ip_ipsp.h revision 1.60
1/* $OpenBSD: ip_ipsp.h,v 1.60 2000/01/27 08:09:12 angelos Exp $ */ 2 3/* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr), 6 * Niels Provos (provos@physnet.uni-hamburg.de) and 7 * Niklas Hallqvist (niklas@appli.se). 8 * 9 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 10 * in November 1995. 11 * 12 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 13 * by Angelos D. Keromytis. 14 * 15 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 16 * and Niels Provos. 17 * 18 * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist. 19 * 20 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 21 * Angelos D. Keromytis and Niels Provos. 22 * Copyright (c) 1999 Niklas Hallqvist. 23 * 24 * Permission to use, copy, and modify this software without fee 25 * is hereby granted, provided that this entire notice is included in 26 * all copies of any software which is or includes a copy or 27 * modification of this software. 28 * You may use this code under the GNU public license if you so wish. Please 29 * contribute changes back to the authors under this freer than GPL license 30 * so that we may further the use of strong encryption without limitations to 31 * all. 32 * 33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 37 * PURPOSE. 38 */ 39 40#ifndef _NETINET_IPSP_H_ 41#define _NETINET_IPSP_H_ 42 43/* 44 * IPSP global definitions. 45 */ 46 47#include <sys/types.h> 48#include <sys/queue.h> 49#include <netinet/in.h> 50#include <sys/md5k.h> 51#include <netinet/ip_sha1.h> 52#include <netinet/ip_rmd160.h> 53#include <netinet/ip_blf.h> 54#include <netinet/ip_cast.h> 55#include <netinet/ip_skipjack.h> 56 57union sockaddr_union 58{ 59 struct sockaddr sa; 60 struct sockaddr_in sin; 61 struct sockaddr_in6 sin6; 62}; 63 64#define FLOW_EGRESS 0 65#define FLOW_INGRESS 1 66 67/* HMAC key sizes */ 68#define MD5HMAC96_KEYSIZE 16 69#define SHA1HMAC96_KEYSIZE 20 70#define RIPEMD160HMAC96_KEYSIZE 20 71 72/* IV lengths */ 73#define ESP_DES_IVS 8 74#define ESP_3DES_IVS 8 75#define ESP_BLF_IVS 8 76#define ESP_CAST_IVS 8 77#define ESP_SKIPJACK_IVS 8 78#define ESP_MAX_IVS 8 /* Keep updated */ 79 80/* Block sizes -- it is assumed that they're powers of 2 */ 81#define ESP_DES_BLKS 8 82#define ESP_3DES_BLKS 8 83#define ESP_BLF_BLKS 8 84#define ESP_CAST_BLKS 8 85#define ESP_SKIPJACK_BLKS 8 86#define ESP_MAX_BLKS 8 /* Keep updated */ 87 88#define HMAC_BLOCK_LEN 64 89 90#define AH_HMAC_HASHLEN 12 /* 96 bits of authenticator */ 91#define AH_HMAC_RPLENGTH 4 /* 32 bits of replay counter */ 92#define AH_HMAC_INITIAL_RPL 1 /* Replay counter initial value */ 93 94/* HMAC definitions */ 95#define HMAC_IPAD_VAL 0x36 96#define HMAC_OPAD_VAL 0x5C 97#define HMAC_BLOCK_LEN 64 98 99/* Authenticator lengths */ 100#define AH_MD5_ALEN 16 101#define AH_SHA1_ALEN 20 102#define AH_RMD160_ALEN 20 103#define AH_ALEN_MAX 20 /* Keep updated */ 104 105/* Reserved SPI numbers */ 