xref: /freebsd/sys/netipsec/ipsec.h (revision 7aa383846770374466b1dcb2cefd71bde9acf463)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
3 
4 /*-
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * IPsec controller part.
35  */
36 
37 #ifndef _NETIPSEC_IPSEC_H_
38 #define _NETIPSEC_IPSEC_H_
39 
40 #if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
41 #include "opt_inet.h"
42 #include "opt_ipsec.h"
43 #endif
44 
45 #include <net/pfkeyv2.h>
46 #include <netipsec/keydb.h>
47 
48 #ifdef _KERNEL
49 
50 #define	IPSEC_ASSERT(_c,_m) KASSERT(_c, _m)
51 
52 #define	IPSEC_IS_PRIVILEGED_SO(_so) \
53 	((_so)->so_cred != NULL && \
54 	 priv_check_cred((_so)->so_cred, PRIV_NETINET_IPSEC, 0) \
55 	 == 0)
56 
57 /*
58  * Security Policy Index
59  * Ensure that both address families in the "src" and "dst" are same.
60  * When the value of the ul_proto is ICMPv6, the port field in "src"
61  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
62  */
63 struct secpolicyindex {
64 	u_int8_t dir;			/* direction of packet flow, see below */
65 	union sockaddr_union src;	/* IP src address for SP */
66 	union sockaddr_union dst;	/* IP dst address for SP */
67 	u_int8_t prefs;			/* prefix length in bits for src */
68 	u_int8_t prefd;			/* prefix length in bits for dst */
69 	u_int16_t ul_proto;		/* upper layer Protocol */
70 #ifdef notyet
71 	uid_t uids;
72 	uid_t uidd;
73 	gid_t gids;
74 	gid_t gidd;
75 #endif
76 };
77 
78 /* Security Policy Data Base */
79 struct secpolicy {
80 	LIST_ENTRY(secpolicy) chain;
81 	struct mtx lock;
82 
83 	u_int refcnt;			/* reference count */
84 	struct secpolicyindex spidx;	/* selector */
85 	u_int32_t id;			/* It's unique number on the system. */
86 	u_int state;			/* 0: dead, others: alive */
87 #define IPSEC_SPSTATE_DEAD	0
88 #define IPSEC_SPSTATE_ALIVE	1
89 	u_int16_t policy;		/* policy_type per pfkeyv2.h */
90 	u_int16_t scangen;		/* scan generation # */
91 	struct ipsecrequest *req;
92 				/* pointer to the ipsec request tree, */
93 				/* if policy == IPSEC else this value == NULL.*/
94 
95 	/*
96 	 * lifetime handler.
97 	 * the policy can be used without limitiation if both lifetime and
98 	 * validtime are zero.
99 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
100 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
101 	 */
102 	time_t created;		/* time created the policy */
103 	time_t lastused;	/* updated every when kernel sends a packet */
104 	long lifetime;		/* duration of the lifetime of this policy */
105 	long validtime;		/* duration this policy is valid without use */
106 };
107 
108 #define	SECPOLICY_LOCK_INIT(_sp) \
109 	mtx_init(&(_sp)->lock, "ipsec policy", NULL, MTX_DEF)
110 #define	SECPOLICY_LOCK(_sp)		mtx_lock(&(_sp)->lock)
111 #define	SECPOLICY_UNLOCK(_sp)		mtx_unlock(&(_sp)->lock)
112 #define	SECPOLICY_LOCK_DESTROY(_sp)	mtx_destroy(&(_sp)->lock)
113 #define	SECPOLICY_LOCK_ASSERT(_sp)	mtx_assert(&(_sp)->lock, MA_OWNED)
114 
115 /* Request for IPsec */
116 struct ipsecrequest {
117 	struct ipsecrequest *next;
118 				/* pointer to next structure */
119 				/* If NULL, it means the end of chain. */
120 	struct secasindex saidx;/* hint for search proper SA */
121 				/* if __ss_len == 0 then no address specified.*/
122 	u_int level;		/* IPsec level defined below. */
123 
124 	struct secasvar *sav;	/* place holder of SA for use */
125 	struct secpolicy *sp;	/* back pointer to SP */
126 	struct mtx lock;	/* to interlock updates */
127 };
128 
129 /*
130  * Need recursion for when crypto callbacks happen directly,
131  * as in the case of software crypto.  Need to look at how
132  * hard it is to remove this...
133  */
134 #define	IPSECREQUEST_LOCK_INIT(_isr) \
135 	mtx_init(&(_isr)->lock, "ipsec request", NULL, MTX_DEF | MTX_RECURSE)
136 #define	IPSECREQUEST_LOCK(_isr)		mtx_lock(&(_isr)->lock)
137 #define	IPSECREQUEST_UNLOCK(_isr)	mtx_unlock(&(_isr)->lock)
138 #define	IPSECREQUEST_LOCK_DESTROY(_isr)	mtx_destroy(&(_isr)->lock)
139 #define	IPSECREQUEST_LOCK_ASSERT(_isr)	mtx_assert(&(_isr)->lock, MA_OWNED)
140 
141 /* security policy in PCB */
142 struct inpcbpolicy {
143 	struct secpolicy *sp_in;
144 	struct secpolicy *sp_out;
145 	int priv;			/* privileged socket ? */
146 };
147 
148 /* SP acquiring list table. */
149 struct secspacq {
150 	LIST_ENTRY(secspacq) chain;
151 
152 	struct secpolicyindex spidx;
153 
154 	time_t created;		/* for lifetime */
155 	int count;		/* for lifetime */
156 	/* XXX: here is mbuf place holder to be sent ? */
157 };
158 #endif /* _KERNEL */
159 
160 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
161 #define IPSEC_PORT_ANY		0
162 #define IPSEC_ULPROTO_ANY	255
163 #define IPSEC_PROTO_ANY		255
164 
165 /* mode of security protocol */
166 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
167 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
168 #define	IPSEC_MODE_TRANSPORT	1
169 #define	IPSEC_MODE_TUNNEL	2
170 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
171 
172 /*
173  * Direction of security policy.
174  * NOTE: Since INVALID is used just as flag.
175  * The other are used for loop counter too.
176  */
177 #define IPSEC_DIR_ANY		0
178 #define IPSEC_DIR_INBOUND	1
179 #define IPSEC_DIR_OUTBOUND	2
180 #define IPSEC_DIR_MAX		3
181 #define IPSEC_DIR_INVALID	4
182 
183 /* Policy level */
184 /*
185  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
186  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
187  * DISCARD and NONE are allowed for system default.
188  */
189 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
190 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
191 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
192 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
193 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
194 
195 /* Security protocol level */
196 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
197 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
198 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
199 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
200 
201 #define IPSEC_MANUAL_REQID_MAX	0x3fff
202 				/*
203 				 * if security policy level == unique, this id
204 				 * indicate to a relative SA for use, else is
205 				 * zero.
206 				 * 1 - 0x3fff are reserved for manual keying.
207 				 * 0 are reserved for above reason.  Others is
208 				 * for kernel use.
209 				 * Note that this id doesn't identify SA
210 				 * by only itself.
211 				 */
212 #define IPSEC_REPLAYWSIZE  32
213 
214 /* statistics for ipsec processing */
215 struct ipsecstat {
216 	u_quad_t in_success;  /* succeeded inbound process */
217 	u_quad_t in_polvio;
218 			/* security policy violation for inbound process */
219 	u_quad_t in_nosa;     /* inbound SA is unavailable */
220 	u_quad_t in_inval;    /* inbound processing failed due to EINVAL */
221 	u_quad_t in_nomem;    /* inbound processing failed due to ENOBUFS */
222 	u_quad_t in_badspi;   /* failed getting a SPI */
223 	u_quad_t in_ahreplay; /* AH replay check failed */
224 	u_quad_t in_espreplay; /* ESP replay check failed */
225 	u_quad_t in_ahauthsucc; /* AH authentication success */
226 	u_quad_t in_ahauthfail; /* AH authentication failure */
227 	u_quad_t in_espauthsucc; /* ESP authentication success */
228 	u_quad_t in_espauthfail; /* ESP authentication failure */
229 	u_quad_t in_esphist[256];
230 	u_quad_t in_ahhist[256];
231 	u_quad_t in_comphist[256];
232 	u_quad_t out_success; /* succeeded outbound process */
233 	u_quad_t out_polvio;
234 			/* security policy violation for outbound process */
235 	u_quad_t out_nosa;    /* outbound SA is unavailable */
236 	u_quad_t out_inval;   /* outbound process failed due to EINVAL */
237 	u_quad_t out_nomem;    /* inbound processing failed due to ENOBUFS */
238 	u_quad_t out_noroute; /* there is no route */
239 	u_quad_t out_esphist[256];
240 	u_quad_t out_ahhist[256];
241 	u_quad_t out_comphist[256];
242 
243 	u_quad_t spdcachelookup;
244 	u_quad_t spdcachemiss;
245 
246 	u_int32_t ips_in_polvio;	/* input: sec policy violation */
247 	u_int32_t ips_out_polvio;	/* output: sec policy violation */
248 	u_int32_t ips_out_nosa;		/* output: SA unavailable  */
249 	u_int32_t ips_out_nomem;	/* output: no memory available */
250 	u_int32_t ips_out_noroute;	/* output: no route available */
251 	u_int32_t ips_out_inval;	/* output: generic error */
252 	u_int32_t ips_out_bundlesa;	/* output: bundled SA processed */
253 	u_int32_t ips_mbcoalesced;	/* mbufs coalesced during clone */
254 	u_int32_t ips_clcoalesced;	/* clusters coalesced during clone */
255 	u_int32_t ips_clcopied;		/* clusters copied during clone */
256 	u_int32_t ips_mbinserted;	/* mbufs inserted during makespace */
257 	/*
258 	 * Temporary statistics for performance analysis.
