xref: /openbmc/linux/include/net/xfrm.h (revision d5cb9783536a41df9f9cba5b0a1d78047ed787f7)
1 #ifndef _NET_XFRM_H
2 #define _NET_XFRM_H
3 
4 #include <linux/compiler.h>
5 #include <linux/xfrm.h>
6 #include <linux/spinlock.h>
7 #include <linux/list.h>
8 #include <linux/skbuff.h>
9 #include <linux/netdevice.h>
10 #include <linux/crypto.h>
11 #include <linux/pfkeyv2.h>
12 #include <linux/in6.h>
13 
14 #include <net/sock.h>
15 #include <net/dst.h>
16 #include <net/route.h>
17 #include <net/ipv6.h>
18 #include <net/ip6_fib.h>
19 
20 #define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
21 
22 extern struct semaphore xfrm_cfg_sem;
23 
24 /* Organization of SPD aka "XFRM rules"
25    ------------------------------------
26 
27    Basic objects:
28    - policy rule, struct xfrm_policy (=SPD entry)
29    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
30    - instance of a transformer, struct xfrm_state (=SA)
31    - template to clone xfrm_state, struct xfrm_tmpl
32 
33    SPD is plain linear list of xfrm_policy rules, ordered by priority.
34    (To be compatible with existing pfkeyv2 implementations,
35    many rules with priority of 0x7fffffff are allowed to exist and
36    such rules are ordered in an unpredictable way, thanks to bsd folks.)
37 
38    Lookup is plain linear search until the first match with selector.
39 
40    If "action" is "block", then we prohibit the flow, otherwise:
41    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
42    policy entry has list of up to XFRM_MAX_DEPTH transformations,
43    described by templates xfrm_tmpl. Each template is resolved
44    to a complete xfrm_state (see below) and we pack bundle of transformations
45    to a dst_entry returned to requestor.
46 
47    dst -. xfrm  .-> xfrm_state #1
48     |---. child .-> dst -. xfrm .-> xfrm_state #2
49                      |---. child .-> dst -. xfrm .-> xfrm_state #3
50                                       |---. child .-> NULL
51 
52    Bundles are cached at xrfm_policy struct (field ->bundles).
53 
54 
55    Resolution of xrfm_tmpl
56    -----------------------
57    Template contains:
58    1. ->mode		Mode: transport or tunnel
59    2. ->id.proto	Protocol: AH/ESP/IPCOMP
60    3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
61       Q: allow to resolve security gateway?
62    4. ->id.spi          If not zero, static SPI.
63    5. ->saddr		Local tunnel endpoint, ignored for transport mode.
64    6. ->algos		List of allowed algos. Plain bitmask now.
65       Q: ealgos, aalgos, calgos. What a mess...
66    7. ->share		Sharing mode.
67       Q: how to implement private sharing mode? To add struct sock* to
68       flow id?
69 
70    Having this template we search through SAD searching for entries
71    with appropriate mode/proto/algo, permitted by selector.
72    If no appropriate entry found, it is requested from key manager.
73 
74    PROBLEMS:
75    Q: How to find all the bundles referring to a physical path for
76       PMTU discovery? Seems, dst should contain list of all parents...
77       and enter to infinite locking hierarchy disaster.
78       No! It is easier, we will not search for them, let them find us.
79       We add genid to each dst plus pointer to genid of raw IP route,
80       pmtu disc will update pmtu on raw IP route and increase its genid.
