summaryrefslogtreecommitdiffstats
path: root/sys/net/pfkeyv2.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Make sure that the address families of a flow's source address,tobhe2020-12-141-7/+23
| | | | | | destination address and their netmasks match, otherwise return EINVAL. ok bluhm@ patrick@
* Make sure not to pass NULL to explicit_bzero().tobhe2020-08-281-2/+3
| | | | | | Fixes CID 1496732. ok patrick@
* pfkey_get may allocate more memory than is needed to hold the SAtobhe2020-08-071-12/+16
| | | | | | information. Make sure to only copy out actually used memory. ok patrick@
* Use PFKEYV2_LIFETIME_CURRENT instead of magic number.tobhe2020-08-051-2/+2
| | | | ok patrick@
* Make sure to explicit_bzero() buffers holding sensitive SA data.tobhe2020-07-211-6/+11
| | | | ok kn@, patrick@
* Add size to free(9) callskn2020-07-181-29/+33
| | | | | | | | | | | pfkeyv2_send() allocates multiple buffers using the same variable `i' to calculate their sizes, use dedicated size variables for each buffer to reuse them with free(9). For this, make pfkeyv2_policy() pass back the size of its freshly allocated buffer. Tested, feedback and OK tobhe
* Add size to free(9) callskn2020-07-181-5/+6
| | | | | | | | | | pfkeyv2_get() and pfkeyv2_dump_policy() allocate buffers and can pass back their sizes, those sizes are already used during copyout() and such. Make one pfkeyv2_dump_policy() call pass back the size and reuse all sizes in the respective free(9) calls. Tested and OK tobhe
* Add sizes to free(9) callskn2020-07-151-6/+6
| | | | | | | All of these buffers are cleared with explicit sizes before free(), so reuse the given sizes. tested and OK tobhe
* Add support for autmatically moving traffic between rdomains on ipsec(4)tobhe2020-04-231-7/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | encryption or decryption. This allows us to keep plaintext and encrypted network traffic seperated and reduces the attack surface for network sidechannel attacks. The only way to reach the inner rdomain from outside is by successful decryption and integrity verification through the responsible Security Association (SA). The only way for internal traffic to get out is getting encrypted and moved through the outgoing SA. Multiple plaintext rdomains can share the same encrypted rdomain while the unencrypted packets are still kept seperate. The encrypted and unencrypted rdomains can have different default routes. The rdomains can be configured with the new SADB_X_EXT_RDOMAIN pfkey extension. Each SA (tdb) gets a new attribute 'tdb_rdomain_post'. If this differs from 'tdb_rdomain' then the packet is moved to 'tdb_rdomain_post' afer IPsec processing. Flows and outgoing IPsec SAs are installed in the plaintext rdomain, incoming IPsec SAs are installed in the encrypted rdomain. IPCOMP SAs are always installed in the plaintext rdomain. They can be viewed with 'route -T X exec ipsecctl -sa' where X is the rdomain ID. As the kernel does not create encX devices automatically when creating rdomains they have to be added by hand with ifconfig for IPsec to work in non-default rdomains. discussed with chris@ and kn@ ok markus@, patrick@
* Plug mem leak in SADB_REGISTER.mpi2020-03-181-14/+15
| | | | From Benjamin Baier, ok tobhe@
* Convert struct pkpcb malloc(9) to pool_get(9). PCB for pfkey isbluhm2019-07-171-4/+7
| | | | | | | | only used in process context, so pass PR_WAITOK to pool_init(9). The possible sleep in pool_put(9) should not hurt as pfkeyv2_detach() is only called by soclose(9). As both pr_attach() and pr_detach() are always called with kernel lock, PR_RWLOCK is not needed. OK mpi@
* Avoid an mbuf double free in the oob soreceive() path. In thebluhm2019-02-041-6/+6
| | | | | | | | | | usrreq functions move the mbuf m_freem() logic to the release block instead of distributing it over the switch statement. Then the goto release in the initial check, whether the pcb still exists, will not free the mbuf for the PRU_RCVD, PRU_RVCOOB, PRU_SENSE command. OK claudio@ mpi@ visa@ Reported-by: syzbot+8e7997d4036ae523c79c@syzkaller.appspotmail.com
* Export per-TDB counters to userland.mpi2019-02-011-2/+6
| | | | | | This time add the counter extention to SADB_GET's whitelist. ok bluhm@, visa@
* Do not silently return if extensions do not match the filters.mpi2019-02-011-3/+7
| | | | ok bluhm@, visa@
* Fix an off-by-one in pfkeyv2_sysctl_policydumper() and get rid of ampi2019-01-131-2/+2
| | | | | | workaround for this bug. ok visa@
* Fix the IPL of pfkeyv2_mtx to prevent a deadlock. The system can usevisa2018-12-181-2/+2
| | | | | | | | the mutex with and without the kernel lock. Prompted by WITNESS. OK deraadt@ kettenis@
* Stop exporting TDB counters to userland, this change introduced ampi2018-09-121-6/+2
| | | | | | regression with iked(8). Reported by Mark Patruck.
