diff options
Diffstat (limited to 'sys/netinet')
-rw-r--r-- | sys/netinet/in.h | 41 | ||||
-rw-r--r-- | sys/netinet/in_proto.c | 15 | ||||
-rw-r--r-- | sys/netinet/ip_ah.c | 47 | ||||
-rw-r--r-- | sys/netinet/ip_ah.h | 20 | ||||
-rw-r--r-- | sys/netinet/ip_esp.c | 47 | ||||
-rw-r--r-- | sys/netinet/ip_esp.h | 20 | ||||
-rw-r--r-- | sys/netinet/ip_input.c | 5 | ||||
-rw-r--r-- | sys/netinet/ip_ipsp.h | 20 | ||||
-rw-r--r-- | sys/netinet/ip_output.c | 27 |
9 files changed, 192 insertions, 50 deletions
diff --git a/sys/netinet/in.h b/sys/netinet/in.h index 089d5e40dcb..24553dff5a6 100644 --- a/sys/netinet/in.h +++ b/sys/netinet/in.h @@ -1,4 +1,4 @@ -/* $OpenBSD: in.h,v 1.22 1999/04/09 23:28:44 niklas Exp $ */ +/* $OpenBSD: in.h,v 1.23 1999/04/11 19:41:36 niklas Exp $ */ /* $NetBSD: in.h,v 1.20 1996/02/13 23:41:47 christos Exp $ */ /* @@ -456,7 +456,7 @@ struct in6_pktinfo { * Third level is protocol number. * Fourth level is desired variable within that protocol. */ -#define IPPROTO_MAXID (IPPROTO_IDP + 1) /* don't list to IPPROTO_MAX */ +#define IPPROTO_MAXID (IPPROTO_AH + 1) /* don't list to IPPROTO_MAX */ #define CTL_IPPROTO_NAMES { \ { "ip", CTLTYPE_NODE }, \ @@ -481,7 +481,36 @@ struct in6_pktinfo { { 0, 0 }, \ { 0, 0 }, \ { 0, 0 }, \ - { "idp", CTLTYPE_NODE }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { 0, 0 }, \ + { "esp", CTLTYPE_NODE }, \ + { "ah", CTLTYPE_NODE }, \ } /* @@ -500,14 +529,15 @@ struct in6_pktinfo { #define IPCTL_IPPORT_HIFIRSTAUTO 9 #define IPCTL_IPPORT_HILASTAUTO 10 #define IPCTL_IPPORT_MAXQUEUE 11 -#define IPCTL_MAXID 12 +#define IPCTL_ENCDEBUG 12 +#define IPCTL_MAXID 13 #define IPCTL_NAMES { \ { 0, 0 }, \ { "forwarding", CTLTYPE_INT }, \ { "redirect", CTLTYPE_INT }, \ { "ttl", CTLTYPE_INT }, \ - { "mtu", CTLTYPE_INT }, \ + /* { "mtu", CTLTYPE_INT }, */ { 0, 0 }, \ { "sourceroute", CTLTYPE_INT }, \ { "directed-broadcast", CTLTYPE_INT }, \ { "portfirst", CTLTYPE_INT }, \ @@ -515,6 +545,7 @@ struct in6_pktinfo { { "porthifirst", CTLTYPE_INT }, \ { "porthilast", CTLTYPE_INT }, \ { "maxqueue", CTLTYPE_INT }, \ + { "encdebug", CTLTYPE_INT }, \ } #ifndef _KERNEL diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c index 7e9abf88109..9fe63585053 100644 --- a/sys/netinet/in_proto.c +++ b/sys/netinet/in_proto.c @@ -1,4 +1,4 @@ -/* $OpenBSD: in_proto.c,v 1.12 1999/04/09 23:28:45 niklas Exp $ */ +/* $OpenBSD: in_proto.c,v 1.13 1999/04/11 19:41:36 niklas Exp $ */ /* $NetBSD: in_proto.c,v 1.14 1996/02/18 18:58:32 christos Exp $ */ /* @@ -112,14 +112,9 @@ void iplinit __P((void)); #ifdef IPSEC #include <netinet/ip_ipsp.h> +#include <netinet/ip_ah.h> +#include <netinet/ip_esp.h> #include <netinet/ip_ip4.h> - -extern void ah_input __P((struct mbuf *, ...)); -extern void esp_input __P((struct mbuf *, ...)); -extern int ah_output __P((struct mbuf *, struct sockaddr_encap *, - struct tdb *, struct mbuf **)); -extern int esp_output __P((struct mbuf *, struct sockaddr_encap *, - struct tdb *, struct mbuf **)); #endif extern struct domain inetdomain; @@ -201,12 +196,12 @@ struct protosw inetsw[] = { { SOCK_RAW, &inetdomain, IPPROTO_AH, PR_ATOMIC|PR_ADDR, ah_input, rip_output, 0, rip_ctloutput, rip_usrreq, - 0, 0, 0, 0, + 0, 0, 0, 0, ah_sysctl }, { SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR, esp_input, rip_output, 0, rip_ctloutput, rip_usrreq, - 0, 0, 0, 0, + 0, 0, 0, 0, esp_sysctl }, #endif #ifdef INET6 diff --git a/sys/netinet/ip_ah.c b/sys/netinet/ip_ah.c index 5045c72c441..5ae21da75fe 100644 --- a/sys/netinet/ip_ah.c +++ b/sys/netinet/ip_ah.