/* ipipsec.h - API of IPIPSEC */ /* ****************************************************************************** * INTERPEAK API HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipipsec.h,v $ $Revision: 1.66.2.4 $ * $Source: /home/interpeak/CVSRoot/ipipsec2/include/ipipsec.h,v $ * $Author: zan $ $Date: 2013-06-19 03:35:51 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Lennart Bang ****************************************************************************** */ #ifndef IPIPSEC_H #define IPIPSEC_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* DESCRIPTION This library contains the API for IPIPSEC implementation */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #include "ipipsec_config.h" /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include #include #include #include #include #include #include #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* *=========================================================================== * IPIPSEC2_RELEASE *=========================================================================== * IPIPSEC2 release version. */ #define IPIPSEC2_RELEASE 60900 /* *=========================================================================== * IPIPSEC2_LAS_SUPPORT *=========================================================================== * This version of IPIPSEC has LAS support. */ #define IPIPSEC2_LAS_SUPPORT 1 /* *=========================================================================== * IPIPSEC_SPI *=========================================================================== * Reserved SPI numbers. */ #define IPIPSEC_SPI_LOCAL_USE 0 #define IPIPSEC_SPI_RESERVED_MIN 1 #define IPIPSEC_SPI_RESERVED_MAX 255 /* *=========================================================================== * IPIPSEC bypass *=========================================================================== */ /* Reserved bypass flow */ #define IPIPSEC_BYPASS_FLOW ((void *)0xffffffff) /* Bypass domain value (in Ipipsec_sa_handle 'domain') */ #define IPIPSEC_AF_BYPASS 0xff /* *=========================================================================== * IPSEC ioctls *=========================================================================== * IPSEC IO controls */ #ifndef IPIPSEC_PORT_IOCTL #define IP_SIOCXIPSEC_SELECTOR IP_IOWR(BASE, 80, W, Ipipsec_ctrl_selector) #define IP_SIOCXIPSEC_NEXT_SA IP_IOWR(BASE, 81, W, Ipipsec_ioctl_sactrl) #define IP_SIOCXIPSEC_Grouped IP_IOWR(BASE, 82, W, Ipipsec_ioctl_sactrl) #define IP_SIOCXIPSEC_InUserOctets IP_IOWR(BASE, 83, W, Ipipsec_ioctl_sactrl) #define IP_SIOCXIPSEC_OutUserOctets IP_IOWR(BASE, 84, W, Ipipsec_ioctl_sactrl) #define IP_SIOCXIPSEC_InUserPackets IP_IOWR(BASE, 85, W, Ipipsec_ioctl_sactrl) #define IP_SIOCXIPSEC_OutUserPackets IP_IOWR(BASE, 86, W, Ipipsec_ioctl_sactrl) #endif /* *=========================================================================== * IPIPSEC I/O events *=========================================================================== * IPIPSEC events are use to call stack functions from IPIPSEC. */ #define IPIPSEC_EIOXIP4ID 0x3005 /* -; Next IPv4 ID. */ #define IPIPSEC_EIOXOUTPUT 0x3006 /* Ipipsec_eio_output; Output to key socket(s). */ #ifdef IPLITE #define IPIPSEC_EIOXCODE_LOCK 0x3008 /* -; Lock IPLITE code. */ #define IPIPSEC_EIOXCODE_UNLOCK 0x3009 /* -; Unlock IPLITE code. */ #endif /* *=========================================================================== * ipipsec_pfkeyv2_output send modes *=========================================================================== */ #define IPIPSEC_SNDMODE_UNICAST 1 #define IPIPSEC_SNDMODE_BROADCAST 2 #define IPIPSEC_SNDMODE_REGISTERED 3 /* *=========================================================================== * TRAPS *=========================================================================== * MIB trap types. 2nd argument in the Ipipsec_trap_func callback. */ #define IPIPSEC_TRAP_NUM 8 #define IPIPSEC_TRAPTYPE_espAuthFailureTrap 0 #define IPIPSEC_TRAPTYPE_ahAuthFailureTrap 1 #define IPIPSEC_TRAPTYPE_espReplayFailureTrap 2 #define IPIPSEC_TRAPTYPE_ahReplayFailureTrap 3 #define IPIPSEC_TRAPTYPE_espPolicyFailureTrap 4 #define IPIPSEC_TRAPTYPE_ahPolicyFailureTrap 5 #define IPIPSEC_TRAPTYPE_invalidSpiTrap 6 #define IPIPSEC_TRAPTYPE_otherPolicyFailureTrap 7 /* *=========================================================================== * Mask lengths *=========================================================================== */ #if defined(IPCOM_USE_INET6) && defined(IPCOM_USE_INET) #define ipipsec_domain_masklen(d) ((d) == IP_AF_INET? (32) : ((d) == IP_AF_INET6? (128) : (0))) #elif defined(IPCOM_USE_INET6) #define ipipsec_domain_masklen(d) ((d) == IP_AF_INET6? (128) : (0)) #else #define ipipsec_domain_masklen(d) ((d) == IP_AF_INET? (32) : (0)) #endif #define ipipsec_addrmasklen(d,m) ipcom_mask_to_prefixlen((m), ipipsec_domain_masklen(d)) /* *=========================================================================== * Return codes for ipipsec_input/output *=========================================================================== * */ #define IPIPSEC_OK 0 #define IPIPSEC_TUNNELED 1 #define IPIPSEC_KEPT 2 #define IPIPSEC_DUMMY_PKT 3 /* Dummy packet discard in daemon mode */ /* *=========================================================================== * SADB_EXT_ BITMAP *=========================================================================== */ #define SEBIT_SA (1ULL << SADB_EXT_SA) #define SEBIT_LIFETIME_CURRENT (1ULL << SADB_EXT_LIFETIME_CURRENT) #define SEBIT_LIFETIME_HARD (1ULL << SADB_EXT_LIFETIME_HARD) #define SEBIT_LIFETIME_SOFT (1ULL << SADB_EXT_LIFETIME_SOFT) #define SEBIT_ADDRESS_SRC (1ULL << SADB_EXT_ADDRESS_SRC) #define SEBIT_ADDRESS_DST (1ULL << SADB_EXT_ADDRESS_DST) #define SEBIT_ADDRESS_PROXY (1ULL << SADB_EXT_ADDRESS_PROXY) #define SEBIT_KEY_AUTH (1ULL << SADB_EXT_KEY_AUTH) #define SEBIT_KEY_ENCRYPT (1ULL << SADB_EXT_KEY_ENCRYPT) #define SEBIT_IDENTITY_SRC (1ULL << SADB_EXT_IDENTITY_SRC) #define SEBIT_IDENTITY_DST (1ULL << SADB_EXT_IDENTITY_DST) #define SEBIT_SENSITIVITY (1ULL << SADB_EXT_SENSITIVITY) #define SEBIT_PROPOSAL (1ULL << SADB_EXT_PROPOSAL) #define SEBIT_SUPPORTED (1ULL << SADB_EXT_SUPPORTED) #define SEBIT_SUPPORTED_ENCRYPOT (1ULL << SADB_EXT_SUPPORTED_ENCRYPT) #define SEBIT_SPIRANGE (1ULL << SADB_EXT_SPIRANGE) /* Linux-API extensions (original values): */ #define SEBIT_LX_POLICY (1ULL << SADB_X_EXT_POLICY) #define SEBIT_LX_SA2 (1ULL << SADB_LX_EXT_SA2) /* Old OpenBSD-API extensions (non-original values): */ #define SEBIT_X_SRC_MASK (1ULL << SADB_X_EXT_SRC_MASK) #define SEBIT_X_DST_MASK (1ULL << SADB_X_EXT_DST_MASK) #define SEBIT_X_PROTOCOL (1ULL << SADB_X_EXT_PROTOCOL) #define SEBIT_X_SA2 (1ULL << SADB_X_EXT_SA2) #define SEBIT_X_SRC_FLOW (1ULL << SADB_X_EXT_SRC_FLOW) #define SEBIT_X_DST_FLOW (1ULL << SADB_X_EXT_DST_FLOW) #define SEBIT_X_DST2 (1ULL << SADB_X_EXT_DST2) #define SEBIT_X_FLOW_OPTIONS (1ULL << SADB_X_EXT_FLOW_OPTIONS) #define SEBIT_X_UDPENCAP (1ULL << SADB_X_EXT_UDPENCAP) #define SEBIT_X_SRCMAX_FLOW (1ULL << SADB_X_EXT_SRCMAX_FLOW) #define SEBIT_X_DSTMAX_FLOW (1ULL << SADB_X_EXT_DSTMAX_FLOW) #define SEBIT_X_EXT_SA_OPTIONS (1ULL << SADB_X_EXT_SA_OPTIONS) #define SEBIT_X_EXT_KMADDRESS (1ULL << SADB_X_EXT_KMADDRESS) /* Own defined */ #define SEBIT_X_EXT_EVENT_INFO (1ULL << SADB_X_EXT_EVENT_INFO) #define SEBIT_X_EXT_ROHC_PARAM (1ULL << SADB_X_EXT_ROHC_PARAM) #define SEBIT_X_EXT_ROHC_INTEG_KEY (1ULL << SADB_X_EXT_ROHC_INTEG_KEY) /* Groups of bits */ #define SEBIT_LIFETIME (SEBIT_LIFETIME_CURRENT | SEBIT_LIFETIME_HARD | SEBIT_LIFETIME_SOFT) #define SEBIT_ADDRESS (SEBIT_ADDRESS_SRC | SEBIT_ADDRESS_DST | SEBIT_ADDRESS_PROXY) #define SEBIT_KEY (SEBIT_KEY_AUTH | SEBIT_KEY_ENCRYPT) #define SEBIT_IDENTITY (SEBIT_IDENTITY_SRC | SEBIT_IDENTITY_DST) #define SEBIT_X_MAXFLOW (SEBIT_X_SRCMAX_FLOW | SEBIT_X_DSTMAX_FLOW) #define SEBIT_X_FLOW (SEBIT_X_SRC_FLOW | SEBIT_X_DST_FLOW) #define SEBIT_X_MASK (SEBIT_X_SRC_MASK | SEBIT_X_DST_MASK) /* Extension sizes */ #define EXT_SADBADDR_SIZE_MIN (int)(sizeof(struct sadb_address) + IP_ROUNDUP(sizeof(struct Ip_sockaddr_in),8)) #define EXT_SADBADDR_SIZE_IN 24 /* same expression as above */ #define EXT_SADBADDR_SIZE_IN6 40 /* 8+sizeof(struct Ip_sockaddr_in6) = 8+28 = 36 -> rounded up = 40 */ /* *=========================================================================== * Maximum size of headers *=========================================================================== * Max size of headers added during IPsec encapsulation */ #ifdef IPCOM_USE_INET6 #define IPIPSEC_IPSEC_HDR_MAX_SIZE (IPCOM_IP6_HEADER_LENGTH + 8 + 16) /* IPv6 + ESP + AES IV */ #else #define IPIPSEC_IPSEC_HDR_MAX_SIZE (IPCOM_IP_HEADER_LENGTH + 8 + 16) /* IPv4 + ESP + AES IV */ #endif /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* *=========================================================================== * Ipipsec_sa_handle *=========================================================================== * Handle to uniquely identify a SA. */ typedef struct Ipipsec_sa_handle_struct { union Ip_in_addr_union dst; /* destination address in network endian. */ union Ip_in_addr_union src; /* source address in network endian. */ Ip_u32 spi_n; /* SPI in network endian. */ Ip_u8 protocol; /* IP_IPPROTO_ESP, IP_IPPROTO_AH or 0 for any. */ Ip_u8 direction; /* See valid values below. */ Ip_u8 domain; /* IP_AF_INET, IP_AF_INET6 or IPIPSEC_AF_BYPASS */ Ip_u8 