1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 2018, Joyent, Inc. 27 */ 28 29 #ifndef _NET_PFKEYV2_H 30 #define _NET_PFKEYV2_H 31 32 /* 33 * Definitions and structures for PF_KEY version 2. See RFC 2367 for 34 * more details. SA == Security Association, which is what PF_KEY provides 35 * an API for managing. 36 */ 37 38 #ifdef __cplusplus 39 extern "C" { 40 #endif 41 42 #define PF_KEY_V2 2 43 #define PFKEYV2_REVISION 200109L 44 45 /* 46 * Base PF_KEY message. 47 */ 48 49 typedef struct sadb_msg { 50 uint8_t sadb_msg_version; /* Version, currently PF_KEY_V2 */ 51 uint8_t sadb_msg_type; /* ADD, UPDATE, etc. */ 52 uint8_t sadb_msg_errno; /* Error number from UNIX errno space */ 53 uint8_t sadb_msg_satype; /* ESP, AH, etc. */ 54 uint16_t sadb_msg_len; /* Length in 64-bit words. */ 55 uint16_t sadb_msg_reserved; /* must be zero */ 56 /* 57 * Use the reserved field for extended diagnostic information on errno 58 * responses. 59 */ 60 #define sadb_x_msg_diagnostic sadb_msg_reserved 61 /* Union is for guaranteeing 64-bit alignment. */ 62 union { 63 struct { 64 uint32_t sadb_x_msg_useq; /* Set by originator */ 65 uint32_t sadb_x_msg_upid; /* Set by originator */ 66 } sadb_x_msg_actual; 67 uint64_t sadb_x_msg_alignment; 68 } sadb_x_msg_u; 69 #define sadb_msg_seq sadb_x_msg_u.sadb_x_msg_actual.sadb_x_msg_useq 70 #define sadb_msg_pid sadb_x_msg_u.sadb_x_msg_actual.sadb_x_msg_upid 71 } sadb_msg_t; 72 73 /* 74 * Generic extension header. 75 */ 76 77 typedef struct sadb_ext { 78 union { 79 /* Union is for guaranteeing 64-bit alignment. */ 80 struct { 81 uint16_t sadb_x_ext_ulen; /* In 64s, inclusive */ 82 uint16_t sadb_x_ext_utype; /* 0 is reserved */ 83 } sadb_x_ext_actual; 84 uint64_t sadb_x_ext_alignment; 85 } sadb_x_ext_u; 86 #define sadb_ext_len sadb_x_ext_u.sadb_x_ext_actual.sadb_x_ext_ulen 87 #define sadb_ext_type sadb_x_ext_u.sadb_x_ext_actual.sadb_x_ext_utype 88 } sadb_ext_t; 89 90 /* 91 * Security Association information extension. 92 */ 93 94 typedef struct sadb_sa { 95 /* Union is for guaranteeing 64-bit alignment. */ 96 union { 97 struct { 98 uint16_t sadb_x_sa_ulen; 99 uint16_t sadb_x_sa_uexttype; /* ASSOCIATION */ 100 uint32_t sadb_x_sa_uspi; /* Sec. Param. Index */ 101 } sadb_x_sa_uactual; 102 uint64_t sadb_x_sa_alignment; 103 } sadb_x_sa_u; 104 #define sadb_sa_len sadb_x_sa_u.sadb_x_sa_uactual.sadb_x_sa_ulen 105 #define sadb_sa_exttype sadb_x_sa_u.sadb_x_sa_uactual.sadb_x_sa_uexttype 106 #define sadb_sa_spi sadb_x_sa_u.sadb_x_sa_uactual.sadb_x_sa_uspi 107 uint8_t sadb_sa_replay; /* Replay counter */ 108 uint8_t sadb_sa_state; /* MATURE, DEAD, DYING, LARVAL */ 109 uint8_t sadb_sa_auth; /* Authentication algorithm */ 110 uint8_t sadb_sa_encrypt; /* Encryption algorithm */ 111 uint32_t sadb_sa_flags; /* SA flags. */ 112 } sadb_sa_t; 113 114 /* 115 * SA Lifetime extension. Already 64-bit aligned thanks to uint64_t fields. 116 */ 117 118 typedef struct sadb_lifetime { 119 uint16_t sadb_lifetime_len; 120 uint16_t sadb_lifetime_exttype; /* SOFT, HARD, CURRENT */ 121 uint32_t sadb_lifetime_allocations; 122 uint64_t sadb_lifetime_bytes; 123 uint64_t sadb_lifetime_addtime; /* These fields are assumed to hold */ 124 uint64_t sadb_lifetime_usetime; /* >= sizeof (time_t). */ 125 } sadb_lifetime_t; 126 127 /* 128 * SA address information. 