summaryrefslogtreecommitdiff
path: root/sys/netinet/ip_ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge projects/ipsec into head/.Andrey V. Elsukov2017-02-061-245/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Small summary ------------- o Almost all IPsec releated code was moved into sys/netipsec. o New kernel modules added: ipsec.ko and tcpmd5.ko. New kernel option IPSEC_SUPPORT added. It enables support for loading and unloading of ipsec.ko and tcpmd5.ko kernel modules. o IPSEC_NAT_T option was removed. Now NAT-T support is enabled by default. The UDP_ENCAP_ESPINUDP_NON_IKE encapsulation type support was removed. Added TCP/UDP checksum handling for inbound packets that were decapsulated by transport mode SAs. setkey(8) modified to show run-time NAT-T configuration of SA. o New network pseudo interface if_ipsec(4) added. For now it is build as part of ipsec.ko module (or with IPSEC kernel). It implements IPsec virtual tunnels to create route-based VPNs. o The network stack now invokes IPsec functions using special methods. The only one header file <netipsec/ipsec_support.h> should be included to declare all the needed things to work with IPsec. o All IPsec protocols handlers (ESP/AH/IPCOMP protosw) were removed. Now these protocols are handled directly via IPsec methods. o TCP_SIGNATURE support was reworked to be more close to RFC. o PF_KEY SADB was reworked: - now all security associations stored in the single SPI namespace, and all SAs MUST have unique SPI. - several hash tables added to speed up lookups in SADB. - SADB now uses rmlock to protect access, and concurrent threads can do SA lookups in the same time. - many PF_KEY message handlers were reworked to reflect changes in SADB. - SADB_UPDATE message was extended to support new PF_KEY headers: SADB_X_EXT_NEW_ADDRESS_SRC and SADB_X_EXT_NEW_ADDRESS_DST. They can be used by IKE daemon to change SA addresses. o ipsecrequest and secpolicy structures were cardinally changed to avoid locking protection for ipsecrequest. Now we support only limited number (4) of bundled SAs, but they are supported for both INET and INET6. o INPCB security policy cache was introduced. Each PCB now caches used security policies to avoid SP lookup for each packet. o For inbound security policies added the mode, when the kernel does check for full history of applied IPsec transforms. o References counting rules for security policies and security associations were changed. The proper SA locking added into xform code. o xform code was also changed. Now it is possible to unregister xforms. tdb_xxx structures were changed and renamed to reflect changes in SADB/SPDB, and changed rules for locking and refcounting. Reviewed by: gnn, wblock Obtained from: Yandex LLC Relnotes: yes Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D9352 Notes: svn path=/head/; revision=313330
* Remove the kernel optoion for IPSEC_FILTERTUNNEL, which was deprecatedBjoern A. Zeeb2016-08-211-4/+0
| | | | | | | more than 7 years ago in favour of a sysctl in r192648. Notes: svn path=/head/; revision=304572
* Set the proper direction to check for policies in this one case.George V. Neville-Neil2015-10-291-1/+1
| | | | | | | | Pointed out by: eri Sponsored by: Rubicon Communications (Netgate) Notes: svn path=/head/; revision=290165
* Turning on IPSEC used to introduce a slight amount of performanceGeorge V. Neville-Neil2015-10-271-0/+4
| | | | | | | | | | | | | | | | degradation (7%) for host host TCP connections over 10Gbps links, even when there were no secuirty policies in place. There is no change in performance on 1Gbps network links. Testing GENERIC vs. GENERIC-NOIPSEC vs. GENERIC with this change shows that the new code removes any overhead introduced by having IPSEC always in the kernel. Differential Revision: D3993 MFC after: 1 month Sponsored by: Rubicon Communications (Netgate) Notes: svn path=/head/; revision=290028
* Take extra reference to security policy before calling crypto_dispatch().Andrey V. Elsukov2015-09-301-3/+1
