| 1 | /* $FreeBSD: src/sys/net/pfkeyv2.h,v 1.4.2.5 2003/01/31 23:21:01 sam Exp $ */ |
| 2 | /* $KAME: pfkeyv2.h,v 1.26 2001/06/27 10:49:49 sakane Exp $ */ |
| 3 | |
| 4 | /* |
| 5 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| 6 | * All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * 1. Redistributions of source code must retain the above copyright |
| 12 | * notice, this list of conditions and the following disclaimer. |
| 13 | * 2. Redistributions in binary form must reproduce the above copyright |
| 14 | * notice, this list of conditions and the following disclaimer in the |
| 15 | * documentation and/or other materials provided with the distribution. |
| 16 | * 3. Neither the name of the project nor the names of its contributors |
| 17 | * may be used to endorse or promote products derived from this software |
| 18 | * without specific prior written permission. |
| 19 | * |
| 20 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| 21 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 22 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 23 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| 24 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 25 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 26 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 27 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 29 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 30 | * SUCH DAMAGE. |
| 31 | */ |
| 32 | |
| 33 | /* |
| 34 | * This file has been derived rfc 2367, |
| 35 | * And added some flags of SADB_KEY_FLAGS_ as SADB_X_EXT_. |
| 36 | * sakane@ydc.co.jp |
| 37 | */ |
| 38 | |
| 39 | #ifndef _NET_PFKEYV2_H_ |
| 40 | #define _NET_PFKEYV2_H_ |
| 41 | |
| 42 | /* |
| 43 | This file defines structures and symbols for the PF_KEY Version 2 |
| 44 | key management interface. It was written at the U.S. Naval Research |
| 45 | Laboratory. This file is in the public domain. The authors ask that |
| 46 | you leave this credit intact on any copies of this file. |
| 47 | */ |
| 48 | #ifndef __PFKEY_V2_H |
| 49 | #define __PFKEY_V2_H 1 |
| 50 | |
| 51 | #define PF_KEY_V2 2 |
| 52 | #define PFKEYV2_REVISION 199806L |
| 53 | |
| 54 | #define SADB_RESERVED 0 |
| 55 | #define SADB_GETSPI 1 |
| 56 | #define SADB_UPDATE 2 |
| 57 | #define SADB_ADD 3 |
| 58 | #define SADB_DELETE 4 |
| 59 | #define SADB_GET 5 |
| 60 | #define SADB_ACQUIRE 6 |
| 61 | #define SADB_REGISTER 7 |
| 62 | #define SADB_EXPIRE 8 |
| 63 | #define SADB_FLUSH 9 |
| 64 | #define SADB_DUMP 10 |
| 65 | #define SADB_X_PROMISC 11 |
| 66 | #define SADB_X_PCHANGE 12 |
| 67 | |
| 68 | #define SADB_X_SPDUPDATE 13 |
| 69 | #define SADB_X_SPDADD 14 |
| 70 | #define SADB_X_SPDDELETE 15 /* by policy index */ |
| 71 | #define SADB_X_SPDGET 16 |
| 72 | #define SADB_X_SPDACQUIRE 17 |
| 73 | #define SADB_X_SPDDUMP 18 |
| 74 | #define SADB_X_SPDFLUSH 19 |
| 75 | #define SADB_X_SPDSETIDX 20 |
| 76 | #define SADB_X_SPDEXPIRE 21 |
| 77 | #define SADB_X_SPDDELETE2 22 /* by policy id */ |
