From owner-p4-projects@FreeBSD.ORG Thu Aug 24 18:54:33 2006 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 1CFEF16A4E5; Thu, 24 Aug 2006 18:54:33 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D0F2316A4DA for ; Thu, 24 Aug 2006 18:54:32 +0000 (UTC) (envelope-from piso@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 75DB943D4C for ; Thu, 24 Aug 2006 18:54:32 +0000 (GMT) (envelope-from piso@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k7OIsWFQ024606 for ; Thu, 24 Aug 2006 18:54:32 GMT (envelope-from piso@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k7OIsWqY024602 for perforce@freebsd.org; Thu, 24 Aug 2006 18:54:32 GMT (envelope-from piso@freebsd.org) Date: Thu, 24 Aug 2006 18:54:32 GMT Message-Id: <200608241854.k7OIsWqY024602@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to piso@freebsd.org using -f From: Paolo Pisati To: Perforce Change Reviews Cc: Subject: PERFORCE change 104973 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2006 18:54:33 -0000 http://perforce.freebsd.org/chv.cgi?CH=104973 Change 104973 by piso@piso_newluxor on 2006/08/24 18:53:46 IFC Affected files ... .. //depot/projects/soc2005/libalias/Makefile.inc1#4 integrate .. //depot/projects/soc2005/libalias/gnu/usr.bin/Makefile#3 integrate .. //depot/projects/soc2005/libalias/share/man/man4/fast_ipsec.4#3 integrate .. //depot/projects/soc2005/libalias/share/man/man4/ipsec.4#2 integrate .. //depot/projects/soc2005/libalias/share/mk/bsd.port.mk#2 integrate .. //depot/projects/soc2005/libalias/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c#3 integrate .. //depot/projects/soc2005/libalias/sys/security/audit/audit_pipe.c#2 integrate Differences ... ==== //depot/projects/soc2005/libalias/Makefile.inc1#4 (text+ko) ==== @@ -1,5 +1,5 @@ # -# $FreeBSD: src/Makefile.inc1,v 1.553 2006/08/22 07:51:05 ru Exp $ +# $FreeBSD: src/Makefile.inc1,v 1.554 2006/08/24 17:02:26 imp Exp $ # # Make command line options: # -DNO_CLEANDIR run ${MAKE} clean, instead of ${MAKE} cleandir @@ -1032,8 +1032,9 @@ .for _lib in ${_startup_libs} ${_prebuild_libs:Nlib/libpam} ${_generic_libs} ${_lib}__L: .PHONY .if exists(${.CURDIR}/${_lib}) - ${_+_}@${ECHODIR} "===> ${_lib} (depend,all,install)"; \ + ${_+_}@${ECHODIR} "===> ${_lib} (obj,depend,all,install)"; \ cd ${.CURDIR}/${_lib}; \ + ${MAKE} DIRPRFX=${_lib}/ obj; \ ${MAKE} DIRPRFX=${_lib}/ depend; \ ${MAKE} DIRPRFX=${_lib}/ all; \ ${MAKE} DIRPRFX=${_lib}/ install @@ -1044,8 +1045,9 @@ # static PAM library, and dynamic PAM library before dynamic PAM # modules. lib/libpam__L: .PHONY - ${_+_}@${ECHODIR} "===> lib/libpam (depend,all,install)"; \ + ${_+_}@${ECHODIR} "===> lib/libpam (obj,depend,all,install)"; \ cd ${.CURDIR}/lib/libpam; \ + ${MAKE} DIRPRFX=lib/libpam/ obj; \ ${MAKE} DIRPRFX=lib/libpam/ depend; \ ${MAKE} DIRPRFX=lib/libpam/ -D_NO_LIBPAM_SO_YET all; \ ${MAKE} DIRPRFX=lib/libpam/ -D_NO_LIBPAM_SO_YET install ==== //depot/projects/soc2005/libalias/gnu/usr.bin/Makefile#3 (text+ko) ==== @@ -1,4 +1,4 @@ -# $FreeBSD: src/gnu/usr.bin/Makefile,v 1.89 2006/08/21 18:25:43 marcel Exp $ +# $FreeBSD: src/gnu/usr.bin/Makefile,v 1.90 2006/08/24 15:46:29 marcel Exp $ .include @@ -24,7 +24,7 @@ sort \ ${_texinfo} -.if ${MACHINE_ARCH} == "arm" || ${MACHINE_ARCH} == "powerpc" +.if ${MACHINE_ARCH} == "arm" MK_GDB= no # not yet .endif ==== //depot/projects/soc2005/libalias/share/man/man4/fast_ipsec.4#3 (text+ko) ==== @@ -22,9 +22,9 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF .\" THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $FreeBSD: src/share/man/man4/fast_ipsec.4,v 1.4 2006/06/26 22:30:07 thompsa Exp $ +.\" $FreeBSD: src/share/man/man4/fast_ipsec.4,v 1.5 2006/08/24 17:07:19 danger Exp $ .\" -.Dd January 20, 2003 +.Dd August 24, 2006 .Dt FAST_IPSEC 4 .Os .Sh NAME @@ -32,6 +32,7 @@ .Nd hardware-accelerated IP Security Protocols .Sh SYNOPSIS .Cd "options FAST_IPSEC" +.Cd "options IPSEC_FILTERGIF" .Cd "device crypto" .Pp .Bl -item -compact @@ -69,6 +70,11 @@ The user should refer to .Xr ipsec 4 for basic information on setting up and using these protocols. +Note that it is not currently possible to use +.Nm +in conjuction with the +.Tn "KAME IPsec" +implementation. .Pp System configuration requires the .Xr crypto 4 @@ -83,6 +89,12 @@ .Dq enc0 , to perform packet filtering before outbound encryption and after decapsulation inbound. +.Pp +To properly filter +.Xr gif 4 +tunnels with firewalls, add +.Cd "options IPSEC_FILTERGIF" +to the kernel configuration file. .Sh DIAGNOSTICS To be added. .Sh SEE ALSO ==== //depot/projects/soc2005/libalias/share/man/man4/ipsec.4#2 (text+ko) ==== @@ -27,9 +27,9 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.\" $FreeBSD: src/share/man/man4/ipsec.4,v 1.18 2006/02/14 13:20:09 gnn Exp $ +.\" $FreeBSD: src/share/man/man4/ipsec.4,v 1.19 2006/08/24 17:07:19 danger Exp $ .\" -.Dd February 14, 2006 +.Dd August 24, 2006 .Dt IPSEC 4 .Os .Sh NAME @@ -39,6 +39,10 @@ .In sys/types.h .In netinet/in.h .In netinet6/ipsec.h +.Cd "options IPSEC" +.Cd "options IPSEC_DEBUG" +.Cd "options IPSEC_ESP" +.Cd "options IPSEC_FILTERGIF" .Sh DESCRIPTION .Nm is a security protocol implemented within the Internet Protocol layer @@ -253,6 +257,7 @@ .Xr ioctl 2 , .Xr socket 2 , .Xr ipsec_set_policy 3 , +.Xr fast_ipsec 4 , .Xr icmp6 4 , .Xr intro 4 , .Xr ip6 4 , ==== //depot/projects/soc2005/libalias/share/mk/bsd.port.mk#2 (text+ko) ==== @@ -1,7 +1,10 @@ -# $FreeBSD: src/share/mk/bsd.port.mk,v 1.307 2004/07/02 20:47:18 eik Exp $ +# $FreeBSD: src/share/mk/bsd.port.mk,v 1.308 2006/08/24 18:04:49 obrien Exp $ PORTSDIR?= /usr/ports BSDPORTMK?= ${PORTSDIR}/Mk/bsd.port.mk +# Needed to keep bsd.own.mk from reading in /etc/src.conf when building ports. +SRCCONF= /dev/null + .include .include "${BSDPORTMK}" ==== //depot/projects/soc2005/libalias/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c#3 (text+ko) ==== @@ -28,7 +28,7 @@ * SUCH DAMAGE. * * $Id: ng_btsocket_rfcomm.c,v 1.28 2003/09/14 23:29:06 max Exp $ - * $FreeBSD: src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c,v 1.22 2006/07/24 15:20:07 rwatson Exp $ + * $FreeBSD: src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c,v 1.23 2006/08/24 16:51:02 emax Exp $ */ #include @@ -1220,7 +1220,8 @@ ng_btsocket_rfcomm_session_p s = NULL; struct sockaddr_l2cap l2sa; struct sockopt l2sopt; - int mtu, error; + int error; + u_int16_t mtu; mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED); ==== //depot/projects/soc2005/libalias/sys/security/audit/audit_pipe.c#2 (text) ==== @@ -25,7 +25,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $FreeBSD: src/sys/security/audit/audit_pipe.c,v 1.7 2006/06/05 14:48:17 rwatson Exp $ + * $FreeBSD: src/sys/security/audit/audit_pipe.c,v 1.8 2006/08/24 17:42:38 rwatson Exp $ */ #include @@ -172,6 +172,7 @@ static d_read_t audit_pipe_read; static d_ioctl_t audit_pipe_ioctl; static d_poll_t audit_pipe_poll; +static d_kqfilter_t audit_pipe_kqfilter; static struct cdevsw audit_pipe_cdevsw = { .d_version = D_VERSION, @@ -181,9 +182,20 @@ .d_read = audit_pipe_read, .d_ioctl = audit_pipe_ioctl, .d_poll = audit_pipe_poll, + .d_kqfilter = audit_pipe_kqfilter, .d_name = AUDIT_PIPE_NAME, }; +static int audit_pipe_kqread(struct knote *note, long hint); +static void audit_pipe_kqdetach(struct knote *note); + +static struct filterops audit_pipe_read_filterops = { + .f_isfd = 1, + .f_attach = NULL, + .f_detach = audit_pipe_kqdetach, + .f_event = audit_pipe_kqread, +}; + /* * Some global statistics on audit pipes. */ @@ -425,6 +437,7 @@ ap->ap_inserts++; ap->ap_qlen++; selwakeuppri(&ap->ap_selinfo, PSOCK); + KNOTE_LOCKED(&ap->ap_selinfo.si_note, 0); if (ap->ap_flags & AUDIT_PIPE_ASYNC) pgsigio(&ap->ap_sigio, SIGIO, 0); } @@ -520,6 +533,8 @@ return (NULL); ap->ap_qlimit = AUDIT_PIPE_QLIMIT_DEFAULT; TAILQ_INIT(&ap->ap_queue); + knlist_init(&ap->ap_selinfo.si_note, &audit_pipe_mtx, NULL, NULL, + NULL); /* * Default flags, naflags, and auid-specific preselection settings to @@ -533,6 +548,9 @@ TAILQ_INIT(&ap->ap_preselect_list); ap->ap_preselect_mode = AUDITPIPE_PRESELECT_MODE_TRAIL; + /* + * Add to global list and update global statistics. + */ TAILQ_INSERT_HEAD(&audit_pipe_list, ap, ap_list); audit_pipe_count++; audit_pipe_ever++; @@ -572,6 +590,7 @@ audit_pipe_preselect_flush_locked(ap); audit_pipe_flush(ap); + knlist_destroy(&ap->ap_selinfo.si_note); TAILQ_REMOVE(&audit_pipe_list, ap, ap_list); free(ap, M_AUDIT_PIPE); audit_pipe_count--; @@ -946,6 +965,71 @@ } /* + * Audit pipe kqfilter. + */ +static int +audit_pipe_kqfilter(struct cdev *dev, struct knote *kn) +{ + struct audit_pipe *ap; + + ap = dev->si_drv1; + KASSERT(ap != NULL, ("audit_pipe_kqfilter: ap == NULL")); + + if (kn->kn_filter != EVFILT_READ) + return (EINVAL); + + kn->kn_fop = &audit_pipe_read_filterops; + kn->kn_hook = ap; + + mtx_lock(&audit_pipe_mtx); + knlist_add(&ap->ap_selinfo.si_note, kn, 1); + mtx_unlock(&audit_pipe_mtx); + return (0); +} + +/* + * Return true if there are records available for reading on the pipe. + */ +static int +audit_pipe_kqread(struct knote *kn, long hint) +{ + struct audit_pipe_entry *ape; + struct audit_pipe *ap; + + mtx_assert(&audit_pipe_mtx, MA_OWNED); + + ap = (struct audit_pipe *)kn->kn_hook; + KASSERT(ap != NULL, ("audit_pipe_kqread: ap == NULL")); + + if (ap->ap_qlen != 0) { + ape = TAILQ_FIRST(&ap->ap_queue); + KASSERT(ape != NULL, ("audit_pipe_kqread: ape == NULL")); + + kn->kn_data = ape->ape_record_len; + return (1); + } else { + kn->kn_data = 0; + return (0); + } +} + +/* + * Detach kqueue state from audit pipe. + */ +static void +audit_pipe_kqdetach(struct knote *kn) +{ + struct audit_pipe *ap; + + ap = (struct audit_pipe *)kn->kn_hook; + KASSERT(ap != NULL, ("audit_pipe_kqdetach: ap == NULL")); + + mtx_lock(&audit_pipe_mtx); + knlist_remove(&ap->ap_selinfo.si_note, kn, 1); + mtx_unlock(&audit_pipe_mtx); +} + +/* * Initialize the audit pipe system. */ static void