11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds #include <net/sock.h> 181da177e4SLinus Torvalds #include <net/dst.h> 19436a0a40SHerbert Xu #include <net/ip.h> 201da177e4SLinus Torvalds #include <net/route.h> 211da177e4SLinus Torvalds #include <net/ipv6.h> 221da177e4SLinus Torvalds #include <net/ip6_fib.h> 23fe1a5f03STimo Teräs #include <net/flow.h> 249e0d57fdSYury Polyanskiy 259e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 269e0d57fdSYury Polyanskiy 27558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 28558f82efSMasahide NAKAMURA #include <net/snmp.h> 29558f82efSMasahide NAKAMURA #endif 301da177e4SLinus Torvalds 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 38d3d6dd3aSMasahide NAKAMURA 39fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 401da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 41b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 42b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 43d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 44d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 451da177e4SLinus Torvalds 46558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 4759c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 48558f82efSMasahide NAKAMURA #else 4959c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 50558f82efSMasahide NAKAMURA #endif 51558f82efSMasahide NAKAMURA 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 541da177e4SLinus Torvalds ------------------------------------ 551da177e4SLinus Torvalds 561da177e4SLinus Torvalds Basic objects: 571da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 581da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 591da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 601da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 631da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 641da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 651da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 681da177e4SLinus Torvalds 691da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 701da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 711da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 721da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 731da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 741da177e4SLinus Torvalds to a dst_entry returned to requestor. 751da177e4SLinus Torvalds 761da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 771da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 781da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 791da177e4SLinus Torvalds |---. child .-> NULL 801da177e4SLinus Torvalds 811da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 821da177e4SLinus Torvalds 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds Resolution of xrfm_tmpl 851da177e4SLinus Torvalds ----------------------- 861da177e4SLinus Torvalds Template contains: 871da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 881da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 891da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 901da177e4SLinus Torvalds Q: allow to resolve security gateway? 911da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 921da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 931da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 941da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 951da177e4SLinus Torvalds 7. ->share Sharing mode. 961da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 971da177e4SLinus Torvalds flow id? 981da177e4SLinus Torvalds 991da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1001da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1011da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds PROBLEMS: 1041da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1051da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1061da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1071da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1081da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1091da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1101da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1111da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1121da177e4SLinus Torvalds */ 1131da177e4SLinus Torvalds 11412a169e7SHerbert Xu struct xfrm_state_walk { 11512a169e7SHerbert Xu struct list_head all; 11612a169e7SHerbert Xu u8 state; 11712a169e7SHerbert Xu u8 dying; 11812a169e7SHerbert Xu u8 proto; 11912a169e7SHerbert Xu u32 seq; 120870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12112a169e7SHerbert Xu }; 12212a169e7SHerbert Xu 1231da177e4SLinus Torvalds /* Full description of state of transformer. */ 124fd2c3ef7SEric Dumazet struct xfrm_state { 1250c5c9fb5SEric W. Biederman possible_net_t xs_net; 126abb81c4fSHerbert Xu union { 12712a169e7SHerbert Xu struct hlist_node gclist; 1288f126e37SDavid S. Miller struct hlist_node bydst; 129abb81c4fSHerbert Xu }; 1308f126e37SDavid S. Miller struct hlist_node bysrc; 1318f126e37SDavid S. Miller struct hlist_node byspi; 1321da177e4SLinus Torvalds 1331da177e4SLinus Torvalds atomic_t refcnt; 1341da177e4SLinus Torvalds spinlock_t lock; 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvalds struct xfrm_id id; 1371da177e4SLinus Torvalds struct xfrm_selector sel; 138bf825f81SJamal Hadi Salim struct xfrm_mark mark; 13935d2856bSMartin Willi u32 tfcpad; 1401da177e4SLinus Torvalds 1419d4a706dSDavid S. Miller u32 genid; 1429d4a706dSDavid S. Miller 14312a169e7SHerbert Xu /* Key manager bits */ 14412a169e7SHerbert Xu struct xfrm_state_walk km; 1451da177e4SLinus Torvalds 1461da177e4SLinus Torvalds /* Parameters of this state. */ 1471da177e4SLinus Torvalds struct { 1481da177e4SLinus Torvalds u32 reqid; 1491da177e4SLinus Torvalds u8 mode; 1501da177e4SLinus Torvalds u8 replay_window; 1511da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1521da177e4SLinus Torvalds u8 flags; 1531da177e4SLinus Torvalds u16 family; 1541da177e4SLinus Torvalds xfrm_address_t saddr; 1551da177e4SLinus Torvalds int header_len; 1561da177e4SLinus Torvalds int trailer_len; 157a947b0a9SNicolas Dichtel u32 extra_flags; 1581da177e4SLinus Torvalds } props; 1591da177e4SLinus Torvalds 1601da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1611da177e4SLinus Torvalds 1621da177e4SLinus Torvalds /* Data for transformer */ 1634447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1641da177e4SLinus Torvalds struct xfrm_algo *ealg; 1651da177e4SLinus Torvalds struct xfrm_algo *calg; 1661a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 16769b0137fSHerbert Xu const char *geniv; 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds /* Data for encapsulator */ 1701da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1711da177e4SLinus Torvalds 172060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 173060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 174060f02a3SNoriaki TAKAMIYA 1751da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1761da177e4SLinus Torvalds struct xfrm_state *tunnel; 1771da177e4SLinus Torvalds 1781da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1791da177e4SLinus Torvalds atomic_t tunnel_users; 1801da177e4SLinus Torvalds 1811da177e4SLinus Torvalds /* State for replay detection */ 1821da177e4SLinus Torvalds struct xfrm_replay_state replay; 1839736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1841da177e4SLinus Torvalds 185f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 186f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1879736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 188f8cd5488SJamal Hadi Salim 1899fdc4883SSteffen Klassert /* The functions for replay detection. */ 190e45a8a9eSJulia Lawall const struct xfrm_replay *repl; 1919fdc4883SSteffen Klassert 1922717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1932717096aSJamal Hadi Salim * moment 1942717096aSJamal Hadi Salim */ 1952717096aSJamal Hadi Salim u32 xflags; 1962717096aSJamal Hadi Salim 197f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 198f8cd5488SJamal Hadi Salim u32 replay_maxage; 199f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 200f8cd5488SJamal Hadi Salim 201f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 202f8cd5488SJamal Hadi Salim struct timer_list rtimer; 203f8cd5488SJamal Hadi Salim 2041da177e4SLinus Torvalds /* Statistics */ 2051da177e4SLinus Torvalds struct xfrm_stats stats; 2061da177e4SLinus Torvalds 2071da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2089e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2091da177e4SLinus Torvalds 210e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 211e3c0d047SFan Du long saved_tmo; 212e3c0d047SFan Du 2139afaca05SMasahide NAKAMURA /* Last used time */ 214d26f3984SHerbert Xu unsigned long lastused; 2159afaca05SMasahide NAKAMURA 216cac2661cSSteffen Klassert struct page_frag xfrag; 217cac2661cSSteffen Klassert 2181da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2191da177e4SLinus Torvalds * transformer. */ 220533cb5b0SEric Dumazet const struct xfrm_type *type; 22113996378SHerbert Xu struct xfrm_mode *inner_mode; 222df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 22313996378SHerbert Xu struct xfrm_mode *outer_mode; 2241da177e4SLinus Torvalds 225df71837dSTrent Jaeger /* Security context */ 226df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 227df71837dSTrent Jaeger 2281da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2291da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2301da177e4SLinus Torvalds void *data; 2311da177e4SLinus Torvalds }; 2321da177e4SLinus Torvalds 233673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 234673c09beSAlexey Dobriyan { 235673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 236673c09beSAlexey Dobriyan } 237673c09beSAlexey Dobriyan 2382717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2392717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 240e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2412717096aSJamal Hadi Salim 2421da177e4SLinus Torvalds enum { 2431da177e4SLinus Torvalds XFRM_STATE_VOID, 2441da177e4SLinus Torvalds XFRM_STATE_ACQ, 2451da177e4SLinus Torvalds XFRM_STATE_VALID, 2461da177e4SLinus Torvalds XFRM_STATE_ERROR, 2471da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2481da177e4SLinus Torvalds XFRM_STATE_DEAD 2491da177e4SLinus Torvalds }; 2501da177e4SLinus Torvalds 25126b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 252fd2c3ef7SEric Dumazet struct km_event { 253bf08867fSHerbert Xu union { 254bf08867fSHerbert Xu u32 hard; 255bf08867fSHerbert Xu u32 proto; 256bf08867fSHerbert Xu u32 byid; 257f8cd5488SJamal