summaryrefslogtreecommitdiff
path: root/sys/netipsec
AgeCommit message (Collapse)Author
2023-01-27ipsec: remove unnecessary splsoftnetozaki-r
Because the code of IPsec itself is already MP-safe.
2022-12-08Fix: sp->lastused should be updated by time_uptime, and refactor a little.knakahara
2022-12-08Fix: update lastused of ipsecif(4) IPv6 out SP.knakahara
2022-12-07gif(4), ipsec(4) and l2tp(4) use encap_attach_addr().knakahara
2022-11-09Fix IPv4 security policy with port number does not work for forwarding packets.knakahara
2022-11-04inpcb: rename functions to inpcb_*ozaki-r
Inspired by rmind-smpnet patches.
2022-10-28Remove in_pcb_hdr.hozaki-r
2022-10-28inpcb: integrate data structures of PCB into oneozaki-r
Data structures of network protocol control blocks (PCBs), i.e., struct inpcb, in6pcb and inpcb_hdr, are not organized well. Users of the data structures have to handle them separately and thus the code is cluttered and duplicated. The commit integrates the data structures into one, struct inpcb. As a result, users of PCBs only have to handle just one data structure, so the code becomes simple. One drawback is that the data size of PCB for IPv4 increases by 40 bytes (from 248 bytes to 288 bytes).
2022-10-19PR/56836: Andrew Cagney: IPv6 ESN tunneling IPcomp has corrupt headerchristos
Always always send / expect CPI in IPcomp header Fixes kern/56836 where an IPsec interop combining compression and ESP|AH would fail. Since fast ipsec, the outgoing IPcomp header has contained the compression algorithm instead of the CPI. Adding the SADB_X_EXT_RAWCPI flag worked around this but ... The IPcomp's SADB was unconditionally hashed using the compression algorithm instead of the CPI. This meant that an incoming packet with a valid CPI could never match its SADB.
2022-10-11Add sadb_x_policy_flags to inform SP origination.knakahara
This extension(struct sadb_x_policy) is *not* defined by RFC2367. OpenBSD does not have reserved fields in struct sadb_x_policy. Linux does not use this field yet. FreeBSD uses this field as "sadb_x_policy_scope"; the value range is from 0x00 to 0x04. We use from most significant bit to avoid the above usage.
2022-09-02Remove unnecessary inclusion of <net/netisr.h>.thorpej
2022-08-23Improve IPsec log when no key association found for SA. Implemented by ↵knakahara
ohishi@IIJ.
2022-08-09Add sysctl entry to improve interconnectivity to some VPN appliances, ↵knakahara
pointed out by seil-team@IIJ. If we want to allow different identifier types on IDii and IDir, set net.key.allow_different_idtype=1. Default(=0) is the same as before.
2022-05-25ipsec: don't assert for the format of incoming packetsozaki-r
2022-05-24fix various typos in comment, documentation and log messages.andvar
2022-05-22opencrypto: crypto_dispatch never fails now. Make it return void.riastradh
Same with crypto_kdispatch.
2022-05-22opencrypto: Rip out EAGAIN logic when unregistering crypto drivers.riastradh
I'm pretty sure this never worked reliably based on code inspection, and it's unlikely to have ever been tested because it only applies when unregistering a driver -- but we have no crypto drivers for removable devices, so it would only apply if we went out of our way to trigger detach with drvctl. Instead, just make the operation fail with ENODEV, and remove all the callback logic to resubmit the request on EAGAIN. (Maybe this should be ENXIO, but crypto_kdispatch already does ENODEV.)
2022-05-22opencrypto: Make crypto_freesession return void.riastradh
No callers use the return value. It is not sensible to allow this to fail.
2022-05-22netipsec: Nothing uses xf_zeroize return value. Nix it.riastradh
2022-05-22opencrypto: Make crp_callback, krp_callback return void.riastradh
Nothing uses the return values inside opencrypto, so let's stop making users return them.
2022-05-19PR/56840: Andrew Cagney: use the proper polarity hton/ntoh macros (nochristos
functional change). Factor out spi retrieving code into a function.
2022-05-18PR/56841: Andrew Cagney: debug-log IPcomp CPI lookups:christos
- debug-logs why an SPI is rejected - adds missing __VA_OPT__(,) to some printf macros - debug-log SPI+proto when adding/updating entry
2022-04-10fix various typos in comments and output/log messages.andvar
2022-02-13fix few typos in comments and log message.andvar
2022-01-02fix few more typos in comments.andvar
2021-12-08s/speficication/specification/andvar
2021-12-03fix various typos in comments, log messages and documentation.andvar
2021-11-10s/assocciation/association/ in comment.msaitoh
2021-08-09fix various typos in compatibility, mainly in comments.andvar
2020-10-05Make sequence number of esp header MP-safe for IPsec Tx side. reviewed by ↵knakahara
ozaki-r@n.o In IPsec Tx side, one Security Association can be used by multiple CPUs. On the other hand, in IPsec Rx side, one Security Association is used by only one CPU. XXX pullup-{8,9}
2020-08-28ipsec: rename ipsec_ip_input to ipsec_ip_input_checkpolicyozaki-r
Because it just checks if a packet passes security policies.
