ipsec_netbsd.c revision 1.11.2.7
1 1.11.2.7 skrll /* $NetBSD: ipsec_netbsd.c,v 1.11.2.7 2005/11/10 14:11:35 skrll Exp $ */ 2 1.11.2.2 skrll /* $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $ */ 3 1.11.2.2 skrll /* $KAME: ah_input.c,v 1.64 2001/09/04 08:43:19 itojun Exp $ */ 4 1.11.2.2 skrll 5 1.11.2.2 skrll /* 6 1.11.2.2 skrll * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 1.11.2.2 skrll * All rights reserved. 8 1.11.2.2 skrll * 9 1.11.2.2 skrll * Redistribution and use in source and binary forms, with or without 10 1.11.2.2 skrll * modification, are permitted provided that the following conditions 11 1.11.2.2 skrll * are met: 12 1.11.2.2 skrll * 1. Redistributions of source code must retain the above copyright 13 1.11.2.2 skrll * notice, this list of conditions and the following disclaimer. 14 1.11.2.2 skrll * 2. Redistributions in binary form must reproduce the above copyright 15 1.11.2.2 skrll * notice, this list of conditions and the following disclaimer in the 16 1.11.2.2 skrll * documentation and/or other materials provided with the distribution. 17 1.11.2.2 skrll * 3. Neither the name of the project nor the names of its contributors 18 1.11.2.2 skrll * may be used to endorse or promote products derived from this software 19 1.11.2.2 skrll * without specific prior written permission. 20 1.11.2.2 skrll * 21 1.11.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 1.11.2.2 skrll * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 1.11.2.2 skrll * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 1.11.2.2 skrll * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 1.11.2.2 skrll * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 1.11.2.2 skrll * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 1.11.2.2 skrll * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 1.11.2.2 skrll * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 1.11.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 1.11.2.2 skrll * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 1.11.2.2 skrll * SUCH DAMAGE. 32 1.11.2.2 skrll */ 33 1.11.2.2 skrll 34 1.11.2.2 skrll #include <sys/cdefs.h> 35 1.11.2.7 skrll __KERNEL_RCSID(0, "$NetBSD: ipsec_netbsd.c,v 1.11.2.7 2005/11/10 14:11:35 skrll Exp $"); 36 1.11.2.2 skrll 37 1.11.2.2 skrll #include "opt_inet.h" 38 1.11.2.2 skrll #include "opt_ipsec.h" 39 1.11.2.2 skrll 40 1.11.2.2 skrll #include <sys/param.h> 41 1.11.2.2 skrll #include <sys/systm.h> 42 1.11.2.2 skrll #include <sys/malloc.h> 43 1.11.2.2 skrll #include <sys/mbuf.h> 44 1.11.2.2 skrll #include <sys/domain.h> 45 1.11.2.2 skrll #include <sys/protosw.h> 46 1.11.2.2 skrll #include <sys/socket.h> 47 1.11.2.2 skrll #include <sys/errno.h> 48 1.11.2.2 skrll #include <sys/time.h> 49 1.11.2.2 skrll #include <sys/kernel.h> 50 1.11.2.2 skrll #include <sys/sysctl.h> 51 1.11.2.2 skrll 52 1.11.2.2 skrll #include <net/if.h> 53 1.11.2.2 skrll #include <net/route.h> 54 1.11.2.2 skrll #include <net/netisr.h> 55 1.11.2.2 skrll #include <machine/cpu.h> 56 1.11.2.2 skrll 57 1.11.2.2 skrll #include <netinet/in.h> 58 1.11.2.2 skrll #include <netinet/in_systm.h> 59 1.11.2.2 skrll #include <netinet/in_var.h> 60 1.11.2.2 skrll #include <netinet/ip.h> 61 1.11.2.2 skrll #include <netinet/ip_var.h> 