Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */#ifndef _LINUX_XFRM_H#define _LINUX_XFRM_H
#include <linux/in6.h>#include <linux/types.h>#include <linux/stddef.h>
/* All of the structures in this file may not change size as they are * passed into the kernel from userspace via netlink sockets. */
/* Structure to encapsulate addresses. I do not want to use * "standard" structure. My apologies. */typedef union { __be32 a4; __be32 a6[4]; struct in6_addr in6;} xfrm_address_t;
/* Ident of a specific xfrm_state. It is used on input to lookup * the state by (spi,daddr,ah/esp) or to store information about * spi, protocol and tunnel address on output. */struct xfrm_id { xfrm_address_t daddr; __be32 spi; __u8 proto;};
struct xfrm_sec_ctx { __u8 ctx_doi; __u8 ctx_alg; __u16 ctx_len; __u32 ctx_sid; char ctx_str[] __counted_by(ctx_len);};
/* Security Context Domains of Interpretation */#define XFRM_SC_DOI_RESERVED 0#define XFRM_SC_DOI_LSM 1
/* Security Context Algorithms */#define XFRM_SC_ALG_RESERVED 0#define XFRM_SC_ALG_SELINUX 1
/* Selector, used as selector both on policy rules (SPD) and SAs. */
struct xfrm_selector { xfrm_address_t daddr; xfrm_address_t saddr; __be16 dport; __be16 dport_mask; __be16 sport; __be16 sport_mask; __u16 family; __u8 prefixlen_d; __u8 prefixlen_s; __u8 proto; int ifindex; __kernel_uid32_t user;};
#define XFRM_INF (~(__u64)0)
struct xfrm_lifetime_cfg { __u64 soft_byte_limit; __u64 hard_byte_limit; __u64 soft_packet_limit; __u64 hard_packet_limit; __u64 soft_add_expires_seconds; __u64 hard_add_expires_seconds; __u64 soft_use_expires_seconds; __u64 hard_use_expires_seconds;};
struct xfrm_lifetime_cur { __u64 bytes; __u64 packets; __u64 add_time; __u64 use_time;};
struct xfrm_replay_state { __u32 oseq; __u32 seq; __u32 bitmap;};
#define XFRMA_REPLAY_ESN_MAX 4096
struct xfrm_replay_state_esn { unsigned int bmp_len; __u32 oseq; __u32 seq; __u32 oseq_hi; __u32 seq_hi; __u32 replay_window; __u32 bmp[];};
struct xfrm_algo { char alg_name[64]; unsigned int alg_key_len; /* in bits */ char alg_key[];};
struct xfrm_algo_auth { char alg_name[64]; unsigned int alg_key_len; /* in bits */ unsigned int alg_trunc_len; /* in bits */ char alg_key[];};
struct xfrm_algo_aead { char alg_name[64]; unsigned int alg_key_len; /* in bits */ unsigned int alg_icv_len; /* in bits */ char alg_key[];};
struct xfrm_stats { __u32 replay_window; __u32 replay; __u32 integrity_failed;};
enum { XFRM_POLICY_TYPE_MAIN = 0, XFRM_POLICY_TYPE_SUB = 1, XFRM_POLICY_TYPE_MAX = 2, XFRM_POLICY_TYPE_ANY = 255};
enum { XFRM_POLICY_IN = 0, XFRM_POLICY_OUT = 1, XFRM_POLICY_FWD = 2, XFRM_POLICY_MASK = 3, XFRM_POLICY_MAX = 3};
enum xfrm_sa_dir { XFRM_SA_DIR_IN = 1, XFRM_SA_DIR_OUT = 2};
enum { XFRM_SHARE_ANY, /* No limitations */ XFRM_SHARE_SESSION, /* For this session only */ XFRM_SHARE_USER, /* For this user only */ XFRM_SHARE_UNIQUE /* Use once */};
#define XFRM_MODE_TRANSPORT 0#define XFRM_MODE_TUNNEL 1#define XFRM_MODE_ROUTEOPTIMIZATION 2#define XFRM_MODE_IN_TRIGGER 3#define XFRM_MODE_BEET 4#define XFRM_MODE_IPTFS 5#define XFRM_MODE_MAX 6
/* Netlink configuration messages. */enum { XFRM_MSG_BASE = 0x10,
XFRM_MSG_NEWSA = 0x10,#define XFRM_MSG_NEWSA XFRM_MSG_NEWSA XFRM_MSG_DELSA,#define XFRM_MSG_DELSA XFRM_MSG_DELSA XFRM_MSG_GETSA,#define XFRM_MSG_GETSA XFRM_MSG_GETSA
