11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds #include <net/sock.h> 181da177e4SLinus Torvalds #include <net/dst.h> 19436a0a40SHerbert Xu #include <net/ip.h> 201da177e4SLinus Torvalds #include <net/route.h> 211da177e4SLinus Torvalds #include <net/ipv6.h> 221da177e4SLinus Torvalds #include <net/ip6_fib.h> 23fe1a5f03STimo Teräs #include <net/flow.h> 249e0d57fdSYury Polyanskiy 259e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 269e0d57fdSYury Polyanskiy 27558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 28558f82efSMasahide NAKAMURA #include <net/snmp.h> 29558f82efSMasahide NAKAMURA #endif 301da177e4SLinus Torvalds 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 38d3d6dd3aSMasahide NAKAMURA 39fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 401da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 41b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 42b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 43d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 44d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 451da177e4SLinus Torvalds 46558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 4759c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 4859c9940eSAlexey Dobriyan #define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field) 4959c9940eSAlexey Dobriyan #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field) 50558f82efSMasahide NAKAMURA #else 5159c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 5259c9940eSAlexey Dobriyan #define XFRM_INC_STATS_BH(net, field) ((void)(net)) 5359c9940eSAlexey Dobriyan #define XFRM_INC_STATS_USER(net, field) ((void)(net)) 54558f82efSMasahide NAKAMURA #endif 55558f82efSMasahide NAKAMURA 561da177e4SLinus Torvalds 571da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 581da177e4SLinus Torvalds ------------------------------------ 591da177e4SLinus Torvalds 601da177e4SLinus Torvalds Basic objects: 611da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 621da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 631da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 641da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 671da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 681da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 691da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 701da177e4SLinus Torvalds 711da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 741da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 751da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 761da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 771da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 781da177e4SLinus Torvalds to a dst_entry returned to requestor. 791da177e4SLinus Torvalds 801da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 811da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 821da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 831da177e4SLinus Torvalds |---. child .-> NULL 841da177e4SLinus Torvalds 851da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds Resolution of xrfm_tmpl 891da177e4SLinus Torvalds ----------------------- 901da177e4SLinus Torvalds Template contains: 911da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 921da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 931da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 941da177e4SLinus Torvalds Q: allow to resolve security gateway? 951da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 961da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 971da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 981da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 991da177e4SLinus Torvalds 7. ->share Sharing mode. 1001da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 1011da177e4SLinus Torvalds flow id? 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1041da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1051da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1061da177e4SLinus Torvalds 1071da177e4SLinus Torvalds PROBLEMS: 1081da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1091da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1101da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1111da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1121da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1131da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1141da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1151da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1161da177e4SLinus Torvalds */ 1171da177e4SLinus Torvalds 11812a169e7SHerbert Xu struct xfrm_state_walk { 11912a169e7SHerbert Xu struct list_head all; 12012a169e7SHerbert Xu u8 state; 12112a169e7SHerbert Xu u8 dying; 12212a169e7SHerbert Xu u8 proto; 12312a169e7SHerbert Xu u32 seq; 124870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12512a169e7SHerbert Xu }; 12612a169e7SHerbert Xu 1271da177e4SLinus Torvalds /* Full description of state of transformer. */ 128fd2c3ef7SEric Dumazet struct xfrm_state { 1290c5c9fb5SEric W. Biederman possible_net_t xs_net; 130abb81c4fSHerbert Xu union { 13112a169e7SHerbert Xu struct hlist_node gclist; 1328f126e37SDavid S. Miller struct hlist_node bydst; 133abb81c4fSHerbert Xu }; 1348f126e37SDavid S. Miller struct hlist_node bysrc; 1358f126e37SDavid S. Miller struct hlist_node byspi; 1361da177e4SLinus Torvalds 1371da177e4SLinus Torvalds atomic_t refcnt; 1381da177e4SLinus Torvalds spinlock_t lock; 1391da177e4SLinus Torvalds 1401da177e4SLinus Torvalds struct xfrm_id id; 1411da177e4SLinus Torvalds struct xfrm_selector sel; 142bf825f81SJamal Hadi Salim struct xfrm_mark mark; 14335d2856bSMartin Willi u32 tfcpad; 1441da177e4SLinus Torvalds 1459d4a706dSDavid S. Miller u32 genid; 1469d4a706dSDavid S. Miller 14712a169e7SHerbert Xu /* Key manager bits */ 14812a169e7SHerbert Xu struct xfrm_state_walk km; 1491da177e4SLinus Torvalds 1501da177e4SLinus Torvalds /* Parameters of this state. */ 1511da177e4SLinus Torvalds struct { 1521da177e4SLinus Torvalds u32 reqid; 1531da177e4SLinus Torvalds u8 mode; 1541da177e4SLinus Torvalds u8 replay_window; 1551da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1561da177e4SLinus Torvalds u8 flags; 1571da177e4SLinus Torvalds u16 family; 1581da177e4SLinus Torvalds xfrm_address_t saddr; 1591da177e4SLinus Torvalds int header_len; 1601da177e4SLinus Torvalds int trailer_len; 161a947b0a9SNicolas Dichtel u32 extra_flags; 1621da177e4SLinus Torvalds } props; 1631da177e4SLinus Torvalds 1641da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1651da177e4SLinus Torvalds 1661da177e4SLinus Torvalds /* Data for transformer */ 1674447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1681da177e4SLinus Torvalds struct xfrm_algo *ealg; 1691da177e4SLinus Torvalds struct xfrm_algo *calg; 1701a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 1711da177e4SLinus Torvalds 1721da177e4SLinus Torvalds /* Data for encapsulator */ 1731da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1741da177e4SLinus Torvalds 175060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 176060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 177060f02a3SNoriaki TAKAMIYA 1781da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1791da177e4SLinus Torvalds struct xfrm_state *tunnel; 1801da177e4SLinus Torvalds 1811da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1821da177e4SLinus Torvalds atomic_t tunnel_users; 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvalds /* State for replay detection */ 1851da177e4SLinus Torvalds struct xfrm_replay_state replay; 1869736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1871da177e4SLinus Torvalds 188f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 189f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1909736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 191f8cd5488SJamal Hadi Salim 1929fdc4883SSteffen Klassert /* The functions for replay detection. */ 1939fdc4883SSteffen Klassert struct xfrm_replay *repl; 1949fdc4883SSteffen Klassert 1952717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1962717096aSJamal Hadi Salim * moment 1972717096aSJamal Hadi Salim */ 1982717096aSJamal Hadi Salim u32 xflags; 1992717096aSJamal Hadi Salim 200f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 201f8cd5488SJamal Hadi Salim u32 replay_maxage; 202f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 203f8cd5488SJamal Hadi Salim 204f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 205f8cd5488SJamal Hadi Salim struct timer_list rtimer; 206f8cd5488SJamal Hadi Salim 2071da177e4SLinus Torvalds /* Statistics */ 2081da177e4SLinus Torvalds struct xfrm_stats stats; 2091da177e4SLinus Torvalds 2101da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2119e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2121da177e4SLinus Torvalds 213e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 214e3c0d047SFan Du long saved_tmo; 215e3c0d047SFan Du 2169afaca05SMasahide NAKAMURA /* Last used time */ 217d26f3984SHerbert Xu unsigned long lastused; 2189afaca05SMasahide NAKAMURA 2191da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2201da177e4SLinus Torvalds * transformer. */ 221533cb5b0SEric Dumazet const struct xfrm_type *type; 22213996378SHerbert Xu struct xfrm_mode *inner_mode; 223df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 22413996378SHerbert Xu struct xfrm_mode *outer_mode; 2251da177e4SLinus Torvalds 226df71837dSTrent Jaeger /* Security context */ 227df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 228df71837dSTrent Jaeger 2291da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2301da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2311da177e4SLinus Torvalds void *data; 2321da177e4SLinus Torvalds }; 2331da177e4SLinus Torvalds 234673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 235673c09beSAlexey Dobriyan { 236673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 237673c09beSAlexey Dobriyan } 238673c09beSAlexey Dobriyan 2392717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2402717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 241e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2422717096aSJamal Hadi Salim 2431da177e4SLinus Torvalds enum { 2441da177e4SLinus Torvalds XFRM_STATE_VOID, 2451da177e4SLinus Torvalds