1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _NET_PFPOLICY_H 27 #define _NET_PFPOLICY_H 28 29 /* 30 * Definitions and structures for PF_POLICY version 1. 31 * 32 * This local protocol provides an interface allowing utilities to 33 * manage a system's IPsec System Policy Database; see RFC2401 for a 34 * conceptual overview of the SPD. 35 * The basic encoding is modelled on PF_KEY version 2; see pfkeyv2.h 36 * and RFC2367 for more information. 37 */ 38 39 #ifdef __cplusplus 40 extern "C" { 41 #endif 42 43 #define PF_POLICY_V1 1 44 #define PF_POLICY_REVISION 200304L 45 46 /* 47 * Base PF_POLICY message header. Each request/response starts with 48 * one of these, followed by some number of extensions. Each 49 * extension type appears at most once in a message. spd_msg_len 50 * contains the total length of the message including header. 51 */ 52 typedef struct spd_msg 53 { 54 uint8_t spd_msg_version; /* PF_POLICY_V1 */ 55 uint8_t spd_msg_type; /* ADD, DELETE, QUERY, ... */ 56 uint8_t spd_msg_errno; /* Unix errno space; mbz on request */ 57 uint8_t spd_msg_spdid; /* which policy db instance */ 58 uint16_t spd_msg_len; /* in 64-bit words */ 59 uint16_t spd_msg_diagnostic; /* additional error reason */ 60 /* Union is for guaranteeing 64-bit alignment. */ 61 union { 62 struct { 63 uint32_t spd_msg_useq; /* set by sender */ 64 uint32_t spd_msg_upid; /* set by sender */ 65 } spd_msg_actual; 66 uint64_t spd_msg_alignment; 67 } spd_msg_u; 68 #define spd_msg_seq spd_msg_u.spd_msg_actual.spd_msg_useq 69 #define spd_msg_pid spd_msg_u.spd_msg_actual.spd_msg_upid 70 } spd_msg_t; 71 72 /* 73 * Command numbers, found in spd_msg_type. 74 */ 75 #define SPD_RESERVED 0 76 #define SPD_MIN 1 77 #define SPD_FLUSH 1 78 #define SPD_ADDRULE 2 79 #define SPD_DELETERULE 3 80 #define SPD_FLIP 4 81 #define SPD_LOOKUP 5 82 #define SPD_DUMP 6 83 #define SPD_CLONE 7 84 #define SPD_ALGLIST 8 85 #define SPD_DUMPALGS 9 86 #define SPD_UPDATEALGS 10 87 #define SPD_MAX 10 88 89 /* 90 * Well-known policy db instances, found in spd_msg_spdid 91 */ 92 #define SPD_ACTIVE 0 /* The currently active instance */ 93 #define SPD_STANDBY 1 /* "on deck" standby SPD */ 94 95 /* 96 * The spd_msg_t is followed by extensions, which start with the 97 * following header; each extension structure includes the length and 98 * type fields internally as an overlay to simplify parsing and 99 * construction. 100 */ 101 typedef struct spd_ext 102 { 103 /* Union is for guaranteeing 64-bit alignment. */ 104 union { 105 struct { 106 uint16_t spd_ext_ulen; /* in 64-bit words */ 107 uint16_t spd_ext_utype; /* 0 is reserved */ 108 } spd_ext_actual; 109 uint64_t spd_ext_alignment; 110 } spd_ext_u; 111 #define spd_ext_len spd_ext_u.spd_ext_actual.spd_ext_ulen 112 #define spd_ext_type spd_ext_u.spd_ext_actual.spd_ext_utype 113 } spd_ext_t; 114 115 /* 116 * Extension numbers, found in spd_ext_type. 117 */ 118 119 #define SPD_EXT_LCLPORT 1 120 #define SPD_EXT_REMPORT 2 121 #define SPD_EXT_PROTO 3 122 #define SPD_EXT_LCLADDR 4 123 #define SPD_EXT_REMADDR 5 124 125 #define SPD_EXT_ACTION 6 126 #define SPD_EXT_RULE 7 127 #define SPD_EXT_RULESET 8 128 #define SPD_EXT_ICMP_TYPECODE 9 129 130 #define SPD_EXT_TUN_NAME 10 131 132 #define SPD_EXT_MAX 10 133 134 /* 135 * base policy rule (attributes which every rule has) 136 * 137 * spd_rule_index MBZ on a SPD_ADD, and is assigned by the kernel. 