aboutsummaryrefslogtreecommitdiff
path: root/sys/netipsec
Commit message (Collapse)AuthorAgeFilesLines
* drop key_sa_stir_iv as it isn't used...John-Mark Gurney2015-06-112-9/+0
| | | | | | | Reviewed by: eri, ae Notes: svn path=/head/; revision=284259
* CALLOUT_MPSAFE has lost its meaning since r141428, i.e., for more than tenJung-uk Kim2015-05-221-1/+1
| | | | | | | | | | | | | years for head. However, it is continuously misused as the mpsafe argument for callout_init(9). Deprecate the flag and clean up callout_init() calls to make them more consistent. Differential Revision: https://reviews.freebsd.org/D2613 Reviewed by: jhb MFC after: 2 weeks Notes: svn path=/head/; revision=283291
* In the reply to SADB_X_SPDGET message use the same sequence number thatAndrey V. Elsukov2015-05-201-2/+3
| | | | | | | | | | | was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour. PR: 137309 MFC after: 2 weeks Notes: svn path=/head/; revision=283146
* Remove unneded mbuf length adjustment, M_PREPEND() already did that.Andrey V. Elsukov2015-05-191-2/+0
| | | | | | | | PR: 139387 MFC after: 1 week Notes: svn path=/head/; revision=283117
* Change SA's state before sending SADB_EXPIRE message. This state willAndrey V. Elsukov2015-05-191-2/+2
| | | | | | | | | be reported to keying daemon. MFC after: 2 weeks Notes: svn path=/head/; revision=283102
* Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARDAndrey V. Elsukov2015-05-191-40/+38
| | | | | | | | | | | | | | | | extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA. PR: 200282, 200283 Submitted by: Tobias Brunner <tobias at strongswan dot org> MFC after: 2 weeks Notes: svn path=/head/; revision=283101
* Summary: Remove spurious, extra, next header comments.George V. Neville-Neil2015-05-151-4/+2
| | | | | | | Correct the name of the pad length field. Notes: svn path=/head/; revision=282982
* Fix the comment. We will not do SPD lookup again, becauseAndrey V. Elsukov2015-04-281-2/+1
| | | | | | | | | ip[6]_ipsec_output() will find PACKET_TAG_IPSEC_OUT_DONE mbuf tag. Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282139
* Since PFIL can change mbuf pointer, we should update pointers afterAndrey V. Elsukov2015-04-282-0/+3
| | | | | | | | | calling ipsec_filter(). Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282132
* Make ipsec_in_reject() static. We use ipsec[46]_in_reject() instead.Andrey V. Elsukov2015-04-272-2/+2
| | | | | | | Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282048
* Fix possible use after free due to security policy deletion.Andrey V. Elsukov2015-04-274-8/+30
| | | | | | | | | | | | | | | | | | | When we are passing mbuf to IPSec processing via ipsec[46]_process_packet(), we hold one reference to security policy and release it just after return from this function. But IPSec processing can be deffered and when we release reference to security policy after ipsec[46]_process_packet(), user can delete this security policy from SPDB. And when IPSec processing will be done, xform's callback function will do access to already freed memory. To fix this move KEY_FREESP() into callback function. Now IPSec code will release reference to SP after processing will be finished. Differential Revision: https://reviews.freebsd.org/D2324 No objections from: #network Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282046
* Change ipsec_address() and ipsec_logsastr() functions to take twoAndrey V. Elsukov2015-04-187-132/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | additional arguments - buffer and size of this buffer. ipsec_address() is used to convert sockaddr structure to presentation format. The IPv6 part of this function returns pointer to the on-stack buffer and at the moment when it will be used by caller, it becames invalid. IPv4 version uses 4 static buffers and returns pointer to new buffer each time when it called. But anyway it is still possible to get corrupted data when several threads will use this function. ipsec_logsastr() is used to format string about SA entry. It also uses static buffer and has the same problem with concurrent threads. To fix these problems add the buffer pointer and size of this buffer to arguments. Now each caller will pass buffer and its size to these functions. Also convert all places where these functions are used (except disabled code). And now ipsec_address() uses inet_ntop() function from libkern. PR: 185996 Differential Revision: https://reviews.freebsd.org/D2321 Reviewed by: gnn Sponsored by: Yandex LLC Notes: svn path=/head/; revision=281695
* Requeue mbuf via netisr when we use IPSec tunnel mode and IPv6.Andrey V. Elsukov2015-04-181-1/+30
