keydb.h (302408) | keydb.h (315514) |
---|---|
1/* $FreeBSD: stable/11/sys/netipsec/keydb.h 286292 2015-08-04 17:47:11Z jmg $ */ | 1/* $FreeBSD: stable/11/sys/netipsec/keydb.h 315514 2017-03-18 22:04:20Z ae $ */ |
2/* $KAME: keydb.h,v 1.14 2000/08/02 17:58:26 sakane Exp $ */ 3 4/*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions --- 19 unchanged lines hidden (view full) --- 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33#ifndef _NETIPSEC_KEYDB_H_ 34#define _NETIPSEC_KEYDB_H_ 35 36#ifdef _KERNEL | 2/* $KAME: keydb.h,v 1.14 2000/08/02 17:58:26 sakane Exp $ */ 3 4/*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions --- 19 unchanged lines hidden (view full) --- 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33#ifndef _NETIPSEC_KEYDB_H_ 34#define _NETIPSEC_KEYDB_H_ 35 36#ifdef _KERNEL |
37#include <sys/counter.h> 38#include <sys/lock.h> 39#include <sys/mutex.h> |
|
37 38#include <netipsec/key_var.h> 39 40#ifndef _SOCKADDR_UNION_DEFINED 41#define _SOCKADDR_UNION_DEFINED 42/* 43 * The union of all possible address formats we handle. 44 */ --- 4 unchanged lines hidden (view full) --- 49}; 50#endif /* _SOCKADDR_UNION_DEFINED */ 51 52/* Security Assocciation Index */ 53/* NOTE: Ensure to be same address family */ 54struct secasindex { 55 union sockaddr_union src; /* source address for SA */ 56 union sockaddr_union dst; /* destination address for SA */ | 40 41#include <netipsec/key_var.h> 42 43#ifndef _SOCKADDR_UNION_DEFINED 44#define _SOCKADDR_UNION_DEFINED 45/* 46 * The union of all possible address formats we handle. 47 */ --- 4 unchanged lines hidden (view full) --- 52}; 53#endif /* _SOCKADDR_UNION_DEFINED */ 54 55/* Security Assocciation Index */ 56/* NOTE: Ensure to be same address family */ 57struct secasindex { 58 union sockaddr_union src; /* source address for SA */ 59 union sockaddr_union dst; /* destination address for SA */ |
57 u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ 58 u_int8_t mode; /* mode of protocol, see ipsec.h */ 59 u_int32_t reqid; /* reqid id who owned this SA */ | 60 uint8_t proto; /* IPPROTO_ESP or IPPROTO_AH */ 61 uint8_t mode; /* mode of protocol, see ipsec.h */ 62 uint32_t reqid; /* reqid id who owned this SA */ |
60 /* see IPSEC_MANUAL_REQID_MAX. */ 61}; 62 63/* 64 * In order to split out the keydb implementation from that of the 65 * PF_KEY sockets we need to define a few structures that while they 66 * may seem common are likely to diverge over time. 67 */ --- 12 unchanged lines hidden (view full) --- 80 81struct seclifetime { 82 u_int32_t allocations; 83 u_int64_t bytes; 84 u_int64_t addtime; 85 u_int64_t usetime; 86}; 87 | 63 /* see IPSEC_MANUAL_REQID_MAX. */ 64}; 65 66/* 67 * In order to split out the keydb implementation from that of the 68 * PF_KEY sockets we need to define a few structures that while they 69 * may seem common are likely to diverge over time. 70 */ --- 12 unchanged lines hidden (view full) --- 83 84struct seclifetime { 85 u_int32_t allocations; 86 u_int64_t bytes; 87 u_int64_t addtime; 88 u_int64_t usetime; 89}; 90 |
