src-test2/sys/netkey/keydb.c, branch releng/6.3FreeBSD source treehttps://cgit-dev.freebsd.org/src-test2/atom?h=releng%2F6.32005-01-07T01:45:51Z/* -> /*- for license, minor formatting changes2005-01-07T01:45:51ZWarner Loshimp@FreeBSD.org2005-01-07T01:45:51Zurn:sha1:c398230b64aea809cb7c5cea8db580af7097920c- cleanup SP refcnt issue.2003-11-04T16:02:05ZHajimu UMEMOTOume@FreeBSD.org2003-11-04T16:02:05Zurn:sha1:0f9ade718da4248226297bed41f3e9e372fd5f4d
- share policy-on-socket for listening socket.
- don't copy policy-on-socket at all. secpolicy no longer contain
spidx, which saves a lot of memory.
- deep-copy pcb policy if it is an ipsec policy. assign ID field to
all SPD entries. make it possible for racoon to grab SPD entry on
pcb.
- fixed the order of searching SA table for packets.
- fixed to get a security association header. a mode is always needed
to compare them.
- fixed that the incorrect time was set to
sadb_comb_{hard|soft}_usetime.
- disallow port spec for tunnel mode policy (as we don't reassemble).
- an user can define a policy-id.
- clear enc/auth key before freeing.
- fixed that the kernel crashed when key_spdacquire() was called
because key_spdacquire() had been implemented imcopletely.
- preparation for 64bit sequence number.
- maintain ordered list of SA, based on SA id.
- cleanup secasvar management; refcnt is key.c responsibility;
alloc/free is keydb.c responsibility.
- cleanup, avoid double-loop.
- use hash for spi-based lookup.
- mark persistent SP "persistent".
XXX in theory refcnt should do the right thing, however, we have
"spdflush" which would touch all SPs. another solution would be to
de-register persistent SPs from sptree.
- u_short -> u_int16_t
- reduce kernel stack usage by auto variable secasindex.
- clarify function name confusion. ipsec_*_policy ->
ipsec_*_pcbpolicy.
- avoid variable name confusion.
(struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct
secpolicy *)
- count number of ipsec encapsulations on ipsec4_output, so that we
can tell ip_output() how to handle the packet further.
- When the value of the ul_proto is ICMP or ICMPV6, the port field in
"src" of the spidx specifies ICMP type, and the port field in "dst"
of the spidx specifies ICMP code.
- avoid from applying IPsec transport mode to the packets when the
kernel forwards the packets.
Tested by: nork
Obtained from: KAME
cleanup secasvar management; refcnt is key.c responsibility;2003-11-02T10:49:47ZHajimu UMEMOTOume@FreeBSD.org2003-11-02T10:49:47Zurn:sha1:9712142383d79449ae34fe9c26506af44f2b1a19
alloc/free is keydb.c responsibility.
Obtained from: KAME
Use __FBSDID().2003-06-11T05:37:42ZDavid E. O'Brienobrien@FreeBSD.org2003-06-11T05:37:42Zurn:sha1:ab0de15baf7234734b1b64c3145cd36f867c98eaRemove __P.2002-03-20T02:39:27ZAlfred Perlsteinalfred@FreeBSD.org2002-03-20T02:39:27Zurn:sha1:96abb1618a1d3123e80a90f7324ab93bd625f6acsync with kame tree as of july00. tons of bug fixes/improvements.2000-07-04T16:35:15ZJun-ichiro itojun Haginoitojun@FreeBSD.org2000-07-04T16:35:15Zurn:sha1:686cdd19b1b182f2257bc158116e78c5fef84980
API changes:
- additional IPv6 ioctls
- IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8).
(also syntax change)