106#define SPI_LOCAL_USE 0 107#define SPI_RESERVED_MIN 1 108#define SPI_RESERVED_MAX 255 109 110/* sysctl default values */ 111#define IPSEC_DEFAULT_EMBRYONIC_SA_TIMEOUT 60 /* 1 minute */ 112#define IPSEC_DEFAULT_PFS 1 113#define IPSEC_DEFAULT_SOFT_ALLOCATIONS 0 114#define IPSEC_DEFAULT_EXP_ALLOCATIONS 0 115#define IPSEC_DEFAULT_SOFT_BYTES 0 116#define IPSEC_DEFAULT_EXP_BYTES 0 117#define IPSEC_DEFAULT_SOFT_TIMEOUT 80000 118#define IPSEC_DEFAULT_EXP_TIMEOUT 86400 119#define IPSEC_DEFAULT_SOFT_FIRST_USE 3600 120#define IPSEC_DEFAULT_EXP_FIRST_USE 7200 121#define IPSEC_DEFAULT_DEF_ENC "3des" 122#define IPSEC_DEFAULT_DEF_AUTH "hmac-sha1" 123 124struct sockaddr_encap 125{ 126 u_int8_t sen_len; /* length */ 127 u_int8_t sen_family; /* PF_KEY */ 128 u_int16_t sen_type; /* see SENT_* */ 129 union 130 { 131 u_int8_t Data[16]; /* other stuff mapped here */ 132 133 struct /* SENT_IP4 */ 134 { 135 struct in_addr Src; 136 struct in_addr Dst; 137 u_int16_t Sport; 138 u_int16_t Dport; 139 u_int8_t Proto; 140 u_int8_t Filler[3]; 141 } Sip4; 142 143 struct /* SENT_IP6 */ 144 { 145 struct in6_addr Src; 146 struct in6_addr Dst; 147 u_int16_t Sport; 148 u_int16_t Dport; 149 u_int8_t Proto; 150 u_int8_t Filler[3]; 151 } Sip6; 152 153 struct /* SENT_IPSP */ 154 { 155 struct in_addr Dst; 156 u_int32_t Spi; 157 u_int8_t Sproto; 158 u_int8_t Filler[7]; 159 } Sipsp; 160 161 struct /* SENT_IPSP6 */ 162 { 163 struct in6_addr Dst; 164 u_int32_t Spi; 165 u_int8_t Sproto; 166 u_int8_t Filler[7]; 167 } Sipsp6; 168 } Sen; 169}; 170 171#define sen_data Sen.Data 172#define sen_ip_src Sen.Sip4.Src 173#define sen_ip_dst Sen.Sip4.Dst 174#define sen_proto Sen.Sip4.Proto 175#define sen_sport Sen.Sip4.Sport 176#define sen_dport Sen.Sip4.Dport 177#define sen_ip6_src Sen.Sip6.Src 178#define sen_ip6_dst Sen.Sip6.Dst 179#define sen_ip6_proto Sen.Sip6.Proto 180#define sen_ip6_sport Sen.Sip6.Sport 181#define sen_ip6_dport Sen.Sip6.Dport 182#define sen_ipsp_dst Sen.Sipsp.Dst 183#define sen_ipsp_spi Sen.Sipsp.Spi 184#define sen_ipsp_sproto Sen.Sipsp.Sproto 185#define sen_ipsp6_dst Sen.Sipsp6.Dst 186#define sen_ipsp6_spi Sen.Sipsp6.Spi 187#define sen_ipsp6_sproto Sen.Sipsp6.Sproto 188 189/* 190 * The "type" is really part of the address as far as the routing 191 * system is concerned. By using only one bit in the type field 192 * for each type, we sort-of make sure that different types of 193 * encapsulation addresses won't be matched against the wrong type. 194 * 195 */ 196 197#define SENT_IP4 0x0001 /* data is two struct in_addr */ 198#define SENT_IPSP 0x0002 /* data as in IP4/6 plus SPI */ 199#define SENT_IP6 0x0004 200#define SENT_IPSP6 0x0008 201 202/* 203 * SENT_HDRLEN is the length of the "header" 204 * SENT_*_LEN are the lengths of various forms of sen_data 205 * SENT_*_OFF are the offsets in the sen_data array of various fields 206 */ 207 208#define SENT_HDRLEN (2 * sizeof(u_int8_t) + sizeof(u_int16_t)) 