1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _NET_PFPOLICY_H 27 #define _NET_PFPOLICY_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * Definitions and structures for PF_POLICY version 1. 33 * 34 * This local protocol provides an interface allowing utilities to 35 * manage a system's IPsec System Policy Database; see RFC2401 for a 36 * conceptual overview of the SPD. 37 * The basic encoding is modelled on PF_KEY version 2; see pfkeyv2.h 38 * and RFC2367 for more information. 39 */ 40 41 #ifdef __cplusplus 42 extern "C" { 43 #endif 44 45 #define PF_POLICY_V1 1 46 #define PF_POLICY_REVISION 200304L 47 48 /* 49 * Base PF_POLICY message header. Each request/response starts with 50 * one of these, followed by some number of extensions. Each 51 * extension type appears at most once in a message. spd_msg_len 52 * contains the total length of the message including header. 53 */ 54 typedef struct spd_msg 55 { 56 uint8_t spd_msg_version; /* PF_POLICY_V1 */ 57 uint8_t spd_msg_type; /* ADD, DELETE, QUERY, ... */ 58 uint8_t spd_msg_errno; /* Unix errno space; mbz on request */ 59 uint8_t spd_msg_spdid; /* which policy db instance */ 60 uint16_t spd_msg_len; /* in 64-bit words */ 61 uint16_t spd_msg_diagnostic; /* additional error reason */ 62 /* Union is for guaranteeing 64-bit alignment. */ 63 union { 64 struct { 65 uint32_t spd_msg_useq; /* set by sender */ 66 uint32_t spd_msg_upid; /* set by sender */ 67 } spd_msg_actual; 68 uint64_t spd_msg_alignment; 69 } spd_msg_u; 70 #define spd_msg_seq spd_msg_u.spd_msg_actual.spd_msg_useq 71 #define spd_msg_pid spd_msg_u.spd_msg_actual.spd_msg_upid 72 } spd_msg_t; 73 74 /* 75 * Command numbers, found in spd_msg_type. 76 */ 77 #define SPD_RESERVED 0 78 #define SPD_MIN 1 79 #define SPD_FLUSH 1 80 #define SPD_ADDRULE 2 81 #define SPD_DELETERULE 3 82 #define SPD_FLIP 4 83 #define SPD_LOOKUP 5 84 #define SPD_DUMP 6 85 #define SPD_CLONE 7 86 #define SPD_ALGLIST 8 87 #define SPD_DUMPALGS 9 88 #define SPD_UPDATEALGS 10 89 #define SPD_MAX 10 90 91 /* 92 * Well-known policy db instances, found in spd_msg_spdid 93 */ 94 #define SPD_ACTIVE 0 /* The currently active instance */ 95 #define SPD_STANDBY 1 /* "on deck" standby SPD */ 96 97 /* 98 * The spd_msg_t is followed by extensions, which start with the 99 * following header; each extension structure includes the length and 100 * type fields internally as an overlay to simplify parsing and 101 * construction. 102 */ 103 typedef struct spd_ext 104 { 105 /* Union is for guaranteeing 64-bit alignment. */ 106 union { 107 struct { 108 uint16_t spd_ext_ulen; /* in 64-bit words */ 109 uint16_t spd_ext_utype; /* 0 is reserved */ 110 } spd_ext_actual; 111 uint64_t spd_ext_alignment; 112 } spd_ext_u; 113 #define spd_ext_len spd_ext_u.spd_ext_actual.spd_ext_ulen 114 #define spd_ext_type spd_ext_u.spd_ext_actual.spd_ext_utype 115 } spd_ext_t; 116 117 /* 118 * Extension numbers, found in spd_ext_type. 119 */ 120 121 #define SPD_EXT_LCLPORT 1 122 #define SPD_EXT_REMPORT 2 123 #define SPD_EXT_PROTO 3 124 #define SPD_EXT_LCLADDR 4 125 #define SPD_EXT_REMADDR 5 126 127 #define SPD_EXT_ACTION 6 128 #define SPD_EXT_RULE 7 129 #define SPD_EXT_RULESET 8 130 #define SPD_EXT_ICMP_TYPECODE 9 131 132 #define SPD_EXT_TUN_NAME 10 133 134 #define SPD_EXT_MAX 10 135 136 /* 137 * base policy rule (attributes which every rule has) 138 * 139 * spd_rule_index MBZ on a SPD_ADD, and is assigned by the kernel. 