650 lines
22 KiB
C
650 lines
22 KiB
C
|
/*++
|
||
|
|
|
||
|
|
Copyright (c) 1997-2001 Microsoft Corporation
|
||
|
|
|
||
|
|
Module Name:
|
||
|
|
|
||
|
|
globals.h
|
||
|
|
|
||
|
|
Abstract:
|
||
|
|
|
||
|
|
This is the main header file for IPSEC. Contains all the globals.
|
||
|
|
|
||
|
|
Author:
|
||
|
|
|
||
|
|
Sanjay Anand (SanjayAn) 2-January-1997
|
||
|
|
ChunYe
|
||
|
|
|
||
|
|
Environment:
|
||
|
|
|
||
|
|
Kernel mode
|
||
|
|
|
||
|
|
Revision History:
|
||
|
|
|
||
|
|
--*/
|
||
|
|
|
||
|
|
|
||
|
|
#ifndef _GLOBALS_H
|
||
|
|
#define _GLOBALS_H
|
||
|
|
|
||
|
|
|
||
|
|
#define MAX_COUNT_STRING_LEN 32
|
||
|
|
|
||
|
|
#define MAX_IP_OPTION_SIZE 40
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
// 64 bytes
|
||
|
|
#define MAX_KEYLEN_SHA 64
|
||
|
|
#define MAX_KEYLEN_MD5 64
|
||
|
|
|
||
|
|
// 8 bytes
|
||
|
|
#define MAX_KEYLEN_DES 8
|
||
|
|
#define MAX_IV_LEN DES_BLOCKLEN
|
||
|
|
|
||
|
|
#define MAX_KEY_LEN MAX(MAX_KEYLEN_MD5, MAX_KEYLEN_DES)
|
||
|
|
|
||
|
|
//
|
||
|
|
// we set aside SPIs between 256 and 65536 (64K) for hardware offload
|
||
|
|
//
|
||
|
|
#define LOWER_BOUND_SPI 256
|
||
|
|
#define UPPER_BOUND_SPI ((ULONG) -1) // MAX_ULONG
|
||
|
|
|
||
|
|
#define INVALID_INDEX 0xffffffff
|
||
|
|
|
||
|
|
#define RNG_KEY_SIZE 256 // 2048 bits
|
||
|
|
#define RNG_REKEY_THRESHOLD 65536 // 64K raw bytes
|
||
|
|
|
||
|
|
//
|
||
|
|
// Constants related to filter lists
|
||
|
|
//
|
||
|
|
#define INBOUND_TRANSPORT_FILTER 0
|
||
|
|
#define OUTBOUND_TRANSPORT_FILTER 1
|
||
|
|
#define INBOUND_TUNNEL_FILTER 2
|
||
|
|
#define OUTBOUND_TUNNEL_FILTER 3
|
||
|
|
|
||
|
|
#define MIN_FILTER INBOUND_TRANSPORT_FILTER
|
||
|
|
#define MAX_FILTER OUTBOUND_TUNNEL_FILTER
|
||
|
|
|
||
|
|
#define MIN_TRANSPORT_FILTER INBOUND_TRANSPORT_FILTER
|
||
|
|
#define MAX_TRANSPORT_FILTER OUTBOUND_TRANSPORT_FILTER
|
||
|
|
|
||
|
|
#define MIN_TUNNEL_FILTER INBOUND_TUNNEL_FILTER
|
||
|
|
#define MAX_TUNNEL_FILTER OUTBOUND_TUNNEL_FILTER
|
||
|
|
|
||
|
|
#define INBOUND_OUTBOUND_INCREMENT 1
|
||
|
|
#define TRANSPORT_TUNNEL_INCREMENT 2
|
||
|
|
|
||
|
|
#define NUM_FILTERS (MAX_FILTER - MIN_FILTER + 1)
|
||
|
|
|
||
|
|
//
|
||
|
|
// Number of extra bytes when we pad - one for padlen and other for payloadtype
|
||
|
|
//
|
||
|
|
#define NUM_EXTRA 2
|
||
|
|
|
||
|
|
#define ESP_SIZE (sizeof(ESP) + DES_BLOCKLEN * sizeof(UCHAR))
|
||
|
|
|
||
|
|
#define TRUNCATED_HASH_LEN 12 // 96 bits
|
||
|
|
#define REPLAY_WINDOW_SIZE 64
|
||
|
|
|
||
|
|
#define MAX_PAD_LEN (DES_BLOCKLEN + NUM_EXTRA - 1)
|
||
|
|
|
||
|
|
#define IPSEC_SMALL_BUFFER_SIZE 50
|
||
|
|
#define IPSEC_LARGE_BUFFER_SIZE 200
|
||
|
|
|
||
|
|
#define IPSEC_CACHE_LINE_SIZE 16
|
||
|
|
|
||
|
|
#define IPSEC_LIST_DEPTH 5
|
||
|
|
