denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- import of strongswan-2.7.0

Browse Source 
- applied patch for charon
This commit is contained in:
Martin Willi
2006-04-28 07:14:48 +00:00
parent 52923c9acb
commit 997358a6c4
2043 changed files with 346842 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linux/include/crypto/des.h
+308
View File
@@ -0,0 +1,308 @@
/* crypto/des/des.org */
/* Copyright (C) 1995-1997 Eric Young ([email protected])
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young ([email protected]).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson ([email protected]).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young ([email protected])"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson ([email protected])"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*
* Always modify des.org since des.h is automatically generated from
* it during SSLeay configuration.
*
* WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
*/
#ifndef HEADER_DES_H
#define HEADER_DES_H
#ifdef __cplusplus
extern "C" {
#endif
/* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
* %20 speed up (longs are 8 bytes, int's are 4). */
/* Must be unsigned int on ia64/Itanium or DES breaks badly */
#ifdef __KERNEL__
#include <linux/types.h>
#else
#include <sys/types.h>
#endif
#ifndef DES_LONG
#define DES_LONG u_int32_t
#endif
typedef unsigned char des_cblock[8];
typedef struct des_ks_struct
{
union {
des_cblock _;
/* make sure things are correct size on machines with
* 8 byte longs */
DES_LONG pad[2];
} ks;
#undef _
#define _ ks._
} des_key_schedule[16];
#define DES_KEY_SZ (sizeof(des_cblock))
#define DES_SCHEDULE_SZ (sizeof(des_key_schedule))
#define DES_ENCRYPT 1
#define DES_DECRYPT 0
#define DES_CBC_MODE 0
#define DES_PCBC_MODE 1
#define des_ecb2_encrypt(i,o,k1,k2,e) \
des_ecb3_encrypt((i),(o),(k1),(k2),(k1),(e))
#define des_ede2_cbc_encrypt(i,o,l,k1,k2,iv,e) \
des_ede3_cbc_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(e))
#define des_ede2_cfb64_encrypt(i,o,l,k1,k2,iv,n,e) \
des_ede3_cfb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n),(e))
#define des_ede2_ofb64_encrypt(i,o,l,k1,k2,iv,n) \
des_ede3_ofb64_encrypt((i),(o),(l),(k1),(k2),(k1),(iv),(n))
#define C_Block des_cblock
#define Key_schedule des_key_schedule
#ifdef KERBEROS
#define ENCRYPT DES_ENCRYPT
#define DECRYPT DES_DECRYPT
#endif
#define KEY_SZ DES_KEY_SZ
#define string_to_key des_string_to_key
#define read_pw_string des_read_pw_string
#define random_key des_random_key
#define pcbc_encrypt des_pcbc_encrypt
#define set_key des_set_key
#define key_sched des_key_sched
#define ecb_encrypt des_ecb_encrypt
#define cbc_encrypt des_cbc_encrypt
#define ncbc_encrypt des_ncbc_encrypt
#define xcbc_encrypt des_xcbc_encrypt
#define cbc_cksum des_cbc_cksum
#define quad_cksum des_quad_cksum
/* For compatibility with the MIT lib - eay 20/05/92 */
typedef des_key_schedule bit_64;
#define des_fixup_key_parity des_set_odd_parity
#define des_check_key_parity check_parity
extern int des_check_key; /* defaults to false */
extern int des_rw_mode; /* defaults to DES_PCBC_MODE */
/* The next line is used to disable full ANSI prototypes, if your
* compiler has problems with the prototypes, make sure this line always
* evaluates to true :-) */
#if defined(MSDOS) || defined(__STDC__)
#undef NOPROTO
#endif
#ifndef NOPROTO
char *des_options(void);
void des_ecb3_encrypt(des_cblock *input,des_cblock *output,
des_key_schedule ks1,des_key_schedule ks2,
des_key_schedule ks3, int enc);
DES_LONG des_cbc_cksum(des_cblock *input,des_cblock *output,
long length,des_key_schedule schedule,des_cblock *ivec);
void des_cbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
void des_ncbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
void des_xcbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,
des_cblock *inw,des_cblock *outw,int enc);
void des_cfb_encrypt(unsigned char *in,unsigned char *out,int numbits,
long length,des_key_schedule schedule,des_cblock *ivec,int enc);
void des_ecb_encrypt(des_cblock *input,des_cblock *output,
des_key_schedule ks,int enc);
void des_encrypt(DES_LONG *data,des_key_schedule ks, int enc);
void des_encrypt2(DES_LONG *data,des_key_schedule ks, int enc);
void des_encrypt3(DES_LONG *data, des_key_schedule ks1,
des_key_schedule ks2, des_key_schedule ks3);
void des_decrypt3(DES_LONG *data, des_key_schedule ks1,
des_key_schedule ks2, des_key_schedule ks3);
void des_ede3_cbc_encrypt(des_cblock *input, des_cblock *output,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int enc);
void des_ede3_cfb64_encrypt(unsigned char *in, unsigned char *out,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int *num, int enc);
void des_ede3_ofb64_encrypt(unsigned char *in, unsigned char *out,
long length, des_key_schedule ks1, des_key_schedule ks2,
des_key_schedule ks3, des_cblock *ivec, int *num);
void des_xwhite_in2out(des_cblock (*des_key), des_cblock (*in_white),
des_cblock (*out_white));
int des_enc_read(int fd,char *buf,int len,des_key_schedule sched,
des_cblock *iv);
int des_enc_write(int fd,char *buf,int len,des_key_schedule sched,
des_cblock *iv);
char *des_fcrypt(const char *buf,const char *salt, char *ret);
#ifdef PERL5
char *des_crypt(const char *buf,const char *salt);
#else
/* some stupid compilers complain because I have declared char instead
* of const char */
#ifndef __KERNEL__
#ifdef HEADER_DES_LOCL_H
char *crypt(const char *buf,const char *salt);
#else /* HEADER_DES_LOCL_H */
char *crypt(void);
#endif /* HEADER_DES_LOCL_H */
#endif /* __KERNEL__ */
#endif /* PERL5 */
void des_ofb_encrypt(unsigned char *in,unsigned char *out,
int numbits,long length,des_key_schedule schedule,des_cblock *ivec);
void des_pcbc_encrypt(des_cblock *input,des_cblock *output,long length,
des_key_schedule schedule,des_cblock *ivec,int enc);
DES_LONG des_quad_cksum(des_cblock *input,des_cblock *output,
long length,int out_count,des_cblock *seed);
void des_random_seed(des_cblock key);
void des_random_key(des_cblock ret);
int des_read_password(des_cblock *key,char *prompt,int verify);
int des_read_2passwords(des_cblock *key1,des_cblock *key2,
char *prompt,int verify);
int des_read_pw_string(char *buf,int length,char *prompt,int verify);
void des_set_odd_parity(des_cblock *key);
int des_is_weak_key(des_cblock *key);
int des_set_key(des_cblock *key,des_key_schedule schedule);
int des_key_sched(des_cblock *key,des_key_schedule schedule);
void des_string_to_key(char *str,des_cblock *key);
void des_string_to_2keys(char *str,des_cblock *key1,des_cblock *key2);
void des_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
des_key_schedule schedule, des_cblock *ivec, int *num, int enc);
void des_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
des_key_schedule schedule, des_cblock *ivec, int *num);
int des_read_pw(char *buf, char *buff, int size, char *prompt, int verify);
/* Extra functions from Mark Murray <[email protected]> */
/* The following functions are not in the normal unix build or the
* SSLeay build. When using the SSLeay build, use RAND_seed()
* and RAND_bytes() instead. */
int des_new_random_key(des_cblock *key);
void des_init_random_number_generator(des_cblock *key);
void des_set_random_generator_seed(des_cblock *key);
void des_set_sequence_number(des_cblock new_sequence_number);
void des_generate_random_block(des_cblock *block);
#else
char *des_options();
void des_ecb3_encrypt();
DES_LONG des_cbc_cksum();
void des_cbc_encrypt();
void des_ncbc_encrypt();
void des_xcbc_encrypt();
void des_cfb_encrypt();
void des_ede3_cfb64_encrypt();
void des_ede3_ofb64_encrypt();
void des_ecb_encrypt();
void des_encrypt();
void des_encrypt2();
void des_encrypt3();
void des_decrypt3();
void des_ede3_cbc_encrypt();
int des_enc_read();
int des_enc_write();
char *des_fcrypt();
#ifdef PERL5
char *des_crypt();
#else
char *crypt();
#endif
void des_ofb_encrypt();
void des_pcbc_encrypt();
DES_LONG des_quad_cksum();
void des_random_seed();
void des_random_key();
int des_read_password();
int des_read_2passwords();
int des_read_pw_string();
void des_set_odd_parity();
int des_is_weak_key();
int des_set_key();
int des_key_sched();
void des_string_to_key();
void des_string_to_2keys();
void des_cfb64_encrypt();
void des_ofb64_encrypt();
int des_read_pw();
void des_xwhite_in2out();
/* Extra functions from Mark Murray <[email protected]> */
/* The following functions are not in the normal unix build or the
* SSLeay build. When using the SSLeay build, use RAND_seed()
* and RAND_bytes() instead. */
#ifdef FreeBSD
int des_new_random_key();
void des_init_random_number_generator();
void des_set_random_generator_seed();
void des_set_sequence_number();
void des_generate_random_block();
#endif
#endif
#ifdef __cplusplus
}
#endif
#endif
linux/include/freeswan.h
+477
View File
@@ -0,0 +1,477 @@
#ifndef _FREESWAN_H
/*
* header file for FreeS/WAN library functions
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: freeswan.h,v 1.2 2004/03/22 21:53:17 as Exp $
*/
#define _FREESWAN_H /* seen it, no need to see it again */
/*
* We've just got to have some datatypes defined... And annoyingly, just
* where we get them depends on whether we're in userland or not.
*/
#ifdef __KERNEL__
# include <linux/types.h>
# include <linux/in.h>
#else /* __KERNEL__ */
# include <stdio.h>
# include <netinet/in.h>
# define uint8_t u_int8_t
# define uint16_t u_int16_t
# define uint32_t u_int32_t
# define uint64_t u_int64_t
# define DEBUG_NO_STATIC static
#endif /* __KERNEL__ */
#include <freeswan/ipsec_param.h>
/*
* Grab the kernel version to see if we have NET_21, and therefore
* IPv6. Some of this is repeated from ipsec_kversions.h. Of course,
* we aren't really testing if the kernel has IPv6, but rather if the
* the include files do.
*/
#include <linux/version.h>
#ifndef KERNEL_VERSION
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
#define NET_21
#endif
#ifndef IPPROTO_COMP
# define IPPROTO_COMP 108
#endif /* !IPPROTO_COMP */
#ifndef IPPROTO_INT
# define IPPROTO_INT 61
#endif /* !IPPROTO_INT */
#ifdef CONFIG_IPSEC_DEBUG
# define DEBUG_NO_STATIC
#else /* CONFIG_IPSEC_DEBUG */
# define DEBUG_NO_STATIC static
#endif /* CONFIG_IPSEC_DEBUG */
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL /* KERNEL ifdef */
#ifndef NAT_TRAVERSAL
#define NAT_TRAVERSAL
#endif
#endif
#ifdef NAT_TRAVERSAL
#define ESPINUDP_WITH_NON_IKE 1 /* draft-ietf-ipsec-nat-t-ike-00/01 */
#define ESPINUDP_WITH_NON_ESP 2 /* draft-ietf-ipsec-nat-t-ike-02 */
#endif
/*
* Basic data types for the address-handling functions.
* ip_address and ip_subnet are supposed to be opaque types; do not
* use their definitions directly, they are subject to change!
*/
/* first, some quick fakes in case we're on an old system with no IPv6 */
#ifndef s6_addr16
struct in6_addr {
union
{
__u8 u6_addr8[16];
__u16 u6_addr16[8];
__u32 u6_addr32[4];
} in6_u;
#define s6_addr in6_u.u6_addr8
#define s6_addr16 in6_u.u6_addr16
#define s6_addr32 in6_u.u6_addr32
};
struct sockaddr_in6 {
unsigned short int sin6_family; /* AF_INET6 */
__u16 sin6_port; /* Transport layer port # */
__u32 sin6_flowinfo; /* IPv6 flow information */
struct in6_addr sin6_addr; /* IPv6 address */
__u32 sin6_scope_id; /* scope id (new in RFC2553) */
};
#endif /* !s6_addr16 */
/* then the main types */
typedef struct {
union {
struct sockaddr_in v4;
struct sockaddr_in6 v6;
} u;
} ip_address;
typedef struct {
ip_address addr;
int maskbits;
} ip_subnet;
/* and the SA ID stuff */
#ifdef __KERNEL__
typedef __u32 ipsec_spi_t;
#else
typedef u_int32_t ipsec_spi_t;
#endif
typedef struct { /* to identify an SA, we need: */
ip_address dst; /* A. destination host */
ipsec_spi_t spi; /* B. 32-bit SPI, assigned by dest. host */
# define SPI_PASS 256 /* magic values... */
# define SPI_DROP 257 /* ...for use... */
# define SPI_REJECT 258 /* ...with SA_INT */
# define SPI_HOLD 259
# define SPI_TRAP 260
# define SPI_TRAPSUBNET 261
int proto; /* C. protocol */
# define SA_ESP 50 /* IPPROTO_ESP */
# define SA_AH 51 /* IPPROTO_AH */
# define SA_IPIP 4 /* IPPROTO_IPIP */
# define SA_COMP 108 /* IPPROTO_COMP */
# define SA_INT 61 /* IANA reserved for internal use */
} ip_said;
struct sa_id { /* old v4-only version */
struct in_addr dst;
ipsec_spi_t spi;
int proto;
};
/* misc */
typedef const char *err_t; /* error message, or NULL for success */
struct prng { /* pseudo-random-number-generator guts */
unsigned char sbox[256];
int i, j;
unsigned long count;
};
/*
* definitions for user space, taken from freeswan/ipsec_sa.h
*/
typedef uint32_t IPsecSAref_t;
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
#define IPsecSAref2NFmark(x) ((x) << (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define NFmark2IPsecSAref(x) ((x) >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define IPSEC_SAREF_NULL (~((IPsecSAref_t)0))
/* GCC magic for use in function definitions! */
#ifdef GCC_LINT
# define PRINTF_LIKE(n) __attribute__ ((format(printf, n, n+1)))
# define NEVER_RETURNS __attribute__ ((noreturn))
# define UNUSED __attribute__ ((unused))
# define BLANK_FORMAT " " /* GCC_LINT whines about empty formats */
#else
# define PRINTF_LIKE(n) /* ignore */
# define NEVER_RETURNS /* ignore */
# define UNUSED /* ignore */
# define BLANK_FORMAT ""
#endif
/*
* new IPv6-compatible functions
*/
/* text conversions */
err_t ttoul(const char *src, size_t srclen, int format, unsigned long *dst);
size_t ultot(unsigned long src, int format, char *buf, size_t buflen);
#define ULTOT_BUF (22+1) /* holds 64 bits in octal */
err_t ttoaddr(const char *src, size_t srclen, int af, ip_address *dst);
err_t tnatoaddr(const char *src, size_t srclen, int af, ip_address *dst);
size_t addrtot(const ip_address *src, int format, char *buf, size_t buflen);
/* RFC 1886 old IPv6 reverse-lookup format is the bulkiest */
#define ADDRTOT_BUF (32*2 + 3 + 1 + 3 + 1 + 1)
err_t ttosubnet(const char *src, size_t srclen, int af, ip_subnet *dst);
size_t subnettot(const ip_subnet *src, int format, char *buf, size_t buflen);
#define SUBNETTOT_BUF (ADDRTOT_BUF + 1 + 3)
err_t ttosa(const char *src, size_t srclen, ip_said *dst);
size_t satot(const ip_said *src, int format, char *bufptr, size_t buflen);
#define SATOT_BUF (5 + ULTOA_BUF + 1 + ADDRTOT_BUF)
err_t ttodata(const char *src, size_t srclen, int base, char *buf,
size_t buflen, size_t *needed);
err_t ttodatav(const char *src, size_t srclen, int base,
char *buf, size_t buflen, size_t *needed,
char *errp, size_t errlen, unsigned int flags);
#define TTODATAV_BUF 40 /* ttodatav's largest non-literal message */
#define TTODATAV_IGNORESPACE (1<<1) /* ignore spaces in base64 encodings*/
#define TTODATAV_SPACECOUNTS 0 /* do not ignore spaces in base64 */
size_t datatot(const char *src, size_t srclen, int format, char *buf,
size_t buflen);
size_t keyblobtoid(const unsigned char *src, size_t srclen, char *dst,
size_t dstlen);
size_t splitkeytoid(const unsigned char *e, size_t elen, const unsigned char *m,
size_t mlen, char *dst, size_t dstlen);
#define KEYID_BUF 10 /* up to 9 text digits plus NUL */
err_t ttoprotoport(char *src, size_t src_len, u_int8_t *proto, u_int16_t *port,
int *has_port_wildcard);
/* initializations */
void initsaid(const ip_address *addr, ipsec_spi_t spi, int proto, ip_said *dst);
err_t loopbackaddr(int af, ip_address *dst);
err_t unspecaddr(int af, ip_address *dst);
err_t anyaddr(int af, ip_address *dst);
err_t initaddr(const unsigned char *src, size_t srclen, int af, ip_address *dst);
err_t initsubnet(const ip_address *addr, int maskbits, int clash, ip_subnet *dst);
err_t addrtosubnet(const ip_address *addr, ip_subnet *dst);
/* misc. conversions and related */
err_t rangetosubnet(const ip_address *from, const ip_address *to, ip_subnet *dst);
int addrtypeof(const ip_address *src);
int subnettypeof(const ip_subnet *src);
size_t addrlenof(const ip_address *src);
size_t addrbytesptr(const ip_address *src, const unsigned char **dst);
size_t addrbytesof(const ip_address *src, unsigned char *dst, size_t dstlen);
int masktocount(const ip_address *src);
void networkof(const ip_subnet *src, ip_address *dst);
void maskof(const ip_subnet *src, ip_address *dst);
/* tests */
int sameaddr(const ip_address *a, const ip_address *b);
int addrcmp(const ip_address *a, const ip_address *b);
int samesubnet(const ip_subnet *a, const ip_subnet *b);
int addrinsubnet(const ip_address *a, const ip_subnet *s);
int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);
int subnetishost(const ip_subnet *s);
int samesaid(const ip_said *a, const ip_said *b);
int sameaddrtype(const ip_address *a, const ip_address *b);
int samesubnettype(const ip_subnet *a, const ip_subnet *b);
int isanyaddr(const ip_address *src);
int isunspecaddr(const ip_address *src);
int isloopbackaddr(const ip_address *src);
/* low-level grot */
int portof(const ip_address *src);
void setportof(int port, ip_address *dst);
struct sockaddr *sockaddrof(ip_address *src);
size_t sockaddrlenof(const ip_address *src);
/* PRNG */
void prng_init(struct prng *prng, const unsigned char *key, size_t keylen);
void prng_bytes(struct prng *prng, unsigned char *dst, size_t dstlen);
unsigned long prng_count(struct prng *prng);
void prng_final(struct prng *prng);
/* odds and ends */
const char *ipsec_version_code(void);
const char *ipsec_version_string(void);
const char **ipsec_copyright_notice(void);
const char *dns_string_rr(int rr, char *buf, int bufsize);
const char *dns_string_datetime(time_t seconds,
char *buf,
int bufsize);
/*
* old functions, to be deleted eventually
*/
/* unsigned long */
const char * /* NULL for success, else string literal */
atoul(
const char *src,
size_t srclen, /* 0 means strlen(src) */
int base, /* 0 means figure it out */
unsigned long *resultp
);
size_t /* space needed for full conversion */
ultoa(
unsigned long n,
int base,
char *dst,
size_t dstlen
);
#define ULTOA_BUF 21 /* just large enough for largest result, */
/* assuming 64-bit unsigned long! */
/* Internet addresses */
const char * /* NULL for success, else string literal */
atoaddr(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct in_addr *addr
);
size_t /* space needed for full conversion */
addrtoa(
struct in_addr addr,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define ADDRTOA_BUF 16 /* just large enough for largest result */
/* subnets */
const char * /* NULL for success, else string literal */
atosubnet(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct in_addr *addr,
struct in_addr *mask
);
size_t /* space needed for full conversion */
subnettoa(
struct in_addr addr,
struct in_addr mask,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define SUBNETTOA_BUF 32 /* large enough for worst case result */
/* ranges */
const char * /* NULL for success, else string literal */
atoasr(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *type, /* 'a', 's', 'r' */
struct in_addr *addrs /* two-element array */
);
size_t /* space needed for full conversion */
rangetoa(
struct in_addr *addrs, /* two-element array */
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define RANGETOA_BUF 34 /* large enough for worst case result */
/* data types for SA conversion functions */
/* SAs */
const char * /* NULL for success, else string literal */
atosa(
const char *src,
size_t srclen, /* 0 means strlen(src) */
struct sa_id *sa
);
size_t /* space needed for full conversion */
satoa(
struct sa_id sa,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
#define SATOA_BUF (3+ULTOA_BUF+ADDRTOA_BUF)
/* generic data, e.g. keys */
const char * /* NULL for success, else string literal */
atobytes(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *dst,
size_t dstlen,
size_t *lenp /* NULL means don't bother telling me */
);
size_t /* 0 failure, else true size */
bytestoa(
const char *src,
size_t srclen,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
/* old versions of generic-data functions; deprecated */
size_t /* 0 failure, else true size */
atodata(
const char *src,
size_t srclen, /* 0 means strlen(src) */
char *dst,
size_t dstlen
);
size_t /* 0 failure, else true size */
datatoa(
const char *src,
size_t srclen,
int format, /* character; 0 means default */
char *dst,
size_t dstlen
);
/* part extraction and special addresses */
struct in_addr
subnetof(
struct in_addr addr,
struct in_addr mask
);
struct in_addr
hostof(
struct in_addr addr,
struct in_addr mask
);
struct in_addr
broadcastof(
struct in_addr addr,
struct in_addr mask
);
/* mask handling */
int
goodmask(
struct in_addr mask
);
int
masktobits(
struct in_addr mask
);
struct in_addr
bitstomask(
int n
);
/*
* general utilities
*/
#ifndef __KERNEL__
/* option pickup from files (userland only because of use of FILE) */
const char *optionsfrom(const char *filename, int *argcp, char ***argvp,
int optind, FILE *errorreport);
#endif
/*
* Debugging levels for pfkey_lib_debug
*/
#define PF_KEY_DEBUG_PARSE_NONE 0
#define PF_KEY_DEBUG_PARSE_PROBLEM 1
#define PF_KEY_DEBUG_PARSE_STRUCT 2
#define PF_KEY_DEBUG_PARSE_FLOW 4
#define PF_KEY_DEBUG_PARSE_MAX 7
extern unsigned int pfkey_lib_debug; /* bits selecting what to report */
/*
* pluto and lwdnsq need to know the maximum size of the commands to,
* and replies from lwdnsq.
*/
#define LWDNSQ_CMDBUF_LEN 1024
#define LWDNSQ_RESULT_LEN_MAX 4096
#endif /* _FREESWAN_H */
linux/include/freeswan/ipcomp.h
+61
View File
@@ -0,0 +1,61 @@
/*
* IPCOMP zlib interface code.
