CVS log for src/sys/netipsec/key.c

Up to [cvs.NetBSD.org] / src / sys / netipsec

Request diff between arbitrary revisions

Default branch: MAIN
Current tag: MAIN

Revision 1.81 / (download) - annotate - [select for diffs], Wed Jun 5 19:01:26 2013 UTC (2 weeks ago) by christos
Branch: MAIN
CVS Tags: HEAD
Changes since 1.80: +24 -24 lines
Diff to previous 1.80 (colored)

IPSEC has not come in two speeds for a long time now (IPSEC == kame,
FAST_IPSEC). Make everything refer to IPSEC to avoid confusion.

Revision 1.80 / (download) - annotate - [select for diffs], Tue Jun 4 22:47:37 2013 UTC (2 weeks, 1 day ago) by christos
Branch: MAIN
Changes since 1.79: +3 -50 lines
Diff to previous 1.79 (colored)

PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may access
outdated pointers and pass ESP data to UPD-sockets.
While here, simplify the code and remove the IPSEC_NAT_T option; always
compile nat-traversal in so that it does not bitrot.

Revision 1.79 / (download) - annotate - [select for diffs], Thu Sep 20 23:50:05 2012 UTC (8 months, 4 weeks ago) by gdt
Branch: MAIN
CVS Tags: yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, tls-maxphys-nbase, tls-maxphys-base, khorben-n900, agc-symver-base, agc-symver
Changes since 1.78: +30 -31 lines
Diff to previous 1.78 (colored)

Fix whitespace (mostly removing trailing).

This commit changes only whitespace (trailing, tabs vs spaces,
removing spurious newlines).  From Bev Schwartz of BBN.

Revision 1.78 / (download) - annotate - [select for diffs], Thu Aug 30 12:16:49 2012 UTC (9 months, 2 weeks ago) by drochner
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.77: +4 -4 lines
Diff to previous 1.77 (colored)

Add "consttime_bcmp" and "explicit_bzero" functions for both kernel
abd userland, as proposed on tech-security, with explicit_bzero using
a volatile function pointer as suggested by Alan Barrett.
Both do what the name says. For userland, both are prefixed by "__"
to keep them out of the user namespace.
Change some memset/memcmp uses to the new functions where it makes
sense -- these are just some examples, more to come.

Revision 1.77 / (download) - annotate - [select for diffs], Wed Aug 29 20:37:50 2012 UTC (9 months, 2 weeks ago) by drochner
Branch: MAIN
Changes since 1.76: +2 -13 lines
Diff to previous 1.76 (colored)

g/c unused struct member

allow the ESP fragment length in the NAT-T case to be reported back
through the pfkey interface, kernel part of PR kern/44952
by Wolfgang Stukenbrock

Revision 1.75 / (download) - annotate - [select for diffs], Mon Dec 19 11:47:16 2011 UTC (18 months ago) by drochner
Branch: MAIN
Changes since 1.74: +5 -43 lines
Diff to previous 1.74 (colored)

as in netkey/key.c, just use cprng_fast() to get a random number
(which is used to choose an SPI), kill the dummy seeding code

Revision 1.74 / (download) - annotate - [select for diffs], Sun Jul 17 20:54:54 2011 UTC (23 months ago) by joerg
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base, jmcneill-audiomp3-base, jmcneill-audiomp3
Branch point for: yamt-pagecache, jmcneill-usbmp
Changes since 1.73: +2 -5 lines
Diff to previous 1.73 (colored)

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

Revision 1.73 / (download) - annotate - [select for diffs], Thu Jun 9 19:54:18 2011 UTC (2 years ago) by drochner
Branch: MAIN
CVS Tags: rmind-uvmplock-nbase, rmind-uvmplock-base
Changes since 1.72: +24 -24 lines
Diff to previous 1.72 (colored)

more "const"

Revision 1.72 / (download) - annotate - [select for diffs], Mon Jun 6 16:48:35 2011 UTC (2 years ago) by drochner
Branch: MAIN
Changes since 1.71: +2 -20 lines
Diff to previous 1.71 (colored)

remove a limitation that inner and outer IP version must be equal
for an ESP tunnel, and add some fixes which make v4-in-v6 work
(v6 as inner protocol isn't ready, even v6-in-v6 can never have worked)

being here, fix a statistics counter and kill an unused variable

Revision 1.71 / (download) - annotate - [select for diffs], Mon May 23 15:17:25 2011 UTC (2 years ago) by drochner
Branch: MAIN
CVS Tags: cherry-xenmp-base
Branch point for: cherry-xenmp
Changes since 1.70: +2 -20 lines
Diff to previous 1.70 (colored)

g/c remainders of IV handling in pfkey code -- this is done in
opencrypto now

Revision 1.70 / (download) - annotate - [select for diffs], Wed May 18 18:56:02 2011 UTC (2 years, 1 month ago) by drochner
Branch: MAIN
Changes since 1.69: +7 -3 lines
Diff to previous 1.69 (colored)

include the SHA2 hashs into the proposal which goes out with
SADB_ACQUIRE -- this doesn't change much because racoon ignores
the proposal from the kernel anyway and applies its own configuration,
but having MD5 and SHA1 in the list but SHA2 not looks strange

Revision 1.69 / (download) - annotate - [select for diffs], Wed May 18 18:36:15 2011 UTC (2 years, 1 month ago) by drochner
Branch: MAIN
Changes since 1.68: +27 -21 lines
Diff to previous 1.68 (colored)

use monotonic time rather than wall time for lifetime related timestamps,
to make key expiration robust against time changes

Revision 1.68 / (download) - annotate - [select for diffs], Tue May 17 18:57:02 2011 UTC (2 years, 1 month ago) by drochner
Branch: MAIN
Changes since 1.67: +20 -23 lines
Diff to previous 1.67 (colored)

cleanup some error handling to avoid memory leaks and doube frees,
from Wolfgang Stukenbrock per PR kern/44948, and part of kern/44952

Revision 1.67 / (download) - annotate - [select for diffs], Tue May 17 18:43:02 2011 UTC (2 years, 1 month ago) by drochner
Branch: MAIN
Changes since 1.66: +33 -8 lines
Diff to previous 1.66 (colored)

fix lookup of SAs for outgoing packets in the !prefered_oldsa case,
as done in KAME and FAST_IPSEC after NetBSD imported the code
(The default differs: KAME uses the oldest valid SA while FAST_IPSEC
in NetBSD uses the newest one. I'm not changing this -- there is a lack
of specification and behavior can be changed with the "oldsa" sysctl.)
For incoming packets it shouldn't matter but I made it look similar
just to avoid unnecessary differences.