62 1.11.2.2 skrll #include <netinet/ip_ecn.h> 63 1.11.2.2 skrll #include <netinet/ip_icmp.h> 64 1.11.2.2 skrll 65 1.11.2.2 skrll 66 1.11.2.2 skrll #include <netipsec/ipsec.h> 67 1.11.2.2 skrll #include <netipsec/ipsec_var.h> 68 1.11.2.2 skrll #include <netipsec/key.h> 69 1.11.2.2 skrll #include <netipsec/keydb.h> 70 1.11.2.2 skrll #include <netipsec/key_debug.h> 71 1.11.2.2 skrll #include <netipsec/ah_var.h> 72 1.11.2.2 skrll #include <netipsec/esp.h> 73 1.11.2.2 skrll #include <netipsec/esp_var.h> 74 1.11.2.2 skrll #include <netipsec/ipip_var.h> 75 1.11.2.2 skrll #include <netipsec/ipcomp_var.h> 76 1.11.2.2 skrll 77 1.11.2.2 skrll #ifdef INET6 78 1.11.2.2 skrll #include <netipsec/ipsec6.h> 79 1.11.2.2 skrll #include <netinet6/ip6protosw.h> 80 1.11.2.2 skrll #include <netinet/icmp6.h> 81 1.11.2.2 skrll #endif 82 1.11.2.2 skrll 83 1.11.2.2 skrll #include <machine/stdarg.h> 84 1.11.2.2 skrll 85 1.11.2.2 skrll 86 1.11.2.2 skrll 87 1.11.2.2 skrll #include <netipsec/key.h> 88 1.11.2.2 skrll 89 1.11.2.2 skrll /* assumes that ip header and ah header are contiguous on mbuf */ 90 1.11.2.2 skrll void * 91 1.11.2.2 skrll ah4_ctlinput(cmd, sa, v) 92 1.11.2.2 skrll int cmd; 93 1.11.2.2 skrll struct sockaddr *sa; 94 1.11.2.2 skrll void *v; 95 1.11.2.2 skrll { 96 1.11.2.2 skrll struct ip *ip = v; 97 1.11.2.2 skrll struct ah *ah; 98 1.11.2.2 skrll struct icmp *icp; 99 1.11.2.2 skrll struct secasvar *sav; 100 1.11.2.2 skrll 101 1.11.2.2 skrll if (sa->sa_family != AF_INET || 102 1.11.2.2 skrll sa->sa_len != sizeof(struct sockaddr_in)) 103 1.11.2.2 skrll return NULL; 104 1.11.2.2 skrll if ((unsigned)cmd >= PRC_NCMDS) 105 1.11.2.2 skrll return NULL; 106 1.11.2.2 skrll #ifndef notyet 107 1.11.2.6 skrll /* jonathan (at) NetBSD.org: XXX FIXME */ 108 1.11.2.2 skrll (void) ip; (void) ah; (void) icp; (void) sav; 109 1.11.2.2 skrll #else 110 1.11.2.2 skrll if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) { 111 1.11.2.2 skrll /* 112 1.11.2.2 skrll * Check to see if we have a valid SA corresponding to 113 1.11.2.2 skrll * the address in the ICMP message payload. 114 1.11.2.2 skrll */ 115 1.11.2.2 skrll ah = (struct ah *)((caddr_t)ip + (ip->ip_hl << 2)); 116 1.11.2.2 skrll if ((sav = key_allocsa(AF_INET, 117 1.11.2.2 skrll (caddr_t) &ip->ip_src, 118 1.11.2.2 skrll (caddr_t) &ip->ip_dst, 119 1.11.2.2 skrll IPPROTO_AH, ah->ah_spi)) == NULL) 120 1.11.2.2 skrll return NULL; 121 1.11.2.2 skrll if (sav->state != SADB_SASTATE_MATURE && 122 1.11.2.2 skrll sav->state != SADB_SASTATE_DYING) { 123 1.11.2.2 skrll key_freesav(sav); 124 1.11.2.2 skrll return NULL; 125 1.11.2.2 skrll } 126 1.11.2.2 skrll 127 1.11.2.2 skrll /* XXX Further validation? */ 128 1.11.2.2 skrll 129 1.11.2.2 skrll key_freesav(sav); 130 1.11.2.2 skrll 131 1.11.2.2 skrll /* 132 1.11.2.2 skrll * Now that we've validated that we are actually communicating 133 1.11.2.2 skrll * with the host indicated in the ICMP message, locate the 134 1.11.2.2 skrll * ICMP header, recalculate the new MTU, and create the 135 1.11.2.2 skrll * corresponding routing entry. 