xref: /netbsd-src/sys/netipsec/ipsec.h (revision 87d689fb734c654d2486f87f7be32f1b53ecdbec)
1 /*	$NetBSD: ipsec.h,v 1.62 2018/01/10 10:56:30 knakahara Exp $	*/
2 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.h,v 1.2.4.2 2004/02/14 22:23:23 bms Exp $	*/
3 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * IPsec controller part.
36  */
37 
38 #ifndef _NETIPSEC_IPSEC_H_
39 #define _NETIPSEC_IPSEC_H_
40 
41 #if defined(_KERNEL_OPT)
42 #include "opt_inet.h"
43 #include "opt_ipsec.h"
44 #endif
45 
46 #include <net/pfkeyv2.h>
47 
48 #ifdef _KERNEL
49 #include <sys/socketvar.h>
50 #include <sys/localcount.h>
51 
52 #include <netinet/in_pcb_hdr.h>
53 #include <netipsec/keydb.h>
54 
55 /*
56  * Security Policy Index
57  * Ensure that both address families in the "src" and "dst" are same.
58  * When the value of the ul_proto is ICMPv6, the port field in "src"
59  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
60  */
61 struct secpolicyindex {
62 	u_int8_t dir;			/* direction of packet flow, see blow */
63 	union sockaddr_union src;	/* IP src address for SP */
64 	union sockaddr_union dst;	/* IP dst address for SP */
65 	u_int8_t prefs;			/* prefix length in bits for src */
66 	u_int8_t prefd;			/* prefix length in bits for dst */
67 	u_int16_t ul_proto;		/* upper layer Protocol */
68 #ifdef notyet
69 	uid_t uids;
70 	uid_t uidd;
71 	gid_t gids;
72 	gid_t gidd;
73 #endif
74 };
75 
76 /* Security Policy Data Base */
77 struct secpolicy {
78 	struct pslist_entry pslist_entry;
79 
80 	struct localcount localcount;	/* reference count */
81 	struct secpolicyindex spidx;	/* selector */
82 	u_int32_t id;			/* It's unique number on the system. */
83 	u_int state;			/* 0: dead, others: alive */
84 #define IPSEC_SPSTATE_DEAD	0
85 #define IPSEC_SPSTATE_ALIVE	1
86 
87 	u_int origin;			/* who generate this SP. */
88 #define IPSEC_SPORIGIN_USER	0
89 #define IPSEC_SPORIGIN_KERNEL	1
90 
91 	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
92 	struct ipsecrequest *req;
93 				/* pointer to the ipsec request tree, */
94 				/* if policy == IPSEC else this value == NULL.*/
95 
96 	/*
97 	 * lifetime handler.
98 	 * the policy can be used without limitiation if both lifetime and
99 	 * validtime are zero.
100 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
101 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
102 	 */
103 	time_t created;		/* time created the policy */
104 	time_t lastused;	/* updated every when kernel sends a packet */
105 	time_t lifetime;	/* duration of the lifetime of this policy */
106 	time_t validtime;	/* duration this policy is valid without use */
107 };
108 
109 /* Request for IPsec */
110 struct ipsecrequest {
111 	struct ipsecrequest *next;
112 				/* pointer to next structure */
113 				/* If NULL, it means the end of chain. */
114 	struct secasindex saidx;/* hint for search proper SA */
115 				/* if __ss_len == 0 then no address specified.*/
116 	u_int level;		/* IPsec level defined below. */
117 
118 	struct secpolicy *sp;	/* back pointer to SP */
119 };
120 
121 /* security policy in PCB */
122 struct inpcbpolicy {
123 	struct secpolicy *sp_in;
124 	struct secpolicy *sp_out;
125 	int priv;			/* privileged socket ? */
126 
127 	/* cached policy */
128 	struct {
129 		struct secpolicy *cachesp;
130 		struct secpolicyindex cacheidx;
131 		int cachehint;		/* processing requirement hint: */
132 #define	IPSEC_PCBHINT_UNKNOWN	0	/* Unknown */
133 #define	IPSEC_PCBHINT_YES	1	/* IPsec processing is required */
134 #define	IPSEC_PCBHINT_NO	2	/* IPsec processing not required */
135 		u_int cachegen;		/* spdgen when cache filled */
136 	} sp_cache[3];			/* XXX 3 == IPSEC_DIR_MAX */
137 	int sp_cacheflags;
138 #define	IPSEC_PCBSP_CONNECTED	1
139 	struct inpcb_hdr *sp_inph;	/* back pointer */
140 };
141 
142 extern u_int ipsec_spdgen;
143 
144 static inline bool
145 ipsec_pcb_skip_ipsec(struct inpcbpolicy *pcbsp, int dir)
146 {
147 
148 	KASSERT(inph_locked(pcbsp->sp_inph));
149 
150 	return pcbsp->sp_cache[(dir)].cachehint == IPSEC_PCBHINT_NO &&
151 	    pcbsp->sp_cache[(dir)].cachegen == ipsec_spdgen;
152 }
153 
154 /* SP acquiring list table. */
155 struct secspacq {
156 	LIST_ENTRY(secspacq) chain;
157 
158 	struct secpolicyindex spidx;
159 
160 	time_t created;		/* for lifetime */
161 	int count;		/* for lifetime */
162 	/* XXX: here is mbuf place holder to be sent ? */
163 };
164 #endif /* _KERNEL */
165 
166 /* buffer size for formatted output of ipsec address (addr + '%' + scope_id?) */
167 #define	IPSEC_ADDRSTRLEN	(INET6_ADDRSTRLEN + 11)
168 /* buffer size for ipsec_logsastr() */
169 #define	IPSEC_LOGSASTRLEN	192
170 
171 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
172 #define IPSEC_PORT_ANY		0
173 #define IPSEC_ULPROTO_ANY	255
174 #define IPSEC_PROTO_ANY		255
175 
176 /* mode of security protocol */
177 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
178 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
179 #define	IPSEC_MODE_TRANSPORT	1
180 #define	IPSEC_MODE_TUNNEL	2
181 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
182 
183 /*
184  * Direction of security policy.
