rfc2367.txt

很多RFC的中文文档

sadb_lifetime_allocations
                   中。

   sadb_comb_soft_bytes
   sadb_comb_hard_bytes
                   如果联合被接受，其值将分别存入SOFT和HARD生存期的
sadb_lifetime_bytes
                   中。

   sadb_comb_soft_addtime
   sadb_comb_hard_addtime
                   如果联合被接受，其值将分别存入SOFT和HARD生存期的
sadb_lifetime_addtime
                   中。

   sadb_comb_soft_usetime
   sadb_comb_hard_usetime
                   如果联合被接受，其值将分别存入SOFT和HARD生存期的
sadb_lifetime_usetime
                   中。

       每一个联合有一个认证和加密算法，也可以没有，值为零。联合的标志位同安
   全关联扩展项的标志位相同。最小和最大密钥长度（位数）来自先验的策略判断，
   依赖于基本的算法特性。


2.3.8 支持算法扩展项

       支持算法扩展项包含系统所支持的算法列表，密钥管理程序可以协商使用。可
   用的认证算法在SUPPORTED_AUTH扩展中列出，可用的加密算法在SUPPORTED_ENCRYPT
   扩展中列出。这些扩展的格式如下：

           struct sadb_supported {
                   uint16_t sadb_supported_len;
                   uint16_t sadb_supported_exttype;
                   uint32_t sadb_supported_reserved;
           };
           /* sizeof(struct sadb_supported) == 8 */

           /* 紧跟：
              struct sadb_alg sadb_algs[(sadb_supported_len *
                  sizeof(uint64_t) - sizeof(struct sadb_supported)) /
                  sizeof(struct sadb_alg)]; */

       扩展头后是一个或多个算法描述，其格式如下：

           struct sadb_alg {
                   uint8_t sadb_alg_id;
                   uint8_t sadb_alg_ivlen;
                   uint16_t sadb_alg_minbits;
                   uint16_t sadb_alg_maxbits;
                   uint16_t sadb_alg_reserved;
           };
           /* sizeof(struct sadb_alg) == 8 */

   sadb_alg_id    算法标识。如果算法被选择，其值将存在sadb_sa_auth和
sadb_sa_encrypt
                  中。

   sadb_alg_ivlen 初始化向量长度。如果IV不需要，其值必须为零。

   sadb_alg_minbits
                  可接受的最小密钥长度，位数。零无效。

   sadb_alg_maxbits
                  可接受的最大密钥长度，位数。零无效。最小值不能大于最大值。


2.3.9 SPI范围扩展项

       SADB_GETSPI消息需要一个可接受的SPI范围，这项扩展完成这个功能。

           struct sadb_spirange {
                   uint16_t sadb_spirange_len;
                   uint16_t sadb_spirange_exttype;
                   uint32_t sadb_spirange_min;
                   uint32_t sadb_spirange_max;
                   uint32_t sadb_spirange_reserved;
           };
           /* sizeof(struct sadb_spirange) == 16 */

   sadb_spirange_min
                   可接受的最小SPI值。

   sadb_spirange_max
                   可接受的最大SPI值。最大值必须大于最小值。


2.4 消息格式的图例

       下面展示PF_KEY消息的各字节安排，各选项也如此说明。

   基本消息头如下：

     0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
    +---------------+---------------+---------------+---------------+
    |  ...version   | sadb_msg_type | sadb_msg_errno| ...msg_satype |
    +---------------+---------------+---------------+---------------+
    |          sadb_msg_len         |       sadb_msg_reserved       |
    +---------------+---------------+---------------+---------------+
    |                         sadb_msg_seq                          |
    +---------------+---------------+---------------+---------------+
    |                         sadb_msg_pid                          |
    +---------------+---------------+---------------+---------------+

       基本消息头后紧跟一个或多个扩展项，基于基本消息头的不同的值。扩展项应
   按下面介绍的顺序出现。

       一个扩展项不能重复出现。如果出现重复的情形，将会引起作者的注意。

   安全关联扩展项

       0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
       +---------------+---------------+---------------+---------------+
       |          sadb_sa_len          |        sadb_sa_exttype        |
       +---------------+---------------+---------------+---------------+
       |                          sadb_sa_spi                          |
       +---------------+---------------+---------------+---------------+
       |   ...replay   | sadb_sa_state | sadb_sa_auth  |sadb_sa_encrypt|
       +---------------+---------------+---------------+---------------+
       |                         sadb_sa_flags                         |
       +---------------+---------------+---------------+---------------+

   生存期扩展项

       +---------------+---------------+---------------+---------------+
       |         sadb_lifetime_len     |    sadb_lifetime_exttype      |
       +---------------+---------------+---------------+---------------+
       |                   sadb_lifetime_allocations                   |
       +---------------+---------------+---------------+---------------+
       |                    sadb_lifetime_bytes                        |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                    sadb_lifetime_addtime                      |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                    sadb_lifetime_usetime                      |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+

