xref: /netbsd-src/sys/netipsec/ipsec.h (revision 796c32c94f6e154afc9de0f63da35c91bb739b45)
1 /*	$NetBSD: ipsec.h,v 1.61 2017/10/03 08:56:52 ozaki-r Exp $	*/
2 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.h,v 1.2.4.2 2004/02/14 22:23:23 bms Exp $	*/
3 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * IPsec controller part.
36  */
37 
38 #ifndef _NETIPSEC_IPSEC_H_
39 #define _NETIPSEC_IPSEC_H_
40 
41 #if defined(_KERNEL_OPT)
42 #include "opt_inet.h"
43 #include "opt_ipsec.h"
44 #endif
45 
46 #include <net/pfkeyv2.h>
47 
48 #ifdef _KERNEL
49 #include <sys/socketvar.h>
50 #include <sys/localcount.h>
51 
52 #include <netinet/in_pcb_hdr.h>
53 #include <netipsec/keydb.h>
54 
55 /*
56  * Security Policy Index
57  * Ensure that both address families in the "src" and "dst" are same.
58  * When the value of the ul_proto is ICMPv6, the port field in "src"
59  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
60  */
61 struct secpolicyindex {
62 	u_int8_t dir;			/* direction of packet flow, see blow */
63 	union sockaddr_union src;	/* IP src address for SP */
64 	union sockaddr_union dst;	/* IP dst address for SP */
65 	u_int8_t prefs;			/* prefix length in bits for src */
66 	u_int8_t prefd;			/* prefix length in bits for dst */
67 	u_int16_t ul_proto;		/* upper layer Protocol */
68 #ifdef notyet
69 	uid_t uids;
70 	uid_t uidd;
71 	gid_t gids;
72 	gid_t gidd;
73 #endif
74 };
75 
76 /* Security Policy Data Base */
77 struct secpolicy {
78 	struct pslist_entry pslist_entry;
79 
80 	struct localcount localcount;	/* reference count */
81 	struct secpolicyindex spidx;	/* selector */
82 	u_int32_t id;			/* It's unique number on the system. */
83 	u_int state;			/* 0: dead, others: alive */
84 #define IPSEC_SPSTATE_DEAD	0
85 #define IPSEC_SPSTATE_ALIVE	1
86 
87 	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
88 	struct ipsecrequest *req;
89 				/* pointer to the ipsec request tree, */
90 				/* if policy == IPSEC else this value == NULL.*/
91 
92 	/*
93 	 * lifetime handler.
94 	 * the policy can be used without limitiation if both lifetime and
95 	 * validtime are zero.
96 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
97 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
98 	 */
99 	time_t created;		/* time created the policy */
100 	time_t lastused;	/* updated every when kernel sends a packet */
101 	time_t lifetime;	/* duration of the lifetime of this policy */
102 	time_t validtime;	/* duration this policy is valid without use */
103 };
104 
105 /* Request for IPsec */
106 struct ipsecrequest {
107 	struct ipsecrequest *next;
108 				/* pointer to next structure */
109 				/* If NULL, it means the end of chain. */
110 	struct secasindex saidx;/* hint for search proper SA */
111 				/* if __ss_len == 0 then no address specified.*/
112 	u_int level;		/* IPsec level defined below. */
113 
114 	struct secpolicy *sp;	/* back pointer to SP */
115 };
116 
117 /* security policy in PCB */
118 struct inpcbpolicy {
119 	struct secpolicy *sp_in;
120 	struct secpolicy *sp_out;
121 	int priv;			/* privileged socket ? */
122 
123 	/* cached policy */
124 	struct {
125 		struct secpolicy *cachesp;
126 		struct secpolicyindex cacheidx;
127 		int cachehint;		/* processing requirement hint: */
128 #define	IPSEC_PCBHINT_UNKNOWN	0	/* Unknown */
129 #define	IPSEC_PCBHINT_YES	1	/* IPsec processing is required */
130 #define	IPSEC_PCBHINT_NO	2	/* IPsec processing not required */
131 		u_int cachegen;		/* spdgen when cache filled */
132 	} sp_cache[3];			/* XXX 3 == IPSEC_DIR_MAX */
133 	int sp_cacheflags;
134 #define	IPSEC_PCBSP_CONNECTED	1
135 	struct inpcb_hdr *sp_inph;	/* back pointer */
136 };
137 
138 extern u_int ipsec_spdgen;
139 
140 static inline bool
141 ipsec_pcb_skip_ipsec(struct inpcbpolicy *pcbsp, int dir)
142 {
143 
144 	KASSERT(inph_locked(pcbsp->sp_inph));
145 
146 	return pcbsp->sp_cache[(dir)].cachehint == IPSEC_PCBHINT_NO &&
147 	    pcbsp->sp_cache[(dir)].cachegen == ipsec_spdgen;
148 }
149 
150 /* SP acquiring list table. */
151 struct secspacq {
152 	LIST_ENTRY(secspacq) chain;
153 
154 	struct secpolicyindex spidx;
155 
156 	time_t created;		/* for lifetime */
157 	int count;		/* for lifetime */
158 	/* XXX: here is mbuf place holder to be sent ? */
159 };
160 #endif /* _KERNEL */
161 
162 /* buffer size for formatted output of ipsec address (addr + '%' + scope_id?) */
163 #define	IPSEC_ADDRSTRLEN	(INET6_ADDRSTRLEN + 11)
164 /* buffer size for ipsec_logsastr() */
165 #define	IPSEC_LOGSASTRLEN	192
166 
167 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
168 #define IPSEC_PORT_ANY		0
169 #define IPSEC_ULPROTO_ANY	255
170 #define IPSEC_PROTO_ANY		255
171 
172 /* mode of security protocol */
173 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
174 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
175 #define	IPSEC_MODE_TRANSPORT	1
176 #define	IPSEC_MODE_TUNNEL	2
177 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
178 
179 /*
180  * Direction of security policy.