81       dst_check() will see this for top level and trigger resyncing
82       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
83  */
84 
85 /* Full description of state of transformer. */
86 struct xfrm_state
87 {
88 	/* Note: bydst is re-used during gc */
89 	struct list_head	bydst;
90 	struct list_head	byspi;
91 
92 	atomic_t		refcnt;
93 	spinlock_t		lock;
94 
95 	struct xfrm_id		id;
96 	struct xfrm_selector	sel;
97 
98 	/* Key manger bits */
99 	struct {
100 		u8		state;
101 		u8		dying;
102 		u32		seq;
103 	} km;
104 
105 	/* Parameters of this state. */
106 	struct {
107 		u32		reqid;
108 		u8		mode;
109 		u8		replay_window;
110 		u8		aalgo, ealgo, calgo;
111 		u8		flags;
112 		u16		family;
113 		xfrm_address_t	saddr;
114 		int		header_len;
115 		int		trailer_len;
116 	} props;
117 
118 	struct xfrm_lifetime_cfg lft;
119 
120 	/* Data for transformer */
121 	struct xfrm_algo	*aalg;
122 	struct xfrm_algo	*ealg;
123 	struct xfrm_algo	*calg;
124 
125 	/* Data for encapsulator */
126 	struct xfrm_encap_tmpl	*encap;
127 
128 	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
129 	struct xfrm_state	*tunnel;
130 
131 	/* If a tunnel, number of users + 1 */
132 	atomic_t		tunnel_users;
133 
134 	/* State for replay detection */
135 	struct xfrm_replay_state replay;
136 
137 	/* Statistics */
138 	struct xfrm_stats	stats;
139 
140 	struct xfrm_lifetime_cur curlft;
141 	struct timer_list	timer;
142 
143 	/* Reference to data common to all the instances of this
144 	 * transformer. */
145 	struct xfrm_type	*type;
146 
147 	/* Private data of this transformer, format is opaque,
148 	 * interpreted by xfrm_type methods. */
149 	void			*data;
150 };
151 
152 enum {
153 	XFRM_STATE_VOID,
154 	XFRM_STATE_ACQ,
155 	XFRM_STATE_VALID,
156 	XFRM_STATE_ERROR,
157 	XFRM_STATE_EXPIRED,
158 	XFRM_STATE_DEAD
159 };
160 
161 /* callback structure passed from either netlink or pfkey */
162 struct km_event
163 {
164 	union {
165 		u32 hard;
166 		u32 proto;
167 		u32 byid;
168 	} data;
169 
170 	u32	seq;
171 	u32	pid;
172 	u32	event;
173 };
174 
175 struct xfrm_type;
176 struct xfrm_dst;
177 struct xfrm_policy_afinfo {
178 	unsigned short		family;
179 	rwlock_t		lock;
180 	struct xfrm_type_map	*type_map;
181 	struct dst_ops		*dst_ops;
182 	void			(*garbage_collect)(void);
183 	int			(*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
184 	struct dst_entry	*(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
185 	int			(*bundle_create)(struct xfrm_policy *policy,
186 						 struct xfrm_state **xfrm,
187 						 int nx,
188 						 struct flowi *fl,
189 						 struct dst_entry **dst_p);
190 	void			(*decode_session)(struct sk_buff *skb,
191 						  struct flowi *fl);
192 };
193 
194 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
195 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
196 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
197 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
198 
199 #define XFRM_ACQ_EXPIRES	30
200 
201 struct xfrm_tmpl;
202 struct xfrm_state_afinfo {
203 	unsigned short		family;
204 	rwlock_t		lock;
205 	struct list_head	*state_bydst;
206 	struct list_head	*state_byspi;
207 	int			(*init_flags)(struct xfrm_state *x);
208 	void			(*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
209 						struct xfrm_tmpl *tmpl,
210 						xfrm_address_t *daddr, xfrm_address_t *saddr);
211 	struct xfrm_state	*(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
212 	struct xfrm_state	*(*find_acq)(u8 mode, u32 reqid, u8 proto,
213 					     xfrm_address_t *daddr, xfrm_address_t *saddr,
214 					     int create);
215 };
216 
217 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
218 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
219 
220 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
221 
222 struct xfrm_decap_state;
223 struct xfrm_type
224 {
225 	char			*description;
226 	struct module		*owner;
227 	__u8			proto;
228 
229 	int			(*init_state)(struct xfrm_state *x);
230 	void			(*destructor)(struct xfrm_state *);
231 	int			(*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
232 	int			(*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
233 	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
234 	/* Estimate maximal size of result of transformation of a dgram */
235 	u32			(*get_max_size)(struct xfrm_state *, int size);
236 };
237 
238 struct xfrm_type_map {
239 	rwlock_t		lock;
240 	struct xfrm_type	*map[256];
241 };
242 
243 extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
244 extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
245 extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
246 extern void xfrm_put_type(struct xfrm_type *type);
247 
248 struct xfrm_tmpl
249 {
250 /* id in template is interpreted as:
251  * daddr - destination of tunnel, may be zero for transport mode.
