ip_ipsp.h revision 1.42
1/* $OpenBSD: ip_ipsp.h,v 1.42 1999/09/29 09:11:21 niklas Exp $ */ 2 3/* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr), 6 * Niels Provos (provos@physnet.uni-hamburg.de) and 7 * Niklas Hallqvist (niklas@appli.se). 8 * 9 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 10 * in November 1995. 11 * 12 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 13 * by Angelos D. Keromytis. 14 * 15 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 16 * and Niels Provos. 17 * 18 * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist. 19 * 20 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 21 * Angelos D. Keromytis and Niels Provos. 22 * Copyright (c) 1999 Niklas Hallqvist. 23 * 24 * Permission to use, copy, and modify this software without fee 25 * is hereby granted, provided that this entire notice is included in 26 * all copies of any software which is or includes a copy or 27 * modification of this software. 28 * You may use this code under the GNU public license if you so wish. Please 29 * contribute changes back to the authors under this freer than GPL license 30 * so that we may further the use of strong encryption without limitations to 31 * all. 32 * 33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 37 * PURPOSE. 38 */ 39 40#ifndef _NETINET_IPSP_H_ 41#define _NETINET_IPSP_H_ 42 43/* 44 * IPSP global definitions. 45 */ 46 47#include <sys/types.h> 48#include <sys/queue.h> 49#include <netinet/in.h> 50#include <sys/md5k.h> 51#include <netinet/ip_sha1.h> 52#include <netinet/ip_rmd160.h> 53#include <netinet/ip_blf.h> 54#include <netinet/ip_cast.h> 55#include <netinet/ip_skipjack.h> 56 57union sockaddr_union 58{ 59 struct sockaddr sa; 60 struct sockaddr_in sin; 61 struct sockaddr_in6 sin6; 62}; 63 64/* HMAC key sizes */ 65#define MD5HMAC96_KEYSIZE 16 66#define SHA1HMAC96_KEYSIZE 20 67#define RIPEMD160HMAC96_KEYSIZE 20 68 69/* IV lengths */ 70#define ESP_DES_IVS 8 71#define ESP_3DES_IVS 8 72#define ESP_BLF_IVS 8 73#define ESP_CAST_IVS 8 74#define ESP_SKIPJACK_IVS 8 75#define ESP_MAX_IVS 8 /* Keep updated */ 76 77/* Block sizes -- it is assumed that they're powers of 2 */ 78#define ESP_DES_BLKS 8 79#define ESP_3DES_BLKS 8 80#define ESP_BLF_BLKS 8 81#define ESP_CAST_BLKS 8 82#define ESP_SKIPJACK_BLKS 8 83#define ESP_MAX_BLKS 8 /* Keep updated */ 84 85#define HMAC_BLOCK_LEN 64 86 87#define AH_HMAC_HASHLEN 12 /* 96 bits of authenticator */ 88#define AH_HMAC_RPLENGTH 4 /* 32 bits of replay counter */ 89#define AH_HMAC_INITIAL_RPL 1 /* Replay counter initial value */ 90 91/* HMAC definitions */ 92#define HMAC_IPAD_VAL 0x36 93#define HMAC_OPAD_VAL 0x5C 94#define HMAC_BLOCK_LEN 64 95 96/* Authenticator lengths */ 97#define AH_MD5_ALEN 16 98#define AH_SHA1_ALEN 20 99#define AH_RMD160_ALEN 20 100#define AH_ALEN_MAX 20 /* Keep updated */ 101 102/* Reserved SPI numbers */ 103#define SPI_LOCAL_USE 0 104#define SPI_RESERVED_MIN 1 105#define SPI_RESERVED_MAX 255 106 107struct sockaddr_encap 108{ 109 u_int8_t sen_len; /* length */ 110 u_int8_t sen_family; /* PF_KEY */ 111 u_int16_t sen_type; /* see SENT_* */ 112 union 113 { 114 u_int8_t Data[16]; /* other stuff mapped here */ 115 116 struct /* SENT_IP4 */ 117 { 118 struct in_addr Src; 119 struct in_addr Dst; 120 u_int16_t Sport; 121 u_int16_t Dport; 122 u_int8_t Proto; 123 u_int8_t Filler[3]; 124 } Sip4; 125 126 struct /* SENT_IPSP */ 127 { 128 struct in_addr Dst; 129 u_int32_t Spi; 130 u_int8_t Sproto; 131 u_int8_t Filler[7]; 132 } Sipsp; 133 } Sen; 134}; 135 136#define