freeswan/klips/doc/klips2-design-api-trips.txt

   1 #  -*- mode: Outline; fill-column: 78; fill-prefix: "   " -*-
   2 #
   3 #  klips2-design-api-trips.txt
   4 #       Richard Guy Briggs <rgb@conscoop.ottawa.on.ca>
   5 #
   6 #  RCSID $Id: klips2-design-api-trips.txt,v 1.8 2001/05/30 08:00:14 rgb Exp $
   7 #
   8
   9 # This document outlines various trips that are made through the
  10 # various APIs for different scenarios.  Please see klips2-design.txt
  11 # for an overview.
  12
  13 # Several scenario titles are listed.  Under each scenario title is
  14 # listed point form text to describe what action is happenning and/or
  15 # the reason for the following calls.  Following the descriptive text
  16 # is a origin and destination entity interface description.  Within
  17 # each interface description is a list of specific arguments used or
  18 # that need to be added to accomplish the action.
  19
  20 Opportunistic encryption:
  21         - put a trap in place from KMd
  22                 KMd -> iptables(8) system(3) call (Policy)
  23                 KMd -> ip6tables(8) system(3) call (Policy)
  24                         in:
  25                                 char[] -I
  26                                 char[] -s SADDR/SMASK
  27                                 char[] -d DADDR/DMASK
  28                                 char[] --protocol PROTO
  29                                 char[] --sport SPORT
  30                                 char[] --dport DPORT
  31                                 char[] --uid-owner UID
  32                                 char[] --seclev seclevstr
  33                                 char[] -J TRAP
  34                         out:
  35                                 unsigned char exit_code
  36
  37                 iptables(8) -> seclev match iptables(8) library
  38                 ip6tables(8) -> seclev match ip6tables(8) library
  39                         in:
  40                                 char[] --seclev seclevstr
  41                         out:
  42                                 struct seclev
  43
  44                 iptables(8) -> NetFilter
  45                 ip6tables(8) -> NetFilter
  46                 I/F is already defined in NetFilter.  In addition, it will
  47                 need structures to pass the following:
  48                         in:
  49                                 struct seclev
  50                                 target TRAP
  51
  52         - packet comes
  53                 NetFilter -> seclev match NetFilter kernel module
  54                         in:
  55                                 struct sk_buff *skb
  56                                 struct seclev
  57                         out:
  58                                 boolean
  59
  60                 NetFilter -> sa match NetFilter kernel module
  61                         in:
  62                                 struct sk_buff *skb
  63                                 struct ip_said SA[,...]
  64                         out:
  65                                 boolean
  66
  67         - packet matches TRAP
  68                 NetFilter -> TRAP target NetFilter kernel module
  69                         in:
  70                                 struct sk_buff *skb
  71                         out:
  72                                 unsigned int = NF_STOLEN
  73
  74         - send up an ACQUIRE
  75                 TRAP target NetFilter kernel module -> KMds (PF_KEYv2 ACQUIRE)
  76                         see RFC2367, PF_KEYv2 ACQUIRE
  77
  78         - create HOLD target with skb info and store the first packet
  79                 TRAP target NetFilter kernel module -> NetFilter
  80                         in:
  81                                 struct sk_buff *skb
  82                         out:
  83                                 boolean
  84
  85         - next packet comes in while KMd is negotiating SAs.
  86                 NetFilter -> seclev match NetFilter kernel module
  87                         in:
  88                                 struct sk_buff *skb
  89                                 struct seclev
  90                         out:
  91                                 boolean
  92
  93                 NetFilter -> sa match NetFilter kernel module
  94                         in:
  95                                 struct sk_buff *skb
  96                                 struct ip_said SA[,...]
  97                         out:
  98                                 boolean
  99
 100         - packet matches HOLD so discard previous skb (packet) and store this one
 101                 NetFilter -> HOLD target NetFilter kernel module
 102                         in:
 103                                 struct sk_buff *skb
 104                         out:
 105                                 unsigned int = NF_STOLEN
 106
 107         - put the new SAs in place once the negotiations have succeeded
 108                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 109                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 110
 111         - add ENCRYPT target with specific SAs to use
 112                 KMd -> iptables(8) system(3) call (Policy)
 113                 KMd -> ip6tables(8) system(3) call (Policy)
 114                         in:
 115                                 char[] -I
 116                                 char[] -s SADDR/SMASK
 117                                 char[] -d DADDR/DMASK
 118                                 char[] --protocol PROTO
 119                                 char[] --sport SPORT
 120                                 char[] --dport DPORT
 121                                 char[] --uid-owner UID
 122                                 char[] --seclev seclev
 123                                 char[] -J ENCRYPT
 124                                 char[] --salist SAList
 125                         out:
 126                                 unsigned char exit_code
 127
 128                 iptables(8) -> seclev match iptables(8) library
 129                 ip6tables(8) -> seclev match ip6tables(8) library
 130                         in:
 131                                 char[] --seclev seclevstr
 132                         out:
 133                                 struct seclev
 134
 135                 iptables(8) -> ENCRYPT target iptables(8) library
 136                 ip6tables(8) -> ENCRYPT target ip6tables(8) library
 137                         in:
 138                                 char[] --salist SAList
 139                         out:
 140                                 struct ip_said SA[, ...]