252  * spi   - zero to acquire spi. Not zero if spi is static, then
253  *	   daddr must be fixed too.
254  * proto - AH/ESP/IPCOMP
255  */
256 	struct xfrm_id		id;
257 
258 /* Source address of tunnel. Ignored, if it is not a tunnel. */
259 	xfrm_address_t		saddr;
260 
261 	__u32			reqid;
262 
263 /* Mode: transport/tunnel */
264 	__u8			mode;
265 
266 /* Sharing mode: unique, this session only, this user only etc. */
267 	__u8			share;
268 
269 /* May skip this transfomration if no SA is found */
270 	__u8			optional;
271 
272 /* Bit mask of algos allowed for acquisition */
273 	__u32			aalgos;
274 	__u32			ealgos;
275 	__u32			calgos;
276 };
277 
278 #define XFRM_MAX_DEPTH		4
279 
280 struct xfrm_policy
281 {
282 	struct xfrm_policy	*next;
283 	struct list_head	list;
284 
285 	/* This lock only affects elements except for entry. */
286 	rwlock_t		lock;
287 	atomic_t		refcnt;
288 	struct timer_list	timer;
289 
290 	u32			priority;
291 	u32			index;
292 	struct xfrm_selector	selector;
293 	struct xfrm_lifetime_cfg lft;
294 	struct xfrm_lifetime_cur curlft;
295 	struct dst_entry       *bundles;
296 	__u16			family;
297 	__u8			action;
298 	__u8			flags;
299 	__u8			dead;
300 	__u8			xfrm_nr;
301 	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
302 };
303 
304 #define XFRM_KM_TIMEOUT		30
305 
306 struct xfrm_mgr
307 {
308 	struct list_head	list;
309 	char			*id;
310 	int			(*notify)(struct xfrm_state *x, struct km_event *c);
311 	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
312 	struct xfrm_policy	*(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
313 	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
314 	int			(*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
315 };
316 
317 extern int xfrm_register_km(struct xfrm_mgr *km);
318 extern int xfrm_unregister_km(struct xfrm_mgr *km);
319 
320 
321 extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
322 
323 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
324 {
325 	if (likely(policy != NULL))
326 		atomic_inc(&policy->refcnt);
327 }
328 
329 extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
330 
331 static inline void xfrm_pol_put(struct xfrm_policy *policy)
332 {
333 	if (atomic_dec_and_test(&policy->refcnt))
334 		__xfrm_policy_destroy(policy);
335 }
336 
337 #define XFRM_DST_HSIZE		1024
338 
339 static __inline__
340 unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
341 {
342 	unsigned h;
343 	h = ntohl(addr->a4);
344 	h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
345 	return h;
346 }
347 
348 static __inline__
349 unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
350 {
351 	unsigned h;
352 	h = ntohl(addr->a6[2]^addr->a6[3]);
353 	h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
354 	return h;
355 }
356 
357 static __inline__
358 unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
359 {
360 	switch (family) {
361 	case AF_INET:
362 		return __xfrm4_dst_hash(addr);
363 	case AF_INET6:
364 		return __xfrm6_dst_hash(addr);
365 	}
366 	return 0;
367 }
368 
369 static __inline__
370 unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
371 {
372 	unsigned h;
373 	h = ntohl(addr->a4^spi^proto);
374 	h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
375 	return h;
376 }
377 
378 static __inline__
379 unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
380 {
381 	unsigned h;
382 	h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
