Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netipsec/xform_ipip.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD$ */ 2 /* $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */ 3 /*- 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * The original version of this code was written by John Ioannidis 9 * for BSD/OS in Athens, Greece, in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Additional features in 1999 by Angelos D. Keromytis. 18 * 19 * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 20 * Angelos D. Keromytis and Niels Provos. 21 * Copyright (c) 2001, Angelos D. Keromytis. 22 * 23 * Permission to use, copy, and modify this software with or without fee 24 * is hereby granted, provided that this entire notice is included in 25 * all copies of any software which is or includes a copy or 26 * modification of this software. 27 * You may use this code under the GNU public license if you so wish. Please 28 * contribute changes back to the authors under this freer than GPL license 29 * so that we may further the use of strong encryption without limitations to 30 * all. 31 * 32 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 33 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 34 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 35 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 36 * PURPOSE. 37 */ 38 39 /* 40 * IP-inside-IP processing 41 */ 42 #include "opt_inet.h" 43 #include "opt_inet6.h" 44 #include "opt_enc.h" 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 #include <sys/mbuf.h> 49 #include <sys/socket.h> 50 #include <sys/kernel.h> 51 #include <sys/protosw.h> 52 #include <sys/sysctl.h> 53 54 #include <net/if.h> 55 #include <net/pfil.h> 56 #include <net/route.h> 57 #include <net/netisr.h> 58 #include <net/vnet.h> 59 60 #include <netinet/in.h> 61 #include <netinet/in_systm.h> 62 #include <netinet/in_var.h> 63 #include <netinet/ip.h> 64 #include <netinet/ip_ecn.h> 65 #include <netinet/ip_var.h> 66 #include <netinet/ip_encap.h> 67 68 #include <netipsec/ipsec.h> 69 #include <netipsec/xform.h> 70 71 #include <netipsec/ipip_var.h> 72 73 #ifdef INET6 74 #include <netinet/ip6.h> 75 #include <netipsec/ipsec6.h> 76 #include <netinet6/ip6_ecn.h> 77 #include <netinet6/in6_var.h> 78 #include <netinet6/ip6protosw.h> 79 #endif 80 81 #include <netipsec/key.h> 82 #include <netipsec/key_debug.h> 83 84 #include <machine/stdarg.h> 85 86 /* 87 * We can control the acceptance of IP4 packets by altering the sysctl 88 * net.inet.ipip.allow value. Zero means drop them, all else is acceptance. 89 */ 90 VNET_DEFINE(int, ipip_allow) = 0; 91 VNET_DEFINE(struct ipipstat, ipipstat); 92 93 SYSCTL_DECL(_net_inet_ipip); 94 SYSCTL_VNET_INT(_net_inet_ipip, OID_AUTO, 95 ipip_allow, CTLFLAG_RW, &VNET_NAME(ipip_allow), 0, ""); 96 SYSCTL_VNET_STRUCT(_net_inet_ipip, IPSECCTL_STATS, 97 stats, CTLFLAG_RD, &VNET_NAME(ipipstat), ipipstat, ""); 98 99 /* XXX IPCOMP */ 100 #define M_IPSEC (M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED) 101 102 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp); 103 104 #ifdef INET6 105 /* 106 * Really only a wrapper for ipip_input(), for use with IPv6. 107 */ 108 int 109 ip4_input6(struct mbuf **m, int *offp, int proto) 110 { 111 #if 0 112 /* If we do not accept IP-in-IP explicitly, drop. */ 113 if (!V_ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) { 114 DPRINTF(("%s: dropped due to policy\n", __func__)); 115 IPIPSTAT_INC(ipips_pdrops); 116 m_freem(*m); 117 return IPPROTO_DONE; 118 } 119 #endif 120 _ipip_input(*m, *offp, NULL); 121 return IPPROTO_DONE; 122 } 123 #endif /* INET6 */ 124 125 #ifdef INET 126 /* 127 * Really only a wrapper for ipip_input(), for use with IPv4. 