209 210#define SENT_IP4_SRCOFF (0) 211#define SENT_IP4_DSTOFF (sizeof (struct in_addr)) 212 213#define SENT_IP6_SRCOFF (0) 214#define SENT_IP6_DSTOFF (sizeof (struct in6_addr)) 215 216#define SENT_IP4_LEN 20 217#define SENT_IPSP_LEN 20 218#define SENT_IP6_LEN 44 219#define SENT_IPSP6_LEN 32 220 221#define NOTIFY_SOFT_EXPIRE 0 /* Soft expiration of SA */ 222#define NOTIFY_HARD_EXPIRE 1 /* Hard expiration of SA */ 223#define NOTIFY_REQUEST_SA 2 /* Establish an SA */ 224 225#define NOTIFY_SATYPE_CONF 1 /* SA should do encryption */ 226#define NOTIFY_SATYPE_AUTH 2 /* SA should do authentication */ 227#define NOTIFY_SATYPE_TUNNEL 4 /* SA should use tunneling */ 228 229/* 230 * For encapsulation routes are possible not only for the destination 231 * address but also for the protocol, source and destination ports 232 * if available 233 */ 234 235struct route_enc { 236 struct rtentry *re_rt; 237 struct sockaddr_encap re_dst; 238}; 239 240struct flow 241{ 242 struct flow *flow_next; /* Next in flow chain */ 243 struct flow *flow_prev; /* Previous in flow chain */ 244 struct tdb *flow_sa; /* Pointer to the SA */ 245 union sockaddr_union flow_src; /* Source address */ 246 union sockaddr_union flow_srcmask; /* Source netmask */ 247 union sockaddr_union flow_dst; /* Destination address */ 248 union sockaddr_union flow_dstmask; /* Destination netmask */ 249 u_int8_t flow_proto; /* Transport protocol, if applicable */ 250 u_int8_t foo[3]; /* Alignment */ 251}; 252 253struct tdb /* tunnel descriptor block */ 254{ 255 struct tdb *tdb_hnext; /* Next in hash chain */ 256 struct tdb *tdb_onext; /* Next in output */ 257 struct tdb *tdb_inext; /* Previous in output */ 258 259 struct xformsw *tdb_xform; /* Transformation to use */ 260 struct enc_xform *tdb_encalgxform; /* Encryption algorithm xform */ 261 struct auth_hash *tdb_authalgxform; /* Authentication algorithm xform */ 262 263#define TDBF_UNIQUE 0x00001 /* This should not be used by others */ 264#define TDBF_TIMER 0x00002 /* Absolute expiration timer in use */ 265#define TDBF_BYTES 0x00004 /* Check the byte counters */ 266#define TDBF_ALLOCATIONS 0x00008 /* Check the flows counters */ 267#define TDBF_INVALID 0x00010 /* This SPI is not valid yet/anymore */ 268#define TDBF_FIRSTUSE 0x00020 /* Expire after first use */ 269#define TDBF_HALFIV 0x00040 /* Use half-length IV (ESP old only) */ 270#define TDBF_SOFT_TIMER 0x00080 /* Soft expiration */ 271#define TDBF_SOFT_BYTES 0x00100 /* Soft expiration */ 272#define TDBF_SOFT_ALLOCATIONS 0x00200 /* Soft expiration */ 273#define TDBF_SOFT_FIRSTUSE 0x00400 /* Soft expiration */ 274#define TDBF_PFS 0x00800 /* Ask for PFS from Key Mgmt. */ 275#define TDBF_TUNNELING 0x01000 /* Force IP-IP encapsulation */ 276#define TDBF_NOREPLAY 0x02000 /* No replay counter present */ 277#define TDBF_RANDOMPADDING 0x04000 /* Random data in the ESP padding */ 278 279 u_int32_t tdb_flags; /* Flags