Blame view
include/linux/xfrm.h
10.6 KB
1da177e4c
|
1 2 3 4 5 6 7 8 9 10 11 12 |
#ifndef _LINUX_XFRM_H #define _LINUX_XFRM_H #include <linux/types.h> /* All of the structures in this file may not change size as they are * passed into the kernel from userspace via netlink sockets. */ /* Structure to encapsulate addresses. I do not want to use * "standard" structure. My apologies. */ |
d94d9fee9
|
13 |
typedef union { |
737b5761d
|
14 15 |
__be32 a4; __be32 a6[4]; |
1da177e4c
|
16 17 18 19 20 21 |
} xfrm_address_t; /* Ident of a specific xfrm_state. It is used on input to lookup * the state by (spi,daddr,ah/esp) or to store information about * spi, protocol and tunnel address on output. */ |
d94d9fee9
|
22 |
struct xfrm_id { |
1da177e4c
|
23 |
xfrm_address_t daddr; |
e037c39bf
|
24 |
__be32 spi; |
1da177e4c
|
25 26 |
__u8 proto; }; |
df71837d5
|
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
struct xfrm_sec_ctx { __u8 ctx_doi; __u8 ctx_alg; __u16 ctx_len; __u32 ctx_sid; char ctx_str[0]; }; /* Security Context Domains of Interpretation */ #define XFRM_SC_DOI_RESERVED 0 #define XFRM_SC_DOI_LSM 1 /* Security Context Algorithms */ #define XFRM_SC_ALG_RESERVED 0 #define XFRM_SC_ALG_SELINUX 1 |
1da177e4c
|
42 |
/* Selector, used as selector both on policy rules (SPD) and SAs. */ |
d94d9fee9
|
43 |
struct xfrm_selector { |
1da177e4c
|
44 45 |
xfrm_address_t daddr; xfrm_address_t saddr; |
8f83f23e6
|
46 47 48 49 |
__be16 dport; __be16 dport_mask; __be16 sport; __be16 sport_mask; |
1da177e4c
|
50 51 52 53 54 |
__u16 family; __u8 prefixlen_d; __u8 prefixlen_s; __u8 proto; int ifindex; |
85efde6f4
|
55 |
__kernel_uid32_t user; |
1da177e4c
|
56 57 58 |
}; #define XFRM_INF (~(__u64)0) |
d94d9fee9
|
59 |
struct xfrm_lifetime_cfg { |
1da177e4c
|
60 61 62 63 64 65 66 67 68 |
__u64 soft_byte_limit; __u64 hard_byte_limit; __u64 soft_packet_limit; __u64 hard_packet_limit; __u64 soft_add_expires_seconds; __u64 hard_add_expires_seconds; __u64 soft_use_expires_seconds; __u64 hard_use_expires_seconds; }; |
d94d9fee9
|
69 |
struct xfrm_lifetime_cur { |
1da177e4c
|
70 71 72 73 74 |
__u64 bytes; __u64 packets; __u64 add_time; __u64 use_time; }; |
d94d9fee9
|
75 |
struct xfrm_replay_state { |
1da177e4c
|
76 77 78 79 |
__u32 oseq; __u32 seq; __u32 bitmap; }; |
9736acf39
|
80 81 82 83 84 85 86 87 88 |
struct xfrm_replay_state_esn { unsigned int bmp_len; __u32 oseq; __u32 seq; __u32 oseq_hi; __u32 seq_hi; __u32 replay_window; __u32 bmp[0]; }; |
1da177e4c
|
89 |
struct xfrm_algo { |
3f4afb644
|
90 |
char alg_name[64]; |
ba749ae98
|
91 |
unsigned int alg_key_len; /* in bits */ |
3f4afb644
|
92 |
char alg_key[0]; |
1da177e4c
|
93 |
}; |
4e242d161
|
94 95 96 97 98 99 |
struct xfrm_algo_auth { char alg_name[64]; unsigned int alg_key_len; /* in bits */ unsigned int alg_trunc_len; /* in bits */ char alg_key[0]; }; |
1a6509d99