136 1.11.2.2 skrll */ 137 1.11.2.2 skrll icp = (struct icmp *)((caddr_t)ip - 138 1.11.2.2 skrll offsetof(struct icmp, icmp_ip)); 139 1.11.2.2 skrll icmp_mtudisc(icp, ip->ip_dst); 140 1.11.2.2 skrll 141 1.11.2.2 skrll return NULL; 142 1.11.2.2 skrll } 143 1.11.2.2 skrll #endif 144 1.11.2.2 skrll 145 1.11.2.2 skrll return NULL; 146 1.11.2.2 skrll } 147 1.11.2.2 skrll 148 1.11.2.2 skrll /* assumes that ip header and esp header are contiguous on mbuf */ 149 1.11.2.2 skrll void * 150 1.11.2.2 skrll esp4_ctlinput(cmd, sa, v) 151 1.11.2.2 skrll int cmd; 152 1.11.2.2 skrll struct sockaddr *sa; 153 1.11.2.2 skrll void *v; 154 1.11.2.2 skrll { 155 1.11.2.2 skrll struct ip *ip = v; 156 1.11.2.2 skrll struct esp *esp; 157 1.11.2.2 skrll struct icmp *icp; 158 1.11.2.2 skrll struct secasvar *sav; 159 1.11.2.2 skrll 160 1.11.2.2 skrll if (sa->sa_family != AF_INET || 161 1.11.2.2 skrll sa->sa_len != sizeof(struct sockaddr_in)) 162 1.11.2.2 skrll return NULL; 163 1.11.2.2 skrll if ((unsigned)cmd >= PRC_NCMDS) 164 1.11.2.2 skrll return NULL; 165 1.11.2.2 skrll #ifndef notyet 166 1.11.2.6 skrll /* jonathan (at) NetBSD.org: XXX FIXME */ 167 1.11.2.2 skrll (void) ip; (void) esp; (void) icp; (void) sav; 168 1.11.2.2 skrll #else 169 1.11.2.2 skrll if (cmd == PRC_MSGSIZE && ip_mtudisc && ip && ip->ip_v == 4) { 170 1.11.2.2 skrll /* 171 1.11.2.2 skrll * Check to see if we have a valid SA corresponding to 172 1.11.2.2 skrll * the address in the ICMP message payload. 173 1.11.2.2 skrll */ 174 1.11.2.2 skrll esp = (struct esp *)((caddr_t)ip + (ip->ip_hl << 2)); 175 1.11.2.2 skrll if ((sav = key_allocsa(AF_INET, 176 1.11.2.2 skrll (caddr_t) &ip->ip_src, 177 1.11.2.2 skrll (caddr_t) &ip->ip_dst, 178 1.11.2.2 skrll IPPROTO_ESP, esp->esp_spi)) == NULL) 179 1.11.2.2 skrll return NULL; 180 1.11.2.2 skrll if (sav->state != SADB_SASTATE_MATURE && 181 1.11.2.2 skrll sav->state != SADB_SASTATE_DYING) { 182 1.11.2.2 skrll key_freesav(sav); 183 1.11.2.2 skrll return NULL; 184 1.11.2.2 skrll } 185 1.11.2.2 skrll 186 1.11.2.2 skrll /* XXX Further validation? */ 187 1.11.2.2 skrll 188 1.11.2.2 skrll key_freesav(sav); 189 1.11.2.2 skrll 190 1.11.2.2 skrll /* 191 1.11.2.2 skrll * Now that we've validated that we are actually communicating 192 1.11.2.2 skrll * with the host indicated in the ICMP message, locate the 193 1.11.2.2 skrll * ICMP header, recalculate the new MTU, and create the 194 1.11.2.2 skrll * corresponding routing entry. 195 1.11.2.2 skrll */ 196 1.11.2.2 skrll icp = (struct icmp *)((caddr_t)ip - 197 1.11.2.2 skrll offsetof(struct icmp, icmp_ip)); 198 1.11.2.2 skrll icmp_mtudisc(icp, ip->ip_dst); 199 1.11.2.2 skrll 200 1.11.2.2 skrll return NULL; 201 1.11.2.2 skrll } 202 1.11.2.2 skrll #endif 203 1.11.2.2 skrll 204 1.11.2.2 skrll return NULL; 205 1.11.2.2 skrll } 206 1.11.2.2 skrll 207 1.11.2.2 skrll #ifdef INET6 208 1.11.2.2 skrll void 209 1.11.2.2 skrll esp6_ctlinput(cmd, sa, d) 210 1.11.2.2 skrll int cmd; 211 1.11.2.2 skrll struct sockaddr *sa; 212 1.11.2.2 skrll void *d; 213 1.11.2.2 skrll { 214 1.11.2.2 skrll const struct newesp *espp; 215 1.11.2.2 skrll struct newesp esp; 216 1.11.2.2 skrll struct ip6ctlparam *ip6cp = NULL, ip6cp1; 217 1.11.2.2 skrll struct secasvar *sav; 218 1.11.2.2 skrll struct ip6_hdr *ip6; 219 1.11.2.2 skrll struct mbuf *m; 220 1.11.2.2 skrll int off; 221 1.11.2.2 skrll struct sockaddr_in6 *sa6_src, *sa6_dst; 222 1.11.2.2 skrll 223 1.11.2.2 skrll if (sa->sa_family != AF_INET6 || 224 1.11.2.2 skrll sa->sa_len != sizeof(struct sockaddr_in6)) 225 1.11.2.2 skrll return; 226 1.11.2.2 skrll if ((unsigned)cmd >= PRC_NCMDS) 227 1.11.2.2 skrll return; 228 1.11.2.2 skrll 229 1.11.2.2 skrll /* if the parameter is from icmp6, decode it. */ 230 1.11.2.2 skrll if (d != NULL) { 231 1.11.2.2 skrll ip6cp = (struct ip6ctlparam *)d; 232 1.11.2.2 skrll m = ip6cp->ip6c_m; 233 1.11.2.2 skrll ip6 = ip6cp->ip6c_ip6; 234 1.11.2.2 skrll off = ip6cp->ip6c_off; 235 1.11.2.2 skrll } else { 236 1.11.2.2 skrll m = NULL; 237 1.11.2.2 skrll ip6 = NULL; 238 1.11.2.2 skrll off = 0; 239 1.11.2.2 skrll } 240 1.11.2.2 skrll 241 1.11.2.2 skrll if (ip6) { 242 1.11.2.2 skrll /* 243 1.11.2.2 skrll * Notify the error to all possible sockets via pfctlinput2. 244 1.11.2.2 skrll * Since the upper layer information (such as protocol type, 245 1.11.2.2 skrll * source and destination ports) is embedded in the encrypted 246 1.11.2.2 skrll * data and might have been cut, we can't directly call 247 1.11.2.2 skrll * an upper layer ctlinput function. However, the pcbnotify 248 1.11.2.2 skrll * function will consider source and destination addresses 249 1.11.2.2 skrll * as well as the flow info value, and may be able to find 250 1.11.2.2 skrll * some PCB that should be notified. 251 1.11.2.2 skrll * Although pfctlinput2 will call esp6_ctlinput(), there is 252 1.11.2.2 skrll * no possibility of an infinite loop of function calls, 253 1.11.2.2 skrll * because we don't pass the inner IPv6 header. 254 1.11.2.2 skrll */ 255 1.11.2.2 skrll bzero(&ip6cp1, sizeof(ip6cp1)); 256 1.11.2.2 skrll ip6cp1.ip6c_src = ip6cp->ip6c_src; 257 1.11.2.2 skrll pfctlinput2(cmd, sa, (void *)&ip6cp1); 258 1.11.2.2 skrll 259 1.11.2.2 skrll /* 260 1.11.2.2 skrll * Then go to special cases that need ESP header information. 261 1.11.2.2 skrll * XXX: We assume that when ip6 is non NULL, 262 1.11.2.2 skrll * M and OFF are valid. 263 1.11.2.2 skrll */ 264 1.11.2.2 skrll 265 1.11.2.2 skrll /* check if we can safely examine src and dst ports */ 266 1.11.2.2 skrll if (m->m_pkthdr.len < off + sizeof(esp)) 267 1.11.2.2 skrll return; 268 1.11.2.2 skrll 269 1.11.2.2 skrll if (m->m_len < off + sizeof(esp)) { 270 1.11.2.2 skrll /* 271 1.11.2.2 skrll * this should be rare case, 272 1.11.2.2 skrll * so we compromise on this copy... 273 1.11.2.2 skrll */ 274 1.11.2.2 skrll m_copydata(m, off, sizeof(esp), (caddr_t)&esp); 275 1.11.2.2 skrll espp = &esp; 276 1.11.2.2 skrll } else 277 1.11.2.2 skrll espp = (struct newesp*)(mtod(m, caddr_t) + off); 278 1.11.2.2 skrll 279 1.11.2.2 skrll if (cmd == PRC_MSGSIZE) { 280 1.11.2.2 skrll int valid = 0; 281 1.11.2.2 skrll 282 1.11.2.2 skrll /* 283 1.11.2.2 skrll * Check to see if we have a valid SA corresponding to 284 1.11.2.2 skrll * the address in the ICMP message payload. 