 141
 142                 iptables(8) -> NetFilter
 143                 ip6tables(8) -> NetFilter
 144                 I/F is already defined in NetFilter.  In addition, it will
 145                 need structures to pass the following:
 146                         in:
 147                                 struct seclev
 148                                 target ENCRYPT
 149                                 struct ip_said SA[, ...]
 150
 151         - add ACCEPT target for once the packet is processed
 152                 KMd -> iptables(8) system(3) call (Policy)
 153                 KMd -> ip6tables(8) system(3) call (Policy)
 154                         in:
 155                                 char[] -I
 156                                 char[] -s SADDR/SMASK (local SG)
 157                                 char[] -d DADDR/DMASK (remote SG)
 158                                 char[] --proto ESP
 159                                 char[] --salist SAList
 160                                 char[] --espspi SPI
 161                                 char[] -J ACCEPT
 162                         out:
 163                                 unsigned char exit_code
 164
 165                 iptables(8) -> seclev match iptables(8) library
 166                 ip6tables(8) -> seclev match ip6tables(8) library
 167                         in:
 168                                 char[] --seclev seclevstr
 169                         out:
 170                                 struct seclev
 171
 172                 iptables(8) -> sa match iptables(8) library
 173                 ip6tables(8) -> sa match ip6tables(8) library
 174                         in:
 175                                 char[] --salist SAList
 176                         out:
 177                                 struct ip_said SA[, ...]
 178
 179                 iptables(8) -> NetFilter
 180                 ip6tables(8) -> NetFilter
 181                 I/F is already defined in NetFilter.  In addition, it will
 182                 need structures to pass the following:
 183                         in:
 184                                 struct seclev
 185                                 struct ip_said SA[, ...]
 186
 187         - replace HOLD target with ENCRYPT target, releasing skb
 188                 HOLD target NetFilter kernel module -> NetFilter
 189                                 (I don't know the best way to show this
 190                                 on the diagram, since the skb is
 191                                 stored with the eroute and not the HOLD
 192                                 target module)
 193                         in:
 194                                 struct sk_buff *skb
 195
 196         - send released packet through newly created ENCRYPT target and SAs
 197                 NetFilter -> ENCRYPT target NetFilter kernel module
 198                         in:
 199                                 struct sk_buff *skb
 200                                 struct ip_said SA[, ...]
 201                         out:
 202                                 unsigned int = NF_STOLEN
 203
 204         - fetch SAs specified in NetFilter table entry with ENCRYPT args
 205                 ENCRYPT target NetFilter kernel module -> SADB (SAID)
 206                         in:
 207                                 struct ip_said SA
 208                         out:
 209                                 struct tdb *tdbp
 210
 211         - send skb (packet) back into NF_IP_POST_ROUTE
 212                 ENCRYPT target NetFilter kernel module -> NetFilter
 213                         in:
 214                                 struct sk_buff *skb
 215                                 struct ip_said SA[,...]
 216
 217         - expire SA if a limit is reached
 218                 SADB -> KMd (PF_KEYv2 EXPIRE)
 219                         see RFC2367, PF_KEYv2 EXPIRE
 220
 221 Outgoing w/existing connection specifying SAs
 222         - put the new SAs in place once negotiations have succeeded
 223                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 224                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 225
 226         - put in a rule to match packets for that set of SAs
 227                 KMd -> iptables(8) system(3) call (Policy)
 228                 KMd -> ip6tables(8) system(3) call (Policy)
 229                         in:
 230                                 char[] -I
 231                                 char[] -s SADDR/SMASK
 232                                 char[] -d DADDR/DMASK
 233                                 char[] --protocol PROTO
 234                                 char[] --sport SPORT
 235                                 char[] --dport DPORT
 236                                 char[] --uid-owner UID
 237                                 char[] --seclev seclev
 238                                 char[] -J ENCRYPT
 239                                 char[] --salist SAList
 240                         out:
 241                                 unsigned char exit_code
 242
 243                 iptables(8) -> seclev match iptables(8) library
 244                 ip6tables(8) -> seclev match ip6tables(8) library
 245                         in:
 246                                 char[] --seclev seclevstr
 247                         out:
 248                                 struct seclev
 249
 250                 iptables(8) -> ENCRYPT target iptables(8) library
 251                 ip6tables(8) -> ENCRYPT target ip6tables(8) library
 252                         in:
 253                                 char[] --salist SAList
 254                         out:
 255                                 struct ip_said SA[, ...]