| | | | | | | | | | | | | | | | | | | | | | ipsec6_common_input_cb() uses partial copy of ip6_input() to parse headers. But this isn't correct, when we use tunnel mode IPSec. When we stripped outer IPv6 header from the decrypted packet, it can become IPv4 packet and should be handled by ip_input. Also when we use tunnel mode IPSec with IPv6 traffic, we should pass decrypted packet with inner IPv6 header to ip6_input, it will correctly handle it and also can decide to forward it. The "skip" variable points to offset where payload starts. In tunnel mode we reset it to zero after stripping the outer header. So, when it is zero, we should requeue mbuf via netisr. Differential Revision: https://reviews.freebsd.org/D2306 Reviewed by: adrian, gnn Sponsored by: Yandex LLC Notes: svn path=/head/; revision=281694
* Fix handling of scoped IPv6 addresses in IPSec code.Andrey V. Elsukov2015-04-183-36/+21
| | | | | | | | | | | | | | | | | | | | | | | | * in ipsec_encap() embed scope zone ids into link-local addresses in the new IPv6 header, this helps ip6_output() disambiguate the scope; * teach key_ismyaddr6() use in6_localip(). in6_localip() is less strict than key_sockaddrcmp(). It doesn't compare all fileds of struct sockaddr_in6, but it is faster and it should be safe, because all SA's data was checked for correctness. Also, since IPv6 link-local addresses in the &V_in6_ifaddrhead are stored in kernel-internal form, we need to embed scope zone id from SA into the address before calling in6_localip. * in ipsec_common_input() take scope zone id embedded in the address and use it to initialize sin6_scope_id, then use this sockaddr structure to lookup SA, because we keep addresses in the SADB without embedded scope zone id. Differential Revision: https://reviews.freebsd.org/D2304 Reviewed by: gnn Sponsored by: Yandex LLC Notes: svn path=/head/; revision=281693
* Remove xform_ipip.c and code related to XF_IP4.Andrey V. Elsukov2015-04-183-404/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | The only thing is used from this code is ipip_output() function, that does IPIP encapsulation. Other parts of XF_IP4 code were removed in r275133. Also it isn't possible to configure the use of XF_IP4, nor from userland via setkey(8), nor from the kernel. Simplify the ipip_output() function and rename it to ipsec_encap(). * move IP_DF handling from ipsec4_process_packet() into ipsec_encap(); * since ipsec_encap() called from ipsec[64]_process_packet(), it is safe to assume that mbuf is contiguous at least to IP header for used IP version. Remove all unneeded m_pullup(), m_copydata and related checks. * use V_ip_defttl and V_ip6_defhlim for outer headers; * use V_ip4_ipsec_ecn and V_ip6_ipsec_ecn for outer headers; * move all diagnostic messages to the ipsec_encap() callers; * simplify handling of ipsec_encap() results: if it returns non zero value, print diagnostic message and free mbuf. * some style(9) fixes. Differential Revision: https://reviews.freebsd.org/D2303 Reviewed by: glebius Sponsored by: Yandex LLC Notes: svn path=/head/; revision=281692
* o Use new function ip_fillid() in all places throughout the kernel,Gleb Smirnoff2015-04-011-3/+1
| | | | | | | | | | | | | | | | | | | | where we want to create a new IP datagram. o Add support for RFC6864, which allows to set IP ID for atomic IP datagrams to any value, to improve performance. The behaviour is controlled by net.inet.ip.rfc6864 sysctl knob, which is enabled by default. o In case if we generate IP ID, use counter(9) to improve performance. o Gather all code related to IP ID into ip_id.c. Differential Revision: https://reviews.freebsd.org/D2177 Reviewed by: adrian, cy, rpaulo Tested by: Emeric POUPON <emeric.poupon stormshield.eu> Sponsored by: Netflix Sponsored by: Nginx, Inc. Relnotes: yes Notes: svn path=/head/; revision=280971
* Remove extra '&'. sin6 is already a pointer.Andrey V. Elsukov2015-03-071-1/+1
| | | | | | | | PR: 195011 MFC after: 1 week Notes: svn path=/head/; revision=279735
* Fix possible memory leak and several races in the IPsec policy managementAndrey V. Elsukov2015-02-242-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | code. Resurrect the state field in the struct secpolicy, it has IPSEC_SPSTATE_ALIVE value when security policy linked in the chain, and IPSEC_SPSTATE_DEAD value in all other cases. This field protects from trying to unlink one security policy several times from the different threads. Take additional reference in the key_flush_spd() to be sure that policy won't be freed from the different thread while we are sending SPDEXPIRE message. Add KEY_FREESP() call to the key_unlink() to release additional reference that we take when use key_getsp*() functions. Differential Revision: https://reviews.freebsd.org/D1914 Tested by: Emeric POUPON <emeric.poupon at stormshield dot eu> Reviewed by: hrs Sponsored by: Yandex LLC Notes: svn path=/head/; revision=279234
