[apple/xnu.git] / bsd / netkey / keydb.h

/*	$KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#ifndef _NETKEY_KEYDB_H_
#define _NETKEY_KEYDB_H_
#include <sys/appleapiopts.h>

#ifdef BSD_KERNEL_PRIVATE

#include <netkey/key_var.h>

/* Security Association Index */
/* NOTE: Ensure to be same address family */
struct secasindex {
	struct sockaddr_storage src;    /* srouce address for SA */
	struct sockaddr_storage dst;    /* destination address for SA */
	u_int16_t proto;                /* IPPROTO_ESP or IPPROTO_AH */
	u_int8_t mode;                  /* mode of protocol, see ipsec.h */
	u_int32_t reqid;                /* reqid id who owned this SA */
	                                /* see IPSEC_MANUAL_REQID_MAX. */
	u_int ipsec_ifindex;
};

#define SECURITY_ASSOCIATION_ANY          0x0000
#define SECURITY_ASSOCIATION_PFKEY        0x0001
#define SECURITY_ASSOCIATION_CUSTOM_IPSEC 0x0010

/* Security Association Data Base */
struct secashead {
	LIST_ENTRY(secashead) chain;

	struct secasindex saidx;

	ifnet_t ipsec_if;
	u_int outgoing_if;
	u_int8_t dir;                   /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */
	u_int8_t state;                 /* MATURE or DEAD. */
	LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX + 1];
	/* SA chain */
	/* The first of this list is newer SA */

	struct route_in6 sa_route;              /* route cache */

	uint16_t flags;
	u_int32_t use_count;
};

#define MAX_REPLAY_WINDOWS 4

/* Security Association */
struct secasvar {
	LIST_ENTRY(secasvar) chain;
	LIST_ENTRY(secasvar) spihash;
	int refcnt;                     /* reference count */
	u_int8_t state;                 /* Status of this Association */

	u_int8_t alg_auth;              /* Authentication Algorithm Identifier*/
	u_int8_t alg_enc;               /* Cipher Algorithm Identifier */
	u_int32_t spi;                  /* SPI Value, network byte order */
	u_int32_t flags;                /* holder for SADB_KEY_FLAGS */
	u_int16_t flags2;               /* holder for SADB_SA2_KEY_FLAGS */

	struct sadb_key *key_auth;      /* Key for Authentication */
	struct sadb_key *key_enc;       /* Key for Encryption */
	caddr_t iv;                     /* Initilization Vector */
	u_int ivlen;                    /* length of IV */
	void *sched;                    /* intermediate encryption key */
	size_t schedlen;

	struct secreplay *replay[MAX_REPLAY_WINDOWS]; /* replay prevention */

	long created;                   /* for lifetime */

	struct sadb_lifetime *lft_c;    /* CURRENT lifetime, it's constant. */
	struct sadb_lifetime *lft_h;    /* HARD lifetime */
	struct sadb_lifetime *lft_s;    /* SOFT lifetime */

	struct socket *so; /* Associated socket */

	u_int32_t seq;                  /* sequence number */
	pid_t pid;                      /* message's pid */

	struct secashead *sah;          /* back pointer to the secashead */

	/* Nat Traversal related bits */
	u_int64_t       natt_last_activity;
	u_int16_t       remote_ike_port;
	u_int16_t       natt_encapsulated_src_port;     /* network byte order */
	u_int16_t       natt_interval; /* Interval in seconds */
	u_int16_t       natt_offload_interval; /* Hardware Offload Interval in seconds */

	u_int8_t        always_expire; /* Send expire/delete messages even if unused */
};

/* replay prevention */
struct secreplay {
	u_int8_t wsize;           /* window size */
	u_int32_t count;
	u_int32_t seq;          /* used by sender */
	u_int32_t lastseq;      /* used by sender/receiver */
	caddr_t bitmap;         /* used by receiver */
	int overflow;           /* overflow flag */
};

/* socket table due to send PF_KEY messages. */
struct secreg {
	LIST_ENTRY(secreg) chain;

	struct socket *so;
};

#ifndef IPSEC_NONBLOCK_ACQUIRE
/* acquiring list table. */
struct secacq {
	LIST_ENTRY(secacq) chain;

	struct secasindex saidx;

	u_int32_t seq;          /* sequence number */
	long created;           /* for lifetime */
	int count;              /* for lifetime */
};
#endif

/* Sensitivity Level Specification */
/* nothing */

#define SADB_KILL_INTERVAL      600     /* six seconds */

struct key_cb {
	int key_count;
	int any_count;
};