XFRM_STATE_ACQ, 2461da177e4SLinus Torvalds XFRM_STATE_VALID, 2471da177e4SLinus Torvalds XFRM_STATE_ERROR, 2481da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2491da177e4SLinus Torvalds XFRM_STATE_DEAD 2501da177e4SLinus Torvalds }; 2511da177e4SLinus Torvalds 25226b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 253fd2c3ef7SEric Dumazet struct km_event { 254bf08867fSHerbert Xu union { 255bf08867fSHerbert Xu u32 hard; 256bf08867fSHerbert Xu u32 proto; 257bf08867fSHerbert Xu u32 byid; 258f8cd5488SJamal Hadi Salim u32 aevent; 259f7b6983fSMasahide NAKAMURA u32 type; 260bf08867fSHerbert Xu } data; 261bf08867fSHerbert Xu 26226b15dadSJamal Hadi Salim u32 seq; 26315e47304SEric W. Biederman u32 portid; 26426b15dadSJamal Hadi Salim u32 event; 2657067802eSAlexey Dobriyan struct net *net; 26626b15dadSJamal Hadi Salim }; 26726b15dadSJamal Hadi Salim 2689fdc4883SSteffen Klassert struct xfrm_replay { 2699fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2709fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2719fdc4883SSteffen Klassert struct sk_buff *skb, 2729fdc4883SSteffen Klassert __be32 net_seq); 2733b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2743b59df46SSteffen Klassert struct sk_buff *skb, 2753b59df46SSteffen Klassert __be32 net_seq); 2769fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2779fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2789fdc4883SSteffen Klassert }; 2799fdc4883SSteffen Klassert 28025ee3286SHerbert Xu struct net_device; 2811da177e4SLinus Torvalds struct xfrm_type; 2821da177e4SLinus Torvalds struct xfrm_dst; 2831da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2841da177e4SLinus Torvalds unsigned short family; 2851da177e4SLinus Torvalds struct dst_ops *dst_ops; 286ddcfd796SAlexey Dobriyan void (*garbage_collect)(struct net *net); 287c5b3cf46SAlexey Dobriyan struct dst_entry *(*dst_lookup)(struct net *net, int tos, 2885e6b930fSDavid S. Miller const xfrm_address_t *saddr, 2895e6b930fSDavid S. Miller const xfrm_address_t *daddr); 290fbda33b2SAlexey Dobriyan int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr); 2911da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 292d5422efeSHerbert Xu struct flowi *fl, 293d5422efeSHerbert Xu int reverse); 29405d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 2959d7b0fc1SPatrick McHardy void (*init_dst)(struct net *net, 2969d7b0fc1SPatrick McHardy struct xfrm_dst *dst); 297a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 298a1b05140SMasahide NAKAMURA struct dst_entry *dst, 299a1b05140SMasahide NAKAMURA int nfheader_len); 30025ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 30187c1e12bSHerbert Xu struct net_device *dev, 3020c7b3eefSDavid S. Miller const struct flowi *fl); 3032774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3041da177e4SLinus Torvalds }; 3051da177e4SLinus Torvalds 306d511337aSJoe Perches int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo); 307d511337aSJoe Perches int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); 308d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 309d511337aSJoe Perches const struct km_event *c); 310d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3111da177e4SLinus Torvalds 3121da177e4SLinus Torvalds struct xfrm_tmpl; 313d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 314d511337aSJoe Perches struct xfrm_policy *pol); 315d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 316d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 31753bc6b4dSJamal Hadi Salim 3181da177e4SLinus Torvalds struct xfrm_state_afinfo { 31917c2a42aSHerbert Xu unsigned int family; 32036cf9acfSHerbert Xu unsigned int proto; 3218e3d716cSAl Viro __be16 eth_proto; 32217c2a42aSHerbert Xu struct module *owner; 323533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 324aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 325d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 32673e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 32773e5ebb2SDavid S. Miller const struct flowi *fl); 32819bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 32919bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 33019bd6244SDavid S. Miller const xfrm_address_t *daddr, 33119bd6244SDavid S. Miller const xfrm_address_t *saddr); 33241a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 33341a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 334aad88724SEric Dumazet int (*output)(struct sock *sk, struct sk_buff *skb); 33543a4dea4SSteffen Klassert int (*output_finish)(struct sk_buff *skb); 336227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 337227620e2SHerbert Xu struct sk_buff *skb); 33836cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 33936cf9acfSHerbert Xu struct sk_buff *skb); 340716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 341716062fdSHerbert Xu int async); 342628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3431da177e4SLinus Torvalds }; 3441da177e4SLinus Torvalds 345d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 346d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 347d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 348d511337aSJoe Perches void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo); 3491da177e4SLinus Torvalds 3502f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3512f32b51bSSteffen Klassert unsigned int family; 3522f32b51bSSteffen Klassert struct module *owner; 3532f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3542f32b51bSSteffen Klassert int err); 3552f32b51bSSteffen Klassert }; 3562f32b51bSSteffen Klassert 3572f32b51bSSteffen Klassert int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo); 3582f32b51bSSteffen Klassert int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo); 3592f32b51bSSteffen Klassert 360d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3611da177e4SLinus Torvalds 362fd2c3ef7SEric Dumazet struct xfrm_type { 3631da177e4SLinus Torvalds char *description; 3641da177e4SLinus Torvalds struct module *owner; 365a6337463Sjamal u8 proto; 366a6337463Sjamal u8 flags; 3671b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 368436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 369f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 370f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3711da177e4SLinus Torvalds 37272cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3731da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 374e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3751da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3768f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3778f029de2SDavid S. Miller const struct flowi *); 378aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3791da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 380c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3811da177e4SLinus Torvalds }; 3821da177e4SLinus Torvalds 383d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 384d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3851da177e4SLinus Torvalds 386b59f45d0SHerbert Xu struct xfrm_mode { 387227620e2SHerbert Xu /* 388227620e2SHerbert Xu * Remove encapsulation header. 389227620e2SHerbert Xu * 390227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 391227620e2SHerbert Xu * header. 392227620e2SHerbert Xu * 393227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 394227620e2SHerbert Xu * should be and the network header shall be set to where the IP 395227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 396227620e2SHerbert Xu * payload. 397227620e2SHerbert Xu */ 398227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 399227620e2SHerbert Xu 400227620e2SHerbert Xu /* 401227620e2SHerbert Xu * This is the actual input entry point. 402227620e2SHerbert Xu * 403227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 404227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 405227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 406227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 407227620e2SHerbert Xu */ 408b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 40937fedd3aSHerbert Xu 41037fedd3aSHerbert Xu /* 41137fedd3aSHerbert Xu * Add encapsulation header. 41237fedd3aSHerbert Xu * 41337fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 41437fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 41537fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 41637fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 41737fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 41837fedd3aSHerbert Xu * header. The value of the network header will always point 41937fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 42037fedd3aSHerbert Xu */ 42136cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 42236cf9acfSHerbert Xu 42336cf9acfSHerbert Xu /* 42436cf9acfSHerbert Xu * This is the actual output entry point. 42536cf9acfSHerbert Xu * 42636cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 42736cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 42836cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 42936cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 43036cf9acfSHerbert Xu * call output2. 43136cf9acfSHerbert Xu */ 432eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 433b59f45d0SHerbert Xu 43417c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 435b59f45d0SHerbert Xu struct module *owner; 436b59f45d0SHerbert Xu unsigned int encap; 4371bfcb10fSHerbert Xu int flags; 4381bfcb10fSHerbert Xu }; 4391bfcb10fSHerbert Xu 4401bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4411bfcb10fSHerbert Xu enum { 4421bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 443b59f45d0SHerbert Xu }; 444b59f45d0SHerbert Xu 445d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 446d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 447b59f45d0SHerbert Xu 448df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 449df9dcb45SKazunori MIYAZAWA { 450df9dcb45SKazunori MIYAZAWA switch(family) { 451df9dcb45SKazunori MIYAZAWA case AF_INET: 452df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 453df9dcb45SKazunori MIYAZAWA case AF_INET6: 454df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 455df9dcb45SKazunori MIYAZAWA default: 456df9dcb45SKazunori MIYAZAWA return 0; 457df9dcb45SKazunori MIYAZAWA } 458df9dcb45SKazunori MIYAZAWA } 459df9dcb45SKazunori MIYAZAWA 460df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 461df9dcb45SKazunori MIYAZAWA { 462df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 463df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 464df9dcb45SKazunori MIYAZAWA return x->inner_mode; 465df9dcb45SKazunori MIYAZAWA else 466df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 467df9dcb45SKazunori MIYAZAWA } 468df9dcb45SKazunori MIYAZAWA 469fd2c3ef7SEric Dumazet struct xfrm_tmpl { 4701da177e4SLinus Torvalds /* id in template is interpreted as: 4711da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4721da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4731da177e4SLinus Torvalds * daddr must be fixed too. 4741da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4751da177e4SLinus Torvalds */ 4761da177e4SLinus Torvalds struct xfrm_id id; 4771da177e4SLinus Torvalds 4781da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4791da177e4SLinus Torvalds xfrm_address_t saddr; 4801da177e4SLinus Torvalds 48176b3f055SMiika Komu unsigned short encap_family; 48276b3f055SMiika Komu 483a6337463Sjamal u32 reqid; 4841da177e4SLinus Torvalds 4857e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 486a6337463Sjamal u8 mode; 4871da177e4SLinus Torvalds 4881da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 489a6337463Sjamal u8 share; 4901da177e4SLinus Torvalds 4911da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 492a6337463Sjamal u8 optional; 4931da177e4SLinus Torvalds 494c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 495a6337463Sjamal u8 allalgs; 496c5d18e98SHerbert Xu 4971da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 498a6337463Sjamal u32 aalgos; 499a6337463Sjamal u32 ealgos; 500a6337463Sjamal u32 calgos; 5011da177e4SLinus Torvalds }; 5021da177e4SLinus Torvalds 503622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 5041da177e4SLinus Torvalds 50512a169e7SHerbert Xu struct xfrm_policy_walk_entry { 50612a169e7SHerbert Xu struct list_head all; 50712a169e7SHerbert Xu u8 dead; 50812a169e7SHerbert Xu }; 50912a169e7SHerbert Xu 51012a169e7SHerbert Xu struct xfrm_policy_walk { 51112a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 51212a169e7SHerbert Xu u8 type; 51312a169e7SHerbert Xu u32 seq; 51412a169e7SHerbert Xu }; 51512a169e7SHerbert Xu 516a0073fe1SSteffen Klassert struct xfrm_policy_queue { 517a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 518a0073fe1SSteffen Klassert struct timer_list hold_timer; 519a0073fe1SSteffen Klassert unsigned long timeout; 520a0073fe1SSteffen Klassert }; 521a0073fe1SSteffen Klassert 522fd2c3ef7SEric Dumazet struct xfrm_policy { 5230c5c9fb5SEric W. Biederman possible_net_t xp_net; 5242518c7c2SDavid S. Miller struct hlist_node bydst; 5252518c7c2SDavid S. Miller struct hlist_node byidx; 5261da177e4SLinus Torvalds 5271da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5281da177e4SLinus Torvalds rwlock_t lock; 5291da177e4SLinus Torvalds atomic_t refcnt; 5301da177e4SLinus Torvalds struct timer_list timer; 5311da177e4SLinus Torvalds 532fe1a5f03STimo Teräs struct flow_cache_object flo; 53380c802f3STimo Teräs atomic_t genid; 5341da177e4SLinus Torvalds u32 priority; 5351da177e4SLinus Torvalds u32 index; 536bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5371da177e4SLinus Torvalds struct xfrm_selector selector; 5381da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5391da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 54012a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 541a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 54246ca5f5dSArnaldo Carvalho de Melo u8 type; 54346ca5f5dSArnaldo Carvalho de Melo u8 action; 54446ca5f5dSArnaldo Carvalho de Melo u8 flags; 54546ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 54612a169e7SHerbert Xu u16 family; 547df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5481da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 5491da177e4SLinus Torvalds }; 5501da177e4SLinus Torvalds 55163eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5520331b1f3SAlexey Dobriyan { 5530331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5540331b1f3SAlexey Dobriyan } 5550331b1f3SAlexey Dobriyan 55613c1d189SArnaud Ebalard struct xfrm_kmaddress { 55713c1d189SArnaud Ebalard xfrm_address_t local; 55813c1d189SArnaud Ebalard xfrm_address_t remote; 55913c1d189SArnaud Ebalard u32 reserved; 56013c1d189SArnaud Ebalard u16 family; 56113c1d189SArnaud Ebalard }; 56213c1d189SArnaud Ebalard 56380c9abaaSShinta Sugimoto struct xfrm_migrate { 56480c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 56580c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 56680c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 56780c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 56880c9abaaSShinta Sugimoto u8 proto; 56980c9abaaSShinta Sugimoto u8 mode; 57080c9abaaSShinta Sugimoto u16 reserved; 57180c9abaaSShinta Sugimoto u32 reqid; 57280c9abaaSShinta Sugimoto u16 old_family; 57380c9abaaSShinta Sugimoto u16 new_family; 57480c9abaaSShinta Sugimoto }; 57580c9abaaSShinta Sugimoto 5761da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 577f8cd5488SJamal Hadi Salim /* what happened */ 578f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 579f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 580f8cd5488SJamal Hadi Salim 581f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 582f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 583f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 584f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 585f8cd5488SJamal Hadi Salim /* default seq threshold size */ 586f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 5871da177e4SLinus Torvalds 588fd2c3ef7SEric Dumazet struct xfrm_mgr { 5891da177e4SLinus Torvalds struct list_head list; 5901da177e4SLinus Torvalds char *id; 591214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 59265e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 593cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 5945d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 595214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 596db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 597183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 598183cad12SDavid S. Miller u8 dir, u8 type, 599183cad12SDavid S. Miller const struct xfrm_migrate *m, 600183cad12SDavid S. Miller int num_bundles, 601183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 6020f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6031da177e4SLinus Torvalds }; 6041da177e4SLinus Torvalds 605d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 606d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6071da177e4SLinus Torvalds 60870be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 60970be6c91SSteffen Klassert union { 61070be6c91SSteffen Klassert struct inet_skb_parm h4; 61170be6c91SSteffen Klassert struct inet6_skb_parm h6; 61270be6c91SSteffen Klassert } header; 61370be6c91SSteffen Klassert 61470be6c91SSteffen Klassert union { 61570be6c91SSteffen Klassert struct ip_tunnel *ip4; 61670be6c91SSteffen Klassert struct ip6_tnl *ip6; 61770be6c91SSteffen Klassert } tunnel; 61870be6c91SSteffen Klassert }; 61970be6c91SSteffen Klassert 62070be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 62170be6c91SSteffen Klassert 622436a0a40SHerbert Xu /* 623436a0a40SHerbert Xu * This structure is used for the duration where packets are being 624436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 625436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 626436a0a40SHerbert Xu */ 627436a0a40SHerbert Xu struct xfrm_skb_cb { 62870be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 629436a0a40SHerbert Xu 630436a0a40SHerbert Xu /* Sequence number for replay protection. */ 631b318e0e4SHerbert Xu union { 6321ce3644aSSteffen Klassert struct { 6331ce3644aSSteffen Klassert __u32 low; 6341ce3644aSSteffen Klassert __u32 hi; 6351ce3644aSSteffen Klassert } output; 6361ce3644aSSteffen Klassert struct { 6371ce3644aSSteffen Klassert __be32 low; 6381ce3644aSSteffen Klassert __be32 hi; 6391ce3644aSSteffen Klassert } input; 640b318e0e4SHerbert Xu } seq; 641436a0a40SHerbert Xu }; 642436a0a40SHerbert Xu 643436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 644436a0a40SHerbert Xu 64536cf9acfSHerbert Xu /* 64636cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 64736cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 64836cf9acfSHerbert Xu */ 64936cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 65070be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 65136cf9acfSHerbert Xu 65236cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 65336cf9acfSHerbert Xu __be16 id; 65436cf9acfSHerbert Xu __be16 frag_off; 65536cf9acfSHerbert Xu 656732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 657732c8bd5SHerbert Xu u8 ihl; 658732c8bd5SHerbert Xu 65936cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 66036cf9acfSHerbert Xu u8 tos; 66136cf9acfSHerbert Xu 66236cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 66336cf9acfSHerbert Xu u8 ttl; 66436cf9acfSHerbert Xu 66536cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 66636cf9acfSHerbert Xu u8 protocol; 66736cf9acfSHerbert Xu 668732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 669732c8bd5SHerbert Xu u8 optlen; 670732c8bd5SHerbert Xu 67136cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 67236cf9acfSHerbert Xu u8 flow_lbl[3]; 67336cf9acfSHerbert Xu }; 67436cf9acfSHerbert Xu 67536cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 67636cf9acfSHerbert Xu 677716062fdSHerbert Xu /* 678716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 679716062fdSHerbert Xu * related information. 680716062fdSHerbert Xu */ 681716062fdSHerbert Xu struct xfrm_spi_skb_cb { 68270be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 683716062fdSHerbert Xu 684716062fdSHerbert Xu unsigned int daddroff; 6852fcb45b6SHerbert Xu unsigned int family; 686716062fdSHerbert Xu }; 687716062fdSHerbert Xu 688716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 689716062fdSHerbert Xu 690c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 691afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 692ab5f5e8bSJoy Latten { 693ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 694ab5f5e8bSJoy Latten 695afeb14b4SPaul Moore if (audit_enabled == 0) 696afeb14b4SPaul Moore return NULL; 697ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 698ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 699ab5f5e8bSJoy Latten if (audit_buf == NULL) 700ab5f5e8bSJoy Latten return NULL; 701afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 702afeb14b4SPaul Moore return audit_buf; 703afeb14b4SPaul Moore } 704afeb14b4SPaul Moore 7052e71029eSTetsuo Handa static inline void xfrm_audit_helper_usrinfo(bool task_valid, 706afeb14b4SPaul Moore struct audit_buffer *audit_buf) 707afeb14b4SPaul Moore { 7082e71029eSTetsuo Handa const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 7092e71029eSTetsuo Handa audit_get_loginuid(current) : 7102e71029eSTetsuo Handa INVALID_UID); 7112e71029eSTetsuo Handa const unsigned int ses = task_valid ? audit_get_sessionid(current) : 7122e71029eSTetsuo Handa (unsigned int) -1; 7132e71029eSTetsuo Handa 7142e71029eSTetsuo Handa audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 715ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 716ab5f5e8bSJoy Latten } 717ab5f5e8bSJoy Latten 7182e71029eSTetsuo Handa void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 7192e71029eSTetsuo Handa void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7202e71029eSTetsuo Handa bool task_valid); 7212e71029eSTetsuo Handa void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 7222e71029eSTetsuo Handa void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 723d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 724afeb14b4SPaul Moore struct sk_buff *skb); 725d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 726d511337aSJoe Perches __be32 net_seq); 727d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 728d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 729d511337aSJoe Perches __be32 net_seq); 730d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 731d511337aSJoe Perches u8 proto); 732c9204d9cSJoy Latten #else 73341fef0eeSMarcin Slusarz 73441fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7352e71029eSTetsuo Handa bool task_valid) 73641fef0eeSMarcin Slusarz { 73741fef0eeSMarcin Slusarz } 73841fef0eeSMarcin Slusarz 73941fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7402e71029eSTetsuo Handa bool task_valid) 74141fef0eeSMarcin Slusarz { 74241fef0eeSMarcin Slusarz } 74341fef0eeSMarcin Slusarz 74441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7452e71029eSTetsuo Handa bool task_valid) 74641fef0eeSMarcin Slusarz { 74741fef0eeSMarcin Slusarz } 74841fef0eeSMarcin Slusarz 74941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7502e71029eSTetsuo Handa bool task_valid) 75141fef0eeSMarcin Slusarz { 75241fef0eeSMarcin Slusarz } 75341fef0eeSMarcin Slusarz 75441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 75541fef0eeSMarcin Slusarz struct sk_buff *skb) 75641fef0eeSMarcin Slusarz { 75741fef0eeSMarcin Slusarz } 75841fef0eeSMarcin Slusarz 7599fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7609fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7619fdc4883SSteffen Klassert { 7629fdc4883SSteffen Klassert } 7639fdc4883SSteffen Klassert 76441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 76541fef0eeSMarcin Slusarz u16 family) 76641fef0eeSMarcin Slusarz { 76741fef0eeSMarcin Slusarz } 76841fef0eeSMarcin Slusarz 76941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 77041fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 77141fef0eeSMarcin Slusarz { 77241fef0eeSMarcin Slusarz } 77341fef0eeSMarcin Slusarz 77441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 77541fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 77641fef0eeSMarcin Slusarz { 77741fef0eeSMarcin Slusarz } 778c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 779161a09e7SJoy Latten 7801da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 7811da177e4SLinus Torvalds { 7821da177e4SLinus Torvalds if (likely(policy != NULL)) 7831da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 7841da177e4SLinus Torvalds } 7851da177e4SLinus Torvalds 786d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 7871da177e4SLinus Torvalds 7881da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 7891da177e4SLinus Torvalds { 7901da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 79164c31b3fSWANG Cong xfrm_policy_destroy(policy); 7921da177e4SLinus Torvalds } 7931da177e4SLinus Torvalds 7944e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 7954e81bb83SMasahide NAKAMURA { 7964e81bb83SMasahide NAKAMURA int i; 7974e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 7984e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 7994e81bb83SMasahide NAKAMURA } 8004e81bb83SMasahide NAKAMURA 801d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8021da177e4SLinus Torvalds 80321380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 80421380b81SHerbert Xu { 80521380b81SHerbert Xu atomic_dec(&x->refcnt); 80621380b81SHerbert Xu } 80721380b81SHerbert Xu 8081da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8091da177e4SLinus Torvalds { 8101da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 8111da177e4SLinus Torvalds __xfrm_state_destroy(x); 8121da177e4SLinus Torvalds } 8131da177e4SLinus Torvalds 8141da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8151da177e4SLinus Torvalds { 8161da177e4SLinus Torvalds atomic_inc(&x->refcnt); 8171da177e4SLinus Torvalds } 8181da177e4SLinus Torvalds 8191744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 8201744a8feSDavid S. Miller int prefixlen) 8211da177e4SLinus Torvalds { 8221744a8feSDavid S. Miller const __be32 *a1 = token1; 8231744a8feSDavid S. Miller const __be32 *a2 = token2; 8241da177e4SLinus Torvalds int pdw; 8251da177e4SLinus Torvalds int pbi; 8261da177e4SLinus Torvalds 827a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8281da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8291da177e4SLinus Torvalds 8301da177e4SLinus Torvalds if (pdw) 8311da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8321744a8feSDavid S. Miller return false; 8331da177e4SLinus Torvalds 8341da177e4SLinus Torvalds if (pbi) { 8355f19343fSAl Viro __be32 mask; 8361da177e4SLinus Torvalds 8371da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8381da177e4SLinus Torvalds 8391da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8401744a8feSDavid S. Miller return false; 8411da177e4SLinus Torvalds } 8421da177e4SLinus Torvalds 8431744a8feSDavid S. Miller return true; 8441da177e4SLinus Torvalds } 8451da177e4SLinus Torvalds 84626bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 84726bff940SAlexey Dobriyan { 84826bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 84926bff940SAlexey Dobriyan if (prefixlen == 0) 85026bff940SAlexey Dobriyan return true; 85126bff940SAlexey Dobriyan return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen))); 85226bff940SAlexey Dobriyan } 85326bff940SAlexey Dobriyan 8541da177e4SLinus Torvalds static __inline__ 8556281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8561da177e4SLinus Torvalds { 857f9d07e41SAl Viro __be16 port; 8581d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8591da177e4SLinus Torvalds case IPPROTO_TCP: 8601da177e4SLinus Torvalds case IPPROTO_UDP: 861ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8621da177e4SLinus Torvalds case IPPROTO_SCTP: 8636281dcc9SDavid S. Miller port = uli->ports.sport; 8641da177e4SLinus Torvalds break; 8651da177e4SLinus Torvalds case IPPROTO_ICMP: 8661da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8676281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 8681da177e4SLinus Torvalds break; 8692ce4272aSMasahide NAKAMURA case IPPROTO_MH: 8706281dcc9SDavid S. Miller port = htons(uli->mht.type); 8712ce4272aSMasahide NAKAMURA break; 872cc9ff19dSTimo Teräs case IPPROTO_GRE: 8736281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 874cc9ff19dSTimo Teräs break; 8751da177e4SLinus Torvalds default: 8761da177e4SLinus Torvalds port = 0; /*XXX*/ 8771da177e4SLinus Torvalds } 8781da177e4SLinus Torvalds return port; 8791da177e4SLinus Torvalds } 8801da177e4SLinus Torvalds 8811da177e4SLinus Torvalds static __inline__ 8826281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 8831da177e4SLinus Torvalds { 884f9d07e41SAl Viro __be16 port; 8851d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8861da177e4SLinus Torvalds case IPPROTO_TCP: 8871da177e4SLinus Torvalds case IPPROTO_UDP: 888ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8891da177e4SLinus Torvalds case IPPROTO_SCTP: 8906281dcc9SDavid S. Miller port = uli->ports.dport; 8911da177e4SLinus Torvalds break; 8921da177e4SLinus Torvalds case IPPROTO_ICMP: 8931da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8946281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 8951da177e4SLinus Torvalds break; 896cc9ff19dSTimo Teräs case IPPROTO_GRE: 8976281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 898cc9ff19dSTimo Teräs break; 8991da177e4SLinus Torvalds default: 9001da177e4SLinus Torvalds port = 0; /*XXX*/ 9011da177e4SLinus Torvalds } 9021da177e4SLinus Torvalds return port; 9031da177e4SLinus Torvalds } 9041da177e4SLinus Torvalds 905d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 906d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9071da177e4SLinus Torvalds 908df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 909df71837dSTrent Jaeger /* If neither has a context --> match 910df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 911df71837dSTrent Jaeger */ 912bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 913df71837dSTrent Jaeger { 914df71837dSTrent Jaeger return ((!s1 && !s2) || 915df71837dSTrent Jaeger (s1 && s2 && 916df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 917df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 918df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 919df71837dSTrent Jaeger } 920df71837dSTrent Jaeger #else 921bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 922df71837dSTrent Jaeger { 923bc9b35adSDavid S. Miller return true; 924df71837dSTrent Jaeger } 925df71837dSTrent Jaeger #endif 926df71837dSTrent Jaeger 9271da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9281da177e4SLinus Torvalds * 