1/*
2 * Copyright (c) 2000-2026 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/* $KAME: pfkeyv2.h,v 1.10 2000/03/22 07:04:20 sakane Exp $ */
29
30/*
31 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
32 * All rights reserved.
33 *
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
36 * are met:
37 * 1. Redistributions of source code must retain the above copyright
38 * notice, this list of conditions and the following disclaimer.
39 * 2. Redistributions in binary form must reproduce the above copyright
40 * notice, this list of conditions and the following disclaimer in the
41 * documentation and/or other materials provided with the distribution.
42 * 3. Neither the name of the project nor the names of its contributors
43 * may be used to endorse or promote products derived from this software
44 * without specific prior written permission.
45 *
46 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56 * SUCH DAMAGE.
57 */
58
59/*
60 * This file has been derived rfc 2367,
61 * And added some flags of SADB_KEY_FLAGS_ as SADB_X_EXT_.
62 * sakane@ydc.co.jp
63 */
64
65#ifndef _NET_PFKEYV2_H_
66#define _NET_PFKEYV2_H_
67#include <sys/appleapiopts.h>
68#include <net/if.h>
69
70/*
71 * This file defines structures and symbols for the PF_KEY Version 2
72 * key management interface. It was written at the U.S. Naval Research
73 * Laboratory. This file is in the public domain. The authors ask that
74 * you leave this credit intact on any copies of this file.
75 */
76#ifndef __PFKEY_V2_H
77#define __PFKEY_V2_H 1
78
79#define PF_KEY_V2 2
80#define PFKEYV2_REVISION 199806L
81
82#define SADB_RESERVED 0
83#define SADB_GETSPI 1
84#define SADB_UPDATE 2
85#define SADB_ADD 3
86#define SADB_DELETE 4
87#define SADB_GET 5
88#define SADB_ACQUIRE 6
89#define SADB_REGISTER 7
90#define SADB_EXPIRE 8
91#define SADB_FLUSH 9
92#define SADB_DUMP 10
93#define SADB_X_PROMISC 11
94#define SADB_X_PCHANGE 12
95
96#define SADB_X_SPDUPDATE 13
97#define SADB_X_SPDADD 14
98#define SADB_X_SPDDELETE 15 /* by policy index */
99#define SADB_X_SPDGET 16
100#define SADB_X_SPDACQUIRE 17
101#define SADB_X_SPDDUMP 18
102#define SADB_X_SPDFLUSH 19
103#define SADB_X_SPDSETIDX 20
104#define SADB_X_SPDEXPIRE 21
105#define SADB_X_SPDDELETE2 22 /* by policy id */
106#define SADB_GETSASTAT 23
107#define SADB_X_SPDENABLE 24 /* by policy id */
108#define SADB_X_SPDDISABLE 25 /* by policy id */
109#define SADB_MIGRATE 26
110#define SADB_MAX 26
111
112struct sadb_msg {
113 u_int8_t sadb_msg_version;
114 u_int8_t sadb_msg_type;
115 u_int8_t sadb_msg_errno;
116 u_int8_t sadb_msg_satype;
117 u_int16_t sadb_msg_len;
118 u_int16_t sadb_msg_reserved;
119 u_int32_t sadb_msg_seq;
120 u_int32_t sadb_msg_pid;
121};
122
123struct sadb_ext {
124 u_int16_t sadb_ext_len;
125 u_int16_t sadb_ext_type;
126};
127
128struct sadb_sa {
129 u_int16_t sadb_sa_len;
130 u_int16_t sadb_sa_exttype;
131 u_int32_t sadb_sa_spi;