sen_data Sen.Data 137#define sen_ip_src Sen.Sip4.Src 138#define sen_ip_dst Sen.Sip4.Dst 139#define sen_proto Sen.Sip4.Proto 140#define sen_sport Sen.Sip4.Sport 141#define sen_dport Sen.Sip4.Dport 142#define sen_ipsp_dst Sen.Sipsp.Dst 143#define sen_ipsp_spi Sen.Sipsp.Spi 144#define sen_ipsp_sproto Sen.Sipsp.Sproto 145 146/* 147 * The "type" is really part of the address as far as the routing 148 * system is concerned. By using only one bit in the type field 149 * for each type, we sort-of make sure that different types of 150 * encapsulation addresses won't be matched against the wrong type. 151 * 152 */ 153 154#define SENT_IP4 0x0001 /* data is two struct in_addr */ 155#define SENT_IPSP 0x0002 /* data as in IP4 plus SPI */ 156 157/* 158 * SENT_HDRLEN is the length of the "header" 159 * SENT_*_LEN are the lengths of various forms of sen_data 160 * SENT_*_OFF are the offsets in the sen_data array of various fields 161 */ 162 163#define SENT_HDRLEN (2 * sizeof(u_int8_t) + sizeof(u_int16_t)) 164 165#define SENT_IP4_SRCOFF (0) 166#define SENT_IP4_DSTOFF (sizeof (struct in_addr)) 167 168#define SENT_IP4_LEN 20 169#define SENT_IPSP_LEN 20 170 171#define NOTIFY_SOFT_EXPIRE 0 /* Soft expiration of SA */ 172#define NOTIFY_HARD_EXPIRE 1 /* Hard expiration of SA */ 173#define NOTIFY_REQUEST_SA 2 /* Establish an SA */ 174 175#define NOTIFY_SATYPE_CONF 1 /* SA should do encryption */ 176#define NOTIFY_SATYPE_AUTH 2 /* SA should do authentication */ 177#define NOTIFY_SATYPE_TUNNEL 4 /* SA should use tunneling */ 178 179/* 180 * For encapsulation routes are possible not only for the destination 181 * address but also for the protocol, source and destination ports 182 * if available 183 */ 184 185struct route_enc { 186 struct rtentry *re_rt; 187 struct sockaddr_encap re_dst; 188}; 189 190struct flow 191{ 192 struct flow *flow_next; /* Next in flow chain */ 193 struct flow *flow_prev; /* Previous in flow chain */ 194 struct tdb *flow_sa; /* Pointer to the SA */ 195 union sockaddr_union flow_src; /* Source address */ 196 union sockaddr_union flow_srcmask; /* Source netmask */ 197 union sockaddr_union flow_dst; /* Destination address */ 198 union sockaddr_union flow_dstmask; /* Destination netmask */ 199 u_int8_t flow_proto; /* Transport protocol, if applicable */ 200 u_int8_t foo[3]; /* Alignment */ 201}; 202 203struct tdb /* tunnel descriptor block */ 204{ 205 struct tdb *tdb_hnext; /* Next in hash chain */ 206 struct tdb *tdb_onext; /* Next in output */ 207 struct tdb *tdb_inext; /* Previous in output */ 208 209 struct xformsw *tdb_xform; /* Transformation to use */ 210 struct enc_xform *tdb_encalgxform; /* Encryption algorithm xform */ 211 struct auth_hash *tdb_authalgxform; /* Authentication algorithm xform */ 212 213#define TDBF_UNIQUE 0x00001 /* This should not be used by others */ 214#define TDBF_TIMER 0x00002 /* Absolute expiration timer in use */ 215#define TDBF_BYTES 0x00004 /* Check the byte counters */ 216#define TDBF_ALLOCATIONS 0x00008 /* Check the flows counters */ 217#define TDBF_INVALID 0x00010 /* This SPI is not valid yet/anymore */ 218#define TDBF_FIRSTUSE 0x00020 /* Expire after first use */ 219#define TDBF_HALFIV 0x00040 /* Use half-length IV (ESP old only) */ 220#define TDBF_SOFT_TIMER 0x00080 /* Soft expiration */ 221#define TDBF_SOFT_BYTES 0x00100 /* Soft expiration */ 222#define TDBF_SOFT_ALLOCATIONS 0x00200 /* Soft expiration */ 223#define TDBF_SOFT_FIRSTUSE 0x00400 /* Soft expiration */ 224#define TDBF_PFS 0x00800 /* Ask for PFS from Key Mgmt. */ 225#define TDBF_TUNNELING 0x01000 /* Force IP-IP encapsulation */ 226 u_int32_t tdb_flags; /* Flags related to this TDB */ 227 228 TAILQ_ENTRY(tdb) tdb_expnext; /* Expiration cluster list link */ 229 TAILQ_ENTRY(tdb) tdb_explink; /* Expiration ordered list link */ 230 231 u_int32_t tdb_exp_allocations; /* Expire after so many flows */ 232 u_int32_t tdb_soft_allocations; /* Expiration warning */ 233 u_int32_t tdb_cur_allocations; /* Total number of allocations */ 234 235 u_int64_t tdb_exp_bytes; /* Expire after so many bytes passed */ 236 u_int64_t tdb_soft_bytes; /* Expiration warning */ 237 u_int64_t tdb_cur_bytes; /* Current count of bytes */ 238 239 u_int64_t tdb_exp_timeout; /* When does the SPI expire */ 240 u_int64_t tdb_soft_timeout; /* Send a soft-expire warning */ 241 u_int64_t tdb_established; /* When was the SPI established */ 242 u_int64_t tdb_timeout; /* Next absolute expiration time. */ 243 244 u_int64_t tdb_first_use; /* When was it first used */ 245 u_int64_t tdb_soft_first_use; /* Soft warning */ 246 u_int64_t tdb_exp_first_use; /* Expire if tdb_first_use + 247 * tdb_exp_first_use <= curtime */ 248 249 u_int32_t tdb_spi; /* SPI */ 250 u_int16_t tdb_amxkeylen; /* AH-old only */ 251 u_int16_t tdb_ivlen; /* IV length */ 252 u_int8_t tdb_sproto; /* IPsec protocol */ 253 u_int8_t tdb_wnd; /* Replay window */ 254 u_int8_t tdb_satype; /* SA type (RFC2367, PF_KEY) */ 255 u_int8_t tdb_FILLER; /* Padding */ 256 257 union sockaddr_union tdb_dst; /* Destination address for this SA */ 258 union sockaddr_union tdb_src; /* Source address for this SA */ 259 union sockaddr_union tdb_proxy; 260 261 u_int8_t *tdb_key; /* Key material (schedules) */ 262 u_int8_t *tdb_ictx; /* Authentication contexts */ 263 u_int8_t *tdb_octx; 264 u_int8_t *tdb_srcid; /* Source ID for this SA */ 265 u_int8_t *tdb_dstid; /* Destination ID for this SA */ 266 u_int8_t *tdb_amxkey; /* AH-old only */ 267 268 union 269 { 270 u_int8_t Iv[ESP_3DES_IVS]; /* That's enough space */ 271 u_int32_t Ivl; /* Make sure this is 4 bytes */ 272 u_int64_t Ivq; /* Make sure this is 8 bytes! */ 273 }IV; 274#define tdb_iv IV.Iv 275#define tdb_ivl IV.Ivl 276#define tdb_ivq IV.Ivq 277 278 u_int32_t tdb_rpl; /* Replay counter */ 279 u_int32_t tdb_bitmap; /* Used for replay sliding window */ 280 u_int32_t tdb_initial; /* Initial replay value */ 281 282 u_int32_t tdb_epoch; /* Used by the kernfs interface */ 283 u_int16_t tdb_srcid_len; 284 u_int16_t tdb_dstid_len; 285 u_int16_t tdb_srcid_type; 286 u_int16_t tdb_dstid_type; 287 288 struct flow *tdb_flow; /* Which flows use this SA */ 289 290 struct tdb *tdb_bind_out; /* Outgoing SA to use */ 291 TAILQ_HEAD(tdb_bind_head, tdb) tdb_bind_in; 292 TAILQ_ENTRY(tdb) tdb_bind_in_next; /* Refering Incoming SAs */ 293 TAILQ_HEAD(tdb_inp_head, inpcb) tdb_inp; 294}; 295 296union authctx_old { 297 MD5_CTX md5ctx; 298 SHA1_CTX sha1ctx; 299}; 300 301union authctx { 302 MD5_CTX md5ctx; 303 SHA1_CTX sha1ctx; 304 RMD160_CTX rmd160ctx; 305}; 306 307struct tdb_ident { 308 u_int32_t spi; 309 union sockaddr_union dst; 310 u_int8_t proto; 311}; 312 313struct auth_hash { 314 int type; 315 char *name; 316 u_int16_t keysize; 317 u_int16_t hashsize; 318 u_int16_t ctxsize; 319 void (*Init)(void *); 320 void (*Update)(void *, u_int8_t *, u_int16_t); 321 void (*Final)(u_int8_t *, void *); 322}; 323 324struct enc_xform { 325 int type; 326 char *name; 327 u_int16_t blocksize, ivsize; 328 u_int16_t minkey, maxkey; 329 u_int32_t ivmask; /* Or all possible