summaryrefslogtreecommitdiff
path: root/sys/netkey
AgeCommit message (Collapse)Author
2003-12-10do not touch sav->xx after key_freesav(). from hajimu umemotoitojun
2003-12-04Dynamic sysctl.atatat
Gone are the old kern_sysctl(), cpu_sysctl(), hw_sysctl(), vfs_sysctl(), etc, routines, along with sysctl_int() et al. Now all nodes are registered with the tree, and nodes can be added (or removed) easily, and I/O to and from the tree is handled generically. Since the nodes are registered with the tree, the mapping from name to number (and back again) can now be discovered, instead of having to be hard coded. Adding new nodes to the tree is likewise much simpler -- the new infrastructure handles almost all the work for simple types, and just about anything else can be done with a small helper function. All existing nodes are where they were before (numerically speaking), so all existing consumers of sysctl information should notice no difference. PS - I'm sorry, but there's a distinct lack of documentation at the moment. I'm working on sysctl(3/8/9) right now, and I promise to watch out for buses.
2003-11-27missing splx. Hajimu UMEMOTO via kameitojun
2003-11-11in_ifaddr -> in_ifaddrheaddrochner
use TAILQ_FOREACH macro
2003-11-10splsoftnet() on spd/sad-dump-via-sysctl to ensure no 2 threads to go intoitojun
the function, or entries being removed during the dump operation. suenaga@iij
2003-11-04suppress -Wuninitializeditojun
2003-10-25fixed uninitialized variablechristos
2003-10-13update m_pkthdr.lenitojun
2003-09-23extra blank lineitojun
2003-09-22mark security policy that should persist in the system "persistent".itojun
this should prevent recently-reported kernel panic when "spdflush" is issued.
2003-09-20unifdef -UFAST_IPSECitojun
2003-09-142^n hash table is better in the kernel. advise by perry@netbsditojun
2003-09-14use prime number to hash SPIitojun
2003-09-12no need for netipsec/key*, they are almost identical to netkey/key*itojun
2003-09-12make it possible to SADB_DUMP via sysctl. request by mrgitojun
2003-09-12remove #define for bsdiitojun
2003-09-12kill unneeded variableitojun
2003-09-09correct hashed SPI lookup. reported by Greg Troxelitojun
2003-09-08add /kern/ipsecsa and /kern/ipsecsp, which can be inspected by setkey(8).itojun
it allows easier access to ipsecsa/sp. it works around problem where setkey -D does not work with large number of ipsec SAs due to socket buffer size.
2003-09-08splsoftnet in key_setspiitojun
2003-09-07revisit spihash logicitojun
2003-09-07- prepare for RFC2401bis 64bit sequence number (no behavior change yet)itojun
- use hash for SPI-based SAD entry lookup (should be faster, i hope) - cleanup keydb.c and key.c. key.c is responsible for refcounting secasvar, keydb.c is responsible for alloc/free.
2003-08-22allow userland to specify SPD ID. more readable debugging messages.itojun
2003-08-22KNFitojun
2003-08-22backout; committed by mistakeitojun
2003-08-22do not quit from key_sendup() even if writes to non-target socket fails.itojun
from SEIL team
2003-07-25fixed that the kernel crashed when key_spdacquire() was calleditojun
because key_spdacquire() had been implemented imcopletely. sync w/kame
2003-07-22fix comments, styleitojun
2003-07-22clear enc/auth key before freeingitojun
2003-07-22clear scheduled key before freeing, for safetyitojun
2003-06-29Back out the lwp/ktrace changes. They contained a lot of colateral damage,fvdl
and need to be examined and discussed more.
2003-06-28malloc() returns "void *", we don't need to cast the return value.simonb
2003-06-28Pass lwp pointers throughtout the kernel, as required, so that the lwpid candarrenr
be inserted into ktrace records. The general change has been to replace "struct proc *" with "struct lwp *" in various function prototypes, pass the lwp through and use l_proc to get the process pointer when needed. Bump the kernel rev up to 1.6V
2003-06-16tighten sanity check on ipsec policy. sync w/kameitojun
2003-02-01Add extensible malloc types, adapted from FreeBSD. This turnsthorpej
malloc types into a structure, a pointer to which is passed around, instead of an int constant. Allow the limit to be adjusted when the malloc type is defined, or with a function call, as suggested by Jonathan Stone.
2003-01-08allocate route_in6 in struct secashead, to avoid mistakenly overrunitojun
the end of secashead. Fixes PR18751.
2002-12-09don't permit port spec on tunnel mode policy. sync w/kame.itojun
2002-11-26Remove KDIR=, since SYS_INCLUDE=symlinks and KDIR are not supported any more.lukem
2002-11-02/*CONTCOND*/ while (0)'ed macrosperry
2002-10-07warn about the arc4 generator if no NRND, but still use itdan
2002-10-06ESP output was drawing down the entropy pool at a ferocious rate, atls
particular problem on hosts with only wireless interfaces that are definitely not safe to use as entropy sources. Add arc4randbytes() which hands out bytes from the same source used by arc4random(). This is intended to be a _temporary_ interface until we can design and implement a better general PRNG interface that is decoupled from the entropy-pool implementation. Modify key_randomfill() (used only for initialization vectors on SA creation and via key_sa_stir_iv(), which does not "stir", despite its name) to use arc4randbytes() instead of pulling bits directly from the entropy pool. It is my hope that this change will pose minimal integration problems for the KAME folks as the random-pool interface is *already* different between each BSD variant; this just simplifies the NetBSD case and solves a fairly serious problem. Note that it is generally considered acceptable cryptographic practice to use a fast stream cipher to generate IVs for encryption with stronger block ciphers. For example, the use of "non-Approved" PRNGs to generate IVs for "Approved" block ciphers is explicitly sanctioned by FIPS 140-2.
2002-10-04port spec is not permitted to tunnel mode policy, as we don't reassembleitojun
fragments. perform more strict check against af match for tunnels. sync w/kame
2002-09-27remove trailing \n in panic(). approved perry.provos
2002-09-23fix signed/unsigned pointer mixupitojun
2002-09-11KNF - return is not a function. sync w/kame.itojun
2002-09-11correct signedness mixup in pointer passing. sync w/kameitojun
2002-08-20should return error code from key_senderror(). sync w/kameitojun
2002-08-20fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime.itojun
sync w/kame
2002-06-27correct %d/%u mismatch. sync w/kameitojun
2002-06-14cache pcb policy as much as possible. in fact, if policy is notitojun
IPSEC_POLICY_IPSEC we don't need to compare spidx. sync w/kame