9291da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9301da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9311da177e4SLinus Torvalds * 9321da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9331da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9341da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9351da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9361da177e4SLinus Torvalds * policy rule. 9371da177e4SLinus Torvalds */ 938fd2c3ef7SEric Dumazet struct xfrm_dst { 9391da177e4SLinus Torvalds union { 9401da177e4SLinus Torvalds struct dst_entry dst; 9411da177e4SLinus Torvalds struct rtable rt; 9421da177e4SLinus Torvalds struct rt6_info rt6; 9431da177e4SLinus Torvalds } u; 9441da177e4SLinus Torvalds struct dst_entry *route; 94580c802f3STimo Teräs struct flow_cache_object flo; 94680c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 94780c802f3STimo Teräs int num_pols, num_xfrms; 948157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 949157bfc25SMasahide NAKAMURA struct flowi *origin; 950157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 951157bfc25SMasahide NAKAMURA #endif 95280c802f3STimo Teräs u32 xfrm_genid; 95380c802f3STimo Teräs u32 policy_genid; 9541da177e4SLinus Torvalds u32 route_mtu_cached; 9551da177e4SLinus Torvalds u32 child_mtu_cached; 95692d63decSHideaki YOSHIFUJI u32 route_cookie; 95792d63decSHideaki YOSHIFUJI u32 path_cookie; 9581da177e4SLinus Torvalds }; 9591da177e4SLinus Torvalds 960def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 961aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 962aabc9761SHerbert Xu { 96380c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 964aabc9761SHerbert Xu dst_release(xdst->route); 965aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 966aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 967157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 968157bfc25SMasahide NAKAMURA kfree(xdst->origin); 969157bfc25SMasahide NAKAMURA xdst->origin = NULL; 970157bfc25SMasahide NAKAMURA kfree(xdst->partner); 971157bfc25SMasahide NAKAMURA xdst->partner = NULL; 972157bfc25SMasahide NAKAMURA #endif 973aabc9761SHerbert Xu } 974def8b4faSAlexey Dobriyan #endif 975aabc9761SHerbert Xu 976d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 977aabc9761SHerbert Xu 978fd2c3ef7SEric Dumazet struct sec_path { 9791da177e4SLinus Torvalds atomic_t refcnt; 9801da177e4SLinus Torvalds int len; 981dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 9821da177e4SLinus Torvalds }; 9831da177e4SLinus Torvalds 984990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 985990078afSMichael Smith { 986990078afSMichael Smith #ifdef CONFIG_XFRM 987990078afSMichael Smith return skb->sp != NULL; 988990078afSMichael Smith #else 989990078afSMichael Smith return 0; 990990078afSMichael Smith #endif 991990078afSMichael Smith } 992990078afSMichael Smith 9931da177e4SLinus Torvalds static inline struct sec_path * 9941da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 9951da177e4SLinus Torvalds { 9961da177e4SLinus Torvalds if (sp) 9971da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 9981da177e4SLinus Torvalds return sp; 9991da177e4SLinus Torvalds } 10001da177e4SLinus Torvalds 1001d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10021da177e4SLinus Torvalds 10031da177e4SLinus Torvalds static inline void 10041da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10051da177e4SLinus Torvalds { 10061da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 10071da177e4SLinus Torvalds __secpath_destroy(sp); 10081da177e4SLinus Torvalds } 10091da177e4SLinus Torvalds 1010d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 10111da177e4SLinus Torvalds 10121da177e4SLinus Torvalds static inline void 10131da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10141da177e4SLinus Torvalds { 10151da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10161da177e4SLinus Torvalds secpath_put(skb->sp); 10171da177e4SLinus Torvalds skb->sp = NULL; 10181da177e4SLinus Torvalds #endif 10191da177e4SLinus Torvalds } 10201da177e4SLinus Torvalds 10211da177e4SLinus Torvalds static inline int 10226cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1023a1e59abfSPatrick McHardy { 1024a1e59abfSPatrick McHardy switch (family) { 1025a1e59abfSPatrick McHardy case AF_INET: 1026a1e59abfSPatrick McHardy return addr->a4 == 0; 1027a1e59abfSPatrick McHardy case AF_INET6: 102815e318bdSJiri Benc return ipv6_addr_any(&addr->in6); 1029a1e59abfSPatrick McHardy } 1030a1e59abfSPatrick McHardy return 0; 1031a1e59abfSPatrick McHardy } 1032a1e59abfSPatrick McHardy 1033a1e59abfSPatrick McHardy static inline int 103421eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10351da177e4SLinus Torvalds { 10361da177e4SLinus Torvalds return (tmpl->saddr.a4 && 10371da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 10381da177e4SLinus Torvalds } 10391da177e4SLinus Torvalds 10401da177e4SLinus Torvalds static inline int 104121eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10421da177e4SLinus Torvalds { 10431da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1044ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 10451da177e4SLinus Torvalds } 10461da177e4SLinus Torvalds 10471da177e4SLinus Torvalds static inline int 104821eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 10491da177e4SLinus Torvalds { 10501da177e4SLinus Torvalds switch (family) { 10511da177e4SLinus Torvalds case AF_INET: 10521da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 10531da177e4SLinus Torvalds case AF_INET6: 10541da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 10551da177e4SLinus Torvalds } 10561da177e4SLinus Torvalds return !0; 10571da177e4SLinus Torvalds } 10581da177e4SLinus Torvalds 10591da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1060d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1061d511337aSJoe Perches unsigned short family); 10621da177e4SLinus Torvalds 1063d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1064d5422efeSHerbert Xu struct sk_buff *skb, 1065d5422efeSHerbert Xu unsigned int family, int reverse) 10661da177e4SLinus Torvalds { 1067f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1068d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1069d5422efeSHerbert Xu 10701da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1071d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 10721da177e4SLinus Torvalds 1073f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1074adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1075d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1076d5422efeSHerbert Xu } 1077d5422efeSHerbert Xu 1078d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1079d5422efeSHerbert Xu { 1080d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 10811da177e4SLinus Torvalds } 10821da177e4SLinus Torvalds 10831da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10841da177e4SLinus Torvalds { 10851da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 10861da177e4SLinus Torvalds } 10871da177e4SLinus Torvalds 10881da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10891da177e4SLinus Torvalds { 10901da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 10911da177e4SLinus Torvalds } 10921da177e4SLinus Torvalds 1093d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1094d5422efeSHerbert Xu struct sk_buff *skb) 1095d5422efeSHerbert Xu { 1096d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1097d5422efeSHerbert Xu } 1098d5422efeSHerbert Xu 1099d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1100d5422efeSHerbert Xu struct sk_buff *skb) 1101d5422efeSHerbert Xu { 1102d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1103d5422efeSHerbert Xu } 1104d5422efeSHerbert Xu 1105d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1106d5422efeSHerbert Xu unsigned int family, int reverse); 1107d5422efeSHerbert Xu 1108d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1109d5422efeSHerbert Xu unsigned int family) 1110d5422efeSHerbert Xu { 1111d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1112d5422efeSHerbert Xu } 1113d5422efeSHerbert Xu 1114d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1115d5422efeSHerbert Xu struct flowi *fl, 1116d5422efeSHerbert Xu unsigned int family) 1117d5422efeSHerbert Xu { 1118d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1119d5422efeSHerbert Xu } 1120d5422efeSHerbert Xu 1121d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11221da177e4SLinus Torvalds 11231da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11241da177e4SLinus Torvalds { 112599a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 112699a66657SAlexey Dobriyan 112799a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1128adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11291da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11301da177e4SLinus Torvalds } 11311da177e4SLinus Torvalds 11321da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11331da177e4SLinus Torvalds { 11341da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 11351da177e4SLinus Torvalds } 11361da177e4SLinus Torvalds 11371da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 11381da177e4SLinus Torvalds { 11391da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 11401da177e4SLinus Torvalds } 11411da177e4SLinus Torvalds 1142d511337aSJoe Perches int __xfrm_sk_clone_policy(struct sock *sk); 11431da177e4SLinus Torvalds 11441da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) 11451da177e4SLinus Torvalds { 11461da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] || sk->sk_policy[1])) 11471da177e4SLinus Torvalds return __xfrm_sk_clone_policy(sk); 11481da177e4SLinus Torvalds return 0; 11491da177e4SLinus Torvalds } 11501da177e4SLinus Torvalds 1151d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 11521da177e4SLinus Torvalds 11531da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 11541da177e4SLinus Torvalds { 11551da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] != NULL)) { 11561da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX); 11571da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 11581da177e4SLinus Torvalds } 11591da177e4SLinus Torvalds if (unlikely(sk->sk_policy[1] != NULL)) { 11601da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1); 11611da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 11621da177e4SLinus