|
100 |
struct xfrm_algo_aead { |
461e6c856
|
101 102 103 104 |
char alg_name[64]; unsigned int alg_key_len; /* in bits */ unsigned int alg_icv_len; /* in bits */ char alg_key[0]; |
1a6509d99
|
105 |
}; |
1da177e4c
|
106 107 108 109 110 |
struct xfrm_stats { __u32 replay_window; __u32 replay; __u32 integrity_failed; }; |
d94d9fee9
|
111 |
enum { |
4e81bb833
|
112 113 |
XFRM_POLICY_TYPE_MAIN = 0, XFRM_POLICY_TYPE_SUB = 1, |
4c563f766
|
114 115 |
XFRM_POLICY_TYPE_MAX = 2, XFRM_POLICY_TYPE_ANY = 255 |
4e81bb833
|
116 |
}; |
d94d9fee9
|
117 |
enum { |
1da177e4c
|
118 119 120 |
XFRM_POLICY_IN = 0, XFRM_POLICY_OUT = 1, XFRM_POLICY_FWD = 2, |
d5422efe6
|
121 |
XFRM_POLICY_MASK = 3, |
1da177e4c
|
122 123 |
XFRM_POLICY_MAX = 3 }; |
d94d9fee9
|
124 |
enum { |
1da177e4c
|
125 126 127 128 129 |
XFRM_SHARE_ANY, /* No limitations */ XFRM_SHARE_SESSION, /* For this session only */ XFRM_SHARE_USER, /* For this user only */ XFRM_SHARE_UNIQUE /* Use once */ }; |
b59f45d0b
|
130 131 |
#define XFRM_MODE_TRANSPORT 0 #define XFRM_MODE_TUNNEL 1 |
7e49e6de3
|
132 133 |
#define XFRM_MODE_ROUTEOPTIMIZATION 2 #define XFRM_MODE_IN_TRIGGER 3 |
0a69452cb
|
134 135 |
#define XFRM_MODE_BEET 4 #define XFRM_MODE_MAX 5 |
b59f45d0b
|
136 |
|
1da177e4c
|
137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 |
/* Netlink configuration messages. */ enum { XFRM_MSG_BASE = 0x10, XFRM_MSG_NEWSA = 0x10, #define XFRM_MSG_NEWSA XFRM_MSG_NEWSA XFRM_MSG_DELSA, #define XFRM_MSG_DELSA XFRM_MSG_DELSA XFRM_MSG_GETSA, #define XFRM_MSG_GETSA XFRM_MSG_GETSA XFRM_MSG_NEWPOLICY, #define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY XFRM_MSG_DELPOLICY, #define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY XFRM_MSG_GETPOLICY, #define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY XFRM_MSG_ALLOCSPI, #define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI XFRM_MSG_ACQUIRE, #define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE XFRM_MSG_EXPIRE, #define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE XFRM_MSG_UPDPOLICY, #define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY XFRM_MSG_UPDSA, #define XFRM_MSG_UPDSA XFRM_MSG_UPDSA XFRM_MSG_POLEXPIRE, #define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE XFRM_MSG_FLUSHSA, #define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHPOLICY, #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY |
f8cd54884
|
174 175 176 177 |
XFRM_MSG_NEWAE, #define XFRM_MSG_NEWAE XFRM_MSG_NEWAE XFRM_MSG_GETAE, #define XFRM_MSG_GETAE XFRM_MSG_GETAE |
97a64b457
|
178 179 180 |
XFRM_MSG_REPORT, #define XFRM_MSG_REPORT XFRM_MSG_REPORT |
80c9abaab
|
181 182 |
XFRM_MSG_MIGRATE, #define XFRM_MSG_MIGRATE XFRM_MSG_MIGRATE |
28d8909bc
|
183 184 185 186 |
XFRM_MSG_NEWSADINFO, #define XFRM_MSG_NEWSADINFO XFRM_MSG_NEWSADINFO XFRM_MSG_GETSADINFO, #define XFRM_MSG_GETSADINFO XFRM_MSG_GETSADINFO |