| | | | | | | | | | | | | | | | Currently we perform crypto requests for IPSEC synchronous for most of crypto providers (software, aesni) and only VIA padlock calls crypto callback asynchronous. In synchronous mode it is possible, that security policy will be removed during the processing crypto request. And crypto callback will release the last reference to SP. Then upon return into ipsec[46]_process_packet() IPSECREQUEST_UNLOCK() will be called to already freed request. To prevent this we will take extra reference to SP. PR: 201876 Sponsored by: Yandex LLC Notes: svn path=/head/; revision=288418
* Remove now unneded KEY_FREESP() for case when ipsec[46]_process_packet()Andrey V. Elsukov2015-04-271-3/+1
| | | | | | | | | returns EJUSTRETURN. Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282047
* Fix possible use after free due to security policy deletion.Andrey V. Elsukov2015-04-271-3/+4
| | | | | | | | | | | | | | | | | | | When we are passing mbuf to IPSec processing via ipsec[46]_process_packet(), we hold one reference to security policy and release it just after return from this function. But IPSec processing can be deffered and when we release reference to security policy after ipsec[46]_process_packet(), user can delete this security policy from SPDB. And when IPSec processing will be done, xform's callback function will do access to already freed memory. To fix this move KEY_FREESP() into callback function. Now IPSec code will release reference to SP after processing will be finished. Differential Revision: https://reviews.freebsd.org/D2324 No objections from: #network Sponsored by: Yandex LLC Notes: svn path=/head/; revision=282046
* Use ipsec4_in_reject() to simplify ip_ipsec_fwd() and ip_ipsec_input().Andrey V. Elsukov2014-12-111-31/+3
| | | | | | | | | | | ipsec4_in_reject() does the same things, also it counts policy violation errors. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275713
* Remove flag/flags argument from the following functions:Andrey V. Elsukov2014-12-111-6/+4
| | | | | | | | | | | | | | | ipsec_getpolicybyaddr() ipsec4_checkpolicy() ip_ipsec_output() ip6_ipsec_output() The only flag used here was IP_FORWARDING. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275710
* Remove flags and tunalready arguments from ipsec4_process_packet()Andrey V. Elsukov2014-12-111-1/+1
| | | | | | | | | | | and make its prototype similar to ipsec6_process_packet. The flags argument isn't used here, tunalready is always zero. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275708
* Move ip_ipsec_fwd() from ip_input() into ip_forward().Andrey V. Elsukov2014-12-111-26/+12
| | | | | | | | | | | | | | | | | | | | Remove check for presence PACKET_TAG_IPSEC_IN_DONE mbuf tag from ip_ipsec_fwd(). PACKET_TAG_IPSEC_IN_DONE tag means that packet is already handled by IPSEC code. This means that before IPSEC processing it was destined to our address and security policy was checked in the ip_ipsec_input(). After IPSEC processing packet has new IP addresses and destination address isn't our own. So, anyway we can't check security policy from the mbuf tag, because it corresponds to different addresses. We should check security policy that corresponds to packet attributes in both cases - when it has a mbuf tag and when it has not. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275704
* Remove PACKET_TAG_IPSEC_IN_DONE mbuf tag lookup and usage of itsAndrey V. Elsukov2014-12-111-23/+7
| | | | | | | | | | | | | | | | | | | | security policy. The changed block of code in ip*_ipsec_input() is called when packet has ESP/AH header. Presence of PACKET_TAG_IPSEC_IN_DONE mbuf tag in the same time means that packet was already handled by IPSEC and reinjected in the netisr, and it has another ESP/AH headers (encrypted twice?). Since it was already processed by IPSEC code, the AH/ESP headers was already stripped (and probably outer IP header was stripped too) and security policy from the tdb_ident was applied to those headers. It is incorrect to apply this security policy to current headers. Also make ip_ipsec_input() prototype similar to ip6_ipsec_input(). Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275703
* Remove check for presence of PACKET_TAG_IPSEC_PENDING_TDB andAndrey V. Elsukov2014-12-111-49/+6
| | | | | | | | | | | | | | | | | | PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED mbuf tags. They aren't used in FreeBSD. Instead check presence of PACKET_TAG_IPSEC_OUT_DONE mbuf tag. If it is found, bypass security policy lookup as described in the comment. PACKET_TAG_IPSEC_OUT_DONE tag added to mbuf when IPSEC code finishes ESP/AH processing. Since it was already finished, this means the security policy placed in the tdb_ident was already checked. And there is no reason to check it again here. Obtained from: Yandex LLC Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275702
* Remove route chaching support from ipsec code. It isn't used for some time.Andrey V. Elsukov2014-12-021-30/+1
| | | | | | | | | | | | * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include <net/route.h>; Sponsored by: Yandex LLC Notes: svn path=/head/; revision=275392
* Remove SYSCTL_VNET_* macros, and simply put CTLFLAG_VNET where needed.Gleb Smirnoff2014-11-071-2/+2
| | | | | | | Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=274225
* drop unnecessary ifdef IPSEC's. This file is only compiled when IPSECJohn-Mark Gurney2014-09-261-13/+0
| | | | | | | | | | | is defined... Differential Revision: D839 Reviewed by: bz, glebius, gnn Sponsered by: EuroBSDCon DevSummit Notes: svn path=/head/; revision=272177
* - Remove rt_metrics_lite and simply put its members into rtentry.Gleb Smirnoff2014-03-051-3/+1
| | | | | | | | | | | | | | | | | | | - Use counter(9) for rt_pksent (former rt_rmx.rmx_pksent). This removes another cache trashing ++ from packet forwarding path. - Create zini/fini methods for the rtentry UMA zone. Via initialize mutex and counter in them. - Fix reporting of rmx_pksent to routing socket. - Fix netstat(1) to report "Use" both in kvm(3) and sysctl(3) mode. The change is mostly targeted for stable/10 merge. For head, rt_pksent is expected to just disappear. Discussed with: melifaro Sponsored by: Netflix Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=262763
* The r48589 promised to remove implicit inclusion of if_var.h soon. PrepareGleb Smirnoff2013-10-261-0/+1
| | | | | | | | | | | to this event, adding if_var.h to files that do need it. Also, include all includes that now are included due to implicit pollution via if_var.h Sponsored by: Netflix Sponsored by: Nginx, Inc. Notes: svn path=/head/; revision=257176
* Switch the entire IPv4 stack to keep the IP packet headerGleb Smirnoff2012-10-221-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | in network byte order. Any host byte order processing is done in local variables and host byte order values are never[1] written to a packet. After this change a packet processed by the stack isn't modified at all[2] except for TTL. After this change a network stack hacker doesn't need to scratch his head trying to figure out what is the byte order at the given place in the stack. [1] One exception still remains. The raw sockets convert host byte order before pass a packet to an application. Probably this would remain for ages for compatibility. [2] The ip_input() still subtructs header len from ip->ip_len, but this is planned to be fixed soon. Reviewed by: luigi, Maxim Dounin <mdounin mdounin.ru> Tested by: ray, Olivier Cochard-Labbe <olivier cochard.me> Notes: svn path=/head/; revision=241913
* Mechanically remove the last stray remains of spl* calls from net*/*.Andre Oppermann2012-10-181-12/+2
| | | | | | | They have been Noop's for a long time now. Notes: svn path=/head/; revision=241686
* After r241245 it appeared that in_delayed_cksum(), which still expectsGleb Smirnoff2012-10-081-2/+3
| | | | | | | | | | | | | | | | | host byte order, was sometimes called with net byte order. Since we are moving towards net byte order throughout the stack, the function was converted to expect net byte order, and its consumers fixed appropriately: - ip_output(), ipfilter(4) not changed, since already call in_delayed_cksum() with header in net byte order. - divert(4), ng_nat(4), ipfw_nat(4) now don't need to swap byte order there and back. - mrouting code and IPv6 ipsec now need to switch byte order there and back, but I hope, this is temporary solution. - In ipsec(4) shifted switch to net byte order prior to in_delayed_cksum(). - pf_route() catches up on r241245 changes to ip_output(). Notes: svn path=/head/; revision=241344