2020-08-28inet, inet6: count packets dropped by IPsecozaki-r
The counters count packets dropped due to security policy checks.
2020-06-30Rename enc_xform_rijndael128 -> enc_xform_aes.riastradh
Update netipsec dependency.
2020-04-22Make crypto/rijindael optional again as cprng_strong does no longerrin
depend on it. Dependency is explicitly declared in files.foo if a component requires it.
2020-03-13Fix kern/55066. Pointed out and fixed by Chuck Zmudzinski, thanks.knakahara
ok'ed by ozaki-r@n.o
2020-02-07Use percpu_foreach_xcall() to gather volatile per-cpu counters. Thesethorpej
must be serialized against the interrupts / soft-interrupts in which they're manipulated, as well as protected from non-atomic 64-bit memory loads on 32-bit platforms.
2020-01-31Fix IPv6 over IPv4 ipsecif(4) uses IPv4 SP wrongly. Pointed out by ohishi@IIJ.knakahara
XXX pullup-8, pullup-9
2019-11-14Reduce load for IKE negotiations when the system has many IPv6 addresses.knakahara
e.g. the system has many vlan(4), gif(4) or ipsecif(4) with link local address.
2019-11-12Fix SA can be expaired wrongly when there are many SPs.knakahara
When key_timehandler_spd() spent over one second, the "now" argument of key_timehandler_sad() could be older than sav->created. That caused SA was expired immediately.
2019-11-01Make global and per-interface ipsecif(4) pmtu tunable like gif(4).knakahara
And make hop limit tunable same as gif(4). See http://mail-index.netbsd.org/source-changes/2019/10/30/msg110426.html
2019-11-01Fix ipsecif(4) IPV6_MINMTU does not work correctly.knakahara
2019-09-25Make panic messages more informativeozaki-r
2019-09-19Avoid having a rtcache directly in a percpu storage for tunnel protocols.knakahara
percpu(9) has a certain memory storage for each CPU and provides it by the piece to users. If the storages went short, percpu(9) enlarges them by allocating new larger memory areas, replacing old ones with them and destroying the old ones. A percpu storage referenced by a pointer gotten via percpu_getref can be destroyed by the mechanism after a running thread sleeps even if percpu_putref has not been called. Using rtcache, i.e., packet processing, typically involves sleepable operations such as rwlock so we must avoid dereferencing a rtcache that is directly stored in a percpu storage during packet processing. Address this situation by having just a pointer to a rtcache in a percpu storage instead. Reviewed by ozaki-r@ and yamaguchi@
2019-09-19Avoid having a rtcache directly in a percpu storageozaki-r
percpu(9) has a certain memory storage for each CPU and provides it by the piece to users. If the storages went short, percpu(9) enlarges them by allocating new larger memory areas, replacing old ones with them and destroying the old ones. A percpu storage referenced by a pointer gotten via percpu_getref can be destroyed by the mechanism after a running thread sleeps even if percpu_putref has not been called. Using rtcache, i.e., packet processing, typically involves sleepable operations such as rwlock so we must avoid dereferencing a rtcache that is directly stored in a percpu storage during packet processing. Address this situation by having just a pointer to a rtcache in a percpu storage instead. Reviewed by knakahara@ and yamaguchi@
2019-08-07ipsec_getpolicybysock() should also call key_havesp() like ↵knakahara
ipsec_getpolicybyaddr(). That can reduce KEYDEBUG messages.
2019-08-04Fix info leaks.maxv
2019-07-23ipsec: fix a regression of the update APIozaki-r
The update API updates an SA by creating a new SA and removing an existing SA. The previous change removed a newly added SA wrongly if an existing SA had been created by the getspi API.
2019-07-17Avoid a race condition between SA (sav) manipulationsozaki-r
An sav can be removed from belonging list(s) twice resulting in an assertion failure of pslist. It can occur if the following two operations interleave: (i) a deletion or a update of an SA via the API, and (ii) a state change (key_sa_chgstate) of the same SA by the timer. Note that even (ii) removes an sav once from its list(s) on a update. The cause of the race condition is that the two operations are not serialized and (i) doesn't get and remove an sav from belonging list(s) atomically. So (ii) can be inserted between an acquisition and a removal of (i). Avoid the race condition by making (i) atomic.
2019-07-09Fix uninitialized variable: in ipsec_checkpcbcache(), spidx.dir is notmaxv
initialized, and the padding of the spidx structure is not initialized either. This causes the memcmp() to wrongfully fail. Change ipsec_setspidx() to always initialize spdix.dir and zero out the padding. ok ozaki-r@
2019-06-12make DPRINTF use varyadic cpp macros, and merge with IPSECLOG.christos