From owner-svn-src-head@FreeBSD.ORG Tue Dec 2 04:20:56 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B1B1E423; Tue, 2 Dec 2014 04:20:56 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9D022AB1; Tue, 2 Dec 2014 04:20:56 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id sB24KuQL066340; Tue, 2 Dec 2014 04:20:56 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id sB24Kpa9064736; Tue, 2 Dec 2014 04:20:51 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201412020420.sB24Kpa9064736@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Tue, 2 Dec 2014 04:20:51 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r275392 - in head/sys: netinet netinet6 netipsec X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Dec 2014 04:20:56 -0000 Author: ae Date: Tue Dec 2 04:20:50 2014 New Revision: 275392 URL: https://svnweb.freebsd.org/changeset/base/275392 Log: Remove route chaching support from ipsec code. It isn't used for some time. * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include ; Sponsored by: Yandex LLC Modified: head/sys/netinet/ip_icmp.c head/sys/netinet/ip_ipsec.c head/sys/netinet6/icmp6.c head/sys/netinet6/ip6_ipsec.c head/sys/netipsec/ipsec.c head/sys/netipsec/ipsec.h head/sys/netipsec/ipsec_input.c head/sys/netipsec/ipsec_mbuf.c head/sys/netipsec/ipsec_output.c head/sys/netipsec/key.c head/sys/netipsec/key.h head/sys/netipsec/key_debug.c head/sys/netipsec/keydb.h head/sys/netipsec/keysock.c head/sys/netipsec/xform_ah.c head/sys/netipsec/xform_esp.c head/sys/netipsec/xform_ipcomp.c head/sys/netipsec/xform_ipip.c head/sys/netipsec/xform_tcp.c Modified: head/sys/netinet/ip_icmp.c ============================================================================== --- head/sys/netinet/ip_icmp.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netinet/ip_icmp.c Tue Dec 2 04:20:50 2014 (r275392) @@ -33,7 +33,6 @@ __FBSDID("$FreeBSD$"); #include "opt_inet.h" -#include "opt_ipsec.h" #include #include @@ -65,10 +64,6 @@ __FBSDID("$FreeBSD$"); #include #ifdef INET -#ifdef IPSEC -#include -#include -#endif #include @@ -619,9 +614,6 @@ reflect: (struct sockaddr *)&icmpgw, fibnum); } pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&icmpsrc); -#ifdef IPSEC - key_sa_routechange((struct sockaddr *)&icmpsrc); -#endif break; /* Modified: head/sys/netinet/ip_ipsec.c ============================================================================== --- head/sys/netinet/ip_ipsec.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netinet/ip_ipsec.c Tue Dec 2 04:20:50 2014 (r275392) @@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$"); #include #include -#include #include #include @@ -206,35 +205,7 @@ ip_ipsec_mtu(struct mbuf *m, int mtu) * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz * XXX quickhack!!! */ - struct secpolicy *sp = NULL; - int ipsecerror; - int ipsechdr; - struct route *ro; - sp = ipsec_getpolicybyaddr(m, - IPSEC_DIR_OUTBOUND, - IP_FORWARDING, - &ipsecerror); - if (sp != NULL) { - /* count IPsec header size */ - ipsechdr = ipsec_hdrsiz(m, IPSEC_DIR_OUTBOUND, NULL); - - /* - * find the correct route for outer IPv4 - * header, compute tunnel MTU. - */ - if (sp->req != NULL && - sp->req->sav != NULL && - sp->req->sav->sah != NULL) { - ro = &sp->req->sav->sah->route_cache.sa_route; - if (ro->ro_rt && ro->ro_rt->rt_ifp) { - mtu = ro->ro_rt->rt_mtu ? ro->ro_rt->rt_mtu : - ro->ro_rt->rt_ifp->if_mtu; - mtu -= ipsechdr; - } - } - KEY_FREESP(&sp); - } - return mtu; + return (mtu - ipsec_hdrsiz(m, IPSEC_DIR_OUTBOUND, NULL)); } /* Modified: head/sys/netinet6/icmp6.c ============================================================================== --- head/sys/netinet6/icmp6.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netinet6/icmp6.c Tue Dec 2 04:20:50 2014 (r275392) @@ -67,7 +67,6 @@ __FBSDID("$FreeBSD$"); #include "opt_inet.h" #include "opt_inet6.h" -#include "opt_ipsec.h" #include #include @@ -110,11 +109,6 @@ __FBSDID("$FreeBSD$"); #include #include -#ifdef IPSEC -#include -#include -#endif - extern struct domain inet6domain; VNET_PCPUSTAT_DEFINE(struct icmp6stat, icmp6stat); @@ -2472,9 +2466,6 @@ icmp6_redirect_input(struct mbuf *m, int sdst.sin6_len = sizeof(struct sockaddr_in6); bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr)); pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst); -#ifdef IPSEC - key_sa_routechange((struct sockaddr *)&sdst); -#endif /* IPSEC */ } freeit: Modified: head/sys/netinet6/ip6_ipsec.c ============================================================================== --- head/sys/netinet6/ip6_ipsec.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netinet6/ip6_ipsec.c Tue Dec 2 04:20:50 2014 (r275392) @@ -48,7 +48,6 @@ __FBSDID("$FreeBSD$"); #include #include -#include #include #include Modified: head/sys/netipsec/ipsec.c ============================================================================== --- head/sys/netipsec/ipsec.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/ipsec.c Tue Dec 2 04:20:50 2014 (r275392) @@ -56,7 +56,6 @@ #include #include -#include #include #include Modified: head/sys/netipsec/ipsec.h ============================================================================== --- head/sys/netipsec/ipsec.h Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/ipsec.h Tue Dec 2 04:20:50 2014 (r275392) @@ -47,6 +47,10 @@ #ifdef _KERNEL +#include +#include +#include + #define IPSEC_ASSERT(_c,_m) KASSERT(_c, _m) #define IPSEC_IS_PRIVILEGED_SO(_so) \ Modified: head/sys/netipsec/ipsec_input.c ============================================================================== --- head/sys/netipsec/ipsec_input.