xfrm.h 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526
  1. #ifndef _LINUX_XFRM_H
  2. #define _LINUX_XFRM_H
  3. #include <linux/in6.h>
  4. #include <linux/types.h>
  5. /* All of the structures in this file may not change size as they are
  6. * passed into the kernel from userspace via netlink sockets.
  7. */
  8. /* Structure to encapsulate addresses. I do not want to use
  9. * "standard" structure. My apologies.
  10. */
  11. typedef union {
  12. __be32 a4;
  13. __be32 a6[4];
  14. struct in6_addr in6;
  15. } xfrm_address_t;
  16. /* Ident of a specific xfrm_state. It is used on input to lookup
  17. * the state by (spi,daddr,ah/esp) or to store information about
  18. * spi, protocol and tunnel address on output.
  19. */
  20. struct xfrm_id {
  21. xfrm_address_t daddr;
  22. __be32 spi;
  23. __u8 proto;
  24. };
  25. struct xfrm_sec_ctx {
  26. __u8 ctx_doi;
  27. __u8 ctx_alg;
  28. __u16 ctx_len;
  29. __u32 ctx_sid;
  30. char ctx_str[0];
  31. };
  32. /* Security Context Domains of Interpretation */
  33. #define XFRM_SC_DOI_RESERVED 0
  34. #define XFRM_SC_DOI_LSM 1
  35. /* Security Context Algorithms */
  36. #define XFRM_SC_ALG_RESERVED 0
  37. #define XFRM_SC_ALG_SELINUX 1
  38. /* Selector, used as selector both on policy rules (SPD) and SAs. */
  39. struct xfrm_selector {
  40. xfrm_address_t daddr;
  41. xfrm_address_t saddr;
  42. __be16 dport;
  43. __be16 dport_mask;
  44. __be16 sport;
  45. __be16 sport_mask;
  46. __u16 family;
  47. __u8 prefixlen_d;
  48. __u8 prefixlen_s;
  49. __u8 proto;
  50. int ifindex;
  51. __kernel_uid32_t user;
  52. };
  53. #define XFRM_INF (~(__u64)0)
  54. struct xfrm_lifetime_cfg {
  55. __u64 soft_byte_limit;
  56. __u64 hard_byte_limit;
  57. __u64 soft_packet_limit;
  58. __u64 hard_packet_limit;
  59. __u64 soft_add_expires_seconds;
  60. __u64 hard_add_expires_seconds;
  61. __u64 soft_use_expires_seconds;
  62. __u64 hard_use_expires_seconds;
  63. };
  64. struct xfrm_lifetime_cur {
  65. __u64 bytes;
  66. __u64 packets;
  67. __u64 add_time;
  68. __u64 use_time;
  69. };
  70. struct xfrm_replay_state {
  71. __u32 oseq;
  72. __u32 seq;
  73. __u32 bitmap;
  74. };
  75. #define XFRMA_REPLAY_ESN_MAX 4096
  76. struct xfrm_replay_state_esn {
  77. unsigned int bmp_len;
  78. __u32 oseq;
  79. __u32 seq;
  80. __u32 oseq_hi;
  81. __u32 seq_hi;
  82. __u32 replay_window;
  83. __u32 bmp[0];
  84. };
  85. struct xfrm_algo {
  86. char alg_name[64];
  87. unsigned int alg_key_len; /* in bits */
  88. char alg_key[0];
  89. };
  90. struct xfrm_algo_auth {
  91. char alg_name[64];
  92. unsigned int alg_key_len; /* in bits */
  93. unsigned int alg_trunc_len; /* in bits */
  94. char alg_key[0];
  95. };
  96. struct xfrm_algo_aead {
  97. char alg_name[64];
  98. unsigned int alg_key_len; /* in bits */
  99. unsigned int alg_icv_len; /* in bits */
  100. char alg_key[0];
  101. };
  102. struct xfrm_stats {
  103. __u32 replay_window;
  104. __u32 replay;
  105. __u32 integrity_failed;
  106. };
  107. enum {
  108. XFRM_POLICY_TYPE_MAIN = 0,
  109. XFRM_POLICY_TYPE_SUB = 1,
  110. XFRM_POLICY_TYPE_MAX = 2,
  111. XFRM_POLICY_TYPE_ANY = 255
  112. };
  113. enum {
  114. XFRM_POLICY_IN = 0,
  115. XFRM_POLICY_OUT = 1,
  116. XFRM_POLICY_FWD = 2,
  117. XFRM_POLICY_MASK = 3,
  118. XFRM_POLICY_MAX = 3
  119. };
  120. enum {
  121. XFRM_SHARE_ANY, /* No limitations */
  122. XFRM_SHARE_SESSION, /* For this session only */
  123. XFRM_SHARE_USER, /* For this user only */