138 * subsequent deletes can operate either by specifying selectors or by 139 * specifying a non-zero rule index. 140 */ 141 struct spd_rule 142 { 143 uint16_t spd_rule_len; 144 uint16_t spd_rule_type; /* SPD_EXT_RULE */ 145 uint32_t spd_rule_priority; 146 uint32_t spd_rule_flags; /* INBOUND, OUTBOUND, ... */ 147 uint32_t spd_rule_unused; 148 uint64_t spd_rule_index; /* unique rule identifier. */ 149 }; 150 151 /* 152 * Flags for spd_rule.spd_rule_flags 153 */ 154 #define SPD_RULE_FLAG_INBOUND 0x0001 155 #define SPD_RULE_FLAG_OUTBOUND 0x0002 156 /* Only applies to tunnel policy heads. */ 157 #define SPD_RULE_FLAG_TUNNEL 0x0004 158 159 /* 160 * Address selectors. Different from PF_KEY because we want a 161 * more precise format for wildcards on ports/protocol. 162 */ 163 typedef struct spd_address { 164 /* Union is for guaranteeing 64-bit alignment. */ 165 union { 166 struct { 167 uint16_t spd_address_ulen; 168 uint16_t spd_address_uexttype; /* SRC, DST */ 169 uint8_t spd_address_uaf; /* address family. */ 170 uint8_t spd_address_uprefixlen; /* Prefix len (bits). */ 171 uint16_t spd_address_ureserved2; /* Padding */ 172 } spd_address_actual; 173 uint64_t spd_address_alignment; 174 } spd_address_u; 175 /* 176 * .. followed by 4 bytes of IPv4 or 16 bytes of IPv6 address, 177 * padded up to next uint64_t 178 */ 179 #define spd_address_len \ 180 spd_address_u.spd_address_actual.spd_address_ulen 181 #define spd_address_exttype \ 182 spd_address_u.spd_address_actual.spd_address_uexttype 183 #define spd_address_af \ 184 spd_address_u.spd_address_actual.spd_address_uaf 185 #define spd_address_prefixlen \ 186 spd_address_u.spd_address_actual.spd_address_uprefixlen 187 #define spd_address_reserved2 \ 188 spd_address_u.spd_address_actual.spd_address_ureserved2 189 } spd_address_t; 190 191 /* 192 * Protocol selector 193 */ 194 struct spd_proto 195 { 196 /* Union is for guaranteeing 64-bit alignment. */ 197 union { 198 struct { 199 uint16_t spd_proto_ulen; 200 uint16_t spd_proto_uexttype; /* PROTO */ 201 uint8_t spd_proto_unumber; /* IPPROTO_* */ 202 uint8_t spd_proto_ureserved1; /* pad */ 203 uint16_t spd_proto_ureserved2; /* pad */ 204 } spd_proto_actual; 205 uint64_t spd_proto_alignment; 206 } spd_proto_u; 207 #define spd_proto_len spd_proto_u.spd_proto_actual.spd_proto_ulen 208 #define spd_proto_exttype spd_proto_u.spd_proto_actual.spd_proto_uexttype 209 #define spd_proto_number spd_proto_u.spd_proto_actual.spd_proto_unumber 210 #define spd_proto_reserved1 spd_proto_u.spd_proto_actual.spd_proto_ureserved1 211 #define spd_proto_reserved2 spd_proto_u.spd_proto_actual.spd_proto_ureserved2 212 }; 213 214 /* 215 * Port selector. We only support minport==maxport at present. 