FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=main 2007-07-02T04:02:21Z 2007-07-02T04:02:21Z George V. Neville-Neil gnn@FreeBSD.org 2007-07-02T04:02:21Z urn:sha1:e66ff7fc8e122c8bf9513decb7bf29dedd4430e5 new FAST_IPSEC based IPsec stack. Approved by: re Reviewed by: bz 2006-08-04T21:27:40Z Brooks Davis brooks@FreeBSD.org 2006-08-04T21:27:40Z urn:sha1:43bc7a9c62fa28bfa59061b28ce0102862a0b224 were unused or already in if_var.h so add if_name() to if_var.h and remove net_osdep.h along with all references to it. Longer term we may want to kill off if_name() entierly since all modern BSDs have if_xname variables rendering it unnecessicary. 2005-10-31T15:41:29Z Robert Watson rwatson@FreeBSD.org 2005-10-31T15:41:29Z urn:sha1:5bb84bc84b1d1f978dd93aa02acef9936e79abc0 - Prefer '_' to ' ', as it results in more easily parsed results in memory monitoring tools such as vmstat. - Remove punctuation that is incompatible with using memory type names as file names, such as '/' characters. - Disambiguate some collisions by adding subsystem prefixes to some memory types. - Generally prefer lower case to upper case. - If the same type is defined in multiple architecture directories, attempt to use the same name in additional cases. Not all instances were caught in this change, so more work is required to finish this conversion. Similar changes are required for UMA zone names. 2005-01-07T01:45:51Z Warner Losh imp@FreeBSD.org 2005-01-07T01:45:51Z urn:sha1:c398230b64aea809cb7c5cea8db580af7097920c 2003-11-04T16:02:05Z Hajimu UMEMOTO ume@FreeBSD.org 2003-11-04T16:02:05Z urn:sha1:0f9ade718da4248226297bed41f3e9e372fd5f4d - share policy-on-socket for listening socket. - don't copy policy-on-socket at all. secpolicy no longer contain spidx, which saves a lot of memory. - deep-copy pcb policy if it is an ipsec policy. assign ID field to all SPD entries. make it possible for racoon to grab SPD entry on pcb. - fixed the order of searching SA table for packets. - fixed to get a security association header. a mode is always needed to compare them. - fixed that the incorrect time was set to sadb_comb_{hard|soft}_usetime. - disallow port spec for tunnel mode policy (as we don't reassemble). - an user can define a policy-id. - clear enc/auth key before freeing. - fixed that the kernel crashed when key_spdacquire() was called because key_spdacquire() had been implemented imcopletely. - preparation for 64bit sequence number. - maintain ordered list of SA, based on SA id. - cleanup secasvar management; refcnt is key.c responsibility; alloc/free is keydb.c responsibility. - cleanup, avoid double-loop. - use hash for spi-based lookup. - mark persistent SP "persistent". XXX in theory refcnt should do the right thing, however, we have "spdflush" which would touch all SPs. another solution would be to de-register persistent SPs from sptree. - u_short -> u_int16_t - reduce kernel stack usage by auto variable secasindex. - clarify function name confusion. ipsec_*_policy -> ipsec_*_pcbpolicy. - avoid variable name confusion. (struct inpcbpolicy *)pcb_sp, spp (struct secpolicy **), sp (struct secpolicy *) - count number of ipsec encapsulations on ipsec4_output, so that we can tell ip_output() how to handle the packet further. - When the value of the ul_proto is ICMP or ICMPV6, the port field in "src" of the spidx specifies ICMP type, and the port field in "dst" of the spidx specifies ICMP code. - avoid from applying IPsec transport mode to the packets when the kernel forwards the packets. Tested by: nork Obtained from: KAME 2003-11-02T10:49:47Z Hajimu UMEMOTO ume@FreeBSD.org 2003-11-02T10:49:47Z urn:sha1:9712142383d79449ae34fe9c26506af44f2b1a19 alloc/free is keydb.c responsibility. Obtained from: KAME 2003-06-11T05:37:42Z David E. O'Brien obrien@FreeBSD.org 2003-06-11T05:37:42Z urn:sha1:ab0de15baf7234734b1b64c3145cd36f867c98ea 2002-03-20T02:39:27Z Alfred Perlstein alfred@FreeBSD.org 2002-03-20T02:39:27Z urn:sha1:96abb1618a1d3123e80a90f7324ab93bd625f6ac 2000-07-04T16:35:15Z Jun-ichiro itojun Hagino itojun@FreeBSD.org 2000-07-04T16:35:15Z urn:sha1:686cdd19b1b182f2257bc158116e78c5fef84980 API changes: - additional IPv6 ioctls - IPsec PF_KEY API was changed, it is mandatory to upgrade setkey(8). (also syntax change)