129 */ 130 131 typedef struct sadb_address { 132 /* Union is for guaranteeing 64-bit alignment. */ 133 union { 134 struct { 135 uint16_t sadb_x_address_ulen; 136 uint16_t sadb_x_address_uexttype; /* SRC, DST, PROXY */ 137 uint8_t sadb_x_address_uproto; /* Proto for ports... */ 138 uint8_t sadb_x_address_uprefixlen; /* Prefix length. */ 139 uint16_t sadb_x_address_ureserved; /* Padding */ 140 } sadb_x_address_actual; 141 uint64_t sadb_x_address_alignment; 142 } sadb_x_address_u; 143 #define sadb_address_len \ 144 sadb_x_address_u.sadb_x_address_actual.sadb_x_address_ulen 145 #define sadb_address_exttype \ 146 sadb_x_address_u.sadb_x_address_actual.sadb_x_address_uexttype 147 #define sadb_address_proto \ 148 sadb_x_address_u.sadb_x_address_actual.sadb_x_address_uproto 149 #define sadb_address_prefixlen \ 150 sadb_x_address_u.sadb_x_address_actual.sadb_x_address_uprefixlen 151 #define sadb_address_reserved \ 152 sadb_x_address_u.sadb_x_address_actual.sadb_x_address_ureserved 153 /* Followed by a sockaddr structure which may contain ports. */ 154 } sadb_address_t; 155 156 /* 157 * SA key information. 158 */ 159 160 typedef struct sadb_key { 161 /* Union is for guaranteeing 64-bit alignment. */ 162 union { 163 struct { 164 uint16_t sadb_x_key_ulen; 165 uint16_t sadb_x_key_uexttype; /* AUTH, ENCRYPT */ 166 uint16_t sadb_x_key_ubits; /* Actual len (bits) */ 167 uint16_t sadb_x_key_ureserved; 168 } sadb_x_key_actual; 169 uint64_t sadb_x_key_alignment; 170 } sadb_x_key_u; 171 #define sadb_key_len sadb_x_key_u.sadb_x_key_actual.sadb_x_key_ulen 172 #define sadb_key_exttype sadb_x_key_u.sadb_x_key_actual.sadb_x_key_uexttype 173 #define sadb_key_bits sadb_x_key_u.sadb_x_key_actual.sadb_x_key_ubits 174 #define sadb_key_reserved sadb_x_key_u.sadb_x_key_actual.sadb_x_key_ureserved 175 /* Followed by actual key(s) in canonical (outbound proc.) order. */ 176 } sadb_key_t; 177 178 /* 179 * SA Identity information. Already 64-bit aligned thanks to uint64_t fields. 180 */ 181 182 typedef struct sadb_ident { 183 uint16_t sadb_ident_len; 184 uint16_t sadb_ident_exttype; /* SRC, DST, PROXY */ 185 uint16_t sadb_ident_type; /* FQDN, USER_FQDN, etc. */ 186 uint16_t sadb_ident_reserved; /* Padding */ 187 uint64_t sadb_ident_id; /* For userid, etc. */ 188 /* Followed by an identity null-terminate C string if present. */ 189 } sadb_ident_t; 190 191 /* 192 * SA sensitivity information. This is mostly useful on MLS systems. 193 */ 194 195 typedef struct sadb_sens { 196 /* Union is for guaranteeing 64-bit alignment. */ 197 union { 198 struct { 199 uint16_t sadb_x_sens_ulen; 200 uint16_t sadb_x_sens_uexttype; /* SENSITIVITY */ 201 uint32_t sadb_x_sens_udpd; /* Protection domain */ 202 } sadb_x_sens_actual; 203 uint64_t sadb_x_sens_alignment; 204 } sadb_x_sens_u; 205 #define sadb_sens_len sadb_x_sens_u.sadb_x_sens_actual.sadb_x_sens_ulen 206 #define sadb_sens_exttype sadb_x_sens_u.sadb_x_sens_actual.sadb_x_sens_uexttype 207 #define sadb_sens_dpd sadb_x_sens_u.sadb_x_sens_actual.sadb_x_sens_udpd 208 uint8_t sadb_sens_sens_level; 209 uint8_t sadb_sens_sens_len; /* 64-bit words */ 210 uint8_t sadb_sens_integ_level; 211 uint8_t sadb_sens_integ_len; /* 64-bit words */ 212 uint32_t sadb_x_sens_flags; 213 /* 214 * followed by two uint64_t arrays 215 * uint64_t sadb_sens_bitmap[sens_bitmap_len]; 216 * uint64_t sadb_integ_bitmap[integ_bitmap_len]; 217 */ 218 } sadb_sens_t; 219 220 /* 221 * We recycled the formerly reserved word for flags. 222 */ 223 224 #define sadb_sens_reserved sadb_x_sens_flags 225 226 #define SADB_X_SENS_IMPLICIT 0x1 /* implicit labelling */ 227 #define SADB_X_SENS_UNLABELED 0x2 /* peer is unlabeled */ 228 229 /* 230 * a proposal extension. This is found in an ACQUIRE message, and it 231 * proposes what sort of SA the kernel would like to ACQUIRE. 