aboutsummaryrefslogtreecommitdiff
path: root/usr.bin/netstat/ipsec.c
Commit message (Collapse)AuthorAgeFilesLines
* usr.bin: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-4/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* usr.bin: Remove ancient SCCS tags.Warner Losh2023-11-271-3/+0
| | | | | | | | Remove ancient SCCS tags from the tree, automated scripting, with two minor fixup to keep things compiling. All the common forms in the tree were removed with a perl script. Sponsored by: Netflix
* Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* ipsec(4): Fix a few typos in error messagesGordon Bergling2022-02-061-3/+3
| | | | | | - s/receieve/receive/ MFC after: 1 week
* netstat: split ipsec and ipsec6 statistics in libxoMateusz Guzik2021-10-051-6/+7
| | | | | | | | In particular fixes --libxo json PR: 254673 Reported by: j.vandeville@gmail.com Sponsored by: Rubicon Communications, LLC ("Netgate")
* Refer to AES-CBC as "aes-cbc" rather than "rijndael-cbc" for IPsec.John Baldwin2020-06-041-1/+1
| | | | | | | | | | | | | | At this point, AES is the more common name for Rijndael128. setkey(8) will still accept the old name, and old constants remain for compatiblity. Reviewed by: cem, bcr (manpages) MFC after: 2 weeks Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24964 Notes: svn path=/head/; revision=361810
* Remove support for IPsec algorithms deprecated in r348205 and r360202.John Baldwin2020-05-021-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Examples of depecrated algorithms in manual pages and sample configs are updated where relevant. I removed the one example of combining ESP and AH (vs using a cipher and auth in ESP) as RFC 8221 says this combination is NOT RECOMMENDED. Specifically, this removes support for the following ciphers: - des-cbc - 3des-cbc - blowfish-cbc - cast128-cbc - des-deriv - des-32iv - camellia-cbc This also removes support for the following authentication algorithms: - hmac-md5 - keyed-md5 - keyed-sha1 - hmac-ripemd160 Reviewed by: cem, gnn (older verisons) Relnotes: yes Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D24342 Notes: svn path=/head/; revision=360557
* Tidy up the list of auth and encryption algorithms for IPsec stats.John Baldwin2019-08-071-24/+5
| | | | | | | | | | | | | | | - Use keyed-md5 and keyed_sha1 instead of md5 and sha1 to match the names accepted by setkey and to also avoid confusion since these are not "plain" MD5 or SHA1. - Remove always-true #ifdef's to make the source a bit easier to read. - Add missing mappings for tcp-md5, camellia-cbc, and aes-gmac. MFC after: 2 weeks Sponsored by: Chelsio Communications Notes: svn path=/head/; revision=350666
* Add a SPD cache to speed up lookups.Fabien Thomas2018-05-221-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | When large SPDs are used, we face two problems: - too many CPU cycles are spent during the linear searches in the SPD for each packet - too much contention on multi socket systems, since we use a single shared lock. Main changes: - added the sysctl tree 'net.key.spdcache' to control the SPD cache (disabled by default). - cache the sp indexes that are used to perform SP lookups. - use a range of dedicated mutexes to protect the cache lines. Submitted by: Emeric Poupon <emeric.poupon@stormshield.eu> Reviewed by: ae Sponsored by: Stormshield Differential Revision: https://reviews.freebsd.org/D15050 Notes: svn path=/head/; revision=334054
* General further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-201-0/+2
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326025
* Add descriptions for AES-GCM IPSec authentication (AH) counters.John Baldwin2017-05-271-0/+9
| | | | | | | | MFC after: 1 week Sponsored by: Chelsio Communications Notes: svn path=/head/; revision=318996
* Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* Switch the IPsec related statistics to using the built in sysctlGeorge V. Neville-Neil2015-12-171-9/+19
| | | | | | | | | | | | variable set rather than reading from kernel memory. This also makes the -z (zero) flag work correctly MFC after: 1 week Sponsored by: Rubicon Communications, LLC (Netgate) Differential Revision: https://reviews.freebsd.org/D4591 Notes: svn path=/head/; revision=292394
* New AES modes for IPSec, user space components.George V. Neville-Neil2015-07-031-0/+3
| | | | | | | | | | | | | | | Update setkey and libipsec to understand aes-gcm-16 as an encryption method. A partial commit of the work in review D2936. Submitted by: eri Reviewed by: jmg MFC after: 2 weeks Sponsored by: Rubicon Communications (Netgate) Notes: svn path=/head/; revision=285108
