xref: /openbmc/linux/include/uapi/linux/pfkeyv2.h (revision 23b6a6df)
1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
2 /* PF_KEY user interface, this is defined by rfc2367 so
3  * do not make arbitrary modifications or else this header
4  * file will not be compliant.
5  */
6 
7 #ifndef _LINUX_PFKEY2_H
8 #define _LINUX_PFKEY2_H
9 
10 #include <linux/types.h>
11 
12 #define PF_KEY_V2		2
13 #define PFKEYV2_REVISION	199806L
14 
15 struct sadb_msg {
16 	__u8		sadb_msg_version;
17 	__u8		sadb_msg_type;
18 	__u8		sadb_msg_errno;
19 	__u8		sadb_msg_satype;
20 	__u16	sadb_msg_len;
21 	__u16	sadb_msg_reserved;
22 	__u32	sadb_msg_seq;
23 	__u32	sadb_msg_pid;
24 } __attribute__((packed));
25 /* sizeof(struct sadb_msg) == 16 */
26 
27 struct sadb_ext {
28 	__u16	sadb_ext_len;
29 	__u16	sadb_ext_type;
30 } __attribute__((packed));
31 /* sizeof(struct sadb_ext) == 4 */
32 
33 struct sadb_sa {
34 	__u16	sadb_sa_len;
35 	__u16	sadb_sa_exttype;
36 	__be32		sadb_sa_spi;
37 	__u8		sadb_sa_replay;
38 	__u8		sadb_sa_state;
39 	__u8		sadb_sa_auth;
40 	__u8		sadb_sa_encrypt;
41 	__u32	sadb_sa_flags;
42 } __attribute__((packed));
43 /* sizeof(struct sadb_sa) == 16 */
44 
45 struct sadb_lifetime {
46 	__u16	sadb_lifetime_len;
47 	__u16	sadb_lifetime_exttype;
48 	__u32	sadb_lifetime_allocations;
49 	__u64	sadb_lifetime_bytes;
50 	__u64	sadb_lifetime_addtime;
51 	__u64	sadb_lifetime_usetime;
52 } __attribute__((packed));
53 /* sizeof(struct sadb_lifetime) == 32 */
54 
55 struct sadb_address {
56 	__u16	sadb_address_len;
57 	__u16	sadb_address_exttype;
58 	__u8		sadb_address_proto;
59 	__u8		sadb_address_prefixlen;
60 	__u16	sadb_address_reserved;
61 } __attribute__((packed));
62 /* sizeof(struct sadb_address) == 8 */
63 
64 struct sadb_key {
65 	__u16	sadb_key_len;
66 	__u16	sadb_key_exttype;
67 	__u16	sadb_key_bits;
68 	__u16	sadb_key_reserved;
69 } __attribute__((packed));
70 /* sizeof(struct sadb_key) == 8 */
71 
72 struct sadb_ident {
73 	__u16	sadb_ident_len;
74 	__u16	sadb_ident_exttype;
75 	__u16	sadb_ident_type;
76 	__u16	sadb_ident_reserved;
77 	__u64	sadb_ident_id;
78 } __attribute__((packed));
79 /* sizeof(struct sadb_ident) == 16 */
80 
81 struct sadb_sens {
82 	__u16	sadb_sens_len;
83 	__u16	sadb_sens_exttype;
84 	__u32	sadb_sens_dpd;
85 	__u8		sadb_sens_sens_level;
86 	__u8		sadb_sens_sens_len;
87 	__u8		sadb_sens_integ_level;
88 	__u8		sadb_sens_integ_len;
89 	__u32	sadb_sens_reserved;
90 } __attribute__((packed));
91 /* sizeof(struct sadb_sens) == 16 */
92 
93 /* followed by:
94 	__u64	sadb_sens_bitmap[sens_len];
95 	__u64	sadb_integ_bitmap[integ_len];  */
96 
97 struct sadb_prop {
98 	__u16	sadb_prop_len;
99 	__u16	sadb_prop_exttype;
100 	__u8		sadb_prop_replay;
101 	__u8		sadb_prop_reserved[3];
102 } __attribute__((packed));
103 /* sizeof(struct sadb_prop) == 8 */
104 
105 /* followed by:
106 	struct sadb_comb sadb_combs[(sadb_prop_len +
107 		sizeof(__u64) - sizeof(struct sadb_prop)) /
108 		sizeof(struct sadb_comb)]; */
109 
110 struct sadb_comb {
111 	__u8		sadb_comb_auth;
