1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _INET_IPSEC_IMPL_H 27 #define _INET_IPSEC_IMPL_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 #ifdef __cplusplus 32 extern "C" { 33 #endif 34 35 #define IPSEC_CONF_SRC_ADDRESS 0 /* Source Address */ 36 #define IPSEC_CONF_SRC_PORT 1 /* Source Port */ 37 #define IPSEC_CONF_DST_ADDRESS 2 /* Dest Address */ 38 #define IPSEC_CONF_DST_PORT 3 /* Dest Port */ 39 #define IPSEC_CONF_SRC_MASK 4 /* Source Address Mask */ 40 #define IPSEC_CONF_DST_MASK 5 /* Destination Address Mask */ 41 #define IPSEC_CONF_ULP 6 /* Upper layer Port */ 42 #define IPSEC_CONF_IPSEC_PROT 7 /* AH or ESP or AH_ESP */ 43 #define IPSEC_CONF_IPSEC_AALGS 8 /* Auth Algorithms - MD5 etc. */ 44 #define IPSEC_CONF_IPSEC_EALGS 9 /* Encr Algorithms - DES etc. */ 45 #define IPSEC_CONF_IPSEC_EAALGS 10 /* Encr Algorithms - MD5 etc. */ 46 #define IPSEC_CONF_IPSEC_SA 11 /* Shared or unique SA */ 47 #define IPSEC_CONF_IPSEC_DIR 12 /* Direction of traffic */ 48 #define IPSEC_CONF_ICMP_TYPE 13 /* ICMP type */ 49 #define IPSEC_CONF_ICMP_CODE 14 /* ICMP code */ 50 #define IPSEC_CONF_NEGOTIATE 15 /* Negotiation */ 51 #define IPSEC_CONF_TUNNEL 16 /* Tunnel */ 52 53 /* Type of an entry */ 54 55 #define IPSEC_NTYPES 0x02 56 #define IPSEC_TYPE_OUTBOUND 0x00 57 #define IPSEC_TYPE_INBOUND 0x01 58 59 /* Policy */ 60 #define IPSEC_POLICY_APPLY 0x01 61 #define IPSEC_POLICY_DISCARD 0x02 62 #define IPSEC_POLICY_BYPASS 0x03 63 64 /* Shared or unique SA */ 65 #define IPSEC_SHARED_SA 0x01 66 #define IPSEC_UNIQUE_SA 0x02 67 68 /* IPSEC protocols and combinations */ 69 #define IPSEC_AH_ONLY 0x01 70 #define IPSEC_ESP_ONLY 0x02 71 #define IPSEC_AH_ESP 0x03 72 73 #ifdef _KERNEL 74 75 #include <inet/common.h> 76 #include <netinet/ip6.h> 77 #include <netinet/icmp6.h> 78 #include <net/pfkeyv2.h> 79 #include <inet/ip.h> 80 #include <inet/sadb.h> 81 #include <inet/ipsecah.h> 82 #include <inet/ipsecesp.h> 83 #include <sys/crypto/common.h> 84 #include <sys/crypto/api.h> 85 #include <sys/avl.h> 86 87 /* 88 * Maximum number of authentication algorithms (can be indexed by one byte 89 * per PF_KEY and the IKE IPsec DOI. 90 */ 91 #define MAX_AALGS 256 92 93 /* 94 * IPsec task queue constants. 95 */ 96 #define IPSEC_TASKQ_MIN 10 97 #define IPSEC_TASKQ_MAX 20 98 99 /* 100 * So we can access IPsec global variables that live in keysock.c. 101 */ 102 extern boolean_t keysock_extended_reg(void); 103 extern uint32_t keysock_next_seq(void); 104 105 /* 106 * Locking for ipsec policy rules: 107 * 108 * policy heads: system policy is static; per-conn polheads are dynamic, 109 * and refcounted (and inherited); use atomic refcounts and "don't let 110 * go with both hands". 111 * 112 * policy: refcounted; references from polhead, ipsec_out 113 * 114 * actions: refcounted; referenced from: action hash table, policy, ipsec_out 115 * selectors: refcounted; referenced from: selector hash table, policy. 116 */ 117 118 /* 119 * the following are inspired by, but not directly based on, 120 * some of the sys/queue.h type-safe pseudo-polymorphic macros 121 * found in BSD. 122 * 123 * XXX If we use these more generally, we'll have to make the names 124 * less generic (HASH_* will probably clobber other namespaces). 