new_timeout when running on qemu

Probably due to PR 43997
---
Add localcount to rump kernels
---
Remove unused macro
---
Fix key_getcomb_setlifetime

The fix adjusts a soft limit to be 80% of a corresponding hard limit.

I'm not sure the fix is really correct though, at least the original
code is wrong. A passed comb is zero-cleared before calling
key_getcomb_setlifetime, so
  comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
is meaningless.
---
Provide and apply key_sp_refcnt (NFC)

It simplifies further changes.
---
Fix indentation

Pointed out by knakahara@
---
Use pslist(9) for sptree
---
Don't acquire global locks for IPsec if NET_MPSAFE

Note that the change is just to make testing easy and IPsec isn't MP-safe yet.
---
Let PF_KEY socks hold their own lock instead of softnet_lock

Operations on SAD and SPD are executed via PF_KEY socks. The operations
include deletions of SAs and SPs that will use synchronization mechanisms
such as pserialize_perform to wait for references to SAs and SPs to be
released. It is known that using such mechanisms with holding softnet_lock
causes a dead lock. We should avoid the situation.
---
Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@
---
Fix updating ipsec_used

- key_update_used wasn't called in key_api_spddelete2 and key_api_spdflush
- key_update_used wasn't called if an SP had been added/deleted but
  a reply to userland failed
---
Fix updating ipsec_used; turn on when SPs on sockets are added
---
Add missing IPsec policy checks to icmp6_rip6_input

icmp6_rip6_input is quite similar to rip6_input and the same checks exist
in rip6_input.
---
Add test cases for setsockopt(IP_IPSEC_POLICY)
---
Don't use KEY_NEWSP for dummy SP entries

By the change KEY_NEWSP is now not called from softint anymore
and we can use kmem_zalloc with KM_SLEEP for KEY_NEWSP.
---
Comment out unused functions
---
Add test cases that there are SPs but no relevant SAs
---
Don't allow sav->lft_c to be NULL

lft_c of an sav that was created by SADB_GETSPI could be NULL.
---
Clean up clunky eval strings

- Remove unnecessary \ at EOL
  - This allows to omit ; too
- Remove unnecessary quotes for arguments of atf_set
- Don't expand $DEBUG in eval
  - We expect it's expanded on execution

Suggested by kre@
---
Remove unnecessary KEY_FREESAV in an error path

sav should be freed (unreferenced) by the caller.
---
Use pslist(9) for sahtree
---
Use pslist(9) for sah->savtree
---
Rename local variable newsah to sah

It may not be new.
---
MP-ify SAD slightly

- Introduce key_sa_mtx and use it for some list operations
- Use pserialize for some list iterations
---
Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never be actually freed in the future

KEY_SA_UNREF is still key_freesav so no functional change for now.

This change reduces diff of further changes.
---
Remove out-of-date log output

Pointed out by riastradh@
---
Use KDASSERT instead of KASSERT for mutex_ownable

Because mutex_ownable is too heavy to run in a fast path
even for DIAGNOSTIC + LOCKDEBUG.

Suggested by riastradh@
---
Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@
---
Move locking notes
---
Update the locking notes

- Add locking order
- Add locking notes for misc lists such as reglist
- Mention pserialize, key_sp_ref and key_sp_unref on SP operations

Requested by riastradh@
---
Describe constraints of key_sp_ref and key_sp_unref

Requested by riastradh@
---
Hold key_sad.lock on SAVLIST_WRITER_INSERT_TAIL
---
Add __read_mostly to key_psz

Suggested by riastradh@
---
Tweak wording (pserialize critical section => pserialize read section)

Suggested by riastradh@
---
Add missing mutex_exit
---
Fix setkey -D -P outputs

The outputs were tweaked (by me), but I forgot updating libipsec
in my local ATF environment...
---
MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.
---
Introduce key_sa_refcnt and replace sav->refcnt with it (NFC)
---
Destroy sav only in the loop for DEAD sav
---
Fix KASSERT(solocked(sb->sb_so)) failure in sbappendaddr that is called eventually from key_sendup_mbuf

If key_sendup_mbuf isn't passed a socket, the assertion fails.
Originally in this case sb->sb_so was softnet_lock and callers
held softnet_lock so the assertion was magically satisfied.
Now sb->sb_so is key_so_mtx and also softnet_lock isn't always
held by callers so the assertion can fail.

Fix it by holding key_so_mtx if key_sendup_mbuf isn't passed a socket.

Reported by knakahara@
Tested by knakahara@ and ozaki-r@
---
Fix locking notes of SAD
---
Fix deadlock between key_sendup_mbuf called from key_acquire and localcount_drain

If we call key_sendup_mbuf from key_acquire that is called on packet
processing, a deadlock can happen like this:
- At key_acquire, a reference to an SP (and an SA) is held
- key_sendup_mbuf will try to take key_so_mtx
- Some other thread may try to localcount_drain to the SP with
  holding key_so_mtx in say key_api_spdflush
- In this case localcount_drain never return because key_sendup_mbuf
  that has stuck on key_so_mtx never release a reference to the SP

Fix the deadlock by deferring key_sendup_mbuf to the timer
(key_timehandler).
---
Fix that prev isn't cleared on retry
---
Limit the number of mbufs queued for deferred key_sendup_mbuf

It's easy to be queued hundreds of mbufs on the list under heavy
network load.
---
MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.
---
Simplify ipsec_reinject_ipstack (NFC)
---
Add per-CPU rtcache to ipsec_reinject_ipstack

It reduces route lookups and also reduces rtcache lock contentions
when NET_MPSAFE is enabled.
---
Use pool_cache(9) instead of pool(9) for tdb_crypto objects

The change improves network throughput especially on multi-core systems.
---
Update

ipsec(4), opencrypto(9) and vlan(4) are now MP-safe.
---
Write known issues on scalability
---
Share a global dummy SP between PCBs

It's never be changed so it can be pre-allocated and shared safely between PCBs.
---
Fix race condition on the rawcb list shared by rtsock and keysock

keysock now protects itself by its own mutex, which means that
the rawcb list is protected by two different mutexes (keysock's one
and softnet_lock for rtsock), of course it's useless.

Fix the situation by having a discrete rawcb list for each.
---
Use a dedicated mutex for rt_rawcb instead of softnet_lock if NET_MPSAFE
---
fix localcount leak in sav. fixed by ozaki-r@n.o.

I commit on behalf of him.
---
remove unnecessary comment.
---
Fix deadlock between pserialize_perform and localcount_drain

A typical ussage of localcount_drain looks like this:

  mutex_enter(&mtx);
  item = remove_from_list();
  pserialize_perform(psz);
  localcount_drain(&item->localcount, &cv, &mtx);
  mutex_exit(&mtx);

This sequence can cause a deadlock which happens for example on the following
situation:

- Thread A calls localcount_drain which calls xc_broadcast after releasing
  a specified mutex
- Thread B enters the sequence and calls pserialize_perform with holding
  the mutex while pserialize_perform also calls xc_broadcast
- Thread C (xc_thread) that calls an xcall callback of localcount_drain tries
  to hold the mutex

xc_broadcast of thread B doesn't start until xc_broadcast of thread A
finishes, which is a feature of xcall(9). This means that pserialize_perform
never complete until xc_broadcast of thread A finishes. On the other hand,
thread C that is a callee of xc_broadcast of thread A sticks on the mutex.
Finally the threads block each other (A blocks B, B blocks C and C blocks A).

A possible fix is to serialize executions of the above sequence by another
mutex, but adding another mutex makes the code complex, so fix the deadlock
by another way; the fix is to release the mutex before pserialize_perform
and instead use a condvar to prevent pserialize_perform from being called
simultaneously.

Note that the deadlock has happened only if NET_MPSAFE is enabled.
---
Add missing ifdef NET_MPSAFE
---
Take softnet_lock on pr_input properly if NET_MPSAFE

Currently softnet_lock is taken unnecessarily in some cases, e.g.,
icmp_input and encap4_input from ip_input, or not taken even if needed,
e.g., udp_input and tcp_input from ipsec4_common_input_cb. Fix them.

NFC if NET_MPSAFE is disabled (default).
---
- sanitize key debugging so that we don't print extra newlines or unassociated
  debugging messages.
- remove unused functions and make internal ones static
- print information in one line per message
---
humanize printing of ip addresses
---
cast reduction, NFC.
---
Fix typo in comment
---
Pull out ipsec_fill_saidx_bymbuf (NFC)
---
Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.
---
Fix SP is broken on transport mode

isr->saidx was modified accidentally in ipsec_nextisr.

Reported by christos@
Helped investigations by christos@ and knakahara@
---
Constify isr at many places (NFC)
---
Include socketvar.h for softnet_lock
---
Fix buffer length for ipsec_logsastr

Revision 1.234 / (download) - annotate - [select for diffs], Tue Oct 3 08:56:52 2017 UTC (6 years, 4 months ago) by ozaki-r
Branch: MAIN
Changes since 1.233: +6 -6 lines
Diff to previous 1.233 (colored)

Constify isr at many places (NFC)

Revision 1.233 / (download) - annotate - [select for diffs], Tue Oct 3 08:34:28 2017 UTC (6 years, 4 months ago) by ozaki-r
Branch: MAIN
Changes since 1.232: +4 -4 lines
Diff to previous 1.232 (colored)

Fix SP is broken on transport mode

isr->saidx was modified accidentally in ipsec_nextisr.

Reported by christos@
Helped investigations by christos@ and knakahara@

Revision 1.232 / (download) - annotate - [select for diffs], Tue Oct 3 08:25:21 2017 UTC (6 years, 4 months ago) by ozaki-r
Branch: MAIN
Changes since 1.231: +3 -4 lines
Diff to previous 1.231 (colored)

Don't abuse key_checkrequest just for looking up sav

It does more than expected for example key_acquire.

Revision 1.231 / (download) - annotate - [select for diffs], Sun Oct 1 09:45:16 2017 UTC (6 years, 4 months ago) by ryoon
Branch: MAIN
Changes since 1.230: +3 -3 lines
Diff to previous 1.230 (colored)

Fix typo in comment

Revision 1.230 / (download) - annotate - [select for diffs], Sat Sep 30 21:47:12 2017 UTC (6 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.229: +78 -87 lines
Diff to previous 1.229 (colored)

cast reduction, NFC.

Revision 1.229 / (download) - annotate - [select for diffs], Fri Sep 29 14:59:43 2017 UTC (6 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.228: +11 -7 lines
Diff to previous 1.228 (colored)

humanize printing of ip addresses

Revision 1.228 / (download) - annotate - [select for diffs], Thu Sep 28 17:21:42 2017 UTC (6 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.227: +5 -8 lines
Diff to previous 1.227 (colored)

- sanitize key debugging so that we don't print extra newlines or unassociated
  debugging messages.
- remove unused functions and make internal ones static
- print information in one line per message

Revision 1.227 / (download) - annotate - [select for diffs], Wed Sep 27 09:55:52 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
Changes since 1.226: +6 -2 lines
Diff to previous 1.226 (colored)

Add missing ifdef NET_MPSAFE

Revision 1.226 / (download) - annotate - [select for diffs], Wed Sep 27 07:27:29 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
Changes since 1.225: +69 -22 lines
Diff to previous 1.225 (colored)

Fix deadlock between pserialize_perform and localcount_drain

A typical ussage of localcount_drain looks like this:

  mutex_enter(&mtx);
  item = remove_from_list();
  pserialize_perform(psz);
  localcount_drain(&item->localcount, &cv, &mtx);
  mutex_exit(&mtx);

This sequence can cause a deadlock which happens for example on the following
situation:

- Thread A calls localcount_drain which calls xc_broadcast after releasing
  a specified mutex
- Thread B enters the sequence and calls pserialize_perform with holding
  the mutex while pserialize_perform also calls xc_broadcast
- Thread C (xc_thread) that calls an xcall callback of localcount_drain tries
  to hold the mutex

xc_broadcast of thread B doesn't start until xc_broadcast of thread A
finishes, which is a feature of xcall(9). This means that pserialize_perform
never complete until xc_broadcast of thread A finishes. On the other hand,
thread C that is a callee of xc_broadcast of thread A sticks on the mutex.
Finally the threads block each other (A blocks B, B blocks C and C blocks A).

A possible fix is to serialize executions of the above sequence by another
mutex, but adding another mutex makes the code complex, so fix the deadlock
by another way; the fix is to release the mutex before pserialize_perform
and instead use a condvar to prevent pserialize_perform from being called
simultaneously.

Note that the deadlock has happened only if NET_MPSAFE is enabled.

Revision 1.91.4.4 / (download) - annotate - [select for diffs], Mon Aug 28 17:53:13 2017 UTC (6 years, 6 months ago) by skrll
Branch: nick-nhusb
Changes since 1.91.4.3: +2437 -2110 lines
Diff to previous 1.91.4.3 (colored) to branchpoint 1.91 (colored) next main 1.92 (colored)

Sync with HEAD

Revision 1.225 / (download) - annotate - [select for diffs], Mon Aug 21 07:38:42 2017 UTC (6 years, 6 months ago) by knakahara
Branch: MAIN
CVS Tags: nick-nhusb-base-20170825
Changes since 1.224: +3 -3 lines
Diff to previous 1.224 (colored)

remove unnecessary comment.

Revision 1.224 / (download) - annotate - [select for diffs], Mon Aug 21 02:35:13 2017 UTC (6 years, 6 months ago) by knakahara
Branch: MAIN
Changes since 1.223: +3 -2 lines
Diff to previous 1.223 (colored)

fix localcount leak in sav. fixed by ozaki-r@n.o.

I commit on behalf of him.

Revision 1.223 / (download) - annotate - [select for diffs], Wed Aug 9 09:48:11 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.222: +150 -106 lines
Diff to previous 1.222 (colored)

MP-ify SAD (savlist)

localcount(9) is used to protect savlist of sah. The basic design is
similar to MP-ifications of SPD and SAD sahlist. Please read the
locking notes of SAD for more details.

Revision 1.222 / (download) - annotate - [select for diffs], Wed Aug 9 08:30:54 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.221: +18 -6 lines
Diff to previous 1.221 (colored)

Limit the number of mbufs queued for deferred key_sendup_mbuf

It's easy to be queued hundreds of mbufs on the list under heavy
network load.

Revision 1.221 / (download) - annotate - [select for diffs], Wed Aug 9 06:04:41 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.220: +4 -3 lines
Diff to previous 1.220 (colored)

Fix that prev isn't cleared on retry

Revision 1.220 / (download) - annotate - [select for diffs], Wed Aug 9 04:29:36 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.219: +80 -3 lines
Diff to previous 1.219 (colored)

Fix deadlock between key_sendup_mbuf called from key_acquire and localcount_drain

If we call key_sendup_mbuf from key_acquire that is called on packet
processing, a deadlock can happen like this:
- At key_acquire, a reference to an SP (and an SA) is held
- key_sendup_mbuf will try to take key_so_mtx
- Some other thread may try to localcount_drain to the SP with
  holding key_so_mtx in say key_api_spdflush
- In this case localcount_drain never return because key_sendup_mbuf
  that has stuck on key_so_mtx never release a reference to the SP

Fix the deadlock by deferring key_sendup_mbuf to the timer
(key_timehandler).

Revision 1.219 / (download) - annotate - [select for diffs], Wed Aug 9 03:41:11 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.218: +3 -3 lines
Diff to previous 1.218 (colored)

Fix locking notes of SAD

Revision 1.218 / (download) - annotate - [select for diffs], Tue Aug 8 08:24:34 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.217: +6 -20 lines
Diff to previous 1.217 (colored)

Destroy sav only in the loop for DEAD sav

Revision 1.217 / (download) - annotate - [select for diffs], Tue Aug 8 08:23:10 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.216: +21 -11 lines
Diff to previous 1.216 (colored)

Introduce key_sa_refcnt and replace sav->refcnt with it (NFC)

Revision 1.216 / (download) - annotate - [select for diffs], Tue Aug 8 04:17:34 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.215: +217 -63 lines
Diff to previous 1.215 (colored)

MP-ify SAD (key_sad.sahlist and sah entries)

localcount(9) is used to protect key_sad.sahlist and sah entries
as well as SPD (and will be used for SAD sav).

Please read the locking notes of SAD for more details.

Revision 1.215 / (download) - annotate - [select for diffs], Tue Aug 8 01:56:49 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.214: +5 -3 lines
Diff to previous 1.214 (colored)

Add missing mutex_exit

Revision 1.214 / (download) - annotate - [select for diffs], Tue Aug 8 01:56:10 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.213: +7 -8 lines
Diff to previous 1.213 (colored)

Tweak wording (pserialize critical section => pserialize read section)

Suggested by riastradh@

Revision 1.213 / (download) - annotate - [select for diffs], Tue Aug 8 01:55:17 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.212: +3 -3 lines
Diff to previous 1.212 (colored)

Add __read_mostly to key_psz

Suggested by riastradh@

Revision 1.212 / (download) - annotate - [select for diffs], Mon Aug 7 07:45:45 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.211: +6 -2 lines
Diff to previous 1.211 (colored)

Hold key_sad.lock on SAVLIST_WRITER_INSERT_TAIL

Revision 1.211 / (download) - annotate - [select for diffs], Mon Aug 7 03:30:45 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.210: +10 -2 lines
Diff to previous 1.210 (colored)

Describe constraints of key_sp_ref and key_sp_unref

Requested by riastradh@

Revision 1.210 / (download) - annotate - [select for diffs], Mon Aug 7 03:28:31 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.209: +19 -7 lines
Diff to previous 1.209 (colored)

Update the locking notes

- Add locking order
- Add locking notes for misc lists such as reglist
- Mention pserialize, key_sp_ref and key_sp_unref on SP operations

Requested by riastradh@

Revision 1.209 / (download) - annotate - [select for diffs], Mon Aug 7 03:22:33 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.208: +15 -15 lines
Diff to previous 1.208 (colored)

Move locking notes

Revision 1.208 / (download) - annotate - [select for diffs], Mon Aug 7 03:21:58 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.207: +152 -137 lines
Diff to previous 1.207 (colored)

Assemble global lists and related locks into cache lines (NFCI)

Also rename variable names from *tree to *list because they are
just lists, not trees.

