Page MenuHomeFreeBSD

Enter and exit the network epoch for async IPsec callbacks.
ClosedPublic

Authored by jhb on Thu, Jun 25, 12:49 AM.

Details

Summary

When an IPsec packet has been encrypted or decrypted, the next step in
the packet's traversal through the network stack is invoked from a
crypto worker thread, not from the original calling thread. These
threads need to enter the network epoch before passing packets down to
IP output routines or up to transport protocols.

Test Plan
  • tried IPsec with a kernel with INVARIANTS on head and it promptly fell over with assertion failures (not sure why I didn't see this previously since the assertions went in)
  • tested with IPv4 (AES-GCM, IPcomp (sort of, I was able to get a single ping reply back, but not others), AES-CBC + SHA1), and IPv6 (AES-GCM)

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

jhb created this revision.Thu, Jun 25, 12:49 AM
jhb requested review of this revision.Thu, Jun 25, 12:49 AM
ae accepted this revision.Thu, Jun 25, 10:25 AM

LGTM.

This revision is now accepted and ready to land.Thu, Jun 25, 10:25 AM
This revision was automatically updated to reflect the committed changes.