216 */ 217 struct spd_portrange 218 { 219 /* Union is for guaranteeing 64-bit alignment. */ 220 union { 221 struct { 222 uint16_t spd_ports_ulen; 223 uint16_t spd_ports_uexttype; /* LCLPORT, REMPORT */ 224 uint16_t spd_ports_uminport; /* min port */ 225 uint16_t spd_ports_umaxport; /* max port */ 226 } spd_ports_actual; 227 uint64_t spd_ports_alignment; 228 } spd_ports_u; 229 #define spd_ports_len spd_ports_u.spd_ports_actual.spd_ports_ulen 230 #define spd_ports_exttype spd_ports_u.spd_ports_actual.spd_ports_uexttype 231 #define spd_ports_minport spd_ports_u.spd_ports_actual.spd_ports_uminport 232 #define spd_ports_maxport spd_ports_u.spd_ports_actual.spd_ports_umaxport 233 }; 234 235 /* 236 * ICMP type selector. 237 */ 238 struct spd_typecode 239 { 240 /* Union is for guaranteeing 64-bit alignment. */ 241 union { 242 struct { 243 uint16_t spd_typecode_ulen; 244 uint16_t spd_typecode_uexttype; /* ICMP_TYPECODE */ 245 uint8_t spd_typecode_utype; 246 uint8_t spd_typecode_utype_end; 247 uint8_t spd_typecode_ucode; 248 uint8_t spd_typecode_ucode_end; 249 } spd_typecode_actual; 250 uint64_t spd_typecode_alignment; 251 } spd_typecode_u; 252 #define spd_typecode_len \ 253 spd_typecode_u.spd_typecode_actual.spd_typecode_ulen 254 #define spd_typecode_exttype \ 255 spd_typecode_u.spd_typecode_actual.spd_typecode_uexttype 256 #define spd_typecode_type \ 257 spd_typecode_u.spd_typecode_actual.spd_typecode_utype 258 #define spd_typecode_type_end \ 259 spd_typecode_u.spd_typecode_actual.spd_typecode_utype_end 260 #define spd_typecode_code \ 261 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode 262 #define spd_typecode_code_end \ 263 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode_end 264 }; 265 266 267 /* 268 * Actions, specifying what happens to packets which match selectors. 269 * This extension is followed by some number of spd_attribute tag-value pairs 270 * which encode one or more alternative policies; see below for 271 * the encoding used. 272 */ 273 struct spd_ext_actions 274 { 275 /* Union is for guaranteeing 64-bit alignment. */ 276 union { 277 struct { 278 uint16_t spd_actions_ulen; 279 uint16_t spd_actions_uexttype; /* ACTION */ 280 uint16_t spd_actions_ucount; /* # of alternatives */ 281 uint16_t spd_actions_ureserved; 282 } spd_actions_actual; 283 uint64_t spd_actions_alignment; 284 } spd_actions_u; 285 #define spd_actions_len \ 286 spd_actions_u.spd_actions_actual.spd_actions_ulen 287 #define spd_actions_exttype \ 288 spd_actions_u.spd_actions_actual.spd_actions_uexttype 289 #define spd_actions_count \ 290 spd_actions_u.spd_actions_actual.spd_actions_ucount 291 #define spd_actions_reserved \ 292 spd_actions_u.spd_actions_actual.spd_actions_ureserved 293 }; 294 295 /* 296 * Extensible encoding for requested SA attributes. 297 * To allow additional attributes to be added, we use a simple-to-interpret 298 * (tag, value) encoding to fill in attributes in a list of alternatives. 299 * 300 * We fill in alternatives one at a time, starting with most-preferred, 301 * proceeding to least-preferred. 