Hadi Salim u32 aevent; 258f7b6983fSMasahide NAKAMURA u32 type; 259bf08867fSHerbert Xu } data; 260bf08867fSHerbert Xu 26126b15dadSJamal Hadi Salim u32 seq; 26215e47304SEric W. Biederman u32 portid; 26326b15dadSJamal Hadi Salim u32 event; 2647067802eSAlexey Dobriyan struct net *net; 26526b15dadSJamal Hadi Salim }; 26626b15dadSJamal Hadi Salim 2679fdc4883SSteffen Klassert struct xfrm_replay { 2689fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2699fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2709fdc4883SSteffen Klassert struct sk_buff *skb, 2719fdc4883SSteffen Klassert __be32 net_seq); 2723b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2733b59df46SSteffen Klassert struct sk_buff *skb, 2743b59df46SSteffen Klassert __be32 net_seq); 2759fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2769fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2779fdc4883SSteffen Klassert }; 2789fdc4883SSteffen Klassert 27925ee3286SHerbert Xu struct net_device; 2801da177e4SLinus Torvalds struct xfrm_type; 2811da177e4SLinus Torvalds struct xfrm_dst; 2821da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2831da177e4SLinus Torvalds struct dst_ops *dst_ops; 28442a7b32bSDavid Ahern struct dst_entry *(*dst_lookup)(struct net *net, 28542a7b32bSDavid Ahern int tos, int oif, 2865e6b930fSDavid S. Miller const xfrm_address_t *saddr, 2875e6b930fSDavid S. Miller const xfrm_address_t *daddr); 28842a7b32bSDavid Ahern int (*get_saddr)(struct net *net, int oif, 28942a7b32bSDavid Ahern xfrm_address_t *saddr, 29042a7b32bSDavid Ahern xfrm_address_t *daddr); 2911da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 292d5422efeSHerbert Xu struct flowi *fl, 293d5422efeSHerbert Xu int reverse); 29405d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 295a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 296a1b05140SMasahide NAKAMURA struct dst_entry *dst, 297a1b05140SMasahide NAKAMURA int nfheader_len); 29825ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 29987c1e12bSHerbert Xu struct net_device *dev, 3000c7b3eefSDavid S. Miller const struct flowi *fl); 3012774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3021da177e4SLinus Torvalds }; 3031da177e4SLinus Torvalds 304a2817d8bSFlorian Westphal int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 305a2817d8bSFlorian Westphal void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 306d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 307d511337aSJoe Perches const struct km_event *c); 308d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3091da177e4SLinus Torvalds 3101da177e4SLinus Torvalds struct xfrm_tmpl; 311d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 312d511337aSJoe Perches struct xfrm_policy *pol); 313d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 314d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 31553bc6b4dSJamal Hadi Salim 3161da177e4SLinus Torvalds struct xfrm_state_afinfo { 31717c2a42aSHerbert Xu unsigned int family; 31836cf9acfSHerbert Xu unsigned int proto; 3198e3d716cSAl Viro __be16 eth_proto; 32017c2a42aSHerbert Xu struct module *owner; 321533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 322aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 323d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 32473e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 32573e5ebb2SDavid S. Miller const struct flowi *fl); 32619bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 32719bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 32819bd6244SDavid S. Miller const xfrm_address_t *daddr, 32919bd6244SDavid S. Miller const xfrm_address_t *saddr); 33041a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 33141a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 332ede2059dSEric W. Biederman int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 3337026b1ddSDavid Miller int (*output_finish)(struct sock *sk, struct sk_buff *skb); 334227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 335227620e2SHerbert Xu struct sk_buff *skb); 33636cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 33736cf9acfSHerbert Xu struct sk_buff *skb); 338716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 339716062fdSHerbert Xu int async); 340628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3411da177e4SLinus Torvalds }; 3421da177e4SLinus Torvalds 343d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 344d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 345d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 346711059b9SFlorian Westphal struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 3471da177e4SLinus Torvalds 3482f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3492f32b51bSSteffen Klassert unsigned int family; 3502f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3512f32b51bSSteffen Klassert int err); 3522f32b51bSSteffen Klassert }; 3532f32b51bSSteffen Klassert 354960fdfdeSFlorian Westphal int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 355960fdfdeSFlorian Westphal int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 3562f32b51bSSteffen Klassert 357d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3581da177e4SLinus Torvalds 359fd2c3ef7SEric Dumazet struct xfrm_type { 3601da177e4SLinus Torvalds char *description; 3611da177e4SLinus Torvalds struct module *owner; 362a6337463Sjamal u8 proto; 363a6337463Sjamal u8 flags; 3641b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 365436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 366f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 367f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3681da177e4SLinus Torvalds 36972cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3701da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 371e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3721da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3738f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3748f029de2SDavid S. Miller const struct flowi *); 375aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3761da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 377c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3781da177e4SLinus Torvalds }; 3791da177e4SLinus Torvalds 380d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 381d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3821da177e4SLinus Torvalds 383b59f45d0SHerbert Xu struct xfrm_mode { 384227620e2SHerbert Xu /* 385227620e2SHerbert Xu * Remove encapsulation header. 386227620e2SHerbert Xu * 387227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 388227620e2SHerbert Xu * header. 389227620e2SHerbert Xu * 390227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 391227620e2SHerbert Xu * should be and the network header shall be set to where the IP 392227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 393227620e2SHerbert Xu * payload. 394227620e2SHerbert Xu */ 395227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 396227620e2SHerbert Xu 397227620e2SHerbert Xu /* 398227620e2SHerbert Xu * This is the actual input entry point. 399227620e2SHerbert Xu * 400227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 401227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 402227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 403227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 404227620e2SHerbert Xu */ 405b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 40637fedd3aSHerbert Xu 40737fedd3aSHerbert Xu /* 40837fedd3aSHerbert Xu * Add encapsulation header. 40937fedd3aSHerbert Xu * 41037fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 41137fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 41237fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 41337fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 41437fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 41537fedd3aSHerbert Xu * header. The value of the network header will always point 41637fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 41737fedd3aSHerbert Xu */ 41836cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 41936cf9acfSHerbert Xu 42036cf9acfSHerbert Xu /* 42136cf9acfSHerbert Xu * This is the actual output entry point. 42236cf9acfSHerbert Xu * 42336cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 42436cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 42536cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 42636cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 42736cf9acfSHerbert Xu * call output2. 42836cf9acfSHerbert Xu */ 429eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 430b59f45d0SHerbert Xu 43117c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 432b59f45d0SHerbert Xu struct module *owner; 433b59f45d0SHerbert Xu unsigned int encap; 4341bfcb10fSHerbert Xu int flags; 4351bfcb10fSHerbert Xu }; 4361bfcb10fSHerbert Xu 4371bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4381bfcb10fSHerbert Xu enum { 4391bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 440b59f45d0SHerbert Xu }; 441b59f45d0SHerbert Xu 442d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 443d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 444b59f45d0SHerbert Xu 445df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 446df9dcb45SKazunori MIYAZAWA { 447df9dcb45SKazunori MIYAZAWA switch(family) { 448df9dcb45SKazunori MIYAZAWA case AF_INET: 449df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 450df9dcb45SKazunori MIYAZAWA case AF_INET6: 451df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 452df9dcb45SKazunori MIYAZAWA default: 453df9dcb45SKazunori MIYAZAWA return 0; 454df9dcb45SKazunori MIYAZAWA } 455df9dcb45SKazunori MIYAZAWA } 456df9dcb45SKazunori MIYAZAWA 457df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 458df9dcb45SKazunori MIYAZAWA { 459df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 460df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 461df9dcb45SKazunori MIYAZAWA return x->inner_mode; 462df9dcb45SKazunori MIYAZAWA else 463df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 464df9dcb45SKazunori MIYAZAWA } 465df9dcb45SKazunori MIYAZAWA 466fd2c3ef7SEric Dumazet struct xfrm_tmpl { 4671da177e4SLinus Torvalds /* id in template is interpreted as: 4681da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4691da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4701da177e4SLinus Torvalds * daddr must be fixed too. 4711da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4721da177e4SLinus Torvalds */ 4731da177e4SLinus Torvalds struct xfrm_id id; 4741da177e4SLinus Torvalds 4751da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4761da177e4SLinus Torvalds