* Copyright (C) 2000 Svenning Soerensen <[email protected]>
* Copyright (C) 2000, 2001 Richard Guy Briggs <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
RCSID $Id: ipcomp.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/* SSS */
#ifndef _IPCOMP_H
#define _IPCOMP_H
/* Prefix all global deflate symbols with "ipcomp_" to avoid collisions with ppp_deflate & ext2comp */
#ifndef IPCOMP_PREFIX
#define IPCOMP_PREFIX
#endif /* IPCOMP_PREFIX */
#ifndef IPPROTO_COMP
#define IPPROTO_COMP 108
#endif /* IPPROTO_COMP */
#ifdef CONFIG_IPSEC_DEBUG
extern int sysctl_ipsec_debug_ipcomp;
#endif /* CONFIG_IPSEC_DEBUG */
struct ipcomphdr { /* IPCOMP header */
__u8 ipcomp_nh; /* Next header (protocol) */
__u8 ipcomp_flags; /* Reserved, must be 0 */
__u16 ipcomp_cpi; /* Compression Parameter Index */
};
extern struct inet_protocol comp_protocol;
extern int sysctl_ipsec_debug_ipcomp;
#define IPCOMP_UNCOMPRESSABLE 0x000000001
#define IPCOMP_COMPRESSIONERROR 0x000000002
#define IPCOMP_PARMERROR 0x000000004
#define IPCOMP_DECOMPRESSIONERROR 0x000000008
#define IPCOMP_ADAPT_INITIAL_TRIES 8
#define IPCOMP_ADAPT_INITIAL_SKIP 4
#define IPCOMP_ADAPT_SUBSEQ_TRIES 2
#define IPCOMP_ADAPT_SUBSEQ_SKIP 8
/* Function prototypes */
struct sk_buff *skb_compress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
struct sk_buff *skb_decompress(struct sk_buff *skb, struct ipsec_sa *ips, unsigned int *flags);
#endif /* _IPCOMP_H */
linux/include/freeswan/ipsec_ah.h
+235
View File
@@ -0,0 +1,235 @@
/*
* Authentication Header declarations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_ah.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#include "ipsec_md5h.h"
#include "ipsec_sha1.h"
#ifndef IPPROTO_AH
#define IPPROTO_AH 51
#endif /* IPPROTO_AH */
#define AH_FLENGTH 12 /* size of fixed part */
#define AHMD5_KMAX 64 /* MD5 max 512 bits key */
#define AHMD5_AMAX 12 /* MD5 96 bits of authenticator */
#define AHMD596_KLEN 16 /* MD5 128 bits key */
#define AHSHA196_KLEN 20 /* SHA1 160 bits key */
#define AHMD596_ALEN 16 /* MD5 128 bits authentication length */
#define AHSHA196_ALEN 20 /* SHA1 160 bits authentication length */
#define AHMD596_BLKLEN 64 /* MD5 block length */
#define AHSHA196_BLKLEN 64 /* SHA1 block length */
#define AHSHA2_256_BLKLEN 64 /* SHA2-256 block length */
#define AHSHA2_384_BLKLEN 128 /* SHA2-384 block length (?) */
#define AHSHA2_512_BLKLEN 128 /* SHA2-512 block length */
#define AH_BLKLEN_MAX 128 /* keep up to date! */
#define AH_AMAX AHSHA196_ALEN /* keep up to date! */
#define AHHMAC_HASHLEN 12 /* authenticator length of 96bits */
#define AHHMAC_RPLLEN 4 /* 32 bit replay counter */
#define DB_AH_PKTRX 0x0001
#define DB_AH_PKTRX2 0x0002
#define DB_AH_DMP 0x0004
#define DB_AH_IPSA 0x0010
#define DB_AH_XF 0x0020
#define DB_AH_INAU 0x0040
#define DB_AH_REPLAY 0x0100
#ifdef __KERNEL__
/* General HMAC algorithm is described in RFC 2104 */
#define HMAC_IPAD 0x36
#define HMAC_OPAD 0x5C
struct md5_ctx {
MD5_CTX ictx; /* context after H(K XOR ipad) */
MD5_CTX octx; /* context after H(K XOR opad) */
};
struct sha1_ctx {
SHA1_CTX ictx; /* context after H(K XOR ipad) */
SHA1_CTX octx; /* context after H(K XOR opad) */
};
struct auth_alg {
void (*init)(void *ctx);
void (*update)(void *ctx, unsigned char *bytes, __u32 len);
void (*final)(unsigned char *hash, void *ctx);
int hashlen;
};
extern struct inet_protocol ah_protocol;
struct options;
extern int
ah_rcv(struct sk_buff *skb,
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
struct ahhdr /* Generic AH header */
{
__u8 ah_nh; /* Next header (protocol) */
__u8 ah_hl; /* AH length, in 32-bit words */
__u16 ah_rv; /* reserved, must be 0 */
__u32 ah_spi; /* Security Parameters Index */
__u32 ah_rpl; /* Replay prevention */
__u8 ah_data[AHHMAC_HASHLEN];/* Authentication hash */
};
#define AH_BASIC_LEN 8 /* basic AH header is 8 bytes, nh,hl,rv,spi
* and the ah_hl, says how many bytes after that
* to cover. */
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_ah;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
/*
* $Log: ipsec_ah.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.20 2003/02/06 02:21:34 rgb
*
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
*
* Revision 1.19 2002/09/16 21:19:13 mcr
* fixes for west-ah-icmp-01 - length of AH header must be
* calculated properly, and next_header field properly copied.
*
* Revision 1.18 2002/05/14 02:37:02 rgb
* Change reference from _TDB to _IPSA.
*
* Revision 1.17 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_ah.h,v
*
* Revision 1.16 2002/02/20 01:27:06 rgb
* Ditched a pile of structs only used by the old Netlink interface.
*
* Revision 1.15 2001/12/11 02:35:57 rgb
* Change "struct net_device" to "struct device" for 2.2 compatibility.
*
* Revision 1.14 2001/11/26 09:23:47 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.13.2.1 2001/09/25 02:18:24 mcr
* replace "struct device" with "struct netdevice"
*
* Revision 1.13 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.12 2000/09/12 03:21:20 rgb
* Cleared out unused htonq.
*
* Revision 1.11 2000/09/08 19:12:55 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.10 2000/01/21 06:13:10 rgb
* Tidied up spacing.
* Added macros for HMAC padding magic numbers.(kravietz)
*
* Revision 1.9 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.8 1999/04/11 00:28:56 henry
* GPL boilerplate
*
* Revision 1.7 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.6 1999/01/26 02:06:01 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
*
* Revision 1.5 1999/01/22 06:17:49 rgb
* Updated macro comments.
* Added context types to support algorithm switch code.
* 64-bit clean-up -- converting 'u long long' to __u64.
*
* Revision 1.4 1998/07/14 15:54:56 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.3 1998/06/30 18:05:16 rgb
* Comment out references to htonq.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:43 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:17 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:05:55 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new AH transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_alg.h
+254
View File
@@ -0,0 +1,254 @@
/*
* Modular extensions service and registration functions interface
*
* Author: JuanJo Ciarlante <[email protected]>
*
* $Id: ipsec_alg.h,v 1.2 2004/03/22 21:53:18 as Exp $
*
*/
/*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
*/
#ifndef IPSEC_ALG_H
#define IPSEC_ALG_H
/*
* gcc >= 3.2 has removed __FUNCTION__, replaced by C99 __func__
* *BUT* its a compiler variable.
*/
#if (__GNUC__ >= 3)
#ifndef __FUNCTION__
#define __FUNCTION__ __func__
#endif
#endif
/* Version 0.8.1-0 */
#define IPSEC_ALG_VERSION 0x00080100
#include <linux/types.h>
#include <linux/list.h>
#include <asm/atomic.h>
/*
* The following structs are used via pointers in ipsec_alg object to
* avoid ipsec_alg.h coupling with freeswan headers, thus simplifying
* module development
*/
struct ipsec_sa;
struct esp;
/**************************************
*
* Main registration object
*
*************************************/
#define IPSEC_ALG_VERSION_QUAD(v) \
(v>>24),((v>>16)&0xff),((v>>8)&0xff),(v&0xff)
/*
* Main ipsec_alg objects: "OOPrograming wannabe"
* Hierachy (carefully handled with _minimal_ cast'ing):
*
* ipsec_alg+
* +->ipsec_alg_enc (ixt_alg_type=SADB_EXT_SUPPORTED_ENCRYPT)
* +->ipsec_alg_auth (ixt_alg_type=SADB_EXT_SUPPORTED_AUTH)
*/
/***************************************************************
*
* INTERFACE object: struct ipsec_alg
*
***************************************************************/
/*
* common part for every struct ipsec_alg_*
* (sortof poor's man OOP)
*/
#define IPSEC_ALG_STRUCT_COMMON \
unsigned ixt_version; /* only allow this version (or 'near')*/ \
struct list_head ixt_list; /* dlinked list */ \
struct module *ixt_module; /* THIS_MODULE */ \
unsigned ixt_state; /* state flags */ \
atomic_t ixt_refcnt; /* ref. count when pointed from ipsec_sa */ \
char ixt_name[16]; /* descriptive short name, eg. "3des" */ \
void *ixt_data; /* private for algo implementation */ \
uint8_t ixt_blocksize; /* blocksize in bytes */ \
\
/* THIS IS A COPY of struct supported (lib/pfkey.h) \
* please keep in sync until we migrate 'supported' stuff \
* to ipsec_alg \
*/ \
uint16_t ixt_alg_type; /* correspond to IPSEC_ALG_{ENCRYPT,AUTH} */ \
uint8_t ixt_alg_id; /* enc. alg. number, eg. ESP_3DES */ \
uint8_t ixt_ivlen; /* ivlen in bits, expected to be multiple of 8! */ \
uint16_t ixt_keyminbits;/* min. keybits (of entropy) */ \
uint16_t ixt_keymaxbits;/* max. keybits (of entropy) */
#define ixt_support ixt_alg_type
#define IPSEC_ALG_ST_SUPP 0x01
#define IPSEC_ALG_ST_REGISTERED 0x02
#define IPSEC_ALG_ST_EXCL 0x04
struct ipsec_alg {
IPSEC_ALG_STRUCT_COMMON
};
/*
* Note the const in cbc_encrypt IV arg:
* some ciphers like to toast passed IV (eg. 3DES): make a local IV copy
*/
struct ipsec_alg_enc {
IPSEC_ALG_STRUCT_COMMON
unsigned ixt_e_keylen; /* raw key length in bytes */
unsigned ixt_e_ctx_size; /* sa_p->key_e_size */
int (*ixt_e_set_key)(struct ipsec_alg_enc *alg, __u8 *key_e, const __u8 *key, size_t keysize);
__u8 *(*ixt_e_new_key)(struct ipsec_alg_enc *alg, const __u8 *key, size_t keysize);
void (*ixt_e_destroy_key)(struct ipsec_alg_enc *alg, __u8 *key_e);
int (*ixt_e_cbc_encrypt)(struct ipsec_alg_enc *alg, __u8 *key_e, __u8 *in, int ilen, const __u8 *iv, int encrypt);
};
struct ipsec_alg_auth {
IPSEC_ALG_STRUCT_COMMON
unsigned ixt_a_keylen; /* raw key length in bytes */
unsigned ixt_a_ctx_size; /* sa_p->key_a_size */
unsigned ixt_a_authlen; /* 'natural' auth. hash len (bytes) */
int (*ixt_a_hmac_set_key)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *key, int keylen);
int (*ixt_a_hmac_hash)(struct ipsec_alg_auth *alg, __u8 *key_a, const __u8 *dat, int len, __u8 *hash, int hashlen);
};
/*
* These are _copies_ of SADB_EXT_SUPPORTED_{AUTH,ENCRYPT},
* to avoid header coupling for true constants
* about headers ... "cp is your friend" --Linus
*/
#define IPSEC_ALG_TYPE_AUTH 14
#define IPSEC_ALG_TYPE_ENCRYPT 15
/***************************************************************
*
* INTERFACE for module loading,testing, and unloading
*
***************************************************************/
/* - registration calls */
int register_ipsec_alg(struct ipsec_alg *);
int unregister_ipsec_alg(struct ipsec_alg *);
/* - optional (simple test) for algos */
int ipsec_alg_test(unsigned alg_type, unsigned alg_id, int testparm);
/* inline wrappers (usefull for type validation */
static inline int register_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
return register_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int unregister_ipsec_alg_enc(struct ipsec_alg_enc *ixt) {
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int register_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
return register_ipsec_alg((struct ipsec_alg*)ixt);
}
static inline int unregister_ipsec_alg_auth(struct ipsec_alg_auth *ixt) {
return unregister_ipsec_alg((struct ipsec_alg*)ixt);
}
/*****************************************************************
*
* INTERFACE for ENC services: key creation, encrypt function
*
*****************************************************************/
#define IPSEC_ALG_ENCRYPT 1
#define IPSEC_ALG_DECRYPT 0
/* encryption key context creation function */
int ipsec_alg_enc_key_create(struct ipsec_sa *sa_p);
/*
* ipsec_alg_esp_encrypt(): encrypt ilen bytes in idat returns
* 0 or ERR<0
*/
int ipsec_alg_esp_encrypt(struct ipsec_sa *sa_p, __u8 *idat, int ilen, const __u8 *iv, int action);
/***************************************************************
*
* INTERFACE for AUTH services: key creation, hash functions
*
***************************************************************/
int ipsec_alg_auth_key_create(struct ipsec_sa *sa_p);
int ipsec_alg_sa_esp_hash(const struct ipsec_sa *sa_p, const __u8 *espp, int len, __u8 *hash, int hashlen) ;
#define ipsec_alg_sa_esp_update(c,k,l) ipsec_alg_sa_esp_hash(c,k,l,NULL,0)
/* only called from ipsec_init.c */
int ipsec_alg_init(void);
/* algo module glue for static algos */
void ipsec_alg_static_init(void);
typedef int (*ipsec_alg_init_func_t) (void);
/**********************************************
*
* INTERFACE for ipsec_sa init and wipe
*
**********************************************/
/* returns true if ipsec_sa has ipsec_alg obj attached */
/*
* Initializes ipsec_sa's ipsec_alg object, using already loaded
* proto, authalg, encalg.; links ipsec_alg objects (enc, auth)
*/
int ipsec_alg_sa_init(struct ipsec_sa *sa_p);
/*
* Destroys ipsec_sa's ipsec_alg object
* unlinking ipsec_alg objects
*/
int ipsec_alg_sa_wipe(struct ipsec_sa *sa_p);
/**********************************************
*
* 2.2 backport for some 2.4 useful module stuff
*
**********************************************/
#ifdef MODULE
#ifndef THIS_MODULE
#define THIS_MODULE (&__this_module)
#endif
#ifndef module_init
typedef int (*__init_module_func_t)(void);
typedef void (*__cleanup_module_func_t)(void);
#define module_init(x) \
int init_module(void) __attribute__((alias(#x))); \
static inline __init_module_func_t __init_module_inline(void) \
{ return x; }
#define module_exit(x) \
void cleanup_module(void) __attribute__((alias(#x))); \
static inline __cleanup_module_func_t __cleanup_module_inline(void) \
{ return x; }
#endif
#define IPSEC_ALG_MODULE_INIT( func_name ) \
static int func_name(void); \
module_init(func_name); \
static int __init func_name(void)
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
static void func_name(void); \
module_exit(func_name); \
static void __exit func_name(void)
#else /* not MODULE */
#ifndef THIS_MODULE
#define THIS_MODULE NULL
#endif
/*
* I only want module_init() magic
* when algo.c file *is THE MODULE*, in all other
* cases, initialization is called explicitely from ipsec_alg_init()
*/
#define IPSEC_ALG_MODULE_INIT( func_name ) \
extern int func_name(void); \
int func_name(void)
#define IPSEC_ALG_MODULE_EXIT( func_name ) \
extern void func_name(void); \
void func_name(void)
#endif
#endif /* IPSEC_ALG_H */
linux/include/freeswan/ipsec_encap.h
+143
View File
@@ -0,0 +1,143 @@
/*
* declarations relevant to encapsulation-like operations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_encap.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#ifndef _IPSEC_ENCAP_H_
#define SENT_IP4 16 /* data is two struct in_addr + proto + ports*/
/* (2 * sizeof(struct in_addr)) */
/* sizeof(struct sockaddr_encap)
- offsetof(struct sockaddr_encap, Sen.Sip4.Src) */
struct sockaddr_encap
{
__u8 sen_len; /* length */
__u8 sen_family; /* AF_ENCAP */
__u16 sen_type; /* see SENT_* */
union
{
struct /* SENT_IP4 */
{
struct in_addr Src;
struct in_addr Dst;
__u8 Proto;
__u16 Sport;
__u16 Dport;
} Sip4;
} Sen;
};
#define sen_ip_src Sen.Sip4.Src
#define sen_ip_dst Sen.Sip4.Dst
#define sen_proto Sen.Sip4.Proto
#define sen_sport Sen.Sip4.Sport
#define sen_dport Sen.Sip4.Dport
#ifndef AF_ENCAP
#define AF_ENCAP 26
#endif /* AF_ENCAP */
#define _IPSEC_ENCAP_H_
#endif /* _IPSEC_ENCAP_H_ */
/*
* $Log: ipsec_encap.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.17 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_encap.h,v
*
* Revision 1.16 2001/11/26 09:23:47 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.15.2.1 2001/09/25 02:18:54 mcr
* struct eroute moved to ipsec_eroute.h
*
* Revision 1.15 2001/09/14 16:58:36 rgb
* Added support for storing the first and last packets through a HOLD.
*
* Revision 1.14 2001/09/08 21:13:31 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.13 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.12 2001/05/27 06:12:10 rgb
* Added structures for pid, packet count and last access time to eroute.
* Added packet count to beginning of /proc/net/ipsec_eroute.
*
* Revision 1.11 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.10 2000/03/22 16:15:36 rgb
* Fixed renaming of dev_get (MB).
*
* Revision 1.9 2000/01/21 06:13:26 rgb
* Added a macro for AF_ENCAP
*
* Revision 1.8 1999/12/31 14:56:55 rgb
* MB fix for 2.3 dev-use-count.
*
* Revision 1.7 1999/11/18 04:09:18 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.6 1999/09/24 00:34:13 rgb
* Add Marc Boucher's support for 2.3.xx+.
*
* Revision 1.5 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.4 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.3 1998/10/19 14:44:28 rgb
* Added inclusion of freeswan.h.
* sa_id structure implemented and used: now includes protocol.
*
* Revision 1.2 1998/07/14 18:19:33 rgb
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.1 1998/06/18 21:27:44 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/21 21:29:10 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:05:58 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Minor cosmetic changes.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_eroute.h
+103
View File
@@ -0,0 +1,103 @@
/*
* @(#) declarations of eroute structures
*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs <[email protected]>
* Copyright (C) 2001 Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_eroute.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
* derived from ipsec_encap.h 1.15 on 2001/9/18 by mcr.
*
*/
#ifndef _IPSEC_EROUTE_H_
#include "radij.h"
#include "ipsec_encap.h"
#include "ipsec_radij.h"
/*
* The "type" is really part of the address as far as the routing
* system is concerned. By using only one bit in the type field
* for each type, we sort-of make sure that different types of
* encapsulation addresses won't be matched against the wrong type.
*/
/*
* An entry in the radix tree
*/
struct rjtentry
{
struct radij_node rd_nodes[2]; /* tree glue, and other values */
#define rd_key(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_key))
#define rd_mask(r) ((struct sockaddr_encap *)((r)->rd_nodes->rj_mask))
short rd_flags;
short rd_count;
};
struct ident
{
__u16 type; /* identity type */
__u64 id; /* identity id */
__u8 len; /* identity len */
caddr_t data; /* identity data */
};
/*
* An encapsulation route consists of a pointer to a
* radix tree entry and a SAID (a destination_address/SPI/protocol triple).
*/
struct eroute
{
struct rjtentry er_rjt;
struct sa_id er_said;
uint32_t er_pid;
uint32_t er_count;
uint64_t er_lasttime;
struct sockaddr_encap er_eaddr; /* MCR get rid of _encap, it is silly*/
struct sockaddr_encap er_emask;
struct ident er_ident_s;
struct ident er_ident_d;
struct sk_buff* er_first;
struct sk_buff* er_last;
};
#define er_dst er_said.dst
#define er_spi er_said.spi
#define _IPSEC_EROUTE_H_
#endif /* _IPSEC_EROUTE_H_ */
/*
* $Log: ipsec_eroute.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_eroute.h,v
*
* Revision 1.2 2001/11/26 09:16:13 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:18:54 mcr
* struct eroute moved to ipsec_eroute.h
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_errs.h
+53
View File
@@ -0,0 +1,53 @@
/*
* @(#) definition of ipsec_errs structure
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_errs.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
*/
/*
* This file describes the errors/statistics that FreeSWAN collects.
*
*/
struct ipsec_errs {
__u32 ips_alg_errs; /* number of algorithm errors */
__u32 ips_auth_errs; /* # of authentication errors */
__u32 ips_encsize_errs; /* # of encryption size errors*/
__u32 ips_encpad_errs; /* # of encryption pad errors*/
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
};
/*
* $Log: ipsec_errs.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_errs.h,v
*
* Revision 1.2 2001/11/26 09:16:13 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:25:57 mcr
* lifetime structure created and common functions created.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_esp.h
+220
View File
@@ -0,0 +1,220 @@
/*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_esp.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#include "freeswan/ipsec_md5h.h"
#include "freeswan/ipsec_sha1.h"
#include "crypto/des.h"
#ifndef IPPROTO_ESP
#define IPPROTO_ESP 50
#endif /* IPPROTO_ESP */
#define ESP_HEADER_LEN 8 /* 64 bits header (spi+rpl)*/
#define EMT_ESPDESCBC_ULEN 20 /* coming from user mode */
#define EMT_ESPDES_KMAX 64 /* 512 bit secret key enough? */
#define EMT_ESPDES_KEY_SZ 8 /* 56 bit secret key with parity = 64 bits */
#define EMT_ESP3DES_KEY_SZ 24 /* 168 bit secret key with parity = 192 bits */
#define EMT_ESPDES_IV_SZ 8 /* IV size */
#define ESP_DESCBC_BLKLEN 8 /* DES-CBC block size */
#define ESP_IV_MAXSZ 16 /* This is _critical_ */
#define ESP_IV_MAXSZ_INT (ESP_IV_MAXSZ/sizeof(int))
#define DB_ES_PKTRX 0x0001
#define DB_ES_PKTRX2 0x0002
#define DB_ES_IPSA 0x0010
#define DB_ES_XF 0x0020
#define DB_ES_IPAD 0x0040
#define DB_ES_INAU 0x0080
#define DB_ES_OINFO 0x0100
#define DB_ES_OINFO2 0x0200
#define DB_ES_OH 0x0400
#define DB_ES_REPLAY 0x0800
#ifdef __KERNEL__
struct des_eks {
des_key_schedule ks;
};
extern struct inet_protocol esp_protocol;
struct options;
extern int
esp_rcv(struct sk_buff *skb,
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
/* Only for 64 bits IVs, eg. ESP_3DES :P */
struct esphdr
{
__u32 esp_spi; /* Security Parameters Index */
__u32 esp_rpl; /* Replay counter */
__u8 esp_iv[8]; /* iv */
};
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_esp;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
/*
* $Log: ipsec_esp.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.21 2003/02/06 02:21:34 rgb
*
* Moved "struct auth_alg" from ipsec_rcv.c to ipsec_ah.h .
* Changed "struct ah" to "struct ahhdr" and "struct esp" to "struct esphdr".
* Removed "#ifdef INBOUND_POLICY_CHECK_eroute" dead code.
*
* Revision 1.20 2002/05/14 02:37:02 rgb
* Change reference from _TDB to _IPSA.
*
* Revision 1.19 2002/04/24 07:55:32 mcr
* #include patches and Makefiles for post-reorg compilation.
*
* Revision 1.18 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_esp.h,v
*
* Revision 1.17 2002/02/20 01:27:07 rgb
* Ditched a pile of structs only used by the old Netlink interface.
*
* Revision 1.16 2001/12/11 02:35:57 rgb
* Change "struct net_device" to "struct device" for 2.2 compatibility.
*
* Revision 1.15 2001/11/26 09:23:48 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.14.2.3 2001/10/23 04:16:42 mcr
* get definition of des_key_schedule from des.h
*
* Revision 1.14.2.2 2001/10/22 20:33:13 mcr
* use "des_key_schedule" structure instead of cooking our own.
*
* Revision 1.14.2.1 2001/09/25 02:18:25 mcr
* replace "struct device" with "struct netdevice"
*
* Revision 1.14 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.13 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.12 2000/08/01 14:51:50 rgb
* Removed _all_ remaining traces of DES.
*
* Revision 1.11 2000/01/10 16:36:20 rgb
* Ditch last of EME option flags, including initiator.
*
* Revision 1.10 1999/12/07 18:16:22 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.9 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.8 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.7 1999/01/26 02:06:00 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
*
* Revision 1.6 1999/01/22 15:22:05 rgb
* Re-enable IV in the espblkrply_edata structure to avoid breaking pluto
* until pluto can be fixed properly.
*
* Revision 1.5 1999/01/22 06:18:16 rgb
* Updated macro comments.
* Added key schedule types to support algorithm switch code.
*
* Revision 1.4 1998/08/12 00:07:32 rgb
* Added data structures for new xforms: null, {,3}dessha1.
*
* Revision 1.3 1998/07/14 15:57:01 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:45 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.6 1998/06/05 02:28:08 rgb
* Minor comment fix.
*
* Revision 1.5 1998/05/27 22:34:00 rgb
* Changed structures to accomodate key separation.
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:20 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:06:00 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96 transform.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new ESP transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_ipe4.h
+68
View File
@@ -0,0 +1,68 @@
/*
* IP-in-IP Header declarations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_ipe4.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/* The packet header is an IP header! */
struct ipe4_xdata /* transform table data */
{
struct in_addr i4_src;
struct in_addr i4_dst;
};
#define EMT_IPE4_ULEN 8 /* coming from user mode */
/*
* $Log: ipsec_ipe4.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.5 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_ipe4.h,v
*
* Revision 1.4 2001/06/14 19:35:08 rgb
* Update copyright date.
*
* Revision 1.3 1999/04/11 00:28:57 henry
* GPL boilerplate
*
* Revision 1.2 1999/04/06 04:54:25 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.1 1998/06/18 21:27:47 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.1 1998/04/09 03:06:07 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:48:53 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_kversion.h
+227
View File
@@ -0,0 +1,227 @@
#ifndef _FREESWAN_KVERSIONS_H
/*
* header file for FreeS/WAN library functions
* Copyright (C) 1998, 1999, 2000 Henry Spencer.
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: ipsec_kversion.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#define _FREESWAN_KVERSIONS_H /* seen it, no need to see it again */
/*
* this file contains a series of atomic defines that depend upon
* kernel version numbers. The kernel versions are arranged
* in version-order number (which is often not chronological)
* and each clause enables or disables a feature.
*/
/*
* First, assorted kernel-version-dependent trickery.