302 * 303 * Conceptually, we are filling in attributes of a "template", and 304 * then copying that template value into the list of alternatives when 305 * we see a SPD_ATTR_END or SPD_ATTR_NEXT. 306 * 307 * The template is not changed by SPD_ATTR_NEXT, so that attributes common to 308 * all alternatives need only be mentioned once. 309 * 310 * spd_actions_count is the maximum number of alternatives present; it 311 * should be one greater than the number of SPD_ATTR_NEXT opcodes 312 * present in the sequence. 313 */ 314 315 struct spd_attribute 316 { 317 union { 318 struct { 319 uint32_t spd_attr_utag; 320 uint32_t spd_attr_uvalue; 321 } spd_attribute_actual; 322 uint64_t spd_attribute_alignment; 323 } spd_attribute_u; 324 #define spd_attr_tag spd_attribute_u.spd_attribute_actual.spd_attr_utag 325 #define spd_attr_value spd_attribute_u.spd_attribute_actual.spd_attr_uvalue 326 }; 327 328 /* 329 * These flags are used by the kernel algorithm structures and by ipsecalgs(8). 330 * ALG_FLAG_KERNELCHECKED is used by ipsecalgs(8) to tag ipsecalgent_t as 331 * kernel verified. ALG_FLAG_VALID is only meaningful if set by the kernel. 332 */ 333 #define ALG_FLAG_VALID 0x01 334 #define ALG_FLAG_COUNTERMODE 0x02 335 #define ALG_FLAG_COMBINED 0x04 336 #define ALG_FLAG_CCM 0x08 337 #define ALG_FLAG_GCM 0x10 338 #define ALG_FLAG_KERNELCHECKED 0x80000000 339 340 #define SPD_ATTR_NOP 0x00000000 /* space filler */ 341 #define SPD_ATTR_END 0x00000001 /* end of description */ 342 #define SPD_ATTR_EMPTY 0x00000002 /* reset template to default */ 343 #define SPD_ATTR_NEXT 0x00000003 /* start filling next alternative */ 344 345 #define SPD_ATTR_TYPE 0x00000100 346 #define SPD_ATTR_FLAGS 0x00000101 347 #define SPD_ATTR_AH_AUTH 0x00000102 348 #define SPD_ATTR_ESP_ENCR 0x00000103 349 #define SPD_ATTR_ESP_AUTH 0x00000104 350 #define SPD_ATTR_ENCR_MINBITS 0x00000105 351 #define SPD_ATTR_ENCR_MAXBITS 0x00000106 352 #define SPD_ATTR_AH_MINBITS 0x00000107 353 #define SPD_ATTR_AH_MAXBITS 0x00000108 354 #define SPD_ATTR_LIFE_SOFT_TIME 0x00000109 355 #define SPD_ATTR_LIFE_HARD_TIME 0x0000010a 356 #define SPD_ATTR_LIFE_SOFT_BYTES 0x0000010b 357 #define SPD_ATTR_LIFE_HARD_BYTES 0x0000010c 358 #define SPD_ATTR_KM_PROTO 0x0000010d 359 #define SPD_ATTR_KM_COOKIE 0x0000010e 360 #define SPD_ATTR_REPLAY_DEPTH 0x0000010f 361 #define SPD_ATTR_ESPA_MINBITS 0x00000110 362 #define SPD_ATTR_ESPA_MAXBITS 0x00000111 363 #define SPD_ATTR_ENCR_DEFBITS 0x00000112 364 #define SPD_ATTR_ENCR_INCRBITS 0x00000113 365 #define SPD_ATTR_AH_DEFBITS 0x00000114 366 #define SPD_ATTR_AH_INCRBITS 0x00000115 367 #define SPD_ATTR_ESPA_DEFBITS 0x00000116 368 #define SPD_ATTR_ESPA_INCRBITS 0x00000117 369 #define SPD_ATTR_ALG_ID 0x00000118 370 #define SPD_ATTR_ALG_PROTO 0x00000119 371 #define SPD_ATTR_ALG_INCRBITS 0x0000011a 372 #define SPD_ATTR_ALG_NKEYSIZES 0x0000011b 373 #define SPD_ATTR_ALG_KEYSIZE 0x0000011c 374 #define SPD_ATTR_ALG_NBLOCKSIZES 0x0000011d 375 #define SPD_ATTR_ALG_BLOCKSIZE 0x0000011e 376 #define SPD_ATTR_ALG_MECHNAME 0x0000011f 377 #define SPD_ATTR_PROTO_ID 0x00000120 378 #define SPD_ATTR_PROTO_EXEC_MODE 0x00000121 379 #define SPD_ATTR_ALG_NPARAMS 0x00000122 380 #define SPD_ATTR_ALG_PARAMS 0x00000123 381 #define SPD_ATTR_ALG_FLAGS 0x00000124 382 383 /* 384 * An interface extension identifies a network interface. 