]>
Commit | Line | Data |
---|---|---|
1 | /* $KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $ */ | |
2 | ||
3 | /* | |
4 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. | |
5 | * All rights reserved. | |
6 | * | |
7 | * Redistribution and use in source and binary forms, with or without | |
8 | * modification, are permitted provided that the following conditions | |
9 | * are met: | |
10 | * 1. Redistributions of source code must retain the above copyright | |
11 | * notice, this list of conditions and the following disclaimer. | |
12 | * 2. Redistributions in binary form must reproduce the above copyright | |
13 | * notice, this list of conditions and the following disclaimer in the | |
14 | * documentation and/or other materials provided with the distribution. | |
15 | * 3. Neither the name of the project nor the names of its contributors | |
16 | * may be used to endorse or promote products derived from this software | |
17 | * without specific prior written permission. | |
18 | * | |
19 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND | |
20 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
21 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | |
22 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE | |
23 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
24 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | |
25 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
26 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |
27 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | |
28 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | |
29 | * SUCH DAMAGE. | |
30 | */ | |
31 | ||
32 | #ifndef _NETKEY_KEYDB_H_ | |
33 | #define _NETKEY_KEYDB_H_ | |
34 | #include <sys/appleapiopts.h> | |
35 | ||
36 | #ifdef BSD_KERNEL_PRIVATE | |
37 | ||
38 | #include <netkey/key_var.h> | |
39 | #include <net/if_utun.h> | |
40 | ||
41 | /* Security Association Index */ | |
42 | /* NOTE: Ensure to be same address family */ | |
43 | struct secasindex { | |
44 | struct sockaddr_storage src; /* srouce address for SA */ | |
45 | struct sockaddr_storage dst; /* destination address for SA */ | |
46 | u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ | |
47 | u_int8_t mode; /* mode of protocol, see ipsec.h */ | |
48 | u_int32_t reqid; /* reqid id who owned this SA */ | |
49 | /* see IPSEC_MANUAL_REQID_MAX. */ | |
50 | u_int ipsec_ifindex; | |
51 | }; | |
52 | ||
53 | /* Security Association Data Base */ | |
54 | struct secashead { | |
55 | LIST_ENTRY(secashead) chain; | |
56 | ||
57 | struct secasindex saidx; | |
58 | ||
59 | struct sadb_ident *idents; /* source identity */ | |
60 | struct sadb_ident *identd; /* destination identity */ | |
61 | /* XXX I don't know how to use them. */ | |
62 | ||
63 | ifnet_t ipsec_if; | |
64 | u_int outgoing_if; | |
65 | u_int8_t dir; /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */ | |
66 | u_int8_t state; /* MATURE or DEAD. */ | |
67 | LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1]; | |
68 | /* SA chain */ | |
69 | /* The first of this list is newer SA */ | |
70 | ||
71 | struct route sa_route; /* route cache */ | |
72 | }; | |
73 | ||
74 | typedef int (*utun_is_keepalive_func) __P((void *, void *, u_int16_t, u_int32_t, size_t)); | |
75 | typedef int (*utun_input_func) __P((void *, void *, protocol_family_t family)); | |
76 | ||
77 | /* Security Association */ | |
78 | struct secasvar { | |
79 | LIST_ENTRY(secasvar) chain; | |
80 | LIST_ENTRY(secasvar) spihash; | |
81 | int refcnt; /* reference count */ | |
82 | u_int8_t state; /* Status of this Association */ | |
83 | ||
84 | u_int8_t alg_auth; /* Authentication Algorithm Identifier*/ | |
85 | u_int8_t alg_enc; /* Cipher Algorithm Identifier */ | |
