include/net/pfpolicy.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #ifndef _NET_PFPOLICY_H
  27 #define _NET_PFPOLICY_H
  28
  29 /*
  30  * Definitions and structures for PF_POLICY version 1.
  31  *
  32  * This local protocol provides an interface allowing utilities to
  33  * manage a system's IPsec System Policy Database; see RFC2401 for a
  34  * conceptual overview of the SPD.
  35  * The basic encoding is modelled on PF_KEY version 2; see pfkeyv2.h
  36  * and RFC2367 for more information.
  37  */
  38
  39 #ifdef  __cplusplus
  40 extern "C" {
  41 #endif
  42
  43 #define PF_POLICY_V1            1
  44 #define PF_POLICY_REVISION      200304L
  45
  46 /*
  47  * Base PF_POLICY message header.  Each request/response starts with
  48  * one of these, followed by some number of extensions.  Each
  49  * extension type appears at most once in a message.  spd_msg_len
  50  * contains the total length of the message including header.
  51  */
  52 typedef struct spd_msg
  53 {
  54         uint8_t spd_msg_version;        /* PF_POLICY_V1 */
  55         uint8_t spd_msg_type;           /* ADD, DELETE, QUERY, ... */
  56         uint8_t spd_msg_errno;          /* Unix errno space; mbz on request */
  57         uint8_t spd_msg_spdid;          /* which policy db instance */
  58         uint16_t spd_msg_len;           /* in 64-bit words */
  59         uint16_t spd_msg_diagnostic;    /* additional error reason */
  60         /* Union is for guaranteeing 64-bit alignment. */
  61         union {
  62                 struct {
  63                         uint32_t spd_msg_useq;          /* set by sender */
  64                         uint32_t spd_msg_upid;          /* set by sender */
  65                 } spd_msg_actual;
  66                 uint64_t spd_msg_alignment;
  67         } spd_msg_u;
  68 #define spd_msg_seq spd_msg_u.spd_msg_actual.spd_msg_useq
  69 #define spd_msg_pid spd_msg_u.spd_msg_actual.spd_msg_upid
  70 } spd_msg_t;
  71
  72 /*
  73  * Command numbers, found in spd_msg_type.
  74  */
  75 #define SPD_RESERVED                            0
  76 #define SPD_MIN                                 1
  77 #define SPD_FLUSH                               1
  78 #define SPD_ADDRULE                             2
  79 #define SPD_DELETERULE                          3
  80 #define SPD_FLIP                                4
  81 #define SPD_LOOKUP                              5
  82 #define SPD_DUMP                                6
  83 #define SPD_CLONE                               7
  84 #define SPD_ALGLIST                             8
  85 #define SPD_DUMPALGS                            9
  86 #define SPD_UPDATEALGS                          10
  87 #define SPD_MAX                                 10
  88
  89 /*
  90  * Well-known policy db instances, found in spd_msg_spdid
  91  */
  92 #define SPD_ACTIVE              0       /* The currently active instance */
  93 #define SPD_STANDBY             1       /* "on deck" standby SPD */
  94
  95 /*
  96  * The spd_msg_t is followed by extensions, which start with the
  97  * following header; each extension structure includes the length and
  98  * type fields internally as an overlay to simplify parsing and
  99  * construction.
 100  */
 101 typedef struct spd_ext
 102 {
 103         /* Union is for guaranteeing 64-bit alignment. */
 104         union {
 105                 struct {
 106                         uint16_t spd_ext_ulen;          /* in 64-bit words */
 107                         uint16_t spd_ext_utype;         /* 0 is reserved */
 108                 } spd_ext_actual;
 109                 uint64_t spd_ext_alignment;
 110         } spd_ext_u;
 111 #define spd_ext_len spd_ext_u.spd_ext_actual.spd_ext_ulen
 112 #define spd_ext_type spd_ext_u.spd_ext_actual.spd_ext_utype
 113 } spd_ext_t;
 114
 115 /*
 116  * Extension numbers, found in spd_ext_type.
 117  */
 118
 119 #define SPD_EXT_LCLPORT                         1
 120 #define SPD_EXT_REMPORT                         2
 121 #define SPD_EXT_PROTO                           3
 122 #define SPD_EXT_LCLADDR                         4
 123 #define SPD_EXT_REMADDR                         5
 124
 125 #define SPD_EXT_ACTION                          6
 126 #define SPD_EXT_RULE                            7
 127 #define SPD_EXT_RULESET                         8
 128 #define SPD_EXT_ICMP_TYPECODE                   9
 129
 130 #define SPD_EXT_TUN_NAME                        10
 131
 132 #define SPD_EXT_MAX                             10
 133
 134 /*
 135  * base policy rule (attributes which every rule has)
 136  *
 137  * spd_rule_index MBZ on a SPD_ADD, and is assigned by the kernel.