related to this TDB */ 280 281 TAILQ_ENTRY(tdb) tdb_expnext; /* Expiration cluster list link */ 282 TAILQ_ENTRY(tdb) tdb_explink; /* Expiration ordered list link */ 283 284 u_int32_t tdb_exp_allocations; /* Expire after so many flows */ 285 u_int32_t tdb_soft_allocations; /* Expiration warning */ 286 u_int32_t tdb_cur_allocations; /* Total number of allocations */ 287 288 u_int64_t tdb_exp_bytes; /* Expire after so many bytes passed */ 289 u_int64_t tdb_soft_bytes; /* Expiration warning */ 290 u_int64_t tdb_cur_bytes; /* Current count of bytes */ 291 292 u_int64_t tdb_exp_timeout; /* When does the SPI expire */ 293 u_int64_t tdb_soft_timeout; /* Send a soft-expire warning */ 294 u_int64_t tdb_established; /* When was the SPI established */ 295 u_int64_t tdb_timeout; /* Next absolute expiration time. */ 296 297 u_int64_t tdb_first_use; /* When was it first used */ 298 u_int64_t tdb_soft_first_use; /* Soft warning */ 299 u_int64_t tdb_exp_first_use; /* Expire if tdb_first_use + 300 * tdb_exp_first_use <= curtime */ 301 302 u_int32_t tdb_spi; /* SPI */ 303 u_int16_t tdb_amxkeylen; /* Raw authentication key length */ 304 u_int16_t tdb_emxkeylen; /* Raw encryption key length */ 305 u_int16_t tdb_ivlen; /* IV length */ 306 u_int8_t tdb_sproto; /* IPsec protocol */ 307 u_int8_t tdb_wnd; /* Replay window */ 308 u_int8_t tdb_satype; /* SA type (RFC2367, PF_KEY) */ 309 310 union sockaddr_union tdb_dst; /* Destination address for this SA */ 311 union sockaddr_union tdb_src; /* Source address for this SA */ 312 union sockaddr_union tdb_proxy; 313 314 u_int8_t *tdb_key; /* Key material (schedules) */ 315 u_int8_t *tdb_ictx; /* Authentication contexts */ 316 u_int8_t *tdb_octx; 317 u_int8_t *tdb_srcid; /* Source ID for this SA */ 318 u_int8_t *tdb_dstid; /* Destination ID for this SA */ 319 u_int8_t *tdb_amxkey; /* Raw authentication key */ 320 u_int8_t *tdb_emxkey; /* Raw encryption key */ 321 322 union 323 { 324 u_int8_t Iv[ESP_3DES_IVS]; /* That's enough space */ 325 u_int32_t Ivl; /* Make sure this is 4 bytes */ 326 u_int64_t Ivq; /* Make sure this is 8 bytes! */ 327 }IV; 328#define tdb_iv IV.Iv 329#define tdb_ivl IV.Ivl 330#define tdb_ivq IV.Ivq 331 332 u_int32_t tdb_rpl; /* Replay counter */ 333 u_int32_t tdb_bitmap; /* Used for replay sliding window */ 334 u_int32_t tdb_initial; /* Initial replay value */ 335 336 u_int32_t tdb_epoch; /* Used by the kernfs interface */ 337 u_int16_t tdb_srcid_len; 338 u_int16_t tdb_dstid_len; 339 u_int16_t tdb_srcid_type; 340 u_int16_t tdb_dstid_type; 341 342 caddr_t tdb_interface; 343 struct flow *tdb_flow; /* Which outboind flows use this SA */ 344 struct flow *tdb_access; /* Ingress access control */ 345 346 struct tdb *tdb_bind_out; /* Outgoing SA to use */ 347 TAILQ_HEAD(tdb_bind_head, tdb) tdb_bind_in; 348 TAILQ_ENTRY(tdb) tdb_bind_in_next; /* Refering Incoming SAs */ 349 TAILQ_HEAD(tdb_inp_head, inpcb) tdb_inp; 350}; 351 352union