125 */ 126 127 #define HASH_LOCK(table, hash) \ 128 mutex_enter(&(table)[hash].hash_lock) 129 #define HASH_UNLOCK(table, hash) \ 130 mutex_exit(&(table)[hash].hash_lock) 131 132 #define HASH_LOCKED(table, hash) \ 133 MUTEX_HELD(&(table)[hash].hash_lock) 134 135 #define HASH_ITERATE(var, field, table, hash) \ 136 var = table[hash].hash_head; var != NULL; var = var->field.hash_next 137 138 #define HASH_NEXT(var, field) \ 139 (var)->field.hash_next 140 141 #define HASH_INSERT(var, field, table, hash) \ 142 { \ 143 ASSERT(HASH_LOCKED(table, hash)); \ 144 (var)->field.hash_next = (table)[hash].hash_head; \ 145 (var)->field.hash_pp = &(table)[hash].hash_head; \ 146 (table)[hash].hash_head = var; \ 147 if ((var)->field.hash_next != NULL) \ 148 (var)->field.hash_next->field.hash_pp = \ 149 &((var)->field.hash_next); \ 150 } 151 152 153 #define HASH_UNCHAIN(var, field, table, hash) \ 154 { \ 155 ASSERT(MUTEX_HELD(&(table)[hash].hash_lock)); \ 156 HASHLIST_UNCHAIN(var, field); \ 157 } 158 159 #define HASHLIST_INSERT(var, field, head) \ 160 { \ 161 (var)->field.hash_next = head; \ 162 (var)->field.hash_pp = &(head); \ 163 head = var; \ 164 if ((var)->field.hash_next != NULL) \ 165 (var)->field.hash_next->field.hash_pp = \ 166 &((var)->field.hash_next); \ 167 } 168 169 #define HASHLIST_UNCHAIN(var, field) \ 170 { \ 171 *var->field.hash_pp = var->field.hash_next; \ 172 if (var->field.hash_next) \ 173 var->field.hash_next->field.hash_pp = \ 174 var->field.hash_pp; \ 175 HASH_NULL(var, field); \ 176 } 177 178 179 #define HASH_NULL(var, field) \ 180 { \ 181 var->field.hash_next = NULL; \ 182 var->field.hash_pp = NULL; \ 183 } 184 185 #define HASH_LINK(fieldname, type) \ 186 struct { \ 187 type *hash_next; \ 188 type **hash_pp; \ 189 } fieldname 190 191 192 #define HASH_HEAD(tag) \ 193 struct { \ 194 struct tag *hash_head; \ 195 kmutex_t hash_lock; \ 196 } 197 198 typedef struct ipsec_policy_s ipsec_policy_t; 199 200 typedef HASH_HEAD(ipsec_policy_s) ipsec_policy_hash_t; 201 202 /* 203 * When adding new fields to ipsec_prot_t, make sure to update 204 * ipsec_in_to_out_action() as well as other code in spd.c 205 */ 206 207 typedef struct ipsec_prot 208 { 209 unsigned int 210 ipp_use_ah : 1, 211 ipp_use_esp : 1, 212 ipp_use_se : 1, 213 ipp_use_unique : 1, 214 ipp_use_espa : 1, 215 ipp_pad : 27; 216 uint8_t ipp_auth_alg; /* DOI number */ 217 uint8_t ipp_encr_alg; /* DOI number */ 218 uint8_t ipp_esp_auth_alg; /* DOI number */ 219 uint16_t ipp_ah_minbits; /* AH: min keylen */ 220 uint16_t ipp_ah_maxbits; /* AH: max keylen */ 221 uint16_t ipp_espe_minbits; /* ESP encr: min keylen */ 222 uint16_t ipp_espe_maxbits; /* ESP encr: max keylen */ 223 uint16_t ipp_espa_minbits; /* ESP auth: min keylen */ 224 uint16_t ipp_espa_maxbits; /* ESP auth: max keylen */ 225 uint32_t ipp_km_proto; /* key mgmt protocol */ 226 uint32_t ipp_km_cookie; /* key mgmt cookie */ 227 uint32_t ipp_replay_depth; /* replay window */ 228 /* XXX add lifetimes */ 229 } ipsec_prot_t; 230 231 #define IPSEC_MAX_KEYBITS (0xffff) 232 233 /* 234 * An individual policy action, possibly a member of a chain. 235 * 236 * Action chains may be shared between multiple policy rules. 237 * 238 * With one exception (IPSEC_POLICY_LOG), a chain consists of an 239 * ordered list of alternative ways to handle a packet. 240 * 241 * All actions are also "interned" into a hash table (to allow 242 * multiple rules with the same action chain to share one copy in 243 * memory). 