11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 151da177e4SLinus Torvalds 161da177e4SLinus Torvalds #include <net/sock.h> 171da177e4SLinus Torvalds #include <net/dst.h> 18436a0a40SHerbert Xu #include <net/ip.h> 191da177e4SLinus Torvalds #include <net/route.h> 201da177e4SLinus Torvalds #include <net/ipv6.h> 211da177e4SLinus Torvalds #include <net/ip6_fib.h> 22558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 23558f82efSMasahide NAKAMURA #include <net/snmp.h> 24558f82efSMasahide NAKAMURA #endif 251da177e4SLinus Torvalds 26d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 27d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 28d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 29d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 30d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 33d3d6dd3aSMasahide NAKAMURA 341da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 35b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 36b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 37d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 38d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 391da177e4SLinus Torvalds 40558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 41558f82efSMasahide NAKAMURA DECLARE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics); 42558f82efSMasahide NAKAMURA #define XFRM_INC_STATS(field) SNMP_INC_STATS(xfrm_statistics, field) 43558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_BH(field) SNMP_INC_STATS_BH(xfrm_statistics, field) 44558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_USER(field) SNMP_INC_STATS_USER(xfrm_statistics, field) 45558f82efSMasahide NAKAMURA #else 46558f82efSMasahide NAKAMURA #define XFRM_INC_STATS(field) 47558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_BH(field) 48558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_USER(field) 49558f82efSMasahide NAKAMURA #endif 50558f82efSMasahide NAKAMURA 51f8cd5488SJamal Hadi Salim extern struct sock *xfrm_nl; 52f8cd5488SJamal Hadi Salim extern u32 sysctl_xfrm_aevent_etime; 53f8cd5488SJamal Hadi Salim extern u32 sysctl_xfrm_aevent_rseqth; 54a37ae408SPavel Emelyanov extern int sysctl_xfrm_larval_drop; 55a37ae408SPavel Emelyanov extern u32 sysctl_xfrm_acq_expires; 56f8cd5488SJamal Hadi Salim 574a3e2f71SArjan van de Ven extern struct mutex xfrm_cfg_mutex; 581da177e4SLinus Torvalds 591da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 601da177e4SLinus Torvalds ------------------------------------ 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds Basic objects: 631da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 641da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 651da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 661da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 691da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 701da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 711da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 741da177e4SLinus Torvalds 751da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 761da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 771da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 781da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 791da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 801da177e4SLinus Torvalds to a dst_entry returned to requestor. 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 831da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 841da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 851da177e4SLinus Torvalds |---. child .-> NULL 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 881da177e4SLinus Torvalds 891da177e4SLinus Torvalds 901da177e4SLinus Torvalds Resolution of xrfm_tmpl 911da177e4SLinus Torvalds ----------------------- 921da177e4SLinus Torvalds Template contains: 931da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 941da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 951da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 961da177e4SLinus Torvalds Q: allow to resolve security gateway? 971da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 981da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 991da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 1001da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 1011da177e4SLinus Torvalds 7. ->share Sharing mode. 1021da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 1031da177e4SLinus Torvalds flow id? 