  124. XFRM_SHARE_UNIQUE /* Use once */
  125. };
  126. #define XFRM_MODE_TRANSPORT 0
  127. #define XFRM_MODE_TUNNEL 1
  128. #define XFRM_MODE_ROUTEOPTIMIZATION 2
  129. #define XFRM_MODE_IN_TRIGGER 3
  130. #define XFRM_MODE_BEET 4
  131. #define XFRM_MODE_MAX 5
  132. /* Netlink configuration messages. */
  133. enum {
  134. XFRM_MSG_BASE = 0x10,
  135. XFRM_MSG_NEWSA = 0x10,
  136. #define XFRM_MSG_NEWSA XFRM_MSG_NEWSA
  137. XFRM_MSG_DELSA,
  138. #define XFRM_MSG_DELSA XFRM_MSG_DELSA
  139. XFRM_MSG_GETSA,
  140. #define XFRM_MSG_GETSA XFRM_MSG_GETSA
  141. XFRM_MSG_NEWPOLICY,
  142. #define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY
  143. XFRM_MSG_DELPOLICY,
  144. #define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY
  145. XFRM_MSG_GETPOLICY,
  146. #define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY
  147. XFRM_MSG_ALLOCSPI,
  148. #define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI
  149. XFRM_MSG_ACQUIRE,
  150. #define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE
  151. XFRM_MSG_EXPIRE,
  152. #define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE
  153. XFRM_MSG_UPDPOLICY,
  154. #define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY
  155. XFRM_MSG_UPDSA,
  156. #define XFRM_MSG_UPDSA XFRM_MSG_UPDSA
  157. XFRM_MSG_POLEXPIRE,
  158. #define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE
  159. XFRM_MSG_FLUSHSA,
  160. #define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA
  161. XFRM_MSG_FLUSHPOLICY,
  162. #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
  163. XFRM_MSG_NEWAE,
  164. #define XFRM_MSG_NEWAE XFRM_MSG_NEWAE
  165. XFRM_MSG_GETAE,
  166. #define XFRM_MSG_GETAE XFRM_MSG_GETAE
  167. XFRM_MSG_REPORT,
  168. #define XFRM_MSG_REPORT XFRM_MSG_REPORT
  169. XFRM_MSG_MIGRATE,
  170. #define XFRM_MSG_MIGRATE XFRM_MSG_MIGRATE
  171. XFRM_MSG_NEWSADINFO,
  172. #define XFRM_MSG_NEWSADINFO XFRM_MSG_NEWSADINFO
  173. XFRM_MSG_GETSADINFO,
  174. #define XFRM_MSG_GETSADINFO XFRM_MSG_GETSADINFO
  175. XFRM_MSG_NEWSPDINFO,
  176. #define XFRM_MSG_NEWSPDINFO XFRM_MSG_NEWSPDINFO
  177. XFRM_MSG_GETSPDINFO,
  178. #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
  179. XFRM_MSG_MAPPING,
  180. #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
  181. __XFRM_MSG_MAX
  182. };
  183. #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
  184. #define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
  185. /*
  186. * Generic LSM security context for comunicating to user space
  187. * NOTE: Same format as sadb_x_sec_ctx
  188. */
  189. struct xfrm_user_sec_ctx {
  190. __u16 len;
  191. __u16 exttype;
  192. __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */
  193. __u8 ctx_doi;
  194. __u16 ctx_len;
  195. };
  196. struct xfrm_user_tmpl {
  197. struct xfrm_id id;
  198. __u16 family;
  199. xfrm_address_t saddr;
  200. __u32 reqid;
  201. __u8 mode;
  202. __u8 share;
  203. __u8 optional;
  204. __u32 aalgos;
  205. __u32 ealgos;
  206. __u32 calgos;
  207. };
  208. struct xfrm_encap_tmpl {
  209. __u16 encap_type;
  210. __be16 encap_sport;
  211. __be16 encap_dport;
  212. xfrm_address_t encap_oa;
  213. };
  214. /* AEVENT flags */
  215. enum xfrm_ae_ftype_t {
  216. XFRM_AE_UNSPEC,
  217. XFRM_AE_RTHR=1, /* replay threshold*/
  218. XFRM_AE_RVAL=2, /* replay value */
  219. XFRM_AE_LVAL=4, /* lifetime value */
  220. XFRM_AE_ETHR=8, /* expiry timer threshold */
  221. XFRM_AE_CR=16, /* Event cause is replay update */
  222. XFRM_AE_CE=32, /* Event cause is timer expiry */
