xref: /netbsd-src/sys/netipsec/ipsec.h (revision da5f4674a3fc214be3572d358b66af40ab9401e7)
1 /*	$NetBSD: ipsec.h,v 1.2 2003/08/15 03:50:20 jonathan Exp $	*/
2 /*	$FreeBSD: src/sys/netipsec/ipsec.h,v 1.2.4.1 2003/01/24 05:11:35 sam Exp $	*/
3 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * IPsec controller part.
36  */
37 
38 #ifndef _NETIPSEC_IPSEC_H_
39 #define _NETIPSEC_IPSEC_H_
40 
41 #if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
42 #include "opt_inet.h"
43 #include "opt_ipsec.h"
44 #endif
45 
46 #include <net/pfkeyv2.h>
47 #include <netipsec/keydb.h>
48 
49 #ifdef _KERNEL
50 
51 /*
52  * Security Policy Index
53  * Ensure that both address families in the "src" and "dst" are same.
54  * When the value of the ul_proto is ICMPv6, the port field in "src"
55  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
56  */
57 struct secpolicyindex {
58 	u_int8_t dir;			/* direction of packet flow, see blow */
59 	union sockaddr_union src;	/* IP src address for SP */
60 	union sockaddr_union dst;	/* IP dst address for SP */
61 	u_int8_t prefs;			/* prefix length in bits for src */
62 	u_int8_t prefd;			/* prefix length in bits for dst */
63 	u_int16_t ul_proto;		/* upper layer Protocol */
64 #ifdef notyet
65 	uid_t uids;
66 	uid_t uidd;
67 	gid_t gids;
68 	gid_t gidd;
69 #endif
70 };
71 
72 /* Security Policy Data Base */
73 struct secpolicy {
74 	LIST_ENTRY(secpolicy) chain;
75 
76 	u_int refcnt;			/* reference count */
77 	struct secpolicyindex spidx;	/* selector */
78 	u_int32_t id;			/* It's unique number on the system. */
79 	u_int state;			/* 0: dead, others: alive */
80 #define IPSEC_SPSTATE_DEAD	0
81 #define IPSEC_SPSTATE_ALIVE	1
82 
83 	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
84 	struct ipsecrequest *req;
85 				/* pointer to the ipsec request tree, */
86 				/* if policy == IPSEC else this value == NULL.*/
87 
88 	/*
89 	 * lifetime handler.
90 	 * the policy can be used without limitiation if both lifetime and
91 	 * validtime are zero.
92 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
93 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
94 	 */
95 	long created;		/* time created the policy */
96 	long lastused;		/* updated every when kernel sends a packet */
97 	long lifetime;		/* duration of the lifetime of this policy */
98 	long validtime;		/* duration this policy is valid without use */
99 };
100 
101 /* Request for IPsec */
102 struct ipsecrequest {
103 	struct ipsecrequest *next;
104 				/* pointer to next structure */
105 				/* If NULL, it means the end of chain. */
106 	struct secasindex saidx;/* hint for search proper SA */
107 				/* if __ss_len == 0 then no address specified.*/
108 	u_int level;		/* IPsec level defined below. */
109 
110 	struct secasvar *sav;	/* place holder of SA for use */
111 	struct secpolicy *sp;	/* back pointer to SP */
112 };
113 
114 /* security policy in PCB */
115 struct inpcbpolicy {
116 	struct secpolicy *sp_in;
117 	struct secpolicy *sp_out;
118 	int priv;			/* privileged socket ? */
119 };
120 
121 /* SP acquiring list table. */
122 struct secspacq {
123 	LIST_ENTRY(secspacq) chain;
124 
125 	struct secpolicyindex spidx;
126 
127 	long created;		/* for lifetime */
128 	int count;		/* for lifetime */
129 	/* XXX: here is mbuf place holder to be sent ? */
130 };
131 #endif /* _KERNEL */
132 
133 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
134 #define IPSEC_PORT_ANY		0
135 #define IPSEC_ULPROTO_ANY	255
136 #define IPSEC_PROTO_ANY		255
137 
138 /* mode of security protocol */
139 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
140 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
141 #define	IPSEC_MODE_TRANSPORT	1
142 #define	IPSEC_MODE_TUNNEL	2
143 
144 /*
145  * Direction of security policy.