91struct secnatt { 92 union sockaddr_union oai; /* original addresses of initiator */ 93 union sockaddr_union oar; /* original address of responder */ 94 uint16_t sport; /* source port */ 95 uint16_t dport; /* destination port */ 96 uint16_t cksum; /* checksum delta */ 97 uint16_t flags; 98#define IPSEC_NATT_F_OAI 0x0001 99#define IPSEC_NATT_F_OAR 0x0002 100}; 101 |
|
88/* Security Association Data Base */ | 102/* Security Association Data Base */ |
103TAILQ_HEAD(secasvar_queue, secasvar); |
|
89struct secashead { | 104struct secashead { |
90 LIST_ENTRY(secashead) chain; | 105 TAILQ_ENTRY(secashead) chain; 106 LIST_ENTRY(secashead) addrhash; /* hash by sproto+src+dst addresses */ 107 LIST_ENTRY(secashead) drainq; /* used ONLY by flush callout */ |
91 92 struct secasindex saidx; 93 94 struct secident *idents; /* source identity */ 95 struct secident *identd; /* destination identity */ 96 /* XXX I don't know how to use them. */ 97 | 108 109 struct secasindex saidx; 110 111 struct secident *idents; /* source identity */ 112 struct secident *identd; /* destination identity */ 113 /* XXX I don't know how to use them. */ 114 |
98 u_int8_t state; /* MATURE or DEAD. */ 99 LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1]; 100 /* SA chain */ 101 /* The first of this list is newer SA */ | 115 volatile u_int refcnt; /* reference count */ 116 uint8_t state; /* MATURE or DEAD. */ 117 struct secasvar_queue savtree_alive; /* MATURE and DYING SA */ 118 struct secasvar_queue savtree_larval; /* LARVAL SA */ |
102}; 103 104struct xformsw; 105struct enc_xform; 106struct auth_hash; 107struct comp_algo; 108 | 119}; 120 121struct xformsw; 122struct enc_xform; 123struct auth_hash; 124struct comp_algo; 125 |
109/* Security Association */ | 126/* 127 * Security Association 128 * 129 * For INBOUND packets we do SA lookup using SPI, thus only SPIHASH is used. 130 * For OUTBOUND packets there may be several SA suitable for packet. 131 * We use key_preferred_oldsa variable to choose better SA. First of we do 132 * lookup for suitable SAH using packet's saidx. Then we use SAH's savtree 133 * to search better candidate. The newer SA (by created time) are placed 134 * in the beginning of the savtree list. There is no preference between 135 * DYING and MATURE. 136 * 137 * NB: Fields with a tdb_ prefix are part of the "glue" used 138 * to interface to the OpenBSD crypto support. This was done 139 * to distinguish this code from the mainline KAME code. 140 * NB: Fields are sorted on the basis of the frequency of changes, i.e. 141 * constants and unchangeable fields are going first. 142 * NB: if you want to change this structure, check that this will not break 143 * key_updateaddresses(). 144 */ |
110struct secasvar { | 145struct secasvar { |
111 LIST_ENTRY(secasvar) chain; 112 struct mtx lock; /* update/access lock */ | 146 uint32_t spi; /* SPI Value, network byte order */ 147 uint32_t flags; /* holder for SADB_KEY_FLAGS */ 148 uint32_t seq; /* sequence number */ 149 pid_t pid; /* message's pid */ 150 u_int ivlen; /* length of IV */ |
113 | 151 |