181  * NOTE: Since INVALID is used just as flag.
182  * The other are used for loop counter too.
183  */
184 #define IPSEC_DIR_ANY		0
185 #define IPSEC_DIR_INBOUND	1
186 #define IPSEC_DIR_OUTBOUND	2
187 #define IPSEC_DIR_MAX		3
188 #define IPSEC_DIR_INVALID	4
189 
190 #define IPSEC_DIR_IS_VALID(dir)		((dir) >= 0 && (dir) <= IPSEC_DIR_MAX)
191 #define IPSEC_DIR_IS_INOROUT(dir)	((dir) == IPSEC_DIR_INBOUND || \
192 					 (dir) == IPSEC_DIR_OUTBOUND)
193 
194 /* Policy level */
195 /*
196  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
197  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
198  * DISCARD and NONE are allowed for system default.
199  */
200 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
201 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
202 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
203 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
204 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
205 
206 /* Security protocol level */
207 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
208 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
209 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
210 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
211 
212 #define IPSEC_MANUAL_REQID_MAX	0x3fff
213 				/*
214 				 * if security policy level == unique, this id
215 				 * indicate to a relative SA for use, else is
216 				 * zero.
217 				 * 1 - 0x3fff are reserved for manual keying.
218 				 * 0 are reserved for above reason.  Others is
219 				 * for kernel use.
220 				 * Note that this id doesn't identify SA
221 				 * by only itself.
222 				 */
223 #define IPSEC_REPLAYWSIZE  32
224 
225 #ifdef _KERNEL
226 struct ipsec_output_state {
227 	struct mbuf *m;
228 	struct route *ro;
229 	struct sockaddr *dst;
230 };
231 
232 struct ipsec_history {
233 	int ih_proto;
234 	u_int32_t ih_spi;
235 };
236 
237 extern int ipsec_debug;
238 #ifdef IPSEC_DEBUG
239 extern int ipsec_replay;
240 extern int ipsec_integrity;
241 #endif
242 
243 extern struct secpolicy ip4_def_policy;
244 extern int ip4_esp_trans_deflev;
245 extern int ip4_esp_net_deflev;
246 extern int ip4_ah_trans_deflev;
247 extern int ip4_ah_net_deflev;
248 extern int ip4_ah_cleartos;
249 extern int ip4_ah_offsetmask;
250 extern int ip4_ipsec_dfbit;
251 extern int ip4_ipsec_ecn;
252 extern int ip4_esp_randpad;
253 extern int crypto_support;
254 
255 #include <sys/syslog.h>
256 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
257 /* for openbsd compatibility */
258 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
259 
260 #define IPSECLOG(level, fmt, args...) 					\
261 	do {								\
262 		if (ipsec_debug)					\
263 			log(level, "%s: " fmt, __func__, ##args);	\
264 	} while (0)
265 
266 void ipsec_pcbconn (struct inpcbpolicy *);
267 void ipsec_pcbdisconn (struct inpcbpolicy *);
268 void ipsec_invalpcbcacheall (void);
269 
270 struct inpcb;
271 struct secpolicy *ipsec4_checkpolicy (struct mbuf *, u_int, u_int,
272 	int *, struct inpcb *);
273 struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
274 	int, int *);
275 int ipsec4_output(struct mbuf *, struct inpcb *, int,
276 	u_long *, bool *, bool *);
277 int ipsec4_input(struct mbuf *, int);
278 int ipsec4_forward(struct mbuf *, int *);
279 #ifdef INET6
280 int ipsec6_input(struct mbuf *);
281 #endif
282 
283 static __inline struct secpolicy*
284 ipsec4_getpolicybysock(
285     struct mbuf *m,
286     u_int dir,
287     const struct socket *so,
288     int *err
289 )
290 {
291   panic("ipsec4_getpolicybysock");
292 }
293 
294 static __inline int
