From owner-svn-src-head@freebsd.org Sun Oct 21 14:19:17 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 165FBFF36E0; Sun, 21 Oct 2018 14:19:17 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B46468F46E; Sun, 21 Oct 2018 14:19:16 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A548E69FF; Sun, 21 Oct 2018 14:19:16 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w9LEJG2O060115; Sun, 21 Oct 2018 14:19:16 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w9LEJGej060114; Sun, 21 Oct 2018 14:19:16 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201810211419.w9LEJGej060114@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Sun, 21 Oct 2018 14:19:16 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r339533 - head/sys/netipsec X-SVN-Group: head X-SVN-Commit-Author: ae X-SVN-Commit-Paths: head/sys/netipsec X-SVN-Commit-Revision: 339533 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Oct 2018 14:19:17 -0000 Author: ae Date: Sun Oct 21 14:19:16 2018 New Revision: 339533 URL: https://svnweb.freebsd.org/changeset/base/339533 Log: Add sadb_x_sa2 extension to SADB_ACQUIRE requests. SADB_ACQUIRE requests are send by kernel, when security policy doesn't have corresponding security association for outbound packet. IKE daemon usually registers its handler for such messages and when the kernel asks for SA it can handle this request. Now such requests will contain additional fields that can help IKE daemon to create SA. And IKE now can create SAs using only information from SADB_ACQUIRE request, this is useful when many if_ipsec(4) interfaces are in use and IKE doesn track security policies that was installed by kernel. Obtained from: Yandex LLC MFC after: 3 weeks Sponsored by: Yandex LLC Modified: head/sys/netipsec/key.c Modified: head/sys/netipsec/key.c ============================================================================== --- head/sys/netipsec/key.c Sun Oct 21 12:39:00 2018 (r339532) +++ head/sys/netipsec/key.c Sun Oct 21 14:19:16 2018 (r339533) @@ -6685,7 +6685,9 @@ key_acquire(const struct secasindex *saidx, struct sec /* XXX proxy address (optional) */ - /* set sadb_x_policy */ + /* + * Set sadb_x_policy. This is KAME extension to RFC2367. + */ if (sp != NULL) { m = key_setsadbxpolicy(sp->policy, sp->spidx.dir, sp->id, sp->priority); @@ -6696,6 +6698,18 @@ key_acquire(const struct secasindex *saidx, struct sec m_cat(result, m); } + /* + * Set sadb_x_sa2 extension if saidx->reqid is not zero. + * This is FreeBSD extension to RFC2367. + */ + if (saidx->reqid != 0) { + m = key_setsadbxsa2(saidx->mode, 0, saidx->reqid); + if (m == NULL) { + error = ENOBUFS; + goto fail; + } + m_cat(result, m); + } /* XXX identity (optional) */ #if 0 if (idexttype && fqdn) {