259 	 */
260 	/* See where ESP/AH/IPCOMP header land in mbuf on input */
261 	u_int32_t ips_input_front;
262 	u_int32_t ips_input_middle;
263 	u_int32_t ips_input_end;
264 };
265 
266 /*
267  * Definitions for IPsec & Key sysctl operations.
268  */
269 /*
270  * Names for IPsec & Key sysctl objects
271  */
272 #define IPSECCTL_STATS			1	/* stats */
273 #define IPSECCTL_DEF_POLICY		2
274 #define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
275 #define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
276 #define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
277 #define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
278 #if 0	/* obsolete, do not reuse */
279 #define IPSECCTL_INBOUND_CALL_IKE	7
280 #endif
281 #define	IPSECCTL_AH_CLEARTOS		8
282 #define	IPSECCTL_AH_OFFSETMASK		9
283 #define	IPSECCTL_DFBIT			10
284 #define	IPSECCTL_ECN			11
285 #define	IPSECCTL_DEBUG			12
286 #define	IPSECCTL_ESP_RANDPAD		13
287 #define IPSECCTL_MAXID			14
288 
289 #define IPSECCTL_NAMES { \
290 	{ 0, 0 }, \
291 	{ 0, 0 }, \
292 	{ "def_policy", CTLTYPE_INT }, \
293 	{ "esp_trans_deflev", CTLTYPE_INT }, \
294 	{ "esp_net_deflev", CTLTYPE_INT }, \
295 	{ "ah_trans_deflev", CTLTYPE_INT }, \
296 	{ "ah_net_deflev", CTLTYPE_INT }, \
297 	{ 0, 0 }, \
298 	{ "ah_cleartos", CTLTYPE_INT }, \
299 	{ "ah_offsetmask", CTLTYPE_INT }, \
300 	{ "dfbit", CTLTYPE_INT }, \
301 	{ "ecn", CTLTYPE_INT }, \
302 	{ "debug", CTLTYPE_INT }, \
303 	{ "esp_randpad", CTLTYPE_INT }, \
304 }
305 
306 #define IPSEC6CTL_NAMES { \
307 	{ 0, 0 }, \
308 	{ 0, 0 }, \
309 	{ "def_policy", CTLTYPE_INT }, \
310 	{ "esp_trans_deflev", CTLTYPE_INT }, \
311 	{ "esp_net_deflev", CTLTYPE_INT }, \
312 	{ "ah_trans_deflev", CTLTYPE_INT }, \
313 	{ "ah_net_deflev", CTLTYPE_INT }, \
314 	{ 0, 0 }, \
315 	{ 0, 0 }, \
316 	{ 0, 0 }, \
317 	{ 0, 0 }, \
318 	{ "ecn", CTLTYPE_INT }, \
319 	{ "debug", CTLTYPE_INT }, \
320 	{ "esp_randpad", CTLTYPE_INT }, \
321 }
322 
323 #ifdef _KERNEL
324 struct ipsec_output_state {
325 	struct mbuf *m;
326 	struct route *ro;
327 	struct sockaddr *dst;
328 };
329 
330 struct ipsec_history {
331 	int ih_proto;
332 	u_int32_t ih_spi;
333 };
334 
335 VNET_DECLARE(int, ipsec_debug);
336 #define	V_ipsec_debug		VNET(ipsec_debug)
337 
338 #ifdef REGRESSION
339 VNET_DECLARE(int, ipsec_replay);
340 VNET_DECLARE(int, ipsec_integrity);
341 
342 #define	V_ipsec_replay		VNET(ipsec_replay)
343 #define	V_ipsec_integrity	VNET(ipsec_integrity)
344 #endif
345 
346 VNET_DECLARE(struct ipsecstat, ipsec4stat);
347 VNET_DECLARE(struct secpolicy, ip4_def_policy);
348 VNET_DECLARE(int, ip4_esp_trans_deflev);
349 VNET_DECLARE(int, ip4_esp_net_deflev);
350 VNET_DECLARE(int, ip4_ah_trans_deflev);
351 VNET_DECLARE(int, ip4_ah_net_deflev);
352 VNET_DECLARE(int, ip4_ah_offsetmask);
353 VNET_DECLARE(int, ip4_ipsec_dfbit);
354 VNET_DECLARE(int, ip4_ipsec_ecn);
355 VNET_DECLARE(int, ip4_esp_randpad);
356 VNET_DECLARE(int, crypto_support);
357 
358 #define	V_ipsec4stat		VNET(ipsec4stat)
359 #define	V_ip4_def_policy	VNET(ip4_def_policy)
360 #define	V_ip4_esp_trans_deflev	VNET(ip4_esp_trans_deflev)
361 #define	V_ip4_esp_net_deflev	VNET(ip4_esp_net_deflev)
362 #define	V_ip4_ah_trans_deflev	VNET(ip4_ah_trans_deflev)
363 #define	V_ip4_ah_net_deflev	VNET(ip4_ah_net_deflev)
364 #define	V_ip4_ah_offsetmask	VNET(ip4_ah_offsetmask)
365 #define	V_ip4_ipsec_dfbit	VNET(ip4_ipsec_dfbit)
366 #define	V_ip4_ipsec_ecn		VNET(ip4_ipsec_ecn)
