merging changes from portability branch back to trunk
important change for developers: %Y replaces %D to print identities!
This commit is contained in:
Tobias Brunner
@@ -1,13 +1,10 @@
|
||||
noinst_LIBRARIES = libfreeswan.a
|
||||
libfreeswan_a_SOURCES = addrtoa.c addrtot.c addrtypeof.c anyaddr.c atoaddr.c atoasr.c \
|
||||
atosa.c atosubnet.c atoul.c copyright.c datatot.c freeswan.h \
|
||||
goodmask.c initaddr.c initsaid.c initsubnet.c internal.h ipcomp.h \
|
||||
ipsec_ah.h ipsec_alg.h ipsec_encap.h ipsec_eroute.h ipsec_errs.h \
|
||||
ipsec_esp.h ipsec_ipe4.h ipsec_kversion.h ipsec_life.h ipsec_md5h.h \
|
||||
ipsec_param.h ipsec_policy.h ipsec_proto.h ipsec_radij.h ipsec_rcv.h \
|
||||
ipsec_sa.h ipsec_sha1.h ipsec_stats.h ipsec_tunnel.h ipsec_xform.h \
|
||||
ipsec_xmit.h keyblobtoid.c optionsfrom.c pfkey_v2_build.c pfkey_v2_debug.c \
|
||||
pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c prng.c radij.h rangetoa.c \
|
||||
goodmask.c initaddr.c initsaid.c initsubnet.c internal.h \
|
||||
ipsec_param.h ipsec_policy.h \
|
||||
keyblobtoid.c optionsfrom.c pfkey_v2_build.c pfkey_v2_debug.c \
|
||||
pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c prng.c rangetoa.c \
|
||||
pfkey.h pfkeyv2.h rangetosubnet.c sameaddr.c satoa.c \
|
||||
satot.c subnetof.c subnettoa.c subnettot.c \
|
||||
subnettypeof.c ttoaddr.c ttodata.c ttoprotoport.c ttosa.c ttosubnet.c ttoul.c \
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -18,19 +18,7 @@
|
||||
*/
|
||||
#define _FREESWAN_H /* seen it, no need to see it again */
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* We've just got to have some datatypes defined... And annoyingly, just
|
||||
* where we get them depends on whether we're in userland or not.
|
||||
*/
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/types.h>
|
||||
# include <linux/in.h>
|
||||
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <sys/types.h>
|
||||
# include <stdio.h>
|
||||
# include <netinet/in.h>
|
||||
|
||||
@@ -41,25 +29,13 @@
|
||||
|
||||
# define DEBUG_NO_STATIC static
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#include <ipsec_param.h>
|
||||
#include <utils.h>
|
||||
|
||||
/*
|
||||
* Grab the kernel version to see if we have NET_21, and therefore
|
||||
* IPv6. Some of this is repeated from ipsec_kversions.h. Of course,
|
||||
* we aren't really testing if the kernel has IPv6, but rather if the
|
||||
* the include files do.
|
||||
* We assume header files have IPv6 (i.e. kernel version >= 2.1.0)
|
||||
*/
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
|
||||
#define NET_21
|
||||
#endif
|
||||
|
||||
#ifndef IPPROTO_COMP
|
||||
# define IPPROTO_COMP 108
|
||||
@@ -84,28 +60,6 @@
|
||||
* use their definitions directly, they are subject to change!
|
||||
*/
|
||||
|
||||
/* first, some quick fakes in case we're on an old system with no IPv6 */
|
||||
#ifndef s6_addr16
|
||||
struct in6_addr {
|
||||
union
|
||||
{
|
||||
__u8 u6_addr8[16];
|
||||
__u16 u6_addr16[8];
|
||||
__u32 u6_addr32[4];
|
||||
} in6_u;
|
||||
#define s6_addr in6_u.u6_addr8
|
||||
#define s6_addr16 in6_u.u6_addr16
|
||||
#define s6_addr32 in6_u.u6_addr32
|
||||
};
|
||||
struct sockaddr_in6 {
|
||||
unsigned short int sin6_family; /* AF_INET6 */
|
||||
__u16 sin6_port; /* Transport layer port # */
|
||||
__u32 sin6_flowinfo; /* IPv6 flow information */
|
||||
struct in6_addr sin6_addr; /* IPv6 address */
|
||||
__u32 sin6_scope_id; /* scope id (new in RFC2553) */
|
||||
};
|
||||
#endif /* !s6_addr16 */
|
||||
|
||||
/* then the main types */
|
||||
typedef struct {
|
||||
union {
|
||||
@@ -119,11 +73,7 @@ typedef struct {
|
||||
} ip_subnet;
|
||||
|
||||
/* and the SA ID stuff */
|
||||
#ifdef __KERNEL__
|
||||
typedef __u32 ipsec_spi_t;
|
||||
#else
|
||||
typedef u_int32_t ipsec_spi_t;
|
||||
#endif
|
||||
typedef struct { /* to identify an SA, we need: */
|
||||
ip_address dst; /* A. destination host */
|
||||
ipsec_spi_t spi; /* B. 32-bit SPI, assigned by dest. host */
|
||||
@@ -159,6 +109,8 @@ struct prng { /* pseudo-random-number-generator guts */
|
||||
*/
|
||||
typedef uint32_t IPsecSAref_t;
|
||||
|
||||
#define IPSEC_SA_REF_TABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)
|
||||
|
||||
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
|
||||
|
||||
#define IPsecSAref2NFmark(x) ((x) << (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
|
||||
@@ -441,11 +393,9 @@ bitstomask(
|
||||
* general utilities
|
||||
*/
|
||||
|
||||
#ifndef __KERNEL__
|
||||
/* option pickup from files (userland only because of use of FILE) */
|
||||
/* option pickup from files */
|
||||
const char *optionsfrom(const char *filename, int *argcp, char ***argvp,
|
||||
int optind, FILE *errorreport);
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Debugging levels for pfkey_lib_debug
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -35,47 +35,14 @@
|
||||
#define PASSTHROUGHDST 0
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Headers, greatly complicated by stupid and unnecessary inconsistencies
|
||||
* between the user environment and the kernel environment. These are done
|
||||
* here so that this mess need exist in only one place.
|
||||
*
|
||||
* It may seem like a -I or two could avoid most of this, but on closer
|
||||
* inspection it is not quite that easy.
|
||||
*/
|
||||
|
||||
/* things that need to come from one place or the other, depending */
|
||||
#ifdef __KERNEL__
|
||||
#include <linux/types.h>
|
||||
#include <linux/socket.h>
|
||||
#include <linux/in.h>
|
||||
#include <linux/string.h>
|
||||
#include <linux/ctype.h>
|
||||
#define assert(foo) /* nothing */
|
||||
#else
|
||||
#include <sys/types.h>
|
||||
#include <netinet/in.h>
|
||||
#include <string.h>
|
||||
#include <ctype.h>
|
||||
#include <assert.h>
|
||||
#endif
|
||||
|
||||
/* things that exist only in userland */
|
||||
#ifndef __KERNEL__
|
||||
|
||||
/* You'd think this would be okay in the kernel too -- it's just a */
|
||||
/* bunch of constants -- but no, in RH5.1 it screws up other things. */
|
||||
/* (Credit: Mike Warfield tracked this problem down. Thanks Mike!) */
|
||||
/* Fortunately, we don't need it in the kernel subset of the library. */
|
||||
#include <limits.h>
|
||||
|
||||
/* header files for things that should never be called in kernel */
|
||||
#include <netdb.h>
|
||||
|
||||
/* memory allocation, currently user-only, macro-ized just in case */
|
||||
#include <stdlib.h>
|
||||
#define MALLOC(n) malloc(n)
|
||||
#define FREE(p) free(p)
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
|
||||
@@ -1,61 +0,0 @@
|
||||
/*
|
||||
* IPCOMP zlib interface code.
|
||||
* Copyright (C) 2000 Svenning Soerensen <[email protected]>
|
||||
* Copyright (C) 2000, 2001 Richard Guy Briggs <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
|
||||
RCSID $Id$
|
||||
|
||||
*/
|
||||
|
||||
/* SSS */
|
||||
|
||||
#ifndef _IPCOMP_H
|
||||
#define _IPCOMP_H
|
||||
|
||||
/* Prefix all global deflate symbols with "ipcomp_" to avoid collisions with ppp_deflate & ext2comp */
|
||||
#ifndef IPCOMP_PREFIX
|
||||
#define IPCOMP_PREFIX
|
||||
#endif /* IPCOMP_PREFIX */
|
||||
|
||||
#ifndef IPPROTO_COMP
|
||||
#define IPPROTO_COMP 108
|
||||
#endif /* IPPROTO_COMP */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int sysctl_ipsec_debug_ipcomp;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
struct ipcomphdr { /* IPCOMP header */
|
||||
__u8 ipcomp_nh; /* Next header (protocol) */
|
||||
__u8 ipcomp_flags; /* Reserved, must be 0 */
|
||||
__u16 ipcomp_cpi; /* Compression Parameter Index */
|
||||
};
|
||||
|
||||
extern struct inet_protocol comp_protocol;
|
||||
extern int sysctl_ipsec_debug_ipcomp;
|
||||
|
||||
#define IPCOMP_UNCOMPRESSABLE 0x000000001
|
||||
#define IPCOMP_COMPRESSIONERROR 0x000000002
|
||||
#define IPCOMP_PARMERROR 0x000000004
|
||||
#define IPCOMP_DECOMPRESSIONERROR 0x000000008
|
||||
|
||||
#define IPCOMP_ADAPT_INITIAL_TRIES 8
|
||||
#define IPCOMP_ADAPT_INITIAL_SKIP 4
|
||||
#define IPCOMP_ADAPT_SUBSEQ_TRIES 2
|
||||
#define IPCOMP_ADAPT_SUBSEQ_SKIP 8
|
||||
|
||||
/* Function prototypes */
|
||||
struct sk_buff *skb_compress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
|
||||
struct sk_buff *skb_decompress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
|
||||
|
||||
#endif /* _IPCOMP_H */
|
||||
@@ -1,111 +0,0 @@
|
||||
/*
|
||||
* Authentication Header declarations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#include "ipsec_md5h.h"
|
||||
#include "ipsec_sha1.h"
|
||||
|
||||
#ifndef IPPROTO_AH
|
||||
#define IPPROTO_AH 51
|
||||
#endif /* IPPROTO_AH */
|
||||
|
||||
#define AH_FLENGTH 12 /* size of fixed part */
|
||||
#define AHMD5_KMAX 64 /* MD5 max 512 bits key */
|
||||
#define AHMD5_AMAX 12 /* MD5 96 bits of authenticator */
|
||||
|
||||
#define AHMD596_KLEN 16 /* MD5 128 bits key */
|
||||
#define AHSHA196_KLEN 20 /* SHA1 160 bits key */
|
||||
|
||||
#define AHMD596_ALEN 16 /* MD5 128 bits authentication length */
|
||||
#define AHSHA196_ALEN 20 /* SHA1 160 bits authentication length */
|
||||
|
||||
#define AHMD596_BLKLEN 64 /* MD5 block length */
|
||||
#define AHSHA196_BLKLEN 64 /* SHA1 block length */
|
||||
#define AHSHA2_256_BLKLEN 64 /* SHA2-256 block length */
|
||||
#define AHSHA2_384_BLKLEN 128 /* SHA2-384 block length (?) */
|
||||
#define AHSHA2_512_BLKLEN 128 /* SHA2-512 block length */
|
||||
|
||||
#define AH_BLKLEN_MAX 128 /* keep up to date! */
|
||||
|
||||
#define AH_AMAX AHSHA196_ALEN /* keep up to date! */
|
||||
#define AHHMAC_HASHLEN 12 /* authenticator length of 96bits */
|
||||
#define AHHMAC_RPLLEN 4 /* 32 bit replay counter */
|
||||
|
||||
#define DB_AH_PKTRX 0x0001
|
||||
#define DB_AH_PKTRX2 0x0002
|
||||
#define DB_AH_DMP 0x0004
|
||||
#define DB_AH_IPSA 0x0010
|
||||
#define DB_AH_XF 0x0020
|
||||
#define DB_AH_INAU 0x0040
|
||||
#define DB_AH_REPLAY 0x0100
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
/* General HMAC algorithm is described in RFC 2104 */
|
||||
|
||||
#define HMAC_IPAD 0x36
|
||||
#define HMAC_OPAD 0x5C
|
||||
|
||||
struct md5_ctx {
|
||||
MD5_CTX ictx; /* context after H(K XOR ipad) */
|
||||
MD5_CTX octx; /* context after H(K XOR opad) */
|
||||
};
|
||||
|
||||
struct sha1_ctx {
|
||||
SHA1_CTX ictx; /* context after H(K XOR ipad) */
|
||||
SHA1_CTX octx; /* context after H(K XOR opad) */
|
||||
};
|
||||
|
||||
struct auth_alg {
|
||||
void (*init)(void *ctx);
|
||||
void (*update)(void *ctx, unsigned char *bytes, __u32 len);
|
||||
void (*final)(unsigned char *hash, void *ctx);
|
||||
int hashlen;
|
||||
};
|
||||
|
||||
extern struct inet_protocol ah_protocol;
|
||||
|
||||
struct options;
|
||||
|
||||
extern int
|
||||
ah_rcv(struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
|
||||
struct ahhdr /* Generic AH header */
|
||||
{
|
||||
__u8 ah_nh; /* Next header (protocol) */
|
||||
__u8 ah_hl; /* AH length, in 32-bit words */
|
||||
__u16 ah_rv; /* reserved, must be 0 */
|
||||
__u32 ah_spi; /* Security Parameters Index */
|
||||
__u32 ah_rpl; /* Replay prevention */
|
||||
__u8 ah_data[AHHMAC_HASHLEN];/* Authentication hash */
|
||||
};
|
||||
#define AH_BASIC_LEN 8 /* basic AH header is 8 bytes, nh,hl,rv,spi
|
||||
* and the ah_hl, says how many bytes after that
|
||||
* to cover. */
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_ah;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
@@ -1,254 +0,0 @@
|
||||
/*
|
||||
* Modular extensions service and registration functions interface
|
||||
*
|
||||
* Author: JuanJo Ciarlante <[email protected]>
|
||||
*
|
||||
* $Id$
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
*/
|
||||
#ifndef IPSEC_ALG_H
|
||||
#define IPSEC_ALG_H
|
||||
|
||||
/*
|
||||
* gcc >= 3.2 has removed __FUNCTION__, replaced by C99 __func__
|
||||
* *BUT* its a compiler variable.