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1061da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1071da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1081da177e4SLinus Torvalds 1091da177e4SLinus Torvalds PROBLEMS: 1101da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1111da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1121da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1131da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1141da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1151da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1161da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1171da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1181da177e4SLinus Torvalds */ 1191da177e4SLinus Torvalds 1201da177e4SLinus Torvalds /* Full description of state of transformer. */ 1211da177e4SLinus Torvalds struct xfrm_state 1221da177e4SLinus Torvalds { 1234c563f76STimo Teras struct list_head all; 124abb81c4fSHerbert Xu union { 125abb81c4fSHerbert Xu struct list_head gclist; 1268f126e37SDavid S. Miller struct hlist_node bydst; 127abb81c4fSHerbert Xu }; 1288f126e37SDavid S. Miller struct hlist_node bysrc; 1298f126e37SDavid S. Miller struct hlist_node byspi; 1301da177e4SLinus Torvalds 1311da177e4SLinus Torvalds atomic_t refcnt; 1321da177e4SLinus Torvalds spinlock_t lock; 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds struct xfrm_id id; 1351da177e4SLinus Torvalds struct xfrm_selector sel; 1361da177e4SLinus Torvalds 1379d4a706dSDavid S. Miller u32 genid; 1389d4a706dSDavid S. Miller 1391da177e4SLinus Torvalds /* Key manger bits */ 1401da177e4SLinus Torvalds struct { 1411da177e4SLinus Torvalds u8 state; 1421da177e4SLinus Torvalds u8 dying; 1431da177e4SLinus Torvalds u32 seq; 1441da177e4SLinus Torvalds } km; 1451da177e4SLinus Torvalds 1461da177e4SLinus Torvalds /* Parameters of this state. */ 1471da177e4SLinus Torvalds struct { 1481da177e4SLinus Torvalds u32 reqid; 1491da177e4SLinus Torvalds u8 mode; 1501da177e4SLinus Torvalds u8 replay_window; 1511da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1521da177e4SLinus Torvalds u8 flags; 1531da177e4SLinus Torvalds u16 family; 1541da177e4SLinus Torvalds xfrm_address_t saddr; 1551da177e4SLinus Torvalds int header_len; 1561da177e4SLinus Torvalds int trailer_len; 1571da177e4SLinus Torvalds } props; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1601da177e4SLinus Torvalds 1611da177e4SLinus Torvalds /* Data for transformer */ 1621da177e4SLinus Torvalds struct xfrm_algo *aalg; 1631da177e4SLinus Torvalds struct xfrm_algo *ealg; 1641da177e4SLinus Torvalds struct xfrm_algo *calg; 1651a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 1661da177e4SLinus Torvalds 1671da177e4SLinus Torvalds /* Data for encapsulator */ 1681da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1691da177e4SLinus Torvalds 170060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 171060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 172060f02a3SNoriaki TAKAMIYA 1731da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1741da177e4SLinus Torvalds struct xfrm_state *tunnel; 1751da177e4SLinus Torvalds 1761da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1771da177e4SLinus Torvalds atomic_t tunnel_users; 1781da177e4SLinus Torvalds 1791da177e4SLinus Torvalds /* State for replay detection */ 1801da177e4SLinus Torvalds struct xfrm_replay_state replay; 1811da177e4SLinus Torvalds 182f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 183f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 184f8cd5488SJamal Hadi Salim 1852717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1862717096aSJamal Hadi Salim * moment 1872717096aSJamal Hadi Salim */ 1882717096aSJamal Hadi Salim u32 xflags; 1892717096aSJamal Hadi Salim 190f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 191f8cd5488SJamal Hadi Salim u32 replay_maxage; 192f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 193f8cd5488SJamal Hadi Salim 194f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 195f8cd5488SJamal Hadi Salim struct timer_list rtimer; 196f8cd5488SJamal Hadi Salim 1971da177e4SLinus Torvalds /* Statistics */ 1981da177e4SLinus Torvalds struct xfrm_stats stats; 1991da177e4SLinus Torvalds 2001da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2011da177e4SLinus Torvalds struct timer_list timer; 2021da177e4SLinus Torvalds 2039afaca05SMasahide NAKAMURA /* Last used time */ 204d26f3984SHerbert Xu unsigned long lastused; 2059afaca05SMasahide NAKAMURA 2061da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2071da177e4SLinus Torvalds * transformer. */ 208533cb5b0SEric Dumazet const struct xfrm_type *type; 20913996378SHerbert Xu struct xfrm_mode *inner_mode; 210df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 21113996378SHerbert Xu struct xfrm_mode *outer_mode; 2121da177e4SLinus Torvalds 213df71837dSTrent Jaeger /* Security context */ 214df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 215df71837dSTrent Jaeger 2161da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2171da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2181da177e4SLinus Torvalds void *data; 2191da177e4SLinus Torvalds }; 2201da177e4SLinus Torvalds 2212717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2222717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 2232717096aSJamal Hadi Salim 2241da177e4SLinus Torvalds enum { 2251da177e4SLinus Torvalds XFRM_STATE_VOID, 2261da177e4SLinus Torvalds XFRM_STATE_ACQ, 2271da177e4SLinus Torvalds XFRM_STATE_VALID, 2281da177e4SLinus Torvalds XFRM_STATE_ERROR, 2291da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2301da177e4SLinus