Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/xform_ipip.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD: releng/10.1/sys/netipsec/xform_ipip.c 264814 2014-04-23 11:22:54Z ae $ */ 2 /* $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * The original version of this code was written by John Ioannidis 9 * for BSD/OS in Athens, Greece, in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IP-inside-IP processing 41 */ 42 #include "opt_inet.h" 43 #include "opt_inet6.h" 44 #include "opt_enc.h" 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 #include <sys/mbuf.h> 49 #include <sys/socket.h> 50 #include <sys/kernel.h> 51 #include <sys/protosw.h> 52 #include <sys/sysctl.h> 53 54 #include <net/if.h> 55 #include <net/pfil.h> 56 #include <net/route.h> 57 #include <net/netisr.h> 58 #include <net/vnet.h> 59 60 #include <netinet/in.h> 61 #include <netinet/in_systm.h> 62 #include <netinet/in_var.h> 63 #include <netinet/ip.h> 64 #include <netinet/ip_ecn.h> 65 #include <netinet/ip_var.h> 66 #include <netinet/ip_encap.h> 67 68 #include <netipsec/ipsec.h> 69 #include <netipsec/xform.h> 70 71 #include <netipsec/ipip_var.h> 72 73 #ifdef INET6 74 #include <netinet/ip6.h> 75 #include <netipsec/ipsec6.h> 76 #include <netinet6/ip6_ecn.h> 77 #include <netinet6/in6_var.h> 78 #include <netinet6/ip6protosw.h> 79 #endif 80 81 #include <netipsec/key.h> 82 #include <netipsec/key_debug.h> 83 84 #include <machine/stdarg.h> 85 86 /* 87 * We can control the acceptance of IP4 packets by altering the sysctl 88 * net.inet.ipip.allow value. Zero means drop them, all else is acceptance. 89 */ 90 VNET_DEFINE(int, ipip_allow) = 0; 91 VNET_PCPUSTAT_DEFINE(struct ipipstat, ipipstat); 92 VNET_PCPUSTAT_SYSINIT(ipipstat); 93 94 #ifdef VIMAGE 95 VNET_PCPUSTAT_SYSUNINIT(ipipstat); 96 #endif /* VIMAGE */ 97 98 SYSCTL_DECL(_net_inet_ipip); 99 SYSCTL_VNET_INT(_net_inet_ipip, OID_AUTO, 100 ipip_allow, CTLFLAG_RW, &VNET_NAME(ipip_allow), 0, ""); 101 SYSCTL_VNET_PCPUSTAT(_net_inet_ipip, IPSECCTL_STATS, stats, 102 struct ipipstat, ipipstat, 103 "IPIP statistics (struct ipipstat, netipsec/ipip_var.h)"); 104 105 /* XXX IPCOMP */ 106 #define M_IPSEC (M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED) 107 108 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp); 109 110 #ifdef INET6 111 /* 112 * Really only a wrapper for ipip_input(), for use with IPv6. 113 */ 114 int 115 ip4_input6(struct mbuf **m, int *offp, int proto) 116 { 117 #if 0 118 /* If we do not accept IP-in-IP explicitly, drop. */ 119 if (!V_ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) { 120 DPRINTF(("%s: dropped due to policy\n", __func__)); 121 IPIPSTAT_INC(ipips_pdrops); 122 m_freem(*m); 123 return IPPROTO_DONE; 124 } 125 #endif 126 _ipip_input(*m, *offp, NULL); 127 return IPPROTO_DONE; 128 } 129 #endif /* INET6 */ 130 131 #ifdef INET 132 /* 133 * Really only a wrapper for ipip_input(), for use with IPv4. 134 */ 135 void 136 ip4_input(struct mbuf *m, int off) 137 { 138 #if 0 139 /* If we do not accept IP-in-IP explicitly, drop. */ 140 if (!V_ipip_allow && (m->m_flags & M_IPSEC) == 0) { 141 DPRINTF(("%s: dropped due to policy\n", __func__)); 142 IPIPSTAT_INC(ipips_pdrops); 143 m_freem(m); 144 return; 145 } 146 #endif 147 _ipip_input(m, off, NULL); 148 } 149 #endif /* INET */ 150 151 /* 152 * ipip_input gets called when we receive an IP{46} encapsulated packet, 153 * either because we got it at a real interface, or because AH or ESP 154 * were being used in tunnel mode (in which case the rcvif element will 155 * contain the address of the encX interface associated with the tunnel. 