modes, zero iv = 1 */ 330 void (*encrypt)(struct tdb *, u_int8_t *); 331 void (*decrypt)(struct tdb *, u_int8_t *); 332 void (*setkey)(u_int8_t **, u_int8_t *, int len); 333 void (*zerokey)(u_int8_t **); 334}; 335 336struct ipsecinit 337{ 338 u_int8_t *ii_enckey; 339 u_int8_t *ii_authkey; 340 u_int16_t ii_enckeylen; 341 u_int16_t ii_authkeylen; 342 u_int8_t ii_encalg; 343 u_int8_t ii_authalg; 344}; 345 346struct xformsw 347{ 348 u_short xf_type; /* Unique ID of xform */ 349 u_short xf_flags; /* flags (see below) */ 350 char *xf_name; /* human-readable name */ 351 int (*xf_attach)(void); /* called at config time */ 352 int (*xf_init)(struct tdb *, struct xformsw *, struct ipsecinit *); 353 int (*xf_zeroize)(struct tdb *); /* termination */ 354 struct mbuf *(*xf_input)(struct mbuf *, struct tdb *); /* input */ 355 int (*xf_output)(struct mbuf *, struct sockaddr_encap *, 356 struct tdb *, struct mbuf **); /* output */ 357}; 358 359/* xform IDs */ 360#define XF_IP4 1 /* IP inside IP */ 361#define XF_OLD_AH 2 /* RFCs 1828 & 1852 */ 362#define XF_OLD_ESP 3 /* RFCs 1829 & 1851 */ 363#define XF_NEW_AH 4 /* AH HMAC 96bits */ 364#define XF_NEW_ESP 5 /* ESP + auth 96bits + replay counter */ 365#define XF_TCPSIGNATURE 6 /* TCP MD5 Signature option, RFC 2358 */ 366 367/* xform attributes */ 368#define XFT_AUTH 0x0001 369#define XFT_CONF 0x0100 370 371#define IPSEC_ZEROES_SIZE 64 372#define IPSEC_KERNFS_BUFSIZE 4096 373 374#if BYTE_ORDER == LITTLE_ENDIAN 375static __inline u_int64_t 376htonq(u_int64_t q) 377{ 378 register u_int32_t u, l; 379 u = q >> 32; 380 l = (u_int32_t) q; 381 382 return htonl(u) | ((u_int64_t)htonl(l) << 32); 383} 384 385#define ntohq(_x) htonq(_x) 386 387#elif BYTE_ORDER == BIG_ENDIAN 388 389#define htonq(_x) (_x) 390#define ntohq(_x) htonq(_x) 391 392#else 393#error "Please fix <machine/endian.h>" 394#endif 395 396#ifdef _KERNEL 397 398/* 399 * Protects all tdb lists. 400 * Must at least be splsoftnet (note: do not use splsoftclock as it is 401 * special on some architectures, assuming it is always an spl lowering 402 * operation). 403 */ 404#define spltdb splsoftnet 405 406extern int encdebug; 407extern int ipsec_in_use; 408extern u_int8_t hmac_ipad_buffer[64]; 409extern u_int8_t hmac_opad_buffer[64]; 410 411extern TAILQ_HEAD(expclusterlist_head, tdb) expclusterlist; 412extern TAILQ_HEAD(explist_head, tdb) explist; 413extern struct xformsw xformsw[], *xformswNXFORMSW; 414 415/* Check if a given tdb has encryption, authentication and/or tunneling */ 416#define TDB_ATTRIB(x) (((x)->tdb_encalgxform ? NOTIFY_SATYPE_CONF : 0)| \ 417 ((x)->tdb_authalgxform ? NOTIFY_SATYPE_AUTH : 0)) 418 419/* Traverse spi chain and get attributes */ 420 421#define SPI_CHAIN_ATTRIB(have, TDB_DIR, TDBP) do {\ 422 int s = spltdb(); \ 423 struct tdb *tmptdb = (TDBP); \ 424 \ 425 (have) = 0; \ 426 while (tmptdb && tmptdb->tdb_xform) { \ 427 if (tmptdb == NULL || tmptdb->tdb_flags & TDBF_INVALID) \ 428 break; \ 429 (have) |= TDB_ATTRIB(tmptdb); \ 430 tmptdb = tmptdb->TDB_DIR; \ 431 } \ 432 splx(s); \ 433} while (0) 434 435/* Misc. */ 436extern char *inet_ntoa4(struct in_addr); 437extern char *ipsp_address(union sockaddr_union); 438 439/* TDB management routines */ 440extern void tdb_add_inp(struct tdb *tdb, struct inpcb *inp); 441extern u_int32_t reserve_spi(u_int32_t, u_int32_t, union sockaddr_union *, 442 union sockaddr_union *, u_int8_t, int *); 443extern struct tdb *gettdb(u_int32_t, union sockaddr_union *, u_int8_t); 444extern void puttdb(struct tdb *); 445extern