1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
|
/*
%%% copyright-nrl-98
This software is Copyright 1998 by Randall Atkinson, Ronald Lee,
Daniel McDonald, Bao Phan, and Chris Winters. All Rights Reserved. All
rights under this copyright have been assigned to the US Naval Research
Laboratory (NRL). The NRL Copyright Notice and License Agreement Version
1.1 (January 17, 1995) applies to this software.
You should have received a copy of the license with this software. If you
didn't get a copy, you may request one from <license@ipv6.nrl.navy.mil>.
*/
#ifndef _NET_PFKEY_V2_H
#define _NET_PFKEY_V2_H 1
#define PF_KEY_V2 2
#define PFKEYV2_REVISION 199806L
/* This should be updated whenever the API is altered. */
#define _OPENBSD_IPSEC_API_VERSION 2
#define SADB_RESERVED 0
#define SADB_GETSPI 1
#define SADB_UPDATE 2
#define SADB_ADD 3
#define SADB_DELETE 4
#define SADB_GET 5
#define SADB_ACQUIRE 6
#define SADB_REGISTER 7
#define SADB_EXPIRE 8
#define SADB_FLUSH 9
#define SADB_DUMP 10
#define SADB_X_PROMISC 11
#define SADB_X_ADDFLOW 12
#define SADB_X_DELFLOW 13
#define SADB_X_GRPSPIS 14
#define SADB_X_ASKPOLICY 15
#define SADB_MAX 15
struct sadb_msg {
uint8_t sadb_msg_version;
uint8_t sadb_msg_type;
uint8_t sadb_msg_errno;
uint8_t sadb_msg_satype;
uint16_t sadb_msg_len;
uint16_t sadb_msg_reserved;
uint32_t sadb_msg_seq;
uint32_t sadb_msg_pid;
};
struct sadb_ext {
uint16_t sadb_ext_len;
uint16_t sadb_ext_type;
};
struct sadb_sa {
uint16_t sadb_sa_len;
uint16_t sadb_sa_exttype;
uint32_t sadb_sa_spi;
uint8_t sadb_sa_replay;
uint8_t sadb_sa_state;
uint8_t sadb_sa_auth;
uint8_t sadb_sa_encrypt;
uint32_t sadb_sa_flags;
};
struct sadb_lifetime {
uint16_t sadb_lifetime_len;
uint16_t sadb_lifetime_exttype;
uint32_t sadb_lifetime_allocations;
uint64_t sadb_lifetime_bytes;
uint64_t sadb_lifetime_addtime;
uint64_t sadb_lifetime_usetime;
};
struct sadb_address {
uint16_t sadb_address_len;
uint16_t sadb_address_exttype;
uint32_t sadb_address_reserved;
};
struct sadb_key {
uint16_t sadb_key_len;
uint16_t sadb_key_exttype;
uint16_t sadb_key_bits;
uint16_t sadb_key_reserved;
};
struct sadb_ident {
uint16_t sadb_ident_len;
uint16_t sadb_ident_exttype;
uint16_t sadb_ident_type;
uint16_t sadb_ident_reserved;
uint64_t sadb_ident_id;
};
struct sadb_sens {
uint16_t sadb_sens_len;
uint16_t sadb_sens_exttype;
uint32_t sadb_sens_dpd;
uint8_t sadb_sens_sens_level;
uint8_t sadb_sens_sens_len;
uint8_t sadb_sens_integ_level;
uint8_t sadb_sens_integ_len;
uint32_t sadb_sens_reserved;
};
struct sadb_prop {
uint16_t sadb_prop_len;
uint16_t sadb_prop_exttype;
uint8_t sadb_prop_num;
uint8_t sadb_prop_replay;
uint16_t sadb_prop_reserved;
};
struct sadb_comb {
uint8_t sadb_comb_auth;
uint8_t sadb_comb_encrypt;
uint16_t sadb_comb_flags;
uint16_t sadb_comb_auth_minbits;
uint16_t sadb_comb_auth_maxbits;
uint16_t sadb_comb_encrypt_minbits;
uint16_t sadb_comb_encrypt_maxbits;
uint32_t sadb_comb_reserved;
uint32_t sadb_comb_soft_allocations;
uint32_t sadb_comb_hard_allocations;
uint64_t sadb_comb_soft_bytes;
uint64_t sadb_comb_hard_bytes;
uint64_t sadb_comb_soft_addtime;
uint64_t sadb_comb_hard_addtime;
uint64_t sadb_comb_soft_usetime;
uint64_t sadb_comb_hard_usetime;
};
struct sadb_supported {
uint16_t sadb_supported_len;
uint16_t sadb_supported_exttype;
uint32_t sadb_supported_reserved;
};
struct sadb_alg {
uint8_t sadb_alg_id;
uint8_t sadb_alg_ivlen;
uint16_t sadb_alg_minbits;
uint16_t sadb_alg_maxbits;
uint16_t sadb_alg_reserved;
};
struct sadb_spirange {
uint16_t sadb_spirange_len;
uint16_t sadb_spirange_exttype;
uint32_t sadb_spirange_min;
uint32_t sadb_spirange_max;
uint32_t sadb_spirange_reserved;
};
struct sadb_protocol {
uint16_t sadb_protocol_len;
uint16_t sadb_protocol_exttype;
uint8_t sadb_protocol_proto;
uint8_t sadb_protocol_direction;
uint16_t sadb_protocol_reserved2;
};
struct sadb_x_policy {
uint16_t sadb_x_policy_len;
uint16_t sadb_x_policy_exttype;
u_int32_t sadb_x_policy_seq;
};
struct sadb_x_cred {
uint16_t sadb_x_cred_len;
uint16_t sadb_x_cred_exttype;
uint16_t sadb_x_cred_type;
uint16_t sadb_x_cred_reserved;
};
#ifdef _KERNEL
#define SADB_X_GETSPROTO(x) ( (x) == SADB_SATYPE_AH ? IPPROTO_AH :\
(x) == SADB_SATYPE_ESP ? IPPROTO_ESP :\
IPPROTO_IPIP )
#endif
#define SADB_EXT_RESERVED 0
#define SADB_EXT_SA 1
#define SADB_EXT_LIFETIME_CURRENT 2
#define SADB_EXT_LIFETIME_HARD 3
#define SADB_EXT_LIFETIME_SOFT 4
#define SADB_EXT_ADDRESS_SRC 5
#define SADB_EXT_ADDRESS_DST 6
#define SADB_EXT_ADDRESS_PROXY 7
#define SADB_EXT_KEY_AUTH 8
#define SADB_EXT_KEY_ENCRYPT 9
#define SADB_EXT_IDENTITY_SRC 10
#define SADB_EXT_IDENTITY_DST 11
#define SADB_EXT_SENSITIVITY 12
#define SADB_EXT_PROPOSAL 13
#define SADB_EXT_SUPPORTED_AUTH 14
#define SADB_EXT_SUPPORTED_ENCRYPT 15
#define SADB_EXT_SPIRANGE 16
#define SADB_X_EXT_SRC_MASK 17
#define SADB_X_EXT_DST_MASK 18
#define SADB_X_EXT_PROTOCOL 19
#define SADB_X_EXT_FLOW_TYPE 20
#define SADB_X_EXT_SRC_FLOW 21
#define SADB_X_EXT_DST_FLOW 22
#define SADB_X_EXT_SA2 23
#define SADB_X_EXT_DST2 24
#define SADB_X_EXT_POLICY 25
#define SADB_X_EXT_LOCAL_CREDENTIALS 26
#define SADB_X_EXT_REMOTE_CREDENTIALS 27
#define SADB_X_EXT_LOCAL_AUTH 28
#define SADB_X_EXT_REMOTE_AUTH 29
#define SADB_EXT_MAX 29
/* Fix pfkeyv2.c struct pfkeyv2_socket if SATYPE_MAX > 31 */
#define SADB_SATYPE_UNSPEC 0
#define SADB_SATYPE_AH 1
#define SADB_SATYPE_ESP 2
#define SADB_SATYPE_RSVP 3
#define SADB_SATYPE_OSPFV2 4
#define SADB_SATYPE_RIPV2 5
#define SADB_SATYPE_MIP 6
#define SADB_X_SATYPE_IPIP 7
#define SADB_X_SATYPE_TCPSIGNATURE 8
#define SADB_SATYPE_MAX 8
#define SADB_SASTATE_LARVAL 0
#define SADB_SASTATE_MATURE 1
#define SADB_SASTATE_DYING 2
#define SADB_SASTATE_DEAD 3
#define SADB_SASTATE_MAX 3
#define SADB_AALG_NONE 0
#define SADB_AALG_MD5HMAC 2
#define SADB_AALG_SHA1HMAC 3
#define SADB_AALG_DES 4
#define SADB_AALG_SHA2_256 5
#define SADB_AALG_SHA2_384 6
#define SADB_AALG_SHA2_512 7
#define SADB_AALG_RIPEMD160HMAC 8
#define SADB_X_AALG_MD5 249
#define SADB_X_AALG_SHA1 250
#define SADB_AALG_MAX 250
#define SADB_EALG_NONE 0
#define SADB_X_EALG_DES_IV64 1
#define SADB_EALG_DESCBC 2
