xref: /freebsd/sys/netipsec/ipsec.h (revision 74bf4e164ba5851606a27d4feff27717452583e5)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * IPsec controller part.
35  */
36 
37 #ifndef _NETIPSEC_IPSEC_H_
38 #define _NETIPSEC_IPSEC_H_
39 
40 #if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
41 #include "opt_inet.h"
42 #include "opt_ipsec.h"
43 #endif
44 
45 #include <net/pfkeyv2.h>
46 #include <netipsec/keydb.h>
47 #include <netipsec/ipsec_osdep.h>
48 
49 #ifdef _KERNEL
50 
51 /*
52  * Security Policy Index
53  * Ensure that both address families in the "src" and "dst" are same.
54  * When the value of the ul_proto is ICMPv6, the port field in "src"
55  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
56  */
57 struct secpolicyindex {
58 	u_int8_t dir;			/* direction of packet flow, see blow */
59 	union sockaddr_union src;	/* IP src address for SP */
60 	union sockaddr_union dst;	/* IP dst address for SP */
61 	u_int8_t prefs;			/* prefix length in bits for src */
62 	u_int8_t prefd;			/* prefix length in bits for dst */
63 	u_int16_t ul_proto;		/* upper layer Protocol */
64 #ifdef notyet
65 	uid_t uids;
66 	uid_t uidd;
67 	gid_t gids;
68 	gid_t gidd;
69 #endif
70 };
71 
72 /* Security Policy Data Base */
73 struct secpolicy {
74 	LIST_ENTRY(secpolicy) chain;
75 	struct mtx lock;
76 
77 	u_int refcnt;			/* reference count */
78 	struct secpolicyindex spidx;	/* selector */
79 	u_int32_t id;			/* It's unique number on the system. */
80 	u_int state;			/* 0: dead, others: alive */
81 #define IPSEC_SPSTATE_DEAD	0
82 #define IPSEC_SPSTATE_ALIVE	1
83 	u_int16_t policy;		/* policy_type per pfkeyv2.h */
84 	u_int16_t scangen;		/* scan generation # */
85 	struct ipsecrequest *req;
86 				/* pointer to the ipsec request tree, */
87 				/* if policy == IPSEC else this value == NULL.*/
88 
89 	/*
90 	 * lifetime handler.
91 	 * the policy can be used without limitiation if both lifetime and
92 	 * validtime are zero.
93 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
94 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
95 	 */
96 	time_t created;		/* time created the policy */
97 	time_t lastused;	/* updated every when kernel sends a packet */
98 	long lifetime;		/* duration of the lifetime of this policy */
99 	long validtime;		/* duration this policy is valid without use */
100 };
101 
102 #define	SECPOLICY_LOCK_INIT(_sp) \
103 	mtx_init(&(_sp)->lock, "ipsec policy", NULL, MTX_DEF)
104 #define	SECPOLICY_LOCK(_sp)		mtx_lock(&(_sp)->lock)
105 #define	SECPOLICY_UNLOCK(_sp)		mtx_unlock(&(_sp)->lock)
106 #define	SECPOLICY_LOCK_DESTROY(_sp)	mtx_destroy(&(_sp)->lock)
107 #define	SECPOLICY_LOCK_ASSERT(_sp)	mtx_assert(&(_sp)->lock, MA_OWNED)
108 
109 /* Request for IPsec */
110 struct ipsecrequest {
111 	struct ipsecrequest *next;
112 				/* pointer to next structure */
113 				/* If NULL, it means the end of chain. */
114 	struct secasindex saidx;/* hint for search proper SA */
115 				/* if __ss_len == 0 then no address specified.*/
116 	u_int level;		/* IPsec level defined below. */
117 
118 	struct secasvar *sav;	/* place holder of SA for use */
119 	struct secpolicy *sp;	/* back pointer to SP */
120 	struct mtx lock;	/* to interlock updates */
121 };
122 
123 /*
124  * Need recursion for when crypto callbacks happen directly,
125  * as in the case of software crypto.  Need to look at how
126  * hard it is to remove this...
