xref: /illumos-gate/usr/src/uts/common/inet/ipsec_info.h (revision 26fd77009b17f8c8fb32eb362584cfd635e87ad9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_INET_IPSEC_INFO_H
27 #define	_INET_IPSEC_INFO_H
28 
29 #ifdef	__cplusplus
30 extern "C" {
31 #endif
32 
33 #include <sys/crypto/common.h>
34 
35 /*
36  * IPsec informational messages.  These are M_CTL STREAMS messages, which
37  * convey IPsec information between various IP and related modules.  The
38  * messages come in a few flavors:
39  *
40  *	* IPSEC_{IN,OUT}  -  These show what IPsec action have been taken (for
41  *	  inbound datagrams), or need to be taken (for outbound datagrams).
42  *	  They flow between AH/ESP and IP.
43  *
44  *	* Keysock consumer interface  -  These messages are wrappers for
45  *	  PF_KEY messages.  They flow between AH/ESP and keysock.
46  *
47  * Some of these messages include pointers such as a netstack_t pointer.
48  * We do not explicitly reference count those with netstack_hold/rele,
49  * since we depend on IP's ability to discard all of the IPSEC_{IN,OUT}
50  * messages in order to handle the ipsa pointers.
51  * We have special logic when doing asynch callouts to kEF for which we
52  * verify netstack_t pointer using the netstackid_t.
53  */
54 
55 /*
56  * The IPsec M_CTL value MUST be something that will not be even close
57  * to an IPv4 or IPv6 header.  This means the first byte must not be
58  * 0x40 - 0x4f or 0x60-0x6f.  For big-endian machines, this is fixable with
59  * the IPSEC_M_CTL prefix.  For little-endian machines, the actual M_CTL
60  * _type_ must not be in the aforementioned ranges.
61  *
62  * The reason for this avoidance is because M_CTL's with a real IPv4/IPv6
63  * datagram get sent from to TCP or UDP when an ICMP datagram affects a
64  * TCP/UDP session.
65  */
66 #define	IPSEC_M_CTL	0x73706900
67 
68 /*
69  * M_CTL types for IPsec messages.  Remember, the values 0x40 - 0x4f and 0x60
70  * - 0x6f are not to be used because of potential little-endian confusion.
71  *
72  * Offsets 1-25 (decimal) are in use, spread through this file.
73  * Check for duplicates through the whole file before adding.
74  */
75 
76 /*
77  * IPSEC_{IN,OUT} policy expressors.
78  */
79 #define	IPSEC_IN	(IPSEC_M_CTL + 1)
80 #define	IPSEC_OUT	(IPSEC_M_CTL + 2)
81 
82 /*
83  * This is used for communication between IP and IPSEC (AH/ESP)
84  * for Inbound datagrams. IPSEC_IN is allocated by IP before IPSEC
85  * processing begins. On return spi fields are initialized so that
86  * IP can locate the security associations later on for doing policy
87  * checks. For loopback case, IPSEC processing is not done. But the
88  * attributes of the security are reflected in <foo>_done fields below.
89  * The code in policy check infers that it is a loopback case and
90  * would not try to get the associations.
91  *
92  * The comment below (and for other netstack_t references) refers
93  * to the fact that we only do netstack_hold in particular cases,
94  * such as the references from open streams (ill_t and conn_t's
95  * pointers). Internally within IP we rely on IP's ability to cleanup e.g.
96  * ire_t's when an ill goes away.
97  */
98 typedef struct ipsec_in_s {
99 	uint32_t ipsec_in_type;
100 	uint32_t ipsec_in_len;
101 	frtn_t ipsec_in_frtn;		/* for esballoc() callback */
102 	struct ipsa_s 	*ipsec_in_ah_sa;	/* SA for AH */
103 	struct ipsa_s 	*ipsec_in_esp_sa;	/* SA for ESP */
104 
105 	struct ipsec_policy_head_s *ipsec_in_policy;
106 	struct ipsec_action_s *ipsec_in_action; /* how we made it in.. */
107 	unsigned int
108 		ipsec_in_secure : 1,	/* Is the message attached secure ? */
109 		ipsec_in_v4 : 1,	/* Is this an ipv4 packet ? */
110 		ipsec_in_loopback : 1,	/* Is this a loopback request ? */
111 		ipsec_in_dont_check : 1, /* Used by TCP to avoid policy check */
112 
113 		ipsec_in_decaps : 1,	/* Was this packet decapsulated from */
114 					/* a matching inner packet? */
115 		ipsec_in_accelerated : 1, /* hardware accelerated packet */
116 
117 		ipsec_in_icmp_loopback : 1, /* Looped-back ICMP packet, */
118 					    /* all should trust this. */
119 		ipsec_in_pad_bits : 25;
120 
121 	int    ipsec_in_ill_index;	/* interface on which ipha_dst was */
122 					/* configured when pkt was recv'd  */
123 	int    ipsec_in_rill_index;	/* interface on which pkt was recv'd */
124 	uint32_t ipsec_in_esp_udp_ports;	/* For an ESP-in-UDP packet. */
125 	mblk_t *ipsec_in_da;		/* data attr. for accelerated pkts */
126 
127 	/*
128 	 * For call to the kernel crypto framework. State needed during
129 	 * the execution of a crypto request. Storing these here
130 	 * allow us to avoid a separate allocation before calling the
131 	 * crypto framework.