| 78 | #define SADB_MAX 22 |
| 79 | |
| 80 | struct sadb_msg { |
| 81 | u_int8_t sadb_msg_version; |
| 82 | u_int8_t sadb_msg_type; |
| 83 | u_int8_t sadb_msg_errno; |
| 84 | u_int8_t sadb_msg_satype; |
| 85 | u_int16_t sadb_msg_len; |
| 86 | u_int16_t sadb_msg_reserved; |
| 87 | u_int32_t sadb_msg_seq; |
| 88 | u_int32_t sadb_msg_pid; |
| 89 | }; |
| 90 | |
| 91 | struct sadb_ext { |
| 92 | u_int16_t sadb_ext_len; |
| 93 | u_int16_t sadb_ext_type; |
| 94 | }; |
| 95 | |
| 96 | struct sadb_sa { |
| 97 | u_int16_t sadb_sa_len; |
| 98 | u_int16_t sadb_sa_exttype; |
| 99 | u_int32_t sadb_sa_spi; |
| 100 | u_int8_t sadb_sa_replay; |
| 101 | u_int8_t sadb_sa_state; |
| 102 | u_int8_t sadb_sa_auth; |
| 103 | u_int8_t sadb_sa_encrypt; |
| 104 | u_int32_t sadb_sa_flags; |
| 105 | }; |
| 106 | |
| 107 | struct sadb_lifetime { |
| 108 | u_int16_t sadb_lifetime_len; |
| 109 | u_int16_t sadb_lifetime_exttype; |
| 110 | u_int32_t sadb_lifetime_allocations; |
| 111 | u_int64_t sadb_lifetime_bytes; |
| 112 | u_int64_t sadb_lifetime_addtime; |
| 113 | u_int64_t sadb_lifetime_usetime; |
| 114 | }; |
| 115 | |
| 116 | struct sadb_address { |
| 117 | u_int16_t sadb_address_len; |
| 118 | u_int16_t sadb_address_exttype; |
| 119 | u_int8_t sadb_address_proto; |
| 120 | u_int8_t sadb_address_prefixlen; |
| 121 | u_int16_t sadb_address_reserved; |
| 122 | }; |
| 123 | |
| 124 | struct sadb_key { |
| 125 | u_int16_t sadb_key_len; |
| 126 | u_int16_t sadb_key_exttype; |
| 127 | u_int16_t sadb_key_bits; |
| 128 | u_int16_t sadb_key_reserved; |
| 129 | }; |
| 130 | |
| 131 | struct sadb_ident { |
| 132 | u_int16_t sadb_ident_len; |
| 133 | u_int16_t sadb_ident_exttype; |
| 134 | u_int16_t sadb_ident_type; |
| 135 | u_int16_t sadb_ident_reserved; |
| 136 | u_int64_t sadb_ident_id; |
| 137 | }; |
| 138 | |
| 139 | struct sadb_sens { |
| 140 | u_int16_t sadb_sens_len; |
| 141 | u_int16_t sadb_sens_exttype; |
| 142 | u_int32_t sadb_sens_dpd; |
| 143 | u_int8_t sadb_sens_sens_level; |
| 144 | u_int8_t sadb_sens_sens_len; |
| 145 | u_int8_t sadb_sens_integ_level; |
| 146 | u_int8_t sadb_sens_integ_len; |
| 147 | u_int32_t sadb_sens_reserved; |
| 148 | }; |
| 149 | |
| 150 | struct sadb_prop { |
| 151 | u_int16_t sadb_prop_len; |
| 152 | u_int16_t sadb_prop_exttype; |
| 153 | u_int8_t sadb_prop_replay; |
| 154 | u_int8_t sadb_prop_reserved[3]; |
| 155 | }; |
| 156 | |
| 157 | struct sadb_comb { |
| 158 | u_int8_t sadb_comb_auth; |
| 159 | u_int8_t sadb_comb_encrypt; |
| 160 | u_int16_t sadb_comb_flags; |
| 161 | u_int16_t sadb_comb_auth_minbits; |
| 162 | u_int16_t sadb_comb_auth_maxbits; |
| 163 | u_int16_t sadb_comb_encrypt_minbits; |
| 164 | u_int16_t sadb_comb_encrypt_maxbits; |
| 165 | u_int32_t sadb_comb_reserved; |
| 166 | u_int32_t sadb_comb_soft_allocations; |
| 167 | u_int32_t sadb_comb_hard_allocations; |
| 168 | u_int64_t sadb_comb_soft_bytes; |
| 169 | u_int64_t sadb_comb_hard_bytes; |
| 170 | u_int64_t sadb_comb_soft_addtime; |
