11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds #include <net/sock.h> 181da177e4SLinus Torvalds #include <net/dst.h> 19436a0a40SHerbert Xu #include <net/ip.h> 201da177e4SLinus Torvalds #include <net/route.h> 211da177e4SLinus Torvalds #include <net/ipv6.h> 221da177e4SLinus Torvalds #include <net/ip6_fib.h> 23fe1a5f03STimo Teräs #include <net/flow.h> 249e0d57fdSYury Polyanskiy 259e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 269e0d57fdSYury Polyanskiy 27558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 28558f82efSMasahide NAKAMURA #include <net/snmp.h> 29558f82efSMasahide NAKAMURA #endif 301da177e4SLinus Torvalds 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 38d3d6dd3aSMasahide NAKAMURA 39fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 401da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 41b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 42b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 43d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 44d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 451da177e4SLinus Torvalds 46558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 4759c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 48558f82efSMasahide NAKAMURA #else 4959c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 50558f82efSMasahide NAKAMURA #endif 51558f82efSMasahide NAKAMURA 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 541da177e4SLinus Torvalds ------------------------------------ 551da177e4SLinus Torvalds 561da177e4SLinus Torvalds Basic objects: 571da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 581da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 591da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 601da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 631da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 641da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 651da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 681da177e4SLinus Torvalds 691da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 701da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 711da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 721da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 731da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 741da177e4SLinus Torvalds to a dst_entry returned to requestor. 751da177e4SLinus Torvalds 761da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 771da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 781da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 791da177e4SLinus Torvalds |---. child .-> NULL 801da177e4SLinus Torvalds 811da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 821da177e4SLinus Torvalds 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds Resolution of xrfm_tmpl 851da177e4SLinus Torvalds ----------------------- 861da177e4SLinus Torvalds Template contains: 871da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 881da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 891da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 901da177e4SLinus Torvalds Q: allow to resolve security gateway? 911da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 921da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 931da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 941da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 951da177e4SLinus Torvalds 7. ->share Sharing mode. 961da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 971da177e4SLinus Torvalds flow id? 981da177e4SLinus Torvalds 991da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1001da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1011da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds PROBLEMS: 1041da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1051da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1061da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1071da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1081da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1091da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1101da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1111da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1121da177e4SLinus Torvalds */ 1131da177e4SLinus Torvalds 11412a169e7SHerbert Xu struct xfrm_state_walk { 11512a169e7SHerbert Xu struct list_head all; 11612a169e7SHerbert Xu u8 state; 11712a169e7SHerbert Xu u8 dying; 11812a169e7SHerbert Xu u8 proto; 11912a169e7SHerbert Xu u32 seq; 120870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12112a169e7SHerbert Xu }; 12212a169e7SHerbert Xu 1231da177e4SLinus Torvalds /* Full description of state of transformer. */ 124fd2c3ef7SEric Dumazet struct xfrm_state { 1250c5c9fb5SEric W. Biederman possible_net_t xs_net; 126abb81c4fSHerbert Xu union { 12712a169e7SHerbert Xu struct hlist_node gclist; 1288f126e37SDavid S. Miller struct hlist_node bydst; 129abb81c4fSHerbert Xu }; 1308f126e37SDavid S. Miller struct hlist_node bysrc; 1318f126e37SDavid S. Miller struct hlist_node byspi; 1321da177e4SLinus Torvalds 1331da177e4SLinus Torvalds atomic_t refcnt; 1341da177e4SLinus Torvalds spinlock_t lock; 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvalds struct xfrm_id id; 1371da177e4SLinus Torvalds struct xfrm_selector sel; 138bf825f81SJamal Hadi Salim struct xfrm_mark mark; 13935d2856bSMartin Willi u32 tfcpad; 1401da177e4SLinus Torvalds 1419d4a706dSDavid S. Miller u32 genid; 1429d4a706dSDavid S. Miller 14312a169e7SHerbert Xu /* Key manager bits */ 14412a169e7SHerbert Xu struct xfrm_state_walk km; 1451da177e4SLinus Torvalds 1461da177e4SLinus Torvalds /* Parameters of this state. */ 1471da177e4SLinus Torvalds struct { 1481da177e4SLinus Torvalds u32 reqid; 1491da177e4SLinus Torvalds u8 mode; 1501da177e4SLinus Torvalds u8 replay_window; 1511da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1521da177e4SLinus Torvalds u8 flags; 1531da177e4SLinus Torvalds u16 family; 1541da177e4SLinus Torvalds xfrm_address_t saddr; 1551da177e4SLinus Torvalds int header_len; 1561da177e4SLinus Torvalds int trailer_len; 157a947b0a9SNicolas Dichtel u32 extra_flags; 1581da177e4SLinus Torvalds } props; 1591da177e4SLinus Torvalds 1601da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1611da177e4SLinus Torvalds 1621da177e4SLinus Torvalds /* Data for transformer */ 1634447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1641da177e4SLinus Torvalds struct xfrm_algo *ealg; 1651da177e4SLinus Torvalds struct xfrm_algo *calg; 1661a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 16769b0137fSHerbert Xu const char *geniv; 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds /* Data for encapsulator */ 1701da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1711da177e4SLinus Torvalds 172060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 173060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 174060f02a3SNoriaki TAKAMIYA 1751da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1761da177e4SLinus Torvalds struct xfrm_state *tunnel; 1771da177e4SLinus Torvalds 1781da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1791da177e4SLinus Torvalds atomic_t tunnel_users; 1801da177e4SLinus Torvalds 1811da177e4SLinus Torvalds /* State for replay detection */ 1821da177e4SLinus Torvalds struct xfrm_replay_state replay; 1839736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1841da177e4SLinus Torvalds 185f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 186f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1879736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 188f8cd5488SJamal Hadi Salim 1899fdc4883SSteffen Klassert /* The functions for replay detection. */ 190e45a8a9eSJulia Lawall const struct xfrm_replay *repl; 1919fdc4883SSteffen Klassert 1922717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1932717096aSJamal Hadi Salim * moment 1942717096aSJamal Hadi Salim */ 1952717096aSJamal Hadi Salim u32 xflags; 1962717096aSJamal Hadi Salim 197f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 198f8cd5488SJamal Hadi Salim u32 replay_maxage; 199f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 200f8cd5488SJamal Hadi Salim 201f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 202f8cd5488SJamal Hadi Salim struct timer_list rtimer; 203f8cd5488SJamal Hadi Salim 2041da177e4SLinus Torvalds /* Statistics */ 2051da177e4SLinus Torvalds struct xfrm_stats stats; 2061da177e4SLinus Torvalds 2071da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2089e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2091da177e4SLinus Torvalds 210e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 211e3c0d047SFan Du long saved_tmo; 212e3c0d047SFan Du 2139afaca05SMasahide NAKAMURA /* Last used time */ 214d26f3984SHerbert Xu unsigned long lastused; 2159afaca05SMasahide NAKAMURA 216cac2661cSSteffen Klassert struct page_frag xfrag; 217cac2661cSSteffen Klassert 2181da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2191da177e4SLinus Torvalds * transformer. */ 220533cb5b0SEric Dumazet const struct xfrm_type *type; 22113996378SHerbert Xu struct xfrm_mode *inner_mode; 222df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 22313996378SHerbert Xu struct xfrm_mode *outer_mode; 2241da177e4SLinus Torvalds 2259d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload; 2269d389d7fSSteffen Klassert 227df71837dSTrent Jaeger /* Security context */ 228df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 229df71837dSTrent Jaeger 2301da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2311da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2321da177e4SLinus Torvalds void *data; 2331da177e4SLinus Torvalds }; 2341da177e4SLinus Torvalds 235673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 236673c09beSAlexey Dobriyan { 237673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 238673c09beSAlexey Dobriyan } 239673c09beSAlexey Dobriyan 2402717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2412717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 242e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2432717096aSJamal Hadi Salim 2441da177e4SLinus Torvalds enum { 2451da177e4SLinus Torvalds XFRM_STATE_VOID, 2461da177e4SLinus Torvalds XFRM_STATE_ACQ, 2471da177e4SLinus Torvalds XFRM_STATE_VALID, 2481da177e4SLinus Torvalds XFRM_STATE_ERROR, 2491da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2501da177e4SLinus Torvalds XFRM_STATE_DEAD 2511da177e4SLinus Torvalds }; 2521da177e4SLinus Torvalds 25326b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 254fd2c3ef7SEric Dumazet struct km_event { 255bf08867fSHerbert Xu union { 256bf08867fSHerbert Xu u32 hard; 257bf08867fSHerbert Xu u32 proto; 258bf08867fSHerbert Xu u32 byid; 259f8cd5488SJamal Hadi Salim u32 aevent; 260f7b6983fSMasahide