/* secpolicy */
extern struct secpolicy *keydb_newsecpolicy(void);
extern void keydb_delsecpolicy(struct secpolicy *);
/* secashead */
extern struct secashead *keydb_newsecashead(void);
// extern void keydb_delsecashead(struct secashead *);	// not used
/* secasvar */
// extern struct secasvar *keydb_newsecasvar(void);		// not used
// extern void keydb_refsecasvar(struct secasvar *);	// not used
// extern void keydb_freesecasvar(struct secasvar *);	// not used
/* secreplay */
extern struct secreplay *keydb_newsecreplay(u_int8_t);
extern void keydb_delsecreplay(struct secreplay *);
/* secreg */
// extern struct secreg *keydb_newsecreg(void);			// not used
// extern void keydb_delsecreg(struct secreg *);		// not used

#endif /* BSD_KERNEL_PRIVATE */

#endif /* _NETKEY_KEYDB_H_ */
Commit	Line	Data
1c79356b A	1	/* $KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $ */
	2
	3	/*
	4	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	5	* All rights reserved.
	6	*
	7	* Redistribution and use in source and binary forms, with or without
	8	* modification, are permitted provided that the following conditions
	9	* are met:
	10	* 1. Redistributions of source code must retain the above copyright
	11	* notice, this list of conditions and the following disclaimer.
	12	* 2. Redistributions in binary form must reproduce the above copyright
	13	* notice, this list of conditions and the following disclaimer in the
	14	* documentation and/or other materials provided with the distribution.
	15	* 3. Neither the name of the project nor the names of its contributors
	16	* may be used to endorse or promote products derived from this software
	17	* without specific prior written permission.
	18	*
	19	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	20	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	21	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	22	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	23	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	24	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	25	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	26	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	27	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	28	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	29	* SUCH DAMAGE.
	30	*/
	31
	32	#ifndef _NETKEY_KEYDB_H_
	33	#define _NETKEY_KEYDB_H_
9bccf70c	34	#include <sys/appleapiopts.h>
1c79356b	35
39236c6e	36	#ifdef BSD_KERNEL_PRIVATE
1c79356b A	37
	38	#include <netkey/key_var.h>
	39
fe8ab488	40	/* Security Association Index */
1c79356b A	41	/* NOTE: Ensure to be same address family */
1c79356b A	42	struct secasindex {
0a7de745 A	43	struct sockaddr_storage src; /* srouce address for SA */
	44	struct sockaddr_storage dst; /* destination address for SA */
	45	u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */
	46	u_int8_t mode; /* mode of protocol, see ipsec.h */
	47	u_int32_t reqid; /* reqid id who owned this SA */
	48	/* see IPSEC_MANUAL_REQID_MAX. */
fe8ab488	49	u_int ipsec_ifindex;
1c79356b A	50	};
1c79356b A	51
ea3f0419 A	52	#define SECURITY_ASSOCIATION_ANY 0x0000
	53	#define SECURITY_ASSOCIATION_PFKEY 0x0001
	54	#define SECURITY_ASSOCIATION_CUSTOM_IPSEC 0x0010
	55
1c79356b A	56	/* Security Association Data Base */
	57	struct secashead {
	58	LIST_ENTRY(secashead) chain;
	59
	60	struct secasindex saidx;
	61
fe8ab488 A	62	ifnet_t ipsec_if;
fe8ab488 A	63	u_int outgoing_if;
b0d623f7	64	u_int8_t dir; /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */
0a7de745 A	65	u_int8_t state; /* MATURE or DEAD. */
	66	LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX + 1];
	67	/* SA chain */
	68	/* The first of this list is newer SA */
1c79356b	69
0a7de745	70	struct route_in6 sa_route; /* route cache */
ea3f0419 A	71
ea3f0419 A	72	uint16_t flags;
f427ee49	73	u_int32_t use_count;
1c79356b A	74	};
1c79356b A	75
cb323159 A	76	#define MAX_REPLAY_WINDOWS 4
cb323159 A	77
