summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ipsec_input.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-4/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* Initialize the TDB to NULL in ipsec_common_input() andmestre2018-09-141-3/+3
| | | | | | | | | | ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus mbuf (NULL) we don't end up trying to dereference the TDB, while being an uninitialized pointer, to increase the drops. Coverity IDs 1473312, 1473313 and 1473317. OK mpi@ visa@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-3/+15
| | | | | | userland. Inputs from markus@, ok sthen@
* Convert AH & IPcomp to ipsec_input_cb() and count drops on input.mpi2018-07-111-3/+9
| | | | ok markus@
* Introduce new IPsec (per-CPU) statistics and refactor ESP inputmpi2018-07-101-15/+110
| | | | | | | | | | callbacks to be able to count dropped packet. Having more generic statistics will help troubleshooting problems with specific tunnels. Per-TDB counters are coming once all the refactoring bits are in. ok markus@
* When checking the IPsec enable sysctls, ipsec_common_input() hadbluhm2018-05-141-25/+43
| | | | | | | | | | | | switches for protocol and address family. Move this code to the specific functions from where the common function is called. As a consequence the raw ip input functions can never be called from udp_input() anymore. If IPsec is disabled, the functions ah6_input(), esp6_input(), and ipcomp6_input() do not start processing the header chain. The raw ip input functions are called with the mbuf and offset pointers from the protocol walking loop which is the usual behavior. OK mpi@ markus@
* Cleanup IPsec common input error handling with consistent goto drop.bluhm2018-05-121-24/+27
| | | | from markus@; OK mpi@
* Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningmpi2017-11-201-1/+2
| | | | | | pr_input handlers without KERNEL_LOCK(). ok visa@
* Introduce ipsec_sysctl() and move IPsec tunables where they belong.mpi2017-11-141-1/+62
| | | | ok bluhm@, visa@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-081-78/+98
| | | | OK bluhm@, mpi@
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-061-37/+34
| | | | ok kettenis@, dhill@, visa@, jca@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-091-16/+43
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-051-16/+2
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-191-13/+7
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* Rename ip_local() to ip_deliver() and give it the same parametersbluhm2017-05-281-4/+4
| | | | | | | as the pr_input functions. Add an assert that IPv4 delivery ends in IP proto done to assure that IPv4 protocol functions work like IPv6. OK mpi@
* Move IPsec forward and local policy check functions to ipsec_input.cbluhm2017-05-221-1/+96
| | | | | and give them better names. input and OK mikeb@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-3/+3
| | | | ok visa@
* IPsec packets were passed through ip_input() a second time afterbluhm2017-05-121-33/+27
| | | | | | | | | | | | | | | | they have been decrypted. That means that all the IP header fields were checked twice. Also fragment reassembly was tried twice. At pf incoming packets in tunnel mode appeared twice on the enc0 interface, once as IP-in-IP and once as the inner packet. In the outgoing path pf only sees the inner packet. Asymmetry is bad for stateful filtering. IPv6 shows that IPsec works without that. After decrypting immediately continue with local delivery. In tunnel mode the IP-in-IP protocol functions pass the inner header to ip6_input(). In transport mode only pf_test() has to be called for the enc0 device. Introduce ip_local() to avoid needless processing and cleaner pf behavior in IPv4 IPsec. OK mikeb@
* Instead of printing a debug message at the end of processing, panicbluhm2017-05-121-19/+21
| | | | | | | early if the IPsec security protocol is unknown. ipsec_common_input() and ipsec_common_input_cb() can only be called with the IP protocols ESP, AH, or IPComp. Everything else is a programming mistake. OK claudio@
* IPv6 IPsec transport mode did not work if pf is enabled. Thebluhm2017-05-111-1/+27
| | | | | | | | decrypted packets in the input path were not checked with pf. So with stateful filtering on enc0, direction aware protocols like ping or TCP did not pass. Add an explicit pf_test() in ipsec_common_input_cb() for IPv6 transport mode to fix this. OK mikeb@
* Expand SA_LEN(), there is no benefit for using the macro in thebluhm2017-05-051-3/+3
| | | | | kernel. It was only used in IPsec sources. No binary change OK deraadt@
* Pass down the address family through the pr_input calls. Thisbluhm2017-04-141-9/+9
| | | | | allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
* Replace bcopy with a simple assignment where both variables aredhill2017-04-061-4/+3
| | | | | | | properly aligned and sockaddr_union fields, or with memcpy when the memory doesn't overlap. OK bluhm@
* Some refactoring in ip6_input() needed to un-KERNEL_LOCK() the IPv6mpi2017-02-281-2/+2
| | | | | | | | | | | | | | forwarding path. Rename ip6_ours() in ip6_local() as this function dispatches packets to the upper layer. Introduce ip6_ours() and get rid of 'goto hbhcheck'. This function will be later used to enqueue local packets. As a bonus this reduces differences with IPv4. Inputs and ok bluhm@