NAKAMURA u32 type; 261bf08867fSHerbert Xu } data; 262bf08867fSHerbert Xu 26326b15dadSJamal Hadi Salim u32 seq; 26415e47304SEric W. Biederman u32 portid; 26526b15dadSJamal Hadi Salim u32 event; 2667067802eSAlexey Dobriyan struct net *net; 26726b15dadSJamal Hadi Salim }; 26826b15dadSJamal Hadi Salim 2699fdc4883SSteffen Klassert struct xfrm_replay { 2709fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2719fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2729fdc4883SSteffen Klassert struct sk_buff *skb, 2739fdc4883SSteffen Klassert __be32 net_seq); 2743b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2753b59df46SSteffen Klassert struct sk_buff *skb, 2763b59df46SSteffen Klassert __be32 net_seq); 2779fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2789fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2799fdc4883SSteffen Klassert }; 2809fdc4883SSteffen Klassert 28125ee3286SHerbert Xu struct net_device; 2821da177e4SLinus Torvalds struct xfrm_type; 2831da177e4SLinus Torvalds struct xfrm_dst; 2841da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2851da177e4SLinus Torvalds struct dst_ops *dst_ops; 28642a7b32bSDavid Ahern struct dst_entry *(*dst_lookup)(struct net *net, 28742a7b32bSDavid Ahern int tos, int oif, 2885e6b930fSDavid S. Miller const xfrm_address_t *saddr, 2895e6b930fSDavid S. Miller const xfrm_address_t *daddr); 29042a7b32bSDavid Ahern int (*get_saddr)(struct net *net, int oif, 29142a7b32bSDavid Ahern xfrm_address_t *saddr, 29242a7b32bSDavid Ahern xfrm_address_t *daddr); 2931da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 294d5422efeSHerbert Xu struct flowi *fl, 295d5422efeSHerbert Xu int reverse); 29605d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 297a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 298a1b05140SMasahide NAKAMURA struct dst_entry *dst, 299a1b05140SMasahide NAKAMURA int nfheader_len); 30025ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 30187c1e12bSHerbert Xu struct net_device *dev, 3020c7b3eefSDavid S. Miller const struct flowi *fl); 3032774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3041da177e4SLinus Torvalds }; 3051da177e4SLinus Torvalds 306a2817d8bSFlorian Westphal int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 307a2817d8bSFlorian Westphal void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 308d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 309d511337aSJoe Perches const struct km_event *c); 310d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3111da177e4SLinus Torvalds 3121da177e4SLinus Torvalds struct xfrm_tmpl; 313d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 314d511337aSJoe Perches struct xfrm_policy *pol); 315d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 316d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 31753bc6b4dSJamal Hadi Salim 3181da177e4SLinus Torvalds struct xfrm_state_afinfo { 31917c2a42aSHerbert Xu unsigned int family; 32036cf9acfSHerbert Xu unsigned int proto; 3218e3d716cSAl Viro __be16 eth_proto; 32217c2a42aSHerbert Xu struct module *owner; 323533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 3249d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload_map[IPPROTO_MAX]; 325aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 3269d389d7fSSteffen Klassert 327d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 32873e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 32973e5ebb2SDavid S. Miller const struct flowi *fl); 33019bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 33119bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 33219bd6244SDavid S. Miller const xfrm_address_t *daddr, 33319bd6244SDavid S. Miller const xfrm_address_t *saddr); 33441a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 33541a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 336ede2059dSEric W. Biederman int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 3377026b1ddSDavid Miller int (*output_finish)(struct sock *sk, struct sk_buff *skb); 338227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 339227620e2SHerbert Xu struct sk_buff *skb); 34036cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 34136cf9acfSHerbert Xu struct sk_buff *skb); 342716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 343716062fdSHerbert Xu int async); 344628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3451da177e4SLinus Torvalds }; 3461da177e4SLinus Torvalds 347d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 348d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 349d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 350711059b9SFlorian Westphal struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 3511da177e4SLinus Torvalds 3522f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3532f32b51bSSteffen Klassert unsigned int family; 3542f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3552f32b51bSSteffen Klassert int err); 3562f32b51bSSteffen Klassert }; 3572f32b51bSSteffen Klassert 358960fdfdeSFlorian Westphal int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 359960fdfdeSFlorian Westphal int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 3602f32b51bSSteffen Klassert 361d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3621da177e4SLinus Torvalds 363fd2c3ef7SEric Dumazet struct xfrm_type { 3641da177e4SLinus Torvalds char *description; 3651da177e4SLinus Torvalds struct module *owner; 366a6337463Sjamal u8 proto; 367a6337463Sjamal u8 flags; 3681b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 369436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 370f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 371f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3721da177e4SLinus Torvalds 37372cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3741da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 375e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3761da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3778f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3788f029de2SDavid S. Miller const struct flowi *); 379aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3801da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 381c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3821da177e4SLinus Torvalds }; 3831da177e4SLinus Torvalds 384d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 385d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3861da177e4SLinus Torvalds 3879d389d7fSSteffen Klassert struct xfrm_type_offload { 3889d389d7fSSteffen Klassert char *description; 3899d389d7fSSteffen Klassert struct module *owner; 3909d389d7fSSteffen Klassert u8 proto; 3919d389d7fSSteffen Klassert void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 3929d389d7fSSteffen Klassert int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 3939d389d7fSSteffen Klassert int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 3949d389d7fSSteffen Klassert }; 3959d389d7fSSteffen Klassert 3969d389d7fSSteffen Klassert int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 3979d389d7fSSteffen Klassert int xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 3989d389d7fSSteffen Klassert 399b59f45d0SHerbert Xu struct xfrm_mode { 400227620e2SHerbert Xu /* 401227620e2SHerbert Xu * Remove encapsulation header. 402227620e2SHerbert Xu * 403227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 404227620e2SHerbert Xu * header. 405227620e2SHerbert Xu * 406227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 407227620e2SHerbert Xu * should be and the network header shall be set to where the IP 408227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 409227620e2SHerbert Xu * payload. 410227620e2SHerbert Xu */ 411227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 412227620e2SHerbert Xu 413227620e2SHerbert Xu /* 414227620e2SHerbert Xu * This is the actual input entry point. 415227620e2SHerbert Xu * 416227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 417227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 418227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 419227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 420227620e2SHerbert Xu */ 421b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 42237fedd3aSHerbert Xu 42337fedd3aSHerbert Xu /* 42437fedd3aSHerbert Xu * Add encapsulation header. 42537fedd3aSHerbert Xu * 42637fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 42737fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 42837fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 42937fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 43037fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 43137fedd3aSHerbert Xu * header. The value of the network header will always point 43237fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 43337fedd3aSHerbert Xu */ 43436cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 43536cf9acfSHerbert Xu 43636cf9acfSHerbert Xu /* 43736cf9acfSHerbert Xu * This is the actual output entry point. 43836cf9acfSHerbert Xu * 43936cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 44036cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 44136cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 44236cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 44336cf9acfSHerbert Xu * call output2. 