NETLINKXFRM

NETLINKXFRM is a netlink family used by the Linux kernel to configure the IPsec XFRM subsystem. It enables user-space processes to manage IPsec policies and security associations that determine how IPsec-protected traffic is processed. Through this interface, applications can create, modify, delete, and query the XFRM policy and state data that govern IPsec behavior in the kernel.

The NETLINK_XFRM interface defines message types for policies and states, such as NEWPOLICY, DELPOLICY, GETPOLICY, and analogous messages for states (NEWSTATE, DELSTATE, GETSTATE). Messages carry attributes that describe policy selectors (source and destination addresses, ports, and protocol), the mode (transport or tunnel), direction, and the cryptographic parameters used by SAs. The API is implemented in the kernel’s IPsec/XFRM subsystem and is specified in header definitions such as linux/xfrm.h.

In practice, NETLINKXFRM is used by user-space tools and IPsec implementations to load and manage IPsec policies and security associations, monitor events, and query current state. It is commonly accessed by tools like ip xfrm and by IPsec implementations such as strongSwan and Libreswan. The interface supports IPv4 and IPv6 and can operate within multiple network namespaces, enabling per-namespace IPsec policy configuration. Access typically requires root privileges or capabilities such as CAP_NET_ADMIN.

Security and compatibility notes: the NETLINK_XFRM interface is a kernel-facing user-space API that underpins the IPsec stack in Linux. Changes to policies and SAs are subject to kernel security controls, and proper privileges are required to modify IPsec configuration.