* Clean up some #endif comments removing from short sections. Add #endifBjoern A. Zeeb2012-01-221-1/+1
| | | | | | | | | | | | | | | comments to longer, also refining strange ones. Properly use #ifdef rather than #if defined() where possible. Four #if defined(PCBGROUP) occurances (netinet and netinet6) were ignored to avoid conflicts with eventually upcoming changes for RSS. Reported by: bde (most) Reviewed by: bde MFC after: 3 days Notes: svn path=/head/; revision=230442
* Correct comments and debug logging in ipsec to better match reality.Bjoern A. Zeeb2011-06-081-1/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=222845
* After some off-list discussion, revert a number of changes to theDimitry Andric2010-11-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DPCPU_DEFINE and VNET_DEFINE macros, as these cause problems for various people working on the affected files. A better long-term solution is still being considered. This reversal may give some modules empty set_pcpu or set_vnet sections, but these are harmless. Changes reverted: ------------------------------------------------------------------------ r215318 | dim | 2010-11-14 21:40:55 +0100 (Sun, 14 Nov 2010) | 4 lines Instead of unconditionally emitting .globl's for the __start_set_xxx and __stop_set_xxx symbols, only emit them when the set_vnet or set_pcpu sections are actually defined. ------------------------------------------------------------------------ r215317 | dim | 2010-11-14 21:38:11 +0100 (Sun, 14 Nov 2010) | 3 lines Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughout the tree. ------------------------------------------------------------------------ r215316 | dim | 2010-11-14 21:23:02 +0100 (Sun, 14 Nov 2010) | 2 lines Add macros to define static instances of VNET_DEFINE and DPCPU_DEFINE. Notes: svn path=/head/; revision=215701
* Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughoutDimitry Andric2010-11-141-2/+2
| | | | | | | the tree. Notes: svn path=/head/; revision=215317
* Make the IPsec SADB embedded route cache a union to be able to hold both theBjoern A. Zeeb2010-10-231-1/+1
| | | | | | | | | | | | legacy and IPv6 route destination address. Previously in case of IPv6, there was a memory overwrite due to not enough space for the IPv6 address. PR: kern/122565 MFC After: 2 weeks Notes: svn path=/head/; revision=214250
* The proper fix for the delayed SCTP checksum is toRandall Stewart2010-03-121-1/+1
| | | | | | | | | | | | | have the delayed function take an argument as to the offset to the SCTP header. This allows it to work for V4 and V6. This of course means changing all callers of the function to either pass the header len, if they have it, or create it (ip_hl << 2 or sizeof(ip6_hdr)). PR: 144529 MFC after: 2 weeks Notes: svn path=/head/; revision=205104
* Remove ifdefed out part of code, which seems to have originated a decade agoEdward Tomasz Napierala2009-11-091-16/+1
| | | | | | | | | | | | in OpenBSD. As it is now, there is no way for this to be useful, since IPsec is free to forward packets via whatever interface it wants, so checking capabilities of the interface passed from ip_output (fetched from the routing table) serves no purpose. Discussed with: sam@ Notes: svn path=/head/; revision=199102
* Merge the remainder of kern_vimage.c and vimage.h into vnet.c andRobert Watson2009-08-011-1/+0
| | | | | | | | | | | | | vnet.h, we now use jails (rather than vimages) as the abstraction for virtualization management, and what remained was specific to virtual network stacks. Minor cleanups are done in the process, and comments updated to reflect these changes. Reviewed by: bz Approved by: re (vimage blanket) Notes: svn path=/head/; revision=196019
* Remove unused VNET_SET() and related macros; only VNET_GET() isRobert Watson2009-07-161-1/+1
