259 lines
8.8 KiB
C
259 lines
8.8 KiB
C
/*
|
|
******************************************************************************
|
|
* INTERPEAK CONFIGURATION SOURCE FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipipsec_config.c,v $ $Revision: 1.25.2.1 $
|
|
* $Source: /home/interpeak/CVSRoot/ipipsec2/config/ipipsec_config.c,v $
|
|
* $Author: csun $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Lennart Bang <lob@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include "ipipsec_config.h"
|
|
|
|
#include <ipcom_cstyle.h>
|
|
#include <ipcom_err.h>
|
|
#include <ipcom_sysvar.h>
|
|
#include <ipcom_os.h>
|
|
#include <ipcom_shell.h>
|
|
#include <ipcom_syslog.h>
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 EXTERN PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
IPCOM_PROCESS(ipipsec_config);
|
|
|
|
IP_PUBLIC int ipipsec_cmd_keyadm(int argc, char **argv);
|
|
IP_PUBLIC int ipipsec_cmd_ipsecctrl(int argc, char **argv);
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 LOCAL PROTOTYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
IP_PUBLIC Ip_err ipipsec_configure(void);
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 7 DATA
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* SYSTEM VARIABLES
|
|
*===========================================================================
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipipsec_conf_sysvar
|
|
*===========================================================================
|
|
*/
|
|
IP_STATIC IP_CONST Ipcom_sysvar ipipsec_conf_sysvar[] =
|
|
{
|
|
/* Default larval SA (created by getspi) timeout in seconds. */
|
|
IP_SYSVAR("ipipsec.larval_sa_tmo_seconds", "600", IPIPSEC_LARVAL_SA_TMO_SECONDS),
|
|
|
|
/* Set to 1 to enable extended sequence numbers (64-bit).
|
|
* Set to 0 to use 32-bit, which is default for most systems today.
|
|
*/
|
|
IP_SYSVAR("ipipsec.pfkey.esn_is_default", "0", "0"),
|
|
|
|
{ IP_NULL, IP_NULL }
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* common dynamic configuration parameters
|
|
*===========================================================================
|
|
* Note: not sysvars due to performance reasons!
|
|
*/
|
|
|
|
#ifdef IP_WB_BUILD
|
|
#define IPIPSEC_CONF_PARAM(value, cdf_define) cdf_define
|
|
#else
|
|
#define IPIPSEC_CONF_PARAM(value, cdf_define) value
|
|
#endif
|
|
|
|
int ipipsec_conf_enable_outfilter = IPIPSEC_CONF_PARAM(0, IPIPSEC_CONF_ENABLE_OUTFILTER);
|
|
|
|
/* Enable ESP, AH and IPIP. */
|
|
int ipipsec_conf_esp_enable = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_ESP_ENABLE);
|
|
int ipipsec_conf_ah_enable = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_AH_ENABLE);
|
|
int ipipsec_conf_ipip_allow = IPIPSEC_CONF_PARAM(1, IPIPSEC_CONF_IPIP_ALLOW); /* WARNING, IPIP IS A SECURITY RISK! */
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* non-LKM dynamic configuration parameters
|
|
*===========================================================================
|
|
* Note: not sysvars due to performance reasons!
|
|
*/
|
|
#ifndef IP_PORT_LKM
|
|
|
|
/* Maximum size of input SA hash-cache in unique packets that use SAs. */
|
|
int ipipsec_conf_sa_cache_maxsize = IPIPSEC_CONF_PARAM(16, IPIPSEC_CONF_SA_CACHE_MAXSIZE);
|
|
|
|
/* Maximum size of input/output flow hash-cache in unique packets. */
|
|
int ipipsec_conf_flow_cache_maxsize = IPIPSEC_CONF_PARAM(64, IPIPSEC_CONF_FLOW_CACHE_MAXSIZE);
|
|
|
|
#ifdef IPIPSEC_USE_ESN
|
|
int ipipsec_conf_esn_resync_trigger = IPIPSEC_CONF_PARAM(1000, 1000);
|
|
#endif
|
|
|
|
/* Traffic flow Confidentiality */
|
|
#ifdef IPIPSEC_USE_TFC
|
|
int ipipsec_max_tfc_bytes = IPIPSEC_CONF_PARAM(255, IPIPSEC_MAX_TFC_PADDING);
|
|
int ipipsec_max_tfc_delay = IPIPSEC_CONF_PARAM(10, IPIPSEC_MAX_TFC_DELAY);
|
|
int ipipsec_min_tfc_delay = IPIPSEC_CONF_PARAM(5, IPIPSEC_MIN_TFC_DELAY);
|
|
int ipipsec_max_dummy_payload = IPIPSEC_CONF_PARAM(500, IPIPSEC_MAX_DUMMY_SIZE);
|
|
#endif
|
|
|
|
/* Number of CPUs to be reserved for IPsec in SMP. (not dynamic) */
|
|
#ifdef INCLUDE_IP_SECURITY_SMP
|
|
int ipipsec_conf_num_cpus = IPIPSEC_SMP_NUM_CPUS;
|
|
#else
|
|
int ipipsec_conf_num_cpus = 0;
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* LKM dynamic configuration parameters
|
|
*===========================================================================
|
|
* The settings for the parameters below is done via the Linux Kconfig.