xfrm_address_t saddr; 4771da177e4SLinus Torvalds 47876b3f055SMiika Komu unsigned short encap_family; 47976b3f055SMiika Komu 480a6337463Sjamal u32 reqid; 4811da177e4SLinus Torvalds 4827e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 483a6337463Sjamal u8 mode; 4841da177e4SLinus Torvalds 4851da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 486a6337463Sjamal u8 share; 4871da177e4SLinus Torvalds 4881da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 489a6337463Sjamal u8 optional; 4901da177e4SLinus Torvalds 491c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 492a6337463Sjamal u8 allalgs; 493c5d18e98SHerbert Xu 4941da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 495a6337463Sjamal u32 aalgos; 496a6337463Sjamal u32 ealgos; 497a6337463Sjamal u32 calgos; 4981da177e4SLinus Torvalds }; 4991da177e4SLinus Torvalds 500622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 50154ef207aSSteffen Klassert #define XFRM_MAX_OFFLOAD_DEPTH 1 5021da177e4SLinus Torvalds 50312a169e7SHerbert Xu struct xfrm_policy_walk_entry { 50412a169e7SHerbert Xu struct list_head all; 50512a169e7SHerbert Xu u8 dead; 50612a169e7SHerbert Xu }; 50712a169e7SHerbert Xu 50812a169e7SHerbert Xu struct xfrm_policy_walk { 50912a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 51012a169e7SHerbert Xu u8 type; 51112a169e7SHerbert Xu u32 seq; 51212a169e7SHerbert Xu }; 51312a169e7SHerbert Xu 514a0073fe1SSteffen Klassert struct xfrm_policy_queue { 515a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 516a0073fe1SSteffen Klassert struct timer_list hold_timer; 517a0073fe1SSteffen Klassert unsigned long timeout; 518a0073fe1SSteffen Klassert }; 519a0073fe1SSteffen Klassert 520fd2c3ef7SEric Dumazet struct xfrm_policy { 5210c5c9fb5SEric W. Biederman possible_net_t xp_net; 5222518c7c2SDavid S. Miller struct hlist_node bydst; 5232518c7c2SDavid S. Miller struct hlist_node byidx; 5241da177e4SLinus Torvalds 5251da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5261da177e4SLinus Torvalds rwlock_t lock; 5271da177e4SLinus Torvalds atomic_t refcnt; 5281da177e4SLinus Torvalds struct timer_list timer; 5291da177e4SLinus Torvalds 530fe1a5f03STimo Teräs struct flow_cache_object flo; 53180c802f3STimo Teräs atomic_t genid; 5321da177e4SLinus Torvalds u32 priority; 5331da177e4SLinus Torvalds u32 index; 534bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5351da177e4SLinus Torvalds struct xfrm_selector selector; 5361da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5371da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 53812a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 539a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 54046ca5f5dSArnaldo Carvalho de Melo u8 type; 54146ca5f5dSArnaldo Carvalho de Melo u8 action; 54246ca5f5dSArnaldo Carvalho de Melo u8 flags; 54346ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 54412a169e7SHerbert Xu u16 family; 545df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5461da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 54756f04730SEric Dumazet struct rcu_head rcu; 5481da177e4SLinus Torvalds }; 5491da177e4SLinus Torvalds 55063eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5510331b1f3SAlexey Dobriyan { 5520331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5530331b1f3SAlexey Dobriyan } 5540331b1f3SAlexey Dobriyan 55513c1d189SArnaud Ebalard struct xfrm_kmaddress { 55613c1d189SArnaud Ebalard xfrm_address_t local; 55713c1d189SArnaud Ebalard xfrm_address_t remote; 55813c1d189SArnaud Ebalard u32 reserved; 55913c1d189SArnaud Ebalard u16 family; 56013c1d189SArnaud Ebalard }; 56113c1d189SArnaud Ebalard 56280c9abaaSShinta Sugimoto struct xfrm_migrate { 56380c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 56480c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 56580c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 56680c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 56780c9abaaSShinta Sugimoto u8 proto; 56880c9abaaSShinta Sugimoto u8 mode; 56980c9abaaSShinta Sugimoto u16 reserved; 57080c9abaaSShinta Sugimoto u32 reqid; 57180c9abaaSShinta Sugimoto u16 old_family; 57280c9abaaSShinta Sugimoto u16 new_family; 57380c9abaaSShinta Sugimoto }; 57480c9abaaSShinta Sugimoto 5751da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 576f8cd5488SJamal Hadi Salim /* what happened */ 577f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 578f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 579f8cd5488SJamal Hadi Salim 580f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 581f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 582f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 583f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 584f8cd5488SJamal Hadi Salim /* default seq threshold size */ 585f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 5861da177e4SLinus Torvalds 587fd2c3ef7SEric Dumazet struct xfrm_mgr { 5881da177e4SLinus Torvalds struct list_head list; 5891da177e4SLinus Torvalds char *id; 590214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 59165e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 592cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 5935d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 594214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 595db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 596183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 597183cad12SDavid S. Miller u8 dir, u8 type, 598183cad12SDavid S. Miller const struct xfrm_migrate *m, 599183cad12SDavid S. Miller int num_bundles, 600183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 6010f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6021da177e4SLinus Torvalds }; 6031da177e4SLinus Torvalds 604d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 605d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6061da177e4SLinus Torvalds 60770be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 60870be6c91SSteffen Klassert union { 60970be6c91SSteffen Klassert struct inet_skb_parm h4; 61070be6c91SSteffen Klassert struct inet6_skb_parm h6; 61170be6c91SSteffen Klassert } header; 61270be6c91SSteffen Klassert 61370be6c91SSteffen Klassert union { 61470be6c91SSteffen Klassert struct ip_tunnel *ip4; 61570be6c91SSteffen Klassert struct ip6_tnl *ip6; 61670be6c91SSteffen Klassert } tunnel; 61770be6c91SSteffen Klassert }; 61870be6c91SSteffen Klassert 61970be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 62070be6c91SSteffen Klassert 621436a0a40SHerbert Xu /* 622436a0a40SHerbert Xu * This structure is used for the duration where packets are being 623436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 624436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 625436a0a40SHerbert Xu */ 626436a0a40SHerbert Xu struct xfrm_skb_cb { 62770be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 628436a0a40SHerbert Xu 629436a0a40SHerbert Xu /* Sequence number for replay protection. */ 630b318e0e4SHerbert Xu union { 6311ce3644aSSteffen Klassert struct { 6321ce3644aSSteffen Klassert __u32 low; 6331ce3644aSSteffen Klassert __u32 hi; 6341ce3644aSSteffen Klassert } output; 6351ce3644aSSteffen Klassert struct { 6361ce3644aSSteffen Klassert __be32 low; 6371ce3644aSSteffen Klassert __be32 hi; 6381ce3644aSSteffen Klassert } input; 639b318e0e4SHerbert Xu } seq; 640436a0a40SHerbert Xu }; 641436a0a40SHerbert Xu 642436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 643436a0a40SHerbert Xu 64436cf9acfSHerbert Xu /* 64536cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 64636cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 64736cf9acfSHerbert Xu */ 64836cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 64970be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 65036cf9acfSHerbert Xu 65136cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 65236cf9acfSHerbert Xu __be16 id; 65336cf9acfSHerbert Xu __be16 frag_off; 65436cf9acfSHerbert Xu 655732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 656732c8bd5SHerbert Xu u8 ihl; 657732c8bd5SHerbert Xu 65836cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 65936cf9acfSHerbert Xu u8 tos; 66036cf9acfSHerbert Xu 66136cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 66236cf9acfSHerbert Xu u8 ttl; 66336cf9acfSHerbert Xu 66436cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 66536cf9acfSHerbert Xu u8 protocol; 66636cf9acfSHerbert Xu 667732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 668732c8bd5SHerbert Xu u8 optlen; 669732c8bd5SHerbert Xu 67036cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 67136cf9acfSHerbert Xu u8 flow_lbl[3]; 67236cf9acfSHerbert Xu }; 67336cf9acfSHerbert Xu 67436cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 67536cf9acfSHerbert Xu 676716062fdSHerbert Xu /* 677716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 678716062fdSHerbert Xu * related information. 679716062fdSHerbert Xu */ 680716062fdSHerbert Xu struct xfrm_spi_skb_cb { 68170be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 682716062fdSHerbert Xu 683716062fdSHerbert Xu unsigned int daddroff; 6842fcb45b6SHerbert Xu unsigned int family; 685716062fdSHerbert Xu }; 686716062fdSHerbert Xu 687716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 688716062fdSHerbert Xu 689c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 690afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 691ab5f5e8bSJoy Latten { 692ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 693ab5f5e8bSJoy Latten 694afeb14b4SPaul Moore if (audit_enabled == 0) 695afeb14b4SPaul Moore return NULL; 696ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 697ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 698ab5f5e8bSJoy Latten if (audit_buf == NULL) 699ab5f5e8bSJoy Latten return NULL; 700afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 701afeb14b4SPaul Moore return audit_buf; 702afeb14b4SPaul Moore } 703afeb14b4SPaul Moore 7042e71029eSTetsuo Handa static inline void xfrm_audit_helper_usrinfo(bool task_valid, 705afeb14b4SPaul Moore struct audit_buffer *audit_buf) 706afeb14b4SPaul Moore { 7072e71029eSTetsuo Handa const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 7082e71029eSTetsuo Handa audit_get_loginuid(current) : 7092e71029eSTetsuo Handa INVALID_UID); 7102e71029eSTetsuo Handa const unsigned int ses = task_valid ? audit_get_sessionid(current) : 7112e71029eSTetsuo Handa (unsigned int) -1; 7122e71029eSTetsuo Handa 7132e71029eSTetsuo Handa audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 714ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 715ab5f5e8bSJoy Latten } 716ab5f5e8bSJoy Latten 7172e71029eSTetsuo Handa