244 */ 245 246 typedef struct ipsec_act 247 { 248 uint8_t ipa_type; 249 uint8_t ipa_log; 250 union 251 { 252 ipsec_prot_t ipau_apply; 253 uint8_t ipau_reject_type; 254 uint32_t ipau_resolve_id; /* magic cookie */ 255 uint8_t ipau_log_type; 256 } ipa_u; 257 #define ipa_apply ipa_u.ipau_apply 258 #define ipa_reject_type ipa_u.ipau_reject_type 259 #define ipa_log_type ipa_u.ipau_log_type 260 #define ipa_resolve_type ipa_u.ipau_resolve_type 261 } ipsec_act_t; 262 263 #define IPSEC_ACT_APPLY 0x01 /* match IPSEC_POLICY_APPLY */ 264 #define IPSEC_ACT_DISCARD 0x02 /* match IPSEC_POLICY_DISCARD */ 265 #define IPSEC_ACT_BYPASS 0x03 /* match IPSEC_POLICY_BYPASS */ 266 #define IPSEC_ACT_REJECT 0x04 267 #define IPSEC_ACT_CLEAR 0x05 268 269 typedef struct ipsec_action_s 270 { 271 HASH_LINK(ipa_hash, struct ipsec_action_s); 272 struct ipsec_action_s *ipa_next; /* next alternative */ 273 uint32_t ipa_refs; /* refcount */ 274 ipsec_act_t ipa_act; 275 /* 276 * The following bits are equivalent to an OR of bits included in the 277 * ipau_apply fields of this and subsequent actions in an 278 * action chain; this is an optimization for the sake of 279 * ipsec_out_process() in ip.c and a few other places. 280 */ 281 unsigned int 282 ipa_hval: 8, 283 ipa_allow_clear:1, /* rule allows cleartext? */ 284 ipa_want_ah:1, /* an action wants ah */ 285 ipa_want_esp:1, /* an action wants esp */ 286 ipa_want_se:1, /* an action wants se */ 287 ipa_want_unique:1, /* want unique sa's */ 288 ipa_pad:19; 289 uint32_t ipa_ovhd; /* per-packet encap ovhd */ 290 } ipsec_action_t; 291 292 #define IPACT_REFHOLD(ipa) { \ 293 atomic_add_32(&(ipa)->ipa_refs, 1); \ 294 ASSERT((ipa)->ipa_refs != 0); \ 295 } 296 #define IPACT_REFRELE(ipa) { \ 297 ASSERT((ipa)->ipa_refs != 0); \ 298 membar_exit(); \ 299 if (atomic_add_32_nv(&(ipa)->ipa_refs, -1) == 0) \ 300 ipsec_action_free(ipa); \ 301 (ipa) = 0; \ 302 } 303 304 /* 305 * Merged address structure, for cheezy address-family independent 306 * matches in policy code. 307 */ 308 309 typedef union ipsec_addr 310 { 311 in6_addr_t ipsad_v6; 312 in_addr_t ipsad_v4; 313 } ipsec_addr_t; 314 315 /* 316 * ipsec selector set, as used by the kernel policy structures. 317 * Note that that we specify "local" and "remote" 318 * rather than "source" and "destination", which allows the selectors 319 * for symmetric policy rules to be shared between inbound and 320 * outbound rules. 321 * 322 * "local" means "destination" on inbound, and "source" on outbound. 323 * "remote" means "source" on inbound, and "destination" on outbound. 324 * XXX if we add a fifth policy enforcement point for forwarded packets, 325 * what do we do? 326 * 327 * The ipsl_valid mask is not done as a bitfield; this is so we 328 * can use "ffs()" to find the "most interesting" valid tag. 329 * 330 * XXX should we have multiple types for space-conservation reasons? 331 * (v4 vs v6? prefix vs. range)? 332 */ 333 334 typedef struct ipsec_selkey 335 { 336 uint32_t ipsl_valid; /* bitmask of valid entries */ 337 #define IPSL_REMOTE_ADDR 0x00000001 338 #define IPSL_LOCAL_ADDR 0x00000002 339 #define IPSL_REMOTE_PORT 0x00000004 340 #define IPSL_LOCAL_PORT 0x00000008 341 #define IPSL_PROTOCOL 0x00000010 342 #define IPSL_ICMP_TYPE 0x00000020 343 #define IPSL_ICMP_CODE 0x00000040 344 #define IPSL_IPV6 0x00000080 345 #define IPSL_IPV4 0x00000100 346 347 #define IPSL_WILDCARD 0x0000007f 348 349 ipsec_addr_t ipsl_local; 350 ipsec_addr_t ipsl_remote; 351 uint16_t ipsl_lport; 352 uint16_t ipsl_rport; 353 /* 354 * ICMP type and code selectors. Both