140 * subsequent deletes can operate either by specifying selectors or by 141 * specifying a non-zero rule index. 142 */ 143 struct spd_rule 144 { 145 uint16_t spd_rule_len; 146 uint16_t spd_rule_type; /* SPD_EXT_RULE */ 147 uint32_t spd_rule_priority; 148 uint32_t spd_rule_flags; /* INBOUND, OUTBOUND, ... */ 149 uint32_t spd_rule_unused; 150 uint64_t spd_rule_index; /* unique rule identifier. */ 151 }; 152 153 /* 154 * Flags for spd_rule.spd_rule_flags 155 */ 156 #define SPD_RULE_FLAG_INBOUND 0x0001 157 #define SPD_RULE_FLAG_OUTBOUND 0x0002 158 /* Only applies to tunnel policy heads. */ 159 #define SPD_RULE_FLAG_TUNNEL 0x0004 160 161 /* 162 * Address selectors. Different from PF_KEY because we want a 163 * more precise format for wildcards on ports/protocol. 164 */ 165 typedef struct spd_address { 166 /* Union is for guaranteeing 64-bit alignment. */ 167 union { 168 struct { 169 uint16_t spd_address_ulen; 170 uint16_t spd_address_uexttype; /* SRC, DST */ 171 uint8_t spd_address_uaf; /* address family. */ 172 uint8_t spd_address_uprefixlen; /* Prefix len (bits). */ 173 uint16_t spd_address_ureserved2; /* Padding */ 174 } spd_address_actual; 175 uint64_t spd_address_alignment; 176 } spd_address_u; 177 /* 178 * .. followed by 4 bytes of IPv4 or 16 bytes of IPv6 address, 179 * padded up to next uint64_t 180 */ 181 #define spd_address_len \ 182 spd_address_u.spd_address_actual.spd_address_ulen 183 #define spd_address_exttype \ 184 spd_address_u.spd_address_actual.spd_address_uexttype 185 #define spd_address_af \ 186 spd_address_u.spd_address_actual.spd_address_uaf 187 #define spd_address_prefixlen \ 188 spd_address_u.spd_address_actual.spd_address_uprefixlen 189 #define spd_address_reserved2 \ 190 spd_address_u.spd_address_actual.spd_address_ureserved2 191 } spd_address_t; 192 193 /* 194 * Protocol selector 195 */ 196 struct spd_proto 197 { 198 /* Union is for guaranteeing 64-bit alignment. */ 199 union { 200 struct { 201 uint16_t spd_proto_ulen; 202 uint16_t spd_proto_uexttype; /* PROTO */ 203 uint8_t spd_proto_unumber; /* IPPROTO_* */ 204 uint8_t spd_proto_ureserved1; /* pad */ 205 uint16_t spd_proto_ureserved2; /* pad */ 206 } spd_proto_actual; 207 uint64_t spd_proto_alignment; 208 } spd_proto_u; 209 #define spd_proto_len spd_proto_u.spd_proto_actual.spd_proto_ulen 210 #define spd_proto_exttype spd_proto_u.spd_proto_actual.spd_proto_uexttype 211 #define spd_proto_number spd_proto_u.spd_proto_actual.spd_proto_unumber 212 #define spd_proto_reserved1 spd_proto_u.spd_proto_actual.spd_proto_ureserved1 213 #define spd_proto_reserved2 spd_proto_u.spd_proto_actual.spd_proto_ureserved2 214 }; 215 216 /* 217 * Port selector. We only support minport==maxport at present. 218 */ 219 struct spd_portrange 220 { 221 /* Union is for guaranteeing 64-bit alignment. */ 222 union { 223 struct { 224 uint16_t spd_ports_ulen; 225 uint16_t spd_ports_uexttype; /* LCLPORT, REMPORT */ 226 uint16_t spd_ports_uminport; /* min port */ 227 uint16_t spd_ports_umaxport; /* max port */ 228 } spd_ports_actual; 229 uint64_t spd_ports_alignment; 230 } spd_ports_u; 231 #define spd_ports_len spd_ports_u.spd_ports_actual.spd_ports_ulen 232 #define spd_ports_exttype spd_ports_u.spd_ports_actual.spd_ports_uexttype 233 #define spd_ports_minport spd_ports_u.spd_ports_actual.spd_ports_uminport 234 #define spd_ports_maxport spd_ports_u.spd_ports_actual.spd_ports_umaxport 235 }; 236 237 /* 238 * ICMP type selector. 239 */ 240 struct spd_typecode 241 { 242 /* Union is for guaranteeing 64-bit alignment. */ 243 union { 244 struct { 245 uint16_t spd_typecode_ulen; 246 uint16_t spd_typecode_uexttype; /* ICMP_TYPECODE */ 247 uint8_t spd_typecode_utype; 248 uint8_t spd_typecode_utype_end; 249 uint8_t spd_typecode_ucode; 250 uint8_t spd_typecode_ucode_end; 251 } spd_typecode_actual; 252 uint64_t spd_typecode_alignment; 253 } spd_typecode_u; 254 #define spd_typecode_len \ 255 spd_typecode_u.spd_typecode_actual.spd_typecode_ulen 256 #define spd_typecode_exttype \ 257 spd_typecode_u.spd_typecode_actual.spd_typecode_uexttype 258 #define spd_typecode_type \ 259 spd_typecode_u.spd_typecode_actual.spd_typecode_utype 260 #define spd_typecode_type_end \ 261 spd_typecode_u.spd_typecode_actual.spd_typecode_utype_end 262 #define spd_typecode_code \ 263 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode 264 #define spd_typecode_code_end \ 265 spd_typecode_u.spd_typecode_actual.spd_typecode_ucode_end 266 }; 267 268 269 /* 270 * Actions, specifying what happens to packets which match selectors. 271 * This extension is followed by some number of spd_attribute tag-value pairs 272 * which encode one or more alternative policies; see below for 273 * the encoding used. 274 */ 275 struct spd_ext_actions 276 { 277 /* Union is for guaranteeing 64-bit alignment. */ 278 union { 279 struct { 280 uint16_t spd_actions_ulen; 281 uint16_t spd_actions_uexttype; /* ACTION */ 282 uint16_t spd_actions_ucount; /* # of alternatives */ 283 uint16_t spd_actions_ureserved; 284 } spd_actions_actual; 285 uint64_t spd_actions_alignment; 286 } spd_actions_u; 287 #define spd_actions_len \ 288 spd_actions_u.spd_actions_actual.spd_actions_ulen 289 #define spd_actions_exttype \ 290 spd_actions_u.spd_actions_actual.spd_actions_uexttype 291 #define spd_actions_count \ 292 spd_actions_u.spd_actions_actual.spd_actions_ucount 293 #define spd_actions_reserved \ 294 spd_actions_u.spd_actions_actual.spd_actions_ureserved 295 }; 296 297 /* 298 * Extensible encoding for requested SA attributes. 299 * To allow additional attributes to be added, we use a simple-to-interpret 300 * (tag, value) encoding to fill in attributes in a list of alternatives. 301 * 302 * We fill in alternatives one at a time, starting with most-preferred, 303 * proceeding to least-preferred. 304 * 305 * Conceptually, we are filling in attributes of a "template", and 306 * then copying that template value into the list of alternatives when 307 * we see a SPD_ATTR_END or SPD_ATTR_NEXT. 308 * 309 * The template is not changed by SPD_ATTR_NEXT, so that attributes common to 310 * all alternatives need only be mentioned once. 311 * 312 * spd_actions_count is the maximum number of alternatives present; it 313 * should be one greater than the number of SPD_ATTR_NEXT opcodes 314 * present in the sequence. 315 */ 316 317 struct spd_attribute 318 { 319 union { 320 struct { 321 uint32_t spd_attr_utag; 322 uint32_t spd_attr_uvalue; 323 } spd_attribute_actual; 324 uint64_t spd_attribute_alignment; 325 } spd_attribute_u; 326 #define spd_attr_tag spd_attribute_u.spd_attribute_actual.spd_attr_utag 327 #define spd_attr_value spd_attribute_u.spd_attribute_actual.spd_attr_uvalue 328 }; 329 330 #define SPD_ATTR_NOP 0x00000000 /* space filler */ 331 #define SPD_ATTR_END 0x00000001 /* end of description */ 332 #define SPD_ATTR_EMPTY 0x00000002 /* reset template to default */ 333 #define SPD_ATTR_NEXT 0x00000003 /* start filling next alternative */ 334 335 #define SPD_ATTR_TYPE 0x00000100 336 #define SPD_ATTR_FLAGS 0x00000101 337 #define SPD_ATTR_AH_AUTH 0x00000102 338 #define SPD_ATTR_ESP_ENCR 0x00000103 339 #define SPD_ATTR_ESP_AUTH 0x00000104 340 #define SPD_ATTR_ENCR_MINBITS 0x00000105 341 #define SPD_ATTR_ENCR_MAXBITS 0x00000106 342 #define SPD_ATTR_AH_MINBITS 0x00000107 343 #define SPD_ATTR_AH_MAXBITS 0x00000108 344 #define SPD_ATTR_LIFE_SOFT_TIME 0x00000109 345 #define SPD_ATTR_LIFE_HARD_TIME 0x0000010a 346 #define SPD_ATTR_LIFE_SOFT_BYTES 0x0000010b 347 #define SPD_ATTR_LIFE_HARD_BYTES 0x0000010c 348 #define SPD_ATTR_KM_PROTO 0x0000010d 349 #define SPD_ATTR_KM_COOKIE 0x0000010e 350 #define SPD_ATTR_REPLAY_DEPTH 0x0000010f 351 #define SPD_ATTR_ESPA_MINBITS 0x00000110 352 #define SPD_ATTR_ESPA_MAXBITS 0x00000111 353 #define SPD_ATTR_ENCR_DEFBITS 0x00000112 354 #define SPD_ATTR_ENCR_INCRBITS 0x00000113 355 #define SPD_ATTR_AH_DEFBITS 0x00000114 356 #define SPD_ATTR_AH_INCRBITS 0x00000115 357 #define SPD_ATTR_ESPA_DEFBITS 0x00000116 358 #define SPD_ATTR_ESPA_INCRBITS 0x00000117 359 #define SPD_ATTR_ALG_ID 0x00000118 360 #define SPD_ATTR_ALG_PROTO 0x00000119 361 #define SPD_ATTR_ALG_INCRBITS 0x0000011a 362 #define SPD_ATTR_ALG_NKEYSIZES 0x0000011b 363 #define SPD_ATTR_ALG_KEYSIZE 0x0000011c 364 #define SPD_ATTR_ALG_NBLOCKSIZES 0x0000011d 365 #define SPD_ATTR_ALG_BLOCKSIZE 0x0000011e 366 #define SPD_ATTR_ALG_MECHNAME 0x0000011f 367 #define SPD_ATTR_PROTO_ID 0x00000120 368 #define SPD_ATTR_PROTO_EXEC_MODE 0x00000121 369 370 /* 371 * An interface extension identifies a network interface. 