*/
#include <linux/version.h>
#ifndef KERNEL_VERSION
#define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,0)
#define HEADER_CACHE_BIND_21
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,1,0)
#define SPINLOCK
#define PROC_FS_21
#define NETLINK_SOCK
#define NET_21
#endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,1,19)
#define net_device_stats enet_statistics
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,0)
#define SPINLOCK_23
#define NETDEV_23
# ifndef CONFIG_IP_ALIAS
# define CONFIG_IP_ALIAS
# endif
#include <linux/socket.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
# ifdef NETLINK_XFRM
# define NETDEV_25
# endif
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,25)
#define PROC_FS_2325
#undef PROC_FS_21
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,30)
#define PROC_NO_DUMMY
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,35)
#define SKB_COPY_EXPAND
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,37)
#define IP_SELECT_IDENT
#endif
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,50)) && defined(CONFIG_NETFILTER)
#define SKB_RESET_NFCT
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,2)
#define IP_SELECT_IDENT_NEW
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4)
#define IPH_is_SKB_PULLED
#define SKB_COW_NEW
#define PROTO_HANDLER_SINGLE_PARM
#define IP_FRAGMENT_LINEARIZE 1
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
# ifdef REDHAT_BOGOSITY
# define IP_SELECT_IDENT_NEW
# define IPH_is_SKB_PULLED
# define SKB_COW_NEW
# define PROTO_HANDLER_SINGLE_PARM
# endif /* REDHAT_BOGOSITY */
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,4) */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,9)
#define MALLOC_SLAB
#define LINUX_KERNEL_HAS_SNPRINTF
#endif
#ifdef NET_21
# include <linux/in6.h>
#else
/* old kernel in.h has some IPv6 stuff, but not quite enough */
# define s6_addr16 s6_addr
# define AF_INET6 10
# define uint8_t __u8
# define uint16_t __u16
# define uint32_t __u32
# define uint64_t __u64
#endif
#ifdef NET_21
# define ipsec_kfree_skb(a) kfree_skb(a)
#else /* NET_21 */
# define ipsec_kfree_skb(a) kfree_skb(a, FREE_WRITE)
#endif /* NET_21 */
#ifdef NETDEV_23
# define device net_device
# define ipsec_dev_get dev_get_by_name
# define __ipsec_dev_get __dev_get_by_name
# define ipsec_dev_put(x) dev_put(x)
# define __ipsec_dev_put(x) __dev_put(x)
# define ipsec_dev_hold(x) dev_hold(x)
#else /* NETDEV_23 */
# define ipsec_dev_get dev_get
# define __ipsec_dev_put(x)
# define ipsec_dev_put(x)
# define ipsec_dev_hold(x)
#endif /* NETDEV_23 */
#ifndef SPINLOCK
# include <linux/bios32.h>
/* simulate spin locks and read/write locks */
typedef struct {
volatile char lock;
} spinlock_t;
typedef struct {
volatile unsigned int lock;
} rwlock_t;
# define spin_lock_init(x) { (x)->lock = 0;}
# define rw_lock_init(x) { (x)->lock = 0; }
# define spin_lock(x) { while ((x)->lock) barrier(); (x)->lock=1;}
# define spin_lock_irq(x) { cli(); spin_lock(x);}
# define spin_lock_irqsave(x,flags) { save_flags(flags); spin_lock_irq(x);}
# define spin_unlock(x) { (x)->lock=0;}
# define spin_unlock_irq(x) { spin_unlock(x); sti();}
# define spin_unlock_irqrestore(x,flags) { spin_unlock(x); restore_flags(flags);}
# define read_lock(x) spin_lock(x)
# define read_lock_irq(x) spin_lock_irq(x)
# define read_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
# define read_unlock(x) spin_unlock(x)
# define read_unlock_irq(x) spin_unlock_irq(x)
# define read_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
# define write_lock(x) spin_lock(x)
# define write_lock_irq(x) spin_lock_irq(x)
# define write_lock_irqsave(x,flags) spin_lock_irqsave(x,flags)
# define write_unlock(x) spin_unlock(x)
# define write_unlock_irq(x) spin_unlock_irq(x)
# define write_unlock_irqrestore(x,flags) spin_unlock_irqrestore(x,flags)
#endif /* !SPINLOCK */
#ifndef SPINLOCK_23
# define spin_lock_bh(x) spin_lock_irq(x)
# define spin_unlock_bh(x) spin_unlock_irq(x)
# define read_lock_bh(x) read_lock_irq(x)
# define read_unlock_bh(x) read_unlock_irq(x)
# define write_lock_bh(x) write_lock_irq(x)
# define write_unlock_bh(x) write_unlock_irq(x)
#endif /* !SPINLOCK_23 */
#endif /* _FREESWAN_KVERSIONS_H */
/*
* $Log: ipsec_kversion.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.7 2003/07/31 22:48:08 mcr
* derive NET25-ness from presence of NETLINK_XFRM macro.
*
* Revision 1.6 2003/06/24 20:22:32 mcr
* added new global: ipsecdevices[] so that we can keep track of
* the ipsecX devices. They will be referenced with dev_hold(),
* so 2.2 may need this as well.
*
* Revision 1.5 2003/04/03 17:38:09 rgb
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
*
* Revision 1.4 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_kversion.h,v
*
* Revision 1.3 2002/04/12 03:21:17 mcr
* three parameter version of ip_select_ident appears first
* in 2.4.2 (RH7.1) not 2.4.4.
*
* Revision 1.2 2002/03/08 21:35:22 rgb
* Defined LINUX_KERNEL_HAS_SNPRINTF to shut up compiler warnings after
* 2.4.9. (Andreas Piesk).
*
* Revision 1.1 2002/01/29 02:11:42 mcr
* removal of kversions.h - sources that needed it now use ipsec_param.h.
* updating of IPv6 structures to match latest in6.h version.
* removed dead code from freeswan.h that also duplicated kversions.h
* code.
*
*
*/
linux/include/freeswan/ipsec_life.h
+112
View File
@@ -0,0 +1,112 @@
/*
* Definitions relevant to IPSEC lifetimes
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_life.h,v 1.1 2004/03/15 20:35:25 as Exp $
*
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
*
*/
/*
* This file describes the book keeping fields for the
* IPsec Security Association Structure. ("ipsec_sa")
*
* This structure is never allocated directly by kernel code,
* (it is always a static/auto or is part of a structure)
* so it does not have a reference count.
*
*/
#ifndef _IPSEC_LIFE_H_
/*
* _count is total count.
* _hard is hard limit (kill SA after this number)
* _soft is soft limit (try to renew SA after this number)
* _last is used in some special cases.
*
*/
struct ipsec_lifetime64
{
__u64 ipl_count;
__u64 ipl_soft;
__u64 ipl_hard;
__u64 ipl_last;
};
struct ipsec_lifetimes
{
/* number of bytes processed */
struct ipsec_lifetime64 ipl_bytes;
/* number of packets processed */
struct ipsec_lifetime64 ipl_packets;
/* time since SA was added */
struct ipsec_lifetime64 ipl_addtime;
/* time since SA was first used */
struct ipsec_lifetime64 ipl_usetime;
/* from rfc2367:
* For CURRENT, the number of different connections,
* endpoints, or flows that the association has been
* allocated towards. For HARD and SOFT, the number of
* these the association may be allocated towards
* before it expires. The concept of a connection,
* flow, or endpoint is system specific.
*
* mcr(2001-9-18) it is unclear what purpose these serve for FreeSWAN.
* They are maintained for PF_KEY compatibility.
*/
struct ipsec_lifetime64 ipl_allocations;
};
enum ipsec_life_alive {
ipsec_life_harddied = -1,
ipsec_life_softdied = 0,
ipsec_life_okay = 1
};
enum ipsec_life_type {
ipsec_life_timebased = 1,
ipsec_life_countbased= 0
};
#define _IPSEC_LIFE_H_
#endif /* _IPSEC_LIFE_H_ */
/*
* $Log: ipsec_life.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.3 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_life.h,v
*
* Revision 1.2 2001/11/26 09:16:14 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:25:58 mcr
* lifetime structure created and common functions created.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_md5h.h
+140
View File
@@ -0,0 +1,140 @@
/*
* RCSID $Id: ipsec_md5h.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* The rest of this file is Copyright RSA DSI. See the following comments
* for the full Copyright notice.
*/
#ifndef _IPSEC_MD5H_H_
#define _IPSEC_MD5H_H_
/* GLOBAL.H - RSAREF types and constants
*/
/* PROTOTYPES should be set to one if and only if the compiler supports
function argument prototyping.
The following makes PROTOTYPES default to 0 if it has not already
been defined with C compiler flags.
*/
#ifndef PROTOTYPES
#define PROTOTYPES 1
#endif /* !PROTOTYPES */
/* POINTER defines a generic pointer type */
typedef __u8 *POINTER;
/* UINT2 defines a two byte word */
typedef __u16 UINT2;
/* UINT4 defines a four byte word */
typedef __u32 UINT4;
/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
returns an empty list.
*/
#if PROTOTYPES
#define PROTO_LIST(list) list
#else /* PROTOTYPES */
#define PROTO_LIST(list) ()
#endif /* PROTOTYPES */
/* MD5.H - header file for MD5C.C
*/
/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.
License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.
License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.
RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.
These notices must be retained in any copies of any part of this
documentation and/or software.
*/
/* MD5 context. */
typedef struct {
UINT4 state[4]; /* state (ABCD) */
UINT4 count[2]; /* number of bits, modulo 2^64 (lsb first) */
unsigned char buffer[64]; /* input buffer */
} MD5_CTX;
void MD5Init PROTO_LIST ((void *));
void MD5Update PROTO_LIST
((void *, unsigned char *, __u32));
void MD5Final PROTO_LIST ((unsigned char [16], void *));
#endif /* _IPSEC_MD5H_H_ */
/*
* $Log: ipsec_md5h.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.8 2002/09/10 01:45:09 mcr
* changed type of MD5_CTX and SHA1_CTX to void * so that
* the function prototypes would match, and could be placed
* into a pointer to a function.
*
* Revision 1.7 2002/04/24 07:36:46 mcr
* Moved from ./klips/net/ipsec/ipsec_md5h.h,v
*
* Revision 1.6 1999/12/13 13:59:13 rgb
* Quick fix to argument size to Update bugs.
*
* Revision 1.5 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.4 1999/04/06 04:54:26 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.3 1999/01/22 06:19:58 rgb
* 64-bit clean-up.
*
* Revision 1.2 1998/11/30 13:22:54 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.1 1998/06/18 21:27:48 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/23 20:54:03 rgb
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
* verified.
*
* Revision 1.1 1998/04/09 03:04:21 henry
* sources moved up from linux/net/ipsec
* these two include files modified not to include others except in kernel
*
* Revision 1.1.1.1 1998/04/08 05:35:03 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:48:53 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_param.h
+226
View File
@@ -0,0 +1,226 @@
/*
* @(#) FreeSWAN tunable paramaters
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_param.h,v 1.2 2004/04/28 08:07:11 as Exp $
*
*/
/*
* This file provides a set of #define's which may be tuned by various
* people/configurations. It keeps all compile-time tunables in one place.
*
* This file should be included before all other IPsec kernel-only files.
*
*/
#ifndef _IPSEC_PARAM_H_
#ifdef __KERNEL__
#include "ipsec_kversion.h"
/* Set number of ipsecX virtual devices here. */
/* This must be < exp(field width of IPSEC_DEV_FORMAT) */
/* It must also be reasonable so as not to overload the memory and CPU */
/* constraints of the host. */
#define IPSEC_NUM_IF 4
/* The field width must be < IF_NAM_SIZ - strlen("ipsec") - 1. */
/* With "ipsec" being 5 characters, that means 10 is the max field width */
/* but machine memory and CPU constraints are not likely to tollerate */
/* more than 3 digits. The default is one digit. */
/* Update: userland scripts get upset if they can't find "ipsec0", so */
/* for now, no "0"-padding should be used (which would have been helpful */
/* to make text-searches work */
#define IPSEC_DEV_FORMAT "ipsec%d"
/* For, say, 500 virtual ipsec devices, I would recommend: */
/* #define IPSEC_NUM_IF 500 */
/* #define IPSEC_DEV_FORMAT "ipsec%03d" */
/* Note that the "interfaces=" line in /etc/ipsec.conf would be, um, challenging. */
/* use dynamic ipsecX device allocation */
#ifndef CONFIG_IPSEC_DYNDEV
#define CONFIG_IPSEC_DYNDEV 1
#endif /* CONFIG_IPSEC_DYNDEV */
#ifdef CONFIG_IPSEC_BIGGATE
# define SADB_HASHMOD 8069
#else /* CONFIG_IPSEC_BIGGATE */
# define SADB_HASHMOD 257
#endif /* CONFIG_IPSEC_BIGGATE */
#endif /* __KERNEL__ */
/*
* This is for the SA reference table. This number is related to the
* maximum number of SAs that KLIPS can concurrently deal with, plus enough
* space for keeping expired SAs around.
*
* TABLE_MAX_WIDTH is the number of bits that we will use.
* MAIN_TABLE_WIDTH is the number of bits used for the primary index table.
*
*/
#ifndef IPSEC_SA_REF_TABLE_IDX_WIDTH
# define IPSEC_SA_REF_TABLE_IDX_WIDTH 16
#endif
#ifndef IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
# define IPSEC_SA_REF_MAINTABLE_IDX_WIDTH 4
#endif
#ifndef IPSEC_SA_REF_FREELIST_NUM_ENTRIES
# define IPSEC_SA_REF_FREELIST_NUM_ENTRIES 256
#endif
#ifndef IPSEC_SA_REF_CODE
# define IPSEC_SA_REF_CODE 1
#endif
#ifdef __KERNEL__
/* This is defined for 2.4, but not 2.2.... */
#ifndef ARPHRD_VOID
# define ARPHRD_VOID 0xFFFF
#endif
/*
* Worry about PROC_FS stuff
*/
#if defined(PROC_FS_2325)
/* kernel 2.4 */
# define IPSEC_PROC_LAST_ARG ,int *eof,void *data
# define IPSEC_PROCFS_DEBUG_NO_STATIC
# define IPSEC_PROC_SUBDIRS
#else
/* kernel <2.4 */
# define IPSEC_PROCFS_DEBUG_NO_STATIC DEBUG_NO_STATIC
# ifndef PROC_NO_DUMMY
# define IPSEC_PROC_LAST_ARG , int dummy
# else
# define IPSEC_PROC_LAST_ARG
# endif /* !PROC_NO_DUMMY */
#endif /* PROC_FS_2325 */
#if !defined(LINUX_KERNEL_HAS_SNPRINTF)
/* GNU CPP specific! */
# define snprintf(buf, len, fmt...) sprintf(buf, ##fmt)
#endif /* !LINUX_KERNEL_HAS_SNPRINTF */
#ifdef SPINLOCK
# ifdef SPINLOCK_23
# include <linux/spinlock.h> /* *lock* */
# else /* SPINLOCK_23 */
# include <asm/spinlock.h> /* *lock* */
# endif /* SPINLOCK_23 */
#endif /* SPINLOCK */
#ifndef KLIPS_FIXES_DES_PARITY
# define KLIPS_FIXES_DES_PARITY 1
#endif /* !KLIPS_FIXES_DES_PARITY */
/* we don't really want to print these unless there are really big problems */
#ifndef KLIPS_DIVULGE_CYPHER_KEY
# define KLIPS_DIVULGE_CYPHER_KEY 0
#endif /* !KLIPS_DIVULGE_CYPHER_KEY */
#ifndef KLIPS_DIVULGE_HMAC_KEY
# define KLIPS_DIVULGE_HMAC_KEY 0
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
#ifndef IPSEC_DISALLOW_IPOPTIONS
# define IPSEC_DISALLOW_IPOPTIONS 1
#endif /* !KLIPS_DIVULGE_HMAC_KEY */
/* extra toggles for regression testing */
#ifdef CONFIG_IPSEC_REGRESS
/*
* should pfkey_acquire() become 100% lossy?
*
*/
extern int sysctl_ipsec_regress_pfkey_lossage;
#ifndef KLIPS_PFKEY_ACQUIRE_LOSSAGE
# ifdef CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 100
# else /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
/* not by default! */
# define KLIPS_PFKEY_ACQUIRE_LOSSAGE 0
# endif /* CONFIG_IPSEC_PFKEY_ACQUIRE_LOSSAGE */
#endif /* KLIPS_PFKEY_ACQUIRE_LOSSAGE */
#endif /* CONFIG_IPSEC_REGRESS */
/*
* debugging routines.
*/
#ifdef CONFIG_IPSEC_DEBUG
extern void ipsec_print_ip(struct iphdr *ip);
#define KLIPS_PRINT(flag, format, args...) \
((flag) ? printk(KERN_INFO format , ## args) : 0)
#define KLIPS_PRINTMORE(flag, format, args...) \
((flag) ? printk(format , ## args) : 0)
#define KLIPS_IP_PRINT(flag, ip) \
((flag) ? ipsec_print_ip(ip) : 0)
#else /* CONFIG_IPSEC_DEBUG */
#define KLIPS_PRINT(flag, format, args...) do ; while(0)
#define KLIPS_PRINTMORE(flag, format, args...) do ; while(0)
#define KLIPS_IP_PRINT(flag, ip) do ; while(0)
#endif /* CONFIG_IPSEC_DEBUG */
/*
* Stupid kernel API differences in APIs. Not only do some
* kernels not have ip_select_ident, but some have differing APIs,
* and SuSE has one with one parameter, but no way of checking to
* see what is really what.
*/
#ifdef SUSE_LINUX_2_4_19_IS_STUPID
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph)
#else
/* simplest case, nothing */
#if !defined(IP_SELECT_IDENT)
#define KLIPS_IP_SELECT_IDENT(iph, skb) do { iph->id = htons(ip_id_count++); } while(0)
#endif
/* kernels > 2.3.37-ish */
#if defined(IP_SELECT_IDENT) && !defined(IP_SELECT_IDENT_NEW)
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst)
#endif
/* kernels > 2.4.2 */
#if defined(IP_SELECT_IDENT) && defined(IP_SELECT_IDENT_NEW)
#define KLIPS_IP_SELECT_IDENT(iph, skb) ip_select_ident(iph, skb->dst, NULL)
#endif
#endif /* SUSE_LINUX_2_4_19_IS_STUPID */
/*
* make klips fail test:east-espiv-01.
* exploit is at testing/attacks/espiv
*
*/
#define KLIPS_IMPAIRMENT_ESPIV_CBC_ATTACK 0
/* IP_FRAGMENT_LINEARIZE is set in freeswan.h if Kernel > 2.4.4 */
#ifndef IP_FRAGMENT_LINEARIZE
# define IP_FRAGMENT_LINEARIZE 0
#endif /* IP_FRAGMENT_LINEARIZE */
#endif /* __KERNEL__ */
#define _IPSEC_PARAM_H_
#endif /* _IPSEC_PARAM_H_ */
linux/include/freeswan/ipsec_policy.h
+225
View File
@@ -0,0 +1,225 @@
#ifndef _IPSEC_POLICY_H
/*
* policy interface file between pluto and applications
* Copyright (C) 2003 Michael Richardson <[email protected]>
*
* This library is free software; you can redistribute it and/or modify it
* under the terms of the GNU Library General Public License as published by
* the Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/lgpl.txt>.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
* License for more details.
*
* RCSID $Id: ipsec_policy.h,v 1.4 2004/10/04 22:43:56 as Exp $
*/
#define _IPSEC_POLICY_H /* seen it, no need to see it again */
/*
* this file defines an interface between an application (or rather an
* application library) and a key/policy daemon. It provides for inquiries
* as to the current state of a connected socket, as well as for general
* questions.
*
* In general, the interface is defined as a series of functional interfaces,
* and the policy messages should be internal. However, because this is in
* fact an ABI between pieces of the system that may get compiled and revised
* seperately, this ABI must be public and revision controlled.
*
* It is expected that the daemon will always support previous versions.
*/
#define IPSEC_POLICY_MSG_REVISION (unsigned)200305061
enum ipsec_policy_command {
IPSEC_CMD_QUERY_FD = 1,
IPSEC_CMD_QUERY_HOSTPAIR = 2,
IPSEC_CMD_QUERY_DSTONLY = 3,
};
struct ipsec_policy_msg_head {
u_int32_t ipm_version;
u_int32_t ipm_msg_len;
u_int32_t ipm_msg_type;
u_int32_t ipm_msg_seq;
};
enum ipsec_privacy_quality {
IPSEC_PRIVACY_NONE = 0,
IPSEC_PRIVACY_INTEGRAL = 4, /* not private at all. AH-like */
IPSEC_PRIVACY_UNKNOWN = 8, /* something is claimed, but details unavail */
IPSEC_PRIVACY_ROT13 = 12, /* trivially breakable, i.e. 1DES */
IPSEC_PRIVACY_GAK = 16, /* known eavesdroppers */
IPSEC_PRIVACY_PRIVATE = 32, /* secure for at least a decade */
IPSEC_PRIVACY_STRONG = 64, /* ridiculously secure */
IPSEC_PRIVACY_TORTOISE = 192, /* even stronger, but very slow */
IPSEC_PRIVACY_OTP = 224, /* some kind of *true* one time pad */
};
enum ipsec_bandwidth_quality {
IPSEC_QOS_UNKNOWN = 0, /* unknown bandwidth */
IPSEC_QOS_INTERACTIVE = 16, /* reasonably moderate jitter, moderate fast.
Good enough for telnet/ssh. */
IPSEC_QOS_VOIP = 32, /* faster crypto, predicable jitter */
IPSEC_QOS_FTP = 64, /* higher throughput crypto, perhaps hardware
offloaded, but latency/jitter may be bad */
IPSEC_QOS_WIRESPEED = 128, /* expect to be able to fill your pipe */
};
/* moved from programs/pluto/constants.h */
/* IPsec AH transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.3
* and in http://www.iana.org/assignments/isakmp-registry
*/
enum ipsec_authentication_algo {
AH_NONE = 0,
AH_MD5 = 2,
AH_SHA = 3,
AH_DES = 4,
AH_SHA2_256 = 5,
AH_SHA2_384 = 6,
AH_SHA2_512 = 7,
AH_RIPEMD = 8
};
/* IPsec ESP transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.4
* and from http://www.iana.org/assignments/isakmp-registry
*/
enum ipsec_cipher_algo {
ESP_NONE = 0,
ESP_DES_IV64 = 1,
ESP_DES = 2,
ESP_3DES = 3,
ESP_RC5 = 4,
ESP_IDEA = 5,
ESP_CAST = 6,
ESP_BLOWFISH = 7,
ESP_3IDEA = 8,
ESP_DES_IV32 = 9,
ESP_RC4 = 10,
ESP_NULL = 11,
ESP_AES = 12,
ESP_AES_CTR = 13,
ESP_AES_CCM_8 = 14,
ESP_AES_CCM_12 = 15,
ESP_AES_CCM_16 = 16,
ESP_SERPENT = 252,
ESP_TWOFISH = 253
};
/* IPCOMP transform values
* RFC2407 The Internet IP security Domain of Interpretation for ISAKMP 4.4.5
*/
enum ipsec_comp_algo {
IPSCOMP_NONE = 0,
IPCOMP_OUI = 1,
IPCOMP_DEFLATE = 2,
IPCOMP_LZS = 3,
IPCOMP_LZJH = 4
};
/* Identification type values
* RFC 2407 The Internet IP security Domain of Interpretation for ISAKMP 4.6.2.1
*/
enum ipsec_id_type {
ID_IMPOSSIBLE= (-2), /* private to Pluto */
ID_MYID= (-1), /* private to Pluto */
ID_NONE= 0, /* private to Pluto */
ID_IPV4_ADDR= 1,
ID_FQDN= 2,
ID_USER_FQDN= 3,
ID_IPV4_ADDR_SUBNET= 4,
ID_IPV6_ADDR= 5,
ID_IPV6_ADDR_SUBNET= 6,
ID_IPV4_ADDR_RANGE= 7,
ID_IPV6_ADDR_RANGE= 8,
ID_DER_ASN1_DN= 9,
ID_DER_ASN1_GN= 10,
ID_KEY_ID= 11
};
/* Certificate type values
* RFC 2408 ISAKMP, chapter 3.9
*/
enum ipsec_cert_type {
CERT_NONE= 0,
CERT_PKCS7_WRAPPED_X509= 1, /* self-signed certificate from disk */
CERT_PGP= 2,
CERT_DNS_SIGNED_KEY= 3, /* KEY RR from DNS */
CERT_X509_SIGNATURE= 4,
CERT_X509_KEY_EXCHANGE= 5,
CERT_KERBEROS_TOKENS= 6,
CERT_CRL= 7,
CERT_ARL= 8,
CERT_SPKI= 9,
CERT_X509_ATTRIBUTE= 10,
CERT_RAW_RSA= 11, /* raw RSA from config file */
};
/* a SIG record in ASCII */
struct ipsec_dns_sig {
char fqdn[256];
char dns_sig[768]; /* empty string if not signed */
};
struct ipsec_raw_key {
char id_name[256];
char fs_keyid[8];
};
struct ipsec_identity {
enum ipsec_id_type ii_type;
enum ipsec_cert_type ii_format;
union {
struct ipsec_dns_sig ipsec_dns_signed;
/* some thing for PGP */
/* some thing for PKIX */
struct ipsec_raw_key ipsec_raw_key;
} ii_credential;
};
#define IPSEC_MAX_CREDENTIALS 32
struct ipsec_policy_cmd_query {
struct ipsec_policy_msg_head head;
/* Query section */
ip_address query_local; /* us */
ip_address query_remote; /* them */
u_short src_port, dst_port;
/* Answer section */
enum ipsec_privacy_quality strength;
enum ipsec_bandwidth_quality bandwidth;
enum ipsec_authentication_algo auth_detail;
enum ipsec_cipher_algo esp_detail;
enum ipsec_comp_algo comp_detail;
int credential_count;
struct ipsec_identity credentials[IPSEC_MAX_CREDENTIALS];
};
#define IPSEC_POLICY_SOCKET "/var/run/pluto.info"
/* prototypes */
extern err_t ipsec_policy_lookup(int fd, struct ipsec_policy_cmd_query *result);
extern err_t ipsec_policy_init(void);
extern err_t ipsec_policy_final(void);
extern err_t ipsec_policy_readmsg(int policysock,
unsigned char *buf, size_t buflen);
extern err_t ipsec_policy_sendrecv(unsigned char *buf, size_t buflen);
extern err_t ipsec_policy_cgilookup(struct ipsec_policy_cmd_query *result);
extern const char *ipsec_policy_version_code(void);
extern const char *ipsec_policy_version_string(void);
#endif /* _IPSEC_POLICY_H */
linux/include/freeswan/ipsec_proto.h
+111
View File
@@ -0,0 +1,111 @@
/*
* @(#) prototypes for FreeSWAN functions
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_proto.h,v 1.3 2004/06/13 19:55:14 as Exp $
*
*/
#ifndef _IPSEC_PROTO_H_
#include "ipsec_param.h"
/*
* This file is a kernel only file that declares prototypes for
* all intra-module function calls and global data structures.