void tdb_delete(struct tdb *, int, int); 446extern int tdb_init(struct tdb *, u_int16_t, struct ipsecinit *); 447extern void tdb_expiration(struct tdb *, int); 448/* Flag values for the last argument of tdb_expiration(). */ 449#define TDBEXP_EARLY 1 /* The tdb is likely to end up early. */ 450#define TDBEXP_TIMEOUT 2 /* Maintain expiration timeout. */ 451extern int tdb_walk(int (*)(struct tdb *, void *), void *); 452extern void handle_expirations(void *); 453 454/* Flow management routines */ 455extern struct flow *get_flow(void); 456extern void put_flow(struct flow *, struct tdb *); 457extern void delete_flow(struct flow *, struct tdb *); 458extern struct flow *find_flow(union sockaddr_union *, union sockaddr_union *, 459 union sockaddr_union *, union sockaddr_union *, 460 u_int8_t, struct tdb *); 461extern struct flow *find_global_flow(union sockaddr_union *, 462 union sockaddr_union *, 463 union sockaddr_union *, 464 union sockaddr_union *, u_int8_t); 465 466/* XF_IP4 */ 467extern int ipe4_attach(void); 468extern int ipe4_init(struct tdb *, struct xformsw *, struct ipsecinit *); 469extern int ipe4_zeroize(struct tdb *); 470extern int ipe4_output(struct mbuf *, struct sockaddr_encap *, struct tdb *, 471 struct mbuf **); 472extern void ipe4_input __P((struct mbuf *, ...)); 473extern void ip4_input __P((struct mbuf *, ...)); 474 475/* XF_OLD_AH */ 476extern int ah_old_attach(void); 477extern int ah_old_init(struct tdb *, struct xformsw *, struct ipsecinit *); 478extern int ah_old_zeroize(struct tdb *); 479extern int ah_old_output(struct mbuf *, struct sockaddr_encap *, struct tdb *, 480 struct mbuf **); 481extern struct mbuf *ah_old_input(struct mbuf *, struct tdb *); 482 483/* XF_NEW_AH */ 484extern int ah_new_attach(void); 485extern int ah_new_init(struct tdb *, struct xformsw *, struct ipsecinit *); 486extern int ah_new_zeroize(struct tdb *); 487extern int ah_new_output(struct mbuf *, struct sockaddr_encap *, struct tdb *, 488 struct mbuf **); 489extern struct mbuf *ah_new_input(struct mbuf *, struct tdb *); 490 491/* XF_OLD_ESP */ 492extern int esp_old_attach(void); 493extern int esp_old_init(struct tdb *, struct xformsw *, struct ipsecinit *); 494extern int esp_old_zeroize(struct tdb *); 495extern int esp_old_output(struct mbuf *, struct sockaddr_encap *, struct tdb *, 496 struct mbuf **); 497extern struct mbuf *esp_old_input(struct mbuf *, struct tdb *); 498 499/* XF_NEW_ESP */ 500extern int esp_new_attach(void); 501extern int esp_new_init(struct tdb *, struct xformsw *, struct ipsecinit *); 502extern int esp_new_zeroize(struct tdb *); 503extern int esp_new_output(struct mbuf *, struct sockaddr_encap *, struct tdb *, 504 struct mbuf **); 505extern struct mbuf *esp_new_input(struct mbuf *, struct tdb *); 506 507/* XF_TCPSIGNATURE */ 508extern int tcp_signature_tdb_attach __P((void)); 509extern int tcp_signature_tdb_init __P((struct tdb *, struct xformsw *, 510 struct ipsecinit *)); 511extern int tcp_signature_tdb_zeroize __P((struct tdb *)); 512extern struct mbuf *tcp_signature_tdb_input __P((struct mbuf *, struct tdb *)); 513extern int tcp_signature_tdb_output __P((struct mbuf *, 514 struct sockaddr_encap *, struct tdb *, 515 struct mbuf **)); 516 517/* Padding */ 518extern caddr_t m_pad(struct mbuf *, int, int); 519 520/* Replay window */ 521extern int checkreplaywindow32(u_int32_t, u_int32_t, u_int32_t *, u_int32_t, 522 u_int32_t *); 523 524extern unsigned char ipseczeroes[]; 525#endif /* _KERNEL */ 526#endif /* _NETINET_IPSP_H_ */ 527