232 */ 233 234 /* First, a base structure... */ 235 236 typedef struct sadb_x_propbase { 237 uint16_t sadb_x_propb_len; 238 uint16_t sadb_x_propb_exttype; /* PROPOSAL, X_EPROP */ 239 union { 240 struct { 241 uint8_t sadb_x_propb_lenres_replay; 242 uint8_t sadb_x_propb_lenres_eres; 243 uint16_t sadb_x_propb_lenres_numecombs; 244 } sadb_x_propb_lenres; 245 struct { 246 uint8_t sadb_x_propb_oldres_replay; 247 uint8_t sadb_x_propb_oldres_reserved[3]; 248 } sadb_x_propb_oldres; 249 } sadb_x_propb_u; 250 #define sadb_x_propb_replay \ 251 sadb_x_propb_u.sadb_x_propb_lenres.sadb_x_propb_lenres_replay 252 #define sadb_x_propb_reserved \ 253 sadb_x_propb_u.sadb_x_propb_oldres.sadb_x_propb_oldres_reserved 254 #define sadb_x_propb_ereserved \ 255 sadb_x_propb_u.sadb_x_propb_lenres.sadb_x_propb_lenres_eres 256 #define sadb_x_propb_numecombs \ 257 sadb_x_propb_u.sadb_x_propb_lenres.sadb_x_propb_lenres_numecombs 258 /* Followed by sadb_comb[] array or sadb_ecomb[] array. */ 259 } sadb_x_propbase_t; 260 261 /* Now, the actual sadb_prop structure, which will have alignment in it! */ 262 263 typedef struct sadb_prop { 264 /* Union is for guaranteeing 64-bit alignment. */ 265 union { 266 sadb_x_propbase_t sadb_x_prop_actual; 267 uint64_t sadb_x_prop_alignment; 268 } sadb_x_prop_u; 269 #define sadb_prop_len sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_len 270 #define sadb_prop_exttype sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_exttype 271 #define sadb_prop_replay sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_replay 272 #define sadb_prop_reserved \ 273 sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_reserved 274 #define sadb_x_prop_ereserved \ 275 sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_ereserved 276 #define sadb_x_prop_numecombs \ 277 sadb_x_prop_u.sadb_x_prop_actual.sadb_x_propb_numecombs 278 } sadb_prop_t; 279 280 /* 281 * This is a proposed combination. Many of these can follow a proposal 282 * extension. Already 64-bit aligned thanks to uint64_t fields. 283 */ 284 285 typedef struct sadb_comb { 286 uint8_t sadb_comb_auth; /* Authentication algorithm */ 287 uint8_t sadb_comb_encrypt; /* Encryption algorithm */ 288 uint16_t sadb_comb_flags; /* Comb. flags (e.g. PFS) */ 289 uint16_t sadb_comb_auth_minbits; /* Bit strengths for auth */ 290 uint16_t sadb_comb_auth_maxbits; 291 uint16_t sadb_comb_encrypt_minbits; /* Bit strengths for encrypt */ 292 uint16_t sadb_comb_encrypt_maxbits; 293 uint8_t sadb_x_comb_encrypt_saltbits; 294 uint8_t sadb_x_comb_reserved; 295 uint16_t sadb_comb_reserved; 296 uint32_t sadb_comb_soft_allocations; /* Lifetime proposals for */ 297 uint32_t sadb_comb_hard_allocations; /* this combination. */ 298 uint64_t sadb_comb_soft_bytes; 299 uint64_t sadb_comb_hard_bytes; 300 uint64_t sadb_comb_soft_addtime; 301 uint64_t sadb_comb_hard_addtime; 302 uint64_t sadb_comb_soft_usetime; 303 uint64_t sadb_comb_hard_usetime; 304 } sadb_comb_t; 305 306 /* 307 * An extended combination that can comprise of many SA types. 308 * A single combination has algorithms and SA types locked. 309 * These are represented by algorithm descriptors, the second structure 310 * in the list. For example, if the EACQUIRE requests AH(MD5) + ESP(DES/null) 311 * _or_ ESP(DES/MD5), it would have two combinations: 312 * 313 * COMB: algdes(AH, AUTH, MD5), algdes(ESP, CRYPT, DES) 314 * COMB: algdes(ESP, AUTH, MD5), algdes(ESP, CRYPT, DES) 315 * 316 * If an SA type supports an algorithm type, and there's no descriptor, 317 * assume it requires NONE, just like it were explicitly stated. 318 * (This includes ESP NULL encryption, BTW.) 319 * 320 * Already 64-bit aligned thanks to uint64_t fields. 