44436cf9acfSHerbert Xu */ 445eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 446b59f45d0SHerbert Xu 44717c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 448b59f45d0SHerbert Xu struct module *owner; 449b59f45d0SHerbert Xu unsigned int encap; 4501bfcb10fSHerbert Xu int flags; 4511bfcb10fSHerbert Xu }; 4521bfcb10fSHerbert Xu 4531bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4541bfcb10fSHerbert Xu enum { 4551bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 456b59f45d0SHerbert Xu }; 457b59f45d0SHerbert Xu 458d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 459d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 460b59f45d0SHerbert Xu 461df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 462df9dcb45SKazunori MIYAZAWA { 463df9dcb45SKazunori MIYAZAWA switch(family) { 464df9dcb45SKazunori MIYAZAWA case AF_INET: 465df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 466df9dcb45SKazunori MIYAZAWA case AF_INET6: 467df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 468df9dcb45SKazunori MIYAZAWA default: 469df9dcb45SKazunori MIYAZAWA return 0; 470df9dcb45SKazunori MIYAZAWA } 471df9dcb45SKazunori MIYAZAWA } 472df9dcb45SKazunori MIYAZAWA 473df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 474df9dcb45SKazunori MIYAZAWA { 475df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 476df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 477df9dcb45SKazunori MIYAZAWA return x->inner_mode; 478df9dcb45SKazunori MIYAZAWA else 479df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 480df9dcb45SKazunori MIYAZAWA } 481df9dcb45SKazunori MIYAZAWA 482fd2c3ef7SEric Dumazet struct xfrm_tmpl { 4831da177e4SLinus Torvalds /* id in template is interpreted as: 4841da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4851da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4861da177e4SLinus Torvalds * daddr must be fixed too. 4871da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4881da177e4SLinus Torvalds */ 4891da177e4SLinus Torvalds struct xfrm_id id; 4901da177e4SLinus Torvalds 4911da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4921da177e4SLinus Torvalds xfrm_address_t saddr; 4931da177e4SLinus Torvalds 49476b3f055SMiika Komu unsigned short encap_family; 49576b3f055SMiika Komu 496a6337463Sjamal u32 reqid; 4971da177e4SLinus Torvalds 4987e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 499a6337463Sjamal u8 mode; 5001da177e4SLinus Torvalds 5011da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 502a6337463Sjamal u8 share; 5031da177e4SLinus Torvalds 5041da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 505a6337463Sjamal u8 optional; 5061da177e4SLinus Torvalds 507c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 508a6337463Sjamal u8 allalgs; 509c5d18e98SHerbert Xu 5101da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 511a6337463Sjamal u32 aalgos; 512a6337463Sjamal u32 ealgos; 513a6337463Sjamal u32 calgos; 5141da177e4SLinus Torvalds }; 5151da177e4SLinus Torvalds 516622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 51754ef207aSSteffen Klassert #define XFRM_MAX_OFFLOAD_DEPTH 1 5181da177e4SLinus Torvalds 51912a169e7SHerbert Xu struct xfrm_policy_walk_entry { 52012a169e7SHerbert Xu struct list_head all; 52112a169e7SHerbert Xu u8 dead; 52212a169e7SHerbert Xu }; 52312a169e7SHerbert Xu 52412a169e7SHerbert Xu struct xfrm_policy_walk { 52512a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 52612a169e7SHerbert Xu u8 type; 52712a169e7SHerbert Xu u32 seq; 52812a169e7SHerbert Xu }; 52912a169e7SHerbert Xu 530a0073fe1SSteffen Klassert struct xfrm_policy_queue { 531a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 532a0073fe1SSteffen Klassert struct timer_list hold_timer; 533a0073fe1SSteffen Klassert unsigned long timeout; 534a0073fe1SSteffen Klassert }; 535a0073fe1SSteffen Klassert 536fd2c3ef7SEric Dumazet struct xfrm_policy { 5370c5c9fb5SEric W. Biederman possible_net_t xp_net; 5382518c7c2SDavid S. Miller struct hlist_node bydst; 5392518c7c2SDavid S. Miller struct hlist_node byidx; 5401da177e4SLinus Torvalds 5411da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5421da177e4SLinus Torvalds rwlock_t lock; 5431da177e4SLinus Torvalds atomic_t refcnt; 5441da177e4SLinus Torvalds struct timer_list timer; 5451da177e4SLinus Torvalds 546fe1a5f03STimo Teräs struct flow_cache_object flo; 54780c802f3STimo Teräs atomic_t genid; 5481da177e4SLinus Torvalds u32 priority; 5491da177e4SLinus Torvalds u32 index; 550bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5511da177e4SLinus Torvalds struct xfrm_selector selector; 5521da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5531da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 55412a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 555a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 55646ca5f5dSArnaldo Carvalho de Melo u8 type; 55746ca5f5dSArnaldo Carvalho de Melo u8 action; 55846ca5f5dSArnaldo Carvalho de Melo u8 flags; 55946ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 56012a169e7SHerbert Xu u16 family; 561df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5621da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 56356f04730SEric Dumazet struct rcu_head rcu; 5641da177e4SLinus Torvalds }; 5651da177e4SLinus Torvalds 56663eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5670331b1f3SAlexey Dobriyan { 5680331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5690331b1f3SAlexey Dobriyan } 5700331b1f3SAlexey Dobriyan 57113c1d189SArnaud Ebalard struct xfrm_kmaddress { 57213c1d189SArnaud Ebalard xfrm_address_t local; 57313c1d189SArnaud Ebalard xfrm_address_t remote; 57413c1d189SArnaud Ebalard u32 reserved; 57513c1d189SArnaud Ebalard u16 family; 57613c1d189SArnaud Ebalard }; 57713c1d189SArnaud Ebalard 57880c9abaaSShinta Sugimoto struct xfrm_migrate { 57980c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 58080c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 58180c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 58280c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 58380c9abaaSShinta Sugimoto u8 proto; 58480c9abaaSShinta Sugimoto u8 mode; 58580c9abaaSShinta Sugimoto u16 reserved; 58680c9abaaSShinta Sugimoto u32 reqid; 58780c9abaaSShinta Sugimoto u16 old_family; 58880c9abaaSShinta Sugimoto u16 new_family; 58980c9abaaSShinta Sugimoto }; 59080c9abaaSShinta Sugimoto 5911da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 592f8cd5488SJamal Hadi Salim /* what happened */ 593f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 594f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 595f8cd5488SJamal Hadi Salim 596f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 597f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 598f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 599f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 600f8cd5488SJamal Hadi Salim /* default seq threshold size */ 601f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 6021da177e4SLinus Torvalds 603fd2c3ef7SEric Dumazet struct xfrm_mgr { 6041da177e4SLinus Torvalds struct list_head list; 605214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 60665e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 607cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 6085d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 609214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 610db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 611183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 612183cad12SDavid S. Miller u8 dir, u8 type, 613183cad12SDavid S. Miller const struct xfrm_migrate *m, 614183cad12SDavid S. Miller int num_bundles, 615183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 6160f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6171da177e4SLinus Torvalds }; 6181da177e4SLinus Torvalds 619d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 620d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6211da177e4SLinus Torvalds 62270be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 62370be6c91SSteffen Klassert union { 62470be6c91SSteffen Klassert struct inet_skb_parm h4; 62570be6c91SSteffen Klassert struct inet6_skb_parm h6; 62670be6c91SSteffen Klassert } header; 62770be6c91SSteffen Klassert 62870be6c91SSteffen Klassert union { 62970be6c91SSteffen Klassert struct ip_tunnel *ip4; 63070be6c91SSteffen Klassert struct ip6_tnl *ip6; 63170be6c91SSteffen Klassert } tunnel; 63270be6c91SSteffen Klassert }; 63370be6c91SSteffen Klassert 63470be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 63570be6c91SSteffen Klassert 636436a0a40SHerbert Xu /* 637436a0a40SHerbert Xu * This structure is used for the duration where packets are being 638436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 639436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 640436a0a40SHerbert Xu */ 641436a0a40SHerbert Xu struct xfrm_skb_cb { 64270be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 643436a0a40SHerbert Xu 644436a0a40SHerbert Xu /* Sequence number for replay protection. */ 645b318e0e4SHerbert Xu union { 6461ce3644aSSteffen Klassert struct { 6471ce3644aSSteffen Klassert __u32 low; 6481ce3644aSSteffen Klassert __u32 hi; 6491ce3644aSSteffen Klassert } output; 6501ce3644aSSteffen Klassert struct { 6511ce3644aSSteffen Klassert __be32 low; 6521ce3644aSSteffen Klassert __be32 hi; 6531ce3644aSSteffen Klassert } input; 654b318e0e4SHerbert Xu } seq; 655436a0a40SHerbert Xu }; 656436a0a40SHerbert Xu 657436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 658436a0a40SHerbert Xu 65936cf9acfSHerbert Xu /* 66036cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 66136cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 66236cf9acfSHerbert Xu */ 66336cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 66470be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 66536cf9acfSHerbert Xu 66636cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 66736cf9acfSHerbert Xu __be16 id; 66836cf9acfSHerbert Xu __be16 frag_off; 66936cf9acfSHerbert Xu 670732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 671732c8bd5SHerbert Xu u8 ihl; 672732c8bd5SHerbert Xu 67336cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 67436cf9acfSHerbert Xu u8 tos; 67536cf9acfSHerbert Xu 67636cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 67736cf9acfSHerbert Xu u8 ttl; 67836cf9acfSHerbert Xu 67936cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 68036cf9acfSHerbert Xu u8 protocol; 68136cf9acfSHerbert Xu 682732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 683732c8bd5SHerbert Xu u8 optlen; 684732c8bd5SHerbert Xu 68536cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 68636cf9acfSHerbert Xu u8 flow_lbl[3]; 68736cf9acfSHerbert Xu }; 68836cf9acfSHerbert Xu 68936cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 69036cf9acfSHerbert Xu 691716062fdSHerbert Xu /* 692716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 693716062fdSHerbert Xu * related information. 