Suggested by riastradh@

Revision 1.207 / (download) - annotate - [select for diffs], Mon Aug 7 03:20:02 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.206: +3 -3 lines
Diff to previous 1.206 (colored)

Use KDASSERT instead of KASSERT for mutex_ownable

Because mutex_ownable is too heavy to run in a fast path
even for DIAGNOSTIC + LOCKDEBUG.

Suggested by riastradh@

Revision 1.206 / (download) - annotate - [select for diffs], Thu Aug 3 06:32:51 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.205: +7 -7 lines
Diff to previous 1.205 (colored)

Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never be actually freed in the future

KEY_SA_UNREF is still key_freesav so no functional change for now.

This change reduces diff of further changes.

Revision 1.205 / (download) - annotate - [select for diffs], Thu Aug 3 06:31:58 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.204: +50 -27 lines
Diff to previous 1.204 (colored)

MP-ify SAD slightly

- Introduce key_sa_mtx and use it for some list operations
- Use pserialize for some list iterations

Revision 1.204 / (download) - annotate - [select for diffs], Thu Aug 3 06:31:16 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.203: +20 -20 lines
Diff to previous 1.203 (colored)

Rename local variable newsah to sah

It may not be new.

Revision 1.203 / (download) - annotate - [select for diffs], Thu Aug 3 06:30:40 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.202: +96 -46 lines
Diff to previous 1.202 (colored)

Use pslist(9) for sah->savtree

Revision 1.202 / (download) - annotate - [select for diffs], Thu Aug 3 06:30:04 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.201: +36 -19 lines
Diff to previous 1.201 (colored)

Use pslist(9) for sahtree

Revision 1.201 / (download) - annotate - [select for diffs], Thu Aug 3 03:12:02 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.200: +6 -2 lines
Diff to previous 1.200 (colored)

Don't allow sav->lft_c to be NULL

lft_c of an sav that was created by SADB_GETSPI could be NULL.

Revision 1.200 / (download) - annotate - [select for diffs], Wed Aug 2 03:45:57 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.199: +5 -5 lines
Diff to previous 1.199 (colored)

Don't use KEY_NEWSP for dummy SP entries

By the change KEY_NEWSP is now not called from softint anymore
and we can use kmem_zalloc with KM_SLEEP for KEY_NEWSP.

Revision 1.199 / (download) - annotate - [select for diffs], Wed Aug 2 02:12:42 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.198: +9 -3 lines
Diff to previous 1.198 (colored)

Fix updating ipsec_used; turn on when SPs on sockets are added

Revision 1.198 / (download) - annotate - [select for diffs], Wed Aug 2 01:59:26 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.197: +6 -4 lines
Diff to previous 1.197 (colored)

Fix updating ipsec_used

- key_update_used wasn't called in key_api_spddelete2 and key_api_spdflush
- key_update_used wasn't called if an SP had been added/deleted but
  a reply to userland failed

Revision 1.197 / (download) - annotate - [select for diffs], Wed Aug 2 01:28:03 2017 UTC (6 years, 6 months ago) by ozaki-r
Branch: MAIN
Changes since 1.196: +267 -149 lines
Diff to previous 1.196 (colored)

Make IPsec SPD MP-safe

We use localcount(9), not psref(9), to make the sptree and secpolicy (SP)
entries MP-safe because SPs need to be referenced over opencrypto
processing that executes a callback in a different context.

SPs on sockets aren't managed by the sptree and can be destroyed in softint.
localcount_drain cannot be used in softint so we delay the destruction of
such SPs to a thread context. To do so, a list to manage such SPs is added
(key_socksplist) and key_timehandler_spd deletes dead SPs in the list.

For more details please read the locking notes in key.c.

Proposed on tech-kern@ and tech-net@

Revision 1.196 / (download) - annotate - [select for diffs], Thu Jul 27 09:53:57 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.195: +4 -2 lines
Diff to previous 1.195 (colored)

Let PF_KEY socks hold their own lock instead of softnet_lock

Operations on SAD and SPD are executed via PF_KEY socks. The operations
include deletions of SAs and SPs that will use synchronization mechanisms
such as pserialize_perform to wait for references to SAs and SPs to be
released. It is known that using such mechanisms with holding softnet_lock
causes a dead lock. We should avoid the situation.

Revision 1.195 / (download) - annotate - [select for diffs], Thu Jul 27 06:59:28 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.194: +5 -7 lines
Diff to previous 1.194 (colored)

Don't acquire global locks for IPsec if NET_MPSAFE

Note that the change is just to make testing easy and IPsec isn't MP-safe yet.

Revision 1.194 / (download) - annotate - [select for diffs], Wed Jul 26 09:18:15 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.193: +69 -31 lines
Diff to previous 1.193 (colored)

Use pslist(9) for sptree

Revision 1.193 / (download) - annotate - [select for diffs], Wed Jul 26 03:59:59 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.192: +16 -6 lines
Diff to previous 1.192 (colored)

Provide and apply key_sp_refcnt (NFC)

It simplifies further changes.

Revision 1.192 / (download) - annotate - [select for diffs], Wed Jul 26 01:33:35 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.191: +5 -5 lines
Diff to previous 1.191 (colored)

Fix key_getcomb_setlifetime

The fix adjusts a soft limit to be 80% of a corresponding hard limit.

I'm not sure the fix is really correct though, at least the original
code is wrong. A passed comb is zero-cleared before calling
key_getcomb_setlifetime, so
  comb->sadb_comb_soft_addtime = comb->sadb_comb_soft_addtime * 80 / 100;
is meaningless.

Revision 1.191 / (download) - annotate - [select for diffs], Fri Jul 21 04:50:11 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.190: +2 -8 lines
Diff to previous 1.190 (colored)

Remove ipsecrequest#sav

Revision 1.190 / (download) - annotate - [select for diffs], Fri Jul 21 04:43:42 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.189: +6 -40 lines
Diff to previous 1.189 (colored)

Stop setting isr->sav on looking up sav in key_checkrequest

Revision 1.189 / (download) - annotate - [select for diffs], Fri Jul 21 04:39:08 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.188: +2 -66 lines
Diff to previous 1.188 (colored)

Don't use key_lookup_sp that depends on unstable sp->req->sav

It provided a fast look-up of SP. We will provide an alternative
method in the future (after basic MP-ification finishes).

Revision 1.188.2.2 / (download) - annotate - [select for diffs], Tue Jul 18 02:10:34 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: perseant-stdc-iso10646
Changes since 1.188.2.1: +8258 -0 lines
Diff to previous 1.188.2.1 (colored) to branchpoint 1.188 (colored) next main 1.189 (colored)

3199078

Revision 1.188.2.1, Tue Jul 18 02:10:33 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: perseant-stdc-iso10646
Changes since 1.188: +0 -8258 lines
FILE REMOVED

file key.c was added on branch perseant-stdc-iso10646 on 2017-07-18 02:10:34 +0000

Revision 1.188 / (download) - annotate - [select for diffs], Tue Jul 18 02:10:33 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: perseant-stdc-iso10646-base
Branch point for: perseant-stdc-iso10646
Changes since 1.187: +6 -11 lines
Diff to previous 1.187 (colored)

Rename key_allocsa_policy to key_lookup_sa_bysaidx

Revision 1.187 / (download) - annotate - [select for diffs], Sun Jul 16 10:46:45 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.186: +24 -5 lines
Diff to previous 1.186 (colored)

Make sure to sort the list when changing the state by key_sa_chgstate

Revision 1.186 / (download) - annotate - [select for diffs], Sun Jul 16 10:36:52 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.185: +4 -3 lines
Diff to previous 1.185 (colored)

Don't validate sav lists of LARVAL or DEAD states

We don't sort the lists so the validation will always fail.

Fix PR kern/52405

Revision 1.185 / (download) - annotate - [select for diffs], Sat Jul 15 22:48:32 2017 UTC (6 years, 7 months ago) by christos
Branch: MAIN
Changes since 1.184: +3 -3 lines
Diff to previous 1.184 (colored)

fix printf format.

Revision 1.184 / (download) - annotate - [select for diffs], Fri Jul 14 12:26:26 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.183: +8 -4 lines
Diff to previous 1.183 (colored)

Prepare to stop using isr->sav

isr is a shared resource and using isr->sav as a temporal storage
for each packet processing is racy. And also having a reference from
isr to sav makes the lifetime of sav non-deterministic; such a reference
is removed when a packet is processed and isr->sav is overwritten by
new one. Let's have a sav locally for each packet processing instead of
using shared isr->sav.

However this change doesn't stop using isr->sav yet because there are
some users of isr->sav. isr->sav will be removed after the users find
a way to not use isr->sav.

Revision 1.183 / (download) - annotate - [select for diffs], Fri Jul 14 01:30:08 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.182: +48 -76 lines
Diff to previous 1.182 (colored)

Avoid examining freshness of sav on packet processing

If a sav list is sorted (by lft_c->sadb_lifetime_addtime) in advance,
we don't need to examine each sav and also don't need to delete one
on the fly and send up a message. Fortunately every sav lists are sorted
as we need.

Added key_validate_savlist validates that each sav list is surely sorted
(run only if DEBUG because it's not cheap).

Revision 1.182 / (download) - annotate - [select for diffs], Fri Jul 14 01:24:23 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.181: +13 -2 lines
Diff to previous 1.181 (colored)

Pass sav directly to opencrypto callback

In a callback, use a passed sav as-is by default and look up a sav
only if the passed sav is dead.

Revision 1.181 / (download) - annotate - [select for diffs], Thu Jul 13 01:22:44 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.180: +4 -4 lines
Diff to previous 1.180 (colored)

Simplify; omit unnecessary saidx passing

- ipsec_nextisr returns a saidx but no caller uses it
- key_checkrequest is passed a saidx but it can be gotton by
  another argument (isr)

Revision 1.180 / (download) - annotate - [select for diffs], Wed Jul 12 07:33:37 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.179: +3 -7 lines
Diff to previous 1.179 (colored)

Omit unnecessary check of sav->state

key_allocsa_policy picks a sav of either MATURE or DYING so we
don't need to check its state again.

Revision 1.179 / (download) - annotate - [select for diffs], Wed Jul 12 07:00:40 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.178: +2 -7 lines
Diff to previous 1.178 (colored)

Omit unnecessary NULL checks for sav->sah

Revision 1.178 / (download) - annotate - [select for diffs], Wed Jul 12 03:59:32 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.177: +6 -16 lines
Diff to previous 1.177 (colored)

Omit NULL checks for sav->lft_c

sav->lft_c can be NULL only when initializing or destroying sav.

Revision 1.177 / (download) - annotate - [select for diffs], Wed Jul 12 03:53:55 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.176: +10 -23 lines
Diff to previous 1.176 (colored)

Simplify; remove unnecessary zero-clears

key_freesaval is used only when a target sav is being destroyed.

Revision 1.176 / (download) - annotate - [select for diffs], Tue Jul 11 10:06:07 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.175: +57 -59 lines
Diff to previous 1.175 (colored)

Separate sending message routine (NFC)

Revision 1.175 / (download) - annotate - [select for diffs], Tue Jul 11 09:49:15 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.174: +8 -6 lines
Diff to previous 1.174 (colored)

Use time_mono_to_wall (NFC)

Revision 1.174 / (download) - annotate - [select for diffs], Tue Jul 11 04:55:39 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.173: +40 -19 lines
Diff to previous 1.173 (colored)

Let key_getsavbyspi take a reference of a returning sav

Revision 1.173 / (download) - annotate - [select for diffs], Tue Jul 11 04:50:59 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.172: +6 -12 lines
Diff to previous 1.172 (colored)

Correct wrong assumption of sav->refcnt in key_delsah

A sav in a list is basically not to be sav->refcnt == 0. And also
KEY_FREESAV assumes sav->refcnt > 0.

Revision 1.172 / (download) - annotate - [select for diffs], Mon Jul 10 07:46:02 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.171: +2 -11 lines
Diff to previous 1.171 (colored)

Remove unnecessary zero-clearing codes from key_setsaval

key_setsaval is now used only for a newly-allocated sav. (It was
used to reset variables of an existing sav.)

Revision 1.171 / (download) - annotate - [select for diffs], Mon Jul 10 07:45:10 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.170: +49 -43 lines
Diff to previous 1.170 (colored)

Make sure a sav is inserted to a sah list after its initialization completes

Revision 1.170 / (download) - annotate - [select for diffs], Mon Jul 10 07:40:23 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.169: +5 -3 lines
Diff to previous 1.169 (colored)

Add missing KEY_FREESAV

Revision 1.169 / (download) - annotate - [select for diffs], Mon Jul 10 07:27:35 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.168: +22 -14 lines
Diff to previous 1.168 (colored)

Make sure to clear keys on error paths of key_setsaval

Revision 1.168 / (download) - annotate - [select for diffs], Fri Jul 7 01:37:34 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.167: +9 -8 lines
Diff to previous 1.167 (colored)

Rename key_alloc* functions (NFC)

We shouldn't use the term "alloc" for functions that just look up
data and actually don't allocate memory.

Revision 1.167 / (download) - annotate - [select for diffs], Thu Jul 6 09:48:42 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.166: +36 -10 lines
Diff to previous 1.166 (colored)

Avoid updating sav directly

On SADB_UPDATE a target sav was updated directly, which was unsafe.
Instead allocate another sav, copy variables of the old sav to
the new one and replace the old one with the new one.

Revision 1.166 / (download) - annotate - [select for diffs], Thu Jul 6 09:04:26 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.165: +6 -6 lines
Diff to previous 1.165 (colored)

Fix usages of sadb_msg_errno

Revision 1.165 / (download) - annotate - [select for diffs], Tue Jul 4 08:11:32 2017 UTC (6 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.164: +3 -4 lines
Diff to previous 1.164 (colored)

Introduce and use SADB_SASTATE_USABLE_P

Revision 1.164 / (download) - annotate - [select for diffs], Sat Jun 10 14:21:01 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.163: +14 -2 lines
Diff to previous 1.163 (colored)

Do m_pullup before mtod

It may fix panicks of some tests on anita/sparc and anita/GuruPlug.

Revision 1.163 / (download) - annotate - [select for diffs], Fri Jun 2 03:32:51 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
CVS Tags: netbsd-8-base
Branch point for: netbsd-8
Changes since 1.162: +2 -4 lines
Diff to previous 1.162 (colored)

Tweak header file inclusions

Revision 1.162 / (download) - annotate - [select for diffs], Fri Jun 2 01:22:50 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.161: +72 -159 lines
Diff to previous 1.161 (colored)

Change the prefix of function names of SADB API handlers to key_api_

By doing so we can easily distinguish them from other utility functions.
And so we can easily know that they are all called from key_parse and
applied assumptions that the arguments are always non-NULL and they
are always called from userland, i.e., never called from interrupt
context (softint). As a result, we can omit some tedious assertions
in the functions.

Revision 1.161 / (download) - annotate - [select for diffs], Thu Jun 1 09:50:35 2017 UTC (6 years, 8 months ago) by ozaki-r
Branch: MAIN
Changes since 1.160: +8 -13 lines
Diff to previous 1.160 (colored)

Simplify; we can assume the arguments are always non-NULL

Revision 1.160 / (download) - annotate - [select for diffs], Thu Jun 1 03:51:08 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.159: +3 -4 lines
Diff to previous 1.159 (colored)

Return a return value of key_senderror as usual

Revision 1.159 / (download) - annotate - [select for diffs], Wed May 31 09:53:35 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.158: +35 -26 lines
Diff to previous 1.158 (colored)

Split the timer handler into small functions (NFC)

Revision 1.158 / (download) - annotate - [select for diffs], Wed May 31 09:52:43 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.157: +41 -46 lines
Diff to previous 1.157 (colored)

Introduce key_fill_replymsg to dedup some routines

Revision 1.157 / (download) - annotate - [select for diffs], Wed May 31 09:51:31 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.156: +10 -8 lines
Diff to previous 1.156 (colored)

Convert some sanity checks to CTASSERT

Revision 1.156 / (download) - annotate - [select for diffs], Wed May 31 09:50:04 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.155: +5 -5 lines
Diff to previous 1.155 (colored)

Move key_init_spidx_bymsghdr to just before spidx is used (NFC)

Revision 1.155 / (download) - annotate - [select for diffs], Wed May 31 05:05:38 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.154: +21 -48 lines
Diff to previous 1.154 (colored)

Use key_getsah more (NFCI)

Revision 1.154 / (download) - annotate - [select for diffs], Wed May 31 04:02:44 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.153: +13 -10 lines
Diff to previous 1.153 (colored)

Avoid using variable newsp for an existing SP (NFC)

Revision 1.153 / (download) - annotate - [select for diffs], Wed May 31 04:02:05 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.152: +3 -3 lines
Diff to previous 1.152 (colored)

Simplify; assignment just works for spidx (NFC)

Revision 1.152 / (download) - annotate - [select for diffs], Wed May 31 04:01:21 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.151: +13 -17 lines
Diff to previous 1.151 (colored)

Sanity-check and return on error early

And delay initializing local variables until they're actually used.

Revision 1.151 / (download) - annotate - [select for diffs], Wed May 31 01:31:07 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.150: +78 -91 lines
Diff to previous 1.150 (colored)

Hide details of the sadb message format (NFCI)

Especially src0 + 1 and dst0 + 1 shouldn't be exposed.

