ipsec_netbsd.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $NetBSD: ipsec_netbsd.c,v 1.55 2022/09/02 23:48:11 thorpej Exp $        */
    2 /*      $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $      */
    3 /*      $KAME: ah_input.c,v 1.64 2001/09/04 08:43:19 itojun Exp $       */
    4 
    5 /*
    6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  * 3. Neither the name of the project nor the names of its contributors
   18  *    may be used to endorse or promote products derived from this software
   19  *    without specific prior written permission.
   20  *
   21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   31  * SUCH DAMAGE.
   32  */
   33 
   34 #include <sys/cdefs.h>
   35 __KERNEL_RCSID(0, "$NetBSD: ipsec_netbsd.c,v 1.55 2022/09/02 23:48:11 thorpej Exp $");
   36 
   37 #if defined(_KERNEL_OPT)
   38 #include "opt_inet.h"
   39 #include "opt_ipsec.h"
   40 #endif
   41 
   42 #include <sys/param.h>
   43 #include <sys/systm.h>
   44 #include <sys/mbuf.h>
   45 #include <sys/domain.h>
   46 #include <sys/protosw.h>
   47 #include <sys/socket.h>
   48 #include <sys/errno.h>
   49 #include <sys/time.h>
   50 #include <sys/kernel.h>
   51 #include <sys/sysctl.h>
   52 
   53 #include <net/if.h>
   54 #include <net/route.h>
   55 #include <sys/cpu.h>
   56 
   57 #include <netinet/in.h>
   58 #include <netinet/in_systm.h>
   59 #include <netinet/in_var.h>
   60 #include <netinet/ip.h>
   61 #include <netinet/ip_var.h>
   62 #include <netinet/ip_ecn.h>
   63 #include <netinet/ip_icmp.h>
   64 
   65 #include <netipsec/ipsec.h>
   66 #include <netipsec/ipsec_var.h>
   67 #include <netipsec/ipsec_private.h>
   68 #include <netipsec/key.h>
   69 #include <netipsec/keydb.h>
   70 #include <netipsec/key_debug.h>
   71 #include <netipsec/ah.h>
   72 #include <netipsec/ah_var.h>
   73 #include <netipsec/esp.h>
   74 #include <netipsec/esp_var.h>
   75 #include <netipsec/ipip_var.h>
   76 #include <netipsec/ipcomp_var.h>
   77 
   78 #ifdef INET6
   79 #include <netipsec/ipsec6.h>
   80 #include <netinet6/ip6protosw.h>
   81 #include <netinet/icmp6.h>
   82 #endif
   83 
   84 #include <netipsec/key.h>
   85 
   86 /* assumes that ip header and ah header are contiguous on mbuf */
   87 void *
   88 ah4_ctlinput(int cmd, const struct sockaddr *sa, void *v)
   89 {
   90         struct ip *ip = v;
   91         struct ah *ah;
   92         struct icmp *icp;
   93         struct secasvar *sav;
   94 
   95         if (sa->sa_family != AF_INET ||
   96             sa->sa_len != sizeof(struct sockaddr_in))
   97                 return NULL;
   98         if ((unsigned)cmd >= PRC_NCMDS)
   99                 return NULL;
  100 
  101         if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) {
  102                 /*
  103                  * Check to see if we have a valid SA corresponding to
  104                  * the address in the ICMP message payload.
  105                  */
  106                 ah = (struct ah *)((char *)ip + (ip->ip_hl << 2));
  107                 sav = KEY_LOOKUP_SA((const union sockaddr_union *)sa,
  108                     IPPROTO_AH, ah->ah_spi, 0, 0);
  109 
  110                 if (sav) {
  111                         if (SADB_SASTATE_USABLE_P(sav)) {
  112                                 /*
  113                                  * Now that we've validated that we are actually
  114                                  * communicating with the host indicated in the
  115                                  * ICMP message, locate the ICMP header,
  116                                  * recalculate the new MTU, and create the
  117                                  * corresponding routing entry.