*
* Include this file last.
*
*/
/* ipsec_init.c */
extern struct prng ipsec_prng;
/* ipsec_sa.c */
extern struct ipsec_sa *ipsec_sadb_hash[SADB_HASHMOD];
extern spinlock_t tdb_lock;
extern int ipsec_sadb_init(void);
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id*);
extern int ipsec_sa_put(struct ipsec_sa *);
extern /* void */ int ipsec_sa_del(struct ipsec_sa *);
extern /* void */ int ipsec_sa_delchain(struct ipsec_sa *);
extern /* void */ int ipsec_sa_add(struct ipsec_sa *);
extern int ipsec_sadb_cleanup(__u8);
extern int ipsec_sa_wipe(struct ipsec_sa *);
/* debug declarations */
/* ipsec_proc.c */
extern int ipsec_proc_init(void);
extern void ipsec_proc_cleanup(void);
/* ipsec_radij.c */
extern int ipsec_makeroute(struct sockaddr_encap *ea,
struct sockaddr_encap *em,
struct sa_id said,
uint32_t pid,
struct sk_buff *skb,
struct ident *ident_s,
struct ident *ident_d);
extern int ipsec_breakroute(struct sockaddr_encap *ea,
struct sockaddr_encap *em,
struct sk_buff **first,
struct sk_buff **last);
int ipsec_radijinit(void);
int ipsec_cleareroutes(void);
int ipsec_radijcleanup(void);
/* ipsec_life.c */
extern enum ipsec_life_alive ipsec_lifetime_check(struct ipsec_lifetime64 *il64,
const char *lifename,
const char *saname,
enum ipsec_life_type ilt,
enum ipsec_direction idir,
struct ipsec_sa *ips);
extern int ipsec_lifetime_format(char *buffer,
int buflen,
char *lifename,
enum ipsec_life_type timebaselife,
struct ipsec_lifetime64 *lifetime);
extern void ipsec_lifetime_update_hard(struct ipsec_lifetime64 *lifetime,
__u64 newvalue);
extern void ipsec_lifetime_update_soft(struct ipsec_lifetime64 *lifetime,
__u64 newvalue);
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_xform;
extern int debug_eroute;
extern int debug_spi;
extern int debug_netlink;
#endif /* CONFIG_IPSEC_DEBUG */
#define _IPSEC_PROTO_H
#endif /* _IPSEC_PROTO_H_ */
linux/include/freeswan/ipsec_radij.h
+63
View File
@@ -0,0 +1,63 @@
/*
* @(#) Definitions relevant to the IPSEC <> radij tree interfacing
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_radij.h,v 1.3 2004/04/28 05:44:29 as Exp $
*/
#ifndef _IPSEC_RADIJ_H
#include <freeswan.h>
int ipsec_walk(char *);
int ipsec_rj_walker_procprint(struct radij_node *, void *);
int ipsec_rj_walker_delete(struct radij_node *, void *);
/* This structure is used to pass information between
* ipsec_eroute_get_info and ipsec_rj_walker_procprint
* (through rj_walktree) and between calls of ipsec_rj_walker_procprint.
*/
struct wsbuf
{
/* from caller of ipsec_eroute_get_info: */
char *const buffer; /* start of buffer provided */
const int length; /* length of buffer provided */
const off_t offset; /* file position of first character of interest */
/* accumulated by ipsec_rj_walker_procprint: */
int len; /* number of character filled into buffer */
off_t begin; /* file position contained in buffer[0] (<=offset) */
};
extern struct radij_node_head *rnh;
extern spinlock_t eroute_lock;
struct eroute * ipsec_findroute(struct sockaddr_encap *);
#define O1(x) (int)(((x)>>24)&0xff)
#define O2(x) (int)(((x)>>16)&0xff)
#define O3(x) (int)(((x)>>8)&0xff)
#define O4(x) (int)(((x))&0xff)
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_radij;
void rj_dumptrees(void);
#define DB_RJ_DUMPTREES 0x0001
#define DB_RJ_FINDROUTE 0x0002
#endif /* CONFIG_IPSEC_DEBUG */
#define _IPSEC_RADIJ_H
#endif
linux/include/freeswan/ipsec_rcv.h
+196
View File
@@ -0,0 +1,196 @@
/*
*
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_rcv.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#define DB_RX_PKTRX 0x0001
#define DB_RX_PKTRX2 0x0002
#define DB_RX_DMP 0x0004
#define DB_RX_IPSA 0x0010
#define DB_RX_XF 0x0020
#define DB_RX_IPAD 0x0040
#define DB_RX_INAU 0x0080
#define DB_RX_OINFO 0x0100
#define DB_RX_OINFO2 0x0200
#define DB_RX_OH 0x0400
#define DB_RX_REPLAY 0x0800
#ifdef __KERNEL__
/* struct options; */
#define __NO_VERSION__
#include <linux/module.h>
#include <linux/config.h> /* for CONFIG_IP_FORWARD */
#include <linux/version.h>
#include <freeswan.h>
#define IPSEC_BIRTH_TEMPLATE_MAXLEN 256
struct ipsec_birth_reply {
int packet_template_len;
unsigned char packet_template[IPSEC_BIRTH_TEMPLATE_MAXLEN];
};
extern struct ipsec_birth_reply ipsec_ipv4_birth_packet;
extern struct ipsec_birth_reply ipsec_ipv6_birth_packet;
extern int
#ifdef PROTO_HANDLER_SINGLE_PARM
ipsec_rcv(struct sk_buff *skb);
#else /* PROTO_HANDLER_SINGLE_PARM */
ipsec_rcv(struct sk_buff *skb,
#ifdef NET_21
unsigned short xlen);
#else /* NET_21 */
struct device *dev,
struct options *opt,
__u32 daddr,
unsigned short len,
__u32 saddr,
int redo,
struct inet_protocol *protocol);
#endif /* NET_21 */
#endif /* PROTO_HANDLER_SINGLE_PARM */
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_rcv;
#endif /* CONFIG_IPSEC_DEBUG */
extern int sysctl_ipsec_inbound_policy_check;
#endif /* __KERNEL__ */
/*
* $Log: ipsec_rcv.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.17 2002/09/03 16:32:32 mcr
* definitions of ipsec_birth_reply.
*
* Revision 1.16 2002/05/14 02:36:00 rgb
* Change references to _TDB to _IPSA.
*
* Revision 1.15 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_rcv.h,v
*
* Revision 1.14 2001/09/07 22:15:48 rgb
* Fix for removal of transport layer protocol handler arg in 2.4.4.
*
* Revision 1.13 2001/06/14 19:35:09 rgb
* Update copyright date.
*
* Revision 1.12 2001/03/16 07:36:44 rgb
* Fixed #endif comment to sate compiler.
*
* Revision 1.11 2000/09/21 04:34:21 rgb
* Moved declaration of sysctl_ipsec_inbound_policy_check outside
* CONFIG_IPSEC_DEBUG. (MB)
*
* Revision 1.10 2000/09/18 02:36:10 rgb
* Exported sysctl_ipsec_inbound_policy_check for skb_decompress().
*
* Revision 1.9 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.8 1999/11/18 04:09:19 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.7 1999/05/25 01:45:37 rgb
* Fix version macros for 2.0.x as a module.
*
* Revision 1.6 1999/05/08 21:24:27 rgb
* Add includes for 2.2.x include into net/ipv4/protocol.c
*
* Revision 1.5 1999/05/05 22:02:32 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.4 1999/04/11 00:28:59 henry
* GPL boilerplate
*
* Revision 1.3 1999/04/06 04:54:27 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.2 1999/01/22 20:06:59 rgb
* Fixed cut-and-paste error from ipsec_esp.h.
*
* Revision 1.1 1999/01/21 20:29:12 rgb
* Converted from transform switching to algorithm switching.
*
* Log: ipsec_esp.h,v
* Revision 1.4 1998/08/12 00:07:32 rgb
* Added data structures for new xforms: null, {,3}dessha1.
*
* Revision 1.3 1998/07/14 15:57:01 rgb
* Add #ifdef __KERNEL__ to protect kernel-only structures.
*
* Revision 1.2 1998/06/25 19:33:46 rgb
* Add prototype for protocol receive function.
* Rearrange for more logical layout.
*
* Revision 1.1 1998/06/18 21:27:45 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.6 1998/06/05 02:28:08 rgb
* Minor comment fix.
*
* Revision 1.5 1998/05/27 22:34:00 rgb
* Changed structures to accomodate key separation.
*
* Revision 1.4 1998/05/18 22:28:43 rgb
* Disable key printing facilities from /proc/net/ipsec_*.
*
* Revision 1.3 1998/04/21 21:29:07 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.2 1998/04/12 22:03:20 rgb
* Updated ESP-3DES-HMAC-MD5-96,
* ESP-DES-HMAC-MD5-96,
* AH-HMAC-MD5-96,
* AH-HMAC-SHA1-96 since Henry started freeswan cvs repository
* from old standards (RFC182[5-9] to new (as of March 1998) drafts.
*
* Fixed eroute references in /proc/net/ipsec*.
*
* Started to patch module unloading memory leaks in ipsec_netlink and
* radij tree unloading.
*
* Revision 1.1 1998/04/09 03:06:00 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:02 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96 transform.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added definitions for new ESP transforms.
*
* Revision 0.3 1996/11/20 14:35:48 ji
* Minor Cleanup.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_sa.h
+338
View File
@@ -0,0 +1,338 @@
/*
* @(#) Definitions of IPsec Security Association (ipsec_sa)
*
* Copyright (C) 2001, 2002, 2003
* Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_sa.h,v 1.3 2004/04/28 08:07:11 as Exp $
*
* This file derived from ipsec_xform.h on 2001/9/18 by mcr.
*
*/
/*
* This file describes the IPsec Security Association Structure.
*
* This structure keeps track of a single transform that may be done
* to a set of packets. It can describe applying the transform or
* apply the reverse. (e.g. compression vs expansion). However, it
* only describes one at a time. To describe both, two structures would
* be used, but since the sides of the transform are performed
* on different machines typically it is usual to have only one side
* of each association.
*
*/
#ifndef _IPSEC_SA_H_
#ifdef __KERNEL__
#include "ipsec_stats.h"
#include "ipsec_life.h"
#include "ipsec_eroute.h"
#endif /* __KERNEL__ */
#include "ipsec_param.h"
/* SAs are held in a table.
* Entries in this table are referenced by IPsecSAref_t values.
* IPsecSAref_t values are conceptually subscripts. Because
* we want to allocate the table piece-meal, the subscripting
* is implemented with two levels, a bit like paged virtual memory.
* This representation mechanism is known as an Iliffe Vector.
*
* The Main table (AKA the refTable) consists of 2^IPSEC_SA_REF_MAINTABLE_IDX_WIDTH
* pointers to subtables.
* Each subtable has 2^IPSEC_SA_REF_SUBTABLE_IDX_WIDTH entries, each of which
* is a pointer to an SA.
*
* An IPsecSAref_t contains either an exceptional value (signified by the
* high-order bit being on) or a reference to a table entry. A table entry
* reference has the subtable subscript in the low-order
* IPSEC_SA_REF_SUBTABLE_IDX_WIDTH bits and the Main table subscript
* in the next lowest IPSEC_SA_REF_MAINTABLE_IDX_WIDTH bits.
*
* The Maintable entry for an IPsecSAref_t x, a pointer to its subtable, is
* IPsecSAref2table(x). It is of type struct IPsecSArefSubTable *.
*
* The pointer to the SA for x is IPsecSAref2SA(x). It is of type
* struct ipsec_sa*. The macro definition clearly shows the two-level
* access needed to find the SA pointer.
*
* The Maintable is allocated when IPsec is initialized.
* Each subtable is allocated when needed, but the first is allocated
* when IPsec is initialized.
*
* IPsecSAref_t is designed to be smaller than an NFmark so that
* they can be stored in NFmarks and still leave a few bits for other
* purposes. The spare bits are in the low order of the NFmark
* but in the high order of the IPsecSAref_t, so conversion is required.
* We pick the upper bits of NFmark on the theory that they are less likely to
* interfere with more pedestrian uses of nfmark.
*/
typedef unsigned short int IPsecRefTableUnusedCount;
#define IPSEC_SA_REF_TABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_TABLE_IDX_WIDTH)
#ifdef __KERNEL__
#if ((IPSEC_SA_REF_TABLE_IDX_WIDTH - (1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) < 0)
#error "IPSEC_SA_REF_TABLE_IDX_WIDTH("IPSEC_SA_REF_TABLE_IDX_WIDTH") MUST be < 1 + IPSEC_SA_REF_MAINTABLE_IDX_WIDTH("IPSEC_SA_REF_MAINTABLE_IDX_WIDTH")"
#endif
#define IPSEC_SA_REF_SUBTABLE_IDX_WIDTH (IPSEC_SA_REF_TABLE_IDX_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES (1 << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#ifdef CONFIG_NETFILTER
#define IPSEC_SA_REF_HOST_FIELD(x) ((struct sk_buff*)(x))->nfmark
#define IPSEC_SA_REF_HOST_FIELD_TYPE typeof(IPSEC_SA_REF_HOST_FIELD(NULL))
#else /* CONFIG_NETFILTER */
/* just make it work for now, it doesn't matter, since there is no nfmark */
#define IPSEC_SA_REF_HOST_FIELD_TYPE unsigned long
#endif /* CONFIG_NETFILTER */
#define IPSEC_SA_REF_HOST_FIELD_WIDTH (8 * sizeof(IPSEC_SA_REF_HOST_FIELD_TYPE))
#define IPSEC_SA_REF_FIELD_WIDTH (8 * sizeof(IPsecSAref_t))
#define IPSEC_SA_REF_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_TABLE_IDX_WIDTH))
#define IPSEC_SA_REF_TABLE_MASK ((IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_MAINTABLE_IDX_WIDTH)) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#define IPSEC_SA_REF_ENTRY_MASK (IPSEC_SAREF_NULL >> (IPSEC_SA_REF_FIELD_WIDTH - IPSEC_SA_REF_SUBTABLE_IDX_WIDTH))
#define IPsecSAref2table(x) (((x) & IPSEC_SA_REF_TABLE_MASK) >> IPSEC_SA_REF_SUBTABLE_IDX_WIDTH)
#define IPsecSAref2entry(x) ((x) & IPSEC_SA_REF_ENTRY_MASK)
#define IPsecSArefBuild(x,y) (((x) << IPSEC_SA_REF_SUBTABLE_IDX_WIDTH) + (y))
#define IPsecSAref2SA(x) (ipsec_sadb.refTable[IPsecSAref2table(x)]->entry[IPsecSAref2entry(x)])
#define IPsecSA2SAref(x) ((x)->ips_ref)
#define EMT_INBOUND 0x01 /* SA direction, 1=inbound */
/* 'struct ipsec_sa' should be 64bit aligned when allocated. */
struct ipsec_sa
{
IPsecSAref_t ips_ref; /* reference table entry number */
atomic_t ips_refcount; /* reference count for this struct */
struct ipsec_sa *ips_hnext; /* next in hash chain */
struct ipsec_sa *ips_inext; /* pointer to next xform */
struct ipsec_sa *ips_onext; /* pointer to prev xform */
struct ifnet *ips_rcvif; /* related rcv encap interface */
struct sa_id ips_said; /* SA ID */
__u32 ips_seq; /* seq num of msg that initiated this SA */
__u32 ips_pid; /* PID of process that initiated this SA */
__u8 ips_authalg; /* auth algorithm for this SA */
__u8 ips_encalg; /* enc algorithm for this SA */
struct ipsec_stats ips_errs;
__u8 ips_replaywin; /* replay window size */
__u8 ips_state; /* state of SA */
__u32 ips_replaywin_lastseq; /* last pkt sequence num */
__u64 ips_replaywin_bitmap; /* bitmap of received pkts */
__u32 ips_replaywin_maxdiff; /* max pkt sequence difference */
__u32 ips_flags; /* generic xform flags */
struct ipsec_lifetimes ips_life; /* lifetime records */
/* selector information */
struct sockaddr*ips_addr_s; /* src sockaddr */
struct sockaddr*ips_addr_d; /* dst sockaddr */
struct sockaddr*ips_addr_p; /* proxy sockaddr */
__u16 ips_addr_s_size;
__u16 ips_addr_d_size;
__u16 ips_addr_p_size;
ip_address ips_flow_s;
ip_address ips_flow_d;
ip_address ips_mask_s;
ip_address ips_mask_d;
__u16 ips_key_bits_a; /* size of authkey in bits */
__u16 ips_auth_bits; /* size of authenticator in bits */
__u16 ips_key_bits_e; /* size of enckey in bits */
__u16 ips_iv_bits; /* size of IV in bits */
__u8 ips_iv_size;
__u16 ips_key_a_size;
__u16 ips_key_e_size;
caddr_t ips_key_a; /* authentication key */
caddr_t ips_key_e; /* encryption key */
caddr_t ips_iv; /* Initialisation Vector */
struct ident ips_ident_s; /* identity src */
struct ident ips_ident_d; /* identity dst */
#ifdef CONFIG_IPSEC_IPCOMP
__u16 ips_comp_adapt_tries; /* ipcomp self-adaption tries */
__u16 ips_comp_adapt_skip; /* ipcomp self-adaption to-skip */
__u64 ips_comp_ratio_cbytes; /* compressed bytes */
__u64 ips_comp_ratio_dbytes; /* decompressed (or uncompressed) bytes */
#endif /* CONFIG_IPSEC_IPCOMP */
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
__u8 ips_natt_type;
__u8 ips_natt_reserved[3];
__u16 ips_natt_sport;
__u16 ips_natt_dport;
struct sockaddr *ips_natt_oa;
__u16 ips_natt_oa_size;
__u16 ips_natt_reserved2;
#endif
#if 0
__u32 ips_sens_dpd;
__u8 ips_sens_sens_level;
__u8 ips_sens_sens_len;
__u64* ips_sens_sens_bitmap;
__u8 ips_sens_integ_level;
__u8 ips_sens_integ_len;
__u64* ips_sens_integ_bitmap;
#endif
struct ipsec_alg_enc *ips_alg_enc;
struct ipsec_alg_auth *ips_alg_auth;
IPsecSAref_t ips_ref_rel;
};
struct IPsecSArefSubTable
{
struct ipsec_sa* entry[IPSEC_SA_REF_SUBTABLE_NUM_ENTRIES];
};
struct ipsec_sadb {
struct IPsecSArefSubTable* refTable[IPSEC_SA_REF_MAINTABLE_NUM_ENTRIES];
IPsecSAref_t refFreeList[IPSEC_SA_REF_FREELIST_NUM_ENTRIES];
int refFreeListHead;
int refFreeListTail;
IPsecSAref_t refFreeListCont;
IPsecSAref_t said_hash[SADB_HASHMOD];
spinlock_t sadb_lock;
};
extern struct ipsec_sadb ipsec_sadb;
extern int ipsec_SAref_recycle(void);
extern int ipsec_SArefSubTable_alloc(unsigned table);
extern int ipsec_saref_freelist_init(void);
extern int ipsec_sadb_init(void);
extern struct ipsec_sa *ipsec_sa_alloc(int*error); /* pass in error var by pointer */
extern IPsecSAref_t ipsec_SAref_alloc(int*erorr); /* pass in error var by pointer */
extern int ipsec_sa_free(struct ipsec_sa* ips);
extern struct ipsec_sa *ipsec_sa_getbyid(struct sa_id *said);
extern int ipsec_sa_put(struct ipsec_sa *ips);
extern int ipsec_sa_add(struct ipsec_sa *ips);
extern int ipsec_sa_del(struct ipsec_sa *ips);
extern int ipsec_sa_delchain(struct ipsec_sa *ips);
extern int ipsec_sadb_cleanup(__u8 proto);
extern int ipsec_sadb_free(void);
extern int ipsec_sa_wipe(struct ipsec_sa *ips);
#endif /* __KERNEL__ */
enum ipsec_direction {
ipsec_incoming = 1,
ipsec_outgoing = 2
};
#define _IPSEC_SA_H_
#endif /* _IPSEC_SA_H_ */
/*
* $Log: ipsec_sa.h,v $
* Revision 1.3 2004/04/28 08:07:11 as
* added dhr's freeswan-2.06 changes
*
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.2.1.2.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1.2.1 2004/03/15 22:30:06 as
* nat-0.6c patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.15 2003/05/11 00:53:09 mcr
* IPsecSAref_t and macros were moved to freeswan.h.
*
* Revision 1.14 2003/02/12 19:31:55 rgb
* Fixed bug in "file seen" machinery.
* Updated copyright year.
*
* Revision 1.13 2003/01/30 02:31:52 rgb
*
* Re-wrote comments describing SAref system for accuracy.
* Rename SAref table macro names for clarity.
* Convert IPsecSAref_t from signed to unsigned to fix apparent SAref exhaustion bug.
* Transmit error code through to caller from callee for better diagnosis of problems.
* Enclose all macro arguments in parens to avoid any possible obscrure bugs.
*
* Revision 1.12 2002/10/07 18:31:19 rgb
* Change comment to reflect the flexible nature of the main and sub-table widths.
* Added a counter for the number of unused entries in each subtable.
* Further break up host field type macro to host field.
* Move field width sanity checks to ipsec_sa.c
* Define a mask for an entire saref.
*
* Revision 1.11 2002/09/20 15:40:33 rgb
* Re-write most of the SAref macros and types to eliminate any pointer references to Entrys.
* Fixed SAref/nfmark macros.
* Rework saref freeslist.
* Place all ipsec sadb globals into one struct.
* Restrict some bits to kernel context for use to klips utils.
*
* Revision 1.10 2002/09/20 05:00:34 rgb
* Update copyright date.
*
* Revision 1.9 2002/09/17 17:19:29 mcr
* make it compile even if there is no netfilter - we lost
* functionality, but it works, especially on 2.2.
*
* Revision 1.8 2002/07/28 22:59:53 mcr
* clarified/expanded one comment.
*
* Revision 1.7 2002/07/26 08:48:31 rgb
* Added SA ref table code.
*
* Revision 1.6 2002/05/31 17:27:48 rgb
* Comment fix.
*
* Revision 1.5 2002/05/27 18:55:03 rgb
* Remove final vistiges of tdb references via IPSEC_KLIPS1_COMPAT.
*
* Revision 1.4 2002/05/23 07:13:36 rgb
* Convert "usecount" to "refcount" to remove ambiguity.
*
* Revision 1.3 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_sa.h,v
*
* Revision 1.2 2001/11/26 09:16:15 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.1.2.1 2001/09/25 02:24:58 mcr
* struct tdb -> struct ipsec_sa.
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
* ipsec_xform.c removed. header file still contains useful things.
*
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_sha1.h
+79
View File
@@ -0,0 +1,79 @@
/*
* RCSID $Id: ipsec_sha1.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* Here is the original comment from the distribution:
SHA-1 in C
By Steve Reid <[email protected]>
100% Public Domain
* Adapted for use by the IPSEC code by John Ioannidis
*/
#ifndef _IPSEC_SHA1_H_
#define _IPSEC_SHA1_H_
typedef struct
{
__u32 state[5];
__u32 count[2];
__u8 buffer[64];
} SHA1_CTX;
void SHA1Transform(__u32 state[5], __u8 buffer[64]);
void SHA1Init(void *context);
void SHA1Update(void *context, unsigned char *data, __u32 len);
void SHA1Final(unsigned char digest[20], void *context);
#endif /* _IPSEC_SHA1_H_ */
/*
* $Log: ipsec_sha1.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.7 2002/09/10 01:45:09 mcr
* changed type of MD5_CTX and SHA1_CTX to void * so that
* the function prototypes would match, and could be placed
* into a pointer to a function.
*
* Revision 1.6 2002/04/24 07:36:47 mcr
* Moved from ./klips/net/ipsec/ipsec_sha1.h,v
*
* Revision 1.5 1999/12/13 13:59:13 rgb
* Quick fix to argument size to Update bugs.
*
* Revision 1.4 1999/12/07 18:16:23 rgb
* Fixed comments at end of #endif lines.
*
* Revision 1.3 1999/04/06 04:54:27 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.2 1998/11/30 13:22:54 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.1 1998/06/18 21:27:50 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.2 1998/04/23 20:54:05 rgb
* Fixed md5 and sha1 include file nesting issues, to be cleaned up when
* verified.
*
* Revision 1.1 1998/04/09 03:04:21 henry
* sources moved up from linux/net/ipsec
* these two include files modified not to include others except in kernel
*
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* New transform
*
*/
linux/include/freeswan/ipsec_stats.h
+38
View File
@@ -0,0 +1,38 @@
/*
* @(#) definition of ipsec_stats structure
*
* Copyright (C) 2001 Richard Guy Briggs <[email protected]>
* and Michael Richardson <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_stats.h,v 1.2 2004/03/30 19:33:52 as Exp $
*
*/
/*
* This file describes the errors/statistics that FreeSWAN collects.
