summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_ah.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-081-2/+44
| | | | OK bluhm@, mpi@
* Convert all the fields of {ah,esp,ipcomp}stat to uint64.visa2017-11-071-20/+21
| | | | | | This is a preliminary step for using percpu counters with the data. OK mpi@
* IPsec packets could be dropped unaccounted if output after cryptobluhm2017-02-071-5/+4
| | | | | failed. Add a counter for that case. OK dhill@
* Fix two bugs in IPsec/HMAC-SHA2:markus2010-01-101-4/+1
| | | | | | | | | | | | | | | (1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt
* add sysctl entry points into various network layers, in particular toderaadt2007-12-141-2/+5
| | | | provide netstat(1) with data it needs; ok claudio reyk
* switch to sysctl_int_arr(); ok henning, deraadtmarkus2004-02-171-1/+6
|
* Remove commons; inspired by netbsd.jason2003-02-121-2/+2
|
* whitespaceitojun2002-06-091-3/+3
|
* Copyright.angelos2001-06-251-5/+5
|
* Inclusion protection.angelos2001-06-091-4/+4
|
* Lots and lots of changes.angelos2000-09-191-3/+3
|
* Cryptographic services framework, and software "device driver". Theangelos2000-03-171-11/+12
| | | | | | | | | | | | | | | | | | | | idea is to support various cryptographic hardware accelerators (which may be (detachable) cards, secondary/tertiary/etc processors, software crypto, etc). Supports session migration between crypto devices. What it doesn't (yet) support: - multiple instances of the same algorithm used in the same session - use of multiple crypto drivers in the same session - asymmetric crypto No support for a userland device yet. IPsec code path modified to allow for asynchronous cryptography (callbacks used in both input and output processing). Some unrelated code simplification done in the process (especially for AH). Development of this code kindly supported by Network Security Technologies (NSTI). The code was writen mostly in Greece, and is being committed from Montreal.
* Merge "old" and "new" ESP and AH in two files (one for each).angelos2000-01-271-33/+9
| | | | | | | | Fix a couple of buglets with ingress flow deletion. tcpdump on enc0 should now show all outgoing packets *before* being processed, and all incoming packets *after* being processed. Good to be in Canada (land of the free commits).
* Add an ip4_input6() for use with IPv6 (just a wrapper forangelos2000-01-131-1/+5
| | | | ip4_input()), add prototype, ifdef include files.
* Add ingress ACL for IPsec: after being processed, IPsec packets areangelos2000-01-091-1/+2
| | | | | matched against a list of acceptable packet classes, if sysctl variable net.inet.ip.ipsec-acl is set to 1.
* fix IPv6 ipsec template lossage.itojun1999-12-311-2/+2
| | | | | | | | | | - previous code grabbed new nexthdr mistakingly - parameter passing must follow ip6protows (actually the code will never get called until in6_proto.c is updated) the current code assumes that {AH,ESP} is right next to IPv6 header. the assumption must be removed, but it means that we need to chase header chain...
* Change some function prototypes, dont unnecessarily initialize someangelos1999-12-251-2/+2
| | | | variables.
* Add v4/v6 wrapper routine definitions.angelos1999-12-091-1/+5
|
* New ah_new_input(), protocol-independent processing (still lackingangelos1999-12-071-1/+4
| | | | IPv6-specific protocol header processing).
* Get rid of unnecessary third argument in *_output routines of IPsec.angelos1999-10-291-3/+2
|
* Introduce net.inet.{ah,esp}.enable sysctl controls that are off by default.niklas1999-04-111-1/+19
| | | | | | If you are going to use either of AH or ESP or both, enable these in /etc/sysctl.conf. Also correct the IPSec debugging sysctl code, it is now named net.inet.ip.encdebug. Some corrected function signatures too.
* Update copyright; remove a few annoying debugging printfs.angelos1999-02-241-3/+5
| | | | Btw, OpenBSD hit 25000 commits a couple commits ago.
* Remove encap.h include; saner debugging printfs; fix buglets; work withangelos1999-02-241-97/+2
| | | | pfkeyv2.
* Add checks of packets getting to big after transforms.niklas1998-11-251-1/+2
| | | | Also make sure some more error conditions get told to the caller.
* first step to the setsockopt/getsockopt interface as described inprovos1998-05-181-10/+16
| | | | | | | draft-mcdonald-simple-ipsec-api, kernel notifies (EMT_REQUESTSA) signal userland key management applications when security services are requested. this is only for outgoing connections at the moment, incoming packets are not yet checked against the selected socket policy.
* add ripemd-160 as authentication function.provos1997-11-241-4/+7
|
* make it easier to add additional transforms. add blowfish and castprovos1997-11-041-21/+33
| | | | encryption. some more info for kernfs/ipsec.
* global byte counters.provos1997-07-141-1/+3
|
* put old esp/ah and new esp/ah in different files.provos1997-07-111-100/+68
| | | | generalised way of handling transforms.
* hard and soft limits for SPI's per absolute timer, relative since establish,provos1997-06-251-1/+2
| | | | | | relative since first use timers, packet and byte counters. notify key mgmt on soft limits. key mgmt can now specify limits. new encap messages: EMT_RESERVESPI, EMT_ENABLESPI, EMT_DISABLESPI
* ah-sha1 + esp-3des + indentationprovos1997-06-201-56/+77
|
* no more 2(two) md5 libs in kernel!mickey1997-03-301-2/+2
| | | | | | | tested for rnd(4).... should work for ip too, since it's the copy of ip_md*. use sys/md5k.h for protos.... std iface forever! hurray!
* I/O packet counters added.angelos1997-02-261-1/+3
|
* Beautification.angelos1997-02-241-9/+9
|
* OpenBSD tags + some prototyping policeniklas1997-02-241-0/+2
|
* IPSEC package by John Ioannidis and Angelos D. Keromytis. Written inderaadt1997-02-201-0/+162
Greece. From ftp.funet.fi:/pub/unix/security/net/ip/BSDipsec.tar.gz
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.