285 1.11.2.2 skrll */ 286 1.11.2.2 skrll sa6_src = ip6cp->ip6c_src; 287 1.11.2.2 skrll sa6_dst = (struct sockaddr_in6 *)sa; 288 1.11.2.2 skrll #ifdef KAME 289 1.11.2.2 skrll sav = key_allocsa(AF_INET6, 290 1.11.2.2 skrll (caddr_t)&sa6_src->sin6_addr, 291 1.11.2.2 skrll (caddr_t)&sa6_dst->sin6_addr, 292 1.11.2.2 skrll IPPROTO_ESP, espp->esp_spi); 293 1.11.2.2 skrll #else 294 1.11.2.6 skrll /* jonathan (at) NetBSD.org: XXX FIXME */ 295 1.11.2.2 skrll (void)sa6_src; (void)sa6_dst; 296 1.11.2.2 skrll sav = KEY_ALLOCSA((union sockaddr_union*)sa, 297 1.11.2.2 skrll IPPROTO_ESP, espp->esp_spi); 298 1.11.2.2 skrll 299 1.11.2.2 skrll #endif 300 1.11.2.2 skrll if (sav) { 301 1.11.2.2 skrll if (sav->state == SADB_SASTATE_MATURE || 302 1.11.2.2 skrll sav->state == SADB_SASTATE_DYING) 303 1.11.2.2 skrll valid++; 304 1.11.2.2 skrll KEY_FREESAV(&sav); 305 1.11.2.2 skrll } 306 1.11.2.2 skrll 307 1.11.2.2 skrll /* XXX Further validation? */ 308 1.11.2.2 skrll 309 1.11.2.2 skrll /* 310 1.11.2.2 skrll * Depending on the value of "valid" and routing table 311 1.11.2.2 skrll * size (mtudisc_{hi,lo}wat), we will: 312 1.11.2.2 skrll * - recalcurate the new MTU and create the 313 1.11.2.2 skrll * corresponding routing entry, or 314 1.11.2.2 skrll * - ignore the MTU change notification. 315 1.11.2.2 skrll */ 316 1.11.2.2 skrll icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 317 1.11.2.2 skrll } 318 1.11.2.2 skrll } else { 319 1.11.2.2 skrll /* we normally notify any pcb here */ 320 1.11.2.2 skrll } 321 1.11.2.2 skrll } 322 1.11.2.2 skrll #endif /* INET6 */ 323 1.11.2.2 skrll 324 1.11.2.2 skrll static int 325 1.11.2.2 skrll sysctl_fast_ipsec(SYSCTLFN_ARGS) 326 1.11.2.2 skrll { 327 1.11.2.2 skrll int error, t; 328 1.11.2.2 skrll struct sysctlnode node; 329 1.11.2.2 skrll 330 1.11.2.2 skrll node = *rnode; 331 1.11.2.2 skrll t = *(int*)rnode->sysctl_data; 332 1.11.2.2 skrll node.sysctl_data = &t; 333 1.11.2.2 skrll error = sysctl_lookup(SYSCTLFN_CALL(&node)); 334 1.11.2.2 skrll if (error || newp == NULL) 335 1.11.2.2 skrll return (error); 336 1.11.2.2 skrll 337 1.11.2.2 skrll switch (rnode->sysctl_num) { 338 1.11.2.2 skrll case IPSECCTL_DEF_ESP_TRANSLEV: 339 1.11.2.2 skrll case IPSECCTL_DEF_ESP_NETLEV: 340 1.11.2.2 skrll case IPSECCTL_DEF_AH_TRANSLEV: 341 1.11.2.2 skrll case IPSECCTL_DEF_AH_NETLEV: 342 1.11.2.6 skrll if (t != IPSEC_LEVEL_USE && 343 1.11.2.2 skrll t != IPSEC_LEVEL_REQUIRE) 344 1.11.2.2 skrll return (EINVAL); 345 1.11.2.2 skrll ipsec_invalpcbcacheall(); 346 1.11.2.2 skrll break; 347 1.11.2.2 skrll case IPSECCTL_DEF_POLICY: 348 1.11.2.2 skrll if (t != IPSEC_POLICY_DISCARD && 349 1.11.2.2 skrll t != IPSEC_POLICY_NONE) 350 1.11.2.2 skrll return (EINVAL); 351 1.11.2.2 skrll ipsec_invalpcbcacheall(); 352 1.11.2.2 skrll break; 353 1.11.2.2 skrll default: 354 1.11.2.2 skrll return (EINVAL); 355 1.11.2.2 skrll } 356 1.11.2.2 skrll 357 1.11.2.2 skrll *(int*)rnode->sysctl_data = t; 358 1.11.2.2 skrll 359 1.11.2.2 skrll return (0); 360 1.11.2.2 skrll } 361 1.11.2.2 skrll 362 1.11.2.2 skrll /* XXX will need a different oid at parent */ 363 1.11.2.2 skrll SYSCTL_SETUP(sysctl_net_inet_fast_ipsec_setup, "sysctl net.inet.ipsec subtree setup") 364 1.11.2.2 skrll { 365 1.11.2.7 skrll const struct sysctlnode *_ipsec; 366 1.11.2.2 skrll int ipproto_ipsec; 367 1.11.2.2 skrll 368 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 369 1.11.2.2 skrll CTLFLAG_PERMANENT, 370 1.11.2.2 skrll CTLTYPE_NODE, "net", NULL, 371 1.11.2.2 skrll NULL, 0, NULL, 0, 372 1.11.2.2 skrll CTL_NET, CTL_EOL); 373 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 374 1.11.2.2 skrll CTLFLAG_PERMANENT, 375 1.11.2.2 skrll CTLTYPE_NODE, "inet", NULL, 