474 lines
15 KiB
C
474 lines
15 KiB
C
/* $OpenBSD: pfkeyv2.h,v 1.95 2024/05/13 01:15:53 jsg Exp $ */
|
|
/*
|
|
* @(#)COPYRIGHT 1.1 (NRL) January 1998
|
|
*
|
|
* NRL grants permission for redistribution and use in source and binary
|
|
* forms, with or without modification, of the software and documentation
|
|
* created at NRL provided that the following conditions are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
* must display the following acknowledgements:
|
|
* This product includes software developed by the University of
|
|
* California, Berkeley and its contributors.
|
|
* This product includes software developed at the Information
|
|
* Technology Division, US Naval Research Laboratory.
|
|
* 4. Neither the name of the NRL nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
|
|
* IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
|
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
|
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
|
|
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
|
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
|
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
|
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
|
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* The views and conclusions contained in the software and documentation
|
|
* are those of the authors and should not be interpreted as representing
|
|
* official policies, either expressed or implied, of the US Naval
|
|
* Research Laboratory (NRL).
|
|
*/
|
|
|
|
#ifndef _NET_PFKEY_V2_H_
|
|
#define _NET_PFKEY_V2_H_
|
|
|
|
#define PF_KEY_V2 2
|
|
#define PFKEYV2_REVISION 199806L
|
|
|
|
/* This should be updated whenever the API is altered. */
|
|
#define _OPENBSD_IPSEC_API_VERSION 2
|
|
|
|
#define SADB_RESERVED 0
|
|
#define SADB_GETSPI 1
|
|
#define SADB_UPDATE 2
|
|
#define SADB_ADD 3
|
|
#define SADB_DELETE 4
|
|
#define SADB_GET 5
|
|
#define SADB_ACQUIRE 6
|
|
#define SADB_REGISTER 7
|
|
#define SADB_EXPIRE 8
|
|
#define SADB_FLUSH 9
|
|
#define SADB_DUMP 10
|
|
#define SADB_X_PROMISC 11
|
|
#define SADB_X_ADDFLOW 12
|
|
#define SADB_X_DELFLOW 13
|
|
#define SADB_X_GRPSPIS 14
|
|
#define SADB_X_ASKPOLICY 15
|
|
#define SADB_X_SPDDUMP 16
|
|
#define SADB_MAX 16
|
|
|
|
struct sadb_msg {
|
|
uint8_t sadb_msg_version;
|
|
uint8_t sadb_msg_type;
|
|
uint8_t sadb_msg_errno;
|
|
uint8_t sadb_msg_satype;
|
|
uint16_t sadb_msg_len;
|
|
uint16_t sadb_msg_reserved;
|
|
uint32_t sadb_msg_seq;
|
|
uint32_t sadb_msg_pid;
|
|
};
|
|
|
|
struct sadb_ext {
|
|
uint16_t sadb_ext_len;
