xref: /illumos-gate/usr/src/uts/common/net/pfpolicy.h (revision bbf21555)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifndef	_NET_PFPOLICY_H
#define	_NET_PFPOLICY_H

/*
 * Definitions and structures for PF_POLICY version 1.
 *
 * This local protocol provides an interface allowing utilities to
 * manage a system's IPsec System Policy Database; see RFC2401 for a
 * conceptual overview of the SPD.
 * The basic encoding is modelled on PF_KEY version 2; see pfkeyv2.h
 * and RFC2367 for more information.
 */

#ifdef	__cplusplus
extern "C" {
#endif

#define	PF_POLICY_V1		1
#define	PF_POLICY_REVISION	200304L

/*
 * Base PF_POLICY message header.  Each request/response starts with
 * one of these, followed by some number of extensions.  Each
 * extension type appears at most once in a message.  spd_msg_len
 * contains the total length of the message including header.
 */
typedef struct spd_msg
{
	uint8_t spd_msg_version;	/* PF_POLICY_V1 */
	uint8_t spd_msg_type;		/* ADD, DELETE, QUERY, ... */
	uint8_t spd_msg_errno;		/* Unix errno space; mbz on request */
	uint8_t spd_msg_spdid;		/* which policy db instance */
	uint16_t spd_msg_len;		/* in 64-bit words */
	uint16_t spd_msg_diagnostic;	/* additional error reason */
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint32_t spd_msg_useq;		/* set by sender */
			uint32_t spd_msg_upid;		/* set by sender */
		} spd_msg_actual;
		uint64_t spd_msg_alignment;
	} spd_msg_u;
#define	spd_msg_seq spd_msg_u.spd_msg_actual.spd_msg_useq
#define	spd_msg_pid spd_msg_u.spd_msg_actual.spd_msg_upid
} spd_msg_t;

/*
 * Command numbers, found in spd_msg_type.
 */
#define	SPD_RESERVED				0
#define	SPD_MIN					1
#define	SPD_FLUSH				1
#define	SPD_ADDRULE				2
#define	SPD_DELETERULE				3
#define	SPD_FLIP				4
#define	SPD_LOOKUP				5
#define	SPD_DUMP				6
#define	SPD_CLONE				7
#define	SPD_ALGLIST				8
#define	SPD_DUMPALGS				9
#define	SPD_UPDATEALGS				10
#define	SPD_MAX					10

/*
 * Well-known policy db instances, found in spd_msg_spdid
 */
#define	SPD_ACTIVE		0	/* The currently active instance */
#define	SPD_STANDBY		1 	/* "on deck" standby SPD */

/*
 * The spd_msg_t is followed by extensions, which start with the
 * following header; each extension structure includes the length and
 * type fields internally as an overlay to simplify parsing and
 * construction.
 */
typedef struct spd_ext
{
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_ext_ulen;		/* in 64-bit words */
			uint16_t spd_ext_utype;		/* 0 is reserved */
		} spd_ext_actual;
		uint64_t spd_ext_alignment;
	} spd_ext_u;
#define	spd_ext_len spd_ext_u.spd_ext_actual.spd_ext_ulen
#define	spd_ext_type spd_ext_u.spd_ext_actual.spd_ext_utype
} spd_ext_t;

/*
 * Extension numbers, found in spd_ext_type.
 */

#define	SPD_EXT_LCLPORT				1
#define	SPD_EXT_REMPORT				2
#define	SPD_EXT_PROTO				3
#define	SPD_EXT_LCLADDR				4
#define	SPD_EXT_REMADDR				5

#define	SPD_EXT_ACTION				6
#define	SPD_EXT_RULE				7
#define	SPD_EXT_RULESET				8
#define	SPD_EXT_ICMP_TYPECODE  			9

#define	SPD_EXT_TUN_NAME			10

#define	SPD_EXT_MAX				10

/*
 * base policy rule (attributes which every rule has)
 *
 * spd_rule_index MBZ on a SPD_ADD, and is assigned by the kernel.
 * subsequent deletes can operate either by specifying selectors or by
 * specifying a non-zero rule index.
 */
struct spd_rule
{
	uint16_t spd_rule_len;
	uint16_t spd_rule_type;		/* SPD_EXT_RULE */
	uint32_t spd_rule_priority;
	uint32_t spd_rule_flags;	/* INBOUND, OUTBOUND, ... */
	uint32_t spd_rule_unused;
	uint64_t spd_rule_index;	/* unique rule identifier. */
};