Revision 1.150 / (download) - annotate - [select for diffs], Tue May 30 09:39:53 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.149: +3 -6 lines
Diff to previous 1.149 (colored)

Use key_senderror

Revision 1.149 / (download) - annotate - [select for diffs], Tue May 30 09:39:08 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.148: +3 -4 lines
Diff to previous 1.148 (colored)

Send up an error message on error as well as others

Revision 1.148 / (download) - annotate - [select for diffs], Tue May 30 01:31:07 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.147: +31 -18 lines
Diff to previous 1.147 (colored)

Make refcnt operations of SA and SP atomic

Using atomic opeartions isn't optimal and should be optimized somehow
in the future though, the change allows a kernel with NET_MPSAFE to
run out a benchmark, which is useful to know performance improvement
and degradation by code changes.

Revision 1.147 / (download) - annotate - [select for diffs], Mon May 29 10:11:10 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.146: +10 -8 lines
Diff to previous 1.146 (colored)

Don't make isr->sav NULL

We assume it's always non-NULL.

Revision 1.146 / (download) - annotate - [select for diffs], Sun May 28 14:16:05 2017 UTC (6 years, 9 months ago) by mlelstv
Branch: MAIN
Changes since 1.145: +3 -2 lines
Diff to previous 1.145 (colored)

release key_mtx on return path.

Revision 1.145 / (download) - annotate - [select for diffs], Fri May 26 08:26:22 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.144: +54 -53 lines
Diff to previous 1.144 (colored)

Replace "cmp" of function names to "match" and make their return value consistent

Function names with cmp are expected to return the order of two comparees
like memcmp and strcmp. The functions in question just answer if matched
or not, so don't use cmp and use match instead.

Consistently return 1 on matched and 0 otherwise.

Revision 1.144 / (download) - annotate - [select for diffs], Fri May 26 08:10:46 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.143: +9 -4 lines
Diff to previous 1.143 (colored)

Make key_cmpspidx_exactly and key_cmpspidx_withmask static

Revision 1.143 / (download) - annotate - [select for diffs], Fri May 26 08:09:44 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.142: +9 -4 lines
Diff to previous 1.142 (colored)

Comment out unused key_freesp_so and key_freeso

Revision 1.142 / (download) - annotate - [select for diffs], Fri May 26 08:00:15 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.141: +4 -7 lines
Diff to previous 1.141 (colored)

Simplify; we can assume the arguments are always non-NULL

Revision 1.141 / (download) - annotate - [select for diffs], Thu May 25 03:36:36 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.140: +36 -11 lines
Diff to previous 1.140 (colored)

Protect acqtree and regtree with a mutex (key_mtx)

The data structures aren't used in any performance-sensitive paths,
so just using a mutex to protect them is good enough.

Revision 1.140 / (download) - annotate - [select for diffs], Tue May 23 09:08:45 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.139: +7 -7 lines
Diff to previous 1.139 (colored)

Use __arraycount (NFC)

Revision 1.139 / (download) - annotate - [select for diffs], Tue May 23 04:26:08 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.138: +18 -2 lines
Diff to previous 1.138 (colored)

Disable secspacq stuffs that are now unused

The stuffs are used only if sp->policy == IPSEC_POLICY_IPSEC
&& sp->req == NULL (see ipsec{4,6}_checkpolicy). However, in the
current implementation, sp->req never be NULL (except for the
moments of SP allocation and deallocation) if sp->policy is
IPSEC_POLICY_IPSEC.

It seems that the facility was partially implemented in the KAME
era and wasn't completed. Make it clear that the facility is
unused for now by #ifdef notyet. Eventually we should complete
the implementation or remove it entirely.

Revision 1.138 / (download) - annotate - [select for diffs], Tue May 23 03:13:52 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.137: +18 -18 lines
Diff to previous 1.137 (colored)

Prepare to retire __LIST_CHAINED

We shouldn't relpy on the band-aid and instead use a lock or
refcnt to maintain chains properly. Before removing them,
replace conditionals with KASSERTs and see what will happen.

Revision 1.137 / (download) - annotate - [select for diffs], Mon May 22 04:40:23 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.136: +231 -199 lines
Diff to previous 1.136 (colored)

KNF

And avoid calling a function, assigning a result to a variable, and
comparing it all together in one condition expression.

Revision 1.136 / (download) - annotate - [select for diffs], Mon May 22 04:23:55 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.135: +3 -4 lines
Diff to previous 1.135 (colored)

Replace remaining DPRINTF with IPSECLOG

Revision 1.135 / (download) - annotate - [select for diffs], Fri May 19 06:32:31 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.134: +2 -4 lines
Diff to previous 1.134 (colored)

Remove unnecessary MALLOC_DEFINE(M_SECA)

Revision 1.134 / (download) - annotate - [select for diffs], Fri May 19 06:24:03 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.133: +189 -204 lines
Diff to previous 1.133 (colored)

Use IPSECLOG instead of ipseclog

Revision 1.133 / (download) - annotate - [select for diffs], Fri May 19 04:39:25 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.132: +8 -8 lines
Diff to previous 1.132 (colored)

Use kmem_intr_free in key_freesaval which can be called in softint

Revision 1.118.2.2 / (download) - annotate - [select for diffs], Fri May 19 00:22:58 2017 UTC (6 years, 9 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.118.2.1: +154 -211 lines
Diff to previous 1.118.2.1 (colored) to branchpoint 1.118 (colored) next main 1.119 (colored)

Resolve conflicts from previous merge (all resulting from $NetBSD
keywork expansion)

Revision 1.132 / (download) - annotate - [select for diffs], Wed May 17 02:19:09 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base3
Changes since 1.131: +32 -83 lines
Diff to previous 1.131 (colored)

Replace malloc/free with kmem(9) and kill KMALLOC/KFREE macros

Revision 1.131 / (download) - annotate - [select for diffs], Wed May 17 02:04:55 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.130: +40 -56 lines
Diff to previous 1.130 (colored)

Fix memory leaks of allocated data to sav on key_update

key_setsaval NULL-clears member variables of sav at the beginning
of the function regardless of the states of the variables. When
key_setsaval is called by key_update, member variables sav->replay,
sav->key_* and sav->lft_* may have data allocated by malloc. In
that case they will leak. Free them before NULL-clear to avoid
memory leaks.

Revision 1.130 / (download) - annotate - [select for diffs], Tue May 16 10:11:24 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.129: +7 -12 lines
Diff to previous 1.129 (colored)

Replace kmem_alloc + memset with kmem_zalloc

Suggested by kamil@

Revision 1.129 / (download) - annotate - [select for diffs], Tue May 16 07:43:50 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.128: +19 -2 lines
Diff to previous 1.128 (colored)

Fix memory leaks of sah->idents and sah->identd

Originally fixed by the SEIL team of IIJ

Revision 1.128 / (download) - annotate - [select for diffs], Tue May 16 07:25:57 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.127: +5 -4 lines
Diff to previous 1.127 (colored)

Fix diagnostic assertion failure in ipsec_init_policy

  panic: kernel diagnostic assertion "!cpu_softintr_p()" failed: file "../../../../netipsec/ipsec.c", line 1277
  cpu7: Begin traceback...
  vpanic() at netbsd:vpanic+0x140
  ch_voltag_convert_in() at netbsd:ch_voltag_convert_in
  ipsec_init_policy() at netbsd:ipsec_init_policy+0x149
  in_pcballoc() at netbsd:in_pcballoc+0x1c5
  tcp_attach_wrapper() at netbsd:tcp_attach_wrapper+0x1e1
  sonewconn() at netbsd:sonewconn+0x1ea
  syn_cache_get() at netbsd:syn_cache_get+0x15f
  tcp_input() at netbsd:tcp_input+0x1689
  ipintr() at netbsd:ipintr+0xa88
  softint_dispatch() at netbsd:softint_dispatch+0xd3
  DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe811d337ff0
  Xsoftintr() at netbsd:Xsoftintr+0x4f

Reported by msaitoh@

Revision 1.127 / (download) - annotate - [select for diffs], Tue May 16 03:05:28 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.126: +56 -71 lines
Diff to previous 1.126 (colored)

Use kmem(9) instead of malloc/free

Some of non-sleepable allocations can be replaced with sleepable ones.
To make it clear that the replacements are possible, some assertions
are addded.

Revision 1.126 / (download) - annotate - [select for diffs], Tue May 16 02:59:22 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.125: +24 -7 lines
Diff to previous 1.125 (colored)

Run key_timehandler in thread context (workqueue)

The handler involves object deallocations so we want to not run
it in softint.

Revision 1.125 / (download) - annotate - [select for diffs], Mon May 15 09:55:29 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.124: +5 -5 lines
Diff to previous 1.124 (colored)

Show __func__ instead of __FILE__ in debug log messages

__func__ is shorter and more useful than __FILE__.

Revision 1.124 / (download) - annotate - [select for diffs], Mon May 15 09:52:05 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.123: +3 -3 lines
Diff to previous 1.123 (colored)

Fix a debug log message

Revision 1.123 / (download) - annotate - [select for diffs], Mon May 15 09:51:00 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.122: +2 -7 lines
Diff to previous 1.122 (colored)

Kill useless IPSEC_DEBUG2 (NFC)

Revision 1.118.2.1 / (download) - annotate - [select for diffs], Thu May 11 02:58:41 2017 UTC (6 years, 9 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.118: +85 -130 lines
Diff to previous 1.118 (colored)

Sync with HEAD

Revision 1.122 / (download) - annotate - [select for diffs], Tue May 9 05:38:50 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base2
Changes since 1.121: +3 -3 lines
Diff to previous 1.121 (colored)

Fix kernel build with IPSEC

Revision 1.121 / (download) - annotate - [select for diffs], Tue May 9 04:20:11 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.120: +40 -8 lines
Diff to previous 1.120 (colored)

Add debugging facilities for refcnt of SA/SP

Revision 1.120 / (download) - annotate - [select for diffs], Tue May 9 04:18:51 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.119: +24 -42 lines
Diff to previous 1.119 (colored)

Provide foreach macros for SA states (NFCI)

Revision 1.119 / (download) - annotate - [select for diffs], Tue May 9 04:17:13 2017 UTC (6 years, 9 months ago) by ozaki-r
Branch: MAIN
Changes since 1.118: +25 -84 lines
Diff to previous 1.118 (colored)

Use LIST_* functions (NFC)

Revision 1.118 / (download) - annotate - [select for diffs], Wed Apr 26 08:36:32 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: prg-localcount2-base1, prg-localcount2-base
Branch point for: prg-localcount2
Changes since 1.117: +24 -24 lines
Diff to previous 1.117 (colored)

Replace leading whitespaces with tabs and tweak some indentations

Revision 1.117 / (download) - annotate - [select for diffs], Wed Apr 26 07:17:38 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.116: +2 -6 lines
Diff to previous 1.116 (colored)

Remove unnecessary LIST_FOREACH definition

Revision 1.100.2.3 / (download) - annotate - [select for diffs], Wed Apr 26 02:53:29 2017 UTC (6 years, 10 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.100.2.2: +429 -451 lines
Diff to previous 1.100.2.2 (colored) to branchpoint 1.100 (colored) next main 1.101 (colored)

Sync with HEAD

Revision 1.101.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:06 2017 UTC (6 years, 10 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.101: +429 -460 lines
Diff to previous 1.101 (colored) next main 1.102 (colored)

Sync with HEAD

Revision 1.116 / (download) - annotate - [select for diffs], Thu Apr 20 06:27:08 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170426, bouyer-socketcan-base1
Changes since 1.115: +3 -4 lines
Diff to previous 1.115 (colored)

Use IPSEC_DIR_IS_INOROUT (NFC)

Revision 1.115 / (download) - annotate - [select for diffs], Thu Apr 20 03:41:47 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.114: +3 -4 lines
Diff to previous 1.114 (colored)

Provide IPSEC_DIR_* validation macros

Revision 1.114 / (download) - annotate - [select for diffs], Wed Apr 19 09:23:19 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.113: +16 -22 lines
Diff to previous 1.113 (colored)

Reduce return points (NFC)

Revision 1.113 / (download) - annotate - [select for diffs], Wed Apr 19 09:22:17 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.112: +150 -146 lines
Diff to previous 1.112 (colored)

Return early, reduce identation (NFCI)

Revision 1.112 / (download) - annotate - [select for diffs], Wed Apr 19 07:19:46 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.111: +114 -120 lines
Diff to previous 1.111 (colored)

Use KASSERT for sanity checks of function arguments

Revision 1.111 / (download) - annotate - [select for diffs], Wed Apr 19 03:42:11 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.110: +79 -85 lines
Diff to previous 1.110 (colored)

Tweak KEYDEBUG macros

Let's avoid passing statements to a macro.

Revision 1.110 / (download) - annotate - [select for diffs], Wed Apr 19 03:40:58 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.109: +6 -18 lines
Diff to previous 1.109 (colored)

Change panic if DIAGNOSTIC to KASSERT

One can be changed to CTASSERT.

Revision 1.109 / (download) - annotate - [select for diffs], Wed Apr 19 03:39:14 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.108: +2 -3 lines
Diff to previous 1.108 (colored)

Retire ipsec_osdep.h

We don't need to care other OSes (FreeBSD) anymore.

Some macros are alive in ipsec_private.h.

Revision 1.108 / (download) - annotate - [select for diffs], Tue Apr 18 05:26:42 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.107: +49 -56 lines
Diff to previous 1.107 (colored)

Convert IPSEC_ASSERT to KASSERT or KASSERTMSG

IPSEC_ASSERT just discarded specified message...

Revision 1.107 / (download) - annotate - [select for diffs], Tue Apr 18 05:25:32 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.106: +2 -15 lines
Diff to previous 1.106 (colored)

Remove __FreeBSD__ and __NetBSD__ switches

No functional changes (except for a debug printf).

Note that there remain some __FreeBSD__ for sysctl knobs which counerparts
to NetBSD don't exist. And ipsec_osdep.h isn't touched yet; tidying it up
requires actual code changes.

Revision 1.106 / (download) - annotate - [select for diffs], Mon Apr 17 05:48:18 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.105: +3 -3 lines
Diff to previous 1.105 (colored)

Accept AH with NULL algorithm of zero-length key

Revision 1.105 / (download) - annotate - [select for diffs], Mon Apr 10 14:02:25 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
CVS Tags: jdolecek-ncq-base, jdolecek-ncq
Changes since 1.104: +26 -10 lines
Diff to previous 1.104 (colored)

Fix assertion failure in in6_lookup_multi via key_ismyaddr

in6_lookup_multi was forgotten to be migrated to in6_multi_group.
Also psz should be changed to psz/psref because in6_multi_group is
sleepable.

Fix PR kern/52151

Revision 1.104 / (download) - annotate - [select for diffs], Thu Apr 6 09:20:07 2017 UTC (6 years, 10 months ago) by ozaki-r
Branch: MAIN
Changes since 1.103: +16 -5 lines
Diff to previous 1.103 (colored)

Prepare netipsec for rump-ification

- Include "opt_*.h" only if _KERNEL_OPT is defined
- Allow encapinit to be called twice (by ifinit and ipe4_attach)
  - ifinit didn't call encapinit if IPSEC is enabled (ipe4_attach called
    it instead), however, on a rump kernel ipe4_attach may not be called
    even if IPSEC is enabled. So we need to allow ifinit to call it anyway
- Setup sysctls in ipsec_attach explicitly instead of using SYSCTL_SETUP
- Call ip6flow_invalidate_all in key_spdadd only if in6_present
  - It's possible that a rump kernel loads the ipsec library but not
    the inet6 library

Revision 1.100.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:57:52 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.100.2.1: +3 -12 lines
Diff to previous 1.100.2.1 (colored) to branchpoint 1.100 (colored)

Sync with HEAD

Revision 1.103 / (download) - annotate - [select for diffs], Thu Feb 23 07:57:09 2017 UTC (7 years ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170320
Changes since 1.102: +2 -11 lines
Diff to previous 1.102 (colored)

Remove mkludge stuffs

For unknown reasons, IPv6 multicast addresses are linked to a first
IPv6 address assigned to an interface. Due to the design, when removing
a first address having multicast addresses, we need to save them to
somewhere and later restore them once a new IPv6 address is activated.
mkludge stuffs support the operations.

This change links multicast addresses to an interface directly and
throws the kludge away.

Note that as usual some obsolete member variables remain for kvm(3)
users. And also sysctl net.inet6.multicast_kludge remains to avoid
breaking old ifmcstat.

TODO: currently ifnet has a list of in6_multi but obviously the list
should be protocol independent. Provide a common structure (if_multi
or something) to handle in6_multi and in_multi together as well as
ifaddr does for in_ifaddr and in6_ifaddr.

Revision 1.102 / (download) - annotate - [select for diffs], Wed Feb 22 07:46:00 2017 UTC (7 years ago) by ozaki-r
Branch: MAIN
Changes since 1.101: +3 -3 lines
Diff to previous 1.101 (colored)

Stop using useless IN6_*_MULTI macros

Revision 1.91.4.3 / (download) - annotate - [select for diffs], Wed Oct 5 20:56:09 2016 UTC (7 years, 4 months ago) by skrll
Branch: nick-nhusb
Changes since 1.91.4.2: +15 -4 lines
Diff to previous 1.91.4.2 (colored) to branchpoint 1.91 (colored)

Sync with HEAD

Revision 1.100.2.1 / (download) - annotate - [select for diffs], Tue Jul 26 03:24:23 2016 UTC (7 years, 7 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.100: +15 -4 lines
Diff to previous 1.100 (colored)

Sync with HEAD

Revision 1.101 / (download) - annotate - [select for diffs], Wed Jul 20 07:37:51 2016 UTC (7 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20170204, nick-nhusb-base-20161204, nick-nhusb-base-20161004, localcount-20160914, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.100: +15 -4 lines
Diff to previous 1.100 (colored)

Apply pserialize to some iterations of IP address lists

Revision 1.91.4.2 / (download) - annotate - [select for diffs], Sat Jul 9 20:25:23 2016 UTC (7 years, 7 months ago) by skrll
Branch: nick-nhusb
Changes since 1.91.4.1: +5 -7 lines
Diff to previous 1.91.4.1 (colored) to branchpoint 1.91 (colored)

Sync with HEAD

Revision 1.100 / (download) - annotate - [select for diffs], Thu Jul 7 06:59:30 2016 UTC (7 years, 7 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-localcount-base, nick-nhusb-base-20160907
Branch point for: pgoyette-localcount
Changes since 1.99: +3 -3 lines
Diff to previous 1.99 (colored)

Restore const qualifier dropped due to switching to IN_ADDRLIST_READER_FOREACH

IN_ADDRLIST_READER_FOREACH (pslist(9)) now allows const variables.

