Annotation of src/sys/net/pfkeyv2.h, Revision 1.29
1.29 ! drochner 1: /* $NetBSD: pfkeyv2.h,v 1.28 2011/05/05 17:46:48 drochner Exp $ */
1.14 itojun 2: /* $KAME: pfkeyv2.h,v 1.36 2003/07/25 09:33:37 itojun Exp $ */
1.3 itojun 3:
4: /*
5: * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6: * All rights reserved.
1.5 itojun 7: *
1.3 itojun 8: * Redistribution and use in source and binary forms, with or without
9: * modification, are permitted provided that the following conditions
10: * are met:
11: * 1. Redistributions of source code must retain the above copyright
12: * notice, this list of conditions and the following disclaimer.
13: * 2. Redistributions in binary form must reproduce the above copyright
14: * notice, this list of conditions and the following disclaimer in the
15: * documentation and/or other materials provided with the distribution.
16: * 3. Neither the name of the project nor the names of its contributors
17: * may be used to endorse or promote products derived from this software
18: * without specific prior written permission.
1.5 itojun 19: *
1.3 itojun 20: * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23: * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30: * SUCH DAMAGE.
31: */
32:
1.4 itojun 33: /*
34: * This file has been derived rfc 2367,
35: * And added some flags of SADB_KEY_FLAGS_ as SADB_X_EXT_.
36: * sakane@ydc.co.jp
37: */
38:
1.3 itojun 39: #ifndef _NET_PFKEYV2_H_
40: #define _NET_PFKEYV2_H_
41:
1.4 itojun 42: /*
43: This file defines structures and symbols for the PF_KEY Version 2
44: key management interface. It was written at the U.S. Naval Research
45: Laboratory. This file is in the public domain. The authors ask that
46: you leave this credit intact on any copies of this file.
47: */
48: #ifndef __PFKEY_V2_H
49: #define __PFKEY_V2_H 1
50:
51: #define PF_KEY_V2 2
52: #define PFKEYV2_REVISION 199806L
53:
54: #define SADB_RESERVED 0
55: #define SADB_GETSPI 1
56: #define SADB_UPDATE 2
57: #define SADB_ADD 3
58: #define SADB_DELETE 4
59: #define SADB_GET 5
60: #define SADB_ACQUIRE 6
61: #define SADB_REGISTER 7
62: #define SADB_EXPIRE 8
63: #define SADB_FLUSH 9
64: #define SADB_DUMP 10
65: #define SADB_X_PROMISC 11
66: #define SADB_X_PCHANGE 12
67:
1.5 itojun 68: #define SADB_X_SPDUPDATE 13
1.4 itojun 69: #define SADB_X_SPDADD 14
1.5 itojun 70: #define SADB_X_SPDDELETE 15 /* by policy index */
71: #define SADB_X_SPDGET 16
72: #define SADB_X_SPDACQUIRE 17
1.4 itojun 73: #define SADB_X_SPDDUMP 18
74: #define SADB_X_SPDFLUSH 19
1.5 itojun 75: #define SADB_X_SPDSETIDX 20
1.4 itojun 76: #define SADB_X_SPDEXPIRE 21 /* not yet */
1.5 itojun 77: #define SADB_X_SPDDELETE2 22 /* by policy id */
1.19 manu 78: #define SADB_X_NAT_T_NEW_MAPPING 23
1.23 yamt 79: #if 0
1.24 yamt 80: #define SADB_X_MIGRATE 24 /* KAME */
1.23 yamt 81: #endif
1.19 manu 82: #define SADB_MAX 23
1.4 itojun 83:
84: struct sadb_msg {
1.26 matt 85: uint8_t sadb_msg_version;
86: uint8_t sadb_msg_type;
87: uint8_t sadb_msg_errno;
88: uint8_t sadb_msg_satype;
89: uint16_t sadb_msg_len;
90: uint16_t sadb_msg_reserved;
91: uint32_t sadb_msg_seq;
92: uint32_t sadb_msg_pid;
1.4 itojun 93: };
94:
95: struct sadb_ext {
1.26 matt 96: uint16_t sadb_ext_len;
97: uint16_t sadb_ext_type;
1.4 itojun 98: };
99:
100: struct sadb_sa {
1.26 matt 101: uint16_t sadb_sa_len;