* Convert netstat to use libxo.Marcel Moolenaar2015-02-211-104/+158
| | | | | | | | | | Obtained from: Phil Shafer <phil@juniper.net> Ported to -current by: alfred@ (mostly), Kim Shrier Formatting: marcel@ Sponsored by: Juniper Networks, Inc. Notes: svn path=/head/; revision=279122
* Remove the large part of struct ipsecstat. Only few fields of thisAndrey V. Elsukov2013-07-231-69/+3
| | | | | | | | | | | | | | structure is used, but they already have equal fields in the struct newipsecstat, that was introduced with FAST_IPSEC and then was merged together with old ipsecstat structure. This fixes kernel stack overflow on some architectures after migration ipsecstat to PCPU counters. Reported by: Taku YAMAMOTO, Maciej Milewski Notes: svn path=/head/; revision=253571
* Migrate structs ahstat, espstat, ipcompstat, ipipstat, pfkeystat,Andrey V. Elsukov2013-07-091-4/+4
| | | | | | | ipsec4stat, ipsec6stat to PCPU counters. Notes: svn path=/head/; revision=253088
* Prepare network statistics structures for migration to PCPU counters.Andrey V. Elsukov2013-07-091-84/+68
| | | | | | | | | | | | | Use uint64_t as type for all fields of structures. Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat, in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat, pfkeystat, pim6stat, pimstat, rip6stat, udpstat. Discussed with: arch@ Notes: svn path=/head/; revision=253081
* Remove the advertising clause from UCB copyrighted files in usr.bin. ThisJoel Dahl2010-12-111-4/+0
| | | | | | | | | | | | is in accordance with the information provided at ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change Also add $FreeBSD$ to a few files to keep svn happy. Discussed with: imp, rwatson Notes: svn path=/head/; revision=216370
* Revert most part of 200420 as requested, as more review and polish isXin LI2009-12-131-0/+2
| | | | | | | needed. Notes: svn path=/head/; revision=200462
* Remove unneeded header includes from usr.bin/ except contributed code.Xin LI2009-12-111-2/+0
| | | | | | | Tested with: make universe Notes: svn path=/head/; revision=200420
* Add more statistics variables for IPcomp.Bjoern A. Zeeb2009-11-291-0/+10
| | | | | | | | | | Try to version the struct in a backward compatible way. People asked for the versioning of the stats structs in general before. MFC after: 5 days Notes: svn path=/head/; revision=199946
* style(9)David E. O'Brien2008-01-021-15/+12
| | | | | | | | | | + kread is not a boolean, so check it as such + fix $FreeBSD$ Ids + denote copyrights with /*- + misc whitespace changes. Notes: svn path=/head/; revision=175061
* Restore netstat -M functionality for most statistics on core dumps. InJohn Baldwin2007-07-161-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | general, when support was added to netstat for fetching data using sysctl, no provision was left for fetching equivalent data from a core dump, and in fact, netstat would _always_ fetch data from the live kernel using sysctl even when -M was specified resulting in the user believing they were getting data from coredumps when they actually weren't. Some specific changes: - Add a global 'live' variable that is true if netstat is running against the live kernel and false if -M has been specified. - Stop abusing the sysctl flag in the protocol tables to hold the protocol number. Instead, the protocol is now its own field in the tables, and it is passed as a separate parameter to the PCB and stat routines rather than overloading the KVM offset parameter. - Don't run PCB or stats functions who don't have a namelist offset if we are being run against a crash dump (!live). - For the inet and unix PCB routines, we generate the same buffer from KVM that the sysctl usually generates complete with the header and trailer. - Don't run bpf stats for !live (before it would just silently always run live). - kread() no longer trashes memory when opening the buffer if there is an error on open and the passed in buffer is smaller than _POSIX2_LINE_MAX. - The multicast routing code doesn't fallback to kvm on live kernels if the sysctl fails. Keeping this made the code rather hairy, and netstat is already tied to the kernel ABI anyway (even when using sysctl's since things like xinpcb contain an inpcb) so any kernels this is run against that have the multicast routing stuff should have the sysctls. - Don't try to dig around in the kernel linker in the netgraph PCB routine for core dumps. Other notes: - sctp's PCB routine only works on live kernels, it looked rather complicated to generate all the same stuff via KVM. Someone can always add it later if desired though. - Fix the ipsec removal bug where N_xxx for IPSEC stats weren't renumbered. - Use sysctlbyname() everywhere rather than hardcoded mib values. MFC after: 1 week Approved by: re (rwatson) Notes: svn path=/head/; revision=171465