146  * NOTE: Since INVALID is used just as flag.
147  * The other are used for loop counter too.
148  */
149 #define IPSEC_DIR_ANY		0
150 #define IPSEC_DIR_INBOUND	1
151 #define IPSEC_DIR_OUTBOUND	2
152 #define IPSEC_DIR_MAX		3
153 #define IPSEC_DIR_INVALID	4
154 
155 /* Policy level */
156 /*
157  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
158  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
159  * DISCARD and NONE are allowed for system default.
160  */
161 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
162 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
163 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
164 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
165 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
166 
167 /* Security protocol level */
168 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
169 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
170 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
171 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
172 
173 #define IPSEC_MANUAL_REQID_MAX	0x3fff
174 				/*
175 				 * if security policy level == unique, this id
176 				 * indicate to a relative SA for use, else is
177 				 * zero.
178 				 * 1 - 0x3fff are reserved for manual keying.
179 				 * 0 are reserved for above reason.  Others is
180 				 * for kernel use.
181 				 * Note that this id doesn't identify SA
182 				 * by only itself.
183 				 */
184 #define IPSEC_REPLAYWSIZE  32
185 
186 /* old statistics for ipsec processing */
187 struct ipsecstat {
188 	u_quad_t in_success;  /* succeeded inbound process */
189 	u_quad_t in_polvio;
190 			/* security policy violation for inbound process */
191 	u_quad_t in_nosa;     /* inbound SA is unavailable */
192 	u_quad_t in_inval;    /* inbound processing failed due to EINVAL */
193 	u_quad_t in_nomem;    /* inbound processing failed due to ENOBUFS */
194 	u_quad_t in_badspi;   /* failed getting a SPI */
195 	u_quad_t in_ahreplay; /* AH replay check failed */
196 	u_quad_t in_espreplay; /* ESP replay check failed */
197 	u_quad_t in_ahauthsucc; /* AH authentication success */
198 	u_quad_t in_ahauthfail; /* AH authentication failure */
199 	u_quad_t in_espauthsucc; /* ESP authentication success */
200 	u_quad_t in_espauthfail; /* ESP authentication failure */
201 	u_quad_t in_esphist[256];
202 	u_quad_t in_ahhist[256];
203 	u_quad_t in_comphist[256];
204 	u_quad_t out_success; /* succeeded outbound process */
205 	u_quad_t out_polvio;
206 			/* security policy violation for outbound process */
207 	u_quad_t out_nosa;    /* outbound SA is unavailable */
208 	u_quad_t out_inval;   /* outbound process failed due to EINVAL */
209 	u_quad_t out_nomem;    /* inbound processing failed due to ENOBUFS */
210 	u_quad_t out_noroute; /* there is no route */
211 	u_quad_t out_esphist[256];
212 	u_quad_t out_ahhist[256];
213 	u_quad_t out_comphist[256];
214 };
215 
216 /* statistics for ipsec processing */
217 struct newipsecstat {
218 	u_int32_t ips_in_polvio;	/* input: sec policy violation */
219 	u_int32_t ips_out_polvio;	/* output: sec policy violation */
220 	u_int32_t ips_out_nosa;		/* output: SA unavailable  */
221 	u_int32_t ips_out_nomem;	/* output: no memory available */
222 	u_int32_t ips_out_noroute;	/* output: no route available */
223 	u_int32_t ips_out_inval;	/* output: generic error */
224 	u_int32_t ips_out_bundlesa;	/* output: bundled SA processed */
225 	u_int32_t ips_mbcoalesced;	/* mbufs coalesced during clone */
226 	u_int32_t ips_clcoalesced;	/* clusters coalesced during clone */
227 	u_int32_t ips_clcopied;		/* clusters copied during clone */
228 	u_int32_t ips_mbinserted;	/* mbufs inserted during makespace */
229 	/*
230 	 * Temporary statistics for performance analysis.
231 	 */
232 	/* See where ESP/AH/IPCOMP header land in mbuf on input */
233 	u_int32_t ips_input_front;
234 	u_int32_t ips_input_middle;
235 	u_int32_t ips_input_end;
236 };
237 
238 /*
239  * XXX JRS FIXME: later replace NetBSD sourcecode with an IPSECSTAT_POLVIO() macro.