102: uint16_t sadb_sa_exttype;
103: uint32_t sadb_sa_spi;
104: uint8_t sadb_sa_replay;
105: uint8_t sadb_sa_state;
106: uint8_t sadb_sa_auth;
107: uint8_t sadb_sa_encrypt;
108: uint32_t sadb_sa_flags;
1.4 itojun 109: };
110:
111: struct sadb_lifetime {
1.26 matt 112: uint16_t sadb_lifetime_len;
113: uint16_t sadb_lifetime_exttype;
114: uint32_t sadb_lifetime_allocations;
115: uint64_t sadb_lifetime_bytes;
116: uint64_t sadb_lifetime_addtime;
117: uint64_t sadb_lifetime_usetime;
1.4 itojun 118: };
119:
120: struct sadb_address {
1.26 matt 121: uint16_t sadb_address_len;
122: uint16_t sadb_address_exttype;
123: uint8_t sadb_address_proto;
124: uint8_t sadb_address_prefixlen;
125: uint16_t sadb_address_reserved;
1.4 itojun 126: };
127:
128: struct sadb_key {
1.26 matt 129: uint16_t sadb_key_len;
130: uint16_t sadb_key_exttype;
131: uint16_t sadb_key_bits;
132: uint16_t sadb_key_reserved;
1.4 itojun 133: };
134:
135: struct sadb_ident {
1.26 matt 136: uint16_t sadb_ident_len;
137: uint16_t sadb_ident_exttype;
138: uint16_t sadb_ident_type;
139: uint16_t sadb_ident_reserved;
140: uint64_t sadb_ident_id;
1.4 itojun 141: };
142:
143: struct sadb_sens {
1.26 matt 144: uint16_t sadb_sens_len;
145: uint16_t sadb_sens_exttype;
146: uint32_t sadb_sens_dpd;
147: uint8_t sadb_sens_sens_level;
148: uint8_t sadb_sens_sens_len;
149: uint8_t sadb_sens_integ_level;
150: uint8_t sadb_sens_integ_len;
151: uint32_t sadb_sens_reserved;
1.4 itojun 152: };
153:
154: struct sadb_prop {
1.26 matt 155: uint16_t sadb_prop_len;
156: uint16_t sadb_prop_exttype;
157: uint8_t sadb_prop_replay;
158: uint8_t sadb_prop_reserved[3];
1.4 itojun 159: };
160:
161: struct sadb_comb {
1.26 matt 162: uint8_t sadb_comb_auth;
163: uint8_t sadb_comb_encrypt;
164: uint16_t sadb_comb_flags;
165: uint16_t sadb_comb_auth_minbits;
166: uint16_t sadb_comb_auth_maxbits;
167: uint16_t sadb_comb_encrypt_minbits;
168: uint16_t sadb_comb_encrypt_maxbits;
169: uint32_t sadb_comb_reserved;
170: uint32_t sadb_comb_soft_allocations;
171: uint32_t sadb_comb_hard_allocations;
172: uint64_t sadb_comb_soft_bytes;
173: uint64_t sadb_comb_hard_bytes;
174: uint64_t sadb_comb_soft_addtime;
175: uint64_t sadb_comb_hard_addtime;
176: uint64_t sadb_comb_soft_usetime;
177: uint64_t sadb_comb_hard_usetime;
1.4 itojun 178: };
179:
180: struct sadb_supported {
1.26 matt 181: uint16_t sadb_supported_len;
182: uint16_t sadb_supported_exttype;
183: uint32_t sadb_supported_reserved;
1.4 itojun 184: };
185:
186: struct sadb_alg {
1.26 matt 187: uint8_t sadb_alg_id;
188: uint8_t sadb_alg_ivlen;
189: uint16_t sadb_alg_minbits;
190: uint16_t sadb_alg_maxbits;
191: uint16_t sadb_alg_reserved;
1.4 itojun 192: };
193:
194: struct sadb_spirange {
1.26 matt 195: uint16_t sadb_spirange_len;
196: uint16_t sadb_spirange_exttype;
197: uint32_t sadb_spirange_min;
198: uint32_t sadb_spirange_max;
199: uint32_t sadb_spirange_reserved;
1.4 itojun 200: };
201:
202: struct sadb_x_kmprivate {
1.26 matt 203: uint16_t sadb_x_kmprivate_len;
204: uint16_t sadb_x_kmprivate_exttype;
205: uint32_t sadb_x_kmprivate_reserved;
1.4 itojun 206: };
207:
1.5 itojun 208: /*
209: * XXX Additional SA Extension.
210: * mode: tunnel or transport
211: * reqid: to make SA unique nevertheless the address pair of SA are same.
212: * Mainly it's for VPN.