  118                                  */
  119                                 icp = (struct icmp *)((char *)ip -
  120                                     offsetof(struct icmp, icmp_ip));
  121                                 icmp_mtudisc(icp, ip->ip_dst);
  122                         }
  123                         KEY_SA_UNREF(&sav);
  124                 }
  125         }
  126         return NULL;
  127 }
  128 
  129 /* assumes that ip header and esp header are contiguous on mbuf */
  130 void *
  131 esp4_ctlinput(int cmd, const struct sockaddr *sa, void *v)
  132 {
  133         struct ip *ip = v;
  134         struct esp *esp;
  135         struct icmp *icp;
  136         struct secasvar *sav;
  137 
  138         if (sa->sa_family != AF_INET ||
  139             sa->sa_len != sizeof(struct sockaddr_in))
  140                 return NULL;
  141         if ((unsigned)cmd >= PRC_NCMDS)
  142                 return NULL;
  143 
  144         if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) {
  145                 /*
  146                  * Check to see if we have a valid SA corresponding to
  147                  * the address in the ICMP message payload.
  148                  */
  149                 esp = (struct esp *)((char *)ip + (ip->ip_hl << 2));
  150                 sav = KEY_LOOKUP_SA((const union sockaddr_union *)sa,
  151                     IPPROTO_ESP, esp->esp_spi, 0, 0);
  152 
  153                 if (sav) {
  154                         if (SADB_SASTATE_USABLE_P(sav)) {
  155                                 /*
  156                                  * Now that we've validated that we are actually
  157                                  * communicating with the host indicated in the
  158                                  * ICMP message, locate the ICMP header,
  159                                  * recalculate the new MTU, and create the
  160                                  * corresponding routing entry.
  161                                  */
  162                                 icp = (struct icmp *)((char *)ip -
  163                                     offsetof(struct icmp, icmp_ip));
  164                                 icmp_mtudisc(icp, ip->ip_dst);
  165                         }
  166                         KEY_SA_UNREF(&sav);
  167                 }
  168         }
  169         return NULL;
  170 }
  171 
  172 #ifdef INET6
  173 void *
  174 ah6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
  175 {
  176         const struct newah *ahp;
  177         struct newah ah;
  178         struct secasvar *sav;
  179         struct ip6_hdr *ip6;
  180         struct mbuf *m;
  181         struct ip6ctlparam *ip6cp = NULL;
  182         int off;
  183 
  184         if (sa->sa_family != AF_INET6 ||
  185             sa->sa_len != sizeof(struct sockaddr_in6))
  186                 return NULL;
  187         if ((unsigned)cmd >= PRC_NCMDS)
  188                 return NULL;
  189 
  190         /* if the parameter is from icmp6, decode it. */
  191         if (d != NULL) {
  192                 ip6cp = (struct ip6ctlparam *)d;
  193                 m = ip6cp->ip6c_m;
  194                 ip6 = ip6cp->ip6c_ip6;
  195                 off = ip6cp->ip6c_off;
  196         } else {
  197                 m = NULL;
  198                 ip6 = NULL;
  199                 off = 0;
  200         }
  201 
  202         if (ip6) {
  203                 /* check if we can safely examine src and dst ports */
  204                 if (m->m_pkthdr.len < off + sizeof(ah))
  205                         return NULL;
  206 
  207                 if (m->m_len < off + sizeof(ah)) {
  208                         /*
  209                          * this should be rare case,
  210                          * so we compromise on this copy...
  211                          */
  212                         m_copydata(m, off, sizeof(ah), &ah);
  213                         ahp = &ah;
  214                 } else
  215                         ahp = (struct newah *)(mtod(m, char *) + off);
  216 
  217                 if (cmd == PRC_MSGSIZE) {
  218                         int valid = 0;
  219 
  220                         /*
  221                          * Check to see if we have a valid SA corresponding
  222                          * to the address in the ICMP message payload.
  223                          */
  224                         sav = KEY_LOOKUP_SA((const union sockaddr_union *)sa,
  225                             IPPROTO_AH, ahp->ah_spi, 0, 0);
  226 
  227                         if (sav) {
  228                                 if (SADB_SASTATE_USABLE_P(sav))
  229                                         valid++;
  230                                 KEY_SA_UNREF(&sav);
  231                         }
  232 
  233                         /* XXX Further validation? */
  234 
  235                         /*
  236                          * Depending on the value of "valid" and routing
  237                          * table size (mtudisc_{hi,lo}wat), we will:
  238                          * - recalculate the new MTU and create the
  239                          *   corresponding routing entry, or
  240                          * - ignore the MTU change notification.
