Home | History | Annotate | Line # | Download | only in netipsec
xform.h revision 1.1 
      1 /*	$NetBSD: xform.h,v 1.1 2003/08/13 20:06:51 jonathan Exp $	*/
      2 /*	$FreeBSD: src/sys/netipsec/xform.h,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $	*/
      3 /*	$OpenBSD: ip_ipsp.h,v 1.119 2002/03/14 01:27:11 millert Exp $	*/
      4 /*
      5  * The authors of this code are John Ioannidis (ji (at) tla.org),
      6  * Angelos D. Keromytis (kermit (at) csd.uch.gr),
      7  * Niels Provos (provos (at) physnet.uni-hamburg.de) and
      8  * Niklas Hallqvist (niklas (at) appli.se).
      9  *
     10  * The original version of this code was written by John Ioannidis
     11  * for BSD/OS in Athens, Greece, in November 1995.
     12  *
     13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
     14  * by Angelos D. Keromytis.
     15  *
     16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
     17  * and Niels Provos.
     18  *
     19  * Additional features in 1999 by Angelos D. Keromytis and Niklas Hallqvist.
     20  *
     21  * Copyright (c) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
     22  * Angelos D. Keromytis and Niels Provos.
     23  * Copyright (c) 1999 Niklas Hallqvist.
     24  * Copyright (c) 2001, Angelos D. Keromytis.
     25  *
     26  * Permission to use, copy, and modify this software with or without fee
     27  * is hereby granted, provided that this entire notice is included in
     28  * all copies of any software which is or includes a copy or
     29  * modification of this software.
     30  * You may use this code under the GNU public license if you so wish. Please
     31  * contribute changes back to the authors under this freer than GPL license
     32  * so that we may further the use of strong encryption without limitations to
     33  * all.
     34  *
     35  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
     36  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
     37  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
     38  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
     39  * PURPOSE.
     40  */
     41 
     42 #ifndef _NETIPSEC_XFORM_H_
     43 #define _NETIPSEC_XFORM_H_
     44 
     45 #include <sys/types.h>
     46 #include <netinet/in.h>
     47 #include <opencrypto/xform.h>
     48 
     49 #define	AH_HMAC_HASHLEN		12	/* 96 bits of authenticator */
     50 #define	AH_HMAC_INITIAL_RPL	1	/* replay counter initial value */
     51 
     52 /*
     53  * Packet tag assigned on completion of IPsec processing; used
     54  * to speedup processing when/if the packet comes back for more
     55  * processing.
     56  */
     57 struct tdb_ident {
     58 	u_int32_t spi;
     59 	union sockaddr_union dst;
     60 	u_int8_t proto;
     61 };
     62 
     63 /*
     64  * Opaque data structure hung off a crypto operation descriptor.
     65  */
     66 struct tdb_crypto {
     67 	struct ipsecrequest	*tc_isr;	/* ipsec request state */
     68 	u_int32_t		tc_spi;		/* associated SPI */
     69 	union sockaddr_union	tc_dst;		/* dst addr of packet */
     70 	u_int8_t		tc_proto;	/* current protocol, e.g. AH */
     71 	u_int8_t		tc_nxt;		/* next protocol, e.g. IPV4 */
     72 	int			tc_protoff;	/* current protocol offset */
     73 	int			tc_skip;	/* data offset */
     74 	caddr_t			tc_ptr;		/* associated crypto data */
     75 };
     76 
     77 struct secasvar;
     78 struct ipescrequest;
     79 
     80 struct xformsw {
     81 	u_short	xf_type;		/* xform ID */
     82 #define	XF_IP4		1	/* IP inside IP */
     83 #define	XF_AH		2	/* AH */
     84 #define	XF_ESP		3	/* ESP */
     85 #define	XF_TCPSIGNATURE	5	/* TCP MD5 Signature option, RFC 2358 */
     86 #define	XF_IPCOMP	6	/* IPCOMP */
     87 	u_short	xf_flags;
     88 #define	XFT_AUTH	0x0001
     89 #define	XFT_CONF	0x0100
     90 #define	XFT_COMP	0x1000
     91 	char	*xf_name;			/* human-readable name */
     92 	int	(*xf_init)(struct secasvar*, struct xformsw*);	/* setup */
     93 	int	(*xf_zeroize)(struct secasvar*);		/* cleanup */
     94 	int	(*xf_input)(struct mbuf*, struct secasvar*,	/* input */
     95 			int, int);
     96 	int	(*xf_output)(struct mbuf*,	       		/* output */
     97 			struct ipsecrequest *, struct mbuf **, int, int);
     98 	struct xformsw *xf_next;		/* list of registered xforms */
     99 };
    100 
    101 #ifdef _KERNEL
    102 extern void xform_register(struct xformsw*);
    103 extern int xform_init(struct secasvar *sav, int xftype);
    104 
    105 struct cryptoini;
    106 
    107 /* XF_IP4 */
    108 extern	int ip4_input6(struct mbuf **m, int *offp, int proto);
    109 extern	void ip4_input(struct mbuf *m, ...);
    110 extern	int ipip_output(struct mbuf *, struct ipsecrequest *,
    111 			struct mbuf **, int, int);
    112 
    113 /* XF_AH */
    114 extern int ah_init0(struct secasvar *, struct xformsw *, struct cryptoini *);
    115 extern int ah_zeroize(struct secasvar *sav);
    116 extern struct auth_hash *ah_algorithm_lookup(int alg);
    117 extern size_t ah_hdrsiz(struct secasvar *);
    118 
    119 /* XF_ESP */
    120 extern struct enc_xform *esp_algorithm_lookup(int alg);
    121 extern size_t esp_hdrsiz(struct secasvar *sav);
    122 
    123 /* XF_COMP */
    124 extern struct comp_algo *ipcomp_algorithm_lookup(int alg);
    125 
    126 #endif /* _KERNEL */
    127 #endif /* _NETIPSEC_XFORM_H_ */
    128