ip_ipsp.h revision 1.64
1/* $OpenBSD: ip_ipsp.h,v 1.64 2000/04/19 03:37:36 angelos Exp $ */ 2 3/* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr), 6 * Niels Provos (provos@physnet.uni-hamburg.de) and 7 * Niklas Hallqvist (niklas@appli.se). 8 * 9 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 10 * in November 1995. 11 * 12 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 13 * by Angelos D. Keromytis. 14 * 15 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 16 * and Niels Provos. 17 * 18 * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist. 19 * 20 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis, 21 * Angelos D. Keromytis and Niels Provos. 22 * Copyright (c) 1999 Niklas Hallqvist. 23 * 24 * Permission to use, copy, and modify this software without fee 25 * is hereby granted, provided that this entire notice is included in 26 * all copies of any software which is or includes a copy or 27 * modification of this software. 28 * You may use this code under the GNU public license if you so wish. Please 29 * contribute changes back to the authors under this freer than GPL license 30 * so that we may further the use of strong encryption without limitations to 31 * all. 32 * 33 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 34 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 35 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 36 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 37 * PURPOSE. 38 */ 39 40#ifndef _NETINET_IPSP_H_ 41#define _NETINET_IPSP_H_ 42 43/* 44 * IPSP global definitions. 45 */ 46 47#include <sys/types.h> 48#include <sys/queue.h> 49#include <netinet/in.h> 50 51union sockaddr_union 52{ 53 struct sockaddr sa; 54 struct sockaddr_in sin; 55 struct sockaddr_in6 sin6; 56}; 57 58#define FLOW_EGRESS 0 59#define FLOW_INGRESS 1 60 61/* HMAC key sizes */ 62#define MD5HMAC96_KEYSIZE 16 63#define SHA1HMAC96_KEYSIZE 20 64#define RIPEMD160HMAC96_KEYSIZE 20 65 66#define AH_HMAC_HASHLEN 12 /* 96 bits of authenticator */ 67#define AH_HMAC_RPLENGTH 4 /* 32 bits of replay counter */ 68#define AH_HMAC_INITIAL_RPL 1 /* Replay counter initial value */ 69 70/* Authenticator lengths */ 71#define AH_MD5_ALEN 16 72#define AH_SHA1_ALEN 20 73#define AH_RMD160_ALEN 20 74#define AH_ALEN_MAX 20 /* Keep updated */ 75 76/* Reserved SPI numbers */ 77#define SPI_LOCAL_USE 0 78#define SPI_RESERVED_MIN 1 79#define SPI_RESERVED_MAX 255 80 81/* sysctl default values */ 82#define IPSEC_DEFAULT_EMBRYONIC_SA_TIMEOUT 60 /* 1 minute */ 83#define IPSEC_DEFAULT_PFS 1 84#define IPSEC_DEFAULT_SOFT_ALLOCATIONS 0 85#define IPSEC_DEFAULT_EXP_ALLOCATIONS 0 86#define IPSEC_DEFAULT_SOFT_BYTES 0 87#define IPSEC_DEFAULT_EXP_BYTES 0 88#define IPSEC_DEFAULT_SOFT_TIMEOUT 80000 89#define IPSEC_DEFAULT_EXP_TIMEOUT 86400 90#define IPSEC_DEFAULT_SOFT_FIRST_USE 3600 91#define IPSEC_DEFAULT_EXP_FIRST_USE 7200 92#define IPSEC_DEFAULT_DEF_ENC "3des" 93#define IPSEC_DEFAULT_DEF_AUTH "hmac-sha1" 94 95struct sockaddr_encap 96{ 97 u_int8_t sen_len; /* length */ 98 u_int8_t sen_family; /* PF_KEY */ 99 u_int16_t sen_type; /* see SENT_* */ 100 union 101 { 102 u_int8_t Data[16]; /* other stuff mapped here */ 103 104 struct /* SENT_IP4 */ 105 { 106 struct in_addr Src; 107 struct in_addr Dst; 108 u_int16_t Sport; 109 u_int16_t Dport; 110 u_int8_t Proto; 111 u_int8_t Filler[3]; 112 } Sip4; 113 114 struct /* SENT_IP6 */ 115 { 116 struct in6_addr Src; 117 struct in6_addr Dst; 118 u_int16_t Sport; 119 u_int16_t Dport; 120 u_int8_t Proto; 121 u_int8_t Filler[3]; 122 } Sip6; 123 124 struct /* SENT_IPSP */ 125 { 126 struct in_addr Dst; 127 u_int32_t Spi; 128 u_int8_t Sproto; 129 u_int8_t Filler[7]; 130 } Sipsp; 131 132 struct /* SENT_IPSP6 */ 133 { 134 struct in6_addr Dst; 135 u_int32_t Spi; 136 u_int8_t Sproto; 137 u_int8_t Filler[7]; 138 } Sipsp6; 139 } Sen; 140}; 141 142#define sen_data Sen.Data 143#define sen_ip_src Sen.Sip4.Src 144#define sen_ip_dst Sen.Sip4.Dst 145#define sen_proto Sen.Sip4.Proto 146#define sen_sport Sen.Sip4.Sport 147#define sen_dport Sen.Sip4.Dport 148#define sen_ip6_src Sen.Sip6.Src 149#define sen_ip6_dst Sen.Sip6.Dst 150#define sen_ip6_proto Sen.Sip6.Proto 151#define sen_ip6_sport Sen.Sip6.Sport 152#define sen_ip6_dport Sen.Sip6.Dport 153#define sen_ipsp_dst Sen.Sipsp.Dst 154#define sen_ipsp_spi Sen.Sipsp.Spi 155#define sen_ipsp_sproto Sen.Sipsp.Sproto 156#define sen_ipsp6_dst Sen.Sipsp6.Dst 157#define sen_ipsp6_spi Sen.Sipsp6.Spi 158#define sen_ipsp6_sproto Sen.Sipsp6.Sproto 159 160/* 161 * The "type" is really part of the address as far as the routing 162 * system is concerned. By using only one bit in the type field 163 * for each type, we sort-of make sure that different types of 164 * encapsulation addresses won't be matched against the wrong type. 165 * 166 */ 167 168#define SENT_IP4 0x0001 /* data is two struct in_addr */ 169#define SENT_IPSP 0x0002 /* data as in IP4/6 plus SPI */ 170#define SENT_IP6 0x0004 171#define SENT_IPSP6 0x0008 172 173/* 174 * SENT_HDRLEN is the length of the "header" 175 * SENT_*_LEN are the lengths of various forms of sen_data 176 * SENT_*_OFF are the offsets in the sen_data array of various fields 177 */ 178 179#define SENT_HDRLEN (2 * sizeof(u_int8_t) + sizeof(u_int16_t)) 180 181#define SENT_IP4_SRCOFF (0) 182#define SENT_IP4_DSTOFF (sizeof (struct in_addr)) 183 184#define SENT_IP6_SRCOFF (0) 185#define SENT_IP6_DSTOFF (sizeof (struct in6_addr)) 186 187#define SENT_IP4_LEN 20 188#define SENT_IPSP_LEN 20 189#define SENT_IP6_LEN 44 190#define SENT_IPSP6_LEN 32 191 192#define NOTIFY_SOFT_EXPIRE 0 /* Soft expiration of SA */ 193#define NOTIFY_HARD_EXPIRE 1 /* Hard expiration of SA */ 194#define NOTIFY_REQUEST_SA 2 /* Establish an SA */ 195 196#define NOTIFY_SATYPE_CONF 1 /* SA should do encryption */ 197#define NOTIFY_SATYPE_AUTH 2 /* SA should do authentication */ 198#define NOTIFY_SATYPE_TUNNEL 4 /* SA should use tunneling */ 199 200/* 201 * For encapsulation routes are possible not only for the destination 202 * address but also for the protocol, source and destination ports 203 * if available 204 */ 205 206struct route_enc { 207 struct rtentry *re_rt; 208 struct sockaddr_encap re_dst; 209}; 210 211struct flow 212{ 213 struct flow *flow_next; /* Next in flow chain */ 214 struct flow *flow_prev; /* Previous in flow chain */ 215 struct tdb *flow_sa; /* Pointer to the SA */ 216 union sockaddr_union flow_src; /* Source