|
||
|
|
typedef ULONG tSPI;
|
||
|
|
|
||
|
|
#define MAX_BLOCKLEN MAX(DES_BLOCKLEN, 0)
|
||
|
|
|
||
|
|
#define IPSEC_TAG_INIT 'ISpI'
|
||
|
|
#define IPSEC_TAG_AH 'TApI'
|
||
|
|
#define IPSEC_TAG_AH_TU 'UApI'
|
||
|
|
#define IPSEC_TAG_ESP 'TEpI'
|
||
|
|
#define IPSEC_TAG_ESP_TU 'UEpI'
|
||
|
|
#define IPSEC_TAG_HUGHES 'THpI'
|
||
|
|
#define IPSEC_TAG_HUGHES_TU 'UHpI'
|
||
|
|
#define IPSEC_TAG_ACQUIRE_CTX 'XApI'
|
||
|
|
#define IPSEC_TAG_FILTER 'IFpI'
|
||
|
|
#define IPSEC_TAG_SA 'ASpI'
|
||
|
|
#define IPSEC_TAG_KEY 'EKpI'
|
||
|
|
#define IPSEC_TAG_TIMER 'ITpI'
|
||
|
|
#define IPSEC_TAG_STALL_QUEUE 'QSpI'
|
||
|
|
#define IPSEC_TAG_LOOKASIDE_LISTS 'ALpI'
|
||
|
|
#define IPSEC_TAG_BUFFER_POOL 'PBpI'
|
||
|
|
#define IPSEC_TAG_SEND_COMPLETE 'CSpI'
|
||
|
|
#define IPSEC_TAG_EVT_QUEUE 'QEpI'
|
||
|
|
#define IPSEC_TAG_HW 'WHpI'
|
||
|
|
#define IPSEC_TAG_HW_PKTINFO 'KPpI'
|
||
|
|
#define IPSEC_TAG_HW_PKTEXT 'XEpI'
|
||
|
|
#define IPSEC_TAG_HW_ADDSA 'SApI'
|
||
|
|
#define IPSEC_TAG_HW_DELSA 'SDpI'
|
||
|
|
#define IPSEC_TAG_HW_PLUMB 'LPpI'
|
||
|
|
#define IPSEC_TAG_COMP 'OCpI'
|
||
|
|
#define IPSEC_TAG_REINJECT 'ERpI'
|
||
|
|
#define IPSEC_TAG_IOCTL 'OIpI'
|
||
|
|
#define IPSEC_TAG_LOG 'OLpI'
|
||
|
|
|
||
|
|
|
||
|
|
#define IPSEC_LOG_PACKET_SIZE 128 //Size in bytes of stored packet in troubleshoot mode
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// The IPSEC ESP payload
|
||
|
|
//
|
||
|
|
typedef struct _ESP {
|
||
|
|
tSPI esp_spi;
|
||
|
|
} ESP, *PESP;
|
||
|
|
|
||
|
|
//
|
||
|
|
// SA Flags - Not mutually exclusive
|
||
|
|
//
|
||
|
|
#define FLAGS_SA_INITIATOR 0x00000001 // use Initiator keys? might be deprecated soon
|
||
|
|
#define FLAGS_SA_OUTBOUND 0x00000002 // outbound SA?
|
||
|
|
#define FLAGS_SA_TUNNEL 0x00000004 // tunnel mode? sa_TunnelAddr is significant
|
||
|
|
#define FLAGS_SA_REPLAY 0x00000008 // check for replays? we always generate replay fields
|
||
|
|
#define FLAGS_SA_REKEY 0x00000010 // is this rekeyed LarvalSA?
|
||
|
|
#define FLAGS_SA_REKEY_ORI 0x00000020 // did this kick off a rekey?
|
||
|
|
#define FLAGS_SA_MANUAL 0x00000040 // manual keyed?
|
||
|
|
#define FLAGS_SA_MTU_BUMPED 0x00000080 // was MTU bumped down on this SA?
|
||
|
|
#define FLAGS_SA_PENDING 0x00000100 // this is on the pending queue.
|
||
|
|
#define FLAGS_SA_TIMER_STARTED 0x00000200 // timer started on this SA
|
||
|
|
#define FLAGS_SA_HW_PLUMBED 0x00000400 // hw acceleration plumbed successfully
|
||
|
|
#define FLAGS_SA_HW_PLUMB_FAILED 0x00000800 // hw acceleration plumbing failed
|
||
|
|
#define FLAGS_SA_HW_DELETE_SA 0x00001000 // hw acceleration - this is the pending delete.
|
||
|
|
#define FLAGS_SA_HW_CRYPTO_ONLY 0x00002000 // hw acceleration - this is a crypto-only provider.
