ipsec_offload: hide SA/SP offload lifecycle prints under verbose sysctl

[kib]

Summary

Also in the diff (separate commits):

• netipsec: move declaration of the sysctl net.inet{,6}.ipsec nodes to header
• netinet/ipsec.h: remove unneeded "extern"s

[np]

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
/* for openbsd compatibility */
#ifdef IPSEC_DEBUG
#define IPSEC_DEBUG_DECLARE(x) x
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
#else
#define IPSEC_DEBUG_DECLARE(x)
#define DPRINTF(x)
#endif

[kib]

In D46045#1049663, @np wrote:

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
/* for openbsd compatibility */
#ifdef IPSEC_DEBUG
#define IPSEC_DEBUG_DECLARE(x) x
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
#else
#define IPSEC_DEBUG_DECLARE(x)
#define DPRINTF(x)
#endif

I would say yes. I remember trying to use existing debug, but it did not mixed well: it was too verbose in parts we do not needed.

[np]

In D46045#1049664, @kib wrote:

In D46045#1049663, @np wrote:

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
/* for openbsd compatibility */
#ifdef IPSEC_DEBUG
#define IPSEC_DEBUG_DECLARE(x) x
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
#else
#define IPSEC_DEBUG_DECLARE(x)
#define DPRINTF(x)
#endif

I would say yes. I remember trying to use existing debug, but it did not mixed well: it was too verbose in parts we do not needed.

There are also some macros in key_debug.h (for keys only) that accept a bitmap of stuff to debug. It would have been nice if ipseclog() was also written this way and then we could control its run-time verbosity and also just have added a bit for ipsec-offload debug. But oh well. I'm okay with whatever you and kp agree on.

#ifdef IPSEC_DEBUG
#define KEYDBG(lev, arg) \

     if ((V_key_debug_level & (KEYDEBUG_ ## lev)) == (KEYDEBUG_ ## lev)) { \
	     arg;		\
     }

#else
#define KEYDBG(lev, arg)
#endif /* !IPSEC_DEBUG */

[kib]

In D46045#1049665, @np wrote:

There are also some macros in key_debug.h (for keys only) that accept a bitmap of stuff to debug. It would have been nice if ipseclog() was also written this way and then we could control its run-time verbosity and also just have added a bit for ipsec-offload debug. But oh well. I'm okay with whatever you and kp agree on.

This should be a dedicated task to unify all logging/debugging in ipsec. Might be we would do it in some future, right now I am not capable.

[kp]

LGTM