128 */ 129 void 130 ip4_input(struct mbuf *m, int off) 131 { 132 #if 0 133 /* If we do not accept IP-in-IP explicitly, drop. */ 134 if (!V_ipip_allow && (m->m_flags & M_IPSEC) == 0) { 135 DPRINTF(("%s: dropped due to policy\n", __func__)); 136 IPIPSTAT_INC(ipips_pdrops); 137 m_freem(m); 138 return; 139 } 140 #endif 141 _ipip_input(m, off, NULL); 142 } 143 #endif /* INET */ 144 145 /* 146 * ipip_input gets called when we receive an IP{46} encapsulated packet, 147 * either because we got it at a real interface, or because AH or ESP 148 * were being used in tunnel mode (in which case the rcvif element will 149 * contain the address of the encX interface associated with the tunnel. 150 */ 151 152 static void 153 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp) 154 { 155 struct ip *ipo; 156 #ifdef INET6 157 struct ip6_hdr *ip6 = NULL; 158 u_int8_t itos; 159 #endif 160 int isr; 161 u_int8_t otos; 162 u_int8_t v; 163 int hlen; 164 165 IPIPSTAT_INC(ipips_ipackets); 166 167 m_copydata(m, 0, 1, &v); 168 169 switch (v >> 4) { 170 #ifdef INET 171 case 4: 172 hlen = sizeof(struct ip); 173 break; 174 #endif /* INET */ 175 #ifdef INET6 176 case 6: 177 hlen = sizeof(struct ip6_hdr); 178 break; 179 #endif 180 default: 181 IPIPSTAT_INC(ipips_family); 182 m_freem(m); 183 return /* EAFNOSUPPORT */; 184 } 185 186 /* Bring the IP header in the first mbuf, if not there already */ 187 if (m->m_len < hlen) { 188 if ((m = m_pullup(m, hlen)) == NULL) { 189 DPRINTF(("%s: m_pullup (1) failed\n", __func__)); 190 IPIPSTAT_INC(ipips_hdrops); 191 return; 192 } 193 } 194 ipo = mtod(m, struct ip *); 195 196 /* Keep outer ecn field. */ 197 switch (v >> 4) { 198 #ifdef INET 199 case 4: 200 otos = ipo->ip_tos; 201 break; 202 #endif /* INET */ 203 #ifdef INET6 204 case 6: 205 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff; 206 break; 207 #endif 208 default: 209 panic("ipip_input: unknown ip version %u (outer)", v>>4); 210 } 211 212 /* Remove outer IP header */ 213 m_adj(m, iphlen); 214 215 /* Sanity check */ 216 if (m->m_pkthdr.len < sizeof(struct ip)) { 217 IPIPSTAT_INC(ipips_hdrops); 218 m_freem(m); 219 return; 220 } 221 222 m_copydata(m, 0, 1, &v); 223 224 switch (v >> 4) { 225 #ifdef INET 226 case 4: 227 hlen = sizeof(struct ip); 228 break; 229 #endif /* INET */ 230 231 #ifdef INET6 232 case 6: 233 hlen = sizeof(struct ip6_hdr); 234 break; 235 #endif 236 default: 237 IPIPSTAT_INC(ipips_family); 238 m_freem(m); 239 return; /* EAFNOSUPPORT */ 240 } 241 242 /* 243 * Bring the inner IP header in the first mbuf, if not there already. 244 */ 245 if (m->m_len < hlen) { 246 if ((m = m_pullup(m, hlen)) == NULL) { 247 DPRINTF(("%s: m_pullup (2) failed\n", __func__)); 248 IPIPSTAT_INC(ipips_hdrops); 249 return; 250 } 251 } 252 253 /* 254 * RFC 1853 specifies that the inner TTL should not be touched on 255 * decapsulation. There's no reason this comment should be here, but 256 * this is as good as any a position. 257 */ 258 259 /* Some sanity checks in the inner IP header */ 260 switch (v >> 4) { 261 #ifdef INET 262 case 4: 263 ipo = mtod(m, struct ip *); 264 ip_ecn_egress(V_ip4_ipsec_ecn, &otos, &ipo->ip_tos); 265 break; 266 #endif /* INET */ 267 #ifdef INET6 268 case 6: 269 ip6 = (struct ip6_hdr *) ipo; 270 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 271 ip_ecn_egress(V_ip6_ipsec_ecn, &otos, &itos); 272 ip6->ip6_flow &= ~htonl(0xff << 20); 273 ip6->ip6_flow |= htonl((u_int32_t) itos << 20); 274 break; 275 #endif 276 default: 277 panic("ipip_input: unknown ip version %u (inner)", v>>4); 278 } 279 280 /* Check for local address spoofing. */ 281 if ((m->m_pkthdr.rcvif == NULL || 282 !