summaryrefslogtreecommitdiffstats
path: root/sys/netinet/ipsec_output.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Initialize the TDB to NULL in ipsec_common_input() andmestre2018-09-141-2/+2
| | | | | | | | | | ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus mbuf (NULL) we don't end up trying to dereference the TDB, while being an uninitialized pointer, to increase the drops. Coverity IDs 1473312, 1473313 and 1473317. OK mpi@ visa@
* Add per-TDB counters and a new SADB extension to export them tompi2018-08-281-5/+12
| | | | | | userland. Inputs from markus@, ok sthen@
* Introduce ipsec_output_cb() to merge duplicate code and account formpi2018-07-121-1/+83
| | | | | | | | dropped packets in the output path. While here fix a memory leak when compression is not needed w/ IPcomp. ok markus@
* Cleanup IPsec output error handling with consistent goto drop.bluhm2018-06-041-45/+61
| | | | from markus@; OK mpi@
* When walking the IPv6 header chain in IPsec output, check that thebluhm2018-05-141-2/+10
| | | | | | next extension header is within the packet length. Also check at the end that the IPv4 headers are not longer than the packet. reported by Maxime Villard; from markus@ via NetBSD; OK mpi@
* Make {ah,esp,ipcomp}stat use percpu counters.visa2017-11-081-3/+3
| | | | OK bluhm@, mpi@
* Use %s and __func__ in DPRINTF() to reduce false positive with grep(1).mpi2017-11-061-2/+2
| | | | ok kettenis@, dhill@, visa@, jca@
* The function name ip4_input() is confusing as it also handles IPv6bluhm2017-05-181-2/+2
| | | | | | | | | | packets. This is the IP in IP protocol input function, so call it ipip_input(). Rename the existing ipip_input() to ipip_input_gif() as it is the input function used by the gif interface. Pass the address family to make it consistent with pr_input. Use __func__ in debug print and panic messages. Move all ipip prototypes to the ip_ipip.h header file. OK dhill@ mpi@
* Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().mpi2017-05-161-2/+2
| | | | ok visa@
* Replace bcopy with a simple assignment where both variables aredhill2017-04-061-2/+2
| | | | | | | properly aligned and sockaddr_union fields, or with memcpy when the memory doesn't overlap. OK bluhm@
* Kill recursive splsofnet()/splx() dances.mpi2017-01-201-5/+2
| | | | Tested by Hrvoje Popovski, ok visa@
* Rename 'i' to 'hlen' for greater readability; ok millert, naddymikeb2016-10-111-19/+20
|
* avoid extensive mbuf allocation for IPsec by replacing m_inject(4)markus2016-09-131-5/+4
| | | | with m_makespace(4) from freebsd; ok mpi@, bluhm@, mikeb@, dlg@
* When IPsec UDP encapsulation is used for IPv6, the stack shouldmikeb2016-02-281-4/+25
| | | | | | | construct an IPv6 packet instead of an IPv4. Diff from Patrick Wildt <patrick at blueri ! se> with input from bluhm@; ok mpi, bluhm
* Kill yet another argument to functions in IPv6. This time ip6_output'sclaudio2015-09-111-2/+2
| | | | | | | ifpp - XXX: just for statistics ifpp is always NULL in all callers so that statistic confirms ifpp is dying OK mpi@
* m_freem() can handle NULL, do not check for this condition beforehands.deraadt2015-07-151-5/+2
| | | | ok stsp mpi
* Move away from using hzto(9); OK dlgmikeb2015-06-111-12/+5
|
* Stubs and support code for NIC-enabled IPsec bite the dust.mikeb2015-04-171-9/+3
| | | | No objection from reyk@, OK markus, hshoexer
* make ipsp_address thread safe; ok mpimikeb2015-04-141-6/+11
|
* Userland (base & ports) was adapted to always include <netinet/in.h>deraadt2015-01-241-7/+5
| | | | | | before <net/pfvar.h> or <net/if_pflog.h>. The kernel files can be cleaned up next. Some sockaddr_union steps make it into here as well. ok naddy
* unifdef INET in net code as a precursor to removing the pretend option.tedu2014-12-191-30/+1
| | | | | long live the one true internet. ok henning mikeb
* remove uneeded route.h includesjsg2014-09-081-2/+1
| | | | ok miod@ mpi@
* Fewer <netinet/in_systm.h> !mpi2014-07-221-2/+1
|
* ip_output() using varargs always struck me as bizarre, esp since it's onlyhenning2014-04-211-2/+2
| | | | | | ever used to pass on uint32 (for ipsec). stop that madness and just pass the uint32, 0 in all cases but the two that pass the ipsec flowinfo. ok deraadt reyk guenther
* we'll do fine without casting NULL to struct foo * / void *henning2014-04-211-3/+3
| | | | ok gcc & md5 (alas, no binary change)
* Remove the number of in6_var.h inclusions by moving some functions andmpi2013-10-241-2/+1
| | | | | | global variables to in6.h. ok deraadt@
* unbreak PMTU-discovery for AES-GCM; ok mikeb@markus2013-08-031-2/+2
|
* Remove various external variable declaration from sources files andmpi2013-04-101-3/+1
| | | | | | | move them to the corresponding header with an appropriate comment if necessary. ok guenther@
* code that calls timeout functions should include timeout.htedu2013-03-281-1/+2
| | | | | slipped by on i386, but the zaurus doesn't automagically pick it up. spotted by patrick
* spltdb() was really just #define'd to be splsoftnet(); replace the formerblambert2012-09-201-2/+2
| | | | | | | | with the latter no change in md5 checksum of generated files ok claudio@ henning@
