summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_ipcomp.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* remove the "copy function" argument to bpf_mtap_hdr.dlg2019-09-301-2/+2
| | | | | | | | it was previously (ab)used by pflog, which has since been fixed. apart from that nothing else used it, so we can trim the cruft. ok kn@ claudio@ visa@ visa@ also made sure i fixed ipw(4) so i386 won't break.
* Include the size of IPCOMP header when checking for compression.mpi2018-09-131-2/+2
| | | | Problem found and anaylyzed by Romain Gabet, ok markus@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-3/+6
| | | | | | userland. Inputs from markus@, ok sthen@
* Fix for uninitialized variables.mpi2018-07-161-4/+4
| | | | Found by and ok jsg@, ok markus@
* Introduce ipsec_output_cb() to merge duplicate code and account formpi2018-07-121-58/+16
| | | | | | | | dropped packets in the output path. While here fix a memory leak when compression is not needed w/ IPcomp. ok markus@
* Convert AH & IPcomp to ipsec_input_cb() and count drops on input.mpi2018-07-111-57/+11
| | | | ok markus@
* Cleanup IPsec IPComp error handling with consistent goto drop.bluhm2018-05-121-44/+41
| | | | from markus@; OK mpi@
* Do not assume that mbufs within a chain do not have M_PKTHDR set.bluhm2018-05-021-7/+20
| | | | | | | | | | This could happen during fragment reassembly. Better check if we are dealing with the first mbuf of the chain. m_adj() changes the length of the mbuf, obviously. So when using this length to calulate the amount of adjustment, do not calculate it again after m_adj() with wrong input. Use a temporary variable to save the value. from Maxime Villard, NetBSD; OK markus@ claudio@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-081-25/+23
| | | | OK bluhm@, mpi@
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-061-28/+26
| | | | ok kettenis@, dhill@, visa@, jca@
* Remove NET_LOCK()'s argument.mpi2017-08-111-12/+12
| | | | Tested by Hrvoje Popovski, ok bluhm@
* Replace 2 bcopy()'s with a simple assignment as both variables aredhill2017-04-051-5/+5
| | | | | | | properly aligned malloc(9)d data and sockaddr_union fields. While here, convert the remaining bcopy() to memmove(). with and ok @bluhm
* Using ipcomp(4) with IPv6 transport mode failed with protocol familybluhm2017-02-171-1/+2
| | | | | | not supported. A break in the af switch statement was missing since revision 1.1 from 2001. OK visa@ deraadt@
* Put back a return that I have removed by accident.bluhm2017-02-091-1/+2
|
* IPsec packets could be dropped unaccounted if output after cryptobluhm2017-02-071-5/+5
| | | | | failed. Add a counter for that case. OK dhill@
* Reduce the per-packet allocation costs for crypto operations (cryptop)patrick2017-02-071-3/+3
| | | | | | | | | | | | | | by pre-allocating two cryptodesc objects and storing them in an array instead of a linked list. If more than two cryptodesc objects are required use mallocarray to fetch them. Adapt the drivers to the new API. This change results in one pool-get per ESP packet instead of three. It also simplifies softraid crypto where more cryptodesc objects are allocated than used. From, with and ok markus@, ok bluhm@ "looks sane" mpi@
* The return code of crp_callback is never checked, so it is notbluhm2017-02-071-30/+20
| | | | | | | | useful to propagate the error. When an error occurs in an asynchronous network path, incrementing a counter is the right thing. There are four places where an error is not accounted, just add a comment for now. OK mpi@ visa@
* Grab the NET_LOCK() in ipcomp input callback.visa2017-01-091-5/+5
| | | | OK mikeb@ mpi@
* Grab the NET_LOCK() before calling ipsp_process_done() as it ends upmpi2016-12-241-6/+6
| | | | | | in ip_output(). Found the hardway by and ok kettenis@
* ANSIfy netinet/; from David Hillnaddy2016-09-241-18/+6
|
* avoid extensive mbuf allocation for IPsec by replacing m_inject(4)markus2016-09-131-4/+4
| | | | with m_makespace(4) from freebsd; ok mpi@, bluhm@, mikeb@, dlg@
* fix panics caused by replacing m_copym2 with m_dup_pkt.dlg2016-08-181-14/+7
| | | | | | | | | | | | | | | | m_copym2 is fine duplicating an arbitrary chain of mbufs, while m_dup_pkt wants to dup a packet with proper headers in the first mbuf. ipsec copied the tail of an mbuf if any of the clusters are shared or readonly, and swapped that tail with the result of m_copym2. m_dup_pkt panics cos of that. this makes ipsec duplicate the whole packet if any of the chain is readonly. found by naddy@ and mlarkin@ this fix is from visa@ who told me to commit it cos he's afk (sleeping) tested by naddy@
* replace the last uses of m_copym2 with m_dup_pkt.dlg2016-08-151-2/+2
| | | | ok mpi@ visa@
* m_freem() can handle NULL, do not check for this condition beforehands.deraadt2015-07-151-5/+3
| | | | ok stsp mpi
* Use proper argument type for crp_callback functions; no functional change.mikeb2015-06-151-17/+11
|
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-4/+2
| | | | No objection from reyk@, OK markus, hshoexer
* make ipsp_address thread safe; ok mpimikeb2015-04-141-13/+27
|
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-3/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-12/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* move arc4random prototype to systm.h. more appropriate for most codetedu2014-11-181-3/+1
| | | | to include that than rdnvar.h. ok deraadt dlg
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* add a size argument to free. will be used soon, but for now default to 0.tedu2014-07-121-10/+10
| | | | after discussions with beck deraadt kettenis.
