1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _INET_IPSECAH_H 27 #define _INET_IPSECAH_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 #include <inet/ip.h> 32 #include <inet/ipdrop.h> 33 34 #ifdef __cplusplus 35 extern "C" { 36 #endif 37 38 #include <sys/note.h> 39 40 #ifdef _KERNEL 41 /* Named Dispatch Parameter Management Structure */ 42 typedef struct ipsecahparam_s { 43 uint_t ipsecah_param_min; 44 uint_t ipsecah_param_max; 45 uint_t ipsecah_param_value; 46 char *ipsecah_param_name; 47 } ipsecahparam_t; 48 49 /* 50 * Stats. This may eventually become a full-blown SNMP MIB once that spec 51 * stabilizes. 52 */ 53 typedef struct ah_kstats_s 54 { 55 kstat_named_t ah_stat_num_aalgs; 56 kstat_named_t ah_stat_good_auth; 57 kstat_named_t ah_stat_bad_auth; 58 kstat_named_t ah_stat_replay_failures; 59 kstat_named_t ah_stat_replay_early_failures; 60 kstat_named_t ah_stat_keysock_in; 61 kstat_named_t ah_stat_out_requests; 62 kstat_named_t ah_stat_acquire_requests; 63 kstat_named_t ah_stat_bytes_expired; 64 kstat_named_t ah_stat_out_discards; 65 kstat_named_t ah_stat_in_accelerated; 66 kstat_named_t ah_stat_out_accelerated; 67 kstat_named_t ah_stat_noaccel; 68 kstat_named_t ah_stat_crypto_sync; 69 kstat_named_t ah_stat_crypto_async; 70 kstat_named_t ah_stat_crypto_failures; 71 } ah_kstats_t; 72 73 /* 74 * ahstack->ah_kstats is equal to ahstack->ah_ksp->ks_data if 75 * kstat_create_netstack for ahstack->ah_ksp succeeds, but when it 76 * fails, it will be NULL. Note this is done for all stack instances, 77 * so it *could* fail. hence a non-NULL checking is done for 78 * AH_BUMP_STAT and AH_DEBUMP_STAT 79 */ 80 #define AH_BUMP_STAT(ahstack, x) \ 81 do { \ 82 if (ahstack->ah_kstats != NULL) \ 83 (ahstack->ah_kstats->ah_stat_ ## x).value.ui64++; \ 84 _NOTE(CONSTCOND) \ 85 } while (0) 86 #define AH_DEBUMP_STAT(ahstack, x) \ 87 do { \ 88 if (ahstack->ah_kstats != NULL) \ 89 (ahstack->ah_kstats->ah_stat_ ## x).value.ui64--; \ 90 _NOTE(CONSTCOND) \ 91 } while (0) 92 93 /* 94 * IPSECAH stack instances 95 */ 96 struct ipsecah_stack { 97 netstack_t *ipsecah_netstack; /* Common netstack */ 98 99 caddr_t ipsecah_g_nd; 100 ipsecahparam_t *ipsecah_params; 101 kmutex_t ipsecah_param_lock; /* Protects params */ 102 103 sadbp_t ah_sadb; 104 105 /* Packet dropper for AH drops. */ 106 ipdropper_t ah_dropper; 107 108 kstat_t *ah_ksp; 109 ah_kstats_t *ah_kstats; 110 111 /* 112 * Keysock instance of AH. There can be only one per stack instance. 113 * Use casptr() on this because I don't set it until KEYSOCK_HELLO 114 * comes down. 115 * Paired up with the ah_pfkey_q is the ah_event, which will age SAs. 116 */ 117 queue_t *ah_pfkey_q; 118 timeout_id_t ah_event; 119 120 mblk_t *ah_ip_unbind; 121 }; 122 typedef struct ipsecah_stack ipsecah_stack_t; 123 124 #endif /* _KERNEL */ 125 126 /* 127 * For now, only provide "aligned" version of header. 128 * If aligned version is needed, we'll go with the naming conventions then. 129 */ 130 131 typedef struct ah { 132 uint8_t ah_nexthdr; 133 uint8_t ah_length; 134 uint16_t ah_reserved; 135 uint32_t ah_spi; 136 uint32_t ah_replay; 137 } ah_t; 138 139 #define AH_BASELEN 12 140 #define AH_TOTAL_LEN(ah) (((ah)->ah_length << 2) + AH_BASELEN - \ 141 sizeof ((ah)->ah_replay)) 142 143 /* "Old" AH, without replay. For 1827-29 compatibility. */ 144 145 typedef struct ahold { 146 uint8_t ah_nexthdr; 147 uint8_t ah_length; 148 uint16_t ah_reserved; 149 uint32_t ah_spi; 150 } ahold_t; 151 152 #define AHOLD_BASELEN 8 153 #define AHOLD_TOTAL_LEN(ah) (((ah)->ah_length << 2) + AH_BASELEN) 154 155 #ifdef __cplusplus 156 } 157 #endif 158 159 #endif /* _INET_IPSECAH_H */ 160