* remove the SADB_X_SAFLAGS_{HALFIV,RANDOMPADDING,NOREPLAY} pfkey-API (not setmarkus2012-09-181-9/+3
| | | | | anywhere) as well as the matching TDBF_{HALFIV,RANDOMPADDING,NOREPLAY} code. ok mikeb@
* The function pf_tag_packet() never fails. Remove a redundant checkbluhm2011-03-051-3/+2
| | | | | and make it void. ok henning@, markus@, mcbride@
* Add support for using IPsec in multiple rdomains.reyk2010-07-091-2/+4
| | | | | | | | | | | | | | | | | This allows to run isakmpd/iked/ipsecctl in multiple rdomains independently (with "route exec"); the kernel will pickup the rdomain from the process context of the pfkey socket and load the flows and SAs into the matching rdomain encap routing table. The network stack also needs to pass the rdomain to the ipsec stack to lookup the correct rdomain that belongs to an interface/mbuf/... You can now run individual IPsec configs per rdomain or create IPsec VPNs between multiple rdomains on the same machine ;). Note that a primary enc(4) in addition to enc0 interface is required per rdomain, eg. enc1 rdomain 1. Test by some people, mostly on existing "rdomain 0" setups. Was in snaps for some days and people didn't complain. ok claudio@ naddy@
* Fix two bugs in IPsec/HMAC-SHA2:markus2010-01-101-2/+2
| | | | | | | | | | | | | | | (1) use correct (message) block size of 128 byte (instead of 64 bytes) for HMAC-SHA512/384 (RFC4634). (2) RFC4868 specifies that HMAC-SHA-{256,384,512} is truncated to nnn/2 bits, while we still use 96 bits. 96 bits have been specified in draft-ietf-ipsec-ciph-sha-256-00 while draft-ietf-ipsec-ciph-sha-256-01 changed it to 128 bits. WARNING: this change makes IPsec with SHA-256 (the default) incompatible with older OpenBSD versions and other IPsec-implementations that share this bug. ok+tests naddy, fries; requested by reyk/deraadt
* we need to call pf_pkt_addr_changed here too. found by davidhenning2008-08-261-1/+2
|
* Assign the ip and ip6 pointers in ipsp_process_packet() only if abluhm2008-08-211-8/+11
| | | | | | header of the matching address family is available. Especially do not read ip->ip_off from an IPv6 packet header. ok markus
* apply the "skip ipsec if there are no flows" speedup diff to IPv6 too.henning2007-06-011-2/+2
| | | | | | we need a pointer to the inpcb to decide, which was not previously passed to ip6_output, so this diff is a little bigger. from itojun, ok ryan
* double pf performance.henning2007-05-281-2/+2
| | | | | | | | | | | | | boring details: pf used to use an mbuf tag to keep track of route-to etc, altq, tags, routing table IDs, packets redirected to localhost etc. so each and every packet going through pf got an mbuf tag. mbuf tags use malloc'd memory, and that is knda slow. instead, stuff the information into the mbuf header directly. bridging soekris with just "pass" as ruleset went from 29 MBit/s to 58 MBit/s with that (before ryan's randomness fix, now it is even betterer) thanks to chris for the test setup! ok ryan ryan ckuethe reyk
* - AH: when computing crypto checksum for output, massage source-routingitojun2007-02-081-1/+62
| | | | | | | | | | header. - ipsec_input: fix mistake in IPv6 next-header chasing. - ipsec_output: look for the position to insert AH more carefully. - ip6_output: enable use of AH with extension headers. avoid tunnellinng when source-routing header is present. ok by deraad, naddy, hshoexer
* TDBF_USEDTUNNEL flag manipulation was inside #ifdef INET. it appliesitojun2006-12-191-2/+2
| | | | to INET6 too, so move it outside. markus ok
* do not install pmtu routes for transport mode SAs, as they do notmarkus2006-12-051-1/+5
| | | | the dest IP; PMTU debugging support; ok hshoexer
* add support to tag ipsec traffic belonging to specific IKE-initiatedreyk2006-11-241-1/+13
| | | | | | | | | | | phase 2 traffic. this allows policy-based filtering of encrypted and unencrypted ipsec traffic with pf(4). see ipsec.conf(5) and isakmpd.conf(5) for details and examples. this is work in progress and still needs some testing and feedback, but it is safe to put it in now. ok hshoexer@
* handle PMTU for ipip SAs, too; ok hshoexer, clodermarkus2005-04-121-1/+5
|
* pmtu support for udpencap; ok hshoexer, homarkus2004-09-241-1/+3
|
* Default enable udpencap. Add 'disable' sysctl to sysctl.conf. markus@ ok.ho2004-06-261-2/+2
|
* First step towards more sane time handling in the kernel -- this changestholo2004-06-211-8/+4
| | | | | | | | things such that code that only need a second-resolution uptime or wall time, and used to get that from time.tv_secs or mono_time.tv_secs now get this from separate time_t globals time_second and time_uptime. ok art@ niklas@ nordin@
* don't send UDP encapsulated packets w/o UDP header if encap is disabled; ok ho@markus2004-06-211-3/+6
|
* UDP encapsulation for ESP in transport mode (draft-ietf-ipsec-udp-encaps-XX.txt)markus2003-12-021-1/+30
| | | | ok deraadt@
* do not flip ip_len/ip_off in netinet stack. deraadt ok.itojun2003-07-091-8/+3
| | | | (please test, especially PF portion)
* add a counter for times ipcomp is skipped because the packet is below thejason2003-02-191-1/+4
| | | | minimum compression threshold.
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.