Revision 1.66 / (download) - annotate - [select for diffs], Mon Feb 21 22:28:18 2011 UTC (2 years, 3 months ago) by drochner
Branch: MAIN
CVS Tags: bouyer-quota2-nbase
Changes since 1.65: +43 -43 lines
Diff to previous 1.65 (colored)

treat "struct secpolicyindex" and "struct secasindex" as "const" once
they are initialized -- during lifetime, no changes are expected
plus some constification of input to comparision functions etc
mostly required by the former

Revision 1.65 / (download) - annotate - [select for diffs], Fri Feb 18 20:40:58 2011 UTC (2 years, 4 months ago) by drochner
Branch: MAIN
Changes since 1.64: +7 -7 lines
Diff to previous 1.64 (colored)

more "const"

Revision 1.64 / (download) - annotate - [select for diffs], Sun Sep 5 06:52:53 2010 UTC (2 years, 9 months ago) by spz
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, uebayasi-xip-base4, uebayasi-xip-base3, matt-mips64-premerge-20101231, jruoho-x86intr-base, bouyer-quota2-base
Branch point for: jruoho-x86intr, bouyer-quota2
Changes since 1.63: +148 -30 lines
Diff to previous 1.63 (colored)

fix two bugs in the PFKEY interface:

1) RFC2367 says in 2.3.3 Address Extension: "All non-address
   information in the sockaddrs, such as sin_zero for AF_INET sockaddrs,
   and sin6_flowinfo for AF_INET6 sockaddrs, MUST be zeroed out."
   the IPSEC_NAT_T code was expecting the port information it needs
   to be conveyed in the sockaddr instead of exclusively by
   SADB_X_EXT_NAT_T_SPORT and SADB_X_EXT_NAT_T_DPORT,
   and was not zeroing out the port information in the non-nat-traversal
   case.
   Since it was expecting the port information to reside in the sockaddr
   it could get away with (re)setting the ports after starting to use them.
   -> Set the natt ports before setting the SA mature.

2) RFC3947 has two Original Address fields, initiator and responder,
   so we need SADB_X_EXT_NAT_T_OAI and SADB_X_EXT_NAT_T_OAR and not just
   SADB_X_EXT_NAT_T_OA

The change has been created using vanhu's patch for FreeBSD as reference.

Note that establishing actual nat-t sessions has not yet been tested.

Likely fixes the following:
PR bin/41757
PR net/42592
PR net/42606

Revision 1.63 / (download) - annotate - [select for diffs], Sun Jan 31 00:43:38 2010 UTC (3 years, 4 months ago) by hubertf
Branch: MAIN
CVS Tags: yamt-nfs-mp-base9, yamt-nfs-mp-base10, uebayasi-xip-base2, uebayasi-xip-base1, uebayasi-xip-base
Branch point for: uebayasi-xip, rmind-uvmplock
Changes since 1.62: +3 -3 lines
Diff to previous 1.62 (colored)

Replace more printfs with aprint_normal / aprint_verbose
Makes "boot -z" go mostly silent for me.

Revision 1.62 / (download) - annotate - [select for diffs], Wed Mar 18 15:14:32 2009 UTC (4 years, 3 months ago) by cegger
Branch: MAIN
CVS Tags: yamt-nfs-mp-base8, yamt-nfs-mp-base7, yamt-nfs-mp-base6, yamt-nfs-mp-base5, yamt-nfs-mp-base4, yamt-nfs-mp-base3, nick-hppapmap-base4, nick-hppapmap-base3, nick-hppapmap-base, matt-premerge-20091211, jymxensuspend-base, jym-xensuspend-nbase, jym-xensuspend-base
Changes since 1.61: +3 -3 lines
Diff to previous 1.61 (colored)

bcmp -> memcmp

Revision 1.61 / (download) - annotate - [select for diffs], Wed Mar 18 10:22:43 2009 UTC (4 years, 3 months ago) by cegger
Branch: MAIN
Changes since 1.60: +11 -11 lines
Diff to previous 1.60 (colored)

Ansify function definitions w/o arguments. Generated with sed.

Revision 1.60 / (download) - annotate - [select for diffs], Sat Feb 14 20:53:58 2009 UTC (4 years, 4 months ago) by christos
Branch: MAIN
CVS Tags: nick-hppapmap-base2
Changes since 1.59: +2 -3 lines
Diff to previous 1.59 (colored)

remove 2038 comment.

Revision 1.59 / (download) - annotate - [select for diffs], Mon Feb 9 15:06:37 2009 UTC (4 years, 4 months ago) by skd
Branch: MAIN
Changes since 1.58: +3 -3 lines
Diff to previous 1.58 (colored)

Back out my previous change.  The problem I'm chasgin is with the
initialization of ports in saidx's when IPSEC_NAT_T is defined but the
association connection is not using nat traversal.  Stay tuned.

Revision 1.58 / (download) - annotate - [select for diffs], Wed Jan 28 19:06:03 2009 UTC (4 years, 4 months ago) by skd
Branch: MAIN
Branch point for: jym-xensuspend
Changes since 1.57: +3 -3 lines
Diff to previous 1.57 (colored)

These comparison functions return 0 on match.  Fix sense of test.

