d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b05765d75f
freebsd-skq/sys
History
Andrey V. Elsukov b05765d75f Do not use xform_ipip as decapsulation fallback. 
xform_ipip was used as fallback with low priority for IPIP
encapsulated packets that were decrypted. In some cases
it can decapsulate packets, that it shouldn't. This leads to situations,
when wrong configurations are magically working. Also it can propagate
wrong ingress interface and this can break security.

Now we redesigned the IPSEC code and IPIP encapsulation is called directly
from ipsec_output, and decapsulation is done in the ipsec_input with m_striphdr.

Differential Revision:	https://reviews.freebsd.org/D1220
MFC after:	1 month
Sponsored by:	Yandex LLC
2014-11-26 17:44:49 +00:00
..
amd64 Revert r274772: it is not valid on MIPS 2014-11-25 03:50:31 +00:00
arm Add new devices to the config. 2014-11-25 16:24:31 +00:00
boot Fix style(9). 2014-11-25 18:58:40 +00:00
bsm
cam Coalesce last data move and command status for read commands. 2014-11-25 17:53:35 +00:00
cddl Revert r273060 per discussion with avg@ as we need to make L2ARC 2014-11-26 02:20:25 +00:00
compat The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
conf o Add Virtio MMIO bus driver to config 2014-11-25 16:53:22 +00:00
contrib Add missing headers needed by write(). 2014-11-25 02:58:38 +00:00
crypto Fix gcc build: preserve const qualifier when casting input values. 2014-11-11 13:37:28 +00:00
ddb ddb: ANSI-fy function declarations. 2014-10-12 18:01:52 +00:00
dev Fix WWNN/WWPN generation for virtual channels. 2014-11-26 16:05:01 +00:00
fs The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
gdb
geom Actually, that was a bad idea. Go back to MAXPARTITIONS. 2014-11-20 17:31:25 +00:00
gnu reiserfs: Use signed i_nlink 2014-09-25 19:10:32 +00:00
i386 MFamd64: Check for invalid flags in the machine context in sigreturn() 2014-11-25 12:52:00 +00:00
isa
kern The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
kgssapi Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
libkern Sync with userland variant. 2014-11-17 21:01:35 +00:00
mips Add support for Buffalo WZR-HP-AG300H atheros MIPS router. 2014-11-25 17:33:22 +00:00
modules There never was a PC Card joystick attachment that worked. Kill the 2014-11-22 20:31:20 +00:00
net Add a sysctl `net.link.tap.deladdrs_on_close' to configure whether tap 2014-11-24 14:00:27 +00:00
net80211 Fix multiple incorrect SYSCTL arguments in the kernel: 2014-10-21 07:31:21 +00:00
netgraph In preparation of merging projects/sendfile, transform bare access to 2014-11-12 09:57:15 +00:00
netinet Re-introduce padding fields removed with r264321 to keep 2014-11-17 14:56:02 +00:00
netinet6 Skip L2 addresses lookups for p2p interfaces. 2014-11-24 21:51:43 +00:00
netipsec Do not use xform_ipip as decapsulation fallback. 2014-11-26 17:44:49 +00:00
netnatm
netpfil pf(4) needs to have a correct checksum during its processing. 2014-11-19 13:31:08 +00:00
netsmb
nfs Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
nfsclient Follow up to r225617. In order to maximize the re-usability of kernel code 2014-10-16 18:04:43 +00:00
nfsserver
nlm Avoid dynamic syscall overhead for statically compiled modules. 2014-10-26 19:42:44 +00:00
ofed In preparation of merging projects/sendfile, transform bare access to 2014-11-12 09:57:15 +00:00
opencrypto Fix build for kernels without COMPAT_FREEBSD32. 2014-09-22 17:32:27 +00:00
pc98 Renove faith(4) and faithd(8) from base. It looks like industry 2014-11-09 21:33:01 +00:00
powerpc Revert r274772: it is not valid on MIPS 2014-11-25 03:50:31 +00:00
rpc In preparation of merging projects/sendfile, transform bare access to 2014-11-12 09:57:15 +00:00
security
sparc64 Revert r274772: it is not valid on MIPS 2014-11-25 03:50:31 +00:00
sys The process spin lock currently has the following distinct uses: 2014-11-26 14:10:00 +00:00
teken
tools
ufs Merge from projects/sendfile: 2014-11-23 12:01:52 +00:00
vm We already have "int i" in this scope. 2014-11-24 07:57:20 +00:00
x86 Improve support for XSAVE with debuggers. 2014-11-21 20:53:17 +00:00
xdr
xen opt_global.h is included automatically in the build. No need to 2014-11-18 17:06:56 +00:00
Makefile Remove "pci" from CSCOPEDIRS. 2014-09-23 06:32:19 +00:00