 256
 257                 iptables(8) -> NetFilter
 258                 ip6tables(8) -> NetFilter
 259                 I/F is already defined in NetFilter.  In addition, it will
 260                 need structures to pass the following:
 261                         in:
 262                                 struct seclev
 263                                 target ENCRYPT
 264                                 struct ip_said SA[, ...]
 265
 266         - add ACCEPT for once the packet is processed
 267                 KMd -> iptables(8) system(3) call (Policy)
 268                 KMd -> ip6tables(8) system(3) call (Policy)
 269                         in:
 270                                 char[] -I
 271                                 char[] -s SADDR/SMASK (local SG)
 272                                 char[] -d DADDR/DMASK (remote SG)
 273                                 char[] --proto ESP
 274                                 char[] --salist SAList
 275                                 char[] --espspi SPI
 276                                 char[] -J ACCEPT
 277                         out:
 278                                 unsigned char exit_code
 279
 280                 iptables(8) -> seclev match iptables(8) library
 281                 ip6tables(8) -> seclev match ip6tables(8) library
 282                         in:
 283                                 char[] --seclev seclevstr
 284                         out:
 285                                 struct seclev
 286
 287                 iptables(8) -> sa match iptables(8) library
 288                 ip6tables(8) -> sa match ip6tables(8) library
 289                         in:
 290                                 char[] --salist SAList
 291                         out:
 292                                 struct ip_said SA[, ...]
 293
 294                 iptables(8) -> NetFilter
 295                 I/F is already defined in NetFilter.  In addition, it will
 296                 need structures to pass the following:
 297                         in:
 298                                 struct seclev
 299                                 struct ip_said SA[, ...]
 300                                 target ACCEPT
 301
 302         - outgoing packet is tested on selectors
 303                 NetFilter -> seclev match NetFilter kernel module
 304                         in:
 305                                 struct sk_buff *skb
 306                                 struct seclev
 307                         out:
 308                                 boolean
 309
 310                 NetFilter -> sa match NetFilter kernel module
 311                         in:
 312                                 struct sk_buff *skb
 313                                 struct ip_said SA[,...]
 314                         out:
 315                                 boolean
 316
 317         - matching packet is sent to ENCRYPT target with SAList
 318                 NetFilter -> ENCRYPT target NetFilter kernel module
 319                         in:
 320                                 struct sk_buff *skb
 321                                 struct ip_said SA[, ...]
 322                         out:
 323                                 unsigned int = NF_STOLEN
 324
 325         - fetch SAs specified in NetFilter table entry with ENCRYPT args
 326                 ENCRYPT target NetFilter kernel module -> SADB (SAID)
 327                         in:
 328                                 struct ip_said SA
 329                         out:
 330                                 struct tdb *tdbp
 331
 332         - send skb (packet) back into NF_IP_POST_ROUTE
 333                 ENCRYPT target NetFilter kernel module -> NetFilter
 334                         in:
 335                                 struct sk_buff *skb
 336                                 struct ip_said SA[,...]
 337
 338         - outgoing processed packet is tested on selectors and ACCEPTed
 339                 NetFilter -> seclev match NetFilter kernel module
 340                         in:
 341                                 struct sk_buff *skb
 342                                 struct seclev
 343                         out:
 344                                 boolean
 345
 346                 NetFilter -> sa match NetFilter kernel module
 347                         in:
 348                                 struct sk_buff *skb
 349                                 struct ip_said SA[,...]
 350                         out:
 351                                 boolean
 352
 353         - expire SA if a limit is reached
 354                 SADB -> KMd (PF_KEYv2 EXPIRE)
 355                         see RFC2367, PF_KEYv2 EXPIRE
 356
 357 Outgoing w/existing connection routing through IPSec device
 358         - put the new SAs in place once negotiations have succeeded
 359                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 360                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 361
 362         - put in a rule to match packets for that set of SAs
 363                 KMd -> iptables(8) system(3) call (Policy)
 364                 KMd -> ip6tables(8) system(3) call (Policy)
 365                         in:
 366                                 char[] -I
 367                                 char[] -s SADDR/SMASK
 368                                 char[] -d DADDR/DMASK
 369                                 char[] --protocol PROTO
 370                                 char[] --sport SPORT
 371                                 char[] --dport DPORT
 372                                 char[] --uid-owner UID
 373                                 char[] --seclev seclev
 374                                 char[] --out-interface IPSECdev
 375                                 char[] -J ENCRYPT
 376                                 char[] --salist SAList
 377                         out:
 378                                 unsigned char exit_code
 379
 380                 iptables(8) -> seclev match iptables(8) library
 381                 ip6tables(8) -> seclev match ip6tables(8) library
 382                         in:
 383                                 char[] --seclev seclevstr
 384                         out:
 385                                 struct seclev
 386
 387                 iptables(8) -> ENCRYPT target iptables(8) library
 388                 ip6tables(8) -> ENCRYPT target ip6tables(8) library
 389                         in:
 390                                 char[] --salist SAList
 391                         out:
 392                                 struct ip_said SA[, ...]
