2002-10-16 02:10:08 +00:00
|
|
|
/* $FreeBSD$ */
|
|
|
|
/* $KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $ */
|
|
|
|
|
2005-01-07 01:45:51 +00:00
|
|
|
/*-
|
2002-10-16 02:10:08 +00:00
|
|
|
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. Neither the name of the project nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IPsec controller part.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef _NETIPSEC_IPSEC_H_
|
|
|
|
#define _NETIPSEC_IPSEC_H_
|
|
|
|
|
|
|
|
#if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
|
|
|
|
#include "opt_inet.h"
|
|
|
|
#include "opt_ipsec.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <net/pfkeyv2.h>
|
|
|
|
#include <netipsec/keydb.h>
|
|
|
|
|
|
|
|
#ifdef _KERNEL
|
|
|
|
|
2008-05-17 04:00:11 +00:00
|
|
|
#define IPSEC_ASSERT(_c,_m) KASSERT(_c, _m)
|
|
|
|
|
|
|
|
#define IPSEC_IS_PRIVILEGED_SO(_so) \
|
|
|
|
((_so)->so_cred != NULL && \
|
|
|
|
priv_check_cred((_so)->so_cred, PRIV_NETINET_IPSEC, 0) \
|
|
|
|
== 0)
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
/*
|
|
|
|
* Security Policy Index
|
|
|
|
* Ensure that both address families in the "src" and "dst" are same.
|
|
|
|
* When the value of the ul_proto is ICMPv6, the port field in "src"
|
|
|
|
* specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
|
|
|
|
*/
|
|
|
|
struct secpolicyindex {
|
2009-09-06 07:30:21 +00:00
|
|
|
u_int8_t dir; /* direction of packet flow, see below */
|
2002-10-16 02:10:08 +00:00
|
|
|
union sockaddr_union src; /* IP src address for SP */
|
|
|
|
union sockaddr_union dst; /* IP dst address for SP */
|
|
|
|
u_int8_t prefs; /* prefix length in bits for src */
|
|
|
|
u_int8_t prefd; /* prefix length in bits for dst */
|
|
|
|
u_int16_t ul_proto; /* upper layer Protocol */
|
|
|
|
#ifdef notyet
|
|
|
|
uid_t uids;
|
|
|
|
uid_t uidd;
|
|
|
|
gid_t gids;
|
|
|
|
gid_t gidd;
|
|
|
|
#endif
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Security Policy Data Base */
|
|
|
|
struct secpolicy {
|
|
|
|
LIST_ENTRY(secpolicy) chain;
|
2003-09-01 05:35:55 +00:00
|
|
|
struct mtx lock;
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
u_int refcnt; /* reference count */
|
|
|
|
struct secpolicyindex spidx; /* selector */
|
|
|
|
u_int32_t id; /* It's unique number on the system. */
|
|
|
|
u_int state; /* 0: dead, others: alive */
|
|
|
|
#define IPSEC_SPSTATE_DEAD 0
|
|
|
|
#define IPSEC_SPSTATE_ALIVE 1
|
2003-09-29 22:57:43 +00:00
|
|
|
u_int16_t policy; /* policy_type per pfkeyv2.h */
|
|
|
|
u_int16_t scangen; /* scan generation # */
|
2002-10-16 02:10:08 +00:00
|
|
|
struct ipsecrequest *req;
|
|
|
|
/* pointer to the ipsec request tree, */
|
|
|
|
/* if policy == IPSEC else this value == NULL.*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* lifetime handler.
|
|
|
|
* the policy can be used without limitiation if both lifetime and
|
|
|
|
* validtime are zero.