Revision 1.57 / (download) - annotate - [select for diffs], Fri Jul 25 20:55:43 2008 UTC (4 years, 10 months ago) by dsl
Branch: MAIN
CVS Tags: wrstuden-revivesa-base-4, wrstuden-revivesa-base-3, wrstuden-revivesa-base-2, simonb-wapbl-nbase, simonb-wapbl-base, netbsd-5-base, netbsd-5-0-RELEASE, netbsd-5-0-RC4, netbsd-5-0-RC3, netbsd-5-0-RC2, netbsd-5-0-RC1, netbsd-5-0-2-RELEASE, netbsd-5-0-1-RELEASE, netbsd-5-0, mjf-devfs2-base, matt-nb5-mips64-u2-k2-k4-k7-k8-k9, matt-nb5-mips64-u1-k1-k5, matt-nb5-mips64-premerge-20091211, matt-nb4-mips64-k7-u2a-k9b, matt-mips64-base2, haad-nbase2, haad-dm-base2, haad-dm-base1, haad-dm-base, ad-audiomp2-base, ad-audiomp2
Branch point for: nick-hppapmap, netbsd-5, matt-nb5-mips64
Changes since 1.56: +4 -4 lines
Diff to previous 1.56 (colored)

Comment out the 'do' and 'while (0)' from KEY_CHKSASTATE().
The expansion contains a 'continue' which is expected to continue
a loop in the callling code, not just abort the #define.

Revision 1.56 / (download) - annotate - [select for diffs], Tue Jul 1 20:18:45 2008 UTC (4 years, 11 months ago) by mlelstv
Branch: MAIN
Branch point for: haad-dm
Changes since 1.55: +6 -4 lines
Diff to previous 1.55 (colored)

Ignore freed rtcache entries.

Revision 1.55 / (download) - annotate - [select for diffs], Sun May 4 07:22:15 2008 UTC (5 years, 1 month ago) by thorpej
Branch: MAIN
CVS Tags: yamt-pf42-base4, yamt-pf42-base3, yamt-pf42-base2, yamt-nfs-mp-base2, wrstuden-revivesa-base-1, wrstuden-revivesa-base, hpcarm-cleanup-nbase
Branch point for: wrstuden-revivesa, simonb-wapbl
Changes since 1.54: +3 -8 lines
Diff to previous 1.54 (colored)

Simplify the interface to netstat_sysctl() and allocate space for
the collated counters using kmem_alloc().

PR kern/38577

Revision 1.54 / (download) - annotate - [select for diffs], Sat May 3 21:53:23 2008 UTC (5 years, 1 month ago) by degroote
Branch: MAIN
Changes since 1.53: +9 -3 lines
Diff to previous 1.53 (colored)

In key_do_allocsa_policy, fix a bad usage of key_setsadbmsg. The third argument
is an SADB_SATYPE_*, not an IPPROTO_* .

Fix PR/38405. Thanks for the report

Revision 1.53 / (download) - annotate - [select for diffs], Thu Apr 24 11:38:38 2008 UTC (5 years, 1 month ago) by ad
Branch: MAIN
CVS Tags: yamt-nfs-mp-base
Branch point for: yamt-nfs-mp
Changes since 1.52: +5 -3 lines
Diff to previous 1.52 (colored)

Merge the socket locking patch:

- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.

Revision 1.52 / (download) - annotate - [select for diffs], Wed Apr 23 07:29:47 2008 UTC (5 years, 1 month ago) by thorpej
Branch: MAIN
Changes since 1.51: +70 -30 lines
Diff to previous 1.51 (colored)

PF_KEY stats for IPSEC and FAST_IPSEC are now per-CPU.

Revision 1.51 / (download) - annotate - [select for diffs], Fri Dec 7 19:44:38 2007 UTC (5 years, 6 months ago) by elad
Branch: MAIN
CVS Tags: yamt-pf42-baseX, yamt-pf42-base, yamt-lazymbuf-base15, yamt-lazymbuf-base14, yamt-kmem-base3, yamt-kmem-base2, yamt-kmem-base, yamt-kmem, vmlocking2-base3, vmlocking2-base2, reinoud-bufcleanup-nbase, nick-net80211-sync-base, nick-net80211-sync, mjf-devfs-base, matt-armv6-nbase, matt-armv6-base, keiichi-mipv6-nbase, keiichi-mipv6-base, keiichi-mipv6, jmcneill-pm-base, hpcarm-cleanup-base, cube-autoconf-base, cube-autoconf, bouyer-xeni386-nbase, bouyer-xeni386-merge1, bouyer-xeni386-base, bouyer-xeni386, ad-socklock-base1
Branch point for: yamt-pf42, mjf-devfs2
Changes since 1.50: +4 -4 lines
Diff to previous 1.50 (colored)

Let this code compile.

Hi, liamjfoy@. :)

Revision 1.50 / (download) - annotate - [select for diffs], Mon Jul 9 21:11:13 2007 UTC (5 years, 11 months ago) by ad
Branch: MAIN
CVS Tags: yamt-x86pmap-base4, yamt-x86pmap-base3, yamt-x86pmap-base2, yamt-x86pmap-base, yamt-x86pmap, vmlocking2-base1, vmlocking-nbase, vmlocking-base, reinoud-bufcleanup-base, nick-csl-alignment-base5, nick-csl-alignment-base, nick-csl-alignment, mjf-ufs-trans-base, matt-mips64-base, matt-mips64, matt-armv6-prevmlocking, jmcneill-base, hpcarm-cleanup, bouyer-xenamd64-base2, bouyer-xenamd64-base, bouyer-xenamd64
Branch point for: vmlocking2, mjf-devfs, matt-armv6, jmcneill-pm
Changes since 1.49: +3 -3 lines
Diff to previous 1.49 (colored)

Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Revision 1.49 / (download) - annotate - [select for diffs], Sat Jul 7 18:38:22 2007 UTC (5 years, 11 months ago) by degroote
Branch: MAIN
Changes since 1.48: +294 -433 lines
Diff to previous 1.48 (colored)

Ansify
Remove useless extern
bzero -> memset, bcopy -> memcpy

No functionnal changes

Revision 1.48 / (download) - annotate - [select for diffs], Wed Jun 27 20:38:33 2007 UTC (5 years, 11 months ago) by degroote
Branch: MAIN
Changes since 1.47: +446 -64 lines
Diff to previous 1.47 (colored)

Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).

