1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _INET_IPSEC_IMPL_H 28 #define _INET_IPSEC_IMPL_H 29 30 #pragma ident "%Z%%M% %I% %E% SMI" 31 32 #ifdef __cplusplus 33 extern "C" { 34 #endif 35 36 #define IPSEC_CONF_SRC_ADDRESS 0 /* Source Address */ 37 #define IPSEC_CONF_SRC_PORT 1 /* Source Port */ 38 #define IPSEC_CONF_DST_ADDRESS 2 /* Dest Address */ 39 #define IPSEC_CONF_DST_PORT 3 /* Dest Port */ 40 #define IPSEC_CONF_SRC_MASK 4 /* Source Address Mask */ 41 #define IPSEC_CONF_DST_MASK 5 /* Destination Address Mask */ 42 #define IPSEC_CONF_ULP 6 /* Upper layer Port */ 43 #define IPSEC_CONF_IPSEC_PROT 7 /* AH or ESP or AH_ESP */ 44 #define IPSEC_CONF_IPSEC_AALGS 8 /* Auth Algorithms - MD5 etc. */ 45 #define IPSEC_CONF_IPSEC_EALGS 9 /* Encr Algorithms - DES etc. */ 46 #define IPSEC_CONF_IPSEC_EAALGS 10 /* Encr Algorithms - MD5 etc. */ 47 #define IPSEC_CONF_IPSEC_SA 11 /* Shared or unique SA */ 48 #define IPSEC_CONF_IPSEC_DIR 12 /* Direction of traffic */ 49 #define IPSEC_CONF_ICMP_TYPE 13 /* ICMP type */ 50 #define IPSEC_CONF_ICMP_CODE 14 /* ICMP code */ 51 52 /* Type of an entry */ 53 54 #define IPSEC_NTYPES 0x02 55 #define IPSEC_TYPE_OUTBOUND 0x00 56 #define IPSEC_TYPE_INBOUND 0x01 57 58 /* Policy */ 59 #define IPSEC_POLICY_APPLY 0x01 60 #define IPSEC_POLICY_DISCARD 0x02 61 #define IPSEC_POLICY_BYPASS 0x03 62 63 /* Shared or unique SA */ 64 #define IPSEC_SHARED_SA 0x01 65 #define IPSEC_UNIQUE_SA 0x02 66 67 /* IPSEC protocols and combinations */ 68 #define IPSEC_AH_ONLY 0x01 69 #define IPSEC_ESP_ONLY 0x02 70 #define IPSEC_AH_ESP 0x03 71 72 #ifdef _KERNEL 73 74 #include <inet/common.h> 75 #include <netinet/ip6.h> 76 #include <netinet/icmp6.h> 77 #include <net/pfkeyv2.h> 78 #include <inet/ip.h> 79 #include <inet/sadb.h> 80 #include <inet/ipsecah.h> 81 #include <inet/ipsecesp.h> 82 #include <sys/crypto/common.h> 83 #include <sys/crypto/api.h> 84 #include <sys/avl.h> 85 86 /* 87 * Maximum number of authentication algorithms (can be indexed by one byte 88 * per PF_KEY and the IKE IPsec DOI. 89 */ 90 #define MAX_AALGS 256 91 92 /* 93 * IPsec task queue constants. 94 */ 95 #define IPSEC_TASKQ_MIN 10 96 #define IPSEC_TASKQ_MAX 20 97 98 /* 99 * So we can access IPsec global variables that live in keysock.c. 100 */ 101 extern boolean_t keysock_extended_reg(void); 102 extern uint32_t keysock_next_seq(void); 103 104 /* 105 * Locking for ipsec policy rules: 106 * 107 * policy heads: system policy is static; per-conn polheads are dynamic, 108 * and refcounted (and inherited); use atomic refcounts and "don't let 109 * go with both hands". 110 * 111 * policy: refcounted; references from polhead, ipsec_out 112 * 113 * actions: refcounted; referenced from: action hash table, policy, ipsec_out 114 * selectors: refcounted; referenced from: selector hash table, policy. 115 */ 116 117 /* 118 * the following are inspired by, but not directly based on, 119 * some of the sys/queue.h type-safe pseudo-polymorphic macros 120 * found in BSD. 121 * 122 * XXX If we use these more generally, we'll have to make the names 123 * less generic (HASH_* will probably clobber other namespaces). 