385 * It is used for configuring Tunnel Mode policies on a tunnelling 386 * interface for now. 387 */ 388 typedef struct spd_if_s { 389 union { 390 struct { 391 uint16_t spd_if_ulen; 392 uint16_t spd_if_uexttype; 393 union { 394 uint8_t spd_if_iuname[4]; 395 uint32_t spd_if_iuindex; 396 } spd_if_iu; 397 } spd_if_actual; 398 uint64_t spd_if_alignment; 399 } spd_if_u; 400 #define spd_if_len spd_if_u.spd_if_actual.spd_if_ulen 401 #define spd_if_exttype spd_if_u.spd_if_actual.spd_if_uexttype 402 #define spd_if_name spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuname 403 #define spd_if_index spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuindex 404 } spd_if_t; 405 406 /* 407 * Minimum, maximum key lengths in bits. 408 */ 409 #define SPD_MIN_MINBITS 0x0000 410 #define SPD_MAX_MAXBITS 0xffff 411 412 /* 413 * IPsec action types (in SPD_ATTR_TYPE attribute) 414 */ 415 #define SPD_ACTTYPE_DROP 0x0001 416 #define SPD_ACTTYPE_PASS 0x0002 417 #define SPD_ACTTYPE_IPSEC 0x0003 418 419 /* 420 * Action flags (in SPD_ATTR_FLAGS attribute) 421 */ 422 #define SPD_APPLY_AH 0x0001 423 #define SPD_APPLY_ESP 0x0002 424 #define SPD_APPLY_SE 0x0004 /* self-encapsulation */ 425 #define SPD_APPLY_COMP 0x0008 /* compression; NYI */ 426 #define SPD_APPLY_UNIQUE 0x0010 /* unique per-flow SA */ 427 #define SPD_APPLY_BYPASS 0x0020 /* bypass policy */ 428 #define SPD_APPLY_ESPA 0x0040 /* ESP authentication */ 429 430 /* 431 * SW crypto execution modes. 432 */ 433 #define SPD_ALG_EXEC_MODE_SYNC 1 /* synchronous */ 434 #define SPD_ALG_EXEC_MODE_ASYNC 2 /* asynchronous */ 435 436 /* 437 * SPD_DUMP protocol: 438 * 439 * We do not want to force an stack to have to read-lock the entire 440 * SPD for the duration of the dump, but we want management apps to be 441 * able to get a consistent snapshot of the SPD. 442 * 443 * Therefore, we make optimistic locking assumptions. 444 * 445 * The response to a SPD_DUMP request consists of multiple spd_msg 446 * records, all with spd_msg_type == SPD_DUMP and spd_msg_{seq,pid} 447 * matching the request. 448 * 449 * There is one header, then a sequence of policy rule records (one 450 * rule per record), then a trailer. 451 * 452 * The header and trailer both contain a single SPD_EXT_RULESET 453 * containing a version number and rule count. The dump was "good" if 454 * header version == trailer version, and the number of rules read by 455 * the application matches the rule count in the trailer. The rule 456 * count in the header is unused and should be set to zero. 457 * 458 * In between, each rule record contains a set of extensions which, if 459 * used in an SPD_ADD request, would recreate an equivalent rule. 460 * 461 * If rules were added to the SPD during the dump, the dump may be 462 * truncated or otherwise incomplete; the management application 463 * should re-try the dump in this case. 464 */ 465 466 /* 467 * Ruleset extension, used at the