1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _NET_PFPOLICY_H 28 #define _NET_PFPOLICY_H 29 30 #pragma ident "%Z%%M% %I% %E% SMI" 31 32 /* 33 * Definitions and structures for PF_POLICY version 1. 34 * 35 * This local protocol provides an interface allowing utilities to 36 * manage a system's IPsec System Policy Database; see RFC2401 for a 37 * conceptual overview of the SPD. 38 * The basic encoding is modelled on PF_KEY version 2; see pfkeyv2.h 39 * and RFC2367 for more information. 40 */ 41 42 #ifdef __cplusplus 43 extern "C" { 44 #endif 45 46 #define PF_POLICY_V1 1 47 #define PF_POLICY_REVISION 200304L 48 49 /* 50 * Base PF_POLICY message header. Each request/response starts with 51 * one of these, followed by some number of extensions. Each 52 * extension type appears at most once in a message. spd_msg_len 53 * contains the total length of the message including header. 54 */ 55 typedef struct spd_msg 56 { 57 uint8_t spd_msg_version; /* PF_POLICY_V1 */ 58 uint8_t spd_msg_type; /* ADD, DELETE, QUERY, ... */ 59 uint8_t spd_msg_errno; /* Unix errno space; mbz on request */ 60 uint8_t spd_msg_spdid; /* which policy db instance */ 61 uint16_t spd_msg_len; /* in 64-bit words */ 62 uint16_t spd_msg_diagnostic; /* additional error reason */ 63 /* Union is for guaranteeing 64-bit alignment. */ 64 union { 65 struct { 66 uint32_t spd_msg_useq; /* set by sender */ 67 uint32_t spd_msg_upid; /* set by sender */ 68 } spd_msg_actual; 69 uint64_t spd_msg_alignment; 70 } spd_msg_u; 71 #define spd_msg_seq spd_msg_u.spd_msg_actual.spd_msg_useq 72 #define spd_msg_pid spd_msg_u.spd_msg_actual.spd_msg_upid 73 } spd_msg_t; 74 75 /* 76 * Command numbers, found in spd_msg_type. 77 */ 78 #define SPD_RESERVED 0 79 #define SPD_MIN 1 80 #define SPD_FLUSH 1 81 #define SPD_ADDRULE 2 82 #define SPD_DELETERULE 3 83 #define SPD_FLIP 4 84 #define SPD_LOOKUP 5 85 #define SPD_DUMP 6 86 #define SPD_CLONE 7 87 #define SPD_ALGLIST 8 88 #define SPD_DUMPALGS 9 89 #define SPD_UPDATEALGS 10 90 #define SPD_MAX 10 91 92 /* 93 * Well-known policy db instances, found in spd_msg_spdid 94 */ 95 #define SPD_ACTIVE 0 /* The currently active instance */ 96 #define SPD_STANDBY 1 /* "on deck" standby SPD */ 97 98 /* 99 * The spd_msg_t is followed by extensions, which start with the 100 * following header; each extension structure includes the length and 101 * type fields internally as an overlay to simplify parsing and 102 * construction. 103 */ 104 typedef struct spd_ext 105 { 106 /* Union is for guaranteeing 64-bit alignment. */ 107 union { 108 struct { 109 uint16_t spd_ext_ulen; /* in 64-bit words */ 110 uint16_t spd_ext_utype; /* 0 is reserved */ 111 } spd_ext_actual; 112 uint64_t spd_ext_alignment; 113 } spd_ext_u; 114 #define spd_ext_len spd_ext_u.spd_ext_actual.spd_ext_ulen 115 #define spd_ext_type spd_ext_u.spd_ext_actual.spd_ext_utype 116 } spd_ext_t; 117 118 /* 119 * Extension numbers, found in spd_ext_type. 120 */ 121 122 #define SPD_EXT_LCLPORT 1 123 #define SPD_EXT_REMPORT 2 124 #define SPD_EXT_PROTO 3 125 #define SPD_EXT_LCLADDR 4 126 #define SPD_EXT_REMADDR 5 127 128 #define SPD_EXT_ACTION 6 129 #define SPD_EXT_RULE 7 130 #define SPD_EXT_RULESET 8 131 #define SPD_EXT_ICMP_TYPECODE 9 132 133 #define SPD_EXT_MAX 9 134 135 /* 136 * base policy rule (attributes which every rule has) 137 * 138 * spd_rule_index MBZ on a SPD_ADD, and is assigned by the kernel. 