* Remove the ipsec protocol callbacks which all do the same. Implementbluhm2017-02-081-149/+22
| | | | | | it in ipsec_common_input_cb() instead. The code that was copied to ah6_input_cb() is now in ip6_ours() so we can call it directly. OK mpi@
* Error propagation does neither make sense for ip input path nor forbluhm2017-02-071-52/+45
| | | | | | asynchronous callbacks. Make the IPsec functions void, there is already a counter in the error path. OK mpi@
* Use percpu counters for ip6statjca2017-02-051-3/+3
| | | | | | | | | Try to follow the existing examples. Some notes: - don't implement counters_dec() yet, which could be used in two similar chunks of code. Let's see if there are more users first. - stop incrementing IPv6-specific mbuf stats, IPv4 has no equivalent. Input from mpi@, ok bluhm@ mpi@
* Change the IPv4 pr_input function to the way IPv6 is implemented,bluhm2017-01-291-15/+17
| | | | | | | to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
* Reduce the difference between struct protosw and ip6protosw. Thebluhm2017-01-261-16/+14
| | | | | | IPv4 pr_ctlinput functions did return a void pointer that was always NULL and never used. Make all functions void like in the IPv6 case. OK mpi@
* Since raw_input() and route_input() are gone from pr_input, we canbluhm2017-01-251-24/+4
| | | | | | make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
* Assert for IPL_SOFTNET rather than raising SPL recursively.mpi2017-01-231-10/+4
| | | | ok benno@
* Kill recursive splsofnet()/splx() dances.mpi2017-01-201-14/+5
| | | | Tested by Hrvoje Popovski, ok visa@
* Drop non-encapulated ESP packets using a UDP-encapsulating TDB, and addvgross2016-09-021-1/+11
| | | | | | the relevant counters. Ok mikeb@
* It is time to put inet6 on a diet. Use the flensing knife and cut outclaudio2015-09-101-3/+3
| | | | | the 3rd argument of in6_recoverscope() and make it return void. OK dlg@ mikeb@
* Kill a couple of if_get()s only needed to increment per-ifp IPv6 stats.mpi2015-09-091-6/+1
| | | | | | | | We do not export those per-ifp statistics and they will soon all die. "We're putting inet6 on a diet" claudio@ ok dlg@, mikeb@, claudio@
* Store a unique ID, an interface index, rather than a pointer to thempi2015-06-161-3/+7
| | | | | | | | | | | | | | | receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
* Move away from using hzto(9); OK dlgmikeb2015-06-111-10/+5
|
* test mbuf pointers against NULL not 0jsg2015-05-131-2/+2
| | | | ok krw@ miod@
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-8/+3
| | | | No objection from reyk@, OK markus, hshoexer
* make ipsp_address thread safe; ok mpimikeb2015-04-141-13/+26
|
* replace the use of ifqueues for most input queues serviced by netisrdlg2015-04-101-35/+4
| | | | | | | | | | | | | | | | | with niqueues. this change is so big because there's a lot of code that takes pointers to different input queues (eg, ether_input picks between ipv4, ipv6, pppoe, arp, and mpls input queues) and falls through to code to enqueue packets against the pointer. if i changed only one of the input queues id have to add sepearate code paths, one for ifqueues and one for niqueues in each of these places by flipping all these input queues at once i can keep the currently common code common. testing by mpi@ sthen@ and rafael zalamena ok mpi@ sthen@ claudio@ henning@
* Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?mikeb2015-03-261-123/+1
| | | | ok markus, hshoexer
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-5/+5
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-17/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
* Yet more #include de-duplication.krw2014-11-201-4/+1
| | | | ok deraadt@ tedu@
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* bpf code surgery / shuffling / simplification.henning2014-07-091-2/+2
| | | | | | | | | | | | | | | the various bpf_mtap_* are very similiar, they differ in what (and to some extent how) they prepend something, and what copy function they pass to bpf_catchpacket. use an internal _bpf_mtap as "backend" for bpf_mtap and friends. extend bpf_mtap_hdr so that it covers all common cases: if dlen is 0, nothing gets prepended. copy function can be given, if NULL the default bpf_mcopy is used. adjust the existing bpf_mtap_hdr users to pass a NULL ptr for the copy fn. re-implement bpf_mtap_af as simple wrapper for bpf_mtap_hdr. re-implement bpf_mtap_ether using bpf_map_hdr re-implement bpf_mtap_pflog as trivial bpf_mtap_hdr wrapper ok bluhm benno
* "struct pkthdr" holds a routing table ID, not a routing domain one.mpi2014-04-141-2/+2
| | | | | | | | | | | | | | Avoid the confusion by using an appropriate name for the variable. Note that since routing domain IDs are a subset of the set of routing table IDs, the following idiom is correct: rtableid = rdomain But to get the routing domain ID corresponding to a given routing table ID, you must call rtable_l2(9). claudio@ likes it, ok mikeb@
* bzero/bcmp -> memset/memcmp. ok matthewtedu2014-01-091-9/+9
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.