2 * @(#) Initialization code.
3 * Copyright (C) 1996, 1997 John Ioannidis.
4 * Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs <rgb@freeswan.org>
5 * 2001 Michael Richardson <mcr@freeswan.org>
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 * /proc system code was split out into ipsec_proc.c after rev. 1.70.
21 char ipsec_init_c_version[] = "RCSID $Id: ipsec_init.c,v 1.80 2002/03/24 07:34:08 rgb Exp $";
23 #include <linux/config.h>
24 #include <linux/version.h>
25 #include <linux/module.h>
26 #include <linux/kernel.h> /* printk() */
28 #include "ipsec_param.h"
31 # include <linux/slab.h> /* kmalloc() */
32 #else /* MALLOC_SLAB */
33 # include <linux/malloc.h> /* kmalloc() */
34 #endif /* MALLOC_SLAB */
35 #include <linux/errno.h> /* error codes */
36 #include <linux/types.h> /* size_t */
37 #include <linux/interrupt.h> /* mark_bh */
39 #include <linux/netdevice.h> /* struct device, and other headers */
40 #include <linux/etherdevice.h> /* eth_type_trans */
41 #include <linux/ip.h> /* struct iphdr */
42 #include <linux/in.h> /* struct sockaddr_in */
43 #include <linux/skbuff.h>
47 # include <asm/uaccess.h>
48 # include <linux/in6.h>
51 #include <asm/checksum.h>
55 # include <linux/proc_fs.h>
56 #endif /* CONFIG_PROC_FS */
59 # include <linux/netlink.h>
61 # include <net/netlink.h>
66 #include "ipsec_life.h"
67 #include "ipsec_stats.h"
70 #include "ipsec_encap.h"
71 #include "ipsec_radij.h"
72 #include "ipsec_netlink.h"
73 #include "ipsec_xform.h"
74 #include "ipsec_tunnel.h"
76 #include "ipsec_rcv.h"
78 #include "ipsec_esp.h"
80 #ifdef CONFIG_IPSEC_IPCOMP
82 #endif /* CONFIG_IPSEC_IPCOMP */
84 #include "ipsec_proto.h"
85 #include "ipsec_alg.h"
87 #ifdef USE_IXP4XX_CRYPTO
88 #include "ipsec_glue_mbuf.h"
89 #include "ipsec_glue.h"
90 #include "ipsec_glue_desc.h"
91 #endif /* USE_IXP4XX_CRYPTO */
96 #if !defined(CONFIG_IPSEC_ESP) && !defined(CONFIG_IPSEC_AH)
97 #error "kernel configuration must include ESP or AH"
101 * seems to be present in 2.4.10 (Linus), but also in some RH and other
102 * distro kernels of a lower number.
104 #ifdef MODULE_LICENSE
105 MODULE_LICENSE("Dual BSD/GPL");
108 #ifdef CONFIG_IPSEC_DEBUG
109 int debug_eroute = 0;
111 int debug_netlink = 0;
112 #endif /* CONFIG_IPSEC_DEBUG */
114 int ipsec_device_event(struct notifier_block *dnot, unsigned long event, void *ptr);
116 * the following structure is required so that we receive
117 * event notifications when network devices are enabled and
118 * disabled (ifconfig up and down).
