<commit_before>/*	$OpenBSD: ip_ipsp.h,v 1.86 2001/05/21 03:02:19 angelos Exp $	*/

/*
 * The authors of this code are <NAME> (<EMAIL>),
 * <NAME> (<EMAIL>),
 * <NAME> (<EMAIL>) and
 * <NAME> (<EMAIL>).
 *
 * The original version of this code was written by <NAME>
 * for BSD/OS in Athens, Greece, in November 1995.
 *
 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
 * by <NAME>.
 *
 * Additional transforms and features in 1997 and 1998 by <NAME>
 * and <NAME>.
 *
 * Additional features in 1999 by <NAME> and <NAME>.
 *
 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by <NAME>,
 * <NAME> and <NAME>.
 * Copyright (c) 1999 <NAME>.
 *
 * Permission to use, copy, and modify this software without fee
 * is hereby granted, provided that this entire notice is included in
 * all copies of any software which is or includes a copy or
 * modification of this software.
 * You may use this code under the GNU public license if you so wish. Please
 * contribute changes back to the authors under this freer than GPL license
 * so that we may further the use of strong encryption without limitations to
 * all.
 *
 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
 * PURPOSE.
 */

#ifndef _NETINET_IPSP_H_
#define _NETINET_IPSP_H_

/*
 * IPSP global definitions.
 */

#include <sys/types.h>
#include <sys/queue.h>
#include <sys/timeout.h>
#include <netinet/in.h>

union sockaddr_union
{
    struct sockaddr     sa;
    struct sockaddr_in  sin;
    struct sockaddr_in6 sin6;
};

/* HMAC key sizes */
#define MD5HMAC96_KEYSIZE       16
#define SHA1HMAC96_KEYSIZE      20
#define RIPEMD160HMAC96_KEYSIZE 20

#define AH_HMAC_HASHLEN		12	/* 96 bits of authenticator */
#define AH_HMAC_RPLENGTH        4	/* 32 bits of replay counter */
#define AH_HMAC_INITIAL_RPL	1	/* Replay counter initial value */

/* Authenticator lengths */
#define AH_MD5_ALEN		16
#define AH_SHA1_ALEN		20
#define AH_RMD160_ALEN		20
#define AH_ALEN_MAX		20 	/* Keep updated */

/* Reserved SPI numbers */
#define SPI_LOCAL_USE		0
#define SPI_RESERVED_MIN	1
#define SPI_RESERVED_MAX	255

/* sysctl default values */
#define IPSEC_DEFAULT_EMBRYONIC_SA_TIMEOUT	60	/* 1 minute */
#define IPSEC_DEFAULT_PFS                       1
#define IPSEC_DEFAULT_SOFT_ALLOCATIONS          0
#define IPSEC_DEFAULT_EXP_ALLOCATIONS           0
#define IPSEC_DEFAULT_SOFT_BYTES                0
#define IPSEC_DEFAULT_EXP_BYTES                 0
#define IPSEC_DEFAULT_SOFT_TIMEOUT              80000
#define IPSEC_DEFAULT_EXP_TIMEOUT               86400
#define IPSEC_DEFAULT_SOFT_FIRST_USE            3600
#define IPSEC_DEFAULT_EXP_FIRST_USE             7200
#define IPSEC_DEFAULT_DEF_ENC                   "aes"
#define IPSEC_DEFAULT_DEF_AUTH                   "hmac-sha1"
#define IPSEC_DEFAULT_EXPIRE_ACQUIRE            30

struct sockaddr_encap
{
    u_int8_t	sen_len;		/* length */
    u_int8_t	sen_family;		/* PF_KEY */
    u_int16_t	sen_type;		/* see SENT_* */
    union
    {
	struct				/* SENT_IP4 */
	{
	    u_int8_t Direction;
	    struct in_addr Src;
	    struct in_addr Dst;
	    u_int8_t Proto;
	    u_int16_t Sport;
	    u_int16_t Dport;
	} Sip4;

	struct				/* SENT_IP6 */
	{
	    u_int8_t Direction;
	    struct in6_addr Src;
	    struct in6_addr Dst;
	    u_int8_t Proto;
	    u_int16_t Sport;
	    u_int16_t Dport;
	} Sip6;

	struct ipsec_policy *PolicyHead;  /* SENT_IPSP */
    } Sen;
};