No objection on tech-net@

Revision 1.47 / (download) - annotate - [select for diffs], Tue May 8 14:03:05 2007 UTC (6 years, 1 month ago) by degroote
Branch: MAIN
CVS Tags: yamt-idlelwp-base8
Changes since 1.46: +7 -2 lines
Diff to previous 1.46 (colored)

Increase the refcount for the default ipv6 policy so nobody can reclaim it

Revision 1.46 / (download) - annotate - [select for diffs], Wed Apr 11 21:33:41 2007 UTC (6 years, 2 months ago) by degroote
Branch: MAIN
CVS Tags: thorpej-atomic-base, thorpej-atomic
Changes since 1.45: +4 -3 lines
Diff to previous 1.45 (colored)

When we construct an answer for SADB_X_SPDGET, don't use an hardcoded 0 for seq but
the seq used by the request. It will improve consistency with the answer of SADB_GET
request and helps some applications which relies both on seq and pid.

Reported by  Karl Knutsson by pr/36119.

Revision 1.45 / (download) - annotate - [select for diffs], Wed Apr 11 21:19:35 2007 UTC (6 years, 2 months ago) by degroote
Branch: MAIN
Changes since 1.44: +3 -3 lines
Diff to previous 1.44 (colored)

In spddelete2, if we can't find the sp by this id, return after sending an error message,
don't process the following code with the NULL sp.

Spotted by Matthew Grooms on freebsd-net ML

Revision 1.44 / (download) - annotate - [select for diffs], Mon Apr 9 21:07:03 2007 UTC (6 years, 2 months ago) by degroote
Branch: MAIN
Changes since 1.43: +3 -2 lines
Diff to previous 1.43 (colored)

Fix a memleak in key_spdget.

Problem was reported by Karl Knutsson by pr/36119.

Revision 1.43 / (download) - annotate - [select for diffs], Wed Mar 21 22:38:34 2007 UTC (6 years, 3 months ago) by degroote
Branch: MAIN
Changes since 1.42: +4 -4 lines
Diff to previous 1.42 (colored)

Call key_checkspidup with spi in network bit order in order to make correct
comparaison with spi stored into the sadb.

Reported by Karl Knutsson in kern/36038 .

Revision 1.42 / (download) - annotate - [select for diffs], Fri Mar 9 00:40:39 2007 UTC (6 years, 3 months ago) by liamjfoy
Branch: MAIN
Branch point for: vmlocking, reinoud-bufcleanup, mjf-ufs-trans
Changes since 1.41: +5 -3 lines
Diff to previous 1.41 (colored)

Allow to build without INET6

Submitted by: Jukka Salmi

Revision 1.41 / (download) - annotate - [select for diffs], Wed Mar 7 22:21:45 2007 UTC (6 years, 3 months ago) by liamjfoy
Branch: MAIN
Changes since 1.40: +3 -2 lines
Diff to previous 1.40 (colored)

Add IPv6 Fast Forward:

Add call to ip6flow_invalidate_all()

ok christos, matt, dyoung and joerg

Revision 1.40 / (download) - annotate - [select for diffs], Sun Mar 4 21:17:55 2007 UTC (6 years, 3 months ago) by degroote
Branch: MAIN
Changes since 1.39: +9 -9 lines
Diff to previous 1.39 (colored)

Remove useless cast
Use NULL instead of (void*) 0

Revision 1.39 / (download) - annotate - [select for diffs], Sun Mar 4 19:54:49 2007 UTC (6 years, 3 months ago) by degroote
Branch: MAIN
Changes since 1.38: +21 -21 lines
Diff to previous 1.38 (colored)

Fix fallout from caddr_t changes

Revision 1.38 / (download) - annotate - [select for diffs], Sun Mar 4 06:03:29 2007 UTC (6 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.37: +40 -40 lines
Diff to previous 1.37 (colored)

Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Revision 1.37 / (download) - annotate - [select for diffs], Sun Feb 18 13:55:25 2007 UTC (6 years, 4 months ago) by degroote
Branch: MAIN
CVS Tags: ad-audiomp-base, ad-audiomp
Changes since 1.36: +3 -3 lines
Diff to previous 1.36 (colored)

Constify the code following the dyoung change ( the "bug" was hidden by the
extern declaration ).
While here, remove a Kame ifdef which is useless in netipsec code

Revision 1.36 / (download) - annotate - [select for diffs], Sat Feb 17 22:34:16 2007 UTC (6 years, 4 months ago) by dyoung
Branch: MAIN
Changes since 1.35: +4 -4 lines
Diff to previous 1.35 (colored)

KNF: de-__P, bzero -> memset, bcmp -> memcmp.  Remove extraneous
   parentheses in return statements.

Cosmetic: don't open-code TAILQ_FOREACH().

Cosmetic: change types of variables to avoid oodles of casts: in
   in6_src.c, avoid casts by changing several route_in6 pointers
   to struct route pointers.  Remove unnecessary casts to caddr_t
   elsewhere.

Pave the way for eliminating address family-specific route caches:
   soon, struct route will not embed a sockaddr, but it will hold
   a reference to an external sockaddr, instead.  We will set the
   destination sockaddr using rtcache_setdst().  (I created a stub
   for it, but it isn't used anywhere, yet.)  rtcache_free() will
   free the sockaddr.  I have extracted from rtcache_free() a helper
   subroutine, rtcache_clear().  rtcache_clear() will "forget" a
   cached route, but it will not forget the destination by releasing
   the sockaddr.  I use rtcache_clear() instead of rtcache_free()
   in rtcache_update(), because rtcache_update() is not supposed
   to forget the destination.

Constify:

   1 Introduce const accessor for route->ro_dst, rtcache_getdst().

   2 Constify the 'dst' argument to ifnet->if_output().  This
     led me to constify a lot of code called by output routines.

   3 Constify the sockaddr argument to protosw->pr_ctlinput.  This
     led me to constify a lot of code called by ctlinput routines.

