This commit is contained in:
Martin Willi
@@ -0,0 +1,477 @@
|
||||
#ifndef _FREESWAN_H
|
||||
/*
|
||||
* header file for FreeS/WAN library functions
|
||||
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
|
||||
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU Library General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
* License for more details.
|
||||
*
|
||||
* RCSID $Id: freeswan.h,v 1.2 2004/03/22 21:53:17 as Exp $
|
||||
*/
|
||||
#define _FREESWAN_H /* seen it, no need to see it again */
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* We've just got to have some datatypes defined... And annoyingly, just
|
||||
* where we get them depends on whether we're in userland or not.
|
||||
*/
|
||||
#ifdef __KERNEL__
|
||||
|
||||
# include <linux/types.h>
|
||||
# include <linux/in.h>
|
||||
|
||||
#else /* __KERNEL__ */
|
||||
|
||||
# include <stdio.h>
|
||||
# include <netinet/in.h>
|
||||
|
||||
# define uint8_t u_int8_t
|
||||
# define uint16_t u_int16_t
|
||||
# define uint32_t u_int32_t
|
||||
# define uint64_t u_int64_t
|
||||
|
||||
# define DEBUG_NO_STATIC static
|
||||
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#include <freeswan/ipsec_param.h>
|
||||
|
||||
|
||||
/*
|
||||
* Grab the kernel version to see if we have NET_21, and therefore
|
||||
* IPv6. Some of this is repeated from ipsec_kversions.h. Of course,
|
||||
* we aren't really testing if the kernel has IPv6, but rather if the
|
||||
* the include files do.
|
||||
*/
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
|
||||
#define NET_21
|
||||
#endif
|
||||
|
||||
#ifndef IPPROTO_COMP
|
||||
# define IPPROTO_COMP 108
|
||||
#endif /* !IPPROTO_COMP */
|
||||
|
||||
#ifndef IPPROTO_INT
|
||||
# define IPPROTO_INT 61
|
||||
#endif /* !IPPROTO_INT */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
# define DEBUG_NO_STATIC
|
||||
#else /* CONFIG_IPSEC_DEBUG */
|
||||
# define DEBUG_NO_STATIC static
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL /* KERNEL ifdef */
|
||||
#ifndef NAT_TRAVERSAL
|
||||
#define NAT_TRAVERSAL
|
||||
#endif
|
||||
#endif
|
||||
#ifdef NAT_TRAVERSAL
|
||||
#define ESPINUDP_WITH_NON_IKE 1 /* draft-ietf-ipsec-nat-t-ike-00/01 */
|
||||
#define ESPINUDP_WITH_NON_ESP 2 /* draft-ietf-ipsec-nat-t-ike-02 */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Basic data types for the address-handling functions.
|
||||
* ip_address and ip_subnet are supposed to be opaque types; do not
|
||||
* use their definitions directly, they are subject to change!
|
||||
*/
|
||||
|
||||
/* first, some quick fakes in case we're on an old system with no IPv6 */
|
||||
#ifndef s6_addr16
|
||||
struct in6_addr {
|
||||
union
|
||||
{
|
||||
__u8 u6_addr8[16];
|
||||
__u16 u6_addr16[8];
|
||||
__u32 u6_addr32[4];
|
||||
} in6_u;
|
||||
#define s6_addr in6_u.u6_addr8
|
||||
#define s6_addr16 in6_u.u6_addr16
|
||||
#define s6_addr32 in6_u.u6_addr32
|
||||
};
|
||||
struct sockaddr_in6 {
|
||||
unsigned short int sin6_family; /* AF_INET6 */
|
||||
__u16 sin6_port; /* Transport layer port # */
|
||||
__u32 sin6_flowinfo; /* IPv6 flow information */
|
||||
struct in6_addr sin6_addr; /* IPv6 address */
|
||||
__u32 sin6_scope_id; /* scope id (new in RFC2553) */
|
||||
};
|
||||
#endif /* !s6_addr16 */
|
||||
|
||||
/* then the main types */
|
||||
typedef struct {
|
||||
union {
|
||||
struct sockaddr_in v4;
|
||||
struct sockaddr_in6 v6;
|
||||
} u;
|
||||
} ip_address;
|
||||
typedef struct {
|
||||
ip_address addr;
|
||||
int maskbits;
|
||||
} ip_subnet;
|
||||
|
||||
/* and the SA ID stuff */
|
||||
#ifdef __KERNEL__
|
||||
typedef __u32 ipsec_spi_t;
|
||||
#else
|
||||
typedef u_int32_t ipsec_spi_t;
|
||||
#endif
|
||||
typedef struct { /* to identify an SA, we need: */
|
||||
ip_address dst; /* A. destination host */
|
||||
ipsec_spi_t spi; /* B. 32-bit SPI, assigned by dest. host */
|
||||
# define SPI_PASS 256 /* magic values... */
|
||||
# define SPI_DROP 257 /* ...for use... */
|
||||
# define SPI_REJECT 258 /* ...with SA_INT */
|
||||
# define SPI_HOLD 259
|
||||
# define SPI_TRAP 260
|
||||
# define SPI_TRAPSUBNET 261
|
||||
int proto; /* C. protocol */
|
||||
# define SA_ESP 50 /* IPPROTO_ESP */
|
||||
# define SA_AH 51 /* IPPROTO_AH */
|
||||
# define SA_IPIP 4 /* IPPROTO_IPIP */
|
||||
# define SA_COMP 108 /* IPPROTO_COMP */
|
||||
# define SA_INT 61 /* IANA reserved for internal use */
|
||||
} ip_said;
|
||||
struct sa_id { /* old v4-only version */
|
||||
struct in_addr dst;
|
||||
ipsec_spi_t spi;
|
||||
int proto;
|
||||
};
|
||||
|
||||
/* misc */
|
||||
typedef const char *err_t; /* error message, or NULL for success */
|
||||
struct prng { /* pseudo-random-number-generator guts */
|
||||
unsigned char sbox[256];
|
||||
int i, j;
|
||||
unsigned long count;
|
||||
};
|
||||
|
||||
|
||||
/*
|
||||
* definitions for user space, taken from freeswan/ipsec_sa.h
|
||||
*/
|
||||
typedef uint32_t IPsecSAref_t;
|
||||
|
||||
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
|
||||
|
||||
#define IPsecSAref2NFmark(x) ((x) << (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
|
||||
#define NFmark2IPsecSAref(x) ((x) >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
|
||||
|
||||
#define IPSEC_SAREF_NULL (~((IPsecSAref_t)0))
|
||||
|
||||
/* GCC magic for use in function definitions! */
|
||||
#ifdef GCC_LINT
|
||||
# define PRINTF_LIKE(n) __attribute__ ((format(printf, n, n+1)))
|
||||
# define NEVER_RETURNS __attribute__ ((noreturn))
|
||||
# define UNUSED __attribute__ ((unused))
|
||||
# define BLANK_FORMAT " " /* GCC_LINT whines about empty formats */
|
||||
#else
|
||||
# define PRINTF_LIKE(n) /* ignore */
|
||||
# define NEVER_RETURNS /* ignore */
|
||||
# define UNUSED /* ignore */
|
||||
# define BLANK_FORMAT ""
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* new IPv6-compatible functions
|
||||
*/
|
||||
|
||||
/* text conversions */
|
||||
err_t ttoul(const char *src, size_t srclen, int format, unsigned long *dst);
|
||||
size_t ultot(unsigned long src, int format, char *buf, size_t buflen);
|
||||
#define ULTOT_BUF (22+1) /* holds 64 bits in octal */
|
||||
err_t ttoaddr(const char *src, size_t srclen, int af, ip_address *dst);
|
||||
err_t tnatoaddr(const char *src, size_t srclen, int af, ip_address *dst);
|
||||
size_t addrtot(const ip_address *src, int format, char *buf, size_t buflen);
|
||||
/* RFC 1886 old IPv6 reverse-lookup format is the bulkiest */
|
||||
#define ADDRTOT_BUF (32*2 + 3 + 1 + 3 + 1 + 1)
|
||||
err_t ttosubnet(const char *src, size_t srclen, int af, ip_subnet *dst);
|
||||
size_t subnettot(const ip_subnet *src, int format, char *buf, size_t buflen);
|
||||
#define SUBNETTOT_BUF (ADDRTOT_BUF + 1 + 3)
|
||||
err_t ttosa(const char *src, size_t srclen, ip_said *dst);
|
||||
size_t satot(const ip_said *src, int format, char *bufptr, size_t buflen);
|
||||
#define SATOT_BUF (5 + ULTOA_BUF + 1 + ADDRTOT_BUF)
|
||||
err_t ttodata(const char *src, size_t srclen, int base, char *buf,
|
||||
size_t buflen, size_t *needed);
|
||||
err_t ttodatav(const char *src, size_t srclen, int base,
|
||||
char *buf, size_t buflen, size_t *needed,
|
||||
char *errp, size_t errlen, unsigned int flags);
|
||||
#define TTODATAV_BUF 40 /* ttodatav's largest non-literal message */
|
||||
#define TTODATAV_IGNORESPACE (1<<1) /* ignore spaces in base64 encodings*/
|
||||
#define TTODATAV_SPACECOUNTS 0 /* do not ignore spaces in base64 */
|
||||
|
||||
size_t datatot(const char *src, size_t srclen, int format, char *buf,
|
||||
size_t buflen);
|
||||
size_t keyblobtoid(const unsigned char *src, size_t srclen, char *dst,
|
||||
size_t dstlen);
|
||||
size_t splitkeytoid(const unsigned char *e, size_t elen, const unsigned char *m,
|
||||
size_t mlen, char *dst, size_t dstlen);
|
||||
#define KEYID_BUF 10 /* up to 9 text digits plus NUL */
|
||||
err_t ttoprotoport(char *src, size_t src_len, u_int8_t *proto, u_int16_t *port,
|
||||
int *has_port_wildcard);
|
||||
|
||||
/* initializations */
|
||||
void initsaid(const ip_address *addr, ipsec_spi_t spi, int proto, ip_said *dst);
|
||||
err_t loopbackaddr(int af, ip_address *dst);
|
||||
err_t unspecaddr(int af, ip_address *dst);
|
||||
err_t anyaddr(int af, ip_address *dst);
|
||||
err_t initaddr(const unsigned char *src, size_t srclen, int af, ip_address *dst);
|
||||
err_t initsubnet(const ip_address *addr, int maskbits, int clash, ip_subnet *dst);
|
||||
err_t addrtosubnet(const ip_address *addr, ip_subnet *dst);
|
||||
|
||||
/* misc. conversions and related */
|
||||
err_t rangetosubnet(const ip_address *from, const ip_address *to, ip_subnet *dst);
|
||||
int addrtypeof(const ip_address *src);
|
||||
int subnettypeof(const ip_subnet *src);
|
||||
size_t addrlenof(const ip_address *src);
|
||||
size_t addrbytesptr(const ip_address *src, const unsigned char **dst);
|
||||
size_t addrbytesof(const ip_address *src, unsigned char *dst, size_t dstlen);
|
||||
int masktocount(const ip_address *src);
|
||||
void networkof(const ip_subnet *src, ip_address *dst);
|
||||
void maskof(const ip_subnet *src, ip_address *dst);
|
||||
|
||||
/* tests */
|
||||
int sameaddr(const ip_address *a, const ip_address *b);
|
||||
int addrcmp(const ip_address *a, const ip_address *b);
|
||||
int samesubnet(const ip_subnet *a, const ip_subnet *b);
|
||||
int addrinsubnet(const ip_address *a, const ip_subnet *s);
|
||||
int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);
|
||||
int subnetishost(const ip_subnet *s);
|
||||
int samesaid(const ip_said *a, const ip_said *b);
|
||||
int sameaddrtype(const ip_address *a, const ip_address *b);
|
||||
int samesubnettype(const ip_subnet *a, const ip_subnet *b);
|
||||
int isanyaddr(const ip_address *src);
|
||||
int isunspecaddr(const ip_address *src);
|
||||
int isloopbackaddr(const ip_address *src);
|
||||
|
||||
/* low-level grot */
|
||||
int portof(const ip_address *src);
|
||||
void setportof(int port, ip_address *dst);
|
||||
struct sockaddr *sockaddrof(ip_address *src);
|
||||
size_t sockaddrlenof(const ip_address *src);
|
||||
|
||||
/* PRNG */
|
||||
void prng_init(struct prng *prng, const unsigned char *key, size_t keylen);
|
||||
void prng_bytes(struct prng *prng, unsigned char *dst, size_t dstlen);
|
||||
unsigned long prng_count(struct prng *prng);
|
||||
void prng_final(struct prng *prng);
|
||||
|
||||
/* odds and ends */
|
||||
const char *ipsec_version_code(void);
|
||||
const char *ipsec_version_string(void);
|
||||
const char **ipsec_copyright_notice(void);
|
||||
|
||||
const char *dns_string_rr(int rr, char *buf, int bufsize);
|
||||
const char *dns_string_datetime(time_t seconds,
|
||||
char *buf,
|
||||
int bufsize);
|
||||
|
||||
|
||||
/*
|
||||
* old functions, to be deleted eventually
|
||||
*/
|
||||
|
||||
/* unsigned long */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atoul(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
int base, /* 0 means figure it out */
|
||||
unsigned long *resultp
|
||||
);
|
||||
size_t /* space needed for full conversion */
|
||||
ultoa(
|
||||
unsigned long n,
|
||||
int base,
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
#define ULTOA_BUF 21 /* just large enough for largest result, */
|
||||
/* assuming 64-bit unsigned long! */
|
||||
|
||||
/* Internet addresses */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atoaddr(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
struct in_addr *addr
|
||||
);
|
||||
size_t /* space needed for full conversion */
|
||||
addrtoa(
|
||||
struct in_addr addr,
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
#define ADDRTOA_BUF 16 /* just large enough for largest result */
|
||||
|
||||
/* subnets */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atosubnet(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
struct in_addr *addr,
|
||||
struct in_addr *mask
|
||||
);
|
||||
size_t /* space needed for full conversion */
|
||||
subnettoa(
|
||||
struct in_addr addr,
|
||||
struct in_addr mask,
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
#define SUBNETTOA_BUF 32 /* large enough for worst case result */
|
||||
|
||||
/* ranges */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atoasr(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
char *type, /* 'a', 's', 'r' */
|
||||
struct in_addr *addrs /* two-element array */
|
||||
);
|
||||
size_t /* space needed for full conversion */
|
||||
rangetoa(
|
||||
struct in_addr *addrs, /* two-element array */
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
#define RANGETOA_BUF 34 /* large enough for worst case result */
|
||||
|
||||
/* data types for SA conversion functions */
|
||||
|
||||
/* SAs */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atosa(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
struct sa_id *sa
|
||||
);
|
||||
size_t /* space needed for full conversion */
|
||||
satoa(
|
||||
struct sa_id sa,
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
#define SATOA_BUF (3+ULTOA_BUF+ADDRTOA_BUF)
|
||||
|
||||
/* generic data, e.g. keys */
|
||||
const char * /* NULL for success, else string literal */
|
||||
atobytes(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
char *dst,
|
||||
size_t dstlen,
|
||||
size_t *lenp /* NULL means don't bother telling me */
|
||||
);
|
||||
size_t /* 0 failure, else true size */
|
||||
bytestoa(
|
||||
const char *src,
|
||||
size_t srclen,
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
|
||||
/* old versions of generic-data functions; deprecated */
|
||||
size_t /* 0 failure, else true size */
|
||||
atodata(
|
||||
const char *src,
|
||||
size_t srclen, /* 0 means strlen(src) */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
size_t /* 0 failure, else true size */
|
||||
datatoa(
|
||||
const char *src,
|
||||
size_t srclen,
|
||||
int format, /* character; 0 means default */
|
||||
char *dst,
|
||||
size_t dstlen
|
||||
);
|
||||
|
||||
/* part extraction and special addresses */
|
||||
struct in_addr
|
||||
subnetof(
|
||||
struct in_addr addr,
|
||||
struct in_addr mask
|
||||
);
|
||||
struct in_addr
|
||||
hostof(
|
||||
struct in_addr addr,
|
||||
struct in_addr mask
|
||||
);
|
||||
struct in_addr
|
||||
broadcastof(
|
||||
struct in_addr addr,
|
||||
struct in_addr mask
|
||||
);
|
||||
|
||||
/* mask handling */
|
||||
int
|
||||
goodmask(
|
||||
struct in_addr mask
|
||||
);
|
||||
int
|
||||
masktobits(
|
||||
struct in_addr mask
|
||||
);
|
||||
struct in_addr
|
||||
bitstomask(
|
||||
int n
|
||||
);
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* general utilities
|
||||
*/
|
||||
|
||||
#ifndef __KERNEL__
|
||||
/* option pickup from files (userland only because of use of FILE) */
|
||||
const char *optionsfrom(const char *filename, int *argcp, char ***argvp,
|
||||
int optind, FILE *errorreport);
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Debugging levels for pfkey_lib_debug
|
||||
*/
|
||||
#define PF_KEY_DEBUG_PARSE_NONE 0
|
||||
#define PF_KEY_DEBUG_PARSE_PROBLEM 1
|
||||
#define PF_KEY_DEBUG_PARSE_STRUCT 2
|
||||
#define PF_KEY_DEBUG_PARSE_FLOW 4
|
||||
#define PF_KEY_DEBUG_PARSE_MAX 7
|
||||
|
||||
extern unsigned int pfkey_lib_debug; /* bits selecting what to report */
|
||||
|
||||
/*
|
||||
* pluto and lwdnsq need to know the maximum size of the commands to,
|
||||
* and replies from lwdnsq.
|
||||
*/
|
||||
|
||||
#define LWDNSQ_CMDBUF_LEN 1024
|
||||
#define LWDNSQ_RESULT_LEN_MAX 4096
|
||||
|
||||
#endif /* _FREESWAN_H */
|
||||
@@ -0,0 +1,61 @@
|
||||
/*
|
||||
* IPCOMP zlib interface code.