112 	__u8		sadb_comb_encrypt;
113 	__u16	sadb_comb_flags;
114 	__u16	sadb_comb_auth_minbits;
115 	__u16	sadb_comb_auth_maxbits;
116 	__u16	sadb_comb_encrypt_minbits;
117 	__u16	sadb_comb_encrypt_maxbits;
118 	__u32	sadb_comb_reserved;
119 	__u32	sadb_comb_soft_allocations;
120 	__u32	sadb_comb_hard_allocations;
121 	__u64	sadb_comb_soft_bytes;
122 	__u64	sadb_comb_hard_bytes;
123 	__u64	sadb_comb_soft_addtime;
124 	__u64	sadb_comb_hard_addtime;
125 	__u64	sadb_comb_soft_usetime;
126 	__u64	sadb_comb_hard_usetime;
127 } __attribute__((packed));
128 /* sizeof(struct sadb_comb) == 72 */
129 
130 struct sadb_supported {
131 	__u16	sadb_supported_len;
132 	__u16	sadb_supported_exttype;
133 	__u32	sadb_supported_reserved;
134 } __attribute__((packed));
135 /* sizeof(struct sadb_supported) == 8 */
136 
137 /* followed by:
138 	struct sadb_alg sadb_algs[(sadb_supported_len +
139 		sizeof(__u64) - sizeof(struct sadb_supported)) /
140 		sizeof(struct sadb_alg)]; */
141 
142 struct sadb_alg {
143 	__u8		sadb_alg_id;
144 	__u8		sadb_alg_ivlen;
145 	__u16	sadb_alg_minbits;
146 	__u16	sadb_alg_maxbits;
147 	__u16	sadb_alg_reserved;
148 } __attribute__((packed));
149 /* sizeof(struct sadb_alg) == 8 */
150 
151 struct sadb_spirange {
152 	__u16	sadb_spirange_len;
153 	__u16	sadb_spirange_exttype;
154 	__u32	sadb_spirange_min;
155 	__u32	sadb_spirange_max;
156 	__u32	sadb_spirange_reserved;
157 } __attribute__((packed));
158 /* sizeof(struct sadb_spirange) == 16 */
159 
160 struct sadb_x_kmprivate {
161 	__u16	sadb_x_kmprivate_len;
162 	__u16	sadb_x_kmprivate_exttype;
163 	__u32	sadb_x_kmprivate_reserved;
164 } __attribute__((packed));
165 /* sizeof(struct sadb_x_kmprivate) == 8 */
166 
167 struct sadb_x_sa2 {
168 	__u16	sadb_x_sa2_len;
169 	__u16	sadb_x_sa2_exttype;
170 	__u8		sadb_x_sa2_mode;
171 	__u8		sadb_x_sa2_reserved1;
172 	__u16	sadb_x_sa2_reserved2;
173 	__u32	sadb_x_sa2_sequence;
174 	__u32	sadb_x_sa2_reqid;
175 } __attribute__((packed));
176 /* sizeof(struct sadb_x_sa2) == 16 */
177 
178 struct sadb_x_policy {
179 	__u16	sadb_x_policy_len;
180 	__u16	sadb_x_policy_exttype;
181 	__u16	sadb_x_policy_type;
182 	__u8		sadb_x_policy_dir;
183 	__u8		sadb_x_policy_reserved;
184 	__u32	sadb_x_policy_id;
185 	__u32	sadb_x_policy_priority;
186 } __attribute__((packed));
187 /* sizeof(struct sadb_x_policy) == 16 */
188 
189 struct sadb_x_ipsecrequest {
190 	__u16	sadb_x_ipsecrequest_len;
191 	__u16	sadb_x_ipsecrequest_proto;
192 	__u8		sadb_x_ipsecrequest_mode;
193 	__u8		sadb_x_ipsecrequest_level;
194 	__u16	sadb_x_ipsecrequest_reserved1;
195 	__u32	sadb_x_ipsecrequest_reqid;
196 	__u32	sadb_x_ipsecrequest_reserved2;
197 } __attribute__((packed));
198 /* sizeof(struct sadb_x_ipsecrequest) == 16 */
199 
200 /* This defines the TYPE of Nat Traversal in use.  Currently only one
201  * type of NAT-T is supported, draft-ietf-ipsec-udp-encaps-06
202  */
203 struct sadb_x_nat_t_type {
204 	__u16	sadb_x_nat_t_type_len;
205 	__u16	sadb_x_nat_t_type_exttype;
206 	__u8		sadb_x_nat_t_type_type;