Revision 1.99 / (download) - annotate - [select for diffs], Wed Jul 6 08:42:34 2016 UTC (7 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.98: +4 -6 lines
Diff to previous 1.98 (colored)

Switch the IPv4 address list to pslist(9)

Note that we leave the old list just in case; it seems there are some
kvm(3) users accessing the list. We can remove it later if we confirmed
nobody does actually.

Revision 1.98 / (download) - annotate - [select for diffs], Mon Jul 4 06:48:14 2016 UTC (7 years, 7 months ago) by ozaki-r
Branch: MAIN
Changes since 1.97: +4 -4 lines
Diff to previous 1.97 (colored)

Use pslist(9) for the global in6_ifaddr list

psz and psref will be applied in another commit.

No functional change intended.

Revision 1.91.4.1 / (download) - annotate - [select for diffs], Sat Mar 19 11:30:33 2016 UTC (7 years, 11 months ago) by skrll
Branch: nick-nhusb
Changes since 1.91: +134 -66 lines
Diff to previous 1.91 (colored)

Sync with HEAD

Revision 1.91.2.1 / (download) - annotate - [select for diffs], Sun Mar 13 11:59:22 2016 UTC (7 years, 11 months ago) by martin
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1
Changes since 1.91: +134 -66 lines
Diff to previous 1.91 (colored) next main 1.92 (colored)

Pull up following revision(s) (requested by christos in ticket #1136):
	sys/netipsec/key.c: revision 1.92-1.97
	sys/netipsec/key_debug.h: revision 1.7

Add more debugging, no functional change.

Gather more information from mbuf.

Fix port matching; we need to ignore ports when they are 0 not only in
the second saidx but the first one too. Fixes NAT-T issue with NetBSD
being the host behind NAT.

Kill stray &

Simplify the port comparison code further.
PR/50905: Henning Petersen: Fix useless comparison (from FreeBSD)

Revision 1.97 / (download) - annotate - [select for diffs], Mon Mar 7 13:08:48 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
CVS Tags: nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319
Changes since 1.96: +5 -3 lines
Diff to previous 1.96 (colored)

PR/50905: Henning Petersen: Fix useless comparison (from FreeBSD)

Revision 1.96 / (download) - annotate - [select for diffs], Sun Mar 6 04:19:51 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.95: +67 -61 lines
Diff to previous 1.95 (colored)

Simplify the port comparison code further.

Revision 1.95 / (download) - annotate - [select for diffs], Sat Mar 5 20:26:07 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.94: +3 -3 lines
Diff to previous 1.94 (colored)

kill stray &

Revision 1.94 / (download) - annotate - [select for diffs], Sat Mar 5 20:13:40 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.93: +35 -22 lines
Diff to previous 1.93 (colored)

Fix port matching; we need to ignore ports when they are 0 not only in
the second saidx but the first one too. Fixes NAT-T issue with NetBSD
being the host behind NAT.

Revision 1.93 / (download) - annotate - [select for diffs], Sat Mar 5 20:12:23 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.92: +7 -4 lines
Diff to previous 1.92 (colored)

gather more information from mbuf.

Revision 1.92 / (download) - annotate - [select for diffs], Sat Mar 5 20:11:09 2016 UTC (7 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.91: +56 -12 lines
Diff to previous 1.91 (colored)

Add more debugging, no functional change.

Revision 1.78.2.3 / (download) - annotate - [select for diffs], Wed Aug 20 00:04:36 2014 UTC (9 years, 6 months ago) by tls
Branch: tls-maxphys
Changes since 1.78.2.2: +152 -131 lines
Diff to previous 1.78.2.2 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.86.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 06:56:34 2014 UTC (9 years, 6 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.86: +119 -81 lines
Diff to previous 1.86 (colored) next main 1.87 (colored)

Rebase.

Revision 1.91 / (download) - annotate - [select for diffs], Mon Jun 16 03:34:45 2014 UTC (9 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, netbsd-7-base, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0
Branch point for: nick-nhusb, netbsd-7
Changes since 1.90: +79 -76 lines
Diff to previous 1.90 (colored)

cleanup debugging printfs and fix port endianness printing issue.

Revision 1.90 / (download) - annotate - [select for diffs], Thu Jun 5 17:18:19 2014 UTC (9 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.89: +4 -3 lines
Diff to previous 1.89 (colored)

CID 1220169: Reverse NULL

Revision 1.89 / (download) - annotate - [select for diffs], Thu Jun 5 17:11:54 2014 UTC (9 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.88: +3 -3 lines
Diff to previous 1.88 (colored)

CID 274353: Forward NULL

Revision 1.88 / (download) - annotate - [select for diffs], Fri May 30 01:39:03 2014 UTC (9 years, 9 months ago) by christos
Branch: MAIN
Changes since 1.87: +34 -2 lines
Diff to previous 1.87 (colored)

Introduce 2 new variables: ipsec_enabled and ipsec_used.
Ipsec enabled is controlled by sysctl and determines if is allowed.
ipsec_used is set automatically based on ipsec being enabled, and
rules existing.

Revision 1.74.2.3 / (download) - annotate - [select for diffs], Thu May 22 11:41:10 2014 UTC (9 years, 9 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.74.2.2: +60 -124 lines
Diff to previous 1.74.2.2 (colored) to branchpoint 1.74 (colored) next main 1.75 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.87 / (download) - annotate - [select for diffs], Mon May 19 02:51:25 2014 UTC (9 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.86: +8 -6 lines
Diff to previous 1.86 (colored)

- Split off PRU_ATTACH and PRU_DETACH logic into separate functions.
- Replace malloc with kmem and eliminate M_PCB while here.
- Sprinkle more asserts.

Revision 1.82.2.2 / (download) - annotate - [select for diffs], Sun May 18 17:46:14 2014 UTC (9 years, 9 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.82.2.1: +33 -52 lines
Diff to previous 1.82.2.1 (colored) to branchpoint 1.82 (colored) next main 1.83 (colored)

sync with head

Revision 1.86 / (download) - annotate - [select for diffs], Sat Mar 1 12:55:23 2014 UTC (10 years ago) by joerg
Branch: MAIN
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.85: +2 -4 lines
Diff to previous 1.85 (colored)

Remove modification of an unused uninitialized variable.

Revision 1.85 / (download) - annotate - [select for diffs], Tue Feb 25 18:30:12 2014 UTC (10 years ago) by pooka
Branch: MAIN
Changes since 1.84: +2 -13 lines
Diff to previous 1.84 (colored)

Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

Revision 1.84 / (download) - annotate - [select for diffs], Sun Nov 3 18:37:10 2013 UTC (10 years, 3 months ago) by mrg
Branch: MAIN
Changes since 1.83: +2 -4 lines
Diff to previous 1.83 (colored)

- apply some __diagused
- remove unused variables
- move some variables inside their relevant use #ifdef

Revision 1.83 / (download) - annotate - [select for diffs], Thu Sep 19 19:29:35 2013 UTC (10 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.82: +33 -37 lines
Diff to previous 1.82 (colored)

make debugging code use __func__
remove stray printf

Revision 1.82.2.1 / (download) - annotate - [select for diffs], Wed Jul 17 03:16:31 2013 UTC (10 years, 7 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.82: +8 -6 lines
Diff to previous 1.82 (colored)

Checkpoint work in progress:
- Move PCB structures under __INPCB_PRIVATE, adjust most of the callers
  and thus make IPv4 PCB structures mostly opaque.  Any volunteers for
  merging in6pcb with inpcb (see rpaulo-netinet-merge-pcb branch)?
- Move various global vars to the modules where they belong, make them static.
- Some preliminary work for IPv4 PCB locking scheme.
- Make raw IP code mostly MP-safe.  Simplify some of it.
- Rework "fast" IP forwarding (ipflow) code to be mostly MP-safe.  It should
  run from a software interrupt, rather than hard.
- Rework tun(4) pseudo interface to be MP-safe.
- Work towards making some other interfaces more strict.

Revision 1.82 / (download) - annotate - [select for diffs], Mon Jun 24 04:21:20 2013 UTC (10 years, 8 months ago) by riastradh
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Branch point for: rmind-smpnet
Changes since 1.81: +6 -4 lines
Diff to previous 1.81 (colored)

Replace consttime_bcmp/explicit_bzero by consttime_memequal/explicit_memset.

consttime_memequal is the same as the old consttime_bcmp.
explicit_memset is to memset as explicit_bzero was to bcmp.

Passes amd64 release and i386/ALL, but I'm sure I missed some spots,
so please let me know.

Revision 1.78.2.2 / (download) - annotate - [select for diffs], Sun Jun 23 06:20:26 2013 UTC (10 years, 8 months ago) by tls
Branch: tls-maxphys
Changes since 1.78.2.1: +25 -72 lines
Diff to previous 1.78.2.1 (colored)

resync from head

Revision 1.81 / (download) - annotate - [select for diffs], Wed Jun 5 19:01:26 2013 UTC (10 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.80: +24 -24 lines
Diff to previous 1.80 (colored)

IPSEC has not come in two speeds for a long time now (IPSEC == kame,
FAST_IPSEC). Make everything refer to IPSEC to avoid confusion.

Revision 1.80 / (download) - annotate - [select for diffs], Tue Jun 4 22:47:37 2013 UTC (10 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.79: +3 -50 lines
Diff to previous 1.79 (colored)

PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

Revision 1.78.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:02:48 2012 UTC (11 years, 3 months ago) by tls
Branch: tls-maxphys
Changes since 1.78: +30 -31 lines
Diff to previous 1.78 (colored)

Resync to 2012-11-19 00:00:00 UTC

Revision 1.76.4.1 / (download) - annotate - [select for diffs], Thu Nov 1 16:45:04 2012 UTC (11 years, 3 months ago) by matt
Branch: matt-nb6-plus
Changes since 1.76: +9 -2 lines
Diff to previous 1.76 (colored) next main 1.77 (colored)

sync with netbsd-6-0-RELEASE.

Revision 1.74.2.2 / (download) - annotate - [select for diffs], Tue Oct 30 17:22:50 2012 UTC (11 years, 4 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.74.2.1: +32 -44 lines
Diff to previous 1.74.2.1 (colored) to branchpoint 1.74 (colored)

sync with head

Revision 1.79 / (download) - annotate - [select for diffs], Thu Sep 20 23:50:05 2012 UTC (11 years, 5 months ago) by gdt
Branch: MAIN
CVS Tags: yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, khorben-n900, agc-symver-base, agc-symver
Changes since 1.78: +30 -31 lines
Diff to previous 1.78 (colored)

Fix whitespace (mostly removing trailing).

This commit changes only whitespace (trailing, tabs vs spaces,
removing spurious newlines).  From Bev Schwartz of BBN.

Revision 1.76.2.1 / (download) - annotate - [select for diffs], Mon Sep 3 19:19:54 2012 UTC (11 years, 5 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, matt-nb6-plus-nbase, matt-nb6-plus-base
Changes since 1.76: +9 -2 lines
Diff to previous 1.76 (colored) next main 1.77 (colored)

Apply patch requested by msaitoh in pullup-6 ticket #538:

* add TAILQ satailq and sptailq
  - these queues are referenced from kernfs/ipsecsa, kernfs/ipsecsp
    as a weak_symbol.
  - KAME netkey has the two queues, but FAST-IPsec netkey doen't.
    This cause a panic. To prevent this panic, make a empty tailq.
  - The tailq doen't work, because there are no implementation yet...

Revision 1.78 / (download) - annotate - [select for diffs], Thu Aug 30 12:16:49 2012 UTC (11 years, 6 months ago) by drochner
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.77: +4 -4 lines
Diff to previous 1.77 (colored)

Add "consttime_bcmp" and "explicit_bzero" functions for both kernel
abd userland, as proposed on tech-security, with explicit_bzero using
a volatile function pointer as suggested by Alan Barrett.
Both do what the name says. For userland, both are prefixed by "__"
to keep them out of the user namespace.
Change some memset/memcmp uses to the new functions where it makes
sense -- these are just some examples, more to come.

Revision 1.77 / (download) - annotate - [select for diffs], Wed Aug 29 20:37:50 2012 UTC (11 years, 6 months ago) by drochner
Branch: MAIN
Changes since 1.76: +2 -13 lines
Diff to previous 1.76 (colored)

g/c unused struct member

Revision 1.74.2.1 / (download) - annotate - [select for diffs], Tue Apr 17 00:08:46 2012 UTC (11 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.74: +42 -44 lines
Diff to previous 1.74 (colored)

sync with head

Revision 1.74.6.1 / (download) - annotate - [select for diffs], Sat Feb 18 07:35:44 2012 UTC (12 years ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.74: +42 -44 lines
Diff to previous 1.74 (colored) next main 1.75 (colored)

merge to -current.

Revision 1.76 / (download) - annotate - [select for diffs], Mon Jan 9 15:42:08 2012 UTC (12 years, 1 month ago) by drochner
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, netbsd-6-base, netbsd-6-0-RC1, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3, jmcneill-usbmp-base2, jmcneill-usbmp-base10
Branch point for: netbsd-6, matt-nb6-plus
Changes since 1.75: +39 -3 lines
Diff to previous 1.75 (colored)

allow the ESP fragment length in the NAT-T case to be reported back
through the pfkey interface, kernel part of PR kern/44952
by Wolfgang Stukenbrock

Revision 1.75 / (download) - annotate - [select for diffs], Mon Dec 19 11:47:16 2011 UTC (12 years, 2 months ago) by drochner
Branch: MAIN
Changes since 1.74: +5 -43 lines
Diff to previous 1.74 (colored)

as in netkey/key.c, just use cprng_fast() to get a random number
(which is used to choose an SPI), kill the dummy seeding code

Revision 1.74 / (download) - annotate - [select for diffs], Sun Jul 17 20:54:54 2011 UTC (12 years, 7 months ago) by joerg
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base, jmcneill-audiomp3-base, jmcneill-audiomp3
Branch point for: yamt-pagecache, jmcneill-usbmp
Changes since 1.73: +2 -5 lines
Diff to previous 1.73 (colored)

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

Revision 1.71.2.1 / (download) - annotate - [select for diffs], Thu Jun 23 14:20:27 2011 UTC (12 years, 8 months ago) by cherry
Branch: cherry-xenmp
Changes since 1.71: +24 -42 lines
Diff to previous 1.71 (colored) next main 1.72 (colored)

Catchup with rmind-uvmplock merge.

Revision 1.63.4.3 / (download) - annotate - [select for diffs], Sun Jun 12 00:24:31 2011 UTC (12 years, 8 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.63.4.2: +22 -40 lines
Diff to previous 1.63.4.2 (colored) to branchpoint 1.63 (colored) next main 1.64 (colored)

sync with head

Revision 1.73 / (download) - annotate - [select for diffs], Thu Jun 9 19:54:18 2011 UTC (12 years, 8 months ago) by drochner
Branch: MAIN
CVS Tags: rmind-uvmplock-nbase, rmind-uvmplock-base
Changes since 1.72: +24 -24 lines
Diff to previous 1.72 (colored)

more "const"

Revision 1.72 / (download) - annotate - [select for diffs], Mon Jun 6 16:48:35 2011 UTC (12 years, 8 months ago) by drochner
Branch: MAIN
Changes since 1.71: +2 -20 lines
Diff to previous 1.71 (colored)

remove a limitation that inner and outer IP version must be equal
for an ESP tunnel, and add some fixes which make v4-in-v6 work
(v6 as inner protocol isn't ready, even v6-in-v6 can never have worked)

being here, fix a statistics counter and kill an unused variable

Revision 1.64.2.1 / (download) - annotate - [select for diffs], Mon Jun 6 09:10:01 2011 UTC (12 years, 8 months ago) by jruoho
Branch: jruoho-x86intr
Changes since 1.64: +126 -112 lines
Diff to previous 1.64 (colored) next main 1.65 (colored)

Sync with HEAD.

Revision 1.63.4.2 / (download) - annotate - [select for diffs], Tue May 31 03:05:09 2011 UTC (12 years, 9 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.63.4.1: +79 -65 lines
Diff to previous 1.63.4.1 (colored) to branchpoint 1.63 (colored)

sync with head

Revision 1.71 / (download) - annotate - [select for diffs], Mon May 23 15:17:25 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
CVS Tags: cherry-xenmp-base
Branch point for: cherry-xenmp
Changes since 1.70: +2 -20 lines
Diff to previous 1.70 (colored)

g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

Revision 1.70 / (download) - annotate - [select for diffs], Wed May 18 18:56:02 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
Changes since 1.69: +7 -3 lines
Diff to previous 1.69 (colored)

include the SHA2 hashs into the proposal which goes out with
SADB_ACQUIRE -- this doesn't change much because racoon ignores
the proposal from the kernel anyway and applies its own configuration,
but having MD5 and SHA1 in the list but SHA2 not looks strange

Revision 1.69 / (download) - annotate - [select for diffs], Wed May 18 18:36:15 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
Changes since 1.68: +27 -21 lines
Diff to previous 1.68 (colored)

use monotonic time rather than wall time for lifetime related timestamps,
to make key expiration robust against time changes

Revision 1.68 / (download) - annotate - [select for diffs], Tue May 17 18:57:02 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
Changes since 1.67: +20 -23 lines
Diff to previous 1.67 (colored)

cleanup some error handling to avoid memory leaks and doube frees,
from Wolfgang Stukenbrock per PR kern/44948, and part of kern/44952

Revision 1.67 / (download) - annotate - [select for diffs], Tue May 17 18:43:02 2011 UTC (12 years, 9 months ago) by drochner
Branch: MAIN
Changes since 1.66: +33 -8 lines
Diff to previous 1.66 (colored)

fix lookup of SAs for outgoing packets in the !prefered_oldsa case,
as done in KAME and FAST_IPSEC after NetBSD imported the code
(The default differs: KAME uses the oldest valid SA while FAST_IPSEC
in NetBSD uses the newest one. I'm not changing this -- there is a lack
of specification and behavior can be changed with the "oldsa" sysctl.)
For incoming packets it shouldn't matter but I made it look similar
just to avoid unnecessary differences.

