]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - include/linux/xfrm.h
[XFRM] STATE: Support non-fragment outbound transformation headers.
[mirror_ubuntu-artful-kernel.git] / include / linux / xfrm.h
CommitLineData
1da177e4
LT
1#ifndef _LINUX_XFRM_H
2#define _LINUX_XFRM_H
3
4#include <linux/types.h>
5
6/* All of the structures in this file may not change size as they are
7 * passed into the kernel from userspace via netlink sockets.
8 */
9
10/* Structure to encapsulate addresses. I do not want to use
11 * "standard" structure. My apologies.
12 */
13typedef union
14{
15 __u32 a4;
16 __u32 a6[4];
17} xfrm_address_t;
18
19/* Ident of a specific xfrm_state. It is used on input to lookup
20 * the state by (spi,daddr,ah/esp) or to store information about
21 * spi, protocol and tunnel address on output.
22 */
23struct xfrm_id
24{
25 xfrm_address_t daddr;
26 __u32 spi;
27 __u8 proto;
28};
29
df71837d
TJ
30struct xfrm_sec_ctx {
31 __u8 ctx_doi;
32 __u8 ctx_alg;
33 __u16 ctx_len;
34 __u32 ctx_sid;
35 char ctx_str[0];
36};
37
38/* Security Context Domains of Interpretation */
39#define XFRM_SC_DOI_RESERVED 0
40#define XFRM_SC_DOI_LSM 1
41
42/* Security Context Algorithms */
43#define XFRM_SC_ALG_RESERVED 0
44#define XFRM_SC_ALG_SELINUX 1
45
1da177e4
LT
46/* Selector, used as selector both on policy rules (SPD) and SAs. */
47
48struct xfrm_selector
49{
50 xfrm_address_t daddr;
51 xfrm_address_t saddr;
52 __u16 dport;
53 __u16 dport_mask;
54 __u16 sport;
55 __u16 sport_mask;
56 __u16 family;
57 __u8 prefixlen_d;
58 __u8 prefixlen_s;
59 __u8 proto;
60 int ifindex;
61 uid_t user;
62};
63
64#define XFRM_INF (~(__u64)0)
65
66struct xfrm_lifetime_cfg
67{
68 __u64 soft_byte_limit;
69 __u64 hard_byte_limit;
70 __u64 soft_packet_limit;
71 __u64 hard_packet_limit;
72 __u64 soft_add_expires_seconds;
73 __u64 hard_add_expires_seconds;
74 __u64 soft_use_expires_seconds;
75 __u64 hard_use_expires_seconds;
76};
77
78struct xfrm_lifetime_cur
79{
80 __u64 bytes;
81 __u64 packets;
82 __u64 add_time;
83 __u64 use_time;
84};
85
86struct xfrm_replay_state
87{
88 __u32 oseq;
89 __u32 seq;
90 __u32 bitmap;
91};
92
93struct xfrm_algo {
94 char alg_name[64];
95 int alg_key_len; /* in bits */
96 char alg_key[0];
97};
98
99struct xfrm_stats {
100 __u32 replay_window;
101 __u32 replay;
102 __u32 integrity_failed;
103};
104
105enum
106{
107 XFRM_POLICY_IN = 0,
108 XFRM_POLICY_OUT = 1,
109 XFRM_POLICY_FWD = 2,
110 XFRM_POLICY_MAX = 3
111};
112
113enum
114{
115 XFRM_SHARE_ANY, /* No limitations */
116 XFRM_SHARE_SESSION, /* For this session only */
117 XFRM_SHARE_USER, /* For this user only */
118 XFRM_SHARE_UNIQUE /* Use once */
119};
120
b59f45d0
HX
121#define XFRM_MODE_TRANSPORT 0
122#define XFRM_MODE_TUNNEL 1
7e49e6de
MN
123#define XFRM_MODE_ROUTEOPTIMIZATION 2
124#define XFRM_MODE_IN_TRIGGER 3
125#define XFRM_MODE_MAX 4
b59f45d0 126
1da177e4
LT
127/* Netlink configuration messages. */
128enum {
