| Age | Commit message (Collapse) | Author |
|
Because the code of IPsec itself is already MP-safe.
|
|
|
|
|
|
Inspired by rmind-smpnet patches.
|
|
Data structures of network protocol control blocks (PCBs), i.e.,
struct inpcb, in6pcb and inpcb_hdr, are not organized well. Users of
the data structures have to handle them separately and thus the code
is cluttered and duplicated.
The commit integrates the data structures into one, struct inpcb. As a
result, users of PCBs only have to handle just one data structure, so
the code becomes simple.
One drawback is that the data size of PCB for IPv4 increases by 40 bytes
(from 248 bytes to 288 bytes).
|
|
|
|
Because it just checks if a packet passes security policies.
|
|
The counters count packets dropped due to security policy checks.
|
|
ipsec_getpolicybyaddr().
That can reduce KEYDEBUG messages.
|
|
initialized, and the padding of the spidx structure is not initialized
either. This causes the memcmp() to wrongfully fail.
Change ipsec_setspidx() to always initialize spdix.dir and zero out the
padding.
ok ozaki-r@
|
|
|
|
Add ATF later.
|
|
|
|
ip_undefer_csum -> in_undefer_cksum
in_delayed_cksum -> in_undefer_cksum_tcpudp
The two previous names were inconsistent and misleading.
Put the two functions into in_offload.c. Add comments to explain what
we're doing.
The same could be done for IPv6.
|
|
a bool for clarity. Optimize the function: if M_CANFASTFWD is not there
(because already removed by the firewall) leave now.
Makes it easier to see that M_CANFASTFWD is not removed on IPv6.
|
|
call M_VERIFY_PACKET here, there is no particular reason for this place to
be more wrong than the rest.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ok ozaki-r@
|
|
|
|
|
|
since we used only ipsec_copy_pcbpolicy, and it was a no-op.
Originally we were using ipsec_copy_policy to optimize the IPsec-PCB
cache: when an ACK was received in response to a SYN, we used to copy the
SP cached in the SYN's PCB into the ACK's PCB, so that
ipsec_getpolicybysock could use the cached SP instead of requerying it.
Then we switched to ipsec_copy_pcbpolicy which has always been a no-op. As
a result the SP cached in the SYN was/is not copied in the ACK, and the
first call to ipsec_getpolicybysock had to query the SP and cache it
itself. It's not totally clear to me why this change was made.
But it has been this way for years, and after a conversation with Ryota
Ozaki it turns out the optimization is not valid anymore due to
MP-ification, so it won't be re-enabled.
ok ozaki-r@
|
|
|
|
style.
|
|
|
|
|
|
|
|
IPv4 code. While here put the correct variable in sizeof.
ok ozaki-r@
|
|
original ipsec_set_policy function is inlined into the new one.
|
|
ipsec_set_policy.
|
|
ipsec4_get_policy and ipsec6_get_policy
ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy
The already-existing ipsec_get_policy() function is inlined in the new
one.
|
|
ipsec4_set_policy and ipsec6_set_policy
ipsec4_get_policy and ipsec6_get_policy
ipsec4_delete_pcbpolicy and ipsec6_delete_pcbpolicy
No real functional change.
|
|
the SP.
ok ozaki-r@
|
|
increased now.
|
|
|
|
While here fix misleading comment.
ok ozaki-r@
|
|
ok ozaki-r@
|
|
ipsec_checkpolicy.
ok ozaki-r@
|
|
and the former is already dereferenced in a kassert. This code should be
the same as ipsec4_set_policy.
|
|
|
|
otherwise the port fields of spidx are uninitialized.
ok mlelstv@
|
|
ipsec4_hdrsiz and ipsec6_hdrsiz
ipsec4_in_reject and ipsec6_in_reject
ipsec4_checkpolicy and ipsec4_checkpolicy
The members of these couples are now identical, and could be merged,
giving only three functions instead of six...
|
|
ipsec_in_reject -> ipsec_sp_reject
ipsec_hdrsiz -> ipsec_sp_hdrsiz
localify the former, and do some cleanup while here.
|
|
reduce the diff between similar functions. No functional change.
|
|
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.
|
|
|