STRUCT XFRM_POLICY(9)

🦋 struct xfrm_policy(9) 🦋

okay so bestie, this is a page from the Kernel API Manual, and it's literally all about struct xfrm_policy — the xfrm policy struct itself. no cap, it's kind of the main character of the whole IPsec policy world 💅

✨ NAME ✨

struct xfrm_policy — the xfrm policy. that's it, that's the vibe 🎀

🌸 SYNOPSIS 🌸

like, here's the whole struct in all its glory, bestie — every single field, exactly as it is, don't @ me:

struct xfrm_policy {
    possible_net_t xp_net;
    struct hlist_node       bydst;
    struct hlist_node       byidx;
    struct hlist_head       state_cache_list;
    rwlock_t lock;
    refcount_t refcnt;
    u32 pos;
    struct timer_list       timer;
    atomic_t genid;
    u32 priority;
    u32 index;
    u32 if_id;
    struct xfrm_mark        mark;
    struct xfrm_selector    selector;
    struct xfrm_lifetime_cfg lft;
    struct xfrm_lifetime_cur curlft;
    struct xfrm_policy_walk_entry walk;
    struct xfrm_policy_queue polq;
    bool bydst_reinsert;
    u8 type;
    u8 action;
    u8 flags;
    u8 xfrm_nr;
    u16 family;
    struct xfrm_sec_ctx     *security;
    struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
    struct rcu_head         rcu;
    struct xfrm_dev_offload xdo;
 };

💖 Members 💖

bestie, here's the member-by-member rundown, in order, no skipping, i promise 🫶

• xp_net — the network namespace this policy lives in. it's giving "whose house is this" energy.
• bydst — hlist node for the SPD hash table or rbtree list.
• byidx — hlist node for the index hash table.
• state_cache_list — hlist head for the policy's cached xfrm states. caching queen ✨
• lock — serializes changes to the policy structure members. one at a time, bestie, we're not animals.
• refcnt — reference count. it gets freed once it reaches 0. like, that's the whole rule 🙈
• pos — kernel internal tie-breaker used to determine the age of the policy.
• timer — timer. yes. that's literally it. a timer. iconic minimalism 💀
• genid — generation, used to invalidate old policies. old news gets cancelled, periodt.
• priority — priority, set by userspace.
• index — policy index (autogenerated).
• if_id — virtual xfrm interface id.
• mark — packet mark.
• selector — selector.
• lft — lifetime configuration data.
• curlft — lifetime state.
• walk — list head on the pernet policy list.
• polq — queue to hold packets while an acquire operation is in progress. the "hold my packets" queue 💅
• bydst_reinsert — this policy tree node needs to be merged.
• type — XFRM_POLICY_TYPE_MAIN or _SUB.
• action — XFRM_POLICY_ALLOW or _BLOCK.
• flags — XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP.
• xfrm_nr — number of used templates in xfrm_vec.
• family — protocol family.
• security — SELinux security label. keeping it secure and cute 🔥
• xfrm_vec — array of templates to resolve state.
• rcu — rcu head, used to defer memory release. bye bestie, but like, later 👋
• xdo — hardware offload state.

🌈 SEE ALSO 🌈

• Kernel file ./include/net/xfrm.h
• struct xfrm_mode_cbs(9)

and that's the whole page, bestie! 🎀 this one came from ./include/net, dated October 2026 — so like, mark your calendars, mwah 💖✨🦋