 393
 394                 iptables(8) -> NetFilter
 395                 ip6tables(8) -> NetFilter
 396                 I/F is already defined in NetFilter.  In addition, it will
 397                 need structures to pass the following:
 398                         in:
 399                                 struct seclev
 400                                 target ENCRYPT
 401                                 struct ip_said SA[, ...]
 402
 403                 KMd -> Routing Table (Routing)
 404                         see route(8) or iproute2(8), currently done by
 405                                      system(3) calls to _updown.
 406                         in:
 407                                 char[] IPSECdev
 408                         out:
 409                                 unsigned char exit_code
 410
 411         - add ACCEPT for once the packet is processed
 412                 KMd -> iptables(8) system(3) call (Policy)
 413                 KMd -> ip6tables(8) system(3) call (Policy)
 414                         in:
 415                                 char[] -I
 416                                 char[] -s SADDR/SMASK (local SG)
 417                                 char[] -d DADDR/DMASK (remote SG)
 418                                 char[] --proto ESP
 419                                 char[] --espspi SPI
 420                                 char[] --salist SAList
 421                                 char[] -J ACCEPT
 422                         out:
 423                                 unsigned char exit_code
 424
 425                 iptables(8) -> seclev match iptables(8) library
 426                 ip6tables(8) -> seclev match ip6tables(8) library
 427                         in:
 428                                 char[] --seclev seclevstr
 429                         out:
 430                                 struct seclev
 431
 432                 iptables(8) -> sa match iptables(8) library
 433                 ip6tables(8) -> sa match ip6tables(8) library
 434                         in:
 435                                 char[] --salist SAList
 436                         out:
 437                                 struct ip_said SA[, ...]
 438
 439                 iptables(8) -> NetFilter
 440                 ip6tables(8) -> NetFilter
 441                 I/F is already defined in NetFilter.  In addition, it will
 442                 need structures to pass the following:
 443                         in:
 444                                 struct seclev
 445                                 struct ip_said SA[, ...]
 446
 447         - outgoing packet is tested on match modules
 448                 NetFilter -> seclev match NetFilter kernel module
 449                         in:
 450                                 struct sk_buff *skb
 451                                 struct seclev
 452                         out:
 453                                 boolean
 454
 455                 NetFilter -> sa match NetFilter kernel module
 456                         in:
 457                                 struct sk_buff *skb
 458                                 struct ip_said SA[,...]
 459                         out:
 460                                 boolean
 461
 462         - outgoing packet matches IPSECdev and is sent to ENCRYPT target with SAList
 463                 NetFilter -> ENCRYPT target NetFilter kernel module
 464                         in:
 465                                 struct sk_buff *skb
 466                                 struct ip_said SA[, ...]
 467                         out:
 468                                 unsigned int = NF_STOLEN
 469
 470         - fetch SAs specified in NetFilter table entry with ENCRYPT args
 471                 ENCRYPT target NetFilter kernel module -> SADB (SAID)
 472                         in:
 473                                 struct ip_said SA
 474                         out:
 475                                 struct tdb *tdbp
 476
 477         - send skb (packet) back into NF_IP_POST_ROUTE
 478                 ENCRYPT target NetFilter kernel module -> NetFilter
 479                         in:
 480                                 struct sk_buff *skb
 481                                 struct ip_said SA[,...]
 482
 483         - processed packet is tested on match modules and ACCEPTed
 484                 NetFilter -> seclev match NetFilter kernel module
 485                         in:
 486                                 struct sk_buff *skb
 487                                 struct seclev
 488                         out:
 489                                 boolean
 490
 491                 NetFilter -> sa match NetFilter kernel module
 492                         in:
 493                                 struct sk_buff *skb
 494                                 struct ip_said SA[,...]