*/
#ifndef _IPSEC_STATS_H_
struct ipsec_stats {
__u32 ips_alg_errs; /* number of algorithm errors */
__u32 ips_auth_errs; /* # of authentication errors */
__u32 ips_encsize_errs; /* # of encryption size errors*/
__u32 ips_encpad_errs; /* # of encryption pad errors*/
__u32 ips_replaywin_errs; /* # of pkt sequence errors */
};
extern int ipsec_snprintf(char * buf, ssize_t size, const char *fmt, ...);
#define _IPSEC_STATS_H_
#endif /* _IPSEC_STATS_H_ */
linux/include/freeswan/ipsec_tunnel.h
+265
View File
@@ -0,0 +1,265 @@
/*
* IPSEC tunneling code
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_tunnel.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
#ifdef NET_21
# define DEV_QUEUE_XMIT(skb, device, pri) {\
skb->dev = device; \
neigh_compat_output(skb); \
/* skb->dst->output(skb); */ \
}
# define ICMP_SEND(skb_in, type, code, info, dev) \
icmp_send(skb_in, type, code, htonl(info))
# define IP_SEND(skb, dev) \
ip_send(skb);
#else /* NET_21 */
# define DEV_QUEUE_XMIT(skb, device, pri) {\
dev_queue_xmit(skb, device, pri); \
}
# define ICMP_SEND(skb_in, type, code, info, dev) \
icmp_send(skb_in, type, code, info, dev)
# define IP_SEND(skb, dev) \
if(ntohs(iph->tot_len) > physmtu) { \
ip_fragment(NULL, skb, dev, 0); \
ipsec_kfree_skb(skb); \
} else { \
dev_queue_xmit(skb, dev, SOPRI_NORMAL); \
}
#endif /* NET_21 */
/*
* Heavily based on drivers/net/new_tunnel.c. Lots
* of ideas also taken from the 2.1.x version of drivers/net/shaper.c
*/
struct ipsectunnelconf
{
__u32 cf_cmd;
union
{
char cfu_name[12];
} cf_u;
#define cf_name cf_u.cfu_name
};
#define IPSEC_SET_DEV (SIOCDEVPRIVATE)
#define IPSEC_DEL_DEV (SIOCDEVPRIVATE + 1)
#define IPSEC_CLR_DEV (SIOCDEVPRIVATE + 2)
#ifdef __KERNEL__
#include <linux/version.h>
#ifndef KERNEL_VERSION
# define KERNEL_VERSION(x,y,z) (((x)<<16)+((y)<<8)+(z))
#endif
struct ipsecpriv
{
struct sk_buff_head sendq;
struct device *dev;
struct wait_queue *wait_queue;
char locked;
int (*hard_start_xmit) (struct sk_buff *skb,
struct device *dev);
int (*hard_header) (struct sk_buff *skb,
struct device *dev,
unsigned short type,
void *daddr,
void *saddr,
unsigned len);
#ifdef NET_21
int (*rebuild_header)(struct sk_buff *skb);
#else /* NET_21 */
int (*rebuild_header)(void *buff, struct device *dev,
unsigned long raddr, struct sk_buff *skb);
#endif /* NET_21 */
int (*set_mac_address)(struct device *dev, void *addr);
#ifndef NET_21
void (*header_cache_bind)(struct hh_cache **hhp, struct device *dev,
unsigned short htype, __u32 daddr);
#endif /* !NET_21 */
void (*header_cache_update)(struct hh_cache *hh, struct device *dev, unsigned char * haddr);
struct net_device_stats *(*get_stats)(struct device *dev);
struct net_device_stats mystats;
int mtu; /* What is the desired MTU? */
};
extern char ipsec_tunnel_c_version[];
extern struct device *ipsecdevices[IPSEC_NUM_IF];
int ipsec_tunnel_init_devices(void);
/* void */ int ipsec_tunnel_cleanup_devices(void);
extern /* void */ int ipsec_init(void);
extern int ipsec_tunnel_start_xmit(struct sk_buff *skb, struct device *dev);
#ifdef CONFIG_IPSEC_DEBUG
extern int debug_tunnel;
extern int sysctl_ipsec_debug_verbose;
#endif /* CONFIG_IPSEC_DEBUG */
#endif /* __KERNEL__ */
#ifdef CONFIG_IPSEC_DEBUG
#define DB_TN_INIT 0x0001
#define DB_TN_PROCFS 0x0002
#define DB_TN_XMIT 0x0010
#define DB_TN_OHDR 0x0020
#define DB_TN_CROUT 0x0040
#define DB_TN_OXFS 0x0080
#define DB_TN_REVEC 0x0100
#endif /* CONFIG_IPSEC_DEBUG */
/*
* $Log: ipsec_tunnel.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.28 2003/06/24 20:22:32 mcr
* added new global: ipsecdevices[] so that we can keep track of
* the ipsecX devices. They will be referenced with dev_hold(),
* so 2.2 may need this as well.
*
* Revision 1.27 2003/04/03 17:38:09 rgb
* Centralised ipsec_kfree_skb and ipsec_dev_{get,put}.
*
* Revision 1.26 2003/02/12 19:32:20 rgb
* Updated copyright year.
*
* Revision 1.25 2002/05/27 18:56:07 rgb
* Convert to dynamic ipsec device allocation.
*
* Revision 1.24 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/ipsec_tunnel.h,v
*
* Revision 1.23 2001/11/06 19:50:44 rgb
* Moved IP_SEND, ICMP_SEND, DEV_QUEUE_XMIT macros to ipsec_tunnel.h for
* use also by pfkey_v2_parser.c
*
* Revision 1.22 2001/09/15 16:24:05 rgb
* Re-inject first and last HOLD packet when an eroute REPLACE is done.
*
* Revision 1.21 2001/06/14 19:35:10 rgb
* Update copyright date.
*
* Revision 1.20 2000/09/15 11:37:02 rgb
* Merge in heavily modified Svenning Soerensen's <[email protected]>
* IPCOMP zlib deflate code.
*
* Revision 1.19 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.18 2000/07/28 13:50:54 rgb
* Changed enet_statistics to net_device_stats and added back compatibility
* for pre-2.1.19.
*
* Revision 1.17 1999/11/19 01:12:15 rgb
* Purge unneeded proc_info prototypes, now that static linking uses
* dynamic proc_info registration.
*
* Revision 1.16 1999/11/18 18:51:00 rgb
* Changed all device registrations for static linking to
* dynamic to reduce the number and size of patches.
*
* Revision 1.15 1999/11/18 04:14:21 rgb
* Replaced all kernel version macros to shorter, readable form.
* Added CONFIG_PROC_FS compiler directives in case it is shut off.
* Added Marc Boucher's 2.3.25 proc patches.
*
* Revision 1.14 1999/05/25 02:50:10 rgb
* Fix kernel version macros for 2.0.x static linking.
*
* Revision 1.13 1999/05/25 02:41:06 rgb
* Add ipsec_klipsdebug support for static linking.
*
* Revision 1.12 1999/05/05 22:02:32 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.11 1999/04/29 15:19:50 rgb
* Add return values to init and cleanup functions.
*
* Revision 1.10 1999/04/16 16:02:39 rgb
* Bump up macro to 4 ipsec I/Fs.
*
* Revision 1.9 1999/04/15 15:37:25 rgb
* Forward check changes from POST1_00 branch.
*
* Revision 1.5.2.1 1999/04/02 04:26:14 rgb
* Backcheck from HEAD, pre1.0.
*
* Revision 1.8 1999/04/11 00:29:01 henry
* GPL boilerplate
*
* Revision 1.7 1999/04/06 04:54:28 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.6 1999/03/31 05:44:48 rgb
* Keep PMTU reduction private.
*
* Revision 1.5 1999/02/10 22:31:20 rgb
* Change rebuild_header member to reflect generality of link layer.
*
* Revision 1.4 1998/12/01 13:22:04 rgb
* Added support for debug printing of version info.
*
* Revision 1.3 1998/07/29 20:42:46 rgb
* Add a macro for clearing all tunnel devices.
* Rearrange structures and declarations for sharing with userspace.
*
* Revision 1.2 1998/06/25 20:01:45 rgb
* Make prototypes available for ipsec_init and ipsec proc_dir_entries
* for static linking.
*
* Revision 1.1 1998/06/18 21:27:50 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.3 1998/05/18 21:51:50 rgb
* Added macros for num of I/F's and a procfs debug switch.
*
* Revision 1.2 1998/04/21 21:29:09 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:06:13 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:05 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added transport mode.
* Changed the way routing is done.
* Lots of bug fixes.
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:39:04 ji
* Minor cleanups.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/freeswan/ipsec_xform.h
+274
View File
@@ -0,0 +1,274 @@
/*
* Definitions relevant to IPSEC transformations
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_xform.h,v 1.3 2004/09/29 22:26:13 as Exp $
*/
#ifndef _IPSEC_XFORM_H_
#include <freeswan.h>
#include "ipsec_policy.h"
#define XF_NONE 0 /* No transform set */
#define XF_IP4 1 /* IPv4 inside IPv4 */
#define XF_AHMD5 2 /* AH MD5 */
#define XF_AHSHA 3 /* AH SHA */
#define XF_ESP3DES 5 /* ESP DES3-CBC */
#define XF_AHHMACMD5 6 /* AH-HMAC-MD5 with opt replay prot */
#define XF_AHHMACSHA1 7 /* AH-HMAC-SHA1 with opt replay prot */
#define XF_ESP3DESMD5 9 /* triple DES, HMAC-MD-5, 128-bits of authentication */
#define XF_ESP3DESMD596 10 /* triple DES, HMAC-MD-5, 96-bits of authentication */
#define XF_ESPNULLMD596 12 /* NULL, HMAC-MD-5 with 96-bits of authentication */
#define XF_ESPNULLSHA196 13 /* NULL, HMAC-SHA-1 with 96-bits of authentication */
#define XF_ESP3DESSHA196 14 /* triple DES, HMAC-SHA-1, 96-bits of authentication */
#define XF_IP6 15 /* IPv6 inside IPv6 */
#define XF_COMPDEFLATE 16 /* IPCOMP deflate */
#define XF_CLR 126 /* Clear SA table */
#define XF_DEL 127 /* Delete SA */
#define XFT_AUTH 0x0001
#define XFT_CONF 0x0100
/* available if CONFIG_IPSEC_DEBUG is defined */
#define DB_XF_INIT 0x0001
#define PROTO2TXT(x) \
(x) == IPPROTO_AH ? "AH" : \
(x) == IPPROTO_ESP ? "ESP" : \
(x) == IPPROTO_IPIP ? "IPIP" : \
(x) == IPPROTO_COMP ? "COMP" : \
"UNKNOWN_proto"
static inline const char *enc_name_id (unsigned id) {
static char buf[16];
snprintf(buf, sizeof(buf), "_ID%d", id);
return buf;
}
static inline const char *auth_name_id (unsigned id) {
static char buf[16];
snprintf(buf, sizeof(buf), "_ID%d", id);
return buf;
}
#define IPS_XFORM_NAME(x) \
PROTO2TXT((x)->ips_said.proto), \
(x)->ips_said.proto == IPPROTO_COMP ? \
((x)->ips_encalg == SADB_X_CALG_DEFLATE ? \
"_DEFLATE" : "_UNKNOWN_comp") : \
(x)->ips_encalg == ESP_NONE ? "" : \
(x)->ips_encalg == ESP_3DES ? "_3DES" : \
(x)->ips_encalg == ESP_AES ? "_AES" : \
(x)->ips_encalg == ESP_SERPENT ? "_SERPENT" : \
(x)->ips_encalg == ESP_TWOFISH ? "_TWOFISH" : \
enc_name_id(x->ips_encalg)/* "_UNKNOWN_encr" */, \
(x)->ips_authalg == AH_NONE ? "" : \
(x)->ips_authalg == AH_MD5 ? "_HMAC_MD5" : \
(x)->ips_authalg == AH_SHA ? "_HMAC_SHA1" : \
(x)->ips_authalg == AH_SHA2_256 ? "_HMAC_SHA2_256" : \
(x)->ips_authalg == AH_SHA2_384 ? "_HMAC_SHA2_384" : \
(x)->ips_authalg == AH_SHA2_512 ? "_HMAC_SHA2_512" : \
auth_name_id(x->ips_authalg) /* "_UNKNOWN_auth" */ \
#define _IPSEC_XFORM_H_
#endif /* _IPSEC_XFORM_H_ */
/*
* $Log: ipsec_xform.h,v $
* Revision 1.3 2004/09/29 22:26:13 as
* included ipsec_policy.h
*
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.4.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.36 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/ipsec_xform.h,v
*
* Revision 1.35 2001/11/26 09:23:51 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.33.2.1 2001/09/25 02:24:58 mcr
* struct tdb -> struct ipsec_sa.
* sa(tdb) manipulation functions renamed and moved to ipsec_sa.c
* ipsec_xform.c removed. header file still contains useful things.
*
* Revision 1.34 2001/11/06 19:47:17 rgb
* Changed lifetime_packets to uint32 from uint64.
*
* Revision 1.33 2001/09/08 21:13:34 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.32 2001/07/06 07:40:01 rgb
* Reformatted for readability.
* Added inbound policy checking fields for use with IPIP SAs.
*
* Revision 1.31 2001/06/14 19:35:11 rgb
* Update copyright date.
*
* Revision 1.30 2001/05/30 08:14:03 rgb
* Removed vestiges of esp-null transforms.
*
* Revision 1.29 2001/01/30 23:42:47 rgb
* Allow pfkey msgs from pid other than user context required for ACQUIRE
* and subsequent ADD or UDATE.
*
* Revision 1.28 2000/11/06 04:30:40 rgb
* Add Svenning's adaptive content compression.
*
* Revision 1.27 2000/09/19 00:38:25 rgb
* Fixed algorithm name bugs introduced for ipcomp.
*
* Revision 1.26 2000/09/17 21:36:48 rgb
* Added proto2txt macro.
*
* Revision 1.25 2000/09/17 18:56:47 rgb
* Added IPCOMP support.
*
* Revision 1.24 2000/09/12 19:34:12 rgb
* Defined XF_IP6 from Gerhard for ipv6 tunnel support.
*
* Revision 1.23 2000/09/12 03:23:14 rgb
* Cleaned out now unused tdb_xform and tdb_xdata members of struct tdb.
*
* Revision 1.22 2000/09/08 19:12:56 rgb
* Change references from DEBUG_IPSEC to CONFIG_IPSEC_DEBUG.
*
* Revision 1.21 2000/09/01 18:32:43 rgb
* Added (disabled) sensitivity members to tdb struct.
*
* Revision 1.20 2000/08/30 05:31:01 rgb
* Removed all the rest of the references to tdb_spi, tdb_proto, tdb_dst.
* Kill remainder of tdb_xform, tdb_xdata, xformsw.
*
* Revision 1.19 2000/08/01 14:51:52 rgb
* Removed _all_ remaining traces of DES.
*
* Revision 1.18 2000/01/21 06:17:45 rgb
* Tidied up spacing.
*
* Revision 1.17 1999/11/17 15:53:40 rgb
* Changed all occurrences of #include "../../../lib/freeswan.h"
* to #include <freeswan.h> which works due to -Ilibfreeswan in the
* klips/net/ipsec/Makefile.
*
* Revision 1.16 1999/10/16 04:23:07 rgb
* Add stats for replaywin_errs, replaywin_max_sequence_difference,
* authentication errors, encryption size errors, encryption padding
* errors, and time since last packet.
*
* Revision 1.15 1999/10/16 00:29:11 rgb
* Added SA lifetime packet counting variables.
*
* Revision 1.14 1999/10/01 00:04:14 rgb
* Added tdb structure locking.
* Add function to initialize tdb hash table.
*
* Revision 1.13 1999/04/29 15:20:57 rgb
* dd return values to init and cleanup functions.
* Eliminate unnessessary usage of tdb_xform member to further switch
* away from the transform switch to the algorithm switch.
* Change gettdb parameter to a pointer to reduce stack loading and
* facilitate parameter sanity checking.
* Add a parameter to tdbcleanup to be able to delete a class of SAs.
*
* Revision 1.12 1999/04/15 15:37:25 rgb
* Forward check changes from POST1_00 branch.
*
* Revision 1.9.2.2 1999/04/13 20:35:57 rgb
* Fix spelling mistake in comment.
*
* Revision 1.9.2.1 1999/03/30 17:13:52 rgb
* Extend struct tdb to support pfkey.
*
* Revision 1.11 1999/04/11 00:29:01 henry
* GPL boilerplate
*
* Revision 1.10 1999/04/06 04:54:28 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.9 1999/01/26 02:09:31 rgb
* Removed CONFIG_IPSEC_ALGO_SWITCH macro.
* Removed dead code.
*
* Revision 1.8 1999/01/22 06:29:35 rgb
* Added algorithm switch code.
* Cruft clean-out.
*
* Revision 1.7 1998/11/10 05:37:35 rgb
* Add support for SA direction flag.
*
* Revision 1.6 1998/10/19 14:44:29 rgb
* Added inclusion of freeswan.h.
* sa_id structure implemented and used: now includes protocol.
*
* Revision 1.5 1998/08/12 00:12:30 rgb
* Added macros for new xforms. Added prototypes for new xforms.
*
* Revision 1.4 1998/07/28 00:04:20 rgb
* Add macro for clearing the SA table.
*
* Revision 1.3 1998/07/14 18:06:46 rgb
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.2 1998/06/23 03:02:19 rgb
* Created a prototype for ipsec_tdbcleanup when it was moved from
* ipsec_init.c.
*
* Revision 1.1 1998/06/18 21:27:51 henry
* move sources from klips/src to klips/net/ipsec, to keep stupid
* kernel-build scripts happier in the presence of symlinks
*
* Revision 1.4 1998/06/11 05:55:31 rgb
* Added transform version string pointer to xformsw structure definition.
* Added extern declarations for transform version strings.
*
* Revision 1.3 1998/05/18 22:02:54 rgb
* Modify the *_zeroize function prototypes to include one parameter.
*
* Revision 1.2 1998/04/21 21:29:08 rgb
* Rearrange debug switches to change on the fly debug output from user
* space. Only kernel changes checked in at this time. radij.c was also
* changed to temporarily remove buggy debugging code in rj_delete causing
* an OOPS and hence, netlink device open errors.
*
* Revision 1.1 1998/04/09 03:06:14 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:06 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.5 1997/06/03 04:24:48 ji
* Added ESP-3DES-MD5-96
*
* Revision 0.4 1997/01/15 01:28:15 ji
* Added new transforms.
*
* Revision 0.3 1996/11/20 14:39:04 ji
* Minor cleanups.
* Rationalized debugging code.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
* Local variables:
* c-file-style: "linux"
* End:
*
*/
linux/include/freeswan/ipsec_xmit.h
+140
View File
@@ -0,0 +1,140 @@
/*
* IPSEC tunneling code
* Copyright (C) 1996, 1997 John Ioannidis.
* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: ipsec_xmit.h,v 1.3 2004/06/13 19:37:07 as Exp $
*/
#include "freeswan/ipsec_sa.h"
enum ipsec_xmit_value
{
IPSEC_XMIT_STOLEN=2,
IPSEC_XMIT_PASS=1,
IPSEC_XMIT_OK=0,
IPSEC_XMIT_ERRMEMALLOC=-1,
IPSEC_XMIT_ESP_BADALG=-2,
IPSEC_XMIT_BADPROTO=-3,
IPSEC_XMIT_ESP_PUSHPULLERR=-4,
IPSEC_XMIT_BADLEN=-5,
IPSEC_XMIT_AH_BADALG=-6,
IPSEC_XMIT_SAIDNOTFOUND=-7,
IPSEC_XMIT_SAIDNOTLIVE=-8,
IPSEC_XMIT_REPLAYROLLED=-9,
IPSEC_XMIT_LIFETIMEFAILED=-10,
IPSEC_XMIT_CANNOTFRAG=-11,
IPSEC_XMIT_MSSERR=-12,
IPSEC_XMIT_ERRSKBALLOC=-13,
IPSEC_XMIT_ENCAPFAIL=-14,
IPSEC_XMIT_NODEV=-15,
IPSEC_XMIT_NOPRIVDEV=-16,
IPSEC_XMIT_NOPHYSDEV=-17,
IPSEC_XMIT_NOSKB=-18,
IPSEC_XMIT_NOIPV6=-19,
IPSEC_XMIT_NOIPOPTIONS=-20,
IPSEC_XMIT_TTLEXPIRED=-21,
IPSEC_XMIT_BADHHLEN=-22,
IPSEC_XMIT_PUSHPULLERR=-23,
IPSEC_XMIT_ROUTEERR=-24,
IPSEC_XMIT_RECURSDETECT=-25,
IPSEC_XMIT_IPSENDFAILURE=-26,
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
IPSEC_XMIT_ESPUDP=-27,
#endif
};
struct ipsec_xmit_state
{
struct sk_buff *skb; /* working skb pointer */
struct device *dev; /* working dev pointer */
struct ipsecpriv *prv; /* Our device' private space */
struct sk_buff *oskb; /* Original skb pointer */
struct net_device_stats *stats; /* This device's statistics */
struct iphdr *iph; /* Our new IP header */
__u32 newdst; /* The other SG's IP address */
__u32 orgdst; /* Original IP destination address */
__u32 orgedst; /* 1st SG's IP address */
__u32 newsrc; /* The new source SG's IP address */
__u32 orgsrc; /* Original IP source address */
__u32 innersrc; /* Innermost IP source address */
int iphlen; /* IP header length */
int pyldsz; /* upper protocol payload size */
int headroom;
int tailroom;
int max_headroom; /* The extra header space needed */
int max_tailroom; /* The extra stuffing needed */
int ll_headroom; /* The extra link layer hard_header space needed */
int tot_headroom; /* The total header space needed */
int tot_tailroom; /* The totalstuffing needed */
__u8 *saved_header; /* saved copy of the hard header */
unsigned short sport, dport;
struct sockaddr_encap matcher; /* eroute search key */
struct eroute *eroute;
struct ipsec_sa *ipsp, *ipsq; /* ipsec_sa pointers */
char sa_txt[SATOA_BUF];
size_t sa_len;
int hard_header_stripped; /* has the hard header been removed yet? */
int hard_header_len;
struct device *physdev;
/* struct device *virtdev; */
short physmtu;
short mtudiff;
#ifdef NET_21
struct rtable *route;
#endif /* NET_21 */
struct sa_id outgoing_said;
#ifdef NET_21
int pass;
#endif /* NET_21 */
int error;
uint32_t eroute_pid;
struct ipsec_sa ips;
#ifdef CONFIG_IPSEC_NAT_TRAVERSAL
uint8_t natt_type;
uint8_t natt_head;
uint16_t natt_sport;
uint16_t natt_dport;
#endif
};
#if 0 /* save for alg refactorisation */
struct xform_functions
{
enum ipsec_xmit_value (*checks)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb);
enum ipsec_xmit_value (*encrypt)(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value (*setup_auth)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb,
__u32 *replay,
unsigned char **authenticator);
enum ipsec_xmit_value (*calc_auth)(struct ipsec_xmit_state *ixs,
struct sk_buff *skb);
};
#endif
enum ipsec_xmit_value
ipsec_xmit_sanity_check_dev(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value
ipsec_xmit_sanity_check_skb(struct ipsec_xmit_state *ixs);
enum ipsec_xmit_value
ipsec_xmit_encap_bundle(struct ipsec_xmit_state *ixs);
extern int ipsec_xmit_trap_count;
extern int ipsec_xmit_trap_sendcount;
extern void ipsec_extract_ports(struct iphdr * iph, struct sockaddr_encap * er);
linux/include/freeswan/radij.h
+280
View File
@@ -0,0 +1,280 @@
/*
* RCSID $Id: radij.h,v 1.1 2004/03/15 20:35:25 as Exp $
*/
/*
* This file is defived from ${SRC}/sys/net/radix.h of BSD 4.4lite
*
* Variable and procedure names have been modified so that they don't
* conflict with the original BSD code, as a small number of modifications
* have been introduced and we may want to reuse this code in BSD.
*
* The `j' in `radij' is pronounced as a voiceless guttural (like a Greek
* chi or a German ch sound (as `doch', not as in `milch'), or even a
* spanish j as in Juan. It is not as far back in the throat like
* the corresponding Hebrew sound, nor is it a soft breath like the English h.
* It has nothing to do with the Dutch ij sound.
*
* Here is the appropriate copyright notice:
*/
/*
* Copyright (c) 1988, 1989, 1993
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by the University of
* California, Berkeley and its contributors.
* 4. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* @(#)radix.h 8.1 (Berkeley) 6/10/93
*/
#ifndef _RADIJ_H_
#define _RADIJ_H_
/*
#define RJ_DEBUG
*/
#ifdef __KERNEL__
#ifndef __P
#ifdef __STDC__
#define __P(x) x
#else
#define __P(x) ()
#endif
#endif
/*
* Radix search tree node layout.
*/
struct radij_node
{
struct radij_mask *rj_mklist; /* list of masks contained in subtree */
struct radij_node *rj_p; /* parent */
short rj_b; /* bit offset; -1-index(netmask) */
char rj_bmask; /* node: mask for bit test*/
u_char rj_flags; /* enumerated next */
#define RJF_NORMAL 1 /* leaf contains normal route */
#define RJF_ROOT 2 /* leaf is root leaf for tree */
#define RJF_ACTIVE 4 /* This node is alive (for rtfree) */
union {
struct { /* leaf only data: */
caddr_t rj_Key; /* object of search */
caddr_t rj_Mask; /* netmask, if present */
struct radij_node *rj_Dupedkey;
} rj_leaf;
struct { /* node only data: */
int rj_Off; /* where to start compare */
struct radij_node *rj_L;/* progeny */
struct radij_node *rj_R;/* progeny */
}rj_node;
} rj_u;
#ifdef RJ_DEBUG
int rj_info;
struct radij_node *rj_twin;
struct radij_node *rj_ybro;
#endif
};
#define rj_dupedkey rj_u.rj_leaf.rj_Dupedkey
#define rj_key rj_u.rj_leaf.rj_Key
#define rj_mask rj_u.rj_leaf.rj_Mask
#define rj_off rj_u.rj_node.rj_Off
#define rj_l rj_u.rj_node.rj_L
#define rj_r rj_u.rj_node.rj_R
/*
* Annotations to tree concerning potential routes applying to subtrees.
