Page MenuHomeFreeBSD

Add large replay widow support to setkey(8) and improve setkey's debugging
ClosedPublic

Authored by ae on Apr 12 2017, 7:43 PM.
Tags
None
Referenced Files
F168555126: D10375.id27406.diff
Sat, Aug 29, 12:21 AM
F168554867: D10375.diff
Sat, Aug 29, 12:20 AM
F168554763: D10375.id27385.diff
Sat, Aug 29, 12:19 AM
F168524046: D10375.id27406.diff
Fri, Aug 28, 8:20 PM
Unknown Object (File)
Thu, Aug 27, 9:29 PM
Unknown Object (File)
Thu, Aug 27, 10:21 AM
Unknown Object (File)
Tue, Aug 25, 7:52 AM
Unknown Object (File)
Tue, Aug 25, 6:09 AM
Subscribers

Details

Summary

rS309144 added support for large replay window, but setkey(8) and libipsec lacks this support.
This patch adds support of new sadb_x_sa_replay extension header to libipsec and setkey(8).
setkey(8) can set replay window for SA using '-r' option. When the replay window size is large than 255 bytes, we should add SADB_X_EXT_SA_REPLAY extension header.

Also extend setkey's debugging support. setkey -x can be used like tcpdump for PF_KEY's traffic. Add support for several new extension headers and NAT-T headers. In kdebug_sadb_address() use inet_ntop() for IP address formatting instead of using less readable hexdump.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable