/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#ifndef _INET_IPSEC_IMPL_H
#define _INET_IPSEC_IMPL_H
#ifdef __cplusplus
extern "C" {
#endif
/* Type of an entry */
/* Policy */
/* Shared or unique SA */
/* IPsec protocols and combinations */
/*
* Internally defined "any" algorithm.
* Move to PF_KEY v3 when that RFC is released.
*/
#ifdef _KERNEL
#include <inet/ipsecesp.h>
/*
* Maximum number of authentication algorithms (can be indexed by one byte
* per PF_KEY and the IKE IPsec DOI.
*/
/*
* IPsec task queue constants.
*/
/*
* So we can access IPsec global variables that live in keysock.c.
*/
/*
* Locking for ipsec policy rules:
*
* policy heads: system policy is static; per-conn polheads are dynamic,
* and refcounted (and inherited); use atomic refcounts and "don't let
* go with both hands".
*
* policy: refcounted; references from polhead, ipsec_out
*
* actions: refcounted; referenced from: action hash table, policy, ipsec_out
* selectors: refcounted; referenced from: selector hash table, policy.
*/
/*
* the following are inspired by, but not directly based on,
* found in BSD.
*
* XXX If we use these more generally, we'll have to make the names
* less generic (HASH_* will probably clobber other namespaces).
*/
{ \
}
{ \
}
{ \
}
{ \
}
{ \
}
struct { \
struct { \
}
/*
* When adding new fields to ipsec_prot_t, make sure to update
* ipsec_in_to_out_action() as well as other code in spd.c
*/
typedef struct ipsec_prot
{
unsigned int
/* XXX add lifetimes */
} ipsec_prot_t;
/*
* An individual policy action, possibly a member of a chain.
*
* Action chains may be shared between multiple policy rules.
*
* With one exception (IPSEC_POLICY_LOG), a chain consists of an
* ordered list of alternative ways to handle a packet.
*
* All actions are also "interned" into a hash table (to allow
* multiple rules with the same action chain to share one copy in
* memory).
*/
typedef struct ipsec_act
{
union
{
} ipa_u;
} ipsec_act_t;
typedef struct ipsec_action_s
{
/*
* The following bits are equivalent to an OR of bits included in the
* ipau_apply fields of this and subsequent actions in an
* action chain; this is an optimization for the sake of
* ipsec_out_process() in ip.c and a few other places.
*/
unsigned int
}
membar_exit(); \
ipsec_action_free(ipa); \
(ipa) = 0; \
}
/*
* For now, use a trivially sized hash table for actions.
* In the future we can add the structure canonicalization necessary
* to get the hash function to behave correctly..
*/
/*
* Merged address structure, for cheezy address-family independent
* matches in policy code.
*/
typedef union ipsec_addr
{
} ipsec_addr_t;
/*
* ipsec selector set, as used by the kernel policy structures.
* Note that that we specify "local" and "remote"
* rather than "source" and "destination", which allows the selectors
* for symmetric policy rules to be shared between inbound and
* outbound rules.
*
* "local" means "destination" on inbound, and "source" on outbound.
* "remote" means "source" on inbound, and "destination" on outbound.
* XXX if we add a fifth policy enforcement point for forwarded packets,
* what do we do?
*
* The ipsl_valid mask is not done as a bitfield; this is so we
* can use "ffs()" to find the "most interesting" valid tag.
*
* XXX should we have multiple types for space-conservation reasons?
* (v4 vs v6? prefix vs. range)?
*/
typedef struct ipsec_selkey
{
/*
* ICMP type and code selectors. Both have an end value to
* specify ranges, or * and *_end are equal for a single
* value
*/
/* Insert new elements above this line */
typedef struct ipsec_sel
{
} ipsec_sel_t;
/*
* One policy rule. This will be linked into a single hash chain bucket in
* the parent rule structure. If the selector is simple enough to
* allow hashing, it gets filed under ipsec_policy_root_t->ipr_hash.
* Otherwise it goes onto a linked list in ipsec_policy_root_t->ipr_nonhash[af]
*
* In addition, we file the rule into an avl tree keyed by the rule index.
* (Duplicate rules are permitted; the comparison function breaks ties).
*/
struct ipsec_policy_s
{
};
}
membar_exit(); \
ipsec_policy_free(ipp); \
(ipp) = 0; \
}
/*
* Policy ruleset. One per (protocol * direction) for system policy.
*/
#define IPSEC_AF_V4 0
typedef struct ipsec_policy_root_s
{
int ipr_nchains;
/*
* Policy head. One for system policy; there may also be one present
* on ill_t's with interface-specific policy, as well as one present
* for sockets with per-socket policy allocated.
*/
typedef struct ipsec_policy_head_s
{
}
membar_exit(); \
(iph) = 0; \
}
/*
* IPsec fragment related structures
*/
typedef struct ipsec_fragcache_entry {
typedef struct ipsec_fragcache {
/*
* Tunnel policies. We keep a minature of the transport-mode/global policy
* per each tunnel instance.