213: */
214: struct sadb_x_sa2 {
1.26 matt 215: uint16_t sadb_x_sa2_len;
216: uint16_t sadb_x_sa2_exttype;
217: uint8_t sadb_x_sa2_mode;
218: uint8_t sadb_x_sa2_reserved1;
219: uint16_t sadb_x_sa2_reserved2;
220: uint32_t sadb_x_sa2_sequence;
221: uint32_t sadb_x_sa2_reqid; /* topmost 16bits are always 0 */
1.5 itojun 222: };
223:
1.4 itojun 224: /* XXX Policy Extension */
1.5 itojun 225: /* sizeof(struct sadb_x_policy) == 16 */
1.4 itojun 226: struct sadb_x_policy {
1.26 matt 227: uint16_t sadb_x_policy_len;
228: uint16_t sadb_x_policy_exttype;
229: uint16_t sadb_x_policy_type; /* See policy type of ipsec.h */
230: uint8_t sadb_x_policy_dir; /* direction, see ipsec.h */
231: uint8_t sadb_x_policy_reserved;
232: uint32_t sadb_x_policy_id;
233: uint32_t sadb_x_policy_reserved2;
1.4 itojun 234: };
235: /*
236: * When policy_type == IPSEC, it is followed by some of
237: * the ipsec policy request.
238: * [total length of ipsec policy requests]
239: * = (sadb_x_policy_len * sizeof(uint64_t) - sizeof(struct sadb_x_policy))
240: */
241:
242: /* XXX IPsec Policy Request Extension */
243: /*
244: * This structure is aligned 8 bytes.
245: */
246: struct sadb_x_ipsecrequest {
1.26 matt 247: uint16_t sadb_x_ipsecrequest_len; /* structure length in 64 bits. */
248: uint16_t sadb_x_ipsecrequest_proto; /* See ipsec.h */
249: uint8_t sadb_x_ipsecrequest_mode; /* See IPSEC_MODE_XX in ipsec.h. */
250: uint8_t sadb_x_ipsecrequest_level; /* See IPSEC_LEVEL_XX in ipsec.h */
251: uint16_t sadb_x_ipsecrequest_reqid; /* See ipsec.h */
1.4 itojun 252:
253: /*
254: * followed by source IP address of SA, and immediately followed by
255: * destination IP address of SA. These encoded into two of sockaddr
256: * structure without any padding. Must set each sa_len exactly.
257: * Each of length of the sockaddr structure are not aligned to 64bits,
258: * but sum of x_request and addresses is aligned to 64bits.
259: */
260: };
261:
1.19 manu 262: /* NAT traversal type, see draft-ietf-ipsec-udp-encaps-06 */
263: /* sizeof(struct sadb_x_nat_t_type) == 8 */
264: struct sadb_x_nat_t_type {
1.26 matt 265: uint16_t sadb_x_nat_t_type_len;
266: uint16_t sadb_x_nat_t_type_exttype;
267: uint8_t sadb_x_nat_t_type_type;
268: uint8_t sadb_x_nat_t_type_reserved[3];
1.19 manu 269: };
270:
271: /* NAT traversal source or destination port */
272: /* sizeof(struct sadb_x_nat_t_port) == 8 */
1.20 perry 273: struct sadb_x_nat_t_port {
1.26 matt 274: uint16_t sadb_x_nat_t_port_len;
275: uint16_t sadb_x_nat_t_port_exttype;
276: uint16_t sadb_x_nat_t_port_port;
277: uint16_t sadb_x_nat_t_port_reserved;
1.19 manu 278: };
279:
280: /* ESP fragmentation size */
281: /* sizeof(struct sadb_x_nat_t_frag) == 8 */
282: struct sadb_x_nat_t_frag {
1.26 matt 283: uint16_t sadb_x_nat_t_frag_len;
284: uint16_t sadb_x_nat_t_frag_exttype;
285: uint16_t sadb_x_nat_t_frag_fraglen;
286: uint16_t sadb_x_nat_t_frag_reserved;
1.19 manu 287: };
288:
289:
1.4 itojun 290: #define SADB_EXT_RESERVED 0
291: #define SADB_EXT_SA 1
292: #define SADB_EXT_LIFETIME_CURRENT 2
293: #define SADB_EXT_LIFETIME_HARD 3
294: #define SADB_EXT_LIFETIME_SOFT 4
295: #define SADB_EXT_ADDRESS_SRC 5