|
||||
*/
|
||||
#if (__GNUC__ >= 3)
|
||||
#ifndef __FUNCTION__
|
||||
#define __FUNCTION__ __func__
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* Version 0.8.1-0 */
|
||||
#define IPSEC_ALG_VERSION 0x00080100
|
||||
|
||||
#include <linux/types.h>
|
||||
#include <linux/list.h>
|
||||
#include <asm/atomic.h>
|
||||
/*
|
||||
* The following structs are used via pointers in ipsec_alg object to
|
||||
* avoid ipsec_alg.h coupling with freeswan headers, thus simplifying
|
||||
* module development
|
||||
*/
|
||||
struct ipsec_sa;
|
||||
struct esp;
|
||||
|
||||
/**************************************
|
||||
*
|
||||
* Main registration object
|
||||
*
|
||||
*************************************/
|
||||
#define IPSEC_ALG_VERSION_QUAD(v) \
|
||||
(v>>24),((v>>16)&0xff),((v>>8)&0xff),(v&0xff)
|
||||
/*
|
||||
* Main ipsec_alg objects: "OOPrograming wannabe"
|
||||
* Hierachy (carefully handled with _minimal_ cast'ing):
|
||||
*
|
||||
* ipsec_alg+
|
||||
* +->ipsec_alg_enc (ixt_alg_type=SADB_EXT_SUPPORTED_ENCRYPT)
|
||||
* +->ipsec_alg_auth (ixt_alg_type=SADB_EXT_SUPPORTED_AUTH)
|
||||
*/
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE object: struct ipsec_alg
|
||||
*
|
||||
***************************************************************/
|
||||
|
||||
/*
|
||||
* common part for every struct ipsec_alg_*
|
||||
* (sortof poor's man OOP)
|
||||
*/
|
||||
#define IPSEC_ALG_STRUCT_COMMON \
|
||||
unsigned ixt_version; /* only allow this version (or 'near')*/ \
|
||||
struct list_head ixt_list; /* dlinked list */ \
|
||||
struct module *ixt_module; /* THIS_MODULE */ \
|
||||
unsigned ixt_state; /* state flags */ \
|
||||
atomic_t ixt_refcnt; /* ref. count when pointed from ipsec_sa */ \
|
||||
char ixt_name[16]; /* descriptive short name, eg. "3des" */ \
|
||||
void *ixt_data; /* private for algo implementation */ \
|
||||
uint8_t ixt_blocksize; /* blocksize in bytes */ \
|
||||
\
|
||||
/* THIS IS A COPY of struct supported (lib/pfkey.h) \
|
||||
* please keep in sync until we migrate 'supported' stuff \
|
||||
* to ipsec_alg \
|
||||
*/ \
|
||||
uint16_t ixt_alg_type; /* correspond to IPSEC_ALG_{ENCRYPT,AUTH} */ \
|
||||
uint8_t ixt_alg_id; /* enc. alg. number, eg. ESP_3DES */ \
|
||||
uint8_t ixt_ivlen; /* ivlen in bits, expected to be multiple of 8! */ \
|
||||
uint16_t ixt_keyminbits;/* min. keybits (of entropy) */ \
|
||||
uint16_t ixt_keymaxbits;/* max. keybits (of entropy) */
|
||||
|
||||
#define ixt_support ixt_alg_type
|
||||
|
||||
#define IPSEC_ALG_ST_SUPP 0x01
|
||||
#define IPSEC_ALG_ST_REGISTERED 0x02
|
||||
#define IPSEC_ALG_ST_EXCL 0x04
|
||||
struct ipsec_alg {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
};
|
||||
/*
|
||||
* Note the const in cbc_encrypt IV arg:
|
||||
* some ciphers like to toast passed IV (eg. 3DES): make a local IV copy
|
||||
*/
|
||||
struct ipsec_alg_enc {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
unsigned ixt_e_keylen; /* raw key length in bytes */
|
||||
unsigned ixt_e_ctx_size; /* sa_p->key_e_size */
|
||||
int (*ixt_e_set_key)(struct ipsec_alg_enc *alg, __u8 *key_e, const __u8 *key, size_t keysize);
|
||||
__u8 *(*ixt_e_new_key)(struct ipsec_alg_enc *alg, const __u8 *key, size_t keysize);
|
||||
void (*ixt_e_destroy_key)(struct ipsec_alg_enc *alg, __u8 *key_e);
|
||||
int (*ixt_e_cbc_encrypt)(struct ipsec_alg_enc *alg, __u8 *key_e, __u8 *in, int ilen, const __u8 *iv, int encrypt);
|
||||
};
|
||||
struct ipsec_alg_auth {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
unsigned ixt_a_keylen; /* raw key length in bytes */
|
||||
unsigned ixt_a_ctx_size; /* sa_p->key_a_size */
|
||||
unsigned ixt_a_authlen; /* 'natural' auth. hash len (bytes) */
|
||||
int (*ixt_a_hmac_set_key)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *key, int keylen);
|
||||
int (*ixt_a_hmac_hash)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *dat, int len, __u8 *hash, int hashlen);
|
||||
};
|
||||
/*
|
||||
* These are _copies_ of SADB_EXT_SUPPORTED_{AUTH,ENCRYPT},
|
||||
* to avoid header coupling for true constants
|
||||
* about headers ... "cp is your friend" --Linus
|
||||
*/
|
||||
#define IPSEC_ALG_TYPE_AUTH 14
|
||||
#define IPSEC_ALG_TYPE_ENCRYPT 15
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE for module loading,testing, and unloading
|
||||
*
|
||||
***************************************************************/
|
||||
/* - registration calls */
|
||||
int register_ipsec_alg(struct ipsec_alg *);
|
||||
int unregister_ipsec_alg(struct ipsec_alg *);
|
||||
/* - optional (simple test) for algos */
|
||||
int ipsec_alg_test(unsigned alg_type, unsigned alg_id, int testparm);
|
||||
/* inline wrappers (usefull for type validation */
|
||||
static inline int register_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
|
||||
return register_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int unregister_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
|
||||
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int register_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
|
||||
return register_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int unregister_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
|
||||
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
*
|
||||
* INTERFACE for ENC services: key creation, encrypt function
|
||||
*
|
||||
*****************************************************************/
|
||||
|
||||
#define IPSEC_ALG_ENCRYPT 1
|
||||
#define IPSEC_ALG_DECRYPT 0
|
||||
|
||||
/* encryption key context creation function */
|
||||
int ipsec_alg_enc_key_create(struct ipsec_sa *sa_p);
|
||||
/*
|
||||
* ipsec_alg_esp_encrypt(): encrypt ilen bytes in idat returns
|
||||
* 0 or ERR<0
|
||||
*/
|
||||
int ipsec_alg_esp_encrypt(struct ipsec_sa *sa_p, __u8 *idat, int ilen, const __u8 *iv, int action);
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE for AUTH services: key creation, hash functions
|
||||
*
|
||||
***************************************************************/
|
||||
int ipsec_alg_auth_key_create(struct ipsec_sa *sa_p);
|
||||
int ipsec_alg_sa_esp_hash(const struct ipsec_sa *sa_p, const __u8 *espp, int len, __u8 *hash, int hashlen) ;
|
||||
#define ipsec_alg_sa_esp_update(c,k,l) ipsec_alg_sa_esp_hash(c,k,l,NULL,0)
|
||||
|
||||
/* only called from ipsec_init.c */
|
||||
int ipsec_alg_init(void);
|
||||
|
||||
/* algo module glue for static algos */
|
||||
void ipsec_alg_static_init(void);
|
||||
typedef int (*ipsec_alg_init_func_t) (void);
|
||||
|
||||
/**********************************************
|
||||
*
|
||||
* INTERFACE for ipsec_sa init and wipe
|
||||
*
|
||||
**********************************************/
|
||||
|
||||
/* returns true if ipsec_sa has ipsec_alg obj attached */
|
||||
/*
|
||||
* Initializes ipsec_sa's ipsec_alg object, using already loaded
|
||||
* proto, authalg, encalg.; links ipsec_alg objects (enc, auth)
|
||||
*/
|
||||
int ipsec_alg_sa_init(struct ipsec_sa *sa_p);
|
||||
/*
|
||||
* Destroys ipsec_sa's ipsec_alg object
|
||||
* unlinking ipsec_alg objects
|
||||
*/
|
||||
int ipsec_alg_sa_wipe(struct ipsec_sa *sa_p);
|
||||
|
||||
/**********************************************
|
||||
*
|
||||
* 2.2 backport for some 2.4 useful module stuff
|
||||
*
|
||||
**********************************************/
|
||||
#ifdef MODULE
|
||||
#ifndef THIS_MODULE
|
||||
#define THIS_MODULE (&__this_module)
|
||||
#endif
|
||||
#ifndef module_init
|
||||
typedef int (*__init_module_func_t)(void);
|
||||
typedef void (*__cleanup_module_func_t)(void);
|
||||
|
||||
#define module_init(x) \
|
||||
int init_module(void) __attribute__((alias(#x))); \
|
||||
static inline __init_module_func_t __init_module_inline(void) \
|
||||
{ return x; }
|
||||
#define module_exit(x) \
|
||||
void cleanup_module(void) __attribute__((alias(#x))); \
|
||||
static inline __cleanup_module_func_t __cleanup_module_inline(void) \
|
||||
{ return x; }
|
||||
#endif
|
||||
|
||||
#define IPSEC_ALG_MODULE_INIT( func_name ) \
|
||||
static int func_name(void); \
|
||||
module_init(func_name); \
|
||||
static int __init func_name(void)
|
||||
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
|
||||
static void func_name(void); \
|
||||
module_exit(func_name); \
|
||||
static void __exit func_name(void)
|
||||
#else /* not MODULE */
|
||||
#ifndef THIS_MODULE
|
||||
#define THIS_MODULE NULL
|
||||
#endif
|
||||
/*
|
||||
* I only want module_init() magic
|
||||
* when algo.c file *is THE MODULE*, in all other
|
||||
* cases, initialization is called explicitely from ipsec_alg_init()
|
||||
*/
|
||||
#define IPSEC_ALG_MODULE_INIT( func_name ) \
|
||||
extern int func_name(void); \
|
||||
int func_name(void)
|
||||
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
|
||||
extern void func_name(void); \
|
||||
void func_name(void)
|
||||
#endif
|
||||
|
||||
#endif /* IPSEC_ALG_H */
|
||||
@@ -1,55 +0,0 @@
|
||||
/*
|
||||
* declarations relevant to encapsulation-like operations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_ENCAP_H_
|
||||
|
||||
#define SENT_IP4 16 /* data is two struct in_addr + proto + ports*/
|
||||
/* (2 * sizeof(struct in_addr)) */
|
||||
/* sizeof(struct sockaddr_encap)
|
||||
- offsetof(struct sockaddr_encap, Sen.Sip4.Src) */
|
||||
|
||||
struct sockaddr_encap
|
||||
{
|
||||
__u8 sen_len; /* length */
|
||||
__u8 sen_family; /* AF_ENCAP */
|
||||
__u16 sen_type; /* see SENT_* */
|
||||
union
|
||||
{
|
||||
struct /* SENT_IP4 */
|
||||
{
|
||||
struct in_addr Src;
|
||||
struct in_addr Dst;
|
||||
__u8 Proto;
|
||||
__u16 Sport;
|
||||
__u16 Dport;
|
||||
} Sip4;
|
||||
} Sen;
|
||||
};
|
||||
|
||||
#define sen_ip_src Sen.Sip4.Src
|
||||
#define sen_ip_dst Sen.Sip4.Dst
|
||||
#define sen_proto Sen.Sip4.Proto
|
||||
#define sen_sport Sen.Sip4.Sport
|
||||
#define sen_dport Sen.Sip4.Dport
|
||||
|
||||
#ifndef AF_ENCAP
|
||||
#define AF_ENCAP 26
|
||||
#endif /* AF_ENCAP */
|
||||
|
||||
#define _IPSEC_ENCAP_H_
|
||||
#endif /* _IPSEC_ENCAP_H_ */
|
||||
@@ -1,82 +0,0 @@
|
||||
/*
|
||||
* @(#) declarations of eroute structures
|
||||
*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs <[email protected]>
|
||||
* Copyright (C) 2001 Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
* derived from ipsec_encap.h 1.15 on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_EROUTE_H_
|
||||
|
||||
#include "radij.h"
|
||||
#include "ipsec_encap.h"
|
||||
#include "ipsec_radij.h"
|
||||
|
||||
/*
|
||||
* The "type" is really part of the address as far as the routing
|
||||
* system is concerned. By using only one bit in the type field
|
||||
* for each type, we sort-of make sure that different types of
|
||||
* encapsulation addresses won't be matched against the wrong type.
|
||||
*/
|
||||
|
||||
/*
|
||||
* An entry in the radix tree
|
||||
*/
|
||||
|
||||
struct rjtentry
|
||||
{
|
||||
struct radij_node rd_nodes[2]; /* tree glue, and other values */
|
||||
#define rd_key(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_key))
|
||||
#define rd_mask(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_mask))
|
||||
short rd_flags;
|
||||
short rd_count;
|
||||
};
|
||||
|
||||
struct ident
|
||||
{
|
||||
__u16 type; /* identity type */
|
||||
__u64 id; /* identity id */
|
||||
__u8 len; /* identity len */
|
||||
caddr_t data; /* identity data */
|
||||
};
|
||||
|
||||
/*
|
||||
* An encapsulation route consists of a pointer to a
|
||||
* radix tree entry and a SAID (a destination_address/SPI/protocol triple).