*/
extern struct radij_mask {
short rm_b; /* bit offset; -1-index(netmask) */
char rm_unused; /* cf. rj_bmask */
u_char rm_flags; /* cf. rj_flags */
struct radij_mask *rm_mklist; /* more masks to try */
caddr_t rm_mask; /* the mask */
int rm_refs; /* # of references to this struct */
} *rj_mkfreelist;
#define MKGet(m) {\
if (rj_mkfreelist) {\
m = rj_mkfreelist; \
rj_mkfreelist = (m)->rm_mklist; \
} else \
R_Malloc(m, struct radij_mask *, sizeof (*(m))); }\
#define MKFree(m) { (m)->rm_mklist = rj_mkfreelist; rj_mkfreelist = (m);}
struct radij_node_head {
struct radij_node *rnh_treetop;
int rnh_addrsize; /* permit, but not require fixed keys */
int rnh_pktsize; /* permit, but not require fixed keys */
#if 0
struct radij_node *(*rnh_addaddr) /* add based on sockaddr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
#endif
int (*rnh_addaddr) /* add based on sockaddr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
struct radij_node *(*rnh_addpkt) /* add based on packet hdr */
__P((void *v, void *mask,
struct radij_node_head *head, struct radij_node nodes[]));
#if 0
struct radij_node *(*rnh_deladdr) /* remove based on sockaddr */
__P((void *v, void *mask, struct radij_node_head *head));
#endif
int (*rnh_deladdr) /* remove based on sockaddr */
__P((void *v, void *mask, struct radij_node_head *head, struct radij_node **node));
struct radij_node *(*rnh_delpkt) /* remove based on packet hdr */
__P((void *v, void *mask, struct radij_node_head *head));
struct radij_node *(*rnh_matchaddr) /* locate based on sockaddr */
__P((void *v, struct radij_node_head *head));
struct radij_node *(*rnh_matchpkt) /* locate based on packet hdr */
__P((void *v, struct radij_node_head *head));
int (*rnh_walktree) /* traverse tree */
__P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
struct radij_node rnh_nodes[3]; /* empty tree for common case */
};
#define Bcmp(a, b, n) memcmp(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
#define Bcopy(a, b, n) memmove(((caddr_t)(b)), ((caddr_t)(a)), (unsigned)(n))
#define Bzero(p, n) memset((caddr_t)(p), 0, (unsigned)(n))
#define R_Malloc(p, t, n) ((p = (t) kmalloc((size_t)(n), GFP_ATOMIC)), Bzero((p),(n)))
#define Free(p) kfree((caddr_t)p);
void rj_init __P((void));
int rj_inithead __P((void **, int));
int rj_refines __P((void *, void *));
int rj_walktree __P((struct radij_node_head *head, int (*f)(struct radij_node *rn, void *w), void *w));
struct radij_node
*rj_addmask __P((void *, int, int)) /* , rgb */ ;
int /* * */ rj_addroute __P((void *, void *, struct radij_node_head *,
struct radij_node [2])) /* , rgb */ ;
int /* * */ rj_delete __P((void *, void *, struct radij_node_head *, struct radij_node **)) /* , rgb */ ;
struct radij_node /* rgb */
*rj_insert __P((void *, struct radij_node_head *, int *,
struct radij_node [2])),
*rj_match __P((void *, struct radij_node_head *)),
*rj_newpair __P((void *, int, struct radij_node[2])),
*rj_search __P((void *, struct radij_node *)),
*rj_search_m __P((void *, struct radij_node *, void *));
void rj_deltree(struct radij_node_head *);
void rj_delnodes(struct radij_node *);
void rj_free_mkfreelist(void);
int radijcleartree(void);
int radijcleanup(void);
extern struct radij_node_head *mask_rjhead;
extern int maj_keylen;
#endif /* __KERNEL__ */
#endif /* _RADIJ_H_ */
/*
* $Log: radij.h,v $
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.12 2002/04/24 07:36:48 mcr
* Moved from ./klips/net/ipsec/radij.h,v
*
* Revision 1.11 2001/09/20 15:33:00 rgb
* Min/max cleanup.
*
* Revision 1.10 1999/11/18 04:09:20 rgb
* Replaced all kernel version macros to shorter, readable form.
*
* Revision 1.9 1999/05/05 22:02:33 rgb
* Add a quick and dirty port to 2.2 kernels by Marc Boucher <[email protected]>.
*
* Revision 1.8 1999/04/29 15:24:58 rgb
* Add check for existence of macros min/max.
*
* Revision 1.7 1999/04/11 00:29:02 henry
* GPL boilerplate
*
* Revision 1.6 1999/04/06 04:54:29 rgb
* Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
* patch shell fixes.
*
* Revision 1.5 1999/01/22 06:30:32 rgb
* 64-bit clean-up.
*
* Revision 1.4 1998/11/30 13:22:55 rgb
* Rationalised all the klips kernel file headers. They are much shorter
* now and won't conflict under RH5.2.
*
* Revision 1.3 1998/10/25 02:43:27 rgb
* Change return type on rj_addroute and rj_delete and add and argument
* to the latter to be able to transmit more infomation about errors.
*
* Revision 1.2 1998/07/14 18:09:51 rgb
* Add a routine to clear eroute table.
* Added #ifdef __KERNEL__ directives to restrict scope of header.
*
* Revision 1.1 1998/06/18 21:30:22 henry
* move sources from klips/src to klips/net/ipsec to keep stupid kernel
* build scripts happier about symlinks
*
* Revision 1.4 1998/05/25 20:34:16 rgb
* Remove temporary ipsec_walk, rj_deltree and rj_delnodes functions.
*
* Rename ipsec_rj_walker (ipsec_walk) to ipsec_rj_walker_procprint and
* add ipsec_rj_walker_delete.
*
* Recover memory for eroute table on unload of module.
*
* Revision 1.3 1998/04/22 16:51:37 rgb
* Tidy up radij debug code from recent rash of modifications to debug code.
*
* Revision 1.2 1998/04/14 17:30:38 rgb
* Fix up compiling errors for radij tree memory reclamation.
*
* Revision 1.1 1998/04/09 03:06:16 henry
* sources moved up from linux/net/ipsec
*
* Revision 1.1.1.1 1998/04/08 05:35:04 henry
* RGB's ipsec-0.8pre2.tar.gz ipsec-0.8
*
* Revision 0.4 1997/01/15 01:28:15 ji
* No changes.
*
* Revision 0.3 1996/11/20 14:44:45 ji
* Release update only.
*
* Revision 0.2 1996/11/02 00:18:33 ji
* First limited release.
*
*
*/
linux/include/mast.h
+33
View File
@@ -0,0 +1,33 @@
struct mast_callbacks {
int (*packet_encap)(struct device *mast, void *context,
struct sk_buff *skb, int flowref);
int (*link_inquire)(struct device *mast, void *context);
};
struct device *mast_init (int family,
struct mast_callbacks *callbacks,
unsigned int flags,
unsigned int desired_unit,
unsigned int max_flowref,
void *context);
int mast_destroy(struct device *mast);
int mast_recv(struct device *mast, struct sk_buff *skb, int flowref);
/* free this skb as being useless, increment failure count. */
int mast_toast(struct device *mast, struct sk_buff *skb, int flowref);
int mast_linkstat (struct device *mast, int flowref,
int status);
int mast_setreference (struct device *mast,
int defaultSA);
int mast_setneighbor (struct device *mast,
struct sockaddr *source,
struct sockaddr *destination,
int flowref);
linux/include/pfkey.h
+498
View File
@@ -0,0 +1,498 @@
/*
* FreeS/WAN specific PF_KEY headers
* Copyright (C) 1999, 2000, 2001 Richard Guy Briggs.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* RCSID $Id: pfkey.h,v 1.2 2004/03/22 21:53:18 as Exp $
*/
#ifndef __NET_IPSEC_PF_KEY_H
#define __NET_IPSEC_PF_KEY_H
#ifdef __KERNEL__
extern struct proto_ops pfkey_proto_ops;
typedef struct sock pfkey_sock;
extern int debug_pfkey;
extern /* void */ int pfkey_init(void);
extern /* void */ int pfkey_cleanup(void);
extern struct sock *pfkey_sock_list;
struct socket_list
{
struct socket *socketp;
struct socket_list *next;
};
extern int pfkey_list_insert_socket(struct socket*, struct socket_list**);
extern int pfkey_list_remove_socket(struct socket*, struct socket_list**);
extern struct socket_list *pfkey_open_sockets;
extern struct socket_list *pfkey_registered_sockets[SADB_SATYPE_MAX+1];
/*
* There is a field-by-field copy in klips/net/ipsec/ipsec_alg.h
* please keep in sync until we migrate all support stuff
* to ipsec_alg objects
*/
struct supported
{
uint16_t supported_alg_exttype;
uint8_t supported_alg_id;
uint8_t supported_alg_ivlen;
uint16_t supported_alg_minbits;
uint16_t supported_alg_maxbits;
};
extern struct supported_list *pfkey_supported_list[SADB_SATYPE_MAX+1];
struct supported_list
{
struct supported *supportedp;
struct supported_list *next;
};
extern int pfkey_list_insert_supported(struct supported*, struct supported_list**);
extern int pfkey_list_remove_supported(struct supported*, struct supported_list**);
struct sockaddr_key
{
uint16_t key_family; /* PF_KEY */
uint16_t key_pad; /* not used */
uint32_t key_pid; /* process ID */
};
struct pfkey_extracted_data
{
struct ipsec_sa* ips;
struct ipsec_sa* ips2;
struct eroute *eroute;
};
extern int
pfkey_alloc_eroute(struct eroute** eroute);
extern int
pfkey_sa_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_lifetime_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_address_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_key_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_ident_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_sens_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_prop_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_supported_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_spirange_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_kmprivate_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_satype_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int
pfkey_x_debug_process(struct sadb_ext *pfkey_ext,
struct pfkey_extracted_data* extr);
extern int pfkey_register_reply(int satype, struct sadb_msg *);
extern int pfkey_upmsg(struct socket *, struct sadb_msg *);
extern int pfkey_expire(struct ipsec_sa *, int);
extern int pfkey_acquire(struct ipsec_sa *);
#else /* ! __KERNEL__ */
extern void (*pfkey_debug_func)(const char *message, ...);
#endif /* __KERNEL__ */
extern uint8_t satype2proto(uint8_t satype);
extern uint8_t proto2satype(uint8_t proto);
extern char* satype2name(uint8_t satype);
extern char* proto2name(uint8_t proto);
struct key_opt
{
uint32_t key_pid; /* process ID */
struct sock *sk;
};
#define key_pid(sk) ((struct key_opt*)&((sk)->protinfo))->key_pid
#define IPSEC_PFKEYv2_ALIGN (sizeof(uint64_t)/sizeof(uint8_t))
#define BITS_PER_OCTET 8
#define OCTETBITS 8
#define PFKEYBITS 64
#define DIVUP(x,y) ((x + y -1) / y) /* divide, rounding upwards */
#define ALIGN_N(x,y) (DIVUP(x,y) * y) /* align on y boundary */
#define PFKEYv2_MAX_MSGSIZE 4096
/*
* PF_KEYv2 permitted and required extensions in and out bitmaps
*/
struct pf_key_ext_parsers_def {
int (*parser)(struct sadb_ext*);
char *parser_name;
};
extern unsigned int extensions_bitmaps[2/*in/out*/][2/*perm/req*/][SADB_MAX + 1/*ext*/];
#define EXT_BITS_IN 0
#define EXT_BITS_OUT 1
#define EXT_BITS_PERM 0
#define EXT_BITS_REQ 1
extern void pfkey_extensions_init(struct sadb_ext *extensions[SADB_EXT_MAX + 1]);
extern void pfkey_extensions_free(struct sadb_ext *extensions[SADB_EXT_MAX + 1]);
extern void pfkey_msg_free(struct sadb_msg **pfkey_msg);
extern int pfkey_msg_parse(struct sadb_msg *pfkey_msg,
struct pf_key_ext_parsers_def *ext_parsers[],
struct sadb_ext **extensions,
int dir);
/*
* PF_KEYv2 build function prototypes
*/
int
pfkey_msg_hdr_build(struct sadb_ext** pfkey_ext,
uint8_t msg_type,
uint8_t satype,
uint8_t msg_errno,
uint32_t seq,
uint32_t pid);
int
pfkey_sa_ref_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t spi, /* in network order */
uint8_t replay_window,
uint8_t sa_state,
uint8_t auth,
uint8_t encrypt,
uint32_t flags,
uint32_t/*IPsecSAref_t*/ ref);
int
pfkey_sa_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t spi, /* in network order */
uint8_t replay_window,
uint8_t sa_state,
uint8_t auth,
uint8_t encrypt,
uint32_t flags);
int
pfkey_lifetime_build(struct sadb_ext ** pfkey_ext,
uint16_t exttype,
uint32_t allocations,
uint64_t bytes,
uint64_t addtime,
uint64_t usetime,
uint32_t packets);
int
pfkey_address_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint8_t proto,
uint8_t prefixlen,
struct sockaddr* address);
int
pfkey_key_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t key_bits,
char* key);
int
pfkey_ident_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t ident_type,
uint64_t ident_id,
uint8_t ident_len,
char* ident_string);
#ifdef NAT_TRAVERSAL
#ifdef __KERNEL__
extern int pfkey_nat_t_new_mapping(struct ipsec_sa *, struct sockaddr *, __u16);
extern int pfkey_x_nat_t_type_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
extern int pfkey_x_nat_t_port_process(struct sadb_ext *pfkey_ext, struct pfkey_extracted_data* extr);
#endif /* __KERNEL__ */
int
pfkey_x_nat_t_type_build(struct sadb_ext** pfkey_ext,
uint8_t type);
int
pfkey_x_nat_t_port_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint16_t port);
#endif
int
pfkey_sens_build(struct sadb_ext** pfkey_ext,
uint32_t dpd,
uint8_t sens_level,
uint8_t sens_len,
uint64_t* sens_bitmap,
uint8_t integ_level,
uint8_t integ_len,
uint64_t* integ_bitmap);
int pfkey_x_protocol_build(struct sadb_ext **, uint8_t);
int
pfkey_prop_build(struct sadb_ext** pfkey_ext,
uint8_t replay,
unsigned int comb_num,
struct sadb_comb* comb);
int
pfkey_supported_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
unsigned int alg_num,
struct sadb_alg* alg);
int
pfkey_spirange_build(struct sadb_ext** pfkey_ext,
uint16_t exttype,
uint32_t min,
uint32_t max);
int
pfkey_x_kmprivate_build(struct sadb_ext** pfkey_ext);
int
pfkey_x_satype_build(struct sadb_ext** pfkey_ext,
uint8_t satype);
int
pfkey_x_debug_build(struct sadb_ext** pfkey_ext,
uint32_t tunnel,
uint32_t netlink,
uint32_t xform,
uint32_t eroute,
uint32_t spi,
uint32_t radij,
uint32_t esp,
uint32_t ah,
uint32_t rcv,
uint32_t pfkey,
uint32_t ipcomp,
uint32_t verbose);
int
pfkey_msg_build(struct sadb_msg** pfkey_msg,
struct sadb_ext* extensions[],
int dir);
/* in pfkey_v2_debug.c - routines to decode numbers -> strings */
const char *
pfkey_v2_sadb_ext_string(int extnum);
const char *
pfkey_v2_sadb_type_string(int sadb_type);
#endif /* __NET_IPSEC_PF_KEY_H */
/*
* $Log: pfkey.h,v $
* Revision 1.2 2004/03/22 21:53:18 as
* merged alg-0.8.1 branch with HEAD
*
* Revision 1.1.2.1.2.1 2004/03/16 09:48:18 as
* alg-0.8.1rc12 patch merged
*
* Revision 1.1.2.1 2004/03/15 22:30:06 as
* nat-0.6c patch merged
*
* Revision 1.1 2004/03/15 20:35:25 as
* added files from freeswan-2.04-x509-1.5.3
*
* Revision 1.42 2003/08/25 22:08:19 mcr
* removed pfkey_proto_init() from pfkey.h for 2.6 support.
*
* Revision 1.41 2003/05/07 17:28:57 mcr
* new function pfkey_debug_func added for us in debugging from
* pfkey library.
*
* Revision 1.40 2003/01/30 02:31:34 rgb
*
* Convert IPsecSAref_t from signed to unsigned to fix apparent SAref exhaustion bug.
*
* Revision 1.39 2002/09/20 15:40:21 rgb
* Switch from pfkey_alloc_ipsec_sa() to ipsec_sa_alloc().
* Added ref parameter to pfkey_sa_build().
* Cleaned out unused cruft.
*
* Revision 1.38 2002/05/14 02:37:24 rgb
* Change all references to tdb, TDB or Tunnel Descriptor Block to ips,
* ipsec_sa or ipsec_sa.
* Added function prototypes for the functions moved to
* pfkey_v2_ext_process.c.
*
* Revision 1.37 2002/04/24 07:36:49 mcr
* Moved from ./lib/pfkey.h,v
*
* Revision 1.36 2002/01/20 20:34:49 mcr
* added pfkey_v2_sadb_type_string to decode sadb_type to string.
*
* Revision 1.35 2001/11/27 05:27:47 mcr
* pfkey parses are now maintained by a structure
* that includes their name for debug purposes.
*
* Revision 1.34 2001/11/26 09:23:53 rgb
* Merge MCR's ipsec_sa, eroute, proc and struct lifetime changes.
*
* Revision 1.33 2001/11/06 19:47:47 rgb
* Added packet parameter to lifetime and comb structures.
*
* Revision 1.32 2001/09/08 21:13:34 rgb
* Added pfkey ident extension support for ISAKMPd. (NetCelo)
*
* Revision 1.31 2001/06/14 19:35:16 rgb
* Update copyright date.
*
* Revision 1.30 2001/02/27 07:04:52 rgb
* Added satype2name prototype.
*
* Revision 1.29 2001/02/26 19:59:33 rgb
* Ditch unused sadb_satype2proto[], replaced by satype2proto().
*
* Revision 1.28 2000/10/10 20:10:19 rgb
* Added support for debug_ipcomp and debug_verbose to klipsdebug.
*
* Revision 1.27 2000/09/21 04:20:45 rgb
* Fixed array size off-by-one error. (Thanks Svenning!)
*
* Revision 1.26 2000/09/12 03:26:05 rgb
* Added pfkey_acquire prototype.
*
* Revision 1.25 2000/09/08 19:21:28 rgb
* Fix pfkey_prop_build() parameter to be only single indirection.
*
* Revision 1.24 2000/09/01 18:46:42 rgb
* Added a supported algorithms array lists, one per satype and registered
* existing algorithms.
* Fixed pfkey_list_{insert,remove}_{socket,support}() to allow change to
* list.
*
* Revision 1.23 2000/08/27 01:55:26 rgb
* Define OCTETBITS and PFKEYBITS to avoid using 'magic' numbers in code.
*
* Revision 1.22 2000/08/20 21:39:23 rgb
* Added kernel prototypes for kernel funcitions pfkey_upmsg() and
* pfkey_expire().
*
* Revision 1.21 2000/08/15 17:29:23 rgb
* Fixes from SZI to untested pfkey_prop_build().
*
* Revision 1.20 2000/05/10 20:14:19 rgb
* Fleshed out sensitivity, proposal and supported extensions.
*
* Revision 1.19 2000/03/16 14:07:23 rgb
* Renamed ALIGN macro to avoid fighting with others in kernel.
*
* Revision 1.18 2000/01/22 23:24:06 rgb
* Added prototypes for proto2satype(), satype2proto() and proto2name().
*
* Revision 1.17 2000/01/21 06:26:59 rgb
* Converted from double tdb arguments to one structure (extr)
* containing pointers to all temporary information structures.
* Added klipsdebug switching capability.
* Dropped unused argument to pfkey_x_satype_build().
*
* Revision 1.16 1999/12/29 21:17:41 rgb
* Changed pfkey_msg_build() I/F to include a struct sadb_msg**
* parameter for cleaner manipulation of extensions[] and to guard
* against potential memory leaks.
* Changed the I/F to pfkey_msg_free() for the same reason.
*
* Revision 1.15 1999/12/09 23:12:54 rgb
* Added macro for BITS_PER_OCTET.
* Added argument to pfkey_sa_build() to do eroutes.
*
* Revision 1.14 1999/12/08 20:33:25 rgb
* Changed sa_family_t to uint16_t for 2.0.xx compatibility.
*
* Revision 1.13 1999/12/07 19:53:40 rgb
* Removed unused first argument from extension parsers.
* Changed __u* types to uint* to avoid use of asm/types.h and
* sys/types.h in userspace code.
* Added function prototypes for pfkey message and extensions
* initialisation and cleanup.
*
* Revision 1.12 1999/12/01 22:19:38 rgb
* Change pfkey_sa_build to accept an SPI in network byte order.
*
* Revision 1.11 1999/11/27 11:55:26 rgb
* Added extern sadb_satype2proto to enable moving protocol lookup table
* to lib/pfkey_v2_parse.c.
* Delete unused, moved typedefs.
* Add argument to pfkey_msg_parse() for direction.
* Consolidated the 4 1-d extension bitmap arrays into one 4-d array.
*
* Revision 1.10 1999/11/23 22:29:21 rgb
* This file has been moved in the distribution from klips/net/ipsec to
* lib.
* Add macros for dealing with alignment and rounding up more opaquely.
* The uint<n>_t type defines have been moved to freeswan.h to avoid
* chicken-and-egg problems.
* Add macros for dealing with alignment and rounding up more opaque.
* Added prototypes for using extention header bitmaps.
* Added prototypes of all the build functions.
*
* Revision 1.9 1999/11/20 21:59:48 rgb
* Moved socketlist type declarations and prototypes for shared use.
* Slightly modified scope of sockaddr_key declaration.
*
* Revision 1.8 1999/11/17 14:34:25 rgb
* Protect sa_family_t from being used in userspace with GLIBC<2.
*
* Revision 1.7 1999/10/27 19:40:35 rgb
* Add a maximum PFKEY packet size macro.
*
* Revision 1.6 1999/10/26 16:58:58 rgb
* Created a sockaddr_key and key_opt socket extension structures.
*
* Revision 1.5 1999/06/10 05:24:41 rgb
* Renamed variables to reduce confusion.
*
* Revision 1.4 1999/04/29 15:21:11 rgb
* Add pfkey support to debugging.
* Add return values to init and cleanup functions.
*
* Revision 1.3 1999/04/15 17:58:07 rgb
* Add RCSID labels.
*
*/
linux/include/pfkeyv2.h
+385
View File
@@ -0,0 +1,385 @@
/*
* RCSID $Id: pfkeyv2.h,v 1.5 2004/10/04 22:43:56 as Exp $
*/
/*
RFC 2367 PF_KEY Key Management API July 1998
Appendix D: Sample Header File
This file defines structures and symbols for the PF_KEY Version 2
key management interface. It was written at the U.S. Naval Research
Laboratory. This file is in the public domain. The authors ask that
you leave this credit intact on any copies of this file.