|
|
|
|
* "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
|
|
|
|
* "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
|
|
|
|
*/
|
2003-09-29 22:57:43 +00:00
|
|
|
time_t created; /* time created the policy */
|
|
|
|
time_t lastused; /* updated every when kernel sends a packet */
|
2002-10-16 02:10:08 +00:00
|
|
|
long lifetime; /* duration of the lifetime of this policy */
|
|
|
|
long validtime; /* duration this policy is valid without use */
|
|
|
|
};
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
#define SECPOLICY_LOCK_INIT(_sp) \
|
|
|
|
mtx_init(&(_sp)->lock, "ipsec policy", NULL, MTX_DEF)
|
|
|
|
#define SECPOLICY_LOCK(_sp) mtx_lock(&(_sp)->lock)
|
|
|
|
#define SECPOLICY_UNLOCK(_sp) mtx_unlock(&(_sp)->lock)
|
|
|
|
#define SECPOLICY_LOCK_DESTROY(_sp) mtx_destroy(&(_sp)->lock)
|
|
|
|
#define SECPOLICY_LOCK_ASSERT(_sp) mtx_assert(&(_sp)->lock, MA_OWNED)
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
/* Request for IPsec */
|
|
|
|
struct ipsecrequest {
|
|
|
|
struct ipsecrequest *next;
|
|
|
|
/* pointer to next structure */
|
|
|
|
/* If NULL, it means the end of chain. */
|
|
|
|
struct secasindex saidx;/* hint for search proper SA */
|
|
|
|
/* if __ss_len == 0 then no address specified.*/
|
|
|
|
u_int level; /* IPsec level defined below. */
|
|
|
|
|
|
|
|
struct secasvar *sav; /* place holder of SA for use */
|
|
|
|
struct secpolicy *sp; /* back pointer to SP */
|
2011-03-31 15:23:32 +00:00
|
|
|
struct rwlock lock; /* to interlock updates */
|
2002-10-16 02:10:08 +00:00
|
|
|
};
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
/*
|
|
|
|
* Need recursion for when crypto callbacks happen directly,
|
|
|
|
* as in the case of software crypto. Need to look at how
|
|
|
|
* hard it is to remove this...
|
|
|
|
*/
|
|
|
|
#define IPSECREQUEST_LOCK_INIT(_isr) \
|
2011-03-31 15:23:32 +00:00
|
|
|
rw_init_flags(&(_isr)->lock, "ipsec request", RW_RECURSE)
|
|
|
|
#define IPSECREQUEST_LOCK(_isr) rw_rlock(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_UNLOCK(_isr) rw_runlock(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_WLOCK(_isr) rw_wlock(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_WUNLOCK(_isr) rw_wunlock(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_UPGRADE(_isr) rw_try_upgrade(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_DOWNGRADE(_isr) rw_downgrade(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_LOCK_DESTROY(_isr) rw_destroy(&(_isr)->lock)
|
|
|
|
#define IPSECREQUEST_LOCK_ASSERT(_isr) rw_assert(&(_isr)->lock, RA_LOCKED)
|
2003-09-29 22:57:43 +00:00
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
/* security policy in PCB */
|
|
|
|
struct inpcbpolicy {
|
|
|
|
struct secpolicy *sp_in;
|
|
|
|
struct secpolicy *sp_out;
|
|
|
|
int priv; /* privileged socket ? */
|
|
|
|
};
|
|
|
|
|
|
|
|
/* SP acquiring list table. */
|
|
|
|
struct secspacq {
|
|
|
|
LIST_ENTRY(secspacq) chain;
|
|
|
|
|
|
|
|
struct secpolicyindex spidx;
|
|
|
|
|
2003-09-29 22:57:43 +00:00
|
|
|
time_t created; /* for lifetime */
|
2002-10-16 02:10:08 +00:00
|
|
|
int count; /* for lifetime */
|
|
|
|
/* XXX: here is mbuf place holder to be sent ? */
|
|
|
|
};
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
|
|
|
|
/* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
|
|
|
|
#define IPSEC_PORT_ANY 0
|
|
|
|
#define IPSEC_ULPROTO_ANY 255
|
|
|
|
#define IPSEC_PROTO_ANY 255
|
|
|
|
|
|
|
|
/* mode of security protocol */
|
|
|
|
/* NOTE: DON'T use IPSEC_MODE_ANY at SPD. It's only use in SAD */
|
|
|
|
#define IPSEC_MODE_ANY 0 /* i.e. wildcard. */
|
|
|
|
#define IPSEC_MODE_TRANSPORT 1
|
|
|
|
#define IPSEC_MODE_TUNNEL 2
|
Initial import of RFC 2385 (TCP-MD5) digest support.