 495                         out:
 496                                 boolean
 497
 498         - expire SA if a limit is reached
 499                 SADB -> KMd (PF_KEYv2 EXPIRE)
 500                         see RFC2367, PF_KEYv2 EXPIRE
 501
 502 Incoming w/existing connection specifying SAs
 503         - put in the new SAs in place once the negotiations have succeeded
 504                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 505                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 506
 507         - put in a blocking entry to prevent unprotected packets entering
 508                 KMd -> iptables(8) system(3) call (Policy)
 509                 KMd -> ip6tables(8) system(3) call (Policy)
 510                         in:
 511                                 char[] -I
 512                                 char[] -s SADDR/SMASK
 513                                 char[] -d DADDR/DMASK
 514                                 char[] --protocol PROTO
 515                                 char[] --sport SPORT
 516                                 char[] --dport DPORT
 517                                 char[] --uid-owner UID
 518                                 char[] --seclev seclev
 519                                 char[] -J DROP (or PEEK)
 520                         out:
 521                                 unsigned char exit_code
 522
 523                 iptables(8) -> seclev match iptables(8) library
 524                 ip6tables(8) -> seclev match ip6tables(8) library
 525                         in:
 526                                 char[] --seclev seclevstr
 527                         out:
 528                                 struct seclev
 529
 530                 iptables(8) -> NetFilter
 531                 ip6tables(8) -> NetFilter
 532                 I/F is already defined in NetFilter.  In addition, it will
 533                 need structures to pass the following:
 534                         in:
 535                                 struct seclev
 536                                 target DROP (or PEEK)
 537
 538         - allow properly processed packets in
 539                 KMd -> iptables(8) system(3) call (Policy)
 540                 KMd -> ip6tables(8) system(3) call (Policy)
 541                         in:
 542                                 char[] -I
 543                                 char[] -s SADDR/SMASK
 544                                 char[] -d DADDR/DMASK
 545                                 char[] --protocol PROTO
 546                                 char[] --sport SPORT
 547                                 char[] --dport DPORT
 548                                 char[] --uid-owner UID
 549                                 char[] --seclev seclev
 550                                 char[] --salist SAList
 551                                 char[] -J ACCEPT
 552                         out:
 553                                 unsigned char exit_code
 554
 555                 iptables(8) -> seclev match iptables(8) library
 556                 ip6tables(8) -> seclev match ip6tables(8) library
 557                         in:
 558                                 char[] --seclev seclevstr
 559                         out:
 560                                 struct seclev
 561
 562                 iptables(8) -> sa match iptables(8) library
 563                 ip6tables(8) -> sa match ip6tables(8) library
 564                         in:
 565                                 char[] --salist SAList
 566                         out:
 567                                 struct ip_said SA[, ...]
 568
 569                 iptables(8) -> NetFilter
 570                 ip6tables(8) -> NetFilter
 571                 I/F is already defined in NetFilter.  In addition, it will
 572                 need structures to pass the following:
 573                         in:
 574                                 struct seclev
 575                                 struct ip_said SA[, ...]
 576
 577         - allow unprocessed packets from IPSec peer in
 578                 KMd -> iptables(8) system(3) call (Policy)
 579                 KMd -> ip6tables(8) system(3) call (Policy)
 580                         in:
 581                                 char[] -I
 582                                 char[] -s SADDR/SMASK (remote SG)
 583                                 char[] -d DADDR/DMASK (local SG)
 584                                 char[] --proto ESP
 585                                 char[] --espspi SPI
 586                                 char[] -J ACCEPT
 587                         out:
 588                                 unsigned char exit_code
 589
 590                 iptables(8) -> seclev match iptables(8) library
 591                 ip6tables(8) -> seclev match ip6tables(8) library
 592                         in:
 593                                 char[] --seclev seclevstr
 594                         out:
 595                                 struct seclev
 596
 597                 iptables(8) -> NetFilter
 598                 ip6tables(8) -> NetFilter
 599                 I/F is already defined in NetFilter.  In addition, it will
 600                 need structures to pass the following:
 601                         in:
 602                                 struct seclev
 603
 604         - incoming packet is tested on match modules
 605                 NetFilter -> seclev match NetFilter kernel module
 606                         in:
 607                                 struct sk_buff *skb
 608                                 struct seclev
 609                         out:
 610                                 boolean
 611
 612                 NetFilter -> sa match NetFilter kernel module
 613                         in:
 614                                 struct sk_buff *skb
 615                                 struct ip_said SA[,...]
 616                         out:
 617                                 boolean
 618
 619         - packet arrives via transport layer demux to DECRYPT
 620                 Transport Layer De-mux -> IPSec DECRYPT kernel module
 621                         in:
 622                                 struct sk_buff *skb
 623
 624         - fetch SAs specified by packet in skb
 625                 IPSec DECRYPT kernel module -> SADB (SAID)
 626                         in:
 627                                 struct ip_said SA
 628                         out:
 629                                 struct tdb *tdbp
 630
 631         - send skb (packet) back into NF_IP_PRE_ROUTE
 632                 IPSec DECRYPT kernel module -> NetFilter
 633                         in:
 634                                 struct sk_buff *skb
 635                                 struct ip_said SA[,...]
 636
 637         - processed packet is tested on match modules and ACCEPTED
 638                 NetFilter -> seclev match NetFilter kernel module
 639                         in:
 640                                 struct sk_buff *skb
 641                                 struct seclev
 642                         out:
 643                                 boolean
 644
 645                 NetFilter -> sa match NetFilter kernel module
 646                         in:
 647                                 struct sk_buff *skb
 648                                 struct ip_said SA[,...]