|
||||
*/
|
||||
|
||||
struct eroute
|
||||
{
|
||||
struct rjtentry er_rjt;
|
||||
struct sa_id er_said;
|
||||
uint32_t er_pid;
|
||||
uint32_t er_count;
|
||||
uint64_t er_lasttime;
|
||||
struct sockaddr_encap er_eaddr; /* MCR get rid of _encap, it is silly*/
|
||||
struct sockaddr_encap er_emask;
|
||||
struct ident er_ident_s;
|
||||
struct ident er_ident_d;
|
||||
struct sk_buff* er_first;
|
||||
struct sk_buff* er_last;
|
||||
};
|
||||
|
||||
#define er_dst er_said.dst
|
||||
#define er_spi er_said.spi
|
||||
|
||||
#define _IPSEC_EROUTE_H_
|
||||
#endif /* _IPSEC_EROUTE_H_ */
|
||||
@@ -1,32 +0,0 @@
|
||||
/*
|
||||
* @(#) definition of ipsec_errs structure
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the errors/statistics that FreeSWAN collects.
|
||||
*
|
||||
*/
|
||||
|
||||
struct ipsec_errs {
|
||||
__u32 ips_alg_errs; /* number of algorithm errors */
|
||||
__u32 ips_auth_errs; /* # of authentication errors */
|
||||
__u32 ips_encsize_errs; /* # of encryption size errors*/
|
||||
__u32 ips_encpad_errs; /* # of encryption pad errors*/
|
||||
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
|
||||
};
|
||||
@@ -1,80 +0,0 @@
|
||||
/*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#include "freeswan/ipsec_md5h.h"
|
||||
#include "freeswan/ipsec_sha1.h"
|
||||
|
||||
#include "crypto/des.h"
|
||||
|
||||
#ifndef IPPROTO_ESP
|
||||
#define IPPROTO_ESP 50
|
||||
#endif /* IPPROTO_ESP */
|
||||
|
||||
#define ESP_HEADER_LEN 8 /* 64 bits header (spi+rpl)*/
|
||||
|
||||
#define EMT_ESPDESCBC_ULEN 20 /* coming from user mode */
|
||||
#define EMT_ESPDES_KMAX 64 /* 512 bit secret key enough? */
|
||||
#define EMT_ESPDES_KEY_SZ 8 /* 56 bit secret key with parity = 64 bits */
|
||||
#define EMT_ESP3DES_KEY_SZ 24 /* 168 bit secret key with parity = 192 bits */
|
||||
#define EMT_ESPDES_IV_SZ 8 /* IV size */
|
||||
#define ESP_DESCBC_BLKLEN 8 /* DES-CBC block size */
|
||||
|
||||
#define ESP_IV_MAXSZ 16 /* This is _critical_ */
|
||||
#define ESP_IV_MAXSZ_INT (ESP_IV_MAXSZ/sizeof(int))
|
||||
|
||||
#define DB_ES_PKTRX 0x0001
|
||||
#define DB_ES_PKTRX2 0x0002
|
||||
#define DB_ES_IPSA 0x0010
|
||||
#define DB_ES_XF 0x0020
|
||||
#define DB_ES_IPAD 0x0040
|
||||
#define DB_ES_INAU 0x0080
|
||||
#define DB_ES_OINFO 0x0100
|
||||
#define DB_ES_OINFO2 0x0200
|
||||
#define DB_ES_OH 0x0400
|
||||
#define DB_ES_REPLAY 0x0800
|
||||
|
||||
#ifdef __KERNEL__
|
||||
struct des_eks {
|
||||
des_key_schedule ks;
|
||||
};
|
||||
|
||||
extern struct inet_protocol esp_protocol;
|
||||
|
||||
struct options;
|
||||
|
||||
extern int
|
||||
esp_rcv(struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
|
||||
/* Only for 64 bits IVs, eg. ESP_3DES :P */
|
||||
struct esphdr
|
||||
{
|
||||
__u32 esp_spi; /* Security Parameters Index */
|
||||
__u32 esp_rpl; /* Replay counter */
|
||||
__u8 esp_iv[8]; /* iv */
|
||||
};
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_esp;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
@@ -1,27 +0,0 @@
|
||||
/*
|
||||
* IP-in-IP Header declarations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
/* The packet header is an IP header! */
|
||||
|
||||
struct ipe4_xdata /* transform table data */
|
||||
{
|
||||
struct in_addr i4_src;
|
||||
struct in_addr i4_dst;
|
||||
};
|
||||
|
||||
#define EMT_IPE4_ULEN 8 /* coming from user mode */
|
||||
@@ -1,191 +0,0 @@
|
||||
#ifndef _FREESWAN_KVERSIONS_H
|
||||
/*
|
||||
* header file for FreeS/WAN library functions
|
||||
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
|
||||
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU Library General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
* License for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#define _FREESWAN_KVERSIONS_H /* seen it, no need to see it again */
|
||||
|
||||
/*
|
||||
* this file contains a series of atomic defines that depend upon
|
||||
* kernel version numbers. The kernel versions are arranged
|
||||
* in version-order number (which is often not chronological)
|
||||
* and each clause enables or disables a feature.
|
||||
*/
|
||||
|
||||
/*
|
||||
* First, assorted kernel-version-dependent trickery.
|
||||
*/
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,0)
|
||||
#define HEADER_CACHE_BIND_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
|
||||
#define SPINLOCK
|
||||
#define PROC_FS_21
|
||||
#define NETLINK_SOCK
|
||||
#define NET_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,19)
|
||||
#define net_device_stats enet_statistics
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,0)
|
||||
#define SPINLOCK_23
|
||||
#define NETDEV_23
|
||||
# ifndef CONFIG_IP_ALIAS
|
||||
# define CONFIG_IP_ALIAS
|
||||
# endif
|
||||
#include <linux/socket.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/netlink.h>
|
||||
# ifdef NETLINK_XFRM
|
||||
# define NETDEV_25
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,25)
|
||||
#define PROC_FS_2325
|
||||
#undef PROC_FS_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,30)
|
||||
#define PROC_NO_DUMMY
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,35)
|
||||
#define SKB_COPY_EXPAND
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,37)
|
||||
#define IP_SELECT_IDENT
|
||||
#endif
|
||||
|
||||
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,50)) && defined(CONFIG_NETFILTER)
|
||||
#define SKB_RESET_NFCT
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,2)
|
||||
#define IP_SELECT_IDENT_NEW
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4)
|
||||
#define IPH_is_SKB_PULLED
|
||||
#define SKB_COW_NEW
|
||||
#define PROTO_HANDLER_SINGLE_PARM
|
||||
#define IP_FRAGMENT_LINEARIZE 1
|
||||
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
|
||||
# ifdef REDHAT_BOGOSITY
|
||||
# define IP_SELECT_IDENT_NEW
|
||||
# define IPH_is_SKB_PULLED
|
||||
# define SKB_COW_NEW
|
||||
# define PROTO_HANDLER_SINGLE_PARM
|
||||
# endif /* REDHAT_BOGOSITY */
|
||||
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,9)
|
||||
#define MALLOC_SLAB
|
||||
#define LINUX_KERNEL_HAS_SNPRINTF
|
||||
#endif
|
||||
|
||||
#ifdef NET_21
|
||||
# include <linux/in6.h>
|
||||
#else
|
||||
/* old kernel in.h has some IPv6 stuff, but not quite enough */
|
||||
# define s6_addr16 s6_addr
|
||||
# define AF_INET6 10
|
||||
# define uint8_t __u8
|
||||
# define uint16_t __u16
|
||||
# define uint32_t __u32
|
||||
# define uint64_t __u64
|
||||
#endif
|
||||
|
||||
#ifdef NET_21
|
||||
# define ipsec_kfree_skb(a) kfree_skb(a)
|
||||
#else /* NET_21 */
|
||||
# define ipsec_kfree_skb(a) kfree_skb(a, FREE_WRITE)
|
||||
#endif /* NET_21 */
|
||||
|
||||
#ifdef NETDEV_23
|
||||
# define device net_device
|
||||
# define ipsec_dev_get dev_get_by_name
|
||||
# define __ipsec_dev_get __dev_get_by_name
|
||||
# define ipsec_dev_put(x) dev_put(x)
|
||||
# define __ipsec_dev_put(x) __dev_put(x)
|
||||
# define ipsec_dev_hold(x) dev_hold(x)
|
||||
#else /* NETDEV_23 */
|
||||
# define ipsec_dev_get dev_get
|
||||
# define __ipsec_dev_put(x)
|
||||
# define ipsec_dev_put(x)
|
||||
# define ipsec_dev_hold(x)
|
||||
#endif /* NETDEV_23 */
|
||||
|
||||
#ifndef SPINLOCK
|
||||
# include <linux/bios32.h>
|
||||
/* simulate spin locks and read/write locks */
|
||||
typedef struct {
|
||||
volatile char lock;
|
||||
} spinlock_t;
|
||||
|
||||
typedef struct {
|
||||
volatile unsigned int lock;
|
||||
} rwlock_t;
|
||||
|
||||
# define spin_lock_init(x) { (x)->lock = 0;}
|
||||
# define rw_lock_init(x) { (x)->lock = 0; }
|
||||
|
||||
# define spin_lock(x) { while ((x)->lock) barrier(); (x)->lock=1;}
|
||||
# define spin_lock_irq(x) { cli(); spin_lock(x);}
|
||||
# define spin_lock_irqsave(x,flags) { save_flags(flags); spin_lock_irq(x);}
|
||||
|
||||
# define spin_unlock(x) { (x)->lock=0;}
|
||||
# define spin_unlock_irq(x) { spin_unlock(x); sti();}
|
||||
# define spin_unlock_irqrestore(x,flags) { spin_unlock(x); restore_flags(flags);}
|
||||
|
||||
# define read_lock(x) spin_lock(x)
|
||||
# define read_lock_irq(x) spin_lock_irq(x)
|
||||
# define read_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
|
||||
|
||||
# define read_unlock(x) spin_unlock(x)
|
||||
# define read_unlock_irq(x) spin_unlock_irq(x)
|
||||
# define read_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
|
||||
|
||||
# define write_lock(x) spin_lock(x)
|
||||
# define write_lock_irq(x) spin_lock_irq(x)
|
||||
# define write_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
|
||||
|
||||
# define write_unlock(x) spin_unlock(x)
|
||||
# define write_unlock_irq(x) spin_unlock_irq(x)
|
||||
# define write_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
|
||||
#endif /* !SPINLOCK */
|
||||
|
||||
#ifndef SPINLOCK_23
|
||||
# define spin_lock_bh(x) spin_lock_irq(x)
|
||||
# define spin_unlock_bh(x) spin_unlock_irq(x)
|
||||
|
||||
# define read_lock_bh(x) read_lock_irq(x)
|
||||
# define read_unlock_bh(x) read_unlock_irq(x)
|
||||
|
||||
# define write_lock_bh(x) write_lock_irq(x)
|
||||
# define write_unlock_bh(x) write_unlock_irq(x)
|
||||
#endif /* !SPINLOCK_23 */
|
||||
|
||||
#endif /* _FREESWAN_KVERSIONS_H */
|
||||
@@ -1,90 +0,0 @@
|
||||
/*
|
||||
* Definitions relevant to IPSEC lifetimes
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the book keeping fields for the
|
||||
* IPsec Security Association Structure. ("ipsec_sa")
|
||||
*
|
||||
* This structure is never allocated directly by kernel code,
|
||||
* (it is always a static/auto or is part of a structure)
|
||||
* so it does not have a reference count.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_LIFE_H_
|
||||
|
||||
/*
|
||||
* _count is total count.
|
||||
* _hard is hard limit (kill SA after this number)
|
||||
* _soft is soft limit (try to renew SA after this number)
|
||||
* _last is used in some special cases.
|
||||
*
|
||||
*/
|
||||
|
||||
struct ipsec_lifetime64
|
||||
{
|
||||
__u64 ipl_count;
|
||||
__u64 ipl_soft;
|
||||
__u64 ipl_hard;
|
||||
__u64 ipl_last;
|
||||
};
|
||||
|
||||
struct ipsec_lifetimes
|
||||
{
|
||||
/* number of bytes processed */
|
||||
struct ipsec_lifetime64 ipl_bytes;
|
||||
|
||||
/* number of packets processed */
|
||||
struct ipsec_lifetime64 ipl_packets;
|
||||
|
||||
/* time since SA was added */
|
||||
struct ipsec_lifetime64 ipl_addtime;
|
||||
|
||||
/* time since SA was first used */
|
||||
struct ipsec_lifetime64 ipl_usetime;
|
||||
|
||||
/* from rfc2367:
|
||||
* For CURRENT, the number of different connections,
|
||||
* endpoints, or flows that the association has been
|
||||
* allocated towards. For HARD and SOFT, the number of
|
||||
* these the association may be allocated towards
|
||||
* before it expires. The concept of a connection,
|
||||
* flow, or endpoint is system specific.
|
||||
*
|
||||
* mcr(2001-9-18) it is unclear what purpose these serve for FreeSWAN.
|
||||
* They are maintained for PF_KEY compatibility.
|
||||
*/
|
||||
struct ipsec_lifetime64 ipl_allocations;
|
||||
};
|
||||
|
||||
enum ipsec_life_alive {
|
||||
ipsec_life_harddied = -1,
|
||||
ipsec_life_softdied = 0,
|
||||
ipsec_life_okay = 1
|
||||
};
|
||||
|
||||
enum ipsec_life_type {
|
||||
ipsec_life_timebased = 1,
|
||||
ipsec_life_countbased= 0
|
||||
};
|
||||
|
||||
#define _IPSEC_LIFE_H_
|
||||
#endif /* _IPSEC_LIFE_H_ */
|
||||
@@ -1,83 +0,0 @@
|
||||
/*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
/*
|
||||
* The rest of this file is Copyright RSA DSI. See the following comments
|
||||
* for the full Copyright notice.