authctx_old { 353 MD5_CTX md5ctx; 354 SHA1_CTX sha1ctx; 355}; 356 357union authctx { 358 MD5_CTX md5ctx; 359 SHA1_CTX sha1ctx; 360 RMD160_CTX rmd160ctx; 361}; 362 363struct tdb_ident { 364 u_int32_t spi; 365 union sockaddr_union dst; 366 u_int8_t proto; 367}; 368 369struct auth_hash { 370 int type; 371 char *name; 372 u_int16_t keysize; 373 u_int16_t hashsize; 374 u_int16_t authsize; 375 u_int16_t ctxsize; 376 void (*Init)(void *); 377 void (*Update)(void *, u_int8_t *, u_int16_t); 378 void (*Final)(u_int8_t *, void *); 379}; 380 381struct enc_xform { 382 int type; 383 char *name; 384 u_int16_t blocksize, ivsize; 385 u_int16_t minkey, maxkey; 386 u_int32_t ivmask; /* Or all possible modes, zero iv = 1 */ 387 void (*encrypt)(struct tdb *, u_int8_t *); 388 void (*decrypt)(struct tdb *, u_int8_t *); 389 void (*setkey)(u_int8_t **, u_int8_t *, int len); 390 void (*zerokey)(u_int8_t **); 391}; 392 393struct ipsecinit 394{ 395 u_int8_t *ii_enckey; 396 u_int8_t *ii_authkey; 397 u_int16_t ii_enckeylen; 398 u_int16_t ii_authkeylen; 399 u_int8_t ii_encalg; 400 u_int8_t ii_authalg; 401}; 402 403struct xformsw 404{ 405 u_short xf_type; /* Unique ID of xform */ 406 u_short xf_flags; /* flags (see below) */ 407 char *xf_name; /* human-readable name */ 408 int (*xf_attach)(void); /* called at config time */ 409 int (*xf_init)(struct tdb *, struct xformsw *, struct ipsecinit *); 410 int (*xf_zeroize)(struct tdb *); /* termination */ 411 struct mbuf *(*xf_input)(struct mbuf *, struct tdb *, int, int); /* input */ 412 int (*xf_output)(struct mbuf *, struct tdb *, struct mbuf **, int, int); /* output */ 413}; 414 415/* xform IDs */ 416#define XF_IP4 1 /* IP inside IP */ 417#define XF_AH 2 /* AH */ 418#define XF_ESP 3 /* ESP */ 419#define XF_TCPSIGNATURE 5 /* TCP MD5 Signature option, RFC 2358 */ 420 421/* xform attributes */ 422#define XFT_AUTH 0x0001 423#define XFT_CONF 0x0100 424 425#define IPSEC_ZEROES_SIZE 256 /* Larger than an IP6 extension hdr. */ 426#define IPSEC_KERNFS_BUFSIZE 4096 427 428#if BYTE_ORDER == LITTLE_ENDIAN 429static __inline u_int64_t 430htonq(u_int64_t q) 431{ 432 register u_int32_t u, l; 433 u = q >> 32; 434 l = (u_int32_t) q; 435 436 return htonl(u) | ((u_int64_t)htonl(l) << 32); 437} 438 439#define ntohq(_x) htonq(_x) 440 441#elif BYTE_ORDER == BIG_ENDIAN 442 443#define htonq(_x) (_x) 444#define ntohq(_x) htonq(_x) 445 446#else 447#error "Please fix <machine/endian.h>" 448#endif 449 450#ifdef _KERNEL 451 452/* 453 * Protects all tdb lists. 454 * Must at least be splsoftnet (note: do not use splsoftclock as it is 455 * special on some architectures, assuming it is always an spl lowering 456 * operation). 