xref: /freebsd/sys/netipsec/ipsec.h (revision 8d20be1e22095c27faf8fe8b2f0d089739cc742e)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
3 
4 /*-
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * IPsec controller part.
35  */
36 
37 #ifndef _NETIPSEC_IPSEC_H_
38 #define _NETIPSEC_IPSEC_H_
39 
40 #if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
41 #include "opt_inet.h"
42 #include "opt_ipsec.h"
43 #endif
44 
45 #include <net/pfkeyv2.h>
46 #include <netipsec/keydb.h>
47 
48 #ifdef _KERNEL
49 
50 #define	IPSEC_ASSERT(_c,_m) KASSERT(_c, _m)
51 
52 #define	IPSEC_IS_PRIVILEGED_SO(_so) \
53 	((_so)->so_cred != NULL && \
54 	 priv_check_cred((_so)->so_cred, PRIV_NETINET_IPSEC, 0) \
55 	 == 0)
56 
57 /*
58  * Security Policy Index
59  * Ensure that both address families in the "src" and "dst" are same.
60  * When the value of the ul_proto is ICMPv6, the port field in "src"
61  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
62  */
63 struct secpolicyindex {
64 	u_int8_t dir;			/* direction of packet flow, see below */
65 	union sockaddr_union src;	/* IP src address for SP */
66 	union sockaddr_union dst;	/* IP dst address for SP */
67 	u_int8_t prefs;			/* prefix length in bits for src */
68 	u_int8_t prefd;			/* prefix length in bits for dst */
69 	u_int16_t ul_proto;		/* upper layer Protocol */
70 #ifdef notyet
71 	uid_t uids;
72 	uid_t uidd;
73 	gid_t gids;
74 	gid_t gidd;
75 #endif
76 };
77 
78 /* Security Policy Data Base */
79 struct secpolicy {
80 	LIST_ENTRY(secpolicy) chain;
81 	struct mtx lock;
82 
83 	u_int refcnt;			/* reference count */
84 	struct secpolicyindex spidx;	/* selector */
85 	u_int32_t id;			/* It's unique number on the system. */
86 	u_int state;			/* 0: dead, others: alive */
87 #define IPSEC_SPSTATE_DEAD	0
88 #define IPSEC_SPSTATE_ALIVE	1
89 	u_int16_t policy;		/* policy_type per pfkeyv2.h */
90 	u_int16_t scangen;		/* scan generation # */
91 	struct ipsecrequest *req;
92 				/* pointer to the ipsec request tree, */
93 				/* if policy == IPSEC else this value == NULL.*/
94 
95 	/*
96 	 * lifetime handler.
97 	 * the policy can be used without limitiation if both lifetime and
98 	 * validtime are zero.
99 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
100 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
101 	 */
102 	time_t created;		/* time created the policy */
103 	time_t lastused;	/* updated every when kernel sends a packet */
104 	long lifetime;		/* duration of the lifetime of this policy */
105 	long validtime;		/* duration this policy is valid without use */
106 };
107 
108 #define	SECPOLICY_LOCK_INIT(_sp) \
109 	mtx_init(&(_sp)->lock, "ipsec policy", NULL, MTX_DEF)
110 #define	SECPOLICY_LOCK(_sp)		mtx_lock(&(_sp)->lock)
111 #define	SECPOLICY_UNLOCK(_sp)		mtx_unlock(&(_sp)->lock)
112 #define	SECPOLICY_LOCK_DESTROY(_sp)	mtx_destroy(&(_sp)->lock)
113 #define	SECPOLICY_LOCK_ASSERT(_sp)	mtx_assert(&(_sp)->lock, MA_OWNED)
114 
115 /* Request for IPsec */
116 struct ipsecrequest {
117 	struct ipsecrequest *next;
118 				/* pointer to next structure */
119 				/* If NULL, it means the end of chain. */
120 	struct secasindex saidx;/* hint for search proper SA */
121 				/* if __ss_len == 0 then no address specified.*/
122 	u_int level;		/* IPsec level defined below. */
123 
124 	struct secasvar *sav;	/* place holder of SA for use */
125 	struct secpolicy *sp;	/* back pointer to SP */
126 	struct rwlock lock;	/* to interlock updates */
127 };
128 
129 /*
130  * Need recursion for when crypto callbacks happen directly,
131  * as in the case of software crypto.  Need to look at how
132  * hard it is to remove this...