Revision 1.63.4.1 / (download) - annotate - [select for diffs], Sat Mar 5 20:56:00 2011 UTC (12 years, 11 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.63: +194 -76 lines
Diff to previous 1.63 (colored)

sync with head

Revision 1.64.4.1 / (download) - annotate - [select for diffs], Sat Mar 5 15:10:48 2011 UTC (12 years, 11 months ago) by bouyer
Branch: bouyer-quota2
Changes since 1.64: +48 -48 lines
Diff to previous 1.64 (colored) next main 1.65 (colored)

Sync with HEAD

Revision 1.66 / (download) - annotate - [select for diffs], Mon Feb 21 22:28:18 2011 UTC (13 years ago) by drochner
Branch: MAIN
CVS Tags: bouyer-quota2-nbase
Changes since 1.65: +43 -43 lines
Diff to previous 1.65 (colored)

treat "struct secpolicyindex" and "struct secasindex" as "const" once
they are initialized -- during lifetime, no changes are expected
plus some constification of input to comparision functions etc
mostly required by the former

Revision 1.65 / (download) - annotate - [select for diffs], Fri Feb 18 20:40:58 2011 UTC (13 years ago) by drochner
Branch: MAIN
Changes since 1.64: +7 -7 lines
Diff to previous 1.64 (colored)

more "const"

Revision 1.63.2.1 / (download) - annotate - [select for diffs], Fri Oct 22 07:22:42 2010 UTC (13 years, 4 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.63: +148 -30 lines
Diff to previous 1.63 (colored) next main 1.64 (colored)

Sync with HEAD (-D20101022).

Revision 1.53.2.4 / (download) - annotate - [select for diffs], Sat Oct 9 03:32:39 2010 UTC (13 years, 4 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.53.2.3: +148 -30 lines
Diff to previous 1.53.2.3 (colored) to branchpoint 1.53 (colored) next main 1.54 (colored)

sync with head

Revision 1.64 / (download) - annotate - [select for diffs], Sun Sep 5 06:52:53 2010 UTC (13 years, 5 months ago) by spz
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, uebayasi-xip-base4, uebayasi-xip-base3, matt-mips64-premerge-20101231, jruoho-x86intr-base, bouyer-quota2-base
Branch point for: jruoho-x86intr, bouyer-quota2
Changes since 1.63: +148 -30 lines
Diff to previous 1.63 (colored)

fix two bugs in the PFKEY interface:

1) RFC2367 says in 2.3.3 Address Extension: "All non-address
   information in the sockaddrs, such as sin_zero for AF_INET sockaddrs,
   and sin6_flowinfo for AF_INET6 sockaddrs, MUST be zeroed out."
   the IPSEC_NAT_T code was expecting the port information it needs
   to be conveyed in the sockaddr instead of exclusively by
   SADB_X_EXT_NAT_T_SPORT and SADB_X_EXT_NAT_T_DPORT,
   and was not zeroing out the port information in the non-nat-traversal
   case.
   Since it was expecting the port information to reside in the sockaddr
   it could get away with (re)setting the ports after starting to use them.
   -> Set the natt ports before setting the SA mature.

2) RFC3947 has two Original Address fields, initiator and responder,
   so we need SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR and not just
   SADB_X_EXT_NAT_T_OA

The change has been created using vanhu's patch for FreeBSD as reference.

Note that establishing actual nat-t sessions has not yet been tested.

Likely fixes the following:
PR bin/41757
PR net/42592
PR net/42606

Revision 1.57.10.1 / (download) - annotate - [select for diffs], Wed Apr 21 00:28:23 2010 UTC (13 years, 10 months ago) by matt
Branch: matt-nb5-mips64
CVS Tags: matt-nb5-mips64-premerge-20101231, matt-nb5-mips64-k15
Changes since 1.57: +3 -3 lines
Diff to previous 1.57 (colored) next main 1.58 (colored)

sync to netbsd-5

Revision 1.53.2.3 / (download) - annotate - [select for diffs], Thu Mar 11 15:04:30 2010 UTC (13 years, 11 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.53.2.2: +3 -3 lines
Diff to previous 1.53.2.2 (colored) to branchpoint 1.53 (colored)

sync with head

Revision 1.57.4.1 / (download) - annotate - [select for diffs], Sun Feb 14 13:35:44 2010 UTC (14 years ago) by bouyer
Branch: netbsd-5
CVS Tags: netbsd-5-2-RELEASE, netbsd-5-2-RC1, netbsd-5-2-3-RELEASE, netbsd-5-2-2-RELEASE, netbsd-5-2-1-RELEASE, netbsd-5-2, netbsd-5-1-RELEASE, netbsd-5-1-RC4, netbsd-5-1-RC3, netbsd-5-1-RC2, netbsd-5-1-RC1, netbsd-5-1-5-RELEASE, netbsd-5-1-4-RELEASE, netbsd-5-1-3-RELEASE, netbsd-5-1-2-RELEASE, netbsd-5-1-1-RELEASE, netbsd-5-1, matt-nb5-pq3-base, matt-nb5-pq3
Changes since 1.57: +3 -3 lines
Diff to previous 1.57 (colored) next main 1.58 (colored)

Pull up following revision(s) (requested by hubertf in ticket #1290):
	sys/kern/kern_ksyms.c: revision 1.53
	sys/dev/pci/agp_via.c: revision 1.18
	sys/netipsec/key.c: revision 1.63
	sys/arch/x86/x86/x86_autoconf.c: revision 1.49
	sys/kern/init_main.c: revision 1.415
	sys/kern/cnmagic.c: revision 1.11
	sys/netipsec/ipsec.c: revision 1.47
	sys/arch/x86/x86/pmap.c: revision 1.100
	sys/netkey/key.c: revision 1.176
Replace more printfs with aprint_normal / aprint_verbose
Makes "boot -z" go mostly silent for me.

Revision 1.63 / (download) - annotate - [select for diffs], Sun Jan 31 00:43:38 2010 UTC (14 years, 1 month ago) by hubertf
Branch: MAIN
CVS Tags: yamt-nfs-mp-base9, yamt-nfs-mp-base10, uebayasi-xip-base2, uebayasi-xip-base1, uebayasi-xip-base
Branch point for: uebayasi-xip, rmind-uvmplock
Changes since 1.62: +3 -3 lines
Diff to previous 1.62 (colored)

Replace more printfs with aprint_normal / aprint_verbose
Makes "boot -z" go mostly silent for me.

Revision 1.58.2.1 / (download) - annotate - [select for diffs], Wed May 13 17:22:41 2009 UTC (14 years, 9 months ago) by jym
Branch: jym-xensuspend
Changes since 1.58: +13 -14 lines
Diff to previous 1.58 (colored) next main 1.59 (colored)

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

Revision 1.53.2.2 / (download) - annotate - [select for diffs], Mon May 4 08:14:19 2009 UTC (14 years, 9 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.53.2.1: +18 -17 lines
Diff to previous 1.53.2.1 (colored) to branchpoint 1.53 (colored)

sync with head.

Revision 1.57.2.2 / (download) - annotate - [select for diffs], Tue Apr 28 07:37:34 2009 UTC (14 years, 10 months ago) by skrll
Branch: nick-hppapmap
Changes since 1.57.2.1: +12 -12 lines
Diff to previous 1.57.2.1 (colored) to branchpoint 1.57 (colored) next main 1.58 (colored)

Sync with HEAD.

Revision 1.62 / (download) - annotate - [select for diffs], Wed Mar 18 15:14:32 2009 UTC (14 years, 11 months ago) by cegger
Branch: MAIN
CVS Tags: yamt-nfs-mp-base8, yamt-nfs-mp-base7, yamt-nfs-mp-base6, yamt-nfs-mp-base5, yamt-nfs-mp-base4, yamt-nfs-mp-base3, nick-hppapmap-base4, nick-hppapmap-base3, nick-hppapmap-base, matt-premerge-20091211, jymxensuspend-base, jym-xensuspend-nbase, jym-xensuspend-base
Changes since 1.61: +3 -3 lines
Diff to previous 1.61 (colored)

bcmp -> memcmp

Revision 1.61 / (download) - annotate - [select for diffs], Wed Mar 18 10:22:43 2009 UTC (14 years, 11 months ago) by cegger
Branch: MAIN
Changes since 1.60: +11 -11 lines
Diff to previous 1.60 (colored)

Ansify function definitions w/o arguments. Generated with sed.

Revision 1.57.2.1 / (download) - annotate - [select for diffs], Tue Mar 3 18:34:06 2009 UTC (15 years ago) by skrll
Branch: nick-hppapmap
Changes since 1.57: +2 -3 lines
Diff to previous 1.57 (colored)

Sync with HEAD.

Revision 1.60 / (download) - annotate - [select for diffs], Sat Feb 14 20:53:58 2009 UTC (15 years ago) by christos
Branch: MAIN
CVS Tags: nick-hppapmap-base2
Changes since 1.59: +2 -3 lines
Diff to previous 1.59 (colored)

remove 2038 comment.

Revision 1.59 / (download) - annotate - [select for diffs], Mon Feb 9 15:06:37 2009 UTC (15 years ago) by skd
Branch: MAIN
Changes since 1.58: +3 -3 lines
Diff to previous 1.58 (colored)

Back out my previous change.  The problem I'm chasgin is with the
initialization of ports in saidx's when IPSEC_NAT_T is defined but the
association connection is not using nat traversal.  Stay tuned.

Revision 1.58 / (download) - annotate - [select for diffs], Wed Jan 28 19:06:03 2009 UTC (15 years, 1 month ago) by skd
Branch: MAIN
Branch point for: jym-xensuspend
Changes since 1.57: +3 -3 lines
Diff to previous 1.57 (colored)

These comparison functions return 0 on match.  Fix sense of test.

Revision 1.56.2.1 / (download) - annotate - [select for diffs], Sun Oct 19 22:17:53 2008 UTC (15 years, 4 months ago) by haad
Branch: haad-dm
Changes since 1.56: +4 -4 lines
Diff to previous 1.56 (colored) next main 1.57 (colored)

Sync with HEAD.

Revision 1.51.12.3 / (download) - annotate - [select for diffs], Sun Sep 28 10:40:59 2008 UTC (15 years, 5 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.51.12.2: +2 -2 lines
Diff to previous 1.51.12.2 (colored) to branchpoint 1.51 (colored) next main 1.52 (colored)

Sync with HEAD.

Revision 1.55.2.1 / (download) - annotate - [select for diffs], Thu Sep 18 04:37:02 2008 UTC (15 years, 5 months ago) by wrstuden
Branch: wrstuden-revivesa
Changes since 1.55: +8 -6 lines
Diff to previous 1.55 (colored) next main 1.56 (colored)

Sync with wrstuden-revivesa-base-2.

Revision 1.55.4.2 / (download) - annotate - [select for diffs], Mon Jul 28 14:37:36 2008 UTC (15 years, 7 months ago) by simonb
Branch: simonb-wapbl
Changes since 1.55.4.1: +4 -4 lines
Diff to previous 1.55.4.1 (colored) to branchpoint 1.55 (colored) next main 1.56 (colored)

Sync with head.

Revision 1.57 / (download) - annotate - [select for diffs], Fri Jul 25 20:55:43 2008 UTC (15 years, 7 months ago) by dsl
Branch: MAIN
CVS Tags: wrstuden-revivesa-base-4, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, simonb-wapbl-nbase, simonb-wapbl-base, netbsd-5-base, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, mjf-devfs2-base, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20091211, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, haad-nbase2, haad-dm-base2, haad-dm-base1, haad-dm-base, ad-audiomp2-base, ad-audiomp2
Branch point for: nick-hppapmap, netbsd-5, matt-nb5-mips64
Changes since 1.56: +4 -4 lines
Diff to previous 1.56 (colored)

Comment out the 'do' and 'while (0)' from KEY_CHKSASTATE().
The expansion contains a 'continue' which is expected to continue
a loop in the callling code, not just abort the #define.

Revision 1.55.4.1 / (download) - annotate - [select for diffs], Thu Jul 3 18:38:20 2008 UTC (15 years, 7 months ago) by simonb
Branch: simonb-wapbl
Changes since 1.55: +6 -4 lines
Diff to previous 1.55 (colored)

Sync with head.

Revision 1.51.12.2 / (download) - annotate - [select for diffs], Wed Jul 2 19:08:20 2008 UTC (15 years, 8 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.51.12.1: +4 -2 lines
Diff to previous 1.51.12.1 (colored) to branchpoint 1.51 (colored)

Sync with HEAD.

Revision 1.56 / (download) - annotate - [select for diffs], Tue Jul 1 20:18:45 2008 UTC (15 years, 8 months ago) by mlelstv
Branch: MAIN
Branch point for: haad-dm
Changes since 1.55: +6 -4 lines
Diff to previous 1.55 (colored)

Ignore freed rtcache entries.

Revision 1.30.2.1.2.2 / (download) - annotate - [select for diffs], Tue Jun 3 20:47:42 2008 UTC (15 years, 8 months ago) by skrll
Branch: wrstuden-fixsa
Changes since 1.30.2.1.2.1: +9 -3 lines
Diff to previous 1.30.2.1.2.1 (colored) next main 1.30.2.2 (colored)

Sync with netbsd-4.

Revision 1.51.12.1 / (download) - annotate - [select for diffs], Mon Jun 2 13:24:28 2008 UTC (15 years, 9 months ago) by mjf
Branch: mjf-devfs2
Changes since 1.51: +75 -32 lines
Diff to previous 1.51 (colored)

Sync with HEAD.

Revision 1.51.14.1 / (download) - annotate - [select for diffs], Sun May 18 12:35:40 2008 UTC (15 years, 9 months ago) by yamt
Branch: yamt-pf42
Changes since 1.51: +75 -32 lines
Diff to previous 1.51 (colored) next main 1.52 (colored)

sync with head.

Revision 1.53.2.1 / (download) - annotate - [select for diffs], Fri May 16 02:25:45 2008 UTC (15 years, 9 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.53: +10 -9 lines
Diff to previous 1.53 (colored)

sync with head.

Revision 1.30.2.3 / (download) - annotate - [select for diffs], Sun May 11 06:10:19 2008 UTC (15 years, 9 months ago) by jdc
Branch: netbsd-4
CVS Tags: wrstuden-fixsa-newbase, wrstuden-fixsa-base
Changes since 1.30.2.2: +9 -3 lines
Diff to previous 1.30.2.2 (colored) to branchpoint 1.30 (colored) next main 1.31 (colored)

Pull up revision 1.54 (requested by degroote in ticket #1137).

In key_do_allocsa_policy, fix a bad usage of key_setsadbmsg. The third argument
is an SADB_SATYPE_*, not an IPPROTO_* .

Fix PR/38405. Thanks for the report

Revision 1.55 / (download) - annotate - [select for diffs], Sun May 4 07:22:15 2008 UTC (15 years, 9 months ago) by thorpej
Branch: MAIN
CVS Tags: yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-nfs-mp-base2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, hpcarm-cleanup-nbase
Branch point for: wrstuden-revivesa, simonb-wapbl
Changes since 1.54: +3 -8 lines
Diff to previous 1.54 (colored)

Simplify the interface to netstat_sysctl() and allocate space for
the collated counters using kmem_alloc().

PR kern/38577

Revision 1.54 / (download) - annotate - [select for diffs], Sat May 3 21:53:23 2008 UTC (15 years, 10 months ago) by degroote
Branch: MAIN
Changes since 1.53: +9 -3 lines
Diff to previous 1.53 (colored)

In key_do_allocsa_policy, fix a bad usage of key_setsadbmsg. The third argument
is an SADB_SATYPE_*, not an IPPROTO_* .

Fix PR/38405. Thanks for the report

Revision 1.53 / (download) - annotate - [select for diffs], Thu Apr 24 11:38:38 2008 UTC (15 years, 10 months ago) by ad
Branch: MAIN
CVS Tags: yamt-nfs-mp-base
Branch point for: yamt-nfs-mp
Changes since 1.52: +5 -3 lines
Diff to previous 1.52 (colored)

Merge the socket locking patch:

- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.

Revision 1.52 / (download) - annotate - [select for diffs], Wed Apr 23 07:29:47 2008 UTC (15 years, 10 months ago) by thorpej
Branch: MAIN
Changes since 1.51: +70 -30 lines
Diff to previous 1.51 (colored)

PF_KEY stats for IPSEC and FAST_IPSEC are now per-CPU.

Revision 1.25.2.5 / (download) - annotate - [select for diffs], Mon Jan 21 09:47:27 2008 UTC (16 years, 1 month ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.25.2.4: +4 -4 lines
Diff to previous 1.25.2.4 (colored) to branchpoint 1.25 (colored) next main 1.26 (colored)

sync with head

Revision 1.50.8.1 / (download) - annotate - [select for diffs], Wed Jan 9 01:57:42 2008 UTC (16 years, 1 month ago) by matt
Branch: matt-armv6
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored) next main 1.51 (colored)

sync with HEAD

Revision 1.50.6.1 / (download) - annotate - [select for diffs], Sun Dec 9 19:38:39 2007 UTC (16 years, 2 months ago) by jmcneill
Branch: jmcneill-pm
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored) next main 1.51 (colored)

Sync with HEAD.

