logo

oasis-root

Compiled tree of Oasis Linux based on own branch at <https://hacktivis.me/git/oasis/> git clone https://anongit.hacktivis.me/git/oasis-root.git

xfrm.h (12816B)


  1. /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
  2. #ifndef _LINUX_XFRM_H
  3. #define _LINUX_XFRM_H
  4. #include <linux/in6.h>
  5. #include <linux/types.h>
  6. #include <linux/stddef.h>
  7. /* All of the structures in this file may not change size as they are
  8. * passed into the kernel from userspace via netlink sockets.
  9. */
  10. /* Structure to encapsulate addresses. I do not want to use
  11. * "standard" structure. My apologies.
  12. */
  13. typedef union {
  14. __be32 a4;
  15. __be32 a6[4];
  16. struct in6_addr in6;
  17. } xfrm_address_t;
  18. /* Ident of a specific xfrm_state. It is used on input to lookup
  19. * the state by (spi,daddr,ah/esp) or to store information about
  20. * spi, protocol and tunnel address on output.
  21. */
  22. struct xfrm_id {
  23. xfrm_address_t daddr;
  24. __be32 spi;
  25. __u8 proto;
  26. };
  27. struct xfrm_sec_ctx {
  28. __u8 ctx_doi;
  29. __u8 ctx_alg;
  30. __u16 ctx_len;
  31. __u32 ctx_sid;
  32. char ctx_str[] __counted_by(ctx_len);
  33. };
  34. /* Security Context Domains of Interpretation */
  35. #define XFRM_SC_DOI_RESERVED 0
  36. #define XFRM_SC_DOI_LSM 1
  37. /* Security Context Algorithms */
  38. #define XFRM_SC_ALG_RESERVED 0
  39. #define XFRM_SC_ALG_SELINUX 1
  40. /* Selector, used as selector both on policy rules (SPD) and SAs. */
  41. struct xfrm_selector {
  42. xfrm_address_t daddr;
  43. xfrm_address_t saddr;
  44. __be16 dport;
  45. __be16 dport_mask;
  46. __be16 sport;
  47. __be16 sport_mask;
  48. __u16 family;
  49. __u8 prefixlen_d;
  50. __u8 prefixlen_s;
  51. __u8 proto;
  52. int ifindex;
  53. __kernel_uid32_t user;
  54. };
  55. #define XFRM_INF (~(__u64)0)
  56. struct xfrm_lifetime_cfg {
  57. __u64 soft_byte_limit;
  58. __u64 hard_byte_limit;
  59. __u64 soft_packet_limit;
  60. __u64 hard_packet_limit;
  61. __u64 soft_add_expires_seconds;
  62. __u64 hard_add_expires_seconds;
  63. __u64 soft_use_expires_seconds;
  64. __u64 hard_use_expires_seconds;
  65. };
  66. struct xfrm_lifetime_cur {
  67. __u64 bytes;
  68. __u64 packets;
  69. __u64 add_time;
  70. __u64 use_time;
  71. };
  72. struct xfrm_replay_state {
  73. __u32 oseq;
  74. __u32 seq;
  75. __u32 bitmap;
  76. };
  77. #define XFRMA_REPLAY_ESN_MAX 4096
  78. struct xfrm_replay_state_esn {
  79. unsigned int bmp_len;
  80. __u32 oseq;
  81. __u32 seq;
  82. __u32 oseq_hi;
  83. __u32 seq_hi;
  84. __u32 replay_window;
  85. __u32 bmp[];
  86. };
  87. struct xfrm_algo {
  88. char alg_name[64];
  89. unsigned int alg_key_len; /* in bits */
  90. char alg_key[];
  91. };
  92. struct xfrm_algo_auth {
  93. char alg_name[64];
  94. unsigned int alg_key_len; /* in bits */
  95. unsigned int alg_trunc_len; /* in bits */
  96. char alg_key[];
  97. };
  98. struct xfrm_algo_aead {
  99. char alg_name[64];
  100. unsigned int alg_key_len; /* in bits */
  101. unsigned int alg_icv_len; /* in bits */
  102. char alg_key[];
  103. };
  104. struct xfrm_stats {
  105. __u32 replay_window;
