summaryrefslogtreecommitdiff
path: root/sys/netinet6/esp_input.c
AgeCommit message (Collapse)Author
2003-10-25fix uninitialized variableschristos
2003-08-06m_cat may free mbuf on 2nd arg, so m_pkthdr manipulation has to happenitojun
before m_cat call. from Julian Coleman via kame.
2003-07-22unifdef -U_IP_VHLitojun
2003-07-09remove obsolete comment on the use of m_pullupitojun
2003-07-04fix missing check for taillen against pkthdr.len. markus@openbsditojun
2003-05-14always use PULLDOWN_TEST codepath.itojun
2003-01-20Remove variable that is only assigned too but not referenced.simonb
2002-10-28increase correct stat. KAME pr 445itojun
2002-09-11correct pointer signedness mixups. sync w/kameitojun
2002-09-11correct signedness mixup in pointer passing. sync w/kameitojun
2002-08-21check packet length before fetching ESP crypto checksum. sync w/kameitojun
2002-08-14avoid swapping endian of ip_len and ip_off on mbuf, to meet with M_LEADINGSPACEitojun
optimization made last year. should solve PR 17867 and 10195. IP_HDRINCL behavior of raw ip socket is kept unchanged. we may want to provide IP_HDRINCL variant that does not swap endian.
2002-06-08whitespace cleanupitojun
2002-03-18esp/ah_ctlinput: pass useful address to key_alloc.itojun
2001-12-18remove obsolete #if 0'ed portion.itojun
2001-11-13add RCSIDslukem
2001-10-15reduce diff with kame. whitespace changes only.itojun
2001-04-13Remove the use of splimp() from the NetBSD kernel. splnet()thorpej
and only splnet() is allowed for the protection of data structures used by network devices.
2001-03-01make sure to enforce inbound ipsec policy checking, for any protocols on topitojun
of ip (check it when final header is visited). sync with kame. XXX kame team will need to re-check policy engine code
2001-02-11pull latest kame pcbnotify code. synchronizes ICMPv6 path mtu discoveryitojun
behavior with other protocols (i.e. validation, use of hiwat/lowat).
2001-01-24- record IPsec packet history into m_aux structure.itojun
- let ipfilter look at wire-format packet only (not the decapsulated ones), so that VPN setting can work with NAT/ipfilter settings. sync with kame. TODO: use header history for stricter inbound validation
2000-12-09update icmp6 too big validation. the change is necessary since pmtud isitojun
mandatory for IPv6 (so we can't just validate by using connected pcb - we need to allow traffic from unconnected pcb to do pmtud). - if the traffic is validated by xx_ctlinput, allow up to "hiwat" pmtud route entries. - if the traffic was not validated by xx_ctlinput, allow up to "lowat" pmtud route entries (there's upper limit, so bad guys cannot blow up our routing table). sync with kame XXX need to think again about default hiwat/lowat value. XXX victim selection to help starvation case
2000-10-19memcpy -> bcopy, for sync with kame treeitojun
2000-10-18verify ICMPv6 too big messages based on TCP pcbs, and/or IPsec SA.itojun
TODO: udp6, and sendto consideration. as pmtud is mandatory for IPv6, it is rather important for us to support those cases. TODO: more testing TODO: kame sync
2000-10-18Restructure the Path MTU Discovery code somewhat to avoidthorpej
entering rtentry's for hosts we're not actually communicating with. Do this by invoking the ctlinput for the protocol, which is responsible for validating the ICMP message: * TCP -- Lookup the connection based on the address/port pairs in the ICMP message. * AH/ESP -- Lookup the SA based on the SPI in the ICMP message. If validation succeeds, ctlinput is responsible for calling icmp_mtudisc(). icmp_mtudisc() then invokes callbacks registered by protocols (such as TCP) which want to take some sort of special action when a path's MTU changes. For TCP, this is where we now refresh cached routes and re-enter slow-start. As a side-effect, this fixes the problem where TCP would not be notified when a path's MTU changed if AH/ESP were being used. XXX Note, this is only a fix for the IPv4 case. For the IPv6 XXX case, we need to wait for the KAME folks. Reviewed by sommerfeld@netbsd.org and itojun@netbsd.org.
2000-10-02fix compilation without INET. fix confusion between ipsecstat and ipsec6stat.itojun
sync with kame.
2000-09-18pullup IPv6 and subsequent headers, on IPv6 IPsec transport mode input.itojun
(not normally visited - we have switched to m_pulldown. just for completeness)
2000-08-29improve code sharing for esp_schedule(). add some diagnostics casesitojun
for esp_cbc_{en,de}crypt(). sync with kame.
2000-08-29use per-block cipher function + esp_cbc_{de,en}crypt. do not useitojun
cbc-over-mbuf functions in sys/crypto. the change should make it much easier to switch crypto function to machine-dependent ones (like assembly code under sys/arch/i386/crypto?). also it should be much easier to import AES algorithms. XXX: it looks that past blowfish-cbc code was buggy. i ran some test pattern, and new blowfish-cbc code looks more correct. there's no interoperability between the old code (before the commit) and the new code (after the commit). XXX: need serious interop tests before move it into 1.5 branch
2000-08-16add missing splx, when outgoing interface queue is full on tunnelleditojun
ESP packet output. KAME PR 280.
2000-07-30clarify comment. from jhawk. sync with kame.itojun
2000-07-23pre-compute and cache intermediate crypto key. suggestion from sommerfeld,itojun
sync with kame. loopback, blowfish-cbc transport mode, 128bit key before: 86588496 bytes received in 00:42 (1.94 MB/s) after: 86588496 bytes received in 00:31 (2.58 MB/s)
2000-07-18correct RFC2367 PF_KEY conformance (SADB_[AE]ALG_xx values and namespaces).itojun
sync from kame. WARNING: need recompilation of setkey(8) and pkgsrc/security/racoon. (no ipsec-ready netbsd was released as official release)
2000-06-14Import IPsec ESP from netbsd-cryptosrc-intl.thorpej