XFRM_MSG_NEWPOLICY,#define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY XFRM_MSG_DELPOLICY,#define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY XFRM_MSG_GETPOLICY,#define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY
XFRM_MSG_ALLOCSPI,#define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI XFRM_MSG_ACQUIRE,#define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE XFRM_MSG_EXPIRE,#define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE
XFRM_MSG_UPDPOLICY,#define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY XFRM_MSG_UPDSA,#define XFRM_MSG_UPDSA XFRM_MSG_UPDSA
XFRM_MSG_POLEXPIRE,#define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE
XFRM_MSG_FLUSHSA,#define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHPOLICY,#define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
XFRM_MSG_NEWAE,#define XFRM_MSG_NEWAE XFRM_MSG_NEWAE XFRM_MSG_GETAE,#define XFRM_MSG_GETAE XFRM_MSG_GETAE
XFRM_MSG_REPORT,#define XFRM_MSG_REPORT XFRM_MSG_REPORT
XFRM_MSG_MIGRATE,#define XFRM_MSG_MIGRATE XFRM_MSG_MIGRATE
XFRM_MSG_NEWSADINFO,#define XFRM_MSG_NEWSADINFO XFRM_MSG_NEWSADINFO XFRM_MSG_GETSADINFO,#define XFRM_MSG_GETSADINFO XFRM_MSG_GETSADINFO
XFRM_MSG_NEWSPDINFO,#define XFRM_MSG_NEWSPDINFO XFRM_MSG_NEWSPDINFO XFRM_MSG_GETSPDINFO,#define XFRM_MSG_GETSPDINFO XFRM_MSG_GETSPDINFO
XFRM_MSG_MAPPING,#define XFRM_MSG_MAPPING XFRM_MSG_MAPPING
XFRM_MSG_SETDEFAULT,#define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT XFRM_MSG_GETDEFAULT,#define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT
XFRM_MSG_MIGRATE_STATE,#define XFRM_MSG_MIGRATE_STATE XFRM_MSG_MIGRATE_STATE __XFRM_MSG_MAX};#define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
#define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
/* * Generic LSM security context for communicating to user space * NOTE: Same format as sadb_x_sec_ctx */struct xfrm_user_sec_ctx { __u16 len; __u16 exttype; __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */ __u8 ctx_doi; __u16 ctx_len;};
struct xfrm_user_tmpl { struct xfrm_id id; __u16 family; xfrm_address_t saddr; __u32 reqid; __u8 mode; __u8 share; __u8 optional; __u32 aalgos; __u32 ealgos; __u32 calgos;};
struct xfrm_encap_tmpl { __u16 encap_type; __be16 encap_sport; __be16 encap_dport; xfrm_address_t encap_oa;};
/* AEVENT flags */enum xfrm_ae_ftype_t { XFRM_AE_UNSPEC, XFRM_AE_RTHR=1, /* replay threshold*/ XFRM_AE_RVAL=2, /* replay value */ XFRM_AE_LVAL=4, /* lifetime value */ XFRM_AE_ETHR=8, /* expiry timer threshold */ XFRM_AE_CR=16, /* Event cause is replay update */ XFRM_AE_CE=32, /* Event cause is timer expiry */ XFRM_AE_CU=64, /* Event cause is policy update */ __XFRM_AE_MAX
#define XFRM_AE_MAX (__XFRM_AE_MAX - 1)};
struct xfrm_userpolicy_type { __u8 type; __u16 reserved1; __u8 reserved2;};
/* Netlink message attributes. */enum xfrm_attr_type_t { XFRMA_UNSPEC, XFRMA_ALG_AUTH, /* struct xfrm_algo */ XFRMA_ALG_CRYPT, /* struct xfrm_algo */ XFRMA_ALG_COMP, /* struct xfrm_algo */ XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */ XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */ XFRMA_SA, /* struct xfrm_usersa_info */ XFRMA_POLICY, /*struct xfrm_userpolicy_info */ XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */ XFRMA_LTIME_VAL, XFRMA_REPLAY_VAL, XFRMA_REPLAY_THRESH, XFRMA_ETIMER_THRESH, XFRMA_SRCADDR, /* xfrm_address_t */ XFRMA_COADDR, /* xfrm_address_t */ XFRMA_LASTUSED, /* __u64 */ XFRMA_POLICY_TYPE, /* struct xfrm_userpolicy_type */ XFRMA_MIGRATE, XFRMA_ALG_AEAD, /* struct xfrm_algo_aead */ XFRMA_KMADDRESS, /* struct xfrm_user_kmaddress */ XFRMA_ALG_AUTH_TRUNC, /* struct xfrm_algo_auth */ XFRMA_MARK, /* struct xfrm_mark */ XFRMA_TFCPAD, /* __u32 */ XFRMA_REPLAY_ESN_VAL, /* struct xfrm_replay_state_esn */ XFRMA_SA_EXTRA_FLAGS, /* __u32 */ XFRMA_PROTO, /* __u8 */ XFRMA_ADDRESS_FILTER, /* struct xfrm_address_filter */ XFRMA_PAD, XFRMA_OFFLOAD_DEV, /* struct xfrm_user_offload */ XFRMA_SET_MARK, /* __u32 */ XFRMA_SET_MARK_MASK, /* __u32 */ XFRMA_IF_ID, /* __u32 */ XFRMA_MTIMER_THRESH, /* __u32 in seconds for input SA */ XFRMA_SA_DIR, /* __u8 */ XFRMA_NAT_KEEPALIVE_INTERVAL, /* __u32 in seconds for NAT keepalive */ XFRMA_SA_PCPU, /* __u32 */ XFRMA_IPTFS_DROP_TIME, /* __u32 in: usec to wait for next seq */ XFRMA_IPTFS_REORDER_WINDOW, /* __u16 in: reorder window size (pkts) */ XFRMA_IPTFS_DONT_FRAG, /* out: don't use fragmentation */ XFRMA_IPTFS_INIT_DELAY, /* __u32 out: initial packet wait delay (usec) */ XFRMA_IPTFS_MAX_QSIZE, /* __u32 out: max ingress queue size (octets) */ XFRMA_IPTFS_PKT_SIZE, /* __u32 out: size of outer packet, 0 for PMTU */ __XFRMA_MAX
#define XFRMA_OUTPUT_MARK XFRMA_SET_MARK /* Compatibility */#define XFRMA_MAX (__XFRMA_MAX - 1)};
struct xfrm_mark { __u32 v; /* value */ __u32 m; /* mask */};
enum xfrm_sadattr_type_t { XFRMA_SAD_UNSPEC, XFRMA_SAD_CNT, XFRMA_SAD_HINFO, __XFRMA_SAD_MAX
#define XFRMA_SAD_MAX (__XFRMA_SAD_MAX - 1)};
struct xfrmu_sadhinfo { __u32 sadhcnt; /* current hash bkts */ __u32 sadhmcnt; /* max allowed hash bkts */};
enum xfrm_spdattr_type_t { XFRMA_SPD_UNSPEC, XFRMA_SPD_INFO, XFRMA_SPD_HINFO, XFRMA_SPD_IPV4_HTHRESH, XFRMA_SPD_IPV6_HTHRESH, __XFRMA_SPD_MAX
#define XFRMA_SPD_MAX (__XFRMA_SPD_MAX - 1)};
struct xfrmu_spdinfo { __u32 incnt; __u32 outcnt; __u32 fwdcnt; __u32 inscnt; __u32 outscnt; __u32 fwdscnt;};
struct xfrmu_spdhinfo { __u32 spdhcnt; __u32 spdhmcnt;};
struct xfrmu_spdhthresh { __u8 lbits; __u8 rbits;};
struct xfrm_usersa_info { struct xfrm_selector sel; struct xfrm_id id; xfrm_address_t saddr; struct xfrm_lifetime_cfg lft; struct xfrm_lifetime_cur curlft; struct xfrm_stats stats; __u32 seq; __u32 reqid; __u16 family; __u8 mode; /* XFRM_MODE_xxx */ __u8 replay_window; __u8 flags;#define XFRM_STATE_NOECN 1#define XFRM_STATE_DECAP_DSCP 2#define XFRM_STATE_NOPMTUDISC 4#define XFRM_STATE_WILDRECV 8#define XFRM_STATE_ICMP 16#define XFRM_STATE_AF_UNSPEC 32#define XFRM_STATE_ALIGN4 64#define XFRM_STATE_ESN 128};
#define XFRM_SA_XFLAG_DONT_ENCAP_DSCP 1#define XFRM_SA_XFLAG_OSEQ_MAY_WRAP 2
struct xfrm_usersa_id { xfrm_address_t daddr; __be32 spi; __u16 family; __u8 proto;};
struct xfrm_aevent_id { struct xfrm_usersa_id sa_id; xfrm_address_t saddr; __u32 flags; __u32 reqid;};
struct xfrm_userspi_info { struct xfrm_usersa_info info; __u32 min; __u32 max;};
struct xfrm_userpolicy_info { struct xfrm_selector sel; struct xfrm_lifetime_cfg lft; struct xfrm_lifetime_cur curlft; __u32 priority; __u32 index; __u8 dir; __u8 action;#define XFRM_POLICY_ALLOW 0#define XFRM_POLICY_BLOCK 1 __u8 flags;#define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */ /* Automatically expand selector to include matching ICMP payloads. */#define XFRM_POLICY_ICMP 2#define XFRM_POLICY_CPU_ACQUIRE 4 __u8 share;};
struct xfrm_userpolicy_id { struct xfrm_selector sel; __u32 index; __u8 dir;};