* key_spdget uses key_setdumpsp() without SPTREE_RLOCK held (it usesAndrey V. Elsukov2015-01-271-2/+0
| | | | | | | | | | | | referenced pointer to sp). Remove SPTREE_RLOCK_ASSERT from key_setdumpsp() to fix wrong assertion. Reported by: Emeric POUPON Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=277797
* In order to reduce use of M_EXT outside of the mbuf allocator andRobert Watson2015-01-062-12/+6
| | | | | | | | | | | | | | | | | | | | | | | | socket-buffer implementations, introduce a return value for MCLGET() (and m_cljget() that underlies it) to allow the caller to avoid testing M_EXT itself. Update all callers to use the return value. With this change, very few network device drivers remain aware of M_EXT; the primary exceptions lie in mbuf-chain pretty printers for debugging, and in a few cases, custom mbuf and cluster allocation implementations. NB: This is a difficult-to-test change as it touches many drivers for which I don't have physical devices. Instead we've gone for intensive review, but further post-commit review would definitely be appreciated to spot errors where changes could not easily be made mechanically, but were largely mechanical in nature. Differential Revision: https://reviews.freebsd.org/D1440 Reviewed by: adrian, bz, gnn Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=276750
* Fix VIMAGE build.Andrey V. Elsukov2014-12-251-1/+1
| | | | Notes: svn path=/head/; revision=276199
* Rename ip4_def_policy variable to def_policy. It is used by both IPv4 andAndrey V. Elsukov2014-12-244-209/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPv6. Initialize it only once in def_policy_init(). Remove its initialization from key_init() and make it static. Remove several fields from struct secpolicy: * lock - it isn't so useful having mutex in the structure, but the only thing we do with it is initialization and destroying. * state - it has only two values - DEAD and ALIVE. Instead of take a lock and change the state to DEAD, then take lock again in GC function and delete policy from the chain - keep in the chain only ALIVE policies. * scangen - it was used in GC function to protect from sending several SADB_SPDEXPIRE messages for one SPD entry. Now we don't keep DEAD entries in the chain and there is no need to have scangen variable. Use TAILQ to implement SPD entries chain. Use rmlock to protect access to SPD entries chain. Protect all SP lookup with RLOCK, and use WLOCK when we are inserting (or removing) SP entry in the chain. Instead of using pattern "LOCK(); refcnt++; UNLOCK();", use refcount(9) API to implement refcounting in SPD. Merge code from key_delsp() and _key_delsp() into _key_freesp(). And use KEY_FREESP() macro in all cases when we want to release reference or just delete SP entry. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=276188
* Treat errors when retrieving security policy as policy violation.Andrey V. Elsukov2014-12-111-2/+4
| | | | | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275712
* Initialize error variable.Andrey V. Elsukov2014-12-111-0/+1
| | | | | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275711
* Remove flag/flags argument from the following functions:Andrey V. Elsukov2014-12-112-23/+12
| | | | | | | | | | | | | | | ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275710
* Remove flags and tunalready arguments from ipsec4_process_packet()Andrey V. Elsukov2014-12-112-94/+54
| | | | | | | | | | | and make its prototype similar to ipsec6_process_packet. The flags argument isn't used here, tunalready is always zero. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275708
* Remove now unused mtag argument from ipsec*_common_input_cb.Andrey V. Elsukov2014-12-116-31/+16
| | | | | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275707
* Remove code related to PACKET_TAG_IPSEC_IN_CRYPTO_DONE mbuf tag.Andrey V. Elsukov2014-12-112-153/+71
| | | | | | | | | | It isn't used in FreeBSD. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275706
* Remove unused mtag variable.Andrey V. Elsukov2014-12-111-2/+0
| | | | | | | | Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275705
* key_getspacq() returns holding the spacq_lock. Unlock it in all cases.Andrey V. Elsukov2014-12-071-1/+2
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275575
* Fix style(9) and remove m_freem(NULL).Andrey V. Elsukov2014-12-041-4/+3
| | | | | | | | | | Add XXX comment, it looks incorrect, because m_pkthdr.len is already incremented by M_PREPEND(). Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275473
* Remove __P() macro.Andrey V. Elsukov2014-12-0310-206/+202
| | | | | | | | Suggested by: kevlo Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275438