Revision 1.42.6.2 / (download) - annotate - [select for diffs], Sun Dec 9 16:04:07 2007 UTC (16 years, 2 months ago) by reinoud
Branch: reinoud-bufcleanup
Changes since 1.42.6.1: +4 -4 lines
Diff to previous 1.42.6.1 (colored) next main 1.43 (colored)

Pullup to HEAD

Revision 1.50.14.1 / (download) - annotate - [select for diffs], Sat Dec 8 18:21:18 2007 UTC (16 years, 2 months ago) by mjf
Branch: mjf-devfs
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored) next main 1.51 (colored)

Sync with HEAD.

Revision 1.50.16.1 / (download) - annotate - [select for diffs], Sat Dec 8 17:57:59 2007 UTC (16 years, 2 months ago) by ad
Branch: vmlocking2
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored) next main 1.51 (colored)

Sync with head.

Revision 1.51 / (download) - annotate - [select for diffs], Fri Dec 7 19:44:38 2007 UTC (16 years, 2 months ago) by elad
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base, yamt-lazymbuf-base15, yamt-lazymbuf-base14, yamt-kmem-base3, yamt-kmem-base2, yamt-kmem-base, yamt-kmem, vmlocking2-base3, vmlocking2-base2, reinoud-bufcleanup-nbase, nick-net80211-sync-base, nick-net80211-sync, mjf-devfs-base, matt-armv6-nbase, matt-armv6-base, keiichi-mipv6-nbase, keiichi-mipv6-base, keiichi-mipv6, jmcneill-pm-base, hpcarm-cleanup-base, cube-autoconf-base, cube-autoconf, bouyer-xeni386-nbase, bouyer-xeni386-merge1, bouyer-xeni386-base, bouyer-xeni386, ad-socklock-base1
Branch point for: yamt-pf42, mjf-devfs2
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored)

Let this code compile.

Hi, liamjfoy@. :)

Revision 1.25.2.4 / (download) - annotate - [select for diffs], Mon Sep 3 14:43:45 2007 UTC (16 years, 5 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.25.2.3: +745 -492 lines
Diff to previous 1.25.2.3 (colored) to branchpoint 1.25 (colored)

sync with head.

Revision 1.42.2.4 / (download) - annotate - [select for diffs], Sun Jul 15 13:28:02 2007 UTC (16 years, 7 months ago) by ad
Branch: vmlocking
Changes since 1.42.2.3: +699 -456 lines
Diff to previous 1.42.2.3 (colored) next main 1.43 (colored)

Sync with head.

Revision 1.42.4.1 / (download) - annotate - [select for diffs], Wed Jul 11 20:11:53 2007 UTC (16 years, 7 months ago) by mjf
Branch: mjf-ufs-trans
Changes since 1.42: +711 -461 lines
Diff to previous 1.42 (colored) next main 1.43 (colored)

Sync with head.

Revision 1.50 / (download) - annotate - [select for diffs], Mon Jul 9 21:11:13 2007 UTC (16 years, 7 months ago) by ad
Branch: MAIN
CVS Tags: yamt-x86pmap-base4, yamt-x86pmap-base3, yamt-x86pmap-base2, yamt-x86pmap-base, yamt-x86pmap, vmlocking2-base1, vmlocking-nbase, vmlocking-base, reinoud-bufcleanup-base, nick-csl-alignment-base5, nick-csl-alignment-base, nick-csl-alignment, mjf-ufs-trans-base, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, jmcneill-base, hpcarm-cleanup, bouyer-xenamd64-base2, bouyer-xenamd64-base, bouyer-xenamd64
Branch point for: vmlocking2, mjf-devfs, matt-armv6, jmcneill-pm
Changes since 1.49: +3 -3 lines
Diff to previous 1.49 (colored)

Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Revision 1.49 / (download) - annotate - [select for diffs], Sat Jul 7 18:38:22 2007 UTC (16 years, 7 months ago) by degroote
Branch: MAIN
Changes since 1.48: +294 -433 lines
Diff to previous 1.48 (colored)

Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Revision 1.42.2.3 / (download) - annotate - [select for diffs], Sun Jul 1 21:50:55 2007 UTC (16 years, 8 months ago) by ad
Branch: vmlocking
Changes since 1.42.2.2: +3 -3 lines
Diff to previous 1.42.2.2 (colored)

Adapt to callout API change.

Revision 1.48 / (download) - annotate - [select for diffs], Wed Jun 27 20:38:33 2007 UTC (16 years, 8 months ago) by degroote
Branch: MAIN
Changes since 1.47: +446 -64 lines
Diff to previous 1.47 (colored)

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

Revision 1.42.2.2 / (download) - annotate - [select for diffs], Fri Jun 8 14:18:00 2007 UTC (16 years, 8 months ago) by ad
Branch: vmlocking
Changes since 1.42.2.1: +10 -4 lines
Diff to previous 1.42.2.1 (colored)

Sync with head.

Revision 1.30.2.1.2.1 / (download) - annotate - [select for diffs], Mon Jun 4 01:54:28 2007 UTC (16 years, 9 months ago) by wrstuden
Branch: wrstuden-fixsa
Changes since 1.30.2.1: +38 -29 lines
Diff to previous 1.30.2.1 (colored)

Update to today's netbsd-4.

Revision 1.30.2.2 / (download) - annotate - [select for diffs], Thu May 24 19:13:12 2007 UTC (16 years, 9 months ago) by pavel
Branch: netbsd-4
CVS Tags: wrstuden-fixsa-base-1, netbsd-4-0-RELEASE, netbsd-4-0-RC5, netbsd-4-0-RC4, netbsd-4-0-RC3, netbsd-4-0-RC2, netbsd-4-0-RC1, netbsd-4-0-1-RELEASE, netbsd-4-0, matt-nb4-arm-base, matt-nb4-arm
Changes since 1.30.2.1: +38 -29 lines
Diff to previous 1.30.2.1 (colored) to branchpoint 1.30 (colored)

Pull up following revision(s) (requested by degroote in ticket #667):
	sys/netinet/tcp_input.c: revision 1.260
	sys/netinet/tcp_output.c: revision 1.154
	sys/netinet/tcp_subr.c: revision 1.210
	sys/netinet6/icmp6.c: revision 1.129
	sys/netinet6/in6_proto.c: revision 1.70
	sys/netinet6/ip6_forward.c: revision 1.54
	sys/netinet6/ip6_input.c: revision 1.94
	sys/netinet6/ip6_output.c: revision 1.114
	sys/netinet6/raw_ip6.c: revision 1.81
	sys/netipsec/ipcomp_var.h: revision 1.4
	sys/netipsec/ipsec.c: revision 1.26 via patch,1.31-1.32
	sys/netipsec/ipsec6.h: revision 1.5
	sys/netipsec/ipsec_input.c: revision 1.14
	sys/netipsec/ipsec_netbsd.c: revision 1.18,1.26
	sys/netipsec/ipsec_output.c: revision 1.21 via patch
	sys/netipsec/key.c: revision 1.33,1.44
	sys/netipsec/xform_ipcomp.c: revision 1.9
	sys/netipsec/xform_ipip.c: revision 1.15
	sys/opencrypto/deflate.c: revision 1.8
Commit my SoC work
Add ipv6 support for fast_ipsec
Note that currently, packet with extensions headers are not correctly
supported
Change the ipcomp logic

Add sysctl tree to modify the fast_ipsec options related to ipv6. Similar
to the sysctl kame interface.

Choose the good default policy, depending of the adress family of the
desired policy

Increase the refcount for the default ipv6 policy so nobody can reclaim it

Always compute the sp index even if we don't have any sp in spd. It will
let us to choose the right default policy (based on the adress family
requested).
While here, fix an error message

Use dynamic array instead of an static array to decompress. It lets us to
decompress any data, whatever is the radio decompressed data / compressed
data.
It fixes the last issues with fast_ipsec and ipcomp.
While here, bzero -> memset, bcopy -> memcpy, FREE -> free
Reviewed a long time ago by sam@

Revision 1.35.2.5 / (download) - annotate - [select for diffs], Thu May 17 13:41:53 2007 UTC (16 years, 9 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.35.2.4: +7 -2 lines
Diff to previous 1.35.2.4 (colored) next main 1.36 (colored)

sync with head.

Revision 1.30.2.1 / (download) - annotate - [select for diffs], Sat May 12 19:24:48 2007 UTC (16 years, 9 months ago) by pavel
Branch: netbsd-4
Branch point for: wrstuden-fixsa
Changes since 1.30: +8 -6 lines
Diff to previous 1.30 (colored)

Pull up following revision(s) (requested by degroote in ticket #630):
	sys/netipsec/key.c: revision 1.43-1.46
	sys/netinet6/ipsec.c: revision 1.116
	sys/netipsec/ipsec.c: revision 1.29 via patch
	sys/netkey/key.c: revision 1.154-1.155
Call key_checkspidup with spi in network bit order in order to make
comparaison with spi stored into the sadb.
Reported by Karl Knutsson in kern/36038 .

Make an exact match when we are looking for a cached sp for an unconnected
socket. If we don't make an exact match, we may use a cached rule which
has lower priority than a rule that would otherwise have matched the
packet.
Code submitted by Karl Knutsson in PR/36051

Fix a memleak in key_spdget.
Problem was reported by Karl Knutsson by pr/36119.

In spddelete2, if we can't find the sp by this id, return after sending an
error message, don't process the following code with the NULL sp.
Spotted by Matthew Grooms on freebsd-net ML

When we construct an answer for SADB_X_SPDGET, don't use an hardcoded 0 for seq but
the seq used by the request. It will improve consistency with the answer of SADB_GET
request and helps some applications which relies both on seq and pid.
Reported by  Karl Knutsson by pr/36119.

Revision 1.47 / (download) - annotate - [select for diffs], Tue May 8 14:03:05 2007 UTC (16 years, 9 months ago) by degroote
Branch: MAIN
CVS Tags: yamt-idlelwp-base8
Changes since 1.46: +7 -2 lines
Diff to previous 1.46 (colored)

Increase the refcount for the default ipv6 policy so nobody can reclaim it

Revision 1.35.2.4 / (download) - annotate - [select for diffs], Sun Apr 15 16:04:02 2007 UTC (16 years, 10 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.35.2.3: +6 -4 lines
Diff to previous 1.35.2.3 (colored)

sync with head.

Revision 1.46 / (download) - annotate - [select for diffs], Wed Apr 11 21:33:41 2007 UTC (16 years, 10 months ago) by degroote
Branch: MAIN
CVS Tags: thorpej-atomic-base, thorpej-atomic
Changes since 1.45: +4 -3 lines
Diff to previous 1.45 (colored)

When we construct an answer for SADB_X_SPDGET, don't use an hardcoded 0 for seq but
the seq used by the request. It will improve consistency with the answer of SADB_GET
request and helps some applications which relies both on seq and pid.

Reported by  Karl Knutsson by pr/36119.

Revision 1.45 / (download) - annotate - [select for diffs], Wed Apr 11 21:19:35 2007 UTC (16 years, 10 months ago) by degroote
Branch: MAIN
Changes since 1.44: +3 -3 lines
Diff to previous 1.44 (colored)

In spddelete2, if we can't find the sp by this id, return after sending an error message,
don't process the following code with the NULL sp.

Spotted by Matthew Grooms on freebsd-net ML

Revision 1.42.2.1 / (download) - annotate - [select for diffs], Tue Apr 10 13:26:52 2007 UTC (16 years, 10 months ago) by ad
Branch: vmlocking
Changes since 1.42: +5 -4 lines
Diff to previous 1.42 (colored)

Sync with head.

Revision 1.44 / (download) - annotate - [select for diffs], Mon Apr 9 21:07:03 2007 UTC (16 years, 10 months ago) by degroote
Branch: MAIN
Changes since 1.43: +3 -2 lines
Diff to previous 1.43 (colored)

Fix a memleak in key_spdget.

Problem was reported by Karl Knutsson by pr/36119.

Revision 1.42.6.1 / (download) - annotate - [select for diffs], Thu Mar 29 19:28:01 2007 UTC (16 years, 11 months ago) by reinoud
Branch: reinoud-bufcleanup
Changes since 1.42: +4 -4 lines
Diff to previous 1.42 (colored)

Pullup to -current

Revision 1.35.2.3 / (download) - annotate - [select for diffs], Sat Mar 24 14:56:13 2007 UTC (16 years, 11 months ago) by yamt
Branch: yamt-idlelwp
Changes since 1.35.2.2: +4 -4 lines
Diff to previous 1.35.2.2 (colored)

sync with head.

Revision 1.43 / (download) - annotate - [select for diffs], Wed Mar 21 22:38:34 2007 UTC (16 years, 11 months ago) by degroote
Branch: MAIN
Changes since 1.42: +4 -4 lines
Diff to previous 1.42 (colored)

Call key_checkspidup with spi in network bit order in order to make correct
comparaison with spi stored into the sadb.

Reported by Karl Knutsson in kern/36038 .

Revision 1.35.2.2 / (download) - annotate - [select for diffs], Mon Mar 12 06:00:09 2007 UTC (16 years, 11 months ago) by rmind
Branch: yamt-idlelwp
Changes since 1.35.2.1: +46 -43 lines
Diff to previous 1.35.2.1 (colored)

Sync with HEAD.

Revision 1.42 / (download) - annotate - [select for diffs], Fri Mar 9 00:40:39 2007 UTC (16 years, 11 months ago) by liamjfoy
Branch: MAIN
Branch point for: vmlocking, reinoud-bufcleanup, mjf-ufs-trans
Changes since 1.41: +5 -3 lines
Diff to previous 1.41 (colored)

Allow to build without INET6

Submitted by: Jukka Salmi

Revision 1.41 / (download) - annotate - [select for diffs], Wed Mar 7 22:21:45 2007 UTC (16 years, 11 months ago) by liamjfoy
Branch: MAIN
Changes since 1.40: +3 -2 lines
Diff to previous 1.40 (colored)

Add IPv6 Fast Forward:

Add call to ip6flow_invalidate_all()

ok christos, matt, dyoung and joerg

Revision 1.40 / (download) - annotate - [select for diffs], Sun Mar 4 21:17:55 2007 UTC (17 years ago) by degroote
Branch: MAIN
Changes since 1.39: +9 -9 lines
Diff to previous 1.39 (colored)

Remove useless cast
Use NULL instead of (void*) 0

Revision 1.39 / (download) - annotate - [select for diffs], Sun Mar 4 19:54:49 2007 UTC (17 years ago) by degroote
Branch: MAIN
Changes since 1.38: +21 -21 lines
Diff to previous 1.38 (colored)

Fix fallout from caddr_t changes

Revision 1.38 / (download) - annotate - [select for diffs], Sun Mar 4 06:03:29 2007 UTC (17 years ago) by christos
Branch: MAIN
Changes since 1.37: +40 -40 lines
Diff to previous 1.37 (colored)

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Revision 1.35.2.1 / (download) - annotate - [select for diffs], Tue Feb 27 16:55:06 2007 UTC (17 years ago) by yamt
Branch: yamt-idlelwp
Changes since 1.35: +5 -5 lines
Diff to previous 1.35 (colored)

- sync with head.
- move sched_changepri back to kern_synch.c as it doesn't know PPQ anymore.

Revision 1.25.2.3 / (download) - annotate - [select for diffs], Mon Feb 26 09:11:57 2007 UTC (17 years ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.25.2.2: +48 -42 lines
Diff to previous 1.25.2.2 (colored) to branchpoint 1.25 (colored)

sync with head.

Revision 1.37 / (download) - annotate - [select for diffs], Sun Feb 18 13:55:25 2007 UTC (17 years ago) by degroote
Branch: MAIN
CVS Tags: ad-audiomp-base, ad-audiomp
Changes since 1.36: +3 -3 lines
Diff to previous 1.36 (colored)

Constify the code following the dyoung change ( the "bug" was hidden by the
extern declaration ).
While here, remove a Kame ifdef which is useless in netipsec code

Revision 1.36 / (download) - annotate - [select for diffs], Sat Feb 17 22:34:16 2007 UTC (17 years ago) by dyoung
Branch: MAIN
Changes since 1.35: +4 -4 lines
Diff to previous 1.35 (colored)

KNF: de-__P, bzero -> memset, bcmp -> memcmp.  Remove extraneous
   parentheses in return statements.

Cosmetic: don't open-code TAILQ_FOREACH().

Cosmetic: change types of variables to avoid oodles of casts: in
   in6_src.c, avoid casts by changing several route_in6 pointers
   to struct route pointers.  Remove unnecessary casts to caddr_t
   elsewhere.

Pave the way for eliminating address family-specific route caches:
   soon, struct route will not embed a sockaddr, but it will hold
   a reference to an external sockaddr, instead.  We will set the
   destination sockaddr using rtcache_setdst().  (I created a stub
   for it, but it isn't used anywhere, yet.)  rtcache_free() will
   free the sockaddr.  I have extracted from rtcache_free() a helper
   subroutine, rtcache_clear().  rtcache_clear() will "forget" a
   cached route, but it will not forget the destination by releasing
   the sockaddr.  I use rtcache_clear() instead of rtcache_free()
   in rtcache_update(), because rtcache_update() is not supposed
   to forget the destination.

Constify:

   1 Introduce const accessor for route->ro_dst, rtcache_getdst().

   2 Constify the 'dst' argument to ifnet->if_output().  This
     led me to constify a lot of code called by output routines.

