1/*	$KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $	*/
2
3/*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#ifndef _NETKEY_KEYDB_H_
33#define _NETKEY_KEYDB_H_
34#include <sys/appleapiopts.h>
35
36#ifdef BSD_KERNEL_PRIVATE
37
38#include <netkey/key_var.h>
39#include <net/if_utun.h>
40
41/* Security Association Index */
42/* NOTE: Ensure to be same address family */
43struct secasindex {
44	struct sockaddr_storage src;	/* srouce address for SA */
45	struct sockaddr_storage dst;	/* destination address for SA */
46	u_int16_t proto;		/* IPPROTO_ESP or IPPROTO_AH */
47	u_int8_t mode;			/* mode of protocol, see ipsec.h */
48	u_int32_t reqid;		/* reqid id who owned this SA */
49					/* see IPSEC_MANUAL_REQID_MAX. */
50	u_int ipsec_ifindex;
51};
52
53/* Security Association Data Base */
54struct secashead {
55	LIST_ENTRY(secashead) chain;
56
57	struct secasindex saidx;
58
59	struct sadb_ident *idents;	/* source identity */
60	struct sadb_ident *identd;	/* destination identity */
61					/* XXX I don't know how to use them. */
62
63	ifnet_t ipsec_if;
64	u_int outgoing_if;
65	u_int8_t dir;                   /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */
66	u_int8_t state;			/* MATURE or DEAD. */
67	LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1];
68					/* SA chain */
69					/* The first of this list is newer SA */
70
71	struct route sa_route;		/* route cache */
72};
73
74typedef int (*utun_is_keepalive_func) __P((void *, void *, u_int16_t, u_int32_t, size_t));
75typedef int (*utun_input_func) __P((void *, void *, protocol_family_t family));
76
77/* Security Association */
78struct secasvar {
79	LIST_ENTRY(secasvar) chain;
80	LIST_ENTRY(secasvar) spihash;
81	int refcnt;			/* reference count */
82	u_int8_t state;			/* Status of this Association */
83
84	u_int8_t alg_auth;		/* Authentication Algorithm Identifier*/
85	u_int8_t alg_enc;		/* Cipher Algorithm Identifier */
86	u_int32_t spi;			/* SPI Value, network byte order */
87	u_int32_t flags;		/* holder for SADB_KEY_FLAGS */
88	u_int16_t flags2;		/* holder for SADB_SA2_KEY_FLAGS */
89
90	struct sadb_key *key_auth;	/* Key for Authentication */
91	struct sadb_key *key_enc;	/* Key for Encryption */
92	caddr_t iv;			/* Initilization Vector */
93	u_int ivlen;			/* length of IV */
94	void *sched;			/* intermediate encryption key */
95	size_t schedlen;
96
97	struct secreplay *replay;	/* replay prevention */
98	long created;			/* for lifetime */
99
100	struct sadb_lifetime *lft_c;	/* CURRENT lifetime, it's constant. */
101	struct sadb_lifetime *lft_h;	/* HARD lifetime */
102	struct sadb_lifetime *lft_s;	/* SOFT lifetime */
103
104	struct socket *so; /* Associated socket */
105
106	u_int32_t seq;			/* sequence number */
107	pid_t pid;			/* message's pid */
108
109	struct secashead *sah;		/* back pointer to the secashead */
110
111	/* Nat Traversal related bits */
112	u_int32_t	natt_last_activity;
113	u_int16_t	remote_ike_port;
114	u_int16_t	natt_encapsulated_src_port;	/* network byte order */
115	u_int16_t	natt_interval; /* Interval in seconds */
116
117	u_int8_t	always_expire; /* Send expire/delete messages even if unused */
118
119	void              *utun_pcb;
120	utun_is_keepalive_func    utun_is_keepalive_fn;
121	utun_input_func    utun_in_fn;
122};
123
124/* replay prevention */
125struct secreplay {
126	u_int32_t count;
127	u_int wsize;		/* window size, i.g. 4 bytes */
128	u_int32_t seq;		/* used by sender */
129	u_int32_t lastseq;	/* used by receiver */
130	caddr_t bitmap;		/* used by receiver */
131	int overflow;		/* overflow flag */
132};
133
134/* socket table due to send PF_KEY messages. */
135struct secreg {
136	LIST_ENTRY(secreg) chain;
137
138	struct socket *so;
139};
140
141#ifndef IPSEC_NONBLOCK_ACQUIRE
142/* acquiring list table. */
143struct secacq {
144	LIST_ENTRY(secacq) chain;
145
146	struct secasindex saidx;
147
148	u_int32_t seq;		/* sequence number */
149	long created;		/* for lifetime */
150	int count;		/* for lifetime */
151};
152#endif
153
154/* Sensitivity Level Specification */
155/* nothing */
156
157#define SADB_KILL_INTERVAL	600	/* six seconds */
158
159struct key_cb {
160	int key_count;
161	int any_count;
162};
163
164/* secpolicy */
165extern struct secpolicy *keydb_newsecpolicy(void);
166extern void keydb_delsecpolicy(struct secpolicy *);
167/* secashead */
168extern struct secashead *keydb_newsecashead(void);
169// extern void keydb_delsecashead(struct secashead *);	// not used
170/* secasvar */
171// extern struct secasvar *keydb_newsecasvar(void);		// not used
172// extern void keydb_refsecasvar(struct secasvar *);	// not used
173// extern void keydb_freesecasvar(struct secasvar *);	// not used
174/* secreplay */
175extern struct secreplay *keydb_newsecreplay(size_t);
176extern void keydb_delsecreplay(struct secreplay *);
177/* secreg */
178// extern struct secreg *keydb_newsecreg(void);			// not used
179// extern void keydb_delsecreg(struct secreg *);		// not used
180
181#endif /* BSD_KERNEL_PRIVATE */
182
183#endif /* _NETKEY_KEYDB_H_ */
184