| 171 | u_int64_t sadb_comb_hard_addtime; |
| 172 | u_int64_t sadb_comb_soft_usetime; |
| 173 | u_int64_t sadb_comb_hard_usetime; |
| 174 | }; |
| 175 | |
| 176 | struct sadb_supported { |
| 177 | u_int16_t sadb_supported_len; |
| 178 | u_int16_t sadb_supported_exttype; |
| 179 | u_int32_t sadb_supported_reserved; |
| 180 | }; |
| 181 | |
| 182 | struct sadb_alg { |
| 183 | u_int8_t sadb_alg_id; |
| 184 | u_int8_t sadb_alg_ivlen; |
| 185 | u_int16_t sadb_alg_minbits; |
| 186 | u_int16_t sadb_alg_maxbits; |
| 187 | u_int16_t sadb_alg_reserved; |
| 188 | }; |
| 189 | |
| 190 | struct sadb_spirange { |
| 191 | u_int16_t sadb_spirange_len; |
| 192 | u_int16_t sadb_spirange_exttype; |
| 193 | u_int32_t sadb_spirange_min; |
| 194 | u_int32_t sadb_spirange_max; |
| 195 | u_int32_t sadb_spirange_reserved; |
| 196 | }; |
| 197 | |
| 198 | struct sadb_x_kmprivate { |
| 199 | u_int16_t sadb_x_kmprivate_len; |
| 200 | u_int16_t sadb_x_kmprivate_exttype; |
| 201 | u_int32_t sadb_x_kmprivate_reserved; |
| 202 | }; |
| 203 | |
| 204 | /* |
| 205 | * XXX Additional SA Extension. |
| 206 | * mode: tunnel or transport |
| 207 | * reqid: to make SA unique nevertheless the address pair of SA are same. |
| 208 | * Mainly it's for VPN. |
| 209 | */ |
| 210 | struct sadb_x_sa2 { |
| 211 | u_int16_t sadb_x_sa2_len; |
| 212 | u_int16_t sadb_x_sa2_exttype; |
| 213 | u_int8_t sadb_x_sa2_mode; |
| 214 | u_int8_t sadb_x_sa2_reserved1; |
| 215 | u_int16_t sadb_x_sa2_reserved2; |
| 216 | u_int32_t sadb_x_sa2_sequence; |
| 217 | u_int32_t sadb_x_sa2_reqid; |
| 218 | }; |
| 219 | |
| 220 | /* XXX Policy Extension */ |
| 221 | /* sizeof(struct sadb_x_policy) == 16 */ |
| 222 | struct sadb_x_policy { |
| 223 | u_int16_t sadb_x_policy_len; |
| 224 | u_int16_t sadb_x_policy_exttype; |
| 225 | u_int16_t sadb_x_policy_type; /* See policy type of ipsec.h */ |
| 226 | u_int8_t sadb_x_policy_dir; /* direction, see ipsec.h */ |
| 227 | u_int8_t sadb_x_policy_reserved; |
| 228 | u_int32_t sadb_x_policy_id; |
| 229 | u_int32_t sadb_x_policy_reserved2; |
| 230 | }; |
| 231 | /* |
| 232 | * When policy_type == IPSEC, it is followed by some of |
| 233 | * the ipsec policy request. |
| 234 | * [total length of ipsec policy requests] |
| 235 | * = (sadb_x_policy_len * sizeof(uint64_t) - sizeof(struct sadb_x_policy)) |
| 236 | */ |
| 237 | |
| 238 | /* XXX IPsec Policy Request Extension */ |
| 239 | /* |
| 240 | * This structure is aligned 8 bytes. |
| 241 | */ |
| 242 | struct sadb_x_ipsecrequest { |
| 243 | u_int16_t sadb_x_ipsecrequest_len; /* structure length aligned to 8 bytes. |
| 244 | * This value is true length of bytes. |
| 245 | * Not in units of 64 bits. */ |
| 246 | u_int16_t sadb_x_ipsecrequest_proto; /* See ipsec.h */ |
| 247 | u_int8_t sadb_x_ipsecrequest_mode; /* See IPSEC_MODE_XX in ipsec.h. */ |
| 248 | u_int8_t sadb_x_ipsecrequest_level; /* See IPSEC_LEVEL_XX in ipsec.h */ |
| 249 | u_int16_t sadb_x_ipsecrequest_reqid; /* See ipsec.h */ |
| 250 | |