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ah.c,v 1.20 1999/04/09 22:27:54 niklas Exp $ */ +/* $OpenBSD: ip_ah.c,v 1.21 1999/04/11 19:41:36 niklas Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -47,6 +47,7 @@ #include <sys/domain.h> #include <sys/protosw.h> #include <sys/socket.h> +#include <sys/sysctl.h> #include <sys/errno.h> #include <sys/time.h> #include <sys/kernel.h> @@ -82,15 +83,21 @@ extern struct ifnet enc_softc; #define DPRINTF(x) #endif -void ah_input __P((struct mbuf *, int)); +int ah_enable = 0; /* * ah_input gets called when we receive an packet with an AH. */ void -ah_input(register struct mbuf *m, int iphlen) +#if __STDC__ +ah_input(struct mbuf *m, ...) +#else +ah_input(m, va_alist) + register struct mbuf *m; +#endif { + int iphlen; union sockaddr_union sunion; struct ifqueue *ifq = NULL; struct ah_old *ahp, ahn; @@ -98,9 +105,21 @@ ah_input(register struct mbuf *m, int iphlen) struct ip *ipo, ipn; struct tdb *tdbp; int s; + va_list ap; + va_start(ap, m); + iphlen = va_arg(ap, int); + va_end(ap); + ahstat.ahs_input++; + if (!ah_enable) + { + m_freem(m); + ahstat.ahs_pdrops++; + return; + } + /* * Make sure that at least the fixed part of the AH header is * in the first mbuf. @@ -317,3 +336,25 @@ ah_input(register struct mbuf *m, int iphlen) splx(s); return; } + +int +ah_sysctl(name, namelen, oldp, oldlenp, newp, newlen) + int *name; + u_int namelen; + void *oldp; + size_t *oldlenp; + void *newp; + size_t newlen; +{ + /* All sysctl names at this level are terminal. */ + if (namelen != 1) + return (ENOTDIR); + + switch (name[0]) { + case AHCTL_ENABLE: + return (sysctl_int(oldp, oldlenp, newp, newlen, &ah_enable)); + default: + return (ENOPROTOOPT); + } + /* NOTREACHED */ +} diff --git a/sys/netinet/ip_ah.h b/sys/netinet/ip_ah.h index 0f4f48d8011..2bf947df5c3 100644 --- a/sys/netinet/ip_ah.h +++ b/sys/netinet/ip_ah.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ah.h,v 1.15 1999/02/24 23:45:47 angelos Exp $ */ +/* $OpenBSD: ip_ah.h,v 1.16 1999/04/11 19:41:37 niklas Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -68,6 +68,7 @@ struct ahstat u_int64_t ahs_ibytes; /* input bytes */ u_int64_t ahs_obytes; /* output bytes */ u_int32_t ahs_toobig; /* packet got larger than IP_MAXPACKET */ + u_int32_t ahs_pdrops; /* packet blocked due to policy */ }; struct ah_new @@ -82,6 +83,23 @@ struct ah_new #define AH_NEW_FLENGTH (sizeof(struct ah_new)) +/* + * Names for AH sysctl objects + */ +#define AHCTL_ENABLE 1 /* Enable AH processing */ +#define AHCTL_MAXID 2 + +#define AHCTL_NAMES { \ + { 0, 0 }, \ + { "enable", CTLTYPE_INT }, \ +} + #ifdef _KERNEL +void ah_input __P((struct mbuf *, ...)); +int ah_output __P((struct mbuf *, struct sockaddr_encap *, + struct tdb *, struct mbuf **)); +int ah_sysctl __P((int *, u_int, void *, size_t *, void *, size_t)); + +extern int ah_enable; struct ahstat ahstat; #endif /* _KERNEL */ diff --git a/sys/netinet/ip_esp.c b/sys/netinet/ip_esp.c index b99460802e1..a09c76481e4 100644 --- a/sys/netinet/ip_esp.c +++ b/sys/netinet/ip_esp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_esp.c,v 1.20 1999/04/09 22:27:53 niklas Exp $ */ +/* $OpenBSD: ip_esp.c,v 1.21 1999/04/11 19:41:37 niklas Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -47,6 +47,7 @@ #include <sys/domain.h> #include <sys/protosw.h> #include <sys/socket.h> +#include <sys/sysctl.h> #include <sys/errno.h> #include <sys/time.h> #include <sys/kernel.h> @@ -82,15 +83,21 @@ extern struct ifnet enc_softc; #define DPRINTF(x) #endif -void esp_input __P((struct mbuf *, int)); +int esp_enable = 0; /* * esp_input gets called when we receive an packet with an ESP. */ void -esp_input(register struct mbuf *m, int iphlen) +#if __STDC__ +esp_input(struct mbuf *m, ...) +#else +esp_input(m, va_alist) + register struct mbuf *m; +#endif { + int iphlen; union sockaddr_union sunion; struct ifqueue *ifq = NULL; struct expiration *exp; @@ -98,9 +105,21 @@ esp_input(register struct mbuf *m, int iphlen) struct tdb *tdbp; u_int32_t spi; int s; + va_list ap; + va_start(ap, m); + iphlen = va_arg(ap, int); + va_end(ap); + espstat.esps_input++; + if (!esp_enable) + { + m_freem(m); + espstat.esps_pdrops++; + return; + } + /* * Make sure that at least the SPI is in the same mbuf */ @@ -316,3 +335,25 @@ esp_input(register struct mbuf *m, int iphlen) splx(s); return; } + +int +esp_sysctl(name, namelen, oldp, oldlenp, newp, newlen) + int *name; + u_int namelen; + void *oldp; + size_t *oldlenp; + void *newp; + size_t newlen; +{ + /* All sysctl names at this level are terminal. */ + if (namelen != 1) + return (ENOTDIR); + + switch (name[0]) { + case ESPCTL_ENABLE: + return (sysctl_int(oldp, oldlenp, newp, newlen, &esp_enable)); + default: + return (ENOPROTOOPT); + } + /* NOTREACHED */ +} diff --git a/sys/netinet/ip_esp.h b/sys/netinet/ip_esp.h index 1b4fe3323f3..6f9d9e76673 100644 --- a/sys/netinet/ip_esp.h +++ b/sys/netinet/ip_esp.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_esp.h,v 1.22 1999/02/24 23:45:49 angelos Exp $ */ +/* $OpenBSD: ip_esp.h,v 1.23 1999/04/11 19:41:38 niklas Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -76,8 +76,26 @@ struct espstat u_int64_t esps_ibytes; /* input bytes */ u_int64_t esps_obytes; /* output bytes */ u_int32_t esps_toobig; /* packet got larger than IP_MAXPACKET */ + u_int32_t esps_pdrops; /* packet blocked due to policy */ }; +/* + * Names for ESP sysctl objects + */ +#define ESPCTL_ENABLE 1 /* Enable ESP processing */ +#define ESPCTL_MAXID 2 + +#define ESPCTL_NAMES { \ + { 0, 0 }, \ + { "enable", CTLTYPE_INT }, \ +} + #ifdef _KERNEL +void esp_input __P((struct mbuf *, ...)); +int esp_output __P((struct mbuf *, struct sockaddr_encap *, + struct tdb *, struct mbuf **)); +int esp_sysctl __P((int *, u_int, void *, size_t *, void *, size_t)); + +extern int esp_enable; struct espstat espstat; #endif /* _Kernel */ diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index f7ada6e46ff..2e01890273c 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_input.c,v 