457 */ 458#define spltdb splsoftnet 459 460extern int encdebug; 461extern int ipsec_acl; 462extern int ipsec_keep_invalid; 463extern int ipsec_in_use; 464extern int ipsec_require_pfs; 465 466extern u_int8_t hmac_ipad_buffer[64]; 467extern u_int8_t hmac_opad_buffer[64]; 468extern int ipsec_soft_allocations; 469extern int ipsec_exp_allocations; 470extern int ipsec_soft_bytes; 471extern int ipsec_exp_bytes; 472extern int ipsec_soft_timeout; 473extern int ipsec_exp_timeout; 474extern int ipsec_soft_first_use; 475extern int ipsec_exp_first_use; 476extern char ipsec_def_enc[]; 477extern char ipsec_def_auth[]; 478 479extern struct enc_xform enc_xform_des; 480extern struct enc_xform enc_xform_3des; 481extern struct enc_xform enc_xform_blf; 482extern struct enc_xform enc_xform_cast5; 483extern struct enc_xform enc_xform_skipjack; 484 485extern struct auth_hash auth_hash_hmac_md5_96; 486extern struct auth_hash auth_hash_hmac_sha1_96; 487extern struct auth_hash auth_hash_hmac_ripemd_160_96; 488 489extern TAILQ_HEAD(expclusterlist_head, tdb) expclusterlist; 490extern TAILQ_HEAD(explist_head, tdb) explist; 491extern struct xformsw xformsw[], *xformswNXFORMSW; 492 493/* Check if a given tdb has encryption, authentication and/or tunneling */ 494#define TDB_ATTRIB(x) (((x)->tdb_encalgxform ? NOTIFY_SATYPE_CONF : 0)| \ 495 ((x)->tdb_authalgxform ? NOTIFY_SATYPE_AUTH : 0)) 496 497/* Traverse spi chain and get attributes */ 498 499#define SPI_CHAIN_ATTRIB(have, TDB_DIR, TDBP) do {\ 500 int s = spltdb(); \ 501 struct tdb *tmptdb = (TDBP); \ 502 \ 503 (have) = 0; \ 504 while (tmptdb && tmptdb->tdb_xform) { \ 505 if (tmptdb == NULL || tmptdb->tdb_flags & TDBF_INVALID) \ 506 break; \ 507 (have) |= TDB_ATTRIB(tmptdb); \ 508 tmptdb = tmptdb->TDB_DIR; \ 509 } \ 510 splx(s); \ 511} while (0) 512 513/* Misc. */ 514extern char *inet_ntoa4(struct in_addr); 515 516#ifdef INET6 517extern char *inet6_ntoa4(struct in6_addr); 518#endif /* INET6 */ 519 520extern char *ipsp_address(union sockaddr_union); 521 522/* TDB management routines */ 523extern void tdb_add_inp(struct tdb *tdb, struct inpcb *inp); 524extern u_int32_t reserve_spi(u_int32_t, u_int32_t, union sockaddr_union *, 525 union sockaddr_union *, u_int8_t, int *); 526extern struct tdb *gettdb(u_int32_t, union sockaddr_union *, u_int8_t); 527extern void puttdb(struct tdb *); 528extern void tdb_delete(struct tdb *, int, int); 529extern int tdb_init(struct tdb *, u_int16_t, struct ipsecinit *); 530extern void tdb_expiration(struct tdb *, int); 531/* Flag values for the last argument of tdb_expiration(). */ 532#define TDBEXP_EARLY 1 /* The tdb is likely to end up early. */ 533#define TDBEXP_TIMEOUT 2 /* Maintain expiration timeout. */ 534extern int tdb_walk(int (*)(struct tdb *, void *), void *); 535extern void handle_expirations(void *); 536 537/* Flow management routines */ 538extern struct flow *get_flow(void); 539extern void put_flow(struct flow *, struct tdb *, int); 540extern void delete_flow(struct flow *, struct tdb *, int); 541extern struct flow *find_flow(union sockaddr_union *, union sockaddr_union *, 542 union sockaddr_union *, union sockaddr_union *, 543 u_int8_t, struct tdb *, int); 544extern struct flow *find_global_flow(union sockaddr_union *, 545 union sockaddr_union *, 546 union sockaddr_union *, 547 union sockaddr_union *, u_int8_t); 548 549/* XF_IP4 */ 550extern int ipe4_attach(void); 551extern int ipe4_init(struct tdb *, struct xformsw *, struct ipsecinit *); 552extern int ipe4_zeroize(struct tdb *); 553extern int ipip_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); 554extern void ipe4_input __P((struct mbuf *, ...)); 555extern void ipip_input __P((struct mbuf *, int)); 556 557#ifdef INET 558extern void ip4_input __P((struct mbuf *, ...)); 559#endif /* INET */ 560 561#ifdef INET6 562extern int ip4_input6 __P((struct mbuf **, int *, int)); 563#endif /* INET */ 564 565/* XF_ETHERIP */ 566extern int etherip_output(struct mbuf *, struct tdb *, struct mbuf **, 567 int, int); 568extern void etherip_input __P((struct mbuf *, ...)); 569 570/* XF_AH */ 571extern int ah_attach(void); 572extern int ah_init(struct tdb *, struct xformsw *, struct ipsecinit *); 573extern int ah_zeroize(struct tdb *); 574extern int ah_output(struct mbuf *, struct tdb *, struct mbuf **, 575 int, int); 576extern struct mbuf *ah_input(struct mbuf *, struct tdb *, int, int); 577extern int ah_sysctl(int *, u_int, void *, size_t *, void *, size_t); 578 579#ifdef INET 580extern void ah4_input __P((struct mbuf *, ...)); 581#endif /* INET */ 582 583#ifdef INET6 584int ah6_input __P((struct mbuf **, int *, int)); 585#endif /* INET6 */ 586 587/* XF_ESP */ 588extern int esp_attach(void); 589extern int esp_init(struct tdb *, struct xformsw *, struct ipsecinit *); 590extern int esp_zeroize(struct tdb *); 591extern int esp_output(struct mbuf *, struct tdb *, struct mbuf **, 592 int, int); 593extern struct mbuf *esp_input(struct mbuf *, struct tdb *, int, int); 594extern int esp_sysctl(int *, u_int, void *, size_t *, void *, size_t); 595 596#ifdef INET 597extern void esp4_input __P((struct mbuf *, ...)); 598#endif /* INET */ 599 600#ifdef INET6 601int esp6_input __P((struct mbuf **, int *, int)); 602#endif /* INET6 */ 603 604/* XF_TCPSIGNATURE */ 605extern int tcp_signature_tdb_attach __P((void)); 606extern int tcp_signature_tdb_init __P((struct tdb *, struct xformsw *, 607 struct ipsecinit *)); 608extern int tcp_signature_tdb_zeroize __P((struct tdb *)); 609extern struct mbuf *tcp_signature_tdb_input __P((struct mbuf *, struct tdb *, int, int)); 610extern int tcp_signature_tdb_output __P((struct mbuf *, struct tdb *, 611 struct mbuf **, int, int)); 612 613/* Padding */ 614extern caddr_t m_pad(struct mbuf *, int, int); 615 616/* Replay window */ 617extern int checkreplaywindow32(u_int32_t, u_int32_t, u_int32_t *, u_int32_t, 618 u_int32_t *); 619 620extern unsigned char ipseczeroes[]; 621 622/* Packet processing */ 623int ipsp_process_packet(struct mbuf *, struct mbuf **, struct tdb *, 624 int *, int); 625#endif /* _KERNEL */ 626#endif /* _NETINET_IPSP_H_ */ 627