/*
 * Flags for spd_rule.spd_rule_flags
 */
#define	SPD_RULE_FLAG_INBOUND		0x0001
#define	SPD_RULE_FLAG_OUTBOUND		0x0002
/* Only applies to tunnel policy heads. */
#define	SPD_RULE_FLAG_TUNNEL		0x0004

/*
 * Address selectors.   Different from PF_KEY because we want a
 * more precise format for wildcards on ports/protocol.
 */
typedef struct spd_address {
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_address_ulen;
			uint16_t spd_address_uexttype;	/* SRC, DST */
			uint8_t spd_address_uaf;	/* address family. */
			uint8_t spd_address_uprefixlen;	/* Prefix len (bits). */
			uint16_t spd_address_ureserved2; /* Padding */
		} spd_address_actual;
		uint64_t spd_address_alignment;
	} spd_address_u;
	/*
	 * .. followed by 4 bytes of IPv4 or 16 bytes of IPv6 address,
	 * padded up to next uint64_t
	 */
#define	spd_address_len	\
	spd_address_u.spd_address_actual.spd_address_ulen
#define	spd_address_exttype \
	spd_address_u.spd_address_actual.spd_address_uexttype
#define	spd_address_af \
	spd_address_u.spd_address_actual.spd_address_uaf
#define	spd_address_prefixlen \
	spd_address_u.spd_address_actual.spd_address_uprefixlen
#define	spd_address_reserved2 \
	spd_address_u.spd_address_actual.spd_address_ureserved2
} spd_address_t;

/*
 * Protocol selector
 */
struct spd_proto
{
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_proto_ulen;
			uint16_t spd_proto_uexttype;		/* PROTO */
			uint8_t spd_proto_unumber;		/* IPPROTO_* */
			uint8_t	spd_proto_ureserved1;		 /* pad */
			uint16_t spd_proto_ureserved2;		 /* pad */
		} spd_proto_actual;
		uint64_t spd_proto_alignment;
	} spd_proto_u;
#define	spd_proto_len spd_proto_u.spd_proto_actual.spd_proto_ulen
#define	spd_proto_exttype spd_proto_u.spd_proto_actual.spd_proto_uexttype
#define	spd_proto_number spd_proto_u.spd_proto_actual.spd_proto_unumber
#define	spd_proto_reserved1 spd_proto_u.spd_proto_actual.spd_proto_ureserved1
#define	spd_proto_reserved2 spd_proto_u.spd_proto_actual.spd_proto_ureserved2
};

/*
 * Port selector.  We only support minport==maxport at present.
 */
struct spd_portrange
{
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_ports_ulen;
			uint16_t spd_ports_uexttype;	/* LCLPORT, REMPORT */
			uint16_t spd_ports_uminport;	/* min port */
			uint16_t spd_ports_umaxport;	/* max port */
		} spd_ports_actual;
		uint64_t spd_ports_alignment;
	} spd_ports_u;
#define	spd_ports_len spd_ports_u.spd_ports_actual.spd_ports_ulen
#define	spd_ports_exttype spd_ports_u.spd_ports_actual.spd_ports_uexttype
#define	spd_ports_minport spd_ports_u.spd_ports_actual.spd_ports_uminport
#define	spd_ports_maxport spd_ports_u.spd_ports_actual.spd_ports_umaxport
};

/*
 * ICMP type selector.
 */
struct spd_typecode
{
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_typecode_ulen;
			uint16_t spd_typecode_uexttype;	/* ICMP_TYPECODE */
			uint8_t  spd_typecode_utype;
			uint8_t  spd_typecode_utype_end;
			uint8_t  spd_typecode_ucode;
			uint8_t  spd_typecode_ucode_end;
		} spd_typecode_actual;
		uint64_t spd_typecode_alignment;
	} spd_typecode_u;
#define	spd_typecode_len	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_ulen
#define	spd_typecode_exttype	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_uexttype
#define	spd_typecode_type	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_utype
#define	spd_typecode_type_end	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_utype_end
#define	spd_typecode_code	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_ucode
#define	spd_typecode_code_end	\
    spd_typecode_u.spd_typecode_actual.spd_typecode_ucode_end
};


