xnu-4903.241.1.tar.gz

[apple/xnu.git] / bsd / netinet6 / ipsec.h

diff --git a/bsd/netinet6/ipsec.h b/bsd/netinet6/ipsec.h
index e4948d4aaef29287b57f6572329875e5ccbe1ece..e016082475d024cf25ad3711ef7fba150450666b 100644 (file)
--- a/bsd/netinet6/ipsec.h
+++ b/bsd/netinet6/ipsec.h
@@ -36,19 +36,34 @@
 
 #ifndef _NETINET6_IPSEC_H_
 #define _NETINET6_IPSEC_H_
 
 #ifndef _NETINET6_IPSEC_H_
 #define _NETINET6_IPSEC_H_

+#include <sys/cdefs.h>

 #include <sys/appleapiopts.h>
 
 #include <net/pfkeyv2.h>
 #include <sys/appleapiopts.h>
 
 #include <net/pfkeyv2.h>

+#ifdef BSD_KERNEL_PRIVATE

 #include <netkey/keydb.h>
 #include <netkey/keydb.h>

+#include <netinet/ip_var.h>
+
+/* lock for IPSec stats */
+extern lck_grp_t         *sadb_stat_mutex_grp;
+extern lck_grp_attr_t    *sadb_stat_mutex_grp_attr;
+extern lck_attr_t        *sadb_stat_mutex_attr;
+extern lck_mtx_t         *sadb_stat_mutex;
+
+
+#define IPSEC_STAT_INCREMENT(x)        \
+       OSIncrementAtomic64((SInt64 *)&x)
+
+struct secpolicyaddrrange {
+       struct sockaddr_storage start;  /* Start (low values) of address range */
+       struct sockaddr_storage end;    /* End (high values) of address range */
+};

 
 

-#ifdef KERNEL
-#ifdef __APPLE_API_PRIVATE

 /*
  * Security Policy Index
 /*
  * Security Policy Index

- * NOTE: Ensure to be same address family and upper layer protocol.
- * NOTE: ul_proto, port number, uid, gid:
- *     ANY: reserved for waldcard.
- *     0 to (~0 - 1): is one of the number of each value.
+ * Ensure that both address families in the "src" and "dst" are same.
+ * When the value of the ul_proto is ICMPv6, the port field in "src"
+ * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.

  */
 struct secpolicyindex {
        u_int8_t dir;                   /* direction of packet flow, see blow */
  */
 struct secpolicyindex {
        u_int8_t dir;                   /* direction of packet flow, see blow */


@@ -57,6 +72,9 @@ struct secpolicyindex {
        u_int8_t prefs;                 /* prefix length in bits for src */
        u_int8_t prefd;                 /* prefix length in bits for dst */
        u_int16_t ul_proto;             /* upper layer Protocol */
        u_int8_t prefs;                 /* prefix length in bits for src */
        u_int8_t prefd;                 /* prefix length in bits for dst */
        u_int16_t ul_proto;             /* upper layer Protocol */

+       ifnet_t internal_if; /* Interface a matching packet is bound to */
+       struct secpolicyaddrrange src_range;    /* IP src address range for SP */
+       struct secpolicyaddrrange dst_range;    /* IP dst address range for SP */

 #ifdef notyet
        uid_t uids;
        uid_t uidd;
 #ifdef notyet
        uid_t uids;
        uid_t uidd;


@@ -81,6 +99,11 @@ struct secpolicy {
                                /* pointer to the ipsec request tree, */
                                /* if policy == IPSEC else this value == NULL.*/
 
                                /* pointer to the ipsec request tree, */
                                /* if policy == IPSEC else this value == NULL.*/
 

+       ifnet_t ipsec_if; /* IPSec interface to use */
+       ifnet_t outgoing_if; /* Outgoing interface for encrypted traffic */
+    
+       char disabled; /* Set to ignore policy */
+    

        /*
         * lifetime handler.
         * the policy can be used without limitiation if both lifetime and
        /*
         * lifetime handler.
         * the policy can be used without limitiation if both lifetime and


@@ -103,7 +126,6 @@ struct ipsecrequest {
                                /* if __ss_len == 0 then no address specified.*/
        u_int level;            /* IPsec level defined below. */
 
                                /* if __ss_len == 0 then no address specified.*/
        u_int level;            /* IPsec level defined below. */
 

-       struct secasvar *sav;   /* place holder of SA for use */

        struct secpolicy *sp;   /* back pointer to SP */
 };
 
        struct secpolicy *sp;   /* back pointer to SP */
 };
 


@@ -124,8 +146,7 @@ struct secspacq {
        int count;              /* for lifetime */
        /* XXX: here is mbuf place holder to be sent ? */
 };
        int count;              /* for lifetime */
        /* XXX: here is mbuf place holder to be sent ? */
 };

