summaryrefslogtreecommitdiffstats
path: root/sys/net/pfkeyv2.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* PFKEY version 2 is the only pfkey version supported. No need for extraclaudio2017-05-291-5/+141
| | | | | abstraction. First step of making PF_KEY a bit more like PF_ROUTE. OK mpi@
* Push the NET_LOCK down into PF_KEY so that it can be treated like PF_ROUTE.claudio2017-05-271-4/+5
| | | | | | Only pfkeyv2_send() needs the NET_LOCK() so grab it at the start and release at the end. This should allow to push the locks down in other places. OK mpi@, bluhm@
* There is only one version of pfkey in OpenBSD and this will not change anyclaudio2017-05-261-27/+1
| | | | | time soon so remove all the code to support multiple pfkey versions. OK mpi@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-4/+4
| | | | ok visa@
* Expand SA_LEN(), there is no benefit for using the macro in thebluhm2017-05-051-14/+14
| | | | | kernel. It was only used in IPsec sources. No binary change OK deraadt@
* Depending on the addresses, ipsecctl(8) automatically groups sabluhm2017-02-281-2/+18
| | | | | | | | | | bundles together. Extend the kernel interface to export the bundle information to userland. Then ipsecctl -ss -v can show the internal relations. Unfortunately the header SADB_X_EXT_PROTOCOL was reused by SADB_X_GRPSPIS, so it cannot be used to transfer the second sa type with sysctl. Introduce a new SADB_X_EXT_SATYPE2 and use it consistently. OK hshoexer@ markus@
* Avoid some casts by using the sa field of union sockaddr_union.bluhm2017-02-241-19/+17
| | | | OK millert@
* Replace two recursive splsoftnet()/splx() dances with a splsoftassert().mpi2017-02-141-6/+4
| | | | ok mikeb@, bluhm@
* A space here, a space there. Soon we're talking real whitespacekrw2017-01-241-10/+10
| | | | rectification.
* Remove recursive splsoftnet() but use splsoftassert() instead.mpi2017-01-131-60/+19
| | | | Tested by Hrvoje Popovski, ok bluhm@
* all pools have their ipl set via pool_setipl, so fold it into pool_init.dlg2016-09-151-4/+3
| | | | | | | | | | | | | | | | | | | | | | the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
* pool_setipldlg2016-08-301-1/+2
| | | | ok markus@
* Remove plain DES encryption from IPsec.naddy2015-12-091-7/+1
| | | | | | | | | | DES is insecure since brute force attacks are practical due to its short key length. This removes support for DES-CBC encryption in ESP and in IKE main and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8). ok mikeb@
* manage spd entries by using the radix api directly instead ofblambert2015-07-171-43/+30
| | | | | | | | reaching around through the routing table original diff by myself, much improved by mikeb@ and mpi@ ok and testing mikeb@ mpi@
* introduce ipsec-id bundles and use them for ipsecflowinfo,markus2015-05-231-82/+37
| | | | | fixes rekeying for l2tp/ipsec against multiple windows clients and saves memory (for many SAs to same peers); feedback and ok mikeb@
* remove unfinished/unused support for socket-attached ipsec-policiesmarkus2015-04-161-11/+2
| | | | ok mikeb
* change {import,export}_identity so it can be used for policies; ok mikebmarkus2015-04-161-62/+17
| | | | (fixes sadb_ident_type conversion for policies)
* Remove support for storing credentials and auth information in the kernel.mikeb2015-04-141-99/+1
| | | | | | | | | This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
* Now that if_input() set the receiving interface pointer on mbufs for usmpi2015-04-131-2/+2
| | | | | | | | | | | | there's no need to do it in m_devget(9). Stop passing an ``ifp'' will help for upcoming interface pointer -> index conversion. While here remove unused ``ifp'' argument from m_clget(9) and kill two birds^W layer violations in one commit. ok henning@
* Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?mikeb2015-03-261-16/+2
| | | | ok markus, hshoexer
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-21/+1
| | | | | long live the one true internet. ok henning mikeb
* The proliferation of "struct route" in all its flavors didn't makempi2014-11-251-13/+7
| | | | | | | | | | | | | | any good to our network stack. The most visible effect is the maze of #ifdef's and casts. But the real problem is the very fragile way of checking if a (cached) route entry is still valid or not. What should we do if the route jumped to another ifaddr or if its gateway has been changed? This change start the dance of "struct route" & friends removal by sending the completly useless "struct route_enc" to the bucket. Tweak & ok claudio@
* Rename rtalloc1() into rtalloc(9) and convert its flags to only enablempi2014-11-011-3/+3
| | | | | | functionnality instead of a mix of enable/disable. ok bluhm@, jca@
* Use rtfree() instead of RTFREE(), NULLify some free'd route pointers andmpi2014-10-141-2/+2
| | | | | | kill the macro. ok mikeb@, henning@
* Kill rtalloc() and update rtalloc1() and rtalloc_mpath() to no longermpi2014-09-271-2/+3
| | | | | | rely on "struct route" that should die. ok claudio@
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-12/+12
| | | | after discussions with beck deraadt kettenis.