| 251 | /* |
| 252 | * followed by source IP address of SA, and immediately followed by |
| 253 | * destination IP address of SA. These encoded into two of sockaddr |
| 254 | * structure without any padding. Must set each sa_len exactly. |
| 255 | * Each of length of the sockaddr structure are not aligned to 64bits, |
| 256 | * but sum of x_request and addresses is aligned to 64bits. |
| 257 | */ |
| 258 | }; |
| 259 | |
| 260 | #define SADB_EXT_RESERVED 0 |
| 261 | #define SADB_EXT_SA 1 |
| 262 | #define SADB_EXT_LIFETIME_CURRENT 2 |
| 263 | #define SADB_EXT_LIFETIME_HARD 3 |
| 264 | #define SADB_EXT_LIFETIME_SOFT 4 |
| 265 | #define SADB_EXT_ADDRESS_SRC 5 |
| 266 | #define SADB_EXT_ADDRESS_DST 6 |
| 267 | #define SADB_EXT_ADDRESS_PROXY 7 |
| 268 | #define SADB_EXT_KEY_AUTH 8 |
| 269 | #define SADB_EXT_KEY_ENCRYPT 9 |
| 270 | #define SADB_EXT_IDENTITY_SRC 10 |
| 271 | #define SADB_EXT_IDENTITY_DST 11 |
| 272 | #define SADB_EXT_SENSITIVITY 12 |
| 273 | #define SADB_EXT_PROPOSAL 13 |
| 274 | #define SADB_EXT_SUPPORTED_AUTH 14 |
| 275 | #define SADB_EXT_SUPPORTED_ENCRYPT 15 |
| 276 | #define SADB_EXT_SPIRANGE 16 |
| 277 | #define SADB_X_EXT_KMPRIVATE 17 |
| 278 | #define SADB_X_EXT_POLICY 18 |
| 279 | #define SADB_X_EXT_SA2 19 |
| 280 | #define SADB_EXT_MAX 19 |
| 281 | |
| 282 | #define SADB_SATYPE_UNSPEC 0 |
| 283 | #define SADB_SATYPE_AH 2 |
| 284 | #define SADB_SATYPE_ESP 3 |
| 285 | #define SADB_SATYPE_RSVP 5 |
| 286 | #define SADB_SATYPE_OSPFV2 6 |
| 287 | #define SADB_SATYPE_RIPV2 7 |
| 288 | #define SADB_SATYPE_MIP 8 |
| 289 | #define SADB_X_SATYPE_IPCOMP 9 |
| 290 | #define SADB_X_SATYPE_POLICY 10 |
| 291 | #define SADB_SATYPE_MAX 11 |
| 292 | |
| 293 | #define SADB_SASTATE_LARVAL 0 |
| 294 | #define SADB_SASTATE_MATURE 1 |
| 295 | #define SADB_SASTATE_DYING 2 |
| 296 | #define SADB_SASTATE_DEAD 3 |
| 297 | #define SADB_SASTATE_MAX 3 |
| 298 | |
| 299 | #define SADB_SAFLAGS_PFS 1 |
| 300 | |
| 301 | /* RFC2367 numbers - meets RFC2407 */ |
| 302 | #define SADB_AALG_NONE 0 |
| 303 | #define SADB_AALG_MD5HMAC 1 /*2*/ |
| 304 | #define SADB_AALG_SHA1HMAC 2 /*3*/ |
| 305 | #define SADB_AALG_MAX 8 |
| 306 | /* private allocations - based on RFC2407/IANA assignment */ |
| 307 | #define SADB_X_AALG_SHA2_256 6 /*5*/ |
| 308 | #define SADB_X_AALG_SHA2_384 7 /*6*/ |
| 309 | #define SADB_X_AALG_SHA2_512 8 /*7*/ |
| 310 | #define SADB_X_AALG_RIPEMD160HMAC 9 /*8*/ |
| 311 | /* private allocations should use 249-255 (RFC2407) */ |
| 312 | #define SADB_X_AALG_MD5 3 /*249*/ /* Keyed MD5 */ |
| 313 | #define SADB_X_AALG_SHA 4 /*250*/ /* Keyed SHA */ |
| 314 | #define SADB_X_AALG_NULL 5 /*251*/ /* null authentication */ |
| 315 | |
| 316 | /* RFC2367 numbers - meets RFC2407 */ |
| 317 | #define SADB_EALG_NONE 0 |
| 318 | #define SADB_EALG_DESCBC 1 /*2*/ |
| 319 | #define SADB_EALG_3DESCBC 2 /*3*/ |
| 320 | #define SADB_EALG_NULL 3 /*11*/ |
| 321 | #define SADB_EALG_MAX 12 |
| 322 | /* private allocations - based on RFC2407/IANA assignment */ |
