aboutsummaryrefslogtreecommitdiff
path: root/sys/netkey
Commit message (Collapse)AuthorAgeFilesLines
* System wide policy should be returned when no policy found in the SPD.Hajimu UMEMOTO2001-10-291-0/+26
| | | | | | | | | | The packet was rejected in ipsec[46]_tunnel_validate(). Obtained from: KAME MFC after: 1 week Notes: svn path=/head/; revision=85694
* Fixed the value of the prefixlen in the sadb_address structure.Hajimu UMEMOTO2001-10-221-8/+20
| | | | | | | | | | When pfkey message relative to SA is sent, the prefixlen was incorrect. Obtained from: KAME MFC after: 1 week Notes: svn path=/head/; revision=85331
* The behavior of SPDUPDATE has been changed.Hajimu UMEMOTO2001-10-171-10/+6
| | | | | | | | | | | SPDUPDATE doesn't depend on whether there is a SP or not. This change makes `generate_policy on' of racoon work. Obtained from: KAME MFC after: 1 week Notes: svn path=/head/; revision=85054
* KSE Milestone 2Julian Elischer2001-09-121-8/+8
| | | | | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha Notes: svn path=/head/; revision=83366
* printed current sequence number of the SA. accordingly, changedHajimu UMEMOTO2001-08-062-10/+13
| | | | | | | | | | | into sadb_x_sa2_sequence from sadb_x_sa2_reserved3 in the sadb_x_sa2 structure. Also the output of setkey is changed. sequence number of the sadb is replaced to the end of the output. Obtained from: KAME Notes: svn path=/head/; revision=81215
* do not play too much trick with evaluation order. from netbsdHajimu UMEMOTO2001-08-061-2/+2
| | | | | | | Obtained from: KAME Notes: svn path=/head/; revision=81214
* fixed to make a response in key_spdadd(). reported by <R.P.Koster@kpn.com>Hajimu UMEMOTO2001-08-061-2/+2
| | | | | | | Obtained from: KAME Notes: svn path=/head/; revision=81213
* merged key_cmpsaidx_*.Hajimu UMEMOTO2001-08-061-149/+60
| | | | | | | Obtained from: KAME Notes: svn path=/head/; revision=81212
* Sync with recent KAME.Hajimu UMEMOTO2001-06-117-270/+799
| | | | | | | | | | | | | | | | | | | | | This work was based on kame-20010528-freebsd43-snap.tgz and some critical problem after the snap was out were fixed. There are many many changes since last KAME merge. TODO: - The definitions of SADB_* in sys/net/pfkeyv2.h are still different from RFC2407/IANA assignment because of binary compatibility issue. It should be fixed under 5-CURRENT. - ip6po_m member of struct ip6_pktopts is no longer used. But, it is still there because of binary compatibility issue. It should be removed under 5-CURRENT. Reviewed by: itojun Obtained from: KAME MFC after: 3 weeks Notes: svn path=/head/; revision=78064
* Remove unneeded includes of sys/ipl.h and machine/ipl.h.John Baldwin2001-05-151-2/+0
| | | | Notes: svn path=/head/; revision=76650
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inMark Murray2001-05-011-5/+7
| | | | | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations) Notes: svn path=/head/; revision=76166
* fixed possibility of panic at key_acquire().Hajimu UMEMOTO2001-01-141-9/+8
| | | | | | | | | key_acquire() does not require a secpolicy structure. Obtained from: KAME Notes: svn path=/head/; revision=71036
* Revert previous commit after discussion with phk.Kris Kennaway2000-10-301-0/+1
| | | | Notes: svn path=/head/; revision=67933
* Remove unneeded #include <sys/proc.h> lines.Poul-Henning Kamp2000-10-291-1/+0
| | | | Notes: svn path=/head/; revision=67882
* Convert all users of fldoff() to offsetof(). fldoff() is badPoul-Henning Kamp2000-10-271-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | because it only takes a struct tag which makes it impossible to use unions, typedefs etc. Define __offsetof() in <machine/ansi.h> Define offsetof() in terms of __offsetof() in <stddef.h> and <sys/types.h> Remove myriad of local offsetof() definitions. Remove includes of <stddef.h> in kernel code. NB: Kernelcode should *never* include from /usr/include ! Make <sys/queue.h> include <machine/ansi.h> to avoid polluting the API. Deprecate <struct.h> with a warning. The warning turns into an error on 01-12-2000 and the file gets removed entirely on 01-01-2001. Paritials reviews by: various. Significant brucifications by: bde Notes: svn path=/head/; revision=67708
* make sure we have IV that is random enough. memory allocator onHajimu UMEMOTO2000-08-281-5/+9