124 */ 125 126 #define HASH_LOCK(table, hash) \ 127 mutex_enter(&(table)[hash].hash_lock) 128 #define HASH_UNLOCK(table, hash) \ 129 mutex_exit(&(table)[hash].hash_lock) 130 131 #define HASH_LOCKED(table, hash) \ 132 MUTEX_HELD(&(table)[hash].hash_lock) 133 134 #define HASH_ITERATE(var, field, table, hash) \ 135 var = table[hash].hash_head; var != NULL; var = var->field.hash_next 136 137 #define HASH_NEXT(var, field) \ 138 (var)->field.hash_next 139 140 #define HASH_INSERT(var, field, table, hash) \ 141 { \ 142 ASSERT(HASH_LOCKED(table, hash)); \ 143 (var)->field.hash_next = (table)[hash].hash_head; \ 144 (var)->field.hash_pp = &(table)[hash].hash_head; \ 145 (table)[hash].hash_head = var; \ 146 if ((var)->field.hash_next != NULL) \ 147 (var)->field.hash_next->field.hash_pp = \ 148 &((var)->field.hash_next); \ 149 } 150 151 152 #define HASH_UNCHAIN(var, field, table, hash) \ 153 { \ 154 ASSERT(MUTEX_HELD(&(table)[hash].hash_lock)); \ 155 HASHLIST_UNCHAIN(var, field); \ 156 } 157 158 #define HASHLIST_INSERT(var, field, head) \ 159 { \ 160 (var)->field.hash_next = head; \ 161 (var)->field.hash_pp = &(head); \ 162 head = var; \ 163 if ((var)->field.hash_next != NULL) \ 164 (var)->field.hash_next->field.hash_pp = \ 165 &((var)->field.hash_next); \ 166 } 167 168 #define HASHLIST_UNCHAIN(var, field) \ 169 { \ 170 *var->field.hash_pp = var->field.hash_next; \ 171 if (var->field.hash_next) \ 172 var->field.hash_next->field.hash_pp = \ 173 var->field.hash_pp; \ 174 HASH_NULL(var, field); \ 175 } 176 177 178 #define HASH_NULL(var, field) \ 179 { \ 180 var->field.hash_next = NULL; \ 181 var->field.hash_pp = NULL; \ 182 } 183 184 #define HASH_LINK(fieldname, type) \ 185 struct { \ 186 type *hash_next; \ 187 type **hash_pp; \ 188 } fieldname 189 190 191 #define HASH_HEAD(tag) \ 192 struct { \ 193 struct tag *hash_head; \ 194 kmutex_t hash_lock; \ 195 } 196 197 typedef struct ipsec_policy_s ipsec_policy_t; 198 199 typedef HASH_HEAD(ipsec_policy_s) ipsec_policy_hash_t; 200 201 /* 202 * When adding new fields to ipsec_prot_t, make sure to update 203 * ipsec_in_to_out_action() as well as other code in spd.c 204 */ 205 206 typedef struct ipsec_prot 207 { 208 unsigned int 209 ipp_use_ah : 1, 210 ipp_use_esp : 1, 211 ipp_use_se : 1, 212 ipp_use_unique : 1, 213 ipp_use_espa : 1, 214 ipp_pad : 27; 215 uint8_t ipp_auth_alg; /* DOI number */ 216 uint8_t ipp_encr_alg; /* DOI number */ 217 uint8_t ipp_esp_auth_alg; /* DOI number */ 218 uint16_t ipp_ah_minbits; /* AH: min keylen */ 219 uint16_t ipp_ah_maxbits; /* AH: max keylen */ 220 uint16_t ipp_espe_minbits; /* ESP encr: min keylen */ 221 uint16_t ipp_espe_maxbits; /* ESP encr: max keylen */ 222 uint16_t ipp_espa_minbits; /* ESP auth: min keylen */ 223 uint16_t ipp_espa_maxbits; /* ESP auth: max keylen */ 224 uint32_t ipp_km_proto; /* key mgmt protocol */ 225 uint32_t ipp_km_cookie; /* key mgmt cookie */ 226 uint32_t ipp_replay_depth; /* replay window */ 227 /* XXX add lifetimes */ 228 } ipsec_prot_t; 229 230 #define IPSEC_MAX_KEYBITS (0xffff) 231 232 /* 233 * An individual policy action, possibly a member of a chain. 234 * 235 * Action chains may be shared between multiple policy rules. 