start and end of a SPD_DUMP. 468 */ 469 typedef struct spd_ruleset_ext 470 { 471 uint16_t spd_ruleset_len; /* 2 x 64 bits */ 472 uint16_t spd_ruleset_type; /* SPD_EXT_RULESET */ 473 uint32_t spd_ruleset_count; /* only valid in trailer */ 474 uint64_t spd_ruleset_version; /* version number */ 475 } spd_ruleset_ext_t; 476 477 /* 478 * Diagnostic codes. These supplement error messages. Be sure to 479 * update libipsecutil's spdsock_diag() if you change any of these. 480 */ 481 #define SPD_DIAGNOSTIC_NONE 0 482 #define SPD_DIAGNOSTIC_UNKNOWN_EXT 1 483 #define SPD_DIAGNOSTIC_BAD_EXTLEN 2 484 #define SPD_DIAGNOSTIC_NO_RULE_EXT 3 485 #define SPD_DIAGNOSTIC_BAD_ADDR_LEN 4 486 #define SPD_DIAGNOSTIC_MIXED_AF 5 487 #define SPD_DIAGNOSTIC_ADD_NO_MEM 6 488 #define SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT 7 489 #define SPD_DIAGNOSTIC_ADD_BAD_TYPE 8 490 #define SPD_DIAGNOSTIC_ADD_BAD_FLAGS 9 491 #define SPD_DIAGNOSTIC_ADD_INCON_FLAGS 10 492 #define SPD_DIAGNOSTIC_MALFORMED_LCLPORT 11 493 #define SPD_DIAGNOSTIC_DUPLICATE_LCLPORT 12 494 #define SPD_DIAGNOSTIC_MALFORMED_REMPORT 13 495 #define SPD_DIAGNOSTIC_DUPLICATE_REMPORT 14 496 #define SPD_DIAGNOSTIC_MALFORMED_PROTO 15 497 #define SPD_DIAGNOSTIC_DUPLICATE_PROTO 16 498 #define SPD_DIAGNOSTIC_MALFORMED_LCLADDR 17 499 #define SPD_DIAGNOSTIC_DUPLICATE_LCLADDR 18 500 #define SPD_DIAGNOSTIC_MALFORMED_REMADDR 19 501 #define SPD_DIAGNOSTIC_DUPLICATE_REMADDR 20 502 #define SPD_DIAGNOSTIC_MALFORMED_ACTION 21 503 #define SPD_DIAGNOSTIC_DUPLICATE_ACTION 22 504 #define SPD_DIAGNOSTIC_MALFORMED_RULE 23 505 #define SPD_DIAGNOSTIC_DUPLICATE_RULE 24 506 #define SPD_DIAGNOSTIC_MALFORMED_RULESET 25 507 #define SPD_DIAGNOSTIC_DUPLICATE_RULESET 26 508 #define SPD_DIAGNOSTIC_INVALID_RULE_INDEX 27 509 #define SPD_DIAGNOSTIC_BAD_SPDID 28 510 #define SPD_DIAGNOSTIC_BAD_MSG_TYPE 29 511 #define SPD_DIAGNOSTIC_UNSUPP_AH_ALG 30 512 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG 31 513 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG 32 514 #define SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE 33 515 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE 34 516 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE 35 517 #define SPD_DIAGNOSTIC_NO_ACTION_EXT 36 518 #define SPD_DIAGNOSTIC_ALG_ID_RANGE 37 519 #define SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES 38 520 #define SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES 39 521 #define SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN 40 522 #define SPD_DIAGNOSTIC_ALG_IPSEC_NOT_LOADED 41 523 #define SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE 42 524 #define SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE 43 525 #define SPD_DIAGNOSTIC_NOT_GLOBAL_OP 44 526 #define SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS 45 527 528 /* 529 * Helper macros. 530 */ 531 #define SPD_64TO8(x) ((x) << 3) 532 #define SPD_8TO64(x) ((x) >> 3) 533 #define SPD_8TO1(x) ((x) << 3) 534 #define SPD_1TO8(x) ((x) >> 3) 535 536 #ifdef __cplusplus 537 } 538 #endif 539 540 #endif /* _NET_PFPOLICY_H */ 541