-#endif /* __APPLE_API_PRIVATE */
-#endif /*KERNEL*/
+#endif /* BSD_KERNEL_PRIVATE */

 
 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
 #define IPSEC_PORT_ANY         0
 
 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
 #define IPSEC_PORT_ANY         0


@@ -160,6 +181,7 @@ struct secspacq {
 #define IPSEC_POLICY_IPSEC     2       /* do IPsec */
 #define IPSEC_POLICY_ENTRUST   3       /* consulting SPD if present. */
 #define IPSEC_POLICY_BYPASS    4       /* only for privileged socket. */
 #define IPSEC_POLICY_IPSEC     2       /* do IPsec */
 #define IPSEC_POLICY_ENTRUST   3       /* consulting SPD if present. */
 #define IPSEC_POLICY_BYPASS    4       /* only for privileged socket. */

+#define IPSEC_POLICY_GENERATE   5       /* same as discard - IKE daemon can override with generated policy */

 
 /* Security protocol level */
 #define        IPSEC_LEVEL_DEFAULT     0       /* reference to system default */
 
 /* Security protocol level */
 #define        IPSEC_LEVEL_DEFAULT     0       /* reference to system default */


@@ -180,38 +202,37 @@ struct secspacq {
                                 */
 #define IPSEC_REPLAYWSIZE  32
 
                                 */
 #define IPSEC_REPLAYWSIZE  32
 

-#ifdef __APPLE_API_UNSTABLE

 /* statistics for ipsec processing */
 struct ipsecstat {
 /* statistics for ipsec processing */
 struct ipsecstat {

-       u_quad_t in_success;  /* succeeded inbound process */
-       u_quad_t in_polvio;
+       u_quad_t in_success __attribute__ ((aligned (8))); /* succeeded inbound process */
+       u_quad_t in_polvio __attribute__ ((aligned (8)));

                        /* security policy violation for inbound process */
                        /* security policy violation for inbound process */

-       u_quad_t in_nosa;     /* inbound SA is unavailable */
-       u_quad_t in_inval;    /* inbound processing failed due to EINVAL */
-       u_quad_t in_nomem;    /* inbound processing failed due to ENOBUFS */
-       u_quad_t in_badspi;   /* failed getting a SPI */
-       u_quad_t in_ahreplay; /* AH replay check failed */
-       u_quad_t in_espreplay; /* ESP replay check failed */
-       u_quad_t in_ahauthsucc; /* AH authentication success */
-       u_quad_t in_ahauthfail; /* AH authentication failure */
-       u_quad_t in_espauthsucc; /* ESP authentication success */
-       u_quad_t in_espauthfail; /* ESP authentication failure */
-       u_quad_t in_esphist[256];
-       u_quad_t in_ahhist[256];
-       u_quad_t in_comphist[256];
-       u_quad_t out_success; /* succeeded outbound process */
-       u_quad_t out_polvio;
+       u_quad_t in_nosa __attribute__ ((aligned (8)));     /* inbound SA is unavailable */
+       u_quad_t in_inval __attribute__ ((aligned (8)));    /* inbound processing failed due to EINVAL */
+       u_quad_t in_nomem __attribute__ ((aligned (8)));    /* inbound processing failed due to ENOBUFS */
+       u_quad_t in_badspi __attribute__ ((aligned (8)));   /* failed getting a SPI */
+       u_quad_t in_ahreplay __attribute__ ((aligned (8))); /* AH replay check failed */
+       u_quad_t in_espreplay __attribute__ ((aligned (8))); /* ESP replay check failed */
+       u_quad_t in_ahauthsucc __attribute__ ((aligned (8))); /* AH authentication success */
+       u_quad_t in_ahauthfail __attribute__ ((aligned (8))); /* AH authentication failure */
+       u_quad_t in_espauthsucc __attribute__ ((aligned (8))); /* ESP authentication success */
+       u_quad_t in_espauthfail __attribute__ ((aligned (8))); /* ESP authentication failure */
+       u_quad_t in_esphist[256] __attribute__ ((aligned (8)));
+       u_quad_t in_ahhist[256] __attribute__ ((aligned (8)));
+       u_quad_t in_comphist[256] __attribute__ ((aligned (8)));
+       u_quad_t out_success __attribute__ ((aligned (8))); /* succeeded outbound process */
+       u_quad_t out_polvio __attribute__ ((aligned (8)));

                        /* security policy violation for outbound process */
                        /* security policy violation for outbound process */

