summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_ipcomp.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* m_freem() can handle NULL, do not check for this condition beforehands.deraadt2015-07-151-5/+3
| | | | ok stsp mpi
* Use proper argument type for crp_callback functions; no functional change.mikeb2015-06-151-17/+11
|
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-4/+2
| | | | No objection from reyk@, OK markus, hshoexer
* make ipsp_address thread safe; ok mpimikeb2015-04-141-13/+27
|
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-3/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-12/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-3/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-10/+10
| | | | after discussions with beck deraadt kettenis.
* bpf code surgery / shuffling / simplification.henning2014-07-091-2/+2
| | | | | | | | | | | | | | | the various bpf_mtap_* are very similiar, they differ in what (and to some extent how) they prepend something, and what copy function they pass to bpf_catchpacket. use an internal _bpf_mtap as "backend" for bpf_mtap and friends. extend bpf_mtap_hdr so that it covers all common cases: if dlen is 0, nothing gets prepended. copy function can be given, if NULL the default bpf_mcopy is used. adjust the existing bpf_mtap_hdr users to pass a NULL ptr for the copy fn. re-implement bpf_mtap_af as simple wrapper for bpf_mtap_hdr. re-implement bpf_mtap_ether using bpf_map_hdr re-implement bpf_mtap_pflog as trivial bpf_mtap_hdr wrapper ok bluhm benno
* bzero/bcmp -> memset/memcmp. ok matthewtedu2014-01-091-4/+4
|
* Fix build with ENCDEBUG defined.mpi2013-05-141-1/+2
|
* Remove the extern keyword from function declarations, documentmpi2013-04-111-1/+4
| | | | | | | sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
* Merge of an original work by markus@ and gerhard@ to increasemikeb2013-02-141-2/+1
| | | | | the anti-replay window size to 2100 entries; plus small ESN related improvements. ok markus
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-3/+3
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzderaadt2011-07-071-2/+3
| | | | | | | | | | | | code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-3/+5
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsblambert2010-07-021-2/+2
| | | | | | | | | are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
* Allow to specify an alternative enc(4) interface for an SA. Allreyk2010-07-011-2/+2
| | | | | | | | | | | | | | | | | | | traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
* Replace enc(4) with a new implementation as a cloner device. We stillreyk2010-06-291-9/+14
| | | | | | | | | | create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
* remove dead stores and newly created unused variables.chl2008-09-151-5/+1
| | | | | | Found by LLVM/Clang Static Analyzer. ok mpf@ looks good mk@ ok henning@
* Oops. Forgot to do FREE -> free when I did MALLOC -> malloc.krw2007-10-061-10/+10
|
* MALLOC+bzero -> malloc+M_ZERO.krw2007-10-031-7/+3
| | | | | | | | In ip_esp.c all allocated memory is now zero'd in the "malloc(sizeof(*tc) + alen ..." case. The +alen memory was not initialized by the bzero() call. Noticed by chl@. "Looks good" art@ "seems ok" chl@
* allow bpf(4) to ignore packets based on their direction (inbound ordjm2006-03-251-2/+3
| | | | | outbound), using a new BIOCSDIRFILT ioctl; guidance, feedback and ok canacar@
* use M_READONLY when trying to find out whether we have to copymarkus2005-12-201-5/+4
| | | | | the mbuf before encryption. otherwise mbufs with M_EXT but w/o M_CLUSTER get modified; ok hshoexer
* Introduce bpf_mtap_af and bpf_mtap_hdr to be used when passing a mbuf chainpascoe2005-07-311-13/+5
| | | | | | | | | | to bpf with either an address family or other header added. These helpers only allocate a much smaller struct m_hdr on the stack when needed, rather than leaving 256 byte struct mbufs on the stack in deep call paths. Also removes a fair bit of duplicated code. commit now, tune after deraadt@
* resolve conflict between M_TUNNEL and M_ANYCAST6, remove M_COMP (it'smarkus2004-11-251-2/+1
| | | | only set and never read), update documentation; ok fgsch, deraadt, millert
* only add ipcomp headers if we've actually compressed the payload; with jfb@markus2004-06-261-77/+35
| | | | ok hshoexer, jfb
* m_copyback()'s 4th arg is const void *, nuke (caddr_t) casts.jason2003-08-141-3/+3
|
* o sanity check mbuf earlier.millert2003-04-021-28/+34
| | | | | | | o return errno, not NULL. o add some missing error values o proper crypto_freereq() in ip_ipcomp.c From Patrick Latifi; OK angelos@
* Avoid using FREEd data when we get a crypto error; Patrick Latifimillert2003-03-311-12/+16
| | | | | Also move the session ID reset into the crp_etype == EAGAIN case (noticed by angelos@). OK jason@ and angelos@
* Add missing splx; Patrick Latifimillert2003-03-311-1/+3
| | | | jason@ OK
* missed in lzs addition: allow LZS as an comp typejason2003-02-181-3/+4
|
* Remove commons; inspired by netbsd.jason2003-02-121-1/+3
|
* Fix max packet size check. Noticed by <j@pureftpd.org>. jjbg@ ok.ho2002-09-121-5/+4
|
* Free crp_opaque only after we've determined we're not going toangelos2002-07-051-3/+6
| | | | re-submit it. From sam@errno.com
* minor indent cleanup while reading codederaadt2002-06-201-11/+11
|
* Style.angelos2002-06-181-26/+13
|
* Initialize mo to NULL, for good measure -- sam@errno.comangelos2002-06-181-1/+2
|
* Missing freeing of crp, from sam@errno.comangelos2002-06-181-4/+4
|
* Fix double-free.angelos2002-06-181-12/+12
|
* whitespaceitojun2002-06-091-11/+11
|
* IPComp. Just like for deflate earlier, it won't be compiled until everythingjjbg2001-07-051-0/+725
is in the tree
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.