📄 klips2-design-api-trips.txt
字号:
char[] --uid-owner UID char[] --seclev seclev char[] -J DROP (or PEEK) out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev target DROP (or PEEK) - allow properly processed packets in KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --seclev seclev char[] --salist SAList char[] -J ACCEPT out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> sa match iptables(8) library ip6tables(8) -> sa match ip6tables(8) library in: char[] --salist SAList out: struct ip_said SA[, ...] iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev struct ip_said SA[, ...] - allow unprocessed packets from IPSec peer in KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK (remote SG) char[] -d DADDR/DMASK (local SG) char[] --proto ESP char[] --espspi SPI char[] -J ACCEPT out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev - incoming packet is tested on match modules NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - packet arrives via transport layer demux to DECRYPT Transport Layer De-mux -> IPSec DECRYPT kernel module in: struct sk_buff *skb - fetch SAs specified by packet in skb IPSec DECRYPT kernel module -> SADB (SAID) in: struct ip_said SA out: struct tdb *tdbp - send skb (packet) back into NF_IP_PRE_ROUTE IPSec DECRYPT kernel module -> NetFilter in: struct sk_buff *skb struct ip_said SA[,...] - processed packet is tested on match modules and ACCEPTED NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - expire SA if a limit is reached SADB -> KMd (PF_KEYv2 EXPIRE) see RFC2367, PF_KEYv2 EXPIRE Incoming w/existing connection specifying IPSec device - put in the new SAs in place once the negotiations have succeeded KMd -> SADB (PF_KEYv2 ADD/UPDATE) see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA - put in a blocking entry to prevent unprotected packets entering KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --seclev seclev char[] -J DROP (or PEEK) out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev target DROP (or PEEK) - allow properly processed packets in KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --in-interface IPSECdev char[] --seclev seclev char[] --salist SAList (can we set an --in-interface IPSECdev from this so we can just test in-interface? This may need two entries, including a target SETDEV) char[] -J ACCEPT out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> sa match iptables(8) library ip6tables(8) -> sa match ip6tables(8) library in: char[] --salist SAList out: struct ip_said SA[, ...] iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev struct ip_said SA[, ...] - allow unprocessed packets from IPSec peer in KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK (remote SG) char[] -d DADDR/DMASK (local SG) char[] --proto ESP char[] --espspi SPI char[] -J ACCEPT out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev - incoming packet is tested on match modules NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - packet arrives via transport layer demux to DECRYPT Transport Layer De-mux -> IPSec DECRYPT kernel module in: struct sk_buff *skb - fetch SAs specified by packet in skb IPSec DECRYPT kernel module -> SADB (SAID) in: struct ip_said SA out: struct tdb *tdbp - send skb (packet) back into NF_IP_PRE_ROUTE IPSec DECRYPT kernel module -> NetFilter in: struct sk_buff *skb struct ip_said SA[,...] - processed packet is tested on match modules and ACCEPTED NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - expire SA if a limit is reached SADB -> KMd (PF_KEYv2 EXPIRE) see RFC2367, PF_KEYv2 EXPIRE Incoming no connection - set target for PEEKing at (or TRAPing) incoming packets with no connection KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --seclev seclev char[] -J PEEK (or TRAP) out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev target PEEK (or TRAP) - packet comes in and gets tested by match modules NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - packet matches and gets sent to PEEK target NetFilter -> PEEK (or TRAP) target NetFilter kernel module in: struct sk_buff *skb out: unsigned int = NF_ACCEPT (or NF_STOLEN) - send up an ACQUIRE PEEK (or TRAP) target NetFilter kernel module -> KMds (PF_KEYv2 ACQUIRE) see RFC2367, PF_KEYv2 ACQUIRE - create ACCEPT (or HOLD) target with skb info to prevent KMd overload PEEK (or HOLD) target NetFilter kernel module -> NetFilter in: struct sk_buff *skb out: boolean - next packet comes in while KMd is negotiating SAs. NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - put the new SAs in place once the negotiations have succeeded KMd -> SADB (PF_KEYv2 ADD/UPDATE) see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA - put in a blocking entry to prevent unprotected packets entering KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --seclev seclev char[] -J DROP (or PEEK) out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev (target PEEK) - allow properly processed packets in KMd -> iptables(8) system(3) call (Policy) KMd -> ip6tables(8) system(3) call (Policy) in: char[] -I char[] -s SADDR/SMASK char[] -d DADDR/DMASK char[] --protocol PROTO char[] --sport SPORT char[] --dport DPORT char[] --uid-owner UID char[] --seclev seclev char[] --salist SAList char[] -J ACCEPT out: unsigned char exit_code iptables(8) -> seclev match iptables(8) library ip6tables(8) -> seclev match ip6tables(8) library in: char[] --seclev seclevstr out: struct seclev iptables(8) -> sa match iptables(8) library ip6tables(8) -> sa match ip6tables(8) library in: char[] --salist SAList out: struct ip_said SA[, ...] iptables(8) -> NetFilter ip6tables(8) -> NetFilter I/F is already defined in NetFilter. In addition, it will need structures to pass the following: in: struct seclev struct ip_said SA[, ...] - incoming packet is tested on match modules NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - packet arrives via transport layer demux to DECRYPT Transport Layer De-mux -> IPSec DECRYPT kernel module in: struct sk_buff *skb - fetch SAs specified by packet in skb IPSec DECRYPT kernel module -> SADB (SAID) in: struct ip_said SA out: struct tdb *tdbp - send skb (packet) back into NF_IP_PRE_ROUTE IPSec DECRYPT kernel module -> NetFilter in: struct sk_buff *skb struct ip_said SA[,...] - processed packet is tested on match modules and ACCEPTed NetFilter -> seclev match NetFilter kernel module in: struct sk_buff *skb struct seclev out: boolean NetFilter -> sa match NetFilter kernel module in: struct sk_buff *skb struct ip_said SA[,...] out: boolean - expire SA if a limit is reached SADB -> KMd (PF_KEYv2 EXPIRE) see RFC2367, PF_KEYv2 EXPIRETODO: api trips: Packet w/no route? how to get to kmd? default route to IPSECdev which calls TRAP? Nested tunnels, IKE recursion api trip how to know when to stop decapsulating nested tunnels? DHR's routing problem mutli-layer routing environments that both touch and denker need. nail down function calls and/or globals for each I/F, c-like function syntax better api block comments interface, function, args, block comment⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -