1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef	_INET_IPSEC_INFO_H
27 #define	_INET_IPSEC_INFO_H
28 
29 #ifdef	__cplusplus
30 extern "C" {
31 #endif
32 
33 #include <sys/crypto/common.h>
34 
35 /*
36  * IPsec informational messages.  These are M_CTL STREAMS messages, which
37  * convey IPsec information between various IP and related modules.  Most
38  * have been deprecated by the de-STREAMS-ing of TCP/IP.  What remains is:
39  *
40  *	* Keysock consumer interface  -  These messages are wrappers for
41  *	  PF_KEY messages.  They flow between AH/ESP and keysock.
42  *
43  */
44 
45 /*
46  * The IPsec M_CTL value MUST be something that will not be even close
47  * to an IPv4 or IPv6 header.  This means the first byte must not be
48  * 0x40 - 0x4f or 0x60-0x6f.  For big-endian machines, this is fixable with
49  * the IPSEC_M_CTL prefix.  For little-endian machines, the actual M_CTL
50  * _type_ must not be in the aforementioned ranges.
51  *
52  * The reason for this avoidance is because M_CTL's with a real IPv4/IPv6
53  * datagram get sent from to TCP or UDP when an ICMP datagram affects a
54  * TCP/UDP session.
55  */
56 #define	IPSEC_M_CTL	0x73706900
57 
58 /*
59  * M_CTL types for IPsec messages.  Remember, the values 0x40 - 0x4f and 0x60
60  * - 0x6f are not to be used because of potential little-endian confusion.
61  *
62  * Offsets 3-7 (decimal) are in use, spread through this file.
63  * Check for duplicates through the whole file before adding.
64  */
65 
66 /*
67  * Keysock consumer interface.
68  *
69  * The driver/module keysock (which is a driver to PF_KEY sockets, but is
70  * a module to 'consumers' like AH and ESP) uses keysock consumer interface
71  * messages to pass on PF_KEY messages to consumers who process and act upon
72  * them.
73  */
74 #define	KEYSOCK_IN		(IPSEC_M_CTL + 3)
75 #define	KEYSOCK_OUT		(IPSEC_M_CTL + 4)
76 #define	KEYSOCK_OUT_ERR		(IPSEC_M_CTL + 5)
77 #define	KEYSOCK_HELLO		(IPSEC_M_CTL + 6)
78 #define	KEYSOCK_HELLO_ACK	(IPSEC_M_CTL + 7)
79 
80 /*
81  * KEYSOCK_HELLO is sent by keysock to a consumer when it is pushed on top
82  * of one (i.e. opened as a module).
83  *
84  * NOTE: Keysock_hello is simply an ipsec_info_t
85  */
86 
87 /*
88  * KEYSOCK_HELLO_ACK is sent by a consumer to acknowledge a KEYSOCK_HELLO.
89  * It contains the PF_KEYv2 sa_type, so keysock can redirect PF_KEY messages
90  * to the right consumer.
91  */
92 typedef struct keysock_hello_ack_s {
93 	uint32_t ks_hello_type;
94 	uint32_t ks_hello_len;
95 	uint8_t ks_hello_satype;	/* PF_KEYv2 sa_type of ks client */
96 } keysock_hello_ack_t;
97 
98 #define	KS_IN_ADDR_UNKNOWN 0
99 #define	KS_IN_ADDR_NOTTHERE 1
100 #define	KS_IN_ADDR_UNSPEC 2
101 #define	KS_IN_ADDR_ME 3
102 #define	KS_IN_ADDR_NOTME 4
103 #define	KS_IN_ADDR_MBCAST 5
104 #define	KS_IN_ADDR_DONTCARE 6
105 
106 /*
107  * KEYSOCK_IN is a PF_KEY message from a PF_KEY socket destined for a consumer.
108  */
109 typedef struct keysock_in_s {
110 	uint32_t ks_in_type;
111 	uint32_t ks_in_len;
112 	/*
113 	 * NOTE:	These pointers MUST be into the M_DATA that follows
114 	 *		this M_CTL message.  If they aren't, weirdness
115 	 *		results.
116 	 */
117 	struct sadb_ext *ks_in_extv[SADB_EXT_MAX + 1];
118 	int ks_in_srctype;	/* Source address type. */
119 	int ks_in_dsttype;	/* Dest address type. */
120 	minor_t ks_in_serial;	/* Serial # of sending socket. */
121 } keysock_in_t;
122 
123 /*
124  * KEYSOCK_OUT is a PF_KEY message from a consumer destined for a PF_KEY
125  * socket.
126  */
127 typedef struct keysock_out_s {
128 	uint32_t ks_out_type;
129 	uint32_t ks_out_len;
130 	minor_t ks_out_serial;	/* Serial # of sending socket. */
131 } keysock_out_t;
132 
133 /*
134  * KEYSOCK_OUT_ERR is sent to a consumer from keysock if for some reason
135  * keysock could not find a PF_KEY socket to deliver a consumer-originated
136  * message (e.g. SADB_ACQUIRE).
137  */
138 typedef struct keysock_out_err_s {
139 	uint32_t ks_err_type;
140 	uint32_t ks_err_len;
141 	minor_t ks_err_serial;
142 	int ks_err_errno;
143 	/*
144 	 * Other, richer error information may end up going here eventually.
145 	 */
146 } keysock_out_err_t;
147 
148 /*
149  * All IPsec informational messages are placed into the ipsec_info_t
150  * union, so that allocation can be done once, and IPsec informational
151  * messages can be recycled.
152  */
153 typedef union ipsec_info_u {
154 	struct {
155 		uint32_t ipsec_allu_type;
156 		uint32_t ipsec_allu_len;	/* In bytes */
157 	} ipsec_allu;
158 	keysock_hello_ack_t keysock_hello_ack;
159 	keysock_in_t keysock_in;
160 	keysock_out_t keysock_out;
161 	keysock_out_err_t keysock_out_err;
162 } ipsec_info_t;
163 #define	ipsec_info_type ipsec_allu.ipsec_allu_type
164 #define	ipsec_info_len ipsec_allu.ipsec_allu_len
165 
166 #ifdef	__cplusplus
167 }
168 #endif
169 
170 #endif	/* _INET_IPSEC_INFO_H */
171