185  * NOTE: Since INVALID is used just as flag.
186  * The other are used for loop counter too.
187  */
188 #define IPSEC_DIR_ANY		0
189 #define IPSEC_DIR_INBOUND	1
190 #define IPSEC_DIR_OUTBOUND	2
191 #define IPSEC_DIR_MAX		3
192 #define IPSEC_DIR_INVALID	4
193 
194 #define IPSEC_DIR_IS_VALID(dir)		((dir) >= 0 && (dir) <= IPSEC_DIR_MAX)
195 #define IPSEC_DIR_IS_INOROUT(dir)	((dir) == IPSEC_DIR_INBOUND || \
196 					 (dir) == IPSEC_DIR_OUTBOUND)
197 
198 /* Policy level */
199 /*
200  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
201  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
202  * DISCARD and NONE are allowed for system default.
203  */
204 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
205 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
206 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
207 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
208 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
209 
210 /* Security protocol level */
211 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
212 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
213 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
214 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
215 
216 #define IPSEC_MANUAL_REQID_MAX	0x3fff
217 				/*
218 				 * if security policy level == unique, this id
219 				 * indicate to a relative SA for use, else is
220 				 * zero.
221 				 * 1 - 0x3fff are reserved for manual keying.
222 				 * 0 are reserved for above reason.  Others is
223 				 * for kernel use.
224 				 * Note that this id doesn't identify SA
225 				 * by only itself.
226 				 */
227 #define IPSEC_REPLAYWSIZE  32
228 
229 #ifdef _KERNEL
230 struct ipsec_output_state {
231 	struct mbuf *m;
232 	struct route *ro;
233 	struct sockaddr *dst;
234 };
235 
236 struct ipsec_history {
237 	int ih_proto;
238 	u_int32_t ih_spi;
239 };
240 
241 extern int ipsec_debug;
242 #ifdef IPSEC_DEBUG
243 extern int ipsec_replay;
244 extern int ipsec_integrity;
245 #endif
246 
247 extern struct secpolicy ip4_def_policy;
248 extern int ip4_esp_trans_deflev;
249 extern int ip4_esp_net_deflev;
250 extern int ip4_ah_trans_deflev;
251 extern int ip4_ah_net_deflev;
252 extern int ip4_ah_cleartos;
253 extern int ip4_ah_offsetmask;
254 extern int ip4_ipsec_dfbit;
255 extern int ip4_ipsec_ecn;
256 extern int ip4_esp_randpad;
257 extern int crypto_support;
258 
259 #include <sys/syslog.h>
260 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
261 /* for openbsd compatibility */
262 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
263 
264 #define IPSECLOG(level, fmt, args...) 					\
265 	do {								\
266 		if (ipsec_debug)					\
267 			log(level, "%s: " fmt, __func__, ##args);	\
268 	} while (0)
269 
270 void ipsec_pcbconn (struct inpcbpolicy *);
271 void ipsec_pcbdisconn (struct inpcbpolicy *);
272 void ipsec_invalpcbcacheall (void);
273 
274 struct inpcb;
275 struct secpolicy *ipsec4_checkpolicy (struct mbuf *, u_int, u_int,
276 	int *, struct inpcb *);
277 struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
278 	int, int *);
279 int ipsec4_output(struct mbuf *, struct inpcb *, int,
280 	u_long *, bool *, bool *);
281 int ipsec4_input(struct mbuf *, int);
282 int ipsec4_forward(struct mbuf *, int *);
283 #ifdef INET6
284 int ipsec6_input(struct mbuf *);
285 #endif
286 
287 static __inline struct secpolicy*
288 ipsec4_getpolicybysock(
289     struct mbuf *m,
290     u_int dir,
291     const struct socket *so,
292     int *err
293 )
294 {
295   panic("ipsec4_getpolicybysock");
296 }
297 
298 static __inline int
