summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ip_spd.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* ipsec: use monotonic clock for SA creation/lookup timestamps; ok dlg@cheloha2018-10-221-3/+3
|
* Assert that the NET_LOCK() is held when iterating over `ipsec_acquire_head'.mpi2018-06-251-1/+3
| | | | ok visa@ as part of a larger bigger diff
* Fix kernel builds without IPSEC.reyk2018-05-161-1/+3
| | | | OK mikeb@
* Flush flows using the radix-tree instead of a global list.mpi2017-11-201-4/+9
| | | | | | This will allows us to get rid of the list. ok visa@
* Remove unused debug macro.mpi2017-11-071-7/+1
|
* Dump IPsec flows by iterating over the rafdix-tree.mpi2017-10-271-1/+15
| | | | | | This enforces an order and will allow us to get rid of the global list. ok millert@, visa@, markus@
* Last changes before running IPsec w/o KERNEL_LOCK().mpi2017-10-161-6/+32
| | | | | | | | | | Put more NET_ASSERT_LOCK() and document which globals it protects. Add a mutex for pfkeyv2 globals. Convert ipsp_delete_acquire() to timeout_set_proc(). Tested by Hrvoje Popovski, ok bluhm@ visa@
* Replace bcopy with a simple assignment where both variables aredhill2017-04-061-3/+3
| | | | | | | properly aligned and sockaddr_union fields, or with memcpy when the memory doesn't overlap. OK bluhm@
* Remove empty #ifdef and #ifndef blocksfcambus2016-09-271-5/+1
| | | | OK natano@
* all pools have their ipl set via pool_setipl, so fold it into pool_init.dlg2016-09-151-3/+2
| | | | | | | | | | | | | | | | | | | | | | the ioff argument to pool_init() is unused and has been for many years, so this replaces it with an ipl argument. because the ipl will be set on init we no longer need pool_setipl. most of these changes have been done with coccinelle using the spatch below. cocci sucks at formatting code though, so i fixed that by hand. the manpage and subr_pool.c bits i did myself. ok tedu@ jmatthew@ @ipl@ expression pp; expression ipl; expression s, a, o, f, m, p; @@ -pool_init(pp, s, a, o, f, m, p); -pool_setipl(pp, ipl); +pool_init(pp, s, a, ipl, f, m, p);
* pool_setipl for various netinet and netinet6 bitsdlg2016-09-061-1/+2
| | | | | | thank you to everyone who helped reviewed these diffs ok mpi@
* Initialize the routing table before domains.mpi2015-10-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | The routing table is not an optional component of the network stack and initializing it inside the "routing domain" requires some ugly introspection in the domain interface. This put the rtable* layer at the same level of the if* level. These two subsystem are organized around the two global data structure used in the network stack: - the global &ifnet list, to be used in process context only, and - the routing table which can be read in interrupt context. This change makes the rtable_* layer domain-aware and extends the "struct domain" such that INET, INET6 and MPLS can specify the length of the binary key used in lookups. This allows us to keep, or move towards, AF-free route and rtable layers. While here stop the madness and pass the size of the maximum key length in *byte* to rn_inithead0(). ok claudio@, mikeb@
* It is time to put inet6 on a diet. Use the flensing knife and cut outclaudio2015-09-101-3/+3
| | | | | the 3rd argument of in6_recoverscope() and make it return void. OK dlg@ mikeb@
* manage spd entries by using the radix api directly instead ofblambert2015-07-171-30/+61
| | | | | | | | reaching around through the routing table original diff by myself, much improved by mikeb@ and mpi@ ok and testing mikeb@ mpi@
* introduce ipsec-id bundles and use them for ipsecflowinfo,markus2015-05-231-39/+14
| | | | | fixes rekeying for l2tp/ipsec against multiple windows clients and saves memory (for many SAs to same peers); feedback and ok mikeb@
* Merge two identical if() statements in ipsp_acquire_sa(). Themillert2015-04-301-11/+7
| | | | | change in ip_spd.c 1.59 makes it appear that there is a cut & pasto. OK mikeb@
* remove unfinished/unused support for socket-attached ipsec-policiesmarkus2015-04-161-371/+20
| | | | ok mikeb
* Remove support for storing credentials and auth information in the kernel.mikeb2015-04-141-27/+14
| | | | | | | | | This code is largely unfinished and is not used for anything. The change leaves identities as only objects referenced by ipsec_ref structure and their handling requires some changes to support more advanced matching of IPsec connections. No objections from reyk and hshoexer, with and OK markus.