|
|
uint16_t sadb_ext_type;
|
|
};
|
|
|
|
struct sadb_sa {
|
|
uint16_t sadb_sa_len;
|
|
uint16_t sadb_sa_exttype;
|
|
uint32_t sadb_sa_spi;
|
|
uint8_t sadb_sa_replay;
|
|
uint8_t sadb_sa_state;
|
|
uint8_t sadb_sa_auth;
|
|
uint8_t sadb_sa_encrypt;
|
|
uint32_t sadb_sa_flags;
|
|
};
|
|
|
|
struct sadb_lifetime {
|
|
uint16_t sadb_lifetime_len;
|
|
uint16_t sadb_lifetime_exttype;
|
|
uint32_t sadb_lifetime_allocations;
|
|
uint64_t sadb_lifetime_bytes;
|
|
uint64_t sadb_lifetime_addtime;
|
|
uint64_t sadb_lifetime_usetime;
|
|
};
|
|
|
|
struct sadb_address {
|
|
uint16_t sadb_address_len;
|
|
uint16_t sadb_address_exttype;
|
|
uint32_t sadb_address_reserved;
|
|
};
|
|
|
|
struct sadb_key {
|
|
uint16_t sadb_key_len;
|
|
uint16_t sadb_key_exttype;
|
|
uint16_t sadb_key_bits;
|
|
uint16_t sadb_key_reserved;
|
|
};
|
|
|
|
struct sadb_ident {
|
|
uint16_t sadb_ident_len;
|
|
uint16_t sadb_ident_exttype;
|
|
uint16_t sadb_ident_type;
|
|
uint16_t sadb_ident_reserved;
|
|
uint64_t sadb_ident_id;
|
|
};
|
|
|
|
struct sadb_sens {
|
|
uint16_t sadb_sens_len;
|
|
uint16_t sadb_sens_exttype;
|
|
uint32_t sadb_sens_dpd;
|
|
uint8_t sadb_sens_sens_level;
|
|
uint8_t sadb_sens_sens_len;
|
|
uint8_t sadb_sens_integ_level;
|
|
uint8_t sadb_sens_integ_len;
|
|
uint32_t sadb_sens_reserved;
|
|
};
|
|
|
|
struct sadb_prop {
|
|
uint16_t sadb_prop_len;
|
|
uint16_t sadb_prop_exttype;
|
|
uint8_t sadb_prop_num;
|
|
uint8_t sadb_prop_replay;
|
|
uint16_t sadb_prop_reserved;
|
|
};
|
|
|
|
struct sadb_comb {
|
|
uint8_t sadb_comb_auth;
|
|
uint8_t sadb_comb_encrypt;
|
|
uint16_t sadb_comb_flags;
|
|
uint16_t sadb_comb_auth_minbits;
|
|
uint16_t sadb_comb_auth_maxbits;
|
|
uint16_t sadb_comb_encrypt_minbits;
|
|
uint16_t sadb_comb_encrypt_maxbits;
|
|
uint32_t sadb_comb_reserved;
|
|
uint32_t sadb_comb_soft_allocations;
|
|
uint32_t sadb_comb_hard_allocations;
|
|
uint64_t sadb_comb_soft_bytes;
|
|
uint64_t sadb_comb_hard_bytes;
|
|
uint64_t sadb_comb_soft_addtime;
|
|
uint64_t sadb_comb_hard_addtime;
|
|
uint64_t sadb_comb_soft_usetime;
|
|
uint64_t sadb_comb_hard_usetime;
|
|
};
|
|
|
|
struct sadb_supported {
|
|
uint16_t sadb_supported_len;
|
|
uint16_t sadb_supported_exttype;
|
|
uint32_t sadb_supported_reserved;
|
|
};
|
|
|
|
struct sadb_alg {
|
|
uint8_t sadb_alg_id;
|
|
uint8_t sadb_alg_ivlen;
|
|
uint16_t sadb_alg_minbits;
|
|
uint16_t sadb_alg_maxbits;
|
|
uint16_t sadb_alg_reserved;
|
|
};
|
|
|
|
struct sadb_spirange {
|
|
uint16_t sadb_spirange_len;
|
|
uint16_t sadb_spirange_exttype;
|
|
