system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-07 09:00:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
freebsd-src/lib
History
Andrey V. Elsukov 22986c6740 Introduce the concept of IPsec security policies scope. 
Currently are defined three scopes: global, ifnet, and pcb.
Generic security policies that IKE daemon can add via PF_KEY interface
or an administrator creates with setkey(8) utility have GLOBAL scope.
Such policies can be applied by the kernel to outgoing packets and checked
agains inbound packets after IPsec processing.
Security policies created by if_ipsec(4) interfaces have IFNET scope.
Such policies are applied to packets that are passed through if_ipsec(4)
interface.
And security policies created by application using setsockopt()
IP_IPSEC_POLICY option have PCB scope. Such policies are applied to
packets related to specific socket. Currently there is no way to list
PCB policies via setkey(8) utility.

Modify setkey(8) and libipsec(3) to be able distinguish the scope of
security policies in the `setkey -DP` listing. Add two optional flags:
'-t' to list only policies related to virtual *tunneling* interfaces,
i.e. policies with IFNET scope, and '-g' to list only policies with GLOBAL
scope. By default policies from all scopes are listed.

To implement this PF_KEY's sadb_x_policy structure was modified.
sadb_x_policy_reserved field is used to pass the policy scope from the
kernel to userland. SADB_SPDDUMP message extended to support filtering
by scope: sadb_msg_satype field is used to specify bit mask of requested
scopes.

For IFNET policies the sadb_x_policy_priority field of struct sadb_x_policy
is used to pass if_ipsec's interface if_index to the userland. For GLOBAL
policies sadb_x_policy_priority is used only to manage order of security
policies in the SPDB. For IFNET policies it is not used, so it can be used
to keep if_index.

After this change the output of `setkey -DP` now looks like:
# setkey -DPt
0.0.0.0/0[any] 0.0.0.0/0[any] any
	in ipsec
	esp/tunnel/87.250.242.144-87.250.242.145/unique:145
	spid=7 seq=3 pid=58025 scope=ifnet ifname=ipsec0
	refcnt=1
# setkey -DPg
::/0 ::/0 icmp6 135,0
	out none
	spid=5 seq=1 pid=872 scope=global
	refcnt=1