  223. XFRM_AE_CU=64, /* Event cause is policy update */
  224. __XFRM_AE_MAX
  225. #define XFRM_AE_MAX (__XFRM_AE_MAX - 1)
  226. };
  227. struct xfrm_userpolicy_type {
  228. __u8 type;
  229. __u16 reserved1;
  230. __u8 reserved2;
  231. };
  232. /* Netlink message attributes. */
  233. enum xfrm_attr_type_t {
  234. XFRMA_UNSPEC,
  235. XFRMA_ALG_AUTH, /* struct xfrm_algo */
  236. XFRMA_ALG_CRYPT, /* struct xfrm_algo */
  237. XFRMA_ALG_COMP, /* struct xfrm_algo */
  238. XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */
  239. XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */
  240. XFRMA_SA, /* struct xfrm_usersa_info */
  241. XFRMA_POLICY, /*struct xfrm_userpolicy_info */
  242. XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */
  243. XFRMA_LTIME_VAL,
  244. XFRMA_REPLAY_VAL,
  245. XFRMA_REPLAY_THRESH,
  246. XFRMA_ETIMER_THRESH,
  247. XFRMA_SRCADDR, /* xfrm_address_t */
  248. XFRMA_COADDR, /* xfrm_address_t */
  249. XFRMA_LASTUSED, /* unsigned long */
  250. XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */
  251. XFRMA_MIGRATE,
  252. XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */
  253. XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */
  254. XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */
  255. XFRMA_MARK, /* struct xfrm_mark */
  256. XFRMA_TFCPAD, /* __u32 */
  257. XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_esn */
  258. XFRMA_SA_EXTRA_FLAGS, /* __u32 */
  259. XFRMA_PROTO, /* __u8 */
  260. XFRMA_ADDRESS_FILTER, /* struct xfrm_address_filter */
  261. __XFRMA_MAX
  262. #define XFRMA_MAX (__XFRMA_MAX - 1)
  263. };
  264. struct xfrm_mark {
  265. __u32 v; /* value */
  266. __u32 m; /* mask */
  267. };
  268. enum xfrm_sadattr_type_t {
  269. XFRMA_SAD_UNSPEC,
  270. XFRMA_SAD_CNT,
  271. XFRMA_SAD_HINFO,
  272. __XFRMA_SAD_MAX
  273. #define XFRMA_SAD_MAX (__XFRMA_SAD_MAX - 1)
  274. };
  275. struct xfrmu_sadhinfo {
  276. __u32 sadhcnt; /* current hash bkts */
  277. __u32 sadhmcnt; /* max allowed hash bkts */
  278. };
  279. enum xfrm_spdattr_type_t {
  280. XFRMA_SPD_UNSPEC,
  281. XFRMA_SPD_INFO,
  282. XFRMA_SPD_HINFO,
  283. XFRMA_SPD_IPV4_HTHRESH,
  284. XFRMA_SPD_IPV6_HTHRESH,
  285. __XFRMA_SPD_MAX
  286. #define XFRMA_SPD_MAX (__XFRMA_SPD_MAX - 1)
  287. };
  288. struct xfrmu_spdinfo {
  289. __u32 incnt;
  290. __u32 outcnt;
  291. __u32 fwdcnt;
  292. __u32 inscnt;
  293. __u32 outscnt;
  294. __u32 fwdscnt;
  295. };
  296. struct xfrmu_spdhinfo {
  297. __u32 spdhcnt;
  298. __u32 spdhmcnt;
  299. };
  300. struct xfrmu_spdhthresh {
  301. __u8 lbits;
  302. __u8 rbits;
  303. };
  304. struct xfrm_usersa_info {
  305. struct xfrm_selector sel;
  306. struct xfrm_id id;
  307. xfrm_address_t saddr;
  308. struct xfrm_lifetime_cfg lft;
  309. struct xfrm_lifetime_cur curlft;
  310. struct xfrm_stats stats;
  311. __u32 seq;
  312. __u32 reqid;
  313. __u16 family;
  314. __u8 mode; /* XFRM_MODE_xxx */
  315. __u8 replay_window;
  316. __u8 flags;
  317. #define XFRM_STATE_NOECN 1
  318. #define XFRM_STATE_DECAP_DSCP 2
  319. #define XFRM_STATE_NOPMTUDISC 4
  320. #define XFRM_STATE_WILDRECV 8
  321. #define XFRM_STATE_ICMP 16
  322. #define XFRM_STATE_AF_UNSPEC 32
  323. #define XFRM_STATE_ALIGN4 64
  324. #define XFRM_STATE_ESN 128
  325. };
  326. #define XFRM_SA_XFLAG_DONT_ENCAP_DSCP 1
  327. struct xfrm_usersa_id {
  328. xfrm_address_t daddr;
  329. __be32 spi;
  330. __u16 family;
  331. __u8 proto;
  332. };
  333. struct xfrm_aevent_id {