129 XFRM_MSG_BASE = 0x10,
130
131 XFRM_MSG_NEWSA = 0x10,
132#define XFRM_MSG_NEWSA XFRM_MSG_NEWSA
133 XFRM_MSG_DELSA,
134#define XFRM_MSG_DELSA XFRM_MSG_DELSA
135 XFRM_MSG_GETSA,
136#define XFRM_MSG_GETSA XFRM_MSG_GETSA
137
138 XFRM_MSG_NEWPOLICY,
139#define XFRM_MSG_NEWPOLICY XFRM_MSG_NEWPOLICY
140 XFRM_MSG_DELPOLICY,
141#define XFRM_MSG_DELPOLICY XFRM_MSG_DELPOLICY
142 XFRM_MSG_GETPOLICY,
143#define XFRM_MSG_GETPOLICY XFRM_MSG_GETPOLICY
144
145 XFRM_MSG_ALLOCSPI,
146#define XFRM_MSG_ALLOCSPI XFRM_MSG_ALLOCSPI
147 XFRM_MSG_ACQUIRE,
148#define XFRM_MSG_ACQUIRE XFRM_MSG_ACQUIRE
149 XFRM_MSG_EXPIRE,
150#define XFRM_MSG_EXPIRE XFRM_MSG_EXPIRE
151
152 XFRM_MSG_UPDPOLICY,
153#define XFRM_MSG_UPDPOLICY XFRM_MSG_UPDPOLICY
154 XFRM_MSG_UPDSA,
155#define XFRM_MSG_UPDSA XFRM_MSG_UPDSA
156
157 XFRM_MSG_POLEXPIRE,
158#define XFRM_MSG_POLEXPIRE XFRM_MSG_POLEXPIRE
159
160 XFRM_MSG_FLUSHSA,
161#define XFRM_MSG_FLUSHSA XFRM_MSG_FLUSHSA
162 XFRM_MSG_FLUSHPOLICY,
163#define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
164
f8cd5488
JHS
165 XFRM_MSG_NEWAE,
166#define XFRM_MSG_NEWAE XFRM_MSG_NEWAE
167 XFRM_MSG_GETAE,
168#define XFRM_MSG_GETAE XFRM_MSG_GETAE
526bdb80 169 __XFRM_MSG_MAX
1da177e4 170};
526bdb80 171#define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
1da177e4 172
492b558b
TG
173#define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
174
df71837d
TJ
175/*
176 * Generic LSM security context for comunicating to user space
177 * NOTE: Same format as sadb_x_sec_ctx
178 */
179struct xfrm_user_sec_ctx {
180 __u16 len;
181 __u16 exttype;
182 __u8 ctx_alg; /* LSMs: e.g., selinux == 1 */
183 __u8 ctx_doi;
184 __u16 ctx_len;
185};
186
1da177e4
LT
187struct xfrm_user_tmpl {
188 struct xfrm_id id;
189 __u16 family;
190 xfrm_address_t saddr;
191 __u32 reqid;
192 __u8 mode;
193 __u8 share;
194 __u8 optional;
195 __u32 aalgos;
196 __u32 ealgos;
197 __u32 calgos;
198};
199
200struct xfrm_encap_tmpl {
201 __u16 encap_type;
202 __u16 encap_sport;
203 __u16 encap_dport;
204 xfrm_address_t encap_oa;
205};
206
f8cd5488
JHS
207/* AEVENT flags */
208enum xfrm_ae_ftype_t {
209 XFRM_AE_UNSPEC,
210 XFRM_AE_RTHR=1, /* replay threshold*/
211 XFRM_AE_RVAL=2, /* replay value */
212 XFRM_AE_LVAL=4, /* lifetime value */
213 XFRM_AE_ETHR=8, /* expiry timer threshold */
214 XFRM_AE_CR=16, /* Event cause is replay update */
215 XFRM_AE_CE=32, /* Event cause is timer expiry */
216 XFRM_AE_CU=64, /* Event cause is policy update */
217 __XFRM_AE_MAX
218
219#define XFRM_AE_MAX (__XFRM_AE_MAX - 1)
220};
221
1da177e4
LT
222/* Netlink message attributes. */
223enum xfrm_attr_type_t {
224 XFRMA_UNSPEC,
225 XFRMA_ALG_AUTH, /* struct xfrm_algo */
226 XFRMA_ALG_CRYPT, /* struct xfrm_algo */
227 XFRMA_ALG_COMP, /* struct xfrm_algo */
228 XFRMA_ENCAP, /* struct xfrm_algo + struct xfrm_encap_tmpl */
229 XFRMA_TMPL, /* 1 or more struct xfrm_user_tmpl */
0603eac0
HX
230 XFRMA_SA,
231 XFRMA_POLICY,