207 	__u8		sadb_x_nat_t_type_reserved[3];
208 } __attribute__((packed));
209 /* sizeof(struct sadb_x_nat_t_type) == 8 */
210 
211 /* Pass a NAT Traversal port (Source or Dest port) */
212 struct sadb_x_nat_t_port {
213 	__u16	sadb_x_nat_t_port_len;
214 	__u16	sadb_x_nat_t_port_exttype;
215 	__be16		sadb_x_nat_t_port_port;
216 	__u16	sadb_x_nat_t_port_reserved;
217 } __attribute__((packed));
218 /* sizeof(struct sadb_x_nat_t_port) == 8 */
219 
220 /* Generic LSM security context */
221 struct sadb_x_sec_ctx {
222 	__u16	sadb_x_sec_len;
223 	__u16	sadb_x_sec_exttype;
224 	__u8		sadb_x_ctx_alg;  /* LSMs: e.g., selinux == 1 */
225 	__u8		sadb_x_ctx_doi;
226 	__u16	sadb_x_ctx_len;
227 } __attribute__((packed));
228 /* sizeof(struct sadb_sec_ctx) = 8 */
229 
230 /* Used by MIGRATE to pass addresses IKE will use to perform
231  * negotiation with the peer */
232 struct sadb_x_kmaddress {
233 	__u16	sadb_x_kmaddress_len;
234 	__u16	sadb_x_kmaddress_exttype;
235 	__u32	sadb_x_kmaddress_reserved;
236 } __attribute__((packed));
237 /* sizeof(struct sadb_x_kmaddress) == 8 */
238 
239 /* To specify the SA dump filter */
240 struct sadb_x_filter {
241 	__u16	sadb_x_filter_len;
242 	__u16	sadb_x_filter_exttype;
243 	__u32	sadb_x_filter_saddr[4];
244 	__u32	sadb_x_filter_daddr[4];
245 	__u16	sadb_x_filter_family;
246 	__u8	sadb_x_filter_splen;
247 	__u8	sadb_x_filter_dplen;
248 } __attribute__((packed));
249 /* sizeof(struct sadb_x_filter) == 40 */
250 
251 /* Message types */
252 #define SADB_RESERVED		0
253 #define SADB_GETSPI		1
254 #define SADB_UPDATE		2
255 #define SADB_ADD		3
256 #define SADB_DELETE		4
257 #define SADB_GET		5
258 #define SADB_ACQUIRE		6
259 #define SADB_REGISTER		7
260 #define SADB_EXPIRE		8
261 #define SADB_FLUSH		9
262 #define SADB_DUMP		10
263 #define SADB_X_PROMISC		11
264 #define SADB_X_PCHANGE		12
265 #define SADB_X_SPDUPDATE	13
266 #define SADB_X_SPDADD		14
267 #define SADB_X_SPDDELETE	15
268 #define SADB_X_SPDGET		16
269 #define SADB_X_SPDACQUIRE	17
270 #define SADB_X_SPDDUMP		18
271 #define SADB_X_SPDFLUSH		19
272 #define SADB_X_SPDSETIDX	20
273 #define SADB_X_SPDEXPIRE	21
274 #define SADB_X_SPDDELETE2	22
275 #define SADB_X_NAT_T_NEW_MAPPING	23
276 #define SADB_X_MIGRATE		24
277 #define SADB_MAX		24
278 
279 /* Security Association flags */
280 #define SADB_SAFLAGS_PFS	1
281 #define SADB_SAFLAGS_NOPMTUDISC	0x20000000
282 #define SADB_SAFLAGS_DECAP_DSCP	0x40000000
283 #define SADB_SAFLAGS_NOECN	0x80000000
284 
285 /* Security Association states */
286 #define SADB_SASTATE_LARVAL	0
287 #define SADB_SASTATE_MATURE	1
288 #define SADB_SASTATE_DYING	2
289 #define SADB_SASTATE_DEAD	3
290 #define SADB_SASTATE_MAX	3
291 
292 /* Security Association types */
293 #define SADB_SATYPE_UNSPEC	0
294 #define SADB_SATYPE_AH		2
295 #define SADB_SATYPE_ESP		3
296 #define SADB_SATYPE_RSVP	5
297 #define SADB_SATYPE_OSPFV2	6
298 #define SADB_SATYPE_RIPV2	7
299 #define SADB_SATYPE_MIP		8
300 #define SADB_X_SATYPE_IPCOMP	9
301 #define SADB_SATYPE_MAX		9
302 
303 /* Authentication algorithms */