|
||||
* Copyright (C) 2000 Svenning Soerensen <[email protected]>
|
||||
* Copyright (C) 2000, 2001 Richard Guy Briggs <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
|
||||
RCSID $Id: ipcomp.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
|
||||
*/
|
||||
|
||||
/* SSS */
|
||||
|
||||
#ifndef _IPCOMP_H
|
||||
#define _IPCOMP_H
|
||||
|
||||
/* Prefix all global deflate symbols with "ipcomp_" to avoid collisions with ppp_deflate & ext2comp */
|
||||
#ifndef IPCOMP_PREFIX
|
||||
#define IPCOMP_PREFIX
|
||||
#endif /* IPCOMP_PREFIX */
|
||||
|
||||
#ifndef IPPROTO_COMP
|
||||
#define IPPROTO_COMP 108
|
||||
#endif /* IPPROTO_COMP */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int sysctl_ipsec_debug_ipcomp;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
struct ipcomphdr { /* IPCOMP header */
|
||||
__u8 ipcomp_nh; /* Next header (protocol) */
|
||||
__u8 ipcomp_flags; /* Reserved, must be 0 */
|
||||
__u16 ipcomp_cpi; /* Compression Parameter Index */
|
||||
};
|
||||
|
||||
extern struct inet_protocol comp_protocol;
|
||||
extern int sysctl_ipsec_debug_ipcomp;
|
||||
|
||||
#define IPCOMP_UNCOMPRESSABLE 0x000000001
|
||||
#define IPCOMP_COMPRESSIONERROR 0x000000002
|
||||
#define IPCOMP_PARMERROR 0x000000004
|
||||
#define IPCOMP_DECOMPRESSIONERROR 0x000000008
|
||||
|
||||
#define IPCOMP_ADAPT_INITIAL_TRIES 8
|
||||
#define IPCOMP_ADAPT_INITIAL_SKIP 4
|
||||
#define IPCOMP_ADAPT_SUBSEQ_TRIES 2
|
||||
#define IPCOMP_ADAPT_SUBSEQ_SKIP 8
|
||||
|
||||
/* Function prototypes */
|
||||
struct sk_buff *skb_compress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
|
||||
struct sk_buff *skb_decompress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
|
||||
|
||||
#endif /* _IPCOMP_H */
|
||||
@@ -0,0 +1,235 @@
|
||||
/*
|
||||
* Authentication Header declarations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_ah.h,v 1.2 2004/03/22 21:53:18 as Exp $
|
||||
*/
|
||||
|
||||
#include "ipsec_md5h.h"
|
||||
#include "ipsec_sha1.h"
|
||||
|
||||
#ifndef IPPROTO_AH
|
||||
#define IPPROTO_AH 51
|
||||
#endif /* IPPROTO_AH */
|
||||
|
||||
#define AH_FLENGTH 12 /* size of fixed part */
|
||||
#define AHMD5_KMAX 64 /* MD5 max 512 bits key */
|
||||
#define AHMD5_AMAX 12 /* MD5 96 bits of authenticator */
|
||||
|
||||
#define AHMD596_KLEN 16 /* MD5 128 bits key */
|
||||
#define AHSHA196_KLEN 20 /* SHA1 160 bits key */
|
||||
|
||||
#define AHMD596_ALEN 16 /* MD5 128 bits authentication length */
|
||||
#define AHSHA196_ALEN 20 /* SHA1 160 bits authentication length */
|
||||
|
||||
#define AHMD596_BLKLEN 64 /* MD5 block length */
|
||||
#define AHSHA196_BLKLEN 64 /* SHA1 block length */
|
||||
#define AHSHA2_256_BLKLEN 64 /* SHA2-256 block length */
|
||||
#define AHSHA2_384_BLKLEN 128 /* SHA2-384 block length (?) */
|
||||
#define AHSHA2_512_BLKLEN 128 /* SHA2-512 block length */
|
||||
|
||||
#define AH_BLKLEN_MAX 128 /* keep up to date! */
|
||||
|
||||
#define AH_AMAX AHSHA196_ALEN /* keep up to date! */
|
||||
#define AHHMAC_HASHLEN 12 /* authenticator length of 96bits */
|
||||
#define AHHMAC_RPLLEN 4 /* 32 bit replay counter */
|
||||
|
||||
#define DB_AH_PKTRX 0x0001
|
||||
#define DB_AH_PKTRX2 0x0002
|
||||
#define DB_AH_DMP 0x0004
|
||||
#define DB_AH_IPSA 0x0010
|
||||
#define DB_AH_XF 0x0020
|
||||
#define DB_AH_INAU 0x0040
|
||||
#define DB_AH_REPLAY 0x0100
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
/* General HMAC algorithm is described in RFC 2104 */
|
||||
|
||||
#define HMAC_IPAD 0x36
|
||||
#define HMAC_OPAD 0x5C
|
||||
|
||||
struct md5_ctx {
|
||||
MD5_CTX ictx; /* context after H(K XOR ipad) */
|
||||
MD5_CTX octx; /* context after H(K XOR opad) */
|
||||
};
|
||||
|
||||
struct sha1_ctx {
|
||||
SHA1_CTX ictx; /* context after H(K XOR ipad) */
|
||||
SHA1_CTX octx; /* context after H(K XOR opad) */
|
||||
};
|
||||
|
||||
struct auth_alg {
|
||||
void (*init)(void *ctx);
|
||||
void (*update)(void *ctx, unsigned char *bytes, __u32 len);
|
||||
void (*final)(unsigned char *hash, void *ctx);
|
||||
int hashlen;
|
||||
};
|
||||
|
||||
extern struct inet_protocol ah_protocol;
|
||||
|
||||
struct options;
|
||||
|
||||
extern int
|
||||
ah_rcv(struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
|
||||
struct ahhdr /* Generic AH header */
|
||||
{
|
||||
__u8 ah_nh; /* Next header (protocol) */
|
||||
__u8 ah_hl; /* AH length, in 32-bit words */
|
||||
__u16 ah_rv; /* reserved, must be 0 */
|
||||
__u32 ah_spi; /* Security Parameters Index */
|
||||
__u32 ah_rpl; /* Replay prevention */
|
||||
__u8 ah_data[AHHMAC_HASHLEN];/* Authentication hash */
|
||||
};
|
||||
#define AH_BASIC_LEN 8 /* basic AH header is 8 bytes, nh,hl,rv,spi
|
||||
* and the ah_hl, says how many bytes after that
|
||||
* to cover. */
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_ah;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_ah.h,v $
|
||||
* Revision 1.2 2004/03/22 21:53:18 as
|
||||
* merged alg-0.8.1 branch with HEAD
|
||||
*
|
||||
* Revision 1.1.4.1 2004/03/16 09:48:18 as
|
||||
* alg-0.8.1rc12 patch merged
|
||||
*
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.20 2003/02/06 02:21:34 rgb
|
||||
*
|
||||
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
|
||||
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
|
||||
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
|
||||
*
|
||||
* Revision 1.19 2002/09/16 21:19:13 mcr
|
||||
* fixes for west-ah-icmp-01 - length of AH header must be
|
||||
* calculated properly, and next_header field properly copied.
|
||||
*
|
||||
* Revision 1.18 2002/05/14 02:37:02 rgb
|
||||
* Change reference from _TDB to _IPSA.
|
||||
*
|
||||
* Revision 1.17 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_ah.h,v
|
||||
*
|
||||
* Revision 1.16 2002/02/20 01:27:06 rgb
|
||||
* Ditched a pile of structs only used by the old Netlink interface.
|
||||
*
|
||||
* Revision 1.15 2001/12/11 02:35:57 rgb
|
||||
* Change "struct net_device" to "struct device" for 2.2 compatibility.
|
||||
*
|
||||
* Revision 1.14 2001/11/26 09:23:47 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.13.2.1 2001/09/25 02:18:24 mcr
|
||||
* replace "struct device" with "struct netdevice"
|
||||
*
|
||||
* Revision 1.13 2001/06/14 19:35:08 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.12 2000/09/12 03:21:20 rgb
|
||||
* Cleared out unused htonq.
|
||||
*
|
||||
* Revision 1.11 2000/09/08 19:12:55 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.10 2000/01/21 06:13:10 rgb
|
||||
* Tidied up spacing.
|
||||
* Added macros for HMAC padding magic numbers.(kravietz)
|
||||
*
|
||||
* Revision 1.9 1999/12/07 18:16:23 rgb
|
||||
* Fixed comments at end of #endif lines.
|
||||
*
|
||||
* Revision 1.8 1999/04/11 00:28:56 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.7 1999/04/06 04:54:25 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.6 1999/01/26 02:06:01 rgb
|
||||
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
|
||||
*
|
||||
* Revision 1.5 1999/01/22 06:17:49 rgb
|
||||
* Updated macro comments.
|
||||
* Added context types to support algorithm switch code.
|
||||
* 64-bit clean-up -- converting 'u long long' to __u64.
|
||||
*
|
||||
* Revision 1.4 1998/07/14 15:54:56 rgb
|
||||
* Add #ifdef __KERNEL__ to protect kernel-only structures.
|
||||
*
|
||||
* Revision 1.3 1998/06/30 18:05:16 rgb
|
||||
* Comment out references to htonq.
|
||||
*
|
||||
* Revision 1.2 1998/06/25 19:33:46 rgb
|
||||
* Add prototype for protocol receive function.
|
||||
* Rearrange for more logical layout.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:43 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.4 1998/05/18 22:28:43 rgb
|
||||
* Disable key printing facilities from /proc/net/ipsec_*.
|
||||
*
|
||||
* Revision 1.3 1998/04/21 21:29:07 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.2 1998/04/12 22:03:17 rgb
|
||||
* Updated ESP-3DES-HMAC-MD5-96,
|
||||
* ESP-DES-HMAC-MD5-96,
|
||||
* AH-HMAC-MD5-96,
|
||||
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
|
||||
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
|
||||
*
|
||||
* Fixed eroute references in /proc/net/ipsec*.
|
||||
*
|
||||
* Started to patch module unloading memory leaks in ipsec_netlink and
|
||||
* radij tree unloading.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:05:55 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* Added definitions for new AH transforms.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:35:48 ji
|
||||
* Minor Cleanup.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,254 @@
|
||||
/*
|
||||
* Modular extensions service and registration functions interface
|
||||
*
|
||||
* Author: JuanJo Ciarlante <[email protected]>
|
||||
*
|
||||
* $Id: ipsec_alg.h,v 1.2 2004/03/22 21:53:18 as Exp $
|
||||
*
|
||||
*/
|
||||
/*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
*/
|
||||
#ifndef IPSEC_ALG_H
|
||||
#define IPSEC_ALG_H
|
||||
|
||||
/*
|
||||
* gcc >= 3.2 has removed __FUNCTION__, replaced by C99 __func__
|
||||
* *BUT* its a compiler variable.
|
||||
*/
|
||||
#if (__GNUC__ >= 3)
|
||||
#ifndef __FUNCTION__
|
||||
#define __FUNCTION__ __func__
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/* Version 0.8.1-0 */
|
||||
#define IPSEC_ALG_VERSION 0x00080100
|
||||
|
||||
#include <linux/types.h>
|
||||
#include <linux/list.h>
|
||||
#include <asm/atomic.h>
|
||||
/*
|
||||
* The following structs are used via pointers in ipsec_alg object to
|
||||
* avoid ipsec_alg.h coupling with freeswan headers, thus simplifying
|
||||
* module development
|
||||
*/
|
||||
struct ipsec_sa;
|
||||
struct esp;
|
||||
|
||||
/**************************************
|
||||
*
|
||||
* Main registration object
|
||||
*
|
||||
*************************************/
|
||||
#define IPSEC_ALG_VERSION_QUAD(v) \
|
||||
(v>>24),((v>>16)&0xff),((v>>8)&0xff),(v&0xff)
|
||||
/*
|
||||
* Main ipsec_alg objects: "OOPrograming wannabe"
|
||||
* Hierachy (carefully handled with _minimal_ cast'ing):
|
||||
*
|
||||
* ipsec_alg+
|
||||
* +->ipsec_alg_enc (ixt_alg_type=SADB_EXT_SUPPORTED_ENCRYPT)
|
||||
* +->ipsec_alg_auth (ixt_alg_type=SADB_EXT_SUPPORTED_AUTH)
|
||||
*/
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE object: struct ipsec_alg
|
||||
*
|
||||
***************************************************************/
|
||||
|
||||
/*
|
||||
* common part for every struct ipsec_alg_*
|
||||
* (sortof poor's man OOP)
|
||||
*/
|
||||
#define IPSEC_ALG_STRUCT_COMMON \
|
||||
unsigned ixt_version; /* only allow this version (or 'near')*/ \
|
||||
struct list_head ixt_list; /* dlinked list */ \
|
||||
struct module *ixt_module; /* THIS_MODULE */ \
|
||||
unsigned ixt_state; /* state flags */ \
|
||||
atomic_t ixt_refcnt; /* ref. count when pointed from ipsec_sa */ \
|
||||
char ixt_name[16]; /* descriptive short name, eg. "3des" */ \
|
||||
void *ixt_data; /* private for algo implementation */ \
|
||||
uint8_t ixt_blocksize; /* blocksize in bytes */ \
|
||||
\
|
||||
/* THIS IS A COPY of struct supported (lib/pfkey.h) \
|
||||
* please keep in sync until we migrate 'supported' stuff \
|
||||
* to ipsec_alg \
|
||||
*/ \
|
||||
uint16_t ixt_alg_type; /* correspond to IPSEC_ALG_{ENCRYPT,AUTH} */ \
|
||||
uint8_t ixt_alg_id; /* enc. alg. number, eg. ESP_3DES */ \
|
||||
uint8_t ixt_ivlen; /* ivlen in bits, expected to be multiple of 8! */ \
|
||||
uint16_t ixt_keyminbits;/* min. keybits (of entropy) */ \
|
||||
uint16_t ixt_keymaxbits;/* max. keybits (of entropy) */
|
||||
|
||||
#define ixt_support ixt_alg_type
|
||||
|
||||
#define IPSEC_ALG_ST_SUPP 0x01
|
||||
#define IPSEC_ALG_ST_REGISTERED 0x02
|
||||
#define IPSEC_ALG_ST_EXCL 0x04
|
||||
struct ipsec_alg {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
};
|
||||
/*
|
||||
* Note the const in cbc_encrypt IV arg:
|
||||
* some ciphers like to toast passed IV (eg. 3DES): make a local IV copy
|
||||
*/
|
||||
struct ipsec_alg_enc {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
unsigned ixt_e_keylen; /* raw key length in bytes */
|
||||
unsigned ixt_e_ctx_size; /* sa_p->key_e_size */
|
||||
int (*ixt_e_set_key)(struct ipsec_alg_enc *alg, __u8 *key_e, const __u8 *key, size_t keysize);
|
||||
__u8 *(*ixt_e_new_key)(struct ipsec_alg_enc *alg, const __u8 *key, size_t keysize);
|
||||
void (*ixt_e_destroy_key)(struct ipsec_alg_enc *alg, __u8 *key_e);
|
||||
int (*ixt_e_cbc_encrypt)(struct ipsec_alg_enc *alg, __u8 *key_e, __u8 *in, int ilen, const __u8 *iv, int encrypt);
|
||||
};
|
||||
struct ipsec_alg_auth {
|
||||
IPSEC_ALG_STRUCT_COMMON
|
||||
unsigned ixt_a_keylen; /* raw key length in bytes */
|
||||
unsigned ixt_a_ctx_size; /* sa_p->key_a_size */
|
||||
unsigned ixt_a_authlen; /* 'natural' auth. hash len (bytes) */
|
||||
int (*ixt_a_hmac_set_key)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *key, int keylen);
|
||||
int (*ixt_a_hmac_hash)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *dat, int len, __u8 *hash, int hashlen);
|
||||
};
|
||||
/*
|
||||
* These are _copies_ of SADB_EXT_SUPPORTED_{AUTH,ENCRYPT},
|
||||
* to avoid header coupling for true constants
|
||||
* about headers ... "cp is your friend" --Linus
|
||||
*/
|
||||
#define IPSEC_ALG_TYPE_AUTH 14
|
||||
#define IPSEC_ALG_TYPE_ENCRYPT 15
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE for module loading,testing, and unloading
|
||||
*
|
||||
***************************************************************/
|
||||
/* - registration calls */
|
||||
int register_ipsec_alg(struct ipsec_alg *);
|
||||
int unregister_ipsec_alg(struct ipsec_alg *);
|
||||
/* - optional (simple test) for algos */
|
||||
int ipsec_alg_test(unsigned alg_type, unsigned alg_id, int testparm);
|
||||
/* inline wrappers (usefull for type validation */
|
||||
static inline int register_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
|
||||
return register_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int unregister_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
|
||||
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int register_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
|
||||
return register_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
static inline int unregister_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
|
||||
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
|
||||
}
|
||||
|
||||
/*****************************************************************
|
||||
*
|
||||
* INTERFACE for ENC services: key creation, encrypt function
|
||||
*
|
||||
*****************************************************************/
|
||||
|
||||
#define IPSEC_ALG_ENCRYPT 1
|
||||
#define IPSEC_ALG_DECRYPT 0
|
||||
|
||||
/* encryption key context creation function */
|
||||
int ipsec_alg_enc_key_create(struct ipsec_sa *sa_p);
|
||||
/*
|
||||
* ipsec_alg_esp_encrypt(): encrypt ilen bytes in idat returns
|
||||
* 0 or ERR<0
|
||||
*/
|
||||
int ipsec_alg_esp_encrypt(struct ipsec_sa *sa_p, __u8 *idat, int ilen, const __u8 *iv, int action);
|
||||
|
||||
/***************************************************************
|
||||
*
|
||||
* INTERFACE for AUTH services: key creation, hash functions
|
||||
*
|
||||
***************************************************************/
|
||||
int ipsec_alg_auth_key_create(struct ipsec_sa *sa_p);
|
||||
int ipsec_alg_sa_esp_hash(const struct ipsec_sa *sa_p, const __u8 *espp, int len, __u8 *hash, int hashlen) ;
|
||||
#define ipsec_alg_sa_esp_update(c,k,l) ipsec_alg_sa_esp_hash(c,k,l,NULL,0)
|
||||
|
||||
/* only called from ipsec_init.c */
|
||||
int ipsec_alg_init(void);
|
||||
|
||||
/* algo module glue for static algos */
|
||||
void ipsec_alg_static_init(void);
|
||||
typedef int (*ipsec_alg_init_func_t) (void);
|
||||
|
||||
/**********************************************
|
||||
*
|
||||
* INTERFACE for ipsec_sa init and wipe
|
||||
*
|
||||
**********************************************/
|
||||
|
||||
/* returns true if ipsec_sa has ipsec_alg obj attached */
|
||||
/*
|
||||
* Initializes ipsec_sa's ipsec_alg object, using already loaded
|
||||
* proto, authalg, encalg.; links ipsec_alg objects (enc, auth)
|
||||
*/
|
||||
int ipsec_alg_sa_init(struct ipsec_sa *sa_p);
|
||||
/*
|
||||
* Destroys ipsec_sa's ipsec_alg object
|
||||
* unlinking ipsec_alg objects
|
||||
*/
|
||||
int ipsec_alg_sa_wipe(struct ipsec_sa *sa_p);
|
||||
|
||||
/**********************************************
|
||||
*
|
||||
* 2.2 backport for some 2.4 useful module stuff
|
||||
*
|
||||
**********************************************/
|
||||
#ifdef MODULE
|
||||
#ifndef THIS_MODULE
|
||||
#define THIS_MODULE (&__this_module)
|
||||
#endif
|
||||
#ifndef module_init
|
||||
typedef int (*__init_module_func_t)(void);
|
||||
typedef void (*__cleanup_module_func_t)(void);
|
||||
|
||||
#define module_init(x) \
|
||||
int init_module(void) __attribute__((alias(#x))); \
|
||||
static inline __init_module_func_t __init_module_inline(void) \
|
||||
{ return x; }
|
||||
#define module_exit(x) \
|
||||
void cleanup_module(void) __attribute__((alias(#x))); \
|
||||
static inline __cleanup_module_func_t __cleanup_module_inline(void) \
|
||||
{ return x; }
|
||||
#endif
|
||||
|
||||
#define IPSEC_ALG_MODULE_INIT( func_name ) \
|
||||
static int func_name(void); \
|
||||
module_init(func_name); \
|
||||
static int __init func_name(void)
|
||||
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
|
||||
static void func_name(void); \
|
||||
module_exit(func_name); \
|
||||
static void __exit func_name(void)
|
||||
#else /* not MODULE */
|
||||
#ifndef THIS_MODULE
|
||||
#define THIS_MODULE NULL
|
||||
#endif
|
||||
/*
|
||||
* I only want module_init() magic
|
||||
* when algo.c file *is THE MODULE*, in all other
|
||||
* cases, initialization is called explicitely from ipsec_alg_init()
|
||||
*/
|
||||
#define IPSEC_ALG_MODULE_INIT( func_name ) \
|
||||
extern int func_name(void); \
|
||||
int func_name(void)
|
||||
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
|
||||
extern void func_name(void); \
|
||||
void func_name(void)
|
||||
#endif
|
||||
|
||||
#endif /* IPSEC_ALG_H */
|
||||
@@ -0,0 +1,143 @@
|
||||
/*
|
||||
* declarations relevant to encapsulation-like operations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_encap.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_ENCAP_H_
|
||||
|
||||
#define SENT_IP4 16 /* data is two struct in_addr + proto + ports*/
|
||||
/* (2 * sizeof(struct in_addr)) */
|
||||
/* sizeof(struct sockaddr_encap)
|
||||
- offsetof(struct sockaddr_encap, Sen.Sip4.Src) */
|
||||
|
||||
struct sockaddr_encap
|
||||
{
|
||||
__u8 sen_len; /* length */
|
||||
__u8 sen_family; /* AF_ENCAP */
|
||||
__u16 sen_type; /* see SENT_* */
|
||||
union
|
||||
{
|
||||
struct /* SENT_IP4 */
|
||||
{
|
||||
struct in_addr Src;
|
||||
struct in_addr Dst;
|
||||
__u8 Proto;
|
||||
__u16 Sport;
|
||||
__u16 Dport;
|
||||
} Sip4;
|
||||
} Sen;
|
||||
};
|
||||
|
||||
#define sen_ip_src Sen.Sip4.Src
|
||||
#define sen_ip_dst Sen.Sip4.Dst
|
||||
#define sen_proto Sen.Sip4.Proto
|
||||
#define sen_sport Sen.Sip4.Sport
|
||||
#define sen_dport Sen.Sip4.Dport
|
||||
|
||||
#ifndef AF_ENCAP
|
||||
#define AF_ENCAP 26
|
||||
#endif /* AF_ENCAP */
|
||||
|
||||
#define _IPSEC_ENCAP_H_
|
||||
#endif /* _IPSEC_ENCAP_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_encap.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.17 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_encap.h,v
|
||||
*
|
||||
* Revision 1.16 2001/11/26 09:23:47 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.15.2.1 2001/09/25 02:18:54 mcr
|
||||
* struct eroute moved to ipsec_eroute.h
|
||||
*
|
||||
* Revision 1.15 2001/09/14 16:58:36 rgb
|
||||
* Added support for storing the first and last packets through a HOLD.