* Cadd a TDB `tdb' instead of `sa'.mpi2018-08-311-78/+78
| | | | | | No functionnal change. ok deraadt@, bluhm@, visa@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-2/+6
| | | | | | userland. Inputs from markus@, ok sthen@
* Remove net/raw_cb.h from includes and replace the RAWSNDQ, RAWRCVQ withclaudio2018-07-101-3/+4
| | | | | protocol specific ones. OK mpi@
* After removing raw_usrreq() from route and pfkey, the global sockaddrbluhm2018-07-101-2/+2
| | | | | variables can be delared constant. OK claudio@ mpi@
* Inline the raw_usrreq() function into pfkeyv2_usrreq(). Similar to theclaudio2018-07-091-10/+75
| | | | | | change to rtsock.c. This simplifies the pfkey code since there is no special wrapping needed and in general the PRU cases get easier. OK bluhm@ henning@ mpi@
* Push the NET_LOCK() down in pfkeyv2_send().mpi2018-06-251-36/+99
| | | | | | While here document which field of the PCB is protected by which lock. ok visa@
* Use the socket lock rather than the KERNEL_LOCK() in pfkey_sendup().mpi2018-06-201-31/+51
| | | | inputs & ok visa@
* Rename routing & pfkey tables for coherency with other PCB tables.mpi2018-06-111-41/+41
| | | | ok claudio@
* Prefix fields of pfkey & routing PCBs, part 2, no functionnal change.mpi2018-06-061-35/+36
| | | | ok tb@
* Prefix fields of pfkey & routing PCBs, no functionnal change.mpi2018-06-061-17/+14
| | | | ok visa@, tb@
* Asseert that a pfkey or routing socket is referenced by a `fp' insteadmpi2018-06-061-2/+3
| | | | | | | | | | | | | of calling sofree(), when its PCB is detached. This is different from TCP which does not always detach `inpcb's from sockets. In the pfkey & routing case caling sofree() there is a noop whereas for TCP it's needed to free closed connections. Having fewer sofree() makes it easier to understand the code and move the locks down. ok visa@
* As long we have no per socket locking, we must grab either net lockbluhm2018-05-191-1/+4
| | | | | | | or kernel lock when accessing a socket. For pf key sockets it is kernel lock, so add its protection in pfkey_sendup(). Fixes a kernel lock assertion panic reported by Peter J. Philipp. OK mpi@ visa@
* Fix kernel builds without IPSEC.reyk2018-05-161-2/+3
| | | | OK mikeb@
* Use a SRP list to protect pfkeyv2 sockets, thus removing the need tompi2018-05-141-32/+64
| | | | | | | | grab the KERNEL_LOCK() when delivering messages. This is the same solution already used by routing sockets. ok claudio@, visa@
* Introduce rtm_sendup() a function to deliver routing messages to ampi2018-05-081-7/+7
| | | | | | | | | socket receive buffer. It is modelled after pfkey_sendup() as both will need the same MP treatment. ok tb@, bluhm@, visa@
* Remove almost unused `flags' argument of suser().mpi2018-02-191-3/+3
| | | | | | | The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
* Flush flows using the radix-tree instead of a global list.mpi2017-11-201-10/+19
| | | | | | This will allows us to get rid of the list. ok visa@
* Grab the KERNEL_LOCK() to iterate on the global list of PF_KEY sockets.mpi2017-11-131-2/+15
| | | | | | | | | | | It isn't safe to manipulate PF_KEY sockets without KERNEL_LOCK() because they aren't protected by the NET_LOCK(). I missed this in my previous audit and neither my tests, the regression tests nor the IPsec performance tests exposed the problem. Hopefully I added the right check to soassertlocked() a while back. Found the hardway by and ok sthen@