This is the first of two commits; bringing in the kernel support first.
This can be enabled by compiling a kernel with options TCP_SIGNATURE
and FAST_IPSEC.
For the uninitiated, this is a TCP option which provides for a means of
authenticating TCP sessions which came into being before IPSEC. It is
still relevant today, however, as it is used by many commercial router
vendors, particularly with BGP, and as such has become a requirement for
interconnect at many major Internet points of presence.
Several parts of the TCP and IP headers, including the segment payload,
are digested with MD5, including a shared secret. The PF_KEY interface
is used to manage the secrets using security associations in the SADB.
There is a limitation here in that as there is no way to map a TCP flow
per-port back to an SPI without polluting tcpcb or using the SPD; the
code to do the latter is unstable at this time. Therefore this code only
supports per-host keying granularity.
Whilst FAST_IPSEC is mutually exclusive with KAME IPSEC (and thus IPv6),
TCP_SIGNATURE applies only to IPv4. For the vast majority of prospective
users of this feature, this will not pose any problem.
This implementation is output-only; that is, the option is honoured when
responding to a host initiating a TCP session, but no effort is made
[yet] to authenticate inbound traffic. This is, however, sufficient to
interwork with Cisco equipment.
Tested with a Cisco 2501 running IOS 12.0(27), and Quagga 0.96.4 with
local patches. Patches for tcpdump to validate TCP-MD5 sessions are also
available from me upon request.
Sponsored by: sentex.net
2004-02-11 04:26:04 +00:00
|
|
|
#define IPSEC_MODE_TCPMD5 3 /* TCP MD5 mode */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Direction of security policy.
|
|
|
|
* NOTE: Since INVALID is used just as flag.
|
|
|
|
* The other are used for loop counter too.
|
|
|
|
*/
|
|
|
|
#define IPSEC_DIR_ANY 0
|
|
|
|
#define IPSEC_DIR_INBOUND 1
|
|
|
|
#define IPSEC_DIR_OUTBOUND 2
|
|
|
|
#define IPSEC_DIR_MAX 3
|
|
|
|
#define IPSEC_DIR_INVALID 4
|
|
|
|
|
|
|
|
/* Policy level */
|
|
|
|
/*
|
|
|
|
* IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
|
|
|
|
* DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
|
|
|
|
* DISCARD and NONE are allowed for system default.
|
|
|
|
*/
|
|
|
|
#define IPSEC_POLICY_DISCARD 0 /* discarding packet */
|
|
|
|
#define IPSEC_POLICY_NONE 1 /* through IPsec engine */
|
|
|
|
#define IPSEC_POLICY_IPSEC 2 /* do IPsec */
|
|
|
|
#define IPSEC_POLICY_ENTRUST 3 /* consulting SPD if present. */
|
|
|
|
#define IPSEC_POLICY_BYPASS 4 /* only for privileged socket. */
|
|
|
|
|
|
|
|
/* Security protocol level */
|
|
|
|
#define IPSEC_LEVEL_DEFAULT 0 /* reference to system default */
|
|
|
|
#define IPSEC_LEVEL_USE 1 /* use SA if present. */
|
|
|
|
#define IPSEC_LEVEL_REQUIRE 2 /* require SA. */
|
|
|
|
#define IPSEC_LEVEL_UNIQUE 3 /* unique SA. */
|
|
|
|
|
|
|
|
#define IPSEC_MANUAL_REQID_MAX 0x3fff
|
|
|
|
/*
|
|
|
|
* if security policy level == unique, this id
|
|
|
|
* indicate to a relative SA for use, else is
|
|
|
|
* zero.
|
|
|
|
* 1 - 0x3fff are reserved for manual keying.
|
|
|
|
* 0 are reserved for above reason. Others is
|
|
|
|
* for kernel use.