132 u_int8_t sadb_sa_replay;
133 u_int8_t sadb_sa_state;
134 u_int8_t sadb_sa_auth;
135 u_int8_t sadb_sa_encrypt;
136 u_int32_t sadb_sa_flags;
137};
138
139
140struct sadb_lifetime {
141 u_int16_t sadb_lifetime_len;
142 u_int16_t sadb_lifetime_exttype;
143 u_int32_t sadb_lifetime_allocations;
144 u_int64_t sadb_lifetime_bytes;
145 u_int64_t sadb_lifetime_addtime;
146 u_int64_t sadb_lifetime_usetime;
147};
148
149struct sadb_address {
150 u_int16_t sadb_address_len;
151 u_int16_t sadb_address_exttype;
152 u_int8_t sadb_address_proto;
153 u_int8_t sadb_address_prefixlen;
154 u_int16_t sadb_address_reserved;
155};
156
157struct sadb_key {
158 u_int16_t sadb_key_len;
159 u_int16_t sadb_key_exttype;
160 u_int16_t sadb_key_bits;
161 u_int16_t sadb_key_reserved;
162};
163
164struct sadb_ident {
165 u_int16_t sadb_ident_len;
166 u_int16_t sadb_ident_exttype;
167 u_int16_t sadb_ident_type;
168 u_int16_t sadb_ident_reserved;
169 u_int64_t sadb_ident_id;
170};
171
172struct sadb_sens {
173 u_int16_t sadb_sens_len;
174 u_int16_t sadb_sens_exttype;
175 u_int32_t sadb_sens_dpd;
176 u_int8_t sadb_sens_sens_level;
177 u_int8_t sadb_sens_sens_len;
178 u_int8_t sadb_sens_integ_level;
179 u_int8_t sadb_sens_integ_len;
180 u_int32_t sadb_sens_reserved;
181};
182
183struct sadb_prop {
184 u_int16_t sadb_prop_len;
185 u_int16_t sadb_prop_exttype;
186 u_int8_t sadb_prop_replay;
187 u_int8_t sadb_prop_reserved[3];
188};
189
190struct sadb_comb {
191 u_int8_t sadb_comb_auth;
192 u_int8_t sadb_comb_encrypt;
193 u_int16_t sadb_comb_flags;
194 u_int16_t sadb_comb_auth_minbits;
195 u_int16_t sadb_comb_auth_maxbits;
196 u_int16_t sadb_comb_encrypt_minbits;
197 u_int16_t sadb_comb_encrypt_maxbits;
198 u_int32_t sadb_comb_reserved;
199 u_int32_t sadb_comb_soft_allocations;
200 u_int32_t sadb_comb_hard_allocations;
201 u_int64_t sadb_comb_soft_bytes;
202 u_int64_t sadb_comb_hard_bytes;
203 u_int64_t sadb_comb_soft_addtime;
204 u_int64_t sadb_comb_hard_addtime;
205 u_int64_t sadb_comb_soft_usetime;
206 u_int64_t sadb_comb_hard_usetime;
207};
208
209struct sadb_supported {
210 u_int16_t sadb_supported_len;
211 u_int16_t sadb_supported_exttype;
212 u_int32_t sadb_supported_reserved;
213};
214
215struct sadb_alg {
216 u_int8_t sadb_alg_id;
217 u_int8_t sadb_alg_ivlen;
218 u_int16_t sadb_alg_minbits;
219 u_int16_t sadb_alg_maxbits;
220 u_int16_t sadb_alg_reserved;
221};
222
223struct sadb_spirange {
224 u_int16_t sadb_spirange_len;
225 u_int16_t sadb_spirange_exttype;
226 u_int32_t sadb_spirange_min;
227 u_int32_t sadb_spirange_max;
228 u_int32_t sadb_spirange_reserved;
229};
230
231struct sadb_x_kmprivate {
232 u_int16_t sadb_x_kmprivate_len;
233 u_int16_t sadb_x_kmprivate_exttype;
234 u_int32_t sadb_x_kmprivate_reserved;
235};
236
237/*
238 * XXX Additional SA Extension.
239 * mode: tunnel or transport
240 * reqid: to make SA unique nevertheless the address pair of SA are same.