  241                          */
  242                         icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
  243                 }
  244 
  245                 /* we normally notify single pcb here */
  246         } else {
  247                 /* we normally notify any pcb here */
  248         }
  249         return NULL;
  250 }
  251 
  252 void *
  253 esp6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
  254 {
  255         const struct newesp *espp;
  256         struct newesp esp;
  257         struct ip6ctlparam *ip6cp = NULL, ip6cp1;
  258         struct secasvar *sav;
  259         struct ip6_hdr *ip6;
  260         struct mbuf *m;
  261         int off;
  262 
  263         if (sa->sa_family != AF_INET6 ||
  264             sa->sa_len != sizeof(struct sockaddr_in6))
  265                 return NULL;
  266         if ((unsigned)cmd >= PRC_NCMDS)
  267                 return NULL;
  268 
  269         /* if the parameter is from icmp6, decode it. */
  270         if (d != NULL) {
  271                 ip6cp = (struct ip6ctlparam *)d;
  272                 m = ip6cp->ip6c_m;
  273                 ip6 = ip6cp->ip6c_ip6;
  274                 off = ip6cp->ip6c_off;
  275         } else {
  276                 m = NULL;
  277                 ip6 = NULL;
  278                 off = 0;
  279         }
  280 
  281         if (ip6) {
  282                 /*
  283                  * Notify the error to all possible sockets via pfctlinput2.
  284                  * Since the upper layer information (such as protocol type,
  285                  * source and destination ports) is embedded in the encrypted
  286                  * data and might have been cut, we can't directly call
  287                  * an upper layer ctlinput function. However, the pcbnotify
  288                  * function will consider source and destination addresses
  289                  * as well as the flow info value, and may be able to find
  290                  * some PCB that should be notified.
  291                  * Although pfctlinput2 will call esp6_ctlinput(), there is
  292                  * no possibility of an infinite loop of function calls,
  293                  * because we don't pass the inner IPv6 header.
  294                  */
  295                 memset(&ip6cp1, 0, sizeof(ip6cp1));
  296                 ip6cp1.ip6c_src = ip6cp->ip6c_src;
  297                 pfctlinput2(cmd, sa, &ip6cp1);
  298 
  299                 /* check if we can safely examine src and dst ports */
  300                 if (m->m_pkthdr.len < off + sizeof(esp))
  301                         return NULL;
  302 
  303                 if (m->m_len < off + sizeof(esp)) {
  304                         /*
  305                          * this should be rare case,
  306                          * so we compromise on this copy...
  307                          */
  308                         m_copydata(m, off, sizeof(esp), &esp);
  309                         espp = &esp;
  310                 } else
  311                         espp = (struct newesp *)(mtod(m, char *) + off);
  312 
  313                 if (cmd == PRC_MSGSIZE) {
  314                         int valid = 0;
  315 
  316                         /*
  317                          * Check to see if we have a valid SA corresponding to
  318                          * the address in the ICMP message payload.
  319                          */
  320 
  321                         sav = KEY_LOOKUP_SA((const union sockaddr_union *)sa,
  322                             IPPROTO_ESP, espp->esp_spi, 0, 0);
  323 
  324                         if (sav) {
  325                                 if (SADB_SASTATE_USABLE_P(sav))
  326                                         valid++;
  327                                 KEY_SA_UNREF(&sav);
  328                         }
  329 
  330                         /* XXX Further validation? */
  331 
  332                         /*
  333                          * Depending on the value of "valid" and routing table
  334                          * size (mtudisc_{hi,lo}wat), we will:
  335                          * - recalcurate the new MTU and create the
  336                          *   corresponding routing entry, or
  337                          * - ignore the MTU change notification.