No objection from:	#network
Obtained from:	Yandex LLC
MFC after:	2 weeks
Sponsored by:	Yandex LLC
Differential Revision:	https://reviews.freebsd.org/D9805
2017-03-07 00:13:53 +00:00
..
atf Don't bake all of CC/CPP/CXX into CFLAGS 2016-09-01 02:42:11 +00:00
clang Merge llvm, clang, compiler-rt, libc++, lld and lldb release_40 branch 2017-02-28 21:18:23 +00:00
csu Use SRCTOP-relative paths and .CURDIR with :H instead of ".." specified paths 2017-01-20 03:52:16 +00:00
lib80211 [lib80211] add VHT bands and channel flags. 2017-01-07 01:56:10 +00:00
libalias Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:34:59 +00:00
libarchive MFV r314565,314567,314570: 2017-03-02 22:59:35 +00:00
libauditd Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:55:21 +00:00
libbegemot Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:55:43 +00:00
libblacklist DIRDEPS_BUILD: Connect new directories and update dependencies. 2016-06-03 19:25:30 +00:00
libblocksruntime Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:56:10 +00:00
libbluetooth Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:56:42 +00:00
libbsdstat Fix off by one error in index limit calculation 2016-05-16 15:42:59 +00:00
libbsm Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:57:24 +00:00
libbsnmp Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:57:52 +00:00
libbz2 Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 03:58:50 +00:00
libc Move ATF_TC_WITHOUT_HEAD(getgrent) near the testcase it annotates 2017-03-06 22:46:49 +00:00
libc++ Belatedly add variant.cpp to libc++. This completes the support for the 2017-02-19 14:53:59 +00:00
libc_nonshared Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:04:25 +00:00
libcalendar
libcam Fix up r314189 2017-02-24 06:49:31 +00:00
libcapsicum capsicum_helpers: Add LOOKUP flag 2016-12-16 01:37:44 +00:00
libcasper Set SHLIBDIR before .including src.opts.mk in libcapser services 2016-10-24 14:37:18 +00:00
libclang_rt Merge ^/head r312968 through r313054. 2017-02-01 21:21:01 +00:00
libcom_err Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:51:36 +00:00
libcompat Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libcompiler_rt Remove an assembler flag, which is redundant since r309124. The upstream 2017-02-23 17:46:38 +00:00
libcrypt Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libcuse libcuse: make more use of the howmany() macro when available. 2016-04-26 01:20:16 +00:00
libcxxrt Surround any unmangled C++ names in libcxxrt's version map with 'extern 2017-02-22 18:44:57 +00:00
libdevctl Implement 'devctl clear driver' to undo a previous 'devctl set driver'. 2016-08-29 22:48:36 +00:00
libdevdctl Use .CURDIR:H instead of .CURDIR to simplify pathing in output, etc 2017-01-20 04:55:14 +00:00
libdevinfo
libdevstat
libdpv
libdwarf Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:54:21 +00:00
libedit MFV 312999: 2017-01-30 23:00:51 +00:00
libefivar Make sure guid table is compiled before we use it. 2017-03-03 20:23:23 +00:00
libelf Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:54:09 +00:00
libelftc Install the lib/libelftc manpages 2016-12-17 03:34:51 +00:00
libevent Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:53:50 +00:00
libexecinfo Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:53:40 +00:00
libexpat Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:53:45 +00:00
libfetch libfetch: extra bounds checking through reallocarray(3). 2017-03-06 15:38:03 +00:00
libfigpar
libgcc_eh libcc_{s,eh}: build without SSP 2016-11-11 23:28:07 +00:00
libgcc_s libgcc_s: add libc DT_NEEDED to fix underlinking 2017-01-13 15:17:25 +00:00
libgeom
libgpio Use GPIOTOGGLE to toggle the pin state instead of read, modify and write. 2016-04-19 15:18:31 +00:00
libgssapi Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:53:20 +00:00
libiconv_modules Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:53:26 +00:00
libifconfig Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libipsec Introduce the concept of IPsec security policies scope. 2017-03-07 00:13:53 +00:00
libjail Fix libjail reached latest sysctl entry. 2016-10-02 11:56:17 +00:00
libkiconv Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:50:46 +00:00
libkvm Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libldns Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:50:19 +00:00
liblzma Use SRCTOP-relative paths and .CURDIR with :H instead of ".." specified paths 2017-01-20 04:46:20 +00:00
libmagic Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:45:09 +00:00
libmd Fix bootstrapping libmd on older systems after r314709. 2017-03-06 21:06:55 +00:00
libmemstat Fix buildworld for powerpc. 2016-11-20 06:10:12 +00:00
libmilter Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:42:43 +00:00
libmp Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:42:11 +00:00
libmt Add the density code for LTO-7 to libmt and the mt(1) man page. 2016-05-20 19:30:52 +00:00
libnandfs
libnetbsd MFhead@r313404 2017-02-07 19:47:30 +00:00
libnetgraph
libngatm Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:41:53 +00:00
libnv Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:40:55 +00:00
libopenbsd
libopie Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:40:10 +00:00
libpam libpam: extra bounds checking through reallocarray(3). 2017-03-06 15:45:46 +00:00
libpathconv This little BSD licensed library has been kicking around for years. 2016-11-23 07:57:52 +00:00
libpcap Remove compatibility with old libpcap. 2017-03-06 08:13:19 +00:00
libpe Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:37:03 +00:00
libpjdlog
libpmc lib: minor spelling fixes in comments. 2016-05-01 19:37:33 +00:00
libproc Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:37:22 +00:00
libprocstat Use SRCTOP-relative paths and .CURDIR with :H instead of ".." specified paths 2017-01-20 04:38:54 +00:00
libradius The NAS-Identifier attribute is a string, not an integer. 2016-05-24 11:44:43 +00:00
librpcsec_gss Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:36:48 +00:00
librpcsvc Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:36:28 +00:00
librss librss: simplify some NULL checks. 2017-02-27 00:10:00 +00:00
librt Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:36:06 +00:00
librtld_db Fix style bugs and remove trailing whitespace in libproc and librtld_db. 2016-12-06 04:13:02 +00:00
libsbuf Expose the sbuf_putbuf() symbol to libsbuf. There are a few other symbols 2017-03-02 01:39:23 +00:00
libsdp lib: minor spelling fixes in comments. 2016-05-01 19:37:33 +00:00
libsm Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:35:36 +00:00
libsmb Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:35:00 +00:00
libsmdb Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:35:18 +00:00
libsmutil Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:34:34 +00:00
libsqlite3 Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:34:01 +00:00
libstand Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libstdbuf
libstdthreads Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:33:45 +00:00
libsysdecode Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libtacplus
libtelnet Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:32:36 +00:00
libthr Make use of clang nullability attributes. 2017-01-28 20:54:43 +00:00
libthread_db Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:28:16 +00:00
libucl Use SRCTOP to find the sources of libucl 2016-10-15 13:17:27 +00:00
libufs Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:30:05 +00:00
libugidfw
libulog Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:29:23 +00:00
libunbound Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:31:19 +00:00
libusb Fix libusb20_dev_get_desc(3) to use the "vendor product" order, not 2016-10-22 14:37:13 +00:00
libusbhid Sync ^/vendor/NetBSD/tests/dist with upstream 2017-01-12 07:26:39 +00:00
libutil Correct MLINKS for sbuf_hexdump(9) 2017-03-03 06:31:47 +00:00
libvgl
libvmmapi Capsicum support for bhyve(8). 2017-02-14 13:35:59 +00:00
libwrap Use SRCTOP instead of .CURDIR-relative path in .PATH directive 2017-01-18 18:14:50 +00:00
libxo Submitted by: phil 2016-05-29 01:43:28 +00:00
liby Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
libypclnt Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones 2017-01-20 04:28:41 +00:00
libz MFV r311279: zlib 1.2.10. 2017-01-04 16:09:08 +00:00
msun Fix warnings in lib/msun/tests/... to help pave way for WARNS?= 6. 2017-03-04 10:07:46 +00:00
ncurses Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
tests Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installed 2016-05-04 23:20:53 +00:00
Makefile Fix typo in lib/Makefile 2017-01-28 23:51:03 +00:00
Makefile.inc