372 * It is used for configuring Tunnel Mode policies on a tunnelling 373 * interface for now. 374 */ 375 typedef struct spd_if_s { 376 union { 377 struct { 378 uint16_t spd_if_ulen; 379 uint16_t spd_if_uexttype; 380 union { 381 uint8_t spd_if_iuname[4]; 382 uint32_t spd_if_iuindex; 383 } spd_if_iu; 384 } spd_if_actual; 385 uint64_t spd_if_alignment; 386 } spd_if_u; 387 #define spd_if_len spd_if_u.spd_if_actual.spd_if_ulen 388 #define spd_if_exttype spd_if_u.spd_if_actual.spd_if_uexttype 389 #define spd_if_name spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuname 390 #define spd_if_index spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuindex 391 } spd_if_t; 392 393 /* 394 * Minimum, maximum key lengths in bits. 395 */ 396 #define SPD_MIN_MINBITS 0x0000 397 #define SPD_MAX_MAXBITS 0xffff 398 399 /* 400 * IPsec action types (in SPD_ATTR_TYPE attribute) 401 */ 402 #define SPD_ACTTYPE_DROP 0x0001 403 #define SPD_ACTTYPE_PASS 0x0002 404 #define SPD_ACTTYPE_IPSEC 0x0003 405 406 /* 407 * Action flags (in SPD_ATTR_FLAGS attribute) 408 */ 409 #define SPD_APPLY_AH 0x0001 410 #define SPD_APPLY_ESP 0x0002 411 #define SPD_APPLY_SE 0x0004 /* self-encapsulation */ 412 #define SPD_APPLY_COMP 0x0008 /* compression; NYI */ 413 #define SPD_APPLY_UNIQUE 0x0010 /* unique per-flow SA */ 414 #define SPD_APPLY_BYPASS 0x0020 /* bypass policy */ 415 #define SPD_APPLY_ESPA 0x0040 /* ESP authentication */ 416 417 /* 418 * SW crypto execution modes. 419 */ 420 #define SPD_ALG_EXEC_MODE_SYNC 1 /* synchronous */ 421 #define SPD_ALG_EXEC_MODE_ASYNC 2 /* asynchronous */ 422 423 /* 424 * SPD_DUMP protocol: 425 * 426 * We do not want to force an stack to have to read-lock the entire 427 * SPD for the duration of the dump, but we want management apps to be 428 * able to get a consistent snapshot of the SPD. 429 * 430 * Therefore, we make optimistic locking assumptions. 431 * 432 * The response to a SPD_DUMP request consists of multiple spd_msg 433 * records, all with spd_msg_type == SPD_DUMP and spd_msg_{seq,pid} 434 * matching the request. 435 * 436 * There is one header, then a sequence of policy rule records (one 437 * rule per record), then a trailer. 438 * 439 * The header and trailer both contain a single SPD_EXT_RULESET 440 * containing a version number and rule count. The dump was "good" if 441 * header version == trailer version, and the number of rules read by 442 * the application matches the rule count in the trailer. The rule 443 * count in the header is unused and should be set to zero. 444 * 445 * In between, each rule record contains a set of extensions which, if 446 * used in an SPD_ADD request, would recreate an equivalent rule. 447 * 448 * If rules were added to the SPD during the dump, the dump may be 449 * truncated or otherwise incomplete; the management application 450 * should re-try the dump in this case. 451 */ 452 453 /* 454 * Ruleset extension, used at the start and end of a SPD_DUMP. 455 */ 456 typedef struct spd_ruleset_ext 457 { 458 uint16_t spd_ruleset_len; /* 2 x 64 bits */ 459 uint16_t spd_ruleset_type; /* SPD_EXT_RULESET */ 460 uint32_t spd_ruleset_count; /* only valid in trailer */ 461 uint64_t spd_ruleset_version; /* version number */ 462 } spd_ruleset_ext_t; 463 464 /* 465 * Diagnostic codes. These supplement error messages. Be sure to 466 * update libipsecutil's spdsock_diag() if you change any of these. 