| | | | | | | | | | | | ever actually used. Rename VNET_GET() to VNET() to shorten variable references. Discussed with: bz, julian Reviewed by: bz Approved by: re (kensmith, kib) Notes: svn path=/head/; revision=195727
* Build on Jeff Roberson's linker-set based dynamic per-CPU allocatorRobert Watson2009-07-141-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (DPCPU), as suggested by Peter Wemm, and implement a new per-virtual network stack memory allocator. Modify vnet to use the allocator instead of monolithic global container structures (vinet, ...). This change solves many binary compatibility problems associated with VIMAGE, and restores ELF symbols for virtualized global variables. Each virtualized global variable exists as a "reference copy", and also once per virtual network stack. Virtualized global variables are tagged at compile-time, placing the in a special linker set, which is loaded into a contiguous region of kernel memory. Virtualized global variables in the base kernel are linked as normal, but those in modules are copied and relocated to a reserved portion of the kernel's vnet region with the help of a the kernel linker. Virtualized global variables exist in per-vnet memory set up when the network stack instance is created, and are initialized statically from the reference copy. Run-time access occurs via an accessor macro, which converts from the current vnet and requested symbol to a per-vnet address. When "options VIMAGE" is not compiled into the kernel, normal global ELF symbols will be used instead and indirection is avoided. This change restores static initialization for network stack global variables, restores support for non-global symbols and types, eliminates the need for many subsystem constructors, eliminates large per-subsystem structures that caused many binary compatibility issues both for monitoring applications (netstat) and kernel modules, removes the per-function INIT_VNET_*() macros throughout the stack, eliminates the need for vnet_symmap ksym(2) munging, and eliminates duplicate definitions of virtualized globals under VIMAGE_GLOBALS. Bump __FreeBSD_version and update UPDATING. Portions submitted by: bz Reviewed by: bz, zec Discussed with: gnn, jamie, jeff, jhb, julian, sam Suggested by: peter Approved by: re (kensmith) Notes: svn path=/head/; revision=195699
* Only four out of nine arguments for ip_ipsec_output() are actually used.Pawel Jakub Dawidek2009-06-051-2/+1
| | | | | | | | Kill unused arguments except for 'ifp' as it might be used in the future for detecting IPsec-capable interfaces. Notes: svn path=/head/; revision=193550
* Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNELBjoern A. Zeeb2009-05-231-2/+9
| | | | | | | | | | | | | | | kernel option. This also permits tuning of the option per virtual network stack, as well as separately per inet, inet6. The kernel option is left for a transition period, marked deprecated, and will be removed soon. Initially requested by: phk (1 year 1 day ago) MFC after: 4 weeks Notes: svn path=/head/; revision=192648
* Don't require packet to match a route (any route; this information wasn'tEdward Tomasz Napierala2009-04-281-1/+2
| | | | | | | | | | used anyway, so a typical workaround was to add a dummy route) if it's going to be sent through IPSec tunnel. Reviewed by: bz Notes: svn path=/head/; revision=191621
* Update stats in struct ipstat using four new macros, IPSTAT_ADD(),Robert Watson2009-04-111-1/+1
| | | | | | | | | | | | IPSTAT_INC(), IPSTAT_SUB(), and IPSTAT_DEC(), rather than directly manipulating the fields across the kernel. This will make it easier to change the implementation of these statistics, such as using per-CPU versions of the data structures. MFC after: 3 days Notes: svn path=/head/; revision=190951