694716062fdSHerbert Xu */ 695716062fdSHerbert Xu struct xfrm_spi_skb_cb { 69670be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 697716062fdSHerbert Xu 698716062fdSHerbert Xu unsigned int daddroff; 6992fcb45b6SHerbert Xu unsigned int family; 7007785bba2SSteffen Klassert __be32 seq; 701716062fdSHerbert Xu }; 702716062fdSHerbert Xu 703716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 704716062fdSHerbert Xu 705c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 706afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 707ab5f5e8bSJoy Latten { 708ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 709ab5f5e8bSJoy Latten 710afeb14b4SPaul Moore if (audit_enabled == 0) 711afeb14b4SPaul Moore return NULL; 712ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 713ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 714ab5f5e8bSJoy Latten if (audit_buf == NULL) 715ab5f5e8bSJoy Latten return NULL; 716afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 717afeb14b4SPaul Moore return audit_buf; 718afeb14b4SPaul Moore } 719afeb14b4SPaul Moore 7202e71029eSTetsuo Handa static inline void xfrm_audit_helper_usrinfo(bool task_valid, 721afeb14b4SPaul Moore struct audit_buffer *audit_buf) 722afeb14b4SPaul Moore { 7232e71029eSTetsuo Handa const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 7242e71029eSTetsuo Handa audit_get_loginuid(current) : 7252e71029eSTetsuo Handa INVALID_UID); 7262e71029eSTetsuo Handa const unsigned int ses = task_valid ? audit_get_sessionid(current) : 7272e71029eSTetsuo Handa (unsigned int) -1; 7282e71029eSTetsuo Handa 7292e71029eSTetsuo Handa audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 730ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 731ab5f5e8bSJoy Latten } 732ab5f5e8bSJoy Latten 7332e71029eSTetsuo Handa void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 7342e71029eSTetsuo Handa void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7352e71029eSTetsuo Handa bool task_valid); 7362e71029eSTetsuo Handa void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 7372e71029eSTetsuo Handa void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 738d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 739afeb14b4SPaul Moore struct sk_buff *skb); 740d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 741d511337aSJoe Perches __be32 net_seq); 742d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 743d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 744d511337aSJoe Perches __be32 net_seq); 745d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 746d511337aSJoe Perches u8 proto); 747c9204d9cSJoy Latten #else 74841fef0eeSMarcin Slusarz 74941fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7502e71029eSTetsuo Handa bool task_valid) 75141fef0eeSMarcin Slusarz { 75241fef0eeSMarcin Slusarz } 75341fef0eeSMarcin Slusarz 75441fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7552e71029eSTetsuo Handa bool task_valid) 75641fef0eeSMarcin Slusarz { 75741fef0eeSMarcin Slusarz } 75841fef0eeSMarcin Slusarz 75941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7602e71029eSTetsuo Handa bool task_valid) 76141fef0eeSMarcin Slusarz { 76241fef0eeSMarcin Slusarz } 76341fef0eeSMarcin Slusarz 76441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7652e71029eSTetsuo Handa bool task_valid) 76641fef0eeSMarcin Slusarz { 76741fef0eeSMarcin Slusarz } 76841fef0eeSMarcin Slusarz 76941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 77041fef0eeSMarcin Slusarz struct sk_buff *skb) 77141fef0eeSMarcin Slusarz { 77241fef0eeSMarcin Slusarz } 77341fef0eeSMarcin Slusarz 7749fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7759fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7769fdc4883SSteffen Klassert { 7779fdc4883SSteffen Klassert } 7789fdc4883SSteffen Klassert 77941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 78041fef0eeSMarcin Slusarz u16 family) 78141fef0eeSMarcin Slusarz { 78241fef0eeSMarcin Slusarz } 78341fef0eeSMarcin Slusarz 78441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 78541fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 78641fef0eeSMarcin Slusarz { 78741fef0eeSMarcin Slusarz } 78841fef0eeSMarcin Slusarz 78941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 79041fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 79141fef0eeSMarcin Slusarz { 79241fef0eeSMarcin Slusarz } 793c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 794161a09e7SJoy Latten 7951da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 7961da177e4SLinus Torvalds { 7971da177e4SLinus Torvalds if (likely(policy != NULL)) 7981da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 7991da177e4SLinus Torvalds } 8001da177e4SLinus Torvalds 801d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 8021da177e4SLinus Torvalds 8031da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 8041da177e4SLinus Torvalds { 8051da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 80664c31b3fSWANG Cong xfrm_policy_destroy(policy); 8071da177e4SLinus Torvalds } 8081da177e4SLinus Torvalds 8094e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 8104e81bb83SMasahide NAKAMURA { 8114e81bb83SMasahide NAKAMURA int i; 8124e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 8134e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 8144e81bb83SMasahide NAKAMURA } 8154e81bb83SMasahide NAKAMURA 816d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8171da177e4SLinus Torvalds 81821380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 81921380b81SHerbert Xu { 82021380b81SHerbert Xu atomic_dec(&x->refcnt); 82121380b81SHerbert Xu } 82221380b81SHerbert Xu 8231da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8241da177e4SLinus Torvalds { 8251da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 8261da177e4SLinus Torvalds __xfrm_state_destroy(x); 8271da177e4SLinus Torvalds } 8281da177e4SLinus Torvalds 8291da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8301da177e4SLinus Torvalds { 8311da177e4SLinus Torvalds atomic_inc(&x->refcnt); 8321da177e4SLinus Torvalds } 8331da177e4SLinus Torvalds 8341744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 835e1b0048eSAlexey Dobriyan unsigned int prefixlen) 8361da177e4SLinus Torvalds { 8371744a8feSDavid S. Miller const __be32 *a1 = token1; 8381744a8feSDavid S. Miller const __be32 *a2 = token2; 839e1b0048eSAlexey Dobriyan unsigned int pdw; 840e1b0048eSAlexey Dobriyan unsigned int pbi; 8411da177e4SLinus Torvalds 842a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8431da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8441da177e4SLinus Torvalds 8451da177e4SLinus Torvalds if (pdw) 8461da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8471744a8feSDavid S. Miller return false; 8481da177e4SLinus Torvalds 8491da177e4SLinus Torvalds if (pbi) { 8505f19343fSAl Viro __be32 mask; 8511da177e4SLinus Torvalds 8521da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8531da177e4SLinus Torvalds 8541da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8551744a8feSDavid S. Miller return false; 8561da177e4SLinus Torvalds } 8571da177e4SLinus Torvalds 8581744a8feSDavid S. Miller return true; 8591da177e4SLinus Torvalds } 8601da177e4SLinus Torvalds 86126bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 86226bff940SAlexey Dobriyan { 86326bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 8646c786bcbSAlexey Dobriyan if (sizeof(long) == 4 && prefixlen == 0) 86526bff940SAlexey Dobriyan return true; 8666c786bcbSAlexey Dobriyan return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 86726bff940SAlexey Dobriyan } 86826bff940SAlexey Dobriyan 8691da177e4SLinus Torvalds static __inline__ 8706281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8711da177e4SLinus Torvalds { 872f9d07e41SAl Viro __be16 port; 8731d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8741da177e4SLinus Torvalds case IPPROTO_TCP: 8751da177e4SLinus Torvalds case IPPROTO_UDP: 876ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8771da177e4SLinus Torvalds case IPPROTO_SCTP: 8786281dcc9SDavid S. Miller port = uli->ports.sport; 8791da177e4SLinus Torvalds break; 8801da177e4SLinus Torvalds case IPPROTO_ICMP: 8811da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8826281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 8831da177e4SLinus Torvalds break; 8842ce4272aSMasahide NAKAMURA case IPPROTO_MH: 8856281dcc9SDavid S. Miller port = htons(uli->mht.type); 8862ce4272aSMasahide NAKAMURA break; 887cc9ff19dSTimo Teräs case IPPROTO_GRE: 8886281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 889cc9ff19dSTimo Teräs break; 8901da177e4SLinus Torvalds default: 8911da177e4SLinus Torvalds port = 0; /*XXX*/ 8921da177e4SLinus Torvalds } 8931da177e4SLinus Torvalds return port; 8941da177e4SLinus Torvalds } 8951da177e4SLinus Torvalds 8961da177e4SLinus Torvalds static __inline__ 8976281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 8981da177e4SLinus Torvalds { 899f9d07e41SAl Viro __be16 port; 9001d28f42cSDavid S. Miller switch(fl->flowi_proto) { 9011da177e4SLinus Torvalds case IPPROTO_TCP: 9021da177e4SLinus Torvalds case IPPROTO_UDP: 903ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 9041da177e4SLinus Torvalds case IPPROTO_SCTP: 9056281dcc9SDavid S. Miller port = uli->ports.dport; 9061da177e4SLinus Torvalds break; 9071da177e4SLinus Torvalds case IPPROTO_ICMP: 9081da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9096281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 9101da177e4SLinus Torvalds break; 911cc9ff19dSTimo Teräs case IPPROTO_GRE: 9126281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 913cc9ff19dSTimo Teräs break; 9141da177e4SLinus Torvalds default: 9151da177e4SLinus Torvalds port = 0; /*XXX*/ 9161da177e4SLinus Torvalds } 9171da177e4SLinus Torvalds return port; 9181da177e4SLinus Torvalds } 9191da177e4SLinus Torvalds 920d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 921d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9221da177e4SLinus Torvalds 923df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 924df71837dSTrent Jaeger /* If neither has a context --> match 925df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 926df71837dSTrent Jaeger */ 927bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 928df71837dSTrent Jaeger { 929df71837dSTrent Jaeger return ((!s1 && !s2) || 930df71837dSTrent Jaeger (s1 && s2 && 931df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 932df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 933df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 934df71837dSTrent Jaeger } 935df71837dSTrent Jaeger #else 936bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 937df71837dSTrent Jaeger { 938bc9b35adSDavid S. Miller return true; 939df71837dSTrent Jaeger } 940df71837dSTrent Jaeger #endif 941df71837dSTrent Jaeger 9421da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9431da177e4SLinus Torvalds * 9441da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9451da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9461da177e4SLinus Torvalds * 9471da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9481da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9491da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9501da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9511da177e4SLinus Torvalds * policy rule. 9521da177e4SLinus Torvalds */ 953fd2c3ef7SEric Dumazet struct xfrm_dst { 9541da177e4SLinus Torvalds union { 9551da177e4SLinus Torvalds struct dst_entry dst; 9561da177e4SLinus Torvalds struct rtable rt; 9571da177e4SLinus Torvalds struct rt6_info rt6; 9581da177e4SLinus Torvalds } u; 9591da177e4SLinus Torvalds struct dst_entry *route; 96080c802f3STimo Teräs struct flow_cache_object flo; 96180c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 96280c802f3STimo Teräs int num_pols, num_xfrms; 963157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 964157bfc25SMasahide NAKAMURA struct flowi *origin; 965157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 966157bfc25SMasahide NAKAMURA #endif 96780c802f3STimo