241 * Mainly it's for VPN.
242 */
243struct sadb_x_sa2 {
244 u_int16_t sadb_x_sa2_len;
245 u_int16_t sadb_x_sa2_exttype;
246 u_int8_t sadb_x_sa2_mode;
247 union {
248 u_int8_t sadb_x_sa2_reserved1;
249 };
250 union {
251 u_int16_t sadb_x_sa2_reserved2;
252 };
253 u_int32_t sadb_x_sa2_sequence;
254 u_int32_t sadb_x_sa2_reqid;
255};
256
257/* XXX Policy Extension */
258/* sizeof(struct sadb_x_policy) == 16 */
259struct sadb_x_policy {
260 u_int16_t sadb_x_policy_len;
261 u_int16_t sadb_x_policy_exttype;
262 u_int16_t sadb_x_policy_type; /* See policy type of ipsec.h */
263 u_int8_t sadb_x_policy_dir; /* direction, see ipsec.h */
264 u_int8_t sadb_x_policy_reserved;
265 u_int32_t sadb_x_policy_id;
266 u_int32_t sadb_x_policy_reserved2;
267};
268/*
269 * When policy_type == IPSEC, it is followed by some of
270 * the ipsec policy request.
271 * [total length of ipsec policy requests]
272 * = (sadb_x_policy_len * sizeof(uint64_t) - sizeof(struct sadb_x_policy))
273 */
274/* XXX IPsec Policy Request Extension */
275/*
276 * This structure is aligned 8 bytes.
277 */
278struct sadb_x_ipsecrequest {
279 u_int16_t sadb_x_ipsecrequest_len; /* structure length aligned to 8 bytes.
280 * This value is true length of bytes.
281 * Not in units of 64 bits. */
282 u_int16_t sadb_x_ipsecrequest_proto; /* See ipsec.h */
283 u_int8_t sadb_x_ipsecrequest_mode; /* See IPSEC_MODE_XX in ipsec.h. */
284 u_int8_t sadb_x_ipsecrequest_level; /* See IPSEC_LEVEL_XX in ipsec.h */
285 u_int16_t sadb_x_ipsecrequest_reqid; /* See ipsec.h */
286
287 /*
288 * followed by source IP address of SA, and immediately followed by
289 * destination IP address of SA. These encoded into two of sockaddr
290 * structure without any padding. Must set each sa_len exactly.
291 * Each of length of the sockaddr structure are not aligned to 64bits,
292 * but sum of x_request and addresses is aligned to 64bits.
293 */
294};
295
296struct sadb_session_id {
297 u_int16_t sadb_session_id_len;
298 u_int16_t sadb_session_id_exttype;
299 /* [0] is an arbitrary handle that means something only for requester
300 * [1] is a global session id for lookups in the kernel and racoon.