 138  * subsequent deletes can operate either by specifying selectors or by
 139  * specifying a non-zero rule index.
 140  */
 141 struct spd_rule
 142 {
 143         uint16_t spd_rule_len;
 144         uint16_t spd_rule_type;         /* SPD_EXT_RULE */
 145         uint32_t spd_rule_priority;
 146         uint32_t spd_rule_flags;        /* INBOUND, OUTBOUND, ... */
 147         uint32_t spd_rule_unused;
 148         uint64_t spd_rule_index;        /* unique rule identifier. */
 149 };
 150
 151 /*
 152  * Flags for spd_rule.spd_rule_flags
 153  */
 154 #define SPD_RULE_FLAG_INBOUND           0x0001
 155 #define SPD_RULE_FLAG_OUTBOUND          0x0002
 156 /* Only applies to tunnel policy heads. */
 157 #define SPD_RULE_FLAG_TUNNEL            0x0004
 158
 159 /*
 160  * Address selectors.   Different from PF_KEY because we want a
 161  * more precise format for wildcards on ports/protocol.
 162  */
 163 typedef struct spd_address {
 164         /* Union is for guaranteeing 64-bit alignment. */
 165         union {
 166                 struct {
 167                         uint16_t spd_address_ulen;
 168                         uint16_t spd_address_uexttype;  /* SRC, DST */
 169                         uint8_t spd_address_uaf;        /* address family. */
 170                         uint8_t spd_address_uprefixlen; /* Prefix len (bits). */
 171                         uint16_t spd_address_ureserved2; /* Padding */
 172                 } spd_address_actual;
 173                 uint64_t spd_address_alignment;
 174         } spd_address_u;
 175         /*
 176          * .. followed by 4 bytes of IPv4 or 16 bytes of IPv6 address,
 177          * padded up to next uint64_t
 178          */
 179 #define spd_address_len \
 180         spd_address_u.spd_address_actual.spd_address_ulen
 181 #define spd_address_exttype \
 182         spd_address_u.spd_address_actual.spd_address_uexttype
 183 #define spd_address_af \
 184         spd_address_u.spd_address_actual.spd_address_uaf
 185 #define spd_address_prefixlen \
 186         spd_address_u.spd_address_actual.spd_address_uprefixlen
 187 #define spd_address_reserved2 \
 188         spd_address_u.spd_address_actual.spd_address_ureserved2
 189 } spd_address_t;
 190
 191 /*
 192  * Protocol selector
 193  */
 194 struct spd_proto
 195 {
 196         /* Union is for guaranteeing 64-bit alignment. */
 197         union {
 198                 struct {
 199                         uint16_t spd_proto_ulen;
 200                         uint16_t spd_proto_uexttype;            /* PROTO */
 201                         uint8_t spd_proto_unumber;              /* IPPROTO_* */
 202                         uint8_t spd_proto_ureserved1;            /* pad */
 203                         uint16_t spd_proto_ureserved2;           /* pad */
 204                 } spd_proto_actual;
 205                 uint64_t spd_proto_alignment;
 206         } spd_proto_u;
 207 #define spd_proto_len spd_proto_u.spd_proto_actual.spd_proto_ulen
 208 #define spd_proto_exttype spd_proto_u.spd_proto_actual.spd_proto_uexttype
 209 #define spd_proto_number spd_proto_u.spd_proto_actual.spd_proto_unumber
 210 #define spd_proto_reserved1 spd_proto_u.spd_proto_actual.spd_proto_ureserved1
 211 #define spd_proto_reserved2 spd_proto_u.spd_proto_actual.spd_proto_ureserved2
 212 };
 213
 214 /*
 215  * Port selector.  We only support minport==maxport at present.
 216  */
 217 struct spd_portrange
 218 {
 219         /* Union is for guaranteeing 64-bit alignment. */
 220         union {
 221                 struct {
 222                         uint16_t spd_ports_ulen;
 223                         uint16_t spd_ports_uexttype;    /* LCLPORT, REMPORT */
 224                         uint16_t spd_ports_uminport;    /* min port */
 225                         uint16_t spd_ports_umaxport;    /* max port */
 226                 } spd_ports_actual;
 227                 uint64_t spd_ports_alignment;
 228         } spd_ports_u;
 229 #define spd_ports_len spd_ports_u.spd_ports_actual.spd_ports_ulen
 230 #define spd_ports_exttype spd_ports_u.spd_ports_actual.spd_ports_uexttype
 231 #define spd_ports_minport spd_ports_u.spd_ports_actual.spd_ports_uminport
 232 #define spd_ports_maxport spd_ports_u.spd_ports_actual.spd_ports_umaxport
 233 };
 234
 235 /*
 236  * ICMP type selector.
 237  */
 238 struct spd_typecode
 239 {
 240         /* Union is for guaranteeing 64-bit alignment. */
 241         union {
 242                 struct {
 243                         uint16_t spd_typecode_ulen;
 244                         uint16_t spd_typecode_uexttype; /* ICMP_TYPECODE */
 245                         uint8_t  spd_typecode_utype;
 246                         uint8_t  spd_typecode_utype_end;
 247                         uint8_t  spd_typecode_ucode;
 248                         uint8_t  spd_typecode_ucode_end;
 249                 } spd_typecode_actual;
 250                 uint64_t spd_typecode_alignment;
 251         } spd_typecode_u;
 252 #define spd_typecode_len        \
 253     spd_typecode_u.spd_typecode_actual.spd_typecode_ulen
 254 #define spd_typecode_exttype    \
 255     spd_typecode_u.spd_typecode_actual.spd_typecode_uexttype
 256 #define spd_typecode_type       \
 257     spd_typecode_u.spd_typecode_actual.spd_typecode_utype
 258 #define spd_typecode_type_end   \
 259     spd_typecode_u.spd_typecode_actual.spd_typecode_utype_end
 260 #define spd_typecode_code       \
 261     spd_typecode_u.spd_typecode_actual.spd_typecode_ucode
 262 #define spd_typecode_code_end   \
 263     spd_typecode_u.spd_typecode_actual.spd_typecode_ucode_end
 264 };
 265
 266
 267 /*
 268  * Actions, specifying what happens to packets which match selectors.
 269  * This extension is followed by some number of spd_attribute tag-value pairs
 270  * which encode one or more alternative policies; see below for
 271  * the encoding used.
 272  */
 273 struct spd_ext_actions
 274 {
 275         /* Union is for guaranteeing 64-bit alignment. */
 276         union {
 277                 struct {
 278                         uint16_t spd_actions_ulen;
 279                         uint16_t spd_actions_uexttype;  /* ACTION */
 280                         uint16_t spd_actions_ucount;    /* # of alternatives */
 281                         uint16_t spd_actions_ureserved;
 282                 } spd_actions_actual;
 283                 uint64_t spd_actions_alignment;
 284         } spd_actions_u;
 285 #define spd_actions_len \
 286         spd_actions_u.spd_actions_actual.spd_actions_ulen
 287 #define spd_actions_exttype \
 288         spd_actions_u.spd_actions_actual.spd_actions_uexttype
 289 #define spd_actions_count \
 290         spd_actions_u.spd_actions_actual.spd_actions_ucount
 291 #define spd_actions_reserved \
 292         spd_actions_u.spd_actions_actual.spd_actions_ureserved
 293 };
 294
 295 /*
 296  * Extensible encoding for requested SA attributes.
 297  * To allow additional attributes to be added, we use a simple-to-interpret
 298  * (tag, value) encoding to fill in attributes in a list of alternatives.
 299  *
 300  * We fill in alternatives one at a time, starting with most-preferred,
 301  * proceeding to least-preferred.
 302  *
 303  * Conceptually, we are filling in attributes of a "template", and
 304  * then copying that template value into the list of alternatives when
 305  * we see a SPD_ATTR_END or SPD_ATTR_NEXT.
 306  *
 307  * The template is not changed by SPD_ATTR_NEXT, so that attributes common to
 308  * all alternatives need only be mentioned once.
 309  *
 310  * spd_actions_count is the maximum number of alternatives present; it
 311  * should be one greater than the number of SPD_ATTR_NEXT opcodes
 312  * present in the sequence.
