summaryrefslogtreecommitdiff
path: root/sys/netipsec
AgeCommit message (Collapse)Author
2014-03-01Remove modification of an unused uninitialized variable.joerg
2014-02-25Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist beforepooka
the sysctl link sets are processed, and remove redundancy. Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate lines of code.
2013-12-24fix debugging output printfs to use __func__ so they print the correct names.christos
2013-12-24fix a typo in the log ouput of ipsec4_get_policydegroote
2013-11-03- apply some __diagusedmrg
- remove unused variables - move some variables inside their relevant use #ifdef
2013-09-19make debugging code use __func__christos
remove stray printf
2013-08-28Fix sense of consttime_memequal and update all callers.riastradh
Now it returns true (nonzero) to mean equal and false (zero) to mean inequal, as the name suggests. As promised on tech-userlevel back in June: https://mail-index.netbsd.org/tech-userlevel/2013/06/24/msg007843.html
2013-06-24Replace consttime_bcmp/explicit_bzero by consttime_memequal/explicit_memset.riastradh
consttime_memequal is the same as the old consttime_bcmp. explicit_memset is to memset as explicit_bzero was to bcmp. Passes amd64 release and i386/ALL, but I'm sure I missed some spots, so please let me know.
2013-06-11remove the last vestiges of fast_ipsecchristos
2013-06-08Split IPsec code in ip_input() and ip_forward() into the separate routinesrmind
ipsec4_input() and ipsec4_forward(). Tested by christos@.
2013-06-08Split IPSec logic from ip_output() into a separate routine - ipsec4_output().rmind
No change to the mechanism intended. Tested by christos@.
2013-06-05IPSEC has not come in two speeds for a long time now (IPSEC == kame,christos
FAST_IPSEC). Make everything refer to IPSEC to avoid confusion.
2013-06-04PR/47886: Dr. Wolfgang Stukenbrock: IPSEC_NAT_T enabled kernels may accesschristos
outdated pointers and pass ESP data to UPD-sockets. While here, simplify the code and remove the IPSEC_NAT_T option; always compile nat-traversal in so that it does not bitrot.
2013-05-09Fix FAST_IPSEC locking violation.gdt
Without this change, using ESP tunnels with FAST_IPSEC on a 2-cpu i386 machine results in an mbuf leak. This change was tested in netbsd-6. When FAST_IPSEC is enabled and a tunnel is set up, after the outer packet is stripped off, FAST_IPSEC queues the inner packet on the appropriate queue (ipinstrq or ip6instrq). These queues require the KERNEL_LOCK to be held before using the queue, and the FAST_IPSEC code did not take the KERNEL_LOCK as required. KERNEL_LOCK and KERNEL_UNLOCK_ONE calls have been added. If a struct ifnet instance is passed to the if_handoff function which does this queuing, the interface's if_start function may be called. Some hardware devices require KERNEL_LOCK to be held; others do not. Looking at the body of NetBSD code, other places where an if_start function is called, KERNEL_LOCK is held. Thus, the lock is not released in if_handoff until after the if_start function is called. In practice, having the kernel lock when if_start is called makes no difference - there is not a single instance in all of the NetBSD code where if_handoff is passed an instance of struct ifnet. This commit is the work of Bev Schwartz of BBN. Approved for Public Release, Distribution Unlimited This material is based upon work supported by the Defense Advanced Research Projects Agency and Space and Naval Warfare Systems Center, Pacific, under Contract No. N66001-09-C-2073.
2012-12-07rename pcb_sp to policy to avoid:christos
$SRC/arch/arm/include/pcb.h:#define pcb_sp pcb_un.un_32.pcb32_sp $SRC/arch/arm/include/pcb.h:#define pcb_sp pcb_sf.sf_r13
2012-09-20Fix whitespace (mostly removing trailing).gdt
This commit changes only whitespace (trailing, tabs vs spaces, removing spurious newlines). From Bev Schwartz of BBN.
2012-08-30Add "consttime_bcmp" and "explicit_bzero" functions for both kerneldrochner
abd userland, as proposed on tech-security, with explicit_bzero using a volatile function pointer as suggested by Alan Barrett. Both do what the name says. For userland, both are prefixed by "__" to keep them out of the user namespace. Change some memset/memcmp uses to the new functions where it makes sense -- these are just some examples, more to come.
2012-08-29g/c unused struct memberdrochner
2012-06-02Add some pre-processor magic to verify that the type of the data itemdsl
passed to sysctl_createv() actually matches the declared type for the item itself. In the places where the caller specifies a function and a structure address (typically the 'softc') an explicit (void *) cast is now needed. Fixes bugs in sys/dev/acpi/asus_acpi.c sys/dev/bluetooth/bcsp.c sys/kern/vfs_bio.c sys/miscfs/syncfs/sync_subr.c and setting AcpiGbl_EnableAmlDebugObject. (mostly passing the address of a uint64_t when typed as CTLTYPE_INT). I've test built quite a few kernels, but there may be some unfixed MD fallout. Most likely passing &char[] to char *. Also add CTLFLAG_UNSIGNED for unsiged decimals - not set yet.
2012-03-22remove KAME IPSEC, replaced by FAST_IPSECdrochner
2012-03-13Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls withelad
something meaningful. All relevant documentation has been updated or written. Most of these changes were brought up in the following messages: http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html Thanks to christos, manu, njoly, and jmmv for input. Huge thanks to pgoyette for spinning these changes through some build cycles and ATF.