   地址扩展项

       +---------------+---------------+---------------+---------------+
       |       sadb_address_len        |     sadb_address_exttype      |
       +---------------+---------------+---------------+---------------+
       | _address_proto| ..._prefixlen |     sadb_address_reserved     |
       +---------------+---------------+---------------+---------------+
       >     Some form of 64-bit aligned struct sockaddr goes here.    <
       >     一些64位对齐的sockaddr结构                                <
       +---------------+---------------+---------------+---------------+

   密钥扩展项

       +---------------+---------------+---------------+---------------+
       |         sadb_key_len          |         sadb_key_exttype      |
       +---------------+---------------+---------------+---------------+
       |        sadb_key_bits          |        sadb_key_reserved      |
       +---------------+---------------+---------------+---------------+
       >    A key, padded to 64-bits, most significant bits to least.  >
       >    密钥，填充至64位                                           >
       +---------------+---------------+---------------+---------------+

   身份扩展项

       +---------------+---------------+---------------+---------------+
       |        sadb_ident_len         |      sadb_ident_exttype       |
       +---------------+---------------+---------------+---------------+
       |        sadb_ident_type        |      sadb_ident_reserved      |
       +---------------+---------------+---------------+---------------+
       |                         sadb_ident_id                         |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       >  A null-terminated C-string which MUST be padded out for      >
       <  64-bit alignment.                                            <
       >  以空结束的C字符串，必须填充至64位对齐                        >
       +---------------+---------------+---------------+---------------+

   敏感度扩展项

       +---------------+---------------+---------------+---------------+
       |         sadb_sens_len         |      sadb_sens_exttype        |
       +---------------+---------------+---------------+---------------+
       |                         sadb_sens_dpd                         |
       +---------------+---------------+---------------+---------------+
       | ...sens_level | ...sens_len   |..._integ_level| ..integ_len   |
       +---------------+---------------+---------------+---------------+
       |                       sadb_sens_reserved                      |
       +---------------+---------------+---------------+---------------+
       >    The sensitivity bitmap, followed immediately by the        <
       <    integrity bitmap, each is an array of uint64_t.            >
       >    敏感度位图，紧跟完整性位图，64位排列                       <
       +---------------+---------------+---------------+---------------+

   提议扩展项

       +---------------+---------------+---------------+---------------+
       |         sadb_prop_len         |       sadb_prop_exttype       |
       +---------------+---------------+---------------+---------------+
       |...prop_replay |           sadb_prop_reserved                  |
       +---------------+---------------+---------------+---------------+
       >     One or more combinations, specified as follows...         <
       >     一个或多个联合                                            <
       +---------------+---------------+---------------+---------------+

       联合
       +---------------+---------------+---------------+---------------+
       |sadb_comb_auth |sadb_comb_encr |        sadb_comb_flags        |
       +---------------+---------------+---------------+---------------+
       |    sadb_comb_auth_minbits     |     sadb_comb_auth_maxbits    |
       +---------------+---------------+---------------+---------------+
       |   sadb_comb_encrypt_minbits   |    sadb_comb_encrypt_maxbits  |
       +---------------+---------------+---------------+---------------+
       |                       sadb_comb_reserved                      |
       +---------------+---------------+---------------+---------------+
       |                   sadb_comb_soft_allocations                  |
       +---------------+---------------+---------------+---------------+
       |                   sadb_comb_hard_allocations                  |
       +---------------+---------------+---------------+---------------+
       |                      sadb_comb_soft_bytes                     |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                      sadb_comb_hard_bytes                     |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                     sadb_comb_soft_addtime                    |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                     sadb_comb_hard_addtime                    |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                     sadb_comb_soft_usetime                    |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+
       |                     sadb_comb_hard_usetime                    |
       |                           (64 bits)                           |
       +---------------+---------------+---------------+---------------+

   支持算法扩展项

       +---------------+---------------+---------------+---------------+
       |      sadb_supported_len       |     sadb_supported_exttype    |
       +---------------+---------------+---------------+---------------+
       |                    sadb_supported_reserved                    |
       +---------------+---------------+---------------+---------------+

      紧跟一个或多个算法描述

       +---------------+---------------+---------------+---------------+
       |  sadb_alg_id  | sadb_alg_ivlen|       sadb_alg_minbits        |
       +---------------+---------------+---------------+---------------+
       |        sadb_alg_maxbits       |       sadb_alg_reserved       |
       +---------------+---------------+---------------+---------------+

   SPI范围扩展项

       +---------------+---------------+---------------+---------------+
       |       sadb_spirange_len       |     sadb_spirange_exttype     |
       +---------------+---------------+---------------+---------------+
       |                      sadb_spirange_min                        |