 313  */
 314
 315 struct spd_attribute
 316 {
 317         union {
 318                 struct {
 319                         uint32_t        spd_attr_utag;
 320                         uint32_t        spd_attr_uvalue;
 321                 } spd_attribute_actual;
 322                 uint64_t spd_attribute_alignment;
 323         } spd_attribute_u;
 324 #define spd_attr_tag spd_attribute_u.spd_attribute_actual.spd_attr_utag
 325 #define spd_attr_value spd_attribute_u.spd_attribute_actual.spd_attr_uvalue
 326 };
 327
 328 /*
 329  * These flags are used by the kernel algorithm structures and by ipsecalgs(1m).
 330  * ALG_FLAG_KERNELCHECKED is used by ipsecalgs(1m) to tag ipsecalgent_t as
 331  * kernel verified. ALG_FLAG_VALID is only meaningful if set by the kernel.
 332  */
 333 #define ALG_FLAG_VALID          0x01
 334 #define ALG_FLAG_COUNTERMODE    0x02
 335 #define ALG_FLAG_COMBINED       0x04
 336 #define ALG_FLAG_CCM            0x08
 337 #define ALG_FLAG_GCM            0x10
 338 #define ALG_FLAG_KERNELCHECKED  0x80000000
 339
 340 #define SPD_ATTR_NOP    0x00000000      /* space filler */
 341 #define SPD_ATTR_END    0x00000001      /* end of description */
 342 #define SPD_ATTR_EMPTY  0x00000002      /* reset template to default */
 343 #define SPD_ATTR_NEXT   0x00000003      /* start filling next alternative */
 344
 345 #define SPD_ATTR_TYPE                   0x00000100
 346 #define SPD_ATTR_FLAGS                  0x00000101
 347 #define SPD_ATTR_AH_AUTH                0x00000102
 348 #define SPD_ATTR_ESP_ENCR               0x00000103
 349 #define SPD_ATTR_ESP_AUTH               0x00000104
 350 #define SPD_ATTR_ENCR_MINBITS           0x00000105
 351 #define SPD_ATTR_ENCR_MAXBITS           0x00000106
 352 #define SPD_ATTR_AH_MINBITS             0x00000107
 353 #define SPD_ATTR_AH_MAXBITS             0x00000108
 354 #define SPD_ATTR_LIFE_SOFT_TIME         0x00000109
 355 #define SPD_ATTR_LIFE_HARD_TIME         0x0000010a
 356 #define SPD_ATTR_LIFE_SOFT_BYTES        0x0000010b
 357 #define SPD_ATTR_LIFE_HARD_BYTES        0x0000010c
 358 #define SPD_ATTR_KM_PROTO               0x0000010d
 359 #define SPD_ATTR_KM_COOKIE              0x0000010e
 360 #define SPD_ATTR_REPLAY_DEPTH           0x0000010f
 361 #define SPD_ATTR_ESPA_MINBITS           0x00000110
 362 #define SPD_ATTR_ESPA_MAXBITS           0x00000111
 363 #define SPD_ATTR_ENCR_DEFBITS           0x00000112
 364 #define SPD_ATTR_ENCR_INCRBITS          0x00000113
 365 #define SPD_ATTR_AH_DEFBITS             0x00000114
 366 #define SPD_ATTR_AH_INCRBITS            0x00000115
 367 #define SPD_ATTR_ESPA_DEFBITS           0x00000116
 368 #define SPD_ATTR_ESPA_INCRBITS          0x00000117
 369 #define SPD_ATTR_ALG_ID                 0x00000118
 370 #define SPD_ATTR_ALG_PROTO              0x00000119
 371 #define SPD_ATTR_ALG_INCRBITS           0x0000011a
 372 #define SPD_ATTR_ALG_NKEYSIZES          0x0000011b
 373 #define SPD_ATTR_ALG_KEYSIZE            0x0000011c
 374 #define SPD_ATTR_ALG_NBLOCKSIZES        0x0000011d
 375 #define SPD_ATTR_ALG_BLOCKSIZE          0x0000011e
 376 #define SPD_ATTR_ALG_MECHNAME           0x0000011f
 377 #define SPD_ATTR_PROTO_ID               0x00000120
 378 #define SPD_ATTR_PROTO_EXEC_MODE        0x00000121
 379 #define SPD_ATTR_ALG_NPARAMS            0x00000122
 380 #define SPD_ATTR_ALG_PARAMS             0x00000123
 381 #define SPD_ATTR_ALG_FLAGS              0x00000124
 382
 383 /*
 384  * An interface extension identifies a network interface.