|
||
|
|
#define FLAGS_SA_HW_RESET 0x00004000 // hw acceleration - this offload SA has been reset
|
||
|
|
#define FLAGS_SA_HW_DELETE_QUEUED 0x00008000 // hw acceleration - this SA delete is queued so make sure reset doesn't touch it
|
||
|
|
#define FLAGS_SA_REFERENCED 0x00010000 // is this SA the next of another?
|
||
|
|
#define FLAGS_SA_NOTIFY_PERFORMED 0x00020000 // For inbound only. Notification performed
|
||
|
|
#define FLAGS_SA_ON_FILTER_LIST 0x00040000 // used on inbound SAs to indicate they are on filter lists
|
||
|
|
#define FLAGS_SA_ON_SPI_HASH 0x00080000 // used on inbound SAs to indicate they are on spi hash lists
|
||
|
|
#define FLAGS_SA_EXPIRED 0x00100000 // has this SA expired?
|
||
|
|
#define FLAGS_SA_IDLED_OUT 0x00200000 // has this SA idled out?
|
||
|
|
#define FLAGS_SA_HIBERNATED 0x00400000 // has this SA been hibernated?
|
||
|
|
#define FLAGS_SA_DELETE_BY_IOCTL 0x00800000 // sa delete initiated by external source
|
||
|
|
#define FLAGS_SA_OFFLOADABLE 0x01000000 // is this SA offloadable?
|
||
|
|
#define FLAGS_SA_PASSTHRU_FILTER 0x02000000 // sa derived from a pass-thru filter
|
||
|
|
#define FLAGS_SA_DISABLE_IDLE_OUT 0x04000000 // don't idle out
|
||
|
|
#define FLAGS_SA_DISABLE_ANTI_REPLAY_CHECK 0x08000000 // don't check anti-replay
|
||
|
|
#define FLAGS_SA_DISABLE_LIFETIME_CHECK 0x10000000 // don't check lifetimes
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// SA States - Mutually exclusive
|
||
|
|
//
|
||
|
|
typedef enum _SA_STATE {
|
||
|
|
STATE_SA_CREATED = 1, // when created
|
||
|
|
STATE_SA_LARVAL, // Key negotiation going on - outbound SAs only
|
||
|
|
STATE_SA_ASSOCIATED, // corresp inbound SA created, associated with outbound SA
|
||
|
|
STATE_SA_ACTIVE, // outbound SA completely setup
|
||
|
|
STATE_SA_ZOMBIE // SAs flushed, ready to be deleted
|
||
|
|
} SA_STATE, *PSA_STATE;
|
||
|
|
|
||
|
|
#define IPSEC_SA_SIGNATURE 0x4601
|
||
|
|
#define IPSEC_FILTER_SIGNATURE 0x4602
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
#define IPSEC_SA_D_1 'SAD1'
|
||
|
|
#define IPSEC_SA_D_2 'SAD2'
|
||
|
|
#define IPSEC_SA_D_3 'SAD3'
|
||
|
|
#define IPSEC_SA_D_4 'SAD4'
|
||
|
|
#endif
|
||
|
|
|
||
|
|
typedef struct _FILTER FILTER, *PFILTER;
|
||
|
|
|
||
|
|
typedef struct _INTERNAL_ALGO_INFO {
|
||
|
|
ULONG algoIdentifier;
|
||
|
|
PUCHAR algoKey;
|
||
|
|
ULONG algoKeylen;
|
||
|
|
ULONG algoRounds;
|
||
|
|
} INTERNAL_ALGO_INFO, *PINTERNAL_ALGO_INFO;
|
||
|
|
|
||
|
|
typedef struct _INTERNAL_ALGO {
|
||
|
|
INTERNAL_ALGO_INFO integrityAlgo;
|
||
|
|
INTERNAL_ALGO_INFO confAlgo;
|
||
|
|
INTERNAL_ALGO_INFO compAlgo;
|
||
|
|
} INTERNAL_ALGO, *PINTERNAL_ALGO;
|
||
|
|
|
||
|
|
typedef struct _IPSEC_ACQUIRE_CONTEXT IPSEC_ACQUIRE_CONTEXT, *PIPSEC_ACQUIRE_CONTEXT;
|
||
|
|
typedef struct _FILTER_CACHE FILTER_CACHE, *PFILTER_CACHE;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Security Association Table (SATable)
|
||
|
|
//
|
||
|
|
// Indexed by the following:
|
||
|
|
//
|
||
|
|
// Sender maps {Src Addr, Dest Addr, User Context} to the index
|
||
|
|
//
|
||
|
|
// Receiver maps {Dest Addr, SPI} to the index
|
||
|
|
// SPI values are unique when generated manually, so can be used directly
|
||
|
|
// to index into the SATable for
|
||
|
|
//
|
||
|
|
typedef struct _SATableEntry {
|
||
|
|
LIST_ENTRY sa_SPILinkage; // linkage in SPI hash table list
|
||
|
|
LIST_ENTRY sa_FilterLinkage; // linkage in Filter table list
|
||
|
|
LIST_ENTRY sa_LarvalLinkage; // linkage in Larval SA list
|
||
|
|
LIST_ENTRY sa_PendingLinkage; // linkage in pending SA list - waiting for Acquire Irp
|
||
|
|
|
||
|
|
struct _SATableEntry *sa_AssociatedSA; // outbound -> inbound link
|
||
|
|
struct _SATableEntry *sa_RekeyLarvalSA; // points to the Larval SA on a rekey
|
||
|
|
struct _SATableEntry *sa_RekeyOriginalSA; // Rekey Larval SA points to the original SA that kicked off the rekey
|
||
|
|
|
||
|
|
ULONG sa_Signature; // contains 4601
|
||
|
|
|
||
|
|
ULONG sa_AcquireId; // cross-check with the Acquire Irp context
|
||
|
|
PIPSEC_ACQUIRE_CONTEXT sa_AcquireCtx; // actual acquire context - used to invalidate the context.
