summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ipsec_input.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Convert *_sysctl in ipsec_input.c to sysctl_bounded_arrgnezdo2020-09-011-11/+33
| | | | The best-guessed limits will be tested by trial.
* Move range check inside sysctl_int_arrgnezdo2020-08-011-33/+21
| | | | | | | Range violations are now consistently reported as EOPNOTSUPP. Previously they were mixed with ENOPROTOOPT. OK kn@
* kernel: use gettime(9)/getuptime(9) in lieu of time_second(9)/time_uptime(9)cheloha2020-06-241-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | time_second(9) and time_uptime(9) are widely used in the kernel to quickly get the system UTC or system uptime as a time_t. However, time_t is 64-bit everywhere, so it is not generally safe to use them on 32-bit platforms: you have a split-read problem if your hardware cannot perform atomic 64-bit reads. This patch replaces time_second(9) with gettime(9), a safer successor interface, throughout the kernel. Similarly, time_uptime(9) is replaced with getuptime(9). There is a performance cost on 32-bit platforms in exchange for eliminating the split-read problem: instead of two register reads you now have a lockless read loop to pull the values from the timehands. This is really not *too* bad in the grand scheme of things, but compared to what we were doing before it is several times slower. There is no performance cost on 64-bit (__LP64__) platforms. With input from visa@, dlg@, and tedu@. Several bugs squashed by visa@. ok kettenis@
* Add support for autmatically moving traffic between rdomains on ipsec(4)tobhe2020-04-231-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | encryption or decryption. This allows us to keep plaintext and encrypted network traffic seperated and reduces the attack surface for network sidechannel attacks. The only way to reach the inner rdomain from outside is by successful decryption and integrity verification through the responsible Security Association (SA). The only way for internal traffic to get out is getting encrypted and moved through the outgoing SA. Multiple plaintext rdomains can share the same encrypted rdomain while the unencrypted packets are still kept seperate. The encrypted and unencrypted rdomains can have different default routes. The rdomains can be configured with the new SADB_X_EXT_RDOMAIN pfkey extension. Each SA (tdb) gets a new attribute 'tdb_rdomain_post'. If this differs from 'tdb_rdomain' then the packet is moved to 'tdb_rdomain_post' afer IPsec processing. Flows and outgoing IPsec SAs are installed in the plaintext rdomain, incoming IPsec SAs are installed in the encrypted rdomain. IPCOMP SAs are always installed in the plaintext rdomain. They can be viewed with 'route -T X exec ipsecctl -sa' where X is the rdomain ID. As the kernel does not create encX devices automatically when creating rdomains they have to be added by hand with ifconfig for IPsec to work in non-default rdomains. discussed with chris@ and kn@ ok markus@, patrick@
* remove the "copy function" argument to bpf_mtap_hdr.dlg2019-09-301-2/+2
| | | | | | | | it was previously (ab)used by pflog, which has since been fixed. apart from that nothing else used it, so we can trim the cruft. ok kn@ claudio@ visa@ visa@ also made sure i fixed ipw(4) so i386 won't break.
* Remove the last few XXX rdomain markers. Even those functions respect theclaudio2018-11-091-4/+1
| | | | | rdomain now and are therefor rdomain save. OK mpi@
* Initialize the TDB to NULL in ipsec_common_input() andmestre2018-09-141-3/+3
| | | | | | | | | | ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus mbuf (NULL) we don't end up trying to dereference the TDB, while being an uninitialized pointer, to increase the drops. Coverity IDs 1473312, 1473313 and 1473317. OK mpi@ visa@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-3/+15
| | | | | | userland. Inputs from markus@, ok sthen@
* Convert AH & IPcomp to ipsec_input_cb() and count drops on input.mpi2018-07-111-3/+9
| | | | ok markus@
* Introduce new IPsec (per-CPU) statistics and refactor ESP inputmpi2018-07-101-15/+110
| | | | | | | | | | callbacks to be able to count dropped packet. Having more generic statistics will help troubleshooting problems with specific tunnels. Per-TDB counters are coming once all the refactoring bits are in. ok markus@
* When checking the IPsec enable sysctls, ipsec_common_input() hadbluhm2018-05-141-25/+43
| | | | | | | | | | | | switches for protocol and address family. Move this code to the specific functions from where the common function is called. As a consequence the raw ip input functions can never be called from udp_input() anymore. If IPsec is disabled, the functions ah6_input(), esp6_input(), and ipcomp6_input() do not start processing the header chain. The raw ip input functions are called with the mbuf and offset pointers from the protocol walking loop which is the usual behavior. OK mpi@ markus@