Teräs u32 xfrm_genid; 96880c802f3STimo Teräs u32 policy_genid; 9691da177e4SLinus Torvalds u32 route_mtu_cached; 9701da177e4SLinus Torvalds u32 child_mtu_cached; 97192d63decSHideaki YOSHIFUJI u32 route_cookie; 97292d63decSHideaki YOSHIFUJI u32 path_cookie; 9731da177e4SLinus Torvalds }; 9741da177e4SLinus Torvalds 975def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 976aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 977aabc9761SHerbert Xu { 97880c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 979aabc9761SHerbert Xu dst_release(xdst->route); 980aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 981aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 982157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 983157bfc25SMasahide NAKAMURA kfree(xdst->origin); 984157bfc25SMasahide NAKAMURA xdst->origin = NULL; 985157bfc25SMasahide NAKAMURA kfree(xdst->partner); 986157bfc25SMasahide NAKAMURA xdst->partner = NULL; 987157bfc25SMasahide NAKAMURA #endif 988aabc9761SHerbert Xu } 989def8b4faSAlexey Dobriyan #endif 990aabc9761SHerbert Xu 991d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 992aabc9761SHerbert Xu 99354ef207aSSteffen Klassert struct xfrm_offload { 99454ef207aSSteffen Klassert /* Output sequence number for replay protection on offloading. */ 99554ef207aSSteffen Klassert struct { 99654ef207aSSteffen Klassert __u32 low; 99754ef207aSSteffen Klassert __u32 hi; 99854ef207aSSteffen Klassert } seq; 99954ef207aSSteffen Klassert 100054ef207aSSteffen Klassert __u32 flags; 100154ef207aSSteffen Klassert #define SA_DELETE_REQ 1 100254ef207aSSteffen Klassert #define CRYPTO_DONE 2 100354ef207aSSteffen Klassert #define CRYPTO_NEXT_DONE 4 100454ef207aSSteffen Klassert #define CRYPTO_FALLBACK 8 100554ef207aSSteffen Klassert #define XFRM_GSO_SEGMENT 16 100654ef207aSSteffen Klassert #define XFRM_GRO 32 100754ef207aSSteffen Klassert 100854ef207aSSteffen Klassert __u32 status; 100954ef207aSSteffen Klassert #define CRYPTO_SUCCESS 1 101054ef207aSSteffen Klassert #define CRYPTO_GENERIC_ERROR 2 101154ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 101254ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 101354ef207aSSteffen Klassert #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 101454ef207aSSteffen Klassert #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 101554ef207aSSteffen Klassert #define CRYPTO_INVALID_PACKET_SYNTAX 64 101654ef207aSSteffen Klassert #define CRYPTO_INVALID_PROTOCOL 128 101754ef207aSSteffen Klassert 101854ef207aSSteffen Klassert __u8 proto; 101954ef207aSSteffen Klassert }; 102054ef207aSSteffen Klassert 1021fd2c3ef7SEric Dumazet struct sec_path { 10221da177e4SLinus Torvalds atomic_t refcnt; 10231da177e4SLinus Torvalds int len; 102454ef207aSSteffen Klassert int olen; 102554ef207aSSteffen Klassert 1026dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 102754ef207aSSteffen Klassert struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 10281da177e4SLinus Torvalds }; 10291da177e4SLinus Torvalds 1030990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 1031990078afSMichael Smith { 1032990078afSMichael Smith #ifdef CONFIG_XFRM 1033990078afSMichael Smith return skb->sp != NULL; 1034990078afSMichael Smith #else 1035990078afSMichael Smith return 0; 1036990078afSMichael Smith #endif 1037990078afSMichael Smith } 1038990078afSMichael Smith 10391da177e4SLinus Torvalds static inline struct sec_path * 10401da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 10411da177e4SLinus Torvalds { 10421da177e4SLinus Torvalds if (sp) 10431da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 10441da177e4SLinus Torvalds return sp; 10451da177e4SLinus Torvalds } 10461da177e4SLinus Torvalds 1047d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10481da177e4SLinus Torvalds 10491da177e4SLinus Torvalds static inline void 10501da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10511da177e4SLinus Torvalds { 10521da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 10531da177e4SLinus Torvalds __secpath_destroy(sp); 10541da177e4SLinus Torvalds } 10551da177e4SLinus Torvalds 1056d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 1057b0fcee82SSteffen Klassert int secpath_set(struct sk_buff *skb); 10581da177e4SLinus Torvalds 10591da177e4SLinus Torvalds static inline void 10601da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10611da177e4SLinus Torvalds { 10621da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10631da177e4SLinus Torvalds secpath_put(skb->sp); 10641da177e4SLinus Torvalds skb->sp = NULL; 10651da177e4SLinus Torvalds #endif 10661da177e4SLinus Torvalds } 10671da177e4SLinus Torvalds 10681da177e4SLinus Torvalds static inline int 10696cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1070a1e59abfSPatrick McHardy { 1071a1e59abfSPatrick McHardy switch (family) { 1072a1e59abfSPatrick McHardy case AF_INET: 1073a1e59abfSPatrick McHardy return addr->a4 == 0; 1074a1e59abfSPatrick McHardy case AF_INET6: 107515e318bdSJiri Benc return ipv6_addr_any(&addr->in6); 1076a1e59abfSPatrick McHardy } 1077a1e59abfSPatrick McHardy return 0; 1078a1e59abfSPatrick McHardy } 1079a1e59abfSPatrick McHardy 1080a1e59abfSPatrick McHardy static inline int 108121eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10821da177e4SLinus Torvalds { 10831da177e4SLinus Torvalds return (tmpl->saddr.a4 && 10841da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 10851da177e4SLinus Torvalds } 10861da177e4SLinus Torvalds 10871da177e4SLinus Torvalds static inline int 108821eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10891da177e4SLinus Torvalds { 10901da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1091ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 10921da177e4SLinus Torvalds } 10931da177e4SLinus Torvalds 10941da177e4SLinus Torvalds static inline int 109521eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 10961da177e4SLinus Torvalds { 10971da177e4SLinus Torvalds switch (family) { 10981da177e4SLinus Torvalds case AF_INET: 10991da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 11001da177e4SLinus Torvalds case AF_INET6: 11011da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 11021da177e4SLinus Torvalds } 11031da177e4SLinus Torvalds return !0; 11041da177e4SLinus Torvalds } 11051da177e4SLinus Torvalds 11061da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1107d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1108d511337aSJoe Perches unsigned short family); 11091da177e4SLinus Torvalds 1110d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1111d5422efeSHerbert Xu struct sk_buff *skb, 1112d5422efeSHerbert Xu unsigned int family, int reverse) 11131da177e4SLinus Torvalds { 1114f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1115d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1116d5422efeSHerbert Xu 11171da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1118d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 11191da177e4SLinus Torvalds 1120f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1121adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1122d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1123d5422efeSHerbert Xu } 1124d5422efeSHerbert Xu 1125d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1126d5422efeSHerbert Xu { 1127d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 11281da177e4SLinus Torvalds } 11291da177e4SLinus Torvalds 11301da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11311da177e4SLinus Torvalds { 11321da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 11331da177e4SLinus Torvalds } 11341da177e4SLinus Torvalds 11351da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11361da177e4SLinus Torvalds { 11371da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 11381da177e4SLinus Torvalds } 11391da177e4SLinus Torvalds 1140d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1141d5422efeSHerbert Xu struct sk_buff *skb) 1142d5422efeSHerbert Xu { 1143d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1144d5422efeSHerbert Xu } 1145d5422efeSHerbert Xu 1146d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1147d5422efeSHerbert Xu struct sk_buff *skb) 1148d5422efeSHerbert Xu { 1149d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1150d5422efeSHerbert Xu } 1151d5422efeSHerbert Xu 1152d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1153d5422efeSHerbert Xu unsigned int family, int reverse); 1154d5422efeSHerbert Xu 1155d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1156d5422efeSHerbert Xu unsigned int family) 1157d5422efeSHerbert Xu { 1158d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1159d5422efeSHerbert Xu } 1160d5422efeSHerbert Xu 1161d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1162d5422efeSHerbert Xu struct flowi *fl, 1163d5422efeSHerbert Xu unsigned int family) 1164d5422efeSHerbert Xu { 1165d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1166d5422efeSHerbert Xu } 1167d5422efeSHerbert Xu 1168d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11691da177e4SLinus Torvalds 11701da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11711da177e4SLinus Torvalds { 117299a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 117399a66657SAlexey Dobriyan 117499a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1175adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11761da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11771da177e4SLinus Torvalds } 11781da177e4SLinus Torvalds 11791da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11801da177e4SLinus Torvalds { 11811da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 11821da177e4SLinus Torvalds } 11831da177e4SLinus Torvalds 11841da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 11851da177e4SLinus Torvalds { 11861da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 11871da177e4SLinus Torvalds } 11881da177e4SLinus Torvalds 1189d188ba86SEric Dumazet int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 11901da177e4SLinus Torvalds 1191d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 11921da177e4SLinus Torvalds { 1193d188ba86SEric Dumazet sk->sk_policy[0] = NULL; 1194d188ba86SEric Dumazet sk->sk_policy[1] = NULL; 1195d188ba86SEric Dumazet if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1196d188ba86SEric Dumazet return __xfrm_sk_clone_policy(sk, osk); 11971da177e4SLinus Torvalds return 0; 11981da177e4SLinus Torvalds } 11991da177e4SLinus Torvalds 1200d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 12011da177e4SLinus Torvalds 12021da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 12031da177e4SLinus Torvalds { 1204d188ba86SEric Dumazet struct xfrm_policy *pol; 1205d188ba86SEric Dumazet 1206d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1207d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1208d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX); 