127  */
128 #define	IPSECREQUEST_LOCK_INIT(_isr) \
129 	mtx_init(&(_isr)->lock, "ipsec request", NULL, MTX_DEF | MTX_RECURSE)
130 #define	IPSECREQUEST_LOCK(_isr)		mtx_lock(&(_isr)->lock)
131 #define	IPSECREQUEST_UNLOCK(_isr)	mtx_unlock(&(_isr)->lock)
132 #define	IPSECREQUEST_LOCK_DESTROY(_isr)	mtx_destroy(&(_isr)->lock)
133 #define	IPSECREQUEST_LOCK_ASSERT(_isr)	mtx_assert(&(_isr)->lock, MA_OWNED)
134 
135 /* security policy in PCB */
136 struct inpcbpolicy {
137 	struct secpolicy *sp_in;
138 	struct secpolicy *sp_out;
139 	int priv;			/* privileged socket ? */
140 };
141 
142 /* SP acquiring list table. */
143 struct secspacq {
144 	LIST_ENTRY(secspacq) chain;
145 
146 	struct secpolicyindex spidx;
147 
148 	time_t created;		/* for lifetime */
149 	int count;		/* for lifetime */
150 	/* XXX: here is mbuf place holder to be sent ? */
151 };
152 #endif /* _KERNEL */
153 
154 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
155 #define IPSEC_PORT_ANY		0
156 #define IPSEC_ULPROTO_ANY	255
157 #define IPSEC_PROTO_ANY		255
158 
159 /* mode of security protocol */
160 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
161 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
162 #define	IPSEC_MODE_TRANSPORT	1
163 #define	IPSEC_MODE_TUNNEL	2
164 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
165 
166 /*
167  * Direction of security policy.
168  * NOTE: Since INVALID is used just as flag.
169  * The other are used for loop counter too.
170  */
171 #define IPSEC_DIR_ANY		0
172 #define IPSEC_DIR_INBOUND	1
173 #define IPSEC_DIR_OUTBOUND	2
174 #define IPSEC_DIR_MAX		3
175 #define IPSEC_DIR_INVALID	4
176 
177 /* Policy level */
178 /*
179  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
180  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
181  * DISCARD and NONE are allowed for system default.
182  */
183 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
184 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
185 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
186 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
187 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
188 
189 /* Security protocol level */
190 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
191 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
192 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
193 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
194 
195 #define IPSEC_MANUAL_REQID_MAX	0x3fff
196 				/*
197 				 * if security policy level == unique, this id
198 				 * indicate to a relative SA for use, else is
199 				 * zero.
200 				 * 1 - 0x3fff are reserved for manual keying.
201 				 * 0 are reserved for above reason.  Others is
202 				 * for kernel use.
203 				 * Note that this id doesn't identify SA
204 				 * by only itself.
205 				 */
206 #define IPSEC_REPLAYWSIZE  32
207 
208 /* old statistics for ipsec processing */
209 struct ipsecstat {
210 	u_quad_t in_success;  /* succeeded inbound process */
211 	u_quad_t in_polvio;
212 			/* security policy violation for inbound process */
213 	u_quad_t in_nosa;     /* inbound SA is unavailable */
214 	u_quad_t in_inval;    /* inbound processing failed due to EINVAL */
215 	u_quad_t in_nomem;    /* inbound processing failed due to ENOBUFS */
216 	u_quad_t in_badspi;   /* failed getting a SPI */
217 	u_quad_t in_ahreplay; /* AH replay check failed */
218 	u_quad_t in_espreplay; /* ESP replay check failed */
219 	u_quad_t in_ahauthsucc; /* AH authentication success */
220 	u_quad_t in_ahauthfail; /* AH authentication failure */
221 	u_quad_t in_espauthsucc; /* ESP authentication success */
222 	u_quad_t in_espauthfail; /* ESP authentication failure */
223 	u_quad_t in_esphist[256];