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_MD5H_H_
|
||||
#define _IPSEC_MD5H_H_
|
||||
|
||||
/* GLOBAL.H - RSAREF types and constants
|
||||
*/
|
||||
|
||||
/* PROTOTYPES should be set to one if and only if the compiler supports
|
||||
function argument prototyping.
|
||||
The following makes PROTOTYPES default to 0 if it has not already
|
||||
been defined with C compiler flags.
|
||||
*/
|
||||
#ifndef PROTOTYPES
|
||||
#define PROTOTYPES 1
|
||||
#endif /* !PROTOTYPES */
|
||||
|
||||
/* POINTER defines a generic pointer type */
|
||||
typedef __u8 *POINTER;
|
||||
|
||||
/* UINT2 defines a two byte word */
|
||||
typedef __u16 UINT2;
|
||||
|
||||
/* UINT4 defines a four byte word */
|
||||
typedef __u32 UINT4;
|
||||
|
||||
/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
|
||||
If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
|
||||
returns an empty list.
|
||||
*/
|
||||
|
||||
#if PROTOTYPES
|
||||
#define PROTO_LIST(list) list
|
||||
#else /* PROTOTYPES */
|
||||
#define PROTO_LIST(list) ()
|
||||
#endif /* PROTOTYPES */
|
||||
|
||||
|
||||
/* MD5.H - header file for MD5C.C
|
||||
*/
|
||||
|
||||
/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
|
||||
rights reserved.
|
||||
|
||||
License to copy and use this software is granted provided that it
|
||||
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
|
||||
Algorithm" in all material mentioning or referencing this software
|
||||
or this function.
|
||||
|
||||
License is also granted to make and use derivative works provided
|
||||
that such works are identified as "derived from the RSA Data
|
||||
Security, Inc. MD5 Message-Digest Algorithm" in all material
|
||||
mentioning or referencing the derived work.
|
||||
|
||||
RSA Data Security, Inc. makes no representations concerning either
|
||||
the merchantability of this software or the suitability of this
|
||||
software for any particular purpose. It is provided "as is"
|
||||
without express or implied warranty of any kind.
|
||||
|
||||
These notices must be retained in any copies of any part of this
|
||||
documentation and/or software.
|
||||
*/
|
||||
|
||||
/* MD5 context. */
|
||||
typedef struct {
|
||||
UINT4 state[4]; /* state (ABCD) */
|
||||
UINT4 count[2]; /* number of bits, modulo 2^64 (lsb first) */
|
||||
unsigned char buffer[64]; /* input buffer */
|
||||
} MD5_CTX;
|
||||
|
||||
void MD5Init PROTO_LIST ((void *));
|
||||
void MD5Update PROTO_LIST
|
||||
((void *, unsigned char *, __u32));
|
||||
void MD5Final PROTO_LIST ((unsigned char [16], void *));
|
||||
|
||||
#endif /* _IPSEC_MD5H_H_ */
|
||||
@@ -28,40 +28,6 @@
|
||||
|
||||
#ifndef _IPSEC_PARAM_H_
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include "ipsec_kversion.h"
|
||||
|
||||
/* Set number of ipsecX virtual devices here. */
|
||||
/* This must be < exp(field width of IPSEC_DEV_FORMAT) */
|
||||
/* It must also be reasonable so as not to overload the memory and CPU */
|
||||
/* constraints of the host. */
|
||||
#define IPSEC_NUM_IF 4
|
||||
/* The field width must be < IF_NAM_SIZ - strlen("ipsec") - 1. */
|
||||
/* With "ipsec" being 5 characters, that means 10 is the max field width */
|
||||
/* but machine memory and CPU constraints are not likely to tollerate */
|
||||
/* more than 3 digits. The default is one digit. */
|
||||
/* Update: userland scripts get upset if they can't find "ipsec0", so */
|
||||
/* for now, no "0"-padding should be used (which would have been helpful */
|
||||
/* to make text-searches work */
|
||||
#define IPSEC_DEV_FORMAT "ipsec%d"
|
||||
/* For, say, 500 virtual ipsec devices, I would recommend: */
|
||||
/* #define IPSEC_NUM_IF 500 */
|
||||
/* #define IPSEC_DEV_FORMAT "ipsec%03d" */
|
||||
/* Note that the "interfaces=" line in /etc/ipsec.conf would be, um, challenging. */
|
||||
|
||||
/* use dynamic ipsecX device allocation */
|
||||
#ifndef CONFIG_IPSEC_DYNDEV
|
||||
#define CONFIG_IPSEC_DYNDEV 1
|
||||
#endif /* CONFIG_IPSEC_DYNDEV */
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_BIGGATE
|
||||
# define SADB_HASHMOD 8069
|
||||
#else /* CONFIG_IPSEC_BIGGATE */
|
||||
# define SADB_HASHMOD 257
|
||||
#endif /* CONFIG_IPSEC_BIGGATE */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
/*
|
||||
* This is for the SA reference table. This number is related to the
|
||||
* maximum number of SAs that KLIPS can concurrently deal with, plus enough
|
||||
@@ -87,140 +53,5 @@
|
||||
# define IPSEC_SA_REF_CODE 1
|
||||
#endif
|
||||
|
||||
#ifdef __KERNEL__
|
||||
/* This is defined for 2.4, but not 2.2.... */
|
||||
#ifndef ARPHRD_VOID
|
||||
# define ARPHRD_VOID 0xFFFF
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Worry about PROC_FS stuff
|
||||
*/
|
||||
#if defined(PROC_FS_2325)
|
||||
/* kernel 2.4 */
|
||||
# define IPSEC_PROC_LAST_ARG ,int *eof,void *data
|
||||
# define IPSEC_PROCFS_DEBUG_NO_STATIC
|
||||
# define IPSEC_PROC_SUBDIRS
|
||||
#else
|
||||
/* kernel <2.4 */
|
||||
# define IPSEC_PROCFS_DEBUG_NO_STATIC DEBUG_NO_STATIC
|
||||
|
||||
# ifndef PROC_NO_DUMMY
|
||||
# define IPSEC_PROC_LAST_ARG , int dummy
|
||||
# else
|
||||
# define IPSEC_PROC_LAST_ARG
|
||||
# endif /* !PROC_NO_DUMMY */
|
||||
#endif /* PROC_FS_2325 */
|
||||
|
||||
#if !defined(LINUX_KERNEL_HAS_SNPRINTF)
|
||||
/* GNU CPP specific! */
|
||||
# define snprintf(buf, len, fmt...) sprintf(buf, ##fmt)
|
||||
#endif /* !LINUX_KERNEL_HAS_SNPRINTF */
|
||||
|
||||
#ifdef SPINLOCK
|
||||
# ifdef SPINLOCK_23
|
||||
# include <linux/spinlock.h> /* *lock* */
|
||||
# else /* SPINLOCK_23 */
|
||||
# include <asm/spinlock.h> /* *lock* */
|
||||
# endif /* SPINLOCK_23 */
|
||||
#endif /* SPINLOCK */
|
||||
|
||||
#ifndef KLIPS_FIXES_DES_PARITY
|
||||
# define KLIPS_FIXES_DES_PARITY 1
|
||||
#endif /* !KLIPS_FIXES_DES_PARITY */
|
||||
|
||||
/* we don't really want to print these unless there are really big problems */
|
||||
#ifndef KLIPS_DIVULGE_CYPHER_KEY
|
||||
# define KLIPS_DIVULGE_CYPHER_KEY 0
|
||||
#endif /* !KLIPS_DIVULGE_CYPHER_KEY */
|
||||
|
||||
#ifndef KLIPS_DIVULGE_HMAC_KEY
|
||||
# define KLIPS_DIVULGE_HMAC_KEY 0
|
||||
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
|
||||
|
||||
#ifndef IPSEC_DISALLOW_IPOPTIONS
|
||||
# define IPSEC_DISALLOW_IPOPTIONS 1
|
||||
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
|
||||
|
||||
/* extra toggles for regression testing */
|
||||
#ifdef CONFIG_IPSEC_REGRESS
|
||||
|
||||
/*
|
||||
* should pfkey_acquire() become 100% lossy?
|
||||
*
|
||||
*/
|
||||
extern int sysctl_ipsec_regress_pfkey_lossage;
|
||||
#ifndef KLIPS_PFKEY_ACQUIRE_LOSSAGE
|
||||
# ifdef CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE
|
||||
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 100
|
||||
# else /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
|
||||
/* not by default! */
|
||||
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 0
|
||||
# endif /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
|
||||
#endif /* KLIPS_PFKEY_ACQUIRE_LOSSAGE */
|
||||
|
||||
#endif /* CONFIG_IPSEC_REGRESS */
|
||||
|
||||
/*
|
||||
* debugging routines.
|
||||
*/
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern void ipsec_print_ip(struct iphdr *ip);
|
||||
|
||||
#define KLIPS_PRINT(flag, format, args...) \
|
||||
((flag) ? printk(KERN_INFO format , ## args) : 0)
|
||||
#define KLIPS_PRINTMORE(flag, format, args...) \
|
||||
((flag) ? printk(format , ## args) : 0)
|
||||
#define KLIPS_IP_PRINT(flag, ip) \
|
||||
((flag) ? ipsec_print_ip(ip) : 0)
|
||||
#else /* CONFIG_IPSEC_DEBUG */
|
||||
#define KLIPS_PRINT(flag, format, args...) do ; while(0)
|
||||
#define KLIPS_PRINTMORE(flag, format, args...) do ; while(0)
|
||||
#define KLIPS_IP_PRINT(flag, ip) do ; while(0)
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
|
||||
/*
|
||||
* Stupid kernel API differences in APIs. Not only do some
|
||||
* kernels not have ip_select_ident, but some have differing APIs,
|
||||
* and SuSE has one with one parameter, but no way of checking to
|
||||
* see what is really what.
|
||||
*/
|
||||
|
||||
#ifdef SUSE_LINUX_2_4_19_IS_STUPID
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph)
|
||||
#else
|
||||
|
||||
/* simplest case, nothing */
|
||||
#if !defined(IP_SELECT_IDENT)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) do { iph->id = htons(ip_id_count++); } while(0)
|
||||
#endif
|
||||
|
||||
/* kernels > 2.3.37-ish */
|
||||
#if defined(IP_SELECT_IDENT) && !defined(IP_SELECT_IDENT_NEW)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst)
|
||||
#endif
|
||||
|
||||
/* kernels > 2.4.2 */
|
||||
#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
|
||||
#endif
|
||||
|
||||
#endif /* SUSE_LINUX_2_4_19_IS_STUPID */
|
||||
|
||||
/*
|
||||
* make klips fail test:east-espiv-01.
|
||||
* exploit is at testing/attacks/espiv
|
||||
*
|
||||
*/
|
||||
#define KLIPS_IMPAIRMENT_ESPIV_CBC_ATTACK 0
|
||||
|
||||
|
||||
/* IP_FRAGMENT_LINEARIZE is set in freeswan.h if Kernel > 2.4.4 */
|
||||
#ifndef IP_FRAGMENT_LINEARIZE
|
||||
# define IP_FRAGMENT_LINEARIZE 0
|
||||
#endif /* IP_FRAGMENT_LINEARIZE */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#define _IPSEC_PARAM_H_
|
||||
#endif /* _IPSEC_PARAM_H_ */
|
||||
|
||||
@@ -1,111 +0,0 @@
|
||||
/*
|
||||
* @(#) prototypes for FreeSWAN functions
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_PROTO_H_
|
||||
|
||||
#include "ipsec_param.h"
|
||||
|
||||
/*
|
||||
* This file is a kernel only file that declares prototypes for
|
||||
* all intra-module function calls and global data structures.
|
||||
*
|
||||
* Include this file last.
|
||||
*
|
||||
*/
|
||||
|
||||
/* ipsec_init.c */
|
||||
extern struct prng ipsec_prng;
|
||||
|
||||
/* ipsec_sa.c */
|
||||
extern struct ipsec_sa *ipsec_sadb_hash[SADB_HASHMOD];
|
||||
extern spinlock_t tdb_lock;
|
||||
extern int ipsec_sadb_init(void);
|
||||
|
||||
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id*);
|
||||
extern int ipsec_sa_put(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_del(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_delchain(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_add(struct ipsec_sa *);
|
||||
|
||||
extern int ipsec_sadb_cleanup(__u8);
|
||||
extern int ipsec_sa_wipe(struct ipsec_sa *);
|
||||
|
||||
/* debug declarations */
|
||||
|
||||
/* ipsec_proc.c */
|
||||
extern int ipsec_proc_init(void);
|
||||
extern void ipsec_proc_cleanup(void);
|
||||
|
||||
/* ipsec_radij.c */
|
||||
extern int ipsec_makeroute(struct sockaddr_encap *ea,
|
||||
struct sockaddr_encap *em,
|
||||
struct sa_id said,
|
||||
uint32_t pid,
|
||||
struct sk_buff *skb,
|
||||
struct ident *ident_s,
|
||||
struct ident *ident_d);
|
||||
|
||||
extern int ipsec_breakroute(struct sockaddr_encap *ea,
|
||||
struct sockaddr_encap *em,
|
||||
struct sk_buff **first,
|
||||
struct sk_buff **last);
|
||||
|
||||
int ipsec_radijinit(void);
|
||||
int ipsec_cleareroutes(void);
|
||||
int ipsec_radijcleanup(void);
|
||||
|
||||
/* ipsec_life.c */
|
||||
extern enum ipsec_life_alive ipsec_lifetime_check(struct ipsec_lifetime64 *il64,
|
||||
const char *lifename,
|
||||
const char *saname,
|
||||
enum ipsec_life_type ilt,
|
||||
enum ipsec_direction idir,
|
||||
struct ipsec_sa *ips);
|
||||
|
||||
|
||||
extern int ipsec_lifetime_format(char *buffer,
|
||||
int buflen,
|
||||
char *lifename,
|
||||
enum ipsec_life_type timebaselife,
|
||||
struct ipsec_lifetime64 *lifetime);
|
||||
|
||||
extern void ipsec_lifetime_update_hard(struct ipsec_lifetime64 *lifetime,
|
||||
__u64 newvalue);
|
||||
|
||||
extern void ipsec_lifetime_update_soft(struct ipsec_lifetime64 *lifetime,
|
||||
__u64 newvalue);
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
|
||||
extern int debug_xform;
|
||||
extern int debug_eroute;
|
||||
extern int debug_spi;
|
||||
extern int debug_netlink;
|
||||
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
|
||||
|
||||
|
||||
#define _IPSEC_PROTO_H
|
||||
#endif /* _IPSEC_PROTO_H_ */
|
||||
@@ -1,63 +0,0 @@
|
||||
/*
|
||||
* @(#) Definitions relevant to the IPSEC <> radij tree interfacing
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_RADIJ_H
|
||||
|
||||
#include <freeswan.h>
|
||||
|
||||
int ipsec_walk(char *);
|
||||
|
||||
int ipsec_rj_walker_procprint(struct radij_node *, void *);
|
||||
int ipsec_rj_walker_delete(struct radij_node *, void *);
|
||||
|
||||
/* This structure is used to pass information between
|
||||
* ipsec_eroute_get_info and ipsec_rj_walker_procprint
|
||||
* (through rj_walktree) and between calls of ipsec_rj_walker_procprint.