296: #define SADB_EXT_ADDRESS_DST 6
297: #define SADB_EXT_ADDRESS_PROXY 7
298: #define SADB_EXT_KEY_AUTH 8
299: #define SADB_EXT_KEY_ENCRYPT 9
300: #define SADB_EXT_IDENTITY_SRC 10
301: #define SADB_EXT_IDENTITY_DST 11
302: #define SADB_EXT_SENSITIVITY 12
303: #define SADB_EXT_PROPOSAL 13
304: #define SADB_EXT_SUPPORTED_AUTH 14
305: #define SADB_EXT_SUPPORTED_ENCRYPT 15
306: #define SADB_EXT_SPIRANGE 16
307: #define SADB_X_EXT_KMPRIVATE 17
308: #define SADB_X_EXT_POLICY 18
1.5 itojun 309: #define SADB_X_EXT_SA2 19
1.19 manu 310: #define SADB_X_EXT_NAT_T_TYPE 20
311: #define SADB_X_EXT_NAT_T_SPORT 21
312: #define SADB_X_EXT_NAT_T_DPORT 22
1.27 spz 313: #define SADB_X_EXT_NAT_T_OA 23 /* compat */
314: #define SADB_X_EXT_NAT_T_OAI 23
315: #define SADB_X_EXT_NAT_T_OAR 24
316: #define SADB_X_EXT_NAT_T_FRAG 25
1.23 yamt 317: #if 0
318: #define SADB_X_EXT_TAG 25 /* KAME */
319: #define SADB_X_EXT_SA3 26 /* KAME */
320: #define SADB_X_EXT_PACKET 27 /* KAME */
321: #endif
1.27 spz 322: #define SADB_EXT_MAX 25
1.4 itojun 323:
324: #define SADB_SATYPE_UNSPEC 0
325: #define SADB_SATYPE_AH 2
326: #define SADB_SATYPE_ESP 3
327: #define SADB_SATYPE_RSVP 5
328: #define SADB_SATYPE_OSPFV2 6
329: #define SADB_SATYPE_RIPV2 7
330: #define SADB_SATYPE_MIP 8
331: #define SADB_X_SATYPE_IPCOMP 9
1.12 itojun 332: /*#define SADB_X_SATYPE_POLICY 10 obsolete, do not reuse */
1.16 jonathan 333: #define SADB_X_SATYPE_TCPSIGNATURE 11
334: #define SADB_SATYPE_MAX 12
1.4 itojun 335:
336: #define SADB_SASTATE_LARVAL 0
337: #define SADB_SASTATE_MATURE 1
338: #define SADB_SASTATE_DYING 2
339: #define SADB_SASTATE_DEAD 3
340: #define SADB_SASTATE_MAX 3
341:
342: #define SADB_SAFLAGS_PFS 1
343:
1.7 itojun 344: /* RFC2367 numbers - meets RFC2407 */
345: #define SADB_AALG_NONE 0
346: #define SADB_AALG_MD5HMAC 2
347: #define SADB_AALG_SHA1HMAC 3
348: #define SADB_AALG_MAX 251
1.13 itojun 349: /* private allocations - based on RFC2407/IANA assignment */
350: #define SADB_X_AALG_SHA2_256 5
351: #define SADB_X_AALG_SHA2_384 6
352: #define SADB_X_AALG_SHA2_512 7
1.14 itojun 353: #define SADB_X_AALG_RIPEMD160HMAC 8
1.29 ! drochner 354: #define SADB_X_AALG_AES_XCBC_MAC 9 /* RFC3566 */
! 355: #define SADB_X_AALG_AES128GMAC 11 /* RFC4543 + Errata1821 */
! 356: #define SADB_X_AALG_AES192GMAC 12
! 357: #define SADB_X_AALG_AES256GMAC 13
1.7 itojun 358: /* private allocations should use 249-255 (RFC2407) */
359: #define SADB_X_AALG_MD5 249 /* Keyed MD5 */
360: #define SADB_X_AALG_SHA 250 /* Keyed SHA */
361: #define SADB_X_AALG_NULL 251 /* null authentication */
1.16 jonathan 362: #define SADB_X_AALG_TCP_MD5 252 /* Keyed TCP-MD5 (RFC2385) */
1.7 itojun 363:
364: /* RFC2367 numbers - meets RFC2407 */
365: #define SADB_EALG_NONE 0
366: #define SADB_EALG_DESCBC 2
367: #define SADB_EALG_3DESCBC 3
1.11 itojun 368: #define SADB_EALG_NULL 11
1.15 jonathan 369: #define SADB_EALG_MAX 250
1.9 itojun 370: /* private allocations - based on RFC2407/IANA assignment */
1.7 itojun 371: #define SADB_X_EALG_CAST128CBC 6
1.8 itojun 372: #define SADB_X_EALG_BLOWFISHCBC 7
1.9 itojun 373: #define SADB_X_EALG_RIJNDAELCBC 12
374: #define SADB_X_EALG_AES 12
1.29 ! drochner 375: #define SADB_X_EALG_AESCTR 13 /* RFC3686 */