 385  * It is used for configuring Tunnel Mode policies on a tunnelling
 386  * interface for now.
 387  */
 388 typedef struct spd_if_s {
 389         union {
 390                 struct {
 391                         uint16_t spd_if_ulen;
 392                         uint16_t spd_if_uexttype;
 393                         union {
 394                                 uint8_t spd_if_iuname[4];
 395                                 uint32_t spd_if_iuindex;
 396                         } spd_if_iu;
 397                 } spd_if_actual;
 398                 uint64_t spd_if_alignment;
 399         } spd_if_u;
 400 #define spd_if_len spd_if_u.spd_if_actual.spd_if_ulen
 401 #define spd_if_exttype spd_if_u.spd_if_actual.spd_if_uexttype
 402 #define spd_if_name spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuname
 403 #define spd_if_index spd_if_u.spd_if_actual.spd_if_iu.spd_if_iuindex
 404 } spd_if_t;
 405
 406 /*
 407  * Minimum, maximum key lengths in bits.
 408  */
 409 #define SPD_MIN_MINBITS         0x0000
 410 #define SPD_MAX_MAXBITS         0xffff
 411
 412 /*
 413  * IPsec action types (in SPD_ATTR_TYPE attribute)
 414  */
 415 #define SPD_ACTTYPE_DROP        0x0001
 416 #define SPD_ACTTYPE_PASS        0x0002
 417 #define SPD_ACTTYPE_IPSEC       0x0003
 418
 419 /*
 420  * Action flags (in SPD_ATTR_FLAGS attribute)
 421  */
 422 #define SPD_APPLY_AH            0x0001
 423 #define SPD_APPLY_ESP           0x0002
 424 #define SPD_APPLY_SE            0x0004  /* self-encapsulation */
 425 #define SPD_APPLY_COMP          0x0008  /* compression; NYI */
 426 #define SPD_APPLY_UNIQUE        0x0010  /* unique per-flow SA */
 427 #define SPD_APPLY_BYPASS        0x0020  /* bypass policy */
 428 #define SPD_APPLY_ESPA          0x0040  /* ESP authentication */
 429
 430 /*
 431  * SW crypto execution modes.
 432  */
 433 #define SPD_ALG_EXEC_MODE_SYNC          1       /* synchronous */
 434 #define SPD_ALG_EXEC_MODE_ASYNC         2       /* asynchronous */
 435
 436 /*
 437  * SPD_DUMP protocol:
 438  *
 439  * We do not want to force an stack to have to read-lock the entire
 440  * SPD for the duration of the dump, but we want management apps to be
 441  * able to get a consistent snapshot of the SPD.
 442  *
 443  * Therefore, we make optimistic locking assumptions.
 444  *
 445  * The response to a SPD_DUMP request consists of multiple spd_msg
 446  * records, all with spd_msg_type == SPD_DUMP and spd_msg_{seq,pid}
 447  * matching the request.
 448  *
 449  * There is one header, then a sequence of policy rule records (one
 450  * rule per record), then a trailer.
 451  *
 452  * The header and trailer both contain a single SPD_EXT_RULESET
 453  * containing a version number and rule count.  The dump was "good" if
 454  * header version == trailer version, and the number of rules read by
 455  * the application matches the rule count in the trailer.  The rule
 456  * count in the header is unused and should be set to zero.
 457  *
 458  * In between, each rule record contains a set of extensions which, if
 459  * used in an SPD_ADD request, would recreate an equivalent rule.
 460  *
 461  * If rules were added to the SPD during the dump, the dump may be
 462  * truncated or otherwise incomplete; the management application
 463  * should re-try the dump in this case.
 464  */
 465
 466 /*
 467  * Ruleset extension, used at the start and end of a SPD_DUMP.
 468  */
 469 typedef struct spd_ruleset_ext
 470 {
 471         uint16_t spd_ruleset_len;       /* 2 x 64 bits */
 472         uint16_t spd_ruleset_type;      /* SPD_EXT_RULESET */
 473         uint32_t spd_ruleset_count;     /* only valid in trailer */
 474         uint64_t spd_ruleset_version;   /* version number */
 475 } spd_ruleset_ext_t;
 476
 477 /*
 478  * Diagnostic codes.  These supplement error messages.  Be sure to
 479  * update libipsecutil's spdsock_diag() if you change any of these.