void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 7182e71029eSTetsuo Handa void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7192e71029eSTetsuo Handa bool task_valid); 7202e71029eSTetsuo Handa void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 7212e71029eSTetsuo Handa void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 722d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 723afeb14b4SPaul Moore struct sk_buff *skb); 724d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 725d511337aSJoe Perches __be32 net_seq); 726d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 727d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 728d511337aSJoe Perches __be32 net_seq); 729d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 730d511337aSJoe Perches u8 proto); 731c9204d9cSJoy Latten #else 73241fef0eeSMarcin Slusarz 73341fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7342e71029eSTetsuo Handa bool task_valid) 73541fef0eeSMarcin Slusarz { 73641fef0eeSMarcin Slusarz } 73741fef0eeSMarcin Slusarz 73841fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7392e71029eSTetsuo Handa bool task_valid) 74041fef0eeSMarcin Slusarz { 74141fef0eeSMarcin Slusarz } 74241fef0eeSMarcin Slusarz 74341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7442e71029eSTetsuo Handa bool task_valid) 74541fef0eeSMarcin Slusarz { 74641fef0eeSMarcin Slusarz } 74741fef0eeSMarcin Slusarz 74841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7492e71029eSTetsuo Handa bool task_valid) 75041fef0eeSMarcin Slusarz { 75141fef0eeSMarcin Slusarz } 75241fef0eeSMarcin Slusarz 75341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 75441fef0eeSMarcin Slusarz struct sk_buff *skb) 75541fef0eeSMarcin Slusarz { 75641fef0eeSMarcin Slusarz } 75741fef0eeSMarcin Slusarz 7589fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7599fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7609fdc4883SSteffen Klassert { 7619fdc4883SSteffen Klassert } 7629fdc4883SSteffen Klassert 76341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 76441fef0eeSMarcin Slusarz u16 family) 76541fef0eeSMarcin Slusarz { 76641fef0eeSMarcin Slusarz } 76741fef0eeSMarcin Slusarz 76841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 76941fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 77041fef0eeSMarcin Slusarz { 77141fef0eeSMarcin Slusarz } 77241fef0eeSMarcin Slusarz 77341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 77441fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 77541fef0eeSMarcin Slusarz { 77641fef0eeSMarcin Slusarz } 777c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 778161a09e7SJoy Latten 7791da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 7801da177e4SLinus Torvalds { 7811da177e4SLinus Torvalds if (likely(policy != NULL)) 7821da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 7831da177e4SLinus Torvalds } 7841da177e4SLinus Torvalds 785d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 7861da177e4SLinus Torvalds 7871da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 7881da177e4SLinus Torvalds { 7891da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 79064c31b3fSWANG Cong xfrm_policy_destroy(policy); 7911da177e4SLinus Torvalds } 7921da177e4SLinus Torvalds 7934e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 7944e81bb83SMasahide NAKAMURA { 7954e81bb83SMasahide NAKAMURA int i; 7964e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 7974e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 7984e81bb83SMasahide NAKAMURA } 7994e81bb83SMasahide NAKAMURA 800d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8011da177e4SLinus Torvalds 80221380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 80321380b81SHerbert Xu { 80421380b81SHerbert Xu atomic_dec(&x->refcnt); 80521380b81SHerbert Xu } 80621380b81SHerbert Xu 8071da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8081da177e4SLinus Torvalds { 8091da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 8101da177e4SLinus Torvalds __xfrm_state_destroy(x); 8111da177e4SLinus Torvalds } 8121da177e4SLinus Torvalds 8131da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8141da177e4SLinus Torvalds { 8151da177e4SLinus Torvalds atomic_inc(&x->refcnt); 8161da177e4SLinus Torvalds } 8171da177e4SLinus Torvalds 8181744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 8191744a8feSDavid S. Miller int prefixlen) 8201da177e4SLinus Torvalds { 8211744a8feSDavid S. Miller const __be32 *a1 = token1; 8221744a8feSDavid S. Miller const __be32 *a2 = token2; 8231da177e4SLinus Torvalds int pdw; 8241da177e4SLinus Torvalds int pbi; 8251da177e4SLinus Torvalds 826a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8271da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8281da177e4SLinus Torvalds 8291da177e4SLinus Torvalds if (pdw) 8301da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8311744a8feSDavid S. Miller return false; 8321da177e4SLinus Torvalds 8331da177e4SLinus Torvalds if (pbi) { 8345f19343fSAl Viro __be32 mask; 8351da177e4SLinus Torvalds 8361da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8371da177e4SLinus Torvalds 8381da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8391744a8feSDavid S. Miller return false; 8401da177e4SLinus Torvalds } 8411da177e4SLinus Torvalds 8421744a8feSDavid S. Miller return true; 8431da177e4SLinus Torvalds } 8441da177e4SLinus Torvalds 84526bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 84626bff940SAlexey Dobriyan { 84726bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 84826bff940SAlexey Dobriyan if (prefixlen == 0) 84926bff940SAlexey Dobriyan return true; 85026bff940SAlexey Dobriyan return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen))); 85126bff940SAlexey Dobriyan } 85226bff940SAlexey Dobriyan 8531da177e4SLinus Torvalds static __inline__ 8546281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8551da177e4SLinus Torvalds { 856f9d07e41SAl Viro __be16 port; 8571d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8581da177e4SLinus Torvalds case IPPROTO_TCP: 8591da177e4SLinus Torvalds case IPPROTO_UDP: 860ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8611da177e4SLinus Torvalds case IPPROTO_SCTP: 8626281dcc9SDavid S. Miller port = uli->ports.sport; 8631da177e4SLinus Torvalds break; 8641da177e4SLinus Torvalds case IPPROTO_ICMP: 8651da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8666281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 8671da177e4SLinus Torvalds break; 8682ce4272aSMasahide NAKAMURA case IPPROTO_MH: 8696281dcc9SDavid S. Miller port = htons(uli->mht.type); 8702ce4272aSMasahide NAKAMURA break; 871cc9ff19dSTimo Teräs case IPPROTO_GRE: 8726281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 873cc9ff19dSTimo Teräs break; 8741da177e4SLinus Torvalds default: 8751da177e4SLinus Torvalds port = 0; /*XXX*/ 8761da177e4SLinus Torvalds } 8771da177e4SLinus Torvalds return port; 8781da177e4SLinus Torvalds } 8791da177e4SLinus Torvalds 8801da177e4SLinus Torvalds static __inline__ 8816281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 8821da177e4SLinus Torvalds { 883f9d07e41SAl Viro __be16 port; 8841d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8851da177e4SLinus Torvalds case IPPROTO_TCP: 8861da177e4SLinus Torvalds case IPPROTO_UDP: 887ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8881da177e4SLinus Torvalds case IPPROTO_SCTP: 8896281dcc9SDavid S. Miller port = uli->ports.dport; 8901da177e4SLinus Torvalds break; 8911da177e4SLinus Torvalds case IPPROTO_ICMP: 8921da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8936281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 8941da177e4SLinus Torvalds break; 895cc9ff19dSTimo Teräs case IPPROTO_GRE: 8966281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 897cc9ff19dSTimo Teräs break; 8981da177e4SLinus Torvalds default: 8991da177e4SLinus Torvalds port = 0; /*XXX*/ 9001da177e4SLinus Torvalds } 9011da177e4SLinus Torvalds return port; 9021da177e4SLinus Torvalds } 9031da177e4SLinus Torvalds 904d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 905d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9061da177e4SLinus Torvalds 907df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 908df71837dSTrent Jaeger /* If neither has a context --> match 909df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 910df71837dSTrent Jaeger */ 911bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 912df71837dSTrent Jaeger { 913df71837dSTrent Jaeger return ((!s1 && !s2) || 914df71837dSTrent Jaeger (s1 && s2 && 915df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 916df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 917df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 918df71837dSTrent Jaeger } 919df71837dSTrent Jaeger #else 920bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 921df71837dSTrent Jaeger { 922bc9b35adSDavid S. Miller return true; 923df71837dSTrent Jaeger } 924df71837dSTrent Jaeger #endif 925df71837dSTrent Jaeger 9261da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9271da177e4SLinus Torvalds * 9281da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9291da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9301da177e4SLinus Torvalds * 9311da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9321da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9331da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9341da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9351da177e4SLinus Torvalds * policy rule. 9361da177e4SLinus Torvalds */ 937fd2c3ef7SEric Dumazet struct xfrm_dst { 9381da177e4SLinus Torvalds union { 9391da177e4SLinus Torvalds struct dst_entry dst; 9401da177e4SLinus Torvalds struct rtable rt; 9411da177e4SLinus Torvalds struct rt6_info rt6; 9421da177e4SLinus Torvalds } u; 9431da177e4SLinus Torvalds struct dst_entry *route; 94480c802f3STimo Teräs struct flow_cache_object flo; 94580c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 94680c802f3STimo Teräs int num_pols, num_xfrms; 947157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 948157bfc25SMasahide NAKAMURA struct flowi *origin; 949157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 950157bfc25SMasahide NAKAMURA #endif 95180c802f3STimo Teräs u32 xfrm_genid; 95280c802f3STimo Teräs u32 policy_genid; 9531da177e4SLinus Torvalds u32 route_mtu_cached; 9541da177e4SLinus Torvalds u32 child_mtu_cached; 95592d63decSHideaki YOSHIFUJI u32 route_cookie; 95692d63decSHideaki YOSHIFUJI u32 path_cookie; 9571da177e4SLinus Torvalds }; 9581da177e4SLinus Torvalds 959def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 960aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 961aabc9761SHerbert