  334. struct xfrm_usersa_id sa_id;
  335. xfrm_address_t saddr;
  336. __u32 flags;
  337. __u32 reqid;
  338. };
  339. struct xfrm_userspi_info {
  340. struct xfrm_usersa_info info;
  341. __u32 min;
  342. __u32 max;
  343. };
  344. struct xfrm_userpolicy_info {
  345. struct xfrm_selector sel;
  346. struct xfrm_lifetime_cfg lft;
  347. struct xfrm_lifetime_cur curlft;
  348. __u32 priority;
  349. __u32 index;
  350. __u8 dir;
  351. __u8 action;
  352. #define XFRM_POLICY_ALLOW 0
  353. #define XFRM_POLICY_BLOCK 1
  354. __u8 flags;
  355. #define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */
  356. /* Automatically expand selector to include matching ICMP payloads. */
  357. #define XFRM_POLICY_ICMP 2
  358. __u8 share;
  359. };
  360. struct xfrm_userpolicy_id {
  361. struct xfrm_selector sel;
  362. __u32 index;
  363. __u8 dir;
  364. };
  365. struct xfrm_user_acquire {
  366. struct xfrm_id id;
  367. xfrm_address_t saddr;
  368. struct xfrm_selector sel;
  369. struct xfrm_userpolicy_info policy;
  370. __u32 aalgos;
  371. __u32 ealgos;
  372. __u32 calgos;
  373. __u32 seq;
  374. };
  375. struct xfrm_user_expire {
  376. struct xfrm_usersa_info state;
  377. __u8 hard;
  378. };
  379. struct xfrm_user_polexpire {
  380. struct xfrm_userpolicy_info pol;
  381. __u8 hard;
  382. };
  383. struct xfrm_usersa_flush {
  384. __u8 proto;
  385. };
  386. struct xfrm_user_report {
  387. __u8 proto;
  388. struct xfrm_selector sel;
  389. };
  390. /* Used by MIGRATE to pass addresses IKE should use to perform
  391. * SA negotiation with the peer */
  392. struct xfrm_user_kmaddress {
  393. xfrm_address_t local;
  394. xfrm_address_t remote;
  395. __u32 reserved;
  396. __u16 family;
  397. };
  398. struct xfrm_user_migrate {
  399. xfrm_address_t old_daddr;
  400. xfrm_address_t old_saddr;
  401. xfrm_address_t new_daddr;
  402. xfrm_address_t new_saddr;
  403. __u8 proto;
  404. __u8 mode;
  405. __u16 reserved;
  406. __u32 reqid;
  407. __u16 old_family;
  408. __u16 new_family;
  409. };
  410. struct xfrm_user_mapping {
  411. struct xfrm_usersa_id id;
  412. __u32 reqid;
  413. xfrm_address_t old_saddr;
  414. xfrm_address_t new_saddr;
  415. __be16 old_sport;
  416. __be16 new_sport;
  417. };
  418. struct xfrm_address_filter {
  419. xfrm_address_t saddr;
  420. xfrm_address_t daddr;
  421. __u16 family;
  422. __u8 splen;
  423. __u8 dplen;
  424. };
  425. /* backwards compatibility for userspace */
  426. #define XFRMGRP_ACQUIRE 1
  427. #define XFRMGRP_EXPIRE 2
  428. #define XFRMGRP_SA 4
  429. #define XFRMGRP_POLICY 8
  430. #define XFRMGRP_REPORT 0x20
  431. enum xfrm_nlgroups {
  432. XFRMNLGRP_NONE,
  433. #define XFRMNLGRP_NONE XFRMNLGRP_NONE
  434. XFRMNLGRP_ACQUIRE,
  435. #define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE
  436. XFRMNLGRP_EXPIRE,
  437. #define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE
  438. XFRMNLGRP_SA,
  439. #define XFRMNLGRP_SA XFRMNLGRP_SA
  440. XFRMNLGRP_POLICY,
  441. #define XFRMNLGRP_POLICY XFRMNLGRP_POLICY
  442. XFRMNLGRP_AEVENTS,
  443. #define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS
  444. XFRMNLGRP_REPORT,
  445. #define XFRMNLGRP_REPORT XFRMNLGRP_REPORT
  446. XFRMNLGRP_MIGRATE,
  447. #define XFRMNLGRP_MIGRATE XFRMNLGRP_MIGRATE
  448. XFRMNLGRP_MAPPING,
  449. #define XFRMNLGRP_MAPPING XFRMNLGRP_MAPPING
  450. __XFRMNLGRP_MAX
  451. };
  452. #define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1)
  453. #endif /* _LINUX_XFRM_H */