keydb.h revision 303975
1139825Simp/* $FreeBSD: releng/11.0/sys/netipsec/keydb.h 286292 2015-08-04 17:47:11Z jmg $ */ 2137822Smarius/* $KAME: keydb.h,v 1.14 2000/08/02 17:58:26 sakane Exp $ */ 3137822Smarius 4137822Smarius/*- 5137822Smarius * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6137822Smarius * All rights reserved. 7137822Smarius * 8137822Smarius * Redistribution and use in source and binary forms, with or without 9137822Smarius * modification, are permitted provided that the following conditions 10137822Smarius * are met: 11137822Smarius * 1. Redistributions of source code must retain the above copyright 12137822Smarius * notice, this list of conditions and the following disclaimer. 13137822Smarius * 2. Redistributions in binary form must reproduce the above copyright 14137822Smarius * notice, this list of conditions and the following disclaimer in the 15137822Smarius * documentation and/or other materials provided with the distribution. 16137822Smarius * 3. Neither the name of the project nor the names of its contributors 17137822Smarius * may be used to endorse or promote products derived from this software 18137822Smarius * without specific prior written permission. 19137822Smarius * 20137822Smarius * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21137822Smarius * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22137822Smarius * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23137822Smarius * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24137822Smarius * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25137822Smarius * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26137822Smarius * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27137822Smarius * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28137822Smarius * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29137822Smarius * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30137822Smarius * SUCH DAMAGE. 31200915Smarius */ 32200915Smarius 33200915Smarius#ifndef _NETIPSEC_KEYDB_H_ 34200915Smarius#define _NETIPSEC_KEYDB_H_ 35200915Smarius 36137822Smarius#ifdef _KERNEL 37137822Smarius 38137822Smarius#include <netipsec/key_var.h> 39137822Smarius 40137822Smarius#ifndef _SOCKADDR_UNION_DEFINED 41137822Smarius#define _SOCKADDR_UNION_DEFINED 42137822Smarius/* 43137822Smarius * The union of all possible address formats we handle. 44146417Smarius */ 45137822Smariusunion sockaddr_union { 46146417Smarius struct sockaddr sa; 47137822Smarius struct sockaddr_in sin; 48137822Smarius struct sockaddr_in6 sin6; 49137822Smarius}; 50137822Smarius#endif /* _SOCKADDR_UNION_DEFINED */ 51137822Smarius 52137822Smarius/* Security Assocciation Index */ 53137822Smarius/* NOTE: Ensure to be same address family */ 54137822Smariusstruct secasindex { 55137822Smarius union sockaddr_union src; /* source address for SA */ 56137822Smarius union sockaddr_union dst; /* destination address for SA */ 57137822Smarius u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ 58170845Smarius u_int8_t mode; /* mode of protocol, see ipsec.h */ 59137822Smarius u_int32_t reqid; /* reqid id who owned this SA */ 60137822Smarius /* see IPSEC_MANUAL_REQID_MAX. */ 61137822Smarius}; 62137822Smarius 63170845Smarius/* 64170845Smarius * In order to split out the keydb implementation from that of the 65170845Smarius * PF_KEY sockets we need to define a few structures that while they 66170845Smarius * may seem common are likely to diverge over time. 67170845Smarius */ 68170845Smarius 