Torvalds } 11631da177e4SLinus Torvalds } 11641da177e4SLinus Torvalds 1165d511337aSJoe Perches void xfrm_garbage_collect(struct net *net); 1166e4c17216SPaul Moore 11671da177e4SLinus Torvalds #else 11681da177e4SLinus Torvalds 11691da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 11701da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; } 11711da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 11721da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 11731da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11741da177e4SLinus Torvalds { 11751da177e4SLinus Torvalds return 1; 11761da177e4SLinus Torvalds } 11771da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11781da177e4SLinus Torvalds { 11791da177e4SLinus Torvalds return 1; 11801da177e4SLinus Torvalds } 11811da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 11821da177e4SLinus Torvalds { 11831da177e4SLinus Torvalds return 1; 11841da177e4SLinus Torvalds } 1185d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1186d5422efeSHerbert Xu struct flowi *fl, 1187d5422efeSHerbert Xu unsigned int family) 1188d5422efeSHerbert Xu { 1189d5422efeSHerbert Xu return -ENOSYS; 1190d5422efeSHerbert Xu } 1191d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1192d5422efeSHerbert Xu struct sk_buff *skb) 1193d5422efeSHerbert Xu { 1194d5422efeSHerbert Xu return 1; 1195d5422efeSHerbert Xu } 1196d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1197d5422efeSHerbert Xu struct sk_buff *skb) 1198d5422efeSHerbert Xu { 1199d5422efeSHerbert Xu return 1; 1200d5422efeSHerbert Xu } 1201e4c17216SPaul Moore static inline void xfrm_garbage_collect(struct net *net) 1202e4c17216SPaul Moore { 1203e4c17216SPaul Moore } 12041da177e4SLinus Torvalds #endif 12051da177e4SLinus Torvalds 12061da177e4SLinus Torvalds static __inline__ 1207e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12081da177e4SLinus Torvalds { 12091da177e4SLinus Torvalds switch (family){ 12101da177e4SLinus Torvalds case AF_INET: 12117e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12121da177e4SLinus Torvalds case AF_INET6: 12137e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12141da177e4SLinus Torvalds } 12151da177e4SLinus Torvalds return NULL; 12161da177e4SLinus Torvalds } 12171da177e4SLinus Torvalds 12181da177e4SLinus Torvalds static __inline__ 1219e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12201da177e4SLinus Torvalds { 12211da177e4SLinus Torvalds switch (family){ 12221da177e4SLinus Torvalds case AF_INET: 12237e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12241da177e4SLinus Torvalds case AF_INET6: 12257e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12261da177e4SLinus Torvalds } 12271da177e4SLinus Torvalds return NULL; 12281da177e4SLinus Torvalds } 12291da177e4SLinus Torvalds 12309bb182a7SYOSHIFUJI Hideaki static __inline__ 1231e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 12329bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 12339bb182a7SYOSHIFUJI Hideaki unsigned short family) 12349bb182a7SYOSHIFUJI Hideaki { 12359bb182a7SYOSHIFUJI Hideaki switch(family) { 12369bb182a7SYOSHIFUJI Hideaki case AF_INET: 12377e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 12387e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 12399bb182a7SYOSHIFUJI Hideaki break; 12409bb182a7SYOSHIFUJI Hideaki case AF_INET6: 124115e318bdSJiri Benc saddr->in6 = fl->u.ip6.saddr; 124215e318bdSJiri Benc daddr->in6 = fl->u.ip6.daddr; 12439bb182a7SYOSHIFUJI Hideaki break; 12449bb182a7SYOSHIFUJI Hideaki } 12459bb182a7SYOSHIFUJI Hideaki } 12469bb182a7SYOSHIFUJI Hideaki 12471da177e4SLinus Torvalds static __inline__ int 1248f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1249f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12501da177e4SLinus Torvalds { 12511da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 12521da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 12531da177e4SLinus Torvalds return 1; 12541da177e4SLinus Torvalds return 0; 12551da177e4SLinus Torvalds } 12561da177e4SLinus Torvalds 12571da177e4SLinus Torvalds static __inline__ int 1258f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1259f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12601da177e4SLinus Torvalds { 1261ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1262ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 12631da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 12641da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 12651da177e4SLinus Torvalds return 1; 12661da177e4SLinus Torvalds return 0; 12671da177e4SLinus Torvalds } 12681da177e4SLinus Torvalds 12691da177e4SLinus Torvalds static __inline__ int 1270f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1271f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 12721da177e4SLinus Torvalds unsigned short family) 12731da177e4SLinus Torvalds { 12741da177e4SLinus Torvalds switch (family) { 12751da177e4SLinus Torvalds case AF_INET: 12761da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 12771da177e4SLinus Torvalds case AF_INET6: 12781da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 12791da177e4SLinus Torvalds } 12801da177e4SLinus Torvalds return 0; 12811da177e4SLinus Torvalds } 12821da177e4SLinus Torvalds 1283e53820deSMasahide NAKAMURA static __inline__ int 1284f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1285e53820deSMasahide NAKAMURA unsigned short family) 1286e53820deSMasahide NAKAMURA { 1287e53820deSMasahide NAKAMURA switch (family) { 1288e53820deSMasahide NAKAMURA case AF_INET: 1289e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 12907e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 12917e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1292e53820deSMasahide NAKAMURA case AF_INET6: 1293e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 12947e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 12957e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1296e53820deSMasahide NAKAMURA } 1297e53820deSMasahide NAKAMURA return 0; 1298e53820deSMasahide NAKAMURA } 1299e53820deSMasahide NAKAMURA 1300f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13011da177e4SLinus Torvalds { 13021da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13031da177e4SLinus Torvalds } 13041da177e4SLinus Torvalds 13055794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13065794708fSMasahide NAKAMURA { 1307dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1308dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1309dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1310dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13115794708fSMasahide NAKAMURA } 13125794708fSMasahide NAKAMURA 13131da177e4SLinus Torvalds /* 13141da177e4SLinus Torvalds * xfrm algorithm information 13151da177e4SLinus Torvalds */ 13161a6509d9SHerbert Xu struct xfrm_algo_aead_info { 13171a6509d9SHerbert Xu u16 icv_truncbits; 13181a6509d9SHerbert Xu }; 13191a6509d9SHerbert Xu 13201da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13211da177e4SLinus Torvalds u16 icv_truncbits; 13221da177e4SLinus Torvalds u16 icv_fullbits; 13231da177e4SLinus Torvalds }; 13241da177e4SLinus Torvalds 13251da177e4SLinus Torvalds struct xfrm_algo_encr_info { 13261da177e4SLinus Torvalds u16 blockbits; 13271da177e4SLinus Torvalds u16 defkeybits; 13281da177e4SLinus Torvalds }; 13291da177e4SLinus Torvalds 13301da177e4SLinus Torvalds struct xfrm_algo_comp_info { 13311da177e4SLinus Torvalds u16 threshold; 13321da177e4SLinus Torvalds }; 13331da177e4SLinus Torvalds 13341da177e4SLinus Torvalds struct xfrm_algo_desc { 13351da177e4SLinus Torvalds char *name; 133604ff1260SHerbert Xu char *compat; 13371da177e4SLinus Torvalds u8 available:1; 13387e50f84cSJussi Kivilinna u8 pfkey_supported:1; 13391da177e4SLinus Torvalds union { 13401a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 13411da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 13421da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 13431da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 13441da177e4SLinus Torvalds } uinfo; 13451da177e4SLinus Torvalds struct sadb_alg desc; 13461da177e4SLinus Torvalds }; 13471da177e4SLinus Torvalds 13483328715eSSteffen Klassert /* XFRM protocol handlers. */ 13493328715eSSteffen Klassert struct xfrm4_protocol { 13503328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 13513328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 13523328715eSSteffen Klassert int encap_type); 13533328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 13543328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 13553328715eSSteffen Klassert 13563328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 13573328715eSSteffen Klassert int priority; 13583328715eSSteffen Klassert }; 13593328715eSSteffen Klassert 13607e14ea15SSteffen Klassert struct xfrm6_protocol { 13617e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 13627e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 13637e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 13647e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 13657e14ea15SSteffen Klassert 13667e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 13677e14ea15SSteffen Klassert int priority; 13687e14ea15SSteffen Klassert }; 13697e14ea15SSteffen Klassert 13701da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 13711da177e4SLinus Torvalds struct xfrm_tunnel { 13721da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1373a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1374d2acc347SHerbert Xu 1375b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1376d2acc347SHerbert Xu int priority; 13771da177e4SLinus Torvalds }; 13781da177e4SLinus Torvalds 13791da177e4SLinus Torvalds struct xfrm6_tunnel { 1380d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1381d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1382d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 13836f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1384d2acc347SHerbert Xu int priority; 13851da177e4SLinus Torvalds }; 13861da177e4SLinus Torvalds 1387d511337aSJoe Perches void xfrm_init(void); 1388d511337aSJoe Perches void xfrm4_init(void); 1389d511337aSJoe Perches int xfrm_state_init(struct net *net); 1390d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1391d511337aSJoe Perches void