uint32_t sadb_spirange_min;
|
|
uint32_t sadb_spirange_max;
|
|
uint32_t sadb_spirange_reserved;
|
|
};
|
|
|
|
struct sadb_protocol {
|
|
uint16_t sadb_protocol_len;
|
|
uint16_t sadb_protocol_exttype;
|
|
uint8_t sadb_protocol_proto;
|
|
uint8_t sadb_protocol_direction;
|
|
uint8_t sadb_protocol_flags;
|
|
uint8_t sadb_protocol_reserved2;
|
|
};
|
|
|
|
struct sadb_x_policy {
|
|
uint16_t sadb_x_policy_len;
|
|
uint16_t sadb_x_policy_exttype;
|
|
uint32_t sadb_x_policy_seq;
|
|
};
|
|
|
|
struct sadb_x_udpencap {
|
|
uint16_t sadb_x_udpencap_len;
|
|
uint16_t sadb_x_udpencap_exttype;
|
|
uint16_t sadb_x_udpencap_port;
|
|
uint16_t sadb_x_udpencap_reserved;
|
|
};
|
|
|
|
struct sadb_x_tag {
|
|
uint16_t sadb_x_tag_len;
|
|
uint16_t sadb_x_tag_exttype;
|
|
uint32_t sadb_x_tag_taglen;
|
|
};
|
|
|
|
struct sadb_x_replay {
|
|
uint16_t sadb_x_replay_len;
|
|
uint16_t sadb_x_replay_exttype;
|
|
uint32_t sadb_x_replay_reserved;
|
|
uint64_t sadb_x_replay_count;
|
|
};
|
|
|
|
struct sadb_x_rdomain {
|
|
uint16_t sadb_x_rdomain_len;
|
|
uint16_t sadb_x_rdomain_exttype;
|
|
uint16_t sadb_x_rdomain_dom1;
|
|
uint16_t sadb_x_rdomain_dom2;
|
|
};
|
|
|
|
struct sadb_x_tap {
|
|
uint16_t sadb_x_tap_len;
|
|
uint16_t sadb_x_tap_exttype;
|
|
uint32_t sadb_x_tap_unit;
|
|
};
|
|
|
|
struct sadb_x_counter {
|
|
uint16_t sadb_x_counter_len;
|
|
uint16_t sadb_x_counter_exttype;
|
|
uint32_t sadb_x_counter_pad;
|
|
uint64_t sadb_x_counter_ipackets; /* Input IPsec packets */
|
|
uint64_t sadb_x_counter_opackets; /* Output IPsec packets */
|
|
uint64_t sadb_x_counter_ibytes; /* Input bytes */
|
|
uint64_t sadb_x_counter_obytes; /* Output bytes */
|
|
uint64_t sadb_x_counter_idrops; /* Dropped on input */
|
|
uint64_t sadb_x_counter_odrops; /* Dropped on output */
|
|
uint64_t sadb_x_counter_idecompbytes; /* Input bytes, decompressed */
|
|
uint64_t sadb_x_counter_ouncompbytes; /* Output bytes, uncompressed */
|
|
};
|
|
|
|
struct sadb_x_mtu {
|
|
uint16_t sadb_x_mtu_len;
|
|
uint16_t sadb_x_mtu_exttype;
|
|
uint32_t sadb_x_mtu_mtu;
|
|
};
|
|
|
|
struct sadb_x_iface {
|
|
uint16_t sadb_x_iface_len;
|
|
uint16_t sadb_x_iface_exttype;
|
|
uint32_t sadb_x_iface_unit;
|
|
uint8_t sadb_x_iface_direction;
|
|
uint8_t sadb_x_iface_reserved[7];
|
|
};
|
|
|
|
#ifdef _KERNEL
|
|
#define SADB_X_GETSPROTO(x) \
|
|
( (x) == SADB_SATYPE_AH ? IPPROTO_AH :\
|
|
(x) == SADB_SATYPE_ESP ? IPPROTO_ESP :\
|
|
(x) == SADB_X_SATYPE_TCPSIGNATURE ? IPPROTO_TCP :\
|
|
(x) == SADB_X_SATYPE_IPCOMP ? IPPROTO_IPCOMP: IPPROTO_IPIP )
|
|
#endif
|
|
|
|