156 */ 157 158 static void 159 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp) 160 { 161 struct ip *ipo; 162 #ifdef INET6 163 struct ip6_hdr *ip6 = NULL; 164 u_int8_t itos; 165 #endif 166 int isr; 167 u_int8_t otos; 168 u_int8_t v; 169 int hlen; 170 171 IPIPSTAT_INC(ipips_ipackets); 172 173 m_copydata(m, 0, 1, &v); 174 175 switch (v >> 4) { 176 #ifdef INET 177 case 4: 178 hlen = sizeof(struct ip); 179 break; 180 #endif /* INET */ 181 #ifdef INET6 182 case 6: 183 hlen = sizeof(struct ip6_hdr); 184 break; 185 #endif 186 default: 187 IPIPSTAT_INC(ipips_family); 188 m_freem(m); 189 return /* EAFNOSUPPORT */; 190 } 191 192 /* Bring the IP header in the first mbuf, if not there already */ 193 if (m->m_len < hlen) { 194 if ((m = m_pullup(m, hlen)) == NULL) { 195 DPRINTF(("%s: m_pullup (1) failed\n", __func__)); 196 IPIPSTAT_INC(ipips_hdrops); 197 return; 198 } 199 } 200 ipo = mtod(m, struct ip *); 201 202 /* Keep outer ecn field. */ 203 switch (v >> 4) { 204 #ifdef INET 205 case 4: 206 otos = ipo->ip_tos; 207 break; 208 #endif /* INET */ 209 #ifdef INET6 210 case 6: 211 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff; 212 break; 213 #endif 214 default: 215 panic("ipip_input: unknown ip version %u (outer)", v>>4); 216 } 217 218 /* Remove outer IP header */ 219 m_adj(m, iphlen); 220 221 /* Sanity check */ 222 if (m->m_pkthdr.len < sizeof(struct ip)) { 223 IPIPSTAT_INC(ipips_hdrops); 224 m_freem(m); 225 return; 226 } 227 228 m_copydata(m, 0, 1, &v); 229 230 switch (v >> 4) { 231 #ifdef INET 232 case 4: 233 hlen = sizeof(struct ip); 234 break; 235 #endif /* INET */ 236 237 #ifdef INET6 238 case 6: 239 hlen = sizeof(struct ip6_hdr); 240 break; 241 #endif 242 default: 243 IPIPSTAT_INC(ipips_family); 244 m_freem(m); 245 return; /* EAFNOSUPPORT */ 246 } 247 248 /* 249 * Bring the inner IP header in the first mbuf, if not there already. 250 */ 251 if (m->m_len < hlen) { 252 if ((m = m_pullup(m, hlen)) == NULL) { 253 DPRINTF(("%s: m_pullup (2) failed\n", __func__)); 254 IPIPSTAT_INC(ipips_hdrops); 255 return; 256 } 257 } 258 259 /* 260 * RFC 1853 specifies that the inner TTL should not be touched on 261 * decapsulation. There's no reason this comment should be here, but 262 * this is as good as any a position. 263 */ 264 265 /* Some sanity checks in the inner IP header */ 266 switch (v >> 4) { 267 #ifdef INET 268 case 4: 269 ipo = mtod(m, struct ip *); 270 ip_ecn_egress(V_ip4_ipsec_ecn, &otos, &ipo->ip_tos); 271 break; 272 #endif /* INET */ 273 #ifdef INET6 274 case 6: 275 ip6 = (struct ip6_hdr *) ipo; 276 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 277 ip_ecn_egress(V_ip6_ipsec_ecn, &otos, &itos); 278 ip6->ip6_flow &= ~htonl(0xff << 20); 279 ip6->ip6_flow |= htonl((u_int32_t) itos << 20); 280 break; 281 #endif 282 default: 283 panic("ipip_input: unknown ip version %u (inner)", v>>4); 284 } 285 286 /* Check for local address spoofing. */ 287 if ((m->m_pkthdr.rcvif == NULL || 288 !