summaryrefslogtreecommitdiff
path: root/sys/netinet
diff options
context:
space:
mode:
Diffstat (limited to 'sys/netinet')
-rw-r--r--sys/netinet/in.h41
-rw-r--r--sys/netinet/in_proto.c15
-rw-r--r--sys/netinet/ip_ah.c47
-rw-r--r--sys/netinet/ip_ah.h20
-rw-r--r--sys/netinet/ip_esp.c47
-rw-r--r--sys/netinet/ip_esp.h20
-rw-r--r--sys/netinet/ip_input.c5
-rw-r--r--sys/netinet/ip_ipsp.h20
-rw-r--r--sys/netinet/ip_output.c27
9 files changed, 192 insertions, 50 deletions
diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index 089d5e40dcb..24553dff5a6 100644
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: in.h,v 1.22 1999/04/09 23:28:44 niklas Exp $ */
+/* $OpenBSD: in.h,v 1.23 1999/04/11 19:41:36 niklas Exp $ */
/* $NetBSD: in.h,v 1.20 1996/02/13 23:41:47 christos Exp $ */
/*
@@ -456,7 +456,7 @@ struct in6_pktinfo {
* Third level is protocol number.
* Fourth level is desired variable within that protocol.
*/
-#define IPPROTO_MAXID (IPPROTO_IDP + 1) /* don't list to IPPROTO_MAX */
+#define IPPROTO_MAXID (IPPROTO_AH + 1) /* don't list to IPPROTO_MAX */
#define CTL_IPPROTO_NAMES { \
{ "ip", CTLTYPE_NODE }, \
@@ -481,7 +481,36 @@ struct in6_pktinfo {
{ 0, 0 }, \
{ 0, 0 }, \
{ 0, 0 }, \
- { "idp", CTLTYPE_NODE }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { 0, 0 }, \
+ { "esp", CTLTYPE_NODE }, \
+ { "ah", CTLTYPE_NODE }, \
}
/*
@@ -500,14 +529,15 @@ struct in6_pktinfo {
#define IPCTL_IPPORT_HIFIRSTAUTO 9
#define IPCTL_IPPORT_HILASTAUTO 10
#define IPCTL_IPPORT_MAXQUEUE 11
-#define IPCTL_MAXID 12
+#define IPCTL_ENCDEBUG 12
+#define IPCTL_MAXID 13
#define IPCTL_NAMES { \
{ 0, 0 }, \
{ "forwarding", CTLTYPE_INT }, \
{ "redirect", CTLTYPE_INT }, \
{ "ttl", CTLTYPE_INT }, \
- { "mtu", CTLTYPE_INT }, \
+ /* { "mtu", CTLTYPE_INT }, */ { 0, 0 }, \
{ "sourceroute", CTLTYPE_INT }, \
{ "directed-broadcast", CTLTYPE_INT }, \
{ "portfirst", CTLTYPE_INT }, \
@@ -515,6 +545,7 @@ struct in6_pktinfo {
{ "porthifirst", CTLTYPE_INT }, \
{ "porthilast", CTLTYPE_INT }, \
{ "maxqueue", CTLTYPE_INT }, \
+ { "encdebug", CTLTYPE_INT }, \
}
#ifndef _KERNEL
diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c
index 7e9abf88109..9fe63585053 100644
--- a/sys/netinet/in_proto.c
+++ b/sys/netinet/in_proto.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: in_proto.c,v 1.12 1999/04/09 23:28:45 niklas Exp $ */
+/* $OpenBSD: in_proto.c,v 1.13 1999/04/11 19:41:36 niklas Exp $ */
/* $NetBSD: in_proto.c,v 1.14 1996/02/18 18:58:32 christos Exp $ */
/*
@@ -112,14 +112,9 @@ void iplinit __P((void));
#ifdef IPSEC
#include <netinet/ip_ipsp.h>
+#include <netinet/ip_ah.h>
+#include <netinet/ip_esp.h>
#include <netinet/ip_ip4.h>
-
-extern void ah_input __P((struct mbuf *, ...));
-extern void esp_input __P((struct mbuf *, ...));
-extern int ah_output __P((struct mbuf *, struct sockaddr_encap *,
- struct tdb *, struct mbuf **));
-extern int esp_output __P((struct mbuf *, struct sockaddr_encap *,
- struct tdb *, struct mbuf **));
#endif
extern struct domain inetdomain;
@@ -201,12 +196,12 @@ struct protosw inetsw[] = {
{ SOCK_RAW, &inetdomain, IPPROTO_AH, PR_ATOMIC|PR_ADDR,
ah_input, rip_output, 0, rip_ctloutput,
rip_usrreq,
- 0, 0, 0, 0,
+ 0, 0, 0, 0, ah_sysctl
},
{ SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR,
esp_input, rip_output, 0, rip_ctloutput,
rip_usrreq,
- 0, 0, 0, 0,
+ 0, 0, 0, 0, esp_sysctl
},
#endif
#ifdef INET6
diff --git a/sys/netinet/ip_ah.c b/sys/netinet/ip_ah.c
index 5045c72c441..5ae21da75fe 100644
--- a/sys/netinet/ip_ah.c
+++ b/sys/netinet/ip_ah.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ah.c,v 1.20 1999/04/09 22:27:54 niklas Exp $ */