xfrm4_state_init(void); 13922f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1393c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1394d511337aSJoe Perches int xfrm6_init(void); 1395d511337aSJoe Perches void xfrm6_fini(void); 1396d511337aSJoe Perches int xfrm6_state_init(void); 1397d511337aSJoe Perches void xfrm6_state_fini(void); 13987e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 13997e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1400c35b7e72SDaniel Lezcano #else 1401c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1402c35b7e72SDaniel Lezcano { 1403c35b7e72SDaniel Lezcano return 0; 1404c35b7e72SDaniel Lezcano } 1405c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1406c35b7e72SDaniel Lezcano { 1407c35b7e72SDaniel Lezcano ; 1408c35b7e72SDaniel Lezcano } 1409c35b7e72SDaniel Lezcano #endif 14101da177e4SLinus Torvalds 1411558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1412d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1413d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1414558f82efSMasahide NAKAMURA #endif 1415558f82efSMasahide NAKAMURA 1416d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1417b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1418d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1419b27aeadbSAlexey Dobriyan #else 1420b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1421b27aeadbSAlexey Dobriyan { 1422b27aeadbSAlexey Dobriyan } 1423b27aeadbSAlexey Dobriyan #endif 1424b27aeadbSAlexey Dobriyan 1425d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1426870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1427d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 14284c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1429283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1430d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1431d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 143233765d06SDavid S. Miller const xfrm_address_t *saddr, 1433b520e9f6SDavid S. Miller const struct flowi *fl, 1434b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 14351da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 14361da177e4SLinus Torvalds unsigned short family); 1437d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 14385447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1439628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1440628529b6SJamal Hadi Salim unsigned short family, 1441628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1442c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1443c454997eSFan Du unsigned short family); 1444d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1445d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1446d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1447d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1448d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1449a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1450bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1451d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1452a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1453a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1454bd55775cSJamal Hadi Salim u8 proto, 1455bd55775cSJamal Hadi Salim unsigned short family); 145641a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1457d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1458283bc9f3SFan Du unsigned short family, struct net *net); 1459d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1460d511337aSJoe Perches unsigned short family); 146141a49cc3SMasahide NAKAMURA #else 146241a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1463283bc9f3SFan Du int n, unsigned short family, struct net *net) 146441a49cc3SMasahide NAKAMURA { 146541a49cc3SMasahide NAKAMURA return -ENOSYS; 146641a49cc3SMasahide NAKAMURA } 146741a49cc3SMasahide NAKAMURA 146841a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 146941a49cc3SMasahide NAKAMURA int n, unsigned short family) 147041a49cc3SMasahide NAKAMURA { 147141a49cc3SMasahide NAKAMURA return -ENOSYS; 147241a49cc3SMasahide NAKAMURA } 147341a49cc3SMasahide NAKAMURA #endif 1474af11e316SJamal Hadi Salim 1475af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1476af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1477af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1478af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1479af11e316SJamal Hadi Salim }; 1480af11e316SJamal Hadi Salim 14815a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 14825a6d3416SJamal Hadi Salim u32 incnt; 14835a6d3416SJamal Hadi Salim u32 outcnt; 14845a6d3416SJamal Hadi Salim u32 fwdcnt; 14855a6d3416SJamal Hadi Salim u32 inscnt; 14865a6d3416SJamal Hadi Salim u32 outscnt; 14875a6d3416SJamal Hadi Salim u32 fwdscnt; 14885a6d3416SJamal Hadi Salim u32 spdhcnt; 14895a6d3416SJamal Hadi Salim u32 spdhmcnt; 14905a6d3416SJamal Hadi Salim }; 14915a6d3416SJamal Hadi Salim 1492d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1493d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 14942e71029eSTetsuo Handa int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1495d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1496d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1497d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1498d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1499d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1500d511337aSJoe Perches int __xfrm_init_state(struct xfrm_state *x, bool init_replay); 1501d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1502d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1503d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1504d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1505d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 1506d511337aSJoe Perches int xfrm_output(struct sk_buff *skb); 1507d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1508d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1509d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1510d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1511d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1512716062fdSHerbert Xu int encap_type); 1513d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1514d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 1515c4541b41SHerbert Xu 1516c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1517c4541b41SHerbert Xu { 151870be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15193328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15203328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15213328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1522c4541b41SHerbert Xu } 1523c4541b41SHerbert Xu 1524d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1525d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1526aad88724SEric Dumazet int xfrm4_output(struct sock *sk, struct sk_buff *skb); 1527d511337aSJoe Perches int xfrm4_output_finish(struct sk_buff *skb); 15283328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15293328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 15303328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1531d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1532d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1533d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1534d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1535d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1536d511337aSJoe Perches int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi); 1537d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 1538d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1539d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1540fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 15417b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 15427e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15437e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 15447e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1545d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 15467b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1547d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1548d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1549d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1550d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1551aad88724SEric Dumazet int xfrm6_output(struct sock *sk, struct sk_buff *skb); 1552d511337aSJoe Perches int xfrm6_output_finish(struct sk_buff *skb); 1553d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1554aee5adb4SMasahide NAKAMURA u8 **prevhdr); 15551da177e4SLinus Torvalds 15561da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1557d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1558d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1559d511337aSJoe Perches u8 __user *optval, int optlen); 15601da177e4SLinus Torvalds #else 15611da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 15621da177e4SLinus Torvalds { 15631da177e4SLinus Torvalds return -ENOPROTOOPT; 15641da177e4SLinus Torvalds } 15651da177e4SLinus Torvalds 1566067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 15671da177e4SLinus Torvalds { 15681da177e4SLinus Torvalds /* should not happen */ 15691da177e4SLinus Torvalds kfree_skb(skb); 15701da177e4SLinus Torvalds return 0; 15711da177e4SLinus Torvalds } 15721da177e4SLinus Torvalds #endif 15731da177e4SLinus Torvalds 15740331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 15754c563f76STimo Teras 1576d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1577d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1578d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1579d511337aSJoe Perches void *); 1580283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 15811da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 15828ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 15838ca2e93bSJamal Hadi Salim u8 type, int dir, 15844e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1585ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1586ef41aaa0SEric Paris int *err); 1587d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1588d511337aSJoe Perches u32 id, int delete, int *err); 15892e71029eSTetsuo Handa int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1590880a6fabSChristophe