summaryrefslogtreecommitdiff
path: root/sys/netinet6/ipsec.h
blob: 2265fb0885da36e97ac19e7b574f027e9a96f85e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
/*	$NetBSD: ipsec.h,v 1.7 1999/12/02 05:08:16 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * IPsec controller part.
 */

#ifndef _NETINET6_IPSEC_H_
#define _NETINET6_IPSEC_H_

#if (defined(__FreeBSD__) && __FreeBSD__ >= 3) || defined(__NetBSD__)
#if defined(_KERNEL) && !defined(_LKM)
#include "opt_inet.h"
#endif
#endif

#include <netkey/keyv2.h>
#include <netkey/keydb.h>

#ifdef _KERNEL

/* Security Policy Data Base */
struct secpolicy {
	struct secpolicy *next;
	struct secpolicy *prev;
	struct keytree *spt;	/* back pointer to the top of SPD */

	struct secindex idx;	/* index */

	int refcnt;		/* reference count */
	u_int state;		/* 0: dead, others: alive */
#define IPSEC_SPSTATE_DEAD	0
#define IPSEC_SPSTATE_ALIVE	1

	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
	struct ipsecrequest *req;
				/* pointer to the ipsec request tree, */
				/* if policy == IPSEC else this value == NULL.*/
};

/* Request for IPsec */
struct ipsecrequest {
	struct ipsecrequest *next;
				/* pointer to next structure */
				/* If 0, it means end of chain. */

	u_int proto;		/* IPPROTO_ESP or IPPROTO_AH */
	u_int mode;		/* mode for security protocol, see below. */
	u_int level;		/* IPsec level defined below. */
	struct sockaddr *proxy;	/* Destination address in Outer IP header. */
				/* If mode == TRANSPORT, it must be set NULL. */
	struct secas *sa;	/* place holder for the security association */

	struct secpolicy *sp;	/* back pointer to SP */
};

#endif /*_KERNEL*/

#define	IPSEC_MODE_TRANSPORT	0
#define	IPSEC_MODE_TUNNEL	1

/* Policy level */
/*
 * IPSEC, ENTRUST and BYPASS are allowd for setsockopt() in PCB,
 * DISCARD, IPSEC and NONE are allowd for setkey() in SPD.
 * DISCARD and NONE are allowd for system default.
 */
#define IPSEC_POLICY_DISCARD	0	/* discarding packet */
#define IPSEC_POLICY_NONE	1	/* through IPsec engine */
#define IPSEC_POLICY_IPSEC	2	/* do IPsec */
#define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
#define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */

/* Security protocol level */
#define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
#define	IPSEC_LEVEL_USE		1	/* use SA if present. */
#define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */

#define IPSEC_REPLAYWSIZE  32

/* statistics for ipsec processing */
struct ipsecstat {
	u_quad_t in_success; /* succeeded inbound process */
	u_quad_t in_polvio;  /* security policy violation for inbound process */
	u_quad_t in_nosa;    /* inbound SA is unavailable */
	u_quad_t in_inval;   /* inbound processing failed due to EINVAL */
	u_quad_t in_badspi;   /* failed getting a SPI */
	u_quad_t in_ahreplay; /* AH replay check failed */
	u_quad_t in_espreplay; /* ESP replay check failed */
	u_quad_t in_ahauthsucc; /* AH authentication success */
	u_quad_t in_ahauthfail; /* AH authentication failure */
	u_quad_t in_espauthsucc; /* ESP authentication success */
	u_quad_t in_espauthfail; /* ESP authentication failure */
	u_quad_t in_esphist[SADB_EALG_MAX];
	u_quad_t in_ahhist[SADB_AALG_MAX];
	u_quad_t out_success; /* succeeded outbound process */
	u_quad_t out_polvio;  /* security policy violation for outbound process */
	u_quad_t out_nosa;    /* outbound SA is unavailable */
	u_quad_t out_inval;   /* outbound process failed due to EINVAL */
	u_quad_t out_noroute; /* there is no route */
	u_quad_t out_esphist[SADB_EALG_MAX];
	u_quad_t out_ahhist[SADB_AALG_MAX];
};