* Perform IPsec bypass check on a socket before performing TDB lookups.mikeb2015-04-131-12/+13
| | | | OK markus, hshoexer
* Rename gettdbbyaddr to gettdbbydst; OK markus, hshoexer, mpimikeb2015-04-131-4/+4
|
* Remove unused arguments from gettdb* functions; OK markus, hshoexer, mpimikeb2015-04-131-8/+7
|
* Remove some includes include-what-you-use claims don'tjsg2015-03-141-2/+1
| | | | | | | have any direct symbols used. Tested for indirect use by compiling amd64/i386/sparc64 kernels. ok tedu@ deraadt@
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-16/+1
| | | | | long live the one true internet. ok henning mikeb
* The proliferation of "struct route" in all its flavors didn't makempi2014-11-251-16/+12
| | | | | | | | | | | | | | any good to our network stack. The most visible effect is the maze of #ifdef's and casts. But the real problem is the very fragile way of checking if a (cached) route entry is still valid or not. What should we do if the route jumped to another ifaddr or if its gateway has been changed? This change start the dance of "struct route" & friends removal by sending the completly useless "struct route_enc" to the bucket. Tweak & ok claudio@
* Rename rtalloc1() into rtalloc(9) and convert its flags to only enablempi2014-11-011-3/+3
| | | | | | functionnality instead of a mix of enable/disable. ok bluhm@, jca@
* Use rtfree() instead of RTFREE(), NULLify some free'd route pointers andmpi2014-10-141-3/+3
| | | | | | kill the macro. ok mikeb@, henning@
* Kill rtalloc() and update rtalloc1() and rtalloc_mpath() to no longermpi2014-09-271-2/+3
| | | | | | rely on "struct route" that should die. ok claudio@
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* "struct pkthdr" holds a routing table ID, not a routing domain one.mpi2014-04-141-2/+2
| | | | | | | | | | | | | | Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
* bzero/bcmp -> memset/memcmp. ok matthewtedu2014-01-091-32/+26
|
* Remove the number of in6_var.h inclusions by moving some functions andmpi2013-10-241-2/+1
| | | | | | global variables to in6.h. ok deraadt@
* Remove the number of in_var.h inclusions by moving some functions andmpi2013-10-231-2/+1
| | | | | | global variables to in.h. ok mikeb@, deraadt@
* Fix build with ENCDEBUG defined.mpi2013-05-141-1/+2
|
* Remove the extern keyword from function declarations, documentmpi2013-04-111-1/+8
| | | | | | | sysctl declarations, move variables and functions used in only one place in their corresponding file. No functional change. No objection from markus@, ok mikeb@
* code that calls timeout functions should include timeout.htedu2013-03-281-1/+2
| | | | | slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
* add IP_IPSECFLOWINFO option to sendmsg() and recvmsg(), so npppd(4)markus2012-07-161-5/+21
| | | | | | | can use this to select the IPsec tunnel for sending L2TP packets. this fixes Windows (always binding to 1701) and Android clients (negotiating wildcard flows); feedback mpf@ and yasuoka@; ok henning@ and yasuoka@; ok jmc@ for the manpage
* missing PR_NOWAITderaadt2010-09-281-2/+2
|
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-7/+19
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* don't reference an item after it has been returned to the pooldavid2010-07-021-3/+3
| | | | | | an 8 year old bug exposed by recent uvm changes ok thib@ tedu@ deraadt@
* Replace pool_get() + bzero() with pool_get(..., PR_ZERO).chl2010-01-151-6/+3
| | | | | | With input from oga@ and krw@ ok oga@ krw@ thib@ markus@ mk@
* In IPsec acquire mode, if the flow was configured for the "any"bluhm2009-01-271-13/+5
| | | | | | | | | | | | | | | | | network 0.0.0.0/0 or ::/0, the SA was established for the IP address in the packet instead of the network in the flow. That means the SA was not negotiated for the network 0.0.0.0 with mask 0 but for the remote IP with mask 255.255.255.255. This SA did not match the flow and did not work. To differentiate between general flows that are used to trigger specific host-to-host SAs and flows for matching network SAs, the if condition only uses the ipo->ipo_dst field now. For a flow without peer, an SA must be negotiated for each host-to-host combination. Otherwise, if a peer exists at the flow, the kernel acquires one SA for the whole network. tested by todd@, ok hshoexer@, angelos@, todd@
* Convert timeout_add() calls using multiples of hz to timeout_add_sec()blambert2008-09-101-2/+2
| | | | | | | Really just the low-hanging fruit of (hopefully) forthcoming timeout conversions. ok art@, krw@
* Assign the struct size to sin6_len instead of sin6_family.bluhm2008-07-221-2/+2
| | | | ok hshoexer claudio mpf henning
* 0 -> PR_NOWAIT (which is defined as 0) in pool_getblambert2008-06-111-2/+2
| | | | | | as an aid to readability ok and thinko-catching henning@
* more rtrequest() to rtrequest1() replacement.claudio2008-05-091-6/+9
| | | | OK henning@
* since thehenning2007-09-011-1/+2
| | | | | | MGET* macros were changed to function calls, there wasn't any need for the pool declarations and the inclusion of pool.h From: tbert <bret.lambert@gmail.com>
* Consistently spell FALLTHROUGH to appease lint.jsg2007-02-141-5/+5
| | | | ok kettenis@ cloder@ tom@ henning@
* adjust functions dealing with the routing table to take a table ID ashenning2006-06-161-2/+2
| | | | | | parameter so they can work on alternate tables. table 0 hardcoded for many callers yet, that will be adapted step by step. input + ok claudio norby hshoexer
* miscellaneous typo fixes:jfb2005-02-171-2/+2
| | | | | | | - sturct -> struct (spotted by pedro) - elimination of consecutive 'the' words ok jmc@, henning@, krw@, robert@, some whining by jolan@
* First step towards more sane time handling in the kernel -- this changestholo2004-06-211-5/+5
| | | | | | | | things such that code that only need a second-resolution uptime or wall time, and used to get that from time.tv_secs or mono_time.tv_secs now get this from separate time_t globals time_second and time_uptime. ok art@ niklas@ nordin@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.