+/* $OpenBSD: ip_ah.c,v 1.21 1999/04/11 19:41:36 niklas Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
@@ -47,6 +47,7 @@
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/socket.h>
+#include <sys/sysctl.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/kernel.h>
@@ -82,15 +83,21 @@ extern struct ifnet enc_softc;
#define DPRINTF(x)
#endif
-void ah_input __P((struct mbuf *, int));
+int ah_enable = 0;
/*
* ah_input gets called when we receive an packet with an AH.
*/
void
-ah_input(register struct mbuf *m, int iphlen)
+#if __STDC__
+ah_input(struct mbuf *m, ...)
+#else
+ah_input(m, va_alist)
+ register struct mbuf *m;
+#endif
{
+ int iphlen;
union sockaddr_union sunion;
struct ifqueue *ifq = NULL;
struct ah_old *ahp, ahn;
@@ -98,9 +105,21 @@ ah_input(register struct mbuf *m, int iphlen)
struct ip *ipo, ipn;
struct tdb *tdbp;
int s;
+ va_list ap;
+ va_start(ap, m);
+ iphlen = va_arg(ap, int);
+ va_end(ap);
+
ahstat.ahs_input++;
+ if (!ah_enable)
+ {
+ m_freem(m);
+ ahstat.ahs_pdrops++;
+ return;
+ }
+
/*
* Make sure that at least the fixed part of the AH header is
* in the first mbuf.
@@ -317,3 +336,25 @@ ah_input(register struct mbuf *m, int iphlen)
splx(s);
return;
}
+
+int
+ah_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
+ int *name;
+ u_int namelen;
+ void *oldp;
+ size_t *oldlenp;
+ void *newp;
+ size_t newlen;
+{
+ /* All sysctl names at this level are terminal. */
+ if (namelen != 1)
+ return (ENOTDIR);
+
+ switch (name[0]) {
+ case AHCTL_ENABLE:
+ return (sysctl_int(oldp, oldlenp, newp, newlen, &ah_enable));
+ default:
+ return (ENOPROTOOPT);
+ }
+ /* NOTREACHED */
+}
diff --git a/sys/netinet/ip_ah.h b/sys/netinet/ip_ah.h
index 0f4f48d8011..2bf947df5c3 100644
--- a/sys/netinet/ip_ah.h
+++ b/sys/netinet/ip_ah.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ah.h,v 1.15 1999/02/24 23:45:47 angelos Exp $ */
+/* $OpenBSD: ip_ah.h,v 1.16 1999/04/11 19:41:37 niklas Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
@@ -68,6 +68,7 @@ struct ahstat
u_int64_t ahs_ibytes; /* input bytes */
u_int64_t ahs_obytes; /* output bytes */
u_int32_t ahs_toobig; /* packet got larger than IP_MAXPACKET */
+ u_int32_t ahs_pdrops; /* packet blocked due to policy */
};
struct ah_new
@@ -82,6 +83,23 @@ struct ah_new
#define AH_NEW_FLENGTH (sizeof(struct ah_new))
+/*
+ * Names for AH sysctl objects
+ */
+#define AHCTL_ENABLE 1 /* Enable AH processing */
+#define AHCTL_MAXID 2
+
+#define AHCTL_NAMES { \
+ { 0, 0 }, \
+ { "enable", CTLTYPE_INT }, \
+}
+
#ifdef _KERNEL
+void ah_input __P((struct mbuf *, ...));
+int ah_output __P((struct mbuf *, struct sockaddr_encap *,
+ struct tdb *, struct mbuf **));
+int ah_sysctl __P((int *, u_int, void *, size_t *, void *, size_t));
+
+extern int ah_enable;
struct ahstat ahstat;
#endif /* _KERNEL */
diff --git a/sys/netinet/ip_esp.c b/sys/netinet/ip_esp.c
index b99460802e1..a09c76481e4 100644
--- a/sys/netinet/ip_esp.c
+++ b/sys/netinet/ip_esp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_esp.c,v 1.20 1999/04/09 22:27:53 niklas Exp $ */
+/* $OpenBSD: ip_esp.c,v 1.21 1999/04/11 19:41:37 niklas Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
@@ -47,6 +47,7 @@
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/socket.h>
+#include <sys/sysctl.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/kernel.h>
@@ -82,15 +83,21 @@ extern struct ifnet enc_softc;
#define DPRINTF(x)
#endif
-void esp_input __P((struct mbuf *, int));
+int esp_enable = 0;
/*
* esp_input gets called when we receive an packet with an ESP.