12091da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 12101da177e4SLinus Torvalds } 1211d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1212d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1213d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 12141da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 12151da177e4SLinus Torvalds } 12161da177e4SLinus Torvalds } 12171da177e4SLinus Torvalds 1218d511337aSJoe Perches void xfrm_garbage_collect(struct net *net); 12193d7d25a6SFlorian Westphal void xfrm_garbage_collect_deferred(struct net *net); 1220e4c17216SPaul Moore 12211da177e4SLinus Torvalds #else 12221da177e4SLinus Torvalds 12231da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 1224d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 12251da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 12261da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 12271da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12281da177e4SLinus Torvalds { 12291da177e4SLinus Torvalds return 1; 12301da177e4SLinus Torvalds } 12311da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12321da177e4SLinus Torvalds { 12331da177e4SLinus Torvalds return 1; 12341da177e4SLinus Torvalds } 12351da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 12361da177e4SLinus Torvalds { 12371da177e4SLinus Torvalds return 1; 12381da177e4SLinus Torvalds } 1239d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1240d5422efeSHerbert Xu struct flowi *fl, 1241d5422efeSHerbert Xu unsigned int family) 1242d5422efeSHerbert Xu { 1243d5422efeSHerbert Xu return -ENOSYS; 1244d5422efeSHerbert Xu } 1245d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1246d5422efeSHerbert Xu struct sk_buff *skb) 1247d5422efeSHerbert Xu { 1248d5422efeSHerbert Xu return 1; 1249d5422efeSHerbert Xu } 1250d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1251d5422efeSHerbert Xu struct sk_buff *skb) 1252d5422efeSHerbert Xu { 1253d5422efeSHerbert Xu return 1; 1254d5422efeSHerbert Xu } 1255e4c17216SPaul Moore static inline void xfrm_garbage_collect(struct net *net) 1256e4c17216SPaul Moore { 1257e4c17216SPaul Moore } 12581da177e4SLinus Torvalds #endif 12591da177e4SLinus Torvalds 12601da177e4SLinus Torvalds static __inline__ 1261e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12621da177e4SLinus Torvalds { 12631da177e4SLinus Torvalds switch (family){ 12641da177e4SLinus Torvalds case AF_INET: 12657e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12661da177e4SLinus Torvalds case AF_INET6: 12677e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12681da177e4SLinus Torvalds } 12691da177e4SLinus Torvalds return NULL; 12701da177e4SLinus Torvalds } 12711da177e4SLinus Torvalds 12721da177e4SLinus Torvalds static __inline__ 1273e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12741da177e4SLinus Torvalds { 12751da177e4SLinus Torvalds switch (family){ 12761da177e4SLinus Torvalds case AF_INET: 12777e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12781da177e4SLinus Torvalds case AF_INET6: 12797e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12801da177e4SLinus Torvalds } 12811da177e4SLinus Torvalds return NULL; 12821da177e4SLinus Torvalds } 12831da177e4SLinus Torvalds 12849bb182a7SYOSHIFUJI Hideaki static __inline__ 1285e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 12869bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 12879bb182a7SYOSHIFUJI Hideaki unsigned short family) 12889bb182a7SYOSHIFUJI Hideaki { 12899bb182a7SYOSHIFUJI Hideaki switch(family) { 12909bb182a7SYOSHIFUJI Hideaki case AF_INET: 12917e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 12927e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 12939bb182a7SYOSHIFUJI Hideaki break; 12949bb182a7SYOSHIFUJI Hideaki case AF_INET6: 129515e318bdSJiri Benc saddr->in6 = fl->u.ip6.saddr; 129615e318bdSJiri Benc daddr->in6 = fl->u.ip6.daddr; 12979bb182a7SYOSHIFUJI Hideaki break; 12989bb182a7SYOSHIFUJI Hideaki } 12999bb182a7SYOSHIFUJI Hideaki } 13009bb182a7SYOSHIFUJI Hideaki 13011da177e4SLinus Torvalds static __inline__ int 1302f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1303f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13041da177e4SLinus Torvalds { 13051da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 13061da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 13071da177e4SLinus Torvalds return 1; 13081da177e4SLinus Torvalds return 0; 13091da177e4SLinus Torvalds } 13101da177e4SLinus Torvalds 13111da177e4SLinus Torvalds static __inline__ int 1312f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1313f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13141da177e4SLinus Torvalds { 1315ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1316ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 13171da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 13181da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 13191da177e4SLinus Torvalds return 1; 13201da177e4SLinus Torvalds return 0; 13211da177e4SLinus Torvalds } 13221da177e4SLinus Torvalds 13231da177e4SLinus Torvalds static __inline__ int 1324f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1325f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 13261da177e4SLinus Torvalds unsigned short family) 13271da177e4SLinus Torvalds { 13281da177e4SLinus Torvalds switch (family) { 13291da177e4SLinus Torvalds case AF_INET: 13301da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 13311da177e4SLinus Torvalds case AF_INET6: 13321da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 13331da177e4SLinus Torvalds } 13341da177e4SLinus Torvalds return 0; 13351da177e4SLinus Torvalds } 13361da177e4SLinus Torvalds 1337e53820deSMasahide NAKAMURA static __inline__ int 1338f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1339e53820deSMasahide NAKAMURA unsigned short family) 1340e53820deSMasahide NAKAMURA { 1341e53820deSMasahide NAKAMURA switch (family) { 1342e53820deSMasahide NAKAMURA case AF_INET: 1343e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 13447e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 13457e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1346e53820deSMasahide NAKAMURA case AF_INET6: 1347e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 13487e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 13497e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1350e53820deSMasahide NAKAMURA } 1351e53820deSMasahide NAKAMURA return 0; 1352e53820deSMasahide NAKAMURA } 1353e53820deSMasahide NAKAMURA 1354f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13551da177e4SLinus Torvalds { 13561da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13571da177e4SLinus Torvalds } 13581da177e4SLinus Torvalds 13595794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13605794708fSMasahide NAKAMURA { 1361dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1362dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1363dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1364dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13655794708fSMasahide NAKAMURA } 13665794708fSMasahide NAKAMURA 13671da177e4SLinus Torvalds /* 13681da177e4SLinus Torvalds * xfrm algorithm information 13691da177e4SLinus Torvalds */ 13701a6509d9SHerbert Xu struct xfrm_algo_aead_info { 1371165ecc63SHerbert Xu char *geniv; 13721a6509d9SHerbert Xu u16 icv_truncbits; 13731a6509d9SHerbert Xu }; 13741a6509d9SHerbert Xu 13751da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13761da177e4SLinus Torvalds u16 icv_truncbits; 13771da177e4SLinus Torvalds u16 icv_fullbits; 13781da177e4SLinus Torvalds }; 13791da177e4SLinus Torvalds 13801da177e4SLinus Torvalds struct xfrm_algo_encr_info { 1381165ecc63SHerbert Xu char *geniv; 13821da177e4SLinus Torvalds u16 blockbits; 13831da177e4SLinus Torvalds u16 defkeybits; 13841da177e4SLinus Torvalds }; 13851da177e4SLinus Torvalds 13861da177e4SLinus Torvalds struct xfrm_algo_comp_info { 13871da177e4SLinus Torvalds u16 threshold; 13881da177e4SLinus Torvalds }; 13891da177e4SLinus Torvalds 13901da177e4SLinus Torvalds struct xfrm_algo_desc { 13911da177e4SLinus Torvalds char *name; 139204ff1260SHerbert Xu char *compat; 13931da177e4SLinus Torvalds u8 available:1; 13947e50f84cSJussi Kivilinna u8 pfkey_supported:1; 13951da177e4SLinus Torvalds union { 13961a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 13971da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 13981da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 13991da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 14001da177e4SLinus Torvalds } uinfo; 14011da177e4SLinus Torvalds struct sadb_alg desc; 14021da177e4SLinus Torvalds }; 14031da177e4SLinus Torvalds 14043328715eSSteffen Klassert /* XFRM protocol handlers. */ 14053328715eSSteffen Klassert struct xfrm4_protocol { 14063328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 14073328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 14083328715eSSteffen Klassert int encap_type); 14093328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14103328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 14113328715eSSteffen Klassert 14123328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 14133328715eSSteffen Klassert int priority; 14143328715eSSteffen Klassert }; 14153328715eSSteffen Klassert 14167e14ea15SSteffen Klassert struct xfrm6_protocol { 14177e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 14187e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14197e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 14207e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 14217e14ea15SSteffen Klassert 14227e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 14237e14ea15SSteffen Klassert int priority; 14247e14ea15SSteffen Klassert }; 14257e14ea15SSteffen Klassert 14261da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 14271da177e4SLinus Torvalds struct xfrm_tunnel { 14281da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1429a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1430d2acc347SHerbert Xu 1431b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1432d2acc347SHerbert Xu int priority; 14331da177e4SLinus Torvalds }; 14341da177e4SLinus Torvalds 14351da177e4SLinus Torvalds struct xfrm6_tunnel { 1436d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1437d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1438d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 14396f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1440d2acc347SHerbert Xu int priority; 14411da177e4SLinus Torvalds }; 14421da177e4SLinus Torvalds 1443d511337aSJoe Perches void xfrm_init(void); 1444d511337aSJoe Perches void xfrm4_init(void); 1445d511337aSJoe Perches int