 649                         out:
 650                                 boolean
 651
 652         - expire SA if a limit is reached
 653                 SADB -> KMd (PF_KEYv2 EXPIRE)
 654                         see RFC2367, PF_KEYv2 EXPIRE
 655
 656 Incoming w/existing connection specifying IPSec device
 657         - put in the new SAs in place once the negotiations have succeeded
 658                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 659                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 660
 661         - put in a blocking entry to prevent unprotected packets entering
 662                 KMd -> iptables(8) system(3) call (Policy)
 663                 KMd -> ip6tables(8) system(3) call (Policy)
 664                         in:
 665                                 char[] -I
 666                                 char[] -s SADDR/SMASK
 667                                 char[] -d DADDR/DMASK
 668                                 char[] --protocol PROTO
 669                                 char[] --sport SPORT
 670                                 char[] --dport DPORT
 671                                 char[] --uid-owner UID
 672                                 char[] --seclev seclev
 673                                 char[] -J DROP (or PEEK)
 674                         out:
 675                                 unsigned char exit_code
 676
 677                 iptables(8) -> seclev match iptables(8) library
 678                 ip6tables(8) -> seclev match ip6tables(8) library
 679                         in:
 680                                 char[] --seclev seclevstr
 681                         out:
 682                                 struct seclev
 683
 684                 iptables(8) -> NetFilter
 685                 ip6tables(8) -> NetFilter
 686                 I/F is already defined in NetFilter.  In addition, it will
 687                 need structures to pass the following:
 688                         in:
 689                                 struct seclev
 690                                 target DROP (or PEEK)
 691
 692         - allow properly processed packets in
 693                 KMd -> iptables(8) system(3) call (Policy)
 694                 KMd -> ip6tables(8) system(3) call (Policy)
 695                         in:
 696                                 char[] -I
 697                                 char[] -s SADDR/SMASK
 698                                 char[] -d DADDR/DMASK
 699                                 char[] --protocol PROTO
 700                                 char[] --sport SPORT
 701                                 char[] --dport DPORT
 702                                 char[] --uid-owner UID
 703                                 char[] --in-interface IPSECdev
 704                                 char[] --seclev seclev
 705                                 char[] --salist SAList
 706                                        (can we set an --in-interface IPSECdev
 707                                         from this so we can just test
 708                                         in-interface?  This may need two
 709                                         entries, including a target SETDEV)
 710                                 char[] -J ACCEPT
 711                         out:
 712                                 unsigned char exit_code
 713
 714                 iptables(8) -> seclev match iptables(8) library
 715                 ip6tables(8) -> seclev match ip6tables(8) library
 716                         in:
 717                                 char[] --seclev seclevstr
 718                         out:
 719                                 struct seclev
 720
 721                 iptables(8) -> sa match iptables(8) library
 722                 ip6tables(8) -> sa match ip6tables(8) library
 723                         in:
 724                                 char[] --salist SAList
 725                         out:
 726                                 struct ip_said SA[, ...]
 727
 728                 iptables(8) -> NetFilter
 729                 ip6tables(8) -> NetFilter
 730                 I/F is already defined in NetFilter.  In addition, it will
 731                 need structures to pass the following:
 732                         in:
 733                                 struct seclev
 734                                 struct ip_said SA[, ...]
 735
 736         - allow unprocessed packets from IPSec peer in
 737                 KMd -> iptables(8) system(3) call (Policy)
 738                 KMd -> ip6tables(8) system(3) call (Policy)
 739                         in:
 740                                 char[] -I
 741                                 char[] -s SADDR/SMASK (remote SG)
 742                                 char[] -d DADDR/DMASK (local SG)
 743                                 char[] --proto ESP
 744                                 char[] --espspi SPI
 745                                 char[] -J ACCEPT
 746                         out:
 747                                 unsigned char exit_code
 748
 749                 iptables(8) -> seclev match iptables(8) library
 750                 ip6tables(8) -> seclev match ip6tables(8) library
 751                         in:
 752                                 char[] --seclev seclevstr
 753                         out:
 754                                 struct seclev
 755
 756                 iptables(8) -> NetFilter
 757                 ip6tables(8) -> NetFilter
 758                 I/F is already defined in NetFilter.  In addition, it will
 759                 need structures to pass the following:
 760                         in:
 761                                 struct seclev
 762
 763         - incoming packet is tested on match modules
 764                 NetFilter -> seclev match NetFilter kernel module
 765                         in:
 766                                 struct sk_buff *skb
 767                                 struct seclev
 768                         out:
 769                                 boolean
 770
 771                 NetFilter -> sa match NetFilter kernel module
 772                         in:
 773                                 struct sk_buff *skb
 774                                 struct ip_said SA[,...]