  106. __u32 replay;
  107. __u32 integrity_failed;
  108. };
  109. enum {
  110. XFRM_POLICY_TYPE_MAIN = 0,
  111. XFRM_POLICY_TYPE_SUB = 1,
  112. XFRM_POLICY_TYPE_MAX = 2,
  113. XFRM_POLICY_TYPE_ANY = 255
  114. };
  115. enum {
  116. XFRM_POLICY_IN = 0,
  117. XFRM_POLICY_OUT = 1,
  118. XFRM_POLICY_FWD = 2,
  119. XFRM_POLICY_MASK = 3,
  120. XFRM_POLICY_MAX = 3
  121. };
  122. enum xfrm_sa_dir {
  123. XFRM_SA_DIR_IN = 1,
  124. XFRM_SA_DIR_OUT = 2
  125. };
  126. enum {
  127. XFRM_SHARE_ANY, /* No limitations */
  128. XFRM_SHARE_SESSION, /* For this session only */
  129. XFRM_SHARE_USER, /* For this user only */
  130. XFRM_SHARE_UNIQUE /* Use once */
  131. };
  132. #define XFRM_MODE_TRANSPORT 0
  133. #define XFRM_MODE_TUNNEL 1
  134. #define XFRM_MODE_ROUTEOPTIMIZATION 2
  135. #define XFRM_MODE_IN_TRIGGER 3
  136. #define XFRM_MODE_BEET 4
  137. #define XFRM_MODE_MAX 5
  138. /* Netlink configuration messages. */
  139. enum {
  140. XFRM_MSG_BASE = 0x10,
  141. XFRM_MSG_NEWSA = 0x10,
  142. #define XFRM_MSG_NEWSA XFRM_MSG_NEWSA
  143. XFRM_MSG_DELSA,
  144. #define XFRM_MSG_DELSA XFRM_MSG_DELSA
  145. XFRM_MSG_GETSA,
  146. #define XFRM_MSG_GETSA XFRM_MSG_GETSA
  147. XFRM_MSG_NEWPOLICY,
  148. #define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY
  149. XFRM_MSG_DELPOLICY,
  150. #define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY
  151. XFRM_MSG_GETPOLICY,
  152. #define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY
  153. XFRM_MSG_ALLOCSPI,
  154. #define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI
  155. XFRM_MSG_ACQUIRE,
  156. #define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE
  157. XFRM_MSG_EXPIRE,
  158. #define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE
  159. XFRM_MSG_UPDPOLICY,
  160. #define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY
  161. XFRM_MSG_UPDSA,
  162. #define XFRM_MSG_UPDSA XFRM_MSG_UPDSA
  163. XFRM_MSG_POLEXPIRE,
  164. #define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE
  165. XFRM_MSG_FLUSHSA,
  166. #define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA
  167. XFRM_MSG_FLUSHPOLICY,
  168. #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
  169. XFRM_MSG_NEWAE,
  170. #define XFRM_MSG_NEWAE XFRM_MSG_NEWAE
  171. XFRM_MSG_GETAE,
  172. #define XFRM_MSG_GETAE XFRM_MSG_GETAE
  173. XFRM_MSG_REPORT,
  174. #define XFRM_MSG_REPORT XFRM_MSG_REPORT
  175. XFRM_MSG_MIGRATE,
  176. #define XFRM_MSG_MIGRATE XFRM_MSG_MIGRATE
  177. XFRM_MSG_NEWSADINFO,
  178. #define XFRM_MSG_NEWSADINFO XFRM_MSG_NEWSADINFO
  179. XFRM_MSG_GETSADINFO,
  180. #define XFRM_MSG_GETSADINFO XFRM_MSG_GETSADINFO
  181. XFRM_MSG_NEWSPDINFO,
  182. #define XFRM_MSG_NEWSPDINFO XFRM_MSG_NEWSPDINFO
  183. XFRM_MSG_GETSPDINFO,
  184. #define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
  185. XFRM_MSG_MAPPING,
  186. #define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
  187. XFRM_MSG_SETDEFAULT,
  188. #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT
  189. XFRM_MSG_GETDEFAULT,
  190. #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
  191. __XFRM_MSG_MAX
  192. };
  193. #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
