diff options
| author | Fabien Thomas <fabient@FreeBSD.org> | 2016-11-25 14:44:49 +0000 |
|---|---|---|
| committer | Fabien Thomas <fabient@FreeBSD.org> | 2016-11-25 14:44:49 +0000 |
| commit | bf4356266d568717f6ae3b7f060ded6598357788 (patch) | |
| tree | 1ed2019b0695d920986e4b721c6938557c8500e6 /sys/net | |
| parent | dcf3302859e24b26f3b1dff2c8e104fdbe976825 (diff) | |
| download | src-bf4356266d568717f6ae3b7f060ded6598357788.tar.gz src-bf4356266d568717f6ae3b7f060ded6598357788.zip | |
IPsec RFC6479 support for replay window sizes up to 2^32 - 32 packets.
Since the previous algorithm, based on bit shifting, does not scale
with large replay windows, the algorithm used here is based on
RFC 6479: IPsec Anti-Replay Algorithm without Bit Shifting.
The replay window will be fast to be updated, but will cost as many bits
in RAM as its size.
The previous implementation did not provide a lock on the replay window,
which may lead to replay issues.
Reviewed by: ae
Obtained from: emeric.poupon@stormshield.eu
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D8468
Notes
Notes:
svn path=/head/; revision=309144
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/pfkeyv2.h | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/sys/net/pfkeyv2.h b/sys/net/pfkeyv2.h index c9b276954a36..353488197c9d 100644 --- a/sys/net/pfkeyv2.h +++ b/sys/net/pfkeyv2.h @@ -283,6 +283,14 @@ struct sadb_x_nat_t_frag { }; _Static_assert(sizeof(struct sadb_x_nat_t_frag) == 8, "struct size mismatch"); +/* Additional large replay window support + */ +struct sadb_x_sa_replay { + u_int16_t sadb_x_sa_replay_len; + u_int16_t sadb_x_sa_replay_exttype; + u_int32_t sadb_x_sa_replay_replay; /* in packets */ +}; +_Static_assert(sizeof(struct sadb_x_sa_replay) == 8, "struct size mismatch"); #define SADB_EXT_RESERVED 0 #define SADB_EXT_SA 1 @@ -311,7 +319,8 @@ _Static_assert(sizeof(struct sadb_x_nat_t_frag) == 8, "struct size mismatch"); #define SADB_X_EXT_NAT_T_OAI 23 /* Peer's NAT_OA for src of SA. */ #define SADB_X_EXT_NAT_T_OAR 24 /* Peer's NAT_OA for dst of SA. */ #define SADB_X_EXT_NAT_T_FRAG 25 /* Manual MTU override. */ -#define SADB_EXT_MAX 25 +#define SADB_X_EXT_SA_REPLAY 26 /* Replay window override. */ +#define SADB_EXT_MAX 26 #define SADB_SATYPE_UNSPEC 0 #define SADB_SATYPE_AH 2 |