! 376: #define SADB_X_EALG_AESGCM8 18 /* RFC4106 */
! 377: #define SADB_X_EALG_AESGCM12 19
! 378: #define SADB_X_EALG_AESGCM16 20
! 379: #define SADB_X_EALG_CAMELLIACBC 22 /* RFC4312 */
! 380: #define SADB_X_EALG_AESGMAC 23 /* RFC4543 + Errata1821 */
1.7 itojun 381: /* private allocations should use 249-255 (RFC2407) */
1.15 jonathan 382: #define SADB_X_EALG_SKIPJACK 250
1.4 itojun 383:
1.13 itojun 384: /* private allocations - based on RFC2407/IANA assignment */
1.4 itojun 385: #define SADB_X_CALG_NONE 0
386: #define SADB_X_CALG_OUI 1
387: #define SADB_X_CALG_DEFLATE 2
388: #define SADB_X_CALG_LZS 3
389: #define SADB_X_CALG_MAX 4
390:
391: #define SADB_IDENTTYPE_RESERVED 0
392: #define SADB_IDENTTYPE_PREFIX 1
393: #define SADB_IDENTTYPE_FQDN 2
394: #define SADB_IDENTTYPE_USERFQDN 3
395: #define SADB_X_IDENTTYPE_ADDR 4
396: #define SADB_IDENTTYPE_MAX 4
397:
398: /* `flags' in sadb_sa structure holds followings */
399: #define SADB_X_EXT_NONE 0x0000 /* i.e. new format. */
400: #define SADB_X_EXT_OLD 0x0001 /* old format. */
401:
402: #define SADB_X_EXT_IV4B 0x0010 /* IV length of 4 bytes in use */
403: #define SADB_X_EXT_DERIV 0x0020 /* DES derived */
404: #define SADB_X_EXT_CYCSEQ 0x0040 /* allowing to cyclic sequence. */
405:
406: /* three of followings are exclusive flags each them */
407: #define SADB_X_EXT_PSEQ 0x0000 /* sequencial padding for ESP */
408: #define SADB_X_EXT_PRAND 0x0100 /* random padding for ESP */
409: #define SADB_X_EXT_PZERO 0x0200 /* zero padding for ESP */
410: #define SADB_X_EXT_PMASK 0x0300 /* mask for padding flag */
411:
412: #if 1
413: #define SADB_X_EXT_RAWCPI 0x0080 /* use well known CPI (IPComp) */
414: #endif
415:
416: #define SADB_KEY_FLAGS_MAX 0x0fff
417:
418: /* SPI size for PF_KEYv2 */
1.26 matt 419: #define PFKEY_SPI_SIZE sizeof(uint32_t)
1.4 itojun 420:
421: /* Identifier for menber of lifetime structure */
422: #define SADB_X_LIFETIME_ALLOCATIONS 0
423: #define SADB_X_LIFETIME_BYTES 1
424: #define SADB_X_LIFETIME_ADDTIME 2
425: #define SADB_X_LIFETIME_USETIME 3
426:
427: /* The rate for SOFT lifetime against HARD one. */
428: #define PFKEY_SOFT_LIFETIME_RATE 80
429:
430: /* Utilities */
431: #define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
432: #define PFKEY_EXTLEN(msg) \
1.21 christos 433: PFKEY_UNUNIT64(((struct sadb_ext *)(void *)(msg))->sadb_ext_len)
1.4 itojun 434: #define PFKEY_ADDR_PREFIX(ext) \
1.21 christos 435: (((struct sadb_address *)(void *)(ext))->sadb_address_prefixlen)
1.4 itojun 436: #define PFKEY_ADDR_PROTO(ext) \
1.21 christos 437: (((struct sadb_address *)(void *)(ext))->sadb_address_proto)
1.4 itojun 438: #define PFKEY_ADDR_SADDR(ext) \
1.22 christos 439: ((struct sockaddr *)(void *)((char *)(void *)(ext) + \
440: sizeof(struct sadb_address)))
1.4 itojun 441:
442: /* in 64bits */
443: #define PFKEY_UNUNIT64(a) ((a) << 3)
444: #define PFKEY_UNIT64(a) ((a) >> 3)
445:
446: #endif /* __PFKEY_V2_H */
1.3 itojun 447:
1.25 elad 448: #endif /* !_NET_PFKEYV2_H_ */
CVSweb <webmaster@jp.NetBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to pfkeyv2.h CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / sys / net