16f52b16cSGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2607ca46eSDavid Howells #ifndef _LINUX_XFRM_H 3607ca46eSDavid Howells #define _LINUX_XFRM_H 4607ca46eSDavid Howells 515e318bdSJiri Benc #include <linux/in6.h> 6607ca46eSDavid Howells #include <linux/types.h> 7*1d495f1cSKees Cook #include <linux/stddef.h> 8607ca46eSDavid Howells 9607ca46eSDavid Howells /* All of the structures in this file may not change size as they are 10607ca46eSDavid Howells * passed into the kernel from userspace via netlink sockets. 11607ca46eSDavid Howells */ 12607ca46eSDavid Howells 13607ca46eSDavid Howells /* Structure to encapsulate addresses. I do not want to use 14607ca46eSDavid Howells * "standard" structure. My apologies. 15607ca46eSDavid Howells */ 16607ca46eSDavid Howells typedef union { 17607ca46eSDavid Howells __be32 a4; 18607ca46eSDavid Howells __be32 a6[4]; 1915e318bdSJiri Benc struct in6_addr in6; 20607ca46eSDavid Howells } xfrm_address_t; 21607ca46eSDavid Howells 22607ca46eSDavid Howells /* Ident of a specific xfrm_state. It is used on input to lookup 23607ca46eSDavid Howells * the state by (spi,daddr,ah/esp) or to store information about 24607ca46eSDavid Howells * spi, protocol and tunnel address on output. 25607ca46eSDavid Howells */ 26607ca46eSDavid Howells struct xfrm_id { 27607ca46eSDavid Howells xfrm_address_t daddr; 28607ca46eSDavid Howells __be32 spi; 29607ca46eSDavid Howells __u8 proto; 30607ca46eSDavid Howells }; 31607ca46eSDavid Howells 32607ca46eSDavid Howells struct xfrm_sec_ctx { 33607ca46eSDavid Howells __u8 ctx_doi; 34607ca46eSDavid Howells __u8 ctx_alg; 35607ca46eSDavid Howells __u16 ctx_len; 36607ca46eSDavid Howells __u32 ctx_sid; 37*1d495f1cSKees Cook char ctx_str[] __counted_by(ctx_len); 38607ca46eSDavid Howells }; 39607ca46eSDavid Howells 40607ca46eSDavid Howells /* Security Context Domains of Interpretation */ 41607ca46eSDavid Howells #define XFRM_SC_DOI_RESERVED 0 42607ca46eSDavid Howells #define XFRM_SC_DOI_LSM 1 43607ca46eSDavid Howells 44607ca46eSDavid Howells /* Security Context Algorithms */ 45607ca46eSDavid Howells #define XFRM_SC_ALG_RESERVED 0 46607ca46eSDavid Howells #define XFRM_SC_ALG_SELINUX 1 47607ca46eSDavid Howells 48607ca46eSDavid Howells /* Selector, used as selector both on policy rules (SPD) and SAs. */ 49607ca46eSDavid Howells 50607ca46eSDavid Howells struct xfrm_selector { 51607ca46eSDavid Howells xfrm_address_t daddr; 52607ca46eSDavid Howells xfrm_address_t saddr; 53607ca46eSDavid Howells __be16 dport; 54607ca46eSDavid Howells __be16 dport_mask; 55607ca46eSDavid Howells __be16 sport; 56607ca46eSDavid Howells __be16 sport_mask; 57607ca46eSDavid Howells __u16 family; 58607ca46eSDavid Howells __u8 prefixlen_d; 59607ca46eSDavid Howells __u8 prefixlen_s; 60607ca46eSDavid Howells __u8 proto; 61607ca46eSDavid Howells int ifindex; 62607ca46eSDavid Howells __kernel_uid32_t user; 63607ca46eSDavid Howells }; 64607ca46eSDavid Howells 65607ca46eSDavid Howells #define XFRM_INF (~(__u64)0) 66607ca46eSDavid Howells 67607ca46eSDavid Howells struct xfrm_lifetime_cfg { 68607ca46eSDavid Howells __u64 soft_byte_limit; 69607ca46eSDavid Howells __u64 hard_byte_limit; 70607ca46eSDavid Howells __u64 soft_packet_limit; 71607ca46eSDavid Howells __u64 hard_packet_limit; 72607ca46eSDavid Howells __u64 soft_add_expires_seconds; 73607ca46eSDavid Howells __u64 hard_add_expires_seconds; 74607ca46eSDavid Howells __u64 