|
||||
*
|
||||
* Revision 1.14 2001/09/08 21:13:31 rgb
|
||||
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
|
||||
*
|
||||
* Revision 1.13 2001/06/14 19:35:08 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.12 2001/05/27 06:12:10 rgb
|
||||
* Added structures for pid, packet count and last access time to eroute.
|
||||
* Added packet count to beginning of /proc/net/ipsec_eroute.
|
||||
*
|
||||
* Revision 1.11 2000/09/08 19:12:56 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.10 2000/03/22 16:15:36 rgb
|
||||
* Fixed renaming of dev_get (MB).
|
||||
*
|
||||
* Revision 1.9 2000/01/21 06:13:26 rgb
|
||||
* Added a macro for AF_ENCAP
|
||||
*
|
||||
* Revision 1.8 1999/12/31 14:56:55 rgb
|
||||
* MB fix for 2.3 dev-use-count.
|
||||
*
|
||||
* Revision 1.7 1999/11/18 04:09:18 rgb
|
||||
* Replaced all kernel version macros to shorter, readable form.
|
||||
*
|
||||
* Revision 1.6 1999/09/24 00:34:13 rgb
|
||||
* Add Marc Boucher's support for 2.3.xx+.
|
||||
*
|
||||
* Revision 1.5 1999/04/11 00:28:57 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.4 1999/04/06 04:54:25 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.3 1998/10/19 14:44:28 rgb
|
||||
* Added inclusion of freeswan.h.
|
||||
* sa_id structure implemented and used: now includes protocol.
|
||||
*
|
||||
* Revision 1.2 1998/07/14 18:19:33 rgb
|
||||
* Added #ifdef __KERNEL__ directives to restrict scope of header.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:44 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.2 1998/04/21 21:29:10 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:05:58 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* Minor cosmetic changes.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:35:48 ji
|
||||
* Minor Cleanup.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,103 @@
|
||||
/*
|
||||
* @(#) declarations of eroute structures
|
||||
*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs <[email protected]>
|
||||
* Copyright (C) 2001 Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_eroute.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*
|
||||
* derived from ipsec_encap.h 1.15 on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_EROUTE_H_
|
||||
|
||||
#include "radij.h"
|
||||
#include "ipsec_encap.h"
|
||||
#include "ipsec_radij.h"
|
||||
|
||||
/*
|
||||
* The "type" is really part of the address as far as the routing
|
||||
* system is concerned. By using only one bit in the type field
|
||||
* for each type, we sort-of make sure that different types of
|
||||
* encapsulation addresses won't be matched against the wrong type.
|
||||
*/
|
||||
|
||||
/*
|
||||
* An entry in the radix tree
|
||||
*/
|
||||
|
||||
struct rjtentry
|
||||
{
|
||||
struct radij_node rd_nodes[2]; /* tree glue, and other values */
|
||||
#define rd_key(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_key))
|
||||
#define rd_mask(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_mask))
|
||||
short rd_flags;
|
||||
short rd_count;
|
||||
};
|
||||
|
||||
struct ident
|
||||
{
|
||||
__u16 type; /* identity type */
|
||||
__u64 id; /* identity id */
|
||||
__u8 len; /* identity len */
|
||||
caddr_t data; /* identity data */
|
||||
};
|
||||
|
||||
/*
|
||||
* An encapsulation route consists of a pointer to a
|
||||
* radix tree entry and a SAID (a destination_address/SPI/protocol triple).
|
||||
*/
|
||||
|
||||
struct eroute
|
||||
{
|
||||
struct rjtentry er_rjt;
|
||||
struct sa_id er_said;
|
||||
uint32_t er_pid;
|
||||
uint32_t er_count;
|
||||
uint64_t er_lasttime;
|
||||
struct sockaddr_encap er_eaddr; /* MCR get rid of _encap, it is silly*/
|
||||
struct sockaddr_encap er_emask;
|
||||
struct ident er_ident_s;
|
||||
struct ident er_ident_d;
|
||||
struct sk_buff* er_first;
|
||||
struct sk_buff* er_last;
|
||||
};
|
||||
|
||||
#define er_dst er_said.dst
|
||||
#define er_spi er_said.spi
|
||||
|
||||
#define _IPSEC_EROUTE_H_
|
||||
#endif /* _IPSEC_EROUTE_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_eroute.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.3 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_eroute.h,v
|
||||
*
|
||||
* Revision 1.2 2001/11/26 09:16:13 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.1.2.1 2001/09/25 02:18:54 mcr
|
||||
* struct eroute moved to ipsec_eroute.h
|
||||
*
|
||||
*
|
||||
* Local variables:
|
||||
* c-file-style: "linux"
|
||||
* End:
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,53 @@
|
||||
/*
|
||||
* @(#) definition of ipsec_errs structure
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_errs.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the errors/statistics that FreeSWAN collects.
|
||||
*
|
||||
*/
|
||||
|
||||
struct ipsec_errs {
|
||||
__u32 ips_alg_errs; /* number of algorithm errors */
|
||||
__u32 ips_auth_errs; /* # of authentication errors */
|
||||
__u32 ips_encsize_errs; /* # of encryption size errors*/
|
||||
__u32 ips_encpad_errs; /* # of encryption pad errors*/
|
||||
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
|
||||
};
|
||||
|
||||
/*
|
||||
* $Log: ipsec_errs.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.3 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_errs.h,v
|
||||
*
|
||||
* Revision 1.2 2001/11/26 09:16:13 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.1.2.1 2001/09/25 02:25:57 mcr
|
||||
* lifetime structure created and common functions created.
|
||||
*
|
||||
*
|
||||
* Local variables:
|
||||
* c-file-style: "linux"
|
||||
* End:
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,220 @@
|
||||
/*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_esp.h,v 1.2 2004/03/22 21:53:18 as Exp $
|
||||
*/
|
||||
|
||||
#include "freeswan/ipsec_md5h.h"
|
||||
#include "freeswan/ipsec_sha1.h"
|
||||
|
||||
#include "crypto/des.h"
|
||||
|
||||
#ifndef IPPROTO_ESP
|
||||
#define IPPROTO_ESP 50
|
||||
#endif /* IPPROTO_ESP */
|
||||
|
||||
#define ESP_HEADER_LEN 8 /* 64 bits header (spi+rpl)*/
|
||||
|
||||
#define EMT_ESPDESCBC_ULEN 20 /* coming from user mode */
|
||||
#define EMT_ESPDES_KMAX 64 /* 512 bit secret key enough? */
|
||||
#define EMT_ESPDES_KEY_SZ 8 /* 56 bit secret key with parity = 64 bits */
|
||||
#define EMT_ESP3DES_KEY_SZ 24 /* 168 bit secret key with parity = 192 bits */
|
||||
#define EMT_ESPDES_IV_SZ 8 /* IV size */
|
||||
#define ESP_DESCBC_BLKLEN 8 /* DES-CBC block size */
|
||||
|
||||
#define ESP_IV_MAXSZ 16 /* This is _critical_ */
|
||||
#define ESP_IV_MAXSZ_INT (ESP_IV_MAXSZ/sizeof(int))
|
||||
|
||||
#define DB_ES_PKTRX 0x0001
|
||||
#define DB_ES_PKTRX2 0x0002
|
||||
#define DB_ES_IPSA 0x0010
|
||||
#define DB_ES_XF 0x0020
|
||||
#define DB_ES_IPAD 0x0040
|
||||
#define DB_ES_INAU 0x0080
|
||||
#define DB_ES_OINFO 0x0100
|
||||
#define DB_ES_OINFO2 0x0200
|
||||
#define DB_ES_OH 0x0400
|
||||
#define DB_ES_REPLAY 0x0800
|
||||
|
||||
#ifdef __KERNEL__
|
||||
struct des_eks {
|
||||
des_key_schedule ks;
|
||||
};
|
||||
|
||||
extern struct inet_protocol esp_protocol;
|
||||
|
||||
struct options;
|
||||
|
||||
extern int
|
||||
esp_rcv(struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
|
||||
/* Only for 64 bits IVs, eg. ESP_3DES :P */
|
||||
struct esphdr
|
||||
{
|
||||
__u32 esp_spi; /* Security Parameters Index */
|
||||
__u32 esp_rpl; /* Replay counter */
|
||||
__u8 esp_iv[8]; /* iv */
|
||||
};
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_esp;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_esp.h,v $
|
||||
* Revision 1.2 2004/03/22 21:53:18 as
|
||||
* merged alg-0.8.1 branch with HEAD
|
||||
*
|
||||
* Revision 1.1.4.1 2004/03/16 09:48:18 as
|
||||
* alg-0.8.1rc12 patch merged
|
||||
*
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.21 2003/02/06 02:21:34 rgb
|
||||
*
|
||||
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
|
||||
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
|
||||
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
|
||||
*
|
||||
* Revision 1.20 2002/05/14 02:37:02 rgb
|
||||
* Change reference from _TDB to _IPSA.
|
||||
*
|
||||
* Revision 1.19 2002/04/24 07:55:32 mcr
|
||||
* #include patches and Makefiles for post-reorg compilation.
|
||||
*
|
||||
* Revision 1.18 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_esp.h,v
|
||||
*
|
||||
* Revision 1.17 2002/02/20 01:27:07 rgb
|
||||
* Ditched a pile of structs only used by the old Netlink interface.
|
||||
*
|
||||
* Revision 1.16 2001/12/11 02:35:57 rgb
|
||||
* Change "struct net_device" to "struct device" for 2.2 compatibility.
|
||||
*
|
||||
* Revision 1.15 2001/11/26 09:23:48 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.14.2.3 2001/10/23 04:16:42 mcr
|
||||
* get definition of des_key_schedule from des.h
|
||||
*
|
||||
* Revision 1.14.2.2 2001/10/22 20:33:13 mcr
|
||||
* use "des_key_schedule" structure instead of cooking our own.
|
||||
*
|
||||
* Revision 1.14.2.1 2001/09/25 02:18:25 mcr
|
||||
* replace "struct device" with "struct netdevice"
|
||||
*
|
||||
* Revision 1.14 2001/06/14 19:35:08 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.13 2000/09/08 19:12:56 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.12 2000/08/01 14:51:50 rgb
|
||||
* Removed _all_ remaining traces of DES.
|
||||
*
|
||||
* Revision 1.11 2000/01/10 16:36:20 rgb
|
||||
* Ditch last of EME option flags, including initiator.
|
||||
*
|
||||
* Revision 1.10 1999/12/07 18:16:22 rgb
|
||||
* Fixed comments at end of #endif lines.
|
||||
*
|
||||
* Revision 1.9 1999/04/11 00:28:57 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.8 1999/04/06 04:54:25 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.7 1999/01/26 02:06:00 rgb
|
||||
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
|
||||
*
|
||||
* Revision 1.6 1999/01/22 15:22:05 rgb
|
||||
* Re-enable IV in the espblkrply_edata structure to avoid breaking pluto
|
||||
* until pluto can be fixed properly.
|
||||
*
|
||||
* Revision 1.5 1999/01/22 06:18:16 rgb
|
||||
* Updated macro comments.
|
||||
* Added key schedule types to support algorithm switch code.
|
||||
*
|
||||
* Revision 1.4 1998/08/12 00:07:32 rgb
|
||||
* Added data structures for new xforms: null, {,3}dessha1.
|
||||
*
|
||||
* Revision 1.3 1998/07/14 15:57:01 rgb
|
||||
* Add #ifdef __KERNEL__ to protect kernel-only structures.
|
||||
*
|
||||
* Revision 1.2 1998/06/25 19:33:46 rgb
|
||||
* Add prototype for protocol receive function.
|
||||
* Rearrange for more logical layout.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:45 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.6 1998/06/05 02:28:08 rgb
|
||||
* Minor comment fix.
|
||||
*
|
||||
* Revision 1.5 1998/05/27 22:34:00 rgb
|
||||
* Changed structures to accomodate key separation.
|
||||
*
|
||||
* Revision 1.4 1998/05/18 22:28:43 rgb
|
||||
* Disable key printing facilities from /proc/net/ipsec_*.
|
||||
*
|
||||
* Revision 1.3 1998/04/21 21:29:07 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.2 1998/04/12 22:03:20 rgb
|
||||
* Updated ESP-3DES-HMAC-MD5-96,
|
||||
* ESP-DES-HMAC-MD5-96,
|
||||
* AH-HMAC-MD5-96,
|
||||
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
|
||||
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
|
||||
*
|
||||
* Fixed eroute references in /proc/net/ipsec*.
|
||||
*
|
||||
* Started to patch module unloading memory leaks in ipsec_netlink and
|
||||
* radij tree unloading.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:00 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.5 1997/06/03 04:24:48 ji
|
||||
* Added ESP-3DES-MD5-96 transform.
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* Added definitions for new ESP transforms.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:35:48 ji
|
||||
* Minor Cleanup.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,68 @@
|
||||
/*
|
||||
* IP-in-IP Header declarations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_ipe4.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
/* The packet header is an IP header! */
|
||||
|
||||
struct ipe4_xdata /* transform table data */
|
||||
{
|
||||
struct in_addr i4_src;
|
||||
struct in_addr i4_dst;
|
||||
};
|
||||
|
||||
#define EMT_IPE4_ULEN 8 /* coming from user mode */
|
||||
|
||||
|
||||
/*
|
||||
* $Log: ipsec_ipe4.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.5 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_ipe4.h,v
|
||||
*
|
||||
* Revision 1.4 2001/06/14 19:35:08 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.3 1999/04/11 00:28:57 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.2 1999/04/06 04:54:25 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:47 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:07 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* No changes.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:48:53 ji
|
||||
* Release update only.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,227 @@
|
||||
#ifndef _FREESWAN_KVERSIONS_H
|
||||
/*
|
||||
* header file for FreeS/WAN library functions
|
||||
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
|
||||
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU Library General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
* License for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_kversion.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
#define _FREESWAN_KVERSIONS_H /* seen it, no need to see it again */
|
||||
|
||||
/*
|
||||
* this file contains a series of atomic defines that depend upon
|
||||
* kernel version numbers. The kernel versions are arranged
|
||||
* in version-order number (which is often not chronological)
|
||||
* and each clause enables or disables a feature.
|
||||
*/
|
||||
|
||||
/*
|
||||
* First, assorted kernel-version-dependent trickery.
|
||||
*/
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,0)
|
||||
#define HEADER_CACHE_BIND_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
|
||||
#define SPINLOCK
|
||||
#define PROC_FS_21
|
||||
#define NETLINK_SOCK
|
||||
#define NET_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,19)
|
||||
#define net_device_stats enet_statistics
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,0)
|
||||
#define SPINLOCK_23
|
||||
#define NETDEV_23
|
||||
# ifndef CONFIG_IP_ALIAS
|
||||
# define CONFIG_IP_ALIAS
|
||||
# endif
|
||||
#include <linux/socket.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/netlink.h>
|
||||
# ifdef NETLINK_XFRM
|
||||
# define NETDEV_25
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,25)
|
||||
#define PROC_FS_2325
|
||||
#undef PROC_FS_21
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,30)
|
||||
#define PROC_NO_DUMMY
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,35)
|
||||
#define SKB_COPY_EXPAND
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,37)
|
||||
#define IP_SELECT_IDENT
|
||||
#endif
|
||||
|
||||
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,50)) && defined(CONFIG_NETFILTER)
|
||||
#define SKB_RESET_NFCT
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,2)
|
||||
#define IP_SELECT_IDENT_NEW
|
||||
#endif
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4)
|
||||
#define IPH_is_SKB_PULLED
|
||||
#define SKB_COW_NEW
|
||||
#define PROTO_HANDLER_SINGLE_PARM
|
||||
#define IP_FRAGMENT_LINEARIZE 1
|
||||
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
|
||||
# ifdef REDHAT_BOGOSITY
|
||||
# define IP_SELECT_IDENT_NEW
|
||||
# define IPH_is_SKB_PULLED
|
||||
# define SKB_COW_NEW
|
||||
# define PROTO_HANDLER_SINGLE_PARM
|
||||
# endif /* REDHAT_BOGOSITY */
|
||||
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
|
||||
|
||||
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,9)
|
||||
#define MALLOC_SLAB
|
||||
#define LINUX_KERNEL_HAS_SNPRINTF
|
||||
#endif
|
||||
|
||||
#ifdef NET_21
|
||||
# include <linux/in6.h>
|
||||
#else
|
||||
/* old kernel in.h has some IPv6 stuff, but not quite enough */
|
||||
# define s6_addr16 s6_addr
|
||||
# define AF_INET6 10
|
||||
# define uint8_t __u8
|
||||
# define uint16_t __u16
|
||||
# define uint32_t __u32
|
||||
# define uint64_t __u64
|
||||
#endif
|
||||
|
||||
#ifdef NET_21
|
||||
# define ipsec_kfree_skb(a) kfree_skb(a)
|
||||
#else /* NET_21 */
|
||||
# define ipsec_kfree_skb(a) kfree_skb(a, FREE_WRITE)
|
||||
#endif /* NET_21 */
|
||||
|
||||
#ifdef NETDEV_23
|
||||
# define device net_device
|
||||
# define ipsec_dev_get dev_get_by_name
|
||||
# define __ipsec_dev_get __dev_get_by_name
|
||||
# define ipsec_dev_put(x) dev_put(x)
|
||||
# define __ipsec_dev_put(x) __dev_put(x)
|
||||
# define ipsec_dev_hold(x) dev_hold(x)
|
||||
#else /* NETDEV_23 */
|
||||
# define ipsec_dev_get dev_get
|
||||
# define __ipsec_dev_put(x)
|
||||
# define ipsec_dev_put(x)
|
||||
# define ipsec_dev_hold(x)
|
||||
#endif /* NETDEV_23 */
|
||||
|
||||
#ifndef SPINLOCK
|
||||
# include <linux/bios32.h>
|
||||
/* simulate spin locks and read/write locks */
|
||||
typedef struct {
|
||||
volatile char lock;
|
||||
} spinlock_t;
|
||||
|
||||
typedef struct {
|
||||
volatile unsigned int lock;
|
||||
} rwlock_t;
|
||||
|
||||
# define spin_lock_init(x) { (x)->lock = 0;}
|
||||
# define rw_lock_init(x) { (x)->lock = 0; }
|
||||
|
||||
# define spin_lock(x) { while ((x)->lock) barrier(); (x)->lock=1;}
|
||||
# define spin_lock_irq(x) { cli(); spin_lock(x);}
|
||||
# define spin_lock_irqsave(x,flags) { save_flags(flags); spin_lock_irq(x);}
|
||||
|
||||
# define spin_unlock(x) { (x)->lock=0;}
|
||||
# define spin_unlock_irq(x) { spin_unlock(x); sti();}
|
||||
# define spin_unlock_irqrestore(x,flags) { spin_unlock(x); restore_flags(flags);}
|
||||
|
||||
# define read_lock(x) spin_lock(x)
|
||||
# define read_lock_irq(x) spin_lock_irq(x)
|
||||
# define read_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
|
||||
|
||||
# define read_unlock(x) spin_unlock(x)
|
||||
# define read_unlock_irq(x) spin_unlock_irq(x)
|
||||
# define read_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
|
||||
|
||||
# define write_lock(x) spin_lock(x)
|
||||
# define write_lock_irq(x) spin_lock_irq(x)
|
||||
# define write_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
|
||||
|
||||
# define write_unlock(x) spin_unlock(x)
|
||||
# define write_unlock_irq(x) spin_unlock_irq(x)
|
||||
# define write_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
|
||||
#endif /* !SPINLOCK */
|
||||
|
||||
#ifndef SPINLOCK_23
|
||||
# define spin_lock_bh(x) spin_lock_irq(x)
|
||||
# define spin_unlock_bh(x) spin_unlock_irq(x)
|
||||
|
||||
# define read_lock_bh(x) read_lock_irq(x)
|
||||
# define read_unlock_bh(x) read_unlock_irq(x)
|
||||
|
||||
# define write_lock_bh(x) write_lock_irq(x)
|
||||
# define write_unlock_bh(x) write_unlock_irq(x)
|
||||
#endif /* !SPINLOCK_23 */
|
||||
|
||||
#endif /* _FREESWAN_KVERSIONS_H */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_kversion.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.7 2003/07/31 22:48:08 mcr
|
||||
* derive NET25-ness from presence of NETLINK_XFRM macro.