| 323 | #define SADB_X_EALG_CAST128CBC 5 /*6*/ |
| 324 | #define SADB_X_EALG_BLOWFISHCBC 4 /*7*/ |
| 325 | #define SADB_X_EALG_RIJNDAELCBC 12 |
| 326 | #define SADB_X_EALG_AES 12 |
| 327 | /* private allocations should use 249-255 (RFC2407) */ |
| 328 | #define SADB_X_EALG_SKIPJACK 249 |
| 329 | |
| 330 | #if 1 /*nonstandard */ |
| 331 | #define SADB_X_CALG_NONE 0 |
| 332 | #define SADB_X_CALG_OUI 1 |
| 333 | #define SADB_X_CALG_DEFLATE 2 |
| 334 | #define SADB_X_CALG_LZS 3 |
| 335 | #define SADB_X_CALG_MAX 4 |
| 336 | #endif |
| 337 | |
| 338 | #define SADB_IDENTTYPE_RESERVED 0 |
| 339 | #define SADB_IDENTTYPE_PREFIX 1 |
| 340 | #define SADB_IDENTTYPE_FQDN 2 |
| 341 | #define SADB_IDENTTYPE_USERFQDN 3 |
| 342 | #define SADB_X_IDENTTYPE_ADDR 4 |
| 343 | #define SADB_IDENTTYPE_MAX 4 |
| 344 | |
| 345 | /* `flags' in sadb_sa structure holds followings */ |
| 346 | #define SADB_X_EXT_NONE 0x0000 /* i.e. new format. */ |
| 347 | #define SADB_X_EXT_OLD 0x0001 /* old format. */ |
| 348 | |
| 349 | #define SADB_X_EXT_IV4B 0x0010 /* IV length of 4 bytes in use */ |
| 350 | #define SADB_X_EXT_DERIV 0x0020 /* DES derived */ |
| 351 | #define SADB_X_EXT_CYCSEQ 0x0040 /* allowing to cyclic sequence. */ |
| 352 | |
| 353 | /* three of followings are exclusive flags each them */ |
| 354 | #define SADB_X_EXT_PSEQ 0x0000 /* sequencial padding for ESP */ |
| 355 | #define SADB_X_EXT_PRAND 0x0100 /* random padding for ESP */ |
| 356 | #define SADB_X_EXT_PZERO 0x0200 /* zero padding for ESP */ |
| 357 | #define SADB_X_EXT_PMASK 0x0300 /* mask for padding flag */ |
| 358 | |
| 359 | #if 1 |
| 360 | #define SADB_X_EXT_RAWCPI 0x0080 /* use well known CPI (IPComp) */ |
| 361 | #endif |
| 362 | |
| 363 | #define SADB_KEY_FLAGS_MAX 0x0fff |
| 364 | |
| 365 | /* SPI size for PF_KEYv2 */ |
| 366 | #define PFKEY_SPI_SIZE sizeof(u_int32_t) |
| 367 | |
| 368 | /* Identifier for menber of lifetime structure */ |
| 369 | #define SADB_X_LIFETIME_ALLOCATIONS 0 |
| 370 | #define SADB_X_LIFETIME_BYTES 1 |
| 371 | #define SADB_X_LIFETIME_ADDTIME 2 |
| 372 | #define SADB_X_LIFETIME_USETIME 3 |
| 373 | |
| 374 | /* The rate for SOFT lifetime against HARD one. */ |
| 375 | #define PFKEY_SOFT_LIFETIME_RATE 80 |
| 376 | |
| 377 | /* Utilities */ |
| 378 | #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1))) |
| 379 | #define PFKEY_EXTLEN(msg) \ |
| 380 | PFKEY_UNUNIT64(((struct sadb_ext *)(msg))->sadb_ext_len) |
| 381 | #define PFKEY_ADDR_PREFIX(ext) \ |
| 382 | (((struct sadb_address *)(ext))->sadb_address_prefixlen) |
| 383 | #define PFKEY_ADDR_PROTO(ext) \ |
| 384 | (((struct sadb_address *)(ext))->sadb_address_proto) |
| 385 | #define PFKEY_ADDR_SADDR(ext) \ |
| 386 | ((struct sockaddr *)((caddr_t)(ext) + sizeof(struct sadb_address))) |
| 387 | |
| 388 | /* in 64bits */ |
| 389 | #define PFKEY_UNUNIT64(a) ((a) << 3) |
| 390 | #define PFKEY_UNIT64(a) ((a) >> 3) |
| 391 | |
| 392 | #endif /* __PFKEY_V2_H */ |
| 393 | |
| 394 | #endif /* _NET_PFKEYV2_H_ */ |