soft_use_expires_seconds; 75607ca46eSDavid Howells __u64 hard_use_expires_seconds; 76607ca46eSDavid Howells }; 77607ca46eSDavid Howells 78607ca46eSDavid Howells struct xfrm_lifetime_cur { 79607ca46eSDavid Howells __u64 bytes; 80607ca46eSDavid Howells __u64 packets; 81607ca46eSDavid Howells __u64 add_time; 82607ca46eSDavid Howells __u64 use_time; 83607ca46eSDavid Howells }; 84607ca46eSDavid Howells 85607ca46eSDavid Howells struct xfrm_replay_state { 86607ca46eSDavid Howells __u32 oseq; 87607ca46eSDavid Howells __u32 seq; 88607ca46eSDavid Howells __u32 bitmap; 89607ca46eSDavid Howells }; 90607ca46eSDavid Howells 91607ca46eSDavid Howells #define XFRMA_REPLAY_ESN_MAX 4096 92607ca46eSDavid Howells 93607ca46eSDavid Howells struct xfrm_replay_state_esn { 94607ca46eSDavid Howells unsigned int bmp_len; 95607ca46eSDavid Howells __u32 oseq; 96607ca46eSDavid Howells __u32 seq; 97607ca46eSDavid Howells __u32 oseq_hi; 98607ca46eSDavid Howells __u32 seq_hi; 99607ca46eSDavid Howells __u32 replay_window; 10094dfc73eSGustavo A. R. Silva __u32 bmp[]; 101607ca46eSDavid Howells }; 102607ca46eSDavid Howells 103607ca46eSDavid Howells struct xfrm_algo { 104607ca46eSDavid Howells char alg_name[64]; 105607ca46eSDavid Howells unsigned int alg_key_len; /* in bits */ 10694dfc73eSGustavo A. R. Silva char alg_key[]; 107607ca46eSDavid Howells }; 108607ca46eSDavid Howells 109607ca46eSDavid Howells struct xfrm_algo_auth { 110607ca46eSDavid Howells char alg_name[64]; 111607ca46eSDavid Howells unsigned int alg_key_len; /* in bits */ 112607ca46eSDavid Howells unsigned int alg_trunc_len; /* in bits */ 11394dfc73eSGustavo A. R. Silva char alg_key[]; 114607ca46eSDavid Howells }; 115607ca46eSDavid Howells 116607ca46eSDavid Howells struct xfrm_algo_aead { 117607ca46eSDavid Howells char alg_name[64]; 118607ca46eSDavid Howells unsigned int alg_key_len; /* in bits */ 119607ca46eSDavid Howells unsigned int alg_icv_len; /* in bits */ 12094dfc73eSGustavo A. R. Silva char alg_key[]; 121607ca46eSDavid Howells }; 122607ca46eSDavid Howells 123607ca46eSDavid Howells struct xfrm_stats { 124607ca46eSDavid Howells __u32 replay_window; 125607ca46eSDavid Howells __u32 replay; 126607ca46eSDavid Howells __u32 integrity_failed; 127607ca46eSDavid Howells }; 128607ca46eSDavid Howells 129607ca46eSDavid Howells enum { 130607ca46eSDavid Howells XFRM_POLICY_TYPE_MAIN = 0, 131607ca46eSDavid Howells XFRM_POLICY_TYPE_SUB = 1, 132607ca46eSDavid Howells XFRM_POLICY_TYPE_MAX = 2, 133607ca46eSDavid Howells XFRM_POLICY_TYPE_ANY = 255 134607ca46eSDavid Howells }; 135607ca46eSDavid Howells 136607ca46eSDavid Howells enum { 137607ca46eSDavid Howells XFRM_POLICY_IN = 0, 138607ca46eSDavid Howells XFRM_POLICY_OUT = 1, 139607ca46eSDavid Howells XFRM_POLICY_FWD = 2, 140607ca46eSDavid Howells XFRM_POLICY_MASK = 3, 141607ca46eSDavid Howells XFRM_POLICY_MAX = 3 142607ca46eSDavid Howells }; 143607ca46eSDavid Howells 144607ca46eSDavid Howells enum { 145607ca46eSDavid Howells XFRM_SHARE_ANY, /* No limitations */ 146607ca46eSDavid Howells XFRM_SHARE_SESSION, /* For this session only */ 147607ca46eSDavid Howells XFRM_SHARE_USER, /* For this user only */ 148607ca46eSDavid Howells XFRM_SHARE_UNIQUE /* Use once */ 149607ca46eSDavid Howells }; 150607ca46eSDavid Howells 151607ca46eSDavid Howells #define XFRM_MODE_TRANSPORT 0 152607ca46eSDavid Howells #define XFRM_MODE_TUNNEL 1 153607ca46eSDavid Howells #define XFRM_MODE_ROUTEOPTIMIZATION 2 