|
||||
*
|
||||
* Revision 1.6 2003/06/24 20:22:32 mcr
|
||||
* added new global: ipsecdevices[] so that we can keep track of
|
||||
* the ipsecX devices. They will be referenced with dev_hold(),
|
||||
* so 2.2 may need this as well.
|
||||
*
|
||||
* Revision 1.5 2003/04/03 17:38:09 rgb
|
||||
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
|
||||
*
|
||||
* Revision 1.4 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_kversion.h,v
|
||||
*
|
||||
* Revision 1.3 2002/04/12 03:21:17 mcr
|
||||
* three parameter version of ip_select_ident appears first
|
||||
* in 2.4.2 (RH7.1) not 2.4.4.
|
||||
*
|
||||
* Revision 1.2 2002/03/08 21:35:22 rgb
|
||||
* Defined LINUX_KERNEL_HAS_SNPRINTF to shut up compiler warnings after
|
||||
* 2.4.9. (Andreas Piesk).
|
||||
*
|
||||
* Revision 1.1 2002/01/29 02:11:42 mcr
|
||||
* removal of kversions.h - sources that needed it now use ipsec_param.h.
|
||||
* updating of IPv6 structures to match latest in6.h version.
|
||||
* removed dead code from freeswan.h that also duplicated kversions.h
|
||||
* code.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,112 @@
|
||||
/*
|
||||
* Definitions relevant to IPSEC lifetimes
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_life.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*
|
||||
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the book keeping fields for the
|
||||
* IPsec Security Association Structure. ("ipsec_sa")
|
||||
*
|
||||
* This structure is never allocated directly by kernel code,
|
||||
* (it is always a static/auto or is part of a structure)
|
||||
* so it does not have a reference count.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_LIFE_H_
|
||||
|
||||
/*
|
||||
* _count is total count.
|
||||
* _hard is hard limit (kill SA after this number)
|
||||
* _soft is soft limit (try to renew SA after this number)
|
||||
* _last is used in some special cases.
|
||||
*
|
||||
*/
|
||||
|
||||
struct ipsec_lifetime64
|
||||
{
|
||||
__u64 ipl_count;
|
||||
__u64 ipl_soft;
|
||||
__u64 ipl_hard;
|
||||
__u64 ipl_last;
|
||||
};
|
||||
|
||||
struct ipsec_lifetimes
|
||||
{
|
||||
/* number of bytes processed */
|
||||
struct ipsec_lifetime64 ipl_bytes;
|
||||
|
||||
/* number of packets processed */
|
||||
struct ipsec_lifetime64 ipl_packets;
|
||||
|
||||
/* time since SA was added */
|
||||
struct ipsec_lifetime64 ipl_addtime;
|
||||
|
||||
/* time since SA was first used */
|
||||
struct ipsec_lifetime64 ipl_usetime;
|
||||
|
||||
/* from rfc2367:
|
||||
* For CURRENT, the number of different connections,
|
||||
* endpoints, or flows that the association has been
|
||||
* allocated towards. For HARD and SOFT, the number of
|
||||
* these the association may be allocated towards
|
||||
* before it expires. The concept of a connection,
|
||||
* flow, or endpoint is system specific.
|
||||
*
|
||||
* mcr(2001-9-18) it is unclear what purpose these serve for FreeSWAN.
|
||||
* They are maintained for PF_KEY compatibility.
|
||||
*/
|
||||
struct ipsec_lifetime64 ipl_allocations;
|
||||
};
|
||||
|
||||
enum ipsec_life_alive {
|
||||
ipsec_life_harddied = -1,
|
||||
ipsec_life_softdied = 0,
|
||||
ipsec_life_okay = 1
|
||||
};
|
||||
|
||||
enum ipsec_life_type {
|
||||
ipsec_life_timebased = 1,
|
||||
ipsec_life_countbased= 0
|
||||
};
|
||||
|
||||
#define _IPSEC_LIFE_H_
|
||||
#endif /* _IPSEC_LIFE_H_ */
|
||||
|
||||
|
||||
/*
|
||||
* $Log: ipsec_life.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.3 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_life.h,v
|
||||
*
|
||||
* Revision 1.2 2001/11/26 09:16:14 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.1.2.1 2001/09/25 02:25:58 mcr
|
||||
* lifetime structure created and common functions created.
|
||||
*
|
||||
*
|
||||
* Local variables:
|
||||
* c-file-style: "linux"
|
||||
* End:
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,140 @@
|
||||
/*
|
||||
* RCSID $Id: ipsec_md5h.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
/*
|
||||
* The rest of this file is Copyright RSA DSI. See the following comments
|
||||
* for the full Copyright notice.
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_MD5H_H_
|
||||
#define _IPSEC_MD5H_H_
|
||||
|
||||
/* GLOBAL.H - RSAREF types and constants
|
||||
*/
|
||||
|
||||
/* PROTOTYPES should be set to one if and only if the compiler supports
|
||||
function argument prototyping.
|
||||
The following makes PROTOTYPES default to 0 if it has not already
|
||||
been defined with C compiler flags.
|
||||
*/
|
||||
#ifndef PROTOTYPES
|
||||
#define PROTOTYPES 1
|
||||
#endif /* !PROTOTYPES */
|
||||
|
||||
/* POINTER defines a generic pointer type */
|
||||
typedef __u8 *POINTER;
|
||||
|
||||
/* UINT2 defines a two byte word */
|
||||
typedef __u16 UINT2;
|
||||
|
||||
/* UINT4 defines a four byte word */
|
||||
typedef __u32 UINT4;
|
||||
|
||||
/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
|
||||
If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
|
||||
returns an empty list.
|
||||
*/
|
||||
|
||||
#if PROTOTYPES
|
||||
#define PROTO_LIST(list) list
|
||||
#else /* PROTOTYPES */
|
||||
#define PROTO_LIST(list) ()
|
||||
#endif /* PROTOTYPES */
|
||||
|
||||
|
||||
/* MD5.H - header file for MD5C.C
|
||||
*/
|
||||
|
||||
/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
|
||||
rights reserved.
|
||||
|
||||
License to copy and use this software is granted provided that it
|
||||
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
|
||||
Algorithm" in all material mentioning or referencing this software
|
||||
or this function.
|
||||
|
||||
License is also granted to make and use derivative works provided
|
||||
that such works are identified as "derived from the RSA Data
|
||||
Security, Inc. MD5 Message-Digest Algorithm" in all material
|
||||
mentioning or referencing the derived work.
|
||||
|
||||
RSA Data Security, Inc. makes no representations concerning either
|
||||
the merchantability of this software or the suitability of this
|
||||
software for any particular purpose. It is provided "as is"
|
||||
without express or implied warranty of any kind.
|
||||
|
||||
These notices must be retained in any copies of any part of this
|
||||
documentation and/or software.
|
||||
*/
|
||||
|
||||
/* MD5 context. */
|
||||
typedef struct {
|
||||
UINT4 state[4]; /* state (ABCD) */
|
||||
UINT4 count[2]; /* number of bits, modulo 2^64 (lsb first) */
|
||||
unsigned char buffer[64]; /* input buffer */
|
||||
} MD5_CTX;
|
||||
|
||||
void MD5Init PROTO_LIST ((void *));
|
||||
void MD5Update PROTO_LIST
|
||||
((void *, unsigned char *, __u32));
|
||||
void MD5Final PROTO_LIST ((unsigned char [16], void *));
|
||||
|
||||
#endif /* _IPSEC_MD5H_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_md5h.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.8 2002/09/10 01:45:09 mcr
|
||||
* changed type of MD5_CTX and SHA1_CTX to void * so that
|
||||
* the function prototypes would match, and could be placed
|
||||
* into a pointer to a function.
|
||||
*
|
||||
* Revision 1.7 2002/04/24 07:36:46 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_md5h.h,v
|
||||
*
|
||||
* Revision 1.6 1999/12/13 13:59:13 rgb
|
||||
* Quick fix to argument size to Update bugs.
|
||||
*
|
||||
* Revision 1.5 1999/12/07 18:16:23 rgb
|
||||
* Fixed comments at end of #endif lines.
|
||||
*
|
||||
* Revision 1.4 1999/04/06 04:54:26 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.3 1999/01/22 06:19:58 rgb
|
||||
* 64-bit clean-up.
|
||||
*
|
||||
* Revision 1.2 1998/11/30 13:22:54 rgb
|
||||
* Rationalised all the klips kernel file headers. They are much shorter
|
||||
* now and won't conflict under RH5.2.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:48 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.2 1998/04/23 20:54:03 rgb
|
||||
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
|
||||
* verified.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:04:21 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
* these two include files modified not to include others except in kernel
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* No changes.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:48:53 ji
|
||||
* Release update only.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,226 @@
|
||||
/*
|
||||
* @(#) FreeSWAN tunable paramaters
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_param.h,v 1.2 2004/04/28 08:07:11 as Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file provides a set of #define's which may be tuned by various
|
||||
* people/configurations. It keeps all compile-time tunables in one place.
|
||||
*
|
||||
* This file should be included before all other IPsec kernel-only files.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_PARAM_H_
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include "ipsec_kversion.h"
|
||||
|
||||
/* Set number of ipsecX virtual devices here. */
|
||||
/* This must be < exp(field width of IPSEC_DEV_FORMAT) */
|
||||
/* It must also be reasonable so as not to overload the memory and CPU */
|
||||
/* constraints of the host. */
|
||||
#define IPSEC_NUM_IF 4
|
||||
/* The field width must be < IF_NAM_SIZ - strlen("ipsec") - 1. */
|
||||
/* With "ipsec" being 5 characters, that means 10 is the max field width */
|
||||
/* but machine memory and CPU constraints are not likely to tollerate */
|
||||
/* more than 3 digits. The default is one digit. */
|
||||
/* Update: userland scripts get upset if they can't find "ipsec0", so */
|
||||
/* for now, no "0"-padding should be used (which would have been helpful */
|
||||
/* to make text-searches work */
|
||||
#define IPSEC_DEV_FORMAT "ipsec%d"
|
||||
/* For, say, 500 virtual ipsec devices, I would recommend: */
|
||||
/* #define IPSEC_NUM_IF 500 */
|
||||
/* #define IPSEC_DEV_FORMAT "ipsec%03d" */
|
||||
/* Note that the "interfaces=" line in /etc/ipsec.conf would be, um, challenging. */
|
||||
|
||||
/* use dynamic ipsecX device allocation */
|
||||
#ifndef CONFIG_IPSEC_DYNDEV
|
||||
#define CONFIG_IPSEC_DYNDEV 1
|
||||
#endif /* CONFIG_IPSEC_DYNDEV */
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_BIGGATE
|
||||
# define SADB_HASHMOD 8069
|
||||
#else /* CONFIG_IPSEC_BIGGATE */
|
||||
# define SADB_HASHMOD 257
|
||||
#endif /* CONFIG_IPSEC_BIGGATE */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
/*
|
||||
* This is for the SA reference table. This number is related to the
|
||||
* maximum number of SAs that KLIPS can concurrently deal with, plus enough
|
||||
* space for keeping expired SAs around.
|
||||
*
|
||||
* TABLE_MAX_WIDTH is the number of bits that we will use.
|
||||
* MAIN_TABLE_WIDTH is the number of bits used for the primary index table.
|
||||
*
|
||||
*/
|
||||
#ifndef IPSEC_SA_REF_TABLE_IDX_WIDTH
|
||||
# define IPSEC_SA_REF_TABLE_IDX_WIDTH 16
|
||||
#endif
|
||||
|
||||
#ifndef IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
|
||||
# define IPSEC_SA_REF_MAINTABLE_IDX_WIDTH 4
|
||||
#endif
|
||||
|
||||
#ifndef IPSEC_SA_REF_FREELIST_NUM_ENTRIES
|
||||
# define IPSEC_SA_REF_FREELIST_NUM_ENTRIES 256
|
||||
#endif
|
||||
|
||||
#ifndef IPSEC_SA_REF_CODE
|
||||
# define IPSEC_SA_REF_CODE 1
|
||||
#endif
|
||||
|
||||
#ifdef __KERNEL__
|
||||
/* This is defined for 2.4, but not 2.2.... */
|
||||
#ifndef ARPHRD_VOID
|
||||
# define ARPHRD_VOID 0xFFFF
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Worry about PROC_FS stuff
|
||||
*/
|
||||
#if defined(PROC_FS_2325)
|
||||
/* kernel 2.4 */
|
||||
# define IPSEC_PROC_LAST_ARG ,int *eof,void *data
|
||||
# define IPSEC_PROCFS_DEBUG_NO_STATIC
|
||||
# define IPSEC_PROC_SUBDIRS
|
||||
#else
|
||||
/* kernel <2.4 */
|
||||
# define IPSEC_PROCFS_DEBUG_NO_STATIC DEBUG_NO_STATIC
|
||||
|
||||
# ifndef PROC_NO_DUMMY
|
||||
# define IPSEC_PROC_LAST_ARG , int dummy
|
||||
# else
|
||||
# define IPSEC_PROC_LAST_ARG
|
||||
# endif /* !PROC_NO_DUMMY */
|
||||
#endif /* PROC_FS_2325 */
|
||||
|
||||
#if !defined(LINUX_KERNEL_HAS_SNPRINTF)
|
||||
/* GNU CPP specific! */
|
||||
# define snprintf(buf, len, fmt...) sprintf(buf, ##fmt)
|
||||
#endif /* !LINUX_KERNEL_HAS_SNPRINTF */
|
||||
|
||||
#ifdef SPINLOCK
|
||||
# ifdef SPINLOCK_23
|
||||
# include <linux/spinlock.h> /* *lock* */
|
||||
# else /* SPINLOCK_23 */
|
||||
# include <asm/spinlock.h> /* *lock* */
|
||||
# endif /* SPINLOCK_23 */
|
||||
#endif /* SPINLOCK */
|
||||
|
||||
#ifndef KLIPS_FIXES_DES_PARITY
|
||||
# define KLIPS_FIXES_DES_PARITY 1
|
||||
#endif /* !KLIPS_FIXES_DES_PARITY */
|
||||
|
||||
/* we don't really want to print these unless there are really big problems */
|
||||
#ifndef KLIPS_DIVULGE_CYPHER_KEY
|
||||
# define KLIPS_DIVULGE_CYPHER_KEY 0
|
||||
#endif /* !KLIPS_DIVULGE_CYPHER_KEY */
|
||||
|
||||
#ifndef KLIPS_DIVULGE_HMAC_KEY
|
||||
# define KLIPS_DIVULGE_HMAC_KEY 0
|
||||
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
|
||||
|
||||
#ifndef IPSEC_DISALLOW_IPOPTIONS
|
||||
# define IPSEC_DISALLOW_IPOPTIONS 1
|
||||
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
|
||||
|
||||
/* extra toggles for regression testing */
|
||||
#ifdef CONFIG_IPSEC_REGRESS
|
||||
|
||||
/*
|
||||
* should pfkey_acquire() become 100% lossy?
|
||||
*
|
||||
*/
|
||||
extern int sysctl_ipsec_regress_pfkey_lossage;
|
||||
#ifndef KLIPS_PFKEY_ACQUIRE_LOSSAGE
|
||||
# ifdef CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE
|
||||
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 100
|
||||
# else /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
|
||||
/* not by default! */
|
||||
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 0
|
||||
# endif /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
|
||||
#endif /* KLIPS_PFKEY_ACQUIRE_LOSSAGE */
|
||||
|
||||
#endif /* CONFIG_IPSEC_REGRESS */
|
||||
|
||||
/*
|
||||
* debugging routines.
|
||||
*/
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern void ipsec_print_ip(struct iphdr *ip);
|
||||
|
||||
#define KLIPS_PRINT(flag, format, args...) \
|
||||
((flag) ? printk(KERN_INFO format , ## args) : 0)
|
||||
#define KLIPS_PRINTMORE(flag, format, args...) \
|
||||
((flag) ? printk(format , ## args) : 0)
|
||||
#define KLIPS_IP_PRINT(flag, ip) \
|
||||
((flag) ? ipsec_print_ip(ip) : 0)
|
||||
#else /* CONFIG_IPSEC_DEBUG */
|
||||
#define KLIPS_PRINT(flag, format, args...) do ; while(0)
|
||||
#define KLIPS_PRINTMORE(flag, format, args...) do ; while(0)
|
||||
#define KLIPS_IP_PRINT(flag, ip) do ; while(0)
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
|
||||
/*
|
||||
* Stupid kernel API differences in APIs. Not only do some
|
||||
* kernels not have ip_select_ident, but some have differing APIs,
|
||||
* and SuSE has one with one parameter, but no way of checking to
|
||||
* see what is really what.
|
||||
*/
|
||||
|
||||
#ifdef SUSE_LINUX_2_4_19_IS_STUPID
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph)
|
||||
#else
|
||||
|
||||
/* simplest case, nothing */
|
||||
#if !defined(IP_SELECT_IDENT)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) do { iph->id = htons(ip_id_count++); } while(0)
|
||||
#endif
|
||||
|
||||
/* kernels > 2.3.37-ish */
|
||||
#if defined(IP_SELECT_IDENT) && !defined(IP_SELECT_IDENT_NEW)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst)
|
||||
#endif
|
||||
|
||||
/* kernels > 2.4.2 */
|
||||
#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
|
||||
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
|
||||
#endif
|
||||
|
||||
#endif /* SUSE_LINUX_2_4_19_IS_STUPID */
|
||||
|
||||
/*
|
||||
* make klips fail test:east-espiv-01.
|
||||
* exploit is at testing/attacks/espiv
|
||||
*
|
||||
*/
|
||||
#define KLIPS_IMPAIRMENT_ESPIV_CBC_ATTACK 0
|
||||
|
||||
|
||||
/* IP_FRAGMENT_LINEARIZE is set in freeswan.h if Kernel > 2.4.4 */
|
||||
#ifndef IP_FRAGMENT_LINEARIZE
|
||||
# define IP_FRAGMENT_LINEARIZE 0
|
||||
#endif /* IP_FRAGMENT_LINEARIZE */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#define _IPSEC_PARAM_H_
|
||||
#endif /* _IPSEC_PARAM_H_ */
|
||||
@@ -0,0 +1,225 @@
|
||||
#ifndef _IPSEC_POLICY_H
|
||||
/*
|
||||
* policy interface file between pluto and applications
|
||||
* Copyright (C) 2003 Michael Richardson <[email protected]>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU Library General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
* License for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_policy.h,v 1.4 2004/10/04 22:43:56 as Exp $
|
||||
*/
|
||||
#define _IPSEC_POLICY_H /* seen it, no need to see it again */
|
||||
|
||||
|
||||
/*
|
||||
* this file defines an interface between an application (or rather an
|
||||
* application library) and a key/policy daemon. It provides for inquiries
|
||||
* as to the current state of a connected socket, as well as for general
|
||||
* questions.
|
||||
*
|
||||
* In general, the interface is defined as a series of functional interfaces,
|
||||
* and the policy messages should be internal. However, because this is in
|
||||
* fact an ABI between pieces of the system that may get compiled and revised
|
||||
* seperately, this ABI must be public and revision controlled.