295 ipsec_copy_pcbpolicy(
296     struct inpcbpolicy *oldp,
297     struct inpcbpolicy *newp
298 )
299 {
300   /*XXX do nothing */
301   return (0);
302 }
303 
304 struct inpcb;
305 #define	ipsec_init_pcbpolicy ipsec_init_policy
306 int ipsec_init_policy (struct socket *so, struct inpcbpolicy **);
307 int ipsec_copy_policy
308 	(const struct inpcbpolicy *, struct inpcbpolicy *);
309 u_int ipsec_get_reqlevel (const struct ipsecrequest *);
310 int ipsec_in_reject (const struct secpolicy *, const struct mbuf *);
311 
312 int ipsec4_set_policy (struct inpcb *, int, const void *, size_t, kauth_cred_t);
313 int ipsec4_get_policy (struct inpcb *, const void *, size_t, struct mbuf **);
314 int ipsec4_delete_pcbpolicy (struct inpcb *);
315 int ipsec4_in_reject (struct mbuf *, struct inpcb *);
316 
317 struct secasvar *
318 	ipsec_lookup_sa(const struct ipsecrequest *, const struct mbuf *);
319 
320 struct secas;
321 struct tcpcb;
322 int ipsec_chkreplay (u_int32_t, const struct secasvar *);
323 int ipsec_updatereplay (u_int32_t, const struct secasvar *);
324 
325 size_t ipsec4_hdrsiz (struct mbuf *, u_int, struct inpcb *);
326 size_t ipsec4_hdrsiz_tcp (struct tcpcb *);
327 #define ipsec4_getpolicybyaddr ipsec_getpolicybyaddr
328 
329 union sockaddr_union;
330 const char *ipsec_address(const union sockaddr_union* sa, char *, size_t);
331 const char *ipsec_logsastr(const struct secasvar *, char *, size_t);
332 
333 void ipsec_dumpmbuf (struct mbuf *);
334 
335 /* NetBSD protosw ctlin entrypoint */
336 void *esp4_ctlinput(int, const struct sockaddr *, void *);
337 void *ah4_ctlinput(int, const struct sockaddr *, void *);
338 
339 void ipsec_output_init(void);
340 struct m_tag;
341 void ipsec4_common_input(struct mbuf *m, ...);
342 int ipsec4_common_input_cb(struct mbuf *, struct secasvar *,
343 			int, int);
344 int ipsec4_process_packet(struct mbuf *, const struct ipsecrequest *, u_long *);
345 int ipsec_process_done(struct mbuf *, const struct ipsecrequest *,
346     struct secasvar *);
347 #define ipsec_indone(m)	\
348 	((m->m_flags & M_AUTHIPHDR) || (m->m_flags & M_DECRYPTED))
349 
350 #define ipsec_outdone(m) \
351 	(m_tag_find((m), PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
352 
353 struct mbuf *ipsec_copypkt (struct mbuf *);
354 
355 void m_checkalignment(const char* , struct mbuf *, int, int);
356 struct mbuf *m_clone(struct mbuf *);
357 struct mbuf *m_makespace(struct mbuf *, int, int, int *);
358 void *m_pad(struct mbuf *, int );
359 int m_striphdr(struct mbuf *, int, int);
360 
361 /* Per-socket caching of IPsec output policy */
362 static __inline
363 int ipsec_clear_socket_cache(struct mbuf *m)
364 {
365   return 0;
366 }
367 
368 void nat_t_ports_get(struct mbuf *, u_int16_t *, u_int16_t *);
369 
370 extern int ipsec_used __read_mostly, ipsec_enabled __read_mostly;
371 
372 #endif /* _KERNEL */
373 
374 #ifndef _KERNEL
375 char *ipsec_set_policy (const char *, int);
376 int ipsec_get_policylen (char *);
377 char *ipsec_dump_policy (char *, const char *);
378 
379 const char *ipsec_strerror (void);
380 #endif /* !_KERNEL */
381 
382 #ifdef _KERNEL
383 /* External declarations of per-file init functions */
384 void ah_attach(void);
385 void esp_attach(void);
386 void ipcomp_attach(void);
387 void ipe4_attach(void);
388 void ipe4_attach(void);
389 void tcpsignature_attach(void);
390 
391 void ipsec_attach(void);
392 
393 void sysctl_net_inet_ipsec_setup(struct sysctllog **);
394 #ifdef INET6
395 void sysctl_net_inet6_ipsec6_setup(struct sysctllog **);
396 #endif
397 
398 #endif /* _KERNEL */
399 #endif /* !_NETIPSEC_IPSEC_H_ */
400