154607ca46eSDavid Howells #define XFRM_MODE_IN_TRIGGER 3 155607ca46eSDavid Howells #define XFRM_MODE_BEET 4 156607ca46eSDavid Howells #define XFRM_MODE_MAX 5 157607ca46eSDavid Howells 158607ca46eSDavid Howells /* Netlink configuration messages. */ 159607ca46eSDavid Howells enum { 160607ca46eSDavid Howells XFRM_MSG_BASE = 0x10, 161607ca46eSDavid Howells 162607ca46eSDavid Howells XFRM_MSG_NEWSA = 0x10, 163607ca46eSDavid Howells #define XFRM_MSG_NEWSA XFRM_MSG_NEWSA 164607ca46eSDavid Howells XFRM_MSG_DELSA, 165607ca46eSDavid Howells #define XFRM_MSG_DELSA XFRM_MSG_DELSA 166607ca46eSDavid Howells XFRM_MSG_GETSA, 167607ca46eSDavid Howells #define XFRM_MSG_GETSA XFRM_MSG_GETSA 168607ca46eSDavid Howells 169607ca46eSDavid Howells XFRM_MSG_NEWPOLICY, 170607ca46eSDavid Howells #define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY 171607ca46eSDavid Howells XFRM_MSG_DELPOLICY, 172607ca46eSDavid Howells #define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY 173607ca46eSDavid Howells XFRM_MSG_GETPOLICY, 174607ca46eSDavid Howells #define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY 175607ca46eSDavid Howells 176607ca46eSDavid Howells XFRM_MSG_ALLOCSPI, 177607ca46eSDavid Howells #define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI 178607ca46eSDavid Howells XFRM_MSG_ACQUIRE, 179607ca46eSDavid Howells #define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE 180607ca46eSDavid Howells XFRM_MSG_EXPIRE, 181607ca46eSDavid Howells #define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE 182607ca46eSDavid Howells 183607ca46eSDavid Howells XFRM_MSG_UPDPOLICY, 184607ca46eSDavid Howells #define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY 185607ca46eSDavid Howells XFRM_MSG_UPDSA, 186607ca46eSDavid Howells #define XFRM_MSG_UPDSA XFRM_MSG_UPDSA 187607ca46eSDavid Howells 188607ca46eSDavid Howells XFRM_MSG_POLEXPIRE, 189607ca46eSDavid Howells #define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE 190607ca46eSDavid Howells 191607ca46eSDavid Howells XFRM_MSG_FLUSHSA, 192607ca46eSDavid Howells #define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA 193607ca46eSDavid Howells XFRM_MSG_FLUSHPOLICY, 194607ca46eSDavid Howells #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY 195607ca46eSDavid Howells 196607ca46eSDavid Howells XFRM_MSG_NEWAE, 197607ca46eSDavid Howells #define XFRM_MSG_NEWAE XFRM_MSG_NEWAE 198607ca46eSDavid Howells XFRM_MSG_GETAE, 199607ca46eSDavid Howells #define XFRM_MSG_GETAE XFRM_MSG_GETAE 200607ca46eSDavid Howells 201607ca46eSDavid Howells XFRM_MSG_REPORT, 202607ca46eSDavid Howells #define XFRM_MSG_REPORT XFRM_MSG_REPORT 203607ca46eSDavid Howells 204607ca46eSDavid Howells XFRM_MSG_MIGRATE, 205607ca46eSDavid Howells #define XFRM_MSG_MIGRATE XFRM_MSG_MIGRATE 206607ca46eSDavid Howells 207607ca46eSDavid Howells XFRM_MSG_NEWSADINFO, 208607ca46eSDavid Howells #define XFRM_MSG_NEWSADINFO XFRM_MSG_NEWSADINFO 209607ca46eSDavid Howells XFRM_MSG_GETSADINFO, 210607ca46eSDavid Howells #define XFRM_MSG_GETSADINFO XFRM_MSG_GETSADINFO 211607ca46eSDavid Howells 212607ca46eSDavid Howells XFRM_MSG_NEWSPDINFO, 213607ca46eSDavid Howells #define XFRM_MSG_NEWSPDINFO XFRM_MSG_NEWSPDINFO 214607ca46eSDavid Howells XFRM_MSG_GETSPDINFO, 215607ca46eSDavid Howells #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO 216607ca46eSDavid Howells 217844f7eaaSEugene Syromiatnikov XFRM_MSG_MAPPING, 218844f7eaaSEugene Syromiatnikov #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING 219844f7eaaSEugene Syromiatnikov 2202d151d39SSteffen Klassert XFRM_MSG_SETDEFAULT, 2212d151d39SSteffen Klassert #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT 2222d151d39SSteffen Klassert XFRM_MSG_GETDEFAULT, 2232d151d39SSteffen Klassert #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT 224607ca46eSDavid Howells __XFRM_MSG_MAX 225607ca46eSDavid Howells }; 226607ca46eSDavid Howells #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1) 227607ca46eSDavid Howells 228607ca46eSDavid Howells #define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE) 229607ca46eSDavid Howells 230607ca46eSDavid Howells /* 231607ca46eSDavid Howells * Generic LSM security context for comunicating to user space 232607ca46eSDavid Howells * NOTE: Same format as sadb_x_sec_ctx 233607ca46eSDavid Howells */ 234607ca46eSDavid Howells struct xfrm_user_sec_ctx { 235607ca46eSDavid Howells __u16 len; 236607ca46eSDavid Howells __u16 exttype; 237607ca46eSDavid Howells __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */ 238607ca46eSDavid Howells __u8 ctx_doi; 239607ca46eSDavid Howells __u16 ctx_len; 240607ca46eSDavid Howells }; 241607ca46eSDavid Howells 242607ca46eSDavid Howells struct xfrm_user_tmpl { 243607ca46eSDavid Howells struct xfrm_id id; 244607ca46eSDavid Howells __u16 family; 245607ca46eSDavid Howells xfrm_address_t saddr; 246607ca46eSDavid Howells __u32 reqid; 247607ca46eSDavid Howells __u8 mode; 248607ca46eSDavid Howells __u8 share; 249607ca46eSDavid Howells __u8 optional; 250607ca46eSDavid Howells __u32 aalgos; 251607ca46eSDavid Howells __u32 ealgos; 252607ca46eSDavid Howells __u32 calgos; 253607ca46eSDavid Howells }; 254607ca46eSDavid Howells 255607ca46eSDavid Howells struct xfrm_encap_tmpl { 256607ca46eSDavid Howells __u16 encap_type; 257607ca46eSDavid Howells __be16 encap_sport; 258607ca46eSDavid Howells __be16 encap_dport; 259607ca46eSDavid Howells xfrm_address_t encap_oa; 260607ca46eSDavid Howells }; 261607ca46eSDavid Howells 262607ca46eSDavid Howells /* AEVENT flags */ 263607ca46eSDavid Howells enum xfrm_ae_ftype_t { 264607ca46eSDavid Howells XFRM_AE_UNSPEC, 265607ca46eSDavid Howells XFRM_AE_RTHR=1, /* replay threshold*/ 266607ca46eSDavid Howells XFRM_AE_RVAL=2, /* replay value */ 267607ca46eSDavid Howells XFRM_AE_LVAL=4, /* lifetime value */ 268607ca46eSDavid Howells XFRM_AE_ETHR=8, /* expiry timer threshold */ 269607ca46eSDavid Howells XFRM_AE_CR=16, /* Event cause is replay update */ 270607ca46eSDavid Howells XFRM_AE_CE=32, /* Event cause is timer expiry */ 271607ca46eSDavid Howells XFRM_AE_CU=64, /* Event cause is policy update */ 272607ca46eSDavid Howells __XFRM_AE_MAX 273607ca46eSDavid Howells 274607ca46eSDavid Howells #define XFRM_AE_MAX (__XFRM_AE_MAX - 1) 275607ca46eSDavid Howells }; 276607ca46eSDavid Howells 277607ca46eSDavid Howells struct xfrm_userpolicy_type { 278607ca46eSDavid Howells __u8 type; 279607ca46eSDavid Howells __u16 reserved1; 280607ca46eSDavid Howells __u8 reserved2; 281607ca46eSDavid Howells }; 282607ca46eSDavid Howells 283607ca46eSDavid Howells /* Netlink message attributes. */ 284607ca46eSDavid Howells enum xfrm_attr_type_t { 285607ca46eSDavid Howells XFRMA_UNSPEC, 286607ca46eSDavid Howells XFRMA_ALG_AUTH, /* struct xfrm_algo */ 287607ca46eSDavid Howells XFRMA_ALG_CRYPT, /* struct xfrm_algo */ 288607ca46eSDavid Howells XFRMA_ALG_COMP, /* struct