Xu { 96280c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 963aabc9761SHerbert Xu dst_release(xdst->route); 964aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 965aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 966157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 967157bfc25SMasahide NAKAMURA kfree(xdst->origin); 968157bfc25SMasahide NAKAMURA xdst->origin = NULL; 969157bfc25SMasahide NAKAMURA kfree(xdst->partner); 970157bfc25SMasahide NAKAMURA xdst->partner = NULL; 971157bfc25SMasahide NAKAMURA #endif 972aabc9761SHerbert Xu } 973def8b4faSAlexey Dobriyan #endif 974aabc9761SHerbert Xu 975d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 976aabc9761SHerbert Xu 97754ef207aSSteffen Klassert struct xfrm_offload { 97854ef207aSSteffen Klassert /* Output sequence number for replay protection on offloading. */ 97954ef207aSSteffen Klassert struct { 98054ef207aSSteffen Klassert __u32 low; 98154ef207aSSteffen Klassert __u32 hi; 98254ef207aSSteffen Klassert } seq; 98354ef207aSSteffen Klassert 98454ef207aSSteffen Klassert __u32 flags; 98554ef207aSSteffen Klassert #define SA_DELETE_REQ 1 98654ef207aSSteffen Klassert #define CRYPTO_DONE 2 98754ef207aSSteffen Klassert #define CRYPTO_NEXT_DONE 4 98854ef207aSSteffen Klassert #define CRYPTO_FALLBACK 8 98954ef207aSSteffen Klassert #define XFRM_GSO_SEGMENT 16 99054ef207aSSteffen Klassert #define XFRM_GRO 32 99154ef207aSSteffen Klassert 99254ef207aSSteffen Klassert __u32 status; 99354ef207aSSteffen Klassert #define CRYPTO_SUCCESS 1 99454ef207aSSteffen Klassert #define CRYPTO_GENERIC_ERROR 2 99554ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 99654ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 99754ef207aSSteffen Klassert #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 99854ef207aSSteffen Klassert #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 99954ef207aSSteffen Klassert #define CRYPTO_INVALID_PACKET_SYNTAX 64 100054ef207aSSteffen Klassert #define CRYPTO_INVALID_PROTOCOL 128 100154ef207aSSteffen Klassert 100254ef207aSSteffen Klassert __u8 proto; 100354ef207aSSteffen Klassert }; 100454ef207aSSteffen Klassert 1005fd2c3ef7SEric Dumazet struct sec_path { 10061da177e4SLinus Torvalds atomic_t refcnt; 10071da177e4SLinus Torvalds int len; 100854ef207aSSteffen Klassert int olen; 100954ef207aSSteffen Klassert 1010dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 101154ef207aSSteffen Klassert struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 10121da177e4SLinus Torvalds }; 10131da177e4SLinus Torvalds 1014990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 1015990078afSMichael Smith { 1016990078afSMichael Smith #ifdef CONFIG_XFRM 1017990078afSMichael Smith return skb->sp != NULL; 1018990078afSMichael Smith #else 1019990078afSMichael Smith return 0; 1020990078afSMichael Smith #endif 1021990078afSMichael Smith } 1022990078afSMichael Smith 10231da177e4SLinus Torvalds static inline struct sec_path * 10241da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 10251da177e4SLinus Torvalds { 10261da177e4SLinus Torvalds if (sp) 10271da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 10281da177e4SLinus Torvalds return sp; 10291da177e4SLinus Torvalds } 10301da177e4SLinus Torvalds 1031d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10321da177e4SLinus Torvalds 10331da177e4SLinus Torvalds static inline void 10341da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10351da177e4SLinus Torvalds { 10361da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 10371da177e4SLinus Torvalds __secpath_destroy(sp); 10381da177e4SLinus Torvalds } 10391da177e4SLinus Torvalds 1040d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 1041b0fcee82SSteffen Klassert int secpath_set(struct sk_buff *skb); 10421da177e4SLinus Torvalds 10431da177e4SLinus Torvalds static inline void 10441da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10451da177e4SLinus Torvalds { 10461da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10471da177e4SLinus Torvalds secpath_put(skb->sp); 10481da177e4SLinus Torvalds skb->sp = NULL; 10491da177e4SLinus Torvalds #endif 10501da177e4SLinus Torvalds } 10511da177e4SLinus Torvalds 10521da177e4SLinus Torvalds static inline int 10536cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1054a1e59abfSPatrick McHardy { 1055a1e59abfSPatrick McHardy switch (family) { 1056a1e59abfSPatrick McHardy case AF_INET: 1057a1e59abfSPatrick McHardy return addr->a4 == 0; 1058a1e59abfSPatrick McHardy case AF_INET6: 105915e318bdSJiri Benc return ipv6_addr_any(&addr->in6); 1060a1e59abfSPatrick McHardy } 1061a1e59abfSPatrick McHardy return 0; 1062a1e59abfSPatrick McHardy } 1063a1e59abfSPatrick McHardy 1064a1e59abfSPatrick McHardy static inline int 106521eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10661da177e4SLinus Torvalds { 10671da177e4SLinus Torvalds return (tmpl->saddr.a4 && 10681da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 10691da177e4SLinus Torvalds } 10701da177e4SLinus Torvalds 10711da177e4SLinus Torvalds static inline int 107221eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10731da177e4SLinus Torvalds { 10741da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1075ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 10761da177e4SLinus Torvalds } 10771da177e4SLinus Torvalds 10781da177e4SLinus Torvalds static inline int 107921eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 10801da177e4SLinus Torvalds { 10811da177e4SLinus Torvalds switch (family) { 10821da177e4SLinus Torvalds case AF_INET: 10831da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 10841da177e4SLinus Torvalds case AF_INET6: 10851da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 10861da177e4SLinus Torvalds } 10871da177e4SLinus Torvalds return !0; 10881da177e4SLinus Torvalds } 10891da177e4SLinus Torvalds 10901da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1091d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1092d511337aSJoe Perches unsigned short family); 10931da177e4SLinus Torvalds 1094d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1095d5422efeSHerbert Xu struct sk_buff *skb, 1096d5422efeSHerbert Xu unsigned int family, int reverse) 10971da177e4SLinus Torvalds { 1098f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1099d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1100d5422efeSHerbert Xu 11011da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1102d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 11031da177e4SLinus Torvalds 1104f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1105adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1106d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1107d5422efeSHerbert Xu } 1108d5422efeSHerbert Xu 1109d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1110d5422efeSHerbert Xu { 1111d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 11121da177e4SLinus Torvalds } 11131da177e4SLinus Torvalds 11141da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11151da177e4SLinus Torvalds { 11161da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 11171da177e4SLinus Torvalds } 11181da177e4SLinus Torvalds 11191da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11201da177e4SLinus Torvalds { 11211da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 11221da177e4SLinus Torvalds } 11231da177e4SLinus Torvalds 1124d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1125d5422efeSHerbert Xu struct sk_buff *skb) 1126d5422efeSHerbert Xu { 1127d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1128d5422efeSHerbert Xu } 1129d5422efeSHerbert Xu 1130d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1131d5422efeSHerbert Xu struct sk_buff *skb) 1132d5422efeSHerbert Xu { 1133d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1134d5422efeSHerbert Xu } 1135d5422efeSHerbert Xu 1136d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1137d5422efeSHerbert Xu unsigned int family, int reverse); 1138d5422efeSHerbert Xu 1139d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1140d5422efeSHerbert Xu unsigned int family) 1141d5422efeSHerbert Xu { 1142d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1143d5422efeSHerbert Xu } 1144d5422efeSHerbert Xu 1145d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1146d5422efeSHerbert Xu struct flowi *fl, 1147d5422efeSHerbert Xu unsigned int family) 1148d5422efeSHerbert Xu { 1149d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1150d5422efeSHerbert Xu } 1151d5422efeSHerbert Xu 1152d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11531da177e4SLinus Torvalds 11541da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11551da177e4SLinus Torvalds { 115699a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 115799a66657SAlexey Dobriyan 115899a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1159adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11601da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11611da177e4SLinus Torvalds } 11621da177e4SLinus Torvalds 11631da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11641da177e4SLinus Torvalds { 11651da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 11661da177e4SLinus Torvalds } 11671da177e4SLinus Torvalds 11681da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 11691da177e4SLinus Torvalds { 11701da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 11711da177e4SLinus Torvalds } 11721da177e4SLinus Torvalds 1173d188ba86SEric Dumazet int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 11741da177e4SLinus Torvalds 1175d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 11761da177e4SLinus Torvalds { 1177d188ba86SEric Dumazet sk->sk_policy[0] = NULL; 1178d188ba86SEric Dumazet sk->sk_policy[1] = NULL; 1179d188ba86SEric Dumazet if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1180d188ba86SEric Dumazet return __xfrm_sk_clone_policy(sk, osk); 11811da177e4SLinus Torvalds return 0; 11821da177e4SLinus Torvalds } 11831da177e4SLinus Torvalds 1184d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 11851da177e4SLinus Torvalds 11861da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 11871da177e4SLinus Torvalds { 1188d188ba86SEric Dumazet struct xfrm_policy *pol; 1189d188ba86SEric Dumazet 1190d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1191d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1192d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX); 11931da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 11941da177e4SLinus Torvalds } 1195d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1196d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1197d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 