  338                          */
  339                         icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
  340                 }
  341         } else {
  342                 /* we normally notify any pcb here */
  343         }
  344         return NULL;
  345 }
  346 #endif /* INET6 */
  347 
  348 static int
  349 sysctl_ipsec(SYSCTLFN_ARGS)
  350 {
  351         int error, t;
  352         struct sysctlnode node;
  353 
  354         node = *rnode;
  355         t = *(int *)rnode->sysctl_data;
  356         node.sysctl_data = &t;
  357         error = sysctl_lookup(SYSCTLFN_CALL(&node));
  358         if (error || newp == NULL)
  359                 return error;
  360 
  361         switch (rnode->sysctl_num) {
  362         case IPSECCTL_DEF_ESP_TRANSLEV:
  363         case IPSECCTL_DEF_ESP_NETLEV:
  364         case IPSECCTL_DEF_AH_TRANSLEV:
  365         case IPSECCTL_DEF_AH_NETLEV:
  366                 if (t != IPSEC_LEVEL_USE &&
  367                     t != IPSEC_LEVEL_REQUIRE)
  368                         return EINVAL;
  369                 ipsec_invalpcbcacheall();
  370                 break;
  371         case IPSECCTL_DEF_POLICY:
  372                 if (t != IPSEC_POLICY_DISCARD &&
  373                     t != IPSEC_POLICY_NONE)
  374                         return EINVAL;
  375                 ipsec_invalpcbcacheall();
  376                 break;
  377         default:
  378                 return EINVAL;
  379         }
  380 
  381         *(int *)rnode->sysctl_data = t;
  382 
  383         return 0;
  384 }
  385 
  386 #ifdef IPSEC_DEBUG
  387 static int
  388 sysctl_ipsec_test(SYSCTLFN_ARGS)
  389 {
  390         int t, error;
  391         struct sysctlnode node;
  392 
  393         node = *rnode;
  394         t = *(int *)rnode->sysctl_data;
  395         node.sysctl_data = &t;
  396         error = sysctl_lookup(SYSCTLFN_CALL(&node));
  397         if (error || newp == NULL)
  398                 return error;
  399 
  400         if (t < 0 || t > 1)
  401                 return EINVAL;
  402 
  403         if (rnode->sysctl_data == &ipsec_replay)
  404                 printf("ipsec: Anti-Replay service %s\n",
  405                     (t == 1) ? "deactivated" : "activated");
  406         else if (rnode->sysctl_data == &ipsec_integrity)
  407                  printf("ipsec: HMAC corruption %s\n",
  408                      (t == 0) ? "deactivated" : "activated");
  409 
  410         *(int *)rnode->sysctl_data = t;
  411 
  412         return 0;
  413 }
  414 #endif
  415 
  416 static int
  417 sysctl_net_inet_ipsec_stats(SYSCTLFN_ARGS)
  418 {
  419 
  420         return (NETSTAT_SYSCTL(ipsecstat_percpu, IPSEC_NSTATS));
  421 }
  422 
  423 static int
  424 sysctl_net_inet_ah_stats(SYSCTLFN_ARGS)
  425 {
  426 
  427         return (NETSTAT_SYSCTL(ahstat_percpu, AH_NSTATS));
  428 }
  429 
  430 static int
  431 sysctl_net_inet_esp_stats(SYSCTLFN_ARGS)
  432 {
  433 
  434         return (NETSTAT_SYSCTL(espstat_percpu, ESP_NSTATS));
  435 }
  436 
  437 static int
  438 sysctl_net_inet_ipcomp_stats(SYSCTLFN_ARGS)
  439 {
  440 
  441         return (NETSTAT_SYSCTL(ipcompstat_percpu, IPCOMP_NSTATS));
  442 }
  443 
  444 static int
  445 sysctl_net_inet_ipip_stats(SYSCTLFN_ARGS)
  446 {
  447 
  448         return (NETSTAT_SYSCTL(ipipstat_percpu, IPIP_NSTATS));
  449 }
  450 
  451 static int
  452 sysctl_net_ipsec_enabled(SYSCTLFN_ARGS)
  453 {
  454         int newenabled, error;
  455         struct sysctlnode node;
  456         node = *rnode;
  457         node.sysctl_data = &newenabled;
  458 
  459         newenabled = ipsec_enabled;
  460         error = sysctl_lookup(SYSCTLFN_CALL(&node));
  461         if (error || newp == NULL)
  462                 return error;
  463 
  464         switch (newenabled) {
  465         case 0:
  466                 if (key_get_used())
  467                         return EBUSY;
  468                 /*FALLTHROUGH*/
  469         case 1:
  470         case 2:
  471                 ipsec_enabled = newenabled;
  472                 key_update_used();
  473                 return 0;
  474         default:
  475                 return EINVAL;
  476         }
  477 }
  478 
  479 /* XXX will need a different oid at parent */
  480 void
  481 sysctl_net_inet_ipsec_setup(struct sysctllog **clog)
  482 {
  483         const struct sysctlnode *_ipsec;
  484         int ipproto_ipsec;
  485 
  486         sysctl_createv(clog, 0, NULL, NULL,
  487                        CTLFLAG_PERMANENT,
  488                        CTLTYPE_NODE, "inet", NULL,
  489                        NULL, 0, NULL, 0,
  490                        CTL_NET, PF_INET, CTL_EOL);
  491 
  492         /*
  493          * in numerical order:
  494          *
  495          * net.inet.ipip:       CTL_NET.PF_INET.IPPROTO_IPIP
  496          * net.inet.esp:        CTL_NET.PF_INET.IPPROTO_ESP
  497          * net.inet.ah:         CTL_NET.PF_INET.IPPROTO_AH
  498          * net.inet.ipcomp:     CTL_NET.PF_INET.IPPROTO_IPCOMP
  499          * net.inet.ipsec:      CTL_NET.PF_INET.CTL_CREATE
  500          *
  501          * this creates separate trees by name, but maintains that the
  502          * ipsec name leads to all the old leaves.