xfrm_algo */ 289607ca46eSDavid Howells XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */ 290607ca46eSDavid Howells XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */ 291607ca46eSDavid Howells XFRMA_SA, /* struct xfrm_usersa_info */ 292607ca46eSDavid Howells XFRMA_POLICY, /*struct xfrm_userpolicy_info */ 293607ca46eSDavid Howells XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */ 294607ca46eSDavid Howells XFRMA_LTIME_VAL, 295607ca46eSDavid Howells XFRMA_REPLAY_VAL, 296607ca46eSDavid Howells XFRMA_REPLAY_THRESH, 297607ca46eSDavid Howells XFRMA_ETIMER_THRESH, 298607ca46eSDavid Howells XFRMA_SRCADDR, /* xfrm_address_t */ 299607ca46eSDavid Howells XFRMA_COADDR, /* xfrm_address_t */ 30036d76350SAntony Antony XFRMA_LASTUSED, /* __u64 */ 301607ca46eSDavid Howells XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */ 302607ca46eSDavid Howells XFRMA_MIGRATE, 303607ca46eSDavid Howells XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */ 304607ca46eSDavid Howells XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */ 305607ca46eSDavid Howells XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */ 306607ca46eSDavid Howells XFRMA_MARK, /* struct xfrm_mark */ 307607ca46eSDavid Howells XFRMA_TFCPAD, /* __u32 */ 30834a3d4b2SRichard Guy Briggs XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_state_esn */ 309a947b0a9SNicolas Dichtel XFRMA_SA_EXTRA_FLAGS, /* __u32 */ 310d3623099SNicolas Dichtel XFRMA_PROTO, /* __u8 */ 311870a2df4SNicolas Dichtel XFRMA_ADDRESS_FILTER, /* struct xfrm_address_filter */ 312de95c4a4SNicolas Dichtel XFRMA_PAD, 31329e42766SAntony Antony XFRMA_OFFLOAD_DEV, /* struct xfrm_user_offload */ 3149b42c1f1SSteffen Klassert XFRMA_SET_MARK, /* __u32 */ 3159b42c1f1SSteffen Klassert XFRMA_SET_MARK_MASK, /* __u32 */ 3167e652640SSteffen Klassert XFRMA_IF_ID, /* __u32 */ 3174e484b3eSAntony Antony XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */ 318607ca46eSDavid Howells __XFRMA_MAX 319607ca46eSDavid Howells 3209b42c1f1SSteffen Klassert #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */ 321607ca46eSDavid Howells #define XFRMA_MAX (__XFRMA_MAX - 1) 322607ca46eSDavid Howells }; 323607ca46eSDavid Howells 324607ca46eSDavid Howells struct xfrm_mark { 325607ca46eSDavid Howells __u32 v; /* value */ 326607ca46eSDavid Howells __u32 m; /* mask */ 327607ca46eSDavid Howells }; 328607ca46eSDavid Howells 329607ca46eSDavid Howells enum xfrm_sadattr_type_t { 330607ca46eSDavid Howells XFRMA_SAD_UNSPEC, 331607ca46eSDavid Howells XFRMA_SAD_CNT, 332607ca46eSDavid Howells XFRMA_SAD_HINFO, 333607ca46eSDavid Howells __XFRMA_SAD_MAX 334607ca46eSDavid Howells 335607ca46eSDavid Howells #define XFRMA_SAD_MAX (__XFRMA_SAD_MAX - 1) 336607ca46eSDavid Howells }; 337607ca46eSDavid Howells 338607ca46eSDavid Howells struct xfrmu_sadhinfo { 339607ca46eSDavid Howells __u32 sadhcnt; /* current hash bkts */ 340607ca46eSDavid Howells __u32 sadhmcnt; /* max allowed hash bkts */ 341607ca46eSDavid Howells }; 342607ca46eSDavid Howells 343607ca46eSDavid Howells enum xfrm_spdattr_type_t { 344607ca46eSDavid Howells XFRMA_SPD_UNSPEC, 345607ca46eSDavid Howells XFRMA_SPD_INFO, 346607ca46eSDavid Howells XFRMA_SPD_HINFO, 347880a6fabSChristophe Gouault XFRMA_SPD_IPV4_HTHRESH, 348880a6fabSChristophe Gouault XFRMA_SPD_IPV6_HTHRESH, 349607ca46eSDavid Howells __XFRMA_SPD_MAX 350607ca46eSDavid Howells 351607ca46eSDavid Howells #define XFRMA_SPD_MAX (__XFRMA_SPD_MAX - 1) 352607ca46eSDavid Howells }; 353607ca46eSDavid Howells 354607ca46eSDavid Howells struct xfrmu_spdinfo { 355607ca46eSDavid Howells __u32 incnt; 356607ca46eSDavid Howells __u32 outcnt; 357607ca46eSDavid Howells __u32 fwdcnt; 358607ca46eSDavid Howells __u32 inscnt; 359607ca46eSDavid Howells __u32 outscnt; 360607ca46eSDavid Howells __u32 fwdscnt; 361607ca46eSDavid Howells }; 362607ca46eSDavid Howells 363607ca46eSDavid Howells struct xfrmu_spdhinfo { 364607ca46eSDavid Howells __u32 spdhcnt; 365607ca46eSDavid Howells __u32 spdhmcnt; 366607ca46eSDavid Howells }; 367607ca46eSDavid Howells 368880a6fabSChristophe Gouault struct xfrmu_spdhthresh { 369880a6fabSChristophe Gouault __u8 lbits; 370880a6fabSChristophe Gouault __u8 rbits; 371880a6fabSChristophe Gouault }; 372880a6fabSChristophe Gouault 373607ca46eSDavid Howells struct xfrm_usersa_info { 374607ca46eSDavid Howells struct xfrm_selector sel; 375607ca46eSDavid Howells struct xfrm_id id; 376607ca46eSDavid Howells xfrm_address_t saddr; 377607ca46eSDavid Howells struct xfrm_lifetime_cfg lft; 378607ca46eSDavid Howells struct xfrm_lifetime_cur curlft; 379607ca46eSDavid Howells struct xfrm_stats stats; 380607ca46eSDavid Howells __u32 seq; 381607ca46eSDavid Howells __u32 reqid; 382607ca46eSDavid Howells __u16 family; 383607ca46eSDavid Howells __u8 mode; /* XFRM_MODE_xxx */ 384607ca46eSDavid Howells __u8 replay_window; 385607ca46eSDavid Howells __u8 flags; 386607ca46eSDavid Howells #define XFRM_STATE_NOECN 1 387607ca46eSDavid Howells #define XFRM_STATE_DECAP_DSCP 2 388607ca46eSDavid Howells #define XFRM_STATE_NOPMTUDISC 4 389607ca46eSDavid Howells #define XFRM_STATE_WILDRECV 8 390607ca46eSDavid Howells #define XFRM_STATE_ICMP 16 391607ca46eSDavid Howells #define XFRM_STATE_AF_UNSPEC 32 392607ca46eSDavid Howells #define XFRM_STATE_ALIGN4 64 393607ca46eSDavid Howells #define XFRM_STATE_ESN 128 394607ca46eSDavid Howells }; 395607ca46eSDavid Howells 396a947b0a9SNicolas Dichtel #define XFRM_SA_XFLAG_DONT_ENCAP_DSCP 1 397428d2459SPetr Vaněk #define XFRM_SA_XFLAG_OSEQ_MAY_WRAP 2 398a947b0a9SNicolas Dichtel 399607ca46eSDavid Howells struct xfrm_usersa_id { 400607ca46eSDavid Howells xfrm_address_t daddr; 401607ca46eSDavid Howells __be32 spi; 402607ca46eSDavid Howells __u16 family; 403607ca46eSDavid Howells __u8 proto; 404607ca46eSDavid Howells }; 405607ca46eSDavid Howells 406607ca46eSDavid Howells struct xfrm_aevent_id { 407607ca46eSDavid Howells struct xfrm_usersa_id sa_id; 408607ca46eSDavid Howells xfrm_address_t saddr; 409607ca46eSDavid Howells __u32 flags; 410607ca46eSDavid Howells __u32 reqid; 411607ca46eSDavid Howells }; 412607ca46eSDavid Howells 413607ca46eSDavid Howells struct xfrm_userspi_info { 414607ca46eSDavid Howells struct xfrm_usersa_info info; 415607ca46eSDavid Howells __u32 min; 416607ca46eSDavid Howells __u32 max; 417607ca46eSDavid Howells }; 418607ca46eSDavid Howells 419607ca46eSDavid Howells struct xfrm_userpolicy_info { 420607ca46eSDavid Howells struct xfrm_selector sel; 421607ca46eSDavid Howells struct xfrm_lifetime_cfg lft; 422607ca46eSDavid Howells struct xfrm_lifetime_cur curlft; 423607ca46eSDavid Howells __u32 priority; 424607ca46eSDavid Howells __u32 index; 425607ca46eSDavid Howells __u8 dir; 426607ca46eSDavid Howells __u8 action; 427607ca46eSDavid Howells #define XFRM_POLICY_ALLOW 0 428607ca46eSDavid Howells #define XFRM_POLICY_BLOCK 1 429607ca46eSDavid Howells __u8 flags; 