240  * for now, map the old fields to the new fields.  */
241 #define ipsecstat newipsecstat
242 
243 #define in_polvio ips_in_polvio
244 #define out_polvio ips_out_polvio
245 #define out_inval ips_out_inval
246 
247 /*
248  * Definitions for IPsec & Key sysctl operations.
249  */
250 /*
251  * Names for IPsec & Key sysctl objects
252  */
253 #define IPSECCTL_STATS			1	/* stats */
254 #define IPSECCTL_DEF_POLICY		2
255 #define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
256 #define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
257 #define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
258 #define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
259 #if 0	/* obsolete, do not reuse */
260 #define IPSECCTL_INBOUND_CALL_IKE	7
261 #endif
262 #define	IPSECCTL_AH_CLEARTOS		8
263 #define	IPSECCTL_AH_OFFSETMASK		9
264 #define	IPSECCTL_DFBIT			10
265 #define	IPSECCTL_ECN			11
266 #define	IPSECCTL_DEBUG			12
267 #define	IPSECCTL_ESP_RANDPAD		13
268 #define IPSECCTL_MAXID			14
269 
270 #define IPSECCTL_NAMES { \
271 	{ 0, 0 }, \
272 	{ 0, 0 }, \
273 	{ "def_policy", CTLTYPE_INT }, \
274 	{ "esp_trans_deflev", CTLTYPE_INT }, \
275 	{ "esp_net_deflev", CTLTYPE_INT }, \
276 	{ "ah_trans_deflev", CTLTYPE_INT }, \
277 	{ "ah_net_deflev", CTLTYPE_INT }, \
278 	{ 0, 0 }, \
279 	{ "ah_cleartos", CTLTYPE_INT }, \
280 	{ "ah_offsetmask", CTLTYPE_INT }, \
281 	{ "dfbit", CTLTYPE_INT }, \
282 	{ "ecn", CTLTYPE_INT }, \
283 	{ "debug", CTLTYPE_INT }, \
284 	{ "esp_randpad", CTLTYPE_INT }, \
285 }
286 
287 #define IPSEC6CTL_NAMES { \
288 	{ 0, 0 }, \
289 	{ 0, 0 }, \
290 	{ "def_policy", CTLTYPE_INT }, \
291 	{ "esp_trans_deflev", CTLTYPE_INT }, \
292 	{ "esp_net_deflev", CTLTYPE_INT }, \
293 	{ "ah_trans_deflev", CTLTYPE_INT }, \
294 	{ "ah_net_deflev", CTLTYPE_INT }, \
295 	{ 0, 0 }, \
296 	{ 0, 0 }, \
297 	{ 0, 0 }, \
298 	{ 0, 0 }, \
299 	{ "ecn", CTLTYPE_INT }, \
300 	{ "debug", CTLTYPE_INT }, \
301 	{ "esp_randpad", CTLTYPE_INT }, \
302 }
303 
304 #ifdef _KERNEL
305 struct ipsec_output_state {
306 	struct mbuf *m;
307 	struct route *ro;
308 	struct sockaddr *dst;
309 };
310 
311 struct ipsec_history {
312 	int ih_proto;
313 	u_int32_t ih_spi;
314 };
315 
316 extern int ipsec_debug;
317 
318 extern struct newipsecstat newipsecstat;
319 extern struct secpolicy ip4_def_policy;
320 extern int ip4_esp_trans_deflev;
321 extern int ip4_esp_net_deflev;
322 extern int ip4_ah_trans_deflev;
323 extern int ip4_ah_net_deflev;
324 extern int ip4_ah_cleartos;
325 extern int ip4_ah_offsetmask;
326 extern int ip4_ipsec_dfbit;
327 extern int ip4_ipsec_ecn;
328 extern int ip4_esp_randpad;
329 extern int crypto_support;
330 
331 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
332 /* for openbsd compatibility */
333 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
334 
335 struct tdb_ident;
336 extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
337 struct inpcb;
338 extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
339 	int *, struct inpcb *));
340 extern struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int,
341 	struct inpcb *, int *);
342 extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
343 	int, int *);
344 
345 
346 static __inline struct secpolicy*
347 ipsec4_getpolicybysock(struct mbuf *m, u_int dir, const struct socket *so, int *err)
348 {
349   panic("ipsec4_getpolicybysock");
350 }
351 
352 static __inline int
353 ipsec_copy_pcbpolicy(struct inpcbpolicy *old, struct inpcbpolicy *new)
354 {
355   /*XXX do nothing */
356   return (0);
357 }
358 
359 
360 
361 struct inpcb;
362 #define	ipsec_init_pcbpolicy ipsec_init_policy