  503          */
  504 
  505         /* create net.inet.ipip */
  506         sysctl_createv(clog, 0, NULL, NULL,
  507                        CTLFLAG_PERMANENT,
  508                        CTLTYPE_NODE, "ipip", NULL,
  509                        NULL, 0, NULL, 0,
  510                        CTL_NET, PF_INET, IPPROTO_IPIP, CTL_EOL);
  511         sysctl_createv(clog, 0, NULL, NULL,
  512                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  513                        CTLTYPE_STRUCT, "ipip_stats", NULL,
  514                        sysctl_net_inet_ipip_stats, 0, NULL, 0,
  515                        CTL_NET, PF_INET, IPPROTO_IPIP,
  516                        CTL_CREATE, CTL_EOL);
  517 
  518         /* create net.inet.esp subtree under IPPROTO_ESP */
  519         sysctl_createv(clog, 0, NULL, NULL,
  520                        CTLFLAG_PERMANENT,
  521                        CTLTYPE_NODE, "esp", NULL,
  522                        NULL, 0, NULL, 0,
  523                        CTL_NET, PF_INET, IPPROTO_ESP, CTL_EOL);
  524         sysctl_createv(clog, 0, NULL, NULL,
  525                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  526                        CTLTYPE_STRUCT, "esp_stats", NULL,
  527                        sysctl_net_inet_esp_stats, 0, NULL, 0,
  528                        CTL_NET, PF_INET, IPPROTO_ESP,
  529                        CTL_CREATE, CTL_EOL);
  530 
  531         /* create net.inet.ah subtree under IPPROTO_AH */
  532         sysctl_createv(clog, 0, NULL, NULL,
  533                        CTLFLAG_PERMANENT,
  534                        CTLTYPE_NODE, "ah", NULL,
  535                        NULL, 0, NULL, 0,
  536                        CTL_NET, PF_INET, IPPROTO_AH, CTL_EOL);
  537         sysctl_createv(clog, 0, NULL, NULL,
  538                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  539                        CTLTYPE_STRUCT, "ah_stats", NULL,
  540                        sysctl_net_inet_ah_stats, 0, NULL, 0,
  541                        CTL_NET, PF_INET, IPPROTO_AH,
  542                        CTL_CREATE, CTL_EOL);
  543 
  544         /* create net.inet.ipcomp */
  545         sysctl_createv(clog, 0, NULL, NULL,
  546                        CTLFLAG_PERMANENT,
  547                        CTLTYPE_NODE, "ipcomp", NULL,
  548                        NULL, 0, NULL, 0,
  549                        CTL_NET, PF_INET, IPPROTO_IPCOMP, CTL_EOL);
  550         sysctl_createv(clog, 0, NULL, NULL,
  551                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  552                        CTLTYPE_STRUCT, "ipcomp_stats", NULL,
  553                        sysctl_net_inet_ipcomp_stats, 0, NULL, 0,
  554                        CTL_NET, PF_INET, IPPROTO_IPCOMP,
  555                        CTL_CREATE, CTL_EOL);
  556 
  557         /* create net.inet.ipsec subtree under dynamic oid */
  558         sysctl_createv(clog, 0, NULL, &_ipsec,
  559                        CTLFLAG_PERMANENT,
  560                        CTLTYPE_NODE, "ipsec", NULL,
  561                        NULL, 0, NULL, 0,
  562                        CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
  563         ipproto_ipsec = (_ipsec != NULL) ? _ipsec->sysctl_num : 0;
  564 
  565         sysctl_createv(clog, 0, NULL, NULL,
  566                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  567                        CTLTYPE_INT, "def_policy", NULL,
  568                        sysctl_ipsec, 0, &ip4_def_policy.policy, 0,
  569                        CTL_NET, PF_INET, ipproto_ipsec,
  570                        IPSECCTL_DEF_POLICY, CTL_EOL);
  571         sysctl_createv(clog, 0, NULL, NULL,
  572                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  573                        CTLTYPE_INT, "esp_trans_deflev", NULL,
  574                        sysctl_ipsec, 0, &ip4_esp_trans_deflev, 0,
  575                        CTL_NET, PF_INET, ipproto_ipsec,
  576                        IPSECCTL_DEF_ESP_TRANSLEV, CTL_EOL);
  577         sysctl_createv(clog, 0, NULL, NULL,