* Try to remove/assimilate as much of formerly IPv4/6 specificBjoern A. Zeeb2009-02-081-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (duplicate) code in sys/netipsec/ipsec.c and fold it into common, INET/6 independent functions. The file local functions ipsec4_setspidx_inpcb() and ipsec6_setspidx_inpcb() were 1:1 identical after the change in r186528. Rename to ipsec_setspidx_inpcb() and remove the duplicate. Public functions ipsec[46]_get_policy() were 1:1 identical. Remove one copy and merge in the factored out code from ipsec_get_policy() into the other. The public function left is now called ipsec_get_policy() and callers were adapted. Public functions ipsec[46]_set_policy() were 1:1 identical. Rename file local ipsec_set_policy() function to ipsec_set_policy_internal(). Remove one copy of the public functions, rename the other to ipsec_set_policy() and adapt callers. Public functions ipsec[46]_hdrsiz() were logically identical (ignoring one questionable assert in the v6 version). Rename the file local ipsec_hdrsiz() to ipsec_hdrsiz_internal(), the public function to ipsec_hdrsiz(), remove the duplicate copy and adapt the callers. The v6 version had been unused anyway. Cleanup comments. Public functions ipsec[46]_in_reject() were logically identical apart from statistics. Move the common code into a file local ipsec46_in_reject() leaving vimage+statistics in small AF specific wrapper functions. Note: unfortunately we already have a public ipsec_in_reject(). Reviewed by: sam Discussed with: rwatson (renaming to *_internal) MFC after: 26 days X-MFC: keep wrapper functions for public symbols? Notes: svn path=/head/; revision=188306
* Adds support for SCTP checksum offload. This meansRandall Stewart2009-02-031-1/+10
| | | | | | | | | | | | | | | | we, like TCP and UDP, move the checksum calculation into the IP routines when there is no hardware support we call into the normal SCTP checksum routine. The next round of SCTP updates will use this functionality. Of course the IGB driver needs a few updates to support the new intel controller set that actually does SCTP csum offload too. Reviewed by: gnn, rwatson, kmacy Notes: svn path=/head/; revision=188066
* Rather than using hidden includes (with cicular dependencies),Bjoern A. Zeeb2008-12-021-0/+1
| | | | | | | | | | | | | | directly include only the header files needed. This reduces the unneeded spamming of various headers into lots of files. For now, this leaves us with very few modules including vnet.h and thus needing to depend on opt_route.h. Reviewed by: brooks, gnn, des, zec, imp Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=185571
* Step 1.5 of importing the network stack virtualization infrastructureMarko Zec2008-10-021-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from the vimage project, as per plan established at devsummit 08/08: http://wiki.freebsd.org/Image/Notes200808DevSummit Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator macros, and CURVNET_SET() context setting macros, all currently resolving to NOPs. Prepare for virtualization of selected SYSCTL objects by introducing a family of SYSCTL_V_*() macros, currently resolving to their global counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT(). Move selected #defines from sys/sys/vimage.h to newly introduced header files specific to virtualized subsystems (sys/net/vnet.h, sys/netinet/vinet.h etc.). All the changes are verified to have zero functional impact at this point in time by doing MD5 comparision between pre- and post-change object files(*). (*) netipsec/keysock.c did not validate depending on compile time options. Implemented by: julian, bz, brooks, zec Reviewed by: julian, bz, brooks, kris, rwatson, ... Approved by: julian (mentor) Obtained from: //depot/projects/vimage-commit2/... X-MFC after: never Sponsored by: NLnet Foundation, The FreeBSD Foundation Notes: svn path=/head/; revision=183550
* Commit step 1 of the vimage project, (network stack)Bjoern A. Zeeb2008-08-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | virtualization work done by Marko Zec (zec@). This is the first in a series of commits over the course of the next few weeks. Mark all uses of global variables to be virtualized with a V_ prefix. Use macros to map them back to their global names for now, so this is a NOP change only. We hope to have caught at least 85-90% of what is needed so we do not invalidate a lot of outstanding patches again. Obtained from: //depot/projects/vimage-commit2/... Reviewed by: brooks, des, ed, mav, julian, jamie, kris, rwatson, zec, ... (various people I forgot, different versions) md5 (with a bit of help) Sponsored by: NLnet Foundation, The FreeBSD Foundation X-MFC after: never V_Commit_Message_Reviewed_By: more people than the patch Notes: svn path=/head/; revision=181803