* Cleanup IPsec common input error handling with consistent goto drop.bluhm2018-05-121-24/+27
| | | | from markus@; OK mpi@
* Sprinkle some NET_ASSERT_LOCKED(), const and co to prepare runningmpi2017-11-201-1/+2
| | | | | | pr_input handlers without KERNEL_LOCK(). ok visa@
* Introduce ipsec_sysctl() and move IPsec tunables where they belong.mpi2017-11-141-1/+62
| | | | ok bluhm@, visa@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-081-78/+98
| | | | OK bluhm@, mpi@
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-061-37/+34
| | | | ok kettenis@, dhill@, visa@, jca@
* Reduces the scope of the NET_LOCK() in sysctl(2) path.mpi2017-10-091-16/+43
| | | | | | Exposes per-CPU counters to real parrallelism. ok visa@, bluhm@, jca@
* The IP in IP input function strips the outer header and reinsertsbluhm2017-07-051-16/+2
| | | | | | | | | | | | | | | the inner IP packet into the internet queue. The IPv6 local delivery code has a loop to deal with header chains. The idea is to use this loop and avoid the queueing and rescheduling. The IPsec packet will be processed in a single flow. Merge the IP deliver loop from both IP versions into a single ip_deliver() function that can handle both addresss families. This allows to process an IP in IP header like a normal extension header. If af != AF_UNSPEC, we are already in a deliver loop and have the kernel look. Then we can just return the next protocol. Otherwise we enqueue. The dequeue thread has the kernel lock and starts an IP delivery loop. OK mpi@
* When dealing with mbuf pointers passed down as function parameters,bluhm2017-06-191-13/+7
| | | | | | | bugs could easily result in use-after-free or double free. Introduce m_freemp() which automatically resets the pointer before freeing it. So we have less dangling pointers in the kernel. OK krw@ mpi@ claudio@
* Rename ip_local() to ip_deliver() and give it the same parametersbluhm2017-05-281-4/+4
| | | | | | | as the pr_input functions. Add an assert that IPv4 delivery ends in IP proto done to assure that IPv4 protocol functions work like IPv6. OK mpi@
* Move IPsec forward and local policy check functions to ipsec_input.cbluhm2017-05-221-1/+96
| | | | | and give them better names. input and OK mikeb@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-3/+3
| | | | ok visa@
* IPsec packets were passed through ip_input() a second time afterbluhm2017-05-121-33/+27
| | | | | | | | | | | | | | | | they have been decrypted. That means that all the IP header fields were checked twice. Also fragment reassembly was tried twice. At pf incoming packets in tunnel mode appeared twice on the enc0 interface, once as IP-in-IP and once as the inner packet. In the outgoing path pf only sees the inner packet. Asymmetry is bad for stateful filtering. IPv6 shows that IPsec works without that. After decrypting immediately continue with local delivery. In tunnel mode the IP-in-IP protocol functions pass the inner header to ip6_input(). In transport mode only pf_test() has to be called for the enc0 device. Introduce ip_local() to avoid needless processing and cleaner pf behavior in IPv4 IPsec. OK mikeb@
* Instead of printing a debug message at the end of processing, panicbluhm2017-05-121-19/+21
| | | | | | | early if the IPsec security protocol is unknown. ipsec_common_input() and ipsec_common_input_cb() can only be called with the IP protocols ESP, AH, or IPComp. Everything else is a programming mistake. OK claudio@
* IPv6 IPsec transport mode did not work if pf is enabled. Thebluhm2017-05-111-1/+27
| | | | | | | | decrypted packets in the input path were not checked with pf. So with stateful filtering on enc0, direction aware protocols like ping or TCP did not pass. Add an explicit pf_test() in ipsec_common_input_cb() for IPv6 transport mode to fix this. OK mikeb@
* Expand SA_LEN(), there is no benefit for using the macro in thebluhm2017-05-051-3/+3
| | | | | kernel. It was only used in IPsec sources. No binary change OK deraadt@
* Pass down the address family through the pr_input calls. Thisbluhm2017-04-141-9/+9
| | | | | allows to simplify code used for both IPv4 and IPv6. OK mikeb@ deraadt@
* Replace bcopy with a simple assignment where both variables aredhill2017-04-061-4/+3
| | | | | | | properly aligned and sockaddr_union fields, or with memcpy when the memory doesn't overlap. OK bluhm@
* Some refactoring in ip6_input() needed to un-KERNEL_LOCK() the IPv6mpi2017-02-281-2/+2