  578                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  579                        CTLTYPE_INT, "esp_net_deflev", NULL,
  580                        sysctl_ipsec, 0, &ip4_esp_net_deflev, 0,
  581                        CTL_NET, PF_INET, ipproto_ipsec,
  582                        IPSECCTL_DEF_ESP_NETLEV, CTL_EOL);
  583         sysctl_createv(clog, 0, NULL, NULL,
  584                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  585                        CTLTYPE_INT, "ah_trans_deflev", NULL,
  586                        sysctl_ipsec, 0, &ip4_ah_trans_deflev, 0,
  587                        CTL_NET, PF_INET, ipproto_ipsec,
  588                        IPSECCTL_DEF_AH_TRANSLEV, CTL_EOL);
  589         sysctl_createv(clog, 0, NULL, NULL,
  590                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  591                        CTLTYPE_INT, "ah_net_deflev", NULL,
  592                        sysctl_ipsec, 0, &ip4_ah_net_deflev, 0,
  593                        CTL_NET, PF_INET, ipproto_ipsec,
  594                        IPSECCTL_DEF_AH_NETLEV, CTL_EOL);
  595         sysctl_createv(clog, 0, NULL, NULL,
  596                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  597                        CTLTYPE_INT, "ah_cleartos", NULL,
  598                        NULL, 0, &ip4_ah_cleartos, 0,
  599                        CTL_NET, PF_INET, ipproto_ipsec,
  600                        IPSECCTL_AH_CLEARTOS, CTL_EOL);
  601         sysctl_createv(clog, 0, NULL, NULL,
  602                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  603                        CTLTYPE_INT, "ah_offsetmask", NULL,
  604                        NULL, 0, &ip4_ah_offsetmask, 0,
  605                        CTL_NET, PF_INET, ipproto_ipsec,
  606                        IPSECCTL_AH_OFFSETMASK, CTL_EOL);
  607         sysctl_createv(clog, 0, NULL, NULL,
  608                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  609                        CTLTYPE_INT, "dfbit", NULL,
  610                        NULL, 0, &ip4_ipsec_dfbit, 0,
  611                        CTL_NET, PF_INET, ipproto_ipsec,
  612                        IPSECCTL_DFBIT, CTL_EOL);
  613         sysctl_createv(clog, 0, NULL, NULL,
  614                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  615                        CTLTYPE_INT, "ecn", NULL,
  616                        NULL, 0, &ip4_ipsec_ecn, 0,
  617                        CTL_NET, PF_INET, ipproto_ipsec,
  618                        IPSECCTL_ECN, CTL_EOL);
  619         sysctl_createv(clog, 0, NULL, NULL,
  620                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  621                        CTLTYPE_INT, "debug", NULL,
  622                        NULL, 0, &ipsec_debug, 0,
  623                        CTL_NET, PF_INET, ipproto_ipsec,
  624                        IPSECCTL_DEBUG, CTL_EOL);
  625         sysctl_createv(clog, 0, NULL, NULL,
  626                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  627                        CTLTYPE_INT, "ipip_spoofcheck", NULL,
  628                        NULL, 0, &ipip_spoofcheck, 0,
  629                        CTL_NET, PF_INET, ipproto_ipsec,
  630                        CTL_CREATE, CTL_EOL);
  631         sysctl_createv(clog, 0, NULL, NULL,
  632                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  633                        CTLTYPE_STRUCT, "ipsecstats", NULL,
  634                        sysctl_net_inet_ipsec_stats, 0, NULL, 0,
  635                        CTL_NET, PF_INET, ipproto_ipsec,
  636                        CTL_CREATE, CTL_EOL);
  637         sysctl_createv(clog, 0, NULL, NULL,
  638                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  639                        CTLTYPE_INT, "enabled",
  640                        SYSCTL_DESCR("Enable IPSec processing"),
  641                        sysctl_net_ipsec_enabled, 0, NULL, 0,
  642                        CTL_NET, PF_INET, ipproto_ipsec,
  643                        CTL_CREATE, CTL_EOL);
  644         sysctl_createv(clog, 0, NULL, NULL,
