1/* $KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $ */
2
3/*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#ifndef _NETKEY_KEYDB_H_
33#define _NETKEY_KEYDB_H_
34#include <sys/appleapiopts.h>
35
36#ifdef BSD_KERNEL_PRIVATE
37
38#include <netkey/key_var.h>
39
40/* Security Association Index */
41/* NOTE: Ensure to be same address family */
42struct secasindex {
43 struct sockaddr_storage src; /* srouce address for SA */
44 struct sockaddr_storage dst; /* destination address for SA */
45 u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */
46 u_int8_t mode; /* mode of protocol, see ipsec.h */
47 u_int32_t reqid; /* reqid id who owned this SA */
48 /* see IPSEC_MANUAL_REQID_MAX. */
49 u_int ipsec_ifindex;
50};
51
52#define SECURITY_ASSOCIATION_ANY 0x0000
53#define SECURITY_ASSOCIATION_PFKEY 0x0001
54#define SECURITY_ASSOCIATION_CUSTOM_IPSEC 0x0010
55
56/* Security Association Data Base */
57struct secashead {
58 LIST_ENTRY(secashead) chain;
59
60 struct secasindex saidx;
61
62 ifnet_t ipsec_if;
63 u_int outgoing_if;
64 u_int8_t dir; /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */
65 u_int8_t state; /* MATURE or DEAD. */
66 LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX + 1];
67 /* SA chain */
68 /* The first of this list is newer SA */
69
70 struct route_in6 sa_route; /* route cache */
71
72 uint16_t flags;
73 u_int32_t use_count;
74};
75
76#define MAX_REPLAY_WINDOWS 4
77#define PER_TC_REPLAY_WINDOW_RANGE ((1ULL << 32) / MAX_REPLAY_WINDOWS)
78#define PER_TC_REPLAY_WINDOW_SN_SHIFT 30
79
80/* Security Association */
81struct secasvar {
82 LIST_ENTRY(secasvar) chain;
83 LIST_ENTRY(secasvar) spihash;
84 int refcnt; /* reference count */
85 u_int8_t state; /* Status of this Association */
86
87 u_int8_t alg_auth; /* Authentication Algorithm Identifier*/
88 u_int8_t alg_enc; /* Cipher Algorithm Identifier */
89 u_int32_t spi; /* SPI Value, network byte order */
90 u_int32_t flags; /* holder for SADB_KEY_FLAGS */
91 u_int16_t flags2; /* holder for SADB_SA2_KEY_FLAGS */
92
93 struct sadb_key *key_auth; /* Key for Authentication */
94 struct sadb_key *key_enc; /* Key for Encryption */
95 caddr_t iv; /* Initialization Vector */
96 u_int ivlen; /* length of IV */
97 void *sched_auth; /* intermediate authentication key */
98 void *sched_enc; /* intermediate encryption key */
99 size_t schedlen_auth;
100 size_t schedlen_enc;
101
102 struct secreplay *replay[MAX_REPLAY_WINDOWS]; /* replay prevention */
103
104 u_int64_t created; /* for lifetime */
105
106 struct sadb_lifetime *lft_c; /* CURRENT lifetime, it's constant. */
107 struct sadb_lifetime *lft_h; /* HARD lifetime */
108 struct sadb_lifetime *lft_s; /* SOFT lifetime */
109
110 struct socket *so; /* Associated socket */
111
112 u_int32_t seq; /* sequence number */
113 pid_t pid; /* message's pid */
114
115 struct secashead *sah; /* back pointer to the secashead */
116
117 /* Nat Traversal related bits */
118 u_int64_t natt_last_activity;
119 u_int16_t remote_ike_port;
120 u_int16_t natt_encapsulated_src_port; /* network byte order */
121 u_int16_t natt_interval; /* Interval in seconds */
122 u_int16_t natt_offload_interval; /* Hardware Offload Interval in seconds */
123 /*
124 * Globally unique flow identifier for the SA.
125 * Added on outgoing packets by the IPSec driver.
126 */
127 uint32_t flowid;
128
129 u_int8_t always_expire; /* Send expire/delete messages even if unused */
130};
131
132/* replay prevention */
133struct secreplay {
134 u_int8_t wsize; /* window size */
135 u_int32_t count; /* used by sender/receiver */
136 u_int32_t seq; /* used by sender/receiver */
137 u_int32_t lastseq; /* used by sender/receiver */
138 caddr_t bitmap; /* used by receiver */
139 int overflow; /* overflow flag */
140};
141
142/* socket table due to send PF_KEY messages. */
143struct secreg {
144 LIST_ENTRY(secreg) chain;
145
146 struct socket *so;
147};
148
149#ifndef IPSEC_NONBLOCK_ACQUIRE
150/* acquiring list table. */
151struct secacq {
152 LIST_ENTRY(secacq) chain;
153
154 struct secasindex saidx;
155
156 u_int32_t seq; /* sequence number */
157 u_int64_t created; /* for lifetime */
158 int count; /* for lifetime */
159};
160#endif
161
162/* Sensitivity Level Specification */
163/* nothing */
164
165#define SADB_KILL_INTERVAL 600 /* six seconds */
166
167struct key_cb {
168 int key_count;
169 int any_count;
170};
171
172/* secpolicy */
173extern struct secpolicy *keydb_newsecpolicy(void);
174extern void keydb_delsecpolicy(struct secpolicy *);
175/* secashead */
176extern struct secashead *keydb_newsecashead(void);
177// extern void keydb_delsecashead(struct secashead *); // not used
178/* secasvar */
179// extern struct secasvar *keydb_newsecasvar(void); // not used
180// extern void keydb_refsecasvar(struct secasvar *); // not used
181// extern void keydb_freesecasvar(struct secasvar *); // not used
182/* secreplay */
183extern struct secreplay *keydb_newsecreplay(u_int8_t);
184extern void keydb_delsecreplay(struct secreplay *);
185/* secreg */
186// extern struct secreg *keydb_newsecreg(void); // not used
187// extern void keydb_delsecreg(struct secreg *); // not used
188
189#endif /* BSD_KERNEL_PRIVATE */
190
191#endif /* _NETKEY_KEYDB_H_ */
192