address */ 217 union sockaddr_union flow_srcmask; /* Source netmask */ 218 union sockaddr_union flow_dst; /* Destination address */ 219 union sockaddr_union flow_dstmask; /* Destination netmask */ 220 u_int8_t flow_proto; /* Transport protocol, if applicable */ 221 u_int8_t foo[3]; /* Alignment */ 222}; 223 224struct tdb /* tunnel descriptor block */ 225{ 226 struct tdb *tdb_hnext; /* Next in hash chain */ 227 struct tdb *tdb_onext; /* Next in output */ 228 struct tdb *tdb_inext; /* Previous in output */ 229 230 struct xformsw *tdb_xform; /* Transformation to use */ 231 struct enc_xform *tdb_encalgxform; /* Encryption algorithm xform */ 232 struct auth_hash *tdb_authalgxform; /* Authentication algorithm xform */ 233 234#define TDBF_UNIQUE 0x00001 /* This should not be used by others */ 235#define TDBF_TIMER 0x00002 /* Absolute expiration timer in use */ 236#define TDBF_BYTES 0x00004 /* Check the byte counters */ 237#define TDBF_ALLOCATIONS 0x00008 /* Check the flows counters */ 238#define TDBF_INVALID 0x00010 /* This SPI is not valid yet/anymore */ 239#define TDBF_FIRSTUSE 0x00020 /* Expire after first use */ 240#define TDBF_HALFIV 0x00040 /* Use half-length IV (ESP old only) */ 241#define TDBF_SOFT_TIMER 0x00080 /* Soft expiration */ 242#define TDBF_SOFT_BYTES 0x00100 /* Soft expiration */ 243#define TDBF_SOFT_ALLOCATIONS 0x00200 /* Soft expiration */ 244#define TDBF_SOFT_FIRSTUSE 0x00400 /* Soft expiration */ 245#define TDBF_PFS 0x00800 /* Ask for PFS from Key Mgmt. */ 246#define TDBF_TUNNELING 0x01000 /* Force IP-IP encapsulation */ 247#define TDBF_NOREPLAY 0x02000 /* No replay counter present */ 248#define TDBF_RANDOMPADDING 0x04000 /* Random data in the ESP padding */ 249 250 u_int32_t tdb_flags; /* Flags related to this TDB */ 251 252 TAILQ_ENTRY(tdb) tdb_expnext; /* Expiration cluster list link */ 253 TAILQ_ENTRY(tdb) tdb_explink; /* Expiration ordered list link */ 254 255 u_int32_t tdb_exp_allocations; /* Expire after so many flows */ 256 u_int32_t tdb_soft_allocations; /* Expiration warning */ 257 u_int32_t tdb_cur_allocations; /* Total number of allocations */ 258 259 u_int64_t tdb_exp_bytes; /* Expire after so many bytes passed */ 260 u_int64_t tdb_soft_bytes; /* Expiration warning */ 261 u_int64_t tdb_cur_bytes; /* Current count of bytes */ 262 263 u_int64_t tdb_exp_timeout; /* When does the SPI expire */ 264 u_int64_t tdb_soft_timeout; /* Send a soft-expire warning */ 265 u_int64_t tdb_established; /* When was the SPI established */ 266 u_int64_t tdb_timeout; /* Next absolute expiration time. */ 267 268 u_int64_t tdb_first_use; /* When was it first used */ 269 u_int64_t tdb_soft_first_use; /* Soft warning */ 270 u_int64_t tdb_exp_first_use; /* Expire if tdb_first_use + 271 * tdb_exp_first_use <= curtime */ 272 u_int64_t tdb_cryptoid; /* Crypto session ID */ 273 274 int32_t tdb_ref; /* References */ 275 u_int32_t tdb_spi; /* SPI */ 276 u_int16_t tdb_amxkeylen; /* Raw authentication key length */ 277 u_int16_t tdb_emxkeylen; /* Raw encryption key length */ 278 u_int16_t tdb_ivlen; /* IV length */ 279 u_int8_t tdb_sproto; /* IPsec protocol */ 280 u_int8_t tdb_wnd; /* Replay window */ 281 u_int8_t tdb_satype; /* SA type (RFC2367, PF_KEY) */ 282 283 union sockaddr_union tdb_dst; /* Destination address for this SA */ 284 union sockaddr_union tdb_src; /* Source address for this SA */ 285 union sockaddr_union tdb_proxy; 286 287 u_int8_t *tdb_srcid; /* Source ID for this SA */ 288 u_int8_t *tdb_dstid; /* Destination ID for this SA */ 289 u_int8_t *tdb_amxkey; /* Raw authentication key */ 290 u_int8_t *tdb_emxkey; /* Raw encryption key */ 291 292 u_int32_t tdb_rpl; /* Replay counter */ 293 u_int32_t tdb_bitmap; /* Used for replay sliding window */ 294 u_int32_t tdb_initial; /* Initial replay value */ 295 296 u_int32_t tdb_epoch; /* Used by the kernfs interface */ 297 u_int16_t tdb_srcid_len; 298 u_int16_t tdb_dstid_len; 299 u_int16_t tdb_srcid_type; 300 u_int16_t tdb_dstid_type; 301 302 u_int8_t tdb_iv[4]; /* Used for HALF-IV ESP */ 303 304 caddr_t tdb_interface; 305 struct flow *tdb_flow; /* Which outboind flows use this SA */ 306 struct flow *tdb_access; /* Ingress access control */ 307 308 struct tdb *tdb_bind_out; /* Outgoing SA to use */ 309 TAILQ_HEAD(tdb_bind_head, tdb) tdb_bind_in; 310 TAILQ_ENTRY(tdb) tdb_bind_in_next; /* Refering Incoming SAs */ 311 TAILQ_HEAD(tdb_inp_head, inpcb) tdb_inp; 312}; 313 314struct tdb_ident { 315 u_int32_t spi; 316 union sockaddr_union dst; 317 u_int8_t proto; 318}; 319 320struct ipsecinit 321{ 322 u_int8_t *ii_enckey; 323 u_int8_t *ii_authkey; 324 u_int16_t ii_enckeylen; 325 u_int16_t ii_authkeylen; 326 u_int8_t ii_encalg; 327 u_int8_t ii_authalg; 328}; 329 330struct xformsw 331{ 332 u_short xf_type; /* Unique ID of xform */ 333 u_short xf_flags; /* flags (see below) */ 334 char *xf_name; /* human-readable name */ 335 int (*xf_attach)(void); /* called at config time */ 336 int (*xf_init)(struct tdb *, struct xformsw *, struct ipsecinit *); 337 int (*xf_zeroize)(struct tdb *); /* termination */ 338 int (*xf_input)(struct mbuf *, struct tdb *, int, int); /* input */ 339 int (*xf_output)(struct mbuf *, struct tdb *, struct mbuf **, int, int); /* output */ 340}; 341 342/* xform IDs */ 343#define XF_IP4 1 /* IP inside IP */ 344#define XF_AH 2 /* AH */ 345#define XF_ESP 3 /* ESP */ 346#define XF_TCPSIGNATURE 5 /* TCP MD5 Signature option, RFC 2358 */ 347 348/* xform attributes */ 349#define XFT_AUTH 0x0001 350#define XFT_CONF 0x0100 351 352#define IPSEC_ZEROES_SIZE 256 /* Larger than an IP6 extension hdr. */ 353#define IPSEC_KERNFS_BUFSIZE 4096 354 355#if BYTE_ORDER == LITTLE_ENDIAN 356static __inline u_int64_t 357htonq(u_int64_t q) 358{ 359 register u_int32_t u, l; 360 u = q >> 32; 361 l = (u_int32_t) q; 362 363 return htonl(u) | ((u_int64_t)htonl(l) << 32); 364} 365 366#define ntohq(_x) htonq(_x) 367 368#elif BYTE_ORDER == BIG_ENDIAN 369 370#define htonq(_x) (_x) 371#define ntohq(_x) htonq(_x) 372 373#else 374#error "Please fix <machine/endian.h>" 375#endif 376 377#ifdef _KERNEL 378 379/* 380 * Protects all tdb lists. 381 * Must at least be splsoftnet (note: do not use splsoftclock as it is 382 * special on some architectures, assuming it is always an spl lowering 383 * operation). 