383 	h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
384 	return h;
385 }
386 
387 static __inline__
388 unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
389 {
390 	switch (family) {
391 	case AF_INET:
392 		return __xfrm4_spi_hash(addr, spi, proto);
393 	case AF_INET6:
394 		return __xfrm6_spi_hash(addr, spi, proto);
395 	}
396 	return 0;	/*XXX*/
397 }
398 
399 extern void __xfrm_state_destroy(struct xfrm_state *);
400 
401 static inline void xfrm_state_put(struct xfrm_state *x)
402 {
403 	if (atomic_dec_and_test(&x->refcnt))
404 		__xfrm_state_destroy(x);
405 }
406 
407 static inline void xfrm_state_hold(struct xfrm_state *x)
408 {
409 	atomic_inc(&x->refcnt);
410 }
411 
412 static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
413 {
414 	__u32 *a1 = token1;
415 	__u32 *a2 = token2;
416 	int pdw;
417 	int pbi;
418 
419 	pdw = prefixlen >> 5;	  /* num of whole __u32 in prefix */
420 	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
421 
422 	if (pdw)
423 		if (memcmp(a1, a2, pdw << 2))
424 			return 0;
425 
426 	if (pbi) {
427 		__u32 mask;
428 
429 		mask = htonl((0xffffffff) << (32 - pbi));
430 
431 		if ((a1[pdw] ^ a2[pdw]) & mask)
432 			return 0;
433 	}
434 
435 	return 1;
436 }
437 
438 static __inline__
439 u16 xfrm_flowi_sport(struct flowi *fl)
440 {
441 	u16 port;
442 	switch(fl->proto) {
443 	case IPPROTO_TCP:
444 	case IPPROTO_UDP:
445 	case IPPROTO_SCTP:
446 		port = fl->fl_ip_sport;
447 		break;
448 	case IPPROTO_ICMP:
449 	case IPPROTO_ICMPV6:
450 		port = htons(fl->fl_icmp_type);
451 		break;
452 	default:
453 		port = 0;	/*XXX*/
454 	}
455 	return port;
456 }
457 
458 static __inline__
459 u16 xfrm_flowi_dport(struct flowi *fl)
460 {
461 	u16 port;
462 	switch(fl->proto) {
463 	case IPPROTO_TCP:
464 	case IPPROTO_UDP:
465 	case IPPROTO_SCTP:
466 		port = fl->fl_ip_dport;
467 		break;
468 	case IPPROTO_ICMP:
469 	case IPPROTO_ICMPV6:
470 		port = htons(fl->fl_icmp_code);
471 		break;
472 	default:
473 		port = 0;	/*XXX*/
474 	}
475 	return port;
476 }
477 
478 static inline int
479 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
480 {
481 	return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
482 		addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
483 		!((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
484 		!((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
485 		(fl->proto == sel->proto || !sel->proto) &&
486 		(fl->oif == sel->ifindex || !sel->ifindex);
487 }
488 
489 static inline int
490 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
491 {
492 	return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
493 		addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
494 		!((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
495 		!((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
496 		(fl->proto == sel->proto || !sel->proto) &&
497 		(fl->oif == sel->ifindex || !sel->ifindex);
498 }
499 
500 static inline int
501 xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
502 		    unsigned short family)
503 {
504 	switch (family) {
505 	case AF_INET:
506 		return __xfrm4_selector_match(sel, fl);
507 	case AF_INET6:
508 		return __xfrm6_selector_match(sel, fl);
509 	}
510 	return 0;
511 }
512 
513 /* A struct encoding bundle of transformations to apply to some set of flow.
514  *
515  * dst->child points to the next element of bundle.
516  * dst->xfrm  points to an instanse of transformer.
