1/* $Id: policy.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp $ */ 2 3/* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32#ifndef _POLICY_H 33#define _POLICY_H 34 35#include "racoon_types.h" 36#include <sys/queue.h> 37 38/* refs. ipsec.h */ 39/* 40 * Security Policy Index 41 * NOTE: Ensure to be same address family and upper layer protocol. 42 * NOTE: ul_proto, port number, uid, gid: 43 * ANY: reserved for waldcard. 44 * 0 to (~0 - 1): is one of the number of each value. 45 */ 46struct policyindex { 47 u_int8_t dir; /* direction of packet flow, see blow */ 48 struct sockaddr_storage src; /* IP src address for SP */ 49 struct sockaddr_storage dst; /* IP dst address for SP */ 50 u_int8_t prefs; /* prefix length in bits for src */ 51 u_int8_t prefd; /* prefix length in bits for dst */ 52 u_int16_t ul_proto; /* upper layer Protocol */ 53 u_int32_t priority; /* priority for the policy */ 54}; 55 56/* Security Policy Data Base */ 57struct secpolicy { 58 TAILQ_ENTRY(secpolicy) chain; 59 60 struct policyindex spidx; /* selector */ 61 u_int32_t id; /* It's unique number on the system. */ 62 63 u_int policy; /* DISCARD, NONE or IPSEC, see keyv2.h */ 64 struct ipsecrequest *req; 65 /* pointer to the ipsec request tree, */ 66 /* if policy == IPSEC else this value == NULL.*/ 67}; 68 69/* Security Assocciation Index */ 70/* NOTE: Ensure to be same address family */ 71struct secasindex { 72 struct sockaddr_storage src; /* srouce address for SA */ 73 struct sockaddr_storage dst; /* destination address for SA */ 74 u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ 75 u_int8_t mode; /* mode of protocol, see ipsec.h */ 76 u_int32_t reqid; /* reqid id who owned this SA */ 77 /* see IPSEC_MANUAL_REQID_MAX. */ 78}; 79 80/* Request for IPsec */ 81struct ipsecrequest { 82 struct ipsecrequest *next; 83 /* pointer to next structure */ 84 /* If NULL, it means the end of chain. */ 85 86 struct secasindex saidx;/* hint for search proper SA */ 87 /* if __ss_len == 0 then no address specified.*/ 88 u_int level; /* IPsec level defined below. */ 89 90 struct secpolicy *sp; /* back pointer to SP */ 91}; 92 93#ifdef HAVE_PFKEY_POLICY_PRIORITY 94#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, _priority, idx) \ 95do { \ 96 bzero((idx), sizeof(struct policyindex)); \ 97 (idx)->dir = (_dir); \ 98 (idx)->prefs = (ps); \ 99 (idx)->prefd = (pd); \ 100 (idx)->ul_proto = (ulp); \ 101 (idx)->priority = (_priority); \ 102 memcpy(&(idx)->src, (s), sysdep_sa_len((struct sockaddr *)(s))); \ 103 memcpy(&(idx)->dst, (d), sysdep_sa_len((struct sockaddr *)(d))); \ 104} while (0) 105#else 106#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, idx) \ 107do { \ 108 bzero((idx), sizeof(struct policyindex)); \ 109 (idx)->dir = (_dir); \ 110 (idx)->prefs = (ps); \ 111 (idx)->prefd = (pd); \ 112 (idx)->ul_proto = (ulp); \ 113 memcpy(&(idx)->src, (s), sysdep_sa_len((struct sockaddr *)(s))); \ 114 memcpy(&(idx)->dst, (d), sysdep_sa_len((struct sockaddr *)(d))); \ 115} while (0) 116#endif 117 118 119struct policyindex; 120extern struct secpolicy *getsp (struct policyindex *); 121extern struct secpolicy *getsp_r (struct policyindex *, phase2_handle_t *); 122struct secpolicy *getspbyspid (u_int32_t); 123extern int cmpspidxstrict (struct policyindex *, struct policyindex *); 124extern int cmpspidxwild (struct policyindex *, struct policyindex *); 125extern struct secpolicy *newsp (void); 126extern void delsp (struct secpolicy *); 127extern void delsp_bothdir (struct policyindex *); 128extern void inssp (struct secpolicy *); 129extern void remsp (struct secpolicy *); 130extern void flushsp (void); 131extern void initsp (void); 132extern struct ipsecrequest *newipsecreq (void); 133extern int policies_installed (void); 134 135extern const char *spidx2str (const struct policyindex *); 136 137#endif /* _POLICY_H */ 138