Home | History | Annotate | Download | only in inet
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef	_INET_IPSECAH_H
     27 #define	_INET_IPSECAH_H
     28 
     29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     30 
     31 #include <inet/ip.h>
     32 #include <inet/ipdrop.h>
     33 
     34 #ifdef	__cplusplus
     35 extern "C" {
     36 #endif
     37 
     38 #include <sys/note.h>
     39 
     40 #ifdef _KERNEL
     41 /* Named Dispatch Parameter Management Structure */
     42 typedef struct ipsecahparam_s {
     43 	uint_t	ipsecah_param_min;
     44 	uint_t	ipsecah_param_max;
     45 	uint_t	ipsecah_param_value;
     46 	char	*ipsecah_param_name;
     47 } ipsecahparam_t;
     48 
     49 /*
     50  * Stats.  This may eventually become a full-blown SNMP MIB once that spec
     51  * stabilizes.
     52  */
     53 typedef struct ah_kstats_s
     54 {
     55 	kstat_named_t ah_stat_num_aalgs;
     56 	kstat_named_t ah_stat_good_auth;
     57 	kstat_named_t ah_stat_bad_auth;
     58 	kstat_named_t ah_stat_replay_failures;
     59 	kstat_named_t ah_stat_replay_early_failures;
     60 	kstat_named_t ah_stat_keysock_in;
     61 	kstat_named_t ah_stat_out_requests;
     62 	kstat_named_t ah_stat_acquire_requests;
     63 	kstat_named_t ah_stat_bytes_expired;
     64 	kstat_named_t ah_stat_out_discards;
     65 	kstat_named_t ah_stat_in_accelerated;
     66 	kstat_named_t ah_stat_out_accelerated;
     67 	kstat_named_t ah_stat_noaccel;
     68 	kstat_named_t ah_stat_crypto_sync;
     69 	kstat_named_t ah_stat_crypto_async;
     70 	kstat_named_t ah_stat_crypto_failures;
     71 } ah_kstats_t;
     72 
     73 /*
     74  * ahstack->ah_kstats is equal to ahstack->ah_ksp->ks_data if
     75  * kstat_create_netstack for ahstack->ah_ksp succeeds, but when it
     76  * fails, it will be NULL. Note this is done for all stack instances,
     77  * so it *could* fail. hence a non-NULL checking is done for
     78  * AH_BUMP_STAT and AH_DEBUMP_STAT
     79  */
     80 #define	AH_BUMP_STAT(ahstack, x)					\
     81 do {									\
     82 	if (ahstack->ah_kstats != NULL)					\
     83 		(ahstack->ah_kstats->ah_stat_ ## x).value.ui64++;	\
     84 _NOTE(CONSTCOND)							\
     85 } while (0)
     86 #define	AH_DEBUMP_STAT(ahstack, x)					\
     87 do {									\
     88 	if (ahstack->ah_kstats != NULL)					\
     89 		(ahstack->ah_kstats->ah_stat_ ## x).value.ui64--;	\
     90 _NOTE(CONSTCOND)							\
     91 } while (0)
     92 
     93 /*
     94  * IPSECAH stack instances
     95  */
     96 struct ipsecah_stack {
     97 	netstack_t		*ipsecah_netstack;	/* Common netstack */
     98 
     99 	caddr_t			ipsecah_g_nd;
    100 	ipsecahparam_t		*ipsecah_params;
    101 	kmutex_t		ipsecah_param_lock;	/* Protects params */
    102 
    103 	sadbp_t			ah_sadb;
    104 
    105 	/* Packet dropper for AH drops. */
    106 	ipdropper_t		ah_dropper;
    107 
    108 	kstat_t			*ah_ksp;
    109 	ah_kstats_t		*ah_kstats;
    110 
    111 	/*
    112 	 * Keysock instance of AH.  There can be only one per stack instance.
    113 	 * Use casptr() on this because I don't set it until KEYSOCK_HELLO
    114 	 * comes down.
    115 	 * Paired up with the ah_pfkey_q is the ah_event, which will age SAs.
    116 	 */
    117 	queue_t			*ah_pfkey_q;
    118 	timeout_id_t		ah_event;
    119 
    120 	mblk_t			*ah_ip_unbind;
    121 };
    122 typedef struct ipsecah_stack ipsecah_stack_t;
    123 
    124 #endif	/* _KERNEL */
    125 
    126 /*
    127  * For now, only provide "aligned" version of header.
    128  * If aligned version is needed, we'll go with the naming conventions then.
    129  */
    130 
    131 typedef struct ah {
    132 	uint8_t ah_nexthdr;
    133 	uint8_t ah_length;
    134 	uint16_t ah_reserved;
    135 	uint32_t ah_spi;
    136 	uint32_t ah_replay;
    137 } ah_t;
    138 
    139 #define	AH_BASELEN	12
    140 #define	AH_TOTAL_LEN(ah)	(((ah)->ah_length << 2) + AH_BASELEN - \
    141 					sizeof ((ah)->ah_replay))
    142 
    143 /* "Old" AH, without replay.  For 1827-29 compatibility. */
    144 
    145 typedef struct ahold {
    146 	uint8_t ah_nexthdr;
    147 	uint8_t ah_length;
    148 	uint16_t ah_reserved;
    149 	uint32_t ah_spi;
    150 } ahold_t;
    151 
    152 #define	AHOLD_BASELEN	8
    153 #define	AHOLD_TOTAL_LEN(ah)	(((ah)->ah_length << 2) + AH_BASELEN)
    154 
    155 #ifdef	__cplusplus
    156 }
    157 #endif
    158 
    159 #endif /* _INET_IPSECAH_H */
    160