236 * 237 * With one exception (IPSEC_POLICY_LOG), a chain consists of an 238 * ordered list of alternative ways to handle a packet. 239 * 240 * All actions are also "interned" into a hash table (to allow 241 * multiple rules with the same action chain to share one copy in 242 * memory). 243 */ 244 245 typedef struct ipsec_act 246 { 247 uint8_t ipa_type; 248 uint8_t ipa_log; 249 union 250 { 251 ipsec_prot_t ipau_apply; 252 uint8_t ipau_reject_type; 253 uint32_t ipau_resolve_id; /* magic cookie */ 254 uint8_t ipau_log_type; 255 } ipa_u; 256 #define ipa_apply ipa_u.ipau_apply 257 #define ipa_reject_type ipa_u.ipau_reject_type 258 #define ipa_log_type ipa_u.ipau_log_type 259 #define ipa_resolve_type ipa_u.ipau_resolve_type 260 } ipsec_act_t; 261 262 #define IPSEC_ACT_APPLY 0x01 /* match IPSEC_POLICY_APPLY */ 263 #define IPSEC_ACT_DISCARD 0x02 /* match IPSEC_POLICY_DISCARD */ 264 #define IPSEC_ACT_BYPASS 0x03 /* match IPSEC_POLICY_BYPASS */ 265 #define IPSEC_ACT_REJECT 0x04 266 #define IPSEC_ACT_CLEAR 0x05 267 268 typedef struct ipsec_action_s 269 { 270 HASH_LINK(ipa_hash, struct ipsec_action_s); 271 struct ipsec_action_s *ipa_next; /* next alternative */ 272 uint32_t ipa_refs; /* refcount */ 273 ipsec_act_t ipa_act; 274 /* 275 * The following bits are equivalent to an OR of bits included in the 276 * ipau_apply fields of this and subsequent actions in an 277 * action chain; this is an optimization for the sake of 278 * ipsec_out_process() in ip.c and a few other places. 279 */ 280 unsigned int 281 ipa_hval: 8, 282 ipa_allow_clear:1, /* rule allows cleartext? */ 283 ipa_want_ah:1, /* an action wants ah */ 284 ipa_want_esp:1, /* an action wants esp */ 285 ipa_want_se:1, /* an action wants se */ 286 ipa_want_unique:1, /* want unique sa's */ 287 ipa_pad:19; 288 uint32_t ipa_ovhd; /* per-packet encap ovhd */ 289 } ipsec_action_t; 290 291 #define IPACT_REFHOLD(ipa) { \ 292 atomic_add_32(&(ipa)->ipa_refs, 1); \ 293 ASSERT((ipa)->ipa_refs != 0); \ 294 } 295 #define IPACT_REFRELE(ipa) { \ 296 ASSERT((ipa)->ipa_refs != 0); \ 297 membar_exit(); \ 298 if (atomic_add_32_nv(&(ipa)->ipa_refs, -1) == 0) \ 299 ipsec_action_free(ipa); \ 300 (ipa) = 0; \ 301 } 302 303 /* 304 * Merged address structure, for cheezy address-family independant 305 * matches in policy code. 306 */ 307 308 typedef union ipsec_addr 309 { 310 in6_addr_t ipsad_v6; 311 in_addr_t ipsad_v4; 312 } ipsec_addr_t; 313 314 /* 315 * ipsec selector set, as used by the kernel policy structures. 316 * Note that that we specify "local" and "remote" 317 * rather than "source" and "destination", which allows the selectors 318 * for symmetric policy rules to be shared between inbound and 319 * outbound rules. 320 * 321 * "local" means "destination" on inbound, and "source" on outbound. 322 * "remote" means "source" on inbound, and "destination" on outbound. 323 * XXX if we add a fifth policy enforcement point for forwarded packets, 324 * what do we do? 325 * 326 * The ipsl_valid mask is not done as a bitfield; this is so we 327 * can use "ffs()" to find the "most interesting" valid tag. 328 * 329 * XXX should we have multiple types for space-conservation reasons? 330 * (v4 vs v6? prefix vs. range)? 