|
||
|
|
|
||
|
|
ULONG sa_Flags; // flags as defined above
|
||
|
|
SA_STATE sa_State; // states as defined above
|
||
|
|
|
||
|
|
ULONG sa_Reference; // ref count
|
||
|
|
PFILTER sa_Filter; // assoc filter entry
|
||
|
|
PFILTER_CACHE sa_FilterCache; // back pointer to cache entry so we can disable it when an SA goes away
|
||
|
|
|
||
|
|
KSPIN_LOCK sa_Lock; // lock to protect the FilterCache ptr.
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
ULONG sa_d1;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
ULARGE_INTEGER sa_uliSrcDstAddr;
|
||
|
|
ULARGE_INTEGER sa_uliSrcDstMask;
|
||
|
|
ULARGE_INTEGER sa_uliProtoSrcDstPort;
|
||
|
|
|
||
|
|
IPAddr sa_TunnelAddr; // Tunnel dest end IP Addr
|
||
|
|
IPAddr sa_SrcTunnelAddr; // Tunnel src end IP Addr
|
||
|
|
|
||
|
|
// SPI - host order - if outbound, SPI for remote,
|
||
|
|
// else inbound (our) SPI
|
||
|
|
|
||
|
|
tSPI sa_SPI; // Inbound: in the multiple ops case, this is the SPI of the last operation.
|
||
|
|
// Outbound: order is as specified in the update.
|
||
|
|
|
||
|
|
LONG sa_NumOps; // the total number of operations to be done
|
||
|
|
|
||
|
|
tSPI sa_OtherSPIs[MAX_OPS]; // the other alternate SPIs.
|
||
|
|
|
||
|
|
OPERATION_E sa_Operation[MAX_OPS];
|
||
|
|
INTERNAL_ALGO sa_Algorithm[MAX_OPS];
|
||
|
|
|
||
|
|
ULONG sa_ReplayStartPoint; // corresponds to RP_Key_I/R
|
||
|
|
ULONG sa_ReplayLastSeq[MAX_OPS]; // for replay detection - last seq recd
|
||
|
|
ULONGLONG sa_ReplayBitmap[MAX_OPS]; // for replay detection - 64 packet window
|
||
|
|
ULONG sa_ReplaySendSeq[MAX_OPS]; // for replay detection - next seq # to send
|
||
|
|
ULONG sa_ReplayLen; // for replay detection - length of replay field - 32 bits
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
ULONG sa_d2;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
UCHAR sa_iv[MAX_OPS][DES_BLOCKLEN]; // IV_Key_I/R
|
||
|
|
ULONG sa_ivlen;
|
||
|
|
|
||
|
|
ULONG sa_TruncatedLen; // length of final hash after truncation
|
||
|
|
|
||
|
|
LARGE_INTEGER sa_KeyExpirationTime; // time till re-key
|
||
|
|
LARGE_INTEGER sa_KeyExpirationBytes; // max # of KBytes xformed till re-key
|
||
|
|
LARGE_INTEGER sa_TotalBytesTransformed; // running total
|
||
|
|
LARGE_INTEGER sa_KeyExpirationTimeWithPad;
|
||
|
|
LARGE_INTEGER sa_KeyExpirationBytesWithPad;
|
||
|
|
|
||
|
|
LARGE_INTEGER sa_IdleTime; // total time this SA can sit idle
|
||
|
|
LARGE_INTEGER sa_LastUsedTime; // time this SA was used last
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
ULONG sa_d3;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
LIFETIME sa_Lifetime;
|
||
|
|
|
||
|
|
ULONG sa_BlockedDataLen; // amount of pended data
|
||
|
|
PNDIS_BUFFER sa_BlockedBuffer; // stall queue of 1 Mdl chain
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
ULONG sa_d4;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
Interface *sa_IPIF;
|
||
|
|
|
||
|
|
IPSEC_TIMER sa_Timer; // Timer struct for timer queue
|
||
|
|
|
||
|
|
ULONG sa_ExpiryTime; // time until this SA expires
|
||
|
|
NDIS_HANDLE sa_OffloadHandle;
|
||
|
|
LONG sa_NumSends;
|
||
|
|
WORK_QUEUE_ITEM sa_QueueItem;
|
||
|
|
|
||
|
|
ULONG sa_IPSecOverhead;
|
||
|
|
ULONG sa_NewMTU;
|
||
|
|
|
||
|
|
DWORD sa_QMPFSGroup;
|
||
|
|
IKE_COOKIE_PAIR sa_CookiePair;
|
||
|
|
IPSEC_SA_STATS sa_Stats;
|
||
|
|
UCHAR sa_DestType;
|
||
|
|
} SA_TABLE_ENTRY, *PSA_TABLE_ENTRY;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Context used between Key manager and IPSEC. Points to the Larval SA basically.