1c79356b A	78	/* Security Association */
	79	struct secasvar {
	80	LIST_ENTRY(secasvar) chain;
91447636	81	LIST_ENTRY(secasvar) spihash;
0a7de745 A	82	int refcnt; /* reference count */
	83	u_int8_t state; /* Status of this Association */
	84
	85	u_int8_t alg_auth; /* Authentication Algorithm Identifier*/
	86	u_int8_t alg_enc; /* Cipher Algorithm Identifier */
	87	u_int32_t spi; /* SPI Value, network byte order */
	88	u_int32_t flags; /* holder for SADB_KEY_FLAGS */
	89	u_int16_t flags2; /* holder for SADB_SA2_KEY_FLAGS */
	90
	91	struct sadb_key key_auth; / Key for Authentication */
	92	struct sadb_key key_enc; / Key for Encryption */
	93	caddr_t iv; /* Initilization Vector */
	94	u_int ivlen; /* length of IV */
	95	void sched; / intermediate encryption key */
9bccf70c	96	size_t schedlen;
1c79356b	97
cb323159 A	98	struct secreplay replay[MAX_REPLAY_WINDOWS]; / replay prevention */
cb323159 A	99
0a7de745	100	long created; /* for lifetime */
1c79356b	101
0a7de745 A	102	struct sadb_lifetime lft_c; / CURRENT lifetime, it's constant. */
	103	struct sadb_lifetime lft_h; / HARD lifetime */
	104	struct sadb_lifetime lft_s; / SOFT lifetime */
1c79356b	105
fe8ab488 A	106	struct socket so; / Associated socket */
fe8ab488 A	107
0a7de745 A	108	u_int32_t seq; /* sequence number */
	109	pid_t pid; /* message's pid */
	110
	111	struct secashead sah; / back pointer to the secashead */
1c79356b	112
55e303ae	113	/* Nat Traversal related bits */
0a7de745 A	114	u_int64_t natt_last_activity;
	115	u_int16_t remote_ike_port;
	116	u_int16_t natt_encapsulated_src_port; /* network byte order */
	117	u_int16_t natt_interval; /* Interval in seconds */
	118	u_int16_t natt_offload_interval; /* Hardware Offload Interval in seconds */
	119
	120	u_int8_t always_expire; /* Send expire/delete messages even if unused */
1c79356b A	121	};
	122
	123	/* replay prevention */
	124	struct secreplay {
f427ee49	125	u_int8_t wsize; /* window size */
1c79356b	126	u_int32_t count;
0a7de745	127	u_int32_t seq; /* used by sender */
cb323159	128	u_int32_t lastseq; /* used by sender/receiver */
0a7de745 A	129	caddr_t bitmap; /* used by receiver */
0a7de745 A	130	int overflow; /* overflow flag */
1c79356b A	131	};
	132
	133	/* socket table due to send PF_KEY messages. */
	134	struct secreg {
	135	LIST_ENTRY(secreg) chain;
	136
	137	struct socket *so;
	138	};
	139
	140	#ifndef IPSEC_NONBLOCK_ACQUIRE
	141	/* acquiring list table. */
	142	struct secacq {
	143	LIST_ENTRY(secacq) chain;
	144
	145	struct secasindex saidx;
	146
0a7de745 A	147	u_int32_t seq; /* sequence number */
	148	long created; /* for lifetime */
	149	int count; /* for lifetime */
1c79356b A	150	};
	151	#endif
	152
	153	/* Sensitivity Level Specification */
	154	/* nothing */
	155
0a7de745	156	#define SADB_KILL_INTERVAL 600 /* six seconds */
1c79356b A	157
	158	struct key_cb {
	159	int key_count;
	160	int any_count;
	161	};
	162
	163	/* secpolicy */
91447636 A	164	extern struct secpolicy *keydb_newsecpolicy(void);
91447636 A	165	extern void keydb_delsecpolicy(struct secpolicy *);
1c79356b	166	/* secashead */
91447636	167	extern struct secashead *keydb_newsecashead(void);
2d21ac55	168	// extern void keydb_delsecashead(struct secashead *); // not used
1c79356b	169	/* secasvar */
2d21ac55 A	170	// extern struct secasvar *keydb_newsecasvar(void); // not used
	171	// extern void keydb_refsecasvar(struct secasvar *); // not used
	172	// extern void keydb_freesecasvar(struct secasvar *); // not used
1c79356b	173	/* secreplay */
f427ee49	174	extern struct secreplay *keydb_newsecreplay(u_int8_t);
91447636	175	extern void keydb_delsecreplay(struct secreplay *);
1c79356b	176	/* secreg */
2d21ac55 A	177	// extern struct secreg *keydb_newsecreg(void); // not used
2d21ac55 A	178	// extern void keydb_delsecreg(struct secreg *); // not used
1c79356b	179
39236c6e	180	#endif /* BSD_KERNEL_PRIVATE */
1c79356b A	181
1c79356b A	182	#endif /* _NETKEY_KEYDB_H_ */