xfrm_state_init(struct net *net); 144621f42cc9SSteffen Klassert void xfrm_dev_init(void); 1447d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1448d511337aSJoe Perches void xfrm4_state_init(void); 14492f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1450c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1451d511337aSJoe Perches int xfrm6_init(void); 1452d511337aSJoe Perches void xfrm6_fini(void); 1453d511337aSJoe Perches int xfrm6_state_init(void); 1454d511337aSJoe Perches void xfrm6_state_fini(void); 14557e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 14567e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1457c35b7e72SDaniel Lezcano #else 1458c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1459c35b7e72SDaniel Lezcano { 1460c35b7e72SDaniel Lezcano return 0; 1461c35b7e72SDaniel Lezcano } 1462c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1463c35b7e72SDaniel Lezcano { 1464c35b7e72SDaniel Lezcano ; 1465c35b7e72SDaniel Lezcano } 1466c35b7e72SDaniel Lezcano #endif 14671da177e4SLinus Torvalds 1468558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1469d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1470d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1471558f82efSMasahide NAKAMURA #endif 1472558f82efSMasahide NAKAMURA 1473d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1474b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1475d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1476b27aeadbSAlexey Dobriyan #else 1477b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1478b27aeadbSAlexey Dobriyan { 1479b27aeadbSAlexey Dobriyan } 1480b27aeadbSAlexey Dobriyan #endif 1481b27aeadbSAlexey Dobriyan 1482d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1483870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1484d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 14854c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1486283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1487d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1488d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 148933765d06SDavid S. Miller const xfrm_address_t *saddr, 1490b520e9f6SDavid S. Miller const struct flowi *fl, 1491b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 14921da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 14931da177e4SLinus Torvalds unsigned short family); 1494d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 14955447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1496628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1497628529b6SJamal Hadi Salim unsigned short family, 1498628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1499c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1500c454997eSFan Du unsigned short family); 1501d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1502d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1503d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1504d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1505d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1506a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1507bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1508d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1509a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1510a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1511bd55775cSJamal Hadi Salim u8 proto, 1512bd55775cSJamal Hadi Salim unsigned short family); 151341a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1514d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1515283bc9f3SFan Du unsigned short family, struct net *net); 1516d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1517d511337aSJoe Perches unsigned short family); 151841a49cc3SMasahide NAKAMURA #else 151941a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1520283bc9f3SFan Du int n, unsigned short family, struct net *net) 152141a49cc3SMasahide NAKAMURA { 152241a49cc3SMasahide NAKAMURA return -ENOSYS; 152341a49cc3SMasahide NAKAMURA } 152441a49cc3SMasahide NAKAMURA 152541a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 152641a49cc3SMasahide NAKAMURA int n, unsigned short family) 152741a49cc3SMasahide NAKAMURA { 152841a49cc3SMasahide NAKAMURA return -ENOSYS; 152941a49cc3SMasahide NAKAMURA } 153041a49cc3SMasahide NAKAMURA #endif 1531af11e316SJamal Hadi Salim 1532af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1533af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1534af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1535af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1536af11e316SJamal Hadi Salim }; 1537af11e316SJamal Hadi Salim 15385a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 15395a6d3416SJamal Hadi Salim u32 incnt; 15405a6d3416SJamal Hadi Salim u32 outcnt; 15415a6d3416SJamal Hadi Salim u32 fwdcnt; 15425a6d3416SJamal Hadi Salim u32 inscnt; 15435a6d3416SJamal Hadi Salim u32 outscnt; 15445a6d3416SJamal Hadi Salim u32 fwdscnt; 15455a6d3416SJamal Hadi Salim u32 spdhcnt; 15465a6d3416SJamal Hadi Salim u32 spdhmcnt; 15475a6d3416SJamal Hadi Salim }; 15485a6d3416SJamal Hadi Salim 1549d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1550d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 15512e71029eSTetsuo Handa int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1552d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1553d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1554d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1555d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1556d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1557d511337aSJoe Perches int __xfrm_init_state(struct xfrm_state *x, bool init_replay); 1558d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1559d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1560d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1561d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1562d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 15637026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb); 1564d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1565d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1566d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1567d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1568d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1569716062fdSHerbert Xu int encap_type); 1570d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1571d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 15721e295370SSteffen Klassert int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1573c4541b41SHerbert Xu 1574c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1575c4541b41SHerbert Xu { 157670be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15773328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15783328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15793328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1580c4541b41SHerbert Xu } 1581c4541b41SHerbert Xu 1582d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1583d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1584ede2059dSEric W. Biederman int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 15857026b1ddSDavid Miller int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb); 15863328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15873328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 15883328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1589d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1590d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1591d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1592d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1593d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 159463c43787SNicolas Dichtel int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 159563c43787SNicolas Dichtel struct ip6_tnl *t); 1596d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 159763c43787SNicolas Dichtel int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1598d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1599d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1600fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 16017b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 16027e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 16037e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 16047e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1605d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 16067b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1607d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1608d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1609d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1610d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1611ede2059dSEric W. Biederman int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 16127026b1ddSDavid Miller int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb); 1613d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1614aee5adb4SMasahide NAKAMURA u8 **prevhdr); 16151da177e4SLinus Torvalds 16161da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1617d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1618d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1619d511337aSJoe Perches u8 __user *optval, int optlen); 16201da177e4SLinus Torvalds #else 16211da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 16221da177e4SLinus Torvalds { 16231da177e4SLinus Torvalds return -ENOPROTOOPT; 16241da177e4SLinus Torvalds } 16251da177e4SLinus Torvalds 1626067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 16271da177e4SLinus Torvalds { 16281da177e4SLinus Torvalds /* should not happen */ 16291da177e4SLinus Torvalds kfree_skb(skb); 16301da177e4SLinus Torvalds return 0; 16311da177e4SLinus Torvalds } 16321da177e4SLinus Torvalds #endif 16331da177e4SLinus Torvalds 16340331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 16354c563f76STimo Teras 1636d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1637d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1638d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1639d511337aSJoe Perches void *); 1640283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 16411da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 16428ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 16438ca2e93bSJamal Hadi Salim u8 type, int dir, 16444e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1645ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1646ef41aaa0SEric Paris int *err); 1647d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1648d511337aSJoe Perches u32 id, int delete, int *err); 16492e71029eSTetsuo Handa int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1650880a6fabSChristophe