have an end value to 355 * specify ranges, or * and *_end are equal for a single 356 * value 357 */ 358 uint8_t ipsl_icmp_type; 359 uint8_t ipsl_icmp_type_end; 360 uint8_t ipsl_icmp_code; 361 uint8_t ipsl_icmp_code_end; 362 363 uint8_t ipsl_proto; /* ip payload type */ 364 uint8_t ipsl_local_pfxlen; /* #bits of prefix */ 365 uint8_t ipsl_remote_pfxlen; /* #bits of prefix */ 366 uint8_t ipsl_mbz; 367 368 /* Insert new elements above this line */ 369 uint32_t ipsl_pol_hval; 370 uint32_t ipsl_sel_hval; 371 } ipsec_selkey_t; 372 373 typedef struct ipsec_sel 374 { 375 HASH_LINK(ipsl_hash, struct ipsec_sel); 376 uint32_t ipsl_refs; /* # refs to this sel */ 377 ipsec_selkey_t ipsl_key; /* actual selector guts */ 378 } ipsec_sel_t; 379 380 /* 381 * One policy rule. This will be linked into a single hash chain bucket in 382 * the parent rule structure. If the selector is simple enough to 383 * allow hashing, it gets filed under ipsec_policy_root_t->ipr_hash. 384 * Otherwise it goes onto a linked list in ipsec_policy_root_t->ipr_nonhash[af] 385 * 386 * In addition, we file the rule into an avl tree keyed by the rule index. 387 * (Duplicate rules are permitted; the comparison function breaks ties). 388 */ 389 struct ipsec_policy_s 390 { 391 HASH_LINK(ipsp_hash, struct ipsec_policy_s); 392 avl_node_t ipsp_byid; 393 uint64_t ipsp_index; /* unique id */ 394 uint32_t ipsp_prio; /* rule priority */ 395 uint32_t ipsp_refs; 396 ipsec_sel_t *ipsp_sel; /* selector set (shared) */ 397 ipsec_action_t *ipsp_act; /* action (may be shared) */ 398 }; 399 400 #define IPPOL_REFHOLD(ipp) { \ 401 atomic_add_32(&(ipp)->ipsp_refs, 1); \ 402 ASSERT((ipp)->ipsp_refs != 0); \ 403 } 404 #define IPPOL_REFRELE(ipp) { \ 405 ASSERT((ipp)->ipsp_refs != 0); \ 406 membar_exit(); \ 407 if (atomic_add_32_nv(&(ipp)->ipsp_refs, -1) == 0) \ 408 ipsec_policy_free(ipp); \ 409 (ipp) = 0; \ 410 } 411 412 #define IPPOL_UNCHAIN(php, ip) \ 413 HASHLIST_UNCHAIN((ip), ipsp_hash); \ 414 avl_remove(&(php)->iph_rulebyid, (ip)); \ 415 IPPOL_REFRELE(ip); 416 417 418 /* 419 * Policy ruleset. One per (protocol * direction) for system policy. 420 */ 421 422 #define IPSEC_AF_V4 0 423 #define IPSEC_AF_V6 1 424 #define IPSEC_NAF 2 425 426 typedef struct ipsec_policy_root_s 427 { 428 ipsec_policy_t *ipr_nonhash[IPSEC_NAF]; 429 int ipr_nchains; 430 ipsec_policy_hash_t *ipr_hash; 431 } ipsec_policy_root_t; 432 433 /* 434 * Policy head. One for system policy; there may also be one present 435 * on ill_t's with interface-specific policy, as well as one present 436 * for sockets with per-socket policy allocated. 437 */ 438 439 typedef struct ipsec_policy_head_s 440 { 441 uint32_t iph_refs; 442 krwlock_t iph_lock; 443 uint64_t iph_gen; /* generation number */ 444 ipsec_policy_root_t iph_root[IPSEC_NTYPES]; 445 avl_tree_t iph_rulebyid; 446 } ipsec_policy_head_t; 447 448 #define IPPH_REFHOLD(iph) { \ 449 atomic_add_32(&(iph)->iph_refs, 1); \ 450 ASSERT((iph)->iph_refs != 0); \ 451 } 452 #define IPPH_REFRELE(iph) { \ 453 ASSERT((iph)->iph_refs != 0); \ 454 membar_exit(); \ 455 if (atomic_add_32_nv(&(iph)->iph_refs, -1) == 0) \ 456 ipsec_polhead_free(iph); \ 457 (iph) = 0; \ 458 } 459 460 /* 461 * IPsec fragment related structures 462 */ 463 464 typedef struct ipsec_fragcache_entry { 465 struct ipsec_fragcache_entry *itpfe_next; /* hash list chain */ 466 mblk_t *itpfe_fraglist; /* list of fragments */ 467 time_t itpfe_exp; /* time