133  */
134 #define	IPSECREQUEST_LOCK_INIT(_isr) \
135 	rw_init_flags(&(_isr)->lock, "ipsec request", RW_RECURSE)
136 #define	IPSECREQUEST_LOCK(_isr)		rw_rlock(&(_isr)->lock)
137 #define	IPSECREQUEST_UNLOCK(_isr)	rw_runlock(&(_isr)->lock)
138 #define	IPSECREQUEST_WLOCK(_isr)	rw_wlock(&(_isr)->lock)
139 #define	IPSECREQUEST_WUNLOCK(_isr)	rw_wunlock(&(_isr)->lock)
140 #define	IPSECREQUEST_UPGRADE(_isr)	rw_try_upgrade(&(_isr)->lock)
141 #define	IPSECREQUEST_DOWNGRADE(_isr)	rw_downgrade(&(_isr)->lock)
142 #define	IPSECREQUEST_LOCK_DESTROY(_isr)	rw_destroy(&(_isr)->lock)
143 #define	IPSECREQUEST_LOCK_ASSERT(_isr)	rw_assert(&(_isr)->lock, RA_LOCKED)
144 
145 /* security policy in PCB */
146 struct inpcbpolicy {
147 	struct secpolicy *sp_in;
148 	struct secpolicy *sp_out;
149 	int priv;			/* privileged socket ? */
150 };
151 
152 /* SP acquiring list table. */
153 struct secspacq {
154 	LIST_ENTRY(secspacq) chain;
155 
156 	struct secpolicyindex spidx;
157 
158 	time_t created;		/* for lifetime */
159 	int count;		/* for lifetime */
160 	/* XXX: here is mbuf place holder to be sent ? */
161 };
162 #endif /* _KERNEL */
163 
164 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
165 #define IPSEC_PORT_ANY		0
166 #define IPSEC_ULPROTO_ANY	255
167 #define IPSEC_PROTO_ANY		255
168 
169 /* mode of security protocol */
170 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
171 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
172 #define	IPSEC_MODE_TRANSPORT	1
173 #define	IPSEC_MODE_TUNNEL	2
174 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
175 
176 /*
177  * Direction of security policy.
178  * NOTE: Since INVALID is used just as flag.
179  * The other are used for loop counter too.
180  */
181 #define IPSEC_DIR_ANY		0
182 #define IPSEC_DIR_INBOUND	1
183 #define IPSEC_DIR_OUTBOUND	2
184 #define IPSEC_DIR_MAX		3
185 #define IPSEC_DIR_INVALID	4
186 
187 /* Policy level */
188 /*
189  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
190  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
191  * DISCARD and NONE are allowed for system default.
192  */
193 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
194 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
195 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
196 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
197 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
198 
199 /* Security protocol level */
200 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
201 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
202 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
203 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
204 
205 #define IPSEC_MANUAL_REQID_MAX	0x3fff
206 				/*
207 				 * if security policy level == unique, this id
208 				 * indicate to a relative SA for use, else is
209 				 * zero.
210 				 * 1 - 0x3fff are reserved for manual keying.
211 				 * 0 are reserved for above reason.  Others is
212 				 * for kernel use.
213 				 * Note that this id doesn't identify SA
214 				 * by only itself.
215 				 */
216 #define IPSEC_REPLAYWSIZE  32
217 
218 /* statistics for ipsec processing */
219 struct ipsecstat {
220 	uint64_t ips_in_polvio;		/* input: sec policy violation */
221 	uint64_t ips_in_nomem;		/* input: no memory available */
222 	uint64_t ips_in_inval;		/* input: generic error */
223 
224 	uint64_t ips_out_polvio;	/* output: sec policy violation */
225 	uint64_t ips_out_nosa;		/* output: SA unavailable  */
226 	uint64_t ips_out_nomem;		/* output: no memory available */
227 	uint64_t ips_out_noroute;	/* output: no route available */
228 	uint64_t ips_out_inval;		/* output: generic error */
229 	uint64_t ips_out_bundlesa;	/* output: bundled SA processed */
230 
231 	uint64_t ips_mbcoalesced;	/* mbufs coalesced during clone */
232 	uint64_t ips_clcoalesced;	/* clusters coalesced during clone */
233 	uint64_t ips_clcopied;		/* clusters copied during clone */
234 	uint64_t ips_mbinserted;	/* mbufs inserted during makespace */
235 	/*
236 	 * Temporary statistics for performance analysis.
237 	 */
238 	/* See where ESP/AH/IPCOMP header land in mbuf on input */
239 	uint64_t ips_input_front;
240 	uint64_t ips_input_middle;
241 	uint64_t ips_input_end;
242 };
243 
244 /*
245  * Definitions for IPsec & Key sysctl operations.
246  */
247 /*
248  * Names for IPsec & Key sysctl objects
249  */
250 #define IPSECCTL_STATS			1	/* stats */
251 #define IPSECCTL_DEF_POLICY		2
252 #define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
253 #define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
254 #define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
255 #define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
256 #if 0	/* obsolete, do not reuse */
257 #define IPSECCTL_INBOUND_CALL_IKE	7
258 #endif
259 #define	IPSECCTL_AH_CLEARTOS		8
260 #define	IPSECCTL_AH_OFFSETMASK		9
261 #define	IPSECCTL_DFBIT			10
262 #define	IPSECCTL_ECN			11
263 #define	IPSECCTL_DEBUG			12
264 #define	IPSECCTL_ESP_RANDPAD		13
265 #define IPSECCTL_MAXID			14
266 
267 #ifdef _KERNEL
268 #include <sys/counter.h>
269 
270 struct ipsec_output_state {
271 	struct mbuf *m;
272 	struct route *ro;
273 	struct sockaddr *dst;
274 };
275 
276 struct ipsec_history {
277 	int ih_proto;
278 	u_int32_t ih_spi;
279 };
280 
281 VNET_DECLARE(int, ipsec_debug);
282 #define	V_ipsec_debug		VNET(ipsec_debug)
283 
284 #ifdef REGRESSION
285 VNET_DECLARE(int, ipsec_replay);
286 VNET_DECLARE(int, ipsec_integrity);
287 
288 #define	V_ipsec_replay		VNET(ipsec_replay)
289 #define	V_ipsec_integrity	VNET(ipsec_integrity)
290 #endif
291 
292 VNET_PCPUSTAT_DECLARE(struct ipsecstat, ipsec4stat);
293 VNET_DECLARE(struct secpolicy, ip4_def_policy);
294 VNET_DECLARE(int, ip4_esp_trans_deflev);
295 VNET_DECLARE(int, ip4_esp_net_deflev);
296 VNET_DECLARE(int, ip4_ah_trans_deflev);
297 VNET_DECLARE(int, ip4_ah_net_deflev);
298 VNET_DECLARE(int, ip4_ah_offsetmask);
299 VNET_DECLARE(int, ip4_ipsec_dfbit);
300 VNET_DECLARE(int, ip4_ipsec_ecn);
301 VNET_DECLARE(int, ip4_esp_randpad);
302 VNET_DECLARE(int, crypto_support);
303 
304 #define	IPSECSTAT_INC(name)	\
305     VNET_PCPUSTAT_ADD(struct ipsecstat, ipsec4stat, name, 1)
306 #define	V_ip4_def_policy	VNET(ip4_def_policy)
307 #define	V_ip4_esp_trans_deflev	VNET(ip4_esp_trans_deflev)
308 #define	V_ip4_esp_net_deflev	VNET(ip4_esp_net_deflev)
309 #define	V_ip4_ah_trans_deflev	VNET(ip4_ah_trans_deflev)
310 #define	V_ip4_ah_net_deflev	VNET(ip4_ah_net_deflev)
311 #define	V_ip4_ah_offsetmask	VNET(ip4_ah_offsetmask)
312 #define	V_ip4_ipsec_dfbit	VNET(ip4_ipsec_dfbit)