304 #define SADB_AALG_NONE			0
305 #define SADB_AALG_MD5HMAC		2
306 #define SADB_AALG_SHA1HMAC		3
307 #define SADB_X_AALG_SHA2_256HMAC	5
308 #define SADB_X_AALG_SHA2_384HMAC	6
309 #define SADB_X_AALG_SHA2_512HMAC	7
310 #define SADB_X_AALG_RIPEMD160HMAC	8
311 #define SADB_X_AALG_AES_XCBC_MAC	9
312 #define SADB_X_AALG_SM3_256HMAC		10
313 #define SADB_X_AALG_NULL		251	/* kame */
314 #define SADB_AALG_MAX			251
315 
316 /* Encryption algorithms */
317 #define SADB_EALG_NONE			0
318 #define SADB_EALG_DESCBC		2
319 #define SADB_EALG_3DESCBC		3
320 #define SADB_X_EALG_CASTCBC		6
321 #define SADB_X_EALG_BLOWFISHCBC		7
322 #define SADB_EALG_NULL			11
323 #define SADB_X_EALG_AESCBC		12
324 #define SADB_X_EALG_AESCTR		13
325 #define SADB_X_EALG_AES_CCM_ICV8	14
326 #define SADB_X_EALG_AES_CCM_ICV12	15
327 #define SADB_X_EALG_AES_CCM_ICV16	16
328 #define SADB_X_EALG_AES_GCM_ICV8	18
329 #define SADB_X_EALG_AES_GCM_ICV12	19
330 #define SADB_X_EALG_AES_GCM_ICV16	20
331 #define SADB_X_EALG_CAMELLIACBC		22
332 #define SADB_X_EALG_NULL_AES_GMAC	23
333 #define SADB_X_EALG_SM4CBC		24
334 #define SADB_EALG_MAX                   253 /* last EALG */
335 /* private allocations should use 249-255 (RFC2407) */
336 #define SADB_X_EALG_SERPENTCBC  252     /* draft-ietf-ipsec-ciph-aes-cbc-00 */
337 #define SADB_X_EALG_TWOFISHCBC  253     /* draft-ietf-ipsec-ciph-aes-cbc-00 */
338 
339 /* Compression algorithms */
340 #define SADB_X_CALG_NONE		0
341 #define SADB_X_CALG_OUI			1
342 #define SADB_X_CALG_DEFLATE		2
343 #define SADB_X_CALG_LZS			3
344 #define SADB_X_CALG_LZJH		4
345 #define SADB_X_CALG_MAX			4
346 
347 /* Extension Header values */
348 #define SADB_EXT_RESERVED		0
349 #define SADB_EXT_SA			1
350 #define SADB_EXT_LIFETIME_CURRENT	2
351 #define SADB_EXT_LIFETIME_HARD		3
352 #define SADB_EXT_LIFETIME_SOFT		4
353 #define SADB_EXT_ADDRESS_SRC		5
354 #define SADB_EXT_ADDRESS_DST		6
355 #define SADB_EXT_ADDRESS_PROXY		7
356 #define SADB_EXT_KEY_AUTH		8
357 #define SADB_EXT_KEY_ENCRYPT		9
358 #define SADB_EXT_IDENTITY_SRC		10
359 #define SADB_EXT_IDENTITY_DST		11
360 #define SADB_EXT_SENSITIVITY		12
361 #define SADB_EXT_PROPOSAL		13
362 #define SADB_EXT_SUPPORTED_AUTH		14
363 #define SADB_EXT_SUPPORTED_ENCRYPT	15
364 #define SADB_EXT_SPIRANGE		16
365 #define SADB_X_EXT_KMPRIVATE		17
366 #define SADB_X_EXT_POLICY		18
367 #define SADB_X_EXT_SA2			19
368 /* The next four entries are for setting up NAT Traversal */
369 #define SADB_X_EXT_NAT_T_TYPE		20
370 #define SADB_X_EXT_NAT_T_SPORT		21
371 #define SADB_X_EXT_NAT_T_DPORT		22
372 #define SADB_X_EXT_NAT_T_OA		23
373 #define SADB_X_EXT_SEC_CTX		24
374 /* Used with MIGRATE to pass @ to IKE for negotiation */
375 #define SADB_X_EXT_KMADDRESS		25
376 #define SADB_X_EXT_FILTER		26
377 #define SADB_EXT_MAX			26
378 
379 /* Identity Extension values */
380 #define SADB_IDENTTYPE_RESERVED	0
381 #define SADB_IDENTTYPE_PREFIX	1
382 #define SADB_IDENTTYPE_FQDN	2
383 #define SADB_IDENTTYPE_USERFQDN	3
384 #define SADB_IDENTTYPE_MAX	3
385 
386 #endif /* !(_LINUX_PFKEY2_H) */
387