#define IPSP_DIRECTION_IN     0x1
#define IPSP_DIRECTION_OUT    0x2

#define sen_data	  Sen.Data
#define sen_ip_src	  Sen.Sip4.Src
#define sen_ip_dst	  Sen.Sip4.Dst
#define sen_proto	  Sen.Sip4.Proto
#define sen_sport	  Sen.Sip4.Sport
#define sen_dport	  Sen.Sip4.Dport
#define sen_direction     Sen.Sip4.Direction
#define sen_ip6_src	  Sen.Sip6.Src
#define sen_ip6_dst	  Sen.Sip6.Dst
#define sen_ip6_proto	  Sen.Sip6.Proto
#define sen_ip6_sport	  Sen.Sip6.Sport
#define sen_ip6_dport	  Sen.Sip6.Dport
#define sen_ip6_direction Sen.Sip6.Direction
#define sen_ipsp          Sen.PolicyHead

/*
 * The "type" is really part of the address as far as the routing
 * system is concerned. By using only one bit in the type field
 * for each type, we sort-of make sure that different types of
 * encapsulation addresses won't be matched against the wrong type.
 *
 */

#define SENT_IP4	0x0001		/* data is two struct in_addr */
#define SENT_IPSP	0x0002		/* data as in IP4/6 plus SPI */
#define SENT_IP6        0x0004

#define SENT_LEN        sizeof(struct sockaddr_encap)

struct ipsec_ref
{
    int ref_type;		/* Subtype of data */
    int ref_len;		/* Length of data following */
    int ref_count;		/* Reference count */
    int ref_malloctype;		/* malloc(9) type, for free'ing purposes */
};

struct ipsec_acquire
{
    union sockaddr_union       ipa_addr;
    u_int64_t                  ipa_expire;
    u_int32_t                  ipa_seq;
    struct sockaddr_encap      ipa_info;
    struct sockaddr_encap      ipa_mask;
    struct mbuf               *ipa_packet;
    TAILQ_ENTRY(ipsec_acquire) ipa_next;<commit_msg>Use int16_t for the type and length of ipsec_ref objects.<commit_after>/*	$OpenBSD: ip_ipsp.h,v 1.87 2001/05/21 03:23:36 angelos Exp $	*/

/*
 * The authors of this code are <NAME> (<EMAIL>),
 * <NAME> (<EMAIL>),
 * <NAME> (<EMAIL>) and
 * <NAME> (<EMAIL>).
 *
 * The original version of this code was written by <NAME>
 * for BSD/OS in Athens, Greece, in November 1995.
 *
 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
 * by <NAME>.
 *
 * Additional transforms and features in 1997 and 1998 by <NAME>
 * and <NAME>.
 *
 * Additional features in 1999 by <NAME> and <NAME>.
 *
 * Copyright (c) 1995, 1996, 1997, 1998, 1999 by <NAME>,
 * <NAME> and <NAME>.
 * Copyright (c) 1999 <NAME>.
 *
 * Permission to use, copy, and modify this software without fee
 * is hereby granted, provided that this entire notice is included in
 * all copies of any software which is or includes a copy or
 * modification of this software.
 * You may use this code under the GNU public license if you so wish. Please
 * contribute changes back to the authors under this freer than GPL license
 * so that we may further the use of strong encryption without limitations to
 * all.
 *
 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
 * PURPOSE.
 */

#ifndef _NETINET_IPSP_H_
#define _NETINET_IPSP_H_

/*
 * IPSP global definitions.
 */

#include <sys/types.h>
#include <sys/queue.h>
#include <sys/timeout.h>
#include <netinet/in.h>

union sockaddr_union
{
    struct sockaddr     sa;
    struct sockaddr_in  sin;
    struct sockaddr_in6 sin6;
};

/* HMAC key sizes */
#define MD5HMAC96_KEYSIZE       16
#define SHA1HMAC96_KEYSIZE      20
#define RIPEMD160HMAC96_KEYSIZE 20

#define AH_HMAC_HASHLEN		12	/* 96 bits of authenticator */
#define AH_HMAC_RPLENGTH        4	/* 32 bits of replay counter */
#define AH_HMAC_INITIAL_RPL	1	/* Replay counter initial value */

/* Authenticator lengths */
#define AH_MD5_ALEN		16
#define AH_SHA1_ALEN		20
#define AH_RMD160_ALEN		20
#define AH_ALEN_MAX		20 	/* Keep updated */