517  *
518  * Due to unfortunate limitations of current routing cache, which we
519  * have no time to fix, it mirrors struct rtable and bound to the same
520  * routing key, including saddr,daddr. However, we can have many of
521  * bundles differing by session id. All the bundles grow from a parent
522  * policy rule.
523  */
524 struct xfrm_dst
525 {
526 	union {
527 		struct xfrm_dst		*next;
528 		struct dst_entry	dst;
529 		struct rtable		rt;
530 		struct rt6_info		rt6;
531 	} u;
532 	struct dst_entry *route;
533 	u32 route_mtu_cached;
534 	u32 child_mtu_cached;
535 	u32 route_cookie;
536 	u32 path_cookie;
537 };
538 
539 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
540 {
541 	dst_release(xdst->route);
542 	if (likely(xdst->u.dst.xfrm))
543 		xfrm_state_put(xdst->u.dst.xfrm);
544 }
545 
546 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
547 
548 /* Decapsulation state, used by the input to store data during
549  * decapsulation procedure, to be used later (during the policy
550  * check
551  */
552 struct xfrm_decap_state {
553 	char	decap_data[20];
554 	__u16	decap_type;
555 };
556 
557 struct sec_decap_state {
558 	struct xfrm_state	*xvec;
559 	struct xfrm_decap_state decap;
560 };
561 
562 struct sec_path
563 {
564 	atomic_t		refcnt;
565 	int			len;
566 	struct sec_decap_state	x[XFRM_MAX_DEPTH];
567 };
568 
569 static inline struct sec_path *
570 secpath_get(struct sec_path *sp)
571 {
572 	if (sp)
573 		atomic_inc(&sp->refcnt);
574 	return sp;
575 }
576 
577 extern void __secpath_destroy(struct sec_path *sp);
578 
579 static inline void
580 secpath_put(struct sec_path *sp)
581 {
582 	if (sp && atomic_dec_and_test(&sp->refcnt))
583 		__secpath_destroy(sp);
584 }
585 
586 extern struct sec_path *secpath_dup(struct sec_path *src);
587 
588 static inline void
589 secpath_reset(struct sk_buff *skb)
590 {
591 #ifdef CONFIG_XFRM
592 	secpath_put(skb->sp);
593 	skb->sp = NULL;
594 #endif
595 }
596 
597 static inline int
598 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
599 {
600 	return	(tmpl->saddr.a4 &&
601 		 tmpl->saddr.a4 != x->props.saddr.a4);
602 }
603 
604 static inline int
605 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
606 {
607 	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
608 		 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
609 }
610 
611 static inline int
612 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
613 {
614 	switch (family) {
615 	case AF_INET:
616 		return __xfrm4_state_addr_cmp(tmpl, x);
617 	case AF_INET6:
618 		return __xfrm6_state_addr_cmp(tmpl, x);
619 	}
620 	return !0;
621 }
622 
623 #ifdef CONFIG_XFRM
624 
625 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
626 
627 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
628 {
629 	if (sk && sk->sk_policy[XFRM_POLICY_IN])
630 		return __xfrm_policy_check(sk, dir, skb, family);
631 
632 	return	(!xfrm_policy_list[dir] && !skb->sp) ||
633 		(skb->dst->flags & DST_NOPOLICY) ||
634 		__xfrm_policy_check(sk, dir, skb, family);
635 }
636 
637 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
638 {
639 	return xfrm_policy_check(sk, dir, skb, AF_INET);
640 }
641 
642 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
643 {
644 	return xfrm_policy_check(sk, dir, skb, AF_INET6);
645 }
646 
647 
648 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
649 
650 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
651 {
652 	return	!xfrm_policy_list[XFRM_POLICY_OUT] ||
653 		(skb->dst->flags & DST_NOXFRM) ||
654 		__xfrm_route_forward(skb, family);
655 }
656 
657 static inline int xfrm4_route_forward(struct sk_buff *skb)
658 {
659 	return xfrm_route_forward(skb, AF_INET);
660 }
661 
662 static inline int xfrm6_route_forward(struct sk_buff *skb)
663 {
664 	return xfrm_route_forward(skb, AF_INET6);
665 }
666 
667 extern int __xfrm_sk_clone_policy(struct sock *sk);
668 
669 static inline int xfrm_sk_clone_policy(struct sock *sk)
670 {
671 	if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
672 		return __xfrm_sk_clone_policy(sk);
673 	return 0;
674 }
675 
676 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
677 
678 static inline void xfrm_sk_free_policy(struct sock *sk)
679 {
680 	if (unlikely(sk->sk_policy[0] != NULL)) {