331 */ 332 333 typedef struct ipsec_selkey 334 { 335 uint32_t ipsl_valid; /* bitmask of valid entries */ 336 #define IPSL_REMOTE_ADDR 0x00000001 337 #define IPSL_LOCAL_ADDR 0x00000002 338 #define IPSL_REMOTE_PORT 0x00000004 339 #define IPSL_LOCAL_PORT 0x00000008 340 #define IPSL_PROTOCOL 0x00000010 341 #define IPSL_ICMP_TYPE 0x00000020 342 #define IPSL_ICMP_CODE 0x00000040 343 #define IPSL_IPV6 0x00000080 344 #define IPSL_IPV4 0x00000100 345 346 #define IPSL_WILDCARD 0x0000007f 347 348 ipsec_addr_t ipsl_local; 349 ipsec_addr_t ipsl_remote; 350 uint16_t ipsl_lport; 351 uint16_t ipsl_rport; 352 /* 353 * ICMP type and code selectors. Both have an end value to 354 * specify ranges, or * and *_end are equal for a single 355 * value 356 */ 357 uint8_t ipsl_icmp_type; 358 uint8_t ipsl_icmp_type_end; 359 uint8_t ipsl_icmp_code; 360 uint8_t ipsl_icmp_code_end; 361 362 uint8_t ipsl_proto; /* ip payload type */ 363 uint8_t ipsl_local_pfxlen; /* #bits of prefix */ 364 uint8_t ipsl_remote_pfxlen; /* #bits of prefix */ 365 uint8_t ipsl_mbz; 366 367 uint32_t ipsl_hval; 368 } ipsec_selkey_t; 369 370 typedef struct ipsec_sel 371 { 372 HASH_LINK(ipsl_hash, struct ipsec_sel); 373 uint32_t ipsl_refs; /* # refs to this sel */ 374 ipsec_selkey_t ipsl_key; /* actual selector guts */ 375 } ipsec_sel_t; 376 377 /* 378 * One policy rule. This will be linked into a single hash chain bucket in 379 * the parent rule structure. If the selector is simple enough to 380 * allow hashing, it gets filed under ipsec_policy_root_t->ipr_hash. 381 * Otherwise it goes onto a linked list in ipsec_policy_root_t->ipr_nonhash[af] 382 * 383 * In addition, we file the rule into an avl tree keyed by the rule index. 384 * (Duplicate rules are permitted; the comparison function breaks ties). 385 */ 386 struct ipsec_policy_s 387 { 388 HASH_LINK(ipsp_hash, struct ipsec_policy_s); 389 avl_node_t ipsp_byid; 390 uint64_t ipsp_index; /* unique id */ 391 uint32_t ipsp_prio; /* rule priority */ 392 uint32_t ipsp_refs; 393 ipsec_sel_t *ipsp_sel; /* selector set (shared) */ 394 ipsec_action_t *ipsp_act; /* action (may be shared) */ 395 }; 396 397 #define IPPOL_REFHOLD(ipp) { \ 398 atomic_add_32(&(ipp)->ipsp_refs, 1); \ 399 ASSERT((ipp)->ipsp_refs != 0); \ 400 } 401 #define IPPOL_REFRELE(ipp) { \ 402 ASSERT((ipp)->ipsp_refs != 0); \ 403 membar_exit(); \ 404 if (atomic_add_32_nv(&(ipp)->ipsp_refs, -1) == 0) \ 405 ipsec_policy_free(ipp); \ 406 (ipp) = 0; \ 407 } 408 409 /* 410 * Policy ruleset. One per (protocol * direction) for system policy. 411 */ 412 413 #define IPSEC_AF_V4 0 414 #define IPSEC_AF_V6 1 415 #define IPSEC_NAF 2 416 417 typedef struct ipsec_policy_root_s 418 { 419 ipsec_policy_t *ipr_nonhash[IPSEC_NAF]; 420 int ipr_nchains; 421 ipsec_policy_hash_t *ipr_hash; 422 } ipsec_policy_root_t; 423 424 /* 425 * Policy head. One for system policy; there may also be one present 426 * on ill_t's with interface-specific policy, as well as one present 427 * for sockets with per-socket policy allocated. 