* Perform manual malloc/free of a large object in pfkeyv2_send() toderaadt2014-01-081-12/+19
| | | | | reduce stack space requirements. ok mikeb mpi
* get rid of the copy argument in m_devget that let you provide andlg2013-08-211-2/+2
| | | | | | | | | alternative to bcopy since noone uses it. while there use memcpy instead of bcopy because we know the memory cannot overlap. ok henning@ matthew@ mikeb@ deraadt@
* re-arrange the pre-accounting of the objects in the buffer so itderaadt2013-03-091-12/+12
| | | | is clearer; ok sthen
* Reserve space for source and destination addresses unconditionally rathersthen2013-02-261-6/+3
| | | | | | than checking if they're zero - export_address() is always called for these. Fixes memory corruption when doing ipsecctl -ssa with md5sig. Debugging hints from deraadt@, ok kettenis@ deraadt@
* change the malloc(9) flags from M_DONTWAIT to M_NOWAIT; OK millert@gsoares2012-12-281-15/+15
|
* add M_ZEROIZE as an mbuf flag, so copied PFKEY messages (with embedded keys)markus2012-09-261-7/+10
| | | | are cleared as well; from hshoexer@, feedback and ok bluhm@, ok claudio@
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-13/+13
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* pfkey needs some p_p->ps_pid too. OK deraadt@ guenther@claudio2012-03-281-3/+3
|
* Never include SADB_X_EXT_REMOTE_AUTH (which is either amikeb2011-01-121-1/+3
| | | | | | | | passphrase or an RSA key) in the reply message. There's nothing that justifies this behavior and PF_KEY RFC prefers to exclude keys and other sensitive material from replies. Discussed with reyk, no objections from deraadt.
* Retire Skipjackmikeb2010-10-061-7/+1
| | | | | | | | | | | There's not much use for the declassified cipher from the 80's with a questionable license these days. According to the FIPS drafts, Skipjack reaches its EOL in December 2010. The libc portion will be removed after the ports hackathon. djm and thib agree, no objections from deraadt Thanks to jsg for digging up FIPS drafts.
* a pool_get() assuming that PR_NOWAIT is 0 (not anymore!); run into by naddyderaadt2010-09-271-2/+2
|
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-34/+66
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* Allow to specify an alternative enc(4) interface for an SA. Allreyk2010-07-011-1/+12
| | | | | | | | | | | | | | | | | | | traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
* replace rtrequest() with corresponding rtrequest1() replacement.claudio2008-05-091-7/+12
| | | | OK henning@
* some spelling fixes from Martynas Venckusjmc2007-11-241-2/+2
|
* Convert MALLOC/FREE to malloc/free and use M_ZERO where applicable.hshoexer2007-09-131-34/+17
| | | | ok krw@
* since thehenning2007-09-011-1/+2
| | | | | | MGET* macros were changed to function calls, there wasn't any need for the pool declarations and the inclusion of pool.h From: tbert <bret.lambert@gmail.com>
* export the flow/filter information attached to the SA, too; ok hshoexer@markus2007-06-221-1/+29
|
* Consistently spell FALLTHROUGH to appease lint.jsg2007-02-141-2/+2
| | | | ok kettenis@ cloder@ tom@ henning@
* allow kernels with TCP_SIGNATURE (aka tcp md5sig), but without IPSEC tohenning2007-01-181-2/+7
| | | | | | compile and work. need to register pfkey whenever tcp md5 or ipsec is defined, and the various ipsec encapsulations only if ipsec is defined. ok theo
* add support to tag ipsec traffic belonging to specific IKE-initiatedreyk2006-11-241-1/+30
| | | | | | | | | | | phase 2 traffic. this allows policy-based filtering of encrypted and unencrypted ipsec traffic with pf(4). see ipsec.conf(5) and isakmpd.conf(5) for details and examples. this is work in progress and still needs some testing and feedback, but it is safe to put it in now. ok hshoexer@
* adjust functions dealing with the routing table to take a table ID ashenning2006-06-161-2/+2
| | | | | | parameter so they can work on alternate tables. table 0 hardcoded for many callers yet, that will be adapted step by step. input + ok claudio norby hshoexer
* Fix bracketing messed up in KNF commit 1.86, allows sasyncd to reliablymcbride2006-05-061-5/+5
| | | | | | set up pfkey promiscuous mode. Diff from Nathanael <list-openbsd-tech at polymorpheus dot com>
* export ipip flows, too; ok hshoexermarkus2005-12-061-1/+3
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.