when entry is stale */ 468 int itpfe_depth; /* # of fragments in list */ 469 ipsec_addr_t itpfe_frag_src; 470 ipsec_addr_t itpfe_frag_dst; 471 #define itpfe_src itpfe_frag_src.ipsad_v4 472 #define itpfe_src6 itpfe_frag_src.ipsad_v6 473 #define itpfe_dst itpfe_frag_dst.ipsad_v4 474 #define itpfe_dst6 itpfe_frag_dst.ipsad_v6 475 uint32_t itpfe_id; /* IP datagram ID */ 476 uint8_t itpfe_proto; /* IP Protocol */ 477 uint8_t itpfe_last; /* Last packet */ 478 } ipsec_fragcache_entry_t; 479 480 typedef struct ipsec_fragcache { 481 kmutex_t itpf_lock; 482 struct ipsec_fragcache_entry **itpf_ptr; 483 struct ipsec_fragcache_entry *itpf_freelist; 484 time_t itpf_expire_hint; /* time when oldest entry is stale */ 485 } ipsec_fragcache_t; 486 487 /* 488 * Tunnel policies. We keep a minature of the transport-mode/global policy 489 * per each tunnel instance. 490 * 491 * People who need both an itp held down AND one of its polheads need to 492 * first lock the itp, THEN the polhead, otherwise deadlock WILL occur. 493 */ 494 typedef struct ipsec_tun_pol_s { 495 avl_node_t itp_node; 496 kmutex_t itp_lock; 497 uint64_t itp_next_policy_index; 498 ipsec_policy_head_t *itp_policy; 499 ipsec_policy_head_t *itp_inactive; 500 uint32_t itp_flags; 501 uint32_t itp_refcnt; 502 char itp_name[LIFNAMSIZ]; 503 ipsec_fragcache_t itp_fragcache; 504 } ipsec_tun_pol_t; 505 /* NOTE - Callers (tun code) synchronize their own instances for these flags. */ 506 #define ITPF_P_ACTIVE 0x1 /* Are we using IPsec right now? */ 507 #define ITPF_P_TUNNEL 0x2 /* Negotiate tunnel-mode */ 508 /* Optimization -> Do we have per-port security entries in this polhead? */ 509 #define ITPF_P_PER_PORT_SECURITY 0x4 510 #define ITPF_PFLAGS 0x7 511 #define ITPF_SHIFT 3 512 513 #define ITPF_I_ACTIVE 0x8 /* Is the inactive using IPsec right now? */ 514 #define ITPF_I_TUNNEL 0x10 /* Negotiate tunnel-mode (on inactive) */ 515 /* Optimization -> Do we have per-port security entries in this polhead? */ 516 #define ITPF_I_PER_PORT_SECURITY 0x20 517 #define ITPF_IFLAGS 0x38 518 519 /* NOTE: f cannot be an expression. */ 520 #define ITPF_CLONE(f) (f) = (((f) & ITPF_PFLAGS) | \ 521 (((f) & ITPF_PFLAGS) << ITPF_SHIFT)); 522 #define ITPF_SWAP(f) (f) = ((((f) & ITPF_PFLAGS) << ITPF_SHIFT) | \ 523 (((f) & ITPF_IFLAGS) >> ITPF_SHIFT)) 524 525 #define ITP_P_ISACTIVE(itp, iph) ((itp)->itp_flags & \ 526 (((itp)->itp_policy == (iph)) ? ITPF_P_ACTIVE : ITPF_I_ACTIVE)) 527 528 #define ITP_P_ISTUNNEL(itp, iph) ((itp)->itp_flags & \ 529 (((itp)->itp_policy == (iph)) ? ITPF_P_TUNNEL : ITPF_I_TUNNEL)) 530 531 #define ITP_P_ISPERPORT(itp, iph) ((itp)->itp_flags & \ 532 (((itp)->itp_policy == (iph)) ? ITPF_P_PER_PORT_SECURITY : \ 533 ITPF_I_PER_PORT_SECURITY)) 534 535 #define ITP_REFHOLD(itp) { \ 536 atomic_add_32(&((itp)->itp_refcnt), 1); \ 537 ASSERT((itp)->itp_refcnt != 0); \ 538 } 539 540 #define ITP_REFRELE(itp) { \ 541 ASSERT((itp)->itp_refcnt != 0); \ 542 membar_exit(); \ 543 if (atomic_add_32_nv(&((itp)->itp_refcnt), -1) == 0) \ 544 itp_free(itp); \ 545 } 546 547 /* 548 * Certificate identity. 549 */ 550 551 typedef struct ipsid_s 552 { 553 struct ipsid_s *ipsid_next; 554 struct ipsid_s **ipsid_ptpn; 555 uint32_t ipsid_refcnt; 556 int ipsid_type; /* id type */ 557 char *ipsid_cid; /* certificate id string */ 558 } ipsid_t; 559 560 /* 561 * ipsid_t reference hold/release macros, just like ipsa versions. 