Gouault void xfrm_policy_hash_rebuild(struct net *net); 16511da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1652776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1653d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1654e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1655bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1656a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1657a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1658bd55775cSJamal Hadi Salim unsigned short family); 1659d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16601da177e4SLinus Torvalds 166180c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1662d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1663183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 1664183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 1665283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1666d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 166780c9abaaSShinta Sugimoto struct xfrm_migrate *m); 1668d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 166913c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16708d549c4fSFan Du struct xfrm_kmaddress *k, struct net *net); 167180c9abaaSShinta Sugimoto #endif 167280c9abaaSShinta Sugimoto 1673d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1674d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1675d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1676d511337aSJoe Perches xfrm_address_t *addr); 16771da177e4SLinus Torvalds 1678d511337aSJoe Perches void xfrm_input_init(void); 1679d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 16801da177e4SLinus Torvalds 1681d511337aSJoe Perches void xfrm_probe_algs(void); 1682d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1683d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1684d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1685d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1686d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1687d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1688d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1689d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1690d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1691d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1692d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 16931a6509d9SHerbert Xu int probe); 16941da177e4SLinus Torvalds 1695ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1696ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1697ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1698ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1699ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1700ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1701ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 170270e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 170370e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 170470e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 170570e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 170670e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 170770e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 170870e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 170970e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 171070e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 171170e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 171270e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 171370e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 171470e94e66SYOSHIFUJI Hideaki / 吉藤英明 171577d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 171677d8d7a6SHerbert Xu { 171777d8d7a6SHerbert Xu return index & 7; 171877d8d7a6SHerbert Xu } 171977d8d7a6SHerbert Xu 1720a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1721a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1722f8cd5488SJamal Hadi Salim { 1723be33690dSPatrick McHardy struct sock *nlsk; 1724be33690dSPatrick McHardy int ret = 0; 1725be33690dSPatrick McHardy 1726be33690dSPatrick McHardy rcu_read_lock(); 1727a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1728be33690dSPatrick McHardy if (nlsk) 1729be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1730be33690dSPatrick McHardy rcu_read_unlock(); 1731be33690dSPatrick McHardy return ret; 1732f8cd5488SJamal Hadi Salim } 17330f24558eSHoria Geanta 17340f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 17350f24558eSHoria Geanta { 17360f24558eSHoria Geanta struct sock *nlsk; 17370f24558eSHoria Geanta int ret = 0; 17380f24558eSHoria Geanta 17390f24558eSHoria Geanta rcu_read_lock(); 17400f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 17410f24558eSHoria Geanta if (nlsk) 17420f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 17430f24558eSHoria Geanta rcu_read_unlock(); 17440f24558eSHoria Geanta 17450f24558eSHoria Geanta return ret; 17460f24558eSHoria Geanta } 1747a6483b79SAlexey Dobriyan #endif 1748f8cd5488SJamal Hadi Salim 1749ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1750ee5c2317SSteffen Klassert { 1751ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1752ee5c2317SSteffen Klassert } 1753ee5c2317SSteffen Klassert 175485158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 17550f99be0dSEric Dumazet { 17560f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17570f99be0dSEric Dumazet } 17580f99be0dSEric Dumazet 175985158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17604447bb33SMartin Willi { 17614447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17624447bb33SMartin Willi } 17634447bb33SMartin Willi 17649736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17659736acf3SSteffen Klassert { 17669736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17679736acf3SSteffen Klassert } 17689736acf3SSteffen Klassert 176980c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1770af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1771af2f464eSSteffen Klassert struct xfrm_state *orig) 1772af2f464eSSteffen Klassert { 1773af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1774af2f464eSSteffen Klassert GFP_KERNEL); 1775af2f464eSSteffen Klassert if (!x->replay_esn) 1776af2f464eSSteffen Klassert return -ENOMEM; 1777af2f464eSSteffen Klassert 1778af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1779af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1780af2f464eSSteffen Klassert 1781af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1782af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1783af2f464eSSteffen Klassert GFP_KERNEL); 1784af2f464eSSteffen Klassert if (!x->preplay_esn) { 1785af2f464eSSteffen Klassert kfree(x->replay_esn); 1786af2f464eSSteffen Klassert return -ENOMEM; 1787af2f464eSSteffen Klassert } 1788af2f464eSSteffen Klassert 1789af2f464eSSteffen Klassert return 0; 1790af2f464eSSteffen Klassert } 1791af2f464eSSteffen Klassert 1792ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1793ee5c2317SSteffen Klassert { 1794ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1795ee5c2317SSteffen Klassert } 1796ee5c2317SSteffen Klassert 1797ee5c2317SSteffen Klassert 179880c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 179980c9abaaSShinta Sugimoto { 18000f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 180180c9abaaSShinta Sugimoto } 180280c9abaaSShinta Sugimoto 18034447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 18044447bb33SMartin Willi { 18054447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 18064447bb33SMartin Willi } 18074447bb33SMartin Willi 180880c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 180980c9abaaSShinta Sugimoto { 181080c9abaaSShinta Sugimoto int i; 181180c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 181280c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 181380c9abaaSShinta Sugimoto } 181480c9abaaSShinta Sugimoto 181580c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 181680c9abaaSShinta Sugimoto { 181780c9abaaSShinta Sugimoto int i; 181880c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 181980c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 182080c9abaaSShinta Sugimoto } 182180c9abaaSShinta Sugimoto #endif 1822f8cd5488SJamal Hadi Salim 1823def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 182400501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 182500501121SHerbert Xu { 182600501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 182700501121SHerbert Xu } 182854ef207aSSteffen Klassert static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 182954ef207aSSteffen Klassert { 183054ef207aSSteffen Klassert struct sec_path *sp = skb->sp; 183154ef207aSSteffen Klassert 183254ef207aSSteffen Klassert if (!sp || !sp->olen || sp->len != sp->olen) 183354ef207aSSteffen Klassert return NULL; 183454ef207aSSteffen Klassert 183554ef207aSSteffen Klassert return &sp->ovec[sp->olen - 1]; 183654ef207aSSteffen Klassert } 1837def8b4faSAlexey Dobriyan #endif 183800501121SHerbert Xu 1839bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1840bf825f81SJamal Hadi Salim { 1841bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 18424efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1843bf825f81SJamal Hadi Salim else 1844bf825f81SJamal Hadi Salim m->v = m->m = 0; 1845bf825f81SJamal Hadi Salim 1846bf825f81SJamal Hadi Salim return m->v & m->m; 1847bf825f81SJamal Hadi Salim } 1848bf825f81SJamal Hadi Salim 1849e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1850bf825f81SJamal Hadi Salim { 18511d1e34ddSDavid S. Miller int ret = 0; 1852bf825f81SJamal Hadi Salim 18531d1e34ddSDavid S. Miller if (m->m | m->v) 18541d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 18551d1e34ddSDavid S. Miller return ret; 1856bf825f81SJamal Hadi Salim } 1857bf825f81SJamal Hadi Salim 185870be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 185970be6c91SSteffen Klassert unsigned int family) 186070be6c91SSteffen Klassert { 186170be6c91SSteffen Klassert bool tunnel = false; 186270be6c91SSteffen Klassert 186370be6c91SSteffen Klassert switch(family) { 186470be6c91SSteffen Klassert case AF_INET: 186570be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 186670be6c91SSteffen Klassert tunnel = true; 186770be6c91SSteffen Klassert break; 186870be6c91SSteffen Klassert case AF_INET6: 186970be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 187070be6c91SSteffen Klassert tunnel = true; 187170be6c91SSteffen Klassert break; 187270be6c91SSteffen Klassert } 187370be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 187470be6c91SSteffen Klassert return -EINVAL; 187570be6c91SSteffen Klassert 187670be6c91SSteffen Klassert return 0; 187770be6c91SSteffen Klassert } 18781da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1879