   4 Introduce const macros for converting from a generic sockaddr
     to family-specific sockaddrs, e.g., sockaddr_in: satocsin6,
     satocsin, et cetera.

Revision 1.35 / (download) - annotate - [select for diffs], Sun Feb 11 13:35:00 2007 UTC (6 years, 4 months ago) by degroote
Branch: MAIN
Branch point for: yamt-idlelwp
Changes since 1.34: +3 -2 lines
Diff to previous 1.34 (colored)

fixed a unexpected addr/port matching failure in SA management
From cvs rev 1.127 of netkey/key.c

Revision 1.34 / (download) - annotate - [select for diffs], Sun Feb 11 13:32:18 2007 UTC (6 years, 4 months ago) by degroote
Branch: MAIN
Changes since 1.33: +13 -12 lines
Diff to previous 1.33 (colored)

reqid (for unique policy) is u_int16_t quantity.
from rev 1.125 of netkey/key.c

Revision 1.33 / (download) - annotate - [select for diffs], Sat Feb 10 09:43:05 2007 UTC (6 years, 4 months ago) by degroote
Branch: MAIN
Changes since 1.32: +33 -29 lines
Diff to previous 1.32 (colored)

Commit my SoC work
Add ipv6 support for fast_ipsec
Note that currently, packet with extensions headers are not correctly
supported
Change the ipcomp logic

Revision 1.32 / (download) - annotate - [select for diffs], Fri Dec 15 21:18:56 2006 UTC (6 years, 6 months ago) by joerg
Branch: MAIN
CVS Tags: yamt-splraiseipl-base5, yamt-splraiseipl-base4, post-newlock2-merge, newlock2-nbase, newlock2-base
Changes since 1.31: +6 -7 lines
Diff to previous 1.31 (colored)

Introduce new helper functions to abstract the route caching.
rtcache_init and rtcache_init_noclone lookup ro_dst and store
the result in ro_rt, taking care of the reference counting and
calling the domain specific route cache.
rtcache_free checks if a route was cashed and frees the reference.
rtcache_copy copies ro_dst of the given struct route, checking that
enough space is available and incrementing the reference count of the
cached rtentry if necessary.
rtcache_check validates that the cached route is still up. If it isn't,
it tries to look it up again. Afterwards ro_rt is either a valid again
or NULL.
rtcache_copy is used internally.

Adjust to callers of rtalloc/rtflush in the tree to check the sanity of
ro_dst first (if necessary). If it doesn't fit the expectations, free
the cache, otherwise check if the cached route is still valid. After
that combination, a single check for ro_rt == NULL is enough to decide
whether a new lookup needs to be done with a different ro_dst.
Make the route checking in gre stricter by repeating the loop check
after revalidation.
Remove some unused RADIX_MPATH code in in6_src.c. The logic is slightly
changed here to first validate the route and check RTF_GATEWAY
afterwards. This is sementically equivalent though.
etherip doesn't need sc_route_expire similiar to the gif changes from
dyoung@ earlier.

Based on the earlier patch from dyoung@, reviewed and discussed with
him.

Revision 1.31 / (download) - annotate - [select for diffs], Sat Dec 9 05:33:09 2006 UTC (6 years, 6 months ago) by dyoung
Branch: MAIN
CVS Tags: yamt-splraiseipl-base3
Changes since 1.30: +7 -11 lines
Diff to previous 1.30 (colored)

Here are various changes designed to protect against bad IPv4
routing caused by stale route caches (struct route).  Route caches
are sprinkled throughout PCBs, the IP fast-forwarding table, and
IP tunnel interfaces (gre, gif, stf).

Stale IPv6 and ISO route caches will be treated by separate patches.

Thank you to Christoph Badura for suggesting the general approach
to invalidating route caches that I take here.

Here are the details:

Add hooks to struct domain for tracking and for invalidating each
domain's route caches: dom_rtcache, dom_rtflush, and dom_rtflushall.

Introduce helper subroutines, rtflush(ro) for invalidating a route
cache, rtflushall(family) for invalidating all route caches in a
routing domain, and rtcache(ro) for notifying the domain of a new
cached route.

Chain together all IPv4 route caches where ro_rt != NULL.  Provide
in_rtcache() for adding a route to the chain.  Provide in_rtflush()
and in_rtflushall() for invalidating IPv4 route caches.  In
in_rtflush(), set ro_rt to NULL, and remove the route from the
chain.  In in_rtflushall(), walk the chain and remove every route
cache.

In rtrequest1(), call rtflushall() to invalidate route caches when
a route is added.

In gif(4), discard the workaround for stale caches that involves
expiring them every so often.

Replace the pattern 'RTFREE(ro->ro_rt); ro->ro_rt = NULL;' with a
call to rtflush(ro).

Update ipflow_fastforward() and all other users of route caches so
that they expect a cached route, ro->ro_rt, to turn to NULL.

Take care when moving a 'struct route' to rtflush() the source and
to rtcache() the destination.

In domain initializers, use .dom_xxx tags.

KNF here and there.

Revision 1.30 / (download) - annotate - [select for diffs], Thu Nov 16 01:33:49 2006 UTC (6 years, 7 months ago) by christos
Branch: MAIN
CVS Tags: netbsd-4-base
Branch point for: netbsd-4
Changes since 1.29: +7 -7 lines
Diff to previous 1.29 (colored)

__unused removal on arguments; approved by core.

Revision 1.29 / (download) - annotate - [select for diffs], Fri Oct 13 20:53:59 2006 UTC (6 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: yamt-splraiseipl-base2
Changes since 1.28: +16 -12 lines
Diff to previous 1.28 (colored)

more __unused

Revision 1.28 / (download) - annotate - [select for diffs], Sun Jul 23 22:06:13 2006 UTC (6 years, 10 months ago) by ad
Branch: MAIN
CVS Tags: yamt-splraiseipl-base, yamt-pdpolicy-base9, yamt-pdpolicy-base8, yamt-pdpolicy-base7, rpaulo-netinet-merge-pcb-base, abandoned-netbsd-4-base, abandoned-netbsd-4
Branch point for: yamt-splraiseipl, newlock2
Changes since 1.27: +4 -4 lines
Diff to previous 1.27 (colored)

Use the LWP cached credentials where sane.