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_ACQUIRE_CONTEXT {
|
||
|
|
ULONG AcquireId; // unique ID to represent this transaction
|
||
|
|
PSA_TABLE_ENTRY pSA; // larval SA should contain this ID
|
||
|
|
} IPSEC_ACQUIRE_CONTEXT, *PIPSEC_ACQUIRE_CONTEXT;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Packet Classification/Policy Setting is similar to that of the
|
||
|
|
// Filter Driver. We dont have filters per interface, however.
|
||
|
|
//
|
||
|
|
typedef struct _FILTER {
|
||
|
|
ULONG Signature; // contains 4602
|
||
|
|
BOOLEAN TunnelFilter;
|
||
|
|
BOOLEAN LinkedFilter; // true if on linked list
|
||
|
|
USHORT Flags;
|
||
|
|
PFILTER_CACHE FilterCache; // back pointer to cache entry so we can disable it when filter is deleted
|
||
|
|
LIST_ENTRY MaskedLinkage;
|
||
|
|
ULARGE_INTEGER uliSrcDstAddr;
|
||
|
|
ULARGE_INTEGER uliSrcDstMask;
|
||
|
|
ULARGE_INTEGER uliProtoSrcDstPort;
|
||
|
|
ULARGE_INTEGER uliProtoSrcDstMask;
|
||
|
|
IPAddr TunnelAddr;
|
||
|
|
ULONG Reference; // ref count
|
||
|
|
LONG SAChainSize; // number of entries for SA chain hash
|
||
|
|
ULONG Index; // hinted index
|
||
|
|
GUID PolicyId; // policy GUID
|
||
|
|
GUID FilterId; // filter GUID
|
||
|
|
#if GPC
|
||
|
|
union {
|
||
|
|
LIST_ENTRY GpcLinkage;
|
||
|
|
struct _GPC_FILTER {
|
||
|
|
GPC_HANDLE GpcCfInfoHandle;
|
||
|
|
GPC_HANDLE GpcPatternHandle;
|
||
|
|
} GpcFilter;
|
||
|
|
};
|
||
|
|
#endif
|
||
|
|
LIST_ENTRY SAChain[1]; // chain of SAs associated with this Filter
|
||
|
|
} FILTER, *PFILTER;
|
||
|
|
|
||
|
|
//
|
||
|
|
// a first level cache, contains IP headers cached for fast lookups
|
||
|
|
//
|
||
|
|
typedef struct _FILTER_CACHE {
|
||
|
|
ULARGE_INTEGER uliSrcDstAddr;
|
||
|
|
ULARGE_INTEGER uliProtoSrcDstPort;
|
||
|
|
BOOLEAN FilterEntry; // if TRUE, the next one is a Filter
|
||
|
|
union {
|
||
|
|
PSA_TABLE_ENTRY pSAEntry; // points to the associated SAEntry
|
||
|
|
PFILTER pFilter; // points to the (drop/PassThru filter)
|
||
|
|
};
|
||
|
|
PSA_TABLE_ENTRY pNextSAEntry; // points to the associated NextSAEntry
|
||
|
|
#if DBG
|
||
|
|
ULARGE_INTEGER CacheHitCount;
|
||
|
|
#endif
|
||
|
|
} FILTER_CACHE, *PFILTER_CACHE;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Hash tables for specific SAs
|
||
|
|
//
|
||
|
|
typedef struct _SA_HASH {
|
||
|
|
LIST_ENTRY SAList;
|
||
|
|
} SA_HASH, *PSA_HASH;
|
||
|
|
|
||
|
|
//
|
||
|
|
// This structure is used to hold on to an Irp from the Key manager.
|
||
|
|
// The Irp is completed to kick off an SA negotiation.