* bpf code surgery / shuffling / simplification.henning2014-07-091-2/+2
| | | | | | | | | | | | | | | the various bpf_mtap_* are very similiar, they differ in what (and to some extent how) they prepend something, and what copy function they pass to bpf_catchpacket. use an internal _bpf_mtap as "backend" for bpf_mtap and friends. extend bpf_mtap_hdr so that it covers all common cases: if dlen is 0, nothing gets prepended. copy function can be given, if NULL the default bpf_mcopy is used. adjust the existing bpf_mtap_hdr users to pass a NULL ptr for the copy fn. re-implement bpf_mtap_af as simple wrapper for bpf_mtap_hdr. re-implement bpf_mtap_ether using bpf_map_hdr re-implement bpf_mtap_pflog as trivial bpf_mtap_hdr wrapper ok bluhm benno
* bzero/bcmp -> memset/memcmp. ok matthewtedu2014-01-091-4/+4
|
* Fix build with ENCDEBUG defined.mpi2013-05-141-1/+2
|
* Remove the extern keyword from function declarations, documentmpi2013-04-111-1/+4
| | | | | | | sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
* Merge of an original work by markus@ and gerhard@ to increasemikeb2013-02-141-2/+1
| | | | | the anti-replay window size to 2100 entries; plus small ESN related improvements. ok markus
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-3/+3
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* Replace the cruddy old sys/net/zlib.[ch]. We now use the sys/lib/libzderaadt2011-07-071-2/+3
| | | | | | | | | | | | code. Missing chunks of the API are imported from the libc version, with a few #ifdef's to port it into the kernel environment. The bootblocks already used the newer code, and should encounter no surprises since there are so few changes to the existing files. In the kernel, ipcomp and kernel ppp are changed to the new API. ipcomp has been tested. ok tedu the brave
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-3/+5
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* m_copyback can fail to allocate memory, but is a void fucntion so gymnasticsblambert2010-07-021-2/+2
| | | | | | | | | are required to detect that. Change the function to take a wait argument (used in nfs server, but M_NOWAIT everywhere else for now) and to return an error ok claudio@ henning@ krw@
* Allow to specify an alternative enc(4) interface for an SA. Allreyk2010-07-011-2/+2
| | | | | | | | | | | | | | | | | | | traffic for this SA will appear on the specified enc interface instead of enc0 and can be filtered and monitored separately. This will allow to group individual ipsec policies to virtual interfaces and simplifies monitoring and pf filtering with many ipsec policies a lot. This diff includes the following changes: - Store the enc interface unit (default 0) in the TDB of an SA and pass it to the enc_getif() lookup when running the bpf or pf_test() handlers. - Add the pfkey SADB_X_EXT_TAP extension to communicate the encX interface unit for a specified SA between userland and kernel. - Update enc(4) again to use an allocate array instead of the TAILQ to lookup the matching enc interface in enc_getif() quickly. Discussed with many, tested by a few, will need more testing & review. ok deraadt@
* Replace enc(4) with a new implementation as a cloner device. We stillreyk2010-06-291-9/+14
| | | | | | | | | | create enc0 by default, but it is possible to add additional enc interfaces. This will be used later to allow alternative encs per policy or to have an enc per rdomain when IPsec becomes rdomain-aware. manpage bits ok jmc@ input from henning@ deraadt@ toby@ naddy@ ok henning@ claudio@
* remove dead stores and newly created unused variables.chl2008-09-151-5/+1
| | | | | | Found by LLVM/Clang Static Analyzer. ok mpf@ looks good mk@ ok henning@
* Oops. Forgot to do FREE -> free when I did MALLOC -> malloc.krw2007-10-061-10/+10
|
* MALLOC+bzero -> malloc+M_ZERO.krw2007-10-031-7/+3
| | | | | | | | In ip_esp.c all allocated memory is now zero'd in the "malloc(sizeof(*tc) + alen ..." case. The +alen memory was not initialized by the bzero() call. Noticed by chl@. "Looks good" art@ "seems ok" chl@
* allow bpf(4) to ignore packets based on their direction (inbound ordjm2006-03-251-2/+3
| | | | | outbound), using a new BIOCSDIRFILT ioctl; guidance, feedback and ok canacar@
* use M_READONLY when trying to find out whether we have to copymarkus2005-12-201-5/+4
| | | | | the mbuf before encryption. otherwise mbufs with M_EXT but w/o M_CLUSTER get modified; ok hshoexer
* Introduce bpf_mtap_af and bpf_mtap_hdr to be used when passing a mbuf chainpascoe2005-07-311-13/+5
| | | | | | | | | | to bpf with either an address family or other header added. These helpers only allocate a much smaller struct m_hdr on the stack when needed, rather than leaving 256 byte struct mbufs on the stack in deep call paths. Also removes a fair bit of duplicated code. commit now, tune after deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.