satype; /* SADB_SATYPE_xx. */ char priority; /* -128 to 127, -128 is highest and 0 default */ Ip_u8 dscp; /* DSCP value (6 highest bits) */ } Ipipsec_sa_handle; /* 'direction' values: */ #define IPIPSEC_SADIR_INPUT 0 #define IPIPSEC_SADIR_OUTPUT 1 #define IPIPSEC_SADIR_ANY 2 /* *=========================================================================== * Ipipsec_ioctl_sactrl *=========================================================================== * Used in all IOCTLS that replace the ipipsec_sactrl() tags. */ typedef struct Ipipsec_ioctl_sactrl_struct { Ipipsec_sa_handle sa; union arg_union { Ipipsec_sa_handle next; Ipipsec_sa_handle group; Ip_u64 u64; } arg; } Ipipsec_ioctl_sactrl; /* *=========================================================================== * Ipipsec_ctrl_selector *=========================================================================== * Used in ipipsec_ctrl() to get selector/flow information. */ typedef struct Ipipsec_ctrl_selector_struct { /* SelectorEntry */ Ip_u32 Index; /* Set to 0 to get first selector (flow). * Updated by ipipsec_ctrl(). */ union Ip_in_addr_union LocalId; union Ip_in_addr_union LocalMaxId; union Ip_in_addr_union RemoteId; union Ip_in_addr_union RemoteMaxId; Ip_u16 LocalPort; /* in network endian. */ Ip_u16 LocalMaxPort; /* in network endian. */ Ip_u16 RemotePort; /* in network endian. */ Ip_u16 RemoteMaxPort; /* in network endian. */ Ip_u8 Protocol; /* IP protocol */ Ip_u8 domain; Ip_u8 direction; /* 0=in, 1=out, 2=any */ Ip_u8 flowtype; /* SADB_X_FLOW_TYPE_xx */ char flowpri; /* Flow priority -128 to 127 */ Ip_u8 ports[2]; /* [0]=ICMP type, [1]=ICMP code */ Ip_u8 pad[1]; /* unused */ /* Masks */ union Ip_in_addr_union local_mask; union Ip_in_addr_union remote_mask; /* SA */ Ipipsec_sa_handle sa; } Ipipsec_ctrl_selector; /* *=========================================================================== * Ipipsec_ip_header *=========================================================================== */ typedef union Ipipsec_ipheader_union { #ifdef IPCOM_USE_INET Ipcom_ip_header inet; #endif #ifdef IPCOM_USE_INET6 Ipcom_ip6_header inet6; #endif } Ipipsec_ip_header; /* *=========================================================================== * Ipipsec_key *=========================================================================== */ typedef struct Ipipsec_key_struct { Ip_u32 policy_id; /* Policy id (set to current in lookup) */ union Ip_in_addr_union src; /* Source address in network endian. */ union Ip_in_addr_union dst; /* Destination address in network endian. */ Ip_u32 srcscope_n; /* IPv6 only */ Ip_u32 dstscope_n; /* IPv6 only */ Ip_u8 proto; /* ESP, AH, UDP etc */ Ip_u8 domain; /* IP_AF_INET or IP_AF_INET6 */ Ip_u8 direction; /* 0=in, 1=out */ signed char priority; /* -128 (highest) to 127 (lowest) */ Ip_u8 dscp; /* DSCP value (6 highest bits) */ char pad[3]; /* currently unused, set to 0 */ union ports_union { Ip_u32 espah_spi_n; Ip_u16 udptcp_srcdst_n[2]; /* [0]=source, [1]=destination */ Ip_u8 icmp_typecode[4]; /* [0]=type, [1]=code [2]=[3]=n/a */ Ip_u8 mh_type[4]; /* [0]=type, [1]=[2]=[3]=n/a */ } ports; } Ipipsec_key; /* *=========================================================================== * Ipipsec_param *=========================================================================== * Used by ipipsec_output() and ipipsec_input() functions. */ typedef struct Ipipsec_param_struct { Ipipsec_key key; /* Packet lookup key */ /***** IPIPSEC Internal params *****/ void *output_sa; /* Output SA cache */ /* Original start and end of packet (used in ipipsec_input()) */ int pkt_org_start; int pkt_org_end; /* Original IP header pointer or new outer-IP header cache */ Ipipsec_ip_header *iph; /* Pointer to IP header (original or store-holder below) */ Ipipsec_ip_header ip; /* Store-holder for created(outer) IP-header */ int iph_length; /* IP header length */ /* UDP Encapsulation */ Ipcom_udp_header udp; /* src_port != 0 if active */ Ip_u8 tos_class; Ip_u8 ttl; Ip_u8 pad[2]; #if defined(IPHWCRYPTO) && defined(IPIPSEC_USE_ESN) Ip_u32 seqh; /* needed in HWCRYPTO async mode */ Ip_u8 calc_digest[64]; /* [ IPIPSEC_AUTH_MAXKEYLEN ] */ #endif } Ipipsec_param; /* *=========================================================================== * Ipipsec_eio_output *=========================================================================== */ typedef struct Ipipsec_eio_output_struct { Ip_u32 sndmode; void *sock; Ipcom_pkt *pkt; Ip_u16 sadb_msg_type; /* REGISTER, ACQUIRE etc. */ Ip_u16 sadb_msg_satype; /* ESP, AH etc. */ } Ipipsec_eio_output; /* *=========================================================================== * Ipipsec_eio_addr *=========================================================================== */ typedef struct Ipipsec_eio_addr_struct { Ip_u32 addr[4]; /* room for 128-bit IPv6 addr. */ Ip_u8 domain; } Ipipsec_eio_addr; /* *=========================================================================== * Ipipsec_pfkeyv2_sadb *=========================================================================== */ typedef struct Ipipsec_pfkeyv2_sadb_struct { struct sadb_msg *msg; struct sadb_sa *sa; struct sadb_lifetime *lifetime_current; struct sadb_lifetime *lifetime_hard; struct sadb_lifetime *lifetime_soft; struct sadb_address *address_src; struct sadb_address *address_dst; struct sadb_address *address_proxy; struct sadb_key *key_auth; struct sadb_key *key_encrypt; struct sadb_ident *ident_src; struct sadb_ident *ident_dst; struct sadb_sens *sens; struct sadb_prop *prop; struct sadb_supported *supported; struct sadb_supported *supported_encrypt; struct sadb_spirange *spirange; /* Linux */ void *unused17; struct sadb_x_policy *lx_policy; struct sadb_x_sa2 *lx_sa2; void *unused20_32[13]; /* Old BSD */ struct sadb_address *src_mask; struct sadb_address *dst_mask; struct sadb_protocol *protocol; struct sadb_sa *sa2; struct sadb_address *src_flow; struct sadb_address *dst_flow; struct sadb_address *dst2; struct sadb_x_flowopt *flowopt; struct sadb_x_udpencap *udpencap; struct sadb_address *srcmax_flow; struct sadb_address *dstmax_flow; struct sadb_x_saopt *saopt; struct sadb_x_kmaddress *kmaddress; /* Own defined */ struct sadb_x_event *event; struct sadb_x_rohc *rohc; struct sadb_key *rohc_integ_key; } Ipipsec_pfkeyv2_sadb; /* **************************************************************************** * 6 PUBLIC FUNCTIONS **************************************************************************** */ /******************************************************************************* * * ipipsec_ctrl - get global IPsec statistics, trap, or flow information * * Get global IPsec statistics, trap, or flow information. * * Parameter: * \is * \i * An array of tag/value pairs terminated by IP_TAG_END. Valid parameter tags are * defined below. Values are 32-bit parameter values or pointers. * \ie * * \ts * IPIPSEC_CTRLT_GET_SELECTOR (deprecated) | Ipipsec_ctrl_selector* * IPIPSEC_CTRLT_GET_ipsecEspCurrentInboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecEspTotalInboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecEspCurrentOutboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecEspTotalOutboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecAhCurrentInboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecAhTotalInboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecAhCurrentOutboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecAhTotalOutboundSAs | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecDecryptionErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecAuthenticationErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecReplayErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecPolicyErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecOtherReceiveErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecSendErrors | Ip_u32 * IPIPSEC_CTRLT_GET_ipsecUnknownSpiErrors | Ip_u32 * IPIPSEC_CTRLT_GET_espAuthFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_ahAuthFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_espReplayFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_ahReplayFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_espPolicyFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_ahPolicyFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_invalidSpiTrapEnable | Ip_u32 * IPIPSEC_CTRLT_GET_otherPolicyFailureTrapEnable| Ip_u32 * IPIPSEC_CTRLT_SET_espAuthFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_ahAuthFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_espReplayFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_ahReplayFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_espPolicyFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_ahPolicyFailureTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_invalidSpiTrapEnable | Ip_u32 * IPIPSEC_CTRLT_SET_otherPolicyFailureTrapEnable| Ip_u32 * IPIPSEC_CTRLT_SET_TRAP_FUNCTION | void* * IPIPSEC_TRABCBT_NUM_ERRORS | Ip_u32 * IPIPSEC_TRABCBT_LOCAL_ADDR | union Ip_in_addr_union* * IPIPSEC_TRABCBT_PEER_ADDR | union Ip_in_addr_union* * IPIPSEC_TRABCBT_SECURITY_PROTOCOL | Ip_u32 * IPIPSEC_TRABCBT_SPI | Ip_u32 * IPIPSEC_TRABCBT_DOMAIN | Ip_u32 * \te * * \cs * typedef struct Ipipsec_ctrl_selector_struct * { * /@ SelectorEntry @/ * Ip_u32 Index; /@ Set to 0 to get first selector (flow). * Updated by ipipsec_ctrl(). @/ * union Ip_in_addr_union