|
||||
*
|
||||
* It is expected that the daemon will always support previous versions.
|
||||
*/
|
||||
|
||||
#define IPSEC_POLICY_MSG_REVISION (unsigned)200305061
|
||||
|
||||
enum ipsec_policy_command {
|
||||
IPSEC_CMD_QUERY_FD = 1,
|
||||
IPSEC_CMD_QUERY_HOSTPAIR = 2,
|
||||
IPSEC_CMD_QUERY_DSTONLY = 3,
|
||||
};
|
||||
|
||||
struct ipsec_policy_msg_head {
|
||||
u_int32_t ipm_version;
|
||||
u_int32_t ipm_msg_len;
|
||||
u_int32_t ipm_msg_type;
|
||||
u_int32_t ipm_msg_seq;
|
||||
};
|
||||
|
||||
enum ipsec_privacy_quality {
|
||||
IPSEC_PRIVACY_NONE = 0,
|
||||
IPSEC_PRIVACY_INTEGRAL = 4, /* not private at all. AH-like */
|
||||
IPSEC_PRIVACY_UNKNOWN = 8, /* something is claimed, but details unavail */
|
||||
IPSEC_PRIVACY_ROT13 = 12, /* trivially breakable, i.e. 1DES */
|
||||
IPSEC_PRIVACY_GAK = 16, /* known eavesdroppers */
|
||||
IPSEC_PRIVACY_PRIVATE = 32, /* secure for at least a decade */
|
||||
IPSEC_PRIVACY_STRONG = 64, /* ridiculously secure */
|
||||
IPSEC_PRIVACY_TORTOISE = 192, /* even stronger, but very slow */
|
||||
IPSEC_PRIVACY_OTP = 224, /* some kind of *true* one time pad */
|
||||
};
|
||||
|
||||
enum ipsec_bandwidth_quality {
|
||||
IPSEC_QOS_UNKNOWN = 0, /* unknown bandwidth */
|
||||
IPSEC_QOS_INTERACTIVE = 16, /* reasonably moderate jitter, moderate fast.
|
||||
Good enough for telnet/ssh. */
|
||||
IPSEC_QOS_VOIP = 32, /* faster crypto, predicable jitter */
|
||||
IPSEC_QOS_FTP = 64, /* higher throughput crypto, perhaps hardware
|
||||
offloaded, but latency/jitter may be bad */
|
||||
IPSEC_QOS_WIRESPEED = 128, /* expect to be able to fill your pipe */
|
||||
};
|
||||
|
||||
/* moved from programs/pluto/constants.h */
|
||||
/* IPsec AH transform values
|
||||
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.3
|
||||
* and in http://www.iana.org/assignments/isakmp-registry
|
||||
*/
|
||||
enum ipsec_authentication_algo {
|
||||
AH_NONE = 0,
|
||||
AH_MD5 = 2,
|
||||
AH_SHA = 3,
|
||||
AH_DES = 4,
|
||||
AH_SHA2_256 = 5,
|
||||
AH_SHA2_384 = 6,
|
||||
AH_SHA2_512 = 7,
|
||||
AH_RIPEMD = 8
|
||||
};
|
||||
|
||||
/* IPsec ESP transform values
|
||||
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.4
|
||||
* and from http://www.iana.org/assignments/isakmp-registry
|
||||
*/
|
||||
|
||||
enum ipsec_cipher_algo {
|
||||
ESP_NONE = 0,
|
||||
ESP_DES_IV64 = 1,
|
||||
ESP_DES = 2,
|
||||
ESP_3DES = 3,
|
||||
ESP_RC5 = 4,
|
||||
ESP_IDEA = 5,
|
||||
ESP_CAST = 6,
|
||||
ESP_BLOWFISH = 7,
|
||||
ESP_3IDEA = 8,
|
||||
ESP_DES_IV32 = 9,
|
||||
ESP_RC4 = 10,
|
||||
ESP_NULL = 11,
|
||||
ESP_AES = 12,
|
||||
ESP_AES_CTR = 13,
|
||||
ESP_AES_CCM_8 = 14,
|
||||
ESP_AES_CCM_12 = 15,
|
||||
ESP_AES_CCM_16 = 16,
|
||||
ESP_SERPENT = 252,
|
||||
ESP_TWOFISH = 253
|
||||
};
|
||||
|
||||
/* IPCOMP transform values
|
||||
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.5
|
||||
*/
|
||||
|
||||
enum ipsec_comp_algo {
|
||||
IPSCOMP_NONE = 0,
|
||||
IPCOMP_OUI = 1,
|
||||
IPCOMP_DEFLATE = 2,
|
||||
IPCOMP_LZS = 3,
|
||||
IPCOMP_LZJH = 4
|
||||
};
|
||||
|
||||
/* Identification type values
|
||||
* RFC 2407 The Internet IP security Domain of Interpretation for ISAKMP 4.6.2.1
|
||||
*/
|
||||
|
||||
enum ipsec_id_type {
|
||||
ID_IMPOSSIBLE= (-2), /* private to Pluto */
|
||||
ID_MYID= (-1), /* private to Pluto */
|
||||
ID_NONE= 0, /* private to Pluto */
|
||||
ID_IPV4_ADDR= 1,
|
||||
ID_FQDN= 2,
|
||||
ID_USER_FQDN= 3,
|
||||
ID_IPV4_ADDR_SUBNET= 4,
|
||||
ID_IPV6_ADDR= 5,
|
||||
ID_IPV6_ADDR_SUBNET= 6,
|
||||
ID_IPV4_ADDR_RANGE= 7,
|
||||
ID_IPV6_ADDR_RANGE= 8,
|
||||
ID_DER_ASN1_DN= 9,
|
||||
ID_DER_ASN1_GN= 10,
|
||||
ID_KEY_ID= 11
|
||||
};
|
||||
|
||||
/* Certificate type values
|
||||
* RFC 2408 ISAKMP, chapter 3.9
|
||||
*/
|
||||
enum ipsec_cert_type {
|
||||
CERT_NONE= 0,
|
||||
CERT_PKCS7_WRAPPED_X509= 1, /* self-signed certificate from disk */
|
||||
CERT_PGP= 2,
|
||||
CERT_DNS_SIGNED_KEY= 3, /* KEY RR from DNS */
|
||||
CERT_X509_SIGNATURE= 4,
|
||||
CERT_X509_KEY_EXCHANGE= 5,
|
||||
CERT_KERBEROS_TOKENS= 6,
|
||||
CERT_CRL= 7,
|
||||
CERT_ARL= 8,
|
||||
CERT_SPKI= 9,
|
||||
CERT_X509_ATTRIBUTE= 10,
|
||||
CERT_RAW_RSA= 11, /* raw RSA from config file */
|
||||
};
|
||||
|
||||
/* a SIG record in ASCII */
|
||||
struct ipsec_dns_sig {
|
||||
char fqdn[256];
|
||||
char dns_sig[768]; /* empty string if not signed */
|
||||
};
|
||||
|
||||
struct ipsec_raw_key {
|
||||
char id_name[256];
|
||||
char fs_keyid[8];
|
||||
};
|
||||
|
||||
struct ipsec_identity {
|
||||
enum ipsec_id_type ii_type;
|
||||
enum ipsec_cert_type ii_format;
|
||||
union {
|
||||
struct ipsec_dns_sig ipsec_dns_signed;
|
||||
/* some thing for PGP */
|
||||
/* some thing for PKIX */
|
||||
struct ipsec_raw_key ipsec_raw_key;
|
||||
} ii_credential;
|
||||
};
|
||||
|
||||
#define IPSEC_MAX_CREDENTIALS 32
|
||||
|
||||
struct ipsec_policy_cmd_query {
|
||||
struct ipsec_policy_msg_head head;
|
||||
|
||||
/* Query section */
|
||||
ip_address query_local; /* us */
|
||||
ip_address query_remote; /* them */
|
||||
u_short src_port, dst_port;
|
||||
|
||||
/* Answer section */
|
||||
enum ipsec_privacy_quality strength;
|
||||
enum ipsec_bandwidth_quality bandwidth;
|
||||
enum ipsec_authentication_algo auth_detail;
|
||||
enum ipsec_cipher_algo esp_detail;
|
||||
enum ipsec_comp_algo comp_detail;
|
||||
|
||||
int credential_count;
|
||||
|
||||
struct ipsec_identity credentials[IPSEC_MAX_CREDENTIALS];
|
||||
};
|
||||
|
||||
#define IPSEC_POLICY_SOCKET "/var/run/pluto.info"
|
||||
|
||||
/* prototypes */
|
||||
extern err_t ipsec_policy_lookup(int fd, struct ipsec_policy_cmd_query *result);
|
||||
extern err_t ipsec_policy_init(void);
|
||||
extern err_t ipsec_policy_final(void);
|
||||
extern err_t ipsec_policy_readmsg(int policysock,
|
||||
unsigned char *buf, size_t buflen);
|
||||
extern err_t ipsec_policy_sendrecv(unsigned char *buf, size_t buflen);
|
||||
extern err_t ipsec_policy_cgilookup(struct ipsec_policy_cmd_query *result);
|
||||
|
||||
|
||||
extern const char *ipsec_policy_version_code(void);
|
||||
extern const char *ipsec_policy_version_string(void);
|
||||
|
||||
#endif /* _IPSEC_POLICY_H */
|
||||
@@ -0,0 +1,111 @@
|
||||
/*
|
||||
* @(#) prototypes for FreeSWAN functions
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_proto.h,v 1.3 2004/06/13 19:55:14 as Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_PROTO_H_
|
||||
|
||||
#include "ipsec_param.h"
|
||||
|
||||
/*
|
||||
* This file is a kernel only file that declares prototypes for
|
||||
* all intra-module function calls and global data structures.
|
||||
*
|
||||
* Include this file last.
|
||||
*
|
||||
*/
|
||||
|
||||
/* ipsec_init.c */
|
||||
extern struct prng ipsec_prng;
|
||||
|
||||
/* ipsec_sa.c */
|
||||
extern struct ipsec_sa *ipsec_sadb_hash[SADB_HASHMOD];
|
||||
extern spinlock_t tdb_lock;
|
||||
extern int ipsec_sadb_init(void);
|
||||
|
||||
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id*);
|
||||
extern int ipsec_sa_put(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_del(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_delchain(struct ipsec_sa *);
|
||||
extern /* void */ int ipsec_sa_add(struct ipsec_sa *);
|
||||
|
||||
extern int ipsec_sadb_cleanup(__u8);
|
||||
extern int ipsec_sa_wipe(struct ipsec_sa *);
|
||||
|
||||
/* debug declarations */
|
||||
|
||||
/* ipsec_proc.c */
|
||||
extern int ipsec_proc_init(void);
|
||||
extern void ipsec_proc_cleanup(void);
|
||||
|
||||
/* ipsec_radij.c */
|
||||
extern int ipsec_makeroute(struct sockaddr_encap *ea,
|
||||
struct sockaddr_encap *em,
|
||||
struct sa_id said,
|
||||
uint32_t pid,
|
||||
struct sk_buff *skb,
|
||||
struct ident *ident_s,
|
||||
struct ident *ident_d);
|
||||
|
||||
extern int ipsec_breakroute(struct sockaddr_encap *ea,
|
||||
struct sockaddr_encap *em,
|
||||
struct sk_buff **first,
|
||||
struct sk_buff **last);
|
||||
|
||||
int ipsec_radijinit(void);
|
||||
int ipsec_cleareroutes(void);
|
||||
int ipsec_radijcleanup(void);
|
||||
|
||||
/* ipsec_life.c */
|
||||
extern enum ipsec_life_alive ipsec_lifetime_check(struct ipsec_lifetime64 *il64,
|
||||
const char *lifename,
|
||||
const char *saname,
|
||||
enum ipsec_life_type ilt,
|
||||
enum ipsec_direction idir,
|
||||
struct ipsec_sa *ips);
|
||||
|
||||
|
||||
extern int ipsec_lifetime_format(char *buffer,
|
||||
int buflen,
|
||||
char *lifename,
|
||||
enum ipsec_life_type timebaselife,
|
||||
struct ipsec_lifetime64 *lifetime);
|
||||
|
||||
extern void ipsec_lifetime_update_hard(struct ipsec_lifetime64 *lifetime,
|
||||
__u64 newvalue);
|
||||
|
||||
extern void ipsec_lifetime_update_soft(struct ipsec_lifetime64 *lifetime,
|
||||
__u64 newvalue);
|
||||
|
||||
|
||||
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
|
||||
extern int debug_xform;
|
||||
extern int debug_eroute;
|
||||
extern int debug_spi;
|
||||
extern int debug_netlink;
|
||||
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
|
||||
|
||||
|
||||
#define _IPSEC_PROTO_H
|
||||
#endif /* _IPSEC_PROTO_H_ */
|
||||
@@ -0,0 +1,63 @@
|
||||
/*
|
||||
* @(#) Definitions relevant to the IPSEC <> radij tree interfacing
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_radij.h,v 1.3 2004/04/28 05:44:29 as Exp $
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_RADIJ_H
|
||||
|
||||
#include <freeswan.h>
|
||||
|
||||
int ipsec_walk(char *);
|
||||
|
||||
int ipsec_rj_walker_procprint(struct radij_node *, void *);
|
||||
int ipsec_rj_walker_delete(struct radij_node *, void *);
|
||||
|
||||
/* This structure is used to pass information between
|
||||
* ipsec_eroute_get_info and ipsec_rj_walker_procprint
|
||||
* (through rj_walktree) and between calls of ipsec_rj_walker_procprint.
|
||||
*/
|
||||
struct wsbuf
|
||||
{
|
||||
/* from caller of ipsec_eroute_get_info: */
|
||||
char *const buffer; /* start of buffer provided */
|
||||
const int length; /* length of buffer provided */
|
||||
const off_t offset; /* file position of first character of interest */
|
||||
/* accumulated by ipsec_rj_walker_procprint: */
|
||||
int len; /* number of character filled into buffer */
|
||||
off_t begin; /* file position contained in buffer[0] (<=offset) */
|
||||
};
|
||||
|
||||
|
||||
extern struct radij_node_head *rnh;
|
||||
extern spinlock_t eroute_lock;
|
||||
|
||||
struct eroute * ipsec_findroute(struct sockaddr_encap *);
|
||||
|
||||
#define O1(x) (int)(((x)>>24)&0xff)
|
||||
#define O2(x) (int)(((x)>>16)&0xff)
|
||||
#define O3(x) (int)(((x)>>8)&0xff)
|
||||
#define O4(x) (int)(((x))&0xff)
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_radij;
|
||||
void rj_dumptrees(void);
|
||||
|
||||
#define DB_RJ_DUMPTREES 0x0001
|
||||
#define DB_RJ_FINDROUTE 0x0002
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
#define _IPSEC_RADIJ_H
|
||||
#endif
|
||||
@@ -0,0 +1,196 @@
|
||||
/*
|
||||
*
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_rcv.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
#define DB_RX_PKTRX 0x0001
|
||||
#define DB_RX_PKTRX2 0x0002
|
||||
#define DB_RX_DMP 0x0004
|
||||
#define DB_RX_IPSA 0x0010
|
||||
#define DB_RX_XF 0x0020
|
||||
#define DB_RX_IPAD 0x0040
|
||||
#define DB_RX_INAU 0x0080
|
||||
#define DB_RX_OINFO 0x0100
|
||||
#define DB_RX_OINFO2 0x0200
|
||||
#define DB_RX_OH 0x0400
|
||||
#define DB_RX_REPLAY 0x0800
|
||||
|
||||
#ifdef __KERNEL__
|
||||
/* struct options; */
|
||||
|
||||
#define __NO_VERSION__
|
||||
#include <linux/module.h>
|
||||
#include <linux/config.h> /* for CONFIG_IP_FORWARD */
|
||||
#include <linux/version.h>
|
||||
#include <freeswan.h>
|
||||
|
||||
#define IPSEC_BIRTH_TEMPLATE_MAXLEN 256
|
||||
|
||||
struct ipsec_birth_reply {
|
||||
int packet_template_len;
|
||||
unsigned char packet_template[IPSEC_BIRTH_TEMPLATE_MAXLEN];
|
||||
};
|
||||
|
||||
extern struct ipsec_birth_reply ipsec_ipv4_birth_packet;
|
||||
extern struct ipsec_birth_reply ipsec_ipv6_birth_packet;
|
||||
|
||||
extern int
|
||||
#ifdef PROTO_HANDLER_SINGLE_PARM
|
||||
ipsec_rcv(struct sk_buff *skb);
|
||||
#else /* PROTO_HANDLER_SINGLE_PARM */
|
||||
ipsec_rcv(struct sk_buff *skb,
|
||||
#ifdef NET_21
|
||||
unsigned short xlen);
|
||||
#else /* NET_21 */
|
||||
struct device *dev,
|
||||
struct options *opt,
|
||||
__u32 daddr,
|
||||
unsigned short len,
|
||||
__u32 saddr,
|
||||
int redo,
|
||||
struct inet_protocol *protocol);
|
||||
#endif /* NET_21 */
|
||||
#endif /* PROTO_HANDLER_SINGLE_PARM */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_rcv;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
extern int sysctl_ipsec_inbound_policy_check;
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_rcv.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.17 2002/09/03 16:32:32 mcr
|
||||
* definitions of ipsec_birth_reply.
|
||||
*
|
||||
* Revision 1.16 2002/05/14 02:36:00 rgb
|
||||
* Change references to _TDB to _IPSA.
|
||||
*
|
||||
* Revision 1.15 2002/04/24 07:36:47 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_rcv.h,v
|
||||
*
|
||||
* Revision 1.14 2001/09/07 22:15:48 rgb
|
||||
* Fix for removal of transport layer protocol handler arg in 2.4.4.
|
||||
*
|
||||
* Revision 1.13 2001/06/14 19:35:09 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.12 2001/03/16 07:36:44 rgb
|
||||
* Fixed #endif comment to sate compiler.
|
||||
*
|
||||
* Revision 1.11 2000/09/21 04:34:21 rgb
|
||||
* Moved declaration of sysctl_ipsec_inbound_policy_check outside
|
||||
* CONFIG_IPSEC_DEBUG. (MB)
|
||||
*
|
||||
* Revision 1.10 2000/09/18 02:36:10 rgb
|
||||
* Exported sysctl_ipsec_inbound_policy_check for skb_decompress().
|
||||
*
|
||||
* Revision 1.9 2000/09/08 19:12:56 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.8 1999/11/18 04:09:19 rgb
|
||||
* Replaced all kernel version macros to shorter, readable form.
|
||||
*
|
||||
* Revision 1.7 1999/05/25 01:45:37 rgb
|
||||
* Fix version macros for 2.0.x as a module.
|
||||
*
|
||||
* Revision 1.6 1999/05/08 21:24:27 rgb
|
||||
* Add includes for 2.2.x include into net/ipv4/protocol.c
|
||||
*
|
||||
* Revision 1.5 1999/05/05 22:02:32 rgb
|
||||
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
|
||||
*
|
||||
* Revision 1.4 1999/04/11 00:28:59 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.3 1999/04/06 04:54:27 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.2 1999/01/22 20:06:59 rgb
|
||||
* Fixed cut-and-paste error from ipsec_esp.h.
|
||||
*
|
||||
* Revision 1.1 1999/01/21 20:29:12 rgb
|
||||
* Converted from transform switching to algorithm switching.
|
||||
*
|
||||
* Log: ipsec_esp.h,v
|
||||
* Revision 1.4 1998/08/12 00:07:32 rgb
|
||||
* Added data structures for new xforms: null, {,3}dessha1.
|
||||
*
|
||||
* Revision 1.3 1998/07/14 15:57:01 rgb
|
||||
* Add #ifdef __KERNEL__ to protect kernel-only structures.
|
||||
*
|
||||
* Revision 1.2 1998/06/25 19:33:46 rgb
|
||||
* Add prototype for protocol receive function.
|
||||
* Rearrange for more logical layout.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:45 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.6 1998/06/05 02:28:08 rgb
|
||||
* Minor comment fix.
|
||||
*
|
||||
* Revision 1.5 1998/05/27 22:34:00 rgb
|
||||
* Changed structures to accomodate key separation.
|
||||
*
|
||||
* Revision 1.4 1998/05/18 22:28:43 rgb
|
||||
* Disable key printing facilities from /proc/net/ipsec_*.
|
||||
*
|
||||
* Revision 1.3 1998/04/21 21:29:07 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.2 1998/04/12 22:03:20 rgb
|
||||
* Updated ESP-3DES-HMAC-MD5-96,
|
||||
* ESP-DES-HMAC-MD5-96,
|
||||
* AH-HMAC-MD5-96,
|
||||
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
|
||||
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
|
||||
*
|
||||
* Fixed eroute references in /proc/net/ipsec*.
|
||||
*
|
||||
* Started to patch module unloading memory leaks in ipsec_netlink and
|
||||
* radij tree unloading.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:00 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.5 1997/06/03 04:24:48 ji
|
||||
* Added ESP-3DES-MD5-96 transform.