384 */ 385#define spltdb splsoftnet 386 387extern int encdebug; 388extern int ipsec_acl; 389extern int ipsec_keep_invalid; 390extern int ipsec_in_use; 391extern int ipsec_require_pfs; 392 393extern int ipsec_soft_allocations; 394extern int ipsec_exp_allocations; 395extern int ipsec_soft_bytes; 396extern int ipsec_exp_bytes; 397extern int ipsec_soft_timeout; 398extern int ipsec_exp_timeout; 399extern int ipsec_soft_first_use; 400extern int ipsec_exp_first_use; 401extern char ipsec_def_enc[]; 402extern char ipsec_def_auth[]; 403 404extern struct enc_xform enc_xform_des; 405extern struct enc_xform enc_xform_3des; 406extern struct enc_xform enc_xform_blf; 407extern struct enc_xform enc_xform_cast5; 408extern struct enc_xform enc_xform_skipjack; 409 410extern struct auth_hash auth_hash_hmac_md5_96; 411extern struct auth_hash auth_hash_hmac_sha1_96; 412extern struct auth_hash auth_hash_hmac_ripemd_160_96; 413 414extern TAILQ_HEAD(expclusterlist_head, tdb) expclusterlist; 415extern TAILQ_HEAD(explist_head, tdb) explist; 416 417extern struct xformsw xformsw[], *xformswNXFORMSW; 418 419/* Check if a given tdb has encryption, authentication and/or tunneling */ 420#define TDB_ATTRIB(x) (((x)->tdb_encalgxform ? NOTIFY_SATYPE_CONF : 0)| \ 421 ((x)->tdb_authalgxform ? NOTIFY_SATYPE_AUTH : 0)) 422 423/* Traverse spi chain and get attributes */ 424 425#define SPI_CHAIN_ATTRIB(have, TDB_DIR, TDBP) do {\ 426 int s = spltdb(); \ 427 struct tdb *tmptdb = (TDBP); \ 428 \ 429 (have) = 0; \ 430 while (tmptdb && tmptdb->tdb_xform) { \ 431 if (tmptdb == NULL || tmptdb->tdb_flags & TDBF_INVALID) \ 432 break; \ 433 (have) |= TDB_ATTRIB(tmptdb); \ 434 tmptdb = tmptdb->TDB_DIR; \ 435 } \ 436 splx(s); \ 437} while (0) 438 439/* Misc. */ 440extern char *inet_ntoa4(struct in_addr); 441 442#ifdef INET6 443extern char *inet6_ntoa4(struct in6_addr); 444#endif /* INET6 */ 445 446extern char *ipsp_address(union sockaddr_union); 447 448/* TDB management routines */ 449extern void tdb_add_inp(struct tdb *tdb, struct inpcb *inp); 450extern u_int32_t reserve_spi(u_int32_t, u_int32_t, union sockaddr_union *, 451 union sockaddr_union *, u_int8_t, int *); 452extern struct tdb *gettdb(u_int32_t, union sockaddr_union *, u_int8_t); 453extern void puttdb(struct tdb *); 454extern void tdb_delete(struct tdb *, int, int); 455extern int tdb_init(struct tdb *, u_int16_t, struct ipsecinit *); 456extern void tdb_expiration(struct tdb *, int); 457/* Flag values for the last argument of tdb_expiration(). */ 458#define TDBEXP_EARLY 1 /* The tdb is likely to end up early. */ 459#define TDBEXP_TIMEOUT 2 /* Maintain expiration timeout. */ 460extern int tdb_walk(int (*)(struct tdb *, void *), void *); 461extern void handle_expirations(void *); 462 463/* Flow management routines */ 464extern struct flow *get_flow(void); 465extern void put_flow(struct flow *, struct tdb *, int); 466extern void delete_flow(struct flow *, struct tdb *, int); 467extern struct flow *find_flow(union sockaddr_union *, union sockaddr_union *, 468 union sockaddr_union *, union sockaddr_union *, 469 u_int8_t, struct tdb *, int); 470extern struct flow *find_global_flow(union sockaddr_union *, 471 union sockaddr_union *, 472 union sockaddr_union *, 473 union sockaddr_union *, u_int8_t); 474 475/* XF_IP4 */ 476extern int ipe4_attach(void); 477extern int ipe4_init(struct