Home | History | Annotate | Download | only in inet
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef	_INET_IPSEC_INFO_H
     27 #define	_INET_IPSEC_INFO_H
     28 
     29 #ifdef	__cplusplus
     30 extern "C" {
     31 #endif
     32 
     33 #include <sys/crypto/common.h>
     34 
     35 /*
     36  * IPsec informational messages.  These are M_CTL STREAMS messages, which
     37  * convey IPsec information between various IP and related modules.  Most
     38  * have been deprecated by the de-STREAMS-ing of TCP/IP.  What remains is:
     39  *
     40  *	* Keysock consumer interface  -  These messages are wrappers for
     41  *	  PF_KEY messages.  They flow between AH/ESP and keysock.
     42  *
     43  */
     44 
     45 /*
     46  * The IPsec M_CTL value MUST be something that will not be even close
     47  * to an IPv4 or IPv6 header.  This means the first byte must not be
     48  * 0x40 - 0x4f or 0x60-0x6f.  For big-endian machines, this is fixable with
     49  * the IPSEC_M_CTL prefix.  For little-endian machines, the actual M_CTL
     50  * _type_ must not be in the aforementioned ranges.
     51  *
     52  * The reason for this avoidance is because M_CTL's with a real IPv4/IPv6
     53  * datagram get sent from to TCP or UDP when an ICMP datagram affects a
     54  * TCP/UDP session.
     55  */
     56 #define	IPSEC_M_CTL	0x73706900
     57 
     58 /*
     59  * M_CTL types for IPsec messages.  Remember, the values 0x40 - 0x4f and 0x60
     60  * - 0x6f are not to be used because of potential little-endian confusion.
     61  *
     62  * Offsets 3-7 (decimal) are in use, spread through this file.
     63  * Check for duplicates through the whole file before adding.
     64  */
     65 
     66 /*
     67  * Keysock consumer interface.
     68  *
     69  * The driver/module keysock (which is a driver to PF_KEY sockets, but is
     70  * a module to 'consumers' like AH and ESP) uses keysock consumer interface
     71  * messages to pass on PF_KEY messages to consumers who process and act upon
     72  * them.
     73  */
     74 #define	KEYSOCK_IN		(IPSEC_M_CTL + 3)
     75 #define	KEYSOCK_OUT		(IPSEC_M_CTL + 4)
     76 #define	KEYSOCK_OUT_ERR		(IPSEC_M_CTL + 5)
     77 #define	KEYSOCK_HELLO		(IPSEC_M_CTL + 6)
     78 #define	KEYSOCK_HELLO_ACK	(IPSEC_M_CTL + 7)
     79 
     80 /*
     81  * KEYSOCK_HELLO is sent by keysock to a consumer when it is pushed on top
     82  * of one (i.e. opened as a module).
     83  *
     84  * NOTE: Keysock_hello is simply an ipsec_info_t
     85  */
     86 
     87 /*
     88  * KEYSOCK_HELLO_ACK is sent by a consumer to acknowledge a KEYSOCK_HELLO.
     89  * It contains the PF_KEYv2 sa_type, so keysock can redirect PF_KEY messages
     90  * to the right consumer.
     91  */
     92 typedef struct keysock_hello_ack_s {
     93 	uint32_t ks_hello_type;
     94 	uint32_t ks_hello_len;
     95 	uint8_t ks_hello_satype;	/* PF_KEYv2 sa_type of ks client */
     96 } keysock_hello_ack_t;
     97 
     98 #define	KS_IN_ADDR_UNKNOWN 0
     99 #define	KS_IN_ADDR_NOTTHERE 1
    100 #define	KS_IN_ADDR_UNSPEC 2
    101 #define	KS_IN_ADDR_ME 3
    102 #define	KS_IN_ADDR_NOTME 4
    103 #define	KS_IN_ADDR_MBCAST 5
    104 #define	KS_IN_ADDR_DONTCARE 6
    105 
    106 /*
    107  * KEYSOCK_IN is a PF_KEY message from a PF_KEY socket destined for a consumer.
    108  */
    109 typedef struct keysock_in_s {
    110 	uint32_t ks_in_type;
    111 	uint32_t ks_in_len;
    112 	/*
    113 	 * NOTE:	These pointers MUST be into the M_DATA that follows
    114 	 *		this M_CTL message.  If they aren't, weirdness
    115 	 *		results.
    116 	 */
    117 	struct sadb_ext *ks_in_extv[SADB_EXT_MAX + 1];
    118 	int ks_in_srctype;	/* Source address type. */
    119 	int ks_in_dsttype;	/* Dest address type. */
    120 	minor_t ks_in_serial;	/* Serial # of sending socket. */
    121 } keysock_in_t;
    122 
    123 /*
    124  * KEYSOCK_OUT is a PF_KEY message from a consumer destined for a PF_KEY
    125  * socket.
    126  */
    127 typedef struct keysock_out_s {
    128 	uint32_t ks_out_type;
    129 	uint32_t ks_out_len;
    130 	minor_t ks_out_serial;	/* Serial # of sending socket. */
    131 } keysock_out_t;
    132 
    133 /*
    134  * KEYSOCK_OUT_ERR is sent to a consumer from keysock if for some reason
    135  * keysock could not find a PF_KEY socket to deliver a consumer-originated
    136  * message (e.g. SADB_ACQUIRE).
    137  */
    138 typedef struct keysock_out_err_s {
    139 	uint32_t ks_err_type;
    140 	uint32_t ks_err_len;
    141 	minor_t ks_err_serial;
    142 	int ks_err_errno;
    143 	/*
    144 	 * Other, richer error information may end up going here eventually.
    145 	 */
    146 } keysock_out_err_t;
    147 
    148 /*
    149  * All IPsec informational messages are placed into the ipsec_info_t
    150  * union, so that allocation can be done once, and IPsec informational
    151  * messages can be recycled.
    152  */
    153 typedef union ipsec_info_u {
    154 	struct {
    155 		uint32_t ipsec_allu_type;
    156 		uint32_t ipsec_allu_len;	/* In bytes */
    157 	} ipsec_allu;
    158 	keysock_hello_ack_t keysock_hello_ack;
    159 	keysock_in_t keysock_in;
    160 	keysock_out_t keysock_out;
    161 	keysock_out_err_t keysock_out_err;
    162 } ipsec_info_t;
    163 #define	ipsec_info_type ipsec_allu.ipsec_allu_type
    164 #define	ipsec_info_len ipsec_allu.ipsec_allu_len
    165 
    166 #ifdef	__cplusplus
    167 }
    168 #endif
    169 
    170 #endif	/* _INET_IPSEC_INFO_H */
    171