120 static struct notifier_block ipsec_dev_notifier={
127 extern int ipsec_sysctl_register(void);
128 extern void ipsec_sysctl_unregister(void);
136 #ifdef CONFIG_IPSEC_ENC_3DES
137 extern int des_check_key;
139 /* turn off checking of keys */
141 #endif /* CONFIG_IPSEC_ENC_3DES */
143 KLIPS_PRINT(1, "klips_info:ipsec_init: "
144 "KLIPS startup, FreeS/WAN IPSec version: %s\n",
145 ipsec_version_code());
147 #ifdef USE_IXP4XX_CRYPTO
148 (void) ixCryptoAccInit();
151 error |= ipsec_proc_init();
155 eroute_lock.lock = 0;
156 #endif /* !SPINLOCK */
158 error |= ipsec_sadb_init();
159 error |= ipsec_radijinit();
161 error |= pfkey_init();
163 error |= register_netdevice_notifier(&ipsec_dev_notifier);
165 #ifdef CONFIG_IPSEC_ESP
166 inet_add_protocol(&esp_protocol);
167 #endif /* CONFIG_IPSEC_ESP */
169 #ifdef CONFIG_IPSEC_AH
170 inet_add_protocol(&ah_protocol);
171 #endif /* CONFIG_IPSEC_AH */
174 #ifdef CONFIG_IPSEC_IPCOMP
175 inet_add_protocol(&comp_protocol);
176 #endif /* CONFIG_IPSEC_IPCOMP */
179 error |= ipsec_tunnel_init_devices();
182 error |= ipsec_sysctl_register();
185 #ifdef USE_IXP4XX_CRYPTO
186 ipsec_glue_crypto_ctx_init();
187 ipsec_glue_mbuf_header_init();
188 ipsec_glue_mbuf_init();
189 ipsec_glue_rcv_desc_init();
190 ipsec_glue_xmit_desc_init();
191 #endif /* USE_IXP4XX_CRYPTO */
193 #ifdef CONFIG_IPSEC_ALG
197 #if LINUX_VERSION_CODE < 0x020100
211 ipsec_sysctl_unregister();
213 KLIPS_PRINT(debug_netlink, /* debug_tunnel & DB_TN_INIT, */
214 "klips_debug:ipsec_cleanup: "
215 "calling ipsec_tunnel_cleanup_devices.\n");
216 error |= ipsec_tunnel_cleanup_devices();
219 #ifdef CONFIG_IPSEC_IPCOMP
220 if (inet_del_protocol(&comp_protocol) < 0)
221 printk(KERN_INFO "klips_debug:ipsec_cleanup: "
222 "comp close: can't remove protocol\n");
223 #endif /* CONFIG_IPSEC_IPCOMP */
225 #ifdef CONFIG_IPSEC_AH
226 if (inet_del_protocol(&ah_protocol) < 0)
227 printk(KERN_INFO "klips_debug:ipsec_cleanup: "
228 "ah close: can't remove protocol\n");
229 #endif /* CONFIG_IPSEC_AH */
230 #ifdef CONFIG_IPSEC_ESP
231 if (inet_del_protocol(&esp_protocol) < 0)
232 printk(KERN_INFO "klips_debug:ipsec_cleanup: "
233 "esp close: can't remove protocol\n");
234 #endif /* CONFIG_IPSEC_ESP */
236 error |= unregister_netdevice_notifier(&ipsec_dev_notifier);
238 KLIPS_PRINT(debug_netlink, /* debug_tunnel & DB_TN_INIT, */
239 "klips_debug:ipsec_cleanup: "
240 "calling ipsec_tdbcleanup.\n");
241 error |= ipsec_sadb_cleanup(0);
242 KLIPS_PRINT(debug_netlink, /* debug_tunnel & DB_TN_INIT, */
243 "klips_debug:ipsec_cleanup: "
244 "calling ipsec_radijcleanup.\n");
245 error |= ipsec_radijcleanup();
247 KLIPS_PRINT(debug_pfkey, /* debug_tunnel & DB_TN_INIT, */
248 "klips_debug:ipsec_cleanup: "
249 "calling pfkey_cleanup.\n");
250 error |= pfkey_cleanup();
252 ipsec_proc_cleanup();
254 #if LINUX_VERSION_CODE < 0x020100
266 error |= ipsec_init();
276 KLIPS_PRINT(debug_netlink, /* debug_tunnel & DB_TN_INIT, */
277 "klips_debug:cleanup_module: "
278 "calling ipsec_cleanup.\n");
280 error |= ipsec_cleanup();
282 KLIPS_PRINT(1, "klips_info:cleanup_module: "
283 "ipsec module unloaded.\n");
290 * $Log: ipsec_init.c,v $
291 * Revision 1.80 2002/03/24 07:34:08 rgb
292 * Sanity check for at least one of AH or ESP configured.
294 * Revision 1.79 2002/02/05 22:55:15 mcr
295 * added MODULE_LICENSE declaration.
296 * This macro does not appear in all kernel versions (see comment).