428 */ 429 430 typedef struct ipsec_policy_head_s 431 { 432 uint32_t iph_refs; 433 krwlock_t iph_lock; 434 uint64_t iph_gen; /* generation number */ 435 ipsec_policy_root_t iph_root[IPSEC_NTYPES]; 436 avl_tree_t iph_rulebyid; 437 } ipsec_policy_head_t; 438 439 #define IPPH_REFHOLD(iph) { \ 440 atomic_add_32(&(iph)->iph_refs, 1); \ 441 ASSERT((iph)->iph_refs != 0); \ 442 } 443 #define IPPH_REFRELE(iph) { \ 444 ASSERT((iph)->iph_refs != 0); \ 445 membar_exit(); \ 446 if (atomic_add_32_nv(&(iph)->iph_refs, -1) == 0) \ 447 ipsec_polhead_free(iph); \ 448 (iph) = 0; \ 449 } 450 451 /* 452 * Certificate identity. 453 */ 454 455 typedef struct ipsid_s 456 { 457 struct ipsid_s *ipsid_next; 458 struct ipsid_s **ipsid_ptpn; 459 uint32_t ipsid_refcnt; 460 int ipsid_type; /* id type */ 461 char *ipsid_cid; /* certificate id string */ 462 } ipsid_t; 463 464 /* 465 * ipsid_t reference hold/release macros, just like ipsa versions. 466 */ 467 468 #define IPSID_REFHOLD(ipsid) { \ 469 atomic_add_32(&(ipsid)->ipsid_refcnt, 1); \ 470 ASSERT((ipsid)->ipsid_refcnt != 0); \ 471 } 472 473 /* 474 * Decrement the reference count on the ID. Someone else will clean up 475 * after us later. 476 */ 477 478 #define IPSID_REFRELE(ipsid) { \ 479 membar_exit(); \ 480 atomic_add_32(&(ipsid)->ipsid_refcnt, -1); \ 481 } 482 483 extern boolean_t ipsec_inbound_v4_policy_present; 484 extern boolean_t ipsec_outbound_v4_policy_present; 485 extern boolean_t ipsec_inbound_v6_policy_present; 486 extern boolean_t ipsec_outbound_v6_policy_present; 487 488 struct ipsec_out_s; 489 490 /* 491 * Following are the estimates of what the maximum AH and ESP header size 492 * would be. This is used to tell the upper layer the right value of MSS 493 * it should use without consulting AH/ESP. If the size is something 494 * different from this, ULP will learn the right one through 495 * ICMP_FRAGMENTATION_NEEDED messages generated locally. 496 * 497 * AH : 12 bytes of constant header + 12 bytes of ICV checksum (MD5/SHA1). 498 * 499 * ESP : 8 bytes of constant header + 16 bytes of IV + 12 bytes ICV + 500 * 2 bytes of trailer + 15 bytes pad = 53 501 * 502 * Note that for ESP, this estimate is overly pessimistic; however, a 503 * more accurate estimate needs to know the exact amount of space 504 * which will be available to ESP so it can just leave 2 bytes free in 505 * the last cipherblock for the ESP inner trailer, and that 506 * information is not available at the right moment in the current 507 * stack. 508 */ 509 #define IPSEC_MAX_AH_HDR_SIZE (24) 510 #define IPSEC_MAX_ESP_HDR_SIZE (53) 511 512 /* Alternate, when we know the crypto block size */ 513 #define IPSEC_BASE_ESP_HDR_SIZE(sa) (4 + 4 + 12 + 1 + 2 * (sa)->ipsa_iv_len) 514 #define IPSEC_DEF_BLOCKSIZE (8) /* safe default */ 515 516 /* 517 * Loader states.. 518 */ 519 #define IPSEC_LOADER_WAIT 0 520 #define IPSEC_LOADER_FAILED -1 521 #define IPSEC_LOADER_SUCCEEDED 1 522 523 extern kmutex_t ipsec_loader_lock; 524 extern int ipsec_loader_state; 525 526 /* 527 * ipsec_loader entrypoints. 