Torvalds XFRM_STATE_DEAD 2311da177e4SLinus Torvalds }; 2321da177e4SLinus Torvalds 23326b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 23426b15dadSJamal Hadi Salim struct km_event 23526b15dadSJamal Hadi Salim { 236bf08867fSHerbert Xu union { 237bf08867fSHerbert Xu u32 hard; 238bf08867fSHerbert Xu u32 proto; 239bf08867fSHerbert Xu u32 byid; 240f8cd5488SJamal Hadi Salim u32 aevent; 241f7b6983fSMasahide NAKAMURA u32 type; 242bf08867fSHerbert Xu } data; 243bf08867fSHerbert Xu 24426b15dadSJamal Hadi Salim u32 seq; 24526b15dadSJamal Hadi Salim u32 pid; 24626b15dadSJamal Hadi Salim u32 event; 24726b15dadSJamal Hadi Salim }; 24826b15dadSJamal Hadi Salim 24925ee3286SHerbert Xu struct net_device; 2501da177e4SLinus Torvalds struct xfrm_type; 2511da177e4SLinus Torvalds struct xfrm_dst; 2521da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2531da177e4SLinus Torvalds unsigned short family; 2541da177e4SLinus Torvalds struct dst_ops *dst_ops; 2551da177e4SLinus Torvalds void (*garbage_collect)(void); 25666cdb3caSHerbert Xu struct dst_entry *(*dst_lookup)(int tos, xfrm_address_t *saddr, 25766cdb3caSHerbert Xu xfrm_address_t *daddr); 258a1e59abfSPatrick McHardy int (*get_saddr)(xfrm_address_t *saddr, xfrm_address_t *daddr); 2591da177e4SLinus Torvalds struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy); 2601da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 261d5422efeSHerbert Xu struct flowi *fl, 262d5422efeSHerbert Xu int reverse); 26325ee3286SHerbert Xu int (*get_tos)(struct flowi *fl); 264a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 265a1b05140SMasahide NAKAMURA struct dst_entry *dst, 266a1b05140SMasahide NAKAMURA int nfheader_len); 26725ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 26825ee3286SHerbert Xu struct net_device *dev); 2691da177e4SLinus Torvalds }; 2701da177e4SLinus Torvalds 2711da177e4SLinus Torvalds extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo); 2721da177e4SLinus Torvalds extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); 27326b15dadSJamal Hadi Salim extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); 27426b15dadSJamal Hadi Salim extern void km_state_notify(struct xfrm_state *x, struct km_event *c); 2751da177e4SLinus Torvalds 2761da177e4SLinus Torvalds struct xfrm_tmpl; 277980ebd25SJamal Hadi Salim extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 27853bc6b4dSJamal Hadi Salim extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid); 27953bc6b4dSJamal Hadi Salim extern int __xfrm_state_delete(struct xfrm_state *x); 28053bc6b4dSJamal Hadi Salim 2811da177e4SLinus Torvalds struct xfrm_state_afinfo { 28217c2a42aSHerbert Xu unsigned int family; 28336cf9acfSHerbert Xu unsigned int proto; 2848e3d716cSAl Viro __be16 eth_proto; 28517c2a42aSHerbert Xu struct module *owner; 286533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 287aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 288d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 2891da177e4SLinus Torvalds void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl, 2901da177e4SLinus Torvalds struct xfrm_tmpl *tmpl, 2911da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr); 29241a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 29341a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 294cdca7265SMiika Komu int (*output)(struct sk_buff *skb); 295227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 296227620e2SHerbert Xu struct sk_buff *skb); 29736cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 29836cf9acfSHerbert Xu struct sk_buff *skb); 299716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 300716062fdSHerbert Xu int async); 3011da177e4SLinus Torvalds }; 3021da177e4SLinus Torvalds 3031da177e4SLinus Torvalds extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 3041da177e4SLinus Torvalds extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 3051da177e4SLinus Torvalds 3061da177e4SLinus Torvalds extern void xfrm_state_delete_tunnel(struct xfrm_state *x); 3071da177e4SLinus Torvalds 3081da177e4SLinus Torvalds struct xfrm_type 3091da177e4SLinus Torvalds { 3101da177e4SLinus Torvalds char *description; 3111da177e4SLinus Torvalds struct module *owner; 3121da177e4SLinus Torvalds __u8 proto; 3131b5c2299SMasahide NAKAMURA __u8 flags; 3141b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 315436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 316f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 317f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3181da177e4SLinus Torvalds 31972cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3201da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 321e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3221da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 323df0ba92aSMasahide NAKAMURA int (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *); 324aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3251da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 326c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3271da177e4SLinus Torvalds }; 3281da177e4SLinus Torvalds 329533cb5b0SEric Dumazet extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 330533cb5b0SEric Dumazet extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3311da177e4SLinus Torvalds 332b59f45d0SHerbert Xu struct xfrm_mode { 333227620e2SHerbert Xu /* 334227620e2SHerbert Xu * Remove encapsulation header. 