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) && 283 V_ipip_allow != 2) { 284 #ifdef INET 285 if ((v >> 4) == IPVERSION && 286 in_localip(ipo->ip_src) != 0) { 287 IPIPSTAT_INC(ipips_spoof); 288 m_freem(m); 289 return; 290 } 291 #endif 292 #ifdef INET6 293 if ((v & IPV6_VERSION_MASK) == IPV6_VERSION && 294 in6_localip(&ip6->ip6_src) != 0) { 295 IPIPSTAT_INC(ipips_spoof); 296 m_freem(m); 297 return; 298 } 299 #endif 300 } 301 302 /* Statistics */ 303 IPIPSTAT_ADD(ipips_ibytes, m->m_pkthdr.len - iphlen); 304 305 #ifdef DEV_ENC 306 switch (v >> 4) { 307 #ifdef INET 308 case 4: 309 ipsec_bpf(m, NULL, AF_INET, ENC_IN|ENC_AFTER); 310 break; 311 #endif 312 #ifdef INET6 313 case 6: 314 ipsec_bpf(m, NULL, AF_INET6, ENC_IN|ENC_AFTER); 315 break; 316 #endif 317 default: 318 panic("%s: bogus ip version %u", __func__, v>>4); 319 } 320 /* pass the mbuf to enc0 for packet filtering */ 321 if (ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER) != 0) 322 return; 323 #endif 324 325 /* 326 * Interface pointer stays the same; if no IPsec processing has 327 * been done (or will be done), this will point to a normal 328 * interface. Otherwise, it'll point to an enc interface, which 329 * will allow a packet filter to distinguish between secure and 330 * untrusted packets. 331 */ 332 333 switch (v >> 4) { 334 #ifdef INET 335 case 4: 336 isr = NETISR_IP; 337 break; 338 #endif 339 #ifdef INET6 340 case 6: 341 isr = NETISR_IPV6; 342 break; 343 #endif 344 default: 345 panic("%s: bogus ip version %u", __func__, v>>4); 346 } 347 348 m_addr_changed(m); 349 350 if (netisr_queue(isr, m)) { /* (0) on success. */ 351 IPIPSTAT_INC(ipips_qfull); 352 DPRINTF(("%s: packet dropped because of full queue\n", 353 __func__)); 354 } 355 } 356 357 int 358 ipip_output( 359 struct mbuf *m, 360 struct ipsecrequest *isr, 361 struct mbuf **mp, 362 int skip, 363 int protoff 364 ) 365 { 366 struct secasvar *sav; 367 u_int8_t tp, otos; 368 struct secasindex *saidx; 369 int error; 370 #if defined(INET) || defined(INET6) 371 u_int8_t itos; 372 #endif 373 #ifdef INET 374 struct ip *ipo; 375 #endif /* INET */ 376 #ifdef INET6 377 struct ip6_hdr *ip6, *ip6o; 378 #endif /* INET6 */ 379 380 sav = isr->sav; 381 IPSEC_ASSERT(sav != NULL, ("null SA")); 382 IPSEC_ASSERT(sav->sah != NULL, ("null SAH")); 383 384 /* XXX Deal with empty TDB source/destination addresses. */ 385 386 m_copydata(m, 0, 1, &tp); 387 tp = (tp >> 4) & 0xff; /* Get the IP version number. */ 388 389 saidx = &sav->sah->saidx; 390 switch (saidx->dst.sa.sa_family) { 391 #ifdef INET 392 case AF_INET: 393 if (saidx->src.sa.sa_family != AF_INET || 394 saidx->src.sin.sin_addr.s_addr == INADDR_ANY || 395 saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) { 396 DPRINTF(("%s: unspecified tunnel endpoint " 397 "address in SA %s/%08lx\n", __func__, 398 ipsec_address(&saidx->dst), 399 (u_long) ntohl(sav->spi))); 400 IPIPSTAT_INC(ipips_unspec); 401 error = EINVAL; 402 goto bad; 403 } 404 405 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 406 if (m == 0) { 407 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 408 IPIPSTAT_INC(ipips_hdrops); 409 error = ENOBUFS; 410 goto bad; 411 } 412 413 ipo = mtod(m, struct ip *); 414 415 ipo->ip_v = IPVERSION; 416 ipo->ip_hl = 5; 417 ipo->ip_len = htons(m->m_pkthdr.len); 