Revision 1.27 / (download) - annotate - [select for diffs], Sat Dec 24 20:45:09 2005 UTC (7 years, 5 months ago) by perry
Branch: MAIN
CVS Tags: yamt-uio_vmspace-base5, yamt-uio_vmspace, yamt-pdpolicy-base6, yamt-pdpolicy-base5, yamt-pdpolicy-base4, yamt-pdpolicy-base3, yamt-pdpolicy-base2, yamt-pdpolicy-base, simonb-timecounters-base, simonb-timecounters, simonb-timcounters-final, peter-altq-base, peter-altq, gdamore-uart-base, gdamore-uart, elad-kernelauth-base, elad-kernelauth, chap-midi-nbase, chap-midi-base, chap-midi
Branch point for: yamt-pdpolicy, rpaulo-netinet-merge-pcb
Changes since 1.26: +4 -4 lines
Diff to previous 1.26 (colored)

Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Dec 11 12:25:05 2005 UTC (7 years, 6 months ago) by christos
Branch: MAIN
Changes since 1.25: +2 -2 lines
Diff to previous 1.25 (colored)

merge ktrace-lwp.

Revision 1.25 / (download) - annotate - [select for diffs], Fri Jun 10 13:22:42 2005 UTC (8 years ago) by christos
Branch: MAIN
CVS Tags: yamt-vop-base3, yamt-vop-base2, yamt-vop-base, yamt-vop, yamt-readahead-pervnode, yamt-readahead-perfile, yamt-readahead-base3, yamt-readahead-base2, yamt-readahead-base, yamt-readahead, thorpej-vnode-attr-base, thorpej-vnode-attr, ktrace-lwp-base
Branch point for: yamt-lazymbuf
Changes since 1.24: +24 -24 lines
Diff to previous 1.24 (colored)

constify and unshadow.

Revision 1.24 / (download) - annotate - [select for diffs], Sun May 8 18:44:40 2005 UTC (8 years, 1 month ago) by christos
Branch: MAIN
Changes since 1.23: +40 -40 lines
Diff to previous 1.23 (colored)

Panic strings should not end with \n.

Revision 1.23 / (download) - annotate - [select for diffs], Mon Feb 28 17:47:50 2005 UTC (8 years, 3 months ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base4, yamt-km-base3, netbsd-3-base, netbsd-3-1-RELEASE, netbsd-3-1-RC4, netbsd-3-1-RC3, netbsd-3-1-RC2, netbsd-3-1-RC1, netbsd-3-1-1-RELEASE, netbsd-3-1, netbsd-3-0-RELEASE, netbsd-3-0-RC6, netbsd-3-0-RC5, netbsd-3-0-RC4, netbsd-3-0-RC3, netbsd-3-0-RC2, netbsd-3-0-RC1, netbsd-3-0-3-RELEASE, netbsd-3-0-2-RELEASE, netbsd-3-0-1-RELEASE, netbsd-3-0, netbsd-3, kent-audio2-base
Changes since 1.22: +4 -4 lines
Diff to previous 1.22 (colored)

Repair references to nonexistent structs in sys/netipsec/key.c after
NAT-T changes. Matches changes to reference non-nonexistent structs in
sys/netkey.

I have no clue if this is correct, but it matches the style in
sys/netkey, and (unlike the previous two revisions) it actually compiles...

Revision 1.22 / (download) - annotate - [select for diffs], Sat Feb 26 22:45:13 2005 UTC (8 years, 3 months ago) by perry
Branch: MAIN
Changes since 1.21: +11 -11 lines
Diff to previous 1.21 (colored)

nuke trailing whitespace

Revision 1.21 / (download) - annotate - [select for diffs], Sat Feb 12 12:31:08 2005 UTC (8 years, 4 months ago) by manu
Branch: MAIN
CVS Tags: yamt-km-base2, matt-timespec
Changes since 1.20: +13 -2 lines
Diff to previous 1.20 (colored)

Add support for IPsec Network Address Translator traversal (NAT-T), as
described by RFC 3947 and 3948.

Revision 1.20 / (download) - annotate - [select for diffs], Thu Jun 10 01:28:25 2004 UTC (9 years ago) by jonathan
Branch: MAIN
CVS Tags: yamt-km-base, kent-audio1-beforemerge, kent-audio1-base, kent-audio1
Branch point for: yamt-km, ktrace-lwp, kent-audio2
Changes since 1.19: +22 -19 lines
Diff to previous 1.19 (colored)

Fix oversight from re-using reworked sysctl() code for unicast SPD,SADB dump:
because the sysctl() code wasn't setting the requestor-pid field in dump
responses, the reworked unicast dump wasn't setting the requestor pid, either.
More exaclty, the pid field was set to 0.

No problem for setkey(8), but racoon reportedly ignores SADB dump-responses
with any pid (including 0) which doesn't match its own pid. A private bug
report says the 0-valued pid field broke racoon code which attempts to recover
from death of a prior racoon process, by dumping the SADB at startup.

Fix by revising sys/netipsec, so that both the new unicast PF_KEY dump
responses and the sysctl code set the requestor pid field in all
response mesages to DUMP requests.

Revision 1.19 / (download) - annotate - [select for diffs], Thu May 27 19:19:00 2004 UTC (9 years ago) by jonathan
Branch: MAIN
Changes since 1.18: +233 -66 lines
Diff to previous 1.18 (colored)

Rework to make  FAST_IPSEC PF_KEY dumps unicast and reliable:

Introduce new socket-layer function sbappendaddrchain() to
sys/kern/uipc_socket2.c: like sbappendaddr(), only takes a chain of
records and appends the entire chain in one pass. sbappendaddrchain()
also takes an `sbprio' argument, which indicates the caller requires
special `reliable' handling of the socket-buffer.  `sbprio' is
described in sys/sys/socketvar.h, although (for now) the different
levels are not yet implemented.