321 */ 322 323 typedef struct sadb_x_ecomb { 324 uint8_t sadb_x_ecomb_numalgs; 325 uint8_t sadb_x_ecomb_reserved; 326 uint16_t sadb_x_ecomb_flags; /* E.g. PFS? */ 327 uint32_t sadb_x_ecomb_reserved2; 328 uint32_t sadb_x_ecomb_soft_allocations; 329 uint32_t sadb_x_ecomb_hard_allocations; 330 uint64_t sadb_x_ecomb_soft_bytes; 331 uint64_t sadb_x_ecomb_hard_bytes; 332 uint64_t sadb_x_ecomb_soft_addtime; 333 uint64_t sadb_x_ecomb_hard_addtime; 334 uint64_t sadb_x_ecomb_soft_usetime; 335 uint64_t sadb_x_ecomb_hard_usetime; 336 } sadb_x_ecomb_t; 337 338 typedef struct sadb_x_algdesc { 339 /* Union is for guaranteeing 64-bit alignment. */ 340 union { 341 struct { 342 uint8_t sadb_x_algdesc_usatype; /* ESP, AH, etc. */ 343 uint8_t sadb_x_algdesc_ualgtype; /* AUTH, CRYPT, COMP */ 344 uint8_t sadb_x_algdesc_ualg; /* 3DES, MD5, etc. */ 345 uint8_t sadb_x_algdesc_usaltbits; 346 uint16_t sadb_x_algdesc_uminbits; /* Bit strengths. */ 347 uint16_t sadb_x_algdesc_umaxbits; 348 } sadb_x_algdesc_actual; 349 uint64_t sadb_x_algdesc_alignment; 350 } sadb_x_algdesc_u; 351 #define sadb_x_algdesc_satype \ 352 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_usatype 353 #define sadb_x_algdesc_algtype \ 354 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_ualgtype 355 #define sadb_x_algdesc_alg \ 356 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_ualg 357 #define sadb_x_algdesc_saltbits \ 358 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_usaltbits 359 #define sadb_x_algdesc_minbits \ 360 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_uminbits 361 #define sadb_x_algdesc_maxbits \ 362 sadb_x_algdesc_u.sadb_x_algdesc_actual.sadb_x_algdesc_umaxbits 363 } sadb_x_algdesc_t; 364 365 /* 366 * When key mgmt. registers with the kernel, the kernel will tell key mgmt. 367 * its supported algorithms. 368 */ 369 370 typedef struct sadb_supported { 371 /* Union is for guaranteeing 64-bit alignment. */ 372 union { 373 struct { 374 uint16_t sadb_x_supported_ulen; 375 uint16_t sadb_x_supported_uexttype; 376 uint32_t sadb_x_supported_ureserved; 377 } sadb_x_supported_actual; 378 uint64_t sadb_x_supported_alignment; 379 } sadb_x_supported_u; 380 #define sadb_supported_len \ 381 sadb_x_supported_u.sadb_x_supported_actual.sadb_x_supported_ulen 382 #define sadb_supported_exttype \ 383 sadb_x_supported_u.sadb_x_supported_actual.sadb_x_supported_uexttype 384 #define sadb_supported_reserved \ 385 sadb_x_supported_u.sadb_x_supported_actual.sadb_x_supported_ureserved 386 } sadb_supported_t; 387 388 /* First, a base structure... */ 389 typedef struct sadb_x_algb { 390 uint8_t sadb_x_algb_id; /* Algorithm type. */ 391 uint8_t sadb_x_algb_ivlen; /* IV len, in bits */ 392 uint16_t sadb_x_algb_minbits; /* Min. key len (in bits) */ 393 uint16_t sadb_x_algb_maxbits; /* Max. key length */ 394 union { 395 uint16_t sadb_x_algb_ureserved; 396 uint8_t sadb_x_algb_udefaults[2]; 397 } sadb_x_algb_union; 398 399 #define sadb_x_algb_reserved sadb_x_algb_union.sadb_x_algb_ureserved 400 #define sadb_x_algb_increment sadb_x_algb_union.sadb_x_algb_udefaults[0] 401 #define sadb_x_algb_saltbits sadb_x_algb_union.sadb_x_algb_udefaults[1] 402 /* 403 * alg_increment: the number of bits from a key length to the next 404 */ 405 } sadb_x_algb_t; 406 407 /* Now, the actual sadb_alg structure, which will have alignment in it. */ 408 typedef struct sadb_alg { 409 /* Union is for guaranteeing 64-bit alignment. */ 410 union { 411 sadb_x_algb_t sadb_x_alg_actual; 412 uint64_t sadb_x_alg_alignment; 413 } sadb_x_alg_u; 414 #define sadb_alg_id sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_id 415 #define sadb_alg_ivlen sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_ivlen 416 #define sadb_alg_minbits sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_minbits 417 #define sadb_alg_maxbits sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_maxbits 418 #define sadb_alg_reserved sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_reserved 419 #define sadb_x_alg_increment \ 420 sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_increment 421 #define sadb_x_alg_saltbits sadb_x_alg_u.sadb_x_alg_actual.sadb_x_algb_saltbits 422 } sadb_alg_t; 423 424 /* 425 * If key mgmt. needs an SPI in a range (including 0 to 0xFFFFFFFF), it 426 * asks the kernel with this extension in the SADB_GETSPI message. 