Changes in Makefile

e9ac41698b2f322d55ccf9da50a3596edb2c1800 - Remove residual blank line at start of Makefile

Mon, 15 Jul 2024 06:46:32 +0200

Remove residual blank line at start of MakefileThis is a residual of the $FreeBSD$ removal.MFC After: 3 days (though I'll just run the command on the branches)Sponsored by: Netflix List of files: /freebsd/sys/modules/ipsec/Makefile

ef2a572bf6bdcac97ef29ce631d2f50f938e1ec8 - ipsec_offload: kernel infrastructure

Sun, 22 Aug 2021 21:38:04 +0200

ipsec_offload: kernel infrastructureInline IPSEC offload moves almost whole IPSEC processing from theCPU/MCU and possibly crypto accelerator, to the network card.The transmitted packet content is not touched by CPU during TXoperations, kernel only does the required policy and securityassociation lookups to find out that given flow is offloaded, and thenpacket is transmitted as plain text to the card. For driver convenience,a metadata is attached to the packet identifying SA which must processthe packet. Card does encryption of the payload, padding, calculatesauthentication, and does the reformat according to the policy.Similarly, on receive, card does the decapsulation, decryption, andauthentification. Kernel receives the identifier of SA that wasused to process the packet, together with the plain-text packet.Overall, payload octets are only read or written by card DMA engine,removing a lot of memory subsystem overhead, and saving CPU time becauseIPSEC algos calculations are avoided.If driver declares support for inline IPSEC offload (with theIFCAP2_IPSEC_OFFLOAD capability set and registering method table structif_ipsec_accel_methods), kernel offers the SPD and SAD to driver.Driver decides which policies and SAs can be offloaded based onhardware capacity, and acks/nacks each SA for given interface tokernel. Kernel needs to keep this information to make a decision toskip software processing on TX, and to assume processing already doneon RX. This shadow SPD/SAD database of offloads is rooted frompolicies (struct secpolicy accel_ifps, struct ifp_handle_sp) and SAs(struct secasvar accel_ipfs, struct ifp_handle_sav).Some extensions to the PF_KEY socket allow to limit interfaces forwhich given SP/SA could be offloaded (proposed for offload). Also,additional statistics extensions allow to observe allocation/octet/usecounters for specific SA.Since SPs and SAs are typically instantiated in non-sleepable context,while offloading them into card is expected to require costly asyncmanipulations of the card state, calls to the driver for offload andtermination are executed in the threaded taskqueue. It also solvesthe issue of allocating resources needed for the offload database.Neither ipf_handle_sp nor ipf_handle_sav do not add reference to theowning SP/SA, the offload must be terminated before last reference isdropped. ipsec_accel only adds transient references to ensure safepointer ownership by taskqueue.Maintaining the SA counters for hardware-accelerated packets is theduty of the driver. The helper ipsec_accel_drv_sa_lifetime_update()is provided to hide accel infrastructure from drivers which would useexpected callout to query hardware periodically for updates.Reviewed by: rscheff (transport, stack integration), npSponsored by: NVIDIA networkingDifferential revision: https://reviews.freebsd.org/D44219 List of files: /freebsd/sys/modules/ipsec/Makefile

c3d7bb5aca7749626b5c70dfa86ee8f07960f44a - netipsec: fix LINT-NOINET build

Sat, 20 Jan 2024 15:37:40 +0100

netipsec: fix LINT-NOINET buildudp_ipsec_input() is used for INET6, so we need it even in NOINETbuilds. Build the relevant file if either of INET or INET6 are set. List of files: /freebsd/sys/modules/ipsec/Makefile

031beb4e239bfce798af17f5fe8dba8bcaf13d99 - sys: Remove $FreeBSD$: one-line sh pattern

Wed, 16 Aug 2023 19:54:58 +0200

sys: Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd/sys/modules/ipsec/Makefile

a335f76f2a40a248df01e22422b84d707bfcc4a9 - modules: a lot: need opt_kern_tls.h

Thu, 30 Sep 2021 06:07:17 +0200

modules: a lot: need opt_kern_tls.hThis fixes the standalone build. List of files: /freebsd/sys/modules/ipsec/Makefile

4bcbd26ff8ba994b042e655dd2c865f3722c0899 - Honor opt_ipsec.h from kernel builds.

Fri, 29 May 2020 21:21:35 +0200

Honor opt_ipsec.h from kernel builds.To make this simpler, set the default contents of opt_ipsec.hfor standalone modules in sys/conf/config.mk.Reviewed by: impMFC after: 2 weeksSponsored by: NetflixDifferential Revision: https://reviews.freebsd.org/D25046 List of files: /freebsd/sys/modules/ipsec/Makefile

740d4c7c9f43974629de022b5c1b7c0f2ae36637 - Revert r347402. After r347429 symlink is no longer needed.