69170845Smarius/* sadb_identity */ 70170845Smariusstruct secident { 71170845Smarius u_int16_t type; 72170845Smarius u_int64_t id; 73170845Smarius}; 74170845Smarius 75170845Smarius/* sadb_key */ 76137822Smariusstruct seckey { 77137822Smarius u_int16_t bits; 78170845Smarius char *key_data; 79170845Smarius}; 80137822Smarius 81170845Smariusstruct seclifetime { 82137822Smarius u_int32_t allocations; 83137822Smarius u_int64_t bytes; 84137822Smarius u_int64_t addtime; 85137822Smarius u_int64_t usetime; 86137822Smarius}; 87137822Smarius 88137822Smarius/* Security Association Data Base */ 89137822Smariusstruct secashead { 90137822Smarius LIST_ENTRY(secashead) chain; 91137822Smarius 92137822Smarius struct secasindex saidx; 93227848Smarius 94137822Smarius struct secident *idents; /* source identity */ 95137822Smarius struct secident *identd; /* destination identity */ 96137822Smarius /* XXX I don't know how to use them. */ 97137822Smarius 98137822Smarius u_int8_t state; /* MATURE or DEAD. */ 99137822Smarius LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1]; 100137822Smarius /* SA chain */ 101137822Smarius /* The first of this list is newer SA */ 102137822Smarius}; 103137822Smarius 104137822Smariusstruct xformsw; 105137822Smariusstruct enc_xform; 106137822Smariusstruct auth_hash; 107137822Smariusstruct comp_algo; 108137822Smarius 109137822Smarius/* Security Association */ 110137822Smariusstruct secasvar { 111137822Smarius LIST_ENTRY(secasvar) chain; 112137822Smarius struct mtx lock; /* update/access lock */ 113137822Smarius 114227848Smarius u_int refcnt; /* reference count */ 115137822Smarius u_int8_t state; /* Status of this Association */ 116137822Smarius 117137822Smarius u_int8_t alg_auth; /* Authentication Algorithm Identifier*/ 118137822Smarius u_int8_t alg_enc; /* Cipher Algorithm Identifier */ 119137822Smarius u_int8_t alg_comp; /* Compression Algorithm Identifier */ 120137822Smarius u_int32_t spi; /* SPI Value, network byte order */ 121137822Smarius u_int32_t flags; /* holder for SADB_KEY_FLAGS */ 122137822Smarius 123137822Smarius struct seckey *key_auth; /* Key for Authentication */ 124137822Smarius struct seckey *key_enc; /* Key for Encryption */ 125137822Smarius u_int ivlen; /* length of IV */ 126201008Smarius void *sched; /* intermediate encryption key */ 127201008Smarius size_t schedlen; 128170845Smarius uint64_t cntr; /* counter for GCM and CTR */ 129137822Smarius 130137822Smarius struct secreplay *replay; /* replay prevention */ 131137822Smarius time_t created; /* for lifetime */ 132170845Smarius 133137822Smarius struct seclifetime *lft_c; /* CURRENT lifetime, it's constant. */ 134200915Smarius struct seclifetime *lft_h; /* HARD lifetime */ 135200915Smarius struct seclifetime *lft_s; /* SOFT lifetime */ 136200915Smarius 137200915Smarius u_int32_t seq; /* sequence number */ 138170845Smarius pid_t pid; /* message's pid */ 139137822Smarius 140137822Smarius struct secashead *sah; /* back pointer to the secashead */ 141137822Smarius 142137822Smarius /* 143137822Smarius * NB: Fields with a tdb_ prefix are part of the "glue" used 144137822Smarius * to interface to the OpenBSD crypto support. This was done 145137822Smarius * to distinguish this code from the mainline KAME code. 146137822Smarius */ 147170845Smarius struct xformsw *tdb_xform; /* transform */ 148137822Smarius struct enc_xform *tdb_encalgxform; /* encoding algorithm */ 149137822Smarius struct auth_hash *tdb_authalgxform; /* authentication algorithm */ 150137822Smarius struct comp_algo *tdb_compalgxform; /* compression algorithm */ 151137822Smarius u_int64_t tdb_cryptoid; /* crypto session id */ 152137822Smarius 153137822Smarius /* 154137822Smarius * NAT-Traversal. 