| | | | | | | | | some of platforms give us almost constant number (oops). Obtained from: KAME Notes: svn path=/head/; revision=65153
* Replace the mbuf external reference counting code with somethingDavid Malone2000-08-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | that should be better. The old code counted references to mbuf clusters by using the offset of the cluster from the start of memory allocated for mbufs and clusters as an index into an array of chars, which did the reference counting. If the external storage was not a cluster then reference counting had to be done by the code using that external storage. NetBSD's system of linked lists of mbufs was cosidered, but Alfred felt it would have locking issues when the kernel was made more SMP friendly. The system implimented uses a pool of unions to track external storage. The union contains an int for counting the references and a pointer for forming a free list. The reference counts are incremented and decremented atomically and so should be SMP friendly. This system can track reference counts for any sort of external storage. Access to the reference counting stuff is now through macros defined in mbuf.h, so it should be easier to make changes to the system in the future. The possibility of storing the reference count in one of the referencing mbufs was considered, but was rejected 'cos it would often leave extra mbufs allocated. Storing the reference count in the cluster was also considered, but because the external storage may not be a cluster this isn't an option. The size of the pool of reference counters is available in the stats provided by "netstat -m". PR: 19866 Submitted by: Bosko Milekic <bmilekic@dsuper.net> Reviewed by: alfred (glanced at by others on -net) Notes: svn path=/head/; revision=64837
* Add missing #include to unbreak IPSEC_DEBUG buildsKris Kennaway2000-07-071-0/+1
| | | | | | | Submitted by: Jim Bloom <bloom@reyim.ne.mediaone.net> Notes: svn path=/head/; revision=62763
* sync with kame tree as of july00. tons of bug fixes/improvements.Jun-ichiro itojun Hagino2000-07-049-2174/+4463
| | | | | | | | | | API changes: - additional IPv6 ioctls - IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8). (also syntax change) Notes: svn path=/head/; revision=62587
* Check for MGET* returning NULL and return ENOBUFS in this case.Jonathan Lemon2000-06-101-2/+8
| | | | | | | Submitted by: Bosko Milekic <bmilekic@technokratis.com> Notes: svn path=/head/; revision=61505
* Back out the previous change to the queue(3) interface.Jake Burkholder2000-05-262-9/+9
| | | | | | | | | It was not discussed and should probably not happen. Requested by: msmith and others Notes: svn path=/head/; revision=60938
* Change the way that the queue(3) structures are declared; don't assume thatJake Burkholder2000-05-232-9/+9
| | | | | | | | | | | the type argument to *_HEAD and *_ENTRY is a struct. Suggested by: phk Reviewed by: phk Approved by: mdodd Notes: svn path=/head/; revision=60833
* comment the string after #endifYoshinobu Inoue2000-01-151-1/+1
| | | | | | | Specified by: bde Notes: svn path=/head/; revision=56015
* Change struct sockaddr_storage member name, because following changeYoshinobu Inoue2000-01-132-43/+43
| | | | | | | | | | | | | | | is very likely to become consensus as recent ietf/ipng mailing list discussion. Also recent KAME repository and other KAME patched BSDs also applied it. s/__ss_family/ss_family/ s/__ss_len/ss_len/ Makeworld is confirmed, and no application should be affected by this change yet. Notes: svn path=/head/; revision=55917
* Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL"Peter Wemm1999-12-295-26/+20
| | | | | | | | | is an application space macro and the applications are supposed to be free to use it as they please (but cannot). This is consistant with the other BSD's who made this change quite some time ago. More commits to come. Notes: svn path=/head/; revision=55205
* IPSEC support in the kernel.Yoshinobu Inoue1999-12-227-3419/+6298
| | | | | | | | | | | pr_input() routines prototype is also changed to support IPSEC and IPV6 chained protocol headers. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project Notes: svn path=/head/; revision=55009
* KAME netinet6 basic part(no IPsec,no V6 Multicast Forwarding, no UDP/TCPYoshinobu Inoue1999-11-223-0/+297