139 * subsequent deletes can operate either by specifying selectors or by 140 * specifying a non-zero rule index. 141 */ 142 struct spd_rule 143 { 144 uint16_t spd_rule_len; 145 uint16_t spd_rule_type; /* SPD_EXT_RULE */ 146 uint32_t spd_rule_priority; 147 uint32_t spd_rule_flags; /* INBOUND, OUTBOUND, ... */ 148 uint32_t spd_rule_unused; 149 uint64_t spd_rule_index; /* unique rule identifier. */ 150 }; 151 152 /* 153 * Flags for spd_rule.spd_rule_flags 154 */ 155 #define SPD_RULE_FLAG_INBOUND 0x0001 156 #define SPD_RULE_FLAG_OUTBOUND 0x0002 157 158 /* 159 * Address selectors. Different from PF_KEY because we want a 160 * more precise format for wildcards on ports/protocol. 161 */ 162 typedef struct spd_address { 163 /* Union is for guaranteeing 64-bit alignment. */ 164 union { 165 struct { 166 uint16_t spd_address_ulen; 167 uint16_t spd_address_uexttype; /* SRC, DST */ 168 uint8_t spd_address_uaf; /* address family. */ 169 uint8_t spd_address_uprefixlen; /* Prefix len (bits). */ 170 uint16_t spd_address_ureserved2; /* Padding */ 171 } spd_address_actual; 172 uint64_t spd_address_alignment; 173 } spd_address_u; 174 /* 175 * .. followed by 4 bytes of IPv4 or 16 bytes of IPv6 address, 176 * padded up to next uint64_t 177 */ 178 #define spd_address_len \ 179 spd_address_u.spd_address_actual.spd_address_ulen 180 #define spd_address_exttype \ 181 spd_address_u.spd_address_actual.spd_address_uexttype 182 #define spd_address_af \ 183 spd_address_u.spd_address_actual.spd_address_uaf 184 #define spd_address_prefixlen \ 185 spd_address_u.spd_address_actual.spd_address_uprefixlen 186 #define spd_address_reserved2 \ 187 spd_address_u.spd_address_actual.spd_address_ureserved2 188 } spd_address_t; 189 190 /* 191 * Protocol selector 192 */ 193 struct spd_proto 194 { 195 /* Union is for guaranteeing 64-bit alignment. */ 196 union { 197 struct { 198 uint16_t spd_proto_ulen; 199 uint16_t spd_proto_uexttype; /* PROTO */ 200 uint8_t spd_proto_unumber; /* IPPROTO_* */ 201 uint8_t spd_proto_ureserved1; /* pad */ 202 uint16_t spd_proto_ureserved2; /* pad */ 203 } spd_proto_actual; 204 uint64_t spd_proto_alignment; 205 } spd_proto_u; 206 #define spd_proto_len spd_proto_u.spd_proto_actual.spd_proto_ulen 207 #define spd_proto_exttype spd_proto_u.spd_proto_actual.spd_proto_uexttype 208 #define spd_proto_number spd_proto_u.spd_proto_actual.spd_proto_unumber 209 #define spd_proto_reserved1 spd_proto_u.spd_proto_actual.spd_proto_ureserved1 210 #define spd_proto_reserved2 spd_proto_u.spd_proto_actual.spd_proto_ureserved2 211 }; 212 213 /* 214 * Port selector. We only support minport==maxport at present. 215 */ 216 struct spd_portrange 217 { 218 /* Union is for guaranteeing 64-bit alignment. */ 219 union { 220 struct { 221 uint16_t spd_ports_ulen; 222 uint16_t spd_ports_uexttype; /* LCLPORT, REMPORT */ 223 uint16_t spd_ports_uminport; /* min port */ 224 uint16_t spd_ports_umaxport; /* max port */ 225 } spd_ports_actual; 226 uint64_t spd_ports_alignment; 227 } spd_ports_u; 228 #define spd_ports_len spd_ports_u.spd_ports_actual.spd_ports_ulen 229 #define spd_ports_exttype spd_ports_u.spd_ports_actual.spd_ports_uexttype 230 #define spd_ports_minport spd_ports_u.spd_ports_actual.spd_ports_uminport 231 #define spd_ports_maxport spd_ports_u.spd_ports_actual.spd_ports_umaxport 232 }; 233 234 /* 235 * ICMP type selector. 