Mon, 13 May 2019 10:34:13 +0200

Revert r347402. After r347429 symlink is no longer needed. List of files: /freebsd/sys/modules/ipsec/Makefile

30de137493f5817638d1b6653c1218ac3ca89bb9 - Add if_ipsec.ko symlink to ipsec.ko kernel module.

Thu, 09 May 2019 20:06:11 +0200

Add if_ipsec.ko symlink to ipsec.ko kernel module.This add ability to automatically load ipsec kernel module, whenif_ipsec(4) virtual interface is created using ifconfig(8).Reviewed by: gallatinMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D20169 List of files: /freebsd/sys/modules/ipsec/Makefile

ea1e967cbf9a3e1bbf964b01859c4d37965548d4 - Merge ^/head r318380 through r318559.

Fri, 19 May 2017 23:20:01 +0200

Merge ^/head r318380 through r318559. List of files: /freebsd/sys/modules/ipsec/Makefile

518613e4125d8fd663ddc6d75d02291f308c1e49 - Normalize .PATH on SRCTOP

Thu, 18 May 2017 08:13:29 +0200

Normalize .PATH on SRCTOPThis will help Jenkins dedupe 9 warnings between the static build andthe module build of ipsec(4).Missed in SRCTOP conversion in r314651.MFC with: r314651Sponsored by: Dell EMC Isilon List of files: /freebsd/sys/modules/ipsec/Makefile

193d9e768ba63fcfb187cfd17f461f7d41345048 - sys/modules: normalize .CURDIR-relative paths to SRCTOP

Sat, 04 Mar 2017 11:10:17 +0100

sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon List of files: /freebsd/sys/modules/ipsec/Makefile

1a36faad54665288ed4eb839d2a4699ae2ead45e - Merge ^/head r313301 through r313643.

Sat, 11 Feb 2017 15:04:18 +0100

Merge ^/head r313301 through r313643. List of files: /freebsd/sys/modules/ipsec/Makefile

15df32b48d5f0546aae69bbbffbb0f133ee14b39 - MFhead@r313360

Tue, 07 Feb 2017 02:33:39 +0100

MFhead@r313360 List of files: /freebsd/sys/modules/ipsec/Makefile

fcf596178b5f2be36424ecbc1b6a3224b29c91d2 - Merge projects/ipsec into head/.

Mon, 06 Feb 2017 09:49:57 +0100

Merge projects/ipsec into head/. Small summary -------------o Almost all IPsec releated code was moved into sys/netipsec.o New kernel modules added: ipsec.ko and tcpmd5.ko. New kernel option IPSEC_SUPPORT added. It enables support for loading and unloading of ipsec.ko and tcpmd5.ko kernel modules.o IPSEC_NAT_T option was removed. Now NAT-T support is enabled by default. The UDP_ENCAP_ESPINUDP_NON_IKE encapsulation type support was removed. Added TCP/UDP checksum handling for inbound packets that were decapsulated by transport mode SAs. setkey(8) modified to show run-time NAT-T configuration of SA.o New network pseudo interface if_ipsec(4) added. For now it is build as part of ipsec.ko module (or with IPSEC kernel). It implements IPsec virtual tunnels to create route-based VPNs.o The network stack now invokes IPsec functions using special methods. The only one header file should be included to declare all the needed things to work with IPsec.o All IPsec protocols handlers (ESP/AH/IPCOMP protosw) were removed. Now these protocols are handled directly via IPsec methods.o TCP_SIGNATURE support was reworked to be more close to RFC.o PF_KEY SADB was reworked: - now all security associations stored in the single SPI namespace, and all SAs MUST have unique SPI. - several hash tables added to speed up lookups in SADB. - SADB now uses rmlock to protect access, and concurrent threads can do SA lookups in the same time. - many PF_KEY message handlers were reworked to reflect changes in SADB. - SADB_UPDATE message was extended to support new PF_KEY headers: SADB_X_EXT_NEW_ADDRESS_SRC and SADB_X_EXT_NEW_ADDRESS_DST. They can be used by IKE daemon to change SA addresses.o ipsecrequest and secpolicy structures were cardinally changed to avoid locking protection for ipsecrequest. Now we support only limited number (4) of bundled SAs, but they are supported for both INET and INET6.o INPCB security policy cache was introduced. Each PCB now caches used security policies to avoid SP lookup for each packet.o For inbound security policies added the mode, when the kernel does check for full history of applied IPsec transforms.o References counting rules for security policies and security associations were changed. The proper SA locking added into xform code.o xform code was also changed. Now it is possible to unregister xforms. tdb_xxx structures were changed and renamed to reflect changes in SADB/SPDB, and changed rules for locking and refcounting.Reviewed by: gnn, wblockObtained from: Yandex LLCRelnotes: yesSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D9352 List of files: /freebsd/sys/modules/ipsec/Makefile