ecfd6b183
|
187 188 189 190 191 |
XFRM_MSG_NEWSPDINFO, #define XFRM_MSG_NEWSPDINFO XFRM_MSG_NEWSPDINFO XFRM_MSG_GETSPDINFO, #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO |
3a2dfbe8a
|
192 193 194 |
XFRM_MSG_MAPPING, #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING |
526bdb80a
|
195 |
__XFRM_MSG_MAX |
1da177e4c
|
196 |
}; |
526bdb80a
|
197 |
#define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1) |
1da177e4c
|
198 |
|
492b558b3
|
199 |
#define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE) |
df71837d5
|
200 201 202 203 204 205 206 207 208 209 210 |
/* * Generic LSM security context for comunicating to user space * NOTE: Same format as sadb_x_sec_ctx */ struct xfrm_user_sec_ctx { __u16 len; __u16 exttype; __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */ __u8 ctx_doi; __u16 ctx_len; }; |
1da177e4c
|
211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 |
struct xfrm_user_tmpl { struct xfrm_id id; __u16 family; xfrm_address_t saddr; __u32 reqid; __u8 mode; __u8 share; __u8 optional; __u32 aalgos; __u32 ealgos; __u32 calgos; }; struct xfrm_encap_tmpl { __u16 encap_type; |
d5a0a1e31
|
226 227 |
__be16 encap_sport; __be16 encap_dport; |
1da177e4c
|
228 229 |
xfrm_address_t encap_oa; }; |
f8cd54884
|
230 231 232 233 234 235 236 237 238 239 240 241 242 243 |
/* AEVENT flags */ enum xfrm_ae_ftype_t { XFRM_AE_UNSPEC, XFRM_AE_RTHR=1, /* replay threshold*/ XFRM_AE_RVAL=2, /* replay value */ XFRM_AE_LVAL=4, /* lifetime value */ XFRM_AE_ETHR=8, /* expiry timer threshold */ XFRM_AE_CR=16, /* Event cause is replay update */ XFRM_AE_CE=32, /* Event cause is timer expiry */ XFRM_AE_CU=64, /* Event cause is policy update */ __XFRM_AE_MAX #define XFRM_AE_MAX (__XFRM_AE_MAX - 1) }; |
f7b6983f0
|
244 245 246 247 248 |
struct xfrm_userpolicy_type { __u8 type; __u16 reserved1; __u8 reserved2; }; |
1da177e4c
|
249 250 251 252 253 254 255 256 |
/* Netlink message attributes. */ enum xfrm_attr_type_t { XFRMA_UNSPEC, XFRMA_ALG_AUTH, /* struct xfrm_algo */ XFRMA_ALG_CRYPT, /* struct xfrm_algo */ XFRMA_ALG_COMP, /* struct xfrm_algo */ XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */ XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */ |
bf825f81b
|
257 258 |
XFRMA_SA, /* struct xfrm_usersa_info */ XFRMA_POLICY, /*struct xfrm_userpolicy_info */ |
df71837d5
|
259 |
XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */ |
f8cd54884
|
260 261 262 263 |
XFRMA_LTIME_VAL, XFRMA_REPLAY_VAL, XFRMA_REPLAY_THRESH, XFRMA_ETIMER_THRESH, |
eb2971b68
|
264 |
XFRMA_SRCADDR, /* xfrm_address_t */ |
060f02a3b
|
265 |
XFRMA_COADDR, /* xfrm_address_t */ |
bf825f81b
|
266 |
XFRMA_LASTUSED, /* unsigned long */ |
f7b6983f0
|
267 |
XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */ |
80c9abaab
|
268 |
XFRMA_MIGRATE, |
1a6509d99
|
269 |
XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */ |
13c1d1893
|
270 |
XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */ |
4e242d161
|
271 |
XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */ |
bf825f81b
|
272 |
XFRMA_MARK, /* struct xfrm_mark */ |
35d2856b4
|
273 |
XFRMA_TFCPAD, /* __u32 */ |
9736acf39
|
274 |
XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_esn */ |
1da177e4c
|
275 276 277 278 |
__XFRMA_MAX #define XFRMA_MAX (__XFRMA_MAX - 1) }; |
bf825f81b
|
279 280 281 282 |
struct xfrm_mark { __u32 v; /* value */ __u32 m; /* mask */ }; |
28d8909bc
|
283 284 |
enum xfrm_sadattr_type_t { XFRMA_SAD_UNSPEC, |
af11e3160
|
285 286 |
XFRMA_SAD_CNT, XFRMA_SAD_HINFO, |
28d8909bc
|
287 288 289 290 |
__XFRMA_SAD_MAX #define XFRMA_SAD_MAX (__XFRMA_SAD_MAX - 1) }; |
af11e3160
|
291 292 293 294 |
struct xfrmu_sadhinfo { __u32 sadhcnt; /* current hash bkts */ __u32 sadhmcnt; /* max allowed hash bkts */ }; |
ecfd6b183
|
295 296 |
enum xfrm_spdattr_type_t { XFRMA_SPD_UNSPEC, |
5a6d34162
|
297 298 |
XFRMA_SPD_INFO, XFRMA_SPD_HINFO, |
ecfd6b183
|
299 300 301 302 |
__XFRMA_SPD_MAX #define XFRMA_SPD_MAX (__XFRMA_SPD_MAX - 1) }; |
5a6d34162
|
303 304 305 306 307 308 309 310 311 312 313 314 315 |
struct xfrmu_spdinfo { __u32 incnt; __u32 outcnt; __u32 fwdcnt; __u32 inscnt; __u32 outscnt; __u32 fwdscnt; }; struct xfrmu_spdhinfo { __u32 spdhcnt; __u32 spdhmcnt; }; |
1da177e4c
|
316 317 318 319 320 321 322 323 324 325 |
struct xfrm_usersa_info { struct xfrm_selector sel; struct xfrm_id id; xfrm_address_t saddr; struct xfrm_lifetime_cfg lft; struct xfrm_lifetime_cur curlft; struct xfrm_stats stats; __u32 seq; __u32 reqid; __u16 family; |
7e49e6de3
|
326 |
__u8 mode; /* XFRM_MODE_xxx */ |
1da177e4c
|
327 328 329 330 |
__u8 replay_window; __u8 flags; #define XFRM_STATE_NOECN 1 #define XFRM_STATE_DECAP_DSCP 2 |
dd87147ee
|
331 |
#define XFRM_STATE_NOPMTUDISC 4 |
fbd9a5b47
|
332 |
#define XFRM_STATE_WILDRECV 8 |
8b7817f3a
|
333 |
#define XFRM_STATE_ICMP 16 |
ccf9b3b83
|
334 |
#define XFRM_STATE_AF_UNSPEC 32 |
fa9921e46
|
335 |
#define XFRM_STATE_ALIGN4 64 |
9736acf39
|
336 |
#define XFRM_STATE_ESN 128 |
1da177e4c
|
337 338 339 340 |
}; struct xfrm_usersa_id { xfrm_address_t daddr; |
9916ecb0a
|
341 |
__be32 spi; |
1da177e4c
|
342 343 344 |
__u16 family; __u8 proto; }; |
f8cd54884
|
345 |
struct xfrm_aevent_id { |
f8cd54884
|
346 |
struct xfrm_usersa_id sa_id; |
2b5f6dcce
|
347 |
xfrm_address_t saddr; |
4bf07ef3f
|
348 |
__u32 flags; |
2b5f6dcce
|
349 |
__u32 reqid; |
f8cd54884
|
350 |
}; |
1da177e4c
|
351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 |
struct xfrm_userspi_info { struct xfrm_usersa_info info; __u32 min; __u32 max; }; struct xfrm_userpolicy_info { struct xfrm_selector sel; struct xfrm_lifetime_cfg lft; struct xfrm_lifetime_cur curlft; __u32 priority; __u32 index; __u8 dir; __u8 action; #define XFRM_POLICY_ALLOW 0 #define XFRM_POLICY_BLOCK 1 __u8 flags; #define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */ |
8b7817f3a
|
369 370 |
/* Automatically expand selector to include matching ICMP payloads. */ #define XFRM_POLICY_ICMP 2 |
1da177e4c
|
371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 |
__u8 share; }; struct xfrm_userpolicy_id { struct xfrm_selector sel; __u32 index; __u8 dir; }; struct xfrm_user_acquire { struct xfrm_id id; xfrm_address_t saddr; struct xfrm_selector sel; struct xfrm_userpolicy_info policy; __u32 aalgos; __u32 ealgos; __u32 calgos; __u32 seq; }; struct xfrm_user_expire { struct xfrm_usersa_info state; __u8 hard; }; struct xfrm_user_polexpire { struct xfrm_userpolicy_info pol; __u8 hard; }; struct xfrm_usersa_flush { __u8 proto; }; |
97a64b457
|
404 405 406 407 |
struct xfrm_user_report { __u8 proto; struct xfrm_selector sel; }; |
13c1d1893
|
408 409 410 411 412 413 414 415 |
/* Used by MIGRATE to pass addresses IKE should use to perform * SA negotiation with the peer */ struct xfrm_user_kmaddress { xfrm_address_t local; xfrm_address_t remote; __u32 reserved; __u16 family; }; |
80c9abaab
|
416 417 418 419 420 421 422 423 424 425 426 427 |
struct xfrm_user_migrate { xfrm_address_t old_daddr; xfrm_address_t old_saddr; xfrm_address_t new_daddr; xfrm_address_t new_saddr; __u8 proto; __u8 mode; __u16 reserved; __u32 reqid; __u16 old_family; __u16 new_family; }; |
3a2dfbe8a
|
428 429 430 431 432 433 434 435 |
struct xfrm_user_mapping { struct xfrm_usersa_id id; __u32 reqid; xfrm_address_t old_saddr; xfrm_address_t new_saddr; __be16 old_sport; __be16 new_sport; }; |
ac6d439d2
|
436 437 |
#ifndef __KERNEL__ /* backwards compatibility for userspace */ |
1da177e4c
|
438 439 |
#define XFRMGRP_ACQUIRE 1 #define XFRMGRP_EXPIRE 2 |
26b15dad9
|
440 441 |
#define XFRMGRP_SA 4 #define XFRMGRP_POLICY 8 |
93366c537
|
442 |
#define XFRMGRP_REPORT 0x20 |
ac6d439d2
|
443 444 445 446 447 448 449 450 451 452 453 454 455 |
#endif enum xfrm_nlgroups { XFRMNLGRP_NONE, #define XFRMNLGRP_NONE XFRMNLGRP_NONE XFRMNLGRP_ACQUIRE, #define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE XFRMNLGRP_EXPIRE, #define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE XFRMNLGRP_SA, #define XFRMNLGRP_SA XFRMNLGRP_SA XFRMNLGRP_POLICY, #define XFRMNLGRP_POLICY XFRMNLGRP_POLICY |
f8cd54884
|
456 457 |
XFRMNLGRP_AEVENTS, #define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS |
97a64b457
|
458 459 |
XFRMNLGRP_REPORT, #define XFRMNLGRP_REPORT XFRMNLGRP_REPORT |
80c9abaab
|
460 461 |
XFRMNLGRP_MIGRATE, #define XFRMNLGRP_MIGRATE XFRMNLGRP_MIGRATE |
3a2dfbe8a
|
462 463 |
XFRMNLGRP_MAPPING, #define XFRMNLGRP_MAPPING XFRMNLGRP_MAPPING |
ac6d439d2
|
464 465 466 |
__XFRMNLGRP_MAX }; #define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1) |
1da177e4c
|
467 468 |
#endif /* _LINUX_XFRM_H */ |