| | | | | | | | | | | | | for IPv6 yet) With this patch, you can assigne IPv6 addr automatically, and can reply to IPv6 ping. Reviewed by: freebsd-arch, cvs-committers Obtained from: KAME project Notes: svn path=/head/; revision=53541
* Fix a printf(3) formatter to match its variable.Bill Fumerola1999-08-171-1/+1
| | | | | | | Reviewed by: bde Notes: svn path=/head/; revision=49989
* #ifdef out unused function key_freetables.Eivind Eklund1999-01-121-1/+2
| | | | Notes: svn path=/head/; revision=42581
* The "easy" fixes for compiling the kernel -Wunused: remove unreferenced staticArchie Cobbs1998-12-072-15/+16
| | | | | | | and local variables, goto labels, and functions declared but not defined. Notes: svn path=/head/; revision=41591
* Fixed printf format errors.Bruce Evans1998-08-171-14/+16
| | | | Notes: svn path=/head/; revision=38373
* Really make this compile..Peter Wemm1998-04-061-12/+58
| | | | | | | Pointed out by: bde Notes: svn path=/head/; revision=35054
* Maybe fix netkey. I am not sure how to test this..Peter Wemm1998-04-051-44/+68
| | | | Notes: svn path=/head/; revision=35039
* Substitute a panic for a undefined function so LINT will compile.Poul-Henning Kamp1998-04-041-0/+4
| | | | Notes: svn path=/head/; revision=35032
* Eradicate the variable "time" from the kernel, using various measures.Poul-Henning Kamp1998-03-301-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "time" wasn't a atomic variable, so splfoo() protection were needed around any access to it, unless you just wanted the seconds part. Most uses of time.tv_sec now uses the new variable time_second instead. gettime() changed to getmicrotime(0. Remove a couple of unneeded splfoo() protections, the new getmicrotime() is atomic, (until Bruce sets a breakpoint in it). A couple of places needed random data, so use read_random() instead of mucking about with time which isn't random. Add a new nfs_curusec() function. Mark a couple of bogosities involving the now disappeard time variable. Update ffs_update() to avoid the weird "== &time" checks, by fixing the one remaining call that passwd &time as args. Change profiling in ncr.c to use ticks instead of time. Resolution is the same. Add new function "tvtohz()" to avoid the bogus "splfoo(), add time, call hzto() which subtracts time" sequences. Reviewed by: bde Notes: svn path=/head/; revision=34961
* Removed unused #includes.Bruce Evans1998-03-282-5/+0
| | | | Notes: svn path=/head/; revision=34928
* key_getspi() bugfix.Jun-ichiro itojun Hagino1998-03-231-2/+19
| | | | | | | Submitted by: k-sugyou@ccs.mt.nec.co.jp Notes: svn path=/head/; revision=34828
* polish the code.Jun-ichiro itojun Hagino1998-02-274-203/+288
| | | | | | | use tradictional decls. tabify. remove bogus #defines. prototypes. Notes: svn path=/head/; revision=33871
* make sys/netkey/key{,_debug}.c compile. I believe it works but not tested.Jun-ichiro itojun Hagino1998-02-274-165/+355
| | | | | | | I'll polish the code later on. Notes: svn path=/head/; revision=33870
* Added a used #include.Bruce Evans1998-02-251-0/+1
| | | | | | | | "options KEY" is not in LINT, and consequently doesn't actually compile, even with this change. Notes: svn path=/head/; revision=33828
* Last major round (Unless Bruce thinks of somthing :-) of malloc changes.Poul-Henning Kamp1997-10-121-1/+1
| | | | | | | | | | | Distribute all but the most fundamental malloc types. This time I also remembered the trick to making things static: Put "static" in front of them. A couple of finer points by: bde Notes: svn path=/head/; revision=30354
* Distribute and statizice a lot of the malloc M_* types.Poul-Henning Kamp1997-10-111-0/+2
| | | | | | | Substantial input from: bde Notes: svn path=/head/; revision=30309
* This is the `netkey' kernel key-management service (the PF_KEY analogueGarrett Wollman1996-06-144-0/+3435
to PF_ROUTE) from NRL's IPv6 distribution, heavily modified by me for better source layout, formatting, and textual conventions. I am told that this code is no longer under active development, but it's a useful hack for those interested in doing work on network security, key management, etc. This code has only been tested twice, so it should be considered highly experimental. Obtained from: ftp.ripe.net Notes: svn path=/head/; revision=16368
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-16 22:20:39 +0000