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* Added definitions for new ESP transforms.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:35:48 ji
|
||||
* Minor Cleanup.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
@@ -0,0 +1,338 @@
|
||||
/*
|
||||
* @(#) Definitions of IPsec Security Association (ipsec_sa)
|
||||
*
|
||||
* Copyright (C) 2001, 2002, 2003
|
||||
* Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_sa.h,v 1.3 2004/04/28 08:07:11 as Exp $
|
||||
*
|
||||
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the IPsec Security Association Structure.
|
||||
*
|
||||
* This structure keeps track of a single transform that may be done
|
||||
* to a set of packets. It can describe applying the transform or
|
||||
* apply the reverse. (e.g. compression vs expansion). However, it
|
||||
* only describes one at a time. To describe both, two structures would
|
||||
* be used, but since the sides of the transform are performed
|
||||
* on different machines typically it is usual to have only one side
|
||||
* of each association.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_SA_H_
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include "ipsec_stats.h"
|
||||
#include "ipsec_life.h"
|
||||
#include "ipsec_eroute.h"
|
||||
#endif /* __KERNEL__ */
|
||||
#include "ipsec_param.h"
|
||||
|
||||
|
||||
/* SAs are held in a table.
|
||||
* Entries in this table are referenced by IPsecSAref_t values.
|
||||
* IPsecSAref_t values are conceptually subscripts. Because
|
||||
* we want to allocate the table piece-meal, the subscripting
|
||||
* is implemented with two levels, a bit like paged virtual memory.
|
||||
* This representation mechanism is known as an Iliffe Vector.
|
||||
*
|
||||
* The Main table (AKA the refTable) consists of 2^IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
|
||||
* pointers to subtables.
|
||||
* Each subtable has 2^IPSEC_SA_REF_SUBTABLE_IDX_WIDTH entries, each of which
|
||||
* is a pointer to an SA.
|
||||
*
|
||||
* An IPsecSAref_t contains either an exceptional value (signified by the
|
||||
* high-order bit being on) or a reference to a table entry. A table entry
|
||||
* reference has the subtable subscript in the low-order
|
||||
* IPSEC_SA_REF_SUBTABLE_IDX_WIDTH bits and the Main table subscript
|
||||
* in the next lowest IPSEC_SA_REF_MAINTABLE_IDX_WIDTH bits.
|
||||
*
|
||||
* The Maintable entry for an IPsecSAref_t x, a pointer to its subtable, is
|
||||
* IPsecSAref2table(x). It is of type struct IPsecSArefSubTable *.
|
||||
*
|
||||
* The pointer to the SA for x is IPsecSAref2SA(x). It is of type
|
||||
* struct ipsec_sa*. The macro definition clearly shows the two-level
|
||||
* access needed to find the SA pointer.
|
||||
*
|
||||
* The Maintable is allocated when IPsec is initialized.
|
||||
* Each subtable is allocated when needed, but the first is allocated
|
||||
* when IPsec is initialized.
|
||||
*
|
||||
* IPsecSAref_t is designed to be smaller than an NFmark so that
|
||||
* they can be stored in NFmarks and still leave a few bits for other
|
||||
* purposes. The spare bits are in the low order of the NFmark
|
||||
* but in the high order of the IPsecSAref_t, so conversion is required.
|
||||
* We pick the upper bits of NFmark on the theory that they are less likely to
|
||||
* interfere with more pedestrian uses of nfmark.
|
||||
*/
|
||||
|
||||
|
||||
typedef unsigned short int IPsecRefTableUnusedCount;
|
||||
|
||||
#define IPSEC_SA_REF_TABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#if ((IPSEC_SA_REF_TABLE_IDX_WIDTH - (1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) < 0)
|
||||
#error "IPSEC_SA_REF_TABLE_IDX_WIDTH("IPSEC_SA_REF_TABLE_IDX_WIDTH") MUST be < 1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH("IPSEC_SA_REF_MAINTABLE_IDX_WIDTH")"
|
||||
#endif
|
||||
|
||||
#define IPSEC_SA_REF_SUBTABLE_IDX_WIDTH (IPSEC_SA_REF_TABLE_IDX_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
|
||||
|
||||
#define IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
|
||||
#define IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
|
||||
#ifdef CONFIG_NETFILTER
|
||||
#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->nfmark
|
||||
#define IPSEC_SA_REF_HOST_FIELD_TYPE typeof(IPSEC_SA_REF_HOST_FIELD(NULL))
|
||||
#else /* CONFIG_NETFILTER */
|
||||
/* just make it work for now, it doesn't matter, since there is no nfmark */
|
||||
#define IPSEC_SA_REF_HOST_FIELD_TYPE unsigned long
|
||||
#endif /* CONFIG_NETFILTER */
|
||||
#define IPSEC_SA_REF_HOST_FIELD_WIDTH (8 * sizeof(IPSEC_SA_REF_HOST_FIELD_TYPE))
|
||||
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
|
||||
|
||||
#define IPSEC_SA_REF_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
|
||||
#define IPSEC_SA_REF_TABLE_MASK ((IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
#define IPSEC_SA_REF_ENTRY_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_SUBTABLE_IDX_WIDTH))
|
||||
|
||||
#define IPsecSAref2table(x) (((x) & IPSEC_SA_REF_TABLE_MASK) >> IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
|
||||
#define IPsecSAref2entry(x) ((x) & IPSEC_SA_REF_ENTRY_MASK)
|
||||
#define IPsecSArefBuild(x,y) (((x) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH) + (y))
|
||||
|
||||
#define IPsecSAref2SA(x) (ipsec_sadb.refTable[IPsecSAref2table(x)]->entry[IPsecSAref2entry(x)])
|
||||
#define IPsecSA2SAref(x) ((x)->ips_ref)
|
||||
|
||||
#define EMT_INBOUND 0x01 /* SA direction, 1=inbound */
|
||||
|
||||
/* 'struct ipsec_sa' should be 64bit aligned when allocated. */
|
||||
struct ipsec_sa
|
||||
{
|
||||
IPsecSAref_t ips_ref; /* reference table entry number */
|
||||
atomic_t ips_refcount; /* reference count for this struct */
|
||||
struct ipsec_sa *ips_hnext; /* next in hash chain */
|
||||
struct ipsec_sa *ips_inext; /* pointer to next xform */
|
||||
struct ipsec_sa *ips_onext; /* pointer to prev xform */
|
||||
|
||||
struct ifnet *ips_rcvif; /* related rcv encap interface */
|
||||
|
||||
struct sa_id ips_said; /* SA ID */
|
||||
|
||||
__u32 ips_seq; /* seq num of msg that initiated this SA */
|
||||
__u32 ips_pid; /* PID of process that initiated this SA */
|
||||
__u8 ips_authalg; /* auth algorithm for this SA */
|
||||
__u8 ips_encalg; /* enc algorithm for this SA */
|
||||
|
||||
struct ipsec_stats ips_errs;
|
||||
|
||||
__u8 ips_replaywin; /* replay window size */
|
||||
__u8 ips_state; /* state of SA */
|
||||
__u32 ips_replaywin_lastseq; /* last pkt sequence num */
|
||||
__u64 ips_replaywin_bitmap; /* bitmap of received pkts */
|
||||
__u32 ips_replaywin_maxdiff; /* max pkt sequence difference */
|
||||
|
||||
__u32 ips_flags; /* generic xform flags */
|
||||
|
||||
|
||||
struct ipsec_lifetimes ips_life; /* lifetime records */
|
||||
|
||||
/* selector information */
|
||||
struct sockaddr*ips_addr_s; /* src sockaddr */
|
||||
struct sockaddr*ips_addr_d; /* dst sockaddr */
|
||||
struct sockaddr*ips_addr_p; /* proxy sockaddr */
|
||||
__u16 ips_addr_s_size;
|
||||
__u16 ips_addr_d_size;
|
||||
__u16 ips_addr_p_size;
|
||||
ip_address ips_flow_s;
|
||||
ip_address ips_flow_d;
|
||||
ip_address ips_mask_s;
|
||||
ip_address ips_mask_d;
|
||||
|
||||
__u16 ips_key_bits_a; /* size of authkey in bits */
|
||||
__u16 ips_auth_bits; /* size of authenticator in bits */
|
||||
__u16 ips_key_bits_e; /* size of enckey in bits */
|
||||
__u16 ips_iv_bits; /* size of IV in bits */
|
||||
__u8 ips_iv_size;
|
||||
__u16 ips_key_a_size;
|
||||
__u16 ips_key_e_size;
|
||||
|
||||
caddr_t ips_key_a; /* authentication key */
|
||||
caddr_t ips_key_e; /* encryption key */
|
||||
caddr_t ips_iv; /* Initialisation Vector */
|
||||
|
||||
struct ident ips_ident_s; /* identity src */
|
||||
struct ident ips_ident_d; /* identity dst */
|
||||
|
||||
#ifdef CONFIG_IPSEC_IPCOMP
|
||||
__u16 ips_comp_adapt_tries; /* ipcomp self-adaption tries */
|
||||
__u16 ips_comp_adapt_skip; /* ipcomp self-adaption to-skip */
|
||||
__u64 ips_comp_ratio_cbytes; /* compressed bytes */
|
||||
__u64 ips_comp_ratio_dbytes; /* decompressed (or uncompressed) bytes */
|
||||
#endif /* CONFIG_IPSEC_IPCOMP */
|
||||
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
__u8 ips_natt_type;
|
||||
__u8 ips_natt_reserved[3];
|
||||
__u16 ips_natt_sport;
|
||||
__u16 ips_natt_dport;
|
||||
|
||||
struct sockaddr *ips_natt_oa;
|
||||
__u16 ips_natt_oa_size;
|
||||
__u16 ips_natt_reserved2;
|
||||
#endif
|
||||
|
||||
#if 0
|
||||
__u32 ips_sens_dpd;
|
||||
__u8 ips_sens_sens_level;
|
||||
__u8 ips_sens_sens_len;
|
||||
__u64* ips_sens_sens_bitmap;
|
||||
__u8 ips_sens_integ_level;
|
||||
__u8 ips_sens_integ_len;
|
||||
__u64* ips_sens_integ_bitmap;
|
||||
#endif
|
||||
struct ipsec_alg_enc *ips_alg_enc;
|
||||
struct ipsec_alg_auth *ips_alg_auth;
|
||||
IPsecSAref_t ips_ref_rel;
|
||||
};
|
||||
|
||||
struct IPsecSArefSubTable
|
||||
{
|
||||
struct ipsec_sa* entry[IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES];
|
||||
};
|
||||
|
||||
struct ipsec_sadb {
|
||||
struct IPsecSArefSubTable* refTable[IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES];
|
||||
IPsecSAref_t refFreeList[IPSEC_SA_REF_FREELIST_NUM_ENTRIES];
|
||||
int refFreeListHead;
|
||||
int refFreeListTail;
|
||||
IPsecSAref_t refFreeListCont;
|
||||
IPsecSAref_t said_hash[SADB_HASHMOD];
|
||||
spinlock_t sadb_lock;
|
||||
};
|
||||
|
||||
extern struct ipsec_sadb ipsec_sadb;
|
||||
|
||||
extern int ipsec_SAref_recycle(void);
|
||||
extern int ipsec_SArefSubTable_alloc(unsigned table);
|
||||
extern int ipsec_saref_freelist_init(void);
|
||||
extern int ipsec_sadb_init(void);
|
||||
extern struct ipsec_sa *ipsec_sa_alloc(int*error); /* pass in error var by pointer */
|
||||
extern IPsecSAref_t ipsec_SAref_alloc(int*erorr); /* pass in error var by pointer */
|
||||
extern int ipsec_sa_free(struct ipsec_sa* ips);
|
||||
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id *said);
|
||||
extern int ipsec_sa_put(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_add(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_del(struct ipsec_sa *ips);
|
||||
extern int ipsec_sa_delchain(struct ipsec_sa *ips);
|
||||
extern int ipsec_sadb_cleanup(__u8 proto);
|
||||
extern int ipsec_sadb_free(void);
|
||||
extern int ipsec_sa_wipe(struct ipsec_sa *ips);
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
enum ipsec_direction {
|
||||
ipsec_incoming = 1,
|
||||
ipsec_outgoing = 2
|
||||
};
|
||||
|
||||
#define _IPSEC_SA_H_
|
||||
#endif /* _IPSEC_SA_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_sa.h,v $
|
||||
* Revision 1.3 2004/04/28 08:07:11 as
|
||||
* added dhr's freeswan-2.06 changes
|
||||
*
|
||||
* Revision 1.2 2004/03/22 21:53:18 as
|
||||
* merged alg-0.8.1 branch with HEAD
|
||||
*
|
||||
* Revision 1.1.2.1.2.1 2004/03/16 09:48:18 as
|
||||
* alg-0.8.1rc12 patch merged
|
||||
*
|
||||
* Revision 1.1.2.1 2004/03/15 22:30:06 as
|
||||
* nat-0.6c patch merged
|
||||
*
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.15 2003/05/11 00:53:09 mcr
|
||||
* IPsecSAref_t and macros were moved to freeswan.h.
|
||||
*
|
||||
* Revision 1.14 2003/02/12 19:31:55 rgb
|
||||
* Fixed bug in "file seen" machinery.
|
||||
* Updated copyright year.
|
||||
*
|
||||
* Revision 1.13 2003/01/30 02:31:52 rgb
|
||||
*
|
||||
* Re-wrote comments describing SAref system for accuracy.
|
||||
* Rename SAref table macro names for clarity.
|
||||
* Convert IPsecSAref_t from signed to unsigned to fix apparent SAref exhaustion bug.
|
||||
* Transmit error code through to caller from callee for better diagnosis of problems.
|
||||
* Enclose all macro arguments in parens to avoid any possible obscrure bugs.
|
||||
*
|
||||
* Revision 1.12 2002/10/07 18:31:19 rgb
|
||||
* Change comment to reflect the flexible nature of the main and sub-table widths.
|
||||
* Added a counter for the number of unused entries in each subtable.
|
||||
* Further break up host field type macro to host field.
|
||||
* Move field width sanity checks to ipsec_sa.c
|
||||
* Define a mask for an entire saref.
|
||||
*
|
||||
* Revision 1.11 2002/09/20 15:40:33 rgb
|
||||
* Re-write most of the SAref macros and types to eliminate any pointer references to Entrys.
|
||||
* Fixed SAref/nfmark macros.
|
||||
* Rework saref freeslist.
|
||||
* Place all ipsec sadb globals into one struct.
|
||||
* Restrict some bits to kernel context for use to klips utils.
|
||||
*
|
||||
* Revision 1.10 2002/09/20 05:00:34 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.9 2002/09/17 17:19:29 mcr
|
||||
* make it compile even if there is no netfilter - we lost
|
||||
* functionality, but it works, especially on 2.2.
|
||||
*
|
||||
* Revision 1.8 2002/07/28 22:59:53 mcr
|
||||
* clarified/expanded one comment.
|
||||
*
|
||||
* Revision 1.7 2002/07/26 08:48:31 rgb
|
||||
* Added SA ref table code.
|
||||
*
|
||||
* Revision 1.6 2002/05/31 17:27:48 rgb
|
||||
* Comment fix.
|
||||
*
|
||||
* Revision 1.5 2002/05/27 18:55:03 rgb
|
||||
* Remove final vistiges of tdb references via IPSEC_KLIPS1_COMPAT.
|
||||
*
|
||||
* Revision 1.4 2002/05/23 07:13:36 rgb
|
||||
* Convert "usecount" to "refcount" to remove ambiguity.
|
||||
*
|
||||
* Revision 1.3 2002/04/24 07:36:47 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_sa.h,v
|
||||
*
|
||||
* Revision 1.2 2001/11/26 09:16:15 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.1.2.1 2001/09/25 02:24:58 mcr
|
||||
* struct tdb -> struct ipsec_sa.
|
||||
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
|
||||
* ipsec_xform.c removed. header file still contains useful things.
|
||||
*
|
||||
*
|
||||
* Local variables:
|
||||
* c-file-style: "linux"
|
||||
* End:
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,79 @@
|
||||
/*
|
||||
* RCSID $Id: ipsec_sha1.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
/*
|
||||
* Here is the original comment from the distribution:
|
||||
|
||||
SHA-1 in C
|
||||
By Steve Reid <[email protected]>
|
||||
100% Public Domain
|
||||
|
||||
* Adapted for use by the IPSEC code by John Ioannidis
|
||||
*/
|
||||
|
||||
|
||||
#ifndef _IPSEC_SHA1_H_
|
||||
#define _IPSEC_SHA1_H_
|
||||
|
||||
typedef struct
|
||||
{
|
||||
__u32 state[5];
|
||||
__u32 count[2];
|
||||
__u8 buffer[64];
|
||||
} SHA1_CTX;
|
||||
|
||||
void SHA1Transform(__u32 state[5], __u8 buffer[64]);
|
||||
void SHA1Init(void *context);
|
||||
void SHA1Update(void *context, unsigned char *data, __u32 len);
|
||||
void SHA1Final(unsigned char digest[20], void *context);
|
||||
|
||||
|
||||
#endif /* _IPSEC_SHA1_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_sha1.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.7 2002/09/10 01:45:09 mcr
|
||||
* changed type of MD5_CTX and SHA1_CTX to void * so that
|
||||
* the function prototypes would match, and could be placed
|
||||
* into a pointer to a function.
|
||||
*
|
||||
* Revision 1.6 2002/04/24 07:36:47 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_sha1.h,v
|
||||
*
|
||||
* Revision 1.5 1999/12/13 13:59:13 rgb
|
||||
* Quick fix to argument size to Update bugs.
|
||||
*
|
||||
* Revision 1.4 1999/12/07 18:16:23 rgb
|
||||
* Fixed comments at end of #endif lines.
|
||||
*
|
||||
* Revision 1.3 1999/04/06 04:54:27 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.2 1998/11/30 13:22:54 rgb
|
||||
* Rationalised all the klips kernel file headers. They are much shorter
|
||||
* now and won't conflict under RH5.2.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:50 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.2 1998/04/23 20:54:05 rgb
|
||||
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
|
||||
* verified.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:04:21 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
* these two include files modified not to include others except in kernel
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* New transform
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,38 @@
|
||||
/*
|
||||
* @(#) definition of ipsec_stats structure
|
||||
*
|
||||
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
|
||||
* and Michael Richardson <[email protected]>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_stats.h,v 1.2 2004/03/30 19:33:52 as Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file describes the errors/statistics that FreeSWAN collects.