* Take the route mtu into account, if available, when sending anBjoern A. Zeeb2008-04-091-2/+1
| | | | | | | | | | | | | | | | | | | ICMP unreach, frag needed. Up to now we only looked at the interface MTU. Make sure to only use the minimum of the two. In case IPSEC is compiled in, loop the mtu through ip_ipsec_mtu() to avoid any further conditional maths. Without this, PMTU was broken in those cases when there was a route with a lower MTU than the MTU of the outgoing interface. PR: kern/122338 Tested by: Mark Cammidge mark peralex.com Reviewed by: silence on net@ MFC after: 2 weeks Notes: svn path=/head/; revision=178029
* Correct IPsec behaviour with a 'use' level in SP but no SA available.Bjoern A. Zeeb2008-03-141-0/+12
| | | | | | | | | | | | In that case return an continue processing the packet without IPsec. PR: 121384 MFC after: 5 days Reported by: Cyrus Rahman (crahman gmail.com) Tested by: Cyrus Rahman (crahman gmail.com) [slightly older version] Notes: svn path=/head/; revision=177175
* Add FBSDID to all files in netinet so that people can moreMike Silbersack2007-10-071-2/+3
| | | | | | | | | easily include file version information in bug reports. Approved by: re (kensmith) Notes: svn path=/head/; revision=172467
* Rename option IPSEC_FILTERGIF to IPSEC_FILTERTUNNEL.Bjoern A. Zeeb2007-08-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Also rename the related functions in a similar way. There are no functional changes. For a packet coming in with IPsec tunnel mode, the default is to only call into the firewall with the "outer" IP header and payload. With this option turned on, in addition to the "outer" parts, the "inner" IP header and payload are passed to the firewall too when going through ip_input() the second time. The option was never only related to a gif(4) tunnel within an IPsec tunnel and thus the name was very misleading. Discussed at: BSDCan 2007 Best new name suggested by: rwatson Reviewed by: rwatson Approved by: re (bmah) Notes: svn path=/head/; revision=171732
* Commit the change from FAST_IPSEC to IPSEC. The FAST_IPSECGeorge V. Neville-Neil2007-07-031-10/+10
| | | | | | | | | | | option is now deprecated, as well as the KAME IPsec code. What was FAST_IPSEC is now IPSEC. Approved by: re Sponsored by: Secure Computing Notes: svn path=/head/; revision=171167
* Commit IPv6 support for FAST_IPSEC to the tree.George V. Neville-Neil2007-07-011-194/+2
| | | | | | | | | | | | This commit includes only the kernel files, the rest of the files will follow in a second commit. Reviewed by: bz Approved by: re Supported by: Secure Computing Notes: svn path=/head/; revision=171133
* Move universally to ANSI C function declarations, with relativelyRobert Watson2007-05-101-3/+2
| | | | | | | consistent style(9)-ish layout. Notes: svn path=/head/; revision=169454
* Remove unneeded mac.h include.Robert Watson2006-07-061-1/+0
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=160134
* Make sure the ip data pointer is correct before touching it againBjoern A. Zeeb2006-05-051-0/+1
| | | | | | | | | | | after ipsec4_output processing else KAME IPSec using the handbook configuration with gif(4) will panic the kernel. Problem reported by: t. patterson <tp lot.org> Tested by: t. patterson <tp lot.org> Notes: svn path=/head/; revision=158305
* Move the IPSEC related code blocks to their own file to unclutterAndre Oppermann2006-02-011-0/+579
and signifincantly improve the readability of ip_input() and ip_output() again. The resulting IPSEC hooks in ip_input() and ip_output() may be used later on for making IPSEC loadable. This move is mostly mechanical and should preserve current IPSEC behaviour as-is. Nothing shall prevent improvements in the way IPSEC interacts with the IPv4 stack. Discussed with: bz, gnn, rwatson; (earlier version) Notes: svn path=/head/; revision=155179
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 16:55:21 +0000