| | | | | | | | | | | | | | forwarding path. Rename ip6_ours() in ip6_local() as this function dispatches packets to the upper layer. Introduce ip6_ours() and get rid of 'goto hbhcheck'. This function will be later used to enqueue local packets. As a bonus this reduces differences with IPv4. Inputs and ok bluhm@
* Remove the ipsec protocol callbacks which all do the same. Implementbluhm2017-02-081-149/+22
| | | | | | it in ipsec_common_input_cb() instead. The code that was copied to ah6_input_cb() is now in ip6_ours() so we can call it directly. OK mpi@
* Error propagation does neither make sense for ip input path nor forbluhm2017-02-071-52/+45
| | | | | | asynchronous callbacks. Make the IPsec functions void, there is already a counter in the error path. OK mpi@
* Use percpu counters for ip6statjca2017-02-051-3/+3
| | | | | | | | | Try to follow the existing examples. Some notes: - don't implement counters_dec() yet, which could be used in two similar chunks of code. Let's see if there are more users first. - stop incrementing IPv6-specific mbuf stats, IPv4 has no equivalent. Input from mpi@, ok bluhm@ mpi@
* Change the IPv4 pr_input function to the way IPv6 is implemented,bluhm2017-01-291-15/+17
| | | | | | | to get rid of struct ip6protosw and some wrapper functions. It is more consistent to have less different structures. The divert_input functions cannot be called anyway, so remove them. OK visa@ mpi@
* Reduce the difference between struct protosw and ip6protosw. Thebluhm2017-01-261-16/+14
| | | | | | IPv4 pr_ctlinput functions did return a void pointer that was always NULL and never used. Make all functions void like in the IPv6 case. OK mpi@
* Since raw_input() and route_input() are gone from pr_input, we canbluhm2017-01-251-24/+4
| | | | | | make the variable parameters of the protocol input functions fixed. Also add the proto to make it similar to IPv6. OK mpi@ guenther@ millert@
* Assert for IPL_SOFTNET rather than raising SPL recursively.mpi2017-01-231-10/+4
| | | | ok benno@
* Kill recursive splsofnet()/splx() dances.mpi2017-01-201-14/+5
| | | | Tested by Hrvoje Popovski, ok visa@
* Drop non-encapulated ESP packets using a UDP-encapsulating TDB, and addvgross2016-09-021-1/+11
| | | | | | the relevant counters. Ok mikeb@
* It is time to put inet6 on a diet. Use the flensing knife and cut outclaudio2015-09-101-3/+3
| | | | | the 3rd argument of in6_recoverscope() and make it return void. OK dlg@ mikeb@
* Kill a couple of if_get()s only needed to increment per-ifp IPv6 stats.mpi2015-09-091-6/+1
| | | | | | | | We do not export those per-ifp statistics and they will soon all die. "We're putting inet6 on a diet" claudio@ ok dlg@, mikeb@, claudio@
* Store a unique ID, an interface index, rather than a pointer to thempi2015-06-161-3/+7
| | | | | | | | | | | | | | | receiving interface in the packet header of every mbuf. The interface pointer should now be retrieved when necessary with if_get(). If a NULL pointer is returned by if_get(), the interface has probably been destroy/removed and the mbuf should be freed. Such mechanism will simplify garbage collection of mbufs and limit problems with dangling ifp pointers. Tested by jmatthew@ and krw@, discussed with many. ok mikeb@, bluhm@, dlg@
* Move away from using hzto(9); OK dlgmikeb2015-06-111-10/+5
|
* test mbuf pointers against NULL not 0jsg2015-05-131-2/+2
| | | | ok krw@ miod@
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-8/+3
| | | | No objection from reyk@, OK markus, hshoexer
* make ipsp_address thread safe; ok mpimikeb2015-04-141-13/+26
|
* replace the use of ifqueues for most input queues serviced by netisrdlg2015-04-101-35/+4
| | | | | | | | | | | | | | | | | with niqueues. this change is so big because there's a lot of code that takes pointers to different input queues (eg, ether_input picks between ipv4, ipv6, pppoe, arp, and mpls input queues) and falls through to code to enqueue packets against the pointer. if i changed only one of the input queues id have to add sepearate code paths, one for ifqueues and one for niqueues in each of these places by flipping all these input queues at once i can keep the currently common code common. testing by mpi@ sthen@ and rafael zalamena ok mpi@ sthen@ claudio@ henning@
* Remove bits of unfinished IPsec proxy support. DNS' KX records, anyone?mikeb2015-03-261-123/+1
| | | | ok markus, hshoexer
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-5/+5
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-17/+1
| | | | | long live the one true internet. ok henning mikeb
* Explicitly include <net/if_var.h> instead of pulling it in <net/if.h>.mpi2014-12-051-1/+2
| | | | ok mikeb@, krw@, bluhm@, tedu@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.