summaryrefslogtreecommitdiff
path: root/sys/netipsec/key.c
AgeCommit message (Collapse)Author
2022-12-08Fix: sp->lastused should be updated by time_uptime, and refactor a little.knakahara
2022-12-08Fix: update lastused of ipsecif(4) IPv6 out SP.knakahara
2022-10-19PR/56836: Andrew Cagney: IPv6 ESN tunneling IPcomp has corrupt headerchristos
Always always send / expect CPI in IPcomp header Fixes kern/56836 where an IPsec interop combining compression and ESP|AH would fail. Since fast ipsec, the outgoing IPcomp header has contained the compression algorithm instead of the CPI. Adding the SADB_X_EXT_RAWCPI flag worked around this but ... The IPcomp's SADB was unconditionally hashed using the compression algorithm instead of the CPI. This meant that an incoming packet with a valid CPI could never match its SADB.
2022-10-11Add sadb_x_policy_flags to inform SP origination.knakahara
This extension(struct sadb_x_policy) is *not* defined by RFC2367. OpenBSD does not have reserved fields in struct sadb_x_policy. Linux does not use this field yet. FreeBSD uses this field as "sadb_x_policy_scope"; the value range is from 0x00 to 0x04. We use from most significant bit to avoid the above usage.
2022-08-09Add sysctl entry to improve interconnectivity to some VPN appliances, ↵knakahara
pointed out by seil-team@IIJ. If we want to allow different identifier types on IDii and IDir, set net.key.allow_different_idtype=1. Default(=0) is the same as before.
2022-05-24fix various typos in comment, documentation and log messages.andvar
2022-05-18PR/56841: Andrew Cagney: debug-log IPcomp CPI lookups:christos
- debug-logs why an SPI is rejected - adds missing __VA_OPT__(,) to some printf macros - debug-log SPI+proto when adding/updating entry
2022-01-02fix few more typos in comments.andvar
2021-12-03fix various typos in comments, log messages and documentation.andvar
2020-03-13Fix kern/55066. Pointed out and fixed by Chuck Zmudzinski, thanks.knakahara
ok'ed by ozaki-r@n.o
2020-02-07Use percpu_foreach_xcall() to gather volatile per-cpu counters. Thesethorpej
must be serialized against the interrupts / soft-interrupts in which they're manipulated, as well as protected from non-atomic 64-bit memory loads on 32-bit platforms.
2019-11-14Reduce load for IKE negotiations when the system has many IPv6 addresses.knakahara
e.g. the system has many vlan(4), gif(4) or ipsecif(4) with link local address.
2019-11-12Fix SA can be expaired wrongly when there are many SPs.knakahara
When key_timehandler_spd() spent over one second, the "now" argument of key_timehandler_sad() could be older than sav->created. That caused SA was expired immediately.
2019-09-25Make panic messages more informativeozaki-r
2019-08-04Fix info leaks.maxv
2019-07-23ipsec: fix a regression of the update APIozaki-r
The update API updates an SA by creating a new SA and removing an existing SA. The previous change removed a newly added SA wrongly if an existing SA had been created by the getspi API.
2019-07-17Avoid a race condition between SA (sav) manipulationsozaki-r
An sav can be removed from belonging list(s) twice resulting in an assertion failure of pslist. It can occur if the following two operations interleave: (i) a deletion or a update of an SA via the API, and (ii) a state change (key_sa_chgstate) of the same SA by the timer. Note that even (ii) removes an sav once from its list(s) on a update. The cause of the race condition is that the two operations are not serialized and (i) doesn't get and remove an sav from belonging list(s) atomically. So (ii) can be inserted between an acquisition and a removal of (i). Avoid the race condition by making (i) atomic.
2019-06-12fix typo in comment, improve error message, add default case handling tochristos
set error.
2019-06-12Fix double free: key_setsaval() free's newsav by calling key_freesaval()christos
and key_api_update() calls key_delsav() when key_setsaval() fails which calls key_freesaval() again...
2019-01-27Merge the [pgoyette-compat] branchpgoyette
2018-12-26ipsecif(4) supports multiple peers in the same NAPT.knakahara
E.g. ipsec0 connects between NetBSD_A and NetBSD_B, ipsec1 connects NetBSD_A and NetBSD_C at the following figure. +----------+ +----| NetBSD_B | +----------+ +------+ | +----------+ | NetBSD_A |--- ... ---| NAPT |---+ +----------+ +------+ | +----------+ +----| NetBSD_C | +----------+ Add ATF later.
2018-12-26Remove unnecessary addresses in PF_KEY message.knakahara
MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says ==================== 5. SPD Update // snip SADB_X_SPDADD: // snip sadb_x_ipsecrequest_reqid: An ID for that SA can be passed to the kernel in the sadb_x_ipsecrequest_reqid field. If tunnel mode is specified, the sadb_x_ipsecrequest structure is followed by two sockaddr structures that define the tunnel endpoint addresses. In the case that transport mode is used, no additional addresses are specified. ==================== see: https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01 ipsecif(4) uses transport mode, so it should not add addresses.