  194. #define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
  195. /*
  196. * Generic LSM security context for communicating to user space
  197. * NOTE: Same format as sadb_x_sec_ctx
  198. */
  199. struct xfrm_user_sec_ctx {
  200. __u16 len;
  201. __u16 exttype;
  202. __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */
  203. __u8 ctx_doi;
  204. __u16 ctx_len;
  205. };
  206. struct xfrm_user_tmpl {
  207. struct xfrm_id id;
  208. __u16 family;
  209. xfrm_address_t saddr;
  210. __u32 reqid;
  211. __u8 mode;
  212. __u8 share;
  213. __u8 optional;
  214. __u32 aalgos;
  215. __u32 ealgos;
  216. __u32 calgos;
  217. };
  218. struct xfrm_encap_tmpl {
  219. __u16 encap_type;
  220. __be16 encap_sport;
  221. __be16 encap_dport;
  222. xfrm_address_t encap_oa;
  223. };
  224. /* AEVENT flags */
  225. enum xfrm_ae_ftype_t {
  226. XFRM_AE_UNSPEC,
  227. XFRM_AE_RTHR=1, /* replay threshold*/
  228. XFRM_AE_RVAL=2, /* replay value */
  229. XFRM_AE_LVAL=4, /* lifetime value */
  230. XFRM_AE_ETHR=8, /* expiry timer threshold */
  231. XFRM_AE_CR=16, /* Event cause is replay update */
  232. XFRM_AE_CE=32, /* Event cause is timer expiry */
  233. XFRM_AE_CU=64, /* Event cause is policy update */
  234. __XFRM_AE_MAX
  235. #define XFRM_AE_MAX (__XFRM_AE_MAX - 1)
  236. };
  237. struct xfrm_userpolicy_type {
  238. __u8 type;
  239. __u16 reserved1;
  240. __u8 reserved2;
  241. };
  242. /* Netlink message attributes. */
  243. enum xfrm_attr_type_t {
  244. XFRMA_UNSPEC,
  245. XFRMA_ALG_AUTH, /* struct xfrm_algo */
  246. XFRMA_ALG_CRYPT, /* struct xfrm_algo */
  247. XFRMA_ALG_COMP, /* struct xfrm_algo */
  248. XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */
  249. XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */
  250. XFRMA_SA, /* struct xfrm_usersa_info */
  251. XFRMA_POLICY, /*struct xfrm_userpolicy_info */
  252. XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */
  253. XFRMA_LTIME_VAL,
  254. XFRMA_REPLAY_VAL,
  255. XFRMA_REPLAY_THRESH,
  256. XFRMA_ETIMER_THRESH,
  257. XFRMA_SRCADDR, /* xfrm_address_t */
  258. XFRMA_COADDR, /* xfrm_address_t */
  259. XFRMA_LASTUSED, /* __u64 */
  260. XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */
  261. XFRMA_MIGRATE,
  262. XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */
  263. XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */
  264. XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */
  265. XFRMA_MARK, /* struct xfrm_mark */
  266. XFRMA_TFCPAD, /* __u32 */
  267. XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_state_esn */
  268. XFRMA_SA_EXTRA_FLAGS, /* __u32 */
  269. XFRMA_PROTO, /* __u8 */
  270. XFRMA_ADDRESS_FILTER, /* struct xfrm_address_filter */
  271. XFRMA_PAD,
  272. XFRMA_OFFLOAD_DEV, /* struct xfrm_user_offload */
  273. XFRMA_SET_MARK, /* __u32 */
  274. XFRMA_SET_MARK_MASK, /* __u32 */
  275. XFRMA_IF_ID, /* __u32 */
  276. XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */
  277. XFRMA_SA_DIR, /* __u8 */
  278. XFRMA_NAT_KEEPALIVE_INTERVAL, /* __u32 in seconds for NAT keepalive */
  279. __XFRMA_MAX
  280. #define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */
  281. #define XFRMA_MAX (__XFRMA_MAX - 1)
  282. };
  283. struct xfrm_mark {
  284. __u32 v; /* value */
  285. __u32 m; /* mask */
  286. };
  287. enum xfrm_sadattr_type_t {
  288. XFRMA_SAD_UNSPEC,
  289. XFRMA_SAD_CNT,
  290. XFRMA_SAD_HINFO,
  291. __XFRMA_SAD_MAX
  292. #define XFRMA_SAD_MAX (__XFRMA_SAD_MAX - 1)
  293. };
  294. struct xfrmu_sadhinfo {
  295. __u32 sadhcnt; /* current hash bkts */
  296. __u32 sadhmcnt; /* max allowed hash bkts */
  297. };
  298. enum xfrm_spdattr_type_t {
  299. XFRMA_SPD_UNSPEC,
  300. XFRMA_SPD_INFO,
  301. XFRMA_SPD_HINFO,
  302. XFRMA_SPD_IPV4_HTHRESH,
  303. XFRMA_SPD_IPV6_HTHRESH,
  304. __XFRMA_SPD_MAX
  305. #define XFRMA_SPD_MAX (__XFRMA_SPD_MAX - 1)
  306. };
  307. struct xfrmu_spdinfo {
  308. __u32 incnt;
  309. __u32 outcnt;
  310. __u32 fwdcnt;
  311. __u32 inscnt;
  312. __u32 outscnt;
  313. __u32 fwdscnt;
  314. };
  315. struct xfrmu_spdhinfo {
  316. __u32 spdhcnt;
  317. __u32 spdhmcnt;
  318. };
  319. struct xfrmu_spdhthresh {
  320. __u8 lbits;
  321. __u8 rbits;
  322. };
  323. struct xfrm_usersa_info {
  324. struct xfrm_selector sel;
  325. struct xfrm_id id;
  326. xfrm_address_t saddr;
  327. struct xfrm_lifetime_cfg lft;
  328. struct xfrm_lifetime_cur curlft;
  329. struct xfrm_stats stats;
  330. __u32 seq;
  331. __u32 reqid;
  332. __u16 family;
  333. __u8 mode; /* XFRM_MODE_xxx */
  334. __u8 replay_window;
  335. __u8 flags;
  336. #define XFRM_STATE_NOECN 1
  337. #define XFRM_STATE_DECAP_DSCP 2
  338. #define XFRM_STATE_NOPMTUDISC 4
  339. #define XFRM_STATE_WILDRECV 8
  340. #define XFRM_STATE_ICMP 16
  341. #define XFRM_STATE_AF_UNSPEC 32
  342. #define XFRM_STATE_ALIGN4 64
  343. #define XFRM_STATE_ESN 128
  344. };
  345. #define XFRM_SA_XFLAG_DONT_ENCAP_DSCP 1
  346. #define XFRM_SA_XFLAG_OSEQ_MAY_WRAP 2
  347. struct xfrm_usersa_id {
  348. xfrm_address_t daddr;
  349. __be32 spi;
  350. __u16 family;
  351. __u8 proto;
  352. };
  353. struct xfrm_aevent_id {
  354. struct xfrm_usersa_id sa_id;
  355. xfrm_address_t saddr;
  356. __u32 flags;
  357. __u32 reqid;
  358. };
  359. struct xfrm_userspi_info {
  360. struct xfrm_usersa_info info;
  361. __u32 min;
  362. __u32 max;
  363. };
  364. struct xfrm_userpolicy_info {
  365. struct xfrm_selector sel;
  366. struct xfrm_lifetime_cfg lft;
  367. struct xfrm_lifetime_cur curlft;
  368. __u32 priority;
  369. __u32 index;
  370. __u8 dir;
  371. __u8 action;
  372. #define XFRM_POLICY_ALLOW 0
  373. #define XFRM_POLICY_BLOCK 1
  374. __u8 flags;
  375. #define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */
  376. /* Automatically expand selector to include matching ICMP payloads. */
  377. #define XFRM_POLICY_ICMP 2
  378. __u8 share;
  379. };
  380. struct xfrm_userpolicy_id {
  381. struct xfrm_selector sel;
  382. __u32 index;
  383. __u8 dir;
  384. };
  385. struct xfrm_user_acquire {
  386. struct xfrm_id id;
  387. xfrm_address_t saddr;
  388. struct xfrm_selector sel;
  389. struct xfrm_userpolicy_info policy;
  390. __u32 aalgos;
  391. __u32 ealgos;
  392. __u32 calgos;
  393. __u32 seq;
  394. };
  395. struct xfrm_user_expire {
  396. struct xfrm_usersa_info state;
  397. __u8 hard;
  398. };