298 * Revision 1.78 2002/01/29 17:17:55 mcr
299 * moved include of ipsec_param.h to after include of linux/kernel.h
300 * otherwise, it seems that some option that is set in ipsec_param.h
301 * screws up something subtle in the include path to kernel.h, and
302 * it complains on the snprintf() prototype.
304 * Revision 1.77 2002/01/29 04:00:51 mcr
305 * more excise of kversions.h header.
307 * Revision 1.76 2002/01/29 02:13:17 mcr
308 * introduction of ipsec_kversion.h means that include of
309 * ipsec_param.h must preceed any decisions about what files to
310 * include to deal with differences in kernel source.
312 * Revision 1.75 2001/11/26 09:23:48 rgb
313 * Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
315 * Revision 1.74 2001/11/22 05:44:11 henry
318 * Revision 1.71.2.2 2001/10/22 20:51:00 mcr
319 * explicitely set des_check_key.
321 * Revision 1.71.2.1 2001/09/25 02:19:39 mcr
322 * /proc manipulation code moved to new ipsec_proc.c
324 * Revision 1.73 2001/11/06 19:47:17 rgb
325 * Changed lifetime_packets to uint32 from uint64.
327 * Revision 1.72 2001/10/18 04:45:19 rgb
328 * 2.4.9 kernel deprecates linux/malloc.h in favour of linux/slab.h,
329 * lib/freeswan.h version macros moved to lib/kversions.h.
330 * Other compiler directive cleanups.
332 * Revision 1.71 2001/09/20 15:32:45 rgb
333 * Minor pfkey lifetime fixes.
335 * Revision 1.70 2001/07/06 19:51:21 rgb
336 * Added inbound policy checking code for IPIP SAs.
338 * Revision 1.69 2001/06/14 19:33:26 rgb
339 * Silence startup message for console, but allow it to be logged.
340 * Update copyright date.
342 * Revision 1.68 2001/05/29 05:14:36 rgb
343 * Added PMTU to /proc/net/ipsec_tncfg output. See 'man 5 ipsec_tncfg'.
345 * Revision 1.67 2001/05/04 16:34:52 rgb
346 * Rremove erroneous checking of return codes for proc_net_* in 2.4.
348 * Revision 1.66 2001/05/03 19:40:34 rgb
349 * Check error return codes in startup and shutdown.
351 * Revision 1.65 2001/02/28 05:03:27 rgb
352 * Clean up and rationalise startup messages.
354 * Revision 1.64 2001/02/27 22:24:53 rgb
355 * Re-formatting debug output (line-splitting, joining, 1arg/line).
356 * Check for satoa() return codes.
358 * Revision 1.63 2000/11/29 20:14:06 rgb
359 * Add src= to the output of /proc/net/ipsec_spi and delete dst from IPIP.
361 * Revision 1.62 2000/11/06 04:31:24 rgb
362 * Ditched spin_lock_irqsave in favour of spin_lock_bh.
363 * Fixed longlong for pre-2.4 kernels (Svenning).
364 * Add Svenning's adaptive content compression.
365 * Disabled registration of ipcomp handler.
367 * Revision 1.61 2000/10/11 13:37:54 rgb
368 * #ifdef out debug print that causes proc/net/ipsec_version to oops.
370 * Revision 1.60 2000/09/20 03:59:01 rgb
371 * Change static info functions to DEBUG_NO_STATIC to reveal function names
374 * Revision 1.59 2000/09/16 01:06:26 rgb
375 * Added cast of var to silence compiler warning about long fed to int
378 * Revision 1.58 2000/09/15 11:37:01 rgb
379 * Merge in heavily modified Svenning Soerensen's <svenning@post5.tele.dk>
380 * IPCOMP zlib deflate code.
382 * Revision 1.57 2000/09/12 03:21:50 rgb
383 * Moved radij_c_version printing to ipsec_version_get_info().
384 * Reformatted ipsec_version_get_info().
385 * Added sysctl_{,un}register() calls.
387 * Revision 1.56 2000/09/08 19:16:50 rgb
388 * Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
389 * Removed all references to CONFIG_IPSEC_PFKEYv2.