LocalId; * union Ip_in_addr_union RemoteId; * Ip_u16 LocalPort; /@ in network endian. @/ * Ip_u16 LocalMaxPort; /@ in network endian. @/ * Ip_u16 RemotePort; /@ in network endian. @/ * Ip_u16 RemoteMaxPort; /@ in network endian. @/ * Ip_u8 Protocol; * Ip_u8 domain; * Ip_u8 direction; * Ip_u8 flowtype; /@ SADB_X_FLOW_TYPE_xx @/ * * /@ Masks @/ * union Ip_in_addr_union local_mask; * union Ip_in_addr_union remote_mask; * * /@ SA @/ * Ipipsec_sa_handle sa; * } * Ipipsec_ctrl_selector; * * typedef Ip_u32 (*Ipipsec_trap_func)(Ipipsec_sa_handle *sa, Ip_u32 traptype, Ip_tag *tags); * \ce * * EXAMPLE * \cs * int example(void) * { * Ip_tag tags[3]; * Ip_err retval; * Ipipsec_ctrl_selector sel; * * sel.Index = 0; /@ get first selector. @/ * tags[0] = IPIPSEC_CTRLT_GET_SELECTOR; * tags[1] = (Ip_tag)&sel; * tags[2] = IP_TAG_END; * * retval = ipipsec_ctrl(tags); * if(retval != IPCOM_SUCCESS) * { * ipcom_printf("error: Selector print aborted: error = %ld"IP_LF, * retval); * return -1; * } * * ipcom_printf("[%ld] :: ", sel.Index); * } * \ce * * RETURNS: Either 'IPCOM_SUCCESS' or one of the following errors: * 'IPCOM_ERR_INVALID_TAG_VALUE', 'IPCOM_ERR_UNSUPPORTED_TAG'. * * ERRNO: */ IP_PUBLIC Ip_err ipipsec_ctrl ( Ip_tag *ctrl_tags ); /****** IPsec control tags. ******/ /* ****************** Selectors ********************** * Selectors (also named 'flows') are used to direct output to a certain SA * or for input access list. * * This tag is used to get first/next lexicographic selector based on a 32-bit * 'id' in the Ipipsec_ctrl_selector. * The 'id' value should be set to 0 for the first selector. Setting 'id' to * a non-zero index results in the retrieval of the next lexicographic * id or 0 if none available. */ #define IPIPSEC_CTRLT_GET_SELECTOR 0xff050001 /* Ipipsec_ctrl_selector* */ /* note: IPIPSEC_CTRLT_GET_SELECTOR is deprecated, use IP_SIOCXIPSEC_SELECTOR ioctl */ /* -- MIB entity IPsec statistics */ #define IPIPSEC_CTRLT_GET_ipsecEspCurrentInboundSAs 0xff050010 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecEspTotalInboundSAs 0xff050011 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecEspCurrentOutboundSAs 0xff050012 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecEspTotalOutboundSAs 0xff050013 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecAhCurrentInboundSAs 0xff050014 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecAhTotalInboundSAs 0xff050015 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecAhCurrentOutboundSAs 0xff050016 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecAhTotalOutboundSAs 0xff050017 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecDecryptionErrors 0xff050018 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecAuthenticationErrors 0xff050019 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecReplayErrors 0xff05001a /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecPolicyErrors 0xff05001b /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecOtherReceiveErrors 0xff05001c /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecSendErrors 0xff05001d /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ipsecUnknownSpiErrors 0xff05001e /* Ip_u32 */ /* -- MIB trap control */ /* check if trap enabled/disabled */ #define IPIPSEC_CTRLT_GET_espAuthFailureTrapEnable 0xff050020 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ahAuthFailureTrapEnable 0xff050021 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_espReplayFailureTrapEnable 0xff050022 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ahReplayFailureTrapEnable 0xff050023 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_espPolicyFailureTrapEnable 0xff050024 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_ahPolicyFailureTrapEnable 0xff050025 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_invalidSpiTrapEnable 0xff050026 /* Ip_u32 */ #define IPIPSEC_CTRLT_GET_otherPolicyFailureTrapEnable 0xff050027 /* Ip_u32 */ /* enable/disable trap */ #define IPIPSEC_CTRLT_SET_espAuthFailureTrapEnable 0xff050028 /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_ahAuthFailureTrapEnable 0xff050029 /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_espReplayFailureTrapEnable 0xff05002a /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_ahReplayFailureTrapEnable 0xff05002b /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_espPolicyFailureTrapEnable 0xff05002c /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_ahPolicyFailureTrapEnable 0xff05002d /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_invalidSpiTrapEnable 0xff05002e /* Ip_u32 */ #define IPIPSEC_CTRLT_SET_otherPolicyFailureTrapEnable 0xff05002f /* Ip_u32 */ /* MIB trap function. If not set, no SA