IPsec socket API hooks are in.

diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index d69dbce..9fca4a4 100644 (file)
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: in.h,v 1.7 1997/02/20 01:07:45 deraadt Exp $  */
+/*     $OpenBSD: in.h,v 1.8 1997/02/28 03:44:52 angelos Exp $  */
 /*     $NetBSD: in.h,v 1.20 1996/02/13 23:41:47 christos Exp $ */
 
 /*
@@ -231,6 +231,27 @@ struct ip_opts {
 #define        IP_DROP_MEMBERSHIP      13   /* ip_mreq; drop an IP group membership */
        /* 14-17 left empty for future compatibility with FreeBSD */
 #define IP_PORTRANGE           19   /* int; range to choose for unspec port */
+#define IP_AUTH_LEVEL          20   /* u_char; authentication used */
+#define IP_ESP_TRANS_LEVEL      21   /* u_char; transport encryption */
+#define IP_ESP_NETWORK_LEVEL    22   /* u_char; full-packet encryption */
+
+
+/*
+ * Security levels - IPsec, not IPSO
+ */
+
+#define IPSEC_LEVEL_BYPASS      0x00    /* Bypass policy altogether */
+#define IPSEC_LEVEL_NONE        0x00    /* Send clear, accept any */
+#define IPSEC_LEVEL_AVAIL       0x01    /* Send secure if SA available */
+#define IPSEC_LEVEL_USE         0x02    /* Send secure, accept any */
+#define IPSEC_LEVEL_REQUIRE     0x03    /* Require secure inbound, also use */
+#define IPSEC_LEVEL_UNIQUE      0x04    /* Use outbound SA that is unique */
+#define IPSEC_LEVEL_DEFAULT     IPSEC_LEVEL_NONE
+
+#define IPSEC_AUTH_LEVEL_DEFAULT IPSEC_LEVEL_DEFAULT
+#define IPSEC_ESP_TRANS_LEVEL_DEFAULT IPSEC_LEVEL_DEFAULT
+#define IPSEC_ESP_NETWORK_LEVEL_DEFAULT IPSEC_LEVEL_DEFAULT
+
 
 /*
  * Defaults and limits for options

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index c0decb9..4753f60 100644 (file)
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ip_input.c,v 1.24 1997/02/22 13:25:28 angelos Exp $   */
+/*     $OpenBSD: ip_input.c,v 1.25 1997/02/28 03:44:53 angelos Exp $   */
 /*     $NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $   */
 
 /*
@@ -95,6 +95,10 @@ int  ip_directedbcast = IPDIRECTEDBCAST;
 int    ipprintfs = 0;
 #endif
 
+u_char  ipsec_auth_default_level = IPSEC_AUTH_LEVEL_DEFAULT;
+u_char  ipsec_esp_trans_default_level = IPSEC_ESP_TRANS_LEVEL_DEFAULT;
+u_char  ipsec_esp_network_default_level = IPSEC_ESP_NETWORK_LEVEL_DEFAULT;
+
 /* from in_pcb.c */
 extern int ipport_firstauto;
 extern int ipport_lastauto;

diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index 0bfe9cc..045444f 100644 (file)
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ip_output.c,v 1.7 1997/02/20 01:08:06 deraadt Exp $   */
+/*     $OpenBSD: ip_output.c,v 1.8 1997/02/28 03:44:54 angelos Exp $   */
 /*     $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $  */
 
 /*
@@ -794,6 +794,35 @@ ip_ctloutput(op, so, level, optname, mp)
                        }
                        break;
 
+               case IP_AUTH_LEVEL:
+               case IP_ESP_TRANS_LEVEL:
+               case IP_ESP_NETWORK_LEVEL:
+#ifndef IPSEC
+                   error = EINVAL;
+#else
+                   if (m == 0 || m->m_len != sizeof(u_char))
+                     error = EINVAL;
+                   else {
+                       optval = *mtod(m, u_char *);
+                       
+                       switch (optname) {
+                           case IP_AUTH_LEVEL:
+                               so->so_seclevel[SL_AUTH] = optval;
+                               break;
+
+                           case IP_ESP_TRANS_LEVEL:
+                               so->so_seclevel[SL_ESP_TRANS] = optval;
+                               break;
+                               
+                           case IP_ESP_NETWORK_LEVEL:
+                               so->so_seclevel[SL_ESP_NETWORK] = optval;
+                               break;
+                       }
+                       
+                   }
+#endif
+                   break;
+                   
                default:
                        error = ENOPROTOOPT;
                        break;
@@ -871,6 +900,30 @@ ip_ctloutput(op, so, level, optname, mp)
                        *mtod(m, int *) = optval;
                        break;
 
+               case IP_AUTH_LEVEL:
+               case IP_ESP_TRANS_LEVEL:
+               case IP_ESP_NETWORK_LEVEL:
+#ifndef IPSEC
+                   *mtod(m, int *) = IPSEC_LEVEL_NONE;
+#else
+                   switch (optname) {
+                           case IP_AUTH_LEVEL:
+                                   optval = so->so_seclevel[SL_AUTH];
+                                   break;
+                               
+                           case IP_ESP_TRANS_LEVEL:
+                                   optval = so->so_seclevel[SL_ESP_TRANS];
+                                   break;
+                               
+                           case IP_ESP_NETWORK_LEVEL:
+                                   optval = so->so_seclevel[SL_ESP_NETWORK];
+                                   break;
+                   }
+                   
+                   *mtod(m, int *) = optval;
+#endif
+                   break;
+                               
                default:
                        error = ENOPROTOOPT;
                        break;