363 extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
364 extern int ipsec_copy_policy
365 	__P((struct inpcbpolicy *, struct inpcbpolicy *));
366 extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
367 extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
368 
369 extern int ipsec4_set_policy __P((struct inpcb *inp, int optname,
370 	caddr_t request, size_t len, int priv));
371 extern int ipsec4_get_policy __P((struct inpcb *inpcb, caddr_t request,
372 	size_t len, struct mbuf **mp));
373 extern int ipsec4_delete_pcbpolicy __P((struct inpcb *));
374 extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
375 /*
376  * KAME ipsec4_in_reject_so(struct mbuf*, struct so)  compatibility shim
377  */
378 #define ipsec4_in_reject_so(m, _so) \
379   ipsec4_in_reject(m, ((_so) == NULL? NULL : sotoinpcb(_so)))
380 
381 
382 struct secas;
383 struct tcpcb;
384 extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
385 extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
386 
387 extern size_t ipsec4_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
388 #ifdef __FreeBSD__
389 extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
390 #else
391 extern size_t ipsec4_hdrsiz_tcp __P((struct tcpcb *));
392 #define ipsec4_getpolicybyaddr ipsec_getpolicybyaddr
393 #endif
394 
395 union sockaddr_union;
396 extern char * ipsec_address(union sockaddr_union* sa);
397 extern const char *ipsec_logsastr __P((struct secasvar *));
398 
399 extern void ipsec_dumpmbuf __P((struct mbuf *));
400 
401 /* NetBSD protosw ctlin entrypoint */
402 extern void *esp4_ctlinput __P((int, struct sockaddr *, void *));
403 extern void *ah4_ctlinput __P((int, struct sockaddr *, void *));
404 extern int ipsec_sysctl __P((int *, u_int, void *, size_t *, void *, size_t));
405 
406 struct m_tag;
407 extern void ipsec4_common_input(struct mbuf *m, ...);
408 extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
409 			int skip, int protoff, struct m_tag *mt);
410 extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
411 			int, int));
412 extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
413 
414 extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
415 
416 extern	void m_checkalignment(const char* where, struct mbuf *m0,
417 		int off, int len);
418 extern	struct mbuf *m_clone(struct mbuf *m0);
419 extern	struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
420 extern	caddr_t m_pad(struct mbuf *m, int n);
421 extern	int m_striphdr(struct mbuf *m, int skip, int hlen);
422 
423 /* Per-socket caching of IPsec output policy */
424 static __inline int ipsec_clear_socket_cache(struct mbuf *m)
425 {
426   return 0;
427 }
428 
429 
430 #endif /* _KERNEL */
431 
432 #ifndef _KERNEL
433 extern caddr_t ipsec_set_policy __P((char *, int));
434 extern int ipsec_get_policylen __P((caddr_t));
435 extern char *ipsec_dump_policy __P((caddr_t, char *));
436 
437 extern const char *ipsec_strerror __P((void));
438 #endif /* !_KERNEL */
439 
440 /*
441  * Porting glue for impedance mismatches between {free,net,open}bsd
442  */
443 #ifdef __FreeBSD__
444   #define IPSEC_ASSERT(x, y) KASSERT(x, y)
445   #define INITFN static
446 #endif
447 #ifdef __NetBSD__
448   #define IPSEC_ASSERT(x, y) KASSERT(x)
449 #define INITFN extern
450 
451 /* External declarations of per-file init functions */
452 INITFN void ah_attach(void);
453 INITFN void esp_attach(void);
454 INITFN void ipcomp_attach(void);
455 INITFN void ipe4_attach(void);
456 
457 INITFN void ipsec_attach(void);
458 #endif /* __NetBSD __ */
459 
460 #endif /* _NETIPSEC_IPSEC_H_ */
461