418 ipo->ip_ttl = V_ip_defttl; 419 ipo->ip_sum = 0; 420 ipo->ip_src = saidx->src.sin.sin_addr; 421 ipo->ip_dst = saidx->dst.sin.sin_addr; 422 423 ipo->ip_id = ip_newid(); 424 425 /* If the inner protocol is IP... */ 426 switch (tp) { 427 case IPVERSION: 428 /* Save ECN notification */ 429 m_copydata(m, sizeof(struct ip) + 430 offsetof(struct ip, ip_tos), 431 sizeof(u_int8_t), (caddr_t) &itos); 432 433 ipo->ip_p = IPPROTO_IPIP; 434 435 /* 436 * We should be keeping tunnel soft-state and 437 * send back ICMPs if needed. 438 */ 439 m_copydata(m, sizeof(struct ip) + 440 offsetof(struct ip, ip_off), 441 sizeof(u_int16_t), (caddr_t) &ipo->ip_off); 442 ipo->ip_off = ntohs(ipo->ip_off); 443 ipo->ip_off &= ~(IP_DF | IP_MF | IP_OFFMASK); 444 ipo->ip_off = htons(ipo->ip_off); 445 break; 446 #ifdef INET6 447 case (IPV6_VERSION >> 4): 448 { 449 u_int32_t itos32; 450 451 /* Save ECN notification. */ 452 m_copydata(m, sizeof(struct ip) + 453 offsetof(struct ip6_hdr, ip6_flow), 454 sizeof(u_int32_t), (caddr_t) &itos32); 455 itos = ntohl(itos32) >> 20; 456 ipo->ip_p = IPPROTO_IPV6; 457 ipo->ip_off = 0; 458 break; 459 } 460 #endif /* INET6 */ 461 default: 462 goto nofamily; 463 } 464 465 otos = 0; 466 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 467 ipo->ip_tos = otos; 468 break; 469 #endif /* INET */ 470 471 #ifdef INET6 472 case AF_INET6: 473 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) || 474 saidx->src.sa.sa_family != AF_INET6 || 475 IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) { 476 DPRINTF(("%s: unspecified tunnel endpoint " 477 "address in SA %s/%08lx\n", __func__, 478 ipsec_address(&saidx->dst), 479 (u_long) ntohl(sav->spi))); 480 IPIPSTAT_INC(ipips_unspec); 481 error = ENOBUFS; 482 goto bad; 483 } 484 485 /* scoped address handling */ 486 ip6 = mtod(m, struct ip6_hdr *); 487 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 488 ip6->ip6_src.s6_addr16[1] = 0; 489 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 490 ip6->ip6_dst.s6_addr16[1] = 0; 491 492 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 493 if (m == 0) { 494 DPRINTF(("%s: M_PREPEND failed\n", __func__)); 495 IPIPSTAT_INC(ipips_hdrops); 496 error = ENOBUFS; 497 goto bad; 498 } 499 500 /* Initialize IPv6 header */ 501 ip6o = mtod(m, struct ip6_hdr *); 502 ip6o->ip6_flow = 0; 503 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK; 504 ip6o->ip6_vfc |= IPV6_VERSION; 505 ip6o->ip6_plen = htons(m->m_pkthdr.len); 506 ip6o->ip6_hlim = V_ip_defttl; 507 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr; 508 ip6o->ip6_src = saidx->src.sin6.sin6_addr; 509 510 switch (tp) { 511 #ifdef INET 512 case IPVERSION: 513 /* Save ECN notification */ 514 m_copydata(m, sizeof(struct ip6_hdr) + 515 offsetof(struct ip, ip_tos), sizeof(u_int8_t), 516 (caddr_t) &itos); 517 518 /* This is really IPVERSION. */ 519 ip6o->ip6_nxt = IPPROTO_IPIP; 520 break; 521 #endif /* INET */ 522 case (IPV6_VERSION >> 4): 523 { 524 u_int32_t itos32; 525 526 /* Save ECN notification. */ 527 m_copydata(m, sizeof(struct ip6_hdr) + 528 offsetof(struct ip6_hdr, ip6_flow), 529 sizeof(u_int32_t), (caddr_t) &itos32); 530 itos = ntohl(itos32) >> 20; 531 532 ip6o->ip6_nxt = IPPROTO_IPV6; 533 break; 534 } 535 default: 536 goto nofamily; 537 } 538 539 otos = 0; 540 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 541 ip6o->ip6_flow |= htonl((u_int32_t) otos << 20); 542 break; 543 #endif /* INET6 */ 544 545 default: 546 nofamily: 547 DPRINTF(("%s: unsupported protocol family %u\n", __func__, 548 saidx->dst.sa.sa_family)); 