|
|
|
|
* Note that this id doesn't identify SA
|
|
|
|
* by only itself.
|
|
|
|
*/
|
|
|
|
#define IPSEC_REPLAYWSIZE 32
|
|
|
|
|
2007-07-01 11:41:27 +00:00
|
|
|
/* statistics for ipsec processing */
|
2002-10-16 02:10:08 +00:00
|
|
|
struct ipsecstat {
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t in_success; /* succeeded inbound process */
|
|
|
|
uint64_t in_polvio;
|
2002-10-16 02:10:08 +00:00
|
|
|
/* security policy violation for inbound process */
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t in_nosa; /* inbound SA is unavailable */
|
|
|
|
uint64_t in_inval; /* inbound processing failed due to EINVAL */
|
|
|
|
uint64_t in_nomem; /* inbound processing failed due to ENOBUFS */
|
|
|
|
uint64_t in_badspi; /* failed getting a SPI */
|
|
|
|
uint64_t in_ahreplay; /* AH replay check failed */
|
|
|
|
uint64_t in_espreplay; /* ESP replay check failed */
|
|
|
|
uint64_t in_ahauthsucc; /* AH authentication success */
|
|
|
|
uint64_t in_ahauthfail; /* AH authentication failure */
|
|
|
|
uint64_t in_espauthsucc; /* ESP authentication success */
|
|
|
|
uint64_t in_espauthfail; /* ESP authentication failure */
|
|
|
|
uint64_t in_esphist[256];
|
|
|
|
uint64_t in_ahhist[256];
|
|
|
|
uint64_t in_comphist[256];
|
|
|
|
uint64_t out_success; /* succeeded outbound process */
|
|
|
|
uint64_t out_polvio;
|
2002-10-16 02:10:08 +00:00
|
|
|
/* security policy violation for outbound process */
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t out_nosa; /* outbound SA is unavailable */
|
|
|
|
uint64_t out_inval; /* outbound process failed due to EINVAL */
|
|
|
|
uint64_t out_nomem; /* inbound processing failed due to ENOBUFS */
|
|
|
|
uint64_t out_noroute; /* there is no route */
|
|
|
|
uint64_t out_esphist[256];
|
|
|
|
uint64_t out_ahhist[256];
|
|
|
|
uint64_t out_comphist[256];
|
2004-01-27 17:42:57 +00:00
|
|
|
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t spdcachelookup;
|
|
|
|
uint64_t spdcachemiss;
|
2002-10-16 02:10:08 +00:00
|
|
|
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t ips_in_polvio; /* input: sec policy violation */
|
|
|
|
uint64_t ips_out_polvio; /* output: sec policy violation */
|
|
|
|
uint64_t ips_out_nosa; /* output: SA unavailable */
|
|
|
|
uint64_t ips_out_nomem; /* output: no memory available */
|
|
|
|
uint64_t ips_out_noroute; /* output: no route available */
|
|
|
|
uint64_t ips_out_inval; /* output: generic error */
|
|
|
|
uint64_t ips_out_bundlesa; /* output: bundled SA processed */
|
|
|
|
uint64_t ips_mbcoalesced; /* mbufs coalesced during clone */
|
|
|
|
uint64_t ips_clcoalesced; /* clusters coalesced during clone */
|
|
|
|
uint64_t ips_clcopied; /* clusters copied during clone */
|
|
|
|
uint64_t ips_mbinserted; /* mbufs inserted during makespace */
|
2002-10-16 02:10:08 +00:00
|
|
|
/*
|
|
|
|
* Temporary statistics for performance analysis.
|
|
|
|
*/
|
|
|
|
/* See where ESP/AH/IPCOMP header land in mbuf on input */
|
Prepare network statistics structures for migration to PCPU counters.
Use uint64_t as type for all fields of structures.
Changed structures: ahstat, arpstat, espstat, icmp6_ifstat, icmp6stat,
in6_ifstat, ip6stat, ipcompstat, ipipstat, ipsecstat, mrt6stat, mrtstat,
pfkeystat, pim6stat, pimstat, rip6stat, udpstat.