224 	u_quad_t in_ahhist[256];
225 	u_quad_t in_comphist[256];
226 	u_quad_t out_success; /* succeeded outbound process */
227 	u_quad_t out_polvio;
228 			/* security policy violation for outbound process */
229 	u_quad_t out_nosa;    /* outbound SA is unavailable */
230 	u_quad_t out_inval;   /* outbound process failed due to EINVAL */
231 	u_quad_t out_nomem;    /* inbound processing failed due to ENOBUFS */
232 	u_quad_t out_noroute; /* there is no route */
233 	u_quad_t out_esphist[256];
234 	u_quad_t out_ahhist[256];
235 	u_quad_t out_comphist[256];
236 
237 	u_quad_t spdcachelookup;
238 	u_quad_t spdcachemiss;
239 };
240 
241 /* statistics for ipsec processing */
242 struct newipsecstat {
243 	u_int32_t ips_in_polvio;	/* input: sec policy violation */
244 	u_int32_t ips_out_polvio;	/* output: sec policy violation */
245 	u_int32_t ips_out_nosa;		/* output: SA unavailable  */
246 	u_int32_t ips_out_nomem;	/* output: no memory available */
247 	u_int32_t ips_out_noroute;	/* output: no route available */
248 	u_int32_t ips_out_inval;	/* output: generic error */
249 	u_int32_t ips_out_bundlesa;	/* output: bundled SA processed */
250 	u_int32_t ips_mbcoalesced;	/* mbufs coalesced during clone */
251 	u_int32_t ips_clcoalesced;	/* clusters coalesced during clone */
252 	u_int32_t ips_clcopied;		/* clusters copied during clone */
253 	u_int32_t ips_mbinserted;	/* mbufs inserted during makespace */
254 	/*
255 	 * Temporary statistics for performance analysis.
256 	 */
257 	/* See where ESP/AH/IPCOMP header land in mbuf on input */
258 	u_int32_t ips_input_front;
259 	u_int32_t ips_input_middle;
260 	u_int32_t ips_input_end;
261 };
262 
263 /*
264  * Definitions for IPsec & Key sysctl operations.
265  */
266 /*
267  * Names for IPsec & Key sysctl objects
268  */
269 #define IPSECCTL_STATS			1	/* stats */
270 #define IPSECCTL_DEF_POLICY		2
271 #define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
272 #define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
273 #define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
274 #define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
275 #if 0	/* obsolete, do not reuse */
276 #define IPSECCTL_INBOUND_CALL_IKE	7
277 #endif
278 #define	IPSECCTL_AH_CLEARTOS		8
279 #define	IPSECCTL_AH_OFFSETMASK		9
280 #define	IPSECCTL_DFBIT			10
281 #define	IPSECCTL_ECN			11
282 #define	IPSECCTL_DEBUG			12
283 #define	IPSECCTL_ESP_RANDPAD		13
284 #define IPSECCTL_MAXID			14
285 
286 #define IPSECCTL_NAMES { \
287 	{ 0, 0 }, \
288 	{ 0, 0 }, \
289 	{ "def_policy", CTLTYPE_INT }, \
290 	{ "esp_trans_deflev", CTLTYPE_INT }, \
291 	{ "esp_net_deflev", CTLTYPE_INT }, \
292 	{ "ah_trans_deflev", CTLTYPE_INT }, \
293 	{ "ah_net_deflev", CTLTYPE_INT }, \
294 	{ 0, 0 }, \
295 	{ "ah_cleartos", CTLTYPE_INT }, \
296 	{ "ah_offsetmask", CTLTYPE_INT }, \
297 	{ "dfbit", CTLTYPE_INT }, \
298 	{ "ecn", CTLTYPE_INT }, \
299 	{ "debug", CTLTYPE_INT }, \
300 	{ "esp_randpad", CTLTYPE_INT }, \
301 }
302 
303 #define IPSEC6CTL_NAMES { \
304 	{ 0, 0 }, \
305 	{ 0, 0 }, \
306 	{ "def_policy", CTLTYPE_INT }, \
307 	{ "esp_trans_deflev", CTLTYPE_INT }, \
308 	{ "esp_net_deflev", CTLTYPE_INT }, \
309 	{ "ah_trans_deflev", CTLTYPE_INT }, \
310 	{ "ah_net_deflev", CTLTYPE_INT }, \
311 	{ 0, 0 }, \
312 	{ 0, 0 }, \
313 	{ 0, 0 }, \
314 	{ 0, 0 }, \
315 	{ "ecn", CTLTYPE_INT }, \
316 	{ "debug", CTLTYPE_INT }, \
317 	{ "esp_randpad", CTLTYPE_INT }, \
318 }
319 
320 #ifdef _KERNEL
321 struct ipsec_output_state {
322 	struct mbuf *m;
323 	struct route *ro;
324 	struct sockaddr *dst;
325 };
326 
327 struct ipsec_history {
328 	int ih_proto;
329 	u_int32_t ih_spi;
330 };
331 
332 extern int ipsec_debug;
333 