2012-01-26remove some DPRINTFs which are not just diagnostics but cause noisedrochner
even on regular operation
2012-01-25After IPSEC input processing, pass a decoded/authenticated IPv4 packetdrochner
to upper layers through the IP protosw, as done for IPv6. Before it was reinjected into the IP netisr queue which caused more overhead and caused artefacts like double IP option processing. Works well for me, should get more testing and review.
2012-01-25Make sure the mbufs in the input path (only the parts which we are goingdrochner
to modify in the AH case) are writable/non-shared. This addresses PR kern/33162 by Jeff Rizzo, and replaces the insufficient patch from that time by a radical solution. (The PR's problem had been worked around by rev.1.3 of xennetback_xenbus.c, so it needs a network driver modification to reproduce it.) Being here, clarify a bit of ipcomp -- uncompression is done in-place, the header must be removed explicitly.
2012-01-24fix pointer/offset mistakes in handling of IPv4 optionsdrochner
2012-01-11fix build in the (FAST_)IPSEC & TCP_SIGNATURE casedrochner
2012-01-11protect "union sockaddr_union" from being defined twice by a CPP symboldrochner
(copied from FreeBSD), allows coexistence of (FAST_)IPSEC and pf
2012-01-10add patch from Arnaud Degroote to handle IPv6 extended options withdrochner
(FAST_)IPSEC, tested lightly with a DSTOPTS header consisting of PAD1
2012-01-09allow the ESP fragment length in the NAT-T case to be reported backdrochner
through the pfkey interface, kernel part of PR kern/44952 by Wolfgang Stukenbrock
2012-01-09Make FAST_IPSEC the default IPSEC implementation which is builtdrochner
into the kernel if the "IPSEC" kernel option is given. The old implementation is still available as KAME_IPSEC. Do some minimal manpage adjustment -- kame_ipsec(4) is a copy of the old ipsec(4) and the latter is now a copy of fast_ipsec(4).
2012-01-06more IPSEC header cleanup: don't install unneeded headers to userland,drochner
and remove some differences berween KAME and FAST_IPSEC
2012-01-04include <netipsec/ipsec.h> rather than <netinet6/ipsec.h> from userlanddrochner
where possible, for consistency and compatibility to FreeBSD (exception: KAME specific statistics gathering in netstat(1) and systat(1))
2012-01-04-consistently use "char *" for the compiled policy buffer in thedrochner
ipsec_*_policy() functions, as it was documented and used by clients -remove "ipsec_policy_t" which was undocumented and only present in the KAME version of the ipsec.h header -misc cleanup of historical artefacts, and to remove unnecessary differences between KAME ans FAST_IPSEC
2011-12-19rename the IPSEC in-kernel CPP variable and config(8) option todrochner
KAME_IPSEC, and make IPSEC define it so that existing kernel config files work as before Now the default can be easily be changed to FAST_IPSEC just by setting the IPSEC alias to FAST_IPSEC.
2011-12-19as in netkey/key.c, just use cprng_fast() to get a random numberdrochner
(which is used to choose an SPI), kill the dummy seeding code
2011-11-29add missing rnd_extract->cprng_fast conversion, fixes build ofdrochner
FAST_IPSEC kernels
2011-08-31NULL does not need a castplunky
2011-07-17Retire varargs.h support. Move machine/stdarg.h logic into MIjoerg
sys/stdarg.h and expect compiler to provide proper builtins, defaulting to the GCC interface. lint still has a special fallback. Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and derive va_list as required by standards.
2011-06-09catch a case where an ip6 address with scope embedded was compared withdrochner
one without -- interestingly this didn't break the connection but just caused a useless encapsulation (this code needs to be rearranged to get it clean)
2011-06-09more "const"drochner
2011-06-08Fiddle a bit with const's to make FAST_IPSEC compile.dyoung
2011-06-07fix tunnel encapsulation in ipsec6_process_packet() -- it is notdrochner
completely clean yet, but at least a v6-in-v6 tunnel works now
2011-06-07reindent ipsec6_process_packet() - whitespace changes onlydrochner
2011-06-06remove a limitation that inner and outer IP version must be equaldrochner
for an ESP tunnel, and add some fixes which make v4-in-v6 work (v6 as inner protocol isn't ready, even v6-in-v6 can never have worked) being here, fix a statistics counter and kill an unused variable
2011-06-05more malloc style.christos
2011-06-05- sprinkle constchristos
- malloc style
2011-05-26pull in AES-GCM/GMAC support from OpenBSDdrochner
This is still somewhat experimental. Tested between 2 similar boxes so far. There is much potential for performance improvement. For now, I've changed the gmac code to accept any data alignment, as the "char *" pointer suggests. As the code is practically used, 32-bit alignment can be assumed, at the cost of data copies. I don't know whether bytewise access or copies are worse performance-wise. For efficient implementations using SSE2 instructions on x86, even stricter alignment requirements might arise.
2011-05-24copy AES-XCBC-MAC support from KAME IPSEC to FAST_IPSECdrochner
For this to fit, an API change in cryptosoft was adopted from OpenBSD (addition of a "Setkey" method to hashes) which was done for GCM/GMAC support there, so it might be useful in the future anyway. tested against KAME IPSEC AFAICT, FAST_IPSEC now supports as much as KAME.
2011-05-23g/c remainders of IV handling in pfkey code -- this is done indrochner
opencrypto now
2011-05-23allow ESP to use AES-CTRdrochner
(pfkey and userland tool support is already there because it has been in KAME IPSEC all the time) tested against KAME IPSEC