   3 Constify the sockaddr argument to protosw->pr_ctlinput.  This
     led me to constify a lot of code called by ctlinput routines.

   4 Introduce const macros for converting from a generic sockaddr
     to family-specific sockaddrs, e.g., sockaddr_in: satocsin6,
     satocsin, et cetera.

Revision 1.35 / (download) - annotate - [select for diffs], Sun Feb 11 13:35:00 2007 UTC (17 years ago) by degroote
Branch: MAIN
Branch point for: yamt-idlelwp
Changes since 1.34: +3 -2 lines
Diff to previous 1.34 (colored)

fixed a unexpected addr/port matching failure in SA management
From cvs rev 1.127 of netkey/key.c

Revision 1.34 / (download) - annotate - [select for diffs], Sun Feb 11 13:32:18 2007 UTC (17 years ago) by degroote
Branch: MAIN
Changes since 1.33: +13 -12 lines
Diff to previous 1.33 (colored)

reqid (for unique policy) is u_int16_t quantity.
from rev 1.125 of netkey/key.c

Revision 1.33 / (download) - annotate - [select for diffs], Sat Feb 10 09:43:05 2007 UTC (17 years ago) by degroote
Branch: MAIN
Changes since 1.32: +33 -29 lines
Diff to previous 1.32 (colored)

Commit my SoC work
Add ipv6 support for fast_ipsec
Note that currently, packet with extensions headers are not correctly
supported
Change the ipcomp logic

Revision 1.28.4.2 / (download) - annotate - [select for diffs], Fri Jan 12 01:04:19 2007 UTC (17 years, 1 month ago) by ad
Branch: newlock2
Changes since 1.28.4.1: +6 -11 lines
Diff to previous 1.28.4.1 (colored) to branchpoint 1.28 (colored) next main 1.29 (colored)

Sync with head.

Revision 1.25.2.2 / (download) - annotate - [select for diffs], Sat Dec 30 20:50:44 2006 UTC (17 years, 2 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.25.2.1: +20 -21 lines
Diff to previous 1.25.2.1 (colored) to branchpoint 1.25 (colored)

sync with head.

Revision 1.28.6.3 / (download) - annotate - [select for diffs], Mon Dec 18 11:42:23 2006 UTC (17 years, 2 months ago) by yamt
Branch: yamt-splraiseipl
Changes since 1.28.6.2: +6 -7 lines
Diff to previous 1.28.6.2 (colored) to branchpoint 1.28 (colored) next main 1.29 (colored)

sync with head.

Revision 1.32 / (download) - annotate - [select for diffs], Fri Dec 15 21:18:56 2006 UTC (17 years, 2 months ago) by joerg
Branch: MAIN
CVS Tags: yamt-splraiseipl-base5, yamt-splraiseipl-base4, post-newlock2-merge, newlock2-nbase, newlock2-base
Changes since 1.31: +6 -7 lines
Diff to previous 1.31 (colored)

Introduce new helper functions to abstract the route caching.
rtcache_init and rtcache_init_noclone lookup ro_dst and store
the result in ro_rt, taking care of the reference counting and
calling the domain specific route cache.
rtcache_free checks if a route was cashed and frees the reference.
rtcache_copy copies ro_dst of the given struct route, checking that
enough space is available and incrementing the reference count of the
cached rtentry if necessary.
rtcache_check validates that the cached route is still up. If it isn't,
it tries to look it up again. Afterwards ro_rt is either a valid again
or NULL.
rtcache_copy is used internally.

Adjust to callers of rtalloc/rtflush in the tree to check the sanity of
ro_dst first (if necessary). If it doesn't fit the expectations, free
the cache, otherwise check if the cached route is still valid. After
that combination, a single check for ro_rt == NULL is enough to decide
whether a new lookup needs to be done with a different ro_dst.
Make the route checking in gre stricter by repeating the loop check
after revalidation.
Remove some unused RADIX_MPATH code in in6_src.c. The logic is slightly
changed here to first validate the route and check RTF_GATEWAY
afterwards. This is sementically equivalent though.
etherip doesn't need sc_route_expire similiar to the gif changes from
dyoung@ earlier.

Based on the earlier patch from dyoung@, reviewed and discussed with
him.

Revision 1.28.6.2 / (download) - annotate - [select for diffs], Sun Dec 10 07:19:19 2006 UTC (17 years, 2 months ago) by yamt
Branch: yamt-splraiseipl
Changes since 1.28.6.1: +12 -16 lines
Diff to previous 1.28.6.1 (colored) to branchpoint 1.28 (colored)

sync with head.

Revision 1.31 / (download) - annotate - [select for diffs], Sat Dec 9 05:33:09 2006 UTC (17 years, 2 months ago) by dyoung
Branch: MAIN
CVS Tags: yamt-splraiseipl-base3
Changes since 1.30: +7 -11 lines
Diff to previous 1.30 (colored)

Here are various changes designed to protect against bad IPv4
routing caused by stale route caches (struct route).  Route caches
are sprinkled throughout PCBs, the IP fast-forwarding table, and
IP tunnel interfaces (gre, gif, stf).

Stale IPv6 and ISO route caches will be treated by separate patches.

Thank you to Christoph Badura for suggesting the general approach
to invalidating route caches that I take here.

Here are the details:

Add hooks to struct domain for tracking and for invalidating each
domain's route caches: dom_rtcache, dom_rtflush, and dom_rtflushall.

Introduce helper subroutines, rtflush(ro) for invalidating a route
cache, rtflushall(family) for invalidating all route caches in a
routing domain, and rtcache(ro) for notifying the domain of a new
cached route.

Chain together all IPv4 route caches where ro_rt != NULL.  Provide
in_rtcache() for adding a route to the chain.  Provide in_rtflush()
and in_rtflushall() for invalidating IPv4 route caches.  In
in_rtflush(), set ro_rt to NULL, and remove the route from the
chain.  In in_rtflushall(), walk the chain and remove every route
cache.

In rtrequest1(), call rtflushall() to invalidate route caches when
a route is added.

In gif(4), discard the workaround for stale caches that involves
expiring them every so often.

Replace the pattern 'RTFREE(ro->ro_rt); ro->ro_rt = NULL;' with a
call to rtflush(ro).

Update ipflow_fastforward() and all other users of route caches so
that they expect a cached route, ro->ro_rt, to turn to NULL.

Take care when moving a 'struct route' to rtflush() the source and
to rtcache() the destination.

In domain initializers, use .dom_xxx tags.

KNF here and there.

Revision 1.28.4.1 / (download) - annotate - [select for diffs], Sat Nov 18 21:39:41 2006 UTC (17 years, 3 months ago) by ad
Branch: newlock2
Changes since 1.28: +14 -10 lines
Diff to previous 1.28 (colored)

Sync with head.

Revision 1.30 / (download) - annotate - [select for diffs], Thu Nov 16 01:33:49 2006 UTC (17 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: netbsd-4-base
Branch point for: netbsd-4
Changes since 1.29: +7 -7 lines
Diff to previous 1.29 (colored)

__unused removal on arguments; approved by core.

Revision 1.28.6.1 / (download) - annotate - [select for diffs], Sun Oct 22 06:07:38 2006 UTC (17 years, 4 months ago) by yamt
Branch: yamt-splraiseipl
Changes since 1.28: +16 -12 lines
Diff to previous 1.28 (colored)

sync with head

Revision 1.29 / (download) - annotate - [select for diffs], Fri Oct 13 20:53:59 2006 UTC (17 years, 4 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base2
Changes since 1.28: +16 -12 lines
Diff to previous 1.28 (colored)

more __unused

Revision 1.27.4.1 / (download) - annotate - [select for diffs], Sat Sep 9 02:59:08 2006 UTC (17 years, 5 months ago) by rpaulo
Branch: rpaulo-netinet-merge-pcb
Changes since 1.27: +4 -4 lines
Diff to previous 1.27 (colored) next main 1.28 (colored)

sync with head

Revision 1.27.8.1 / (download) - annotate - [select for diffs], Fri Aug 11 15:46:49 2006 UTC (17 years, 6 months ago) by yamt
Branch: yamt-pdpolicy
Changes since 1.27: +4 -4 lines
Diff to previous 1.27 (colored) next main 1.28 (colored)

sync with head

Revision 1.28 / (download) - annotate - [select for diffs], Sun Jul 23 22:06:13 2006 UTC (17 years, 7 months ago) by ad
Branch: MAIN
CVS Tags: yamt-splraiseipl-base, yamt-pdpolicy-base9, yamt-pdpolicy-base8, yamt-pdpolicy-base7, rpaulo-netinet-merge-pcb-base, abandoned-netbsd-4-base, abandoned-netbsd-4
Branch point for: yamt-splraiseipl, newlock2
Changes since 1.27: +4 -4 lines
Diff to previous 1.27 (colored)

Use the LWP cached credentials where sane.

Revision 1.25.2.1 / (download) - annotate - [select for diffs], Wed Jun 21 15:11:24 2006 UTC (17 years, 8 months ago) by yamt
Branch: yamt-lazymbuf
Changes since 1.25: +4 -4 lines
Diff to previous 1.25 (colored)

sync with head.

Revision 1.27 / (download) - annotate - [select for diffs], Sat Dec 24 20:45:09 2005 UTC (18 years, 2 months ago) by perry
Branch: MAIN
CVS Tags: yamt-uio_vmspace-base5, yamt-uio_vmspace, yamt-pdpolicy-base6, yamt-pdpolicy-base5, yamt-pdpolicy-base4, yamt-pdpolicy-base3, yamt-pdpolicy-base2, yamt-pdpolicy-base, simonb-timecounters-base, simonb-timecounters, simonb-timcounters-final, peter-altq-base, peter-altq, gdamore-uart-base, gdamore-uart, elad-kernelauth-base, elad-kernelauth, chap-midi-nbase, chap-midi-base, chap-midi
Branch point for: yamt-pdpolicy, rpaulo-netinet-merge-pcb
Changes since 1.26: +4 -4 lines
Diff to previous 1.26 (colored)

Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Dec 11 12:25:05 2005 UTC (18 years, 2 months ago) by christos
Branch: MAIN
Changes since 1.25: +2 -2 lines
Diff to previous 1.25 (colored)

merge ktrace-lwp.

Revision 1.20.2.7 / (download) - annotate - [select for diffs], Thu Nov 10 14:11:35 2005 UTC (18 years, 3 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.6: +62 -62 lines
Diff to previous 1.20.2.6 (colored) to branchpoint 1.20 (colored) next main 1.21 (colored)

Sync with HEAD. Here we go again...

Revision 1.25 / (download) - annotate - [select for diffs], Fri Jun 10 13:22:42 2005 UTC (18 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: yamt-vop-base3, yamt-vop-base2, yamt-vop-base, yamt-vop, yamt-readahead-pervnode, yamt-readahead-perfile, yamt-readahead-base3, yamt-readahead-base2, yamt-readahead-base, yamt-readahead, thorpej-vnode-attr-base, thorpej-vnode-attr, ktrace-lwp-base
Branch point for: yamt-lazymbuf
Changes since 1.24: +24 -24 lines
Diff to previous 1.24 (colored)

constify and unshadow.

Revision 1.24 / (download) - annotate - [select for diffs], Sun May 8 18:44:40 2005 UTC (18 years, 9 months ago) by christos
Branch: MAIN
Changes since 1.23: +40 -40 lines
Diff to previous 1.23 (colored)

Panic strings should not end with \n.

Revision 1.20.6.1 / (download) - annotate - [select for diffs], Fri Apr 29 11:29:34 2005 UTC (18 years, 10 months ago) by kent
Branch: kent-audio2
Changes since 1.20: +22 -11 lines
Diff to previous 1.20 (colored) next main 1.21 (colored)

sync with -current

Revision 1.20.8.2 / (download) - annotate - [select for diffs], Sat Mar 19 08:36:41 2005 UTC (18 years, 11 months ago) by yamt
Branch: yamt-km
Changes since 1.20.8.1: +13 -13 lines
Diff to previous 1.20.8.1 (colored) to branchpoint 1.20 (colored) next main 1.21 (colored)

sync with head.  xen and whitespace.  xen part is not finished.

Revision 1.20.2.6 / (download) - annotate - [select for diffs], Fri Mar 4 16:53:44 2005 UTC (19 years ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.5: +13 -13 lines
Diff to previous 1.20.2.5 (colored) to branchpoint 1.20 (colored)

Sync with HEAD.

Hi Perry!

Revision 1.23 / (download) - annotate - [select for diffs], Mon Feb 28 17:47:50 2005 UTC (19 years ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base4, yamt-km-base3, netbsd-3-base, netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-1, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, netbsd-3-0, netbsd-3, kent-audio2-base
Changes since 1.22: +4 -4 lines
Diff to previous 1.22 (colored)

Repair references to nonexistent structs in sys/netipsec/key.c after
NAT-T changes. Matches changes to reference non-nonexistent structs in
sys/netkey.

I have no clue if this is correct, but it matches the style in
sys/netkey, and (unlike the previous two revisions) it actually compiles...

Revision 1.22 / (download) - annotate - [select for diffs], Sat Feb 26 22:45:13 2005 UTC (19 years ago) by perry
Branch: MAIN
Changes since 1.21: +11 -11 lines
Diff to previous 1.21 (colored)

nuke trailing whitespace

Revision 1.20.2.5 / (download) - annotate - [select for diffs], Tue Feb 15 21:33:40 2005 UTC (19 years ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.4: +13 -2 lines
Diff to previous 1.20.2.4 (colored) to branchpoint 1.20 (colored)

Sync with HEAD.

Revision 1.20.8.1 / (download) - annotate - [select for diffs], Sat Feb 12 18:17:54 2005 UTC (19 years ago) by yamt
Branch: yamt-km
Changes since 1.20: +13 -2 lines
Diff to previous 1.20 (colored)

sync with head.

Revision 1.21 / (download) - annotate - [select for diffs], Sat Feb 12 12:31:08 2005 UTC (19 years ago) by manu
Branch: MAIN
CVS Tags: yamt-km-base2
Changes since 1.20: +13 -2 lines
Diff to previous 1.20 (colored)

Add support for IPsec Network Address Translator traversal (NAT-T), as
described by RFC 3947 and 3948.

Revision 1.20.2.4 / (download) - annotate - [select for diffs], Tue Sep 21 13:37:48 2004 UTC (19 years, 5 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.3: +2 -2 lines
Diff to previous 1.20.2.3 (colored) to branchpoint 1.20 (colored)

Fix the sync with head I botched.

Revision 1.20.2.3 / (download) - annotate - [select for diffs], Sat Sep 18 14:55:32 2004 UTC (19 years, 5 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.2: +2 -2 lines
Diff to previous 1.20.2.2 (colored) to branchpoint 1.20 (colored)

Sync with HEAD.

Revision 1.20.2.2 / (download) - annotate - [select for diffs], Tue Aug 3 10:55:29 2004 UTC (19 years, 7 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.20.2.1: +7959 -0 lines
Diff to previous 1.20.2.1 (colored) to branchpoint 1.20 (colored)

Sync with HEAD

Revision 1.11.2.7 / (download) - annotate - [select for diffs], Thu Jun 17 09:26:57 2004 UTC (19 years, 8 months ago) by tron
Branch: netbsd-2-0
CVS Tags: netbsd-2-base, netbsd-2-1-RELEASE, netbsd-2-1-RC6, netbsd-2-1-RC5, netbsd-2-1-RC4, netbsd-2-1-RC3, netbsd-2-1-RC2, netbsd-2-1-RC1, netbsd-2-1, netbsd-2-0-RELEASE, netbsd-2-0-RC5, netbsd-2-0-RC4, netbsd-2-0-RC3, netbsd-2-0-RC2, netbsd-2-0-RC1, netbsd-2-0-3-RELEASE, netbsd-2-0-2-RELEASE, netbsd-2-0-1-RELEASE, netbsd-2
Changes since 1.11.2.6: +20 -17 lines
Diff to previous 1.11.2.6 (colored) to branchpoint 1.11 (colored) next main 1.12 (colored)

Pull up revision 1.20 (requested by jonathan in ticket #504):
Fix oversight from re-using reworked sysctl() code for unicast SPD,SADB dump:
because the sysctl() code wasn't setting the requestor-pid field in dump
responses, the reworked unicast dump wasn't setting the requestor pid, either.
More exaclty, the pid field was set to 0.
No problem for setkey(8), but racoon reportedly ignores SADB dump-responses
with any pid (including 0) which doesn't match its own pid. A private bug
report says the 0-valued pid field broke racoon code which attempts to recover
from death of a prior racoon process, by dumping the SADB at startup.
Fix by revising sys/netipsec, so that both the new unicast PF_KEY dump
responses and the sysctl code set the requestor pid field in all
response mesages to DUMP requests.

Revision 1.20.2.1, Thu Jun 10 01:28:25 2004 UTC (19 years, 8 months ago) by skrll
Branch: ktrace-lwp
Changes since 1.20: +0 -7959 lines
FILE REMOVED

file key.c was added on branch ktrace-lwp on 2004-08-03 10:55:29 +0000

Revision 1.20 / (download) - annotate - [select for diffs], Thu Jun 10 01:28:25 2004 UTC (19 years, 8 months ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base, kent-audio1-beforemerge, kent-audio1-base, kent-audio1
Branch point for: yamt-km, ktrace-lwp, kent-audio2
Changes since 1.19: +22 -19 lines
Diff to previous 1.19 (colored)

Fix oversight from re-using reworked sysctl() code for unicast SPD,SADB dump:
because the sysctl() code wasn't setting the requestor-pid field in dump
responses, the reworked unicast dump wasn't setting the requestor pid, either.
More exaclty, the pid field was set to 0.

No problem for setkey(8), but racoon reportedly ignores SADB dump-responses
with any pid (including 0) which doesn't match its own pid. A private bug
report says the 0-valued pid field broke racoon code which attempts to recover
from death of a prior racoon process, by dumping the SADB at startup.

