1 /* $OpenBSD: ip_ah.h,v 1.37 2020/09/01 01:53:34 gnezdo Exp $ */
2 /*
3 * The authors of this code are John Ioannidis (ji@tla.org),
4 * Angelos D. Keromytis (kermit@csd.uch.gr) and
5 * Niels Provos (provos@physnet.uni-hamburg.de).
6 *
7 * The original version of this code was written by John Ioannidis
8 * for BSD/OS in Athens, Greece, in November 1995.
9 *
10 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
11 * by Angelos D. Keromytis.
12 *
13 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
14 * and Niels Provos.
15 *
16 * Additional features in 1999 by Angelos D. Keromytis.
17 *
18 * Copyright (C) 1995, 1996, 1997, 1998, 1999 John Ioannidis,
19 * Angelos D. Keromytis and Niels Provos.
20 * Copyright (c) 2001 Angelos D. Keromytis.
21 *
22 * Permission to use, copy, and modify this software with or without fee
23 * is hereby granted, provided that this entire notice is included in
24 * all copies of any software which is or includes a copy or
25 * modification of this software.
26 * You may use this code under the GNU public license if you so wish. Please
27 * contribute changes back to the authors under this freer than GPL license
28 * so that we may further the use of strong encryption without limitations to
29 * all.
30 *
31 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
32 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
33 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
34 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
35 * PURPOSE.
36 */
37
38 #ifndef _NETINET_IP_AH_H_
39 #define _NETINET_IP_AH_H_
40
41 struct ahstat {
42 uint64_t ahs_hdrops; /* Packet shorter than header shows */
43 uint64_t ahs_nopf; /* Protocol family not supported */
44 uint64_t ahs_notdb;
45 uint64_t ahs_badkcr;
46 uint64_t ahs_badauth;
47 uint64_t ahs_noxform;
48 uint64_t ahs_qfull;
49 uint64_t ahs_wrap;
50 uint64_t ahs_replay;
51 uint64_t ahs_badauthl; /* Bad authenticator length */
52 uint64_t ahs_input; /* Input AH packets */
53 uint64_t ahs_output; /* Output AH packets */
54 uint64_t ahs_invalid; /* Trying to use an invalid TDB */
55 uint64_t ahs_ibytes; /* Input bytes */
56 uint64_t ahs_obytes; /* Output bytes */
57 uint64_t ahs_toobig; /* Packet got larger than
58 * IP_MAXPACKET */
59 uint64_t ahs_pdrops; /* Packet blocked due to policy */
60 uint64_t ahs_crypto; /* Crypto processing failure */
61 uint64_t ahs_outfail; /* Packet output failure */
62 };
63
64 struct ah {
65 u_int8_t ah_nh;
66 u_int8_t ah_hl;
67 u_int16_t ah_rv;
68 u_int32_t ah_spi;
69 u_int32_t ah_rpl; /* We may not use this, if we're using old xforms */
70 };
71
72 /* Length of base AH header */
73 #define AH_FLENGTH 8
74
75 /*
76 * Names for AH sysctl objects
77 */
78 #define AHCTL_ENABLE 1 /* Enable AH processing */
79 #define AHCTL_STATS 2 /* AH stats */
80 #define AHCTL_MAXID 3
81
82 #define AHCTL_NAMES { \
83 { 0, 0 }, \
84 { "enable", CTLTYPE_INT }, \
85 { "stats", CTLTYPE_STRUCT } \
86 }
87
88 #ifdef _KERNEL
89
90 #include <sys/percpu.h>
91
92 enum ahstat_counters {
93 ahs_hdrops, /* Packet shorter than header shows */
94 ahs_nopf, /* Protocol family not supported */
95 ahs_notdb,
96 ahs_badkcr,
97 ahs_badauth,
98 ahs_noxform,
99 ahs_qfull,
100 ahs_wrap,
101 ahs_replay,
102 ahs_badauthl, /* Bad authenticator length */
103 ahs_input, /* Input AH packets */
104 ahs_output, /* Output AH packets */
105 ahs_invalid, /* Trying to use an invalid TDB */
106 ahs_ibytes, /* Input bytes */
107 ahs_obytes, /* Output bytes */
108 ahs_toobig, /* Packet got larger than
109 * IP_MAXPACKET */
110 ahs_pdrops, /* Packet blocked due to policy */
111 ahs_crypto, /* Crypto processing failure */
112 ahs_outfail, /* Packet output failure */
113
114 ahs_ncounters
115 };
116
117 extern struct cpumem *ahcounters;
118
119 static inline void
ahstat_inc(enum ahstat_counters c)120 ahstat_inc(enum ahstat_counters c)
121 {
122 counters_inc(ahcounters, c);
123 }
124
125 static inline void
ahstat_add(enum ahstat_counters c,uint64_t v)126 ahstat_add(enum ahstat_counters c, uint64_t v)
127 {
128 counters_add(ahcounters, c, v);
129 }
130
131 extern int ah_enable;
132
133 #endif /* _KERNEL */
134 #endif /* _NETINET_IP_AH_H_ */
135