*/
#ifndef __PFKEY_V2_H
#define __PFKEY_V2_H 1
#define PF_KEY_V2 2
#define PFKEYV2_REVISION 199806L
#define SADB_RESERVED 0
#define SADB_GETSPI 1
#define SADB_UPDATE 2
#define SADB_ADD 3
#define SADB_DELETE 4
#define SADB_GET 5
#define SADB_ACQUIRE 6
#define SADB_REGISTER 7
#define SADB_EXPIRE 8
#define SADB_FLUSH 9
#define SADB_DUMP 10
#define SADB_X_PROMISC 11
#define SADB_X_PCHANGE 12
#define SADB_X_GRPSA 13
#define SADB_X_ADDFLOW 14
#define SADB_X_DELFLOW 15
#define SADB_X_DEBUG 16
#ifdef NAT_TRAVERSAL
#define SADB_X_NAT_T_NEW_MAPPING 17
#define SADB_MAX 17
#else
#define SADB_MAX 16
#endif
struct sadb_msg {
uint8_t sadb_msg_version;
uint8_t sadb_msg_type;
uint8_t sadb_msg_errno;
uint8_t sadb_msg_satype;
uint16_t sadb_msg_len;
uint16_t sadb_msg_reserved;
uint32_t sadb_msg_seq;
uint32_t sadb_msg_pid;
};
struct sadb_ext {
uint16_t sadb_ext_len;
uint16_t sadb_ext_type;
};
struct sadb_sa {
uint16_t sadb_sa_len;
uint16_t sadb_sa_exttype;
uint32_t sadb_sa_spi;
uint8_t sadb_sa_replay;
uint8_t sadb_sa_state;
uint8_t sadb_sa_auth;
uint8_t sadb_sa_encrypt;
uint32_t sadb_sa_flags;
uint32_t /*IPsecSAref_t*/ sadb_x_sa_ref; /* 32 bits */
uint8_t sadb_x_reserved[4];
};
struct sadb_sa_v1 {
uint16_t sadb_sa_len;
uint16_t sadb_sa_exttype;
uint32_t sadb_sa_spi;
uint8_t sadb_sa_replay;
uint8_t sadb_sa_state;
uint8_t sadb_sa_auth;
uint8_t sadb_sa_encrypt;
uint32_t sadb_sa_flags;
};
struct sadb_lifetime {
uint16_t sadb_lifetime_len;
uint16_t sadb_lifetime_exttype;
uint32_t sadb_lifetime_allocations;
uint64_t sadb_lifetime_bytes;
uint64_t sadb_lifetime_addtime;
uint64_t sadb_lifetime_usetime;
uint32_t sadb_x_lifetime_packets;
uint32_t sadb_x_lifetime_reserved;
};
struct sadb_address {
uint16_t sadb_address_len;
uint16_t sadb_address_exttype;
uint8_t sadb_address_proto;
uint8_t sadb_address_prefixlen;
uint16_t sadb_address_reserved;
};
struct sadb_key {
uint16_t sadb_key_len;
uint16_t sadb_key_exttype;
uint16_t sadb_key_bits;
uint16_t sadb_key_reserved;
};
struct sadb_ident {
uint16_t sadb_ident_len;
uint16_t sadb_ident_exttype;
uint16_t sadb_ident_type;
uint16_t sadb_ident_reserved;
uint64_t sadb_ident_id;
};
struct sadb_sens {
uint16_t sadb_sens_len;
uint16_t sadb_sens_exttype;
uint32_t sadb_sens_dpd;
uint8_t sadb_sens_sens_level;
uint8_t sadb_sens_sens_len;
uint8_t sadb_sens_integ_level;
uint8_t sadb_sens_integ_len;
uint32_t sadb_sens_reserved;
};
struct sadb_prop {
uint16_t sadb_prop_len;
uint16_t sadb_prop_exttype;
uint8_t sadb_prop_replay;
uint8_t sadb_prop_reserved[3];
};
struct sadb_comb {
uint8_t sadb_comb_auth;
uint8_t sadb_comb_encrypt;
uint16_t sadb_comb_flags;
uint16_t sadb_comb_auth_minbits;
uint16_t sadb_comb_auth_maxbits;
uint16_t sadb_comb_encrypt_minbits;
uint16_t sadb_comb_encrypt_maxbits;
uint32_t sadb_comb_reserved;
uint32_t sadb_comb_soft_allocations;
uint32_t sadb_comb_hard_allocations;
uint64_t sadb_comb_soft_bytes;
uint64_t sadb_comb_hard_bytes;
uint64_t sadb_comb_soft_addtime;
uint64_t sadb_comb_hard_addtime;
uint64_t sadb_comb_soft_usetime;
uint64_t sadb_comb_hard_usetime;
uint32_t sadb_x_comb_soft_packets;
uint32_t sadb_x_comb_hard_packets;
};
struct sadb_supported {
uint16_t sadb_supported_len;
uint16_t sadb_supported_exttype;
uint32_t sadb_supported_reserved;
};
struct sadb_alg {
uint8_t sadb_alg_id;
uint8_t sadb_alg_ivlen;
uint16_t sadb_alg_minbits;
uint16_t sadb_alg_maxbits;
uint16_t sadb_alg_reserved;
};
struct sadb_spirange {
uint16_t sadb_spirange_len;
uint16_t sadb_spirange_exttype;
uint32_t sadb_spirange_min;
uint32_t sadb_spirange_max;
uint32_t sadb_spirange_reserved;
};
struct sadb_x_kmprivate {
uint16_t sadb_x_kmprivate_len;
uint16_t sadb_x_kmprivate_exttype;
uint32_t sadb_x_kmprivate_reserved;
};
struct sadb_x_satype {
uint16_t sadb_x_satype_len;
uint16_t sadb_x_satype_exttype;
uint8_t sadb_x_satype_satype;
uint8_t sadb_x_satype_reserved[3];
};
struct sadb_x_policy {
uint16_t sadb_x_policy_len;
uint16_t sadb_x_policy_exttype;
uint16_t sadb_x_policy_type;
uint8_t sadb_x_policy_dir;
uint8_t sadb_x_policy_reserved;
uint32_t sadb_x_policy_id;
uint32_t sadb_x_policy_reserved2;
};
struct sadb_x_debug {
uint16_t sadb_x_debug_len;
uint16_t sadb_x_debug_exttype;
uint32_t sadb_x_debug_tunnel;
uint32_t sadb_x_debug_netlink;
uint32_t sadb_x_debug_xform;
uint32_t sadb_x_debug_eroute;
uint32_t sadb_x_debug_spi;
uint32_t sadb_x_debug_radij;
uint32_t sadb_x_debug_esp;
uint32_t sadb_x_debug_ah;
uint32_t sadb_x_debug_rcv;
uint32_t sadb_x_debug_pfkey;
uint32_t sadb_x_debug_ipcomp;
uint32_t sadb_x_debug_verbose;
uint8_t sadb_x_debug_reserved[4];
};
#ifdef NAT_TRAVERSAL
struct sadb_x_nat_t_type {
uint16_t sadb_x_nat_t_type_len;
uint16_t sadb_x_nat_t_type_exttype;
uint8_t sadb_x_nat_t_type_type;
uint8_t sadb_x_nat_t_type_reserved[3];
};
struct sadb_x_nat_t_port {
uint16_t sadb_x_nat_t_port_len;
uint16_t sadb_x_nat_t_port_exttype;
uint16_t sadb_x_nat_t_port_port;
uint16_t sadb_x_nat_t_port_reserved;
};
#endif
/*
* A protocol structure for passing through the transport level
* protocol. It contains more fields than are actually used/needed
* but it is this way to be compatible with the structure used in
* OpenBSD (http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net/pfkeyv2.h)
*/
struct sadb_protocol {
uint16_t sadb_protocol_len;
uint16_t sadb_protocol_exttype;
uint8_t sadb_protocol_proto;
uint8_t sadb_protocol_direction;
uint8_t sadb_protocol_flags;
uint8_t sadb_protocol_reserved2;
};
#define SADB_EXT_RESERVED 0
#define SADB_EXT_SA 1
#define SADB_EXT_LIFETIME_CURRENT 2
#define SADB_EXT_LIFETIME_HARD 3
#define SADB_EXT_LIFETIME_SOFT 4
#define SADB_EXT_ADDRESS_SRC 5
#define SADB_EXT_ADDRESS_DST 6
#define SADB_EXT_ADDRESS_PROXY 7
#define SADB_EXT_KEY_AUTH 8
#define SADB_EXT_KEY_ENCRYPT 9
#define SADB_EXT_IDENTITY_SRC 10
#define SADB_EXT_IDENTITY_DST 11
#define SADB_EXT_SENSITIVITY 12
#define SADB_EXT_PROPOSAL 13
#define SADB_EXT_SUPPORTED_AUTH 14
#define SADB_EXT_SUPPORTED_ENCRYPT 15
#define SADB_EXT_SPIRANGE 16
#define SADB_X_EXT_KMPRIVATE 17
#define SADB_X_EXT_SATYPE2 18
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_EXT_POLICY 18
#endif
#define SADB_X_EXT_SA2 19
#define SADB_X_EXT_ADDRESS_DST2 20
#define SADB_X_EXT_ADDRESS_SRC_FLOW 21
#define SADB_X_EXT_ADDRESS_DST_FLOW 22
#define SADB_X_EXT_ADDRESS_SRC_MASK 23
#define SADB_X_EXT_ADDRESS_DST_MASK 24
#define SADB_X_EXT_DEBUG 25
#define SADB_X_EXT_PROTOCOL 26
#ifdef NAT_TRAVERSAL
#define SADB_X_EXT_NAT_T_TYPE 27
#define SADB_X_EXT_NAT_T_SPORT 28
#define SADB_X_EXT_NAT_T_DPORT 29
#define SADB_X_EXT_NAT_T_OA 30
#define SADB_EXT_MAX 30
#else
#define SADB_EXT_MAX 26
#endif
/* SADB_X_DELFLOW required over and above SADB_X_SAFLAGS_CLEARFLOW */
#define SADB_X_EXT_ADDRESS_DELFLOW \
( (1<<SADB_X_EXT_ADDRESS_SRC_FLOW) \
| (1<<SADB_X_EXT_ADDRESS_DST_FLOW) \
| (1<<SADB_X_EXT_ADDRESS_SRC_MASK) \
| (1<<SADB_X_EXT_ADDRESS_DST_MASK))
#define SADB_SATYPE_UNSPEC 0
#define SADB_SATYPE_AH 2
#define SADB_SATYPE_ESP 3
#define SADB_SATYPE_RSVP 5
#define SADB_SATYPE_OSPFV2 6
#define SADB_SATYPE_RIPV2 7
#define SADB_SATYPE_MIP 8
#define SADB_X_SATYPE_IPIP 9
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_SATYPE_IPCOMP 9 /* ICK! */
#endif
#define SADB_X_SATYPE_COMP 10
#define SADB_X_SATYPE_INT 11
#define SADB_SATYPE_MAX 11
#define SADB_SASTATE_LARVAL 0
#define SADB_SASTATE_MATURE 1
#define SADB_SASTATE_DYING 2
#define SADB_SASTATE_DEAD 3
#define SADB_SASTATE_MAX 3
#define SADB_SAFLAGS_PFS 1
#define SADB_X_SAFLAGS_REPLACEFLOW 2
#define SADB_X_SAFLAGS_CLEARFLOW 4
#define SADB_X_SAFLAGS_INFLOW 8
/* not obvious, but these are the same values as used in isakmp,
* and in freeswan/ipsec_policy.h. If you need to add any, they
* should be added as according to
* http://www.iana.org/assignments/isakmp-registry
*
* and if not, then please try to use a private-use value, and
* consider asking IANA to assign a value.
*/
#define SADB_AALG_NONE 0
#define SADB_AALG_MD5_HMAC 2
#define SADB_AALG_SHA1_HMAC 3
#define SADB_AALG_DES_MAC 4
#define SADB_AALG_SHA2_256_HMAC 5
#define SADB_AALG_SHA2_384_HMAC 6
#define SADB_AALG_SHA2_512_HMAC 7
#define SADB_AALG_RIPEMD_160_HMAC 8
#define SADB_AALG_AES_XCBC_MAC 9
#define SADB_X_AALG_NULL 251 /* kame */
#define SADB_AALG_MAX 251
#define SADB_EALG_NONE 0
#define SADB_EALG_DES_CBC 2
#define SADB_EALG_3DES_CBC 3
#define SADB_EALG_RC5_CBC 4
#define SADB_EALG_IDEA_CBC 5
#define SADB_EALG_CAST_CBC 6
#define SADB_EALG_BLOWFISH_CBC 7
#define SADB_EALG_NULL 11
#define SADB_EALG_AES_CBC 12
#define SADB_EALG_AES_CTR 13
#define SADB_X_EALG_SERPENT_CBC 252
#define SADB_X_EALG_TWOFISH_CBC 253
#define SADB_EALG_MAX 253
#define SADB_X_CALG_NONE 0
#define SADB_X_CALG_OUI 1
#define SADB_X_CALG_DEFLATE 2
#define SADB_X_CALG_LZS 3
#define SADB_X_CALG_V42BIS 4
#ifdef KERNEL26_HAS_KAME_DUPLICATES
#define SADB_X_CALG_LZJH 4
#endif
#define SADB_X_CALG_MAX 4
#define SADB_X_TALG_NONE 0
#define SADB_X_TALG_IPv4_in_IPv4 1
#define SADB_X_TALG_IPv6_in_IPv4 2
#define SADB_X_TALG_IPv4_in_IPv6 3
#define SADB_X_TALG_IPv6_in_IPv6 4
#define SADB_X_TALG_MAX 4
#define SADB_IDENTTYPE_RESERVED 0
#define SADB_IDENTTYPE_PREFIX 1
#define SADB_IDENTTYPE_FQDN 2
#define SADB_IDENTTYPE_USERFQDN 3
#define SADB_X_IDENTTYPE_CONNECTION 4
#define SADB_IDENTTYPE_MAX 4
#define SADB_KEY_FLAGS_MAX 0
#endif /* __PFKEY_V2_H */
linux/include/zlib/zlib.h
+893
View File
@@ -0,0 +1,893 @@
/* zlib.h -- interface of the 'zlib' general purpose compression library
version 1.1.4, March 11th, 2002
Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any damages
arising from the use of this software.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must not
claim that you wrote the original software. If you use this software
in a product, an acknowledgment in the product documentation would be
appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.
Jean-loup Gailly Mark Adler
[email protected] [email protected]
The data format used by the zlib library is described by RFCs (Request for
Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
(zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
*/
#ifndef _ZLIB_H
#define _ZLIB_H
#include "zconf.h"
#ifdef __cplusplus
extern "C" {
#endif
#define ZLIB_VERSION "1.1.4"
/*
The 'zlib' compression library provides in-memory compression and
decompression functions, including integrity checks of the uncompressed
data. This version of the library supports only one compression method
(deflation) but other algorithms will be added later and will have the same
stream interface.
Compression can be done in a single step if the buffers are large
enough (for example if an input file is mmap'ed), or can be done by
repeated calls of the compression function. In the latter case, the
application must provide more input and/or consume the output
(providing more output space) before each call.
The library also supports reading and writing files in gzip (.gz) format
with an interface similar to that of stdio.
The library does not install any signal handler. The decoder checks
the consistency of the compressed data, so the library should never
crash even in case of corrupted input.
*/
typedef voidpf (*alloc_func) OF((voidpf opaque, uInt items, uInt size));
typedef void (*free_func) OF((voidpf opaque, voidpf address));
struct internal_state;
typedef struct z_stream_s {
Bytef *next_in; /* next input byte */
uInt avail_in; /* number of bytes available at next_in */
uLong total_in; /* total nb of input bytes read so far */
Bytef *next_out; /* next output byte should be put there */
uInt avail_out; /* remaining free space at next_out */
uLong total_out; /* total nb of bytes output so far */
const char *msg; /* last error message, NULL if no error */
struct internal_state FAR *state; /* not visible by applications */
alloc_func zalloc; /* used to allocate the internal state */
free_func zfree; /* used to free the internal state */
voidpf opaque; /* private data object passed to zalloc and zfree */
int data_type; /* best guess about the data type: ascii or binary */
uLong adler; /* adler32 value of the uncompressed data */
uLong reserved; /* reserved for future use */
} z_stream;
typedef z_stream FAR *z_streamp;
/*
The application must update next_in and avail_in when avail_in has
dropped to zero. It must update next_out and avail_out when avail_out
has dropped to zero. The application must initialize zalloc, zfree and
opaque before calling the init function. All other fields are set by the
compression library and must not be updated by the application.
The opaque value provided by the application will be passed as the first
parameter for calls of zalloc and zfree. This can be useful for custom
memory management. The compression library attaches no meaning to the
opaque value.
zalloc must return Z_NULL if there is not enough memory for the object.
If zlib is used in a multi-threaded application, zalloc and zfree must be
thread safe.
On 16-bit systems, the functions zalloc and zfree must be able to allocate
exactly 65536 bytes, but will not be required to allocate more than this
if the symbol MAXSEG_64K is defined (see zconf.h). WARNING: On MSDOS,
pointers returned by zalloc for objects of exactly 65536 bytes *must*
have their offset normalized to zero. The default allocation function
provided by this library ensures this (see zutil.c). To reduce memory
requirements and avoid any allocation of 64K objects, at the expense of
compression ratio, compile the library with -DMAX_WBITS=14 (see zconf.h).
The fields total_in and total_out can be used for statistics or
progress reports. After compression, total_in holds the total size of
the uncompressed data and may be saved for use in the decompressor
(particularly if the decompressor wants to decompress everything in
a single step).
*/
/* constants */
#define Z_NO_FLUSH 0
#define Z_PARTIAL_FLUSH 1 /* will be removed, use Z_SYNC_FLUSH instead */
#define Z_SYNC_FLUSH 2
#define Z_FULL_FLUSH 3
#define Z_FINISH 4
/* Allowed flush values; see deflate() below for details */
#define Z_OK 0
#define Z_STREAM_END 1
#define Z_NEED_DICT 2
#define Z_ERRNO (-1)
#define Z_STREAM_ERROR (-2)
#define Z_DATA_ERROR (-3)
#define Z_MEM_ERROR (-4)
#define Z_BUF_ERROR (-5)
#define Z_VERSION_ERROR (-6)
/* Return codes for the compression/decompression functions. Negative
* values are errors, positive values are used for special but normal events.
*/
#define Z_NO_COMPRESSION 0
#define Z_BEST_SPEED 1
#define Z_BEST_COMPRESSION 9
#define Z_DEFAULT_COMPRESSION (-1)
/* compression levels */
#define Z_FILTERED 1
#define Z_HUFFMAN_ONLY 2
#define Z_DEFAULT_STRATEGY 0
/* compression strategy; see deflateInit2() below for details */
#define Z_BINARY 0
#define Z_ASCII 1
#define Z_UNKNOWN 2
/* Possible values of the data_type field */
#define Z_DEFLATED 8
/* The deflate compression method (the only one supported in this version) */
#define Z_NULL 0 /* for initializing zalloc, zfree, opaque */
#define zlib_version zlibVersion()
/* for compatibility with versions < 1.0.2 */
/* basic functions */
ZEXTERN const char * ZEXPORT zlibVersion OF((void));
/* The application can compare zlibVersion and ZLIB_VERSION for consistency.
If the first character differs, the library code actually used is
not compatible with the zlib.h header file used by the application.
This check is automatically made by deflateInit and inflateInit.
*/
/*
ZEXTERN int ZEXPORT deflateInit OF((z_streamp strm, int level));
Initializes the internal stream state for compression. The fields
zalloc, zfree and opaque must be initialized before by the caller.
If zalloc and zfree are set to Z_NULL, deflateInit updates them to
use default allocation functions.
The compression level must be Z_DEFAULT_COMPRESSION, or between 0 and 9:
1 gives best speed, 9 gives best compression, 0 gives no compression at
all (the input data is simply copied a block at a time).
Z_DEFAULT_COMPRESSION requests a default compromise between speed and
compression (currently equivalent to level 6).
deflateInit returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_STREAM_ERROR if level is not a valid compression level,
Z_VERSION_ERROR if the zlib library version (zlib_version) is incompatible
with the version assumed by the caller (ZLIB_VERSION).
msg is set to null if there is no error message. deflateInit does not
perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflate OF((z_streamp strm, int flush));
/*
deflate compresses as much data as possible, and stops when the input
buffer becomes empty or the output buffer becomes full. It may introduce some
output latency (reading input without producing any output) except when
forced to flush.
The detailed semantics are as follows. deflate performs one or both of the
following actions:
- Compress more input starting at next_in and update next_in and avail_in
accordingly. If not all input can be processed (because there is not
enough room in the output buffer), next_in and avail_in are updated and
processing will resume at this point for the next call of deflate().
- Provide more output starting at next_out and update next_out and avail_out
accordingly. This action is forced if the parameter flush is non zero.
Forcing flush frequently degrades the compression ratio, so this parameter
should be set only when necessary (in interactive applications).
Some output may be provided even if flush is not set.
Before the call of deflate(), the application should ensure that at least
one of the actions is possible, by providing more input and/or consuming
more output, and updating avail_in or avail_out accordingly; avail_out
should never be zero before the call. The application can consume the
compressed output when it wants, for example when the output buffer is full
(avail_out == 0), or after each call of deflate(). If deflate returns Z_OK
and with zero avail_out, it must be called again after making room in the
output buffer because there might be more output pending.
If the parameter flush is set to Z_SYNC_FLUSH, all pending output is
flushed to the output buffer and the output is aligned on a byte boundary, so
that the decompressor can get all input data available so far. (In particular
avail_in is zero after the call if enough output space has been provided
before the call.) Flushing may degrade compression for some compression
algorithms and so it should be used only when necessary.
If flush is set to Z_FULL_FLUSH, all output is flushed as with
Z_SYNC_FLUSH, and the compression state is reset so that decompression can
restart from this point if previous compressed data has been damaged or if
random access is desired. Using Z_FULL_FLUSH too often can seriously degrade
the compression.
If deflate returns with avail_out == 0, this function must be called again
with the same value of the flush parameter and more output space (updated
avail_out), until the flush is complete (deflate returns with non-zero
avail_out).
If the parameter flush is set to Z_FINISH, pending input is processed,
pending output is flushed and deflate returns with Z_STREAM_END if there
was enough output space; if deflate returns with Z_OK, this function must be
called again with Z_FINISH and more output space (updated avail_out) but no
more input data, until it returns with Z_STREAM_END or an error. After
deflate has returned Z_STREAM_END, the only possible operations on the
stream are deflateReset or deflateEnd.
Z_FINISH can be used immediately after deflateInit if all the compression
is to be done in a single step. In this case, avail_out must be at least
0.1% larger than avail_in plus 12 bytes. If deflate does not return
Z_STREAM_END, then it must be called again as described above.
deflate() sets strm->adler to the adler32 checksum of all input read
so far (that is, total_in bytes).
deflate() may update data_type if it can make a good guess about
the input data type (Z_ASCII or Z_BINARY). In doubt, the data is considered
binary. This field is only for information purposes and does not affect
the compression algorithm in any manner.
deflate() returns Z_OK if some progress has been made (more input
processed or more output produced), Z_STREAM_END if all input has been
consumed and all output has been produced (only when flush is set to
Z_FINISH), Z_STREAM_ERROR if the stream state was inconsistent (for example
if next_in or next_out was NULL), Z_BUF_ERROR if no progress is possible
(for example avail_in or avail_out was zero).
*/
ZEXTERN int ZEXPORT deflateEnd OF((z_streamp strm));
/*
All dynamically allocated data structures for this stream are freed.
This function discards any unprocessed input and does not flush any
pending output.
deflateEnd returns Z_OK if success, Z_STREAM_ERROR if the
stream state was inconsistent, Z_DATA_ERROR if the stream was freed
prematurely (some input or output was discarded). In the error case,
msg may be set but then points to a static string (which must not be
deallocated).
*/
/*
ZEXTERN int ZEXPORT inflateInit OF((z_streamp strm));
Initializes the internal stream state for decompression. The fields
next_in, avail_in, zalloc, zfree and opaque must be initialized before by
the caller. If next_in is not Z_NULL and avail_in is large enough (the exact
value depends on the compression method), inflateInit determines the
compression method from the zlib header and allocates all data structures
accordingly; otherwise the allocation will be deferred to the first call of
inflate. If zalloc and zfree are set to Z_NULL, inflateInit updates them to
use default allocation functions.
inflateInit returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_VERSION_ERROR if the zlib library version is incompatible with the
version assumed by the caller. msg is set to null if there is no error
message. inflateInit does not perform any decompression apart from reading
the zlib header if present: this will be done by inflate(). (So next_in and
avail_in may be modified, but next_out and avail_out are unchanged.)
*/
ZEXTERN int ZEXPORT inflate OF((z_streamp strm, int flush));
/*
inflate decompresses as much data as possible, and stops when the input
buffer becomes empty or the output buffer becomes full. It may some
introduce some output latency (reading input without producing any output)
except when forced to flush.
The detailed semantics are as follows. inflate performs one or both of the
following actions:
- Decompress more input starting at next_in and update next_in and avail_in
accordingly. If not all input can be processed (because there is not
enough room in the output buffer), next_in is updated and processing
will resume at this point for the next call of inflate().
- Provide more output starting at next_out and update next_out and avail_out
accordingly. inflate() provides as much output as possible, until there
is no more input data or no more space in the output buffer (see below
about the flush parameter).
Before the call of inflate(), the application should ensure that at least
one of the actions is possible, by providing more input and/or consuming
more output, and updating the next_* and avail_* values accordingly.
The application can consume the uncompressed output when it wants, for
example when the output buffer is full (avail_out == 0), or after each
call of inflate(). If inflate returns Z_OK and with zero avail_out, it
must be called again after making room in the output buffer because there
might be more output pending.
If the parameter flush is set to Z_SYNC_FLUSH, inflate flushes as much
output as possible to the output buffer. The flushing behavior of inflate is
not specified for values of the flush parameter other than Z_SYNC_FLUSH
and Z_FINISH, but the current implementation actually flushes as much output
as possible anyway.
inflate() should normally be called until it returns Z_STREAM_END or an
error. However if all decompression is to be performed in a single step
(a single call of inflate), the parameter flush should be set to
Z_FINISH. In this case all pending input is processed and all pending
output is flushed; avail_out must be large enough to hold all the
uncompressed data. (The size of the uncompressed data may have been saved
by the compressor for this purpose.) The next operation on this stream must
be inflateEnd to deallocate the decompression state. The use of Z_FINISH
is never required, but can be used to inform inflate that a faster routine
may be used for the single inflate() call.
If a preset dictionary is needed at this point (see inflateSetDictionary
below), inflate sets strm-adler to the adler32 checksum of the
dictionary chosen by the compressor and returns Z_NEED_DICT; otherwise
it sets strm->adler to the adler32 checksum of all output produced
so far (that is, total_out bytes) and returns Z_OK, Z_STREAM_END or
an error code as described below. At the end of the stream, inflate()
checks that its computed adler32 checksum is equal to that saved by the
compressor and returns Z_STREAM_END only if the checksum is correct.
inflate() returns Z_OK if some progress has been made (more input processed
or more output produced), Z_STREAM_END if the end of the compressed data has
been reached and all uncompressed output has been produced, Z_NEED_DICT if a
preset dictionary is needed at this point, Z_DATA_ERROR if the input data was
corrupted (input stream not conforming to the zlib format or incorrect
adler32 checksum), Z_STREAM_ERROR if the stream structure was inconsistent
(for example if next_in or next_out was NULL), Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if no progress is possible or if there was not
enough room in the output buffer when Z_FINISH is used. In the Z_DATA_ERROR
case, the application may then call inflateSync to look for a good
compression block.
