CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/08/12 12:23:14
Modified files:
sys/net : if_pfsync.c pfkeyv2_convert.c
sys/netinet : ip_ah.c ip_esp.c ip_ipsp.h
Log message:
Protect the IPsec TDB replay counter with mutex.
Put all tdb_rpl read, write and increment under tdb_mtx. Although
shared net lock and kernel lock should be enough for now, we want
to move towards fine grained locking. Mark tdb_rpl and tdb_seen
as MP safe.
The wrap-around check in ah_output() is not atomic with the increment
code and would not work. As tdb_rpl is 64 bit nowadays, it cannot
warp. Better remove the useless tdb_rpl == 0 check than making it
MP safe.
OK deraadt@