427 */ 428 429 typedef struct sadb_spirange { 430 uint16_t sadb_spirange_len; 431 uint16_t sadb_spirange_exttype; /* SPI_RANGE */ 432 uint32_t sadb_spirange_min; 433 /* Union is for guaranteeing 64-bit alignment. */ 434 union { 435 struct { 436 uint32_t sadb_x_spirange_umax; 437 uint32_t sadb_x_spirange_ureserved; 438 } sadb_x_spirange_actual; 439 uint64_t sadb_x_spirange_alignment; 440 } sadb_x_spirange_u; 441 #define sadb_spirange_max \ 442 sadb_x_spirange_u.sadb_x_spirange_actual.sadb_x_spirange_umax 443 #define sadb_spirange_reserved \ 444 sadb_x_spirange_u.sadb_x_spirange_actual.sadb_x_spirange_ureserved 445 } sadb_spirange_t; 446 447 /* 448 * For the "extended REGISTER" which'll tell the kernel to send me 449 * "extended ACQUIREs". 450 */ 451 452 typedef struct sadb_x_ereg { 453 /* Union is for guaranteeing 64-bit alignment. */ 454 union { 455 struct { 456 uint16_t sadb_x_ereg_ulen; 457 uint16_t sadb_x_ereg_uexttype; /* X_EREG */ 458 /* Array of SA types, 0-terminated. */ 459 uint8_t sadb_x_ereg_usatypes[4]; 460 } sadb_x_ereg_actual; 461 uint64_t sadb_x_ereg_alignment; 462 } sadb_x_ereg_u; 463 #define sadb_x_ereg_len \ 464 sadb_x_ereg_u.sadb_x_ereg_actual.sadb_x_ereg_ulen 465 #define sadb_x_ereg_exttype \ 466 sadb_x_ereg_u.sadb_x_ereg_actual.sadb_x_ereg_uexttype 467 #define sadb_x_ereg_satypes \ 468 sadb_x_ereg_u.sadb_x_ereg_actual.sadb_x_ereg_usatypes 469 } sadb_x_ereg_t; 470 471 /* 472 * For conveying a Key Management Cookie with SADB_GETSPI, SADB_ADD, 473 * SADB_ACQUIRE, or SADB_X_INVERSE_ACQUIRE. 474 */ 475 476 typedef struct sadb_x_kmc { 477 uint16_t sadb_x_kmc_len; 478 uint16_t sadb_x_kmc_exttype; /* X_KM_COOKIE */ 479 uint32_t sadb_x_kmc_proto; /* KM protocol */ 480 union { 481 struct { 482 uint32_t sadb_x_kmc_ucookie; /* KMP-specific */ 483 uint32_t sadb_x_kmc_ureserved; /* Must be zero */ 484 } sadb_x_kmc_actual; 485 uint64_t sadb_x_kmc_ucookie64; 486 } sadb_x_kmc_u; 487 #define sadb_x_kmc_cookie sadb_x_kmc_u.sadb_x_kmc_actual.sadb_x_kmc_ucookie 488 #define sadb_x_kmc_reserved sadb_x_kmc_u.sadb_x_kmc_actual.sadb_x_kmc_ureserved 489 #define sadb_x_kmc_cookie64 sadb_x_kmc_u.sadb_x_kmc_ucookie64 490 } sadb_x_kmc_t; 491 492 typedef struct sadb_x_pair { 493 union { 494 /* Union is for guaranteeing 64-bit alignment. */ 495 struct { 496 uint16_t sadb_x_pair_ulen; 497 uint16_t sadb_x_pair_uexttype; 498 uint32_t sadb_x_pair_uspi; /* SPI of paired SA */ 499 } sadb_x_pair_actual; 500 uint64_t sadb_x_ext_alignment; 501 } sadb_x_pair_u; 502 #define sadb_x_pair_len sadb_x_pair_u.sadb_x_pair_actual.sadb_x_pair_ulen 503 #define sadb_x_pair_exttype \ 504 sadb_x_pair_u.sadb_x_pair_actual.sadb_x_pair_uexttype 505 #define sadb_x_pair_spi sadb_x_pair_u.sadb_x_pair_actual.sadb_x_pair_uspi 506 } sadb_x_pair_t; 507 508 /* 509 * For the Sequence numbers to be used with SADB_DUMP, SADB_GET, SADB_UPDATE. 510 */ 511 512 typedef struct sadb_x_replay_ctr { 513 uint16_t sadb_x_rc_len; 514 uint16_t sadb_x_rc_exttype; 515 uint32_t sadb_x_rc_replay32; /* For 240x SAs. */ 516 uint64_t sadb_x_rc_replay64; /* For 430x SAs. */ 517 } sadb_x_replay_ctr_t; 518 519 /* 520 * For extended DUMP request. Dumps the SAs which were idle for 521 * longer than the timeout specified. 522 */ 523 524 typedef struct sadb_x_edump { 525 uint16_t sadb_x_edump_len; 526 uint16_t sadb_x_edump_exttype; 527 uint32_t sadb_x_edump_reserved; 528 uint64_t sadb_x_edump_timeout; 529 } sadb_x_edump_t; 530 531 /* 532 * Base message types. 