Fix by revising sys/netipsec, so that both the new unicast PF_KEY dump
responses and the sysctl code set the requestor pid field in all
response mesages to DUMP requests.

Revision 1.11.2.6 / (download) - annotate - [select for diffs], Sun May 30 07:02:32 2004 UTC (19 years, 9 months ago) by tron
Branch: netbsd-2-0
Changes since 1.11.2.5: +231 -64 lines
Diff to previous 1.11.2.5 (colored) to branchpoint 1.11 (colored)

Pull up revision 1.19 (requested by jonathan in ticket #405):
Rework to make  FAST_IPSEC PF_KEY dumps unicast and reliable:
Introduce new socket-layer function sbappendaddrchain() to
sys/kern/uipc_socket2.c: like sbappendaddr(), only takes a chain of
records and appends the entire chain in one pass. sbappendaddrchain()
also takes an `sbprio' argument, which indicates the caller requires
special `reliable' handling of the socket-buffer.  `sbprio' is
described in sys/sys/socketvar.h, although (for now) the different
levels are not yet implemented.
Rework sys/netipsec/key.c PF_KEY DUMP responses to build a chain of
mbuf records, one record per dump response. Unicast the entire chain
to the requestor, with all-or-none semantics.
Changed files;
 	sys/socketvar.h kern/uipc_socket2.c netipsec/key.c
Reviewed by:
	Jason Thorpe, Thor Lancelot Simon, post to tech-kern.
Todo: request pullup to 2.0 branch.  Post-2.0, rework sysctl() API for
dumps to use new record-chain constructors. Actually implement
the distinct service levels in sbappendaddrchain() so we can use them
to make PF_KEY ACQUIRE messages more reliable.

Revision 1.11.2.5 / (download) - annotate - [select for diffs], Sat May 29 21:20:44 2004 UTC (19 years, 9 months ago) by tron
Branch: netbsd-2-0
Changes since 1.11.2.4: +54 -13 lines
Diff to previous 1.11.2.4 (colored) to branchpoint 1.11 (colored)

Pull up revision 1.18 (requested by jonathan in ticket #402):
Fix bugs in SPD refcounts due to PCBpolicy cache, by backporting the
KAME sys/netkey/key.c rev 1.119 ke_sp_unlink()/key_sp_dead() logic.
I have been running a similar version for about 10 days now, and it
fixes the PCB-cache refcount problems for me.
Checked in as a candidate for pullup to the 2.0 branch.

Revision 1.11.2.4 / (download) - annotate - [select for diffs], Sat May 29 21:17:42 2004 UTC (19 years, 9 months ago) by tron
Branch: netbsd-2-0
Changes since 1.11.2.3: +3 -3 lines
Diff to previous 1.11.2.3 (colored) to branchpoint 1.11 (colored)

Pull up revision 1.17 (requested by jonathan in ticket #401):
Thanks to Andrew Brown for the heads-up that fast_ipsec still had
key_prefered_oldsa, defaulted to 1 (on): preferring old SAs, based on
the ill-concieved Jenkins I-D, is broken by design.  For now, just
turn it off, as the simplest way to fix this in the 2.0 branch.
Next step is to rip it out entirely: it was always a bad idea.

Revision 1.19 / (download) - annotate - [select for diffs], Thu May 27 19:19:00 2004 UTC (19 years, 9 months ago) by jonathan
Branch: MAIN
Changes since 1.18: +233 -66 lines
Diff to previous 1.18 (colored)

Rework to make  FAST_IPSEC PF_KEY dumps unicast and reliable:

Introduce new socket-layer function sbappendaddrchain() to
sys/kern/uipc_socket2.c: like sbappendaddr(), only takes a chain of
records and appends the entire chain in one pass. sbappendaddrchain()
also takes an `sbprio' argument, which indicates the caller requires
special `reliable' handling of the socket-buffer.  `sbprio' is
described in sys/sys/socketvar.h, although (for now) the different
levels are not yet implemented.

Rework sys/netipsec/key.c PF_KEY DUMP responses to build a chain of
mbuf records, one record per dump response. Unicast the entire chain
to the requestor, with all-or-none semantics.

Changed files;
 	sys/socketvar.h kern/uipc_socket2.c netipsec/key.c
Reviewed by:
	Jason Thorpe, Thor Lancelot Simon, post to tech-kern.

Todo: request pullup to 2.0 branch.  Post-2.0, rework sysctl() API for
dumps to use new record-chain constructors. Actually implement
the distinct service levels in sbappendaddrchain() so we can use them
to make PF_KEY ACQUIRE messages more reliable.

Revision 1.18 / (download) - annotate - [select for diffs], Wed May 26 23:16:25 2004 UTC (19 years, 9 months ago) by jonathan
Branch: MAIN
Changes since 1.17: +56 -15 lines
Diff to previous 1.17 (colored)

Fix bugs in SPD refcounts due to PCBpolicy cache, by backporting the
KAME sys/netkey/key.c rev 1.119 ke_sp_unlink()/key_sp_dead() logic.

I have been running a similar version for about 10 days now, and it
fixes the PCB-cache refcount problems for me.

Checked in as a candidate for pullup to the 2.0 branch.

Revision 1.17 / (download) - annotate - [select for diffs], Wed May 26 22:14:18 2004 UTC (19 years, 9 months ago) by jonathan
Branch: MAIN
Changes since 1.16: +3 -3 lines
Diff to previous 1.16 (colored)

Thanks to Andrew Brown for the heads-up that fast_ipsec still had
key_prefered_oldsa, defaulted to 1 (on): preferring old SAs, based on
the ill-concieved Jenkins I-D, is broken by design.  For now, just
turn it off, as the simplest way to fix this in the 2.0 branch.

Next step is to rip it out entirely: it was always a bad idea.

Revision 1.11.2.3 / (download) - annotate - [select for diffs], Tue May 25 04:14:03 2004 UTC (19 years, 9 months ago) by jmc
Branch: netbsd-2-0
Changes since 1.11.2.2: +7 -2 lines
Diff to previous 1.11.2.2 (colored) to branchpoint 1.11 (colored)

Pullup rev 1.16 (requested by atatat in ticket #386)

The FAST_IPSEC code actually supports KEYCTL_PREFERED_OLDSA, so export
it via sysctl.

Revision 1.16 / (download) - annotate - [select for diffs], Tue May 25 04:00:33 2004 UTC (19 years, 9 months ago) by atatat
Branch: MAIN
Changes since 1.15: +7 -2 lines
Diff to previous 1.15 (colored)

The FAST_IPSEC code actually supports KEYCTL_PREFERED_OLDSA, so export
it via sysctl.

Revision 1.11.2.2 / (download) - annotate - [select for diffs], Mon May 10 15:14:17 2004 UTC (19 years, 9 months ago) by tron
Branch: netbsd-2-0
Changes since 1.11.2.1: +60 -16 lines
Diff to previous 1.11.2.1 (colored) to branchpoint 1.11 (colored)

Pull up revision 1.15 (requested by jonathan in ticket #281):
Fix for setkey(8) to dump SPD and SAdb via sysctl:
passing sysctl argument name[1] to a helper.  According to Andrew
Brown's revised dynamic sysctl schmea, it must instead pass name[0].
2.  There is a naming glitch in using sysctl() for setkey(8): setkey
queries the same sysctl MIB numbers to dump IPsec database state,
irrepesctive of the underlying IPsec is KAME or FAST_IPSEC.
For this to work as expected, sys/netipsec must export net.key.dumpsa
and net.key.dumpsp via the identical MIB numbers  used by sys/netkey.
``Make it so''. For now, renumber the sys/netipsec/key.c nodes;
post-2.0 we can use sysctl aliases.
3.  For as-yet-unexplained reasons, the PF_KEY_V2 nodes are never
shown (or queried?) by sysctl(8). For 2.0, I am following an earlier
suggestion from Andrew Brown, and renumbering allthe FAST_IPSEC sysctl
nodes to appear under net.key at MIB number { CTL_NET, PF_KEY }. Since
the renumbering may change, the renumbering is done via a level of
indirection in the C preprocessor.
The nett result is that setkey(8) can find the nodes it needs for
setkey -D and setkey -PD: and that sysctl(8) finds all the FAST_IPSEC
sysctl nodes relatedy to IPsec keying, under net.key.  Andrew Brown
has reviewed this patch and tentatively approved the changes, though
we may rework some of the changes in -current in the near future.

Revision 1.11.2.1 / (download) - annotate - [select for diffs], Fri Apr 30 03:55:11 2004 UTC (19 years, 10 months ago) by jmc
Branch: netbsd-2-0
Changes since 1.11: +28 -2 lines
Diff to previous 1.11 (colored)

Pullup rev 1.14 (requested by jonathan in ticket #235)

Update sys/netipsec/key.c to check for attempts to add IPv6-related
SPDs, and to warn about and reject any such attempts.

Revision 1.15 / (download) - annotate - [select for diffs], Fri Apr 30 01:08:35 2004 UTC (19 years, 10 months ago) by jonathan
Branch: MAIN
Changes since 1.14: +60 -16 lines
Diff to previous 1.14 (colored)

Fix for setkey(8) to dump SPD and SAdb via sysctl:

#1. Fix an off-by-one error in sysctl_net_key_dumpsa(), which was
passing sysctl argument name[1] to a helper.  According to Andrew
Brown's revised dynamic sysctl schmea, it must instead pass name[0].

2.  There is a naming glitch in using sysctl() for setkey(8): setkey
queries the same sysctl MIB numbers to dump IPsec database state,
irrepesctive of the underlying IPsec is KAME or FAST_IPSEC.
For this to work as expected, sys/netipsec must export net.key.dumpsa
and net.key.dumpsp via the identical MIB numbers  used by sys/netkey.
``Make it so''. For now, renumber the sys/netipsec/key.c nodes;
post-2.0 we can use sysctl aliases.

3.  For as-yet-unexplained reasons, the PF_KEY_V2 nodes are never
shown (or queried?) by sysctl(8). For 2.0, I am following an earlier
suggestion from Andrew Brown, and renumbering allthe FAST_IPSEC sysctl
nodes to appear under net.key at MIB number { CTL_NET, PF_KEY }. Since
the renumbering may change, the renumbering is done via a level of
indirection in the C preprocessor.

The nett result is that setkey(8) can find the nodes it needs for
setkey -D and setkey -PD: and that sysctl(8) finds all the FAST_IPSEC
sysctl nodes relatedy to IPsec keying, under net.key.  Andrew Brown
has reviewed this patch and tentatively approved the changes, though
we may rework some of the changes in -current in the near future.

Revision 1.14 / (download) - annotate - [select for diffs], Tue Apr 27 23:57:19 2004 UTC (19 years, 10 months ago) by jonathan
Branch: MAIN
Changes since 1.13: +28 -2 lines
Diff to previous 1.13 (colored)

Update sys/netipsec/key.c to check for attempts to add IPv6-related
SPDs, and to warn about and reject any such attempts.

Addresses a security concern, that the (eas-yet incomplete, experimental)
FAST_IPSEC+INET6 does not honour IPv6 SPDs.  The security risk is that
Naive users may not realize this, and their data may get leaked in
cleartext, rather than IPsec'ed, if they use IPv6.

Security issue raised by: Thor Lancelot Simon
reviewed and OKed by: Thor Lancelot Simon

2.0 Pullup request after: 24 hours for further public comment.

Revision 1.13 / (download) - annotate - [select for diffs], Mon Apr 26 01:41:15 2004 UTC (19 years, 10 months ago) by matt
Branch: MAIN
Changes since 1.12: +2 -11 lines
Diff to previous 1.12 (colored)

Remove #else of #if __STDC__

Revision 1.12 / (download) - annotate - [select for diffs], Sun Apr 25 22:25:03 2004 UTC (19 years, 10 months ago) by jonathan
Branch: MAIN
Changes since 1.11: +21 -3 lines
Diff to previous 1.11 (colored)

Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).


NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.

Revision 1.11 / (download) - annotate - [select for diffs], Wed Mar 24 15:34:55 2004 UTC (19 years, 11 months ago) by atatat
Branch: MAIN
CVS Tags: netbsd-2-0-base
Branch point for: netbsd-2-0
Changes since 1.10: +32 -17 lines
Diff to previous 1.10 (colored)

Tango on sysctl_createv() and flags.  The flags have all been renamed,
and sysctl_createv() now uses more arguments.

Revision 1.10 / (download) - annotate - [select for diffs], Wed Mar 17 00:17:45 2004 UTC (19 years, 11 months ago) by jonathan
Branch: MAIN
Changes since 1.9: +10 -2 lines
Diff to previous 1.9 (colored)

Fix key_ismyaddr6() multicast test, as per sys/netkey/key.c NetBSD rev 1.112.

Revision 1.9 / (download) - annotate - [select for diffs], Tue Mar 2 02:22:56 2004 UTC (20 years ago) by thorpej
Branch: MAIN
Changes since 1.8: +35 -15 lines
Diff to previous 1.8 (colored)

Bring the PCB policy cache over from KAME IPsec, including the "hint"
used to short-circuit IPsec processing in other places.

This is enabled only for NetBSD at the moment; in order for it to function
correctly, ipsec_pcbconn() must be called as appropriate.

Revision 1.8 / (download) - annotate - [select for diffs], Mon Mar 1 18:33:03 2004 UTC (20 years ago) by thorpej
Branch: MAIN
Changes since 1.7: +3 -2 lines
Diff to previous 1.7 (colored)

Merge netkey/key.c rev 1.51 (wiz):

va_{start,end} audit:
Make sure that each va_start has one and only one matching va_end,
especially in error cases.
If the va_list is used multiple times, do multiple va_starts/va_ends.
If a function gets va_list as argument, don't let it use va_end (since
it's the callers responsibility).

Improved by comments from enami and christos -- thanks!

Heimdal/krb4/KAME changes already fed back, rest to follow.

Inspired by, but not not based on, OpenBSD.

Revision 1.7 / (download) - annotate - [select for diffs], Tue Feb 24 15:12:52 2004 UTC (20 years ago) by wiz
Branch: MAIN
Changes since 1.6: +7 -7 lines
Diff to previous 1.6 (colored)

occured -> occurred. From Peter Postma.

Revision 1.6 / (download) - annotate - [select for diffs], Fri Dec 12 21:17:59 2003 UTC (20 years, 2 months ago) by scw
Branch: MAIN
Changes since 1.5: +15 -2 lines
Diff to previous 1.5 (colored)

Make fast-ipsec and ipflow (Fast Forwarding) interoperate.

The idea is that we only clear M_CANFASTFWD if an SPD exists
for the packet. Otherwise, it's safe to add a fast-forward
cache entry for the route.

To make this work properly, we invalidate the entire ipflow
cache if a fast-ipsec key is added or changed.

Revision 1.5 / (download) - annotate - [select for diffs], Fri Dec 12 21:04:03 2003 UTC (20 years, 2 months ago) by scw
Branch: MAIN
Changes since 1.4: +237 -8 lines
Diff to previous 1.4 (colored)

Add KEYCTL_DUMPSA/KEYCTL_DUMPSP support.
setkey(8)'s -D and -P options now work as expected with fast-ipsec.

Revision 1.4 / (download) - annotate - [select for diffs], Thu Dec 4 19:38:25 2003 UTC (20 years, 3 months ago) by atatat
Branch: MAIN
Changes since 1.3: +62 -51 lines
Diff to previous 1.3 (colored)

Dynamic sysctl.

Gone are the old kern_sysctl(), cpu_sysctl(), hw_sysctl(),
vfs_sysctl(), etc, routines, along with sysctl_int() et al.  Now all
nodes are registered with the tree, and nodes can be added (or
removed) easily, and I/O to and from the tree is handled generically.

Since the nodes are registered with the tree, the mapping from name to
number (and back again) can now be discovered, instead of having to be
hard coded.  Adding new nodes to the tree is likewise much simpler --
the new infrastructure handles almost all the work for simple types,
and just about anything else can be done with a small helper function.

All existing nodes are where they were before (numerically speaking),
so all existing consumers of sysctl information should notice no
difference.

PS - I'm sorry, but there's a distinct lack of documentation at the
moment.  I'm working on sysctl(3/8/9) right now, and I promise to
watch out for buses.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Oct 6 22:05:15 2003 UTC (20 years, 4 months ago) by tls
Branch: MAIN
Changes since 1.2: +3 -3 lines
Diff to previous 1.2 (colored)

Reversion of "netkey merge", part 2 (replacement of removed files in the
repository by christos was part 1).  netipsec should now be back as it
was on 2003-09-11, with some very minor changes:

1) Some residual platform-dependent code was moved from ipsec.h to
   ipsec_osdep.h; without this, IPSEC_ASSERT() was multiply defined.  ipsec.h
   now includes ipsec_osdep.h

2) itojun's renaming of netipsec/files.ipsec to netipsec/files.netipsec has
   been left in place (it's arguable which name is less confusing but the
   rename is pretty harmless).

3) Some #endif TOKEN has been replaced by #endif /* TOKEN */; #endif TOKEN
   is invalid and GCC 3 won't compile it.

An i386 kernel with "options FAST_IPSEC" and "options OPENCRYPTO" now
gets through "make depend" but fails to build with errors in ip_input.c.
But it's better than it was (thank heaven for small favors).

Revision 1.2 / (download) - annotate - [select for diffs], Wed Aug 20 22:33:40 2003 UTC (20 years, 6 months ago) by jonathan
Branch: MAIN
Changes since 1.1: +4 -2 lines
Diff to previous 1.1 (colored)

opt_inet6.h is FreeBSD-specific, so wrap it with #ifdef __FreeBSD__/#endif.

Revision 1.1 / (download) - annotate - [select for diffs], Wed Aug 13 20:06:51 2003 UTC (20 years, 6 months ago) by jonathan
Branch: MAIN

Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source.  For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>