1 /* 2 * Copyright (c) 2008-2013, 2023 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 /* $FreeBSD: src/sys/netinet6/esp.h,v 1.2.2.2 2001/07/03 11:01:49 ume Exp $ */ 30 /* $KAME: esp.h,v 1.16 2000/10/18 21:28:00 itojun Exp $ */ 31 32 /* 33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 34 * All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 3. Neither the name of the project nor the names of its contributors 45 * may be used to endorse or promote products derived from this software 46 * without specific prior written permission. 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 58 * SUCH DAMAGE. 59 */ 60 61 /* 62 * RFC1827/2406 Encapsulated Security Payload. 63 */ 64 65 #ifndef _NETINET6_ESP_H_ 66 #define _NETINET6_ESP_H_ 67 #include <sys/appleapiopts.h> 68 #include <sys/types.h> 69 70 struct esp { 71 u_int32_t esp_spi; /* ESP */ 72 /*variable size, 32bit bound*/ /* Initialization Vector */ 73 /*variable size*/ /* Payload data */ 74 /*variable size*/ /* padding */ 75 /*8bit*/ /* pad size */ 76 /*8bit*/ /* next header */ 77 /*8bit*/ /* next header */ 78 /*variable size, 32bit bound*/ /* Authentication data (new IPsec) */ 79 }; 80 81 struct newesp { 82 u_int32_t esp_spi; /* ESP */ 83 u_int32_t esp_seq; /* Sequence number */ 84 /*variable size*/ /* (IV and) Payload data */ 85 /*variable size*/ /* padding */ 86 /*8bit*/ /* pad size */ 87 /*8bit*/ /* next header */ 88 /*8bit*/ /* next header */ 89 /*variable size, 32bit bound*/ /* Authentication data */ 90 }; 91 92 struct esptail { 93 u_int8_t esp_padlen; /* pad length */ 94 u_int8_t esp_nxt; /* Next header */ 95 /*variable size, 32bit bound*/ /* Authentication data (new IPsec)*/ 96 }; 97 98 #ifdef BSD_KERNEL_PRIVATE 99 struct secasvar; 100 101 #define ESP_AUTH_MAXSUMSIZE 64 102 103 #define ESP_ASSERT(_cond, _format, ...) \ 104 do { \ 105 if (__improbable(!(_cond))) { \ 106 panic("%s:%d " _format, __FUNCTION__, __LINE__, ##__VA_ARGS__); \ 107 } \ 108 } while (0) 109 110 #define ESP_CHECK_ARG(_arg) ESP_ASSERT(_arg != NULL, #_arg " is NULL") 111 112 #define _esp_log(_level, _format, ...) \ 113 log(_level, "%s:%d " _format, __FUNCTION__, __LINE__, ##__VA_ARGS__) 114 #define esp_log_err(_format, ...) _esp_log(LOG_ERR, _format, ##__VA_ARGS__) 115 #define esp_log_default(_format, ...) _esp_log(LOG_NOTICE, _format, ##__VA_ARGS__) 116 #define esp_log_info(_format, ...) _esp_log(LOG_INFO, _format, ##__VA_ARGS__) 117 118 #define _esp_packet_log(_level, _format, ...) \ 119 ipseclog((_level, "%s:%d " _format, __FUNCTION__, __LINE__, ##__VA_ARGS__)) 120 #define esp_packet_log_err(_format, ...) _esp_packet_log(LOG_ERR, _format, ##__VA_ARGS__) 121 122 struct esp_algorithm { 123 uint32_t padbound; /* pad boundary, in byte */ 124 int ivlenval; /* iv length, in byte */ 125 int (*mature)(struct secasvar *); 126 u_int16_t keymin; /* in bits */ 127 u_int16_t keymax; /* in bits */ 128 size_t (*schedlen)(const struct esp_algorithm *); 129 const char *name; 130 int (*ivlen)(const struct esp_algorithm *, struct secasvar *); 131 int (*decrypt)(struct mbuf *, size_t, 132 struct secasvar *, const struct esp_algorithm *, int); 133 int (*encrypt)(struct mbuf *, size_t, size_t, 134 struct secasvar *, const struct esp_algorithm *, int); 135 /* not supposed to be called directly */ 136 int (*schedule)(const struct esp_algorithm *, struct secasvar *); 137 int (*blockdecrypt)(const struct esp_algorithm *, 138 struct secasvar *, u_int8_t *, u_int8_t *); 139 int (*blockencrypt)(const struct esp_algorithm *, 140 struct secasvar *, u_int8_t *, u_int8_t *); 141 /* For Authenticated Encryption Methods */ 142 size_t icvlen; 143 int (*finalizedecrypt)(struct secasvar *, u_int8_t *, size_t); 144 int (*finalizeencrypt)(struct secasvar *, u_int8_t *, size_t); 145 int (*encrypt_pkt)(struct secasvar *, uint8_t *, size_t, 146 struct newesp *, uint8_t *, size_t, uint8_t *, size_t); 147 int (*decrypt_pkt)(struct secasvar *, uint8_t *, size_t, 148 struct newesp *, uint8_t *, size_t, uint8_t *, size_t); 149 }; 150 151 extern os_log_t esp_mpkl_log_object; 152 153 extern const struct esp_algorithm *esp_algorithm_lookup(int); 154 extern int esp_max_ivlen(void); 155 156 /* crypt routines */ 157 extern int esp4_output(struct mbuf *, struct secasvar *); 158 extern void esp4_input(struct mbuf *, int off); 159 extern struct mbuf *esp4_input_extended(struct mbuf *, int off, ifnet_t interface); 160 extern size_t esp_hdrsiz(struct ipsecrequest *); 161 extern int esp_kpipe_output(struct secasvar *, kern_packet_t, kern_packet_t); 162 extern int esp_kpipe_input(ifnet_t, kern_packet_t, kern_packet_t); 163 164 extern int esp_schedule(const struct esp_algorithm *, struct secasvar *); 165 extern int esp_auth(struct mbuf *, size_t, size_t, 166 struct secasvar *, u_char *__sized_by(ESP_AUTH_MAXSUMSIZE)); 167 extern int esp_auth_data(struct secasvar *, uint8_t *, size_t, uint8_t *, size_t); 168 169 extern void esp_init(void); 170 #endif /* BSD_KERNEL_PRIVATE */ 171 172 #endif /* _NETINET6_ESP_H_ */ 173