CVS: cvs.openbsd.org: src

CVSROOT:	/cvs
Module name:	src
Changes by:	[email protected]	2026/08/12 12:23:14

Modified files:
	sys/net        : if_pfsync.c pfkeyv2_convert.c 
	sys/netinet    : ip_ah.c ip_esp.c ip_ipsp.h 

Log message:
Protect the IPsec TDB replay counter with mutex.

Put all tdb_rpl read, write and increment under tdb_mtx.  Although
shared net lock and kernel lock should be enough for now, we want
to move towards fine grained locking.  Mark tdb_rpl and tdb_seen
as MP safe.
The wrap-around check in ah_output() is not atomic with the increment
code and would not work.  As tdb_rpl is 64 bit nowadays, it cannot
warp.  Better remove the useless tdb_rpl == 0 check than making it
MP safe.

OK deraadt@