1 | /* $KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $ */ |
2 | |
3 | /* |
4 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
5 | * All rights reserved. |
6 | * |
7 | * Redistribution and use in source and binary forms, with or without |
8 | * modification, are permitted provided that the following conditions |
9 | * are met: |
10 | * 1. Redistributions of source code must retain the above copyright |
11 | * notice, this list of conditions and the following disclaimer. |
12 | * 2. Redistributions in binary form must reproduce the above copyright |
13 | * notice, this list of conditions and the following disclaimer in the |
14 | * documentation and/or other materials provided with the distribution. |
15 | * 3. Neither the name of the project nor the names of its contributors |
16 | * may be used to endorse or promote products derived from this software |
17 | * without specific prior written permission. |
18 | * |
19 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
20 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
21 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
22 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
23 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
24 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
25 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
26 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
27 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
28 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
29 | * SUCH DAMAGE. |
30 | */ |
31 | |
32 | #ifndef _NETKEY_KEYDB_H_ |
33 | #define _NETKEY_KEYDB_H_ |
34 | #include <sys/appleapiopts.h> |
35 | |
36 | #ifdef BSD_KERNEL_PRIVATE |
37 | |
38 | #include <netkey/key_var.h> |
39 | |
40 | /* Security Association Index */ |
41 | /* NOTE: Ensure to be same address family */ |
42 | struct secasindex { |
43 | struct sockaddr_storage src; /* srouce address for SA */ |
44 | struct sockaddr_storage dst; /* destination address for SA */ |
45 | u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ |
46 | u_int8_t mode; /* mode of protocol, see ipsec.h */ |
47 | u_int32_t reqid; /* reqid id who owned this SA */ |
48 | /* see IPSEC_MANUAL_REQID_MAX. */ |
49 | u_int ipsec_ifindex; |
50 | }; |
51 | |
52 | #define SECURITY_ASSOCIATION_ANY 0x0000 |
53 | #define SECURITY_ASSOCIATION_PFKEY 0x0001 |
54 | #define SECURITY_ASSOCIATION_CUSTOM_IPSEC 0x0010 |
55 | |
56 | /* Security Association Data Base */ |
57 | struct secashead { |
58 | LIST_ENTRY(secashead) chain; |
59 | |
60 | struct secasindex saidx; |
61 | |
62 | ifnet_t ipsec_if; |
63 | u_int outgoing_if; |
64 | u_int8_t dir; /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */ |
65 | u_int8_t state; /* MATURE or DEAD. */ |
66 | LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX + 1]; |
67 | /* SA chain */ |
68 | /* The first of this list is newer SA */ |
69 | |
70 | struct route_in6 sa_route; /* route cache */ |
71 | |
72 | uint16_t flags; |
73 | u_int32_t use_count; |
74 | }; |
75 | |
76 | #define MAX_REPLAY_WINDOWS 4 |
77 | #define PER_TC_REPLAY_WINDOW_RANGE ((1ULL << 32) / MAX_REPLAY_WINDOWS) |
78 | #define PER_TC_REPLAY_WINDOW_SN_SHIFT 30 |
79 | |
80 | /* Security Association */ |
81 | struct secasvar { |
82 | LIST_ENTRY(secasvar) chain; |
83 | LIST_ENTRY(secasvar) spihash; |
84 | int refcnt; /* reference count */ |
85 | u_int8_t state; /* Status of this Association */ |
86 | |
87 | u_int8_t alg_auth; /* Authentication Algorithm Identifier*/ |
88 | u_int8_t alg_enc; /* Cipher Algorithm Identifier */ |
89 | u_int32_t spi; /* SPI Value, network byte order */ |
90 | u_int32_t flags; /* holder for SADB_KEY_FLAGS */ |
