Add sadb_x_policy_flags to inform SP origination.

This extension(struct sadb_x_policy) is *not* defined by RFC2367.

OpenBSD does not have reserved fields in struct sadb_x_policy.
Linux does not use

Add sadb_x_policy_flags to inform SP origination.

This extension(struct sadb_x_policy) is *not* defined by RFC2367.

OpenBSD does not have reserved fields in struct sadb_x_policy.
Linux does not use this field yet.
FreeBSD uses this field as "sadb_x_policy_scope"; the value range is
from 0x00 to 0x04.

We use from most significant bit to avoid the above usage.

show more ...

Fix overflow case detected by clang. Pointed out by wsh@IIJ, thanks.

ipsecif(4) can use fixed SP reqid based on ifindex, that can reduce number of reqid.

If we want to use fixed SP reqid for ipsecif(4), set
net.ipsecif.use_fixed_reqid=1 Default(=0) is the same as be

ipsecif(4) can use fixed SP reqid based on ifindex, that can reduce number of reqid.

If we want to use fixed SP reqid for ipsecif(4), set
net.ipsecif.use_fixed_reqid=1 Default(=0) is the same as before.
net.ipsecif.use_fixed_reqid can be changed only if there is no ipsecif(4) yet.

If we want to change the range of ipseif(4) SP reqid,
set net.ipsecif.reqid_base and net.ipsecif.reqid_last.
These can also be changed only if there is no ipsecif(4) yet.

show more ...

Make pktq_rps_hash() pluggable for each interface type. Reviewed by gdt@n.o, thorpej@n.o, and riastradh@n.o, thanks.

ipsecif: Set the link state UP if we have a tunnel, otherwise DOWN.

reduce unnecessary reqid of NAT-T ipsecif(4), suggested by ohishi@IIJ.

Fix ipsecif(4) SPDADD pfkey message has garbage. Pointed out by ohishi@IIJ.

"setkey -x" output is the following.

========== before ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
len=15

Fix ipsecif(4) SPDADD pfkey message has garbage. Pointed out by ohishi@IIJ.

"setkey -x" output is the following.

========== before ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
len=15 reserved=0 seq=0 pid=0
sadb_ext{ len=56 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
{ len=40 proto=50 mode=1 level=3 reqid=16393
sockaddr{ len=0 family=0 }
sockaddr{ len=0 family=0 }
}
========== before ==========

========== after ==========
sadb_msg{ version=2 type=14 errno=0 satype=0
len=11 reserved=0 seq=0 pid=0
sadb_ext{ len=24 type=18 }
sadb_x_policy{ type=2 dir=1 id=9 }
{ len=8 proto=50 mode=1 level=3 reqid=16393
}
========== after ==========

show more ...

Fix order in rollback case; switch if_ipsec to atomic_load/store_*.

Adopt <net/if_stats.h>.

Make global and per-interface ipsecif(4) pmtu tunable like gif(4).

And make hop limit tunable same as gif(4).

See http://mail-index.netbsd.org/source-changes/2019/10/30/msg110426.html

Avoid having a rtcache directly in a percpu storage for tunnel protocols.

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users. If the storages went short, perc

Avoid having a rtcache directly in a percpu storage for tunnel protocols.

percpu(9) has a certain memory storage for each CPU and provides it by the piece
to users. If the storages went short, percpu(9) enlarges them by allocating new
larger memory areas, replacing old ones with them and destroying the old ones.
A percpu storage referenced by a pointer gotten via percpu_getref can be
destroyed by the mechanism after a running thread sleeps even if percpu_putref
has not been called.

Using rtcache, i.e., packet processing, typically involves sleepable operations
such as rwlock so we must avoid dereferencing a rtcache that is directly stored
in a percpu storage during packet processing. Address this situation by having
just a pointer to a rtcache in a percpu storage instead.

Reviewed by ozaki-r@ and yamaguchi@

show more ...

if_flags is neither int nor short. It's unsigned short.

Simplify "LIST_HEAD();" to make the code more understandable.
No functional change.

Fix ipsecif(4) memory leak in some ioctl cases.

Remove unnecessary addresses in PF_KEY message.

MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says
====================
5. SPD Update
// snip
SADB_X_SPDADD:
// snip

Remove unnecessary addresses in PF_KEY message.

MOBIKE Extensions for PF_KEY draft-schilcher-mobike-pfkey-extension-01.txt says
====================
5. SPD Update
// snip
SADB_X_SPDADD:
// snip
sadb_x_ipsecrequest_reqid:

An ID for that SA can be passed to the kernel in the
sadb_x_ipsecrequest_reqid field.


If tunnel mode is specified, the sadb_x_ipsecrequest structure is
followed by two sockaddr structures that define the tunnel
endpoint addresses. In the case that transport mode is used, no
additional addresses are specified.
====================
see: https://tools.ietf.org/html/draft-schilcher-mobike-pfkey-extension-01

ipsecif(4) uses transport mode, so it should not add addresses.

show more ...

ipsecif(4) support input drop packet counter.

Fix panic when doing ioctl to multiple pseudo interfaces. Pointed out by k-goda@IIJ.

XXX pullup-8

Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

This change also fixes a bug th

Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

This change also fixes a bug that the direction is misunderstand on some
environment by passing the direction to bpf_mtap*() instead of checking
m->m_pkthdr.rcvif.

show more ...

Reviewd by ohishi@IIJ. Sorry, I jumped the gun and committed.

Fix the following two issues.
- remove extra padding of sizeof(xisr) when adding ipsec policy
- add padding for xpl when adding

Reviewd by ohishi@IIJ. Sorry, I jumped the gun and committed.

Fix the following two issues.
- remove extra padding of sizeof(xisr) when adding ipsec policy
- add padding for xpl when adding discard policy

show more ...

Fix panic when ipsecif(4) adds discard policy. Pointed out by ohishi@IIJ, thanks.

ipsecif(4) must not set port number to spidx even if NAT-T. Pointed out by ohishi@IIJ, thanks.

Fix LOCKDEBUG kernel panic when many(about 200) tunnel interfaces is created.

The tunnel interfaces are gif(4), l2tp(4), and ipsecif(4). They use mutex
itself in percpu area. When percpu_cpu_enlarge

Fix LOCKDEBUG kernel panic when many(about 200) tunnel interfaces is created.

The tunnel interfaces are gif(4), l2tp(4), and ipsecif(4). They use mutex
itself in percpu area. When percpu_cpu_enlarge() run, the address of the
mutex in percpu area becomes different from the address which lockdebug
saved. That can cause "already initialized" false detection.

show more ...

Fix "how" argument of MGET(). Pointed out by maxv@n.o, thanks.

MGET() does not have M_ZERO flag, so add memset when it is required.

Fix unexpected failure when ipsecif(4) over IPv6 is changed port number only.

Here is an example of the operation which causes this problem.
# ifconfig ipsec0 create link0
# ifconfig ipsec0

Fix unexpected failure when ipsecif(4) over IPv6 is changed port number only.

Here is an example of the operation which causes this problem.
# ifconfig ipsec0 create link0
# ifconfig ipsec0 tunnel fc00:1001::2,4500 fc00:1001::1,4501
# ifconfig ipsec0 tunnel fc00:1001::2,4500 fc00:1001::1,4502

show more ...

fix ipsecif(4) stack overflow.

XXX pullup-8