533 */ 534 535 #define SADB_RESERVED 0 536 #define SADB_GETSPI 1 537 #define SADB_UPDATE 2 538 #define SADB_ADD 3 539 #define SADB_DELETE 4 540 #define SADB_GET 5 541 #define SADB_ACQUIRE 6 542 #define SADB_REGISTER 7 543 #define SADB_EXPIRE 8 544 #define SADB_FLUSH 9 545 #define SADB_DUMP 10 /* not used normally */ 546 #define SADB_X_PROMISC 11 547 #define SADB_X_INVERSE_ACQUIRE 12 548 #define SADB_X_UPDATEPAIR 13 549 #define SADB_X_DELPAIR 14 550 #define SADB_X_DELPAIR_STATE 15 551 #define SADB_MAX 15 552 553 /* 554 * SA flags 555 */ 556 557 #define SADB_SAFLAGS_PFS 0x1 /* Perfect forward secrecy? */ 558 #define SADB_SAFLAGS_NOREPLAY 0x2 /* Replay field NOT PRESENT. */ 559 560 /* Below flags are used by this implementation. Grow from left-to-right. */ 561 #define SADB_X_SAFLAGS_USED 0x80000000 /* SA used/not used */ 562 #define SADB_X_SAFLAGS_UNIQUE 0x40000000 /* SA unique/reusable */ 563 #define SADB_X_SAFLAGS_AALG1 0x20000000 /* Auth-alg specific flag 1 */ 564 #define SADB_X_SAFLAGS_AALG2 0x10000000 /* Auth-alg specific flag 2 */ 565 #define SADB_X_SAFLAGS_EALG1 0x8000000 /* Encr-alg specific flag 1 */ 566 #define SADB_X_SAFLAGS_EALG2 0x4000000 /* Encr-alg specific flag 2 */ 567 #define SADB_X_SAFLAGS_KM1 0x2000000 /* Key mgmt. specific flag 1 */ 568 #define SADB_X_SAFLAGS_KM2 0x1000000 /* Key mgmt. specific flag 2 */ 569 #define SADB_X_SAFLAGS_KM3 0x800000 /* Key mgmt. specific flag 3 */ 570 #define SADB_X_SAFLAGS_KM4 0x400000 /* Key mgmt. specific flag 4 */ 571 #define SADB_X_SAFLAGS_KRES1 0x200000 /* Reserved by the kernel */ 572 #define SADB_X_SAFLAGS_NATT_LOC 0x100000 /* this has a natted src SA */ 573 #define SADB_X_SAFLAGS_NATT_REM 0x80000 /* this has a natted dst SA */ 574 #define SADB_X_SAFLAGS_KRES2 0x40000 /* Reserved by the kernel */ 575 #define SADB_X_SAFLAGS_TUNNEL 0x20000 /* tunnel mode */ 576 #define SADB_X_SAFLAGS_PAIRED 0x10000 /* inbound/outbound pair */ 577 #define SADB_X_SAFLAGS_OUTBOUND 0x8000 /* SA direction bit */ 578 #define SADB_X_SAFLAGS_INBOUND 0x4000 /* SA direction bit */ 579 #define SADB_X_SAFLAGS_NATTED 0x1000 /* Local node is behind a NAT */ 580 581 #define SADB_X_SAFLAGS_KRES \ 582 SADB_X_SAFLAGS_KRES1 | SADB_X_SAFLAGS_KRES2 583 584 /* 585 * SA state. 586 */ 587 588 #define SADB_SASTATE_LARVAL 0 589 #define SADB_SASTATE_MATURE 1 590 #define SADB_SASTATE_DYING 2 591 #define SADB_SASTATE_DEAD 3 592 #define SADB_X_SASTATE_ACTIVE_ELSEWHERE 4 593 #define SADB_X_SASTATE_IDLE 5 594 #define SADB_X_SASTATE_ACTIVE 6 595 596 #define SADB_SASTATE_MAX 6 597 598 /* 599 * SA type. Gaps are present in the number space because (for the time being) 600 * these types correspond to the SA types in the IPsec DOI document. 601 */ 602 603 #define SADB_SATYPE_UNSPEC 0 604 #define SADB_SATYPE_AH 2 /* RFC-1826 */ 605 #define SADB_SATYPE_ESP 3 /* RFC-1827 */ 606 #define SADB_SATYPE_RSVP 5 /* RSVP Authentication */ 607 #define SADB_SATYPE_OSPFV2 6 /* OSPFv2 Authentication */ 608 #define SADB_SATYPE_RIPV2 7 /* RIPv2 Authentication */ 609 #define SADB_SATYPE_MIP 8 /* Mobile IPv4 Authentication */ 610 611 #define SADB_SATYPE_MAX 8 612 613 /* 614 * Algorithm types. Gaps are present because (for the time being) these types 615 * correspond to the SA types in the IPsec DOI document. 616 * 617 * NOTE: These are numbered to play nice with the IPsec DOI. That's why 618 * there are gaps. 619 */ 620 621 /* Authentication algorithms */ 622 #define SADB_AALG_NONE 0 623 #define SADB_AALG_MD5HMAC 2 624 #define SADB_AALG_SHA1HMAC 3 625 #define SADB_AALG_SHA256HMAC 5 626 #define SADB_AALG_SHA384HMAC 6 627 #define SADB_AALG_SHA512HMAC 7 628 629 #define SADB_AALG_MAX 7 630 631 /* Encryption algorithms */ 632 #define SADB_EALG_NONE 0 633 #define SADB_EALG_DESCBC 2 634 #define SADB_EALG_3DESCBC 3 635 #define SADB_EALG_BLOWFISH 7 636 #define SADB_EALG_NULL 11 637 #define SADB_EALG_AES 12 638 #define SADB_EALG_AES_CCM_8 14 639 #define SADB_EALG_AES_CCM_12 15 640 #define SADB_EALG_AES_CCM_16 16 641 #define SADB_EALG_AES_GCM_8 18 642 #define SADB_EALG_AES_GCM_12 19 643 #define SADB_EALG_AES_GCM_16 20 644 #define SADB_EALG_MAX 20 645 646 /* 647 * Extension header values. 