301 */
302 u_int64_t sadb_session_id_v[2];
303} __attribute__ ((aligned(8)));
304
305struct sastat {
306 u_int32_t spi; /* SPI Value, network byte order */
307 u_int32_t created; /* for lifetime */
308 struct sadb_lifetime lft_c; /* CURRENT lifetime. */
309}; // no need to align
310
311struct sadb_sastat {
312 u_int16_t sadb_sastat_len;
313 u_int16_t sadb_sastat_exttype;
314 u_int32_t sadb_sastat_dir;
315 u_int32_t sadb_sastat_reserved;
316 u_int32_t sadb_sastat_list_len;
317 /* list of struct sastat comes after */
318} __attribute__ ((aligned(8)));
319
320#define SADB_EXT_RESERVED 0
321#define SADB_EXT_SA 1
322#define SADB_EXT_LIFETIME_CURRENT 2
323#define SADB_EXT_LIFETIME_HARD 3
324#define SADB_EXT_LIFETIME_SOFT 4
325#define SADB_EXT_ADDRESS_SRC 5
326#define SADB_EXT_ADDRESS_DST 6
327#define SADB_EXT_ADDRESS_PROXY 7
328#define SADB_EXT_KEY_AUTH 8
329#define SADB_EXT_KEY_ENCRYPT 9
330#define SADB_EXT_IDENTITY_SRC 10
331#define SADB_EXT_IDENTITY_DST 11
332#define SADB_EXT_SENSITIVITY 12
333#define SADB_EXT_PROPOSAL 13
334#define SADB_EXT_SUPPORTED_AUTH 14
335#define SADB_EXT_SUPPORTED_ENCRYPT 15
336#define SADB_EXT_SPIRANGE 16
337#define SADB_X_EXT_KMPRIVATE 17
338#define SADB_X_EXT_POLICY 18
339#define SADB_X_EXT_SA2 19
340#define SADB_EXT_SESSION_ID 20
341#define SADB_EXT_SASTAT 21
342#define SADB_X_EXT_IPSECIF 22
343#define SADB_X_EXT_ADDR_RANGE_SRC_START 23
344#define SADB_X_EXT_ADDR_RANGE_SRC_END 24
345#define SADB_X_EXT_ADDR_RANGE_DST_START 25
346#define SADB_X_EXT_ADDR_RANGE_DST_END 26
347#define SADB_EXT_MIGRATE_ADDRESS_SRC 27
348#define SADB_EXT_MIGRATE_ADDRESS_DST 28
349#define SADB_X_EXT_MIGRATE_IPSECIF 29
350#define SADB_EXT_MAX 29
351
352#define SADB_SATYPE_UNSPEC 0
353#define SADB_SATYPE_AH 2
354#define SADB_SATYPE_ESP 3
355#define SADB_SATYPE_RSVP 5
356#define SADB_SATYPE_OSPFV2 6
357#define SADB_SATYPE_RIPV2 7
358#define SADB_SATYPE_MIP 8
359#define SADB_X_SATYPE_IPCOMP 9
360#define SADB_X_SATYPE_POLICY 10
361#define SADB_SATYPE_MAX 11
362
363#define SADB_SASTATE_LARVAL 0
364#define SADB_SASTATE_MATURE 1
365#define SADB_SASTATE_DYING 2
366#define SADB_SASTATE_DEAD 3
367#define SADB_SASTATE_MAX 3
368
369#define SADB_SAFLAGS_PFS 1
370
371/* RFC2367 numbers - meets RFC2407 */
372#define SADB_AALG_NONE 0
373#define SADB_AALG_MD5HMAC 1 /*2*/
374#define SADB_AALG_SHA1HMAC 2 /*3*/
375#define SADB_AALG_MAX 8
376/* private allocations - based on RFC2407/IANA assignment */
377#define SADB_X_AALG_SHA2_256 6 /*5*/
378#define SADB_X_AALG_SHA2_384 7 /*6*/
379#define SADB_X_AALG_SHA2_512 8 /*7*/
380/* private allocations should use 249-255 (RFC2407) */
381#define SADB_X_AALG_MD5 3 /*249*/ /* Keyed MD5, not implemented */
382#define SADB_X_AALG_SHA 4 /*250*/ /* Keyed SHA, not implemented */
383#define SADB_X_AALG_NULL 5 /*251*/ /* null authentication */
384
385/* RFC2367 numbers - meets RFC2407 */
386#define SADB_EALG_NONE 0
387#define SADB_EALG_DESCBC 1 /*2*/
388#define SADB_EALG_3DESCBC 2 /*3*/