  645                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  646                        CTLTYPE_INT, "used",
  647                        SYSCTL_DESCR("Is IPSec active?"),
  648                        NULL, 0, &ipsec_used, 0,
  649                        CTL_NET, PF_INET, ipproto_ipsec,
  650                        CTL_CREATE, CTL_EOL);
  651         sysctl_createv(clog, 0, NULL, NULL,
  652                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  653                        CTLTYPE_INT, "ah_enable", NULL,
  654                        NULL, 0, &ah_enable, 0,
  655                        CTL_NET, PF_INET, ipproto_ipsec,
  656                        CTL_CREATE, CTL_EOL);
  657         sysctl_createv(clog, 0, NULL, NULL,
  658                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  659                        CTLTYPE_INT, "esp_enable", NULL,
  660                        NULL, 0, &esp_enable, 0,
  661                        CTL_NET, PF_INET, ipproto_ipsec,
  662                        CTL_CREATE, CTL_EOL);
  663         sysctl_createv(clog, 0, NULL, NULL,
  664                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  665                        CTLTYPE_INT, "ipcomp_enable", NULL,
  666                        NULL, 0, &ipcomp_enable, 0,
  667                        CTL_NET, PF_INET, ipproto_ipsec,
  668                        CTL_CREATE, CTL_EOL);
  669         sysctl_createv(clog, 0, NULL, NULL,
  670                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  671                        CTLTYPE_INT, "crypto_support", NULL,
  672                        NULL, 0, &crypto_support, 0,
  673                        CTL_NET, PF_INET, ipproto_ipsec,
  674                        CTL_CREATE, CTL_EOL);
  675 
  676 #ifdef IPSEC_DEBUG
  677         sysctl_createv(clog, 0, NULL, NULL,
  678                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  679                        CTLTYPE_INT, "test_replay",
  680                        SYSCTL_DESCR("Emulate replay attack"),
  681                        sysctl_ipsec_test, 0, &ipsec_replay, 0,
  682                        CTL_NET, PF_INET, ipproto_ipsec,
  683                        CTL_CREATE, CTL_EOL);
  684         sysctl_createv(clog, 0, NULL, NULL,
  685                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  686                        CTLTYPE_INT, "test_integrity",
  687                        SYSCTL_DESCR("Emulate man-in-the-middle attack"),
  688                        sysctl_ipsec_test, 0, &ipsec_integrity, 0,
  689                        CTL_NET, PF_INET, ipproto_ipsec,
  690                        CTL_CREATE, CTL_EOL);
  691 #endif
  692 }
  693 
  694 #ifdef INET6
  695 void
  696 sysctl_net_inet6_ipsec6_setup(struct sysctllog **clog)
  697 {
  698 
  699         sysctl_createv(clog, 0, NULL, NULL,
  700                        CTLFLAG_PERMANENT,
  701                        CTLTYPE_NODE, "inet6", NULL,
  702                        NULL, 0, NULL, 0,
  703                        CTL_NET, PF_INET6, CTL_EOL);
  704         sysctl_createv(clog, 0, NULL, NULL,
  705                        CTLFLAG_PERMANENT,
  706                        CTLTYPE_NODE, "ipsec6",
  707                        SYSCTL_DESCR("IPv6 related IPSec settings"),
  708                        NULL, 0, NULL, 0,
  709                        CTL_NET, PF_INET6, IPPROTO_AH, CTL_EOL);
  710 
  711         sysctl_createv(clog, 0, NULL, NULL,
  712                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  713                        CTLTYPE_STRUCT, "stats",
  714                        SYSCTL_DESCR("IPSec statistics and counters"),
  715                        sysctl_net_inet_ipsec_stats, 0, NULL, 0,
  716                        CTL_NET, PF_INET6, IPPROTO_AH,
  717                        IPSECCTL_STATS, CTL_EOL);
  718         sysctl_createv(clog, 0, NULL, NULL,
  719                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  720                        CTLTYPE_INT, "def_policy",
  721                        SYSCTL_DESCR("Default action for non-IPSec packets"),
  722                        sysctl_ipsec, 0, &ip6_def_policy.policy, 0,