391 * Revision 1.55 2000/08/30 05:19:03 rgb
392 * Cleaned up no longer used spi_next, netlink register/unregister, other
394 * Removed cruft replaced by TDB_XFORM_NAME.
395 * Removed all the rest of the references to tdb_spi, tdb_proto, tdb_dst.
396 * Moved debug version strings to printk when /proc/net/ipsec_version is
399 * Revision 1.54 2000/08/20 18:31:05 rgb
400 * Changed cosmetic alignment in spi_info.
401 * Changed addtime and usetime to use actual value which is relative
402 * anyways, as intended. (Momchil)
404 * Revision 1.53 2000/08/18 17:37:03 rgb
405 * Added an (int) cast to shut up the compiler...
407 * Revision 1.52 2000/08/01 14:51:50 rgb
408 * Removed _all_ remaining traces of DES.
410 * Revision 1.51 2000/07/25 20:41:22 rgb
411 * Removed duplicate parameter in spi_getinfo.
413 * Revision 1.50 2000/07/17 03:21:45 rgb
414 * Removed /proc/net/ipsec_spinew.
416 * Revision 1.49 2000/06/28 05:46:51 rgb
417 * Renamed ivlen to iv_bits for consistency.
418 * Changed output of add and use times to be relative to now.
420 * Revision 1.48 2000/05/11 18:26:10 rgb
421 * Commented out calls to netlink_attach/detach to avoid activating netlink
422 * in the kenrel config.
424 * Revision 1.47 2000/05/10 22:35:26 rgb
425 * Comment out most of the startup version information.
427 * Revision 1.46 2000/03/22 16:15:36 rgb
428 * Fixed renaming of dev_get (MB).
430 * Revision 1.45 2000/03/16 06:40:48 rgb
431 * Hardcode PF_KEYv2 support.
433 * Revision 1.44 2000/01/22 23:19:20 rgb
434 * Simplified code to use existing macro TDB_XFORM_NAME().
436 * Revision 1.43 2000/01/21 06:14:04 rgb
437 * Print individual stats only if non-zero.
438 * Removed 'bits' from each keylength for brevity.
439 * Shortened lifetimes legend for brevity.
440 * Changed wording from 'last_used' to the clearer 'idle'.
442 * Revision 1.42 1999/12/31 14:57:19 rgb
443 * MB fix for new dummy-less proc_get_info in 2.3.35.
445 * Revision 1.41 1999/11/23 23:04:03 rgb
446 * Use provided macro ADDRTOA_BUF instead of hardcoded value.
447 * Sort out pfkey and freeswan headers, putting them in a library path.
449 * Revision 1.40 1999/11/18 18:47:01 rgb
450 * Added dynamic proc registration for 2.3.25+.
451 * Changed all device registrations for static linking to
452 * dynamic to reduce the number and size of patches.
453 * Changed all protocol registrations for static linking to
454 * dynamic to reduce the number and size of patches.
456 * Revision 1.39 1999/11/18 04:12:07 rgb
457 * Replaced all kernel version macros to shorter, readable form.
458 * Added Marc Boucher's 2.3.25 proc patches.
459 * Converted all PROC_FS entries to dynamic to reduce kernel patching.
460 * Added CONFIG_PROC_FS compiler directives in case it is shut off.
462 * Revision 1.38 1999/11/17 15:53:38 rgb
463 * Changed all occurrences of #include "../../../lib/freeswan.h"
464 * to #include <freeswan.h> which works due to -Ilibfreeswan in the
465 * klips/net/ipsec/Makefile.
467 * Revision 1.37 1999/10/16 04:23:06 rgb
468 * Add stats for replaywin_errs, replaywin_max_sequence_difference,
469 * authentication errors, encryption size errors, encryption padding
470 * errors, and time since last packet.
472 * Revision 1.36 1999/10/16 00:30:47 rgb
473 * Added SA lifetime counting.
475 * Revision 1.35 1999/10/15 22:14:00 rgb
478 * Revision 1.34 1999/10/03 18:46:28 rgb
479 * Spinlock fixes for 2.0.xx and 2.3.xx.
481 * Revision 1.33 1999/10/01 17:08:10 rgb
482 * Disable spinlock init.
484 * Revision 1.32 1999/10/01 16:22:24 rgb
485 * Switch from assignment init. to functional init. of spinlocks.
487 * Revision 1.31 1999/10/01 15:44:52 rgb
488 * Move spinlock header include to 2.1> scope.
490 * Revision 1.30 1999/10/01 00:00:16 rgb
491 * Added eroute structure locking.
492 * Added tdb structure locking.
493 * Minor formatting changes.
494 * Add call to initialize tdb hash table.
496 * Revision 1.29 1999/09/23 20:22:40 rgb
497 * Enable, tidy and fix network notifier code.
499 * Revision 1.28 1999/09/18 11:39:56 rgb
500 * Start to add (disabled) netdevice notifier code.
502 * Revision 1.27 1999/08/28 08:24:47 rgb
503 * Add compiler directives to compile cleanly without debugging.
505 * Revision 1.26 1999/08/06 16:03:22 rgb
506 * Correct error messages on failure to unload /proc entries.
508 * Revision 1.25 1999/08/03 17:07:25 rgb
509 * Report device MTU, not private MTU.
511 * Revision 1.24 1999/05/25 22:24:37 rgb
512 * /PROC/NET/ipsec* init problem fix.
514 * Revision 1.23 1999/05/25 02:16:38 rgb
515 * Make modular proc_fs entries dynamic and fix for 2.2.x.
517 * Revision 1.22 1999/05/09 03:25:35 rgb
518 * Fix bug introduced by 2.2 quick-and-dirty patch.
520 * Revision 1.21 1999/05/05 22:02:30 rgb
521 * Add a quick and dirty port to 2.2 kernels by Marc Boucher <marc@mbsi.ca>.
523 * Revision 1.20 1999/04/29 15:15:50 rgb
524 * Fix undetected iv_len reporting bug.
525 * Add sanity checking for null pointer to private data space.
526 * Add return values to init and cleanup functions.
528 * Revision 1.19 1999/04/27 19:24:44 rgb
529 * Added /proc/net/ipsec_klipsdebug support for reading the current debug
531 * Instrument module load/init/unload.
533 * Revision 1.18 1999/04/15 15:37:24 rgb
534 * Forward check changes from POST1_00 branch.
536 * Revision 1.15.2.3 1999/04/13 20:29:19 rgb
537 * /proc/net/ipsec_* cleanup.
539 * Revision 1.15.2.2 1999/04/02 04:28:23 rgb
540 * /proc/net/ipsec_* formatting enhancements.
542 * Revision 1.15.2.1 1999/03/30 17:08:33 rgb
543 * Add pfkey initialisation.
545 * Revision 1.17 1999/04/11 00:28:57 henry
548 * Revision 1.16 1999/04/06 04:54:25 rgb
549 * Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
552 * Revision 1.15 1999/02/24 20:15:07 rgb
553 * Update output format.
555 * Revision 1.14 1999/02/17 16:49:39 rgb
556 * Convert DEBUG_IPSEC to KLIPS_PRINT
557 * Ditch NET_IPIP dependancy.
559 * Revision 1.13 1999/01/26 02:06:37 rgb
560 * Remove ah/esp switching on include files.
561 * Removed CONFIG_IPSEC_ALGO_SWITCH macro.
563 * Remove references to INET_GET_PROTOCOL.
565 * Revision 1.12 1999/01/22 06:19:18 rgb
568 * Added algorithm switch code.
570 * Revision 1.11 1998/12/01 05:54:53 rgb
571 * Cleanup and order debug version output.
573 * Revision 1.10 1998/11/30 13:22:54 rgb
574 * Rationalised all the klips kernel file headers. They are much shorter
575 * now and won't conflict under RH5.2.
577 * Revision 1.9 1998/11/10 05:35:13 rgb
578 * Print direction in/out flag from /proc/net/ipsec_spi.
580 * Revision 1.8 1998/10/27 13:48:10 rgb
581 * Cleaned up /proc/net/ipsec_* filesystem for easy parsing by scripts.
582 * Fixed less(1) truncated output bug.