467 */ 468 #define SPD_DIAGNOSTIC_NONE 0 469 #define SPD_DIAGNOSTIC_UNKNOWN_EXT 1 470 #define SPD_DIAGNOSTIC_BAD_EXTLEN 2 471 #define SPD_DIAGNOSTIC_NO_RULE_EXT 3 472 #define SPD_DIAGNOSTIC_BAD_ADDR_LEN 4 473 #define SPD_DIAGNOSTIC_MIXED_AF 5 474 #define SPD_DIAGNOSTIC_ADD_NO_MEM 6 475 #define SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT 7 476 #define SPD_DIAGNOSTIC_ADD_BAD_TYPE 8 477 #define SPD_DIAGNOSTIC_ADD_BAD_FLAGS 9 478 #define SPD_DIAGNOSTIC_ADD_INCON_FLAGS 10 479 #define SPD_DIAGNOSTIC_MALFORMED_LCLPORT 11 480 #define SPD_DIAGNOSTIC_DUPLICATE_LCLPORT 12 481 #define SPD_DIAGNOSTIC_MALFORMED_REMPORT 13 482 #define SPD_DIAGNOSTIC_DUPLICATE_REMPORT 14 483 #define SPD_DIAGNOSTIC_MALFORMED_PROTO 15 484 #define SPD_DIAGNOSTIC_DUPLICATE_PROTO 16 485 #define SPD_DIAGNOSTIC_MALFORMED_LCLADDR 17 486 #define SPD_DIAGNOSTIC_DUPLICATE_LCLADDR 18 487 #define SPD_DIAGNOSTIC_MALFORMED_REMADDR 19 488 #define SPD_DIAGNOSTIC_DUPLICATE_REMADDR 20 489 #define SPD_DIAGNOSTIC_MALFORMED_ACTION 21 490 #define SPD_DIAGNOSTIC_DUPLICATE_ACTION 22 491 #define SPD_DIAGNOSTIC_MALFORMED_RULE 23 492 #define SPD_DIAGNOSTIC_DUPLICATE_RULE 24 493 #define SPD_DIAGNOSTIC_MALFORMED_RULESET 25 494 #define SPD_DIAGNOSTIC_DUPLICATE_RULESET 26 495 #define SPD_DIAGNOSTIC_INVALID_RULE_INDEX 27 496 #define SPD_DIAGNOSTIC_BAD_SPDID 28 497 #define SPD_DIAGNOSTIC_BAD_MSG_TYPE 29 498 #define SPD_DIAGNOSTIC_UNSUPP_AH_ALG 30 499 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG 31 500 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG 32 501 #define SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE 33 502 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE 34 503 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE 35 504 #define SPD_DIAGNOSTIC_NO_ACTION_EXT 36 505 #define SPD_DIAGNOSTIC_ALG_ID_RANGE 37 506 #define SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES 38 507 #define SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES 39 508 #define SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN 40 509 #define SPD_DIAGNOSTIC_ALG_IPSEC_NOT_LOADED 41 510 #define SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE 42 511 #define SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE 43 512 #define SPD_DIAGNOSTIC_NOT_GLOBAL_OP 44 513 #define SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS 45 514 515 /* 516 * Helper macros. 517 */ 518 #define SPD_64TO8(x) ((x) << 3) 519 #define SPD_8TO64(x) ((x) >> 3) 520 #define SPD_8TO1(x) ((x) << 3) 521 #define SPD_1TO8(x) ((x) >> 3) 522 523 #ifdef __cplusplus 524 } 525 #endif 526 527 #endif /* _NET_PFPOLICY_H */ 528