 775                         out:
 776                                 boolean
 777
 778         - packet arrives via transport layer demux to DECRYPT
 779                 Transport Layer De-mux -> IPSec DECRYPT kernel module
 780                         in:
 781                                 struct sk_buff *skb
 782
 783         - fetch SAs specified by packet in skb
 784                 IPSec DECRYPT kernel module -> SADB (SAID)
 785                         in:
 786                                 struct ip_said SA
 787                         out:
 788                                 struct tdb *tdbp
 789
 790         - send skb (packet) back into NF_IP_PRE_ROUTE
 791                 IPSec DECRYPT kernel module -> NetFilter
 792                         in:
 793                                 struct sk_buff *skb
 794                                 struct ip_said SA[,...]
 795
 796         - processed packet is tested on match modules and ACCEPTED
 797                 NetFilter -> seclev match NetFilter kernel module
 798                         in:
 799                                 struct sk_buff *skb
 800                                 struct seclev
 801                         out:
 802                                 boolean
 803
 804                 NetFilter -> sa match NetFilter kernel module
 805                         in:
 806                                 struct sk_buff *skb
 807                                 struct ip_said SA[,...]
 808                         out:
 809                                 boolean
 810
 811         - expire SA if a limit is reached
 812                 SADB -> KMd (PF_KEYv2 EXPIRE)
 813                         see RFC2367, PF_KEYv2 EXPIRE
 814
 815 Incoming no connection
 816          - set target for PEEKing at (or TRAPing) incoming packets with no connection
 817                 KMd -> iptables(8) system(3) call (Policy)
 818                 KMd -> ip6tables(8) system(3) call (Policy)
 819                         in:
 820                                 char[] -I
 821                                 char[] -s SADDR/SMASK
 822                                 char[] -d DADDR/DMASK
 823                                 char[] --protocol PROTO
 824                                 char[] --sport SPORT
 825                                 char[] --dport DPORT
 826                                 char[] --uid-owner UID
 827                                 char[] --seclev seclev
 828                                 char[] -J PEEK (or TRAP)
 829                         out:
 830                                 unsigned char exit_code
 831
 832                 iptables(8) -> seclev match iptables(8) library
 833                 ip6tables(8) -> seclev match ip6tables(8) library
 834                         in:
 835                                 char[] --seclev seclevstr
 836                         out:
 837                                 struct seclev
 838
 839                 iptables(8) -> NetFilter
 840                 ip6tables(8) -> NetFilter
 841                 I/F is already defined in NetFilter.  In addition, it will
 842                 need structures to pass the following:
 843                         in:
 844                                 struct seclev
 845                                 target PEEK (or TRAP)
 846
 847         - packet comes in and gets tested by match modules
 848                 NetFilter -> seclev match NetFilter kernel module
 849                         in:
 850                                 struct sk_buff *skb
 851                                 struct seclev
 852                         out:
 853                                 boolean
 854
 855                 NetFilter -> sa match NetFilter kernel module
 856                         in:
 857                                 struct sk_buff *skb
 858                                 struct ip_said SA[,...]
 859                         out:
 860                                 boolean
 861
 862         - packet matches and gets sent to PEEK target
 863                 NetFilter -> PEEK (or TRAP) target NetFilter kernel module
 864                         in:
 865                                 struct sk_buff *skb
 866                         out:
 867                                 unsigned int = NF_ACCEPT (or NF_STOLEN)
 868
 869         - send up an ACQUIRE
 870                 PEEK (or TRAP) target NetFilter kernel module -> KMds (PF_KEYv2 ACQUIRE)
 871                         see RFC2367, PF_KEYv2 ACQUIRE
 872
 873         - create ACCEPT (or HOLD) target with skb info to prevent KMd overload
 874                 PEEK (or HOLD) target NetFilter kernel module -> NetFilter
 875                         in:
 876                                 struct sk_buff *skb
 877                         out:
 878                                 boolean
 879
 880         - next packet comes in while KMd is negotiating SAs.
 881                 NetFilter -> seclev match NetFilter kernel module
 882                         in:
 883                                 struct sk_buff *skb
 884                                 struct seclev
 885                         out:
 886                                 boolean
 887
 888                 NetFilter -> sa match NetFilter kernel module
 889                         in:
 890                                 struct sk_buff *skb
 891                                 struct ip_said SA[,...]
