summaryrefslogtreecommitdiff
path: root/sys/netipsec/key.h
AgeCommit message (Collapse)Author
2022-12-08Fix: update lastused of ipsecif(4) IPv6 out SP.knakahara
2021-08-09fix various typos in compatibility, mainly in comments.andvar
2018-04-19Remove extra long file paths from the headers.maxv
2018-04-18Style, and remove unused MALLOC_DECLARE.maxv
2018-01-10add ipsec(4) interface, which is used for route-based VPN.knakahara
man and ATF are added later, please see man for details. reviewed by christos@n.o, joerg@n.o and ozaki-r@n.o, thanks. https://mail-index.netbsd.org/tech-net/2017/12/18/msg006557.html
2017-11-21Use M_WAITOK to allocate mbufs wherever sleepableozaki-r
Further changes will get rid of unnecessary NULL checks then.
2017-10-03Constify isr at many places (NFC)ozaki-r
2017-10-03Fix SP is broken on transport modeozaki-r
isr->saidx was modified accidentally in ipsec_nextisr. Reported by christos@ Helped investigations by christos@ and knakahara@
2017-10-03Don't abuse key_checkrequest just for looking up savozaki-r
It does more than expected for example key_acquire.
2017-08-09MP-ify SAD (savlist)ozaki-r
localcount(9) is used to protect savlist of sah. The basic design is similar to MP-ifications of SPD and SAD sahlist. Please read the locking notes of SAD for more details.
2017-08-08Introduce key_sa_refcnt and replace sav->refcnt with it (NFC)ozaki-r
2017-08-03Introduce KEY_SA_UNREF and replace KEY_FREESAV with it where sav will never ↵ozaki-r
be actually freed in the future KEY_SA_UNREF is still key_freesav so no functional change for now. This change reduces diff of further changes.
2017-08-02Make IPsec SPD MP-safeozaki-r
We use localcount(9), not psref(9), to make the sptree and secpolicy (SP) entries MP-safe because SPs need to be referenced over opencrypto processing that executes a callback in a different context. SPs on sockets aren't managed by the sptree and can be destroyed in softint. localcount_drain cannot be used in softint so we delay the destruction of such SPs to a thread context. To do so, a list to manage such SPs is added (key_socksplist) and key_timehandler_spd deletes dead SPs in the list. For more details please read the locking notes in key.c. Proposed on tech-kern@ and tech-net@
2017-07-26Provide and apply key_sp_refcnt (NFC)ozaki-r
It simplifies further changes.
2017-07-21Don't use key_lookup_sp that depends on unstable sp->req->savozaki-r
It provided a fast look-up of SP. We will provide an alternative method in the future (after basic MP-ification finishes).
2017-07-14Prepare to stop using isr->savozaki-r
isr is a shared resource and using isr->sav as a temporal storage for each packet processing is racy. And also having a reference from isr to sav makes the lifetime of sav non-deterministic; such a reference is removed when a packet is processed and isr->sav is overwritten by new one. Let's have a sav locally for each packet processing instead of using shared isr->sav. However this change doesn't stop using isr->sav yet because there are some users of isr->sav. isr->sav will be removed after the users find a way to not use isr->sav.
2017-07-14Pass sav directly to opencrypto callbackozaki-r
In a callback, use a passed sav as-is by default and look up a sav only if the passed sav is dead.
2017-07-13Simplify; omit unnecessary saidx passingozaki-r
- ipsec_nextisr returns a saidx but no caller uses it - key_checkrequest is passed a saidx but it can be gotton by another argument (isr)
2017-07-07Rename key_alloc* functions (NFC)ozaki-r
We shouldn't use the term "alloc" for functions that just look up data and actually don't allocate memory.
2017-05-30Make refcnt operations of SA and SP atomicozaki-r
Using atomic opeartions isn't optimal and should be optimized somehow in the future though, the change allows a kernel with NET_MPSAFE to run out a benchmark, which is useful to know performance improvement and degradation by code changes.
2017-05-26Make key_cmpspidx_exactly and key_cmpspidx_withmask staticozaki-r
2017-05-26Comment out unused key_freesp_so and key_freesoozaki-r
2017-05-16Run key_timehandler in thread context (workqueue)ozaki-r
The handler involves object deallocations so we want to not run it in softint.
2017-05-15Show __func__ instead of __FILE__ in debug log messagesozaki-r
__func__ is shorter and more useful than __FILE__.
2015-03-30Tidy up opt_ipsec.h inclusionsozaki-r
Some inclusions of opt_ipsec.h were for IPSEC_NAT_T and are now unnecessary. Add inclusions to some C files for IPSEC_DEBUG.
2014-05-30Introduce 2 new variables: ipsec_enabled and ipsec_used.christos
Ipsec enabled is controlled by sysctl and determines if is allowed. ipsec_used is set automatically based on ipsec being enabled, and rules existing.
2013-06-04PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may accesschristos
outdated pointers and pass ESP data to UPD-sockets. While here, simplify the code and remove the IPSEC_NAT_T option; always compile nat-traversal in so that it does not bitrot.
2011-06-09more "const"drochner
2011-05-23g/c remainders of IV handling in pfkey code -- this is done indrochner
opencrypto now
2011-02-21treat "struct secpolicyindex" and "struct secasindex" as "const" oncedrochner
they are initialized -- during lifetime, no changes are expected plus some constification of input to comparision functions etc mostly required by the former
2007-07-07Ansifydegroote
Remove useless extern bzero -> memset, bcopy -> memcpy No functionnal changes
2007-06-27Add support for options IPSEC_NAT_T (RFC 3947 and 3948) for fast_ipsec(4).degroote
No objection on tech-net@
2007-03-04Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.christos
2007-02-18Constify the code following the dyoung change ( the "bug" was hidden by thedegroote
extern declaration ). While here, remove a Kame ifdef which is useless in netipsec code
2005-12-10Multiple inclusion protection, as suggested by christos@ on tech-kern@elad
few days ago.
2005-02-26nuke trailing whitespaceperry
2004-03-02Bring the PCB policy cache over from KAME IPsec, including the "hint"thorpej
used to short-circuit IPsec processing in other places. This is enabled only for NetBSD at the moment; in order for it to function correctly, ipsec_pcbconn() must be called as appropriate.
2003-08-13Initial import of Sam Leffler's `Fast-IPsec' from FreeBSD 4.jonathan
Fast-IPsec is a rework of the OpenBSD and KAME IPsec code, using the OpenCryptoFramework (and thus hardware crypto accelerators) and numerous detailed performance improvements. This import is (aside from SPL-level names) the FreeBSD source, imported ``as-is'' as a historical snapshot, for future maintenance and comparison against the FreeBSD source. For now, several minor kernel-API differences are hidden by macros a shim file, ipsec_osdep.h, which (aside from SPL names) can be targeted at either NetBSD or FreeBSD.