430607ca46eSDavid Howells #define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */ 431607ca46eSDavid Howells /* Automatically expand selector to include matching ICMP payloads. */ 432607ca46eSDavid Howells #define XFRM_POLICY_ICMP 2 433607ca46eSDavid Howells __u8 share; 434607ca46eSDavid Howells }; 435607ca46eSDavid Howells 436607ca46eSDavid Howells struct xfrm_userpolicy_id { 437607ca46eSDavid Howells struct xfrm_selector sel; 438607ca46eSDavid Howells __u32 index; 439607ca46eSDavid Howells __u8 dir; 440607ca46eSDavid Howells }; 441607ca46eSDavid Howells 442607ca46eSDavid Howells struct xfrm_user_acquire { 443607ca46eSDavid Howells struct xfrm_id id; 444607ca46eSDavid Howells xfrm_address_t saddr; 445607ca46eSDavid Howells struct xfrm_selector sel; 446607ca46eSDavid Howells struct xfrm_userpolicy_info policy; 447607ca46eSDavid Howells __u32 aalgos; 448607ca46eSDavid Howells __u32 ealgos; 449607ca46eSDavid Howells __u32 calgos; 450607ca46eSDavid Howells __u32 seq; 451607ca46eSDavid Howells }; 452607ca46eSDavid Howells 453607ca46eSDavid Howells struct xfrm_user_expire { 454607ca46eSDavid Howells struct xfrm_usersa_info state; 455607ca46eSDavid Howells __u8 hard; 456607ca46eSDavid Howells }; 457607ca46eSDavid Howells 458607ca46eSDavid Howells struct xfrm_user_polexpire { 459607ca46eSDavid Howells struct xfrm_userpolicy_info pol; 460607ca46eSDavid Howells __u8 hard; 461607ca46eSDavid Howells }; 462607ca46eSDavid Howells 463607ca46eSDavid Howells struct xfrm_usersa_flush { 464607ca46eSDavid Howells __u8 proto; 465607ca46eSDavid Howells }; 466607ca46eSDavid Howells 467607ca46eSDavid Howells struct xfrm_user_report { 468607ca46eSDavid Howells __u8 proto; 469607ca46eSDavid Howells struct xfrm_selector sel; 470607ca46eSDavid Howells }; 471607ca46eSDavid Howells 472607ca46eSDavid Howells /* Used by MIGRATE to pass addresses IKE should use to perform 473607ca46eSDavid Howells * SA negotiation with the peer */ 474607ca46eSDavid Howells struct xfrm_user_kmaddress { 475607ca46eSDavid Howells xfrm_address_t local; 476607ca46eSDavid Howells xfrm_address_t remote; 477607ca46eSDavid Howells __u32 reserved; 478607ca46eSDavid Howells __u16 family; 479607ca46eSDavid Howells }; 480607ca46eSDavid Howells 481607ca46eSDavid Howells struct xfrm_user_migrate { 482607ca46eSDavid Howells xfrm_address_t old_daddr; 483607ca46eSDavid Howells xfrm_address_t old_saddr; 484607ca46eSDavid Howells xfrm_address_t new_daddr; 485607ca46eSDavid Howells xfrm_address_t new_saddr; 486607ca46eSDavid Howells __u8 proto; 487607ca46eSDavid Howells __u8 mode; 488607ca46eSDavid Howells __u16 reserved; 489607ca46eSDavid Howells __u32 reqid; 490607ca46eSDavid Howells __u16 old_family; 491607ca46eSDavid Howells __u16 new_family; 492607ca46eSDavid Howells }; 493607ca46eSDavid Howells 494607ca46eSDavid Howells struct xfrm_user_mapping { 495607ca46eSDavid Howells struct xfrm_usersa_id id; 496607ca46eSDavid Howells __u32 reqid; 497607ca46eSDavid Howells xfrm_address_t old_saddr; 498607ca46eSDavid Howells xfrm_address_t new_saddr; 499607ca46eSDavid Howells __be16 old_sport; 500607ca46eSDavid Howells __be16 new_sport; 501607ca46eSDavid Howells }; 502607ca46eSDavid Howells 503870a2df4SNicolas Dichtel struct xfrm_address_filter { 504d3623099SNicolas Dichtel xfrm_address_t saddr; 505d3623099SNicolas Dichtel xfrm_address_t daddr; 506d3623099SNicolas Dichtel __u16 family; 507d3623099SNicolas Dichtel __u8 splen; 508d3623099SNicolas Dichtel __u8 dplen; 509d3623099SNicolas Dichtel }; 510d3623099SNicolas Dichtel 511d77e38e6SSteffen Klassert struct xfrm_user_offload { 512d77e38e6SSteffen Klassert int ifindex; 513d77e38e6SSteffen Klassert __u8 flags; 514d77e38e6SSteffen Klassert }; 5155e25c25aSPetr Vaněk /* This flag was exposed without any kernel code that supports it. 5165e25c25aSPetr Vaněk * Unfortunately, strongswan has the code that sets this flag, 5175e25c25aSPetr Vaněk * which makes it impossible to reuse this bit. 5187c76ecd9SLeon Romanovsky * 5197c76ecd9SLeon Romanovsky * So leave it here to make sure that it won't be reused by mistake. 5207c76ecd9SLeon Romanovsky */ 521d77e38e6SSteffen Klassert #define XFRM_OFFLOAD_IPV6 1 522d77e38e6SSteffen Klassert #define XFRM_OFFLOAD_INBOUND 2 523d14f28b8SLeon Romanovsky /* Two bits above are relevant for state path only, while 524d14f28b8SLeon Romanovsky * offload is used for both policy and state flows. 525d14f28b8SLeon Romanovsky * 526d14f28b8SLeon Romanovsky * In policy offload mode, they are free and can be safely reused. 527d14f28b8SLeon Romanovsky */ 528d14f28b8SLeon Romanovsky #define XFRM_OFFLOAD_PACKET 4 529d77e38e6SSteffen Klassert 5302d151d39SSteffen Klassert struct xfrm_userpolicy_default { 531f8d858e6SNicolas Dichtel #define XFRM_USERPOLICY_UNSPEC 0 532f8d858e6SNicolas Dichtel #define XFRM_USERPOLICY_BLOCK 1 533f8d858e6SNicolas Dichtel #define XFRM_USERPOLICY_ACCEPT 2 534f8d858e6SNicolas Dichtel __u8 in; 535f8d858e6SNicolas Dichtel __u8 fwd; 536f8d858e6SNicolas Dichtel __u8 out; 5372d151d39SSteffen Klassert }; 5382d151d39SSteffen Klassert 539607ca46eSDavid Howells #ifndef __KERNEL__ 540607ca46eSDavid Howells /* backwards compatibility for userspace */ 541607ca46eSDavid Howells #define XFRMGRP_ACQUIRE 1 542607ca46eSDavid Howells #define XFRMGRP_EXPIRE 2 543607ca46eSDavid Howells #define XFRMGRP_SA 4 544607ca46eSDavid Howells #define XFRMGRP_POLICY 8 545607ca46eSDavid Howells #define XFRMGRP_REPORT 0x20 546607ca46eSDavid Howells #endif 547607ca46eSDavid Howells 548607ca46eSDavid Howells enum xfrm_nlgroups { 549607ca46eSDavid Howells XFRMNLGRP_NONE, 550607ca46eSDavid Howells #define XFRMNLGRP_NONE XFRMNLGRP_NONE 551607ca46eSDavid Howells XFRMNLGRP_ACQUIRE, 552607ca46eSDavid Howells #define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE 553607ca46eSDavid Howells XFRMNLGRP_EXPIRE, 554607ca46eSDavid Howells #define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE 555607ca46eSDavid Howells XFRMNLGRP_SA, 556607ca46eSDavid Howells #define XFRMNLGRP_SA XFRMNLGRP_SA 557607ca46eSDavid Howells XFRMNLGRP_POLICY, 558607ca46eSDavid Howells #define XFRMNLGRP_POLICY XFRMNLGRP_POLICY 559607ca46eSDavid Howells XFRMNLGRP_AEVENTS, 560607ca46eSDavid Howells #define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS 561607ca46eSDavid Howells XFRMNLGRP_REPORT, 562607ca46eSDavid Howells #define XFRMNLGRP_REPORT XFRMNLGRP_REPORT 563607ca46eSDavid Howells XFRMNLGRP_MIGRATE, 564607ca46eSDavid Howells #define XFRMNLGRP_MIGRATE XFRMNLGRP_MIGRATE 565607ca46eSDavid Howells XFRMNLGRP_MAPPING, 566607ca46eSDavid Howells #define XFRMNLGRP_MAPPING XFRMNLGRP_MAPPING 567607ca46eSDavid Howells __XFRMNLGRP_MAX 568607ca46eSDavid Howells }; 569607ca46eSDavid Howells #define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1) 570607ca46eSDavid Howells 571607ca46eSDavid Howells #endif /* _LINUX_XFRM_H */ 572