|
||||
*/
|
||||
struct wsbuf
|
||||
{
|
||||
/* from caller of ipsec_eroute_get_info: */
|
||||
char *const buffer; /* start of buffer provided */
|
||||
const int length; /* length of buffer provided */
|
||||
const off_t offset; /* file position of first character of interest */
|
||||
/* accumulated by ipsec_rj_walker_procprint: */
|
||||
int len; /* number of character filled into buffer */
|
||||
off_t begin; /* file position contained in buffer[0] (<=offset) */
|
||||
};
|
||||
|
||||
|
||||
extern struct radij_node_head *rnh;
|
||||
extern spinlock_t eroute_lock;
|
||||
|
||||
struct eroute * ipsec_findroute(struct sockaddr_encap *);
|
||||
|
||||
#define O1(x) (int)(((x)>>24)&0xff)
|
||||
#define O2(x) (int)(((x)>>16)&0xff)
|
||||
#define O3(x) (int)(((x)>>8)&0xff)
|
||||
#define O4(x) (int)(((x))&0xff)
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_radij;
|
||||
void rj_dumptrees(void);
|
||||
|
||||
#define DB_RJ_DUMPTREES 0x0001
|
||||
#define DB_RJ_FINDROUTE 0x0002
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
#define _IPSEC_RADIJ_H
|
||||
#endif
|
||||
@@ -1,72 +0,0 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#define DB_RX_PKTRX 0x0001
|
||||
#define DB_RX_PKTRX2 0x0002
|
||||
#define DB_RX_DMP 0x0004
|
||||
#define DB_RX_IPSA 0x0010
|
||||
#define DB_RX_XF 0x0020
|
||||
#define DB_RX_IPAD 0x0040
|
||||
#define DB_RX_INAU 0x0080
|
||||
#define DB_RX_OINFO 0x0100
|
||||
#define DB_RX_OINFO2 0x0200
|
||||
#define DB_RX_OH 0x0400
|
||||
#define DB_RX_REPLAY 0x0800
|
||||
|
||||
#ifdef __KERNEL__
|
||||
/* struct options; */
|
||||
|
||||
#define __NO_VERSION__
|
||||
#include <linux/module.h>
|
||||
#include <linux/config.h> /* for CONFIG_IP_FORWARD */
|
||||
#include <linux/version.h>
|
||||
#include <freeswan.h>
|
||||
|
||||
#define IPSEC_BIRTH_TEMPLATE_MAXLEN 256
|
||||
|
||||
struct ipsec_birth_reply {
|
||||
int packet_template_len;
|
||||
unsigned char packet_template[IPSEC_BIRTH_TEMPLATE_MAXLEN];
|
||||
};
|
||||
|
||||
extern struct ipsec_birth_reply ipsec_ipv4_birth_packet;
|
||||
extern struct ipsec_birth_reply ipsec_ipv6_birth_packet;
|
||||
|
||||
extern int
|
||||
#ifdef PROTO_HANDLER_SINGLE_PARM
|
||||
ipsec_rcv(struct sk_buff *skb);
|
||||
#else /* PROTO_HANDLER_SINGLE_PARM */
|
||||
ipsec_rcv(struct sk_buff *skb,
|
||||
#ifdef NET_21
|
||||
unsigned short xlen);
|
||||
#else /* NET_21 */
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
#endif /* NET_21 */
|
||||
#endif /* PROTO_HANDLER_SINGLE_PARM */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_rcv;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
extern int sysctl_ipsec_inbound_policy_check;
|
||||
#endif /* __KERNEL__ */
|
||||
@@ -1,252 +0,0 @@
|
||||
/*
|
||||
* @(#) Definitions of IPsec Security Association (ipsec_sa)
|
||||
*
|
||||
* Copyright (C) 2001, 2002, 2003
|
||||
* Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the IPsec Security Association Structure.
|
||||
*
|
||||
* This structure keeps track of a single transform that may be done
|
||||
* to a set of packets. It can describe applying the transform or
|
||||
* apply the reverse. (e.g. compression vs expansion). However, it
|
||||
* only describes one at a time. To describe both, two structures would
|
||||
* be used, but since the sides of the transform are performed
|
||||
* on different machines typically it is usual to have only one side
|
||||
* of each association.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_SA_H_
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include "ipsec_stats.h"
|
||||
#include "ipsec_life.h"
|
||||
#include "ipsec_eroute.h"
|
||||
#endif /* __KERNEL__ */
|
||||
#include "ipsec_param.h"
|
||||
|
||||
|
||||
/* SAs are held in a table.
|
||||
* Entries in this table are referenced by IPsecSAref_t values.
|
||||
* IPsecSAref_t values are conceptually subscripts. Because
|
||||
* we want to allocate the table piece-meal, the subscripting
|
||||
* is implemented with two levels, a bit like paged virtual memory.
|
||||
* This representation mechanism is known as an Iliffe Vector.
|
||||
*
|
||||
* The Main table (AKA the refTable) consists of 2^IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
|
||||
* pointers to subtables.
|
||||
* Each subtable has 2^IPSEC_SA_REF_SUBTABLE_IDX_WIDTH entries, each of which
|
||||
* is a pointer to an SA.
|
||||
*
|
||||
* An IPsecSAref_t contains either an exceptional value (signified by the
|
||||
* high-order bit being on) or a reference to a table entry. A table entry
|
||||
* reference has the subtable subscript in the low-order
|
||||
* IPSEC_SA_REF_SUBTABLE_IDX_WIDTH bits and the Main table subscript
|
||||
* in the next lowest IPSEC_SA_REF_MAINTABLE_IDX_WIDTH bits.
|
||||
*
|
||||
* The Maintable entry for an IPsecSAref_t x, a pointer to its subtable, is
|
||||
* IPsecSAref2table(x). It is of type struct IPsecSArefSubTable *.
|
||||
*
|
||||
* The pointer to the SA for x is IPsecSAref2SA(x). It is of type
|
||||
* struct ipsec_sa*. The macro definition clearly shows the two-level
|
||||
* access needed to find the SA pointer.
|
||||
*
|
||||
* The Maintable is allocated when IPsec is initialized.
|
||||
* Each subtable is allocated when needed, but the first is allocated
|
||||
* when IPsec is initialized.
|
||||
*
|
||||
* IPsecSAref_t is designed to be smaller than an NFmark so that
|
||||
* they can be stored in NFmarks and still leave a few bits for other
|
||||
* purposes. The spare bits are in the low order of the NFmark
|
||||
* but in the high order of the IPsecSAref_t, so conversion is required.
|
||||
* We pick the upper bits of NFmark on the theory that they are less likely to
|
||||
* interfere with more pedestrian uses of nfmark.
|
||||
*/
|
||||
|
||||
|
||||
typedef unsigned short int IPsecRefTableUnusedCount;
|
||||
|
||||
#define IPSEC_SA_REF_TABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#if ((IPSEC_SA_REF_TABLE_IDX_WIDTH - (1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) < 0)
|
||||
#error "IPSEC_SA_REF_TABLE_IDX_WIDTH("IPSEC_SA_REF_TABLE_IDX_WIDTH") MUST be < 1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH("IPSEC_SA_REF_MAINTABLE_IDX_WIDTH")"
|
||||
#endif
|
||||
|
||||
#define IPSEC_SA_REF_SUBTABLE_IDX_WIDTH (IPSEC_SA_REF_TABLE_IDX_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
|
||||
|
||||
#define IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
|
||||
#define IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
|
||||
#ifdef CONFIG_NETFILTER
|
||||
#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->nfmark
|
||||
#define IPSEC_SA_REF_HOST_FIELD_TYPE typeof(IPSEC_SA_REF_HOST_FIELD(NULL))
|
||||
#else /* CONFIG_NETFILTER */
|
||||
/* just make it work for now, it doesn't matter, since there is no nfmark */
|
||||
#define IPSEC_SA_REF_HOST_FIELD_TYPE unsigned long
|
||||
#endif /* CONFIG_NETFILTER */
|
||||
#define IPSEC_SA_REF_HOST_FIELD_WIDTH (8 * sizeof(IPSEC_SA_REF_HOST_FIELD_TYPE))
|
||||
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
|
||||
|
||||
#define IPSEC_SA_REF_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
|
||||
#define IPSEC_SA_REF_TABLE_MASK ((IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
#define IPSEC_SA_REF_ENTRY_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_SUBTABLE_IDX_WIDTH))
|
||||
|
||||
#define IPsecSAref2table(x) (((x) & IPSEC_SA_REF_TABLE_MASK) >> IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
#define IPsecSAref2entry(x) ((x) & IPSEC_SA_REF_ENTRY_MASK)
|
||||
#define IPsecSArefBuild(x,y) (((x) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH) + (y))
|
||||
|
||||
#define IPsecSAref2SA(x) (ipsec_sadb.refTable[IPsecSAref2table(x)]->entry[IPsecSAref2entry(x)])
|
||||
#define IPsecSA2SAref(x) ((x)->ips_ref)
|
||||
|
||||
#define EMT_INBOUND 0x01 /* SA direction, 1=inbound */
|
||||
|
||||
/* 'struct ipsec_sa' should be 64bit aligned when allocated. */
|
||||
struct ipsec_sa
|
||||
{
|
||||
IPsecSAref_t ips_ref; /* reference table entry number */
|
||||
atomic_t ips_refcount; /* reference count for this struct */
|
||||
struct ipsec_sa *ips_hnext; /* next in hash chain */
|
||||
struct ipsec_sa *ips_inext; /* pointer to next xform */
|
||||
struct ipsec_sa *ips_onext; /* pointer to prev xform */
|
||||
|
||||
struct ifnet *ips_rcvif; /* related rcv encap interface */
|
||||
|
||||
struct sa_id ips_said; /* SA ID */
|
||||
|
||||
__u32 ips_seq; /* seq num of msg that initiated this SA */
|
||||
__u32 ips_pid; /* PID of process that initiated this SA */
|
||||
__u8 ips_authalg; /* auth algorithm for this SA */
|
||||
__u8 ips_encalg; /* enc algorithm for this SA */
|
||||
|
||||
struct ipsec_stats ips_errs;
|
||||
|
||||
__u8 ips_replaywin; /* replay window size */
|
||||
__u8 ips_state; /* state of SA */
|
||||
__u32 ips_replaywin_lastseq; /* last pkt sequence num */
|
||||
__u64 ips_replaywin_bitmap; /* bitmap of received pkts */
|
||||
__u32 ips_replaywin_maxdiff; /* max pkt sequence difference */
|
||||
|
||||
__u32 ips_flags; /* generic xform flags */
|
||||
|
||||
|
||||
struct ipsec_lifetimes ips_life; /* lifetime records */
|
||||
|
||||
/* selector information */
|
||||
struct sockaddr*ips_addr_s; /* src sockaddr */
|
||||
struct sockaddr*ips_addr_d; /* dst sockaddr */
|
||||
struct sockaddr*ips_addr_p; /* proxy sockaddr */
|
||||
__u16 ips_addr_s_size;
|
||||
__u16 ips_addr_d_size;
|
||||
__u16 ips_addr_p_size;
|
||||
ip_address ips_flow_s;
|
||||
ip_address ips_flow_d;
|
||||
ip_address ips_mask_s;
|
||||
ip_address ips_mask_d;
|
||||
|
||||
__u16 ips_key_bits_a; /* size of authkey in bits */
|
||||
__u16 ips_auth_bits; /* size of authenticator in bits */
|
||||
__u16 ips_key_bits_e; /* size of enckey in bits */
|
||||
__u16 ips_iv_bits; /* size of IV in bits */
|
||||
__u8 ips_iv_size;
|
||||
__u16 ips_key_a_size;
|
||||
__u16 ips_key_e_size;
|
||||
|
||||
caddr_t ips_key_a; /* authentication key */
|
||||
caddr_t ips_key_e; /* encryption key */
|
||||
caddr_t ips_iv; /* Initialisation Vector */
|
||||
|
||||
struct ident ips_ident_s; /* identity src */
|
||||
struct ident ips_ident_d; /* identity dst */
|
||||
|
||||
#ifdef CONFIG_IPSEC_IPCOMP
|
||||
__u16 ips_comp_adapt_tries; /* ipcomp self-adaption tries */
|
||||
__u16 ips_comp_adapt_skip; /* ipcomp self-adaption to-skip */
|
||||
__u64 ips_comp_ratio_cbytes; /* compressed bytes */
|
||||
__u64 ips_comp_ratio_dbytes; /* decompressed (or uncompressed) bytes */
|
||||
#endif /* CONFIG_IPSEC_IPCOMP */
|
||||
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
__u8 ips_natt_type;
|
||||
__u8 ips_natt_reserved[3];
|
||||
__u16 ips_natt_sport;
|
||||
__u16 ips_natt_dport;
|
||||
|
||||
struct sockaddr *ips_natt_oa;
|
||||
__u16 ips_natt_oa_size;
|
||||
__u16 ips_natt_reserved2;
|
||||
#endif
|
||||
|
||||
#if 0
|
||||
__u32 ips_sens_dpd;
|
||||
__u8 ips_sens_sens_level;
|
||||
__u8 ips_sens_sens_len;
|
||||
__u64* ips_sens_sens_bitmap;
|
||||
__u8 ips_sens_integ_level;
|
||||
__u8 ips_sens_integ_len;
|
||||
__u64* ips_sens_integ_bitmap;
|
||||
#endif
|
||||
struct ipsec_alg_enc *ips_alg_enc;
|
||||
struct ipsec_alg_auth *ips_alg_auth;
|
||||
IPsecSAref_t ips_ref_rel;
|
||||
};
|
||||
|
||||
struct IPsecSArefSubTable
|
||||
{
|
||||
struct ipsec_sa* entry[IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES];
|
||||
};
|
||||
|
||||
struct ipsec_sadb {
|
||||
struct IPsecSArefSubTable* refTable[IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES];
|
||||
IPsecSAref_t refFreeList[IPSEC_SA_REF_FREELIST_NUM_ENTRIES];
|
||||
int refFreeListHead;
|
||||
int refFreeListTail;
|
||||
IPsecSAref_t refFreeListCont;
|
||||
IPsecSAref_t said_hash[SADB_HASHMOD];
|
||||
spinlock_t sadb_lock;
|
||||
};
|
||||
|
||||
extern struct ipsec_sadb ipsec_sadb;
|
||||
|
||||
extern int ipsec_SAref_recycle(void);
|
||||
extern int ipsec_SArefSubTable_alloc(unsigned table);
|
||||
extern int ipsec_saref_freelist_init(void);
|
||||
extern int ipsec_sadb_init(void);
|
||||
extern struct ipsec_sa *ipsec_sa_alloc(int*error); /* pass in error var by pointer */
|
||||
extern IPsecSAref_t ipsec_SAref_alloc(int*erorr); /* pass in error var by pointer */
|
||||
extern int ipsec_sa_free(struct ipsec_sa* ips);
|
||||
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id *said);
|
||||
extern int ipsec_sa_put(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_add(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_del(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_delchain(struct ipsec_sa *ips);
|
||||
extern int ipsec_sadb_cleanup(__u8 proto);
|
||||
extern int ipsec_sadb_free(void);
|
||||
extern int ipsec_sa_wipe(struct ipsec_sa *ips);
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
enum ipsec_direction {
|
||||
ipsec_incoming = 1,
|
||||
ipsec_outgoing = 2
|
||||
};
|
||||
|
||||
#define _IPSEC_SA_H_
|
||||
#endif /* _IPSEC_SA_H_ */
|
||||
@@ -1,32 +0,0 @@
|
||||
/*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
/*
|
||||
* Here is the original comment from the distribution:
|
||||
|
||||
SHA-1 in C
|
||||
By Steve Reid <[email protected]>
|
||||
100% Public Domain
|
||||
|
||||
* Adapted for use by the IPSEC code by John Ioannidis
|
||||
*/
|
||||
|
||||
|
||||
#ifndef _IPSEC_SHA1_H_
|
||||
#define _IPSEC_SHA1_H_
|
||||
|
||||
typedef struct
|
||||
{
|
||||
__u32 state[5];
|
||||
__u32 count[2];
|
||||
__u8 buffer[64];
|
||||
} SHA1_CTX;
|
||||
|
||||
void SHA1Transform(__u32 state[5], __u8 buffer[64]);
|
||||
void SHA1Init(void *context);
|
||||
void SHA1Update(void *context, unsigned char *data, __u32 len);
|
||||
void SHA1Final(unsigned char digest[20], void *context);
|
||||
|
||||
|
||||
#endif /* _IPSEC_SHA1_H_ */
|
||||
@@ -1,38 +0,0 @@
|
||||
/*
|
||||
* @(#) definition of ipsec_stats structure
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the errors/statistics that FreeSWAN collects.