 892                         out:
 893                                 boolean
 894
 895         - put the new SAs in place once the negotiations have succeeded
 896                 KMd -> SADB (PF_KEYv2 ADD/UPDATE)
 897                         see RFC2367, PF_KEYv2 ADD/UPDATE message for each SA
 898
 899         - put in a blocking entry to prevent unprotected packets entering
 900                 KMd -> iptables(8) system(3) call (Policy)
 901                 KMd -> ip6tables(8) system(3) call (Policy)
 902                         in:
 903                                 char[] -I
 904                                 char[] -s SADDR/SMASK
 905                                 char[] -d DADDR/DMASK
 906                                 char[] --protocol PROTO
 907                                 char[] --sport SPORT
 908                                 char[] --dport DPORT
 909                                 char[] --uid-owner UID
 910                                 char[] --seclev seclev
 911                                 char[] -J DROP (or PEEK)
 912                         out:
 913                                 unsigned char exit_code
 914
 915                 iptables(8) -> seclev match iptables(8) library
 916                 ip6tables(8) -> seclev match ip6tables(8) library
 917                         in:
 918                                 char[] --seclev seclevstr
 919                         out:
 920                                 struct seclev
 921
 922                 iptables(8) -> NetFilter
 923                 ip6tables(8) -> NetFilter
 924                 I/F is already defined in NetFilter.  In addition, it will
 925                 need structures to pass the following:
 926                         in:
 927                                 struct seclev
 928                                 (target PEEK)
 929
 930         - allow properly processed packets in
 931                 KMd -> iptables(8) system(3) call (Policy)
 932                 KMd -> ip6tables(8) system(3) call (Policy)
 933                         in:
 934                                 char[] -I
 935                                 char[] -s SADDR/SMASK
 936                                 char[] -d DADDR/DMASK
 937                                 char[] --protocol PROTO
 938                                 char[] --sport SPORT
 939                                 char[] --dport DPORT
 940                                 char[] --uid-owner UID
 941                                 char[] --seclev seclev
 942                                 char[] --salist SAList
 943                                 char[] -J ACCEPT
 944                         out:
 945                                 unsigned char exit_code
 946
 947                 iptables(8) -> seclev match iptables(8) library
 948                 ip6tables(8) -> seclev match ip6tables(8) library
 949                         in:
 950                                 char[] --seclev seclevstr
 951                         out:
 952                                 struct seclev
 953
 954                 iptables(8) -> sa match iptables(8) library
 955                 ip6tables(8) -> sa match ip6tables(8) library
 956                         in:
 957                                 char[] --salist SAList
 958                         out:
 959                                 struct ip_said SA[, ...]
 960
 961                 iptables(8) -> NetFilter
 962                 ip6tables(8) -> NetFilter
 963                 I/F is already defined in NetFilter.  In addition, it will
 964                 need structures to pass the following:
 965                         in:
 966                                 struct seclev
 967                                 struct ip_said SA[, ...]
 968
 969         - incoming packet is tested on match modules
 970                 NetFilter -> seclev match NetFilter kernel module
 971                         in:
 972                                 struct sk_buff *skb
 973                                 struct seclev
 974                         out:
 975                                 boolean
 976
 977                 NetFilter -> sa match NetFilter kernel module
 978                         in:
 979                                 struct sk_buff *skb
 980                                 struct ip_said SA[,...]
 981                         out:
 982                                 boolean
 983
 984         - packet arrives via transport layer demux to DECRYPT
 985                 Transport Layer De-mux -> IPSec DECRYPT kernel module
 986                         in:
 987                                 struct sk_buff *skb
 988
 989         - fetch SAs specified by packet in skb
 990                 IPSec DECRYPT kernel module -> SADB (SAID)
 991                         in:
 992                                 struct ip_said SA
 993                         out:
 994                                 struct tdb *tdbp
 995
 996         - send skb (packet) back into NF_IP_PRE_ROUTE
 997                 IPSec DECRYPT kernel module -> NetFilter
 998                         in:
 999                                 struct sk_buff *skb
1000                                 struct ip_said SA[,...]
1001
1002         - processed packet is tested on match modules and ACCEPTed
1003                 NetFilter -> seclev match NetFilter kernel module
1004                         in:
1005                                 struct sk_buff *skb
1006                                 struct seclev
1007                         out:
1008                                 boolean
1009
1010                 NetFilter -> sa match NetFilter kernel module
1011                         in:
1012                                 struct sk_buff *skb
1013                                 struct ip_said SA[,...]
1014                         out:
1015                                 boolean
1016
1017         - expire SA if a limit is reached
1018                 SADB -> KMd (PF_KEYv2 EXPIRE)
1019                         see RFC2367, PF_KEYv2 EXPIRE
1020
1021 TODO:
1022         api trips:
1023                 Packet w/no route?  how to get to kmd?  default route to IPSECdev which calls TRAP?
1024                 Nested tunnels, IKE recursion api trip
1025                 how to know when to stop decapsulating nested tunnels?
1026                 DHR's routing problem
1027                 mutli-layer routing environments that both touch and denker need.
1028         nail down function calls and/or globals for each I/F, c-like function syntax
1029         better api block comments
1030         interface, function, args, block comment
1031