1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved. 25 */ 26 27 #ifndef _INET_IPSECESP_H 28 #define _INET_IPSECESP_H 29 30 #include <inet/ip.h> 31 #include <inet/ipdrop.h> 32 33 #ifdef __cplusplus 34 extern "C" { 35 #endif 36 37 #ifdef _KERNEL 38 39 /* Named Dispatch Parameter Management Structure */ 40 typedef struct ipsecespparam_s { 41 uint_t ipsecesp_param_min; 42 uint_t ipsecesp_param_max; 43 uint_t ipsecesp_param_value; 44 char *ipsecesp_param_name; 45 } ipsecespparam_t; 46 47 /* 48 * Stats. This may eventually become a full-blown SNMP MIB once that spec 49 * stabilizes. 50 */ 51 52 typedef struct esp_kstats_s { 53 kstat_named_t esp_stat_num_aalgs; 54 kstat_named_t esp_stat_good_auth; 55 kstat_named_t esp_stat_bad_auth; 56 kstat_named_t esp_stat_bad_padding; 57 kstat_named_t esp_stat_replay_failures; 58 kstat_named_t esp_stat_replay_early_failures; 59 kstat_named_t esp_stat_keysock_in; 60 kstat_named_t esp_stat_out_requests; 61 kstat_named_t esp_stat_acquire_requests; 62 kstat_named_t esp_stat_bytes_expired; 63 kstat_named_t esp_stat_out_discards; 64 kstat_named_t esp_stat_crypto_sync; 65 kstat_named_t esp_stat_crypto_async; 66 kstat_named_t esp_stat_crypto_failures; 67 kstat_named_t esp_stat_num_ealgs; 68 kstat_named_t esp_stat_bad_decrypt; 69 kstat_named_t esp_stat_sa_port_renumbers; 70 } esp_kstats_t; 71 72 /* 73 * espstack->esp_kstats is equal to espstack->esp_ksp->ks_data if 74 * kstat_create_netstack for espstack->esp_ksp succeeds, but when it 75 * fails, it will be NULL. Note this is done for all stack instances, 76 * so it *could* fail. hence a non-NULL checking is done for 77 * ESP_BUMP_STAT and ESP_DEBUMP_STAT 78 */ 79 #define ESP_BUMP_STAT(espstack, x) \ 80 do { \ 81 if (espstack->esp_kstats != NULL) \ 82 (espstack->esp_kstats->esp_stat_ ## x).value.ui64++; \ 83 _NOTE(CONSTCOND) \ 84 } while (0) 85 86 #define ESP_DEBUMP_STAT(espstack, x) \ 87 do { \ 88 if (espstack->esp_kstats != NULL) \ 89 (espstack->esp_kstats->esp_stat_ ## x).value.ui64--; \ 90 _NOTE(CONSTCOND) \ 91 } while (0) 92 93 /* 94 * IPSECESP stack instances 95 */ 96 struct ipsecesp_stack { 97 netstack_t *ipsecesp_netstack; /* Common netstack */ 98 99 caddr_t ipsecesp_g_nd; 100 struct ipsecespparam_s *ipsecesp_params; 101 kmutex_t ipsecesp_param_lock; /* Protects params */ 102 103 /* Packet dropper for ESP drops. */ 104 ipdropper_t esp_dropper; 105 106 kstat_t *esp_ksp; 107 struct esp_kstats_s *esp_kstats; 108 109 /* 110 * Keysock instance of ESP. There can be only one per stack instance. 111 * Use atomic_cas_ptr() on this because I don't set it until 112 * KEYSOCK_HELLO comes down. 113 * Paired up with the esp_pfkey_q is the esp_event, which will age SAs. 114 */ 115 queue_t *esp_pfkey_q; 116 timeout_id_t esp_event; 117 118 sadbp_t esp_sadb; 119 }; 120 typedef struct ipsecesp_stack ipsecesp_stack_t; 121 122 #define ipsecesp_debug ipsecesp_params[0].ipsecesp_param_value 123 #define ipsecesp_age_interval ipsecesp_params[1].ipsecesp_param_value 124 #define ipsecesp_age_int_max ipsecesp_params[1].ipsecesp_param_max 125 #define ipsecesp_reap_delay ipsecesp_params[2].ipsecesp_param_value 126 #define ipsecesp_replay_size ipsecesp_params[3].ipsecesp_param_value 127 #define ipsecesp_acquire_timeout \ 128 ipsecesp_params[4].ipsecesp_param_value 129 #define ipsecesp_larval_timeout \ 130 ipsecesp_params[5].ipsecesp_param_value 131 #define ipsecesp_default_soft_bytes \ 132 ipsecesp_params[6].ipsecesp_param_value 133 #define ipsecesp_default_hard_bytes \ 134 ipsecesp_params[7].ipsecesp_param_value 135 #define ipsecesp_default_soft_addtime \ 136 ipsecesp_params[8].ipsecesp_param_value 137 #define ipsecesp_default_hard_addtime \ 138 ipsecesp_params[9].ipsecesp_param_value 139 #define ipsecesp_default_soft_usetime \ 140 ipsecesp_params[10].ipsecesp_param_value 141 #define ipsecesp_default_hard_usetime \ 142 ipsecesp_params[11].ipsecesp_param_value 143 #define ipsecesp_log_unknown_spi \ 144 ipsecesp_params[12].ipsecesp_param_value 145 #define ipsecesp_padding_check \ 146 ipsecesp_params[13].ipsecesp_param_value 147 #define ipsecesp_nat_keepalive_interval \ 148 ipsecesp_params[14].ipsecesp_param_value 149 150 #endif /* _KERNEL */ 151 152 /* 153 * For now, only provide "aligned" version of header. 154 * If aligned version is needed, we'll go with the naming conventions then. 155 */ 156 157 typedef struct esph { 158 uint32_t esph_spi; 159 uint32_t esph_replay; 160 } esph_t; 161 162 /* No need for "old" ESP, just point a uint32_t *. */ 163 164 #ifdef __cplusplus 165 } 166 #endif 167 168 #endif /* _INET_IPSECESP_H */ 169