Rework sys/netipsec/key.c PF_KEY DUMP responses to build a chain of
mbuf records, one record per dump response. Unicast the entire chain
to the requestor, with all-or-none semantics.

Changed files;
 	sys/socketvar.h kern/uipc_socket2.c netipsec/key.c
Reviewed by:
	Jason Thorpe, Thor Lancelot Simon, post to tech-kern.

Todo: request pullup to 2.0 branch.  Post-2.0, rework sysctl() API for
dumps to use new record-chain constructors. Actually implement
the distinct service levels in sbappendaddrchain() so we can use them
to make PF_KEY ACQUIRE messages more reliable.

Revision 1.18 / (download) - annotate - [select for diffs], Wed May 26 23:16:25 2004 UTC (9 years ago) by jonathan
Branch: MAIN
Changes since 1.17: +56 -15 lines
Diff to previous 1.17 (colored)

Fix bugs in SPD refcounts due to PCBpolicy cache, by backporting the
KAME sys/netkey/key.c rev 1.119 ke_sp_unlink()/key_sp_dead() logic.

I have been running a similar version for about 10 days now, and it
fixes the PCB-cache refcount problems for me.

Checked in as a candidate for pullup to the 2.0 branch.

Revision 1.17 / (download) - annotate - [select for diffs], Wed May 26 22:14:18 2004 UTC (9 years ago) by jonathan
Branch: MAIN
Changes since 1.16: +3 -3 lines
Diff to previous 1.16 (colored)

Thanks to Andrew Brown for the heads-up that fast_ipsec still had
key_prefered_oldsa, defaulted to 1 (on): preferring old SAs, based on
the ill-concieved Jenkins I-D, is broken by design.  For now, just
turn it off, as the simplest way to fix this in the 2.0 branch.

Next step is to rip it out entirely: it was always a bad idea.

Revision 1.16 / (download) - annotate - [select for diffs], Tue May 25 04:00:33 2004 UTC (9 years ago) by atatat
Branch: MAIN
Changes since 1.15: +7 -2 lines
Diff to previous 1.15 (colored)

The FAST_IPSEC code actually supports KEYCTL_PREFERED_OLDSA, so export
it via sysctl.

Revision 1.15 / (download) - annotate - [select for diffs], Fri Apr 30 01:08:35 2004 UTC (9 years, 1 month ago) by jonathan
Branch: MAIN
Changes since 1.14: +60 -16 lines
Diff to previous 1.14 (colored)

Fix for setkey(8) to dump SPD and SAdb via sysctl:

#1. Fix an off-by-one error in sysctl_net_key_dumpsa(), which was
passing sysctl argument name[1] to a helper.  According to Andrew
Brown's revised dynamic sysctl schmea, it must instead pass name[0].

2.  There is a naming glitch in using sysctl() for setkey(8): setkey
queries the same sysctl MIB numbers to dump IPsec database state,
irrepesctive of the underlying IPsec is KAME or FAST_IPSEC.
For this to work as expected, sys/netipsec must export net.key.dumpsa
and net.key.dumpsp via the identical MIB numbers  used by sys/netkey.
``Make it so''. For now, renumber the sys/netipsec/key.c nodes;
post-2.0 we can use sysctl aliases.

3.  For as-yet-unexplained reasons, the PF_KEY_V2 nodes are never
shown (or queried?) by sysctl(8). For 2.0, I am following an earlier
suggestion from Andrew Brown, and renumbering allthe FAST_IPSEC sysctl
nodes to appear under net.key at MIB number { CTL_NET, PF_KEY }. Since
the renumbering may change, the renumbering is done via a level of
indirection in the C preprocessor.

The nett result is that setkey(8) can find the nodes it needs for
setkey -D and setkey -PD: and that sysctl(8) finds all the FAST_IPSEC
sysctl nodes relatedy to IPsec keying, under net.key.  Andrew Brown
has reviewed this patch and tentatively approved the changes, though
we may rework some of the changes in -current in the near future.

Revision 1.14 / (download) - annotate - [select for diffs], Tue Apr 27 23:57:19 2004 UTC (9 years, 1 month ago) by jonathan
Branch: MAIN
Changes since 1.13: +28 -2 lines
Diff to previous 1.13 (colored)

Update sys/netipsec/key.c to check for attempts to add IPv6-related
SPDs, and to warn about and reject any such attempts.

Addresses a security concern, that the (eas-yet incomplete, experimental)
FAST_IPSEC+INET6 does not honour IPv6 SPDs.  The security risk is that
Naive users may not realize this, and their data may get leaked in
cleartext, rather than IPsec'ed, if they use IPv6.

Security issue raised by: Thor Lancelot Simon
reviewed and OKed by: Thor Lancelot Simon

2.0 Pullup request after: 24 hours for further public comment.

Revision 1.13 / (download) - annotate - [select for diffs], Mon Apr 26 01:41:15 2004 UTC (9 years, 1 month ago) by matt
Branch: MAIN
Changes since 1.12: +2 -11 lines
Diff to previous 1.12 (colored)

Remove #else of #if __STDC__

Revision 1.12 / (download) - annotate - [select for diffs], Sun Apr 25 22:25:03 2004 UTC (9 years, 1 month ago) by jonathan
Branch: MAIN
Changes since 1.11: +21 -3 lines
Diff to previous 1.11 (colored)

Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).


NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.

Revision 1.11 / (download) - annotate - [select for diffs], Wed Mar 24 15:34:55 2004 UTC (9 years, 2 months ago) by atatat
Branch: MAIN
CVS Tags: netbsd-2-0-base
Branch point for: netbsd-2-0
Changes since 1.10: +32 -17 lines
Diff to previous 1.10 (colored)

Tango on sysctl_createv() and flags.  The flags have all been renamed,
and sysctl_createv() now uses more arguments.