313 #define	V_ip4_ipsec_ecn		VNET(ip4_ipsec_ecn)
314 #define	V_ip4_esp_randpad	VNET(ip4_esp_randpad)
315 #define	V_crypto_support	VNET(crypto_support)
316 
317 #define ipseclog(x)	do { if (V_ipsec_debug) log x; } while (0)
318 /* for openbsd compatibility */
319 #define	DPRINTF(x)	do { if (V_ipsec_debug) printf x; } while (0)
320 
321 extern	struct ipsecrequest *ipsec_newisr(void);
322 extern	void ipsec_delisr(struct ipsecrequest *);
323 
324 struct tdb_ident;
325 extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
326 struct inpcb;
327 extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
328 	int *, struct inpcb *));
329 extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
330 	int, int *);
331 
332 struct inpcb;
333 extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
334 extern int ipsec_copy_policy
335 	__P((struct inpcbpolicy *, struct inpcbpolicy *));
336 extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
337 extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
338 
339 extern int ipsec_set_policy __P((struct inpcb *inp, int optname,
340 	caddr_t request, size_t len, struct ucred *cred));
341 extern int ipsec_get_policy __P((struct inpcb *inpcb, caddr_t request,
342 	size_t len, struct mbuf **mp));
343 extern int ipsec_delete_pcbpolicy __P((struct inpcb *));
344 extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
345 
346 struct secas;
347 struct tcpcb;
348 extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
349 extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
350 
351 extern size_t ipsec_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
352 extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
353 
354 union sockaddr_union;
355 extern char * ipsec_address(union sockaddr_union* sa);
356 extern const char *ipsec_logsastr __P((struct secasvar *));
357 
358 extern void ipsec_dumpmbuf __P((struct mbuf *));
359 
360 struct m_tag;
361 extern void ah4_input(struct mbuf *m, int off);
362 extern void ah4_ctlinput(int cmd, struct sockaddr *sa, void *);
363 extern void esp4_input(struct mbuf *m, int off);
364 extern void esp4_ctlinput(int cmd, struct sockaddr *sa, void *);
365 extern void ipcomp4_input(struct mbuf *m, int off);
366 extern int ipsec4_common_input(struct mbuf *m, ...);
367 extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
368 			int skip, int protoff, struct m_tag *mt);
369 extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
370 			int, int));
371 extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
372 
373 extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
374 
375 extern	void m_checkalignment(const char* where, struct mbuf *m0,
376 		int off, int len);
377 extern	struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
378 extern	caddr_t m_pad(struct mbuf *m, int n);
379 extern	int m_striphdr(struct mbuf *m, int skip, int hlen);
380 
381 #ifdef DEV_ENC
382 #define	ENC_BEFORE	0x0001
383 #define	ENC_AFTER	0x0002
384 #define	ENC_IN		0x0100
385 #define	ENC_OUT		0x0200
386 extern	int ipsec_filter(struct mbuf **, int, int);
387 extern	void ipsec_bpf(struct mbuf *, struct secasvar *, int, int);
388 #endif
389 #endif /* _KERNEL */
390 
391 #ifndef _KERNEL
392 extern caddr_t ipsec_set_policy __P((char *, int));
393 extern int ipsec_get_policylen __P((caddr_t));
394 extern char *ipsec_dump_policy __P((caddr_t, char *));
395 
396 extern const char *ipsec_strerror __P((void));
397 
398 #endif /* ! KERNEL */
399 
400 #endif /* _NETIPSEC_IPSEC_H_ */
401