summaryrefslogtreecommitdiff
path: root/sys/netkey
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2003-09-08 06:51:53 +0000
committeritojun <itojun@NetBSD.org>2003-09-08 06:51:53 +0000
commit8ca90bd4e4ea537a4470ab03eacc51f68bdfa40f (patch)
treeb769efe5a7fef8da81c50c4639946c967cd50a8f /sys/netkey
parent140fe23a05ca652b72cf93da4acdbd3b8fd7908a (diff)
add /kern/ipsecsa and /kern/ipsecsp, which can be inspected by setkey(8).
it allows easier access to ipsecsa/sp. it works around problem where setkey -D does not work with large number of ipsec SAs due to socket buffer size.
Diffstat (limited to 'sys/netkey')
-rw-r--r--sys/netkey/key.c65
-rw-r--r--sys/netkey/key.h6
2 files changed, 62 insertions, 9 deletions
diff --git a/sys/netkey/key.c b/sys/netkey/key.c
index f0072a887c4..a2d4410abd0 100644
--- a/sys/netkey/key.c
+++ b/sys/netkey/key.c
@@ -1,5 +1,5 @@
-/* $NetBSD: key.c,v 1.92 2003/09/08 01:55:09 itojun Exp $ */
-/* $KAME: key.c,v 1.308 2003/09/07 20:35:59 itojun Exp $ */
+/* $NetBSD: key.c,v 1.93 2003/09/08 06:51:56 itojun Exp $ */
+/* $KAME: key.c,v 1.310 2003/09/08 02:23:44 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -35,10 +35,11 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.92 2003/09/08 01:55:09 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.93 2003/09/08 06:51:56 itojun Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
+#include "fs_kernfs.h"
#include <sys/param.h>
#include <sys/systm.h>
@@ -91,6 +92,10 @@ __KERNEL_RCSID(0, "$NetBSD: key.c,v 1.92 2003/09/08 01:55:09 itojun Exp $");
#endif
#include <netinet6/ipcomp.h>
+#ifdef KERNFS
+#include <miscfs/kernfs/kernfs.h>
+#endif
+
#include <machine/stdarg.h>
#include "rnd.h"
@@ -312,7 +317,6 @@ static struct secasvar *key_do_allocsa_policy __P((struct secashead *, u_int));
static void key_delsav __P((struct secasvar *));
static void key_delsp __P((struct secpolicy *));
static struct secpolicy *key_getsp __P((struct secpolicyindex *, int));
-static struct secpolicy *key_getspbyid __P((u_int32_t));
static u_int32_t key_newreqid __P((void));
static struct mbuf *key_gather_mbuf __P((struct mbuf *,
const struct sadb_msghdr *, int, int, ...));
@@ -328,8 +332,6 @@ static int key_spdflush __P((struct socket *, struct mbuf *,
const struct sadb_msghdr *));
static int key_spddump __P((struct socket *, struct mbuf *,
const struct sadb_msghdr *));
-static struct mbuf *key_setdumpsp __P((struct secpolicy *,
- u_int8_t, u_int32_t, u_int32_t));
static u_int key_getspreqmsglen __P((struct secpolicy *));
static int key_spdexpire __P((struct secpolicy *));
static struct secashead *key_newsah __P((struct secasindex *));
@@ -969,6 +971,10 @@ key_delsp(sp)
s = splsoftnet(); /*called from softclock()*/
+#ifdef KERNFS
+ kernfs_revoke_sp(sp);
+#endif
+
{
struct ipsecrequest *isr = sp->req, *nextisr;
@@ -1027,7 +1033,7 @@ key_getsp(spidx, dir)
* OUT: NULL : not found
* others : found, pointer to a SP.
*/
-static struct secpolicy *
+struct secpolicy *
key_getspbyid(id)
u_int32_t id;
{
@@ -2199,7 +2205,7 @@ key_spddump(so, m, mhp)
return 0;
}
-static struct mbuf *
+struct mbuf *
key_setdumpsp(sp, type, seq, pid)
struct secpolicy *sp;
u_int8_t type;
@@ -6548,6 +6554,49 @@ key_dump(so, m, mhp)
return 0;
}
+struct mbuf *
+key_setdumpsa_spi(spi)
+ u_int32_t spi;
+{
+ struct mbuf *m, *n;
+ struct secasvar *sav;
+ u_int8_t satype;
+ int cnt;
+
+ cnt = 0;
+ LIST_FOREACH(sav, &spihash[spi % SPIHASHSIZE], spihash) {
+ if (sav->spi != spi)
+ continue;
+ cnt++;
+ }
+
+ if (cnt == 0)
+ return NULL;
+
+ m = NULL;
+ LIST_FOREACH(sav, &spihash[spi % SPIHASHSIZE], spihash) {
+ if (sav->spi != spi)
+ continue;
+ satype = key_proto2satype(sav->sah->saidx.proto);
+ n = key_setdumpsa(sav, SADB_DUMP, satype, --cnt, 0);
+ if (!m)
+ m = n;
+ else if (n)
+ m_cat(m, n);
+ }
+
+ if (!m)
+ return NULL;
+
+ if ((m->m_flags & M_PKTHDR) != 0) {
+ m->m_pkthdr.len = 0;
+ for (n = m; n; n = n->m_next)
+ m->m_pkthdr.len += n->m_len;
+ }
+
+ return m;
+}
+
/*
* SADB_X_PROMISC processing
*
diff --git a/sys/netkey/key.h b/sys/netkey/key.h
index 9d10b1c8076..c9f414370b5 100644
--- a/sys/netkey/key.h
+++ b/sys/netkey/key.h
@@ -1,4 +1,4 @@
-/* $NetBSD: key.h,v 1.15 2003/09/07 15:59:38 itojun Exp $ */
+/* $NetBSD: key.h,v 1.16 2003/09/08 06:51:59 itojun Exp $ */
/* $KAME: key.h,v 1.32 2003/09/07 05:25:20 itojun Exp $ */
/*
@@ -56,6 +56,7 @@ extern int key_checkrequest
__P((struct ipsecrequest *isr, struct secasindex *));
extern struct secasvar *key_allocsa __P((u_int, caddr_t, caddr_t,
u_int, u_int32_t));
+extern struct secpolicy *key_getspbyid __P((u_int32_t));
extern void key_freesp __P((struct secpolicy *));
extern void key_freesav __P((struct secasvar *));
extern struct secpolicy *key_newsp __P((u_int32_t));
@@ -67,9 +68,12 @@ extern int key_cmpspidx_exactly
extern int key_cmpspidx_withmask
__P((struct secpolicyindex *, struct secpolicyindex *));
extern int key_spdacquire __P((struct secpolicy *));
+extern struct mbuf *key_setdumpsp __P((struct secpolicy *,
+ u_int8_t, u_int32_t, u_int32_t));
extern void key_timehandler __P((void *));
extern void key_randomfill __P((void *, size_t));
extern void key_freereg __P((struct socket *));
+struct mbuf *key_setdumpsa_spi __P((u_int32_t));
extern int key_parse __P((struct mbuf *, struct socket *));
extern void key_init __P((void));
extern int key_checktunnelsanity __P((struct secasvar *, u_int,