1.37 1999/02/21 04:01:46 deraadt Exp $ */ +/* $OpenBSD: ip_input.c,v 1.38 1999/04/11 19:41:38 niklas Exp $ */ /* $NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $ */ /* @@ -64,6 +64,7 @@ #include <netinet/in_var.h> #include <netinet/ip_var.h> #include <netinet/ip_icmp.h> +#include <netinet/ip_ipsp.h> #ifndef IPFORWARDING #ifdef GATEWAY @@ -1430,6 +1431,8 @@ ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen) case IPCTL_IPPORT_MAXQUEUE: return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_maxqueue)); + case IPCTL_ENCDEBUG: + return (sysctl_int(oldp, oldlenp, newp, newlen, &encdebug)); default: return (EOPNOTSUPP); } diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h index e963410849f..f8016b565fb 100644 --- a/sys/netinet/ip_ipsp.h +++ b/sys/netinet/ip_ipsp.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_ipsp.h,v 1.28 1999/03/27 21:04:19 provos Exp $ */ +/* $OpenBSD: ip_ipsp.h,v 1.29 1999/04/11 19:41:39 niklas Exp $ */ /* * The authors of this code are John Ioannidis (ji@tla.org), @@ -379,24 +379,6 @@ htonq(u_int64_t q) #error "Please fix <machine/endian.h>" #endif -/* - * Names for IPsec sysctl objects - */ -#define IPSECCTL_PFKEY 0 -#define IPSECCTL_MAXID 1 - -#define CTL_IPSEC_NAMES {\ - { "pfkey", CTLTYPE_NODE }, \ -} - -#define PFKEYCTL_ENCDEBUG 1 -#define PFKEYCTL_MAXID 2 - -#define PFKEYCTL_NAMES {\ - { 0, 0 }, \ - { "encdebug", CTLTYPE_INT }, \ -} - #ifdef _KERNEL extern int encdebug; extern int ipsec_in_use; diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index 0c0400c0c1a..2f74c801df4 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.44 1999/03/27 21:04:20 provos Exp $ */ +/* $OpenBSD: ip_output.c,v 1.45 1999/04/11 19:41:39 niklas Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -64,7 +64,8 @@ #include <machine/stdarg.h> #ifdef IPSEC -#include <netinet/ip_ipsp.h> +#include <netinet/ip_ah.h> +#include <netinet/ip_esp.h> #include <netinet/udp.h> #include <netinet/tcp.h> @@ -167,14 +168,14 @@ ip_output(m0, va_alist) /* * Check if the packet needs encapsulation */ - if (!(flags & IP_ENCAPSULATED) && + if (!(flags & IP_ENCAPSULATED) && (inp == NULL || - (inp->inp_seclevel[SL_AUTH] != IPSEC_LEVEL_BYPASS || - inp->inp_seclevel[SL_ESP_TRANS] != IPSEC_LEVEL_BYPASS || - inp->inp_seclevel[SL_ESP_NETWORK] != IPSEC_LEVEL_BYPASS))) { + inp->inp_seclevel[SL_AUTH] != IPSEC_LEVEL_BYPASS || + inp->inp_seclevel[SL_ESP_TRANS] != IPSEC_LEVEL_BYPASS || + inp->inp_seclevel[SL_ESP_NETWORK] != IPSEC_LEVEL_BYPASS)) { struct route_enc re0, *re = &re0; struct sockaddr_encap *ddst, *gw; - struct tdb *tdb; + struct tdb *tdb, *t; u_int8_t sa_require, sa_have = 0; if (inp == NULL) @@ -318,6 +319,18 @@ ip_output(m0, va_alist) goto done; } + for (t = tdb; t != NULL; t = t->tdb_onext) + if ((t->tdb_sproto == IPPROTO_ESP && !esp_enable) || + (t->tdb_sproto == IPPROTO_AH && !ah_enable)) { + DPRINTF(("ip_output(): IPSec outbound packet dropped due to policy\n")); + + if (re->re_rt) + RTFREE(re->re_rt); + error = EHOSTUNREACH; + m_freem(m); + goto done; + } + /* Fix the ip_src field if necessary */ if (ip->ip_src.s_addr == INADDR_ANY) { if (tdb && tdb->tdb_src.sin.sin_addr.s_addr != 0 && |