681 		xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
682 		sk->sk_policy[0] = NULL;
683 	}
684 	if (unlikely(sk->sk_policy[1] != NULL)) {
685 		xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
686 		sk->sk_policy[1] = NULL;
687 	}
688 }
689 
690 #else
691 
692 static inline void xfrm_sk_free_policy(struct sock *sk) {}
693 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
694 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
695 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
696 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
697 {
698 	return 1;
699 }
700 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
701 {
702 	return 1;
703 }
704 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
705 {
706 	return 1;
707 }
708 #endif
709 
710 static __inline__
711 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
712 {
713 	switch (family){
714 	case AF_INET:
715 		return (xfrm_address_t *)&fl->fl4_dst;
716 	case AF_INET6:
717 		return (xfrm_address_t *)&fl->fl6_dst;
718 	}
719 	return NULL;
720 }
721 
722 static __inline__
723 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
724 {
725 	switch (family){
726 	case AF_INET:
727 		return (xfrm_address_t *)&fl->fl4_src;
728 	case AF_INET6:
729 		return (xfrm_address_t *)&fl->fl6_src;
730 	}
731 	return NULL;
732 }
733 
734 static __inline__ int
735 __xfrm4_state_addr_check(struct xfrm_state *x,
736 			 xfrm_address_t *daddr, xfrm_address_t *saddr)
737 {
738 	if (daddr->a4 == x->id.daddr.a4 &&
739 	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
740 		return 1;
741 	return 0;
742 }
743 
744 static __inline__ int
745 __xfrm6_state_addr_check(struct xfrm_state *x,
746 			 xfrm_address_t *daddr, xfrm_address_t *saddr)
747 {
748 	if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
749 	    (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
750 	     ipv6_addr_any((struct in6_addr *)saddr) ||
751 	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
752 		return 1;
753 	return 0;
754 }
755 
756 static __inline__ int
757 xfrm_state_addr_check(struct xfrm_state *x,
758 		      xfrm_address_t *daddr, xfrm_address_t *saddr,
759 		      unsigned short family)
760 {
761 	switch (family) {
762 	case AF_INET:
763 		return __xfrm4_state_addr_check(x, daddr, saddr);
764 	case AF_INET6:
765 		return __xfrm6_state_addr_check(x, daddr, saddr);
766 	}
767 	return 0;
768 }
769 
770 static inline int xfrm_state_kern(struct xfrm_state *x)
771 {
772 	return atomic_read(&x->tunnel_users);
773 }
774 
775 /*
776  * xfrm algorithm information
777  */
778 struct xfrm_algo_auth_info {
779 	u16 icv_truncbits;
780 	u16 icv_fullbits;
781 };
782 
783 struct xfrm_algo_encr_info {
784 	u16 blockbits;
785 	u16 defkeybits;
786 };
787 
788 struct xfrm_algo_comp_info {
789 	u16 threshold;
790 };
791 
792 struct xfrm_algo_desc {
793 	char *name;
794 	u8 available:1;
795 	union {
796 		struct xfrm_algo_auth_info auth;
797 		struct xfrm_algo_encr_info encr;
798 		struct xfrm_algo_comp_info comp;
799 	} uinfo;
800 	struct sadb_alg desc;
801 };
802 
803 /* XFRM tunnel handlers.  */
804 struct xfrm_tunnel {
805 	int (*handler)(struct sk_buff *skb);
806 	void (*err_handler)(struct sk_buff *skb, __u32 info);
807 };
808 
809 struct xfrm6_tunnel {
810 	int (*handler)(struct sk_buff **pskb, unsigned int *nhoffp);
811 	void (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
812 			    int type, int code, int offset, __u32 info);
813 };
814 
815 extern void xfrm_init(void);
816 extern void xfrm4_init(void);
817 extern void xfrm6_init(void);
818 extern void xfrm6_fini(void);
819 extern void xfrm_state_init(void);
820 extern void xfrm4_state_init(void);
821 extern void xfrm6_state_init(void);
822 extern void xfrm6_state_fini(void);
823 
824 extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
825 extern struct xfrm_state *xfrm_state_alloc(void);
826 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
827 					  struct flowi *fl, struct xfrm_tmpl *tmpl,
828 					  struct xfrm_policy *pol, int *err,
829 					  unsigned short family);
830 extern int xfrm_state_check_expire(struct xfrm_state *x);
831 extern void xfrm_state_insert(struct xfrm_state *x);
832 extern int xfrm_state_add(struct xfrm_state *x);
