/* ****************************************************************************** * INTERPEAK CONFIGURATION SOURCE FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipipsec_config.c,v $ $Revision: 1.25.2.1 $ * $Source: /home/interpeak/CVSRoot/ipipsec2/config/ipipsec_config.c,v $ * $Author: csun $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Lennart Bang ****************************************************************************** */ /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 INCLUDE FILES **************************************************************************** */ #include "ipipsec_config.h" #include #include #include #include #include #include /* **************************************************************************** * 3 DEFINES **************************************************************************** */ /* **************************************************************************** * 4 TYPES **************************************************************************** */ /* **************************************************************************** * 5 EXTERN PROTOTYPES **************************************************************************** */ IPCOM_PROCESS(ipipsec_config); IP_PUBLIC int ipipsec_cmd_keyadm(int argc, char **argv); IP_PUBLIC int ipipsec_cmd_ipsecctrl(int argc, char **argv); /* **************************************************************************** * 6 LOCAL PROTOTYPES **************************************************************************** */ IP_PUBLIC Ip_err ipipsec_configure(void); /* **************************************************************************** * 7 DATA **************************************************************************** */ /* *=========================================================================== * SYSTEM VARIABLES *=========================================================================== */ /* *=========================================================================== * ipipsec_conf_sysvar *=========================================================================== */ IP_STATIC IP_CONST Ipcom_sysvar ipipsec_conf_sysvar[] = { /* Default larval SA (created by getspi) timeout in seconds. */ IP_SYSVAR("ipipsec.larval_sa_tmo_seconds", "600", IPIPSEC_LARVAL_SA_TMO_SECONDS), /* Set to 1 to enable extended sequence numbers (64-bit). * Set to 0 to use 32-bit, which is default for most systems today. */ IP_SYSVAR("ipipsec.pfkey.esn_is_default", "0", "0"), { IP_NULL, IP_NULL } }; /* *=========================================================================== * common dynamic configuration parameters *=========================================================================== * Note: not sysvars due to performance reasons! */ #ifdef IP_WB_BUILD #define IPIPSEC_CONF_PARAM(value, cdf_define) cdf_define #else #define IPIPSEC_CONF_PARAM(value, cdf_define) value #endif int ipipsec_conf_enable_outfilter = IPIPSEC_CONF_PARAM(0, IPIPSEC_CONF_ENABLE_OUTFILTER); /* Enable ESP, AH and IPIP. */ int ipipsec_conf_esp_enable = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_ESP_ENABLE); int ipipsec_conf_ah_enable = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_AH_ENABLE); int ipipsec_conf_ipip_allow = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_IPIP_ALLOW); /* WARNING, IPIP IS A SECURITY RISK! */ /* *=========================================================================== * non-LKM dynamic configuration parameters *=========================================================================== * Note: not sysvars due to performance reasons! */ #ifndef IP_PORT_LKM /* Maximum size of input SA hash-cache in unique packets that use SAs. */ int ipipsec_conf_sa_cache_maxsize = IPIPSEC_CONF_PARAM(16, IPIPSEC_CONF_SA_CACHE_MAXSIZE); /* Maximum size of input/output flow hash-cache in unique packets. */ int ipipsec_conf_flow_cache_maxsize = IPIPSEC_CONF_PARAM(64, IPIPSEC_CONF_FLOW_CACHE_MAXSIZE); #ifdef IPIPSEC_USE_ESN int ipipsec_conf_esn_resync_trigger = IPIPSEC_CONF_PARAM(1000, 1000); #endif /* Traffic flow Confidentiality */ #ifdef IPIPSEC_USE_TFC int ipipsec_max_tfc_bytes = IPIPSEC_CONF_PARAM(255, IPIPSEC_MAX_TFC_PADDING); int ipipsec_max_tfc_delay = IPIPSEC_CONF_PARAM(10, IPIPSEC_MAX_TFC_DELAY); int ipipsec_min_tfc_delay = IPIPSEC_CONF_PARAM(5, IPIPSEC_MIN_TFC_DELAY); int ipipsec_max_dummy_payload = IPIPSEC_CONF_PARAM(500, IPIPSEC_MAX_DUMMY_SIZE); #endif /* Number of CPUs to be reserved for IPsec in SMP. (not dynamic) */ #ifdef INCLUDE_IP_SECURITY_SMP int ipipsec_conf_num_cpus = IPIPSEC_SMP_NUM_CPUS; #else int ipipsec_conf_num_cpus = 0; #endif /* *=========================================================================== * LKM dynamic configuration parameters *=========================================================================== * The settings for the parameters below is done via the Linux Kconfig. */ #else /* !IP_PORT_LKM */ /* Maximum size of input SA hash-cache in unique packets that use SAs. */ int ipipsec_conf_sa_cache_maxsize = IPIPSEC_CONF_SA_CACHE_MAXSIZE; /* Maximum size of input/output flow hash-cache in unique packets. */ int ipipsec_conf_flow_cache_maxsize = IPIPSEC_CONF_FLOW_CACHE_MAXSIZE; #ifdef IPIPSEC_USE_ESN int ipipsec_conf_esn_resync_trigger = IPIPSEC_CONF_ESN_RESYNC_TRIGGER; #endif /* Traffic flow Confidentiality */ #ifdef IPIPSEC_USE_TFC int ipipsec_max_tfc_bytes = IPIPSEC_MAX_TFC_BYTES; int ipipsec_max_tfc_delay = IPIPSEC_MAX_TFC_DELAY; int ipipsec_min_tfc_delay = IPIPSEC_MIN_TFC_DELAY; int ipipsec_max_dummy_payload = IPIPSEC_MAX_DUMMY_PAYLOAD; #endif /* Number of CPUs to be reserved for IPsec in SMP. (not dynamic) */ #ifdef IPIPSEC_CONF_NUM_CPUS int ipipsec_conf_num_cpus = IPIPSEC_CONF_NUM_CPUS; #else int ipipsec_conf_num_cpus = 1; #endif #endif /*! IP_PORT_LKM */ /* **************************************************************************** * 8 STATIC FUNCTIONS **************************************************************************** */ /* **************************************************************************** * 9 GLOBAL FUNCTIONS **************************************************************************** */ /* **************************************************************************** * 10 PUBLIC FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipipsec_configure *=========================================================================== * Description: * Parameters: * Returns: IPCOM_SUCCESS = success. * */ IP_PUBLIC Ip_err ipipsec_configure(void) { /* Set IPIPSEC system variables. */ (void)ipcom_sysvar_setv(ipipsec_conf_sysvar, 0); #if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS) (void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIPSEC); #endif #if !defined(IP_PORT_LKM) && !defined(IP_PORT_OSE5) && !defined(IPCOM_FORWARDER_NAE) #if !defined(IPWRNAD) && !defined(IP_PORT_VXWORKS) (void)ipcom_proc_create("ipipsec_config", (Ipcom_proc_func)ipipsec_config, IPCOM_PROC_STACK_DEFAULT, IP_NULL); #endif /* !IPWRNAD && !IP_PORT_VXWORKS */ #if defined(INCLUDE_IPSECCTRL_CMD) || !defined(IP_PORT_VXWORKS) (void)ipcom_shell_add_cmd("ipsecctrl", "ipsecctrl [command] ", "config ipsec", ipipsec_cmd_ipsecctrl, IPCOM_SHELL_PRIO_SAME, 2048); #endif /* defined(INCLUDE_IPSECCTRL_CMD) || !defined(IP_PORT_VXWORKS) */ #if defined(INCLUDE_KEYADM_CMD) || !defined(IP_PORT_VXWORKS) (void)ipcom_shell_add_cmd("keyadm", "keyadm [command] ", "admin IPsec keys", ipipsec_cmd_keyadm, IPCOM_SHELL_PRIO_SAME, 4096); #endif /* defined(INCLUDE_KEYADM_CMD) || !defined(IP_PORT_VXWORKS) */ #endif /* !defined(IP_PORT_LKM) && !defined(IP_PORT_OSE5) && !defined(IPCOM_FORWARDER_NAE) */ return IPCOM_SUCCESS; } /* **************************************************************************** * END OF FILE **************************************************************************** */