114 u_int refcnt; /* reference count */ 115 u_int8_t state; /* Status of this Association */ 116 117 u_int8_t alg_auth; /* Authentication Algorithm Identifier*/ 118 u_int8_t alg_enc; /* Cipher Algorithm Identifier */ 119 u_int8_t alg_comp; /* Compression Algorithm Identifier */ 120 u_int32_t spi; /* SPI Value, network byte order */ 121 u_int32_t flags; /* holder for SADB_KEY_FLAGS */ 122 | 152 struct secashead *sah; /* back pointer to the secashead */ |
123 struct seckey *key_auth; /* Key for Authentication */ 124 struct seckey *key_enc; /* Key for Encryption */ | 153 struct seckey *key_auth; /* Key for Authentication */ 154 struct seckey *key_enc; /* Key for Encryption */ |
125 u_int ivlen; /* length of IV */ 126 void *sched; /* intermediate encryption key */ 127 size_t schedlen; 128 uint64_t cntr; /* counter for GCM and CTR */ 129 | |
130 struct secreplay *replay; /* replay prevention */ | 155 struct secreplay *replay; /* replay prevention */ |
131 time_t created; /* for lifetime */ | 156 struct secnatt *natt; /* NAT-T config */ 157 struct mtx *lock; /* update/access lock */ |
132 | 158 |
133 struct seclifetime *lft_c; /* CURRENT lifetime, it's constant. */ | 159 const struct xformsw *tdb_xform; /* transform */ 160 const struct enc_xform *tdb_encalgxform;/* encoding algorithm */ 161 const struct auth_hash *tdb_authalgxform;/* authentication algorithm */ 162 const struct comp_algo *tdb_compalgxform;/* compression algorithm */ 163 uint64_t tdb_cryptoid; /* crypto session id */ 164 165 uint8_t alg_auth; /* Authentication Algorithm Identifier*/ 166 uint8_t alg_enc; /* Cipher Algorithm Identifier */ 167 uint8_t alg_comp; /* Compression Algorithm Identifier */ 168 uint8_t state; /* Status of this SA (pfkeyv2.h) */ 169 170 counter_u64_t lft_c; /* CURRENT lifetime */ 171#define lft_c_allocations lft_c 172#define lft_c_bytes lft_c + 1 |
134 struct seclifetime *lft_h; /* HARD lifetime */ 135 struct seclifetime *lft_s; /* SOFT lifetime */ 136 | 173 struct seclifetime *lft_h; /* HARD lifetime */ 174 struct seclifetime *lft_s; /* SOFT lifetime */ 175 |
137 u_int32_t seq; /* sequence number */ 138 pid_t pid; /* message's pid */ | 176 uint64_t created; /* time when SA was created */ 177 uint64_t firstused; /* time when SA was first used */ |
139 | 178 |
140 struct secashead *sah; /* back pointer to the secashead */ | 179 TAILQ_ENTRY(secasvar) chain; 180 LIST_ENTRY(secasvar) spihash; 181 LIST_ENTRY(secasvar) drainq; /* used ONLY by flush callout */ |
141 | 182 |
142 /* 143 * NB: Fields with a tdb_ prefix are part of the "glue" used 144 * to interface to the OpenBSD crypto support. This was done 145 * to distinguish this code from the mainline KAME code. 146 */ 147 struct xformsw *tdb_xform; /* transform */ 148 struct enc_xform *tdb_encalgxform; /* encoding algorithm */ 149 struct auth_hash *tdb_authalgxform; /* authentication algorithm */ 150 struct comp_algo *tdb_compalgxform; /* compression algorithm */ 151 u_int64_t tdb_cryptoid; /* crypto session id */ 152 153 /* 154 * NAT-Traversal. 155 */ 156 u_int16_t natt_type; /* IKE/ESP-marker in output. */ 157 u_int16_t natt_esp_frag_len; /* MTU for payload fragmentation. */ | 183 uint64_t cntr; /* counter for GCM and CTR */ 184 volatile u_int refcnt; /* reference count */ |
