xref: /illumos-gate/usr/src/uts/common/inet/ipsecah.h (revision b7daf79982d77b491ef9662483cd4549e0e5da9a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved.
25  */
26 
27 #ifndef	_INET_IPSECAH_H
28 #define	_INET_IPSECAH_H
29 
30 #include <inet/ip.h>
31 #include <inet/ipdrop.h>
32 
33 #ifdef	__cplusplus
34 extern "C" {
35 #endif
36 
37 #include <sys/note.h>
38 
39 #ifdef _KERNEL
40 /* Named Dispatch Parameter Management Structure */
41 typedef struct ipsecahparam_s {
42 	uint_t	ipsecah_param_min;
43 	uint_t	ipsecah_param_max;
44 	uint_t	ipsecah_param_value;
45 	char	*ipsecah_param_name;
46 } ipsecahparam_t;
47 
48 /*
49  * Stats.  This may eventually become a full-blown SNMP MIB once that spec
50  * stabilizes.
51  */
52 typedef struct ah_kstats_s
53 {
54 	kstat_named_t ah_stat_num_aalgs;
55 	kstat_named_t ah_stat_good_auth;
56 	kstat_named_t ah_stat_bad_auth;
57 	kstat_named_t ah_stat_replay_failures;
58 	kstat_named_t ah_stat_replay_early_failures;
59 	kstat_named_t ah_stat_keysock_in;
60 	kstat_named_t ah_stat_out_requests;
61 	kstat_named_t ah_stat_acquire_requests;
62 	kstat_named_t ah_stat_bytes_expired;
63 	kstat_named_t ah_stat_out_discards;
64 	kstat_named_t ah_stat_crypto_sync;
65 	kstat_named_t ah_stat_crypto_async;
66 	kstat_named_t ah_stat_crypto_failures;
67 } ah_kstats_t;
68 
69 /*
70  * ahstack->ah_kstats is equal to ahstack->ah_ksp->ks_data if
71  * kstat_create_netstack for ahstack->ah_ksp succeeds, but when it
72  * fails, it will be NULL. Note this is done for all stack instances,
73  * so it *could* fail. hence a non-NULL checking is done for
74  * AH_BUMP_STAT and AH_DEBUMP_STAT
75  */
76 #define	AH_BUMP_STAT(ahstack, x)					\
77 do {									\
78 	if (ahstack->ah_kstats != NULL)					\
79 		(ahstack->ah_kstats->ah_stat_ ## x).value.ui64++;	\
80 _NOTE(CONSTCOND)							\
81 } while (0)
82 #define	AH_DEBUMP_STAT(ahstack, x)					\
83 do {									\
84 	if (ahstack->ah_kstats != NULL)					\
85 		(ahstack->ah_kstats->ah_stat_ ## x).value.ui64--;	\
86 _NOTE(CONSTCOND)							\
87 } while (0)
88 
89 /*
90  * IPSECAH stack instances
91  */
92 struct ipsecah_stack {
93 	netstack_t		*ipsecah_netstack;	/* Common netstack */
94 
95 	caddr_t			ipsecah_g_nd;
96 	ipsecahparam_t		*ipsecah_params;
97 	kmutex_t		ipsecah_param_lock;	/* Protects params */
98 
99 	sadbp_t			ah_sadb;
100 
101 	/* Packet dropper for AH drops. */
102 	ipdropper_t		ah_dropper;
103 
104 	kstat_t			*ah_ksp;
105 	ah_kstats_t		*ah_kstats;
106 
107 	/*
108 	 * Keysock instance of AH.  There can be only one per stack instance.
109 	 * Use atomic_cas_ptr() on this because I don't set it until
110 	 * KEYSOCK_HELLO comes down.
111 	 * Paired up with the ah_pfkey_q is the ah_event, which will age SAs.
112 	 */
113 	queue_t			*ah_pfkey_q;
114 	timeout_id_t		ah_event;
115 };
116 typedef struct ipsecah_stack ipsecah_stack_t;
117 
118 #define	ipsecah_debug			ipsecah_params[0].ipsecah_param_value
119 #define	ipsecah_age_interval		ipsecah_params[1].ipsecah_param_value
120 #define	ipsecah_age_int_max		ipsecah_params[1].ipsecah_param_max
121 #define	ipsecah_reap_delay		ipsecah_params[2].ipsecah_param_value
122 #define	ipsecah_replay_size		ipsecah_params[3].ipsecah_param_value
123 #define	ipsecah_acquire_timeout		ipsecah_params[4].ipsecah_param_value
124 #define	ipsecah_larval_timeout		ipsecah_params[5].ipsecah_param_value
125 #define	ipsecah_default_soft_bytes	ipsecah_params[6].ipsecah_param_value
126 #define	ipsecah_default_hard_bytes	ipsecah_params[7].ipsecah_param_value
127 #define	ipsecah_default_soft_addtime	ipsecah_params[8].ipsecah_param_value
128 #define	ipsecah_default_hard_addtime	ipsecah_params[9].ipsecah_param_value
129 #define	ipsecah_default_soft_usetime	ipsecah_params[10].ipsecah_param_value
130 #define	ipsecah_default_hard_usetime	ipsecah_params[11].ipsecah_param_value
131 #define	ipsecah_log_unknown_spi		ipsecah_params[12].ipsecah_param_value
132 
133 #endif	/* _KERNEL */
134 
135 /*
136  * For now, only provide "aligned" version of header.
137  * If aligned version is needed, we'll go with the naming conventions then.
138  */
139 
140 typedef struct ah {
141 	uint8_t ah_nexthdr;
142 	uint8_t ah_length;
143 	uint16_t ah_reserved;
144 	uint32_t ah_spi;
145 	uint32_t ah_replay;
146 } ah_t;
147 
148 #define	AH_BASELEN	12
149 #define	AH_TOTAL_LEN(ah)	(((ah)->ah_length << 2) + AH_BASELEN - \
150 					sizeof ((ah)->ah_replay))
151 
152 /* "Old" AH, without replay.  For 1827-29 compatibility. */
153 
154 typedef struct ahold {
155 	uint8_t ah_nexthdr;
156 	uint8_t ah_length;
157 	uint16_t ah_reserved;
158 	uint32_t ah_spi;
159 } ahold_t;
160 
161 #define	AHOLD_BASELEN	8
162 #define	AHOLD_TOTAL_LEN(ah)	(((ah)->ah_length << 2) + AH_BASELEN)
163 
164 #ifdef	__cplusplus
165 }
166 #endif
167 
168 #endif /* _INET_IPSECAH_H */
169