334 extern struct newipsecstat newipsecstat;
335 extern struct secpolicy ip4_def_policy;
336 extern int ip4_esp_trans_deflev;
337 extern int ip4_esp_net_deflev;
338 extern int ip4_ah_trans_deflev;
339 extern int ip4_ah_net_deflev;
340 extern int ip4_ah_cleartos;
341 extern int ip4_ah_offsetmask;
342 extern int ip4_ipsec_dfbit;
343 extern int ip4_ipsec_ecn;
344 extern int ip4_esp_randpad;
345 extern int crypto_support;
346 
347 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
348 /* for openbsd compatibility */
349 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
350 
351 /* XXX for KAME code compatibility */
352 #define ipsec_pcbconn(_x)
353 #define	ipsec_pcbdisconn(_x)
354 
355 extern	struct ipsecrequest *ipsec_newisr(void);
356 extern	void ipsec_delisr(struct ipsecrequest *);
357 
358 struct tdb_ident;
359 extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
360 struct inpcb;
361 extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
362 	int *, struct inpcb *));
363 extern struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int,
364 	struct inpcb *, int *);
365 extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
366 	int, int *);
367 
368 struct inpcb;
369 extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
370 extern int ipsec_copy_policy
371 	__P((struct inpcbpolicy *, struct inpcbpolicy *));
372 extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
373 extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
374 
375 extern int ipsec4_set_policy __P((struct inpcb *inp, int optname,
376 	caddr_t request, size_t len, int priv));
377 extern int ipsec4_get_policy __P((struct inpcb *inpcb, caddr_t request,
378 	size_t len, struct mbuf **mp));
379 extern int ipsec4_delete_pcbpolicy __P((struct inpcb *));
380 extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
381 
382 struct secas;
383 struct tcpcb;
384 extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
385 extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
386 
387 extern size_t ipsec4_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
388 extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
389 
390 union sockaddr_union;
391 extern char * ipsec_address(union sockaddr_union* sa);
392 extern const char *ipsec_logsastr __P((struct secasvar *));
393 
394 extern void ipsec_dumpmbuf __P((struct mbuf *));
395 
396 struct m_tag;
397 extern void ah4_input(struct mbuf *m, int off);
398 extern void ah4_ctlinput(int cmd, struct sockaddr *sa, void *);
399 extern void esp4_input(struct mbuf *m, int off);
400 extern void esp4_ctlinput(int cmd, struct sockaddr *sa, void *);
401 extern void ipcomp4_input(struct mbuf *m, int off);
402 extern int ipsec4_common_input(struct mbuf *m, ...);
403 extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
404 			int skip, int protoff, struct m_tag *mt);
405 extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
406 			int, int));
407 extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
408 
409 extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
410 
411 extern	void m_checkalignment(const char* where, struct mbuf *m0,
412 		int off, int len);
413 extern	struct mbuf *m_clone(struct mbuf *m0);
414 extern	struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
415 extern	caddr_t m_pad(struct mbuf *m, int n);
416 extern	int m_striphdr(struct mbuf *m, int skip, int hlen);
417 #endif /* _KERNEL */
418 
419 #ifndef _KERNEL
420 extern caddr_t ipsec_set_policy __P((char *, int));
421 extern int ipsec_get_policylen __P((caddr_t));
422 extern char *ipsec_dump_policy __P((caddr_t, char *));
423 
424 extern const char *ipsec_strerror __P((void));
425 #endif /* !_KERNEL */
426 
427 #endif /* _NETIPSEC_IPSEC_H_ */
428