562 */ 563 564 #define IPSID_REFHOLD(ipsid) { \ 565 atomic_add_32(&(ipsid)->ipsid_refcnt, 1); \ 566 ASSERT((ipsid)->ipsid_refcnt != 0); \ 567 } 568 569 /* 570 * Decrement the reference count on the ID. Someone else will clean up 571 * after us later. 572 */ 573 574 #define IPSID_REFRELE(ipsid) { \ 575 membar_exit(); \ 576 atomic_add_32(&(ipsid)->ipsid_refcnt, -1); \ 577 } 578 579 extern boolean_t ipsec_inbound_v4_policy_present; 580 extern boolean_t ipsec_outbound_v4_policy_present; 581 extern boolean_t ipsec_inbound_v6_policy_present; 582 extern boolean_t ipsec_outbound_v6_policy_present; 583 584 struct ipsec_out_s; 585 586 /* 587 * Following are the estimates of what the maximum AH and ESP header size 588 * would be. This is used to tell the upper layer the right value of MSS 589 * it should use without consulting AH/ESP. If the size is something 590 * different from this, ULP will learn the right one through 591 * ICMP_FRAGMENTATION_NEEDED messages generated locally. 592 * 593 * AH : 12 bytes of constant header + 12 bytes of ICV checksum (MD5/SHA1). 594 * 595 * ESP : 8 bytes of constant header + 16 bytes of IV + 12 bytes ICV + 596 * 2 bytes of trailer + 15 bytes pad = 53 597 * 598 * Note that for ESP, this estimate is overly pessimistic; however, a 599 * more accurate estimate needs to know the exact amount of space 600 * which will be available to ESP so it can just leave 2 bytes free in 601 * the last cipherblock for the ESP inner trailer, and that 602 * information is not available at the right moment in the current 603 * stack. 604 */ 605 #define IPSEC_MAX_AH_HDR_SIZE (24) 606 #define IPSEC_MAX_ESP_HDR_SIZE (53) 607 608 /* Alternate, when we know the crypto block size */ 609 #define IPSEC_BASE_ESP_HDR_SIZE(sa) (4 + 4 + 12 + 1 + 2 * (sa)->ipsa_iv_len) 610 #define IPSEC_DEF_BLOCKSIZE (8) /* safe default */ 611 612 /* 613 * Loader states.. 614 */ 615 #define IPSEC_LOADER_WAIT 0 616 #define IPSEC_LOADER_FAILED -1 617 #define IPSEC_LOADER_SUCCEEDED 1 618 619 extern kmutex_t ipsec_loader_lock; 620 extern int ipsec_loader_state; 621 622 /* 623 * ipsec_loader entrypoints. 624 */ 625 extern void ipsec_loader_init(void); 626 extern void ipsec_loader_start(void); 627 extern void ipsec_loader_destroy(void); 628 extern void ipsec_loader_loadnow(void); 629 extern boolean_t ipsec_loader_wait(queue_t *q); 630 extern boolean_t ipsec_loaded(void); 631 extern boolean_t ipsec_failed(void); 632 633 /* 634 * callback from ipsec_loader to ip 635 */ 636 extern void ip_ipsec_load_complete(); 637 638 /* 639 * ipsec policy entrypoints (spd.c) 640 */ 641 642 extern void ipsec_policy_destroy(void); 643 extern void ipsec_policy_init(void); 644 extern int ipsec_alloc_table(ipsec_policy_head_t *, int, int, boolean_t); 645 extern void ipsec_polhead_init(ipsec_policy_head_t *, int); 646 extern void ipsec_polhead_destroy(ipsec_policy_head_t *); 647 extern void ipsec_polhead_free_table(ipsec_policy_head_t *); 648 extern mblk_t *ipsec_check_global_policy(mblk_t *, conn_t *, ipha_t *, 649 ip6_t *, boolean_t); 650 extern mblk_t *ipsec_check_inbound_policy(mblk_t *, conn_t *, ipha_t *, ip6_t *, 651 boolean_t); 652 653 extern boolean_t ipsec_in_to_out(mblk_t *, ipha_t *, ip6_t *); 654 extern void ipsec_log_policy_failure(queue_t *, int, char *, ipha_t *, 655 ip6_t *, boolean_t); 656 extern boolean_t ipsec_inbound_accept_clear(mblk_t *, ipha_t *, ip6_t *); 657 extern int ipsec_conn_cache_policy(conn_t *, boolean_t); 658 extern mblk_t *ipsec_alloc_ipsec_out(void); 659 extern mblk_t *ipsec_attach_ipsec_out(mblk_t *, conn_t *, ipsec_policy_t *, 660 uint8_t); 661 extern mblk_t *ipsec_init_ipsec_out(mblk_t *, conn_t *, ipsec_policy_t *, 662 uint8_t); 663 struct ipsec_in_s; 664 extern ipsec_action_t *ipsec_in_to_out_action(struct ipsec_in_s *); 665 extern boolean_t ipsec_check_ipsecin_latch(struct ipsec_in_s *, mblk_t *, 666 struct ipsec_latch_s *, ipha_t *, ip6_t *, const char **, kstat_named_t **, 667 conn_t *); 668 extern void ipsec_latch_inbound(ipsec_latch_t *ipl, struct ipsec_in_s *ii); 669 670 extern void ipsec_policy_free(ipsec_policy_t *); 671 extern void ipsec_action_free(ipsec_action_t *); 672 extern void ipsec_polhead_free(ipsec_policy_head_t *); 673 extern ipsec_policy_head_t *ipsec_polhead_split(ipsec_policy_head_t *); 674 extern ipsec_policy_head_t *ipsec_polhead_create(void); 675 extern ipsec_policy_head_t *ipsec_system_policy(void); 676 extern ipsec_policy_head_t *ipsec_inactive_policy(void); 677 extern void ipsec_swap_policy(ipsec_policy_head_t *, ipsec_policy_head_t *); 678 extern void ipsec_swap_global_policy(void); 679 680 extern int ipsec_clone_system_policy(void); 681 extern ipsec_policy_t *ipsec_policy_create(ipsec_selkey_t *, 682 const ipsec_act_t *, int, int, uint64_t *); 683 extern boolean_t ipsec_policy_delete(ipsec_policy_head_t *, 684 ipsec_selkey_t *, int); 685 extern int ipsec_policy_delete_index(ipsec_policy_head_t *, uint64_t); 686 extern void ipsec_polhead_flush(ipsec_policy_head_t *); 687 extern int ipsec_copy_polhead(ipsec_policy_head_t *, ipsec_policy_head_t *); 688 extern void ipsec_actvec_from_req(ipsec_req_t *, ipsec_act_t **, uint_t *); 689 extern void ipsec_actvec_free(ipsec_act_t *, uint_t); 690 extern int ipsec_req_from_head(ipsec_policy_head_t *, ipsec_req_t *, int); 691 extern mblk_t *ipsec_construct_inverse_acquire(sadb_msg_t *, sadb_ext_t **); 692 extern mblk_t *ip_wput_attach_policy(mblk_t *, ipha_t *, ip6_t *, ire_t *, 693 conn_t *, boolean_t, zoneid_t); 694 extern mblk_t *ip_wput_ire_parse_ipsec_out(mblk_t *, ipha_t *, ip6_t *, 695 ire_t *, conn_t *, boolean_t, zoneid_t); 696 extern ipsec_policy_t *ipsec_find_policy(int, conn_t *, 697 struct ipsec_out_s *, ipsec_selector_t *); 698 extern ipsid_t *ipsid_lookup(int, char *); 699 extern boolean_t ipsid_equal(ipsid_t *, ipsid_t *); 700 extern void ipsid_gc(void); 701 extern void ipsec_latch_ids(ipsec_latch_t *, ipsid_t *, ipsid_t *); 702 703 extern void ipsec_config_flush(void); 704 extern boolean_t ipsec_check_policy(ipsec_policy_head_t *, ipsec_policy_t *, 705 int); 706 extern void ipsec_enter_policy(ipsec_policy_head_t *, ipsec_policy_t *, int); 707 extern boolean_t ipsec_check_action(ipsec_act_t *, int *); 708 709 extern mblk_t *ipsec_out_tag(mblk_t *, mblk_t *); 710 extern mblk_t *ipsec_in_tag(mblk_t *, mblk_t *); 711 extern mblk_t *ip_copymsg(mblk_t *mp); 712 713 extern void iplatch_free(ipsec_latch_t *); 714 extern ipsec_latch_t *iplatch_create(void); 715 extern int ipsec_set_req(cred_t *, conn_t *, ipsec_req_t *); 716 717 extern void ipsec_insert_always(avl_tree_t *tree, void *new_node); 718 719 extern int32_t ipsec_act_ovhd(const ipsec_act_t *act); 720 721 722 extern boolean_t iph_ipvN(ipsec_policy_head_t *, boolean_t); 723 724 /* 725 * Tunnel-support SPD functions and variables. 