 480  */
 481 #define SPD_DIAGNOSTIC_NONE                     0
 482 #define SPD_DIAGNOSTIC_UNKNOWN_EXT              1
 483 #define SPD_DIAGNOSTIC_BAD_EXTLEN               2
 484 #define SPD_DIAGNOSTIC_NO_RULE_EXT              3
 485 #define SPD_DIAGNOSTIC_BAD_ADDR_LEN             4
 486 #define SPD_DIAGNOSTIC_MIXED_AF                 5
 487 #define SPD_DIAGNOSTIC_ADD_NO_MEM               6
 488 #define SPD_DIAGNOSTIC_ADD_WRONG_ACT_COUNT      7
 489 #define SPD_DIAGNOSTIC_ADD_BAD_TYPE             8
 490 #define SPD_DIAGNOSTIC_ADD_BAD_FLAGS            9
 491 #define SPD_DIAGNOSTIC_ADD_INCON_FLAGS          10
 492 #define SPD_DIAGNOSTIC_MALFORMED_LCLPORT        11
 493 #define SPD_DIAGNOSTIC_DUPLICATE_LCLPORT        12
 494 #define SPD_DIAGNOSTIC_MALFORMED_REMPORT        13
 495 #define SPD_DIAGNOSTIC_DUPLICATE_REMPORT        14
 496 #define SPD_DIAGNOSTIC_MALFORMED_PROTO          15
 497 #define SPD_DIAGNOSTIC_DUPLICATE_PROTO          16
 498 #define SPD_DIAGNOSTIC_MALFORMED_LCLADDR        17
 499 #define SPD_DIAGNOSTIC_DUPLICATE_LCLADDR        18
 500 #define SPD_DIAGNOSTIC_MALFORMED_REMADDR        19
 501 #define SPD_DIAGNOSTIC_DUPLICATE_REMADDR        20
 502 #define SPD_DIAGNOSTIC_MALFORMED_ACTION         21
 503 #define SPD_DIAGNOSTIC_DUPLICATE_ACTION         22
 504 #define SPD_DIAGNOSTIC_MALFORMED_RULE           23
 505 #define SPD_DIAGNOSTIC_DUPLICATE_RULE           24
 506 #define SPD_DIAGNOSTIC_MALFORMED_RULESET        25
 507 #define SPD_DIAGNOSTIC_DUPLICATE_RULESET        26
 508 #define SPD_DIAGNOSTIC_INVALID_RULE_INDEX       27
 509 #define SPD_DIAGNOSTIC_BAD_SPDID                28
 510 #define SPD_DIAGNOSTIC_BAD_MSG_TYPE             29
 511 #define SPD_DIAGNOSTIC_UNSUPP_AH_ALG            30
 512 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_ALG      31
 513 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_ALG      32
 514 #define SPD_DIAGNOSTIC_UNSUPP_AH_KEYSIZE        33
 515 #define SPD_DIAGNOSTIC_UNSUPP_ESP_ENCR_KEYSIZE  34
 516 #define SPD_DIAGNOSTIC_UNSUPP_ESP_AUTH_KEYSIZE  35
 517 #define SPD_DIAGNOSTIC_NO_ACTION_EXT            36
 518 #define SPD_DIAGNOSTIC_ALG_ID_RANGE             37
 519 #define SPD_DIAGNOSTIC_ALG_NUM_KEY_SIZES        38
 520 #define SPD_DIAGNOSTIC_ALG_NUM_BLOCK_SIZES      39
 521 #define SPD_DIAGNOSTIC_ALG_MECH_NAME_LEN        40
 522 #define SPD_DIAGNOSTIC_ALG_IPSEC_NOT_LOADED     41
 523 #define SPD_DIAGNOSTIC_MALFORMED_ICMP_TYPECODE  42
 524 #define SPD_DIAGNOSTIC_DUPLICATE_ICMP_TYPECODE  43
 525 #define SPD_DIAGNOSTIC_NOT_GLOBAL_OP            44
 526 #define SPD_DIAGNOSTIC_NO_TUNNEL_SELECTORS      45
 527
 528 /*
 529  * Helper macros.
 530  */
 531 #define SPD_64TO8(x)    ((x) << 3)
 532 #define SPD_8TO64(x)    ((x) >> 3)
 533 #define SPD_8TO1(x)     ((x) << 3)
 534 #define SPD_1TO8(x)     ((x) >> 3)
 535
 536 #ifdef  __cplusplus
 537 }
 538 #endif
 539
 540 #endif  /* _NET_PFPOLICY_H */