*/
ZEXTERN int ZEXPORT inflateEnd OF((z_streamp strm));
/*
All dynamically allocated data structures for this stream are freed.
This function discards any unprocessed input and does not flush any
pending output.
inflateEnd returns Z_OK if success, Z_STREAM_ERROR if the stream state
was inconsistent. In the error case, msg may be set but then points to a
static string (which must not be deallocated).
*/
/* Advanced functions */
/*
The following functions are needed only in some special applications.
*/
/*
ZEXTERN int ZEXPORT deflateInit2 OF((z_streamp strm,
int level,
int method,
int windowBits,
int memLevel,
int strategy));
This is another version of deflateInit with more compression options. The
fields next_in, zalloc, zfree and opaque must be initialized before by
the caller.
The method parameter is the compression method. It must be Z_DEFLATED in
this version of the library.
The windowBits parameter is the base two logarithm of the window size
(the size of the history buffer). It should be in the range 8..15 for this
version of the library. Larger values of this parameter result in better
compression at the expense of memory usage. The default value is 15 if
deflateInit is used instead.
The memLevel parameter specifies how much memory should be allocated
for the internal compression state. memLevel=1 uses minimum memory but
is slow and reduces compression ratio; memLevel=9 uses maximum memory
for optimal speed. The default value is 8. See zconf.h for total memory
usage as a function of windowBits and memLevel.
The strategy parameter is used to tune the compression algorithm. Use the
value Z_DEFAULT_STRATEGY for normal data, Z_FILTERED for data produced by a
filter (or predictor), or Z_HUFFMAN_ONLY to force Huffman encoding only (no
string match). Filtered data consists mostly of small values with a
somewhat random distribution. In this case, the compression algorithm is
tuned to compress them better. The effect of Z_FILTERED is to force more
Huffman coding and less string matching; it is somewhat intermediate
between Z_DEFAULT and Z_HUFFMAN_ONLY. The strategy parameter only affects
the compression ratio but not the correctness of the compressed output even
if it is not set appropriately.
deflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_STREAM_ERROR if a parameter is invalid (such as an invalid
method). msg is set to null if there is no error message. deflateInit2 does
not perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflateSetDictionary OF((z_streamp strm,
const Bytef *dictionary,
uInt dictLength));
/*
Initializes the compression dictionary from the given byte sequence
without producing any compressed output. This function must be called
immediately after deflateInit, deflateInit2 or deflateReset, before any
call of deflate. The compressor and decompressor must use exactly the same
dictionary (see inflateSetDictionary).
The dictionary should consist of strings (byte sequences) that are likely
to be encountered later in the data to be compressed, with the most commonly
used strings preferably put towards the end of the dictionary. Using a
dictionary is most useful when the data to be compressed is short and can be
predicted with good accuracy; the data can then be compressed better than
with the default empty dictionary.
Depending on the size of the compression data structures selected by
deflateInit or deflateInit2, a part of the dictionary may in effect be
discarded, for example if the dictionary is larger than the window size in
deflate or deflate2. Thus the strings most likely to be useful should be
put at the end of the dictionary, not at the front.
Upon return of this function, strm->adler is set to the Adler32 value
of the dictionary; the decompressor may later use this value to determine
which dictionary has been used by the compressor. (The Adler32 value
applies to the whole dictionary even if only a subset of the dictionary is
actually used by the compressor.)
deflateSetDictionary returns Z_OK if success, or Z_STREAM_ERROR if a
parameter is invalid (such as NULL dictionary) or the stream state is
inconsistent (for example if deflate has already been called for this stream
or if the compression method is bsort). deflateSetDictionary does not
perform any compression: this will be done by deflate().
*/
ZEXTERN int ZEXPORT deflateCopy OF((z_streamp dest,
z_streamp source));
/*
Sets the destination stream as a complete copy of the source stream.
This function can be useful when several compression strategies will be
tried, for example when there are several ways of pre-processing the input
data with a filter. The streams that will be discarded should then be freed
by calling deflateEnd. Note that deflateCopy duplicates the internal
compression state which can be quite large, so this strategy is slow and
can consume lots of memory.
deflateCopy returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_STREAM_ERROR if the source stream state was inconsistent
(such as zalloc being NULL). msg is left unchanged in both source and
destination.
*/
ZEXTERN int ZEXPORT deflateReset OF((z_streamp strm));
/*
This function is equivalent to deflateEnd followed by deflateInit,
but does not free and reallocate all the internal compression state.
The stream will keep the same compression level and any other attributes
that may have been set by deflateInit2.
deflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
stream state was inconsistent (such as zalloc or state being NULL).
*/
ZEXTERN int ZEXPORT deflateParams OF((z_streamp strm,
int level,
int strategy));
/*
Dynamically update the compression level and compression strategy. The
interpretation of level and strategy is as in deflateInit2. This can be
used to switch between compression and straight copy of the input data, or
to switch to a different kind of input data requiring a different
strategy. If the compression level is changed, the input available so far
is compressed with the old level (and may be flushed); the new level will
take effect only at the next call of deflate().
Before the call of deflateParams, the stream state must be set as for
a call of deflate(), since the currently available input may have to
be compressed and flushed. In particular, strm->avail_out must be non-zero.
deflateParams returns Z_OK if success, Z_STREAM_ERROR if the source
stream state was inconsistent or if a parameter was invalid, Z_BUF_ERROR
if strm->avail_out was zero.
*/
/*
ZEXTERN int ZEXPORT inflateInit2 OF((z_streamp strm,
int windowBits));
This is another version of inflateInit with an extra parameter. The
fields next_in, avail_in, zalloc, zfree and opaque must be initialized
before by the caller.
The windowBits parameter is the base two logarithm of the maximum window
size (the size of the history buffer). It should be in the range 8..15 for
this version of the library. The default value is 15 if inflateInit is used
instead. If a compressed stream with a larger window size is given as
input, inflate() will return with the error code Z_DATA_ERROR instead of
trying to allocate a larger window.
inflateInit2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_STREAM_ERROR if a parameter is invalid (such as a negative
memLevel). msg is set to null if there is no error message. inflateInit2
does not perform any decompression apart from reading the zlib header if
present: this will be done by inflate(). (So next_in and avail_in may be
modified, but next_out and avail_out are unchanged.)
*/
ZEXTERN int ZEXPORT inflateSetDictionary OF((z_streamp strm,
const Bytef *dictionary,
uInt dictLength));
/*
Initializes the decompression dictionary from the given uncompressed byte
sequence. This function must be called immediately after a call of inflate
if this call returned Z_NEED_DICT. The dictionary chosen by the compressor
can be determined from the Adler32 value returned by this call of
inflate. The compressor and decompressor must use exactly the same
dictionary (see deflateSetDictionary).
inflateSetDictionary returns Z_OK if success, Z_STREAM_ERROR if a
parameter is invalid (such as NULL dictionary) or the stream state is
inconsistent, Z_DATA_ERROR if the given dictionary doesn't match the
expected one (incorrect Adler32 value). inflateSetDictionary does not
perform any decompression: this will be done by subsequent calls of
inflate().
*/
ZEXTERN int ZEXPORT inflateSync OF((z_streamp strm));
/*
Skips invalid compressed data until a full flush point (see above the
description of deflate with Z_FULL_FLUSH) can be found, or until all
available input is skipped. No output is provided.
inflateSync returns Z_OK if a full flush point has been found, Z_BUF_ERROR
if no more input was provided, Z_DATA_ERROR if no flush point has been found,
or Z_STREAM_ERROR if the stream structure was inconsistent. In the success
case, the application may save the current current value of total_in which
indicates where valid compressed data was found. In the error case, the
application may repeatedly call inflateSync, providing more input each time,
until success or end of the input data.
*/
ZEXTERN int ZEXPORT inflateReset OF((z_streamp strm));
/*
This function is equivalent to inflateEnd followed by inflateInit,
but does not free and reallocate all the internal decompression state.
The stream will keep attributes that may have been set by inflateInit2.
inflateReset returns Z_OK if success, or Z_STREAM_ERROR if the source
stream state was inconsistent (such as zalloc or state being NULL).
*/
/* utility functions */
/*
The following utility functions are implemented on top of the
basic stream-oriented functions. To simplify the interface, some
default options are assumed (compression level and memory usage,
standard memory allocation functions). The source code of these
utility functions can easily be modified if you need special options.
*/
ZEXTERN int ZEXPORT compress OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen));
/*
Compresses the source buffer into the destination buffer. sourceLen is
the byte length of the source buffer. Upon entry, destLen is the total
size of the destination buffer, which must be at least 0.1% larger than
sourceLen plus 12 bytes. Upon exit, destLen is the actual size of the
compressed buffer.
This function can be used to compress a whole file at once if the
input file is mmap'ed.
compress returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if there was not enough room in the output
buffer.
*/
ZEXTERN int ZEXPORT compress2 OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen,
int level));
/*
Compresses the source buffer into the destination buffer. The level
parameter has the same meaning as in deflateInit. sourceLen is the byte
length of the source buffer. Upon entry, destLen is the total size of the
destination buffer, which must be at least 0.1% larger than sourceLen plus
12 bytes. Upon exit, destLen is the actual size of the compressed buffer.
compress2 returns Z_OK if success, Z_MEM_ERROR if there was not enough
memory, Z_BUF_ERROR if there was not enough room in the output buffer,
Z_STREAM_ERROR if the level parameter is invalid.
*/
ZEXTERN int ZEXPORT uncompress OF((Bytef *dest, uLongf *destLen,
const Bytef *source, uLong sourceLen));
/*
Decompresses the source buffer into the destination buffer. sourceLen is
the byte length of the source buffer. Upon entry, destLen is the total
size of the destination buffer, which must be large enough to hold the
entire uncompressed data. (The size of the uncompressed data must have
been saved previously by the compressor and transmitted to the decompressor
by some mechanism outside the scope of this compression library.)
Upon exit, destLen is the actual size of the compressed buffer.
This function can be used to decompress a whole file at once if the
input file is mmap'ed.
uncompress returns Z_OK if success, Z_MEM_ERROR if there was not
enough memory, Z_BUF_ERROR if there was not enough room in the output
buffer, or Z_DATA_ERROR if the input data was corrupted.
*/
typedef voidp gzFile;
ZEXTERN gzFile ZEXPORT gzopen OF((const char *path, const char *mode));
/*
Opens a gzip (.gz) file for reading or writing. The mode parameter
is as in fopen ("rb" or "wb") but can also include a compression level
("wb9") or a strategy: 'f' for filtered data as in "wb6f", 'h' for
Huffman only compression as in "wb1h". (See the description
of deflateInit2 for more information about the strategy parameter.)
gzopen can be used to read a file which is not in gzip format; in this
case gzread will directly read from the file without decompression.
gzopen returns NULL if the file could not be opened or if there was
insufficient memory to allocate the (de)compression state; errno
can be checked to distinguish the two cases (if errno is zero, the
zlib error is Z_MEM_ERROR). */
ZEXTERN gzFile ZEXPORT gzdopen OF((int fd, const char *mode));
/*
gzdopen() associates a gzFile with the file descriptor fd. File
descriptors are obtained from calls like open, dup, creat, pipe or
fileno (in the file has been previously opened with fopen).
The mode parameter is as in gzopen.
The next call of gzclose on the returned gzFile will also close the
file descriptor fd, just like fclose(fdopen(fd), mode) closes the file
descriptor fd. If you want to keep fd open, use gzdopen(dup(fd), mode).
gzdopen returns NULL if there was insufficient memory to allocate
the (de)compression state.
*/
ZEXTERN int ZEXPORT gzsetparams OF((gzFile file, int level, int strategy));
/*
Dynamically update the compression level or strategy. See the description
of deflateInit2 for the meaning of these parameters.
gzsetparams returns Z_OK if success, or Z_STREAM_ERROR if the file was not
opened for writing.
*/
ZEXTERN int ZEXPORT gzread OF((gzFile file, voidp buf, unsigned len));
/*
Reads the given number of uncompressed bytes from the compressed file.
If the input file was not in gzip format, gzread copies the given number
of bytes into the buffer.
gzread returns the number of uncompressed bytes actually read (0 for
end of file, -1 for error). */
ZEXTERN int ZEXPORT gzwrite OF((gzFile file,
const voidp buf, unsigned len));
/*
Writes the given number of uncompressed bytes into the compressed file.
gzwrite returns the number of uncompressed bytes actually written
(0 in case of error).
*/
ZEXTERN int ZEXPORTVA gzprintf OF((gzFile file, const char *format, ...));
/*
Converts, formats, and writes the args to the compressed file under
control of the format string, as in fprintf. gzprintf returns the number of
uncompressed bytes actually written (0 in case of error).
*/
ZEXTERN int ZEXPORT gzputs OF((gzFile file, const char *s));
/*
Writes the given null-terminated string to the compressed file, excluding
the terminating null character.
gzputs returns the number of characters written, or -1 in case of error.
*/
ZEXTERN char * ZEXPORT gzgets OF((gzFile file, char *buf, int len));
/*
Reads bytes from the compressed file until len-1 characters are read, or
a newline character is read and transferred to buf, or an end-of-file
condition is encountered. The string is then terminated with a null
character.
gzgets returns buf, or Z_NULL in case of error.
*/
ZEXTERN int ZEXPORT gzputc OF((gzFile file, int c));
/*
Writes c, converted to an unsigned char, into the compressed file.
gzputc returns the value that was written, or -1 in case of error.
*/
ZEXTERN int ZEXPORT gzgetc OF((gzFile file));
/*
Reads one byte from the compressed file. gzgetc returns this byte
or -1 in case of end of file or error.
*/
ZEXTERN int ZEXPORT gzflush OF((gzFile file, int flush));
/*
Flushes all pending output into the compressed file. The parameter
flush is as in the deflate() function. The return value is the zlib
error number (see function gzerror below). gzflush returns Z_OK if
the flush parameter is Z_FINISH and all output could be flushed.
gzflush should be called only when strictly necessary because it can
degrade compression.
*/
ZEXTERN z_off_t ZEXPORT gzseek OF((gzFile file,
z_off_t offset, int whence));
/*
Sets the starting position for the next gzread or gzwrite on the
given compressed file. The offset represents a number of bytes in the
uncompressed data stream. The whence parameter is defined as in lseek(2);
the value SEEK_END is not supported.
If the file is opened for reading, this function is emulated but can be
extremely slow. If the file is opened for writing, only forward seeks are
supported; gzseek then compresses a sequence of zeroes up to the new
starting position.
gzseek returns the resulting offset location as measured in bytes from
the beginning of the uncompressed stream, or -1 in case of error, in
particular if the file is opened for writing and the new starting position
would be before the current position.
*/
ZEXTERN int ZEXPORT gzrewind OF((gzFile file));
/*
Rewinds the given file. This function is supported only for reading.
gzrewind(file) is equivalent to (int)gzseek(file, 0L, SEEK_SET)
*/
ZEXTERN z_off_t ZEXPORT gztell OF((gzFile file));
/*
Returns the starting position for the next gzread or gzwrite on the
given compressed file. This position represents a number of bytes in the
uncompressed data stream.
gztell(file) is equivalent to gzseek(file, 0L, SEEK_CUR)
*/
ZEXTERN int ZEXPORT gzeof OF((gzFile file));
/*
Returns 1 when EOF has previously been detected reading the given
input stream, otherwise zero.
*/
ZEXTERN int ZEXPORT gzclose OF((gzFile file));
/*
Flushes all pending output if necessary, closes the compressed file
and deallocates all the (de)compression state. The return value is the zlib
error number (see function gzerror below).
*/
ZEXTERN const char * ZEXPORT gzerror OF((gzFile file, int *errnum));
/*
Returns the error message for the last error which occurred on the
given compressed file. errnum is set to zlib error number. If an
error occurred in the file system and not in the compression library,
errnum is set to Z_ERRNO and the application may consult errno
to get the exact error code.
*/
/* checksum functions */
/*
These functions are not related to compression but are exported
anyway because they might be useful in applications using the
compression library.
*/
ZEXTERN uLong ZEXPORT adler32 OF((uLong adler, const Bytef *buf, uInt len));
/*
Update a running Adler-32 checksum with the bytes buf[0..len-1] and
return the updated checksum. If buf is NULL, this function returns
the required initial value for the checksum.
An Adler-32 checksum is almost as reliable as a CRC32 but can be computed
much faster. Usage example:
uLong adler = adler32(0L, Z_NULL, 0);
while (read_buffer(buffer, length) != EOF) {
adler = adler32(adler, buffer, length);
}
if (adler != original_adler) error();
*/
ZEXTERN uLong ZEXPORT crc32 OF((uLong crc, const Bytef *buf, uInt len));
/*
Update a running crc with the bytes buf[0..len-1] and return the updated
crc. If buf is NULL, this function returns the required initial value
for the crc. Pre- and post-conditioning (one's complement) is performed
within this function so it shouldn't be done by the application.
Usage example:
uLong crc = crc32(0L, Z_NULL, 0);
while (read_buffer(buffer, length) != EOF) {
crc = crc32(crc, buffer, length);
}
if (crc != original_crc) error();
*/
/* various hacks, don't look :) */
/* deflateInit and inflateInit are macros to allow checking the zlib version
* and the compiler's view of z_stream:
*/
ZEXTERN int ZEXPORT deflateInit_ OF((z_streamp strm, int level,
const char *version, int stream_size));
ZEXTERN int ZEXPORT inflateInit_ OF((z_streamp strm,
const char *version, int stream_size));
ZEXTERN int ZEXPORT deflateInit2_ OF((z_streamp strm, int level, int method,
int windowBits, int memLevel,
int strategy, const char *version,
int stream_size));
ZEXTERN int ZEXPORT inflateInit2_ OF((z_streamp strm, int windowBits,
const char *version, int stream_size));
#define deflateInit(strm, level) \
deflateInit_((strm), (level), ZLIB_VERSION, sizeof(z_stream))
#define inflateInit(strm) \
inflateInit_((strm), ZLIB_VERSION, sizeof(z_stream))
#define deflateInit2(strm, level, method, windowBits, memLevel, strategy) \
deflateInit2_((strm),(level),(method),(windowBits),(memLevel),\
(strategy), ZLIB_VERSION, sizeof(z_stream))
#define inflateInit2(strm, windowBits) \
inflateInit2_((strm), (windowBits), ZLIB_VERSION, sizeof(z_stream))
#if !defined(_Z_UTIL_H) && !defined(NO_DUMMY_DECL)
struct internal_state {int dummy;}; /* hack for buggy compilers */
#endif
ZEXTERN const char * ZEXPORT zError OF((int err));
ZEXTERN int ZEXPORT inflateSyncPoint OF((z_streamp z));
ZEXTERN const uLongf * ZEXPORT get_crc_table OF((void));
#ifdef __cplusplus
}
#endif
#endif /* _ZLIB_H */
linux/include/zlib/zutil.h
+225
View File
@@ -0,0 +1,225 @@
/* zutil.h -- internal interface and configuration of the compression library
* Copyright (C) 1995-2002 Jean-loup Gailly.
* For conditions of distribution and use, see copyright notice in zlib.h
*/
/* WARNING: this file should *not* be used by applications. It is
part of the implementation of the compression library and is
subject to change. Applications should only use zlib.h.
*/
/* @(#) $Id: zutil.h,v 1.1 2004/03/15 20:35:25 as Exp $ */
#ifndef _Z_UTIL_H
#define _Z_UTIL_H
#include "zlib.h"
#include <linux/string.h>
#define HAVE_MEMCPY
#if 0 // #ifdef STDC
# include <stddef.h>
# include <string.h>
# include <stdlib.h>
#endif
#ifndef __KERNEL__
#ifdef NO_ERRNO_H
extern int errno;
#else
# include <errno.h>
#endif
#endif
#ifndef local
# define local static
#endif
/* compile with -Dlocal if your debugger can't find static symbols */
typedef unsigned char uch;
typedef uch FAR uchf;
typedef unsigned short ush;
typedef ush FAR ushf;
typedef unsigned long ulg;
extern const char *z_errmsg[10]; /* indexed by 2-zlib_error */
/* (size given to avoid silly warnings with Visual C++) */
#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
#define ERR_RETURN(strm,err) \
return (strm->msg = ERR_MSG(err), (err))
/* To be used only when the state is known to be valid */
/* common constants */
#ifndef DEF_WBITS
# define DEF_WBITS MAX_WBITS
#endif
/* default windowBits for decompression. MAX_WBITS is for compression only */
#if MAX_MEM_LEVEL >= 8
# define DEF_MEM_LEVEL 8
#else
# define DEF_MEM_LEVEL MAX_MEM_LEVEL
#endif
/* default memLevel */
#define STORED_BLOCK 0
#define STATIC_TREES 1
#define DYN_TREES 2
/* The three kinds of block type */
#define MIN_MATCH 3
#define MAX_MATCH 258
/* The minimum and maximum match lengths */
#define PRESET_DICT 0x20 /* preset dictionary flag in zlib header */
/* target dependencies */
#ifdef MSDOS
# define OS_CODE 0x00
# if defined(__TURBOC__) || defined(__BORLANDC__)
# if(__STDC__ == 1) && (defined(__LARGE__) || defined(__COMPACT__))
/* Allow compilation with ANSI keywords only enabled */
void _Cdecl farfree( void *block );
void *_Cdecl farmalloc( unsigned long nbytes );
# else
# include <alloc.h>
# endif
# else /* MSC or DJGPP */
# include <malloc.h>
# endif
#endif
#ifdef OS2
# define OS_CODE 0x06
#endif
#ifdef WIN32 /* Window 95 & Windows NT */
# define OS_CODE 0x0b
#endif
#if defined(VAXC) || defined(VMS)
# define OS_CODE 0x02
# define F_OPEN(name, mode) \
fopen((name), (mode), "mbc=60", "ctx=stm", "rfm=fix", "mrs=512")
#endif
#ifdef AMIGA
# define OS_CODE 0x01
#endif
#if defined(ATARI) || defined(atarist)
# define OS_CODE 0x05
#endif
#if defined(MACOS) || defined(TARGET_OS_MAC)
# define OS_CODE 0x07
# if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
# include <unix.h> /* for fdopen */
# else
# ifndef fdopen
# define fdopen(fd,mode) NULL /* No fdopen() */
# endif
# endif
#endif
#ifdef __50SERIES /* Prime/PRIMOS */
# define OS_CODE 0x0F
#endif
#ifdef TOPS20
# define OS_CODE 0x0a
#endif
#if defined(_BEOS_) || defined(RISCOS)
# define fdopen(fd,mode) NULL /* No fdopen() */
#endif
#if (defined(_MSC_VER) && (_MSC_VER > 600))
# define fdopen(fd,type) _fdopen(fd,type)
#endif
/* Common defaults */
#ifndef OS_CODE
# define OS_CODE 0x03 /* assume Unix */
#endif
#ifndef F_OPEN
# define F_OPEN(name, mode) fopen((name), (mode))
#endif
/* functions */
#ifdef HAVE_STRERROR
extern char *strerror OF((int));
# define zstrerror(errnum) strerror(errnum)
#else
# define zstrerror(errnum) ""
#endif
#if defined(pyr)
# define NO_MEMCPY
#endif
#if defined(SMALL_MEDIUM) && !defined(_MSC_VER) && !defined(__SC__)
/* Use our own functions for small and medium model with MSC <= 5.0.
* You may have to use the same strategy for Borland C (untested).
* The __SC__ check is for Symantec.
*/
# define NO_MEMCPY
#endif
#if defined(STDC) && !defined(HAVE_MEMCPY) && !defined(NO_MEMCPY)
# define HAVE_MEMCPY
#endif
#ifdef HAVE_MEMCPY
# ifdef SMALL_MEDIUM /* MSDOS small or medium model */
# define zmemcpy _fmemcpy
# define zmemcmp _fmemcmp
# define zmemzero(dest, len) _fmemset(dest, 0, len)
# else
# define zmemcpy memcpy
# define zmemcmp memcmp
# define zmemzero(dest, len) memset(dest, 0, len)
# endif
#else
extern void zmemcpy OF((Bytef* dest, const Bytef* source, uInt len));
extern int zmemcmp OF((const Bytef* s1, const Bytef* s2, uInt len));
extern void zmemzero OF((Bytef* dest, uInt len));
#endif
/* Diagnostic functions */
#ifdef DEBUG
# include <stdio.h>
extern int z_verbose;
extern void z_error OF((char *m));
# define Assert(cond,msg) {if(!(cond)) z_error(msg);}
# define Trace(x) {if (z_verbose>=0) fprintf x ;}
# define Tracev(x) {if (z_verbose>0) fprintf x ;}
# define Tracevv(x) {if (z_verbose>1) fprintf x ;}
# define Tracec(c,x) {if (z_verbose>0 && (c)) fprintf x ;}
# define Tracecv(c,x) {if (z_verbose>1 && (c)) fprintf x ;}
#else
# define Assert(cond,msg)
# define Trace(x)
# define Tracev(x)
# define Tracevv(x)
# define Tracec(c,x)
# define Tracecv(c,x)
#endif
typedef uLong (ZEXPORT *check_func) OF((uLong check, const Bytef *buf,
uInt len));
voidpf zcalloc OF((voidpf opaque, unsigned items, unsigned size));
void zcfree OF((voidpf opaque, voidpf ptr));
#define ZALLOC(strm, items, size) \
(*((strm)->zalloc))((strm)->opaque, (items), (size))
#define ZFREE(strm, addr) (*((strm)->zfree))((strm)->opaque, (voidpf)(addr))
#define TRY_FREE(s, p) {if (p) ZFREE(s, p);}
#endif /* _Z_UTIL_H */