549 IPIPSTAT_INC(ipips_family); 550 error = EAFNOSUPPORT; /* XXX diffs from openbsd */ 551 goto bad; 552 } 553 554 IPIPSTAT_INC(ipips_opackets); 555 *mp = m; 556 557 #ifdef INET 558 if (saidx->dst.sa.sa_family == AF_INET) { 559 #if 0 560 if (sav->tdb_xform->xf_type == XF_IP4) 561 tdb->tdb_cur_bytes += 562 m->m_pkthdr.len - sizeof(struct ip); 563 #endif 564 IPIPSTAT_ADD(ipips_obytes, 565 m->m_pkthdr.len - sizeof(struct ip)); 566 } 567 #endif /* INET */ 568 569 #ifdef INET6 570 if (saidx->dst.sa.sa_family == AF_INET6) { 571 #if 0 572 if (sav->tdb_xform->xf_type == XF_IP4) 573 tdb->tdb_cur_bytes += 574 m->m_pkthdr.len - sizeof(struct ip6_hdr); 575 #endif 576 IPIPSTAT_ADD(ipips_obytes, 577 m->m_pkthdr.len - sizeof(struct ip6_hdr)); 578 } 579 #endif /* INET6 */ 580 581 return 0; 582 bad: 583 if (m) 584 m_freem(m); 585 *mp = NULL; 586 return (error); 587 } 588 589 #ifdef IPSEC 590 #if defined(INET) || defined(INET6) 591 static int 592 ipe4_init(struct secasvar *sav, struct xformsw *xsp) 593 { 594 sav->tdb_xform = xsp; 595 return 0; 596 } 597 598 static int 599 ipe4_zeroize(struct secasvar *sav) 600 { 601 sav->tdb_xform = NULL; 602 return 0; 603 } 604 605 static int 606 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff) 607 { 608 /* This is a rather serious mistake, so no conditional printing. */ 609 printf("%s: should never be called\n", __func__); 610 if (m) 611 m_freem(m); 612 return EOPNOTSUPP; 613 } 614 615 static struct xformsw ipe4_xformsw = { 616 XF_IP4, 0, "IPv4 Simple Encapsulation", 617 ipe4_init, ipe4_zeroize, ipe4_input, ipip_output, 618 }; 619 620 extern struct domain inetdomain; 621 #endif /* INET || INET6 */ 622 #ifdef INET 623 static struct protosw ipe4_protosw = { 624 .pr_type = SOCK_RAW, 625 .pr_domain = &inetdomain, 626 .pr_protocol = IPPROTO_IPV4, 627 .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR, 628 .pr_input = ip4_input, 629 .pr_ctloutput = rip_ctloutput, 630 .pr_usrreqs = &rip_usrreqs 631 }; 632 #endif /* INET */ 633 #if defined(INET6) && defined(INET) 634 static struct ip6protosw ipe6_protosw = { 635 .pr_type = SOCK_RAW, 636 .pr_domain = &inetdomain, 637 .pr_protocol = IPPROTO_IPV6, 638 .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR, 639 .pr_input = ip4_input6, 640 .pr_ctloutput = rip_ctloutput, 641 .pr_usrreqs = &rip_usrreqs 642 }; 643 #endif /* INET6 && INET */ 644 645 #if defined(INET) 646 /* 647 * Check the encapsulated packet to see if we want it 648 */ 649 static int 650 ipe4_encapcheck(const struct mbuf *m, int off, int proto, void *arg) 651 { 652 /* 653 * Only take packets coming from IPSEC tunnels; the rest 654 * must be handled by the gif tunnel code. Note that we 655 * also return a minimum priority when we want the packet 656 * so any explicit gif tunnels take precedence. 657 */ 658 return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0); 659 } 660 #endif /* INET */ 661 662 static void 663 ipe4_attach(void) 664 { 665 666 xform_register(&ipe4_xformsw); 667 /* attach to encapsulation framework */ 668 /* XXX save return cookie for detach on module remove */ 669 #ifdef INET 670 (void) encap_attach_func(AF_INET, -1, 671 ipe4_encapcheck, &ipe4_protosw, NULL); 672 #endif 673 #if defined(INET6) && defined(INET) 674 (void) encap_attach_func(AF_INET6, -1, 675 ipe4_encapcheck, (struct protosw *)&ipe6_protosw, NULL); 676 #endif 677 } 678 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL); 679 #endif /* IPSEC */
Cache object: 8b70ce9f2fc81bdbc898e8c9e818783e
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]