-       u_quad_t out_nosa;    /* outbound SA is unavailable */
-       u_quad_t out_inval;   /* outbound process failed due to EINVAL */
-       u_quad_t out_nomem;    /* inbound processing failed due to ENOBUFS */
-       u_quad_t out_noroute; /* there is no route */
-       u_quad_t out_esphist[256];
-       u_quad_t out_ahhist[256];
-       u_quad_t out_comphist[256];
+       u_quad_t out_nosa __attribute__ ((aligned (8)));    /* outbound SA is unavailable */
+       u_quad_t out_inval __attribute__ ((aligned (8)));   /* outbound process failed due to EINVAL */
+       u_quad_t out_nomem __attribute__ ((aligned (8)));    /* inbound processing failed due to ENOBUFS */
+       u_quad_t out_noroute __attribute__ ((aligned (8))); /* there is no route */
+       u_quad_t out_esphist[256] __attribute__ ((aligned (8)));
+       u_quad_t out_ahhist[256] __attribute__ ((aligned (8)));
+       u_quad_t out_comphist[256] __attribute__ ((aligned (8)));

 };
 };

-#endif /* __APPLE_API_UNSTABLE */

 
 

+#ifdef BSD_KERNEL_PRIVATE

 /*
  * Definitions for IPsec & Key sysctl operations.
  */
 /*
  * Definitions for IPsec & Key sysctl operations.
  */


@@ -224,7 +245,7 @@ struct ipsecstat {
 #define IPSECCTL_DEF_ESP_NETLEV                4       /* int; ESP tunnel mode */
 #define IPSECCTL_DEF_AH_TRANSLEV       5       /* int; AH transport mode */
 #define IPSECCTL_DEF_AH_NETLEV         6       /* int; AH tunnel mode */
 #define IPSECCTL_DEF_ESP_NETLEV                4       /* int; ESP tunnel mode */
 #define IPSECCTL_DEF_AH_TRANSLEV       5       /* int; AH transport mode */
 #define IPSECCTL_DEF_AH_NETLEV         6       /* int; AH tunnel mode */

-#if 0  /*obsolete, do not reuse*/
+#if 0  /* obsolete, do not reuse */

 #define IPSECCTL_INBOUND_CALL_IKE      7
 #endif
 #define        IPSECCTL_AH_CLEARTOS            8
 #define IPSECCTL_INBOUND_CALL_IKE      7
 #endif
 #define        IPSECCTL_AH_CLEARTOS            8


@@ -269,12 +290,20 @@ struct ipsecstat {
        { "esp_randpad", CTLTYPE_INT }, \
 }
 
        { "esp_randpad", CTLTYPE_INT }, \
 }
 

-#ifdef KERNEL
-#ifdef __APPLE_API_PRIVATE
+#if defined(__ARM__)
+#define IPSEC_IS_P2ALIGNED(p)        IS_P2ALIGNED(p, sizeof (u_int32_t))
+#define IPSEC_GET_P2UNALIGNED_OFS(p) (sizeof(u_int32_t) - (((uintptr_t)(p)) & ((uintptr_t)(sizeof(u_int32_t)) - 1)))
+#else
+#define IPSEC_IS_P2ALIGNED(p)        1
+#define IPSEC_GET_P2UNALIGNED_OFS(p) 0
+#endif
+

 struct ipsec_output_state {
 struct ipsec_output_state {

+       int tunneled;

        struct mbuf *m;
        struct mbuf *m;

-       struct route *ro;
+       struct route_in6 ro;

        struct sockaddr *dst;
        struct sockaddr *dst;

+       u_int outgoing_if;

 };
 
 struct ipsec_history {
 };
 
 struct ipsec_history {


@@ -298,59 +327,69 @@ extern int ip4_esp_randpad;
 
 #define ipseclog(x)    do { if (ipsec_debug) log x; } while (0)
 
 
 #define ipseclog(x)    do { if (ipsec_debug) log x; } while (0)
 

-extern struct secpolicy *ipsec4_getpolicybysock
-       __P((struct mbuf *, u_int, struct socket *, int *));
-extern struct secpolicy *ipsec4_getpolicybyaddr
-       __P((struct mbuf *, u_int, int, int *));
+extern struct secpolicy *ipsec4_getpolicybysock(struct mbuf *, u_int,
+                                               struct socket *, int *);
+extern struct secpolicy *ipsec4_getpolicybyaddr(struct mbuf *, u_int, int,
+                                               int *);
+extern int ipsec4_getpolicybyinterface(struct mbuf *, u_int, int *,
+                        struct ip_out_args *, struct secpolicy **);
+
+extern u_int ipsec_get_reqlevel(struct ipsecrequest *);

 
 struct inpcb;
 
 struct inpcb;

-extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
-extern int ipsec_copy_policy
-       __P((struct inpcbpolicy *, struct inpcbpolicy *));
-extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
-
-extern int ipsec4_set_policy __P((struct inpcb *inp, int optname,
-       caddr_t request, size_t len, int priv));
-extern int ipsec4_get_policy __P((struct inpcb *inpcb, caddr_t request,
-       size_t len, struct mbuf **mp));
-extern int ipsec4_delete_pcbpolicy __P((struct inpcb *));
-extern int ipsec4_in_reject_so __P((struct mbuf *, struct socket *));
-extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
+extern int ipsec_init_policy(struct socket *so, struct inpcbpolicy **);
+extern int ipsec_copy_policy(struct inpcbpolicy *, struct inpcbpolicy *);
+extern u_int ipsec_get_reqlevel(struct ipsecrequest *);
+
+extern int ipsec4_set_policy(struct inpcb *inp, int optname,
+                                               caddr_t request, size_t len, int priv);
+extern int ipsec4_delete_pcbpolicy(struct inpcb *);
+extern int ipsec4_in_reject_so(struct mbuf *, struct socket *);
+extern int ipsec4_in_reject(struct mbuf *, struct inpcb *);

 
 struct secas;
 struct tcpcb;
 
 struct secas;
 struct tcpcb;

-extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
-extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
+extern int ipsec_chkreplay(u_int32_t, struct secasvar *);
+extern int ipsec_updatereplay(u_int32_t, struct secasvar *);

 
 

-extern size_t ipsec4_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
-extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
+extern size_t ipsec4_hdrsiz(struct mbuf *, u_int, struct inpcb *);
+extern size_t ipsec_hdrsiz_tcp(struct tcpcb *);
+extern size_t ipsec_hdrsiz(struct secpolicy *);

 
 struct ip;
 
 struct ip;

-extern const char *ipsec4_logpacketstr __P((struct ip *, u_int32_t));
-extern const char *ipsec_logsastr __P((struct secasvar *));
-
-extern void ipsec_dumpmbuf __P((struct mbuf *));
-
-extern int ipsec4_output __P((struct ipsec_output_state *, struct secpolicy *,
-       int));
-extern int ipsec4_tunnel_validate __P((struct mbuf *, int, u_int,
-       struct secasvar *));
-extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
-extern void ipsec_delaux __P((struct mbuf *));
-extern int ipsec_setsocket __P((struct mbuf *, struct socket *));
-extern struct socket *ipsec_getsocket __P((struct mbuf *));
-extern int ipsec_addhist __P((struct mbuf *, int, u_int32_t)); 
-extern struct ipsec_history *ipsec_gethist __P((struct mbuf *, int *));
-extern void ipsec_clearhist __P((struct mbuf *));
-#endif /* __APPLE_API_PRIVATE */
-#endif /*KERNEL*/
+extern const char *ipsec4_logpacketstr(struct ip *, u_int32_t);
+extern const char *ipsec_logsastr(struct secasvar *);
+
+extern void ipsec_dumpmbuf(struct mbuf *);
+
+extern int ipsec4_interface_output(struct ipsec_output_state *state, ifnet_t interface);
+extern int ipsec4_output(struct ipsec_output_state *, struct secpolicy *, int);
+#if INET
+extern struct mbuf * ipsec4_splithdr(struct mbuf *);
+extern int ipsec4_encapsulate(struct mbuf *, struct secasvar *);
+#endif
+#if INET6
+extern struct mbuf * ipsec6_splithdr(struct mbuf *);
+extern int ipsec6_encapsulate(struct mbuf *, struct secasvar *);
+#endif
+extern int ipsec4_tunnel_validate(struct mbuf *, int, u_int, struct secasvar *, sa_family_t *);
+extern struct mbuf *ipsec_copypkt(struct mbuf *);
+extern void ipsec_delaux(struct mbuf *);
+extern int ipsec_setsocket(struct mbuf *, struct socket *);
+extern struct socket *ipsec_getsocket(struct mbuf *);
+extern int ipsec_addhist(struct mbuf *, int, u_int32_t); 
+extern struct ipsec_history *ipsec_gethist(struct mbuf *, int *);
+extern void ipsec_clearhist(struct mbuf *);
+#endif /* BSD_KERNEL_PRIVATE */

 
 #ifndef KERNEL
 
 #ifndef KERNEL

-extern caddr_t ipsec_set_policy __P((char *, int));
-extern int ipsec_get_policylen __P((caddr_t));
-extern char *ipsec_dump_policy __P((caddr_t, char *));
+__BEGIN_DECLS
+extern caddr_t ipsec_set_policy(char *, int);
+extern int ipsec_get_policylen(caddr_t);
+extern char *ipsec_dump_policy(caddr_t, char *);

 
 

-extern const char *ipsec_strerror __P((void));
-#endif /*!KERNEL*/
+extern const char *ipsec_strerror(void);
+__END_DECLS
+#endif /* KERNEL */

 
 

-#endif /*_NETINET6_IPSEC_H_*/
+#endif /* _NETINET6_IPSEC_H_ */