132 	 */
133 	size_t ipsec_in_skip_len;		/* len to skip for AH auth */
134 	crypto_data_t ipsec_in_crypto_data;	/* single op crypto data */
135 	crypto_dual_data_t ipsec_in_crypto_dual_data; /* for dual ops */
136 	crypto_data_t ipsec_in_crypto_mac;	/* to store the MAC */
137 
138 	zoneid_t ipsec_in_zoneid;	/* target zone for the datagram */
139 	netstack_t *ipsec_in_ns;	/* Does not have a netstack_hold */
140 	netstackid_t ipsec_in_stackid;	/* Used while waing for kEF callback */
141 } ipsec_in_t;
142 
143 #define	IPSECOUT_MAX_ADDRLEN 4	/* Max addr len. (in 32-bit words) */
144 /*
145  * This is used for communication between IP and IPSEC (AH/ESP)
146  * for Outbound datagrams. IPSEC_OUT is allocated by IP before IPSEC
147  * processing begins. On return SA fields are initialized so that
148  * IP can locate the security associations later on for doing policy
149  * checks.  The policy and the actions associated with this packet are
150  * stored in the ipsec_out_policy and ipsec_out_act fields respectively.
151  * IPSEC_OUT is also used to carry non-ipsec information when conn is
152  * absent or the conn information is lost across the calls to ARP.
153  * example: message from ARP or from ICMP error routines.
154  */
155 typedef struct ipsec_out_s {
156 	uint32_t ipsec_out_type;
157 	uint32_t ipsec_out_len;
158 	frtn_t ipsec_out_frtn;		/* for esballoc() callback */
159 	struct ipsec_policy_head_s *ipsec_out_polhead;
160 	ipsec_latch_t		*ipsec_out_latch;
161 	struct ipsec_policy_s 	*ipsec_out_policy; /* why are we here? */
162 	struct ipsec_action_s	*ipsec_out_act;	/* what do we want? */
163 	struct ipsa_s	*ipsec_out_ah_sa; /* AH SA used for the packet */
164 	struct ipsa_s	*ipsec_out_esp_sa; /* ESP SA used for the packet */
165 	/*
166 	 * NOTE: "Source" and "Dest" are w.r.t. outbound datagrams.  Ports can
167 	 *	 be zero, and the protocol number is needed to make the ports
168 	 *	 significant.
169 	 */
170 	uint16_t ipsec_out_src_port;	/* Source port number of d-gram. */
171 	uint16_t ipsec_out_dst_port;	/* Destination port number of d-gram. */
172 	uint8_t  ipsec_out_icmp_type;	/* ICMP type of d-gram */
173 	uint8_t  ipsec_out_icmp_code;	/* ICMP code of d-gram */
174 
175 	sa_family_t ipsec_out_inaf;	/* Inner address family */
176 	uint32_t ipsec_out_insrc[IPSECOUT_MAX_ADDRLEN];	/* Inner src address */
177 	uint32_t ipsec_out_indst[IPSECOUT_MAX_ADDRLEN];	/* Inner dest address */
178 	uint8_t  ipsec_out_insrcpfx;	/* Inner source prefix */
179 	uint8_t  ipsec_out_indstpfx;	/* Inner destination prefix */
180 
181 	uint_t ipsec_out_ill_index;	/* ill index used for multicast etc. */
182 	uint8_t ipsec_out_proto;	/* IP protocol number for d-gram. */
183 	unsigned int
184 		ipsec_out_tunnel : 1,	/* Tunnel mode? */
185 		ipsec_out_use_global_policy : 1, /* Inherit global policy ? */
186 		ipsec_out_secure : 1,	/* Is this secure ? */
187 		ipsec_out_proc_begin : 1, /* IPSEC processing begun */
188 		/*
189 		 * Following five values reflects the values stored
190 		 * in conn.