tdb *, struct xformsw *, struct ipsecinit *); 478extern int ipe4_zeroize(struct tdb *); 479extern int ipip_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); 480extern void ipe4_input __P((struct mbuf *, ...)); 481extern void ipip_input __P((struct mbuf *, int)); 482 483#ifdef INET 484extern void ip4_input __P((struct mbuf *, ...)); 485#endif /* INET */ 486 487#ifdef INET6 488extern int ip4_input6 __P((struct mbuf **, int *, int)); 489#endif /* INET */ 490 491/* XF_ETHERIP */ 492extern int etherip_output(struct mbuf *, struct tdb *, struct mbuf **, 493 int, int); 494extern void etherip_input __P((struct mbuf *, ...)); 495 496/* XF_AH */ 497extern int ah_attach(void); 498extern int ah_init(struct tdb *, struct xformsw *, struct ipsecinit *); 499extern int ah_zeroize(struct tdb *); 500extern int ah_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); 501extern int ah_output_cb(void *); 502extern int ah_input(struct mbuf *, struct tdb *, int, int); 503extern int ah_input_cb(void *); 504extern int ah_sysctl(int *, u_int, void *, size_t *, void *, size_t); 505extern int ah_massage_headers(struct mbuf **, int, int, int, int); 506 507#ifdef INET 508extern void ah4_input __P((struct mbuf *, ...)); 509extern int ah4_input_cb __P((struct mbuf *, ...)); 510#endif /* INET */ 511 512#ifdef INET6 513extern int ah6_input __P((struct mbuf **, int *, int)); 514extern int ah6_input_cb __P((struct mbuf *, int)); 515#endif /* INET6 */ 516 517/* XF_ESP */ 518extern int esp_attach(void); 519extern int esp_init(struct tdb *, struct xformsw *, struct ipsecinit *); 520extern int esp_zeroize(struct tdb *); 521extern int esp_output(struct mbuf *, struct tdb *, struct mbuf **, int, int); 522extern int esp_output_cb(void *); 523extern int esp_input(struct mbuf *, struct tdb *, int, int); 524extern int esp_input_cb(void *); 525extern int esp_sysctl(int *, u_int, void *, size_t *, void *, size_t); 526 527#ifdef INET 528extern void esp4_input __P((struct mbuf *, ...)); 529extern int esp4_input_cb __P((struct mbuf *, ...)); 530#endif /* INET */ 531 532#ifdef INET6 533extern int esp6_input __P((struct mbuf **, int *, int)); 534extern int esp6_input_cb __P((struct mbuf *, int)); 535#endif /* INET6 */ 536 537/* XF_TCPSIGNATURE */ 538extern int tcp_signature_tdb_attach __P((void)); 539extern int tcp_signature_tdb_init __P((struct tdb *, struct xformsw *, 540 struct ipsecinit *)); 541extern int tcp_signature_tdb_zeroize __P((struct tdb *)); 542extern int tcp_signature_tdb_input __P((struct mbuf *, struct tdb *, int, 543 int)); 544extern int tcp_signature_tdb_output __P((struct mbuf *, struct tdb *, 545 struct mbuf **, int, int)); 546 547/* Padding */ 548extern caddr_t m_pad(struct mbuf *, int, int); 549 550/* Replay window */ 551extern int checkreplaywindow32(u_int32_t, u_int32_t, u_int32_t *, u_int32_t, 552 u_int32_t *); 553 554extern unsigned char ipseczeroes[]; 555 556/* Packet processing */ 557extern int ipsp_process_packet(struct mbuf *, struct tdb *, int, int); 558extern int ipsp_process_done(struct mbuf *, struct tdb *); 559extern int ipsec_common_input_cb(struct mbuf *, struct tdb *, int, int); 560#endif /* _KERNEL */ 561#endif /* _NETINET_IPSP_H_ */ 562