*
* People who need both an itp held down AND one of its polheads need to
* first lock the itp, THEN the polhead, otherwise deadlock WILL occur.
*/
typedef struct ipsec_tun_pol_s {
/* NOTE - Callers (tun code) synchronize their own instances for these flags. */
/* Optimization -> Do we have per-port security entries in this polhead? */
/* Optimization -> Do we have per-port security entries in this polhead? */
/* NOTE: f cannot be an expression. */
(((f) & ITPF_PFLAGS) << ITPF_SHIFT));
(((f) & ITPF_IFLAGS) >> ITPF_SHIFT))
}
membar_exit(); \
}
/*
* Certificate identity.
*/
typedef struct ipsid_s
{
} ipsid_t;
/*
*/
}
/*
* Decrement the reference count on the ID. Someone else will clean up
* after us later.
*/
membar_exit(); \
}
/*
* Following are the estimates of what the maximum AH and ESP header size
* would be. This is used to tell the upper layer the right value of MSS
* different from this, ULP will learn the right one through
* ICMP_FRAGMENTATION_NEEDED messages generated locally.
*
* AH : 12 bytes of constant header + 32 bytes of ICV checksum (SHA-512).
*/
/*
* ESP : Is a bit more complex...
*
* A system of one inequality and one equation MUST be solved for proper ESP
* overhead. The inequality is:
*
* MTU - sizeof (IP header + options) >=
* sizeof (esph_t) + sizeof (IV or ctr) + data-size + 2 + ICV
*
* IV or counter is almost always the cipher's block size. The equation is:
*
* data-size % block-size = (block-size - 2)
*
* so we can put as much data into the datagram as possible. If we are
* pessimistic and include our largest overhead cipher (AES) and hash
* (SHA-512), and assume 1500-byte MTU minus IPv4 overhead of 20 bytes, we get:
*
* 1480 >= 8 + 16 + data-size + 2 + 32
* 1480 >= 58 + data-size
* 1422 >= data-size, 1422 % 16 = 14, so 58 is the overhead!
*
* But, let's re-run the numbers with the same algorithms, but with an IPv6
* header:
*
* 1460 >= 58 + data-size
* 1402 >= data-size, 1402 % 16 = 10, meaning shrink to 1390 to get 14,
*
* which means the overhead is now 70.
*
* Hmmm... IPv4 headers can never be anything other than multiples of 4-bytes,
* and IPv6 ones can never be anything other than multiples of 8-bytes. We've
* seen overheads of 58 and 70. 58 % 16 == 10, and 70 % 16 == 6. IPv4 could
* force us to have 62 ( % 16 == 14) or 66 ( % 16 == 2), or IPv6 could force us
* to have 78 ( % 16 = 14). Let's compute IPv6 + 8-bytes of options:
*
* 1452 >= 58 + data-size
* 1394 >= data-size, 1394 % 16 = 2, meaning shrink to 1390 to get 14,
*
* Aha! The "ESP overhead" shrinks to 62 (70 - 8). This is good. Let's try
* IPv4 + 8 bytes of IPv4 options:
*
* 1472 >= 58 + data-size
* 1414 >= data-size, 1414 % 16 = 6, meaning shrink to 1406,
*
* meaning 66 is the overhead. Let's try 12 bytes:
*
* 1468 >= 58 + data-size
* 1410 >= data-size, 1410 % 16 = 2, meaning also shrink to 1406,
*
* meaning 62 is the overhead. How about 16 bytes?
*
* 1464 >= 58 + data-size
* 1406 >= data-size, 1402 % 16 = 14, which is great!
*
* this means 58 is the overhead. If I wrap and add 20 bytes, it looks just
* like IPv6's 70 bytes. If I add 24, we go back to 66 bytes.
*
* So picking 70 is a sensible, conservative default. Optimal calculations
* will depend on knowing pre-ESP header length (called "divpoint" in the ESP
* code), which could be cached in the conn_t for connected endpoints, or
* which must be computed on every datagram otherwise.
*/
/*
* Alternate, when we know the crypto block size via the SA. Assume an ICV on
* the SA. Use:
*
* discounts the overhead of the pad + padlen that gets swallowed up by the
* second (theoretically all-pad) cipher-block. If you use our examples of
* AES and SHA512, you get:
*
* 8 + 32 - 2 + 32 == 70.
*
* Which is our pre-computed maximum above.
*/
#include <inet/ipsecesp.h>
/*
* Identity hash table.
*
* Identities are refcounted and "interned" into the hash table.
* Only references coming from other objects (SA's, latching state)
* are counted in ipsid_refcnt.
*
* Locking: IPSID_REFHOLD is safe only when (a) the object's hash bucket
* is locked, (b) we know that the refcount must be > 0.
*
* The ipsid_next and ipsid_ptpn fields are only to be referenced or
* modified when the bucket lock is held; in particular, we only
* delete objects while holding the bucket lock, and we only increase
* the refcount from 0 to 1 while the bucket lock is held.