traps will be generated. */ #define IPIPSEC_CTRLT_SET_TRAP_FUNCTION 0xff05000a /* void * */ typedef Ip_u32 (*Ipipsec_trap_func)(Ipipsec_sa_handle *sa, Ip_u32 traptype, Ip_tag *tags); /* The trap callback function use the following tags: */ #define IPIPSEC_TRABCBT_NUM_ERRORS 0xffff0001 /* Ip_u32 */ #define IPIPSEC_TRABCBT_LOCAL_ADDR 0xffff0002 /* union Ip_in_addr_union* */ #define IPIPSEC_TRABCBT_PEER_ADDR 0xffff0003 /* union Ip_in_addr_union* */ #define IPIPSEC_TRABCBT_SECURITY_PROTOCOL 0xffff0004 /* Ip_u32 */ #define IPIPSEC_TRABCBT_SPI 0xffff0005 /* Ip_u32 */ #define IPIPSEC_TRABCBT_DOMAIN 0xffff0007 /* Ip_u32 */ /******************************************************************************* * * ipipsec_sactrl - get SA-specific information and configuration values * * Get SA-specific information and configuration values. * * Parameters: * \is * \i * An 'ipipsec_sa_handle' structure identifying the SA. * \i * An array of tag/value pairs terminated by IP_TAG_END. Valid parameter tags are * defined below. Values are 32-bit parameter values or pointers. * \ie * * \ts * IPIPSEC_SACTRLT_GET_NEXT_SA (deprecated) | Ipipsec_sa_handle* * IPIPSEC_SACTRLT_GET_SaSelector | Ip_u32 * IPIPSEC_SACTRLT_GET_SaCreator | Ip_u32 * IPIPSEC_SACTRLT_GET_Encapsulation | Ip_u32 * IPIPSEC_SACTRLT_GET_EncAlg | Ip_u32 * IPIPSEC_SACTRLT_GET_EncKeyLength | Ip_u32 * IPIPSEC_SACTRLT_GET_AuthAlg | Ip_u32 * IPIPSEC_SACTRLT_GET_AuthKeyLength | Ip_u32 * IPIPSEC_SACTRLT_GET_RepWinSize | Ip_u32 * IPIPSEC_SACTRLT_GET_LimitSeconds | Ip_u32 * IPIPSEC_SACTRLT_GET_LimitKbytes | Ip_u32 * IPIPSEC_SACTRLT_GET_AccSeconds | Ip_u32 * IPIPSEC_SACTRLT_GET_InAccKbytes | Ip_u32 * IPIPSEC_SACTRLT_GET_OutAccKbytes | Ip_u32 * IPIPSEC_SACTRLT_GET_InUserOctets (dep.) | Ip_u64* * IPIPSEC_SACTRLT_GET_OutUserOctets (dep.) | Ip_u64* * IPIPSEC_SACTRLT_GET_InPackets (dep.) | Ip_u64* * IPIPSEC_SACTRLT_GET_OutPackets (dep.) | Ip_u64* * IPIPSEC_SACTRLT_GET_DecryptErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_AuthErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_ReplayErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_PolicyErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_PadErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_OtherReceiveErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_OutSendErrors | Ip_u32 * IPIPSEC_SACTRLT_GET_Grouped (dep.) | Ipipsec_sa_handle* * IPIPSEC_SACTRLT_GET_DstAddr | size = sizeof(Ip_addr4) * IPIPSEC_SACTRLT_GET_SrcAddr | size = sizeof(Ip_addr4) * IPIPSEC_SACTRLT_GET_State | size = sizeof(Ip_u32) * IPIPSEC_SACTRLT_GET_DstAddr6 | size = 16 * IPIPSEC_SACTRLT_GET_SrcAddr6 | size = 16 * \te * * \cs * typedef struct Ipipsec_sa_handle_struct * { * union Ip_in_addr_union dst; /@ address in network endian. @/ * * Ip_u32 spi_n; /@ SPI in network endian. @/ * * Ip_u8 protocol; /@ IP_IPPROTO_ESP, IP_IPPROTO_AH or 0 for any. @/ * Ip_u8 direction; /@ See valid values below. @/ * Ip_u8 domain; /@ IP_AF_INET or IP_AF_INET6 @/ * Ip_u8 satype; /@ SADB_SATYPE_xx. @/ * } * Ipipsec_sa_handle; * * /@ 'direction' values: @/ * #define IPIPSEC_SADIR_INPUT 0 * #define IPIPSEC_SADIR_OUTPUT 1 * #define IPIPSEC_SADIR_ANY 2 * \ce * * EXAMPLE * \cs * * int example(void) * { * Ipipsec_sa_handle sa, sa_next, sa_group; * int num; * Ip_err retval; * Ip_tag tags[7]; * #ifdef IPCOM_USE_INET6 * char str[40]; * #else * char str[16]; * #endif * * (void)vars; * * /@ Print all SAs. @/ * ipcom_printf("SA - Security Associations:"IP_LF); * * sa_next.spi_n = 0; /@ get first SA. @/ * * for(num = 0;;) * { * ipcom_memcpy(&sa, &sa_next, sizeof(Ipipsec_sa_handle)); * sa_next.direction = IPIPSEC_SADIR_ANY; * sa_next.protocol = 0; * sa_next.domain = 0; * tags[0] = IPIPSEC_SACTRLT_GET_NEXT_SA; * tags[1] = (Ip_tag)&sa_next; * tags[2] = IP_TAG_END; * retval = ipipsec_sactrl(&sa, tags); * if(retval != IPCOM_SUCCESS) * { * ipcom_printf("ipsecctrl: ipipsec_sactrl(next) failed, error = * %ld"IP_LF, retval); * return -1; * } * * if(sa_next.spi_n == 0) * break; * * /@ Get additional information. @/ * tags[0] = IPIPSEC_SACTRLT_GET_AuthAlg; * tags[2] = IPIPSEC_SACTRLT_GET_EncAlg; * tags[4] = IPIPSEC_SACTRLT_GET_Grouped; * tags[5] = (Ip_tag)&sa_group; * tags[6] = IP_TAG_END; * * retval = ipipsec_sactrl(&sa_next, tags); * if(retval != IPCOM_SUCCESS) * { * ipcom_printf("ipsecctrl: ipipsec_sactrl(info) failed, error = * %ld"IP_LF, retval); * return -1; * } * * ipcom_printf("[%2d] :: %-6s %s spi=0x%-5lx dst=%-15s auth=%s", * ++num, * sa_next.direction == 0 ? "input" : sa_next.direction == * 1 ? "output" : "any", * ipcom_ipproto_name(sa_next.protocol), * ip_ntohl(sa_next.spi_n), * ipcom_inet_ntop(sa_next.domain, &sa_next.dst, str, * sizeof(str)), * mib_AuthAlg[tags[1]]); * if(sa_next.protocol == IP_IPPROTO_ESP) * ipcom_printf(" enc=%s", mib_EncAlg[tags[3]]); * ipcom_printf(IP_LF); * if(sa_group.spi_n) * ipcom_printf(" -> %s spi=0x%-5lx dst=%-15s"IP_LF, * ipcom_ipproto_name(sa_group.protocol), * ip_ntohl(sa_group.spi_n), * ipcom_inet_ntop(sa_group.domain, &sa_next.dst, str, * sizeof(str))); * } * * ipcom_printf("Total of %d SAs."IP_LF, num); * return 0; * } * \ce * * RETURNS: 'IPCOM_SUCCESS', or one of the following errors: * 'IPCOM_ERR_INVALID_TAG_VALUE', 'IPCOM_ERR_UNSUPPORTED_TAG' * * ERRNO: */ IP_PUBLIC Ip_err ipipsec_sactrl ( Ipipsec_sa_handle *sah, Ip_tag *sactrl_tags ); /* -- MIB SA : selector */ #define IPIPSEC_SACTRLT_GET_SaSelector 0xff070010 /* Ip_u32 */ /* -- MIB SA : how created */ #define IPIPSEC_SACTRLT_GET_SaCreator 0xff070011 /* Ip_u32 */ /* -- MIB SA : security services description */ #define IPIPSEC_SACTRLT_GET_Encapsulation 0xff070012 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_EncAlg 0xff070013 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_EncKeyLength 0xff070014 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_AuthAlg 0xff070015 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_AuthKeyLength 0xff070016 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_RepWinSize 0xff070017 /* Ip_u32 */ /* -- MIB SA : expiration limits */ #define IPIPSEC_SACTRLT_GET_LimitSeconds 0xff070018 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_LimitKbytes 0xff070019 /* Ip_u32 */ /* -- MIB SA : current operating statistics */ #define IPIPSEC_SACTRLT_GET_AccSeconds 0xff07001a /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_InAccKbytes 0xff07001b /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_OutAccKbytes 0xff07001c /* Ip_u32 */ /* -- MIB SA : error statistics */ #define IPIPSEC_SACTRLT_GET_DecryptErrors 0xff070021 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_AuthErrors 0xff070022 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_ReplayErrors 0xff070023 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_PolicyErrors 0xff070024 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_PadErrors 0xff070025 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_OtherReceiveErrors 0xff070026 /* Ip_u32 */ #define IPIPSEC_SACTRLT_GET_OutSendErrors 0xff070027 /* Ip_u32 */ /* -- Interpeak proprietary (i.e. non MIB) SA tags: */ #define IPIPSEC_SACTRLT_GET_DstAddr 0xff070031 /* size = sizeof(Ip_addr4) */ #define IPIPSEC_SACTRLT_GET_SrcAddr 0xff070032 /* size = sizeof(Ip_addr4) */ #define IPIPSEC_SACTRLT_GET_State 0xff070033 /* size = sizeof(Ip_u32) */ #define IPIPSEC_SACTRLT_GET_DstAddr6 0xff070034 /* size = 16 */ #define IPIPSEC_SACTRLT_GET_SrcAddr6 0xff070035 /* size = 16 */ #define IPIPSEC_SACTRLT_GET_LAST 0xff070035 /* Must be set to last! */ /* --- Deprecated tags, use IP_SIOCXIPSEC_xxx IOCTLS instead! */ #define IPIPSEC_SACTRLT_GET_Grouped 0xff070030 /* Ipipsec_sa_handle* */ #define IPIPSEC_SACTRLT_GET_InUserOctets 0xff07001d /* Ip_u64* */ #define IPIPSEC_SACTRLT_GET_OutUserOctets 0xff07001e /* Ip_u64* */ #define IPIPSEC_SACTRLT_GET_InPackets 0xff07001f /* Ip_u64* */ #define IPIPSEC_SACTRLT_GET_OutPackets 0xff070020 /* Ip_u64* */ /* Get first/next lexicographic SA relative to the specified SA 'sa'. * * Set sah->spi_n to 0 when retrieving the first SA. * In order to get the next SA, use the IPIPSEC_SACTRLT_GET_NEXT_SA tag. * If no additional SAs are found, the spi_n will be set to 0 in the * tag value. Check src/ipipsec_cmd_ipsecctrl.c for an example. * * For additional info on 'sa' entries, check the text on Ipipsec_sa_handle. * */ #define IPIPSEC_SACTRLT_GET_NEXT_SA 0xff070001 /* Ipipsec_sa_handle* */ /* *=========================================================================== * ipipsec_conf *=========================================================================== * Description: Get/set global information/configuration * Parameters: conf_tags A tag array. * Returns: IPCOM_ERR_UNSUPPORTED_TAG - The optional configuration * tag array contained an unknown tag. * IPCOM_SUCCESS - Success. * */ IP_PUBLIC Ip_err ipipsec_conf(Ip_tag *conf_tags); #define IPIPSEC_CONF_GET_ENABLE_OUTFILTER 0xfffff001 /* Ip_u32 */ #define IPIPSEC_CONF_SET_ENABLE_OUTFILTER 0xfffff002 /* Ip_u32 */ #define IPIPSEC_CONF_GET_ENABLE_ESP 0xfffff005 /* Ip_u32 */ #define IPIPSEC_CONF_SET_ENABLE_ESP 0xfffff006 /* Ip_u32 */ #define IPIPSEC_CONF_GET_ENABLE_AH 0xfffff007 /* Ip_u32 */ #define IPIPSEC_CONF_SET_ENABLE_AH 0xfffff008 /* Ip_u32 */ #define IPIPSEC_CONF_GET_ALLOW_IPIP 0xfffff009 /* Ip_u32 */ #define IPIPSEC_CONF_SET_ALLOW_IPIP 0xfffff00a /* Ip_u32 */ #define IPIPSEC_CONF_GET_NUM_DAEMONS_ACTIVE 0xfffff00b /* Ip_u32 */ #define IPIPSEC_CONF_SET_NUM_DAEMONS_ACTIVE 