376 1.11.2.2 skrll NULL, 0, NULL, 0, 377 1.11.2.2 skrll CTL_NET, PF_INET, CTL_EOL); 378 1.11.2.2 skrll 379 1.11.2.2 skrll /* 380 1.11.2.2 skrll * in numerical order: 381 1.11.2.2 skrll * 382 1.11.2.2 skrll * net.inet.ipip: CTL_NET.PF_INET.IPPROTO_IPIP 383 1.11.2.2 skrll * net.inet.esp: CTL_NET.PF_INET.IPPROTO_ESP 384 1.11.2.2 skrll * net.inet.ah: CTL_NET.PF_INET.IPPROTO_AH 385 1.11.2.2 skrll * net.inet.ipcomp: CTL_NET.PF_INET.IPPROTO_IPCOMP 386 1.11.2.2 skrll * net.inet.ipsec: CTL_NET.PF_INET.CTL_CREATE 387 1.11.2.2 skrll * 388 1.11.2.2 skrll * this creates separate trees by name, but maintains that the 389 1.11.2.2 skrll * ipsec name leads to all the old leaves. 390 1.11.2.2 skrll */ 391 1.11.2.2 skrll 392 1.11.2.2 skrll /* create net.inet.ipip */ 393 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 394 1.11.2.2 skrll CTLFLAG_PERMANENT, 395 1.11.2.2 skrll CTLTYPE_NODE, "ipip", NULL, 396 1.11.2.2 skrll NULL, 0, NULL, 0, 397 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_IPIP, CTL_EOL); 398 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 399 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READONLY, 400 1.11.2.2 skrll CTLTYPE_STRUCT, "ipip_stats", NULL, 401 1.11.2.2 skrll NULL, 0, &ipipstat, sizeof(ipipstat), 402 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_IPIP, 403 1.11.2.2 skrll CTL_CREATE, CTL_EOL); 404 1.11.2.2 skrll 405 1.11.2.2 skrll /* create net.inet.esp subtree under IPPROTO_ESP */ 406 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 407 1.11.2.2 skrll CTLFLAG_PERMANENT, 408 1.11.2.2 skrll CTLTYPE_NODE, "esp", NULL, 409 1.11.2.2 skrll NULL, 0, NULL, 0, 410 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_ESP, CTL_EOL); 411 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 412 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 413 1.11.2.2 skrll CTLTYPE_INT, "trans_deflev", NULL, 414 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_esp_trans_deflev, 0, 415 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_ESP, 416 1.11.2.2 skrll IPSECCTL_DEF_ESP_TRANSLEV, CTL_EOL); 417 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 418 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 419 1.11.2.2 skrll CTLTYPE_INT, "net_deflev", NULL, 420 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_esp_net_deflev, 0, 421 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_ESP, 422 1.11.2.2 skrll IPSECCTL_DEF_ESP_NETLEV, CTL_EOL); 423 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 424 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READONLY, 425 1.11.2.2 skrll CTLTYPE_STRUCT, "esp_stats", NULL, 426 1.11.2.2 skrll NULL, 0, &espstat, sizeof(espstat), 427 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_ESP, 428 1.11.2.2 skrll CTL_CREATE, CTL_EOL); 429 1.11.2.2 skrll 430 1.11.2.2 skrll /* create net.inet.ah subtree under IPPROTO_AH */ 431 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 432 1.11.2.2 skrll CTLFLAG_PERMANENT, 433 1.11.2.2 skrll CTLTYPE_NODE, "ah", NULL, 434 1.11.2.2 skrll NULL, 0, NULL, 0, 435 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, CTL_EOL); 436 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 437 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 438 