#define SADB_EXT_RESERVED 0
|
|
#define SADB_EXT_SA 1
|
|
#define SADB_EXT_LIFETIME_CURRENT 2
|
|
#define SADB_EXT_LIFETIME_HARD 3
|
|
#define SADB_EXT_LIFETIME_SOFT 4
|
|
#define SADB_EXT_ADDRESS_SRC 5
|
|
#define SADB_EXT_ADDRESS_DST 6
|
|
#define SADB_EXT_ADDRESS_PROXY 7
|
|
#define SADB_EXT_KEY_AUTH 8
|
|
#define SADB_EXT_KEY_ENCRYPT 9
|
|
#define SADB_EXT_IDENTITY_SRC 10
|
|
#define SADB_EXT_IDENTITY_DST 11
|
|
#define SADB_EXT_SENSITIVITY 12
|
|
#define SADB_EXT_PROPOSAL 13
|
|
#define SADB_EXT_SUPPORTED_AUTH 14
|
|
#define SADB_EXT_SUPPORTED_ENCRYPT 15
|
|
#define SADB_EXT_SPIRANGE 16
|
|
#define SADB_X_EXT_SRC_MASK 17
|
|
#define SADB_X_EXT_DST_MASK 18
|
|
#define SADB_X_EXT_PROTOCOL 19
|
|
#define SADB_X_EXT_FLOW_TYPE 20
|
|
#define SADB_X_EXT_SRC_FLOW 21
|
|
#define SADB_X_EXT_DST_FLOW 22
|
|
#define SADB_X_EXT_SA2 23
|
|
#define SADB_X_EXT_DST2 24
|
|
#define SADB_X_EXT_POLICY 25
|
|
#define SADB_X_EXT_LOCAL_CREDENTIALS 26
|
|
#define SADB_X_EXT_REMOTE_CREDENTIALS 27
|
|
#define SADB_X_EXT_LOCAL_AUTH 28
|
|
#define SADB_X_EXT_REMOTE_AUTH 29
|
|
#define SADB_X_EXT_SUPPORTED_COMP 30
|
|
#define SADB_X_EXT_UDPENCAP 31
|
|
#define SADB_X_EXT_LIFETIME_LASTUSE 32
|
|
#define SADB_X_EXT_TAG 33
|
|
#define SADB_X_EXT_TAP 34
|
|
#define SADB_X_EXT_SATYPE2 35
|
|
#define SADB_X_EXT_COUNTER 36
|
|
#define SADB_X_EXT_RDOMAIN 37
|
|
#define SADB_X_EXT_MTU 38
|
|
#define SADB_X_EXT_REPLAY 39
|
|
#define SADB_X_EXT_IFACE 40
|
|
#define SADB_EXT_MAX 40
|
|
|
|
/* Fix pfkeyv2.c struct pfkeyv2_socket if SATYPE_MAX > 31 */
|
|
#define SADB_SATYPE_UNSPEC 0
|
|
#define SADB_SATYPE_AH 1
|
|
#define SADB_SATYPE_ESP 2
|
|
#define SADB_SATYPE_RSVP 3
|
|
#define SADB_SATYPE_OSPFV2 4
|
|
#define SADB_SATYPE_RIPV2 5
|
|
#define SADB_SATYPE_MIP 6
|
|
#define SADB_X_SATYPE_IPIP 7
|
|
#define SADB_X_SATYPE_TCPSIGNATURE 8
|
|
#define SADB_X_SATYPE_IPCOMP 9
|
|
#define SADB_SATYPE_MAX 9
|
|
|
|
#define SADB_SASTATE_LARVAL 0
|
|
#define SADB_SASTATE_MATURE 1
|
|
#define SADB_SASTATE_DYING 2
|
|
#define SADB_SASTATE_DEAD 3
|
|
#define SADB_SASTATE_MAX 3
|
|
|
|
#define SADB_AALG_NONE 0
|
|
#define SADB_AALG_MD5HMAC 2
|
|
#define SADB_AALG_SHA1HMAC 3
|
|
#define SADB_X_AALG_SHA2_256 5
|
|
#define SADB_X_AALG_SHA2_384 6
|
|
#define SADB_X_AALG_SHA2_512 7
|
|
#define SADB_X_AALG_RIPEMD160HMAC 8
|
|
#define SADB_X_AALG_AES128GMAC 9
|
|
#define SADB_X_AALG_AES192GMAC 10
|
|
#define SADB_X_AALG_AES256GMAC 11
|
|
#define SADB_X_AALG_CHACHA20POLY1305 12
|
|
#define SADB_AALG_MAX 12
|
|
|
|
#define SADB_EALG_NONE 0
|
|
#define SADB_EALG_3DESCBC 3