*/
typedef struct ipsif_s
{
} ipsif_t;
/*
* For call to the kernel crypto framework. State needed during
* the execution of a crypto request.
*/
typedef struct ipsec_crypto_s {
/*
* IPsec stack instances
*/
struct ipsec_stack {
/* Packet dropper for IP IPsec processing failures */
/* From spd.c */
/*
* Policy rule index generator. We assume this won't wrap in the
* lifetime of a system. If we make 2^20 policy changes per second,
* this will last 2^44 seconds, or roughly 500,000 years, so we don't
* have to worry about reusing policy index values.
*/
/*
* Active & Inactive system policy roots
*/
/* Packet dropper for generic SPD drops. */
/* ipdrop.c */
/* spd.c */
/*
* Have a counter for every possible policy message in
* ipsec_policy_failure_msgs
*/
/* Time since last ipsec policy failure that printed a message. */
/* ip_spd.c */
/* stats */
/* sadb.c */
/* Packet dropper for generic SADB drops. */
/* spd.c */
/* spd.c */
/*
* Because policy needs to know what algorithms are supported, keep the
* lists of algorithms here.
*/
/*
* Tunnel policies - AVL tree indexed by tunnel name.
*/
/* ipsec_loader.c */
int ipsec_loader_state;
int ipsec_loader_sig;
};
/* Handle the kstat_create in ip_drop_init() failing */
/*
* Loader states..
*/
#define IPSEC_LOADER_WAIT 0
/*
* ipsec_loader entrypoints.
*/
extern void ipsec_loader_init(ipsec_stack_t *);
extern void ipsec_loader_start(ipsec_stack_t *);
extern void ipsec_loader_destroy(ipsec_stack_t *);
extern void ipsec_loader_loadnow(ipsec_stack_t *);
/*
* ipsec policy entrypoints (spd.c)
*/
extern void ipsec_policy_g_destroy(void);
extern void ipsec_policy_g_init(void);
netstack_t *);
extern void ipsec_polhead_init(ipsec_policy_head_t *, int);
extern void ipsec_polhead_destroy(ipsec_policy_head_t *);
extern void ipsec_polhead_free_table(ipsec_policy_head_t *);
ip_recv_attr_t *);
extern void ipsec_in_release_refs(ip_recv_attr_t *);
extern void ipsec_out_release_refs(ip_xmit_attr_t *);
netstack_t *);
extern void ipsec_policy_free(ipsec_policy_t *);
extern void ipsec_action_free(ipsec_action_t *);
netstack_t *);
extern ipsec_policy_head_t *ipsec_polhead_create(void);
netstack_t *);
extern void ipsec_swap_global_policy(netstack_t *);
extern int ipsec_clone_system_policy(netstack_t *);
ipsec_selkey_t *, int, netstack_t *);
netstack_t *);
uint_t, int, int, netstack_t *);
netstack_t *);
netstack_t *);
netstack_t *);
ipsec_selector_t *, netstack_t *);
extern void ipsid_gc(netstack_t *);
extern void ipsec_config_flush(netstack_t *);
int);
netstack_t *);
extern void iplatch_free(ipsec_latch_t *);
extern ipsec_latch_t *iplatch_create(void);
kstat_named_t *, ipdropper_t *);
ipdropper_t *);
ipdropper_t *);
/*
* Tunnel-support SPD functions and variables.
*/
struct iptun_s; /* Defined in inet/iptun/iptun_impl.h. */
netstack_t *);
void *, netstack_t *);
ip_stack_t *);
/*
*/
extern void ipsecesp_send_keepalive(ipsa_t *);
/*
* Algorithm management helper functions.
*/
/*
* Per-socket policy, for now, takes precedence... this priority value
* insures it.
*/
/* DDI initialization functions. */
extern boolean_t ipsecesp_ddi_init(void);
extern boolean_t ipsecah_ddi_init(void);
extern boolean_t keysock_ddi_init(void);
extern boolean_t spdsock_ddi_init(void);
extern void ipsecesp_ddi_destroy(void);
extern void ipsecah_ddi_destroy(void);
extern void keysock_ddi_destroy(void);
extern void spdsock_ddi_destroy(void);
/*
* AH- and ESP-specific functions that are called directly by other modules.
*/
extern void ipsecah_algs_changed(netstack_t *);
extern void ipsecesp_algs_changed(netstack_t *);
extern void ipsecesp_init_funcs(ipsa_t *);
extern void ipsecah_init_funcs(ipsa_t *);
/*
* spdsock functions that are called directly by IP.
*/
extern void spdsock_update_pending_algs(netstack_t *);
/*
* IP functions that are called from AH and ESP.
*/
ipsec_policy_head_t *, int, ipsec_selector_t *);
/*
*/
void ip_drop_init(ipsec_stack_t *);
void ip_drop_destroy(ipsec_stack_t *);
/*
* Common functions
*/
/*
* AH and ESP counters types.
*/
#endif /* _KERNEL */
#ifdef __cplusplus
}
#endif
#endif /* _INET_IPSEC_IMPL_H */