  399. struct xfrm_user_polexpire {
  400. struct xfrm_userpolicy_info pol;
  401. __u8 hard;
  402. };
  403. struct xfrm_usersa_flush {
  404. __u8 proto;
  405. };
  406. struct xfrm_user_report {
  407. __u8 proto;
  408. struct xfrm_selector sel;
  409. };
  410. /* Used by MIGRATE to pass addresses IKE should use to perform
  411. * SA negotiation with the peer */
  412. struct xfrm_user_kmaddress {
  413. xfrm_address_t local;
  414. xfrm_address_t remote;
  415. __u32 reserved;
  416. __u16 family;
  417. };
  418. struct xfrm_user_migrate {
  419. xfrm_address_t old_daddr;
  420. xfrm_address_t old_saddr;
  421. xfrm_address_t new_daddr;
  422. xfrm_address_t new_saddr;
  423. __u8 proto;
  424. __u8 mode;
  425. __u16 reserved;
  426. __u32 reqid;
  427. __u16 old_family;
  428. __u16 new_family;
  429. };
  430. struct xfrm_user_mapping {
  431. struct xfrm_usersa_id id;
  432. __u32 reqid;
  433. xfrm_address_t old_saddr;
  434. xfrm_address_t new_saddr;
  435. __be16 old_sport;
  436. __be16 new_sport;
  437. };
  438. struct xfrm_address_filter {
  439. xfrm_address_t saddr;
  440. xfrm_address_t daddr;
  441. __u16 family;
  442. __u8 splen;
  443. __u8 dplen;
  444. };
  445. struct xfrm_user_offload {
  446. int ifindex;
  447. __u8 flags;
  448. };
  449. /* This flag was exposed without any kernel code that supports it.
  450. * Unfortunately, strongswan has the code that sets this flag,
  451. * which makes it impossible to reuse this bit.
  452. *
  453. * So leave it here to make sure that it won't be reused by mistake.
  454. */
  455. #define XFRM_OFFLOAD_IPV6 1
  456. #define XFRM_OFFLOAD_INBOUND 2
  457. /* Two bits above are relevant for state path only, while
  458. * offload is used for both policy and state flows.
  459. *
  460. * In policy offload mode, they are free and can be safely reused.
  461. */
  462. #define XFRM_OFFLOAD_PACKET 4
  463. struct xfrm_userpolicy_default {
  464. #define XFRM_USERPOLICY_UNSPEC 0
  465. #define XFRM_USERPOLICY_BLOCK 1
  466. #define XFRM_USERPOLICY_ACCEPT 2
  467. __u8 in;
  468. __u8 fwd;
  469. __u8 out;
  470. };
  471. /* backwards compatibility for userspace */
  472. #define XFRMGRP_ACQUIRE 1
  473. #define XFRMGRP_EXPIRE 2
  474. #define XFRMGRP_SA 4
  475. #define XFRMGRP_POLICY 8
  476. #define XFRMGRP_REPORT 0x20
  477. enum xfrm_nlgroups {
  478. XFRMNLGRP_NONE,
  479. #define XFRMNLGRP_NONE XFRMNLGRP_NONE
  480. XFRMNLGRP_ACQUIRE,
  481. #define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE
  482. XFRMNLGRP_EXPIRE,
  483. #define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE
  484. XFRMNLGRP_SA,
  485. #define XFRMNLGRP_SA XFRMNLGRP_SA
  486. XFRMNLGRP_POLICY,
  487. #define XFRMNLGRP_POLICY XFRMNLGRP_POLICY
  488. XFRMNLGRP_AEVENTS,
  489. #define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS
  490. XFRMNLGRP_REPORT,
  491. #define XFRMNLGRP_REPORT XFRMNLGRP_REPORT
  492. XFRMNLGRP_MIGRATE,
  493. #define XFRMNLGRP_MIGRATE XFRMNLGRP_MIGRATE
  494. XFRMNLGRP_MAPPING,
  495. #define XFRMNLGRP_MAPPING XFRMNLGRP_MAPPING
  496. __XFRMNLGRP_MAX
  497. };
  498. #define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1)
  499. #endif /* _LINUX_XFRM_H */