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_STATS_H_
|
||||
|
||||
struct ipsec_stats {
|
||||
__u32 ips_alg_errs; /* number of algorithm errors */
|
||||
__u32 ips_auth_errs; /* # of authentication errors */
|
||||
__u32 ips_encsize_errs; /* # of encryption size errors*/
|
||||
__u32 ips_encpad_errs; /* # of encryption pad errors*/
|
||||
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
|
||||
};
|
||||
|
||||
extern int ipsec_snprintf(char * buf, ssize_t size, const char *fmt, ...);
|
||||
|
||||
#define _IPSEC_STATS_H_
|
||||
#endif /* _IPSEC_STATS_H_ */
|
||||
@@ -1,128 +0,0 @@
|
||||
/*
|
||||
* IPSEC tunneling code
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#include <linux/types.h>
|
||||
|
||||
#ifdef NET_21
|
||||
# define DEV_QUEUE_XMIT(skb, device, pri) {\
|
||||
skb->dev = device; \
|
||||
neigh_compat_output(skb); \
|
||||
/* skb->dst->output(skb); */ \
|
||||
}
|
||||
# define ICMP_SEND(skb_in, type, code, info, dev) \
|
||||
icmp_send(skb_in, type, code, htonl(info))
|
||||
# define IP_SEND(skb, dev) \
|
||||
ip_send(skb);
|
||||
#else /* NET_21 */
|
||||
# define DEV_QUEUE_XMIT(skb, device, pri) {\
|
||||
dev_queue_xmit(skb, device, pri); \
|
||||
}
|
||||
# define ICMP_SEND(skb_in, type, code, info, dev) \
|
||||
icmp_send(skb_in, type, code, info, dev)
|
||||
# define IP_SEND(skb, dev) \
|
||||
if(ntohs(iph->tot_len) > physmtu) { \
|
||||
ip_fragment(NULL, skb, dev, 0); \
|
||||
ipsec_kfree_skb(skb); \
|
||||
} else { \
|
||||
dev_queue_xmit(skb, dev, SOPRI_NORMAL); \
|
||||
}
|
||||
#endif /* NET_21 */
|
||||
|
||||
|
||||
/*
|
||||
* Heavily based on drivers/net/new_tunnel.c. Lots
|
||||
* of ideas also taken from the 2.1.x version of drivers/net/shaper.c
|
||||
*/
|
||||
|
||||
struct ipsectunnelconf
|
||||
{
|
||||
__u32 cf_cmd;
|
||||
union
|
||||
{
|
||||
char cfu_name[12];
|
||||
} cf_u;
|
||||
#define cf_name cf_u.cfu_name
|
||||
};
|
||||
|
||||
#define IPSEC_SET_DEV (SIOCDEVPRIVATE)
|
||||
#define IPSEC_DEL_DEV (SIOCDEVPRIVATE + 1)
|
||||
#define IPSEC_CLR_DEV (SIOCDEVPRIVATE + 2)
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
# define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
struct ipsecpriv
|
||||
{
|
||||
struct sk_buff_head sendq;
|
||||
struct device *dev;
|
||||
struct wait_queue *wait_queue;
|
||||
char locked;
|
||||
int (*hard_start_xmit) (struct sk_buff *skb,
|
||||
struct device *dev);
|
||||
int (*hard_header) (struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
unsigned short type,
|
||||
void *daddr,
|
||||
void *saddr,
|
||||
unsigned len);
|
||||
#ifdef NET_21
|
||||
int (*rebuild_header)(struct sk_buff *skb);
|
||||
#else /* NET_21 */
|
||||
int (*rebuild_header)(void *buff, struct device *dev,
|
||||
unsigned long raddr, struct sk_buff *skb);
|
||||
#endif /* NET_21 */
|
||||
int (*set_mac_address)(struct device *dev, void *addr);
|
||||
#ifndef NET_21
|
||||
void (*header_cache_bind)(struct hh_cache **hhp, struct device *dev,
|
||||
unsigned short htype, __u32 daddr);
|
||||
#endif /* !NET_21 */
|
||||
void (*header_cache_update)(struct hh_cache *hh, struct device *dev, unsigned char * haddr);
|
||||
struct net_device_stats *(*get_stats)(struct device *dev);
|
||||
struct net_device_stats mystats;
|
||||
int mtu; /* What is the desired MTU? */
|
||||
};
|
||||
|
||||
extern char ipsec_tunnel_c_version[];
|
||||
|
||||
extern struct device *ipsecdevices[IPSEC_NUM_IF];
|
||||
|
||||
int ipsec_tunnel_init_devices(void);
|
||||
|
||||
/* void */ int ipsec_tunnel_cleanup_devices(void);
|
||||
|
||||
extern /* void */ int ipsec_init(void);
|
||||
|
||||
extern int ipsec_tunnel_start_xmit(struct sk_buff *skb, struct device *dev);
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_tunnel;
|
||||
extern int sysctl_ipsec_debug_verbose;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
#define DB_TN_INIT 0x0001
|
||||
#define DB_TN_PROCFS 0x0002
|
||||
#define DB_TN_XMIT 0x0010
|
||||
#define DB_TN_OHDR 0x0020
|
||||
#define DB_TN_CROUT 0x0040
|
||||
#define DB_TN_OXFS 0x0080
|
||||
#define DB_TN_REVEC 0x0100
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
@@ -1,84 +0,0 @@
|
||||
/*
|
||||
* Definitions relevant to IPSEC transformations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_XFORM_H_
|
||||
|
||||
#include <freeswan.h>
|
||||
#include "ipsec_policy.h"
|
||||
|
||||
#define XF_NONE 0 /* No transform set */
|
||||
#define XF_IP4 1 /* IPv4 inside IPv4 */
|
||||
#define XF_AHMD5 2 /* AH MD5 */
|
||||
#define XF_AHSHA 3 /* AH SHA */
|
||||
#define XF_ESP3DES 5 /* ESP DES3-CBC */
|
||||
#define XF_AHHMACMD5 6 /* AH-HMAC-MD5 with opt replay prot */
|
||||
#define XF_AHHMACSHA1 7 /* AH-HMAC-SHA1 with opt replay prot */
|
||||
#define XF_ESP3DESMD5 9 /* triple DES, HMAC-MD-5, 128-bits of authentication */
|
||||
#define XF_ESP3DESMD596 10 /* triple DES, HMAC-MD-5, 96-bits of authentication */
|
||||
#define XF_ESPNULLMD596 12 /* NULL, HMAC-MD-5 with 96-bits of authentication */
|
||||
#define XF_ESPNULLSHA196 13 /* NULL, HMAC-SHA-1 with 96-bits of authentication */
|
||||
#define XF_ESP3DESSHA196 14 /* triple DES, HMAC-SHA-1, 96-bits of authentication */
|
||||
#define XF_IP6 15 /* IPv6 inside IPv6 */
|
||||
#define XF_COMPDEFLATE 16 /* IPCOMP deflate */
|
||||
|
||||
#define XF_CLR 126 /* Clear SA table */
|
||||
#define XF_DEL 127 /* Delete SA */
|
||||
|
||||
#define XFT_AUTH 0x0001
|
||||
#define XFT_CONF 0x0100
|
||||
|
||||
/* available if CONFIG_IPSEC_DEBUG is defined */
|
||||
#define DB_XF_INIT 0x0001
|
||||
|
||||
#define PROTO2TXT(x) \
|
||||
(x) == IPPROTO_AH ? "AH" : \
|
||||
(x) == IPPROTO_ESP ? "ESP" : \
|
||||
(x) == IPPROTO_IPIP ? "IPIP" : \
|
||||
(x) == IPPROTO_COMP ? "COMP" : \
|
||||
"UNKNOWN_proto"
|
||||
static inline const char *enc_name_id (unsigned id) {
|
||||
static char buf[16];
|
||||
snprintf(buf, sizeof(buf), "_ID%d", id);
|
||||
return buf;
|
||||
}
|
||||
static inline const char *auth_name_id (unsigned id) {
|
||||
static char buf[16];
|
||||
snprintf(buf, sizeof(buf), "_ID%d", id);
|
||||
return buf;
|
||||
}
|
||||
#define IPS_XFORM_NAME(x) \
|
||||
PROTO2TXT((x)->ips_said.proto), \
|
||||
(x)->ips_said.proto == IPPROTO_COMP ? \
|
||||
((x)->ips_encalg == SADB_X_CALG_DEFLATE ? \
|
||||
"_DEFLATE" : "_UNKNOWN_comp") : \
|
||||
(x)->ips_encalg == ESP_NONE ? "" : \
|
||||
(x)->ips_encalg == ESP_3DES ? "_3DES" : \
|
||||
(x)->ips_encalg == ESP_AES ? "_AES" : \
|
||||
(x)->ips_encalg == ESP_SERPENT ? "_SERPENT" : \
|
||||
(x)->ips_encalg == ESP_TWOFISH ? "_TWOFISH" : \
|
||||
enc_name_id(x->ips_encalg)/* "_UNKNOWN_encr" */, \
|
||||
(x)->ips_authalg == AH_NONE ? "" : \
|
||||
(x)->ips_authalg == AH_MD5 ? "_HMAC_MD5" : \
|
||||
(x)->ips_authalg == AH_SHA ? "_HMAC_SHA1" : \
|
||||
(x)->ips_authalg == AH_SHA2_256 ? "_HMAC_SHA2_256" : \
|
||||
(x)->ips_authalg == AH_SHA2_384 ? "_HMAC_SHA2_384" : \
|
||||
(x)->ips_authalg == AH_SHA2_512 ? "_HMAC_SHA2_512" : \
|
||||
auth_name_id(x->ips_authalg) /* "_UNKNOWN_auth" */ \
|
||||
|
||||
#define _IPSEC_XFORM_H_
|
||||
#endif /* _IPSEC_XFORM_H_ */
|
||||
@@ -1,140 +0,0 @@
|
||||
/*
|
||||
* IPSEC tunneling code
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#include "freeswan/ipsec_sa.h"
|
||||
|
||||
enum ipsec_xmit_value
|
||||
{
|
||||
IPSEC_XMIT_STOLEN=2,
|
||||
IPSEC_XMIT_PASS=1,
|
||||
IPSEC_XMIT_OK=0,
|
||||
IPSEC_XMIT_ERRMEMALLOC=-1,
|
||||
IPSEC_XMIT_ESP_BADALG=-2,
|
||||
IPSEC_XMIT_BADPROTO=-3,
|
||||
IPSEC_XMIT_ESP_PUSHPULLERR=-4,
|
||||
IPSEC_XMIT_BADLEN=-5,
|
||||
IPSEC_XMIT_AH_BADALG=-6,
|
||||
IPSEC_XMIT_SAIDNOTFOUND=-7,
|
||||
IPSEC_XMIT_SAIDNOTLIVE=-8,
|
||||
IPSEC_XMIT_REPLAYROLLED=-9,
|
||||
IPSEC_XMIT_LIFETIMEFAILED=-10,
|
||||
IPSEC_XMIT_CANNOTFRAG=-11,
|
||||
IPSEC_XMIT_MSSERR=-12,
|
||||
IPSEC_XMIT_ERRSKBALLOC=-13,
|
||||
IPSEC_XMIT_ENCAPFAIL=-14,
|
||||
IPSEC_XMIT_NODEV=-15,
|
||||
IPSEC_XMIT_NOPRIVDEV=-16,
|
||||
IPSEC_XMIT_NOPHYSDEV=-17,
|
||||
IPSEC_XMIT_NOSKB=-18,
|
||||
IPSEC_XMIT_NOIPV6=-19,
|
||||
IPSEC_XMIT_NOIPOPTIONS=-20,
|
||||
IPSEC_XMIT_TTLEXPIRED=-21,
|
||||
IPSEC_XMIT_BADHHLEN=-22,
|
||||
IPSEC_XMIT_PUSHPULLERR=-23,
|
||||
IPSEC_XMIT_ROUTEERR=-24,
|
||||
IPSEC_XMIT_RECURSDETECT=-25,
|
||||
IPSEC_XMIT_IPSENDFAILURE=-26,
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
IPSEC_XMIT_ESPUDP=-27,
|
||||
#endif
|
||||
};
|
||||
|
||||
struct ipsec_xmit_state
|
||||
{
|
||||
struct sk_buff *skb; /* working skb pointer */
|
||||
struct device *dev; /* working dev pointer */
|
||||
struct ipsecpriv *prv; /* Our device' private space */
|
||||
struct sk_buff *oskb; /* Original skb pointer */
|
||||
struct net_device_stats *stats; /* This device's statistics */
|
||||
struct iphdr *iph; /* Our new IP header */
|
||||
__u32 newdst; /* The other SG's IP address */
|
||||
__u32 orgdst; /* Original IP destination address */
|
||||
__u32 orgedst; /* 1st SG's IP address */
|
||||
__u32 newsrc; /* The new source SG's IP address */
|
||||
__u32 orgsrc; /* Original IP source address */
|
||||
__u32 innersrc; /* Innermost IP source address */
|
||||
int iphlen; /* IP header length */
|
||||
int pyldsz; /* upper protocol payload size */
|
||||
int headroom;
|
||||
int tailroom;
|
||||
int max_headroom; /* The extra header space needed */
|
||||
int max_tailroom; /* The extra stuffing needed */
|
||||
int ll_headroom; /* The extra link layer hard_header space needed */
|
||||
int tot_headroom; /* The total header space needed */
|
||||
int tot_tailroom; /* The totalstuffing needed */
|
||||
__u8 *saved_header; /* saved copy of the hard header */
|
||||
unsigned short sport, dport;
|
||||
|
||||
struct sockaddr_encap matcher; /* eroute search key */
|
||||
struct eroute *eroute;
|
||||
struct ipsec_sa *ipsp, *ipsq; /* ipsec_sa pointers */
|
||||
char sa_txt[SATOA_BUF];
|
||||
size_t sa_len;
|
||||
int hard_header_stripped; /* has the hard header been removed yet? */
|
||||
int hard_header_len;
|
||||
struct device *physdev;
|
||||
/* struct device *virtdev; */
|
||||
short physmtu;
|
||||
short mtudiff;
|
||||
#ifdef NET_21
|
||||
struct rtable *route;
|
||||
#endif /* NET_21 */
|
||||
struct sa_id outgoing_said;
|
||||
#ifdef NET_21
|
||||
int pass;
|
||||
#endif /* NET_21 */
|
||||
int error;
|
||||
uint32_t eroute_pid;
|
||||
struct ipsec_sa ips;
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
uint8_t natt_type;
|
||||
uint8_t natt_head;
|
||||
uint16_t natt_sport;
|
||||
uint16_t natt_dport;
|
||||
#endif
|
||||
};
|
||||
|
||||
#if 0 /* save for alg refactorisation */
|
||||
struct xform_functions
|
||||
{
|
||||
enum ipsec_xmit_value (*checks)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb);
|
||||
enum ipsec_xmit_value (*encrypt)(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value (*setup_auth)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb,
|
||||
__u32 *replay,
|
||||
unsigned char **authenticator);
|
||||
enum ipsec_xmit_value (*calc_auth)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb);
|
||||
};
|
||||
#endif
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_sanity_check_dev(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_sanity_check_skb(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_encap_bundle(struct ipsec_xmit_state *ixs);