833 extern int xfrm_state_update(struct xfrm_state *x);
834 extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
835 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
836 extern int xfrm_state_delete(struct xfrm_state *x);
837 extern void xfrm_state_flush(u8 proto);
838 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
839 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
840 extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
841 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
842 extern int xfrm_init_state(struct xfrm_state *x);
843 extern int xfrm4_rcv(struct sk_buff *skb);
844 extern int xfrm4_output(struct sk_buff *skb);
845 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
846 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
847 extern int xfrm6_rcv_spi(struct sk_buff **pskb, unsigned int *nhoffp, u32 spi);
848 extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
849 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
850 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
851 extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
852 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
853 extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
854 extern int xfrm6_output(struct sk_buff *skb);
855 
856 #ifdef CONFIG_XFRM
857 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
858 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
859 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
860 #else
861 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
862 {
863  	return -ENOPROTOOPT;
864 }
865 
866 static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
867 {
868  	/* should not happen */
869  	kfree_skb(skb);
870 	return 0;
871 }
872 static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
873 {
874 	return -EINVAL;
875 }
876 #endif
877 
878 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
879 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
880 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
881 struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
882 				      int delete);
883 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
884 void xfrm_policy_flush(void);
885 u32 xfrm_get_acqseq(void);
886 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
887 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
888 				  xfrm_address_t *daddr, xfrm_address_t *saddr,
889 				  int create, unsigned short family);
890 extern void xfrm_policy_flush(void);
891 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
892 extern int xfrm_flush_bundles(void);
893 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
894 extern void xfrm_init_pmtu(struct dst_entry *dst);
895 
896 extern wait_queue_head_t km_waitq;
897 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
898 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard);
899 
900 extern void xfrm_input_init(void);
901 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
902 
903 extern void xfrm_probe_algs(void);
904 extern int xfrm_count_auth_supported(void);
905 extern int xfrm_count_enc_supported(void);
906 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
907 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
908 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
909 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
910 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
911 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
912 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
913 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
914 
915 struct crypto_tfm;
916 typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
917 
918 extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
919 			 int offset, int len, icv_update_fn_t icv_update);
920 
921 static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
922 				int family)
923 {
924 	switch (family) {
925 	default:
926 	case AF_INET:
927 		return a->a4 - b->a4;
928 	case AF_INET6:
929 		return ipv6_addr_cmp((struct in6_addr *)a,
930 				     (struct in6_addr *)b);
931 	}
932 }
933 
934 static inline int xfrm_policy_id2dir(u32 index)
935 {
936 	return index & 7;
937 }
938 
939 #endif	/* _NET_XFRM_H */
940