11981da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 11991da177e4SLinus Torvalds } 12001da177e4SLinus Torvalds } 12011da177e4SLinus Torvalds 1202d511337aSJoe Perches void xfrm_garbage_collect(struct net *net); 12033d7d25a6SFlorian Westphal void xfrm_garbage_collect_deferred(struct net *net); 1204e4c17216SPaul Moore 12051da177e4SLinus Torvalds #else 12061da177e4SLinus Torvalds 12071da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 1208d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 12091da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 12101da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 12111da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12121da177e4SLinus Torvalds { 12131da177e4SLinus Torvalds return 1; 12141da177e4SLinus Torvalds } 12151da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12161da177e4SLinus Torvalds { 12171da177e4SLinus Torvalds return 1; 12181da177e4SLinus Torvalds } 12191da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 12201da177e4SLinus Torvalds { 12211da177e4SLinus Torvalds return 1; 12221da177e4SLinus Torvalds } 1223d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1224d5422efeSHerbert Xu struct flowi *fl, 1225d5422efeSHerbert Xu unsigned int family) 1226d5422efeSHerbert Xu { 1227d5422efeSHerbert Xu return -ENOSYS; 1228d5422efeSHerbert Xu } 1229d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1230d5422efeSHerbert Xu struct sk_buff *skb) 1231d5422efeSHerbert Xu { 1232d5422efeSHerbert Xu return 1; 1233d5422efeSHerbert Xu } 1234d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1235d5422efeSHerbert Xu struct sk_buff *skb) 1236d5422efeSHerbert Xu { 1237d5422efeSHerbert Xu return 1; 1238d5422efeSHerbert Xu } 1239e4c17216SPaul Moore static inline void xfrm_garbage_collect(struct net *net) 1240e4c17216SPaul Moore { 1241e4c17216SPaul Moore } 12421da177e4SLinus Torvalds #endif 12431da177e4SLinus Torvalds 12441da177e4SLinus Torvalds static __inline__ 1245e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12461da177e4SLinus Torvalds { 12471da177e4SLinus Torvalds switch (family){ 12481da177e4SLinus Torvalds case AF_INET: 12497e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12501da177e4SLinus Torvalds case AF_INET6: 12517e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12521da177e4SLinus Torvalds } 12531da177e4SLinus Torvalds return NULL; 12541da177e4SLinus Torvalds } 12551da177e4SLinus Torvalds 12561da177e4SLinus Torvalds static __inline__ 1257e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12581da177e4SLinus Torvalds { 12591da177e4SLinus Torvalds switch (family){ 12601da177e4SLinus Torvalds case AF_INET: 12617e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12621da177e4SLinus Torvalds case AF_INET6: 12637e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12641da177e4SLinus Torvalds } 12651da177e4SLinus Torvalds return NULL; 12661da177e4SLinus Torvalds } 12671da177e4SLinus Torvalds 12689bb182a7SYOSHIFUJI Hideaki static __inline__ 1269e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 12709bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 12719bb182a7SYOSHIFUJI Hideaki unsigned short family) 12729bb182a7SYOSHIFUJI Hideaki { 12739bb182a7SYOSHIFUJI Hideaki switch(family) { 12749bb182a7SYOSHIFUJI Hideaki case AF_INET: 12757e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 12767e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 12779bb182a7SYOSHIFUJI Hideaki break; 12789bb182a7SYOSHIFUJI Hideaki case AF_INET6: 127915e318bdSJiri Benc saddr->in6 = fl->u.ip6.saddr; 128015e318bdSJiri Benc daddr->in6 = fl->u.ip6.daddr; 12819bb182a7SYOSHIFUJI Hideaki break; 12829bb182a7SYOSHIFUJI Hideaki } 12839bb182a7SYOSHIFUJI Hideaki } 12849bb182a7SYOSHIFUJI Hideaki 12851da177e4SLinus Torvalds static __inline__ int 1286f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1287f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12881da177e4SLinus Torvalds { 12891da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 12901da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 12911da177e4SLinus Torvalds return 1; 12921da177e4SLinus Torvalds return 0; 12931da177e4SLinus Torvalds } 12941da177e4SLinus Torvalds 12951da177e4SLinus Torvalds static __inline__ int 1296f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1297f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12981da177e4SLinus Torvalds { 1299ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1300ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 13011da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 13021da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 13031da177e4SLinus Torvalds return 1; 13041da177e4SLinus Torvalds return 0; 13051da177e4SLinus Torvalds } 13061da177e4SLinus Torvalds 13071da177e4SLinus Torvalds static __inline__ int 1308f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1309f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 13101da177e4SLinus Torvalds unsigned short family) 13111da177e4SLinus Torvalds { 13121da177e4SLinus Torvalds switch (family) { 13131da177e4SLinus Torvalds case AF_INET: 13141da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 13151da177e4SLinus Torvalds case AF_INET6: 13161da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 13171da177e4SLinus Torvalds } 13181da177e4SLinus Torvalds return 0; 13191da177e4SLinus Torvalds } 13201da177e4SLinus Torvalds 1321e53820deSMasahide NAKAMURA static __inline__ int 1322f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1323e53820deSMasahide NAKAMURA unsigned short family) 1324e53820deSMasahide NAKAMURA { 1325e53820deSMasahide NAKAMURA switch (family) { 1326e53820deSMasahide NAKAMURA case AF_INET: 1327e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 13287e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 13297e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1330e53820deSMasahide NAKAMURA case AF_INET6: 1331e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 13327e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 13337e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1334e53820deSMasahide NAKAMURA } 1335e53820deSMasahide NAKAMURA return 0; 1336e53820deSMasahide NAKAMURA } 1337e53820deSMasahide NAKAMURA 1338f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13391da177e4SLinus Torvalds { 13401da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13411da177e4SLinus Torvalds } 13421da177e4SLinus Torvalds 13435794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13445794708fSMasahide NAKAMURA { 1345dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1346dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1347dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1348dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13495794708fSMasahide NAKAMURA } 13505794708fSMasahide NAKAMURA 13511da177e4SLinus Torvalds /* 13521da177e4SLinus Torvalds * xfrm algorithm information 13531da177e4SLinus Torvalds */ 13541a6509d9SHerbert Xu struct xfrm_algo_aead_info { 1355165ecc63SHerbert Xu char *geniv; 13561a6509d9SHerbert Xu u16 icv_truncbits; 13571a6509d9SHerbert Xu }; 13581a6509d9SHerbert Xu 13591da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13601da177e4SLinus Torvalds u16 icv_truncbits; 13611da177e4SLinus Torvalds u16 icv_fullbits; 13621da177e4SLinus Torvalds }; 13631da177e4SLinus Torvalds 13641da177e4SLinus Torvalds struct xfrm_algo_encr_info { 1365165ecc63SHerbert Xu char *geniv; 13661da177e4SLinus Torvalds u16 blockbits; 13671da177e4SLinus Torvalds u16 defkeybits; 13681da177e4SLinus Torvalds }; 13691da177e4SLinus Torvalds 13701da177e4SLinus Torvalds struct xfrm_algo_comp_info { 13711da177e4SLinus Torvalds u16 threshold; 13721da177e4SLinus Torvalds }; 13731da177e4SLinus Torvalds 13741da177e4SLinus Torvalds struct xfrm_algo_desc { 13751da177e4SLinus Torvalds char *name; 137604ff1260SHerbert Xu char *compat; 13771da177e4SLinus Torvalds u8 available:1; 13787e50f84cSJussi Kivilinna u8 pfkey_supported:1; 13791da177e4SLinus Torvalds union { 13801a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 13811da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 13821da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 13831da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 13841da177e4SLinus Torvalds } uinfo; 13851da177e4SLinus Torvalds struct sadb_alg desc; 13861da177e4SLinus Torvalds }; 13871da177e4SLinus Torvalds 13883328715eSSteffen Klassert /* XFRM protocol handlers. */ 13893328715eSSteffen Klassert struct xfrm4_protocol { 13903328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 13913328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 13923328715eSSteffen Klassert int encap_type); 13933328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 13943328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 13953328715eSSteffen Klassert 13963328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 13973328715eSSteffen Klassert int priority; 13983328715eSSteffen Klassert }; 13993328715eSSteffen Klassert 14007e14ea15SSteffen Klassert struct xfrm6_protocol { 14017e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 14027e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14037e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 14047e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 14057e14ea15SSteffen Klassert 14067e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 14077e14ea15SSteffen Klassert int priority; 14087e14ea15SSteffen Klassert }; 14097e14ea15SSteffen Klassert 14101da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 14111da177e4SLinus Torvalds struct xfrm_tunnel { 14121da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1413a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1414d2acc347SHerbert Xu 1415b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1416d2acc347SHerbert Xu int priority; 14171da177e4SLinus Torvalds }; 14181da177e4SLinus Torvalds 14191da177e4SLinus Torvalds struct xfrm6_tunnel { 1420d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1421d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1422d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 14236f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1424d2acc347SHerbert Xu int priority; 14251da177e4SLinus Torvalds }; 14261da177e4SLinus Torvalds 1427d511337aSJoe Perches void xfrm_init(void); 1428d511337aSJoe Perches void xfrm4_init(void); 1429d511337aSJoe Perches int xfrm_state_init(struct net *net); 1430d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1431d511337aSJoe Perches void xfrm4_state_init(void); 