* Commit IPv6 support for FAST_IPSEC to the tree.George V. Neville-Neil2007-07-011-47/+17
| | | | | | | | | | | This commit includes all remaining changes for the time being including user space updates. Submitted by: bz Approved by: re Notes: svn path=/head/; revision=171135
* Don't shadow globals.Yaroslav Tykhiy2006-11-271-4/+4
| | | | | | | | Found by: WARNS=6 MFC after: 3 days Notes: svn path=/head/; revision=164687
* Achieve WARNS=2 by using uintmax_t to pass around 64-bit quantities,Yaroslav Tykhiy2006-07-281-26/+27
| | | | | | | | | | including to printf(). Using uintmax_t is also robust to further extensions in both the C language and the bitwidth of kernel counters. Tested on: i386 amd64 ia64 Notes: svn path=/head/; revision=160787
* Add support for printing IPSEC protocol stats if the kernel was compiledKelly Yancey2005-12-281-96/+268
| | | | | | | | | | | | | | | | with FAST_IPSEC rather than the KAME IPSEC stack. Note that the output of "netstat -s -p ipsec" differs depending on which stack is compiled into the kernel since they each keep different stats. This delta also adds the "esp", "ah", and "ipcomp" protocol stats, which are also available when the kernel is compiled with the FAST_IPSEC stack (e.g. "netstat -s -p esp"). Submitted by: Matt Titus <titus at nttmcl dot com> MFC after: 3 days Notes: svn path=/head/; revision=153809
* Add __FBSDID. Replace local variable sin by sockin to not conflict with sin(3).Philippe Charnier2004-07-261-7/+6
| | | | | | | | Use warnx() instead of warn() when error message is not of any interest. Add prototypes. Notes: svn path=/head/; revision=132671
* - support hmac-ripemd160.Hajimu UMEMOTO2004-02-051-1/+10
| | | | | | | | | - support AES XCBC MAC/AES counter mode. Obtained from: KAME Notes: svn path=/head/; revision=125481
* print stats on SPD cache lookups.Hajimu UMEMOTO2004-02-051-0/+5
| | | | | | | Obtained from: KAME Notes: svn path=/head/; revision=125480
* - %d is 12 chars, not 10. use NI_MAX* where appropriate.Hajimu UMEMOTO2004-02-051-67/+52
| | | | | | | | | | | - goodbye RC5. - use %llu directly. - KNF. Obtained from: KAME Notes: svn path=/head/; revision=125479
* Warns cleanups for netstat:David Malone2002-09-051-2/+2
| | | | | | | | | | | | | | 1) Include arpa/inet.h for ntohs. 2) Constness fixes. 3) Fix shadowing except for "sin" which shouldn't be in scope. 4) Remove register keyword. 5) Add missing initialsers to user defined structs. 5) Make prototype of netname6 globally visable. 6) Use right macros for printing syncache stats (even though entrie isn't a word). Notes: svn path=/head/; revision=102975
* Removed duplicate VCS ID tags, as per style(9).Ruslan Ermilov2001-08-131-1/+0
| | | | Notes: svn path=/head/; revision=81586
* remove warningsAssar Westerlund2001-06-151-7/+6
| | | | | | | | remove superfluous declarations make things more consistent Notes: svn path=/head/; revision=78316
* remove K&R supportAssar Westerlund2001-06-151-19/+13
| | | | Notes: svn path=/head/; revision=78314
* revert removal of warning and K&R supportAssar Westerlund2001-06-151-12/+19
| | | | | | | Requested by: bde Notes: svn path=/head/; revision=78309
* remove most of the warningsAssar Westerlund2001-06-151-19/+12
| | | | Notes: svn path=/head/; revision=78245
* Sync with recent KAME.Hajimu UMEMOTO2001-06-111-41/+57
| | | | | | | | | | | | | | | | | | | | | This work was based on kame-20010528-freebsd43-snap.tgz and some critical problem after the snap was out were fixed. There are many many changes since last KAME merge. TODO: - The definitions of SADB_* in sys/net/pfkeyv2.h are still different from RFC2407/IANA assignment because of binary compatibility issue. It should be fixed under 5-CURRENT. - ip6po_m member of struct ip6_pktopts is no longer used. But, it is still there because of binary compatibility issue. It should be removed under 5-CURRENT. Reviewed by: itojun Obtained from: KAME MFC after: 3 weeks Notes: svn path=/head/; revision=78064
* sync with latest kame netstat. basically, more statisticsJun-ichiro itojun Hagino2000-07-041-0/+316
Notes: svn path=/head/; revision=62584
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-13 22:56:45 +0000