528 */ 529 extern void ipsec_loader_init(void); 530 extern void ipsec_loader_start(void); 531 extern void ipsec_loader_destroy(void); 532 extern void ipsec_loader_loadnow(void); 533 extern boolean_t ipsec_loader_wait(queue_t *q); 534 extern boolean_t ipsec_loaded(void); 535 extern boolean_t ipsec_failed(void); 536 537 /* 538 * callback from ipsec_loader to ip 539 */ 540 extern void ip_ipsec_load_complete(); 541 542 /* 543 * ipsec policy entrypoints (spd.c) 544 */ 545 546 extern void ipsec_policy_destroy(void); 547 extern void ipsec_policy_init(void); 548 extern boolean_t ipsec_inherit_global_policy(conn_t *, ipsec_req_t *, 549 ipsec_selector_t *, boolean_t); 550 extern mblk_t *ipsec_check_global_policy(mblk_t *, conn_t *, ipha_t *, 551 ip6_t *, boolean_t); 552 extern mblk_t *ipsec_check_inbound_policy(mblk_t *, conn_t *, ipha_t *, ip6_t *, 553 boolean_t); 554 555 extern boolean_t ipsec_in_to_out(mblk_t *, ipha_t *, ip6_t *); 556 extern void ipsec_log_policy_failure(queue_t *, int, char *, ipha_t *, 557 ip6_t *, boolean_t); 558 extern boolean_t ipsec_inbound_accept_clear(mblk_t *, ipha_t *, ip6_t *); 559 extern int ipsec_policy_alloc(conn_t *); 560 extern int ipsec_conn_cache_policy(conn_t *, boolean_t); 561 extern mblk_t *ipsec_alloc_ipsec_out(void); 562 extern mblk_t *ipsec_attach_ipsec_out(mblk_t *, conn_t *, ipsec_policy_t *, 563 uint8_t); 564 extern mblk_t *ipsec_init_ipsec_out(mblk_t *, conn_t *, ipsec_policy_t *, 565 uint8_t); 566 struct ipsec_in_s; 567 extern ipsec_action_t *ipsec_in_to_out_action(struct ipsec_in_s *); 568 extern boolean_t ipsec_check_ipsecin_latch(struct ipsec_in_s *, mblk_t *, 569 struct ipsec_latch_s *, ipha_t *, ip6_t *, const char **, kstat_named_t **); 570 extern void ipsec_latch_inbound(ipsec_latch_t *ipl, struct ipsec_in_s *ii); 571 572 extern void ipsec_policy_free(ipsec_policy_t *); 573 extern void ipsec_action_free(ipsec_action_t *); 574 extern void ipsec_polhead_free(ipsec_policy_head_t *); 575 extern ipsec_policy_head_t *ipsec_polhead_split(ipsec_policy_head_t *); 576 extern ipsec_policy_head_t *ipsec_polhead_create(void); 577 extern ipsec_policy_head_t *ipsec_system_policy(void); 578 extern ipsec_policy_head_t *ipsec_inactive_policy(void); 579 extern void ipsec_swap_policy(void); 580 581 extern int ipsec_clone_system_policy(void); 582 extern ipsec_policy_t *ipsec_policy_create(ipsec_selkey_t *, 583 const ipsec_act_t *, int, int); 584 extern boolean_t ipsec_policy_delete(ipsec_policy_head_t *, 585 ipsec_selkey_t *, int); 586 extern int ipsec_policy_delete_index(ipsec_policy_head_t *, uint64_t); 587 extern void ipsec_polhead_flush(ipsec_policy_head_t *); 588 extern void ipsec_actvec_from_req(ipsec_req_t *, ipsec_act_t **, uint_t *); 589 extern void ipsec_actvec_free(ipsec_act_t *, uint_t); 590 extern mblk_t *ipsec_construct_inverse_acquire(sadb_msg_t *, sadb_ext_t **); 591 extern mblk_t *ip_wput_attach_policy(mblk_t *, ipha_t *, ip6_t *, ire_t *, 592 conn_t *, boolean_t); 593 extern mblk_t *ip_wput_ire_parse_ipsec_out(mblk_t *, ipha_t *, ip6_t *, 594 ire_t *, conn_t *, boolean_t); 595 extern ipsec_policy_t *ipsec_find_policy(int, conn_t *, 596 struct ipsec_out_s *, ipsec_selector_t *); 597 extern ipsid_t *ipsid_lookup(int, char *); 598 extern boolean_t ipsid_equal(ipsid_t *, ipsid_t *); 599 extern void ipsid_gc(void); 600 extern void ipsec_latch_ids(ipsec_latch_t *, ipsid_t *, ipsid_t *); 601 602 extern void ipsec_config_flush(void); 