*/
void
-esp_input(register struct mbuf *m, int iphlen)
+#if __STDC__
+esp_input(struct mbuf *m, ...)
+#else
+esp_input(m, va_alist)
+ register struct mbuf *m;
+#endif
{
+ int iphlen;
union sockaddr_union sunion;
struct ifqueue *ifq = NULL;
struct expiration *exp;
@@ -98,9 +105,21 @@ esp_input(register struct mbuf *m, int iphlen)
struct tdb *tdbp;
u_int32_t spi;
int s;
+ va_list ap;
+ va_start(ap, m);
+ iphlen = va_arg(ap, int);
+ va_end(ap);
+
espstat.esps_input++;
+ if (!esp_enable)
+ {
+ m_freem(m);
+ espstat.esps_pdrops++;
+ return;
+ }
+
/*
* Make sure that at least the SPI is in the same mbuf
*/
@@ -316,3 +335,25 @@ esp_input(register struct mbuf *m, int iphlen)
splx(s);
return;
}
+
+int
+esp_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
+ int *name;
+ u_int namelen;
+ void *oldp;
+ size_t *oldlenp;
+ void *newp;
+ size_t newlen;
+{
+ /* All sysctl names at this level are terminal. */
+ if (namelen != 1)
+ return (ENOTDIR);
+
+ switch (name[0]) {
+ case ESPCTL_ENABLE:
+ return (sysctl_int(oldp, oldlenp, newp, newlen, &esp_enable));
+ default:
+ return (ENOPROTOOPT);
+ }
+ /* NOTREACHED */
+}
diff --git a/sys/netinet/ip_esp.h b/sys/netinet/ip_esp.h
index 1b4fe3323f3..6f9d9e76673 100644
--- a/sys/netinet/ip_esp.h
+++ b/sys/netinet/ip_esp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_esp.h,v 1.22 1999/02/24 23:45:49 angelos Exp $ */
+/* $OpenBSD: ip_esp.h,v 1.23 1999/04/11 19:41:38 niklas Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
@@ -76,8 +76,26 @@ struct espstat
u_int64_t esps_ibytes; /* input bytes */
u_int64_t esps_obytes; /* output bytes */
u_int32_t esps_toobig; /* packet got larger than IP_MAXPACKET */
+ u_int32_t esps_pdrops; /* packet blocked due to policy */
};
+/*
+ * Names for ESP sysctl objects
+ */
+#define ESPCTL_ENABLE 1 /* Enable ESP processing */
+#define ESPCTL_MAXID 2
+
+#define ESPCTL_NAMES { \
+ { 0, 0 }, \
+ { "enable", CTLTYPE_INT }, \
+}
+
#ifdef _KERNEL
+void esp_input __P((struct mbuf *, ...));
+int esp_output __P((struct mbuf *, struct sockaddr_encap *,
+ struct tdb *, struct mbuf **));
+int esp_sysctl __P((int *, u_int, void *, size_t *, void *, size_t));
+
+extern int esp_enable;
struct espstat espstat;
#endif /* _Kernel */
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index f7ada6e46ff..2e01890273c 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_input.c,v 1.37 1999/02/21 04:01:46 deraadt Exp $ */
+/* $OpenBSD: ip_input.c,v 1.38 1999/04/11 19:41:38 niklas Exp $ */
/* $NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $ */
/*
@@ -64,6 +64,7 @@
#include <netinet/in_var.h>
#include <netinet/ip_var.h>
#include <netinet/ip_icmp.h>
+#include <netinet/ip_ipsp.h>
#ifndef IPFORWARDING
#ifdef GATEWAY
@@ -1430,6 +1431,8 @@ ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