0xfffff00c /* Ip_u32 */ /* **************************************************************************** * 6 IPNET/IPLITE FUNCTIONS **************************************************************************** */ typedef void (*Ipipsec_timeout_handler)(void *cookie); /* *=========================================================================== * ipcom_ipsec_ioevent *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC void *ipcom_ipsec_ioevent(int command, void *data); /* *=========================================================================== * ipipsec_timeout_schedule *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC void ipipsec_timeout_schedule(Ip_u32 sec, Ipipsec_timeout_handler handler, void *cookie, void **ptmo); /* *=========================================================================== * ipipsec_timeout_cancel *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC void ipipsec_timeout_cancel(void *tmo); /* *=========================================================================== * ipipsec_seconds_now *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC Ip_u32 ipipsec_seconds_now(void); /* *=========================================================================== * ipipsec_timeout_to_string *=========================================================================== * Description: * Parameters: * Returns: * */ #ifdef IPNET typedef int (*Ipipsec_timeout_to_string_f)(void *tmo_elem, char *buf, Ip_size_t buf_len); IP_PUBLIC void ipipsec_timeout_to_string(Ipipsec_timeout_handler handler, Ipipsec_timeout_to_string_f to_str); #endif /* **************************************************************************** * 7 PUBLIC FUNCTIONS **************************************************************************** * Functions that IPNET/IPLITE must call to use IPIPSEC. */ /* *=========================================================================== * ipipsec_output_hdrspace *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC Ip_u32 ipipsec_output_hdrspace(Ipipsec_param *param); /* *=========================================================================== * ipipsec_pfkeyv2_input *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC int ipipsec_pfkeyv2_input(Ipcom_socket *sock, IP_CONST struct Ip_msghdr *msg, Ipcom_pkt *pkt); /* *=========================================================================== * ipipsec_policy_check *=========================================================================== * Description: Check if pkt passes IPSEc policies * Parameters: * Returns: 0 for success, else -IP_ERRNO_EACCES * */ IP_PUBLIC int ipipsec_policy_check(Ipcom_pkt *pkt, Ipipsec_param *param); /* *=========================================================================== * ipipsec_input *=========================================================================== * Description: * Parameters: * Returns: IPIPSEC_OK * IPIPSEC_TUNNELED * IPIPSEC_KEPT * negative errno */ IP_PUBLIC int ipipsec_input(Ipcom_pkt *pkt, Ipipsec_param *param); /* *=========================================================================== * ipipsec_output *=========================================================================== * Description: * Parameters: * Returns: IPIPSEC_OK * IPIPSEC_TUNNELED * IPIPSEC_KEPT * negative errno */ IP_PUBLIC int ipipsec_output(Ipcom_pkt **pktp, Ipipsec_param *param); /* *=========================================================================== * ipipsec_send_daemon_pipe *=========================================================================== * Description: * Parameters: * Returns: IPIPSEC_OK * IPIPSEC_KEPT * negative errno */ IP_PUBLIC int ipipsec_send_daemon_pipe(Ipcom_pkt *pkt, Ipipsec_param *param, Ip_u8 input); /* *=========================================================================== * ipipsec_sys_ioctl *=========================================================================== * Description: IO control. * Parameters: fd - A socket descriptor. * request - The IO control request. * argp - Request specific data. * Returns: 0 = success, -1 = error (error code from ipcom_errno). * */ IP_PUBLIC int ipipsec_sys_ioctl(Ip_fd fd, unsigned long request, void *argp); /* *=========================================================================== * ipipsec_flow_lookup_vlan_dest *=========================================================================== * Description: Lookup ipsec output flow * Parameters: param - * pkt - * Returns: 0 = success, -1 = error (error code from ipcom_errno). */ #ifdef IPFIREWALL IP_PUBLIC int ipipsec_flow_lookup_vlan_dest(Ipipsec_param *param, Ipcom_pkt *pkt, Ip_u32 dst_addr[4]); #endif #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */