Home | History | Annotate | Line # | Download | only in netipsec
keydb.h revision 1.10.4.3
      1  1.10.4.3      yamt /*	$NetBSD: keydb.h,v 1.10.4.3 2014/05/22 11:41:10 yamt Exp $	*/
      2       1.1  jonathan /*	$FreeBSD: src/sys/netipsec/keydb.h,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $	*/
      3       1.1  jonathan /*	$KAME: keydb.h,v 1.14 2000/08/02 17:58:26 sakane Exp $	*/
      4       1.1  jonathan 
      5       1.1  jonathan /*
      6       1.1  jonathan  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      7       1.1  jonathan  * All rights reserved.
      8       1.1  jonathan  *
      9       1.1  jonathan  * Redistribution and use in source and binary forms, with or without
     10       1.1  jonathan  * modification, are permitted provided that the following conditions
     11       1.1  jonathan  * are met:
     12       1.1  jonathan  * 1. Redistributions of source code must retain the above copyright
     13       1.1  jonathan  *    notice, this list of conditions and the following disclaimer.
     14       1.1  jonathan  * 2. Redistributions in binary form must reproduce the above copyright
     15       1.1  jonathan  *    notice, this list of conditions and the following disclaimer in the
     16       1.1  jonathan  *    documentation and/or other materials provided with the distribution.
     17       1.1  jonathan  * 3. Neither the name of the project nor the names of its contributors
     18       1.1  jonathan  *    may be used to endorse or promote products derived from this software
     19       1.1  jonathan  *    without specific prior written permission.
     20       1.1  jonathan  *
     21       1.1  jonathan  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     22       1.1  jonathan  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23       1.1  jonathan  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24       1.1  jonathan  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     25       1.1  jonathan  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26       1.1  jonathan  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27       1.1  jonathan  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28       1.1  jonathan  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29       1.1  jonathan  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30       1.1  jonathan  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31       1.1  jonathan  * SUCH DAMAGE.
     32       1.1  jonathan  */
     33       1.1  jonathan 
     34       1.1  jonathan #ifndef _NETIPSEC_KEYDB_H_
     35       1.1  jonathan #define _NETIPSEC_KEYDB_H_
     36       1.1  jonathan 
     37       1.1  jonathan #ifdef _KERNEL
     38       1.1  jonathan 
     39       1.5  degroote #include "opt_ipsec.h"
     40       1.5  degroote 
     41       1.1  jonathan #include <netipsec/key_var.h>
     42       1.1  jonathan #include <net/route.h>
     43       1.1  jonathan #include <netinet/in.h>
     44       1.1  jonathan 
     45  1.10.4.1      yamt #ifndef _SOCKADDR_UNION_DEFINED
     46  1.10.4.1      yamt #define _SOCKADDR_UNION_DEFINED
     47       1.1  jonathan /*
     48       1.1  jonathan  * The union of all possible address formats we handle.
     49       1.1  jonathan  */
     50       1.1  jonathan union sockaddr_union {
     51       1.1  jonathan 	struct sockaddr		sa;
     52       1.1  jonathan 	struct sockaddr_in	sin;
     53       1.1  jonathan 	struct sockaddr_in6	sin6;
     54       1.1  jonathan };
     55  1.10.4.1      yamt #endif /* _SOCKADDR_UNION_DEFINED */
     56       1.1  jonathan 
     57       1.1  jonathan /* Security Assocciation Index */
     58       1.1  jonathan /* NOTE: Ensure to be same address family */
     59       1.1  jonathan struct secasindex {
     60       1.7       spz 	union sockaddr_union src;	/* source address for SA */
     61       1.1  jonathan 	union sockaddr_union dst;	/* destination address for SA */
     62       1.1  jonathan 	u_int16_t proto;		/* IPPROTO_ESP or IPPROTO_AH */
     63       1.1  jonathan 	u_int8_t mode;			/* mode of protocol, see ipsec.h */
     64       1.1  jonathan 	u_int32_t reqid;		/* reqid id who owned this SA */
     65       1.1  jonathan 					/* see IPSEC_MANUAL_REQID_MAX. */
     66       1.1  jonathan };
     67       1.1  jonathan 
     68       1.1  jonathan /* Security Association Data Base */
     69       1.1  jonathan struct secashead {
     70       1.1  jonathan 	LIST_ENTRY(secashead) chain;
     71       1.1  jonathan 
     72       1.1  jonathan 	struct secasindex saidx;
     73       1.1  jonathan 
     74       1.1  jonathan 	struct sadb_ident *idents;	/* source identity */
     75       1.1  jonathan 	struct sadb_ident *identd;	/* destination identity */
     76       1.1  jonathan 					/* XXX I don't know how to use them. */
     77       1.1  jonathan 
     78       1.1  jonathan 	u_int8_t state;			/* MATURE or DEAD. */
     79       1.1  jonathan 	LIST_HEAD(_satree, secasvar) savtree[SADB_SASTATE_MAX+1];
     80       1.1  jonathan 					/* SA chain */
     81       1.1  jonathan 					/* The first of this list is newer SA */
     82       1.1  jonathan 
     83       1.1  jonathan 	struct route sa_route;		/* route cache */
     84       1.1  jonathan };
     85       1.1  jonathan 
     86       1.1  jonathan struct xformsw;
     87       1.1  jonathan struct enc_xform;
     88       1.1  jonathan struct auth_hash;
     89       1.1  jonathan struct comp_algo;
     90       1.1  jonathan 
     91       1.1  jonathan /* Security Association */
     92       1.1  jonathan struct secasvar {
     93       1.1  jonathan 	LIST_ENTRY(secasvar) chain;
     94       1.1  jonathan 
     95       1.1  jonathan 	u_int refcnt;			/* reference count */
     96       1.1  jonathan 	u_int8_t state;			/* Status of this Association */
     97       1.1  jonathan 
     98       1.1  jonathan 	u_int8_t alg_auth;		/* Authentication Algorithm Identifier*/
     99       1.1  jonathan 	u_int8_t alg_enc;		/* Cipher Algorithm Identifier */
    100       1.1  jonathan 	u_int8_t alg_comp;		/* Compression Algorithm Identifier */
    101       1.1  jonathan 	u_int32_t spi;			/* SPI Value, network byte order */
    102       1.1  jonathan 	u_int32_t flags;		/* holder for SADB_KEY_FLAGS */
    103       1.1  jonathan 
    104       1.1  jonathan 	struct sadb_key *key_auth;	/* Key for Authentication */
    105       1.1  jonathan 	struct sadb_key *key_enc;	/* Key for Encryption */
    106       1.1  jonathan 	u_int ivlen;			/* length of IV */
    107       1.1  jonathan 
    108       1.1  jonathan 	struct secreplay *replay;	/* replay prevention */
    109       1.9  drochner 	time_t created;			/* for lifetime */
    110       1.1  jonathan 
    111       1.1  jonathan 	struct sadb_lifetime *lft_c;	/* CURRENT lifetime, it's constant. */
    112       1.1  jonathan 	struct sadb_lifetime *lft_h;	/* HARD lifetime */
    113       1.1  jonathan 	struct sadb_lifetime *lft_s;	/* SOFT lifetime */
    114       1.1  jonathan 
    115       1.1  jonathan 	u_int32_t seq;			/* sequence number */
    116       1.1  jonathan 	pid_t pid;			/* message's pid */
    117       1.1  jonathan 
    118       1.1  jonathan 	struct secashead *sah;		/* back pointer to the secashead */
    119       1.1  jonathan 
    120       1.1  jonathan 	/*
    121       1.1  jonathan 	 * NB: Fields with a tdb_ prefix are part of the "glue" used
    122       1.1  jonathan 	 *     to interface to the OpenBSD crypto support.  This was done
    123       1.1  jonathan 	 *     to distinguish this code from the mainline KAME code.
    124       1.1  jonathan 	 */
    125       1.8  drochner 	const struct xformsw *tdb_xform;	/* transform */
    126       1.8  drochner 	const struct enc_xform *tdb_encalgxform; /* encoding algorithm */
    127       1.8  drochner 	const struct auth_hash *tdb_authalgxform; /* authentication algorithm */
    128       1.8  drochner 	const struct comp_algo *tdb_compalgxform; /* compression algorithm */
    129       1.1  jonathan 	u_int64_t tdb_cryptoid;		/* crypto session id */
    130       1.5  degroote 
    131       1.5  degroote 	u_int16_t natt_type;
    132       1.5  degroote 	u_int16_t esp_frag;
    133       1.1  jonathan };
    134       1.1  jonathan 
    135       1.1  jonathan /* replay prevention */
    136       1.1  jonathan struct secreplay {
    137       1.1  jonathan 	u_int32_t count;
    138       1.1  jonathan 	u_int wsize;		/* window size, i.g. 4 bytes */
    139       1.1  jonathan 	u_int32_t seq;		/* used by sender */
    140       1.1  jonathan 	u_int32_t lastseq;	/* used by receiver */
    141       1.4  degroote 	char *bitmap;		/* used by receiver */
    142       1.1  jonathan 	int overflow;		/* overflow flag */
    143       1.1  jonathan };
    144       1.1  jonathan 
    145       1.1  jonathan /* socket table due to send PF_KEY messages. */
    146       1.1  jonathan struct secreg {
    147       1.1  jonathan 	LIST_ENTRY(secreg) chain;
    148       1.1  jonathan 
    149       1.1  jonathan 	struct socket *so;
    150       1.1  jonathan };
    151       1.1  jonathan 
    152       1.1  jonathan #ifndef IPSEC_NONBLOCK_ACQUIRE
    153       1.1  jonathan /* acquiring list table. */
    154       1.1  jonathan struct secacq {
    155       1.1  jonathan 	LIST_ENTRY(secacq) chain;
    156       1.1  jonathan 
    157       1.1  jonathan 	struct secasindex saidx;
    158       1.1  jonathan 
    159       1.1  jonathan 	u_int32_t seq;		/* sequence number */
    160       1.9  drochner 	time_t created;		/* for lifetime */
    161       1.1  jonathan 	int count;		/* for lifetime */
    162       1.1  jonathan };
    163       1.1  jonathan #endif
    164       1.1  jonathan 
    165       1.1  jonathan /* Sensitivity Level Specification */
    166       1.1  jonathan /* nothing */
    167       1.1  jonathan 
    168       1.1  jonathan #define SADB_KILL_INTERVAL	600	/* six seconds */
    169       1.1  jonathan 
    170       1.1  jonathan /* secpolicy */
    171       1.6  degroote struct secpolicy *keydb_newsecpolicy (void);
    172       1.6  degroote void keydb_delsecpolicy (struct secpolicy *);
    173       1.1  jonathan /* secashead */
    174       1.6  degroote struct secashead *keydb_newsecashead (void);
    175       1.6  degroote void keydb_delsecashead (struct secashead *);
    176       1.1  jonathan /* secasvar */
    177       1.6  degroote struct secasvar *keydb_newsecasvar (void);
    178       1.6  degroote void keydb_refsecasvar (struct secasvar *);
    179       1.6  degroote void keydb_freesecasvar (struct secasvar *);
    180       1.1  jonathan /* secreplay */
    181       1.6  degroote struct secreplay *keydb_newsecreplay (size_t);
    182       1.6  degroote void keydb_delsecreplay (struct secreplay *);
    183       1.1  jonathan /* secreg */
    184       1.6  degroote struct secreg *keydb_newsecreg (void);
    185       1.6  degroote void keydb_delsecreg (struct secreg *);
    186       1.1  jonathan 
    187       1.1  jonathan #endif /* _KERNEL */
    188       1.1  jonathan 
    189       1.2      elad #endif /* !_NETIPSEC_KEYDB_H_ */
    190