389#define SADB_EALG_NULL 3 /*11*/
390#define SADB_EALG_MAX 15
391/* private allocations - based on RFC2407/IANA assignment */
392#define SADB_X_EALG_CAST128CBC 5 /*6*/
393#define SADB_X_EALG_BLOWFISHCBC 4 /*7*/
394#define SADB_X_EALG_RIJNDAELCBC 12
395#define SADB_X_EALG_AESCBC 12
396#define SADB_X_EALG_AES 12
397#define SADB_X_EALG_AES_GCM 13
398#define SADB_X_EALG_CHACHA20POLY1305 14
399#define SADB_X_EALG_AES_GMAC 15
400/* private allocations should use 249-255 (RFC2407) */
401
402#if 1 /*nonstandard */
403#define SADB_X_CALG_NONE 0
404#define SADB_X_CALG_OUI 1
405#define SADB_X_CALG_DEFLATE 2
406#define SADB_X_CALG_LZS 3
407#define SADB_X_CALG_MAX 4
408#endif
409
410#define SADB_IDENTTYPE_RESERVED 0
411#define SADB_IDENTTYPE_PREFIX 1
412#define SADB_IDENTTYPE_FQDN 2
413#define SADB_IDENTTYPE_USERFQDN 3
414#define SADB_X_IDENTTYPE_ADDR 4
415#define SADB_IDENTTYPE_MAX 4
416
417/* `flags' in sadb_sa structure holds followings */
418#define SADB_X_EXT_NONE 0x0000 /* i.e. new format. */
419#define SADB_X_EXT_OLD 0x0001 /* old format. */
420
421#define SADB_X_EXT_IV4B 0x0010 /* IV length of 4 bytes in use */
422#define SADB_X_EXT_DERIV 0x0020 /* DES derived */
423#define SADB_X_EXT_CYCSEQ 0x0040 /* allowing to cyclic sequence. */
424
425/* three of followings are exclusive flags each them */
426#define SADB_X_EXT_PSEQ 0x0000 /* sequencial padding for ESP */
427#define SADB_X_EXT_PRAND 0x0100 /* random padding for ESP */
428#define SADB_X_EXT_PZERO 0x0200 /* zero padding for ESP */
429#define SADB_X_EXT_PMASK 0x0300 /* mask for padding flag */
430
431#define SADB_X_EXT_IIV 0x0400 /* Implicit IV */
432/* Extended Sequence Numbers (RFC 4304). Not implemented in software;
433 * plumbed through to drivers for hardware offload. */
434#define SADB_X_EXT_ESN 0x0800
435
436
437
438#if 1
439#define SADB_X_EXT_RAWCPI 0x0080 /* use well known CPI (IPComp) */
440#endif
441
442#define SADB_KEY_FLAGS_MAX 0x7fff
443
444
445/* SPI size for PF_KEYv2 */
446#define PFKEY_SPI_SIZE sizeof(u_int32_t)
447
448/* Identifier for menber of lifetime structure */
449#define SADB_X_LIFETIME_ALLOCATIONS 0
450#define SADB_X_LIFETIME_BYTES 1
451#define SADB_X_LIFETIME_ADDTIME 2
452#define SADB_X_LIFETIME_USETIME 3
453
454/* The rate for SOFT lifetime against HARD one. */
455#define PFKEY_SOFT_LIFETIME_RATE 80
456
457/* Utilities */
458#define PFKEY_ALIGN8(a) (1 + (((a) - 1) | (8 - 1)))
459#define PFKEY_EXTLEN(msg) \
460 PFKEY_UNUNIT64(((struct sadb_ext *)(msg))->sadb_ext_len)
461#define PFKEY_ADDR_PREFIX(ext) \
462 (((struct sadb_address *)(ext))->sadb_address_prefixlen)
463#define PFKEY_ADDR_PROTO(ext) \
464 (((struct sadb_address *)(ext))->sadb_address_proto)
465#define PFKEY_ADDR_SADDR(ext) \
466 ((struct sockaddr *)((caddr_t)(ext) + sizeof(struct sadb_address)))
467
468/* in 64bits */
469#define PFKEY_UNUNIT64(a) ((a) << 3)
470#define PFKEY_UNIT64(a) ((a) >> 3)
471
472#endif /* __PFKEY_V2_H */
473
474#endif /* _NET_PFKEYV2_H_ */