1.11.2.2 skrll CTLTYPE_INT, "cleartos", NULL, 439 1.11.2.2 skrll NULL, 0, &/*ip4_*/ah_cleartos, 0, 440 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, 441 1.11.2.2 skrll IPSECCTL_AH_CLEARTOS, CTL_EOL); 442 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 443 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 444 1.11.2.2 skrll CTLTYPE_INT, "offsetmask", NULL, 445 1.11.2.2 skrll NULL, 0, &ip4_ah_offsetmask, 0, 446 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, 447 1.11.2.2 skrll IPSECCTL_AH_OFFSETMASK, CTL_EOL); 448 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 449 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 450 1.11.2.2 skrll CTLTYPE_INT, "trans_deflev", NULL, 451 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_ah_trans_deflev, 0, 452 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, 453 1.11.2.2 skrll IPSECCTL_DEF_AH_TRANSLEV, CTL_EOL); 454 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 455 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 456 1.11.2.2 skrll CTLTYPE_INT, "net_deflev", NULL, 457 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_ah_net_deflev, 0, 458 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, 459 1.11.2.2 skrll IPSECCTL_DEF_AH_NETLEV, CTL_EOL); 460 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 461 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READONLY, 462 1.11.2.2 skrll CTLTYPE_STRUCT, "ah_stats", NULL, 463 1.11.2.2 skrll NULL, 0, &ahstat, sizeof(ahstat), 464 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_AH, 465 1.11.2.2 skrll CTL_CREATE, CTL_EOL); 466 1.11.2.2 skrll 467 1.11.2.2 skrll /* create net.inet.ipcomp */ 468 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 469 1.11.2.2 skrll CTLFLAG_PERMANENT, 470 1.11.2.2 skrll CTLTYPE_NODE, "ipcomp", NULL, 471 1.11.2.2 skrll NULL, 0, NULL, 0, 472 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_IPCOMP, CTL_EOL); 473 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 474 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READONLY, 475 1.11.2.2 skrll CTLTYPE_STRUCT, "ipcomp_stats", NULL, 476 1.11.2.2 skrll NULL, 0, &ipcompstat, sizeof(ipcompstat), 477 1.11.2.2 skrll CTL_NET, PF_INET, IPPROTO_IPCOMP, 478 1.11.2.2 skrll CTL_CREATE, CTL_EOL); 479 1.11.2.2 skrll 480 1.11.2.2 skrll /* create net.inet.ipsec subtree under dynamic oid */ 481 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, &_ipsec, 482 1.11.2.2 skrll CTLFLAG_PERMANENT, 483 1.11.2.2 skrll CTLTYPE_NODE, "ipsec", NULL, 484 1.11.2.2 skrll NULL, 0, NULL, 0, 485 1.11.2.2 skrll CTL_NET, PF_INET, CTL_CREATE, CTL_EOL); 486 1.11.2.2 skrll ipproto_ipsec = (_ipsec != NULL) ? _ipsec->sysctl_num : 0; 487 1.11.2.2 skrll 488 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 489 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 490 1.11.2.2 skrll CTLTYPE_INT, "def_policy", NULL, 491 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_def_policy.policy, 0, 492 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 493 1.11.2.2 skrll IPSECCTL_DEF_POLICY, CTL_EOL); 494 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 495 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 496 1.11.2.2 skrll CTLTYPE_INT, "esp_trans_deflev", NULL, 497 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_esp_trans_deflev, 0, 498 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 499 1.11.2.2 skrll IPSECCTL_DEF_ESP_TRANSLEV, CTL_EOL); 500 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 501 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 502 1.11.2.2 skrll CTLTYPE_INT, "esp_net_deflev", NULL, 503 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_esp_net_deflev, 0, 504 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 505 1.11.2.2 skrll IPSECCTL_DEF_ESP_NETLEV, CTL_EOL); 506 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 507 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 508 1.11.2.2 skrll CTLTYPE_INT, "ah_trans_deflev", NULL, 509 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_ah_trans_deflev, 0, 510 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 511 1.11.2.2 skrll IPSECCTL_DEF_AH_TRANSLEV, CTL_EOL); 512 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 513 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 514 1.11.2.2 skrll CTLTYPE_INT, "ah_net_deflev", NULL, 515 1.11.2.2 skrll sysctl_fast_ipsec, 0, &ip4_ah_net_deflev, 0, 516 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 517 1.11.2.2 skrll IPSECCTL_DEF_AH_NETLEV, CTL_EOL); 518 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 519 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 520 1.11.2.2 skrll CTLTYPE_INT, "ah_cleartos", NULL, 521 1.11.2.2 skrll NULL, 0, &/*ip4_*/ah_cleartos, 0, 522 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 523 1.11.2.2 skrll IPSECCTL_AH_CLEARTOS, CTL_EOL); 524 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 525 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 526 1.11.2.2 skrll CTLTYPE_INT, "ah_offsetmask", NULL, 527 1.11.2.2 skrll NULL, 0, &ip4_ah_offsetmask, 0, 528 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 529 1.11.2.2 skrll IPSECCTL_AH_OFFSETMASK, CTL_EOL); 530 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 531 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 532 1.11.2.2 skrll CTLTYPE_INT, "dfbit", NULL, 533 1.11.2.2 skrll NULL, 0, &ip4_ipsec_dfbit, 0, 534 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 535 1.11.2.2 skrll IPSECCTL_DFBIT, CTL_EOL); 536 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 537 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 538 1.11.2.2 skrll CTLTYPE_INT, "ecn", NULL, 539 1.11.2.2 skrll NULL, 0, &ip4_ipsec_ecn, 0, 540 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 541 1.11.2.2 skrll IPSECCTL_ECN, CTL_EOL); 542 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 543 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 544 1.11.2.2 skrll CTLTYPE_INT, "debug", NULL, 545 1.11.2.2 skrll NULL, 0, &ipsec_debug, 0, 546 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 547 1.11.2.2 skrll IPSECCTL_DEBUG, CTL_EOL); 548 1.11.2.2 skrll sysctl_createv(clog, 0, NULL, NULL, 549 1.11.2.2 skrll CTLFLAG_PERMANENT|CTLFLAG_READONLY, 550 1.11.2.2 skrll CTLTYPE_STRUCT, "ipsecstats", NULL, 551 1.11.2.2 skrll NULL, 0, &ipsecstat, sizeof(ipsecstat), 552 1.11.2.2 skrll CTL_NET, PF_INET, ipproto_ipsec, 553 1.11.2.2 skrll CTL_CREATE, CTL_EOL); 554 1.11.2.2 skrll } 555
Indexes created Fri Sep 26 20:09:58 GMT 2025