603 extern boolean_t ipsec_check_policy(ipsec_policy_head_t *, ipsec_policy_t *, 604 int); 605 extern void ipsec_enter_policy(ipsec_policy_head_t *, ipsec_policy_t *, int); 606 extern boolean_t ipsec_check_action(ipsec_act_t *, int *); 607 608 extern void ipsec_config_list_compat(queue_t *, mblk_t *); 609 extern int ipsec_config_add_compat(mblk_t *); 610 extern int ipsec_config_delete_compat(mblk_t *); 611 612 extern mblk_t *ipsec_out_tag(mblk_t *, mblk_t *); 613 extern mblk_t *ipsec_in_tag(mblk_t *, mblk_t *); 614 extern mblk_t *ip_copymsg(mblk_t *mp); 615 616 extern void iplatch_free(ipsec_latch_t *); 617 extern ipsec_latch_t *iplatch_create(void); 618 extern int ipsec_set_req(cred_t *, conn_t *, ipsec_req_t *); 619 620 extern void ipsec_insert_always(avl_tree_t *tree, void *new_node); 621 622 /* 623 * IPsec AH/ESP functions called from IP. 624 */ 625 626 extern void ipsecah_rl_strlog(char, ushort_t, char *, ...); 627 extern void ipsecah_in_assocfailure(mblk_t *, char, ushort_t, char *, 628 uint32_t, void *, int); 629 extern void ipsecesp_in_assocfailure(mblk_t *, char, ushort_t, char *, 630 uint32_t, void *, int); 631 632 /* 633 * Algorithm management helper functions. 634 */ 635 extern boolean_t ipsec_valid_key_size(uint16_t, ipsec_alginfo_t *); 636 637 /* 638 * Per-socket policy, for now, takes precedence... this priority value 639 * insures it. 640 */ 641 #define IPSEC_PRIO_SOCKET 0x1000000 642 643 /* DDI initialization functions. */ 644 extern boolean_t ipsecesp_ddi_init(void); 645 extern boolean_t ipsecah_ddi_init(void); 646 extern boolean_t keysock_ddi_init(void); 647 extern boolean_t spdsock_ddi_init(void); 648 649 extern void ipsecesp_ddi_destroy(void); 650 extern void ipsecah_ddi_destroy(void); 651 extern void keysock_ddi_destroy(void); 652 extern void spdsock_ddi_destroy(void); 653 654 /* 655 * AH- and ESP-specific functions that are called directly by other modules. 656 */ 657 extern void ipsecah_fill_defs(struct sadb_x_ecomb *); 658 extern void ipsecesp_fill_defs(struct sadb_x_ecomb *); 659 extern void ipsecah_algs_changed(void); 660 extern void ipsecesp_algs_changed(void); 661 extern void ipsecesp_init_funcs(ipsa_t *); 662 extern void ipsecah_init_funcs(ipsa_t *); 663 extern ipsec_status_t ipsecah_icmp_error(mblk_t *); 664 extern ipsec_status_t ipsecesp_icmp_error(mblk_t *); 665 666 /* 667 * Wrapper for putnext() to ipsec accelerated interface. 668 */ 669 extern void ipsec_hw_putnext(queue_t *, mblk_t *); 670 671 /* 672 * spdsock functions that are called directly by IP. 673 */ 674 extern void spdsock_update_pending_algs(void); 675 676 /* 677 * IP functions that are called from AH and ESP. 678 */ 679 extern boolean_t ipsec_outbound_sa(mblk_t *, uint_t); 680 extern esph_t *ipsec_inbound_esp_sa(mblk_t *); 681 extern ah_t *ipsec_inbound_ah_sa(mblk_t *); 682 683 /* 684 * NAT-Traversal cleanup 685 */ 686 extern void nattymod_clean_ipif(ipif_t *); 687 688 /* 689 * AH and ESP counters types. 690 */ 691 typedef uint32_t ah_counter; 692 typedef uint32_t esp_counter; 693 694 #endif /* _KERNEL */ 695 696 #ifdef __cplusplus 697 } 698 #endif 699 700 #endif /* _INET_IPSEC_IMPL_H */ 701