|
||||
|
||||
extern int ipsec_xmit_trap_count;
|
||||
extern int ipsec_xmit_trap_sendcount;
|
||||
|
||||
extern void ipsec_extract_ports(struct iphdr * iph, struct sockaddr_encap * er);
|
||||
@@ -17,122 +17,9 @@
|
||||
|
||||
#ifndef __NET_IPSEC_PF_KEY_H
|
||||
#define __NET_IPSEC_PF_KEY_H
|
||||
#ifdef __KERNEL__
|
||||
extern struct proto_ops pfkey_proto_ops;
|
||||
typedef struct sock pfkey_sock;
|
||||
extern int debug_pfkey;
|
||||
|
||||
extern /* void */ int pfkey_init(void);
|
||||
extern /* void */ int pfkey_cleanup(void);
|
||||
|
||||
extern struct sock *pfkey_sock_list;
|
||||
struct socket_list
|
||||
{
|
||||
struct socket *socketp;
|
||||
struct socket_list *next;
|
||||
};
|
||||
extern int pfkey_list_insert_socket(struct socket*, struct socket_list**);
|
||||
extern int pfkey_list_remove_socket(struct socket*, struct socket_list**);
|
||||
extern struct socket_list *pfkey_open_sockets;
|
||||
extern struct socket_list *pfkey_registered_sockets[SADB_SATYPE_MAX+1];
|
||||
|
||||
/*
|
||||
* There is a field-by-field copy in klips/net/ipsec/ipsec_alg.h
|
||||
* please keep in sync until we migrate all support stuff
|
||||
* to ipsec_alg objects
|
||||
*/
|
||||
struct supported
|
||||
{
|
||||
uint16_t supported_alg_exttype;
|
||||
uint8_t supported_alg_id;
|
||||
uint8_t supported_alg_ivlen;
|
||||
uint16_t supported_alg_minbits;
|
||||
uint16_t supported_alg_maxbits;
|
||||
};
|
||||
extern struct supported_list *pfkey_supported_list[SADB_SATYPE_MAX+1];
|
||||
struct supported_list
|
||||
{
|
||||
struct supported *supportedp;
|
||||
struct supported_list *next;
|
||||
};
|
||||
extern int pfkey_list_insert_supported(struct supported*, struct supported_list**);
|
||||
extern int pfkey_list_remove_supported(struct supported*, struct supported_list**);
|
||||
|
||||
struct sockaddr_key
|
||||
{
|
||||
uint16_t key_family; /* PF_KEY */
|
||||
uint16_t key_pad; /* not used */
|
||||
uint32_t key_pid; /* process ID */
|
||||
};
|
||||
|
||||
struct pfkey_extracted_data
|
||||
{
|
||||
struct ipsec_sa* ips;
|
||||
struct ipsec_sa* ips2;
|
||||
struct eroute *eroute;
|
||||
};
|
||||
|
||||
extern int
|
||||
pfkey_alloc_eroute(struct eroute** eroute);
|
||||
|
||||
extern int
|
||||
pfkey_sa_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_lifetime_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_address_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_key_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_ident_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_sens_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_prop_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_supported_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_spirange_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_x_kmprivate_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_x_satype_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int
|
||||
pfkey_x_debug_process(struct sadb_ext *pfkey_ext,
|
||||
struct pfkey_extracted_data* extr);
|
||||
|
||||
extern int pfkey_register_reply(int satype, struct sadb_msg *);
|
||||
extern int pfkey_upmsg(struct socket *, struct sadb_msg *);
|
||||
extern int pfkey_expire(struct ipsec_sa *, int);
|
||||
extern int pfkey_acquire(struct ipsec_sa *);
|
||||
#else /* ! __KERNEL__ */
|
||||
|
||||
extern void (*pfkey_debug_func)(const char *message, ...);
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
extern uint8_t satype2proto(uint8_t satype);
|
||||
extern uint8_t proto2satype(uint8_t proto);
|
||||
extern char* satype2name(uint8_t satype);
|
||||
@@ -242,12 +129,6 @@ pfkey_ident_build(struct sadb_ext** pfkey_ext,
|
||||
uint8_t ident_len,
|
||||
char* ident_string);
|
||||
|
||||
#ifdef __KERNEL__
|
||||
extern int pfkey_nat_t_new_mapping(struct ipsec_sa *, struct sockaddr *, __u16);
|
||||
extern int pfkey_x_nat_t_type_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
|
||||
extern int pfkey_x_nat_t_port_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
int
|
||||
pfkey_x_nat_t_type_build(struct sadb_ext** pfkey_ext,
|
||||
uint8_t type);
|
||||
|
||||
@@ -21,41 +21,10 @@
|
||||
|
||||
char pfkey_v2_build_c_version[] = "$Id$";
|
||||
|
||||
/*
|
||||
* Some ugly stuff to allow consistent debugging code for use in the
|
||||
* kernel and in user space
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/kernel.h> /* for printk */
|
||||
|
||||
# include "freeswan/ipsec_kversion.h" /* for malloc switch */
|
||||
# ifdef MALLOC_SLAB
|
||||
# include <linux/slab.h> /* kmalloc() */
|
||||
# else /* MALLOC_SLAB */
|
||||
# include <linux/malloc.h> /* kmalloc() */
|
||||
# endif /* MALLOC_SLAB */
|
||||
# include <linux/errno.h> /* error codes */
|
||||
# include <linux/types.h> /* size_t */
|
||||
# include <linux/interrupt.h> /* mark_bh */
|
||||
|
||||
# include <linux/netdevice.h> /* struct device, and other headers */
|
||||
# include <linux/etherdevice.h> /* eth_type_trans */
|
||||
# include <linux/ip.h> /* struct iphdr */
|
||||
# if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
||||
# include <linux/ipv6.h> /* struct ipv6hdr */
|
||||
# endif /* if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
|
||||
|
||||
# define MALLOC(size) kmalloc(size, GFP_ATOMIC)
|
||||
# define FREE(obj) kfree(obj)
|
||||
# include <freeswan.h>
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <sys/types.h>
|
||||
# include <linux/types.h>
|
||||
# include <linux/errno.h>
|
||||
# include <malloc.h>
|
||||
# include <sys/socket.h>
|
||||
# include <stdlib.h>
|
||||
# include <errno.h>
|
||||
# include <string.h> /* memset */
|
||||
|
||||
# include <freeswan.h>
|
||||
@@ -63,8 +32,6 @@ unsigned int pfkey_lib_debug = 0;
|
||||
|
||||
void (*pfkey_debug_func)(const char *message, ...) PRINTF_LIKE(1);
|
||||
|
||||
/* #define PLUTO */
|
||||
|
||||
#define DEBUGGING(args...) if(pfkey_lib_debug) { \
|
||||
if(pfkey_debug_func != NULL) { \
|
||||
(*pfkey_debug_func)("pfkey_lib_debug:" args); \
|
||||
@@ -73,22 +40,10 @@ void (*pfkey_debug_func)(const char *message, ...) PRINTF_LIKE(1);
|
||||
} }
|
||||
# define MALLOC(size) malloc(size)
|
||||
# define FREE(obj) free(obj)
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#include <pfkeyv2.h>
|
||||
#include <pfkey.h>
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
#include "freeswan/radij.h" /* rd_nodes */
|
||||
#include "freeswan/ipsec_encap.h" /* sockaddr_encap */
|
||||
|
||||
# define DEBUGGING(args...) \
|
||||
KLIPS_PRINT(debug_pfkey, "klips_debug:" args)
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#include "ipsec_sa.h" /* IPSEC_SAREF_NULL, IPSEC_SA_REF_TABLE_IDX_WIDTH */
|
||||
|
||||
#define SENDERR(_x) do { error = -(_x); goto errlab; } while (0)
|
||||
|
||||
void
|
||||
@@ -483,14 +438,14 @@ pfkey_address_build(struct sadb_ext** pfkey_ext,
|
||||
"found address family AF_INET6.\n");
|
||||
saddr_len = sizeof(struct sockaddr_in6);
|
||||
sprintf(ipaddr_txt, "%x:%x:%x:%x:%x:%x:%x:%x-%x"
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[0])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[1])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[2])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[3])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[4])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[5])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[6])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr16[7])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[0])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[1])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[2])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[3])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[4])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[5])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[6])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_addr.s6_addr[7])
|
||||
, ntohs(((struct sockaddr_in6*)address)->sin6_port));
|
||||
break;
|
||||
default:
|
||||
|
||||
@@ -18,31 +18,8 @@
|
||||
*
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/kernel.h> /* for printk */
|
||||
|
||||
# include "freeswan/ipsec_kversion.h" /* for malloc switch */
|
||||
# ifdef MALLOC_SLAB
|
||||
# include <linux/slab.h> /* kmalloc() */
|
||||
# else /* MALLOC_SLAB */
|
||||
# include <linux/malloc.h> /* kmalloc() */
|
||||
# endif /* MALLOC_SLAB */
|
||||
# include <linux/errno.h> /* error codes */
|
||||
# include <linux/types.h> /* size_t */
|
||||
# include <linux/interrupt.h> /* mark_bh */
|
||||
|
||||
# include <linux/netdevice.h> /* struct device, and other headers */
|
||||
# include <linux/etherdevice.h> /* eth_type_trans */
|
||||
extern int debug_pfkey;
|
||||
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <sys/types.h>
|
||||
# include <linux/types.h>
|
||||
# include <linux/errno.h>
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
# include <errno.h>
|
||||
|
||||
#include "freeswan.h"
|
||||
#include "pfkeyv2.h"
|
||||
|
||||
@@ -21,38 +21,8 @@
|
||||
|
||||
char pfkey_v2_ext_bits_c_version[] = "$Id$";
|
||||
|
||||
/*
|
||||
* Some ugly stuff to allow consistent debugging code for use in the
|
||||
* kernel and in user space
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/kernel.h> /* for printk */
|
||||
|
||||
# include "freeswan/ipsec_kversion.h" /* for malloc switch */
|
||||
# ifdef MALLOC_SLAB
|
||||
# include <linux/slab.h> /* kmalloc() */
|
||||
# else /* MALLOC_SLAB */
|
||||
# include <linux/malloc.h> /* kmalloc() */
|
||||
# endif /* MALLOC_SLAB */
|
||||
# include <linux/errno.h> /* error codes */
|
||||
# include <linux/types.h> /* size_t */
|
||||
# include <linux/interrupt.h> /* mark_bh */
|
||||
|
||||
# include <linux/netdevice.h> /* struct device, and other headers */
|
||||
# include <linux/etherdevice.h> /* eth_type_trans */
|
||||
# include <linux/ip.h> /* struct iphdr */
|
||||
# if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
||||
# include <linux/ipv6.h>
|
||||
# endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
|
||||
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <sys/types.h>
|
||||
# include <linux/types.h>
|
||||
# include <linux/errno.h>
|
||||
#endif
|
||||
# include <errno.h>
|
||||
|
||||
#include <freeswan.h>
|
||||
#include <pfkeyv2.h>
|
||||
|
||||
@@ -21,73 +21,24 @@
|
||||
|
||||
char pfkey_v2_parse_c_version[] = "$Id$";
|
||||
|
||||
/*
|
||||
* Some ugly stuff to allow consistent debugging code for use in the
|
||||
* kernel and in user space
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/kernel.h> /* for printk */
|
||||
|
||||
#include "freeswan/ipsec_kversion.h" /* for malloc switch */
|
||||
|
||||
# ifdef MALLOC_SLAB
|
||||
# include <linux/slab.h> /* kmalloc() */
|
||||
# else /* MALLOC_SLAB */
|
||||
# include <linux/malloc.h> /* kmalloc() */
|
||||
# endif /* MALLOC_SLAB */
|
||||
# include <linux/errno.h> /* error codes */
|
||||
# include <linux/types.h> /* size_t */
|
||||
# include <linux/interrupt.h> /* mark_bh */
|
||||
|
||||