191 		 */
192 		ipsec_out_multicast_loop : 1,
193 		ipsec_out_dontroute : 1,
194 		ipsec_out_reserved : 1,
195 		ipsec_out_v4 : 1,
196 
197 		ipsec_out_unspec_src : 1,	/* IPv6 ip6i_t info */
198 		ipsec_out_reachable : 1, 	/* NDP reachability info */
199 		ipsec_out_failed: 1,
200 		ipsec_out_se_done: 1,
201 
202 		ipsec_out_esp_done: 1,
203 		ipsec_out_ah_done: 1,
204 		ipsec_out_need_policy: 1,
205 
206 		/*
207 		 * To indicate that packet must be accelerated, i.e.
208 		 * ICV or encryption performed, by Provider.
209 		 */
210 		ipsec_out_accelerated : 1,
211 		/*
212 		 * Used by IP to tell IPsec that the outbound ill for this
213 		 * packet supports acceleration of the AH or ESP prototocol.
214 		 * If set, ipsec_out_capab_ill_index contains the
215 		 * index of the ill.
216 		 */
217 		ipsec_out_is_capab_ill : 1,
218 		/*
219 		 * Indicates ICMP message destined for self.  These
220 		 * messages are to be trusted by all receivers.
221 		 */
222 		ipsec_out_icmp_loopback: 1,
223 		ipsec_out_ip_nexthop : 1,	/* IP_NEXTHOP option is set */
224 		ipsec_out_pad_bits : 13;
225 	cred_t	*ipsec_out_cred;
226 	uint32_t ipsec_out_capab_ill_index;
227 
228 	/*
229 	 * For call to the kernel crypto framework. State needed during
230 	 * the execution of a crypto request. Storing these here
231 	 * allow us to avoid a separate allocation before calling the
232 	 * crypto framework.
233 	 */
234 	size_t ipsec_out_skip_len;		/* len to skip for AH auth */
235 	crypto_data_t ipsec_out_crypto_data;	/* single op crypto data */
236 	crypto_dual_data_t ipsec_out_crypto_dual_data; /* for dual ops */
237 	crypto_data_t ipsec_out_crypto_mac;	/* to store the MAC */
238 
239 	zoneid_t ipsec_out_zoneid;	/* source zone for the datagram */
240 	in6_addr_t ipsec_out_nexthop_v6;	/* nexthop IP address */
241 #define	ipsec_out_nexthop_addr V4_PART_OF_V6(ipsec_out_nexthop_v6)
242 	netstack_t *ipsec_out_ns;	/* Does not have a netstack_hold */
243 	netstackid_t ipsec_out_stackid;	/* Used while waing for kEF callback */
244 } ipsec_out_t;
245 
246 /*
247  * This is used to mark the ipsec_out_t *req* fields
248  * when the operation is done without affecting the
249  * requests.
250  */
251 #define	IPSEC_REQ_DONE		0x80000000
252 /*
253  * Operation could not be performed by the AH/ESP
254  * module.
255  */
256 #define	IPSEC_REQ_FAILED	0x40000000
257 
258 /*
259  * Keysock consumer interface.
260  *
261  * The driver/module keysock (which is a driver to PF_KEY sockets, but is
262  * a module to 'consumers' like AH and ESP) uses keysock consumer interface
263  * messages to pass on PF_KEY messages to consumers who process and act upon
264  * them.
265  */
266 #define	KEYSOCK_IN		(IPSEC_M_CTL + 3)
267 #define	KEYSOCK_OUT		(IPSEC_M_CTL + 4)
268 #define	KEYSOCK_OUT_ERR		(IPSEC_M_CTL + 5)
269 #define	KEYSOCK_HELLO		(IPSEC_M_CTL + 6)
270 #define	KEYSOCK_HELLO_ACK	(IPSEC_M_CTL + 7)
271 
272 /*
273  * KEYSOCK_HELLO is sent by keysock to a consumer when it is pushed on top
274  * of one (i.e. opened as a module).
275  *
276  * NOTE: Keysock_hello is simply an ipsec_info_t
277  */
278 
279 /* TUN_HELLO is just like KEYSOCK_HELLO, except for tunnels to talk with IP. */
280 #define	TUN_HELLO		KEYSOCK_HELLO
281 
282 /*
283  * KEYSOCK_HELLO_ACK is sent by a consumer to acknowledge a KEYSOCK_HELLO.
284  * It contains the PF_KEYv2 sa_type, so keysock can redirect PF_KEY messages
285  * to the right consumer.