2018-12-22Replace M_ALIGN and MH_ALIGN by m_align.maxv
2018-08-23Don't call key_ismyaddr, which may sleep, in a pserialize read sectionozaki-r
Use mutex here instead of pserialize because using mutex is simpler than using psz+ref, which is another solution, and key_checkspidup isn't called in any performance-sensitive paths.
2018-07-04merge duplicated code, more informative debugging.christos
2018-04-28Remove IPSEC_SPLASSERT_SOFTNET, it has always been a no-op.maxv
2018-04-19Remove extra long file paths from the headers.maxv
2018-04-17Fix panic of SADB when the state of sav is changed in timeoutyamaguchi
pointed out by ozaki-r@n.o, thanks
2018-04-16Added a lookup table to find an sav quicklyyamaguchi
key_sad.sahlists doesn't work well for inbound packets because its key includes source address. For the reason, the look-up-table for the inbound packets is newly added. The table has all sav whose state is MATURE or DYING and uses a key calculated by destination address, protocol, and spi instead of saidx. reviewd ozaki-r@n.o, thanks.
2018-04-16Introduced a hash table to sahlistyamaguchi
An saidx of sah included in the list is unique so that the search can use a hash list whose hash is calculated by the saidx to find an sah quickly. The hash list of the sahlits is used in FreeBSD, too. reviewed by ozaki-r@n.o, thanks.
2018-04-09Removed the unnecessary order check of key_lookup_sayamaguchi
key_prefered_oldsa flag can change the sa to use if an sah has multiple sav. However the multiple saves whose protocol is ah, esp, or tcp cannot exist because their duplications are checked by the spi value. Although the multiple saves can exist in the case of ipcomp, the values using in the post processing are same between the saves. For those reasons, it is no need to select an sav by its lifetime. In addition, FreeBSD has already remove this. reviewed by ozaki-r@n.o, thanks.
2018-03-02Avoid data races on lifetime counters by using percpu(9)ozaki-r
We don't make them percpu(9) directly because the structure is exposed to userland and we don't want to break ABI. So we add another member variable for percpu(9) and use it internally. When we export them to userland, they are converted to the original format.
2018-02-08Remove unused net_osdep.h include.maxv
2018-01-10add ipsec(4) interface, which is used for route-based VPN.knakahara
man and ATF are added later, please see man for details. reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks. https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html
2017-12-01Don't touch an SP without a reference to itozaki-r
2017-11-30Fix a deadlock happening if !NET_MPSAFEozaki-r
If NET_MPSAFE isn't set, key_timehandler_work is executed with holding softnet_lock. This means that localcount_drain can be called with holding softnet_lock resulting in a deadlock that localcount_drain waits for packet processing to release a reference to SP/SA while network processing is prevented by softnet_lock. Fix the deadlock by not taking softnet_lock in key_timehandler_work. It's okay because IPsec is MP-safe even if !NET_MPSAFE. Note that the change also needs to enable pserialize_perform because the IPsec code can be run in parallel now. Reported by christos@
2017-11-30Use KDASSERT for mutex_ownableozaki-r
Because mutex_ownable is not cheap.
2017-11-22Fix usage of FOREACH macroozaki-r
key_sad.lock is held there so SAVLIST_WRITER_FOREACH is enough.
2017-11-21Call key_sendup_mbuf immediately unless key_acquire is called in softintozaki-r
We need to defer it only if it's called in softint to avoid deadlock.
2017-11-21Simply the code by avoiding unnecessary error checksozaki-r
- Remove unnecessary m_pullup for self-allocated mbufs - Replace some if-fails-return sanity checks with KASSERT
2017-11-21Get rid of unnecessary NULL checks that are obsoleted by M_WAITOKozaki-r
2017-11-21Use M_WAITOK to allocate mbufs wherever sleepableozaki-r
Further changes will get rid of unnecessary NULL checks then.
2017-11-21Add missing splx to key_spdexpireozaki-r
2017-11-21Fix error handling of MCLGET in key_alloc_mbufozaki-r
2017-11-21Provide a function to call MGETHDR and MCLGETozaki-r
The change fixes two usages of MGETHDR that don't check whether a mbuf is really allocated before passing it to MCLGET.
2017-11-08Mark key_timehandler_ch callout as MP-safe (just forgot to do so)ozaki-r
2017-10-03Constify isr at many places (NFC)ozaki-r
2017-10-03Fix SP is broken on transport modeozaki-r
isr->saidx was modified accidentally in ipsec_nextisr. Reported by christos@ Helped investigations by christos@ and knakahara@
2017-10-03Don't abuse key_checkrequest just for looking up savozaki-r
It does more than expected for example key_acquire.
2017-10-01Fix typo in commentryoon