299 ipsec_copy_pcbpolicy(
300     struct inpcbpolicy *oldp,
301     struct inpcbpolicy *newp
302 )
303 {
304   /*XXX do nothing */
305   return (0);
306 }
307 
308 struct inpcb;
309 #define	ipsec_init_pcbpolicy ipsec_init_policy
310 int ipsec_init_policy (struct socket *so, struct inpcbpolicy **);
311 int ipsec_copy_policy
312 	(const struct inpcbpolicy *, struct inpcbpolicy *);
313 u_int ipsec_get_reqlevel (const struct ipsecrequest *);
314 int ipsec_in_reject (const struct secpolicy *, const struct mbuf *);
315 
316 int ipsec4_set_policy (struct inpcb *, int, const void *, size_t, kauth_cred_t);
317 int ipsec4_get_policy (struct inpcb *, const void *, size_t, struct mbuf **);
318 int ipsec4_delete_pcbpolicy (struct inpcb *);
319 int ipsec4_in_reject (struct mbuf *, struct inpcb *);
320 
321 struct secasvar *
322 	ipsec_lookup_sa(const struct ipsecrequest *, const struct mbuf *);
323 
324 struct secas;
325 struct tcpcb;
326 int ipsec_chkreplay (u_int32_t, const struct secasvar *);
327 int ipsec_updatereplay (u_int32_t, const struct secasvar *);
328 
329 size_t ipsec4_hdrsiz (struct mbuf *, u_int, struct inpcb *);
330 size_t ipsec4_hdrsiz_tcp (struct tcpcb *);
331 #define ipsec4_getpolicybyaddr ipsec_getpolicybyaddr
332 
333 union sockaddr_union;
334 const char *ipsec_address(const union sockaddr_union* sa, char *, size_t);
335 const char *ipsec_logsastr(const struct secasvar *, char *, size_t);
336 
337 void ipsec_dumpmbuf (struct mbuf *);
338 
339 /* NetBSD protosw ctlin entrypoint */
340 void *esp4_ctlinput(int, const struct sockaddr *, void *);
341 void *ah4_ctlinput(int, const struct sockaddr *, void *);
342 
343 void ipsec_output_init(void);
344 struct m_tag;
345 void ipsec4_common_input(struct mbuf *m, ...);
346 int ipsec4_common_input_cb(struct mbuf *, struct secasvar *,
347 			int, int);
348 int ipsec4_process_packet(struct mbuf *, const struct ipsecrequest *, u_long *);
349 int ipsec_process_done(struct mbuf *, const struct ipsecrequest *,
350     struct secasvar *);
351 #define ipsec_indone(m)	\
352 	((m->m_flags & M_AUTHIPHDR) || (m->m_flags & M_DECRYPTED))
353 
354 #define ipsec_outdone(m) \
355 	(m_tag_find((m), PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
356 
357 struct mbuf *ipsec_copypkt (struct mbuf *);
358 
359 void m_checkalignment(const char* , struct mbuf *, int, int);
360 struct mbuf *m_clone(struct mbuf *);
361 struct mbuf *m_makespace(struct mbuf *, int, int, int *);
362 void *m_pad(struct mbuf *, int );
363 int m_striphdr(struct mbuf *, int, int);
364 
365 /* Per-socket caching of IPsec output policy */
366 static __inline
367 int ipsec_clear_socket_cache(struct mbuf *m)
368 {
369   return 0;
370 }
371 
372 void nat_t_ports_get(struct mbuf *, u_int16_t *, u_int16_t *);
373 
374 extern int ipsec_used __read_mostly, ipsec_enabled __read_mostly;
375 
376 #endif /* _KERNEL */
377 
378 #ifndef _KERNEL
379 char *ipsec_set_policy (const char *, int);
380 int ipsec_get_policylen (char *);
381 char *ipsec_dump_policy (char *, const char *);
382 
383 const char *ipsec_strerror (void);
384 #endif /* !_KERNEL */
385 
386 #ifdef _KERNEL
387 /* External declarations of per-file init functions */
388 void ah_attach(void);
389 void esp_attach(void);
390 void ipcomp_attach(void);
391 void ipe4_attach(void);
392 void ipe4_attach(void);
393 void tcpsignature_attach(void);
394 
395 void ipsec_attach(void);
396 
397 void sysctl_net_inet_ipsec_setup(struct sysctllog **);
398 #ifdef INET6
399 void sysctl_net_inet6_ipsec6_setup(struct sysctllog **);
400 #endif
401 
402 #endif /* _KERNEL */
403 #endif /* !_NETIPSEC_IPSEC_H_ */
404