Discussed with: arch@
2013-07-09 09:32:06 +00:00
|
|
|
uint64_t ips_input_front;
|
|
|
|
uint64_t ips_input_middle;
|
|
|
|
uint64_t ips_input_end;
|
2002-10-16 02:10:08 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Definitions for IPsec & Key sysctl operations.
|
|
|
|
*/
|
|
|
|
/*
|
|
|
|
* Names for IPsec & Key sysctl objects
|
|
|
|
*/
|
|
|
|
#define IPSECCTL_STATS 1 /* stats */
|
|
|
|
#define IPSECCTL_DEF_POLICY 2
|
|
|
|
#define IPSECCTL_DEF_ESP_TRANSLEV 3 /* int; ESP transport mode */
|
|
|
|
#define IPSECCTL_DEF_ESP_NETLEV 4 /* int; ESP tunnel mode */
|
|
|
|
#define IPSECCTL_DEF_AH_TRANSLEV 5 /* int; AH transport mode */
|
|
|
|
#define IPSECCTL_DEF_AH_NETLEV 6 /* int; AH tunnel mode */
|
|
|
|
#if 0 /* obsolete, do not reuse */
|
|
|
|
#define IPSECCTL_INBOUND_CALL_IKE 7
|
|
|
|
#endif
|
|
|
|
#define IPSECCTL_AH_CLEARTOS 8
|
|
|
|
#define IPSECCTL_AH_OFFSETMASK 9
|
|
|
|
#define IPSECCTL_DFBIT 10
|
|
|
|
#define IPSECCTL_ECN 11
|
|
|
|
#define IPSECCTL_DEBUG 12
|
|
|
|
#define IPSECCTL_ESP_RANDPAD 13
|
|
|
|
#define IPSECCTL_MAXID 14
|
|
|
|
|
|
|
|
#define IPSECCTL_NAMES { \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ "def_policy", CTLTYPE_INT }, \
|
|
|
|
{ "esp_trans_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "esp_net_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "ah_trans_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "ah_net_deflev", CTLTYPE_INT }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ "ah_cleartos", CTLTYPE_INT }, \
|
|
|
|
{ "ah_offsetmask", CTLTYPE_INT }, \
|
|
|
|
{ "dfbit", CTLTYPE_INT }, \
|
|
|
|
{ "ecn", CTLTYPE_INT }, \
|
|
|
|
{ "debug", CTLTYPE_INT }, \
|
|
|
|
{ "esp_randpad", CTLTYPE_INT }, \
|
|
|
|
}
|
|
|
|
|
|
|
|
#define IPSEC6CTL_NAMES { \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ "def_policy", CTLTYPE_INT }, \
|
|
|
|
{ "esp_trans_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "esp_net_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "ah_trans_deflev", CTLTYPE_INT }, \
|
|
|
|
{ "ah_net_deflev", CTLTYPE_INT }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ 0, 0 }, \
|
|
|
|
{ "ecn", CTLTYPE_INT }, \
|
|
|
|
{ "debug", CTLTYPE_INT }, \
|
|
|
|
{ "esp_randpad", CTLTYPE_INT }, \
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef _KERNEL
|
|
|
|
struct ipsec_output_state {
|
|
|
|
struct mbuf *m;
|
|
|
|
struct route *ro;
|
|
|
|
struct sockaddr *dst;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct ipsec_history {
|
|
|
|
int ih_proto;
|
|
|
|
u_int32_t ih_spi;
|
|
|
|
};
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DECLARE(int, ipsec_debug);
|
2009-07-16 21:13:04 +00:00
|
|
|
#define V_ipsec_debug VNET(ipsec_debug)
|
2010-04-29 11:52:42 +00:00
|
|
|
|
|
|
|
#ifdef REGRESSION
|
|
|
|
VNET_DECLARE(int, ipsec_replay);
|
|
|
|
VNET_DECLARE(int, ipsec_integrity);
|
|
|
|
|
|
|
|
#define V_ipsec_replay VNET(ipsec_replay)
|
|
|
|
#define V_ipsec_integrity VNET(ipsec_integrity)
|
|
|
|
#endif
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DECLARE(struct ipsecstat, ipsec4stat);
|