86 | u_int32_t spi; /* SPI Value, network byte order */ | |
87 | u_int32_t flags; /* holder for SADB_KEY_FLAGS */ | |
88 | u_int16_t flags2; /* holder for SADB_SA2_KEY_FLAGS */ | |
89 | ||
90 | struct sadb_key *key_auth; /* Key for Authentication */ | |
91 | struct sadb_key *key_enc; /* Key for Encryption */ | |
92 | caddr_t iv; /* Initilization Vector */ | |
93 | u_int ivlen; /* length of IV */ | |
94 | void *sched; /* intermediate encryption key */ | |
95 | size_t schedlen; | |
96 | ||
97 | struct secreplay *replay; /* replay prevention */ | |
98 | long created; /* for lifetime */ | |
99 | ||
100 | struct sadb_lifetime *lft_c; /* CURRENT lifetime, it's constant. */ | |
101 | struct sadb_lifetime *lft_h; /* HARD lifetime */ | |
102 | struct sadb_lifetime *lft_s; /* SOFT lifetime */ | |
103 | ||
104 | struct socket *so; /* Associated socket */ | |
105 | ||
106 | u_int32_t seq; /* sequence number */ | |
107 | pid_t pid; /* message's pid */ | |
108 | ||
109 | struct secashead *sah; /* back pointer to the secashead */ | |
110 | ||
111 | /* Nat Traversal related bits */ | |
112 | u_int32_t natt_last_activity; | |
113 | u_int16_t remote_ike_port; | |
114 | u_int16_t natt_encapsulated_src_port; /* network byte order */ | |
115 | u_int16_t natt_interval; /* Interval in seconds */ | |
116 | u_int16_t natt_offload_interval; /* Hardware Offload Interval in seconds */ | |
117 | ||
118 | u_int8_t always_expire; /* Send expire/delete messages even if unused */ | |
119 | ||
120 | void *utun_pcb; | |
121 | utun_is_keepalive_func utun_is_keepalive_fn; | |
122 | utun_input_func utun_in_fn; | |
123 | }; | |
124 | ||
125 | /* replay prevention */ | |
126 | struct secreplay { | |
127 | u_int32_t count; | |
128 | u_int wsize; /* window size, i.g. 4 bytes */ | |
129 | u_int32_t seq; /* used by sender */ | |
130 | u_int32_t lastseq; /* used by receiver */ | |
131 | caddr_t bitmap; /* used by receiver */ | |
132 | int overflow; /* overflow flag */ | |
133 | }; | |
134 | ||
135 | /* socket table due to send PF_KEY messages. */ | |
136 | struct secreg { | |
137 | LIST_ENTRY(secreg) chain; | |
138 | ||
139 | struct socket *so; | |
140 | }; | |
141 | ||
142 | #ifndef IPSEC_NONBLOCK_ACQUIRE | |
143 | /* acquiring list table. */ | |
144 | struct secacq { | |
145 | LIST_ENTRY(secacq) chain; | |
146 | ||
147 | struct secasindex saidx; | |
148 | ||
149 | u_int32_t seq; /* sequence number */ | |
150 | long created; /* for lifetime */ | |
151 | int count; /* for lifetime */ | |
152 | }; | |
153 | #endif | |
154 | ||
155 | /* Sensitivity Level Specification */ | |
156 | /* nothing */ | |
157 | ||
158 | #define SADB_KILL_INTERVAL 600 /* six seconds */ | |
159 | ||
160 | struct key_cb { | |
161 | int key_count; | |
162 | int any_count; | |
163 | }; | |
164 | ||
165 | /* secpolicy */ | |
166 | extern struct secpolicy *keydb_newsecpolicy(void); | |
167 | extern void keydb_delsecpolicy(struct secpolicy *); | |
168 | /* secashead */ | |
169 | extern struct secashead *keydb_newsecashead(void); | |
170 | // extern void keydb_delsecashead(struct secashead *); // not used | |
171 | /* secasvar */ | |
172 | // extern struct secasvar *keydb_newsecasvar(void); // not used | |
173 | // extern void keydb_refsecasvar(struct secasvar *); // not used | |
174 | // extern void keydb_freesecasvar(struct secasvar *); // not used | |
175 | /* secreplay */ | |
176 | extern struct secreplay *keydb_newsecreplay(size_t); | |
177 | extern void keydb_delsecreplay(struct secreplay *); | |
178 | /* secreg */ | |
179 | // extern struct secreg *keydb_newsecreg(void); // not used | |
180 | // extern void keydb_delsecreg(struct secreg *); // not used | |
181 | ||
182 | #endif /* BSD_KERNEL_PRIVATE */ | |
183 | ||
184 | #endif /* _NETKEY_KEYDB_H_ */ |