struct xfrm_user_acquire { struct xfrm_id id; xfrm_address_t saddr; struct xfrm_selector sel; struct xfrm_userpolicy_info policy; __u32 aalgos; __u32 ealgos; __u32 calgos; __u32 seq;};
struct xfrm_user_expire { struct xfrm_usersa_info state; __u8 hard;};
struct xfrm_user_polexpire { struct xfrm_userpolicy_info pol; __u8 hard;};
struct xfrm_usersa_flush { __u8 proto;};
struct xfrm_user_report { __u8 proto; struct xfrm_selector sel;};
/* Used by MIGRATE to pass addresses IKE should use to perform * SA negotiation with the peer */struct xfrm_user_kmaddress { xfrm_address_t local; xfrm_address_t remote; __u32 reserved; __u16 family;};
struct xfrm_user_migrate { xfrm_address_t old_daddr; xfrm_address_t old_saddr; xfrm_address_t new_daddr; xfrm_address_t new_saddr; __u8 proto; __u8 mode; __u16 reserved; __u32 reqid; __u16 old_family; __u16 new_family;};
struct xfrm_user_migrate_state { struct xfrm_usersa_id id; xfrm_address_t new_daddr; xfrm_address_t new_saddr; struct xfrm_mark old_mark; struct xfrm_selector new_sel; __u32 new_reqid; __u32 flags; __u16 new_family; __u16 reserved;};
/* Flags for xfrm_user_migrate_state.flags */enum xfrm_migrate_state_flags { XFRM_MIGRATE_STATE_CLEAR_OFFLOAD = 1, /* do not inherit offload from existing SA */ XFRM_MIGRATE_STATE_UPDATE_H2H_SEL = 2, /* update H2H selector from new daddr/saddr */};
/* All flags defined as of this header version; unknown bits are rejected. */#define XFRM_MIGRATE_STATE_KNOWN_FLAGS \ (XFRM_MIGRATE_STATE_CLEAR_OFFLOAD | XFRM_MIGRATE_STATE_UPDATE_H2H_SEL)
struct xfrm_user_mapping { struct xfrm_usersa_id id; __u32 reqid; xfrm_address_t old_saddr; xfrm_address_t new_saddr; __be16 old_sport; __be16 new_sport;};
struct xfrm_address_filter { xfrm_address_t saddr; xfrm_address_t daddr; __u16 family; __u8 splen; __u8 dplen;};
struct xfrm_user_offload { int ifindex; __u8 flags;};/* This flag was exposed without any kernel code that supports it. * Unfortunately, strongswan has the code that sets this flag, * which makes it impossible to reuse this bit. * * So leave it here to make sure that it won't be reused by mistake. */#define XFRM_OFFLOAD_IPV6 1#define XFRM_OFFLOAD_INBOUND 2/* Two bits above are relevant for state path only, while * offload is used for both policy and state flows. * * In policy offload mode, they are free and can be safely reused. */#define XFRM_OFFLOAD_PACKET 4
struct xfrm_userpolicy_default {#define XFRM_USERPOLICY_UNSPEC 0#define XFRM_USERPOLICY_BLOCK 1#define XFRM_USERPOLICY_ACCEPT 2 __u8 in; __u8 fwd; __u8 out;};
#ifndef __KERNEL__/* backwards compatibility for userspace */#define XFRMGRP_ACQUIRE 1#define XFRMGRP_EXPIRE 2#define XFRMGRP_SA 4#define XFRMGRP_POLICY 8#define XFRMGRP_REPORT 0x20#endif
enum xfrm_nlgroups { XFRMNLGRP_NONE,#define XFRMNLGRP_NONE XFRMNLGRP_NONE XFRMNLGRP_ACQUIRE,#define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE XFRMNLGRP_EXPIRE,#define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE XFRMNLGRP_SA,#define XFRMNLGRP_SA XFRMNLGRP_SA XFRMNLGRP_POLICY,#define XFRMNLGRP_POLICY XFRMNLGRP_POLICY XFRMNLGRP_AEVENTS,#define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS XFRMNLGRP_REPORT,#define XFRMNLGRP_REPORT XFRMNLGRP_REPORT XFRMNLGRP_MIGRATE,#define XFRMNLGRP_MIGRATE XFRMNLGRP_MIGRATE XFRMNLGRP_MAPPING,#define XFRMNLGRP_MAPPING XFRMNLGRP_MAPPING __XFRMNLGRP_MAX};#define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1)
#endif /* _LINUX_XFRM_H */