* Return current level. * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. */
| 873 | * Either IPSEC_LEVEL_USE or IPSEC_LEVEL_REQUIRE are always returned. |
| 874 | */ |
| 875 | u_int |
| 876 | ipsec_get_reqlevel(struct secpolicy *sp, u_int idx) |
| 877 | { |
| 878 | struct ipsecrequest *isr; |
| 879 | u_int esp_trans_deflev, esp_net_deflev; |
| 880 | u_int ah_trans_deflev, ah_net_deflev; |
| 881 | u_int level = 0; |
| 882 | |
| 883 | IPSEC_ASSERT(idx < sp->tcount, ("Wrong IPsec request index %d", idx)); |
| 884 | /* XXX Note that we have ipseclog() expanded here - code sync issue. */ |
| 885 | #define IPSEC_CHECK_DEFAULT(lev) \ |
| 886 | (((lev) != IPSEC_LEVEL_USE && (lev) != IPSEC_LEVEL_REQUIRE && \ |
| 887 | (lev) != IPSEC_LEVEL_UNIQUE) \ |
| 888 | ? (V_ipsec_debug ? \ |
| 889 | log(LOG_INFO, "fixed system default level " #lev ":%d->%d\n",\ |
| 890 | (lev), IPSEC_LEVEL_REQUIRE) : 0), \ |
| 891 | (lev) = IPSEC_LEVEL_REQUIRE, (lev) : (lev)) |
| 892 | |
| 893 | /* |
| 894 | * IPsec VTI uses unique security policy with fake spidx filled |
| 895 | * with zeroes. Just return IPSEC_LEVEL_REQUIRE instead of doing |
| 896 | * full level lookup for such policies. |
| 897 | */ |
| 898 | if (sp->state == IPSEC_SPSTATE_IFNET) { |
| 899 | IPSEC_ASSERT(sp->req[idx]->level == IPSEC_LEVEL_UNIQUE, |
| 900 | ("Wrong IPsec request level %d", sp->req[idx]->level)); |
| 901 | return (IPSEC_LEVEL_REQUIRE); |
| 902 | } |
| 903 | |
| 904 | /* Set default level. */ |
| 905 | switch (sp->spidx.src.sa.sa_family) { |
| 906 | #ifdef INET |
| 907 | case AF_INET: |
| 908 | esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_trans_deflev); |
| 909 | esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_esp_net_deflev); |
| 910 | ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_trans_deflev); |
| 911 | ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip4_ah_net_deflev); |
| 912 | break; |
| 913 | #endif |
| 914 | #ifdef INET6 |
| 915 | case AF_INET6: |
| 916 | esp_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_trans_deflev); |
| 917 | esp_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_esp_net_deflev); |
| 918 | ah_trans_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_trans_deflev); |
| 919 | ah_net_deflev = IPSEC_CHECK_DEFAULT(V_ip6_ah_net_deflev); |
| 920 | break; |
| 921 | #endif /* INET6 */ |
| 922 | default: |
| 923 | panic("%s: unknown af %u", |
| 924 | __func__, sp->spidx.src.sa.sa_family); |
| 925 | } |
| 926 | |
| 927 | #undef IPSEC_CHECK_DEFAULT |
| 928 | |
| 929 | isr = sp->req[idx]; |
| 930 | /* Set level. */ |
| 931 | switch (isr->level) { |
| 932 | case IPSEC_LEVEL_DEFAULT: |
no test coverage detected