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) && 289 V_ipip_allow != 2) { 290 #ifdef INET 291 if ((v >> 4) == IPVERSION && 292 in_localip(ipo->ip_src) != 0) { 293 IPIPSTAT_INC(ipips_spoof); 294 m_freem(m); 295 return; 296 } 297 #endif 298 #ifdef INET6 299 if ((v & IPV6_VERSION_MASK) == IPV6_VERSION && 300 in6_localip(&ip6->ip6_src) != 0) { 301 IPIPSTAT_INC(ipips_spoof); 302 m_freem(m); 303 return; 304 } 305 #endif 306 } 307 308 /* Statistics */ 309 IPIPSTAT_ADD(ipips_ibytes, m->m_pkthdr.len - iphlen); 310 311 #ifdef DEV_ENC 312 switch (v >> 4) { 313 #ifdef INET 314 case 4: 315 ipsec_bpf(m, NULL, AF_INET, ENC_IN|ENC_AFTER); 316 break; 317 #endif 318 #ifdef INET6 319 case 6: 320 ipsec_bpf(m, NULL, AF_INET6, ENC_IN|ENC_AFTER); 321 break; 322 #endif 323 default: 324 panic("%s: bogus ip version %u", __func__, v>>4); 325 } 326 /* pass the mbuf to enc0 for packet filtering */ 327 if (ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER) != 0) 328 return; 329 #endif 330 331 /* 332 * Interface pointer stays the same; if no IPsec processing has 333 * been done (or will be done), this will point to a normal 334 * interface. Otherwise, it'll point to an enc interface, which 335 * will allow a packet filter to distinguish between secure and 336 * untrusted packets. 337 */ 338 339 switch (v >> 4) { 340 #ifdef INET 341 case 4: 342 isr = NETISR_IP; 343 break; 344 #endif 345 #ifdef INET6 346 case 6: 347 isr = NETISR_IPV6; 348 break; 349 #endif 350 default: 351 panic("%s: bogus ip version %u", __func__, v>>4); 352 } 353 354 if (netisr_queue(isr, m)) { /* (0) on success. */ 355 IPIPSTAT_INC(ipips_qfull); 356 DPRINTF(("%s: packet dropped because of full queue\n", 357 __func__)); 358 } 359 } 360 361 int 362 ipip_output( 363 struct mbuf *m, 364 struct ipsecrequest *isr, 365 struct mbuf **mp, 366 int skip, 367 int protoff 368 ) 369 { 370 struct secasvar *sav; 371 u_int8_t tp, otos; 372 struct secasindex *saidx; 373 int error; 374 #if defined(INET) || defined(INET6) 375 u_int8_t itos; 376 #endif 377 #ifdef INET 378 struct ip *ipo; 379 #endif /* INET */ 380 #ifdef INET6 381 struct ip6_hdr *ip6, *ip6o; 382 #endif /* INET6 */ 383 384 sav = isr->sav; 385 IPSEC_ASSERT(sav != NULL, ("null SA")); 386 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 387 388 /* XXX Deal with empty TDB source/destination addresses. */ 389 390 m_copydata(m, 0, 1, &tp); 391 tp = (tp >> 4) & 0xff; /* Get the IP version number. */ 392 393 saidx = &sav->sah->saidx; 394 switch (saidx->dst.sa.sa_family) { 395 #ifdef INET 396 case AF_INET: 397 if (saidx->src.sa.sa_family != AF_INET || 398 saidx->src.sin.sin_addr.s_addr == INADDR_ANY || 399 saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) { 400 DPRINTF(("%s: unspecified tunnel endpoint " 401 "address in SA %s/%08lx\n", __func__, 402 ipsec_address(&saidx->dst), 403 (u_long) ntohl(sav->spi))); 404 IPIPSTAT_INC(ipips_unspec); 405 error = EINVAL; 406 goto bad; 407 } 408 409 M_PREPEND(m, sizeof(struct ip), M_NOWAIT); 410 if (m == 0) { 411 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 412 IPIPSTAT_INC(ipips_hdrops); 413 error = ENOBUFS; 414 goto bad; 415 } 416 417 ipo = mtod(m, struct ip *); 418 419 ipo->ip_v = IPVERSION; 420 ipo->ip_hl = 5; 421 ipo->ip_len = htons(m->m_pkthdr.len); 422 ipo->ip_ttl = V_ip_defttl; 423 ipo->ip_sum = 0; 424 ipo->ip_src = saidx->src.sin.sin_addr; 425 ipo->ip_dst = saidx->dst.sin.sin_addr; 426 427 ipo->ip_id = ip_newid(); 428 429 /* If the inner protocol is IP... */ 430 switch (tp) { 431 case IPVERSION: 432 /* Save ECN notification */ 433 m_copydata(m, sizeof(struct ip) + 434 offsetof(struct ip, ip_tos), 435 sizeof(u_int8_t), (caddr_t) &itos); 436 437 ipo->ip_p = IPPROTO_IPIP; 438 439 /* 440 * We should be keeping tunnel soft-state and 441 * send back ICMPs if needed. 