648 */ 649 650 #define SADB_EXT_RESERVED 0 651 652 #define SADB_EXT_SA 1 653 #define SADB_EXT_LIFETIME_CURRENT 2 654 #define SADB_EXT_LIFETIME_HARD 3 655 #define SADB_EXT_LIFETIME_SOFT 4 656 #define SADB_EXT_ADDRESS_SRC 5 657 #define SADB_EXT_ADDRESS_DST 6 658 /* These two are synonyms. */ 659 #define SADB_EXT_ADDRESS_PROXY 7 660 #define SADB_X_EXT_ADDRESS_INNER_SRC SADB_EXT_ADDRESS_PROXY 661 #define SADB_EXT_KEY_AUTH 8 662 #define SADB_EXT_KEY_ENCRYPT 9 663 #define SADB_EXT_IDENTITY_SRC 10 664 #define SADB_EXT_IDENTITY_DST 11 665 #define SADB_EXT_SENSITIVITY 12 666 #define SADB_EXT_PROPOSAL 13 667 #define SADB_EXT_SUPPORTED_AUTH 14 668 #define SADB_EXT_SUPPORTED_ENCRYPT 15 669 #define SADB_EXT_SPIRANGE 16 670 #define SADB_X_EXT_EREG 17 671 #define SADB_X_EXT_EPROP 18 672 #define SADB_X_EXT_KM_COOKIE 19 673 #define SADB_X_EXT_ADDRESS_NATT_LOC 20 674 #define SADB_X_EXT_ADDRESS_NATT_REM 21 675 #define SADB_X_EXT_ADDRESS_INNER_DST 22 676 #define SADB_X_EXT_PAIR 23 677 #define SADB_X_EXT_REPLAY_VALUE 24 678 #define SADB_X_EXT_EDUMP 25 679 #define SADB_X_EXT_LIFETIME_IDLE 26 680 #define SADB_X_EXT_OUTER_SENS 27 681 682 #define SADB_EXT_MAX 27 683 684 /* 685 * Identity types. 686 */ 687 688 #define SADB_IDENTTYPE_RESERVED 0 689 690 /* 691 * For PREFIX and ADDR_RANGE, use the AF of the PROXY if present, or the SRC 692 * if not present. 693 */ 694 #define SADB_IDENTTYPE_PREFIX 1 695 #define SADB_IDENTTYPE_FQDN 2 /* Fully qualified domain name. */ 696 #define SADB_IDENTTYPE_USER_FQDN 3 /* e.g. root@domain.com */ 697 #define SADB_X_IDENTTYPE_DN 4 /* ASN.1 DER Distinguished Name. */ 698 #define SADB_X_IDENTTYPE_GN 5 /* ASN.1 DER Generic Name. */ 699 #define SADB_X_IDENTTYPE_KEY_ID 6 /* Generic KEY ID. */ 700 #define SADB_X_IDENTTYPE_ADDR_RANGE 7 701 702 #define SADB_IDENTTYPE_MAX 7 703 704 /* 705 * Protection DOI values for the SENSITIVITY extension. There are no values 706 * currently, so the MAX is the only non-zero value available. 707 */ 708 709 #define SADB_DPD_NONE 0 710 711 #define SADB_DPD_MAX 1 712 713 /* 714 * Diagnostic codes. These supplement error messages. Be sure to 715 * update libipsecutil's keysock_diag() if you change any of these. 716 */ 717 718 #define SADB_X_DIAGNOSTIC_PRESET -1 /* Internal value. */ 719 720 #define SADB_X_DIAGNOSTIC_NONE 0 721 722 #define SADB_X_DIAGNOSTIC_UNKNOWN_MSG 1 723 #define SADB_X_DIAGNOSTIC_UNKNOWN_EXT 2 724 #define SADB_X_DIAGNOSTIC_BAD_EXTLEN 3 725 #define SADB_X_DIAGNOSTIC_UNKNOWN_SATYPE 4 726 #define SADB_X_DIAGNOSTIC_SATYPE_NEEDED 5 727 #define SADB_X_DIAGNOSTIC_NO_SADBS 6 728 #define SADB_X_DIAGNOSTIC_NO_EXT 7 729 /* Bad address family value */ 730 #define SADB_X_DIAGNOSTIC_BAD_SRC_AF 8 731 /* in sockaddr->sa_family. */ 732 #define SADB_X_DIAGNOSTIC_BAD_DST_AF 9 733 /* These two are synonyms. */ 734 #define SADB_X_DIAGNOSTIC_BAD_PROXY_AF 10 735 #define SADB_X_DIAGNOSTIC_BAD_INNER_SRC_AF 10 736 737 #define SADB_X_DIAGNOSTIC_AF_MISMATCH 11 738 739 #define SADB_X_DIAGNOSTIC_BAD_SRC 12 740 #define SADB_X_DIAGNOSTIC_BAD_DST 13 741 742 #define SADB_X_DIAGNOSTIC_ALLOC_HSERR 14 743 #define SADB_X_DIAGNOSTIC_BYTES_HSERR 15 744 #define SADB_X_DIAGNOSTIC_ADDTIME_HSERR 16 745 #define SADB_X_DIAGNOSTIC_USETIME_HSERR 17 746 747 #define SADB_X_DIAGNOSTIC_MISSING_SRC 18 748 #define SADB_X_DIAGNOSTIC_MISSING_DST 19 749 #define SADB_X_DIAGNOSTIC_MISSING_SA 20 750 #define SADB_X_DIAGNOSTIC_MISSING_EKEY 21 751 #define SADB_X_DIAGNOSTIC_MISSING_AKEY 22 752 #define SADB_X_DIAGNOSTIC_MISSING_RANGE 23 753 754 #define SADB_X_DIAGNOSTIC_DUPLICATE_SRC 24 755 #define SADB_X_DIAGNOSTIC_DUPLICATE_DST 25 756 #define SADB_X_DIAGNOSTIC_DUPLICATE_SA 26 757 #define SADB_X_DIAGNOSTIC_DUPLICATE_EKEY 27 758 #define SADB_X_DIAGNOSTIC_DUPLICATE_AKEY 28 759 #define