| | 1 | /* $KAME: keydb.h,v 1.9 2000/02/22 14:06:41 itojun Exp $ */ |
| | 2 | |
| | 3 | /* |
| | 4 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| | 5 | * All rights reserved. |
| | 6 | * |
| | 7 | * Redistribution and use in source and binary forms, with or without |
| | 8 | * modification, are permitted provided that the following conditions |
| | 9 | * are met: |
| | 10 | * 1. Redistributions of source code must retain the above copyright |
| | 11 | * notice, this list of conditions and the following disclaimer. |
| | 12 | * 2. Redistributions in binary form must reproduce the above copyright |
| | 13 | * notice, this list of conditions and the following disclaimer in the |
| | 14 | * documentation and/or other materials provided with the distribution. |
| | 15 | * 3. Neither the name of the project nor the names of its contributors |
| | 16 | * may be used to endorse or promote products derived from this software |
| | 17 | * without specific prior written permission. |
| | 18 | * |
| | 19 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| | 20 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| | 21 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| | 22 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| | 23 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| | 24 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| | 25 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| | 26 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| | 27 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| | 28 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| | 29 | * SUCH DAMAGE. |
| | 30 | */ |
| | 31 | |
| | 32 | #ifndef _NETKEY_KEYDB_H_ |
| | 33 | #define _NETKEY_KEYDB_H_ |
| | 34 | #include <sys/appleapiopts.h> |
| | 35 | |
| | 36 | #ifdef BSD_KERNEL_PRIVATE |
| | 37 | |
| | 38 | #include <netkey/key_var.h> |
| | 39 | |
| | 40 | /* Security Association Index */ |
| | 41 | /* NOTE: Ensure to be same address family */ |
| | 42 | struct secasindex { |
| | 43 | struct sockaddr_storage src; /* srouce address for SA */ |
| | 44 | struct sockaddr_storage dst; /* destination address for SA */ |
| | 45 | u_int16_t proto; /* IPPROTO_ESP or IPPROTO_AH */ |
| | 46 | u_int8_t mode; /* mode of protocol, see ipsec.h */ |
| | 47 | u_int32_t reqid; /* reqid id who owned this SA */ |
| | 48 | /* see IPSEC_MANUAL_REQID_MAX. */ |
| | 49 | u_int ipsec_ifindex; |
| | 50 | }; |
| | 51 | |
| | 52 | #define SECURITY_ASSOCIATION_ANY 0x0000 |
| | 53 | #define SECURITY_ASSOCIATION_PFKEY 0x0001 |
| | 54 | #define SECURITY_ASSOCIATION_CUSTOM_IPSEC 0x0010 |
| | 55 | |
| | 56 | /* Security Association Data Base */ |
| | 57 | struct secashead { |
| | 58 | LIST_ENTRY(secashead) chain; |
| | 59 | |
| | 60 | struct secasindex saidx; |
| | 61 | |
| | 62 | ifnet_t ipsec_if; |
| | 63 | u_int outgoing_if; |
| | 64 | u_int8_t dir; /* IPSEC_DIR_INBOUND or IPSEC_DIR_OUTBOUND */ |
| | 65 | u_int8_t state; /* MATURE or DEAD. */ |
| | 66 | LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX + 1]; |
| | 67 | /* SA chain */ |
| | 68 | /* The first of this list is newer SA */ |
| | 69 | |
| | 70 | struct route_in6 sa_route; /* route cache */ |
| | 71 | |
| | 72 | uint16_t flags; |
| | 73 | u_int32_t use_count; |
| | 74 | }; |
| | 75 | |
| | 76 | #define MAX_REPLAY_WINDOWS 4 |
| | 77 | |
| | 78 | /* Security Association */ |
| | 79 | struct secasvar { |
| | 80 | LIST_ENTRY(secasvar) chain; |
| | 81 | LIST_ENTRY(secasvar) spihash; |
| | 82 | int refcnt; /* reference count */ |
| | 83 | u_int8_t state; /* Status of this Association */ |
| | 84 | |
| | 85 | u_int8_t alg_auth; /* Authentication Algorithm Identifier*/ |
| | 86 | u_int8_t alg_enc; /* Cipher Algorithm Identifier */ |
| | 87 | u_int32_t spi; /* SPI Value, network byte order */ |