726 */ 727 struct tun_s; /* Defined in inet/tun.h. */ 728 extern boolean_t ipsec_tun_inbound(mblk_t *, mblk_t **, ipsec_tun_pol_t *, 729 ipha_t *, ip6_t *, ipha_t *, ip6_t *, int); 730 extern mblk_t *ipsec_tun_outbound(mblk_t *, struct tun_s *, ipha_t *, 731 ip6_t *, ipha_t *, ip6_t *, int); 732 extern void itp_free(ipsec_tun_pol_t *); 733 extern ipsec_tun_pol_t *create_tunnel_policy(char *, int *, uint64_t *); 734 extern ipsec_tun_pol_t *get_tunnel_policy(char *); 735 extern void itp_unlink(ipsec_tun_pol_t *); 736 extern void itp_free(ipsec_tun_pol_t *node); 737 extern void itp_walk(void (*)(ipsec_tun_pol_t *, void *), void *); 738 739 extern ipsec_tun_pol_t *(*itp_get_byaddr)(uint32_t *, uint32_t *, int); 740 extern ipsec_tun_pol_t *itp_get_byaddr_dummy(uint32_t *, uint32_t *, 741 int); 742 extern krwlock_t itp_get_byaddr_rw_lock; 743 744 extern krwlock_t tunnel_policy_lock; 745 extern uint64_t tunnel_policy_gen; 746 extern avl_tree_t tunnel_policies; 747 748 /* 749 * IPsec AH/ESP functions called from IP. 750 */ 751 752 extern void ipsecah_in_assocfailure(mblk_t *, char, ushort_t, char *, 753 uint32_t, void *, int); 754 extern void ipsecesp_in_assocfailure(mblk_t *, char, ushort_t, char *, 755 uint32_t, void *, int); 756 757 /* 758 * Algorithm management helper functions. 759 */ 760 extern boolean_t ipsec_valid_key_size(uint16_t, ipsec_alginfo_t *); 761 762 /* 763 * Per-socket policy, for now, takes precedence... this priority value 764 * insures it. 765 */ 766 #define IPSEC_PRIO_SOCKET 0x1000000 767 768 /* DDI initialization functions. */ 769 extern boolean_t ipsecesp_ddi_init(void); 770 extern boolean_t ipsecah_ddi_init(void); 771 extern boolean_t keysock_ddi_init(void); 772 extern boolean_t spdsock_ddi_init(void); 773 774 extern void ipsecesp_ddi_destroy(void); 775 extern void ipsecah_ddi_destroy(void); 776 extern void keysock_ddi_destroy(void); 777 extern void spdsock_ddi_destroy(void); 778 779 /* 780 * AH- and ESP-specific functions that are called directly by other modules. 781 */ 782 extern void ipsecah_fill_defs(struct sadb_x_ecomb *); 783 extern void ipsecesp_fill_defs(struct sadb_x_ecomb *); 784 extern void ipsecah_algs_changed(void); 785 extern void ipsecesp_algs_changed(void); 786 extern void ipsecesp_init_funcs(ipsa_t *); 787 extern void ipsecah_init_funcs(ipsa_t *); 788 extern ipsec_status_t ipsecah_icmp_error(mblk_t *); 789 extern ipsec_status_t ipsecesp_icmp_error(mblk_t *); 790 791 /* 792 * Wrapper for putnext() to ipsec accelerated interface. 793 */ 794 extern void ipsec_hw_putnext(queue_t *, mblk_t *); 795 796 /* 797 * spdsock functions that are called directly by IP. 798 */ 799 extern void spdsock_update_pending_algs(void); 800 801 /* 802 * IP functions that are called from AH and ESP. 803 */ 804 extern boolean_t ipsec_outbound_sa(mblk_t *, uint_t); 805 extern esph_t *ipsec_inbound_esp_sa(mblk_t *); 806 extern ah_t *ipsec_inbound_ah_sa(mblk_t *); 807 extern ipsec_policy_t *ipsec_find_policy_head(ipsec_policy_t *, 808 ipsec_policy_head_t *, int, ipsec_selector_t *); 809 810 811 /* 812 * NAT-Traversal cleanup 813 */ 814 extern void nattymod_clean_ipif(ipif_t *); 815 816 /* 817 * Common functions 818 */ 819 extern boolean_t ip_addr_match(uint8_t *, int, in6_addr_t *); 820 821 /* 822 * AH and ESP counters types. 823 */ 824 typedef uint32_t ah_counter; 825 typedef uint32_t esp_counter; 826 827 #endif /* _KERNEL */ 828 829 #ifdef __cplusplus 830 } 831 #endif 832 833 #endif /* _INET_IPSEC_IMPL_H */ 834