91 | u_int16_t flags2; /* holder for SADB_SA2_KEY_FLAGS */ |
92 | |
93 | struct sadb_key *key_auth; /* Key for Authentication */ |
94 | struct sadb_key *key_enc; /* Key for Encryption */ |
95 | caddr_t iv; /* Initialization Vector */ |
96 | u_int ivlen; /* length of IV */ |
97 | void *sched_auth; /* intermediate authentication key */ |
98 | void *sched_enc; /* intermediate encryption key */ |
99 | size_t schedlen_auth; |
100 | size_t schedlen_enc; |
101 | |
102 | struct secreplay *replay[MAX_REPLAY_WINDOWS]; /* replay prevention */ |
103 | |
104 | u_int64_t created; /* for lifetime */ |
105 | |
106 | struct sadb_lifetime *lft_c; /* CURRENT lifetime, it's constant. */ |
107 | struct sadb_lifetime *lft_h; /* HARD lifetime */ |
108 | struct sadb_lifetime *lft_s; /* SOFT lifetime */ |
109 | |
110 | struct socket *so; /* Associated socket */ |
111 | |
112 | u_int32_t seq; /* sequence number */ |
113 | pid_t pid; /* message's pid */ |
114 | |
115 | struct secashead *sah; /* back pointer to the secashead */ |
116 | |
117 | /* Nat Traversal related bits */ |
118 | u_int64_t natt_last_activity; |
119 | u_int16_t remote_ike_port; |
120 | u_int16_t natt_encapsulated_src_port; /* network byte order */ |
121 | u_int16_t natt_interval; /* Interval in seconds */ |
122 | u_int16_t natt_offload_interval; /* Hardware Offload Interval in seconds */ |
123 | /* |
124 | * Globally unique flow identifier for the SA. |
125 | * Added on outgoing packets by the IPSec driver. |
126 | */ |
127 | uint32_t flowid; |
128 | |
129 | u_int8_t always_expire; /* Send expire/delete messages even if unused */ |
130 | }; |
131 | |
132 | /* replay prevention */ |
133 | struct secreplay { |
134 | u_int8_t wsize; /* window size */ |
135 | u_int32_t count; /* used by sender/receiver */ |
136 | u_int32_t seq; /* used by sender/receiver */ |
137 | u_int32_t lastseq; /* used by sender/receiver */ |
138 | caddr_t bitmap; /* used by receiver */ |
139 | int overflow; /* overflow flag */ |
140 | }; |
141 | |
142 | /* socket table due to send PF_KEY messages. */ |
143 | struct secreg { |
144 | LIST_ENTRY(secreg) chain; |
145 | |
146 | struct socket *so; |
147 | }; |
148 | |
149 | #ifndef IPSEC_NONBLOCK_ACQUIRE |
150 | /* acquiring list table. */ |
151 | struct secacq { |
152 | LIST_ENTRY(secacq) chain; |
153 | |
154 | struct secasindex saidx; |
155 | |
156 | u_int32_t seq; /* sequence number */ |
157 | u_int64_t created; /* for lifetime */ |
158 | int count; /* for lifetime */ |
159 | }; |
160 | #endif |
161 | |
162 | /* Sensitivity Level Specification */ |
163 | /* nothing */ |
164 | |
165 | #define SADB_KILL_INTERVAL 600 /* six seconds */ |
166 | |
167 | struct key_cb { |
168 | int key_count; |
169 | int any_count; |
170 | }; |
171 | |
172 | /* secpolicy */ |
173 | extern struct secpolicy *keydb_newsecpolicy(void); |
174 | extern void keydb_delsecpolicy(struct secpolicy *); |
175 | /* secashead */ |
176 | extern struct secashead *keydb_newsecashead(void); |
177 | // extern void keydb_delsecashead(struct secashead *); // not used |
178 | /* secasvar */ |
179 | // extern struct secasvar *keydb_newsecasvar(void); // not used |
180 | // extern void keydb_refsecasvar(struct secasvar *); // not used |
181 | // extern void keydb_freesecasvar(struct secasvar *); // not used |
182 | /* secreplay */ |
183 | extern struct secreplay *keydb_newsecreplay(u_int8_t); |
184 | extern void keydb_delsecreplay(struct secreplay *); |
185 | /* secreg */ |
186 | // extern struct secreg *keydb_newsecreg(void); // not used |
187 | // extern void keydb_delsecreg(struct secreg *); // not used |
188 | |
189 | #endif /* BSD_KERNEL_PRIVATE */ |
190 | |
191 | #endif /* _NETKEY_KEYDB_H_ */ |
192 | |