summaryrefslogtreecommitdiff
path: root/sys/netipsec/ipsec.c
AgeCommit message (Collapse)Author
2023-01-27ipsec: remove unnecessary splsoftnetozaki-r
Because the code of IPsec itself is already MP-safe.
2022-12-08Fix: sp->lastused should be updated by time_uptime, and refactor a little.knakahara
2022-11-09Fix IPv4 security policy with port number does not work for forwarding packets.knakahara
2022-11-04inpcb: rename functions to inpcb_*ozaki-r
Inspired by rmind-smpnet patches.
2022-10-28inpcb: integrate data structures of PCB into oneozaki-r
Data structures of network protocol control blocks (PCBs), i.e., struct inpcb, in6pcb and inpcb_hdr, are not organized well. Users of the data structures have to handle them separately and thus the code is cluttered and duplicated. The commit integrates the data structures into one, struct inpcb. As a result, users of PCBs only have to handle just one data structure, so the code becomes simple. One drawback is that the data size of PCB for IPv4 increases by 40 bytes (from 248 bytes to 288 bytes).
2021-12-08s/speficication/specification/andvar
2020-08-28ipsec: rename ipsec_ip_input to ipsec_ip_input_checkpolicyozaki-r
Because it just checks if a packet passes security policies.
2020-08-28inet, inet6: count packets dropped by IPsecozaki-r
The counters count packets dropped due to security policy checks.
2019-08-07ipsec_getpolicybysock() should also call key_havesp() like ↵knakahara
ipsec_getpolicybyaddr(). That can reduce KEYDEBUG messages.
2019-07-09Fix uninitialized variable: in ipsec_checkpcbcache(), spidx.dir is notmaxv
initialized, and the padding of the spidx structure is not initialized either. This causes the memcmp() to wrongfully fail. Change ipsec_setspidx() to always initialize spdix.dir and zero out the padding. ok ozaki-r@
2019-01-27Merge the [pgoyette-compat] branchpgoyette
2018-11-22Support IPv6 NAT-T. Implemented by hsuenaga@IIJ and ohishi@IIJ.knakahara
Add ATF later.
2018-10-27Localify one function, and switch to C99 types while here.maxv
2018-07-11Renamemaxv
ip_undefer_csum -> in_undefer_cksum in_delayed_cksum -> in_undefer_cksum_tcpudp The two previous names were inconsistent and misleading. Put the two functions into in_offload.c. Add comments to explain what we're doing. The same could be done for IPv6.
2018-05-14Merge ipsec4_input and ipsec6_input into ipsec_ip_input. Make the argumentmaxv
a bool for clarity. Optimize the function: if M_CANFASTFWD is not there (because already removed by the firewall) leave now. Makes it easier to see that M_CANFASTFWD is not removed on IPv6.
2018-05-10Replace dumb code by M_VERIFY_PACKET. In fact, perhaps we should not evenmaxv
call M_VERIFY_PACKET here, there is no particular reason for this place to be more wrong than the rest.
2018-05-10Rename ipsec4_forward -> ipsec_mtu, and switch to void.maxv
2018-04-29Remove unused and misleading argument from ipsec_set_policy.maxv
2018-04-28Remove IPSEC_SPLASSERT_SOFTNET, it has always been a no-op.maxv
2018-04-28Stop using a macro, rename the function to ipsec_init_pcbpolicy directly.maxv
2018-04-28Style and remove unused stuff.maxv
2018-04-19Remove extra long file paths from the headers.maxv
2018-04-18Remove dead code.maxv
ok ozaki-r@
2018-04-17Add XXX. If this code really does something, it should use MCHTYPE.maxv
2018-04-17Style, add XXX (about the mtu that goes negative), and remove #ifdef inet.maxv
2018-04-03Remove ipsec_copy_policy and ipsec_copy_pcbpolicy. No functional change,maxv
since we used only ipsec_copy_pcbpolicy, and it was a no-op. Originally we were using ipsec_copy_policy to optimize the IPsec-PCB cache: when an ACK was received in response to a SYN, we used to copy the SP cached in the SYN's PCB into the ACK's PCB, so that ipsec_getpolicybysock could use the cached SP instead of requerying it. Then we switched to ipsec_copy_pcbpolicy which has always been a no-op. As a result the SP cached in the SYN was/is not copied in the ACK, and the first call to ipsec_getpolicybysock had to query the SP and cache it itself. It's not totally clear to me why this change was made. But it has been this way for years, and after a conversation with Ryota Ozaki it turns out the optimization is not valid anymore due to MP-ification, so it won't be re-enabled. ok ozaki-r@
2018-03-31typo in commentsmaxv
2018-03-03Reduce the diff between ipsec4_output and ipsec6_check_policy. While heremaxv
style.