Revision 1.10 / (download) - annotate - [select for diffs], Wed Mar 17 00:17:45 2004 UTC (9 years, 3 months ago) by jonathan
Branch: MAIN
Changes since 1.9: +10 -2 lines
Diff to previous 1.9 (colored)

Fix key_ismyaddr6() multicast test, as per sys/netkey/key.c NetBSD rev 1.112.

Revision 1.9 / (download) - annotate - [select for diffs], Tue Mar 2 02:22:56 2004 UTC (9 years, 3 months ago) by thorpej
Branch: MAIN
Changes since 1.8: +35 -15 lines
Diff to previous 1.8 (colored)

Bring the PCB policy cache over from KAME IPsec, including the "hint"
used to short-circuit IPsec processing in other places.

This is enabled only for NetBSD at the moment; in order for it to function
correctly, ipsec_pcbconn() must be called as appropriate.

Revision 1.8 / (download) - annotate - [select for diffs], Mon Mar 1 18:33:03 2004 UTC (9 years, 3 months ago) by thorpej
Branch: MAIN
Changes since 1.7: +3 -2 lines
Diff to previous 1.7 (colored)

Merge netkey/key.c rev 1.51 (wiz):

va_{start,end} audit:
Make sure that each va_start has one and only one matching va_end,
especially in error cases.
If the va_list is used multiple times, do multiple va_starts/va_ends.
If a function gets va_list as argument, don't let it use va_end (since
it's the callers responsibility).

Improved by comments from enami and christos -- thanks!

Heimdal/krb4/KAME changes already fed back, rest to follow.

Inspired by, but not not based on, OpenBSD.

Revision 1.7 / (download) - annotate - [select for diffs], Tue Feb 24 15:12:52 2004 UTC (9 years, 3 months ago) by wiz
Branch: MAIN
Changes since 1.6: +7 -7 lines
Diff to previous 1.6 (colored)

occured -> occurred. From Peter Postma.

Revision 1.6 / (download) - annotate - [select for diffs], Fri Dec 12 21:17:59 2003 UTC (9 years, 6 months ago) by scw
Branch: MAIN
Changes since 1.5: +15 -2 lines
Diff to previous 1.5 (colored)

Make fast-ipsec and ipflow (Fast Forwarding) interoperate.

The idea is that we only clear M_CANFASTFWD if an SPD exists
for the packet. Otherwise, it's safe to add a fast-forward
cache entry for the route.

To make this work properly, we invalidate the entire ipflow
cache if a fast-ipsec key is added or changed.

Revision 1.5 / (download) - annotate - [select for diffs], Fri Dec 12 21:04:03 2003 UTC (9 years, 6 months ago) by scw
Branch: MAIN
Changes since 1.4: +237 -8 lines
Diff to previous 1.4 (colored)

Add KEYCTL_DUMPSA/KEYCTL_DUMPSP support.
setkey(8)'s -D and -P options now work as expected with fast-ipsec.

Revision 1.4 / (download) - annotate - [select for diffs], Thu Dec 4 19:38:25 2003 UTC (9 years, 6 months ago) by atatat
Branch: MAIN
Changes since 1.3: +62 -51 lines
Diff to previous 1.3 (colored)

Dynamic sysctl.

Gone are the old kern_sysctl(), cpu_sysctl(), hw_sysctl(),
vfs_sysctl(), etc, routines, along with sysctl_int() et al.  Now all
nodes are registered with the tree, and nodes can be added (or
removed) easily, and I/O to and from the tree is handled generically.

Since the nodes are registered with the tree, the mapping from name to
number (and back again) can now be discovered, instead of having to be
hard coded.  Adding new nodes to the tree is likewise much simpler --
the new infrastructure handles almost all the work for simple types,
and just about anything else can be done with a small helper function.

All existing nodes are where they were before (numerically speaking),
so all existing consumers of sysctl information should notice no
difference.

PS - I'm sorry, but there's a distinct lack of documentation at the
moment.  I'm working on sysctl(3/8/9) right now, and I promise to
watch out for buses.

Revision 1.3 / (download) - annotate - [select for diffs], Mon Oct 6 22:05:15 2003 UTC (9 years, 8 months ago) by tls
Branch: MAIN
Changes since 1.2: +3 -3 lines
Diff to previous 1.2 (colored)

Reversion of "netkey merge", part 2 (replacement of removed files in the
repository by christos was part 1).  netipsec should now be back as it
was on 2003-09-11, with some very minor changes:

1) Some residual platform-dependent code was moved from ipsec.h to
   ipsec_osdep.h; without this, IPSEC_ASSERT() was multiply defined.  ipsec.h
   now includes ipsec_osdep.h

2) itojun's renaming of netipsec/files.ipsec to netipsec/files.netipsec has
   been left in place (it's arguable which name is less confusing but the
   rename is pretty harmless).

3) Some #endif TOKEN has been replaced by #endif /* TOKEN */; #endif TOKEN
   is invalid and GCC 3 won't compile it.

An i386 kernel with "options FAST_IPSEC" and "options OPENCRYPTO" now
gets through "make depend" but fails to build with errors in ip_input.c.
But it's better than it was (thank heaven for small favors).

Revision 1.2 / (download) - annotate - [select for diffs], Wed Aug 20 22:33:40 2003 UTC (9 years, 10 months ago) by jonathan
Branch: MAIN
Changes since 1.1: +4 -2 lines
Diff to previous 1.1 (colored)

opt_inet6.h is FreeBSD-specific, so wrap it with #ifdef __FreeBSD__/#endif.

Revision 1.1 / (download) - annotate - [select for diffs], Wed Aug 13 20:06:51 2003 UTC (9 years, 10 months ago) by jonathan
Branch: MAIN

Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the
OpenCryptoFramework (and thus hardware crypto accelerators) and
numerous detailed performance improvements.

This import is (aside from SPL-level names) the FreeBSD source,
imported ``as-is'' as a historical snapshot, for future maintenance
and comparison against the FreeBSD source.  For now, several minor
kernel-API differences are hidden by macros a shim file, ipsec_osdep.h,
which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Diffs between
and

Preferred Diff type:
View only Branch:
Sort log by:

CVSweb <webmaster@jp.NetBSD.org>