  723                        CTL_NET, PF_INET6, IPPROTO_AH,
  724                        IPSECCTL_DEF_POLICY, CTL_EOL);
  725         sysctl_createv(clog, 0, NULL, NULL,
  726                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  727                        CTLTYPE_INT, "esp_trans_deflev",
  728                        SYSCTL_DESCR("Default required security level for "
  729                                     "transport mode traffic"),
  730                        sysctl_ipsec, 0, &ip6_esp_trans_deflev, 0,
  731                        CTL_NET, PF_INET6, IPPROTO_AH,
  732                        IPSECCTL_DEF_ESP_TRANSLEV, CTL_EOL);
  733         sysctl_createv(clog, 0, NULL, NULL,
  734                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  735                        CTLTYPE_INT, "esp_net_deflev",
  736                        SYSCTL_DESCR("Default required security level for "
  737                                     "tunneled traffic"),
  738                        sysctl_ipsec, 0, &ip6_esp_net_deflev, 0,
  739                        CTL_NET, PF_INET6, IPPROTO_AH,
  740                        IPSECCTL_DEF_ESP_NETLEV, CTL_EOL);
  741         sysctl_createv(clog, 0, NULL, NULL,
  742                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  743                        CTLTYPE_INT, "ah_trans_deflev",
  744                        SYSCTL_DESCR("Default required security level for "
  745                                     "transport mode headers"),
  746                        sysctl_ipsec, 0, &ip6_ah_trans_deflev, 0,
  747                        CTL_NET, PF_INET6, IPPROTO_AH,
  748                        IPSECCTL_DEF_AH_TRANSLEV, CTL_EOL);
  749         sysctl_createv(clog, 0, NULL, NULL,
  750                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  751                        CTLTYPE_INT, "ah_net_deflev",
  752                        SYSCTL_DESCR("Default required security level for "
  753                                     "tunneled headers"),
  754                        sysctl_ipsec, 0, &ip6_ah_net_deflev, 0,
  755                        CTL_NET, PF_INET6, IPPROTO_AH,
  756                        IPSECCTL_DEF_AH_NETLEV, CTL_EOL);
  757         sysctl_createv(clog, 0, NULL, NULL,
  758                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  759                        CTLTYPE_INT, "ecn",
  760                        SYSCTL_DESCR("Behavior of ECN for tunneled traffic"),
  761                        NULL, 0, &ip6_ipsec_ecn, 0,
  762                        CTL_NET, PF_INET6, IPPROTO_AH,
  763                        IPSECCTL_ECN, CTL_EOL);
  764         sysctl_createv(clog, 0, NULL, NULL,
  765                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  766                        CTLTYPE_INT, "debug",
  767                        SYSCTL_DESCR("Enable IPSec debugging output"),
  768                        NULL, 0, &ipsec_debug, 0,
  769                        CTL_NET, PF_INET6, IPPROTO_AH,
  770                        IPSECCTL_DEBUG, CTL_EOL);
  771         sysctl_createv(clog, 0, NULL, NULL,
  772                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
  773                        CTLTYPE_INT, "enabled",
  774                        SYSCTL_DESCR("Enable IPSec processing"),
  775                        sysctl_net_ipsec_enabled, 0, NULL, 0,
  776                        CTL_NET, PF_INET6, IPPROTO_AH,
  777                        CTL_CREATE, CTL_EOL);
  778         sysctl_createv(clog, 0, NULL, NULL,
  779                        CTLFLAG_PERMANENT|CTLFLAG_READONLY,
  780                        CTLTYPE_INT, "used",
  781                        SYSCTL_DESCR("Is IPSec active?"),
  782                        NULL, 0, &ipsec_used, 0,
  783                        CTL_NET, PF_INET6, IPPROTO_AH,
  784                        CTL_CREATE, CTL_EOL);
  785 }
  786 #endif /* INET6 */
Cache object: d2ad8be21d98cab66f2c96434a242308
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netipsec/ipsec_netbsd.c

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/ipsec_netbsd.c