/* Reserved SPI numbers */
#define SPI_LOCAL_USE		0
#define SPI_RESERVED_MIN	1
#define SPI_RESERVED_MAX	255

/* sysctl default values */
#define IPSEC_DEFAULT_EMBRYONIC_SA_TIMEOUT	60	/* 1 minute */
#define IPSEC_DEFAULT_PFS                       1
#define IPSEC_DEFAULT_SOFT_ALLOCATIONS          0
#define IPSEC_DEFAULT_EXP_ALLOCATIONS           0
#define IPSEC_DEFAULT_SOFT_BYTES                0
#define IPSEC_DEFAULT_EXP_BYTES                 0
#define IPSEC_DEFAULT_SOFT_TIMEOUT              80000
#define IPSEC_DEFAULT_EXP_TIMEOUT               86400
#define IPSEC_DEFAULT_SOFT_FIRST_USE            3600
#define IPSEC_DEFAULT_EXP_FIRST_USE             7200
#define IPSEC_DEFAULT_DEF_ENC                   "aes"
#define IPSEC_DEFAULT_DEF_AUTH                   "hmac-sha1"
#define IPSEC_DEFAULT_EXPIRE_ACQUIRE            30

struct sockaddr_encap
{
    u_int8_t	sen_len;		/* length */
    u_int8_t	sen_family;		/* PF_KEY */
    u_int16_t	sen_type;		/* see SENT_* */
    union
    {
	struct				/* SENT_IP4 */
	{
	    u_int8_t Direction;
	    struct in_addr Src;
	    struct in_addr Dst;
	    u_int8_t Proto;
	    u_int16_t Sport;
	    u_int16_t Dport;
	} Sip4;

	struct				/* SENT_IP6 */
	{
	    u_int8_t Direction;
	    struct in6_addr Src;
	    struct in6_addr Dst;
	    u_int8_t Proto;
	    u_int16_t Sport;
	    u_int16_t Dport;
	} Sip6;

	struct ipsec_policy *PolicyHead;  /* SENT_IPSP */
    } Sen;
};

#define IPSP_DIRECTION_IN     0x1
#define IPSP_DIRECTION_OUT    0x2

#define sen_data	  Sen.Data
#define sen_ip_src	  Sen.Sip4.Src
#define sen_ip_dst	  Sen.Sip4.Dst
#define sen_proto	  Sen.Sip4.Proto
#define sen_sport	  Sen.Sip4.Sport
#define sen_dport	  Sen.Sip4.Dport
#define sen_direction     Sen.Sip4.Direction
#define sen_ip6_src	  Sen.Sip6.Src
#define sen_ip6_dst	  Sen.Sip6.Dst
#define sen_ip6_proto	  Sen.Sip6.Proto
#define sen_ip6_sport	  Sen.Sip6.Sport
#define sen_ip6_dport	  Sen.Sip6.Dport
#define sen_ip6_direction Sen.Sip6.Direction
#define sen_ipsp          Sen.PolicyHead

/*
 * The "type" is really part of the address as far as the routing
 * system is concerned. By using only one bit in the type field
 * for each type, we sort-of make sure that different types of
 * encapsulation addresses won't be matched against the wrong type.
 *
 */

#define SENT_IP4	0x0001		/* data is two struct in_addr */
#define SENT_IPSP	0x0002		/* data as in IP4/6 plus SPI */
#define SENT_IP6        0x0004

#define SENT_LEN        sizeof(struct sockaddr_encap)

struct ipsec_ref
{
    u_int16_t ref_type;		/* Subtype of data */
    int16_t   ref_len;		/* Length of data following */
    int       ref_count;	/* Reference count */
    int       ref_malloctype;	/* malloc(9) type, for freeing purposes */
};

struct ipsec_acquire
{
    union sockaddr_union       ipa_addr;
    u_int64_t                  ipa_expire;
    u_int32_t                  ipa_seq;
    struct sockaddr_encap      ipa_info;
    struct sockaddr_encap      ipa_mask;
    struct mbuf               *ipa_packet;
    TAILQ_ENTRY(ipsec_acquire) ipa_next;
{'fraction_non_alphanumeric': 0.0766071257999809, 'fraction_numerical': 0.03935428407679817, 'mean_word_length': 2.970420932878271, 'pattern_counts': {'":': 0, '<': 47, '<?xml version=': 0, '>': 47, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1601572', 'n_tokens_mistral': 4021, 'n_tokens_neox': 3686, 'n_words': 1114}