/*
 * Definitions for IPsec & Key sysctl operations.
 */
/*
 * Names for IPsec & Key sysctl objects
 */
#define IPSECCTL_STATS			1	/* stats */
#define IPSECCTL_DEF_POLICY		2
#define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
#define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
#define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
#define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
#define IPSECCTL_INBOUND_CALL_IKE	7
#define	IPSECCTL_AH_CLEARTOS		8
#define	IPSECCTL_AH_OFFSETMASK		9
#define	IPSECCTL_DFBIT			10
#define	IPSECCTL_ECN			11
#define IPSECCTL_MAXID			12

#define IPSECCTL_NAMES { \
	{ 0, 0 }, \
	{ 0, 0 }, \
	{ "def_policy", CTLTYPE_INT }, \
	{ "esp_trans_deflev", CTLTYPE_INT }, \
	{ "esp_net_deflev", CTLTYPE_INT }, \
	{ "ah_trans_deflev", CTLTYPE_INT }, \
	{ "ah_net_deflev", CTLTYPE_INT }, \
	{ "inbound_call_ike", CTLTYPE_INT }, \
	{ "ah_cleartos", CTLTYPE_INT }, \
	{ "ah_offsetmask", CTLTYPE_INT }, \
	{ "dfbit", CTLTYPE_INT }, \
	{ "ecn", CTLTYPE_INT }, \
}

#define IPSEC6CTL_NAMES { \
	{ 0, 0 }, \
	{ 0, 0 }, \
	{ "def_policy", CTLTYPE_INT }, \
	{ "esp_trans_deflev", CTLTYPE_INT }, \
	{ "esp_net_deflev", CTLTYPE_INT }, \
	{ "ah_trans_deflev", CTLTYPE_INT }, \
	{ "ah_net_deflev", CTLTYPE_INT }, \
	{ "inbound_call_ike", CTLTYPE_INT }, \
	{ 0, 0 }, \
	{ 0, 0 }, \
	{ 0, 0 }, \
	{ "ecn", CTLTYPE_INT }, \
}

#define IPSECCTL_VARS { \
	0, \
	0, \
	&ip4_def_policy.policy, \
	&ip4_esp_trans_deflev, \
	&ip4_esp_net_deflev, \
	&ip4_ah_trans_deflev, \
	&ip4_ah_net_deflev, \
	&ip4_inbound_call_ike, \
	&ip4_ah_cleartos, \
	&ip4_ah_offsetmask, \
	&ip4_ipsec_dfbit, \
	&ip4_ipsec_ecn, \
}

#define IPSEC6CTL_VARS { \
	0, \
	0, \
	&ip6_def_policy.policy, \
	&ip6_esp_trans_deflev, \
	&ip6_esp_net_deflev, \
	&ip6_ah_trans_deflev, \
	&ip6_ah_net_deflev, \
	&ip6_inbound_call_ike, \
	0, \
	0, \
	0, \
	&ip6_ipsec_ecn, \
}

#ifdef _KERNEL
struct ipsec_output_state {
	struct mbuf *m;
	struct route *ro;
	struct sockaddr *dst;
};

extern struct ipsecstat ipsecstat;
extern struct secpolicy ip4_def_policy;
extern int ip4_esp_trans_deflev;
extern int ip4_esp_net_deflev;
extern int ip4_ah_trans_deflev;
extern int ip4_ah_net_deflev;
extern int ip4_inbound_call_ike;
extern int ip4_ah_cleartos;
extern int ip4_ah_offsetmask;
extern int ip4_ipsec_dfbit;
extern int ip4_ipsec_ecn;

#ifdef INET6
extern struct ipsecstat ipsec6stat;
extern struct secpolicy ip6_def_policy;
extern int ip6_esp_trans_deflev;
extern int ip6_esp_net_deflev;
extern int ip6_ah_trans_deflev;
extern int ip6_ah_net_deflev;
extern int ip6_inbound_call_ike;
extern int ip6_ipsec_ecn;
#endif

extern struct secpolicy *ipsec4_getpolicybysock
	__P((struct mbuf *, struct socket *, int *));
extern struct secpolicy *ipsec4_getpolicybyaddr
	__P((struct mbuf *, int, int *));