* Only use a single taskq to process incoming network packets as soon asmpi2017-11-121-1/+9
| | | | | | | | | | IPsec is enabled. This is currently a no-op since we still use a single taskq. But it will allows us to experiment with multiple forwarding threads and the PF_LOCK() without having to fix IPsec at the same time. ok sashan@, visa@
* After inlining of raw_detach we know the sizes for free; pointed outflorian2017-11-031-2/+2
| | | | by & OK mpi, input & OK visa
* Inline trivial functions from raw_cb.c and tedu it.florian2017-11-031-3/+10
| | | | Suggested by and OK mpi, OK visa
* Move PRU_DETACH out of pr_usrreq into per proto pr_detachflorian2017-11-021-10/+6
| | | | | | functions to pave way for more fine grained locking. Suggested by, comments & OK mpi
* Dump IPsec flows by iterating over the rafdix-tree.mpi2017-10-271-20/+5
| | | | | | This enforces an order and will allow us to get rid of the global list. ok millert@, visa@, markus@
* Last changes before running IPsec w/o KERNEL_LOCK().mpi2017-10-161-14/+35
| | | | | | | | | | Put more NET_ASSERT_LOCK() and document which globals it protects. Add a mutex for pfkeyv2 globals. Convert ipsp_delete_acquire() to timeout_set_proc(). Tested by Hrvoje Popovski, ok bluhm@ visa@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-091-3/+5
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* If you use sys/param.h, you don't need sys/types.hderaadt2017-09-081-2/+1
|
* Remove NET_LOCK()'s argument.mpi2017-08-111-4/+4
| | | | Tested by Hrvoje Popovski, ok bluhm@
* Consistantly use kp as the var name for struct keycb.claudio2017-07-261-35/+34
| | | | Suggested by and OK bluhm@ OK mpi@
* Both PF_ROUTE and PF_KEY need to start to take care of their own PCB listclaudio2017-07-031-81/+71
| | | | | | | to simplify the locking of those lists. For now move the LIST_ENTRY from rawcb into routecb and in the pfkey case a new keycb. Do some cleanup and renaming in the pfkey code but more to come. OK bluhm@ mpi@
* Assert that the corresponding socket is locked when manipulating socketmpi2017-06-261-4/+4
| | | | | | | | | | | | | | | | buffers. This is one step towards unlocking TCP input path. Note that all the functions asserting for the socket lock are not necessarilly MP-safe. All the fields of 'struct socket' aren't protected. Introduce a new kernel-only kqueue hint, NOTE_SUBMIT, to be able to tell when a filter needs to lock the underlying data structures. Logic and name taken from NetBSD. Tested by Hrvoje Popovski. ok claudio@, bluhm@, mikeb@
* Allow updating the destination address of an existing TDB. Since thepatrick2017-06-261-1/+10
| | | | | | | | | destination address is used as an index when looking for a TDB, we need to supply the new destination address in a different member. For this, re-use the proxy address, that so far no one else has been using. It would make sense to rename this member in the future. ok claudio@
* Replace handrolled list with LIST_* macros. OK mpi@claudio2017-05-291-33/+29
|
* Kill struct pfkey_version and move struct pfkeyv2_socket & dump_stateclaudio2017-05-291-1/+15
| | | | | to pfkeyv2.c. These structs are nowhere else needed. OK gcc
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.