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_ACQUIRE_INFO {
|
||
|
|
PIRP Irp; // irp passed down from Key manager
|
||
|
|
LIST_ENTRY PendingAcquires; // linked list of pending acquire requests
|
||
|
|
LIST_ENTRY PendingNotifies; // linked list of pending notifications
|
||
|
|
KSPIN_LOCK Lock;
|
||
|
|
BOOLEAN ResolvingNow; // irp is in user mode doing a resolve
|
||
|
|
BOOLEAN InMe; // irp is in user mode doing a resolve
|
||
|
|
} IPSEC_ACQUIRE_INFO, *PIPSEC_ACQUIRE_INFO;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Buffer for lookaside list descriptors. Lookaside list descriptors
|
||
|
|
// cannot be statically allocated, as they need to ALWAYS be nonpageable,
|
||
|
|
// even when the entire driver is paged out.
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_LOOKASIDE_LISTS {
|
||
|
|
NPAGED_LOOKASIDE_LIST SendCompleteCtxList;
|
||
|
|
NPAGED_LOOKASIDE_LIST LargeBufferList;
|
||
|
|
NPAGED_LOOKASIDE_LIST SmallBufferList;
|
||
|
|
} IPSEC_LOOKASIDE_LISTS, *PIPSEC_LOOKASIDE_LISTS;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Data is organized as an MDL followed by the actual buffer being described by
|
||
|
|
// the mdl.
|
||
|
|
//
|
||
|
|
// !!NOTE: In the struct below, Data should be quadaligned since MDLs are always
|
||
|
|
// quad-aligned.
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_LA_BUFFER {
|
||
|
|
ULONG Tag; // the actual tag this was used for
|
||
|
|
PVOID Buffer; // the actual buffer
|
||
|
|
ULONG BufferLength; // length of the buffer pointed by MDL
|
||
|
|
PMDL Mdl; // pointer to an MDL describing the buffer
|
||
|
|
UCHAR Data[1]; // the real data starts here
|
||
|
|
} IPSEC_LA_BUFFER, *PIPSEC_LA_BUFFER;
|
||
|
|
|
||
|
|
typedef struct _IPSEC_GLOBAL {
|
||
|
|
BOOLEAN DriverUnloading; // Is driver being unloaded?
|
||
|
|
BOOLEAN BoundToIP; // Are we bound to IP yet?
|
||
|
|
BOOLEAN SendBoundToIP; // Is IPSecHandler bound to IP?
|
||
|
|
BOOLEAN InitCrypto; // Are crypto routines initialized?
|
||
|
|
BOOLEAN InitRNG; // Is RNG initialized?
|
||
|
|
BOOLEAN InitTcpip; // Is TCP/IP loaded?
|
||
|
|
#if FIPS
|
||
|
|
BOOLEAN InitFips; // Is Fips driver loaded and function table set?
|
||
|
|
#endif
|
||
|
|
#if GPC
|
||
|
|
BOOLEAN InitGpc; // Is GPC driver loaded and function table set?
|
||
|
|
#endif
|
||
|
|
|
||
|
|
LONG NumSends; // counts the number of pending sends
|
||
|
|
LONG NumThreads; // counts the number of threads in driver
|
||
|
|
LONG NumWorkers; // counts the number of worker threads
|
||
|
|
LONG NumTimers; // counts the number of active timers
|
||
|
|
LONG NumIoctls; // counts the number of active IOCTLs
|
||
|
|
|
||
|
|
LIST_ENTRY LarvalSAList;
|
||
|
|
KSPIN_LOCK LarvalListLock; // protects the larval SA list
|
||
|
|
|
||
|
|
MRSW_LOCK SADBLock; // protects the Filter/SA DB
|
||
|
|
MRSW_LOCK SPIListLock; // protects the SPI list
|
||
|
|
|
||
|
|
//
|
||
|
|
// We partition the filters into tunnel/masked and inbound/outbound filters.
|
||
|
|
//
|
||
|
|
LIST_ENTRY FilterList[NUM_FILTERS];
|
||
|
|
|
||
|
|
ULONG NumPolicies; // number of filters plumbed in the driver
|
||
|
|
ULONG NumTunnelFilters;
|
||
|
|
ULONG NumMaskedFilters;
|
||
|
|
ULONG NumOutboundSAs;
|
||
|
|
ULONG NumMulticastFilters;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Inbound <SPI, dest> hash
|
||
|
|
//
|
||
|
|
PSA_HASH pSADb;
|
||
|
|
LONG NumSA;
|
||
|
|
LONG SAHashSize;
|
||
|
|
|
||
|
|
PFILTER_CACHE *ppCache;
|
||
|
|
ULONG CacheSize;
|
||
|
|
ULONG CacheHalfSize;
|
||
|
|
|
||
|
|
//
|
||
|
|
// SA negotiate context
|
||
|
|
//
|
||
|
|
IPSEC_ACQUIRE_INFO AcquireInfo;
|
||
|
|
|
||
|
|
//
|
||
|
|
// timers
|
||
|
|
//
|
||
|
|
KSPIN_LOCK TimerLock;
|
||
|
|
IPSEC_TIMER_LIST TimerList[IPSEC_CLASS_MAX];
|
||
|
|
|
||
|
|
IPSEC_TIMER ReaperTimer; // reaper thread runs here.