#ifdef INET6
extern struct secpolicy *ipsec6_getpolicybysock
	__P((struct mbuf *, struct socket *, int *));
extern struct secpolicy *ipsec6_getpolicybyaddr
	__P((struct mbuf *, int, int *));
#endif /*INET6*/

struct inpcb;
#ifdef INET6
struct in6pcb;
#endif
extern int ipsec_init_policy __P((struct secpolicy **));
extern struct secpolicy *ipsec_copy_policy __P((struct secpolicy *));
extern int ipsec_set_policy __P((struct secpolicy **, int, caddr_t, int, int));
extern int ipsec_get_policy __P((struct secpolicy *, struct mbuf **));
extern int ipsec4_delete_pcbpolicy __P((struct inpcb *));
#ifdef INET6
#if defined(__FreeBSD__) && __FreeBSD__ >= 3
extern int ipsec6_delete_pcbpolicy __P((struct inpcb *));
#else
extern int ipsec6_delete_pcbpolicy __P((struct in6pcb *));
#endif
#endif
extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));

extern int ipsec4_in_reject_so __P((struct mbuf *, struct socket *));
extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));

#ifdef INET6
extern int ipsec6_in_reject_so __P((struct mbuf *, struct socket *));
#if defined(__FreeBSD__) && __FreeBSD__ >= 3
extern int ipsec6_in_reject __P((struct mbuf *, struct inpcb *));
#else
extern int ipsec6_in_reject __P((struct mbuf *, struct in6pcb *));
#endif
#endif /*INET6*/

struct secas;
struct tcpcb;
struct tcp6cb;
extern int ipsec_chkreplay __P((u_int32_t, struct secas *));
extern int ipsec_updatereplay __P((u_int32_t, struct secas *));

extern size_t ipsec4_hdrsiz __P((struct mbuf *, struct inpcb *));
#if defined(__FreeBSD__) && __FreeBSD__ >= 3
extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *, int));
#else
extern size_t ipsec4_hdrsiz_tcp __P((struct tcpcb *));
#endif
#ifdef INET6
#if defined(__FreeBSD__) && __FreeBSD__ >= 3
extern size_t ipsec6_hdrsiz __P((struct mbuf *, struct inpcb *));
#else
extern size_t ipsec6_hdrsiz __P((struct mbuf *, struct in6pcb *));
#if !defined(__NetBSD__) || defined(TCP6)
extern size_t ipsec6_hdrsiz_tcp __P((struct tcp6cb *));
#else
extern size_t ipsec6_hdrsiz_tcp __P((struct tcpcb *));
#endif
#endif
#endif

struct ip;
#ifdef INET6
struct ip6_hdr;
#endif
extern const char *ipsec4_logpacketstr __P((struct ip *, u_int32_t));
#ifdef INET6
extern const char *ipsec6_logpacketstr __P((struct ip6_hdr *, u_int32_t));
#endif
extern const char *ipsec_logsastr __P((struct secas *));

extern void ipsec_dumpmbuf __P((struct mbuf *));

extern int ipsec4_output __P((struct ipsec_output_state *, struct secpolicy *,
	int));
#ifdef INET6
extern int ipsec6_output_trans __P((struct ipsec_output_state *, u_char *,
	struct mbuf *, struct secpolicy *, int, int *));
extern int ipsec6_output_tunnel __P((struct ipsec_output_state *,
	struct secpolicy *, int));
#endif
extern int ipsec4_tunnel_validate __P((struct ip *, u_int, struct secas *));
#ifdef INET6
extern int ipsec6_tunnel_validate __P((struct ip6_hdr *, u_int,
	struct secas *));
#endif
extern struct mbuf *ipsec_copypkt __P((struct mbuf *));

#if defined(__bsdi__) || defined(__NetBSD__)
extern int ipsec_sysctl __P((int *, u_int, void *, size_t *, void *, size_t));
extern int ipsec6_sysctl __P((int *, u_int, void *, size_t *, void *, size_t));
#endif /* __bsdi__ || __NetBSD__ */

#endif /*_KERNEL*/

#ifndef _KERNEL
extern int ipsec_get_policylen(char *reqstr);
extern int ipsec_set_policy(char *buf, int len, char *reqstr);
extern char *ipsec_dump_policy(char *buf, char *delimiter);

extern char *ipsec_strerror(void);
#endif /*!_KERNEL*/

#endif /*_NETINET6_IPSEC_H_*/