286  */
287 typedef struct keysock_hello_ack_s {
288 	uint32_t ks_hello_type;
289 	uint32_t ks_hello_len;
290 	uint8_t ks_hello_satype;	/* PF_KEYv2 sa_type of ks client */
291 } keysock_hello_ack_t;
292 
293 #define	KS_IN_ADDR_UNKNOWN 0
294 #define	KS_IN_ADDR_NOTTHERE 1
295 #define	KS_IN_ADDR_UNSPEC 2
296 #define	KS_IN_ADDR_ME 3
297 #define	KS_IN_ADDR_NOTME 4
298 #define	KS_IN_ADDR_MBCAST 5
299 #define	KS_IN_ADDR_DONTCARE 6
300 
301 /*
302  * KEYSOCK_IN is a PF_KEY message from a PF_KEY socket destined for a consumer.
303  */
304 typedef struct keysock_in_s {
305 	uint32_t ks_in_type;
306 	uint32_t ks_in_len;
307 	/*
308 	 * NOTE:	These pointers MUST be into the M_DATA that follows
309 	 *		this M_CTL message.  If they aren't, weirdness
310 	 *		results.
311 	 */
312 	struct sadb_ext *ks_in_extv[SADB_EXT_MAX + 1];
313 	int ks_in_srctype;	/* Source address type. */
314 	int ks_in_dsttype;	/* Dest address type. */
315 	minor_t ks_in_serial;	/* Serial # of sending socket. */
316 } keysock_in_t;
317 
318 /*
319  * KEYSOCK_OUT is a PF_KEY message from a consumer destined for a PF_KEY
320  * socket.
321  */
322 typedef struct keysock_out_s {
323 	uint32_t ks_out_type;
324 	uint32_t ks_out_len;
325 	minor_t ks_out_serial;	/* Serial # of sending socket. */
326 } keysock_out_t;
327 
328 /*
329  * KEYSOCK_OUT_ERR is sent to a consumer from keysock if for some reason
330  * keysock could not find a PF_KEY socket to deliver a consumer-originated
331  * message (e.g. SADB_ACQUIRE).
332  */
333 typedef struct keysock_out_err_s {
334 	uint32_t ks_err_type;
335 	uint32_t ks_err_len;
336 	minor_t ks_err_serial;
337 	int ks_err_errno;
338 	/*
339 	 * Other, richer error information may end up going here eventually.
340 	 */
341 } keysock_out_err_t;
342 
343 /*
344  * M_CTL message type for sending inbound pkt information between IP & ULP.
345  * These are _not_ related to IPsec in any way, but are here so that there is
346  * one place where all these values are defined which makes it easier to track.
347  * The choice of this value has the same rationale as explained above.
348  */
349 #define	IN_PKTINFO		(IPSEC_M_CTL + 24)
350 
351 
352 /*
353  * IPSEC_CTL messages are used by IPsec to send control type requests
354  * to IP. Such a control message is currently used by IPsec to request
355  * that IP send the contents of an IPsec SA or the entire SADB to
356  * every IPsec hardware acceleration capable provider.
357  */
358 
359 #define	IPSEC_CTL		(IPSEC_M_CTL + 25)
360 
361 typedef struct ipsec_ctl_s {
362 	uint32_t ipsec_ctl_type;
363 	uint32_t ipsec_ctl_len;
364 	uint_t ipsec_ctl_sa_type;
365 	void *ipsec_ctl_sa;
366 } ipsec_ctl_t;
367 
368 
369 /*
370  * All IPsec informational messages are placed into the ipsec_info_t
371  * union, so that allocation can be done once, and IPsec informational
372  * messages can be recycled.
373  */
374 typedef union ipsec_info_u {
375 	struct {
376 		uint32_t ipsec_allu_type;
377 		uint32_t ipsec_allu_len;	/* In bytes */
378 	} ipsec_allu;
379 	ipsec_in_t ipsec_in;
380 	ipsec_out_t ipsec_out;
381 	keysock_hello_ack_t keysock_hello_ack;
382 	keysock_in_t keysock_in;
383 	keysock_out_t keysock_out;
384 	keysock_out_err_t keysock_out_err;
385 	ipsec_ctl_t ipsec_ctl;
386 } ipsec_info_t;
387 #define	ipsec_info_type ipsec_allu.ipsec_allu_type
388 #define	ipsec_info_len ipsec_allu.ipsec_allu_len
389 
390 #ifdef	__cplusplus
391 }
392 #endif
393 
394 #endif	/* _INET_IPSEC_INFO_H */
395