2018-03-03Dedup.maxv
2018-02-28add missing staticmaxv
2018-02-28Dedup: merge ipsec4_setspidx_inpcb and ipsec6_setspidx_in6pcb.maxv
2018-02-28ipsec6_setspidx_in6pcb: call ipsec_setspidx() only once, just like themaxv
IPv4 code. While here put the correct variable in sizeof. ok ozaki-r@
2018-02-27Dedup: merge ipsec4_set_policy and ipsec6_set_policy. The content of themaxv
original ipsec_set_policy function is inlined into the new one.
2018-02-27Remove duplicate checks, and no need to initialize 'newsp' inmaxv
ipsec_set_policy.
2018-02-27Dedup: mergemaxv
ipsec4_get_policy and ipsec6_get_policy ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy The already-existing ipsec_get_policy() function is inlined in the new one.
2018-02-27Use inpcb_hdr to reduce the diff betweenmaxv
ipsec4_set_policy and ipsec6_set_policy ipsec4_get_policy and ipsec6_get_policy ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy No real functional change.
2018-02-27Optimize: use ipsec_sp_hdrsiz instead of ipsec_hdrsiz, not to re-querymaxv
the SP. ok ozaki-r@
2018-02-26Dedup: call ipsec_in_reject directly. IPSEC_STAT_IN_POLVIO also getsmaxv
increased now.
2018-02-26Reduce the diff between ipsec6_input and ipsec4_input.maxv
2018-02-26Dedup: merge ipsec4_in_reject and ipsec6_in_reject into ipsec_in_reject.maxv
While here fix misleading comment. ok ozaki-r@
2018-02-26Dedup: merge ipsec4_hdrsiz and ipsec6_hdrsiz into ipsec_hdrsiz.maxv
ok ozaki-r@
2018-02-26Dedup: merge ipsec4_checkpolicy and ipsec6_checkpolicy intomaxv
ipsec_checkpolicy. ok ozaki-r@
2018-02-26Fix nonsensical checks, neither in6p nor request is allowed to be NULL,maxv
and the former is already dereferenced in a kassert. This code should be the same as ipsec4_set_policy.
2018-02-26Merge some minor (mostly stylistic) changes from last week.maxv
2018-02-21Fix ipsec4_get_ulp(). We should do "goto done" instead of "return",maxv
otherwise the port fields of spidx are uninitialized. ok mlelstv@
2018-02-21Use inpcb_hdr to reduce the diff between:maxv
ipsec4_hdrsiz and ipsec6_hdrsiz ipsec4_in_reject and ipsec6_in_reject ipsec4_checkpolicy and ipsec4_checkpolicy The members of these couples are now identical, and could be merged, giving only three functions instead of six...
2018-02-21Rename:maxv
ipsec_in_reject -> ipsec_sp_reject ipsec_hdrsiz -> ipsec_sp_hdrsiz localify the former, and do some cleanup while here.
2018-02-16Style, remove unused and misleading macros and comments, localify, andmaxv
reduce the diff between similar functions. No functional change.
2018-02-16Fix inverted logic, otherwise the kernel crashes when receiving a 1-bytemaxv
AH packet. Triggerable before authentication when IPsec and forwarding are both enabled.
2018-02-16Style a bit, no functional change.maxv