14322f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1433c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1434d511337aSJoe Perches int xfrm6_init(void); 1435d511337aSJoe Perches void xfrm6_fini(void); 1436d511337aSJoe Perches int xfrm6_state_init(void); 1437d511337aSJoe Perches void xfrm6_state_fini(void); 14387e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 14397e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1440c35b7e72SDaniel Lezcano #else 1441c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1442c35b7e72SDaniel Lezcano { 1443c35b7e72SDaniel Lezcano return 0; 1444c35b7e72SDaniel Lezcano } 1445c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1446c35b7e72SDaniel Lezcano { 1447c35b7e72SDaniel Lezcano ; 1448c35b7e72SDaniel Lezcano } 1449c35b7e72SDaniel Lezcano #endif 14501da177e4SLinus Torvalds 1451558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1452d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1453d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1454558f82efSMasahide NAKAMURA #endif 1455558f82efSMasahide NAKAMURA 1456d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1457b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1458d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1459b27aeadbSAlexey Dobriyan #else 1460b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1461b27aeadbSAlexey Dobriyan { 1462b27aeadbSAlexey Dobriyan } 1463b27aeadbSAlexey Dobriyan #endif 1464b27aeadbSAlexey Dobriyan 1465d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1466870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1467d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 14684c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1469283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1470d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1471d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 147233765d06SDavid S. Miller const xfrm_address_t *saddr, 1473b520e9f6SDavid S. Miller const struct flowi *fl, 1474b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 14751da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 14761da177e4SLinus Torvalds unsigned short family); 1477d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 14785447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1479628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1480628529b6SJamal Hadi Salim unsigned short family, 1481628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1482c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1483c454997eSFan Du unsigned short family); 1484d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1485d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1486d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1487d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1488d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1489a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1490bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1491d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1492a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1493a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1494bd55775cSJamal Hadi Salim u8 proto, 1495bd55775cSJamal Hadi Salim unsigned short family); 149641a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1497d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1498283bc9f3SFan Du unsigned short family, struct net *net); 1499d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1500d511337aSJoe Perches unsigned short family); 150141a49cc3SMasahide NAKAMURA #else 150241a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1503283bc9f3SFan Du int n, unsigned short family, struct net *net) 150441a49cc3SMasahide NAKAMURA { 150541a49cc3SMasahide NAKAMURA return -ENOSYS; 150641a49cc3SMasahide NAKAMURA } 150741a49cc3SMasahide NAKAMURA 150841a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 150941a49cc3SMasahide NAKAMURA int n, unsigned short family) 151041a49cc3SMasahide NAKAMURA { 151141a49cc3SMasahide NAKAMURA return -ENOSYS; 151241a49cc3SMasahide NAKAMURA } 151341a49cc3SMasahide NAKAMURA #endif 1514af11e316SJamal Hadi Salim 1515af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1516af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1517af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1518af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1519af11e316SJamal Hadi Salim }; 1520af11e316SJamal Hadi Salim 15215a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 15225a6d3416SJamal Hadi Salim u32 incnt; 15235a6d3416SJamal Hadi Salim u32 outcnt; 15245a6d3416SJamal Hadi Salim u32 fwdcnt; 15255a6d3416SJamal Hadi Salim u32 inscnt; 15265a6d3416SJamal Hadi Salim u32 outscnt; 15275a6d3416SJamal Hadi Salim u32 fwdscnt; 15285a6d3416SJamal Hadi Salim u32 spdhcnt; 15295a6d3416SJamal Hadi Salim u32 spdhmcnt; 15305a6d3416SJamal Hadi Salim }; 15315a6d3416SJamal Hadi Salim 1532d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1533d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 15342e71029eSTetsuo Handa int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1535d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1536d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1537d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1538d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1539d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1540d511337aSJoe Perches int __xfrm_init_state(struct xfrm_state *x, bool init_replay); 1541d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1542d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1543d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1544d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1545d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 15467026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb); 1547d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1548d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1549d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1550d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1551d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1552716062fdSHerbert Xu int encap_type); 1553d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1554d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 15551e295370SSteffen Klassert int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1556c4541b41SHerbert Xu 1557c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1558c4541b41SHerbert Xu { 155970be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15603328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15613328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15623328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1563c4541b41SHerbert Xu } 1564c4541b41SHerbert Xu 1565d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1566d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1567ede2059dSEric W. Biederman int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 15687026b1ddSDavid Miller int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb); 15693328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15703328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 15713328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1572d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1573d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1574d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1575d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1576d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 157763c43787SNicolas Dichtel int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 157863c43787SNicolas Dichtel struct ip6_tnl *t); 1579d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 158063c43787SNicolas Dichtel int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1581d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1582d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1583fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 15847b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 15857e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15867e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 15877e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1588d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 15897b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1590d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1591d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1592d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1593d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1594ede2059dSEric W. Biederman int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 15957026b1ddSDavid Miller int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb); 1596d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1597aee5adb4SMasahide NAKAMURA u8 **prevhdr); 15981da177e4SLinus Torvalds 15991da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1600d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1601d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1602d511337aSJoe Perches u8 __user *optval, int optlen); 16031da177e4SLinus Torvalds #else 16041da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 16051da177e4SLinus Torvalds { 16061da177e4SLinus Torvalds return -ENOPROTOOPT; 16071da177e4SLinus Torvalds } 16081da177e4SLinus Torvalds 1609067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 16101da177e4SLinus Torvalds { 16111da177e4SLinus Torvalds /* should not happen */ 16121da177e4SLinus Torvalds kfree_skb(skb); 16131da177e4SLinus Torvalds return 0; 16141da177e4SLinus Torvalds } 16151da177e4SLinus Torvalds #endif 16161da177e4SLinus Torvalds 16170331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 16184c563f76STimo Teras 1619d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1620d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1621d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1622d511337aSJoe Perches void *); 1623283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 16241da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 16258ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 16268ca2e93bSJamal Hadi Salim u8 type, int dir, 16274e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1628ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1629ef41aaa0SEric Paris int *err); 1630d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1631d511337aSJoe Perches u32 id, int delete, int *err); 16322e71029eSTetsuo Handa int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1633880a6fabSChristophe Gouault void xfrm_policy_hash_rebuild(struct net *net); 