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_STATS_H_
|
||||
|
||||
struct ipsec_stats {
|
||||
__u32 ips_alg_errs; /* number of algorithm errors */
|
||||
__u32 ips_auth_errs; /* # of authentication errors */
|
||||
__u32 ips_encsize_errs; /* # of encryption size errors*/
|
||||
__u32 ips_encpad_errs; /* # of encryption pad errors*/
|
||||
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
|
||||
};
|
||||
|
||||
extern int ipsec_snprintf(char * buf, ssize_t size, const char *fmt, ...);
|
||||
|
||||
#define _IPSEC_STATS_H_
|
||||
#endif /* _IPSEC_STATS_H_ */
|
||||
@@ -0,0 +1,265 @@
|
||||
/*
|
||||
* IPSEC tunneling code
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_tunnel.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
|
||||
#ifdef NET_21
|
||||
# define DEV_QUEUE_XMIT(skb, device, pri) {\
|
||||
skb->dev = device; \
|
||||
neigh_compat_output(skb); \
|
||||
/* skb->dst->output(skb); */ \
|
||||
}
|
||||
# define ICMP_SEND(skb_in, type, code, info, dev) \
|
||||
icmp_send(skb_in, type, code, htonl(info))
|
||||
# define IP_SEND(skb, dev) \
|
||||
ip_send(skb);
|
||||
#else /* NET_21 */
|
||||
# define DEV_QUEUE_XMIT(skb, device, pri) {\
|
||||
dev_queue_xmit(skb, device, pri); \
|
||||
}
|
||||
# define ICMP_SEND(skb_in, type, code, info, dev) \
|
||||
icmp_send(skb_in, type, code, info, dev)
|
||||
# define IP_SEND(skb, dev) \
|
||||
if(ntohs(iph->tot_len) > physmtu) { \
|
||||
ip_fragment(NULL, skb, dev, 0); \
|
||||
ipsec_kfree_skb(skb); \
|
||||
} else { \
|
||||
dev_queue_xmit(skb, dev, SOPRI_NORMAL); \
|
||||
}
|
||||
#endif /* NET_21 */
|
||||
|
||||
|
||||
/*
|
||||
* Heavily based on drivers/net/new_tunnel.c. Lots
|
||||
* of ideas also taken from the 2.1.x version of drivers/net/shaper.c
|
||||
*/
|
||||
|
||||
struct ipsectunnelconf
|
||||
{
|
||||
__u32 cf_cmd;
|
||||
union
|
||||
{
|
||||
char cfu_name[12];
|
||||
} cf_u;
|
||||
#define cf_name cf_u.cfu_name
|
||||
};
|
||||
|
||||
#define IPSEC_SET_DEV (SIOCDEVPRIVATE)
|
||||
#define IPSEC_DEL_DEV (SIOCDEVPRIVATE + 1)
|
||||
#define IPSEC_CLR_DEV (SIOCDEVPRIVATE + 2)
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#include <linux/version.h>
|
||||
#ifndef KERNEL_VERSION
|
||||
# define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
|
||||
#endif
|
||||
struct ipsecpriv
|
||||
{
|
||||
struct sk_buff_head sendq;
|
||||
struct device *dev;
|
||||
struct wait_queue *wait_queue;
|
||||
char locked;
|
||||
int (*hard_start_xmit) (struct sk_buff *skb,
|
||||
struct device *dev);
|
||||
int (*hard_header) (struct sk_buff *skb,
|
||||
struct device *dev,
|
||||
unsigned short type,
|
||||
void *daddr,
|
||||
void *saddr,
|
||||
unsigned len);
|
||||
#ifdef NET_21
|
||||
int (*rebuild_header)(struct sk_buff *skb);
|
||||
#else /* NET_21 */
|
||||
int (*rebuild_header)(void *buff, struct device *dev,
|
||||
unsigned long raddr, struct sk_buff *skb);
|
||||
#endif /* NET_21 */
|
||||
int (*set_mac_address)(struct device *dev, void *addr);
|
||||
#ifndef NET_21
|
||||
void (*header_cache_bind)(struct hh_cache **hhp, struct device *dev,
|
||||
unsigned short htype, __u32 daddr);
|
||||
#endif /* !NET_21 */
|
||||
void (*header_cache_update)(struct hh_cache *hh, struct device *dev, unsigned char * haddr);
|
||||
struct net_device_stats *(*get_stats)(struct device *dev);
|
||||
struct net_device_stats mystats;
|
||||
int mtu; /* What is the desired MTU? */
|
||||
};
|
||||
|
||||
extern char ipsec_tunnel_c_version[];
|
||||
|
||||
extern struct device *ipsecdevices[IPSEC_NUM_IF];
|
||||
|
||||
int ipsec_tunnel_init_devices(void);
|
||||
|
||||
/* void */ int ipsec_tunnel_cleanup_devices(void);
|
||||
|
||||
extern /* void */ int ipsec_init(void);
|
||||
|
||||
extern int ipsec_tunnel_start_xmit(struct sk_buff *skb, struct device *dev);
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
extern int debug_tunnel;
|
||||
extern int sysctl_ipsec_debug_verbose;
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#ifdef CONFIG_IPSEC_DEBUG
|
||||
#define DB_TN_INIT 0x0001
|
||||
#define DB_TN_PROCFS 0x0002
|
||||
#define DB_TN_XMIT 0x0010
|
||||
#define DB_TN_OHDR 0x0020
|
||||
#define DB_TN_CROUT 0x0040
|
||||
#define DB_TN_OXFS 0x0080
|
||||
#define DB_TN_REVEC 0x0100
|
||||
#endif /* CONFIG_IPSEC_DEBUG */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_tunnel.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.28 2003/06/24 20:22:32 mcr
|
||||
* added new global: ipsecdevices[] so that we can keep track of
|
||||
* the ipsecX devices. They will be referenced with dev_hold(),
|
||||
* so 2.2 may need this as well.
|
||||
*
|
||||
* Revision 1.27 2003/04/03 17:38:09 rgb
|
||||
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
|
||||
*
|
||||
* Revision 1.26 2003/02/12 19:32:20 rgb
|
||||
* Updated copyright year.
|
||||
*
|
||||
* Revision 1.25 2002/05/27 18:56:07 rgb
|
||||
* Convert to dynamic ipsec device allocation.
|
||||
*
|
||||
* Revision 1.24 2002/04/24 07:36:48 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_tunnel.h,v
|
||||
*
|
||||
* Revision 1.23 2001/11/06 19:50:44 rgb
|
||||
* Moved IP_SEND, ICMP_SEND, DEV_QUEUE_XMIT macros to ipsec_tunnel.h for
|
||||
* use also by pfkey_v2_parser.c
|
||||
*
|
||||
* Revision 1.22 2001/09/15 16:24:05 rgb
|
||||
* Re-inject first and last HOLD packet when an eroute REPLACE is done.
|
||||
*
|
||||
* Revision 1.21 2001/06/14 19:35:10 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.20 2000/09/15 11:37:02 rgb
|
||||
* Merge in heavily modified Svenning Soerensen's <[email protected]>
|
||||
* IPCOMP zlib deflate code.
|
||||
*
|
||||
* Revision 1.19 2000/09/08 19:12:56 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.18 2000/07/28 13:50:54 rgb
|
||||
* Changed enet_statistics to net_device_stats and added back compatibility
|
||||
* for pre-2.1.19.
|
||||
*
|
||||
* Revision 1.17 1999/11/19 01:12:15 rgb
|
||||
* Purge unneeded proc_info prototypes, now that static linking uses
|
||||
* dynamic proc_info registration.
|
||||
*
|
||||
* Revision 1.16 1999/11/18 18:51:00 rgb
|
||||
* Changed all device registrations for static linking to
|
||||
* dynamic to reduce the number and size of patches.
|
||||
*
|
||||
* Revision 1.15 1999/11/18 04:14:21 rgb
|
||||
* Replaced all kernel version macros to shorter, readable form.
|
||||
* Added CONFIG_PROC_FS compiler directives in case it is shut off.
|
||||
* Added Marc Boucher's 2.3.25 proc patches.
|
||||
*
|
||||
* Revision 1.14 1999/05/25 02:50:10 rgb
|
||||
* Fix kernel version macros for 2.0.x static linking.
|
||||
*
|
||||
* Revision 1.13 1999/05/25 02:41:06 rgb
|
||||
* Add ipsec_klipsdebug support for static linking.
|
||||
*
|
||||
* Revision 1.12 1999/05/05 22:02:32 rgb
|
||||
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
|
||||
*
|
||||
* Revision 1.11 1999/04/29 15:19:50 rgb
|
||||
* Add return values to init and cleanup functions.
|
||||
*
|
||||
* Revision 1.10 1999/04/16 16:02:39 rgb
|
||||
* Bump up macro to 4 ipsec I/Fs.
|
||||
*
|
||||
* Revision 1.9 1999/04/15 15:37:25 rgb
|
||||
* Forward check changes from POST1_00 branch.
|
||||
*
|
||||
* Revision 1.5.2.1 1999/04/02 04:26:14 rgb
|
||||
* Backcheck from HEAD, pre1.0.
|
||||
*
|
||||
* Revision 1.8 1999/04/11 00:29:01 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.7 1999/04/06 04:54:28 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.6 1999/03/31 05:44:48 rgb
|
||||
* Keep PMTU reduction private.
|
||||
*
|
||||
* Revision 1.5 1999/02/10 22:31:20 rgb
|
||||
* Change rebuild_header member to reflect generality of link layer.
|
||||
*
|
||||
* Revision 1.4 1998/12/01 13:22:04 rgb
|
||||
* Added support for debug printing of version info.
|
||||
*
|
||||
* Revision 1.3 1998/07/29 20:42:46 rgb
|
||||
* Add a macro for clearing all tunnel devices.
|
||||
* Rearrange structures and declarations for sharing with userspace.
|
||||
*
|
||||
* Revision 1.2 1998/06/25 20:01:45 rgb
|
||||
* Make prototypes available for ipsec_init and ipsec proc_dir_entries
|
||||
* for static linking.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:50 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.3 1998/05/18 21:51:50 rgb
|
||||
* Added macros for num of I/F's and a procfs debug switch.
|
||||
*
|
||||
* Revision 1.2 1998/04/21 21:29:09 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:13 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:05 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.5 1997/06/03 04:24:48 ji
|
||||
* Added transport mode.
|
||||
* Changed the way routing is done.
|
||||
* Lots of bug fixes.
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* No changes.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:39:04 ji
|
||||
* Minor cleanups.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,274 @@
|
||||
/*
|
||||
* Definitions relevant to IPSEC transformations
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_xform.h,v 1.3 2004/09/29 22:26:13 as Exp $
|
||||
*/
|
||||
|
||||
#ifndef _IPSEC_XFORM_H_
|
||||
|
||||
#include <freeswan.h>
|
||||
#include "ipsec_policy.h"
|
||||
|
||||
#define XF_NONE 0 /* No transform set */
|
||||
#define XF_IP4 1 /* IPv4 inside IPv4 */
|
||||
#define XF_AHMD5 2 /* AH MD5 */
|
||||
#define XF_AHSHA 3 /* AH SHA */
|
||||
#define XF_ESP3DES 5 /* ESP DES3-CBC */
|
||||
#define XF_AHHMACMD5 6 /* AH-HMAC-MD5 with opt replay prot */
|
||||
#define XF_AHHMACSHA1 7 /* AH-HMAC-SHA1 with opt replay prot */
|
||||
#define XF_ESP3DESMD5 9 /* triple DES, HMAC-MD-5, 128-bits of authentication */
|
||||
#define XF_ESP3DESMD596 10 /* triple DES, HMAC-MD-5, 96-bits of authentication */
|
||||
#define XF_ESPNULLMD596 12 /* NULL, HMAC-MD-5 with 96-bits of authentication */
|
||||
#define XF_ESPNULLSHA196 13 /* NULL, HMAC-SHA-1 with 96-bits of authentication */
|
||||
#define XF_ESP3DESSHA196 14 /* triple DES, HMAC-SHA-1, 96-bits of authentication */
|
||||
#define XF_IP6 15 /* IPv6 inside IPv6 */
|
||||
#define XF_COMPDEFLATE 16 /* IPCOMP deflate */
|
||||
|
||||
#define XF_CLR 126 /* Clear SA table */
|
||||
#define XF_DEL 127 /* Delete SA */
|
||||
|
||||
#define XFT_AUTH 0x0001
|
||||
#define XFT_CONF 0x0100
|
||||
|
||||
/* available if CONFIG_IPSEC_DEBUG is defined */
|
||||
#define DB_XF_INIT 0x0001
|
||||
|
||||
#define PROTO2TXT(x) \
|
||||
(x) == IPPROTO_AH ? "AH" : \
|
||||
(x) == IPPROTO_ESP ? "ESP" : \
|
||||
(x) == IPPROTO_IPIP ? "IPIP" : \
|
||||
(x) == IPPROTO_COMP ? "COMP" : \
|
||||
"UNKNOWN_proto"
|
||||
static inline const char *enc_name_id (unsigned id) {
|
||||
static char buf[16];
|
||||
snprintf(buf, sizeof(buf), "_ID%d", id);
|
||||
return buf;
|
||||
}
|
||||
static inline const char *auth_name_id (unsigned id) {
|
||||
static char buf[16];
|
||||
snprintf(buf, sizeof(buf), "_ID%d", id);
|
||||
return buf;
|
||||
}
|
||||
#define IPS_XFORM_NAME(x) \
|
||||
PROTO2TXT((x)->ips_said.proto), \
|
||||
(x)->ips_said.proto == IPPROTO_COMP ? \
|
||||
((x)->ips_encalg == SADB_X_CALG_DEFLATE ? \
|
||||
"_DEFLATE" : "_UNKNOWN_comp") : \
|
||||
(x)->ips_encalg == ESP_NONE ? "" : \
|
||||
(x)->ips_encalg == ESP_3DES ? "_3DES" : \
|
||||
(x)->ips_encalg == ESP_AES ? "_AES" : \
|
||||
(x)->ips_encalg == ESP_SERPENT ? "_SERPENT" : \
|
||||
(x)->ips_encalg == ESP_TWOFISH ? "_TWOFISH" : \
|
||||
enc_name_id(x->ips_encalg)/* "_UNKNOWN_encr" */, \
|
||||
(x)->ips_authalg == AH_NONE ? "" : \
|
||||
(x)->ips_authalg == AH_MD5 ? "_HMAC_MD5" : \
|
||||
(x)->ips_authalg == AH_SHA ? "_HMAC_SHA1" : \
|
||||
(x)->ips_authalg == AH_SHA2_256 ? "_HMAC_SHA2_256" : \
|
||||
(x)->ips_authalg == AH_SHA2_384 ? "_HMAC_SHA2_384" : \
|
||||
(x)->ips_authalg == AH_SHA2_512 ? "_HMAC_SHA2_512" : \
|
||||
auth_name_id(x->ips_authalg) /* "_UNKNOWN_auth" */ \
|
||||
|
||||
#define _IPSEC_XFORM_H_
|
||||
#endif /* _IPSEC_XFORM_H_ */
|
||||
|
||||
/*
|
||||
* $Log: ipsec_xform.h,v $
|
||||
* Revision 1.3 2004/09/29 22:26:13 as
|
||||
* included ipsec_policy.h
|
||||
*
|
||||
* Revision 1.2 2004/03/22 21:53:18 as
|
||||
* merged alg-0.8.1 branch with HEAD
|
||||
*
|
||||
* Revision 1.1.4.1 2004/03/16 09:48:18 as
|
||||
* alg-0.8.1rc12 patch merged
|
||||
*
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.36 2002/04/24 07:36:48 mcr
|
||||
* Moved from ./klips/net/ipsec/ipsec_xform.h,v
|
||||
*
|
||||
* Revision 1.35 2001/11/26 09:23:51 rgb
|
||||
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
|
||||
*
|
||||
* Revision 1.33.2.1 2001/09/25 02:24:58 mcr
|
||||
* struct tdb -> struct ipsec_sa.
|
||||
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
|
||||
* ipsec_xform.c removed. header file still contains useful things.
|
||||
*
|
||||
* Revision 1.34 2001/11/06 19:47:17 rgb
|
||||
* Changed lifetime_packets to uint32 from uint64.
|
||||
*
|
||||
* Revision 1.33 2001/09/08 21:13:34 rgb
|
||||
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
|
||||
*
|
||||
* Revision 1.32 2001/07/06 07:40:01 rgb
|
||||
* Reformatted for readability.
|
||||
* Added inbound policy checking fields for use with IPIP SAs.
|
||||
*
|
||||
* Revision 1.31 2001/06/14 19:35:11 rgb
|
||||
* Update copyright date.
|
||||
*
|
||||
* Revision 1.30 2001/05/30 08:14:03 rgb
|
||||
* Removed vestiges of esp-null transforms.
|
||||
*
|
||||
* Revision 1.29 2001/01/30 23:42:47 rgb
|
||||
* Allow pfkey msgs from pid other than user context required for ACQUIRE
|
||||
* and subsequent ADD or UDATE.
|
||||
*
|
||||
* Revision 1.28 2000/11/06 04:30:40 rgb
|
||||
* Add Svenning's adaptive content compression.
|
||||
*
|
||||
* Revision 1.27 2000/09/19 00:38:25 rgb
|
||||
* Fixed algorithm name bugs introduced for ipcomp.
|
||||
*
|
||||
* Revision 1.26 2000/09/17 21:36:48 rgb
|
||||
* Added proto2txt macro.
|
||||
*
|
||||
* Revision 1.25 2000/09/17 18:56:47 rgb
|
||||
* Added IPCOMP support.
|
||||
*
|
||||
* Revision 1.24 2000/09/12 19:34:12 rgb
|
||||
* Defined XF_IP6 from Gerhard for ipv6 tunnel support.
|
||||
*
|
||||
* Revision 1.23 2000/09/12 03:23:14 rgb
|
||||
* Cleaned out now unused tdb_xform and tdb_xdata members of struct tdb.
|
||||
*
|
||||
* Revision 1.22 2000/09/08 19:12:56 rgb
|
||||
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
|
||||
*
|
||||
* Revision 1.21 2000/09/01 18:32:43 rgb
|
||||
* Added (disabled) sensitivity members to tdb struct.
|
||||
*
|
||||
* Revision 1.20 2000/08/30 05:31:01 rgb
|
||||
* Removed all the rest of the references to tdb_spi, tdb_proto, tdb_dst.
|
||||
* Kill remainder of tdb_xform, tdb_xdata, xformsw.
|
||||
*
|
||||
* Revision 1.19 2000/08/01 14:51:52 rgb
|
||||
* Removed _all_ remaining traces of DES.
|
||||
*
|
||||
* Revision 1.18 2000/01/21 06:17:45 rgb
|
||||
* Tidied up spacing.
|
||||
*
|
||||
* Revision 1.17 1999/11/17 15:53:40 rgb
|
||||
* Changed all occurrences of #include "../../../lib/freeswan.h"
|
||||
* to #include <freeswan.h> which works due to -Ilibfreeswan in the
|
||||
* klips/net/ipsec/Makefile.
|
||||
*
|
||||
* Revision 1.16 1999/10/16 04:23:07 rgb
|
||||
* Add stats for replaywin_errs, replaywin_max_sequence_difference,
|
||||
* authentication errors, encryption size errors, encryption padding
|
||||
* errors, and time since last packet.
|
||||
*
|
||||
* Revision 1.15 1999/10/16 00:29:11 rgb
|
||||
* Added SA lifetime packet counting variables.
|
||||
*
|
||||
* Revision 1.14 1999/10/01 00:04:14 rgb
|
||||
* Added tdb structure locking.
|
||||
* Add function to initialize tdb hash table.
|
||||
*
|
||||
* Revision 1.13 1999/04/29 15:20:57 rgb
|
||||
* dd return values to init and cleanup functions.
|
||||
* Eliminate unnessessary usage of tdb_xform member to further switch
|
||||
* away from the transform switch to the algorithm switch.
|
||||
* Change gettdb parameter to a pointer to reduce stack loading and
|
||||
* facilitate parameter sanity checking.
|
||||
* Add a parameter to tdbcleanup to be able to delete a class of SAs.
|
||||
*
|
||||
* Revision 1.12 1999/04/15 15:37:25 rgb
|
||||
* Forward check changes from POST1_00 branch.
|
||||
*
|
||||
* Revision 1.9.2.2 1999/04/13 20:35:57 rgb
|
||||
* Fix spelling mistake in comment.
|
||||
*
|
||||
* Revision 1.9.2.1 1999/03/30 17:13:52 rgb
|
||||
* Extend struct tdb to support pfkey.
|
||||
*
|
||||
* Revision 1.11 1999/04/11 00:29:01 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.10 1999/04/06 04:54:28 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.9 1999/01/26 02:09:31 rgb
|
||||
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
|
||||
* Removed dead code.
|
||||
*
|
||||
* Revision 1.8 1999/01/22 06:29:35 rgb
|
||||
* Added algorithm switch code.
|
||||
* Cruft clean-out.