|
|
#define SADB_X_EALG_CAST 6
|
|
#define SADB_X_EALG_BLF 7
|
|
#define SADB_EALG_NULL 11
|
|
#define SADB_X_EALG_AES 12
|
|
#define SADB_X_EALG_AESCTR 13
|
|
#define SADB_X_EALG_AESGCM8 18
|
|
#define SADB_X_EALG_AESGCM12 19
|
|
#define SADB_X_EALG_AESGCM16 20
|
|
#define SADB_X_EALG_AESGMAC 21
|
|
#define SADB_X_EALG_CHACHA20POLY1305 22
|
|
#define SADB_EALG_MAX 22
|
|
|
|
#define SADB_X_CALG_NONE 0
|
|
#define SADB_X_CALG_OUI 1
|
|
#define SADB_X_CALG_DEFLATE 2
|
|
#define SADB_X_CALG_MAX 2
|
|
|
|
#define SADB_SAFLAGS_PFS 0x001 /* perfect forward secrecy */
|
|
#define SADB_X_SAFLAGS_TUNNEL 0x004 /* Force tunneling */
|
|
#define SADB_X_SAFLAGS_CHAINDEL 0x008 /* Delete whole SA chain */
|
|
#define SADB_X_SAFLAGS_UDPENCAP 0x200 /* ESP in UDP */
|
|
#define SADB_X_SAFLAGS_ESN 0x400 /* Extended Sequence Number */
|
|
|
|
#define SADB_X_POLICYFLAGS_POLICY 0x0001 /* This is a static policy */
|
|
|
|
#define SADB_IDENTTYPE_RESERVED 0
|
|
#define SADB_IDENTTYPE_PREFIX 1
|
|
#define SADB_IDENTTYPE_FQDN 2
|
|
#define SADB_IDENTTYPE_USERFQDN 3
|
|
#define SADB_IDENTTYPE_ASN1_DN 4
|
|
#define SADB_IDENTTYPE_MAX 4
|
|
|
|
#define SADB_KEY_FLAGS_MAX 0
|
|
|
|
#ifdef _KERNEL
|
|
#define PFKEYV2_LIFETIME_HARD 0
|
|
#define PFKEYV2_LIFETIME_SOFT 1
|
|
#define PFKEYV2_LIFETIME_CURRENT 2
|
|
#define PFKEYV2_LIFETIME_LASTUSE 3
|
|
|
|
#define PFKEYV2_IDENTITY_SRC 0
|
|
#define PFKEYV2_IDENTITY_DST 1
|
|
|
|
#define PFKEYV2_ENCRYPTION_KEY 0
|
|
#define PFKEYV2_AUTHENTICATION_KEY 1
|
|
|
|
#define PFKEYV2_SOCKETFLAGS_REGISTERED 1
|
|
#define PFKEYV2_SOCKETFLAGS_PROMISC 2
|
|
|
|
#define PFKEYV2_SENDMESSAGE_UNICAST 1
|
|
#define PFKEYV2_SENDMESSAGE_REGISTERED 2
|
|
#define PFKEYV2_SENDMESSAGE_BROADCAST 3
|
|
#endif /* _KERNEL */
|
|
|
|
#define SADB_X_FLOW_TYPE_USE 1
|
|
#define SADB_X_FLOW_TYPE_ACQUIRE 2
|
|
#define SADB_X_FLOW_TYPE_REQUIRE 3
|
|
#define SADB_X_FLOW_TYPE_BYPASS 4
|
|
#define SADB_X_FLOW_TYPE_DENY 5
|
|
#define SADB_X_FLOW_TYPE_DONTACQ 6
|
|
|
|
#ifdef _KERNEL
|
|
struct tdb;
|
|
struct socket;
|
|
struct mbuf;
|
|
|
|
#define EXTLEN(x) (((struct sadb_ext *)(x))->sadb_ext_len * sizeof(uint64_t))
|
|
#define PADUP(x) (((x) + sizeof(uint64_t) - 1) & ~(sizeof(uint64_t) - 1))
|
|
|
|
int pfkeyv2_parsemessage(void *, int, void **);
|
|
int pfkeyv2_expire(struct tdb *, u_int16_t);
|
|
int pfkeyv2_acquire(struct ipsec_policy *, union sockaddr_union *,
|
|
union sockaddr_union *, u_int32_t *, struct sockaddr_encap *);
|
|
|
|
int pfkeyv2_get(struct tdb *, void **, void **, int *, int *);
|
|