case IPCTL_IPPORT_MAXQUEUE:
return (sysctl_int(oldp, oldlenp, newp, newlen,
&ip_maxqueue));
+ case IPCTL_ENCDEBUG:
+ return (sysctl_int(oldp, oldlenp, newp, newlen, &encdebug));
default:
return (EOPNOTSUPP);
}
diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h
index e963410849f..f8016b565fb 100644
--- a/sys/netinet/ip_ipsp.h
+++ b/sys/netinet/ip_ipsp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ipsp.h,v 1.28 1999/03/27 21:04:19 provos Exp $ */
+/* $OpenBSD: ip_ipsp.h,v 1.29 1999/04/11 19:41:39 niklas Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
@@ -379,24 +379,6 @@ htonq(u_int64_t q)
#error "Please fix <machine/endian.h>"
#endif
-/*
- * Names for IPsec sysctl objects
- */
-#define IPSECCTL_PFKEY 0
-#define IPSECCTL_MAXID 1
-
-#define CTL_IPSEC_NAMES {\
- { "pfkey", CTLTYPE_NODE }, \
-}
-
-#define PFKEYCTL_ENCDEBUG 1
-#define PFKEYCTL_MAXID 2
-
-#define PFKEYCTL_NAMES {\
- { 0, 0 }, \
- { "encdebug", CTLTYPE_INT }, \
-}
-
#ifdef _KERNEL
extern int encdebug;
extern int ipsec_in_use;
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 0c0400c0c1a..2f74c801df4 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_output.c,v 1.44 1999/03/27 21:04:20 provos Exp $ */
+/* $OpenBSD: ip_output.c,v 1.45 1999/04/11 19:41:39 niklas Exp $ */
/* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */
/*
@@ -64,7 +64,8 @@
#include <machine/stdarg.h>
#ifdef IPSEC
-#include <netinet/ip_ipsp.h>
+#include <netinet/ip_ah.h>
+#include <netinet/ip_esp.h>
#include <netinet/udp.h>
#include <netinet/tcp.h>
@@ -167,14 +168,14 @@ ip_output(m0, va_alist)
/*
* Check if the packet needs encapsulation
*/
- if (!(flags & IP_ENCAPSULATED) &&
+ if (!(flags & IP_ENCAPSULATED) &&
(inp == NULL ||
- (inp->inp_seclevel[SL_AUTH] != IPSEC_LEVEL_BYPASS ||
- inp->inp_seclevel[SL_ESP_TRANS] != IPSEC_LEVEL_BYPASS ||
- inp->inp_seclevel[SL_ESP_NETWORK] != IPSEC_LEVEL_BYPASS))) {
+ inp->inp_seclevel[SL_AUTH] != IPSEC_LEVEL_BYPASS ||
+ inp->inp_seclevel[SL_ESP_TRANS] != IPSEC_LEVEL_BYPASS ||
+ inp->inp_seclevel[SL_ESP_NETWORK] != IPSEC_LEVEL_BYPASS)) {
struct route_enc re0, *re = &re0;
struct sockaddr_encap *ddst, *gw;
- struct tdb *tdb;
+ struct tdb *tdb, *t;
u_int8_t sa_require, sa_have = 0;
if (inp == NULL)
@@ -318,6 +319,18 @@ ip_output(m0, va_alist)
goto done;
}
+ for (t = tdb; t != NULL; t = t->tdb_onext)
+ if ((t->tdb_sproto == IPPROTO_ESP && !esp_enable) ||
+ (t->tdb_sproto == IPPROTO_AH && !ah_enable)) {
+ DPRINTF(("ip_output(): IPSec outbound packet dropped due to policy\n"));
+
+ if (re->re_rt)
+ RTFREE(re->re_rt);
+ error = EHOSTUNREACH;
+ m_freem(m);
+ goto done;
+ }
+
/* Fix the ip_src field if necessary */
if (ip->ip_src.s_addr == INADDR_ANY) {
if (tdb && tdb->tdb_src.sin.sin_addr.s_addr != 0 &&