442 */ 443 m_copydata(m, sizeof(struct ip) + 444 offsetof(struct ip, ip_off), 445 sizeof(u_int16_t), (caddr_t) &ipo->ip_off); 446 ipo->ip_off = ntohs(ipo->ip_off); 447 ipo->ip_off &= ~(IP_DF | IP_MF | IP_OFFMASK); 448 ipo->ip_off = htons(ipo->ip_off); 449 break; 450 #ifdef INET6 451 case (IPV6_VERSION >> 4): 452 { 453 u_int32_t itos32; 454 455 /* Save ECN notification. */ 456 m_copydata(m, sizeof(struct ip) + 457 offsetof(struct ip6_hdr, ip6_flow), 458 sizeof(u_int32_t), (caddr_t) &itos32); 459 itos = ntohl(itos32) >> 20; 460 ipo->ip_p = IPPROTO_IPV6; 461 ipo->ip_off = 0; 462 break; 463 } 464 #endif /* INET6 */ 465 default: 466 goto nofamily; 467 } 468 469 otos = 0; 470 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 471 ipo->ip_tos = otos; 472 break; 473 #endif /* INET */ 474 475 #ifdef INET6 476 case AF_INET6: 477 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) || 478 saidx->src.sa.sa_family != AF_INET6 || 479 IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) { 480 DPRINTF(("%s: unspecified tunnel endpoint " 481 "address in SA %s/%08lx\n", __func__, 482 ipsec_address(&saidx->dst), 483 (u_long) ntohl(sav->spi))); 484 IPIPSTAT_INC(ipips_unspec); 485 error = ENOBUFS; 486 goto bad; 487 } 488 489 /* scoped address handling */ 490 ip6 = mtod(m, struct ip6_hdr *); 491 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 492 ip6->ip6_src.s6_addr16[1] = 0; 493 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 494 ip6->ip6_dst.s6_addr16[1] = 0; 495 496 M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT); 497 if (m == 0) { 498 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 499 IPIPSTAT_INC(ipips_hdrops); 500 error = ENOBUFS; 501 goto bad; 502 } 503 504 /* Initialize IPv6 header */ 505 ip6o = mtod(m, struct ip6_hdr *); 506 ip6o->ip6_flow = 0; 507 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK; 508 ip6o->ip6_vfc |= IPV6_VERSION; 509 ip6o->ip6_plen = htons(m->m_pkthdr.len); 510 ip6o->ip6_hlim = V_ip_defttl; 511 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr; 512 ip6o->ip6_src = saidx->src.sin6.sin6_addr; 513 514 switch (tp) { 515 #ifdef INET 516 case IPVERSION: 517 /* Save ECN notification */ 518 m_copydata(m, sizeof(struct ip6_hdr) + 519 offsetof(struct ip, ip_tos), sizeof(u_int8_t), 520 (caddr_t) &itos); 521 522 /* This is really IPVERSION. */ 523 ip6o->ip6_nxt = IPPROTO_IPIP; 524 break; 525 #endif /* INET */ 526 case (IPV6_VERSION >> 4): 527 { 528 u_int32_t itos32; 529 530 /* Save ECN notification. */ 531 m_copydata(m, sizeof(struct ip6_hdr) + 532 offsetof(struct ip6_hdr, ip6_flow), 533 sizeof(u_int32_t), (caddr_t) &itos32); 534 itos = ntohl(itos32) >> 20; 535 536 ip6o->ip6_nxt = IPPROTO_IPV6; 537 break; 538 } 539 default: 540 goto nofamily; 541 } 542 543 otos = 0; 544 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 545 ip6o->ip6_flow |= htonl((u_int32_t) otos << 20); 546 break; 547 #endif /* INET6 */ 548 549 default: 550 nofamily: 551 DPRINTF(("%s: unsupported protocol family %u\n", __func__, 552 saidx->dst.sa.sa_family)); 553 IPIPSTAT_INC(ipips_family); 554 error = EAFNOSUPPORT; /* XXX diffs from openbsd */ 555 goto bad; 556 } 557 558 IPIPSTAT_INC(ipips_opackets); 