|
||||
*
|
||||
* Revision 1.7 1998/11/10 05:37:35 rgb
|
||||
* Add support for SA direction flag.
|
||||
*
|
||||
* Revision 1.6 1998/10/19 14:44:29 rgb
|
||||
* Added inclusion of freeswan.h.
|
||||
* sa_id structure implemented and used: now includes protocol.
|
||||
*
|
||||
* Revision 1.5 1998/08/12 00:12:30 rgb
|
||||
* Added macros for new xforms. Added prototypes for new xforms.
|
||||
*
|
||||
* Revision 1.4 1998/07/28 00:04:20 rgb
|
||||
* Add macro for clearing the SA table.
|
||||
*
|
||||
* Revision 1.3 1998/07/14 18:06:46 rgb
|
||||
* Added #ifdef __KERNEL__ directives to restrict scope of header.
|
||||
*
|
||||
* Revision 1.2 1998/06/23 03:02:19 rgb
|
||||
* Created a prototype for ipsec_tdbcleanup when it was moved from
|
||||
* ipsec_init.c.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:27:51 henry
|
||||
* move sources from klips/src to klips/net/ipsec, to keep stupid
|
||||
* kernel-build scripts happier in the presence of symlinks
|
||||
*
|
||||
* Revision 1.4 1998/06/11 05:55:31 rgb
|
||||
* Added transform version string pointer to xformsw structure definition.
|
||||
* Added extern declarations for transform version strings.
|
||||
*
|
||||
* Revision 1.3 1998/05/18 22:02:54 rgb
|
||||
* Modify the *_zeroize function prototypes to include one parameter.
|
||||
*
|
||||
* Revision 1.2 1998/04/21 21:29:08 rgb
|
||||
* Rearrange debug switches to change on the fly debug output from user
|
||||
* space. Only kernel changes checked in at this time. radij.c was also
|
||||
* changed to temporarily remove buggy debugging code in rj_delete causing
|
||||
* an OOPS and hence, netlink device open errors.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:14 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:06 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.5 1997/06/03 04:24:48 ji
|
||||
* Added ESP-3DES-MD5-96
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* Added new transforms.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:39:04 ji
|
||||
* Minor cleanups.
|
||||
* Rationalized debugging code.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
* Local variables:
|
||||
* c-file-style: "linux"
|
||||
* End:
|
||||
*
|
||||
*/
|
||||
@@ -0,0 +1,140 @@
|
||||
/*
|
||||
* IPSEC tunneling code
|
||||
* Copyright (C) 1996, 1997 John Ioannidis.
|
||||
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*
|
||||
* RCSID $Id: ipsec_xmit.h,v 1.3 2004/06/13 19:37:07 as Exp $
|
||||
*/
|
||||
|
||||
#include "freeswan/ipsec_sa.h"
|
||||
|
||||
enum ipsec_xmit_value
|
||||
{
|
||||
IPSEC_XMIT_STOLEN=2,
|
||||
IPSEC_XMIT_PASS=1,
|
||||
IPSEC_XMIT_OK=0,
|
||||
IPSEC_XMIT_ERRMEMALLOC=-1,
|
||||
IPSEC_XMIT_ESP_BADALG=-2,
|
||||
IPSEC_XMIT_BADPROTO=-3,
|
||||
IPSEC_XMIT_ESP_PUSHPULLERR=-4,
|
||||
IPSEC_XMIT_BADLEN=-5,
|
||||
IPSEC_XMIT_AH_BADALG=-6,
|
||||
IPSEC_XMIT_SAIDNOTFOUND=-7,
|
||||
IPSEC_XMIT_SAIDNOTLIVE=-8,
|
||||
IPSEC_XMIT_REPLAYROLLED=-9,
|
||||
IPSEC_XMIT_LIFETIMEFAILED=-10,
|
||||
IPSEC_XMIT_CANNOTFRAG=-11,
|
||||
IPSEC_XMIT_MSSERR=-12,
|
||||
IPSEC_XMIT_ERRSKBALLOC=-13,
|
||||
IPSEC_XMIT_ENCAPFAIL=-14,
|
||||
IPSEC_XMIT_NODEV=-15,
|
||||
IPSEC_XMIT_NOPRIVDEV=-16,
|
||||
IPSEC_XMIT_NOPHYSDEV=-17,
|
||||
IPSEC_XMIT_NOSKB=-18,
|
||||
IPSEC_XMIT_NOIPV6=-19,
|
||||
IPSEC_XMIT_NOIPOPTIONS=-20,
|
||||
IPSEC_XMIT_TTLEXPIRED=-21,
|
||||
IPSEC_XMIT_BADHHLEN=-22,
|
||||
IPSEC_XMIT_PUSHPULLERR=-23,
|
||||
IPSEC_XMIT_ROUTEERR=-24,
|
||||
IPSEC_XMIT_RECURSDETECT=-25,
|
||||
IPSEC_XMIT_IPSENDFAILURE=-26,
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
IPSEC_XMIT_ESPUDP=-27,
|
||||
#endif
|
||||
};
|
||||
|
||||
struct ipsec_xmit_state
|
||||
{
|
||||
struct sk_buff *skb; /* working skb pointer */
|
||||
struct device *dev; /* working dev pointer */
|
||||
struct ipsecpriv *prv; /* Our device' private space */
|
||||
struct sk_buff *oskb; /* Original skb pointer */
|
||||
struct net_device_stats *stats; /* This device's statistics */
|
||||
struct iphdr *iph; /* Our new IP header */
|
||||
__u32 newdst; /* The other SG's IP address */
|
||||
__u32 orgdst; /* Original IP destination address */
|
||||
__u32 orgedst; /* 1st SG's IP address */
|
||||
__u32 newsrc; /* The new source SG's IP address */
|
||||
__u32 orgsrc; /* Original IP source address */
|
||||
__u32 innersrc; /* Innermost IP source address */
|
||||
int iphlen; /* IP header length */
|
||||
int pyldsz; /* upper protocol payload size */
|
||||
int headroom;
|
||||
int tailroom;
|
||||
int max_headroom; /* The extra header space needed */
|
||||
int max_tailroom; /* The extra stuffing needed */
|
||||
int ll_headroom; /* The extra link layer hard_header space needed */
|
||||
int tot_headroom; /* The total header space needed */
|
||||
int tot_tailroom; /* The totalstuffing needed */
|
||||
__u8 *saved_header; /* saved copy of the hard header */
|
||||
unsigned short sport, dport;
|
||||
|
||||
struct sockaddr_encap matcher; /* eroute search key */
|
||||
struct eroute *eroute;
|
||||
struct ipsec_sa *ipsp, *ipsq; /* ipsec_sa pointers */
|
||||
char sa_txt[SATOA_BUF];
|
||||
size_t sa_len;
|
||||
int hard_header_stripped; /* has the hard header been removed yet? */
|
||||
int hard_header_len;
|
||||
struct device *physdev;
|
||||
/* struct device *virtdev; */
|
||||
short physmtu;
|
||||
short mtudiff;
|
||||
#ifdef NET_21
|
||||
struct rtable *route;
|
||||
#endif /* NET_21 */
|
||||
struct sa_id outgoing_said;
|
||||
#ifdef NET_21
|
||||
int pass;
|
||||
#endif /* NET_21 */
|
||||
int error;
|
||||
uint32_t eroute_pid;
|
||||
struct ipsec_sa ips;
|
||||
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
|
||||
uint8_t natt_type;
|
||||
uint8_t natt_head;
|
||||
uint16_t natt_sport;
|
||||
uint16_t natt_dport;
|
||||
#endif
|
||||
};
|
||||
|
||||
#if 0 /* save for alg refactorisation */
|
||||
struct xform_functions
|
||||
{
|
||||
enum ipsec_xmit_value (*checks)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb);
|
||||
enum ipsec_xmit_value (*encrypt)(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value (*setup_auth)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb,
|
||||
__u32 *replay,
|
||||
unsigned char **authenticator);
|
||||
enum ipsec_xmit_value (*calc_auth)(struct ipsec_xmit_state *ixs,
|
||||
struct sk_buff *skb);
|
||||
};
|
||||
#endif
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_sanity_check_dev(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_sanity_check_skb(struct ipsec_xmit_state *ixs);
|
||||
|
||||
enum ipsec_xmit_value
|
||||
ipsec_xmit_encap_bundle(struct ipsec_xmit_state *ixs);
|
||||
|
||||
extern int ipsec_xmit_trap_count;
|
||||
extern int ipsec_xmit_trap_sendcount;
|
||||
|
||||
extern void ipsec_extract_ports(struct iphdr * iph, struct sockaddr_encap * er);
|
||||
@@ -0,0 +1,280 @@
|
||||
/*
|
||||
* RCSID $Id: radij.h,v 1.1 2004/03/15 20:35:25 as Exp $
|
||||
*/
|
||||
|
||||
/*
|
||||
* This file is defived from ${SRC}/sys/net/radix.h of BSD 4.4lite
|
||||
*
|
||||
* Variable and procedure names have been modified so that they don't
|
||||
* conflict with the original BSD code, as a small number of modifications
|
||||
* have been introduced and we may want to reuse this code in BSD.
|
||||
*
|
||||
* The `j' in `radij' is pronounced as a voiceless guttural (like a Greek
|
||||
* chi or a German ch sound (as `doch', not as in `milch'), or even a
|
||||
* spanish j as in Juan. It is not as far back in the throat like
|
||||
* the corresponding Hebrew sound, nor is it a soft breath like the English h.
|
||||
* It has nothing to do with the Dutch ij sound.
|
||||
*
|
||||
* Here is the appropriate copyright notice:
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (c) 1988, 1989, 1993
|
||||
* The Regents of the University of California. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by the University of
|
||||
* California, Berkeley and its contributors.
|
||||
* 4. Neither the name of the University nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)radix.h 8.1 (Berkeley) 6/10/93
|
||||
*/
|
||||
|
||||
#ifndef _RADIJ_H_
|
||||
#define _RADIJ_H_
|
||||
|
||||
/*
|
||||
#define RJ_DEBUG
|
||||
*/
|
||||
|
||||
#ifdef __KERNEL__
|
||||
|
||||
#ifndef __P
|
||||
#ifdef __STDC__
|
||||
#define __P(x) x
|
||||
#else
|
||||
#define __P(x) ()
|
||||
#endif
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Radix search tree node layout.
|
||||
*/
|
||||
|
||||
struct radij_node
|
||||
{
|
||||
struct radij_mask *rj_mklist; /* list of masks contained in subtree */
|
||||
struct radij_node *rj_p; /* parent */
|
||||
short rj_b; /* bit offset; -1-index(netmask) */
|
||||
char rj_bmask; /* node: mask for bit test*/
|
||||
u_char rj_flags; /* enumerated next */
|
||||
#define RJF_NORMAL 1 /* leaf contains normal route */
|
||||
#define RJF_ROOT 2 /* leaf is root leaf for tree */
|
||||
#define RJF_ACTIVE 4 /* This node is alive (for rtfree) */
|
||||
union {
|
||||
struct { /* leaf only data: */
|
||||
caddr_t rj_Key; /* object of search */
|
||||
caddr_t rj_Mask; /* netmask, if present */
|
||||
struct radij_node *rj_Dupedkey;
|
||||
} rj_leaf;
|
||||
struct { /* node only data: */
|
||||
int rj_Off; /* where to start compare */
|
||||
struct radij_node *rj_L;/* progeny */
|
||||
struct radij_node *rj_R;/* progeny */
|
||||
}rj_node;
|
||||
} rj_u;
|
||||
#ifdef RJ_DEBUG
|
||||
int rj_info;
|
||||
struct radij_node *rj_twin;
|
||||
struct radij_node *rj_ybro;
|
||||
#endif
|
||||
};
|
||||
|
||||
#define rj_dupedkey rj_u.rj_leaf.rj_Dupedkey
|
||||
#define rj_key rj_u.rj_leaf.rj_Key
|
||||
#define rj_mask rj_u.rj_leaf.rj_Mask
|
||||
#define rj_off rj_u.rj_node.rj_Off
|
||||
#define rj_l rj_u.rj_node.rj_L
|
||||
#define rj_r rj_u.rj_node.rj_R
|
||||
|
||||
/*
|
||||
* Annotations to tree concerning potential routes applying to subtrees.
|
||||
*/
|
||||
|
||||
extern struct radij_mask {
|
||||
short rm_b; /* bit offset; -1-index(netmask) */
|
||||
char rm_unused; /* cf. rj_bmask */
|
||||
u_char rm_flags; /* cf. rj_flags */
|
||||
struct radij_mask *rm_mklist; /* more masks to try */
|
||||
caddr_t rm_mask; /* the mask */
|
||||
int rm_refs; /* # of references to this struct */
|
||||
} *rj_mkfreelist;
|
||||
|
||||
#define MKGet(m) {\
|
||||
if (rj_mkfreelist) {\
|
||||
m = rj_mkfreelist; \
|
||||
rj_mkfreelist = (m)->rm_mklist; \
|
||||
} else \
|
||||
R_Malloc(m, struct radij_mask *, sizeof (*(m))); }\
|
||||
|
||||
#define MKFree(m) { (m)->rm_mklist = rj_mkfreelist; rj_mkfreelist = (m);}
|
||||
|
||||
struct radij_node_head {
|
||||
struct radij_node *rnh_treetop;
|
||||
int rnh_addrsize; /* permit, but not require fixed keys */
|
||||
int rnh_pktsize; /* permit, but not require fixed keys */
|
||||
#if 0
|
||||
struct radij_node *(*rnh_addaddr) /* add based on sockaddr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
#endif
|
||||
int (*rnh_addaddr) /* add based on sockaddr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
struct radij_node *(*rnh_addpkt) /* add based on packet hdr */
|
||||
__P((void *v, void *mask,
|
||||
struct radij_node_head *head, struct radij_node nodes[]));
|
||||
#if 0
|
||||
struct radij_node *(*rnh_deladdr) /* remove based on sockaddr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head));
|
||||
#endif
|
||||
int (*rnh_deladdr) /* remove based on sockaddr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head, struct radij_node **node));
|
||||
struct radij_node *(*rnh_delpkt) /* remove based on packet hdr */
|
||||
__P((void *v, void *mask, struct radij_node_head *head));
|
||||
struct radij_node *(*rnh_matchaddr) /* locate based on sockaddr */
|
||||
__P((void *v, struct radij_node_head *head));
|
||||
struct radij_node *(*rnh_matchpkt) /* locate based on packet hdr */
|
||||
__P((void *v, struct radij_node_head *head));
|
||||
int (*rnh_walktree) /* traverse tree */
|
||||
__P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
|
||||
struct radij_node rnh_nodes[3]; /* empty tree for common case */
|
||||
};
|
||||
|
||||
|
||||
#define Bcmp(a, b, n) memcmp(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
|
||||
#define Bcopy(a, b, n) memmove(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
|
||||
#define Bzero(p, n) memset((caddr_t)(p), 0, (unsigned)(n))
|
||||
#define R_Malloc(p, t, n) ((p = (t) kmalloc((size_t)(n), GFP_ATOMIC)), Bzero((p),(n)))
|
||||
#define Free(p) kfree((caddr_t)p);
|
||||
|
||||
void rj_init __P((void));
|
||||
int rj_inithead __P((void **, int));
|
||||
int rj_refines __P((void *, void *));
|
||||
int rj_walktree __P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
|
||||
struct radij_node
|
||||
*rj_addmask __P((void *, int, int)) /* , rgb */ ;
|
||||
int /* * */ rj_addroute __P((void *, void *, struct radij_node_head *,
|
||||
struct radij_node [2])) /* , rgb */ ;
|
||||
int /* * */ rj_delete __P((void *, void *, struct radij_node_head *, struct radij_node **)) /* , rgb */ ;
|
||||
struct radij_node /* rgb */
|
||||
*rj_insert __P((void *, struct radij_node_head *, int *,
|
||||
struct radij_node [2])),
|
||||
*rj_match __P((void *, struct radij_node_head *)),
|
||||
*rj_newpair __P((void *, int, struct radij_node[2])),
|
||||
*rj_search __P((void *, struct radij_node *)),
|
||||
*rj_search_m __P((void *, struct radij_node *, void *));
|
||||
|
||||
void rj_deltree(struct radij_node_head *);
|
||||
void rj_delnodes(struct radij_node *);
|
||||
void rj_free_mkfreelist(void);
|
||||
int radijcleartree(void);
|
||||
int radijcleanup(void);
|
||||
|
||||
extern struct radij_node_head *mask_rjhead;
|
||||
extern int maj_keylen;
|
||||
#endif /* __KERNEL__ */
|
||||
|
||||
#endif /* _RADIJ_H_ */
|
||||
|
||||
|
||||
/*
|
||||
* $Log: radij.h,v $
|
||||
* Revision 1.1 2004/03/15 20:35:25 as
|
||||
* added files from freeswan-2.04-x509-1.5.3
|
||||
*
|
||||
* Revision 1.12 2002/04/24 07:36:48 mcr
|
||||
* Moved from ./klips/net/ipsec/radij.h,v
|
||||
*
|
||||
* Revision 1.11 2001/09/20 15:33:00 rgb
|
||||
* Min/max cleanup.
|
||||
*
|
||||
* Revision 1.10 1999/11/18 04:09:20 rgb
|
||||
* Replaced all kernel version macros to shorter, readable form.
|
||||
*
|
||||
* Revision 1.9 1999/05/05 22:02:33 rgb
|
||||
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
|
||||
*
|
||||
* Revision 1.8 1999/04/29 15:24:58 rgb
|
||||
* Add check for existence of macros min/max.
|
||||
*
|
||||
* Revision 1.7 1999/04/11 00:29:02 henry
|
||||
* GPL boilerplate
|
||||
*
|
||||
* Revision 1.6 1999/04/06 04:54:29 rgb
|
||||
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
* patch shell fixes.
|
||||
*
|
||||
* Revision 1.5 1999/01/22 06:30:32 rgb
|
||||
* 64-bit clean-up.
|
||||
*
|
||||
* Revision 1.4 1998/11/30 13:22:55 rgb
|
||||
* Rationalised all the klips kernel file headers. They are much shorter
|
||||
* now and won't conflict under RH5.2.
|
||||
*
|
||||
* Revision 1.3 1998/10/25 02:43:27 rgb
|
||||
* Change return type on rj_addroute and rj_delete and add and argument
|
||||
* to the latter to be able to transmit more infomation about errors.
|
||||
*
|
||||
* Revision 1.2 1998/07/14 18:09:51 rgb
|
||||
* Add a routine to clear eroute table.
|
||||
* Added #ifdef __KERNEL__ directives to restrict scope of header.
|
||||
*
|
||||
* Revision 1.1 1998/06/18 21:30:22 henry
|
||||
* move sources from klips/src to klips/net/ipsec to keep stupid kernel
|
||||
* build scripts happier about symlinks
|
||||
*
|
||||
* Revision 1.4 1998/05/25 20:34:16 rgb
|
||||
* Remove temporary ipsec_walk, rj_deltree and rj_delnodes functions.
|
||||
*
|
||||
* Rename ipsec_rj_walker (ipsec_walk) to ipsec_rj_walker_procprint and
|
||||
* add ipsec_rj_walker_delete.
|
||||
*
|
||||
* Recover memory for eroute table on unload of module.
|
||||
*
|
||||
* Revision 1.3 1998/04/22 16:51:37 rgb
|
||||
* Tidy up radij debug code from recent rash of modifications to debug code.
|
||||
*
|
||||
* Revision 1.2 1998/04/14 17:30:38 rgb
|
||||
* Fix up compiling errors for radij tree memory reclamation.
|
||||
*
|
||||
* Revision 1.1 1998/04/09 03:06:16 henry
|
||||
* sources moved up from linux/net/ipsec
|
||||
*
|
||||
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
|
||||
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
|
||||
*
|
||||
* Revision 0.4 1997/01/15 01:28:15 ji
|
||||
* No changes.
|
||||
*
|
||||
* Revision 0.3 1996/11/20 14:44:45 ji
|
||||
* Release update only.
|
||||
*
|
||||
* Revision 0.2 1996/11/02 00:18:33 ji
|
||||
* First limited release.
|
||||
*
|
||||
*
|
||||
*/
|
||||
Reference in New Issue
Block a user