xref: /netbsd-src/sys/netipsec/ipsec.h (revision fc4f42693f9b1c31f39f9cf50af1bf2010325808)
1 /*	$NetBSD: ipsec.h,v 1.72 2018/04/03 09:03:59 maxv Exp $	*/
2 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.h,v 1.2.4.2 2004/02/14 22:23:23 bms Exp $	*/
3 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
4 
5 /*
6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the project nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * IPsec controller part.
36  */
37 
38 #ifndef _NETIPSEC_IPSEC_H_
39 #define _NETIPSEC_IPSEC_H_
40 
41 #if defined(_KERNEL_OPT)
42 #include "opt_inet.h"
43 #include "opt_ipsec.h"
44 #endif
45 
46 #include <net/pfkeyv2.h>
47 
48 #ifdef _KERNEL
49 #include <sys/socketvar.h>
50 #include <sys/localcount.h>
51 
52 #include <netinet/in_pcb_hdr.h>
53 #include <netipsec/keydb.h>
54 
55 /*
56  * Security Policy Index
57  * Ensure that both address families in the "src" and "dst" are same.
58  * When the value of the ul_proto is ICMPv6, the port field in "src"
59  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
60  */
61 struct secpolicyindex {
62 	u_int8_t dir;			/* direction of packet flow, see blow */
63 	union sockaddr_union src;	/* IP src address for SP */
64 	union sockaddr_union dst;	/* IP dst address for SP */
65 	u_int8_t prefs;			/* prefix length in bits for src */
66 	u_int8_t prefd;			/* prefix length in bits for dst */
67 	u_int16_t ul_proto;		/* upper layer Protocol */
68 #ifdef notyet
69 	uid_t uids;
70 	uid_t uidd;
71 	gid_t gids;
72 	gid_t gidd;
73 #endif
74 };
75 
76 /* Security Policy Data Base */
77 struct secpolicy {
78 	struct pslist_entry pslist_entry;
79 
80 	struct localcount localcount;	/* reference count */
81 	struct secpolicyindex spidx;	/* selector */
82 	u_int32_t id;			/* It's unique number on the system. */
83 	u_int state;			/* 0: dead, others: alive */
84 #define IPSEC_SPSTATE_DEAD	0
85 #define IPSEC_SPSTATE_ALIVE	1
86 
87 	u_int origin;			/* who generate this SP. */
88 #define IPSEC_SPORIGIN_USER	0
89 #define IPSEC_SPORIGIN_KERNEL	1
90 
91 	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
92 	struct ipsecrequest *req;
93 				/* pointer to the ipsec request tree, */
94 				/* if policy == IPSEC else this value == NULL.*/
95 
96 	/*
97 	 * lifetime handler.
98 	 * the policy can be used without limitiation if both lifetime and
99 	 * validtime are zero.
100 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
101 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
102 	 */
103 	time_t created;		/* time created the policy */
104 	time_t lastused;	/* updated every when kernel sends a packet */
105 	time_t lifetime;	/* duration of the lifetime of this policy */
106 	time_t validtime;	/* duration this policy is valid without use */
107 };
108 
109 /* Request for IPsec */
110 struct ipsecrequest {
111 	struct ipsecrequest *next;
112 				/* pointer to next structure */
113 				/* If NULL, it means the end of chain. */
114 	struct secasindex saidx;/* hint for search proper SA */
115 				/* if __ss_len == 0 then no address specified.*/
116 	u_int level;		/* IPsec level defined below. */
117 
118 	struct secpolicy *sp;	/* back pointer to SP */
119 };
120 
121 /* security policy in PCB */
122 struct inpcbpolicy {
123 	struct secpolicy *sp_in;
124 	struct secpolicy *sp_out;
125 	int priv;			/* privileged socket ? */
126 
127 	/* cached policy */
128 	struct {
129 		struct secpolicy *cachesp;
130 		struct secpolicyindex cacheidx;
131 		int cachehint;		/* processing requirement hint: */
132 #define	IPSEC_PCBHINT_UNKNOWN	0	/* Unknown */
133 #define	IPSEC_PCBHINT_YES	1	/* IPsec processing is required */
134 #define	IPSEC_PCBHINT_NO	2	/* IPsec processing not required */
135 		u_int cachegen;		/* spdgen when cache filled */
136 	} sp_cache[3];			/* XXX 3 == IPSEC_DIR_MAX */
137 	int sp_cacheflags;
138 #define	IPSEC_PCBSP_CONNECTED	1
139 	struct inpcb_hdr *sp_inph;	/* back pointer */
140 };
141 
142 extern u_int ipsec_spdgen;
143 
144 static inline bool
145 ipsec_pcb_skip_ipsec(struct inpcbpolicy *pcbsp, int dir)
146 {
147 
148 	KASSERT(inph_locked(pcbsp->sp_inph));
149 
150 	return pcbsp->sp_cache[(dir)].cachehint == IPSEC_PCBHINT_NO &&
151 	    pcbsp->sp_cache[(dir)].cachegen == ipsec_spdgen;
152 }
153 
154 /* SP acquiring list table. */
155 struct secspacq {
156 	LIST_ENTRY(secspacq) chain;
157 
158 	struct secpolicyindex spidx;
159 
160 	time_t created;		/* for lifetime */
161 	int count;		/* for lifetime */
162 	/* XXX: here is mbuf place holder to be sent ? */
163 };
164 #endif /* _KERNEL */
165 
166 /* buffer size for formatted output of ipsec address (addr + '%' + scope_id?) */
167 #define	IPSEC_ADDRSTRLEN	(INET6_ADDRSTRLEN + 11)
168 /* buffer size for ipsec_logsastr() */
169 #define	IPSEC_LOGSASTRLEN	192
170 
171 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
172 #define IPSEC_PORT_ANY		0
173 #define IPSEC_ULPROTO_ANY	255
174 #define IPSEC_PROTO_ANY		255
175 
176 /* mode of security protocol */
177 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
178 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
179 #define	IPSEC_MODE_TRANSPORT	1
180 #define	IPSEC_MODE_TUNNEL	2
181 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
182 
183 /*
184  * Direction of security policy.
185  * NOTE: Since INVALID is used just as flag.
186  * The other are used for loop counter too.
187  */
188 #define IPSEC_DIR_ANY		0
189 #define IPSEC_DIR_INBOUND	1
190 #define IPSEC_DIR_OUTBOUND	2
191 #define IPSEC_DIR_MAX		3
192 #define IPSEC_DIR_INVALID	4
193 
194 #define IPSEC_DIR_IS_VALID(dir)		((dir) >= 0 && (dir) <= IPSEC_DIR_MAX)
195 #define IPSEC_DIR_IS_INOROUT(dir)	((dir) == IPSEC_DIR_INBOUND || \
196 					 (dir) == IPSEC_DIR_OUTBOUND)
197 
198 /* Policy level */
199 /*
200  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
201  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
202  * DISCARD and NONE are allowed for system default.
203  */
204 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
205 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
206 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
207 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
208 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
209 
210 /* Security protocol level */
211 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
212 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
213 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
214 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
215 
216 #define IPSEC_MANUAL_REQID_MAX	0x3fff
217 				/*
218 				 * if security policy level == unique, this id
219 				 * indicate to a relative SA for use, else is
220 				 * zero.
221 				 * 1 - 0x3fff are reserved for manual keying.
222 				 * 0 are reserved for above reason.  Others is
223 				 * for kernel use.
224 				 * Note that this id doesn't identify SA
225 				 * by only itself.
226 				 */
227 #define IPSEC_REPLAYWSIZE  32
228 
229 #ifdef _KERNEL
230 struct ipsec_output_state {
231 	struct mbuf *m;
232 	struct route *ro;
233 	struct sockaddr *dst;
234 };
235 
236 struct ipsec_history {
237 	int ih_proto;
238 	u_int32_t ih_spi;
239 };
240 
241 extern int ipsec_debug;
242 #ifdef IPSEC_DEBUG
243 extern int ipsec_replay;
244 extern int ipsec_integrity;
245 #endif
246 
247 extern struct secpolicy ip4_def_policy;
248 extern int ip4_esp_trans_deflev;
249 extern int ip4_esp_net_deflev;
250 extern int ip4_ah_trans_deflev;
251 extern int ip4_ah_net_deflev;
252 extern int ip4_ah_cleartos;
253 extern int ip4_ah_offsetmask;
254 extern int ip4_ipsec_dfbit;
255 extern int ip4_ipsec_ecn;
256 extern int crypto_support;
257 
258 #include <sys/syslog.h>
259 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
260 /* for openbsd compatibility */
261 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
262 
263 #define IPSECLOG(level, fmt, args...) 					\
264 	do {								\
265 		if (ipsec_debug)					\
266 			log(level, "%s: " fmt, __func__, ##args);	\
267 	} while (0)
268 
269 void ipsec_pcbconn(struct inpcbpolicy *);
270 void ipsec_pcbdisconn(struct inpcbpolicy *);
271 void ipsec_invalpcbcacheall(void);
272 
273 struct inpcb;
274 int ipsec4_output(struct mbuf *, struct inpcb *, int, u_long *, bool *, bool *);
275 int ipsec4_input(struct mbuf *, int);
276 int ipsec4_forward(struct mbuf *, int *);
277 #ifdef INET6
278 int ipsec6_input(struct mbuf *);
279 #endif
280 
281 struct inpcb;
282 #define	ipsec_init_pcbpolicy ipsec_init_policy
283 int ipsec_init_policy(struct socket *so, struct inpcbpolicy **);
284 int ipsec_copy_policy(const struct inpcbpolicy *, struct inpcbpolicy *);
285 u_int ipsec_get_reqlevel(const struct ipsecrequest *);
286 
287 int ipsec_set_policy(void *, int, const void *, size_t, kauth_cred_t);
288 int ipsec_get_policy(void *, const void *, size_t, struct mbuf **);
289 int ipsec_delete_pcbpolicy(void *);
290 int ipsec_in_reject(struct mbuf *, void *);
291 
292 struct secasvar *ipsec_lookup_sa(const struct ipsecrequest *,
293     const struct mbuf *);
294 
295 struct secas;
296 struct tcpcb;
297 int ipsec_chkreplay(u_int32_t, const struct secasvar *);
298 int ipsec_updatereplay(u_int32_t, const struct secasvar *);
299 
300 size_t ipsec_hdrsiz(struct mbuf *, u_int, void *);
301 size_t ipsec4_hdrsiz_tcp(struct tcpcb *);
302 
303 union sockaddr_union;
304 const char *ipsec_address(const union sockaddr_union* sa, char *, size_t);
305 const char *ipsec_logsastr(const struct secasvar *, char *, size_t);
306 
307 void ipsec_dumpmbuf(struct mbuf *);
308 
309 /* NetBSD protosw ctlin entrypoint */
310 void *esp4_ctlinput(int, const struct sockaddr *, void *);
311 void *ah4_ctlinput(int, const struct sockaddr *, void *);
312 
313 void ipsec_output_init(void);
314 struct m_tag;
315 void ipsec4_common_input(struct mbuf *m, ...);
316 int ipsec4_common_input_cb(struct mbuf *, struct secasvar *, int, int);
317 int ipsec4_process_packet(struct mbuf *, const struct ipsecrequest *, u_long *);
318 int ipsec_process_done(struct mbuf *, const struct ipsecrequest *,
319     struct secasvar *);
320 
321 #define ipsec_indone(m)	\
322 	((m->m_flags & M_AUTHIPHDR) || (m->m_flags & M_DECRYPTED))
323 #define ipsec_outdone(m) \
324 	(m_tag_find((m), PACKET_TAG_IPSEC_OUT_DONE, NULL) != NULL)
325 
326 struct mbuf *m_clone(struct mbuf *);
327 struct mbuf *m_makespace(struct mbuf *, int, int, int *);
328 void *m_pad(struct mbuf *, int );
329 int m_striphdr(struct mbuf *, int, int);
330 
331 void nat_t_ports_get(struct mbuf *, u_int16_t *, u_int16_t *);
332 
333 extern int ipsec_used __read_mostly, ipsec_enabled __read_mostly;
334 
335 #endif /* _KERNEL */
336 
337 #ifndef _KERNEL
338 char *ipsec_set_policy(const char *, int);
339 int ipsec_get_policylen(char *);
340 char *ipsec_dump_policy(char *, const char *);
341 const char *ipsec_strerror(void);
342 #endif /* !_KERNEL */
343 
344 #ifdef _KERNEL
345 /* External declarations of per-file init functions */
346 void ah_attach(void);
347 void esp_attach(void);
348 void ipcomp_attach(void);
349 void ipe4_attach(void);
350 void ipe4_attach(void);
351 void tcpsignature_attach(void);
352 
353 void ipsec_attach(void);
354 
355 void sysctl_net_inet_ipsec_setup(struct sysctllog **);
356 #ifdef INET6
357 void sysctl_net_inet6_ipsec6_setup(struct sysctllog **);
358 #endif
359 
360 #endif /* _KERNEL */
361 #endif /* !_NETIPSEC_IPSEC_H_ */
362