16341da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1635776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1636d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1637e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1638bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1639a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1640a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1641bd55775cSJamal Hadi Salim unsigned short family); 1642d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16431da177e4SLinus Torvalds 164480c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1645d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1646183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 1647183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 1648283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1649d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 165080c9abaaSShinta Sugimoto struct xfrm_migrate *m); 1651d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 165213c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16538d549c4fSFan Du struct xfrm_kmaddress *k, struct net *net); 165480c9abaaSShinta Sugimoto #endif 165580c9abaaSShinta Sugimoto 1656d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1657d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1658d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1659d511337aSJoe Perches xfrm_address_t *addr); 16601da177e4SLinus Torvalds 1661d511337aSJoe Perches void xfrm_input_init(void); 1662d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 16631da177e4SLinus Torvalds 1664d511337aSJoe Perches void xfrm_probe_algs(void); 1665d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1666d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1667d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1668d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1669d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1670d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1671d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1672d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1673d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1674d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1675d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 16761a6509d9SHerbert Xu int probe); 16771da177e4SLinus Torvalds 1678ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1679ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1680ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1681ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1682ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1683ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1684ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 168570e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 168670e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 168770e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 168870e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 168970e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 169070e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 169170e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 169270e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 169370e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 169470e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 169570e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 169670e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 169770e94e66SYOSHIFUJI Hideaki / 吉藤英明 169877d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 169977d8d7a6SHerbert Xu { 170077d8d7a6SHerbert Xu return index & 7; 170177d8d7a6SHerbert Xu } 170277d8d7a6SHerbert Xu 1703a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1704a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1705f8cd5488SJamal Hadi Salim { 1706be33690dSPatrick McHardy struct sock *nlsk; 1707be33690dSPatrick McHardy int ret = 0; 1708be33690dSPatrick McHardy 1709be33690dSPatrick McHardy rcu_read_lock(); 1710a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1711be33690dSPatrick McHardy if (nlsk) 1712be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1713be33690dSPatrick McHardy rcu_read_unlock(); 1714be33690dSPatrick McHardy return ret; 1715f8cd5488SJamal Hadi Salim } 17160f24558eSHoria Geanta 17170f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 17180f24558eSHoria Geanta { 17190f24558eSHoria Geanta struct sock *nlsk; 17200f24558eSHoria Geanta int ret = 0; 17210f24558eSHoria Geanta 17220f24558eSHoria Geanta rcu_read_lock(); 17230f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 17240f24558eSHoria Geanta if (nlsk) 17250f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 17260f24558eSHoria Geanta rcu_read_unlock(); 17270f24558eSHoria Geanta 17280f24558eSHoria Geanta return ret; 17290f24558eSHoria Geanta } 1730a6483b79SAlexey Dobriyan #endif 1731f8cd5488SJamal Hadi Salim 1732ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1733ee5c2317SSteffen Klassert { 1734ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1735ee5c2317SSteffen Klassert } 1736ee5c2317SSteffen Klassert 173785158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 17380f99be0dSEric Dumazet { 17390f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17400f99be0dSEric Dumazet } 17410f99be0dSEric Dumazet 174285158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17434447bb33SMartin Willi { 17444447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17454447bb33SMartin Willi } 17464447bb33SMartin Willi 17479736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17489736acf3SSteffen Klassert { 17499736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17509736acf3SSteffen Klassert } 17519736acf3SSteffen Klassert 175280c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1753af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1754af2f464eSSteffen Klassert struct xfrm_state *orig) 1755af2f464eSSteffen Klassert { 1756af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1757af2f464eSSteffen Klassert GFP_KERNEL); 1758af2f464eSSteffen Klassert if (!x->replay_esn) 1759af2f464eSSteffen Klassert return -ENOMEM; 1760af2f464eSSteffen Klassert 1761af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1762af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1763af2f464eSSteffen Klassert 1764af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1765af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1766af2f464eSSteffen Klassert GFP_KERNEL); 1767af2f464eSSteffen Klassert if (!x->preplay_esn) { 1768af2f464eSSteffen Klassert kfree(x->replay_esn); 1769af2f464eSSteffen Klassert return -ENOMEM; 1770af2f464eSSteffen Klassert } 1771af2f464eSSteffen Klassert 1772af2f464eSSteffen Klassert return 0; 1773af2f464eSSteffen Klassert } 1774af2f464eSSteffen Klassert 1775ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1776ee5c2317SSteffen Klassert { 1777ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1778ee5c2317SSteffen Klassert } 1779ee5c2317SSteffen Klassert 1780ee5c2317SSteffen Klassert 178180c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 178280c9abaaSShinta Sugimoto { 17830f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 178480c9abaaSShinta Sugimoto } 178580c9abaaSShinta Sugimoto 17864447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 17874447bb33SMartin Willi { 17884447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 17894447bb33SMartin Willi } 17904447bb33SMartin Willi 179180c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 179280c9abaaSShinta Sugimoto { 179380c9abaaSShinta Sugimoto int i; 179480c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 179580c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 179680c9abaaSShinta Sugimoto } 179780c9abaaSShinta Sugimoto 179880c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 179980c9abaaSShinta Sugimoto { 180080c9abaaSShinta Sugimoto int i; 180180c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 180280c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 180380c9abaaSShinta Sugimoto } 180480c9abaaSShinta Sugimoto #endif 1805f8cd5488SJamal Hadi Salim 1806def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 180700501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 180800501121SHerbert Xu { 180900501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 181000501121SHerbert Xu } 181154ef207aSSteffen Klassert static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 181254ef207aSSteffen Klassert { 181354ef207aSSteffen Klassert struct sec_path *sp = skb->sp; 181454ef207aSSteffen Klassert 181554ef207aSSteffen Klassert if (!sp || !sp->olen || sp->len != sp->olen) 181654ef207aSSteffen Klassert return NULL; 181754ef207aSSteffen Klassert 181854ef207aSSteffen Klassert return &sp->ovec[sp->olen - 1]; 181954ef207aSSteffen Klassert } 1820def8b4faSAlexey Dobriyan #endif 182100501121SHerbert Xu 1822bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1823bf825f81SJamal Hadi Salim { 1824bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 18254efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1826bf825f81SJamal Hadi Salim else 1827bf825f81SJamal Hadi Salim m->v = m->m = 0; 1828bf825f81SJamal Hadi Salim 1829bf825f81SJamal Hadi Salim return m->v & m->m; 1830bf825f81SJamal Hadi Salim } 1831bf825f81SJamal Hadi Salim 1832e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1833bf825f81SJamal Hadi Salim { 18341d1e34ddSDavid S. Miller int ret = 0; 1835bf825f81SJamal Hadi Salim 18361d1e34ddSDavid S. Miller if (m->m | m->v) 18371d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 18381d1e34ddSDavid S. Miller return ret; 1839bf825f81SJamal Hadi Salim } 1840bf825f81SJamal Hadi Salim 184170be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 184270be6c91SSteffen Klassert unsigned int family) 184370be6c91SSteffen Klassert { 184470be6c91SSteffen Klassert bool tunnel = false; 184570be6c91SSteffen Klassert 184670be6c91SSteffen Klassert switch(family) { 184770be6c91SSteffen Klassert case AF_INET: 184870be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 184970be6c91SSteffen Klassert tunnel = true; 185070be6c91SSteffen Klassert break; 185170be6c91SSteffen Klassert case AF_INET6: 185270be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 185370be6c91SSteffen Klassert tunnel = true; 185470be6c91SSteffen Klassert break; 185570be6c91SSteffen Klassert } 185670be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 185770be6c91SSteffen Klassert return -EINVAL; 185870be6c91SSteffen Klassert 185970be6c91SSteffen Klassert return 0; 186070be6c91SSteffen Klassert } 18611da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1862