#define SADB_EALG_3DESCBC 3
#define SADB_X_EALG_RC5 4
#define SADB_X_EALG_IDEA 5
#define SADB_X_EALG_CAST 6
#define SADB_X_EALG_BLF 7
#define SADB_X_EALG_3IDEA 8
#define SADB_X_EALG_DES_IV32 9
#define SADB_X_EALG_RC4 10
#define SADB_X_EALG_NULL 11
#define SADB_X_EALG_AES 12
#define SADB_X_EALG_SKIPJACK 249
#define SADB_EALG_MAX 249
#define SADB_SAFLAGS_PFS 0x001 /* perfect forward secrecy */
#define SADB_X_SAFLAGS_HALFIV 0x002 /* Used for ESP-old */
#define SADB_X_SAFLAGS_TUNNEL 0x004 /* Force tunneling */
#define SADB_X_SAFLAGS_CHAINDEL 0x008 /* Delete whole SA chain */
#define SADB_X_SAFLAGS_RANDOMPADDING 0x080 /* Random ESP padding */
#define SADB_X_SAFLAGS_NOREPLAY 0x100 /* No replay counter */
#define SADB_IDENTTYPE_RESERVED 0
#define SADB_IDENTTYPE_PREFIX 1
#define SADB_IDENTTYPE_FQDN 2
#define SADB_IDENTTYPE_USERFQDN 3
#define SADB_X_IDENTTYPE_CONNECTION 4
#define SADB_IDENTTYPE_MAX 4
#define SADB_KEY_FLAGS_MAX 0
#ifdef _KERNEL
#define PFKEYV2_LIFETIME_HARD 0
#define PFKEYV2_LIFETIME_SOFT 1
#define PFKEYV2_LIFETIME_CURRENT 2
#define PFKEYV2_IDENTITY_SRC 0
#define PFKEYV2_IDENTITY_DST 1
#define PFKEYV2_ENCRYPTION_KEY 0
#define PFKEYV2_AUTHENTICATION_KEY 1
#define PFKEYV2_SOCKETFLAGS_REGISTERED 1
#define PFKEYV2_SOCKETFLAGS_PROMISC 2
#define PFKEYV2_SENDMESSAGE_UNICAST 1
#define PFKEYV2_SENDMESSAGE_REGISTERED 2
#define PFKEYV2_SENDMESSAGE_BROADCAST 3
#endif /* _KERNEL */
#define SADB_X_CREDTYPE_NONE 0
#define SADB_X_CREDTYPE_X509 1 /* ASN1 encoding of the certificate */
#define SADB_X_CREDTYPE_KEYNOTE 2 /* NUL-terminated buffer */
#define SADB_X_CREDTYPE_MAX 3
#ifdef _KERNEL
#define PFKEYV2_AUTH_LOCAL 0
#define PFKEYV2_AUTH_REMOTE 1
#define PFKEYV2_CRED_LOCAL 0
#define PFKEYV2_CRED_REMOTE 1
#endif /* _KERNEL */
#define SADB_X_AUTHTYPE_NONE 0
#define SADB_X_AUTHTYPE_PASSPHRASE 1
#define SADB_X_AUTHTYPE_RSA 2
#define SADB_X_AUTHTYPE_MAX 2
#define SADB_X_FLOW_TYPE_USE 1
#define SADB_X_FLOW_TYPE_ACQUIRE 2
#define SADB_X_FLOW_TYPE_REQUIRE 3
#define SADB_X_FLOW_TYPE_BYPASS 4
#define SADB_X_FLOW_TYPE_DENY 5
#define SADB_X_FLOW_TYPE_DONTACQ 6
#ifdef _KERNEL
struct tdb;
struct socket;
struct mbuf;
struct pfkey_version
{
int protocol;
int (*create)(struct socket *socket);
int (*release)(struct socket *socket);
int (*send)(struct socket *socket, void *message, int len);
};
struct pfkeyv2_socket
{
struct pfkeyv2_socket *next;
struct socket *socket;
int flags;
uint32_t pid;
uint32_t registration; /* Increase size if SATYPE_MAX > 31 */
};
struct dump_state
{
struct sadb_msg *sadb_msg;
struct socket *socket;
};
int pfkeyv2_init(void);
int pfkeyv2_cleanup(void);
int pfkeyv2_parsemessage(void *, int, void **);
int pfkeyv2_expire(struct tdb *, u_int16_t);
int pfkeyv2_acquire(struct ipsec_policy *, union sockaddr_union *,
union sockaddr_union *, u_int32_t *,
struct sockaddr_encap *);
int pfkey_register(struct pfkey_version *version);
int pfkey_unregister(struct pfkey_version *version);
int pfkey_sendup(struct socket *socket, struct mbuf *packet, int more);
#endif /* _KERNEL */
#endif /* _NET_PFKEY_V2_H */
|