int pfkeyv2_policy(struct ipsec_acquire *, void **, void **, int *);
|
|
int pfkeyv2_dosend(struct socket *, void *, int);
|
|
int pfkeyv2_sendmessage(void **, int, struct socket *, u_int8_t, int, u_int);
|
|
int pfkeyv2_dump_policy(struct ipsec_policy *, void **, void **, int *);
|
|
int pfkeyv2_dump_walker(struct tdb *, void *, int);
|
|
int pfkeyv2_get_proto_alg(u_int8_t, u_int8_t *, int *);
|
|
int pfkeyv2_sysctl(int *, u_int, void *, size_t *, void *, size_t);
|
|
int pfkeyv2_sysctl_walker(struct tdb *, void *, int);
|
|
|
|
int pfdatatopacket(void *, int, struct mbuf **);
|
|
|
|
void export_address(void **, struct sockaddr *);
|
|
void export_identities(void **, struct ipsec_ids *, int, void **);
|
|
void export_lifetime(void **, struct tdb *, int);
|
|
void export_sa(void **, struct tdb *);
|
|
void export_flow(void **, u_int8_t, struct sockaddr_encap *,
|
|
struct sockaddr_encap *, void **);
|
|
void export_key(void **, struct tdb *, int);
|
|
void export_udpencap(void **, struct tdb *);
|
|
void export_tag(void **, struct tdb *);
|
|
void export_replay(void **, struct tdb *);
|
|
void export_rdomain(void **, struct tdb *);
|
|
void export_mtu(void **, struct tdb *);
|
|
void export_tap(void **, struct tdb *);
|
|
void export_satype(void **, struct tdb *);
|
|
void export_counter(void **, struct tdb *);
|
|
void export_iface(void **, struct tdb *);
|
|
|
|
void import_address(struct sockaddr *, struct sadb_address *);
|
|
void import_identities(struct ipsec_ids **, int, struct sadb_ident *,
|
|
struct sadb_ident *);
|
|
void import_key(struct ipsecinit *, struct sadb_key *, int);
|
|
void import_lifetime(struct tdb *, struct sadb_lifetime *, int);
|
|
void import_sa(struct tdb *, struct sadb_sa *, struct ipsecinit *);
|
|
int import_flow(struct sockaddr_encap *, struct sockaddr_encap *,
|
|
struct sadb_address *, struct sadb_address *, struct sadb_address *,
|
|
struct sadb_address *, struct sadb_protocol *, struct sadb_protocol *);
|
|
void import_udpencap(struct tdb *, struct sadb_x_udpencap *);
|
|
void import_tag(struct tdb *, struct sadb_x_tag *);
|
|
void import_rdomain(struct tdb *, struct sadb_x_rdomain *);
|
|
void import_tap(struct tdb *, struct sadb_x_tap *);
|
|
void import_iface(struct tdb *, struct sadb_x_iface *);
|
|
|
|
extern const uint64_t sadb_exts_allowed_out[SADB_MAX+1];
|
|
extern const uint64_t sadb_exts_required_out[SADB_MAX+1];
|
|
|
|
extern struct pool ipsec_policy_pool;
|
|
extern struct pool ipsec_acquire_pool;
|
|
#endif /* _KERNEL */
|
|
|
|
#endif /* _NET_PFKEY_V2_H_ */
|