/*
 * Actions, specifying what happens to packets which match selectors.
 * This extension is followed by some number of spd_attribute tag-value pairs
 * which encode one or more alternative policies; see below for
 * the encoding used.
 */
struct spd_ext_actions
{
	/* Union is for guaranteeing 64-bit alignment. */
	union {
		struct {
			uint16_t spd_actions_ulen;
			uint16_t spd_actions_uexttype;	/* ACTION */
			uint16_t spd_actions_ucount;	/* # of alternatives */
			uint16_t spd_actions_ureserved;
		} spd_actions_actual;
		uint64_t spd_actions_alignment;
	} spd_actions_u;
#define	spd_actions_len \
	spd_actions_u.spd_actions_actual.spd_actions_ulen
#define	spd_actions_exttype \
	spd_actions_u.spd_actions_actual.spd_actions_uexttype
#define	spd_actions_count \
	spd_actions_u.spd_actions_actual.spd_actions_ucount
#define	spd_actions_reserved \
	spd_actions_u.spd_actions_actual.spd_actions_ureserved
};

/*
 * Extensible encoding for requested SA attributes.
 * To allow additional attributes to be added, we use a simple-to-interpret
 * (tag, value) encoding to fill in attributes in a list of alternatives.
 *
 * We fill in alternatives one at a time, starting with most-preferred,
 * proceeding to least-preferred.
 *
 * Conceptually, we are filling in attributes of a "template", and
 * then copying that template value into the list of alternatives when
 * we see a SPD_ATTR_END or SPD_ATTR_NEXT.
 *
 * The template is not changed by SPD_ATTR_NEXT, so that attributes common to
 * all alternatives need only be mentioned once.
 *
 * spd_actions_count is the maximum number of alternatives present; it
 * should be one greater than the number of SPD_ATTR_NEXT opcodes
 * present in the sequence.
 */

struct spd_attribute
{
	union {
		struct {
			uint32_t	spd_attr_utag;
			uint32_t	spd_attr_uvalue;
		} spd_attribute_actual;
		uint64_t spd_attribute_alignment;
	} spd_attribute_u;
#define	spd_attr_tag spd_attribute_u.spd_attribute_actual.spd_attr_utag
#define	spd_attr_value spd_attribute_u.spd_attribute_actual.spd_attr_uvalue
};

/*
 * These flags are used by the kernel algorithm structures and by ipsecalgs(8).
 * ALG_FLAG_KERNELCHECKED is used by ipsecalgs(8) to tag ipsecalgent_t as
 * kernel verified. ALG_FLAG_VALID is only meaningful if set by the kernel.
 */
#define	ALG_FLAG_VALID		0x01
#define	ALG_FLAG_COUNTERMODE	0x02
#define	ALG_FLAG_COMBINED	0x04
#define	ALG_FLAG_CCM		0x08
#define	ALG_FLAG_GCM		0x10
#define	ALG_FLAG_KERNELCHECKED	0x80000000

#define	SPD_ATTR_NOP	0x00000000	/* space filler */
#define	SPD_ATTR_END	0x00000001	/* end of description */
#define	SPD_ATTR_EMPTY	0x00000002	/* reset template to default */
#define	SPD_ATTR_NEXT	0x00000003	/* start filling next alternative */

