src/usr.bin/netstat/ipsec.c, branch stable/14 FreeBSD source tree Remove $FreeBSD$: one-line .c pattern 2023-08-16T17:54:42+00:00 Warner Losh imp@FreeBSD.org 2023-08-16T17:54:42+00:00 1d386b48a555f61cb7325543adbbb5c3f3407a66 Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/ 
Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
ipsec(4): Fix a few typos in error messages 2022-02-06T12:43:42+00:00 Gordon Bergling gbe@FreeBSD.org 2022-02-06T12:43:42+00:00 ecc467ebad065299804ca556e86c0c5ebf060700 - s/receieve/receive/ MFC after: 1 week 
- s/receieve/receive/

MFC after:	1 week
netstat: split ipsec and ipsec6 statistics in libxo 2021-10-05T09:42:58+00:00 Mateusz Guzik mjg@FreeBSD.org 2021-10-05T09:42:58+00:00 ae4fb190fd4a21649c4562fc6cd81bba4da222a4 In particular fixes --libxo json PR: 254673 Reported by: j.vandeville@gmail.com Sponsored by: Rubicon Communications, LLC ("Netgate") 
In particular fixes --libxo json

PR:		254673
Reported by:	j.vandeville@gmail.com
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Refer to AES-CBC as "aes-cbc" rather than "rijndael-cbc" for IPsec. 2020-06-04T22:58:37+00:00 John Baldwin jhb@FreeBSD.org 2020-06-04T22:58:37+00:00 00a4311adc197c3518f5d60c69e00c4e80d065fd At this point, AES is the more common name for Rijndael128. setkey(8) will still accept the old name, and old constants remain for compatiblity. Reviewed by: cem, bcr (manpages) MFC after: 2 weeks Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24964 
At this point, AES is the more common name for Rijndael128.  setkey(8)
will still accept the old name, and old constants remain for
compatiblity.

Reviewed by:	cem, bcr (manpages)
MFC after:	2 weeks
Sponsored by:	Chelsio Communications
Differential Revision:	https://reviews.freebsd.org/D24964
Remove support for IPsec algorithms deprecated in r348205 and r360202. 2020-05-02T00:06:58+00:00 John Baldwin jhb@FreeBSD.org 2020-05-02T00:06:58+00:00 16aabb761c0a8e5fb120594fcce4f2bf79fad61e Examples of depecrated algorithms in manual pages and sample configs are updated where relevant. I removed the one example of combining ESP and AH (vs using a cipher and auth in ESP) as RFC 8221 says this combination is NOT RECOMMENDED. Specifically, this removes support for the following ciphers: - des-cbc - 3des-cbc - blowfish-cbc - cast128-cbc - des-deriv - des-32iv - camellia-cbc This also removes support for the following authentication algorithms: - hmac-md5 - keyed-md5 - keyed-sha1 - hmac-ripemd160 Reviewed by: cem, gnn (older verisons) Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24342 
Examples of depecrated algorithms in manual pages and sample configs
are updated where relevant.  I removed the one example of combining
ESP and AH (vs using a cipher and auth in ESP) as RFC 8221 says this
combination is NOT RECOMMENDED.

Specifically, this removes support for the following ciphers:
- des-cbc
- 3des-cbc
- blowfish-cbc
- cast128-cbc
- des-deriv
- des-32iv
- camellia-cbc

This also removes support for the following authentication algorithms:
- hmac-md5
- keyed-md5
- keyed-sha1
- hmac-ripemd160

Reviewed by:	cem, gnn (older verisons)
Relnotes:	yes
Sponsored by:	Chelsio Communications
Differential Revision:	https://reviews.freebsd.org/D24342
Tidy up the list of auth and encryption algorithms for IPsec stats. 2019-08-07T00:53:27+00:00 John Baldwin jhb@FreeBSD.org 2019-08-07T00:53:27+00:00 67b3fe8ecfee0266f3aaabc0c04e0b9de1af45ec - Use keyed-md5 and keyed_sha1 instead of md5 and sha1 to match the names accepted by setkey and to also avoid confusion since these are not "plain" MD5 or SHA1. - Remove always-true #ifdef's to make the source a bit easier to read. - Add missing mappings for tcp-md5, camellia-cbc, and aes-gmac. MFC after: 2 weeks Sponsored by: Chelsio Communications 
- Use keyed-md5 and keyed_sha1 instead of md5 and sha1 to match
  the names accepted by setkey and to also avoid confusion since
  these are not "plain" MD5 or SHA1.
- Remove always-true #ifdef's to make the source a bit easier to
  read.
- Add missing mappings for tcp-md5, camellia-cbc, and aes-gmac.

MFC after:	2 weeks
Sponsored by:	Chelsio Communications
Add a SPD cache to speed up lookups. 2018-05-22T15:54:25+00:00 Fabien Thomas fabient@FreeBSD.org 2018-05-22T15:54:25+00:00 f8e73c47d844996676c9e788cae7a950281de64d When large SPDs are used, we face two problems: - too many CPU cycles are spent during the linear searches in the SPD for each packet - too much contention on multi socket systems, since we use a single shared lock. Main changes: - added the sysctl tree 'net.key.spdcache' to control the SPD cache (disabled by default). - cache the sp indexes that are used to perform SP lookups. - use a range of dedicated mutexes to protect the cache lines. Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu> Reviewed by: ae Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D15050 
When large SPDs are used, we face two problems:

- too many CPU cycles are spent during the linear searches in the SPD
  for each packet
- too much contention on multi socket systems, since we use a single
  shared lock.

Main changes:

- added the sysctl tree 'net.key.spdcache' to control the SPD cache
  (disabled by default).
- cache the sp indexes that are used to perform SP lookups.
- use a range of dedicated mutexes to protect the cache lines.

Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu>
Reviewed by: ae
Sponsored by:	Stormshield
Differential Revision: https://reviews.freebsd.org/D15050
General further adoption of SPDX licensing ID tags. 2017-11-20T19:49:47+00:00 Pedro F. Giffuni pfg@FreeBSD.org 2017-11-20T19:49:47+00:00 8a16b7a18f5d0b031f09832fd7752fba717e2a97 Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. 
Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.
Add descriptions for AES-GCM IPSec authentication (AH) counters. 2017-05-27T16:53:39+00:00 John Baldwin jhb@FreeBSD.org 2017-05-27T16:53:39+00:00 708e72dc376e421f72946de635f627da36541095 MFC after: 1 week Sponsored by: Chelsio Communications 
MFC after:	1 week
Sponsored by:	Chelsio Communications
Renumber copyright clause 4 2017-02-28T23:42:47+00:00 Warner Losh imp@FreeBSD.org 2017-02-28T23:42:47+00:00 fbbd9655e5107c68e4e0146ff22b73d7350475bc Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96