236 */ 237 struct spd_typecode 238 { 239 /* Union is for guaranteeing 64-bit alignment. */ 240 union { 241 struct { 242 uint16_t spd_typecode_ulen; 243 uint16_t spd_typecode_uexttype; /* ICMP_TYPECODE */ 244 uint8_t spd_typecode_utype; 245 uint8_t spd_typecode_utype_end; 246 uint8_t spd_typecode_ucode; 247 uint8_t spd_typecode_ucode_end; 248 } spd_typecode_actual; 249 uint64_t spd_typecode_alignment; 250 } spd_typecode_u; 251 #define spd_typecode_len \ 252 spd_typecode_u.spd_typecode_actual.spd_typecode_ulen 253 #define spd_typecode_exttype \ 254 spd_typecode_u.spd_typecode_actual.spd_typecode_uexttype 255 #define spd_typecode_type \ 256 spd_typecode_u.spd_typecode_actual.spd_typecode_utype 257 #define spd_typecode_type_end \ 258 spd_typecode_u.spd_typecode_actual.spd_typecode_utype_end 259 #define spd_typecode_code \ 260 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode 261 #define spd_typecode_code_end \ 262 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode_end 263 }; 264 265 266 /* 267 * Actions, specifying what happens to packets which match selectors. 268 * This extension is followed by some number of spd_attribute tag-value pairs 269 * which encode one or more alternative policies; see below for 270 * the encoding used. 271 */ 272 struct spd_ext_actions 273 { 274 /* Union is for guaranteeing 64-bit alignment. */ 275 union { 276 struct { 277 uint16_t spd_actions_ulen; 278 uint16_t spd_actions_uexttype; /* ACTION */ 279 uint16_t spd_actions_ucount; /* # of alternatives */ 280 uint16_t spd_actions_ureserved; 281 } spd_actions_actual; 282 uint64_t spd_actions_alignment; 283 } spd_actions_u; 284 #define spd_actions_len \ 285 spd_actions_u.spd_actions_actual.spd_actions_ulen 286 #define spd_actions_exttype \ 287 spd_actions_u.spd_actions_actual.spd_actions_uexttype 288 #define spd_actions_count \ 289 spd_actions_u.spd_actions_actual.spd_actions_ucount 290 #define spd_actions_reserved \ 291 spd_actions_u.spd_actions_actual.spd_actions_ureserved 292 }; 293 294 /* 295 * Extensible encoding for requested SA attributes. 296 * To allow additional attributes to be added, we use a simple-to-interpret 297 * (tag, value) encoding to fill in attributes in a list of alternatives. 298 * 299 * We fill in alternatives one at a time, starting with most-preferred, 300 * proceeding to least-preferred. 301 * 302 * Conceptually, we are filling in attributes of a "template", and 303 * then copying that template value into the list of alternatives when 304 * we see a SPD_ATTR_END or SPD_ATTR_NEXT. 305 * 306 * The template is not changed by SPD_ATTR_NEXT, so that attributes common to 307 * all alternatives need only be mentioned once. 308 * 309 * spd_actions_count is the maximum number of alternatives present; it 310 * should be one greater than the number of SPD_ATTR_NEXT opcodes 311 * present in the sequence. 312 */ 313 314 struct spd_attribute 315 { 316 union { 317 struct { 318 uint32_t spd_attr_utag; 319 uint32_t spd_attr_uvalue; 320 } spd_attribute_actual; 321 uint64_t spd_attribute_alignment; 322 } spd_attribute_u; 323 #define spd_attr_tag spd_attribute_u.spd_attribute_actual.spd_attr_utag 324 #define spd_attr_value spd_attribute_u.spd_attribute_actual.spd_attr_uvalue 325 }; 326 327 #define SPD_ATTR_NOP 0x00000000 /* space filler */ 328 #define SPD_ATTR_END 0x00000001 /* end of description */ 329 #define SPD_ATTR_EMPTY 0x00000002 /* reset template to default */ 330 #define SPD_ATTR_NEXT 0x00000003 /* start filling next alternative */ 331 332 #define SPD_ATTR_TYPE 0x00000100 333 #define SPD_ATTR_FLAGS 0x00000101 334 #define SPD_ATTR_AH_AUTH 0x00000102 335 #define SPD_ATTR_ESP_ENCR 0x00000103 336 #define SPD_ATTR_ESP_AUTH 0x00000104 337 #define SPD_ATTR_ENCR_MINBITS 0x00000105 338 #define SPD_ATTR_ENCR_MAXBITS 0x00000106 339 #define SPD_ATTR_AH_MINBITS 0x00000107 340 #define SPD_ATTR_AH_MAXBITS 0x00000108 341 #define SPD_ATTR_LIFE_SOFT_TIME 0x00000109 342 #define SPD_ATTR_LIFE_HARD_TIME 0x0000010a 343 #define SPD_ATTR_LIFE_SOFT_BYTES 0x0000010b 344 #define SPD_ATTR_LIFE_HARD_BYTES 0x0000010c 345 #define SPD_ATTR_KM_PROTO 0x0000010d 346 #define SPD_ATTR_KM_COOKIE 0x0000010e 347 #define SPD_ATTR_REPLAY_DEPTH 0x0000010f 348 #define SPD_ATTR_ESPA_MINBITS 0x00000110 349 #define SPD_ATTR_ESPA_MAXBITS 0x00000111 350 #define SPD_ATTR_ENCR_DEFBITS 0x00000112 351 #define SPD_ATTR_ENCR_INCRBITS 0x00000113 352 #define SPD_ATTR_AH_DEFBITS 0x00000114 353 #define SPD_ATTR_AH_INCRBITS 0x00000115 354 #define SPD_ATTR_ESPA_DEFBITS 0x00000116 355 #define SPD_ATTR_ESPA_INCRBITS 0x00000117 356 #define SPD_ATTR_ALG_ID 0x00000118 357 #define SPD_ATTR_ALG_PROTO 0x00000119 358 #define SPD_ATTR_ALG_INCRBITS 0x0000011a 359 #define SPD_ATTR_ALG_NKEYSIZES 0x0000011b 360 #define SPD_ATTR_ALG_KEYSIZE 0x0000011c 361 #define SPD_ATTR_ALG_NBLOCKSIZES 0x0000011d 362 #define SPD_ATTR_ALG_BLOCKSIZE 0x0000011e 363 #define SPD_ATTR_ALG_MECHNAME 0x0000011f 364 #define SPD_ATTR_PROTO_ID 0x00000120 365 #define SPD_ATTR_PROTO_EXEC_MODE 0x00000121 366 367 /* 368 * Minimum, maximum key lengths in bits. 369 */ 370 #define SPD_MIN_MINBITS 0x0000 371 #define SPD_MAX_MAXBITS 0xffff 372 373 /* 374 * IPsec action types (in SPD_ATTR_TYPE attribute) 375 */ 376 #define SPD_ACTTYPE_DROP 0x0001 377 #define SPD_ACTTYPE_PASS 0x0002 378 #define SPD_ACTTYPE_IPSEC 0x0003 379 380 /* 381 * Action flags (in SPD_ATTR_FLAGS attribute) 382 */ 383 #define SPD_APPLY_AH 0x0001 384 #define SPD_APPLY_ESP 0x0002 385 #define SPD_APPLY_SE 0x0004 /* self-encapsulation */ 386 #define SPD_APPLY_COMP 0x0008 /* compression; NYI */ 387 #define SPD_APPLY_UNIQUE 0x0010 /* unique per-flow SA */ 388 #define SPD_APPLY_BYPASS 0x0020 /* bypass policy */ 389 #define SPD_APPLY_ESPA 0x0040 /* ESP authentication */ 390 391 /* 392 * SW crypto execution modes. 393 */ 394 #define SPD_ALG_EXEC_MODE_SYNC 1 /* synchronous */ 395 #define SPD_ALG_EXEC_MODE_ASYNC 2 /* asynchronous */ 396 397 /* 398 * SPD_DUMP protocol: 399 * 400 * We do not want to force an stack to have to read-lock the entire 401 * SPD for the duration of the dump, but we want management apps to be 402 * able to get a consistent snapshot of the SPD. 403 * 404 * Therefore, we make optimistic locking assumptions. 405 * 406 * The response to a SPD_DUMP request consists of multiple spd_msg 407 * records, all with spd_msg_type == SPD_DUMP and spd_msg_{seq,pid} 408 * matching the request. 409 * 410 * There is one header, then a sequence of policy rule records (one 411 * rule per record), then a trailer. 