|
||
|
|
|
||
|
|
//
|
||
|
|
// Global lookaside lists. These must always be in nonpaged pool,
|
||
|
|
// even when the driver is paged out.
|
||
|
|
//
|
||
|
|
PIPSEC_LOOKASIDE_LISTS IPSecLookasideLists;
|
||
|
|
|
||
|
|
ULONG IPSecLargeBufferSize;
|
||
|
|
ULONG IPSecLargeBufferListDepth;
|
||
|
|
|
||
|
|
ULONG IPSecSmallBufferSize;
|
||
|
|
ULONG IPSecSmallBufferListDepth;
|
||
|
|
|
||
|
|
ULONG IPSecSendCompleteCtxSize;
|
||
|
|
ULONG IPSecSendCompleteCtxDepth;
|
||
|
|
|
||
|
|
ULONG IPSecCacheLineSize;
|
||
|
|
|
||
|
|
PDEVICE_OBJECT IPSecDevice;
|
||
|
|
PDRIVER_OBJECT IPSecDriverObject;
|
||
|
|
|
||
|
|
ProtInfo IPProtInfo;
|
||
|
|
IPOptInfo OptInfo;
|
||
|
|
|
||
|
|
//
|
||
|
|
// stats
|
||
|
|
//
|
||
|
|
IPSEC_QUERY_STATS Statistics;
|
||
|
|
|
||
|
|
ULONG EnableOffload;
|
||
|
|
ULONG DefaultSAIdleTime;
|
||
|
|
ULONG LogInterval;
|
||
|
|
ULONG EventQueueSize;
|
||
|
|
ULONG RekeyTime;
|
||
|
|
ULONG NoDefaultExempt;
|
||
|
|
|
||
|
|
KSPIN_LOCK EventLogLock; // lock to protect event queue
|
||
|
|
IPSEC_TIMER EventLogTimer;
|
||
|
|
ULONG IPSecBufferedEvents;
|
||
|
|
PUCHAR IPSecLogMemory;
|
||
|
|
PUCHAR IPSecLogMemoryLoc;
|
||
|
|
PUCHAR IPSecLogMemoryEnd;
|
||
|
|
|
||
|
|
LARGE_INTEGER SAIdleTime;
|
||
|
|
|
||
|
|
#if DBG
|
||
|
|
ULARGE_INTEGER CacheHitCount;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
OPERATION_MODE OperationMode;
|
||
|
|
|
||
|
|
ULONG DiagnosticMode;
|
||
|
|
|
||
|
|
#if GPC
|
||
|
|
GPC_EXPORTED_CALLS GpcEntries;
|
||
|
|
GPC_HANDLE GpcClients[GPC_CF_MAX];
|
||
|
|
ULONG GpcActive;
|
||
|
|
ULONG GpcNumFilters[GPC_CF_MAX];
|
||
|
|
LIST_ENTRY GpcFilterList[NUM_FILTERS];
|
||
|
|
#if DBG
|
||
|
|
LARGE_INTEGER GpcTotalPassedIn;
|
||
|
|
LARGE_INTEGER GpcClassifyNeeded;
|
||
|
|
LARGE_INTEGER GpcReClassified;
|
||
|
|
#endif
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#if FIPS
|
||
|
|
PFILE_OBJECT FipsFileObject;
|
||
|
|
FIPS_FUNCTION_TABLE FipsFunctionTable;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
VOID (*TcpipFreeBuff)(struct IPRcvBuf *);
|
||
|
|
INT (*TcpipAllocBuff)(struct IPRcvBuf *, UINT);
|
||
|
|
UCHAR (*TcpipGetAddrType)(IPAddr);
|
||
|
|
IP_STATUS (*TcpipGetInfo)(IPInfo *, INT);
|
||
|
|
NDIS_STATUS (*TcpipNdisRequest)(PVOID, NDIS_REQUEST_TYPE, NDIS_OID, PVOID, UINT, PUINT);
|
||
|
|
PVOID (*TcpipRegisterProtocol)(UCHAR, PVOID, PVOID, PVOID, PVOID, PVOID, PVOID);
|
||
|
|
NTSTATUS (*TcpipSetIPSecStatus)(BOOLEAN);
|
||
|
|
IP_STATUS (*TcpipIPTransmit)(PVOID, PVOID, PNDIS_BUFFER, UINT, IPAddr, IPAddr, IPOptInfo *, RouteCacheEntry *, UCHAR, PIRP);
|
||
|
|
IP_STATUS (*TcpipSetIPSecPtr)(PIPSEC_FUNCTIONS);
|
||
|
|
IP_STATUS (*TcpipUnSetIPSecPtr)(PIPSEC_FUNCTIONS);
|
||
|
|
IP_STATUS (*TcpipUnSetIPSecSendPtr)(PIPSEC_FUNCTIONS);
|
||
|
|
UINT (*TcpipTCPXsum)(UINT, PVOID, UINT);
|
||
|
|
USHORT (*TcpipGenIpId)();
|
||
|
|
PVOID (*TcpipDeRegisterProtocol)(UCHAR);
|
||
|
|
} IPSEC_GLOBAL, *PIPSEC_GLOBAL;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Contexts used to store eventlog contexts.