367 #define	V_ip4_esp_randpad	VNET(ip4_esp_randpad)
368 #define	V_crypto_support	VNET(crypto_support)
369 
370 #define ipseclog(x)	do { if (V_ipsec_debug) log x; } while (0)
371 /* for openbsd compatibility */
372 #define	DPRINTF(x)	do { if (V_ipsec_debug) printf x; } while (0)
373 
374 extern	struct ipsecrequest *ipsec_newisr(void);
375 extern	void ipsec_delisr(struct ipsecrequest *);
376 
377 struct tdb_ident;
378 extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
379 struct inpcb;
380 extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
381 	int *, struct inpcb *));
382 extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
383 	int, int *);
384 
385 struct inpcb;
386 extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
387 extern int ipsec_copy_policy
388 	__P((struct inpcbpolicy *, struct inpcbpolicy *));
389 extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
390 extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
391 
392 extern int ipsec_set_policy __P((struct inpcb *inp, int optname,
393 	caddr_t request, size_t len, struct ucred *cred));
394 extern int ipsec_get_policy __P((struct inpcb *inpcb, caddr_t request,
395 	size_t len, struct mbuf **mp));
396 extern int ipsec_delete_pcbpolicy __P((struct inpcb *));
397 extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
398 
399 struct secas;
400 struct tcpcb;
401 extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
402 extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
403 
404 extern size_t ipsec_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
405 extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
406 
407 union sockaddr_union;
408 extern char * ipsec_address(union sockaddr_union* sa);
409 extern const char *ipsec_logsastr __P((struct secasvar *));
410 
411 extern void ipsec_dumpmbuf __P((struct mbuf *));
412 
413 struct m_tag;
414 extern void ah4_input(struct mbuf *m, int off);
415 extern void ah4_ctlinput(int cmd, struct sockaddr *sa, void *);
416 extern void esp4_input(struct mbuf *m, int off);
417 extern void esp4_ctlinput(int cmd, struct sockaddr *sa, void *);
418 extern void ipcomp4_input(struct mbuf *m, int off);
419 extern int ipsec4_common_input(struct mbuf *m, ...);
420 extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
421 			int skip, int protoff, struct m_tag *mt);
422 extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
423 			int, int));
424 extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
425 
426 extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
427 
428 extern	void m_checkalignment(const char* where, struct mbuf *m0,
429 		int off, int len);
430 extern	struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
431 extern	caddr_t m_pad(struct mbuf *m, int n);
432 extern	int m_striphdr(struct mbuf *m, int skip, int hlen);
433 
434 #ifdef DEV_ENC
435 #define	ENC_BEFORE	0x0001
436 #define	ENC_AFTER	0x0002
437 #define	ENC_IN		0x0100
438 #define	ENC_OUT		0x0200
439 extern	int ipsec_filter(struct mbuf **, int, int);
440 extern	void ipsec_bpf(struct mbuf *, struct secasvar *, int, int);
441 #endif
442 #endif /* _KERNEL */
443 
444 #ifndef _KERNEL
445 extern caddr_t ipsec_set_policy __P((char *, int));
446 extern int ipsec_get_policylen __P((caddr_t));
447 extern char *ipsec_dump_policy __P((caddr_t, char *));
448 
449 extern const char *ipsec_strerror __P((void));
450 
451 #endif /* ! KERNEL */
452 
453 #endif /* _NETIPSEC_IPSEC_H_ */
454