155170845Smarius */ 156137822Smarius u_int16_t natt_type; /* IKE/ESP-marker in output. */ 157137822Smarius u_int16_t natt_esp_frag_len; /* MTU for payload fragmentation. */ 158137822Smarius}; 159137822Smarius 160137822Smarius#define SECASVAR_LOCK_INIT(_sav) \ 161137822Smarius mtx_init(&(_sav)->lock, "ipsec association", NULL, MTX_DEF) 162137822Smarius#define SECASVAR_LOCK(_sav) mtx_lock(&(_sav)->lock) 163137822Smarius#define SECASVAR_UNLOCK(_sav) mtx_unlock(&(_sav)->lock) 164137822Smarius#define SECASVAR_LOCK_DESTROY(_sav) mtx_destroy(&(_sav)->lock) 165137822Smarius#define SECASVAR_LOCK_ASSERT(_sav) mtx_assert(&(_sav)->lock, MA_OWNED) 166137822Smarius#define SAV_ISGCM(_sav) \ 167137822Smarius ((_sav)->alg_enc == SADB_X_EALG_AESGCM8 || \ 168170845Smarius (_sav)->alg_enc == SADB_X_EALG_AESGCM12 || \ 169137822Smarius (_sav)->alg_enc == SADB_X_EALG_AESGCM16) 170137822Smarius#define SAV_ISCTR(_sav) ((_sav)->alg_enc == SADB_X_EALG_AESCTR) 171137822Smarius#define SAV_ISCTRORGCM(_sav) (SAV_ISCTR((_sav)) || SAV_ISGCM((_sav))) 172146982Smarius 173146417Smarius/* replay prevention */ 174170845Smariusstruct secreplay { 175170845Smarius u_int32_t count; 176170845Smarius u_int wsize; /* window size, i.g. 4 bytes */ 177146417Smarius u_int32_t seq; /* used by sender */ 178137822Smarius u_int32_t lastseq; /* used by receiver */ 179170845Smarius caddr_t bitmap; /* used by receiver */ 180170845Smarius int overflow; /* overflow flag */ 181137822Smarius}; 182146417Smarius 183146417Smarius/* socket table due to send PF_KEY messages. */ 184146417Smariusstruct secreg { 185137822Smarius LIST_ENTRY(secreg) chain; 186137822Smarius 187137822Smarius struct socket *so; 188137822Smarius}; 189170845Smarius 190170845Smarius/* acquiring list table. */ 191137822Smariusstruct secacq { 192137822Smarius LIST_ENTRY(secacq) chain; 193170845Smarius 194170845Smarius struct secasindex saidx; 195170845Smarius 196170845Smarius u_int32_t seq; /* sequence number */ 197137822Smarius time_t created; /* for lifetime */ 198170845Smarius int count; /* for lifetime */ 199170845Smarius}; 200170845Smarius 201170845Smarius/* Sensitivity Level Specification */ 202170845Smarius/* nothing */ 203170845Smarius 204170845Smarius#define SADB_KILL_INTERVAL 600 /* six seconds */ 205170845Smarius 206170845Smarius/* secpolicy */ 207170845Smariusextern struct secpolicy *keydb_newsecpolicy(void); 208170845Smariusextern void keydb_delsecpolicy(struct secpolicy *); 209170845Smarius/* secashead */ 210137822Smariusextern struct secashead *keydb_newsecashead(void); 211137822Smariusextern void keydb_delsecashead(struct secashead *); 212146417Smarius/* secasvar */ 213137822Smariusextern struct secasvar *keydb_newsecasvar(void); 214137822Smariusextern void keydb_refsecasvar(struct secasvar *); 215137822Smariusextern void keydb_freesecasvar(struct secasvar *); 216171553Sdwmalone/* secreplay */ 217171553Sdwmaloneextern struct secreplay *keydb_newsecreplay(size_t); 218171553Sdwmaloneextern void keydb_delsecreplay(struct secreplay *); 219171553Sdwmalone/* secreg */ 220171553Sdwmaloneextern struct secreg *keydb_newsecreg(void); 221170845Smariusextern void keydb_delsecreg(struct secreg *); 222137822Smarius 223137822Smarius#endif /* _KERNEL */ 224146417Smarius 225146417Smarius#endif /* _NETIPSEC_KEYDB_H_ */ 226170845Smarius