Gouault void xfrm_policy_hash_rebuild(struct net *net); 15911da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1592776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1593d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1594e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1595bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1596a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1597a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1598bd55775cSJamal Hadi Salim unsigned short family); 1599d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16001da177e4SLinus Torvalds 160180c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1602d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1603183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 1604183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 1605283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1606d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 160780c9abaaSShinta Sugimoto struct xfrm_migrate *m); 1608d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 160913c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16108d549c4fSFan Du struct xfrm_kmaddress *k, struct net *net); 161180c9abaaSShinta Sugimoto #endif 161280c9abaaSShinta Sugimoto 1613d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1614d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1615d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1616d511337aSJoe Perches xfrm_address_t *addr); 16171da177e4SLinus Torvalds 1618d511337aSJoe Perches void xfrm_input_init(void); 1619d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 16201da177e4SLinus Torvalds 1621d511337aSJoe Perches void xfrm_probe_algs(void); 1622d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1623d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1624d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1625d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1626d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1627d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1628d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1629d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1630d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1631d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1632d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 16331a6509d9SHerbert Xu int probe); 16341da177e4SLinus Torvalds 1635ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1636ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1637ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1638ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1639ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1640ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1641ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 164270e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 164370e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 164470e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 164570e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 164670e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 164770e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 164870e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 164970e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 165070e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 165170e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 165270e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 165370e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 165470e94e66SYOSHIFUJI Hideaki / 吉藤英明 165577d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 165677d8d7a6SHerbert Xu { 165777d8d7a6SHerbert Xu return index & 7; 165877d8d7a6SHerbert Xu } 165977d8d7a6SHerbert Xu 1660a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1661a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1662f8cd5488SJamal Hadi Salim { 1663be33690dSPatrick McHardy struct sock *nlsk; 1664be33690dSPatrick McHardy int ret = 0; 1665be33690dSPatrick McHardy 1666be33690dSPatrick McHardy rcu_read_lock(); 1667a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1668be33690dSPatrick McHardy if (nlsk) 1669be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1670be33690dSPatrick McHardy rcu_read_unlock(); 1671be33690dSPatrick McHardy return ret; 1672f8cd5488SJamal Hadi Salim } 16730f24558eSHoria Geanta 16740f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 16750f24558eSHoria Geanta { 16760f24558eSHoria Geanta struct sock *nlsk; 16770f24558eSHoria Geanta int ret = 0; 16780f24558eSHoria Geanta 16790f24558eSHoria Geanta rcu_read_lock(); 16800f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 16810f24558eSHoria Geanta if (nlsk) 16820f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 16830f24558eSHoria Geanta rcu_read_unlock(); 16840f24558eSHoria Geanta 16850f24558eSHoria Geanta return ret; 16860f24558eSHoria Geanta } 1687a6483b79SAlexey Dobriyan #endif 1688f8cd5488SJamal Hadi Salim 1689ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1690ee5c2317SSteffen Klassert { 1691ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1692ee5c2317SSteffen Klassert } 1693ee5c2317SSteffen Klassert 169485158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 16950f99be0dSEric Dumazet { 16960f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 16970f99be0dSEric Dumazet } 16980f99be0dSEric Dumazet 169985158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17004447bb33SMartin Willi { 17014447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17024447bb33SMartin Willi } 17034447bb33SMartin Willi 17049736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17059736acf3SSteffen Klassert { 17069736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17079736acf3SSteffen Klassert } 17089736acf3SSteffen Klassert 170980c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1710af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1711af2f464eSSteffen Klassert struct xfrm_state *orig) 1712af2f464eSSteffen Klassert { 1713af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1714af2f464eSSteffen Klassert GFP_KERNEL); 1715af2f464eSSteffen Klassert if (!x->replay_esn) 1716af2f464eSSteffen Klassert return -ENOMEM; 1717af2f464eSSteffen Klassert 1718af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1719af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1720af2f464eSSteffen Klassert 1721af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1722af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1723af2f464eSSteffen Klassert GFP_KERNEL); 1724af2f464eSSteffen Klassert if (!x->preplay_esn) { 1725af2f464eSSteffen Klassert kfree(x->replay_esn); 1726af2f464eSSteffen Klassert return -ENOMEM; 1727af2f464eSSteffen Klassert } 1728af2f464eSSteffen Klassert 1729af2f464eSSteffen Klassert return 0; 1730af2f464eSSteffen Klassert } 1731af2f464eSSteffen Klassert 1732ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1733ee5c2317SSteffen Klassert { 1734ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1735ee5c2317SSteffen Klassert } 1736ee5c2317SSteffen Klassert 1737ee5c2317SSteffen Klassert 173880c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 173980c9abaaSShinta Sugimoto { 17400f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 174180c9abaaSShinta Sugimoto } 174280c9abaaSShinta Sugimoto 17434447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 17444447bb33SMartin Willi { 17454447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 17464447bb33SMartin Willi } 17474447bb33SMartin Willi 174880c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 174980c9abaaSShinta Sugimoto { 175080c9abaaSShinta Sugimoto int i; 175180c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 175280c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 175380c9abaaSShinta Sugimoto } 175480c9abaaSShinta Sugimoto 175580c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 175680c9abaaSShinta Sugimoto { 175780c9abaaSShinta Sugimoto int i; 175880c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 175980c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 176080c9abaaSShinta Sugimoto } 176180c9abaaSShinta Sugimoto #endif 1762f8cd5488SJamal Hadi Salim 1763def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 176400501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 176500501121SHerbert Xu { 176600501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 176700501121SHerbert Xu } 1768def8b4faSAlexey Dobriyan #endif 176900501121SHerbert Xu 1770bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1771bf825f81SJamal Hadi Salim { 1772bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 17734efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1774bf825f81SJamal Hadi Salim else 1775bf825f81SJamal Hadi Salim m->v = m->m = 0; 1776bf825f81SJamal Hadi Salim 1777bf825f81SJamal Hadi Salim return m->v & m->m; 1778bf825f81SJamal Hadi Salim } 1779bf825f81SJamal Hadi Salim 1780e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1781bf825f81SJamal Hadi Salim { 17821d1e34ddSDavid S. Miller int ret = 0; 1783bf825f81SJamal Hadi Salim 17841d1e34ddSDavid S. Miller if (m->m | m->v) 17851d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 17861d1e34ddSDavid S. Miller return ret; 1787bf825f81SJamal Hadi Salim } 1788bf825f81SJamal Hadi Salim 178970be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 179070be6c91SSteffen Klassert unsigned int family) 179170be6c91SSteffen Klassert { 179270be6c91SSteffen Klassert bool tunnel = false; 179370be6c91SSteffen Klassert 179470be6c91SSteffen Klassert switch(family) { 179570be6c91SSteffen Klassert case AF_INET: 179670be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 179770be6c91SSteffen Klassert tunnel = true; 179870be6c91SSteffen Klassert break; 179970be6c91SSteffen Klassert case AF_INET6: 180070be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 180170be6c91SSteffen Klassert tunnel = true; 180270be6c91SSteffen Klassert break; 180370be6c91SSteffen Klassert } 180470be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 180570be6c91SSteffen Klassert return -EINVAL; 180670be6c91SSteffen Klassert 180770be6c91SSteffen Klassert return 0; 180870be6c91SSteffen Klassert } 18091da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1810