#define	SPD_ATTR_TYPE			0x00000100
#define	SPD_ATTR_FLAGS			0x00000101
#define	SPD_ATTR_AH_AUTH		0x00000102
#define	SPD_ATTR_ESP_ENCR		0x00000103
#define	SPD_ATTR_ESP_AUTH		0x00000104
#define	SPD_ATTR_ENCR_MINBITS		0x00000105
#define	SPD_ATTR_ENCR_MAXBITS		0x00000106
#define	SPD_ATTR_AH_MINBITS		0x00000107
#define	SPD_ATTR_AH_MAXBITS		0x00000108
#define	SPD_ATTR_LIFE_SOFT_TIME		0x00000109
#define	SPD_ATTR_LIFE_HARD_TIME		0x0000010a
#define	SPD_ATTR_LIFE_SOFT_BYTES	0x0000010b
#define	SPD_ATTR_LIFE_HARD_BYTES	0x0000010c
#define	SPD_ATTR_KM_PROTO		0x0000010d
#define	SPD_ATTR_KM_COOKIE		0x0000010e
#define	SPD_ATTR_REPLAY_DEPTH		0x0000010f
#define	SPD_ATTR_ESPA_MINBITS		0x00000110
#define	SPD_ATTR_ESPA_MAXBITS		0x00000111
#define	SPD_ATTR_ENCR_DEFBITS		0x00000112
#define	SPD_ATTR_ENCR_INCRBITS		0x00000113
#define	SPD_ATTR_AH_DEFBITS		0x00000114
#define	SPD_ATTR_AH_INCRBITS		0x00000115
#define	SPD_ATTR_ESPA_DEFBITS		0x00000116
#define	SPD_ATTR_ESPA_INCRBITS		0x00000117
#define	SPD_ATTR_ALG_ID			0x00000118
#define	SPD_ATTR_ALG_PROTO		0x00000119
#define	SPD_ATTR_ALG_INCRBITS		0x0000011a
#define	SPD_ATTR_ALG_NKEYSIZES		0x0000011b
#define	SPD_ATTR_ALG_KEYSIZE		0x0000011c
#define	SPD_ATTR_ALG_NBLOCKSIZES	0x0000011d
#define	SPD_ATTR_ALG_BLOCKSIZE		0x0000011e
#define	SPD_ATTR_ALG_MECHNAME		0x0000011f
#define	SPD_ATTR_PROTO_ID		0x00000120
#define	SPD_ATTR_PROTO_EXEC_MODE	0x00000121
#define	SPD_ATTR_ALG_NPARAMS		0x00000122
#define	SPD_ATTR_ALG_PARAMS		0x00000123
#define	SPD_ATTR_ALG_FLAGS		0x00000124

/*
 * An interface extension identifies a network interface.
 * It is used for configuring Tunnel Mode policies on a tunnelling
 * interface for now.
 */
typedef struct spd_if_s {
	union {
		struct {
			uint16_t spd_if_ulen;
			uint16_t spd_if_uexttype;
			union {
				uint8_t spd_if_iuname[4];
				uint32_t spd_if_iuindex;
			} spd_if_iu;
		} spd_if_actual;
		uint64_t spd_if_alignment;
	} spd_if_u;
#define	spd_if_len spd_if_u.spd_if_actual.spd_if_ulen
#define	spd_if_exttype spd_if_u.spd_if_actual.spd_if_uexttype
#define	spd_if_name spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuname
#define	spd_if_index spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuindex
} spd_if_t;

/*
 * Minimum, maximum key lengths in bits.
 */
#define	SPD_MIN_MINBITS		0x0000
#define	SPD_MAX_MAXBITS		0xffff

/*
 * IPsec action types (in SPD_ATTR_TYPE attribute)
 */
#define	SPD_ACTTYPE_DROP	0x0001
#define	SPD_ACTTYPE_PASS	0x0002
#define	SPD_ACTTYPE_IPSEC	0x0003

/*
 * Action flags (in SPD_ATTR_FLAGS attribute)
 */
#define	SPD_APPLY_AH		0x0001
#define	SPD_APPLY_ESP		0x0002
#define	SPD_APPLY_SE		0x0004  /* self-encapsulation */
#define	SPD_APPLY_COMP		0x0008	/* compression; NYI */
#define	SPD_APPLY_UNIQUE	0x0010	/* unique per-flow SA */
#define	SPD_APPLY_BYPASS	0x0020	/* bypass policy */
#define	SPD_APPLY_ESPA		0x0040 	/* ESP authentication */

/*
 * SW crypto execution modes.
 */
#define	SPD_ALG_EXEC_MODE_SYNC		1	/* synchronous */
#define	SPD_ALG_EXEC_MODE_ASYNC		2	/* asynchronous */

/*
 * SPD_DUMP protocol:
 *
 * We do not want to force an stack to have to read-lock the entire
 * SPD for the duration of the dump, but we want management apps to be
 * able to get a consistent snapshot of the SPD.
 *
 * Therefore, we make optimistic locking assumptions.
 *
 * The response to a SPD_DUMP request consists of multiple spd_msg
 * records, all with spd_msg_type == SPD_DUMP and spd_msg_{seq,pid}
 * matching the request.
 *
 * There is one header, then a sequence of policy rule records (one
 * rule per record), then a trailer.
 *
 * The header and trailer both contain a single SPD_EXT_RULESET
 * containing a version number and rule count.  The dump was "good" if
 * header version == trailer version, and the number of rules read by
 * the application matches the rule count in the trailer.  The rule
 * count in the header is unused and should be set to zero.
 *
 * In between, each rule record contains a set of extensions which, if
 * used in an SPD_ADD request, would recreate an equivalent rule.
 *
 * If rules were added to the SPD during the dump, the dump may be
 * truncated or otherwise incomplete; the management application
 * should re-try the dump in this case.
 */