df71837d 232 XFRMA_SEC_CTX, /* struct xfrm_sec_ctx */
f8cd5488
JHS
233 XFRMA_LTIME_VAL,
234 XFRMA_REPLAY_VAL,
235 XFRMA_REPLAY_THRESH,
236 XFRMA_ETIMER_THRESH,
eb2971b6 237 XFRMA_SRCADDR, /* xfrm_address_t */
1da177e4
LT
238 __XFRMA_MAX
239
240#define XFRMA_MAX (__XFRMA_MAX - 1)
241};
242
243struct xfrm_usersa_info {
244 struct xfrm_selector sel;
245 struct xfrm_id id;
246 xfrm_address_t saddr;
247 struct xfrm_lifetime_cfg lft;
248 struct xfrm_lifetime_cur curlft;
249 struct xfrm_stats stats;
250 __u32 seq;
251 __u32 reqid;
252 __u16 family;
7e49e6de 253 __u8 mode; /* XFRM_MODE_xxx */
1da177e4
LT
254 __u8 replay_window;
255 __u8 flags;
256#define XFRM_STATE_NOECN 1
257#define XFRM_STATE_DECAP_DSCP 2
dd87147e 258#define XFRM_STATE_NOPMTUDISC 4
fbd9a5b4 259#define XFRM_STATE_WILDRECV 8
1da177e4
LT
260};
261
262struct xfrm_usersa_id {
263 xfrm_address_t daddr;
264 __u32 spi;
265 __u16 family;
266 __u8 proto;
267};
268
f8cd5488 269struct xfrm_aevent_id {
f8cd5488 270 struct xfrm_usersa_id sa_id;
4bf07ef3 271 __u32 flags;
f8cd5488
JHS
272};
273
1da177e4
LT
274struct xfrm_userspi_info {
275 struct xfrm_usersa_info info;
276 __u32 min;
277 __u32 max;
278};
279
280struct xfrm_userpolicy_info {
281 struct xfrm_selector sel;
282 struct xfrm_lifetime_cfg lft;
283 struct xfrm_lifetime_cur curlft;
284 __u32 priority;
285 __u32 index;
286 __u8 dir;
287 __u8 action;
288#define XFRM_POLICY_ALLOW 0
289#define XFRM_POLICY_BLOCK 1
290 __u8 flags;
291#define XFRM_POLICY_LOCALOK 1 /* Allow user to override global policy */
292 __u8 share;
293};
294
295struct xfrm_userpolicy_id {
296 struct xfrm_selector sel;
297 __u32 index;
298 __u8 dir;
299};
300
301struct xfrm_user_acquire {
302 struct xfrm_id id;
303 xfrm_address_t saddr;
304 struct xfrm_selector sel;
305 struct xfrm_userpolicy_info policy;
306 __u32 aalgos;
307 __u32 ealgos;
308 __u32 calgos;
309 __u32 seq;
310};
311
312struct xfrm_user_expire {
313 struct xfrm_usersa_info state;
314 __u8 hard;
315};
316
317struct xfrm_user_polexpire {
318 struct xfrm_userpolicy_info pol;
319 __u8 hard;
320};
321
322struct xfrm_usersa_flush {
323 __u8 proto;
324};
325
ac6d439d
PM
326#ifndef __KERNEL__
327/* backwards compatibility for userspace */
1da177e4
LT
328#define XFRMGRP_ACQUIRE 1
329#define XFRMGRP_EXPIRE 2
26b15dad
JHS
330#define XFRMGRP_SA 4
331#define XFRMGRP_POLICY 8
ac6d439d
PM
332#endif
333
334enum xfrm_nlgroups {
335 XFRMNLGRP_NONE,
336#define XFRMNLGRP_NONE XFRMNLGRP_NONE
337 XFRMNLGRP_ACQUIRE,
338#define XFRMNLGRP_ACQUIRE XFRMNLGRP_ACQUIRE
339 XFRMNLGRP_EXPIRE,
340#define XFRMNLGRP_EXPIRE XFRMNLGRP_EXPIRE
341 XFRMNLGRP_SA,
342#define XFRMNLGRP_SA XFRMNLGRP_SA
343 XFRMNLGRP_POLICY,
344#define XFRMNLGRP_POLICY XFRMNLGRP_POLICY
f8cd5488
JHS
345 XFRMNLGRP_AEVENTS,
346#define XFRMNLGRP_AEVENTS XFRMNLGRP_AEVENTS
ac6d439d
PM
347 __XFRMNLGRP_MAX
348};
349#define XFRMNLGRP_MAX (__XFRMNLGRP_MAX - 1)
1da177e4
LT
350
351#endif /* _LINUX_XFRM_H */