412 * 413 * The header and trailer both contain a single SPD_EXT_RULESET 414 * containing a version number and rule count. The dump was "good" if 415 * header version == trailer version, and the number of rules read by 416 * the application matches the rule count in the trailer. The rule 417 * count in the header is unused and should be set to zero. 418 * 419 * In between, each rule record contains a set of extensions which, if 420 * used in an SPD_ADD request, would recreate an equivalent rule. 421 * 422 * If rules were added to the SPD during the dump, the dump may be 423 * truncated or otherwise incomplete; the management application 424 * should re-try the dump in this case. 425 */ 426 427 /* 428 * Ruleset extension, used at the start and end of a SPD_DUMP. 429 */ 430 typedef struct spd_ruleset_ext 431 { 432 uint16_t spd_ruleset_len; /* 2 x 64 bits */ 433 uint16_t spd_ruleset_type; /* SPD_EXT_RULESET */ 434 uint32_t spd_ruleset_count; /* only valid in trailer */ 435 uint64_t spd_ruleset_version; /* version number */ 436 } spd_ruleset_ext_t; 437 438 /* 439 * Diagnostic codes. These supplement error messages. Be sure to 440 * update libipsecutil's spdsock_diag() if you change any of these. 441 */ 442 #define SPD_DIAGNOSTIC_NONE 0 443 #define SPD_DIAGNOSTIC_UNKNOWN_EXT 1 444 #define SPD_DIAGNOSTIC_BAD_EXTLEN 2 445 #define SPD_DIAGNOSTIC_NO_RULE_EXT 3 446 #define SPD_DIAGNOSTIC_BAD_ADDR_LEN 4 447 #define SPD_DIAGNOSTIC_MIXED_AF 5 448 #define SPD_DIAGNOSTIC_ADD_NO_MEM 6 449 #define SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT 7 450 #define SPD_DIAGNOSTIC_ADD_BAD_TYPE 8 451 #define SPD_DIAGNOSTIC_ADD_BAD_FLAGS 9 452 #define SPD_DIAGNOSTIC_ADD_INCON_FLAGS 10 453 #define SPD_DIAGNOSTIC_MALFORMED_LCLPORT 11 454 #define SPD_DIAGNOSTIC_DUPLICATE_LCLPORT 12 455 #define SPD_DIAGNOSTIC_MALFORMED_REMPORT 13 456 #define SPD_DIAGNOSTIC_DUPLICATE_REMPORT 14 457 #define SPD_DIAGNOSTIC_MALFORMED_PROTO 15 458 #define SPD_DIAGNOSTIC_DUPLICATE_PROTO 16 459 #define SPD_DIAGNOSTIC_MALFORMED_LCLADDR 17 460 #define SPD_DIAGNOSTIC_DUPLICATE_LCLADDR 18 461 #define SPD_DIAGNOSTIC_MALFORMED_REMADDR 19 462 #define SPD_DIAGNOSTIC_DUPLICATE_REMADDR 20 463 #define SPD_DIAGNOSTIC_MALFORMED_ACTION 21 464 #define SPD_DIAGNOSTIC_DUPLICATE_ACTION 22 465 #define SPD_DIAGNOSTIC_MALFORMED_RULE 23 466 #define SPD_DIAGNOSTIC_DUPLICATE_RULE 24 467 #define SPD_DIAGNOSTIC_MALFORMED_RULESET 25 468 #define SPD_DIAGNOSTIC_DUPLICATE_RULESET 26 469 #define SPD_DIAGNOSTIC_INVALID_RULE_INDEX 27 470 #define SPD_DIAGNOSTIC_BAD_SPDID 28 471 #define SPD_DIAGNOSTIC_BAD_MSG_TYPE 29 472 #define SPD_DIAGNOSTIC_UNSUPP_AH_ALG 30 473 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG 31 474 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG 32 475 #define SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE 33 476 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE 34 477 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE 35 478 #define SPD_DIAGNOSTIC_NO_ACTION_EXT 36 479 #define SPD_DIAGNOSTIC_ALG_ID_RANGE 37 480 #define SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES 38 481 #define SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES 39 482 #define SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN 40 483 #define SPD_DIAGNOSTIC_ALG_IPSEC_NOT_LOADED 41 484 #define SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE 42 485 #define SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE 43 486 487 /* 488 * Helper macros. 489 */ 490 #define SPD_64TO8(x) ((x) << 3) 491 #define SPD_8TO64(x) ((x) >> 3) 492 #define SPD_8TO1(x) ((x) << 3) 493 #define SPD_1TO8(x) ((x) >> 3) 494 495 #ifdef __cplusplus 496 } 497 #endif 498 499 #endif /* _NET_PFPOLICY_H */ 500