| | 88 | u_int32_t flags; /* holder for SADB_KEY_FLAGS */ |
| | 89 | u_int16_t flags2; /* holder for SADB_SA2_KEY_FLAGS */ |
| | 90 | |
| | 91 | struct sadb_key *key_auth; /* Key for Authentication */ |
| | 92 | struct sadb_key *key_enc; /* Key for Encryption */ |
| | 93 | caddr_t iv; /* Initilization Vector */ |
| | 94 | u_int ivlen; /* length of IV */ |
| | 95 | void *sched; /* intermediate encryption key */ |
| | 96 | size_t schedlen; |
| | 97 | |
| | 98 | struct secreplay *replay[MAX_REPLAY_WINDOWS]; /* replay prevention */ |
| | 99 | |
| | 100 | long created; /* for lifetime */ |
| | 101 | |
| | 102 | struct sadb_lifetime *lft_c; /* CURRENT lifetime, it's constant. */ |
| | 103 | struct sadb_lifetime *lft_h; /* HARD lifetime */ |
| | 104 | struct sadb_lifetime *lft_s; /* SOFT lifetime */ |
| | 105 | |
| | 106 | struct socket *so; /* Associated socket */ |
| | 107 | |
| | 108 | u_int32_t seq; /* sequence number */ |
| | 109 | pid_t pid; /* message's pid */ |
| | 110 | |
| | 111 | struct secashead *sah; /* back pointer to the secashead */ |
| | 112 | |
| | 113 | /* Nat Traversal related bits */ |
| | 114 | u_int64_t natt_last_activity; |
| | 115 | u_int16_t remote_ike_port; |
| | 116 | u_int16_t natt_encapsulated_src_port; /* network byte order */ |
| | 117 | u_int16_t natt_interval; /* Interval in seconds */ |
| | 118 | u_int16_t natt_offload_interval; /* Hardware Offload Interval in seconds */ |
| | 119 | |
| | 120 | u_int8_t always_expire; /* Send expire/delete messages even if unused */ |
| | 121 | }; |
| | 122 | |
| | 123 | /* replay prevention */ |
| | 124 | struct secreplay { |
| | 125 | u_int8_t wsize; /* window size */ |
| | 126 | u_int32_t count; |
| | 127 | u_int32_t seq; /* used by sender */ |
| | 128 | u_int32_t lastseq; /* used by sender/receiver */ |
| | 129 | caddr_t bitmap; /* used by receiver */ |
| | 130 | int overflow; /* overflow flag */ |
| | 131 | }; |
| | 132 | |
| | 133 | /* socket table due to send PF_KEY messages. */ |
| | 134 | struct secreg { |
| | 135 | LIST_ENTRY(secreg) chain; |
| | 136 | |
| | 137 | struct socket *so; |
| | 138 | }; |
| | 139 | |
| | 140 | #ifndef IPSEC_NONBLOCK_ACQUIRE |
| | 141 | /* acquiring list table. */ |
| | 142 | struct secacq { |
| | 143 | LIST_ENTRY(secacq) chain; |
| | 144 | |
| | 145 | struct secasindex saidx; |
| | 146 | |
| | 147 | u_int32_t seq; /* sequence number */ |
| | 148 | long created; /* for lifetime */ |
| | 149 | int count; /* for lifetime */ |
| | 150 | }; |
| | 151 | #endif |
| | 152 | |
| | 153 | /* Sensitivity Level Specification */ |
| | 154 | /* nothing */ |
| | 155 | |
| | 156 | #define SADB_KILL_INTERVAL 600 /* six seconds */ |
| | 157 | |
| | 158 | struct key_cb { |
| | 159 | int key_count; |
| | 160 | int any_count; |
| | 161 | }; |
| | 162 | |
| | 163 | /* secpolicy */ |
| | 164 | extern struct secpolicy *keydb_newsecpolicy(void); |
| | 165 | extern void keydb_delsecpolicy(struct secpolicy *); |
| | 166 | /* secashead */ |
| | 167 | extern struct secashead *keydb_newsecashead(void); |
| | 168 | // extern void keydb_delsecashead(struct secashead *); // not used |
| | 169 | /* secasvar */ |
| | 170 | // extern struct secasvar *keydb_newsecasvar(void); // not used |
| | 171 | // extern void keydb_refsecasvar(struct secasvar *); // not used |
| | 172 | // extern void keydb_freesecasvar(struct secasvar *); // not used |
| | 173 | /* secreplay */ |
| | 174 | extern struct secreplay *keydb_newsecreplay(u_int8_t); |
| | 175 | extern void keydb_delsecreplay(struct secreplay *); |
| | 176 | /* secreg */ |
| | 177 | // extern struct secreg *keydb_newsecreg(void); // not used |
| | 178 | // extern void keydb_delsecreg(struct secreg *); // not used |
| | 179 | |
| | 180 | #endif /* BSD_KERNEL_PRIVATE */ |
| | 181 | |
| | 182 | #endif /* _NETKEY_KEYDB_H_ */ |
projects / apple / xnu.git / blame_incremental