SADB_X_DIAGNOSTIC_DUPLICATE_RANGE 29 760 761 #define SADB_X_DIAGNOSTIC_MALFORMED_SRC 30 762 #define SADB_X_DIAGNOSTIC_MALFORMED_DST 31 763 #define SADB_X_DIAGNOSTIC_MALFORMED_SA 32 764 #define SADB_X_DIAGNOSTIC_MALFORMED_EKEY 33 765 #define SADB_X_DIAGNOSTIC_MALFORMED_AKEY 34 766 #define SADB_X_DIAGNOSTIC_MALFORMED_RANGE 35 767 768 #define SADB_X_DIAGNOSTIC_AKEY_PRESENT 36 769 #define SADB_X_DIAGNOSTIC_EKEY_PRESENT 37 770 #define SADB_X_DIAGNOSTIC_PROP_PRESENT 38 771 #define SADB_X_DIAGNOSTIC_SUPP_PRESENT 39 772 773 #define SADB_X_DIAGNOSTIC_BAD_AALG 40 774 #define SADB_X_DIAGNOSTIC_BAD_EALG 41 775 #define SADB_X_DIAGNOSTIC_BAD_SAFLAGS 42 776 #define SADB_X_DIAGNOSTIC_BAD_SASTATE 43 777 778 #define SADB_X_DIAGNOSTIC_BAD_AKEYBITS 44 779 #define SADB_X_DIAGNOSTIC_BAD_EKEYBITS 45 780 781 #define SADB_X_DIAGNOSTIC_ENCR_NOTSUPP 46 782 783 #define SADB_X_DIAGNOSTIC_WEAK_EKEY 47 784 #define SADB_X_DIAGNOSTIC_WEAK_AKEY 48 785 786 #define SADB_X_DIAGNOSTIC_DUPLICATE_KMP 49 787 #define SADB_X_DIAGNOSTIC_DUPLICATE_KMC 50 788 789 #define SADB_X_DIAGNOSTIC_MISSING_NATT_LOC 51 790 #define SADB_X_DIAGNOSTIC_MISSING_NATT_REM 52 791 #define SADB_X_DIAGNOSTIC_DUPLICATE_NATT_LOC 53 792 #define SADB_X_DIAGNOSTIC_DUPLICATE_NATT_REM 54 793 #define SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC 55 794 #define SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM 56 795 #define SADB_X_DIAGNOSTIC_DUPLICATE_NATT_PORTS 57 796 797 #define SADB_X_DIAGNOSTIC_MISSING_INNER_SRC 58 798 #define SADB_X_DIAGNOSTIC_MISSING_INNER_DST 59 799 #define SADB_X_DIAGNOSTIC_DUPLICATE_INNER_SRC 60 800 #define SADB_X_DIAGNOSTIC_DUPLICATE_INNER_DST 61 801 #define SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC 62 802 #define SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST 63 803 804 #define SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC 64 805 #define SADB_X_DIAGNOSTIC_PREFIX_INNER_DST 65 806 #define SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF 66 807 #define SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH 67 808 809 #define SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF 68 810 #define SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF 69 811 812 #define SADB_X_DIAGNOSTIC_PROTO_MISMATCH 70 813 #define SADB_X_DIAGNOSTIC_INNER_PROTO_MISMATCH 71 814 815 #define SADB_X_DIAGNOSTIC_DUAL_PORT_SETS 72 816 817 #define SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE 73 818 #define SADB_X_DIAGNOSTIC_PAIR_ADD_MISMATCH 74 819 #define SADB_X_DIAGNOSTIC_PAIR_ALREADY 75 820 #define SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND 76 821 #define SADB_X_DIAGNOSTIC_BAD_SA_DIRECTION 77 822 823 #define SADB_X_DIAGNOSTIC_SA_NOTFOUND 78 824 #define SADB_X_DIAGNOSTIC_SA_EXPIRED 79 825 #define SADB_X_DIAGNOSTIC_BAD_CTX 80 826 #define SADB_X_DIAGNOSTIC_INVALID_REPLAY 81 827 #define SADB_X_DIAGNOSTIC_MISSING_LIFETIME 82 828 829 #define SADB_X_DIAGNOSTIC_BAD_LABEL 83 830 #define SADB_X_DIAGNOSTIC_MAX 83 831 832 /* Algorithm type for sadb_x_algdesc above... */ 833 834 #define SADB_X_ALGTYPE_NONE 0 835 #define SADB_X_ALGTYPE_AUTH 1 836 #define SADB_X_ALGTYPE_CRYPT 2 837 #define SADB_X_ALGTYPE_COMPRESS 3 838 839 #define SADB_X_ALGTYPE_MAX 3 840 841 /* Key management protocol for sadb_x_kmc above... */ 842 843 #define SADB_X_KMP_MANUAL 0 /* Cookie is ignored. */ 844 #define SADB_X_KMP_IKE 1 845 #define SADB_X_KMP_KINK 2 846 #define SADB_X_KMP_IKEV2 3 847 848 #define SADB_X_KMP_MAX SADB_X_KMP_IKEV2 849 850 /* 851 * Handy conversion macros. Not part of the PF_KEY spec... 852 */ 853 854 #define SADB_64TO8(x) ((x) << 3) 855 #define SADB_8TO64(x) ((x) >> 3) 856 #define SADB_8TO1(x) ((x) << 3) 857 #define SADB_1TO8(x) ((x) >> 3) 858 859 #ifdef __cplusplus 860 } 861 #endif 862 863 #endif /* _NET_PFKEYV2_H */ 864