* ANSIfy function declarations.Andrey V. Elsukov2014-12-033-257/+103
| | | | | | | Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275437
* Remove unneded check. No need to do m_pullup to the size that we prepended.Andrey V. Elsukov2014-12-021-2/+0
| | | | | | | Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275393
* Remove route chaching support from ipsec code. It isn't used for some time.Andrey V. Elsukov2014-12-0215-47/+4
| | | | | | | | | | | | * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>; Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275392
* Remove unused structure declarations.Andrey V. Elsukov2014-12-021-11/+0
| | | | | | | Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275391
* Remove unused declartations.Andrey V. Elsukov2014-12-021-10/+0
| | | | | | | Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275390
* Remove ip4_input() declaration. It was removed in r275133.Andrey V. Elsukov2014-11-271-1/+0
| | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=275159
* Do not use xform_ipip as decapsulation fallback.Andrey V. Elsukov2014-11-263-433/+6
| | | | | | | | | | | | | | | | | | xform_ipip was used as fallback with low priority for IPIP encapsulated packets that were decrypted. In some cases it can decapsulate packets, that it shouldn't. This leads to situations, when wrong configurations are magically working. Also it can propagate wrong ingress interface and this can break security. Now we redesigned the IPSEC code and IPIP encapsulation is called directly from ipsec_output, and decapsulation is done in the ipsec_input with m_striphdr. Differential Revision: https://reviews.freebsd.org/D1220 MFC after: 1 month Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275133
* Count statistics for the specific address family.Andrey V. Elsukov2014-11-131-1/+2
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274467
* Strip IP header only when we act in tunnel mode.Andrey V. Elsukov2014-11-131-29/+30
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274466
* Remove redundant ip6_plen initialization.Andrey V. Elsukov2014-11-131-3/+0
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274465
* ipsec6_process_packet is called before ip6_output fixes ip6_plen.Andrey V. Elsukov2014-11-121-5/+2
| | | | | | | | | | Update ip6_plen before bpf processing to be able see correct value. MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274454
* Fix ips_out_nosa errors accounting.Andrey V. Elsukov2014-11-121-1/+10
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274434
* Pass mbuf to pfil processing before stripping outer IP header as itAndrey V. Elsukov2014-11-071-17/+6
| | | | | | | | | | is described in if_enc(4). MFC after: 2 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274230
* Remove SYSCTL_VNET_* macros, and simply put CTLFLAG_VNET where needed.Gleb Smirnoff2014-11-076-74/+74
| | | | | | | Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=274225
* When mode isn't explicitly specified (wildcard) and inner protocol isn'tAndrey V. Elsukov2014-11-061-1/+10
| | | | | | | | | | | IPv4 or IPv6, assume it is the transport mode. Reported by: jmg MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=274193
* Use in_localip() instead of handmade implementation.Andrey V. Elsukov2014-10-311-21/+2
| | | | | | | | MFC after: 1 week Sponsored by: Yandex LLC Notes: svn path=/head/; revision=273904
* Use a static callout to drive key_timehandler() instead of timeout().John Baldwin2014-10-232-5/+9
| | | | | | | | | | While here, make key_timehandler() private to key.c. Submitted by: bz (2) Tested by: bz Notes: svn path=/head/; revision=273557
* Fix multiple incorrect SYSCTL arguments in the kernel:Hans Petter Selasky2014-10-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Wrong integer type was specified. - Wrong or missing "access" specifier. The "access" specifier sometimes included the SYSCTL type, which it should not, except for procedural SYSCTL nodes. - Logical OR where binary OR was expected. - Properly assert the "access" argument passed to all SYSCTL macros, using the CTASSERT macro. This applies to both static- and dynamically created SYSCTLs. - Properly assert the the data type for both static and dynamic SYSCTLs. In the case of static SYSCTLs we only assert that the data pointed to by the SYSCTL data pointer has the correct size, hence there is no easy way to assert types in the C language outside a C-function. - Rewrote some code which doesn't pass a constant "access" specifier when creating dynamic SYSCTL nodes, which is now a requirement. - Updated "EXAMPLES" section in SYSCTL manual page. MFC after: 3 days Sponsored by: Mellanox Technologies Notes: svn path=/head/; revision=273377
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-22 08:09:30 +0000