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/ipsec_input.c Tue Dec 2 04:20:50 2014 (r275392) @@ -58,7 +58,6 @@ #include #include #include -#include #include #include Modified: head/sys/netipsec/ipsec_mbuf.c ============================================================================== --- head/sys/netipsec/ipsec_mbuf.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/ipsec_mbuf.c Tue Dec 2 04:20:50 2014 (r275392) @@ -37,11 +37,8 @@ #include #include -#include #include - #include - #include /* Modified: head/sys/netipsec/ipsec_output.c ============================================================================== --- head/sys/netipsec/ipsec_output.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/ipsec_output.c Tue Dec 2 04:20:50 2014 (r275392) @@ -46,7 +46,6 @@ #include #include #include -#include #include #include Modified: head/sys/netipsec/key.c ============================================================================== --- head/sys/netipsec/key.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/key.c Tue Dec 2 04:20:50 2014 (r275392) @@ -59,7 +59,6 @@ #include #include -#include #include #include @@ -2770,10 +2769,6 @@ key_delsah(sah) /* remove from tree of SA index */ if (__LIST_CHAINED(sah)) LIST_REMOVE(sah, chain); - if (sah->route_cache.sa_route.ro_rt) { - RTFREE(sah->route_cache.sa_route.ro_rt); - sah->route_cache.sa_route.ro_rt = (struct rtentry *)NULL; - } free(sah, M_IPSEC_SAH); } } @@ -7898,26 +7893,6 @@ key_sa_recordxfer(sav, m) return; } -/* dumb version */ -void -key_sa_routechange(dst) - struct sockaddr *dst; -{ - struct secashead *sah; - struct route *ro; - - SAHTREE_LOCK(); - LIST_FOREACH(sah, &V_sahtree, chain) { - ro = &sah->route_cache.sa_route; - if (ro->ro_rt && dst->sa_len == ro->ro_dst.sa_len - && bcmp(dst, &ro->ro_dst, dst->sa_len) == 0) { - RTFREE(ro->ro_rt); - ro->ro_rt = (struct rtentry *)NULL; - } - } - SAHTREE_UNLOCK(); -} - static void key_sa_chgstate(struct secasvar *sav, u_int8_t state) { Modified: head/sys/netipsec/key.h ============================================================================== --- head/sys/netipsec/key.h Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/key.h Tue Dec 2 04:20:50 2014 (r275392) @@ -106,7 +106,6 @@ extern void key_init __P((void)); extern void key_destroy(void); #endif extern void key_sa_recordxfer __P((struct secasvar *, struct mbuf *)); -extern void key_sa_routechange __P((struct sockaddr *)); extern void key_sa_stir_iv __P((struct secasvar *)); #ifdef IPSEC_NAT_T u_int16_t key_portfromsaddr(struct sockaddr *); Modified: head/sys/netipsec/key_debug.c ============================================================================== --- head/sys/netipsec/key_debug.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/key_debug.c Tue Dec 2 04:20:50 2014 (r275392) @@ -45,7 +45,6 @@ #endif #include -#include #include #include Modified: head/sys/netipsec/keydb.h ============================================================================== --- head/sys/netipsec/keydb.h Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/keydb.h Tue Dec 2 04:20:50 2014 (r275392) @@ -85,12 +85,6 @@ struct seclifetime { u_int64_t usetime; }; -union sa_route_union { - struct route sa_route; - struct route sin_route; /* Duplicate for consistency. */ - struct route_in6 sin6_route; -}; - /* Security Association Data Base */ struct secashead { LIST_ENTRY(secashead) chain; @@ -105,8 +99,6 @@ struct secashead { LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1]; /* SA chain */ /* The first of this list is newer SA */ - - union sa_route_union route_cache; }; struct xformsw; Modified: head/sys/netipsec/keysock.c ============================================================================== --- head/sys/netipsec/keysock.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/keysock.c Tue Dec 2 04:20:50 2014 (r275392) @@ -54,7 +54,6 @@ #include #include #include -#include #include Modified: head/sys/netipsec/xform_ah.c ============================================================================== --- head/sys/netipsec/xform_ah.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/xform_ah.c Tue Dec 2 04:20:50 2014 (r275392) @@ -58,7 +58,6 @@ #include #include -#include #include #include #include Modified: head/sys/netipsec/xform_esp.c ============================================================================== --- head/sys/netipsec/xform_esp.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/xform_esp.c Tue Dec 2 04:20:50 2014 (r275392) @@ -58,7 +58,6 @@ #include #include -#include #include #include #include Modified: head/sys/netipsec/xform_ipcomp.c ============================================================================== --- head/sys/netipsec/xform_ipcomp.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/xform_ipcomp.c Tue Dec 2 04:20:50 2014 (r275392) @@ -48,7 +48,6 @@ #include #include -#include #include #include Modified: head/sys/netipsec/xform_ipip.c ============================================================================== --- head/sys/netipsec/xform_ipip.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/xform_ipip.c Tue Dec 2 04:20:50 2014 (r275392) @@ -54,7 +54,6 @@ #include #include #include -#include #include #include Modified: head/sys/netipsec/xform_tcp.c ============================================================================== --- head/sys/netipsec/xform_tcp.c Tue Dec 2 02:41:44 2014 (r275391) +++ head/sys/netipsec/xform_tcp.c Tue Dec 2 04:20:50 2014 (r275392) @@ -47,7 +47,6 @@ #include #include -#include #include #include