|
||
|
|
//
|
||
|
|
#define IPSEC_DROP_STATUS_CRYPTO_DONE 0x00000001
|
||
|
|
#define IPSEC_DROP_STATUS_NEXT_CRYPTO_DONE 0x00000002
|
||
|
|
#define IPSEC_DROP_STATUS_SA_DELETE_REQ 0x00000004
|
||
|
|
#define IPSEC_DROP_STATUS_DONT_LOG 0x00000008
|
||
|
|
|
||
|
|
typedef struct _IPSEC_DROP_STATUS {
|
||
|
|
ULONG IPSecStatus;
|
||
|
|
ULONG OffloadStatus;
|
||
|
|
ULONG Flags;
|
||
|
|
} IPSEC_DROP_STATUS, *PIPSEC_DROP_STATUS;
|
||
|
|
|
||
|
|
typedef struct _IPSEC_EVENT_CTX {
|
||
|
|
IPAddr Addr;
|
||
|
|
ULONG EventCode;
|
||
|
|
ULONG UniqueEventValue;
|
||
|
|
ULONG EventCount;
|
||
|
|
PUCHAR pPacket;
|
||
|
|
ULONG PacketSize;
|
||
|
|
IPSEC_DROP_STATUS DropStatus;
|
||
|
|
} IPSEC_EVENT_CTX, *PIPSEC_EVENT_CTX;
|
||
|
|
|
||
|
|
typedef struct _IPSEC_NOTIFY_EXPIRE {
|
||
|
|
LIST_ENTRY notify_PendingLinkage; // linkage in pending SA list - waiting for Acquire Irp
|
||
|
|
ULARGE_INTEGER sa_uliSrcDstAddr;
|
||
|
|
ULARGE_INTEGER sa_uliSrcDstMask;
|
||
|
|
ULARGE_INTEGER sa_uliProtoSrcDstPort;
|
||
|
|
|
||
|
|
IPAddr sa_TunnelAddr; // Tunnel end IP Addr
|
||
|
|
IPAddr sa_InboundTunnelAddr; // Tunnel end IP Addr
|
||
|
|
|
||
|
|
tSPI InboundSpi; // Inbound: in the multiple ops case, this is the SPI of the last operation.
|
||
|
|
tSPI OutboundSpi;
|
||
|
|
|
||
|
|
IKE_COOKIE_PAIR sa_CookiePair;
|
||
|
|
DWORD Flags;
|
||
|
|
} IPSEC_NOTIFY_EXPIRE, *PIPSEC_NOTIFY_EXPIRE;
|
||
|
|
|
||
|
|
typedef IPSEC_ADD_UPDATE_SA IPSEC_ADD_SA, *PIPSEC_ADD_SA;
|
||
|
|
typedef IPSEC_ADD_UPDATE_SA IPSEC_UPDATE_SA, *PIPSEC_UPDATE_SA;
|
||
|
|
|
||
|
|
#define IPSEC_ADD_SA_NO_KEY_SIZE FIELD_OFFSET(IPSEC_ADD_SA, SAInfo.KeyMat[0])
|
||
|
|
#define IPSEC_UPDATE_SA_NO_KEY_SIZE FIELD_OFFSET(IPSEC_UPDATE_SA, SAInfo.KeyMat[0])
|
||
|
|
|
||
|
|
//
|
||
|
|
// Contexts used to store SA plumbing contexts.
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_PLUMB_SA {
|
||
|
|
Interface *DestIF;
|
||
|
|
PSA_TABLE_ENTRY pSA;
|
||
|
|
PUCHAR Buf;
|
||
|
|
ULONG Len;
|
||
|
|
WORK_QUEUE_ITEM PlumbQueueItem;
|
||
|
|
} IPSEC_PLUMB_SA, *PIPSEC_PLUMB_SA;
|
||
|
|
|
||
|
|
//
|
||
|
|
// Contexts used to log events
|
||
|
|
//
|
||
|
|
typedef struct _IPSEC_LOG_EVENT {
|
||
|
|
LONG LogSize;
|
||
|
|
WORK_QUEUE_ITEM LogQueueItem;
|
||
|
|
UCHAR pLog[1];
|
||
|
|
} IPSEC_LOG_EVENT, *PIPSEC_LOG_EVENT;
|
||
|
|
|
||
|
|
|
||
|
|
#endif _GLOBALS_H
|
||
|
|
|