2010-04-29 11:52:42 +00:00
|
|
|
VNET_DECLARE(struct secpolicy, ip4_def_policy);
|
|
|
|
VNET_DECLARE(int, ip4_esp_trans_deflev);
|
|
|
|
VNET_DECLARE(int, ip4_esp_net_deflev);
|
|
|
|
VNET_DECLARE(int, ip4_ah_trans_deflev);
|
|
|
|
VNET_DECLARE(int, ip4_ah_net_deflev);
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
VNET_DECLARE(int, ip4_ah_offsetmask);
|
|
|
|
VNET_DECLARE(int, ip4_ipsec_dfbit);
|
2010-04-29 11:52:42 +00:00
|
|
|
VNET_DECLARE(int, ip4_ipsec_ecn);
|
|
|
|
VNET_DECLARE(int, ip4_esp_randpad);
|
|
|
|
VNET_DECLARE(int, crypto_support);
|
|
|
|
|
2013-06-20 09:55:53 +00:00
|
|
|
#define IPSECSTAT_INC(name) V_ipsec4stat.name += 1
|
2010-04-29 11:52:42 +00:00
|
|
|
#define V_ipsec4stat VNET(ipsec4stat)
|
|
|
|
#define V_ip4_def_policy VNET(ip4_def_policy)
|
2009-07-16 21:13:04 +00:00
|
|
|
#define V_ip4_esp_trans_deflev VNET(ip4_esp_trans_deflev)
|
|
|
|
#define V_ip4_esp_net_deflev VNET(ip4_esp_net_deflev)
|
|
|
|
#define V_ip4_ah_trans_deflev VNET(ip4_ah_trans_deflev)
|
|
|
|
#define V_ip4_ah_net_deflev VNET(ip4_ah_net_deflev)
|
2010-04-29 11:52:42 +00:00
|
|
|
#define V_ip4_ah_offsetmask VNET(ip4_ah_offsetmask)
|
|
|
|
#define V_ip4_ipsec_dfbit VNET(ip4_ipsec_dfbit)
|
2009-07-16 21:13:04 +00:00
|
|
|
#define V_ip4_ipsec_ecn VNET(ip4_ipsec_ecn)
|
|
|
|
#define V_ip4_esp_randpad VNET(ip4_esp_randpad)
|
|
|
|
#define V_crypto_support VNET(crypto_support)
|
2002-10-16 02:10:08 +00:00
|
|
|
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
|
2002-10-16 02:10:08 +00:00
|
|
|
/* for openbsd compatibility */
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
|
2002-10-16 02:10:08 +00:00
|
|
|
|
2003-09-01 05:35:55 +00:00
|
|
|
extern struct ipsecrequest *ipsec_newisr(void);
|
|
|
|
extern void ipsec_delisr(struct ipsecrequest *);
|
|
|
|
|
2002-10-16 02:10:08 +00:00
|
|
|
struct tdb_ident;
|
|
|
|
extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
|
|
|
|
struct inpcb;
|
|
|
|
extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
|
|
|
|
int *, struct inpcb *));
|
|
|
|
extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
|
|
|
|
int, int *);
|
|
|
|
|
|
|
|
struct inpcb;
|
|
|
|
extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
|
|
|
|
extern int ipsec_copy_policy
|
|
|
|
__P((struct inpcbpolicy *, struct inpcbpolicy *));
|
|
|
|
extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
|
|
|
|
extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
extern int ipsec_set_policy __P((struct inpcb *inp, int optname,
|
2008-02-02 14:11:31 +00:00
|
|
|
caddr_t request, size_t len, struct ucred *cred));
|
2009-02-08 09:27:07 +00:00
|
|
|
extern int ipsec_get_policy __P((struct inpcb *inpcb, caddr_t request,
|
2002-10-16 02:10:08 +00:00
|
|
|
size_t len, struct mbuf **mp));
|
2008-11-27 10:43:08 +00:00
|
|
|
extern int ipsec_delete_pcbpolicy __P((struct inpcb *));
|
2002-10-16 02:10:08 +00:00
|
|
|
extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
|
|
|
|
|
|
|
|
struct secas;
|
|
|
|
struct tcpcb;
|
|
|
|
extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
|
|
|
|
extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
|
|
|
|
|
2009-02-08 09:27:07 +00:00
|
|
|
extern size_t ipsec_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
|
2002-10-16 02:10:08 +00:00
|
|
|
extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
|
|
|
|
|
|
|
|
union sockaddr_union;
|
|
|
|
extern char * ipsec_address(union sockaddr_union* sa);
|
|
|
|
extern const char *ipsec_logsastr __P((struct secasvar *));
|
|
|
|
|
|
|
|
extern void ipsec_dumpmbuf __P((struct mbuf *));
|
|
|
|
|
|
|
|
struct m_tag;
|
2002-11-08 23:37:50 +00:00
|
|
|
extern void ah4_input(struct mbuf *m, int off);
|
2003-09-29 22:57:43 +00:00
|
|
|
extern void ah4_ctlinput(int cmd, struct sockaddr *sa, void *);
|
2002-11-08 23:37:50 +00:00
|
|
|
extern void esp4_input(struct mbuf *m, int off);
|
2003-09-29 22:57:43 +00:00
|
|
|
extern void esp4_ctlinput(int cmd, struct sockaddr *sa, void *);
|
2002-11-08 23:37:50 +00:00
|
|
|
extern void ipcomp4_input(struct mbuf *m, int off);
|
2002-10-16 02:10:08 +00:00
|
|
|
extern int ipsec4_common_input(struct mbuf *m, ...);
|
|
|
|
extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
|
|
|
|
int skip, int protoff, struct m_tag *mt);
|
|
|
|
extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
|
|
|
|
int, int));
|
|
|
|
extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
|
|
|
|
|
|
|
|
extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
|
|
|
|
|
|
|
|
extern void m_checkalignment(const char* where, struct mbuf *m0,
|
|
|
|
int off, int len);
|
|
|
|
extern struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
|
|
|
|
extern caddr_t m_pad(struct mbuf *m, int n);
|
|
|
|
extern int m_striphdr(struct mbuf *m, int skip, int hlen);
|
2007-11-28 22:33:53 +00:00
|
|
|
|
|
|
|
#ifdef DEV_ENC
|
|
|
|
#define ENC_BEFORE 0x0001
|
|
|
|
#define ENC_AFTER 0x0002
|
|
|
|
#define ENC_IN 0x0100
|
|
|
|
#define ENC_OUT 0x0200
|
|
|
|
extern int ipsec_filter(struct mbuf **, int, int);
|
|
|
|
extern void ipsec_bpf(struct mbuf *, struct secasvar *, int, int);
|
|
|
|
#endif
|
2002-10-16 02:10:08 +00:00
|
|
|
#endif /* _KERNEL */
|
|
|
|
|
|
|
|
#ifndef _KERNEL
|
|
|
|
extern caddr_t ipsec_set_policy __P((char *, int));
|
|
|
|
extern int ipsec_get_policylen __P((caddr_t));
|
|
|
|
extern char *ipsec_dump_policy __P((caddr_t, char *));
|
|
|
|
|
|
|
|
extern const char *ipsec_strerror __P((void));
|
Step 1.5 of importing the network stack virtualization infrastructure
from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit
Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.
Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().
Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).
All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).
(*) netipsec/keysock.c did not validate depending on compile time options.
Implemented by: julian, bz, brooks, zec
Reviewed by: julian, bz, brooks, kris, rwatson, ...
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-10-02 15:37:58 +00:00
|
|
|
|
|
|
|
#endif /* ! KERNEL */
|
2002-10-16 02:10:08 +00:00
|
|
|
|
|
|
|
#endif /* _NETIPSEC_IPSEC_H_ */
|