|
|
*/
|
|
#else /* !IP_PORT_LKM */
|
|
|
|
/* Maximum size of input SA hash-cache in unique packets that use SAs. */
|
|
int ipipsec_conf_sa_cache_maxsize = IPIPSEC_CONF_SA_CACHE_MAXSIZE;
|
|
|
|
/* Maximum size of input/output flow hash-cache in unique packets. */
|
|
int ipipsec_conf_flow_cache_maxsize = IPIPSEC_CONF_FLOW_CACHE_MAXSIZE;
|
|
|
|
#ifdef IPIPSEC_USE_ESN
|
|
int ipipsec_conf_esn_resync_trigger = IPIPSEC_CONF_ESN_RESYNC_TRIGGER;
|
|
#endif
|
|
|
|
/* Traffic flow Confidentiality */
|
|
#ifdef IPIPSEC_USE_TFC
|
|
int ipipsec_max_tfc_bytes = IPIPSEC_MAX_TFC_BYTES;
|
|
int ipipsec_max_tfc_delay = IPIPSEC_MAX_TFC_DELAY;
|
|
int ipipsec_min_tfc_delay = IPIPSEC_MIN_TFC_DELAY;
|
|
int ipipsec_max_dummy_payload = IPIPSEC_MAX_DUMMY_PAYLOAD;
|
|
#endif
|
|
|
|
/* Number of CPUs to be reserved for IPsec in SMP. (not dynamic) */
|
|
#ifdef IPIPSEC_CONF_NUM_CPUS
|
|
int ipipsec_conf_num_cpus = IPIPSEC_CONF_NUM_CPUS;
|
|
#else
|
|
int ipipsec_conf_num_cpus = 1;
|
|
#endif
|
|
|
|
|
|
#endif /*! IP_PORT_LKM */
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 8 STATIC FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 9 GLOBAL FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 10 PUBLIC FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ipipsec_configure
|
|
*===========================================================================
|
|
* Description:
|
|
* Parameters:
|
|
* Returns: IPCOM_SUCCESS = success.
|
|
*
|
|
*/
|
|
IP_PUBLIC Ip_err
|
|
ipipsec_configure(void)
|
|
{
|
|
/* Set IPIPSEC system variables. */
|
|
(void)ipcom_sysvar_setv(ipipsec_conf_sysvar, 0);
|
|
|
|
#if defined(IP_DEBUG) && !defined(IP_PORT_VXWORKS)
|
|
(void)ipcom_setlogmask_on(IPCOM_LOG_DEBUG2, IPCOM_LOG_IPIPSEC);
|
|
#endif
|
|
|
|
#if !defined(IP_PORT_LKM) && !defined(IP_PORT_OSE5) && !defined(IPCOM_FORWARDER_NAE)
|
|
#if !defined(IPWRNAD) && !defined(IP_PORT_VXWORKS)
|
|
(void)ipcom_proc_create("ipipsec_config", (Ipcom_proc_func)ipipsec_config, IPCOM_PROC_STACK_DEFAULT, IP_NULL);
|
|
#endif /* !IPWRNAD && !IP_PORT_VXWORKS */
|
|
|
|
#if defined(INCLUDE_IPSECCTRL_CMD) || !defined(IP_PORT_VXWORKS)
|
|
(void)ipcom_shell_add_cmd("ipsecctrl", "ipsecctrl [command] <modifier...>", "config ipsec",
|
|
ipipsec_cmd_ipsecctrl,
|
|
IPCOM_SHELL_PRIO_SAME, 2048);
|
|
#endif /* defined(INCLUDE_IPSECCTRL_CMD) || !defined(IP_PORT_VXWORKS) */
|
|
|
|
#if defined(INCLUDE_KEYADM_CMD) || !defined(IP_PORT_VXWORKS)
|
|
(void)ipcom_shell_add_cmd("keyadm", "keyadm [command] <modifier...>", "admin IPsec keys",
|
|
ipipsec_cmd_keyadm,
|
|
IPCOM_SHELL_PRIO_SAME, 4096);
|
|
#endif /* defined(INCLUDE_KEYADM_CMD) || !defined(IP_PORT_VXWORKS) */
|
|
#endif /* !defined(IP_PORT_LKM) && !defined(IP_PORT_OSE5) && !defined(IPCOM_FORWARDER_NAE) */
|
|
|
|
return IPCOM_SUCCESS;
|
|
|
|
|
|
}
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|