/*
 * Ruleset extension, used at the start and end of a SPD_DUMP.
 */
typedef struct spd_ruleset_ext
{
	uint16_t spd_ruleset_len;	/* 2 x 64 bits */
	uint16_t spd_ruleset_type;	/* SPD_EXT_RULESET */
	uint32_t spd_ruleset_count;	/* only valid in trailer */
	uint64_t spd_ruleset_version;	/* version number */
} spd_ruleset_ext_t;

/*
 * Diagnostic codes.  These supplement error messages.  Be sure to
 * update libipsecutil's spdsock_diag() if you change any of these.
 */
#define	SPD_DIAGNOSTIC_NONE			0
#define	SPD_DIAGNOSTIC_UNKNOWN_EXT		1
#define	SPD_DIAGNOSTIC_BAD_EXTLEN		2
#define	SPD_DIAGNOSTIC_NO_RULE_EXT		3
#define	SPD_DIAGNOSTIC_BAD_ADDR_LEN		4
#define	SPD_DIAGNOSTIC_MIXED_AF			5
#define	SPD_DIAGNOSTIC_ADD_NO_MEM		6
#define	SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT	7
#define	SPD_DIAGNOSTIC_ADD_BAD_TYPE		8
#define	SPD_DIAGNOSTIC_ADD_BAD_FLAGS		9
#define	SPD_DIAGNOSTIC_ADD_INCON_FLAGS		10
#define	SPD_DIAGNOSTIC_MALFORMED_LCLPORT 	11
#define	SPD_DIAGNOSTIC_DUPLICATE_LCLPORT	12
#define	SPD_DIAGNOSTIC_MALFORMED_REMPORT	13
#define	SPD_DIAGNOSTIC_DUPLICATE_REMPORT	14
#define	SPD_DIAGNOSTIC_MALFORMED_PROTO		15
#define	SPD_DIAGNOSTIC_DUPLICATE_PROTO		16
#define	SPD_DIAGNOSTIC_MALFORMED_LCLADDR	17
#define	SPD_DIAGNOSTIC_DUPLICATE_LCLADDR	18
#define	SPD_DIAGNOSTIC_MALFORMED_REMADDR	19
#define	SPD_DIAGNOSTIC_DUPLICATE_REMADDR	20
#define	SPD_DIAGNOSTIC_MALFORMED_ACTION		21
#define	SPD_DIAGNOSTIC_DUPLICATE_ACTION		22
#define	SPD_DIAGNOSTIC_MALFORMED_RULE		23
#define	SPD_DIAGNOSTIC_DUPLICATE_RULE		24
#define	SPD_DIAGNOSTIC_MALFORMED_RULESET	25
#define	SPD_DIAGNOSTIC_DUPLICATE_RULESET	26
#define	SPD_DIAGNOSTIC_INVALID_RULE_INDEX	27
#define	SPD_DIAGNOSTIC_BAD_SPDID		28
#define	SPD_DIAGNOSTIC_BAD_MSG_TYPE		29
#define	SPD_DIAGNOSTIC_UNSUPP_AH_ALG		30
#define	SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG	31
#define	SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG	32
#define	SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE	33
#define	SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE	34
#define	SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE	35
#define	SPD_DIAGNOSTIC_NO_ACTION_EXT		36
#define	SPD_DIAGNOSTIC_ALG_ID_RANGE		37
#define	SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES	38
#define	SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES	39
#define	SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN	40
#define	SPD_DIAGNOSTIC_ALG_IPSEC_NOT_LOADED	41
#define	SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE	42
#define	SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE	43
#define	SPD_DIAGNOSTIC_NOT_GLOBAL_OP		44
#define	SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS	45

/*
 * Helper macros.
 */
#define	SPD_64TO8(x)	((x) << 3)
#define	SPD_8TO64(x)	((x) >> 3)
#define	SPD_8TO1(x)	((x) << 3)
#define	SPD_1TO8(x)	((x) >> 3)

#ifdef	__cplusplus
}
#endif

#endif	/* _NET_PFPOLICY_H */