# include <linux/netdevice.h> /* struct device, and other headers */
|
||||
# include <linux/etherdevice.h> /* eth_type_trans */
|
||||
# include <linux/ip.h> /* struct iphdr */
|
||||
# if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
|
||||
# include <linux/ipv6.h> /* struct ipv6hdr */
|
||||
# endif /* if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
|
||||
extern int debug_pfkey;
|
||||
|
||||
#include "freeswan.h"
|
||||
|
||||
#include "ipsec_encap.h"
|
||||
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <sys/types.h>
|
||||
# include <linux/types.h>
|
||||
# include <linux/errno.h>
|
||||
# include <sys/socket.h>
|
||||
# include <errno.h>
|
||||
|
||||
# include <freeswan.h>
|
||||
# include <constants.h>
|
||||
# include <defs.h> /* for PRINTF_LIKE */
|
||||
# include <log.h> /* for debugging and DBG_log */
|
||||
|
||||
/* #define PLUTO */
|
||||
|
||||
# ifdef PLUTO
|
||||
# define DEBUGGING(level, args...) { DBG_log("pfkey_lib_debug:" args); }
|
||||
# else
|
||||
# define DEBUGGING(level, args...) if(pfkey_lib_debug & level) { printf("pfkey_lib_debug:" args); } else { ; }
|
||||
# endif
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
|
||||
#include <pfkeyv2.h>
|
||||
#include <pfkey.h>
|
||||
|
||||
#ifdef __KERNEL__
|
||||
extern int sysctl_ipsec_debug_verbose;
|
||||
# define DEBUGGING(level, args...) \
|
||||
KLIPS_PRINT( \
|
||||
((debug_pfkey & level & (PF_KEY_DEBUG_PARSE_STRUCT | PF_KEY_DEBUG_PARSE_PROBLEM)) \
|
||||
|| (sysctl_ipsec_debug_verbose && (debug_pfkey & level & PF_KEY_DEBUG_PARSE_FLOW))) \
|
||||
, "klips_debug:" args)
|
||||
#endif /* __KERNEL__ */
|
||||
#include "ipsec_sa.h" /* IPSEC_SAREF_NULL, IPSEC_SA_REF_TABLE_IDX_WIDTH */
|
||||
|
||||
|
||||
#define SENDERR(_x) do { error = -(_x); goto errlab; } while (0)
|
||||
|
||||
@@ -96,21 +47,11 @@ struct satype_tbl {
|
||||
uint8_t satype;
|
||||
char* name;
|
||||
} static satype_tbl[] = {
|
||||
#ifdef __KERNEL__
|
||||
{ IPPROTO_ESP, SADB_SATYPE_ESP, "ESP" },
|
||||
{ IPPROTO_AH, SADB_SATYPE_AH, "AH" },
|
||||
{ IPPROTO_IPIP, SADB_X_SATYPE_IPIP, "IPIP" },
|
||||
#ifdef CONFIG_IPSEC_IPCOMP
|
||||
{ IPPROTO_COMP, SADB_X_SATYPE_COMP, "COMP" },
|
||||
#endif /* CONFIG_IPSEC_IPCOMP */
|
||||
{ IPPROTO_INT, SADB_X_SATYPE_INT, "INT" },
|
||||
#else /* __KERNEL__ */
|
||||
{ SA_ESP, SADB_SATYPE_ESP, "ESP" },
|
||||
{ SA_AH, SADB_SATYPE_AH, "AH" },
|
||||
{ SA_IPIP, SADB_X_SATYPE_IPIP, "IPIP" },
|
||||
{ SA_COMP, SADB_X_SATYPE_COMP, "COMP" },
|
||||
{ SA_INT, SADB_X_SATYPE_INT, "INT" },
|
||||
#endif /* __KERNEL__ */
|
||||
{ 0, 0, "UNKNOWN" }
|
||||
};
|
||||
|
||||
@@ -418,14 +359,14 @@ pfkey_address_parse(struct sadb_ext *pfkey_ext)
|
||||
case AF_INET6:
|
||||
saddr_len = sizeof(struct sockaddr_in6);
|
||||
sprintf(ipaddr_txt, "%x:%x:%x:%x:%x:%x:%x:%x"
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[0])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[1])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[2])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[3])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[4])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[5])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[6])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr16[7]));
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[0])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[1])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[2])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[3])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[4])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[5])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[6])
|
||||
, ntohs(((struct sockaddr_in6*)s)->sin6_addr.s6_addr[7]));
|
||||
DEBUGGING(PF_KEY_DEBUG_PARSE_STRUCT,
|
||||
"pfkey_address_parse: "
|
||||
"found exttype=%u(%s) family=%d(AF_INET6) address=%s proto=%u port=%u.\n",
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -1,201 +0,0 @@
|
||||
/*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file is defived from ${SRC}/sys/net/radix.h of BSD 4.4lite
|
||||
*
|
||||
* Variable and procedure names have been modified so that they don't
|
||||
* conflict with the original BSD code, as a small number of modifications
|
||||
* have been introduced and we may want to reuse this code in BSD.
|
||||
*
|
||||
* The `j' in `radij' is pronounced as a voiceless guttural (like a Greek
|
||||
* chi or a German ch sound (as `doch', not as in `milch'), or even a
|
||||
* spanish j as in Juan. It is not as far back in the throat like
|
||||
* the corresponding Hebrew sound, nor is it a soft breath like the English h.
|
||||
* It has nothing to do with the Dutch ij sound.
|
||||
*
|
||||
* Here is the appropriate copyright notice:
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (c) 1988, 1989, 1993
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by the University of
|
||||
* California, Berkeley and its contributors.
|
||||
* 4. Neither the name of the University nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)radix.h 8.1 (Berkeley) 6/10/93
|
||||
*/
|
||||
|
||||
#ifndef _RADIJ_H_
|
||||
#define _RADIJ_H_
|
||||
|
||||
/*
|
||||
#define RJ_DEBUG
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
#ifndef __P
|
||||
#ifdef __STDC__
|
||||
#define __P(x) x
|
||||
#else
|
||||
#define __P(x) ()
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Radix search tree node layout.
|
||||
*/
|
||||
|
||||
struct radij_node
|
||||
{
|
||||
struct radij_mask *rj_mklist; /* list of masks contained in subtree */
|
||||
struct radij_node *rj_p; /* parent */
|
||||
short rj_b; /* bit offset; -1-index(netmask) */
|
||||
char rj_bmask; /* node: mask for bit test*/
|
||||
u_char rj_flags; /* enumerated next */
|
||||
#define RJF_NORMAL 1 /* leaf contains normal route */
|
||||
#define RJF_ROOT 2 /* leaf is root leaf for tree */
|
||||
#define RJF_ACTIVE 4 /* This node is alive (for rtfree) */
|
||||
union {
|
||||
struct { /* leaf only data: */
|
||||
caddr_t rj_Key; /* object of search */
|
||||
caddr_t rj_Mask; /* netmask, if present */
|
||||
struct radij_node *rj_Dupedkey;
|
||||
} rj_leaf;
|
||||
struct { /* node only data: */
|
||||
int rj_Off; /* where to start compare */
|
||||
struct radij_node *rj_L;/* progeny */
|
||||
struct radij_node *rj_R;/* progeny */
|
||||
}rj_node;
|
||||
} rj_u;
|
||||
#ifdef RJ_DEBUG
|
||||
int rj_info;
|
||||
struct radij_node *rj_twin;
|
||||
struct radij_node *rj_ybro;
|
||||
#endif
|
||||
};
|
||||
|
||||
#define rj_dupedkey rj_u.rj_leaf.rj_Dupedkey
|
||||
#define rj_key rj_u.rj_leaf.rj_Key
|
||||
#define rj_mask rj_u.rj_leaf.rj_Mask
|
||||
#define rj_off rj_u.rj_node.rj_Off
|
||||
#define rj_l rj_u.rj_node.rj_L
|
||||
#define rj_r rj_u.rj_node.rj_R
|
||||
|
||||
/*
|
||||
* Annotations to tree concerning potential routes applying to subtrees.
|
||||
*/
|
||||
|
||||
extern struct radij_mask {
|
||||
short rm_b; /* bit offset; -1-index(netmask) */
|
||||
char rm_unused; /* cf. rj_bmask */
|
||||
u_char rm_flags; /* cf. rj_flags */
|
||||
struct radij_mask *rm_mklist; /* more masks to try */
|
||||
caddr_t rm_mask; /* the mask */
|
||||
int rm_refs; /* # of references to this struct */
|
||||
} *rj_mkfreelist;
|
||||
|
||||
#define MKGet(m) {\
|
||||
if (rj_mkfreelist) {\
|
||||
m = rj_mkfreelist; \
|
||||
rj_mkfreelist = (m)->rm_mklist; \
|
||||
} else \
|
||||
R_Malloc(m, struct radij_mask *, sizeof (*(m))); }\
|
||||
|
||||
#define MKFree(m) { (m)->rm_mklist = rj_mkfreelist; rj_mkfreelist = (m);}
|
||||
|
||||
struct radij_node_head {
|
||||
struct radij_node *rnh_treetop;
|
||||
int rnh_addrsize; /* permit, but not require fixed keys */
|
||||
int rnh_pktsize; /* permit, but not require fixed keys */
|
||||
#if 0
|
||||
struct radij_node *(*rnh_addaddr) /* add based on sockaddr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
#endif
|
||||
int (*rnh_addaddr) /* add based on sockaddr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
struct radij_node *(*rnh_addpkt) /* add based on packet hdr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
#if 0
|
||||
struct radij_node *(*rnh_deladdr) /* remove based on sockaddr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head));
|
||||
#endif
|
||||
int (*rnh_deladdr) /* remove based on sockaddr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head, struct radij_node **node));
|
||||
struct radij_node *(*rnh_delpkt) /* remove based on packet hdr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head));
|
||||
struct radij_node *(*rnh_matchaddr) /* locate based on sockaddr */
|
||||
__P((void *v, struct radij_node_head *head));
|
||||
struct radij_node *(*rnh_matchpkt) /* locate based on packet hdr */
|
||||
__P((void *v, struct radij_node_head *head));
|
||||
int (*rnh_walktree) /* traverse tree */
|
||||
__P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
|
||||
struct radij_node rnh_nodes[3]; /* empty tree for common case */
|
||||
};
|
||||
|
||||
|
||||
#define Bcmp(a, b, n) memcmp(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
|
||||
#define Bcopy(a, b, n) memmove(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
|
||||
#define Bzero(p, n) memset((caddr_t)(p), 0, (unsigned)(n))
|
||||
#define R_Malloc(p, t, n) ((p = (t) kmalloc((size_t)(n), GFP_ATOMIC)), Bzero((p),(n)))
|
||||
#define Free(p) kfree((caddr_t)p);
|
||||
|
||||
void rj_init __P((void));
|
||||
int rj_inithead __P((void **, int));
|
||||
int rj_refines __P((void *, void *));
|
||||
int rj_walktree __P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
|
||||
struct radij_node
|
||||
*rj_addmask __P((void *, int, int)) /* , rgb */ ;
|
||||
int /* * */ rj_addroute __P((void *, void *, struct radij_node_head *,
|
||||
struct radij_node [2])) /* , rgb */ ;
|
||||
int /* * */ rj_delete __P((void *, void *, struct radij_node_head *, struct radij_node **)) /* , rgb */ ;
|
||||
struct radij_node /* rgb */
|
||||
*rj_insert __P((void *, struct radij_node_head *, int *,
|
||||
struct radij_node [2])),
|
||||
*rj_match __P((void *, struct radij_node_head *)),
|
||||
*rj_newpair __P((void *, int, struct radij_node[2])),
|
||||
*rj_search __P((void *, struct radij_node *)),
|
||||
*rj_search_m __P((void *, struct radij_node *, void *));
|
||||
|
||||
void rj_deltree(struct radij_node_head *);
|
||||
void rj_delnodes(struct radij_node *);
|
||||
void rj_free_mkfreelist(void);
|
||||
int radijcleartree(void);
|
||||
int radijcleanup(void);
|
||||
|
||||
extern struct radij_node_head *mask_rjhead;
|
||||
extern int maj_keylen;
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#endif /* _RADIJ_H_ */
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@
|
||||
*
|
||||
* RCSID $Id$
|
||||
*/
|
||||
#include <sys/socket.h>
|
||||
|
||||
#include "internal.h"
|
||||
#include "freeswan.h"
|
||||
|
||||
|
||||
@@ -15,10 +15,6 @@
|
||||
* RCSID $Id$
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include <linux/netdevice.h>
|
||||
#endif
|
||||
|
||||
#include "freeswan.h"
|
||||
|
||||
static const char strongswan_number[] = VERSION;
|
||||
|
||||
Reference in New Issue
Block a user