158}; 159 | 185}; 186 |
160#define SECASVAR_LOCK_INIT(_sav) \ 161 mtx_init(&(_sav)->lock, "ipsec association", NULL, MTX_DEF) 162#define SECASVAR_LOCK(_sav) mtx_lock(&(_sav)->lock) 163#define SECASVAR_UNLOCK(_sav) mtx_unlock(&(_sav)->lock) 164#define SECASVAR_LOCK_DESTROY(_sav) mtx_destroy(&(_sav)->lock) 165#define SECASVAR_LOCK_ASSERT(_sav) mtx_assert(&(_sav)->lock, MA_OWNED) | 187#define SECASVAR_LOCK(_sav) mtx_lock((_sav)->lock) 188#define SECASVAR_UNLOCK(_sav) mtx_unlock((_sav)->lock) 189#define SECASVAR_LOCK_ASSERT(_sav) mtx_assert((_sav)->lock, MA_OWNED) |
166#define SAV_ISGCM(_sav) \ 167 ((_sav)->alg_enc == SADB_X_EALG_AESGCM8 || \ 168 (_sav)->alg_enc == SADB_X_EALG_AESGCM12 || \ 169 (_sav)->alg_enc == SADB_X_EALG_AESGCM16) 170#define SAV_ISCTR(_sav) ((_sav)->alg_enc == SADB_X_EALG_AESCTR) 171#define SAV_ISCTRORGCM(_sav) (SAV_ISCTR((_sav)) || SAV_ISGCM((_sav))) 172 | 190#define SAV_ISGCM(_sav) \ 191 ((_sav)->alg_enc == SADB_X_EALG_AESGCM8 || \ 192 (_sav)->alg_enc == SADB_X_EALG_AESGCM12 || \ 193 (_sav)->alg_enc == SADB_X_EALG_AESGCM16) 194#define SAV_ISCTR(_sav) ((_sav)->alg_enc == SADB_X_EALG_AESCTR) 195#define SAV_ISCTRORGCM(_sav) (SAV_ISCTR((_sav)) || SAV_ISGCM((_sav))) 196 |
173/* replay prevention */ | 197/* Replay prevention, protected by SECASVAR_LOCK: 198 * (m) locked by mtx 199 * (c) read only except during creation / free 200 */ |
174struct secreplay { | 201struct secreplay { |
175 u_int32_t count; 176 u_int wsize; /* window size, i.g. 4 bytes */ 177 u_int32_t seq; /* used by sender */ 178 u_int32_t lastseq; /* used by receiver */ 179 caddr_t bitmap; /* used by receiver */ 180 int overflow; /* overflow flag */ | 202 u_int32_t count; /* (m) */ 203 u_int wsize; /* (c) window size, i.g. 4 bytes */ 204 u_int32_t seq; /* (m) used by sender */ 205 u_int32_t lastseq; /* (m) used by receiver */ 206 u_int32_t *bitmap; /* (m) used by receiver */ 207 u_int bitmap_size; /* (c) size of the bitmap array */ 208 int overflow; /* (m) overflow flag */ |
181}; 182 183/* socket table due to send PF_KEY messages. */ 184struct secreg { 185 LIST_ENTRY(secreg) chain; 186 187 struct socket *so; 188}; 189 190/* acquiring list table. */ 191struct secacq { 192 LIST_ENTRY(secacq) chain; | 209}; 210 211/* socket table due to send PF_KEY messages. */ 212struct secreg { 213 LIST_ENTRY(secreg) chain; 214 215 struct socket *so; 216}; 217 218/* acquiring list table. */ 219struct secacq { 220 LIST_ENTRY(secacq) chain; |
221 LIST_ENTRY(secacq) addrhash; 222 LIST_ENTRY(secacq) seqhash; |
|
193 194 struct secasindex saidx; | 223 224 struct secasindex saidx; |
195 196 u_int32_t seq; /* sequence number */ | 225 uint32_t seq; /* sequence number */ |
197 time_t created; /* for lifetime */ 198 int count; /* for lifetime */ 199}; 200 201/* Sensitivity Level Specification */ 202/* nothing */ 203 204#define SADB_KILL_INTERVAL 600 /* six seconds */ --- 21 unchanged lines hidden --- | 226 time_t created; /* for lifetime */ 227 int count; /* for lifetime */ 228}; 229 230/* Sensitivity Level Specification */ 231/* nothing */ 232 233#define SADB_KILL_INTERVAL 600 /* six seconds */ --- 21 unchanged lines hidden --- |