559 *mp = m; 560 561 #ifdef INET 562 if (saidx->dst.sa.sa_family == AF_INET) { 563 #if 0 564 if (sav->tdb_xform->xf_type == XF_IP4) 565 tdb->tdb_cur_bytes += 566 m->m_pkthdr.len - sizeof(struct ip); 567 #endif 568 IPIPSTAT_ADD(ipips_obytes, 569 m->m_pkthdr.len - sizeof(struct ip)); 570 } 571 #endif /* INET */ 572 573 #ifdef INET6 574 if (saidx->dst.sa.sa_family == AF_INET6) { 575 #if 0 576 if (sav->tdb_xform->xf_type == XF_IP4) 577 tdb->tdb_cur_bytes += 578 m->m_pkthdr.len - sizeof(struct ip6_hdr); 579 #endif 580 IPIPSTAT_ADD(ipips_obytes, 581 m->m_pkthdr.len - sizeof(struct ip6_hdr)); 582 } 583 #endif /* INET6 */ 584 585 return 0; 586 bad: 587 if (m) 588 m_freem(m); 589 *mp = NULL; 590 return (error); 591 } 592 593 #ifdef IPSEC 594 #if defined(INET) || defined(INET6) 595 static int 596 ipe4_init(struct secasvar *sav, struct xformsw *xsp) 597 { 598 sav->tdb_xform = xsp; 599 return 0; 600 } 601 602 static int 603 ipe4_zeroize(struct secasvar *sav) 604 { 605 sav->tdb_xform = NULL; 606 return 0; 607 } 608 609 static int 610 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 611 { 612 /* This is a rather serious mistake, so no conditional printing. */ 613 printf("%s: should never be called\n", __func__); 614 if (m) 615 m_freem(m); 616 return EOPNOTSUPP; 617 } 618 619 static struct xformsw ipe4_xformsw = { 620 XF_IP4, 0, "IPv4 Simple Encapsulation", 621 ipe4_init, ipe4_zeroize, ipe4_input, ipip_output, 622 }; 623 624 extern struct domain inetdomain; 625 #endif /* INET || INET6 */ 626 #ifdef INET 627 static struct protosw ipe4_protosw = { 628 .pr_type = SOCK_RAW, 629 .pr_domain = &inetdomain, 630 .pr_protocol = IPPROTO_IPV4, 631 .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR, 632 .pr_input = ip4_input, 633 .pr_ctloutput = rip_ctloutput, 634 .pr_usrreqs = &rip_usrreqs 635 }; 636 #endif /* INET */ 637 #if defined(INET6) && defined(INET) 638 static struct ip6protosw ipe6_protosw = { 639 .pr_type = SOCK_RAW, 640 .pr_domain = &inetdomain, 641 .pr_protocol = IPPROTO_IPV6, 642 .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR, 643 .pr_input = ip4_input6, 644 .pr_ctloutput = rip_ctloutput, 645 .pr_usrreqs = &rip_usrreqs 646 }; 647 #endif /* INET6 && INET */ 648 649 #ifdef INET 650 /* 651 * Check the encapsulated packet to see if we want it 652 */ 653 static int 654 ipe4_encapcheck(const struct mbuf *m, int off, int proto, void *arg) 655 { 656 /* 657 * Only take packets coming from IPSEC tunnels; the rest 658 * must be handled by the gif tunnel code. Note that we 659 * also return a minimum priority when we want the packet 660 * so any explicit gif tunnels take precedence. 661 */ 662 return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0); 663 } 664 #endif /* INET */ 665 666 static void 667 ipe4_attach(void) 668 { 669 670 xform_register(&ipe4_xformsw); 671 /* attach to encapsulation framework */ 672 /* XXX save return cookie for detach on module remove */ 673 #ifdef INET 674 (void) encap_attach_func(AF_INET, -1, 675 ipe4_encapcheck, &ipe4_protosw, NULL); 676 #endif 677 #if defined(INET6) && defined(INET) 678 (void) encap_attach_func(AF_INET6, -1, 679 ipe4_encapcheck, (struct protosw *)&ipe6_protosw, NULL); 680 #endif 681 } 682 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL); 683 #endif /* IPSEC */
Cache object: 1fe1511fc78b9e74699434548a402464
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]