1/*	$KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $	*/
2
3/*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#ifndef _NETKEY_KEYDB_H_
33#define _NETKEY_KEYDB_H_
34#include <sys/appleapiopts.h>
35
36#ifdef KERNEL
37#ifdef KERNEL_PRIVATE
38
39#include <netkey/key_var.h>
40#include <net/if_utun.h>
41
42/* Security Assocciation Index */
43/* NOTE: Ensure to be same address family */
44struct secasindex {
45	struct sockaddr_storage src;	/* srouce address for SA */
46	struct sockaddr_storage dst;	/* destination address for SA */
47	u_int16_t proto;		/* IPPROTO_ESP or IPPROTO_AH */
48	u_int8_t mode;			/* mode of protocol, see ipsec.h */
49	u_int32_t reqid;		/* reqid id who owned this SA */
50					/* see IPSEC_MANUAL_REQID_MAX. */
51};
52
53/* Security Association Data Base */
54struct secashead {
55	LIST_ENTRY(secashead) chain;
56
57	struct secasindex saidx;
58
59	struct sadb_ident *idents;	/* source identity */
60	struct sadb_ident *identd;	/* destination identity */
61					/* XXX I don't know how to use them. */
62
63	u_int8_t dir;                   /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */
64	u_int8_t state;			/* MATURE or DEAD. */
65	LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1];
66					/* SA chain */
67					/* The first of this list is newer SA */
68
69	struct route sa_route;		/* route cache */
70};
71
72typedef int (*utun_is_keepalive_func) __P((void *, void *, u_int16_t, u_int32_t, size_t));
73typedef int (*utun_input_func) __P((void *, void *, protocol_family_t family));
74
75/* Security Association */
76struct secasvar {
77	LIST_ENTRY(secasvar) chain;
78	LIST_ENTRY(secasvar) spihash;
79	int refcnt;			/* reference count */
80	u_int8_t state;			/* Status of this Association */
81
82	u_int8_t alg_auth;		/* Authentication Algorithm Identifier*/
83	u_int8_t alg_enc;		/* Cipher Algorithm Identifier */
84	u_int32_t spi;			/* SPI Value, network byte order */
85	u_int32_t flags;		/* holder for SADB_KEY_FLAGS */
86
87	struct sadb_key *key_auth;	/* Key for Authentication */
88	struct sadb_key *key_enc;	/* Key for Encryption */
89	caddr_t iv;			/* Initilization Vector */
90	u_int ivlen;			/* length of IV */
91	void *sched;			/* intermediate encryption key */
92	size_t schedlen;
93
94	struct secreplay *replay;	/* replay prevention */
95	long created;			/* for lifetime */
96
97	struct sadb_lifetime *lft_c;	/* CURRENT lifetime, it's constant. */
98	struct sadb_lifetime *lft_h;	/* HARD lifetime */
99	struct sadb_lifetime *lft_s;	/* SOFT lifetime */
100
101	u_int32_t seq;			/* sequence number */
102	pid_t pid;			/* message's pid */
103
104	struct secashead *sah;		/* back pointer to the secashead */
105
106	/* Nat Traversal related bits */
107	u_int32_t	natt_last_activity;
108	u_int16_t	remote_ike_port;
109	u_int16_t	natt_encapsulated_src_port;	/* network byte order */
110
111	void              *utun_pcb;
112	utun_is_keepalive_func    utun_is_keepalive_fn;
113	utun_input_func    utun_in_fn;
114};
115
116/* replay prevention */
117struct secreplay {
118	u_int32_t count;
119	u_int wsize;		/* window size, i.g. 4 bytes */
120	u_int32_t seq;		/* used by sender */
121	u_int32_t lastseq;	/* used by receiver */
122	caddr_t bitmap;		/* used by receiver */
123	int overflow;		/* overflow flag */
124};
125
126/* socket table due to send PF_KEY messages. */
127struct secreg {
128	LIST_ENTRY(secreg) chain;
129
130	struct socket *so;
131};
132
133#ifndef IPSEC_NONBLOCK_ACQUIRE
134/* acquiring list table. */
135struct secacq {
136	LIST_ENTRY(secacq) chain;
137
138	struct secasindex saidx;
139
140	u_int32_t seq;		/* sequence number */
141	long created;		/* for lifetime */
142	int count;		/* for lifetime */
143};
144#endif
145
146/* Sensitivity Level Specification */
147/* nothing */
148
149#define SADB_KILL_INTERVAL	600	/* six seconds */
150
151struct key_cb {
152	int key_count;
153	int any_count;
154};
155
156/* secpolicy */
157extern struct secpolicy *keydb_newsecpolicy(void);
158extern void keydb_delsecpolicy(struct secpolicy *);
159/* secashead */
160extern struct secashead *keydb_newsecashead(void);
161// extern void keydb_delsecashead(struct secashead *);	// not used
162/* secasvar */
163// extern struct secasvar *keydb_newsecasvar(void);		// not used
164// extern void keydb_refsecasvar(struct secasvar *);	// not used
165// extern void keydb_freesecasvar(struct secasvar *);	// not used
166/* secreplay */
167extern struct secreplay *keydb_newsecreplay(size_t);
168extern void keydb_delsecreplay(struct secreplay *);
169/* secreg */
170// extern struct secreg *keydb_newsecreg(void);			// not used
171// extern void keydb_delsecreg(struct secreg *);		// not used
172
173#endif /* KERNEL_PRIVATE */
174#endif /* KERNEL */
175
176#endif /* _NETKEY_KEYDB_H_ */
177