585 * Revision 1.7 1998/10/22 06:43:16 rgb
586 * Convert to use satoa for printk.
588 * Revision 1.6 1998/10/19 14:24:35 rgb
589 * Added inclusion of freeswan.h.
591 * Revision 1.5 1998/10/09 04:43:35 rgb
592 * Added 'klips_debug' prefix to all klips printk debug statements.
594 * Revision 1.4 1998/07/27 21:50:22 rgb
595 * Not necessary to traverse mask tree for /proc/net/ipsec_eroute.
597 * Revision 1.3 1998/06/25 19:51:20 rgb
598 * Clean up #endif comments.
599 * Shift debugging comment control for procfs to debug_tunnel.
600 * Make proc_dir_entries visible to rest of kernel for static link.
601 * Replace hardwired fileperms with macros.
602 * Use macros for procfs inode numbers.
603 * Rearrange initialisations between ipsec_init and module_init as appropriate
604 * for static loading.
606 * Revision 1.2 1998/06/23 02:55:43 rgb
607 * Slightly quieted init-time messages.
608 * Re-introduced inet_add_protocol after it mysteriously disappeared...
609 * Check for and warn of absence of IPIP protocol on install of module.
610 * Move tdbcleanup to ipsec_xform.c.
612 * Revision 1.10 1998/06/18 21:29:04 henry
613 * move sources from klips/src to klips/net/ipsec, to keep stupid kernel
614 * build scripts happier in presence of symbolic links
616 * Revision 1.9 1998/06/14 23:49:40 rgb
617 * Clarify version reporting on module loading.
619 * Revision 1.8 1998/06/11 05:54:23 rgb
620 * Added /proc/net/ipsec_version to report freeswan and transform versions.
621 * Added /proc/net/ipsec_spinew to generate new and unique spi's..
622 * Fixed /proc/net/ipsec_tncfg bug.
624 * Revision 1.7 1998/05/25 20:23:13 rgb
625 * proc_register changed to dynamic registration to avoid arbitrary inode
628 * Implement memory recovery from tdb and eroute tables.
630 * Revision 1.6 1998/05/21 13:08:58 rgb
631 * Rewrote procinfo subroutines to avoid *bad things* when more that 3k of
632 * information is available for printout.
634 * Revision 1.5 1998/05/18 21:29:48 rgb
635 * Cleaned up /proc/net/ipsec_* output, including a title line, algorithm
636 * names instead of numbers, standard format for numerical output base,
637 * whitespace for legibility, and the names themselves for consistency.
639 * Added /proc/net/ipsec_spigrp and /proc/net/ipsec_tncfg.
641 * Revision 1.4 1998/04/30 15:42:24 rgb
642 * Silencing attach for normal operations with #ifdef IPSEC_DEBUG.
644 * Revision 1.3 1998/04/21 21:28:58 rgb
645 * Rearrange debug switches to change on the fly debug output from user
646 * space. Only kernel changes checked in at this time. radij.c was also
647 * changed to temporarily remove buggy debugging code in rj_delete causing
648 * an OOPS and hence, netlink device open errors.
650 * Revision 1.2 1998/04/12 22:03:22 rgb
651 * Updated ESP-3DES-HMAC-MD5-96,
652 * ESP-DES-HMAC-MD5-96,
654 * AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
655 * from old standards (RFC182[5-9] to new (as of March 1998) drafts.
657 * Fixed eroute references in /proc/net/ipsec*.
659 * Started to patch module unloading memory leaks in ipsec_netlink and
660 * radij tree unloading.
662 * Revision 1.1 1998/04/09 03:06:05 henry
663 * sources moved up from linux/net/ipsec
665 * Revision 1.1.1.1 1998/04/08 05:35:02 henry
666 * RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
668 * Revision 0.4 1997/01/15 01:28:15 ji
671 * Revision 0.3 1996/11/20 14:39:04 ji
672 * Fixed problem with node names of /proc/net entries.
673 * Other minor cleanups.
674 * Rationalized debugging code.
676 * Revision 0.2 1996/11/02 00:18:33 ji
677 * First limited release.
680 * c-file-style: "linux"