335227620e2SHerbert Xu * 336227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 337227620e2SHerbert Xu * header. 338227620e2SHerbert Xu * 339227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 340227620e2SHerbert Xu * should be and the network header shall be set to where the IP 341227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 342227620e2SHerbert Xu * payload. 343227620e2SHerbert Xu */ 344227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 345227620e2SHerbert Xu 346227620e2SHerbert Xu /* 347227620e2SHerbert Xu * This is the actual input entry point. 348227620e2SHerbert Xu * 349227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 350227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 351227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 352227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 353227620e2SHerbert Xu */ 354b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 35537fedd3aSHerbert Xu 35637fedd3aSHerbert Xu /* 35737fedd3aSHerbert Xu * Add encapsulation header. 35837fedd3aSHerbert Xu * 35937fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 36037fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 36137fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 36237fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 36337fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 36437fedd3aSHerbert Xu * header. The value of the network header will always point 36537fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 36637fedd3aSHerbert Xu */ 36736cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 36836cf9acfSHerbert Xu 36936cf9acfSHerbert Xu /* 37036cf9acfSHerbert Xu * This is the actual output entry point. 37136cf9acfSHerbert Xu * 37236cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 37336cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 37436cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 37536cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 37636cf9acfSHerbert Xu * call output2. 37736cf9acfSHerbert Xu */ 378eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 379b59f45d0SHerbert Xu 38017c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 381b59f45d0SHerbert Xu struct module *owner; 382b59f45d0SHerbert Xu unsigned int encap; 3831bfcb10fSHerbert Xu int flags; 3841bfcb10fSHerbert Xu }; 3851bfcb10fSHerbert Xu 3861bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 3871bfcb10fSHerbert Xu enum { 3881bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 389b59f45d0SHerbert Xu }; 390b59f45d0SHerbert Xu 391b59f45d0SHerbert Xu extern int xfrm_register_mode(struct xfrm_mode *mode, int family); 392b59f45d0SHerbert Xu extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 393b59f45d0SHerbert Xu 394df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 395df9dcb45SKazunori MIYAZAWA { 396df9dcb45SKazunori MIYAZAWA switch(family) { 397df9dcb45SKazunori MIYAZAWA case AF_INET: 398df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 399df9dcb45SKazunori MIYAZAWA case AF_INET6: 400df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 401df9dcb45SKazunori MIYAZAWA default: 402df9dcb45SKazunori MIYAZAWA return 0; 403df9dcb45SKazunori MIYAZAWA } 404df9dcb45SKazunori MIYAZAWA } 405df9dcb45SKazunori MIYAZAWA 406df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 407df9dcb45SKazunori MIYAZAWA { 408df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 409df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 410df9dcb45SKazunori MIYAZAWA return x->inner_mode; 411df9dcb45SKazunori MIYAZAWA else 412df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 413df9dcb45SKazunori MIYAZAWA } 414df9dcb45SKazunori MIYAZAWA 4151da177e4SLinus Torvalds struct xfrm_tmpl 4161da177e4SLinus Torvalds { 4171da177e4SLinus Torvalds /* id in template is interpreted as: 4181da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4191da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4201da177e4SLinus Torvalds * daddr must be fixed too. 4211da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4221da177e4SLinus Torvalds */ 4231da177e4SLinus Torvalds struct xfrm_id id; 4241da177e4SLinus Torvalds 4251da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4261da177e4SLinus Torvalds xfrm_address_t saddr; 4271da177e4SLinus Torvalds 42876b3f055SMiika Komu unsigned short encap_family; 42976b3f055SMiika Komu 4301da177e4SLinus Torvalds __u32 reqid; 4311da177e4SLinus Torvalds 4327e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 4331da177e4SLinus Torvalds __u8 mode; 4341da177e4SLinus Torvalds 4351da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 4361da177e4SLinus Torvalds __u8 share; 4371da177e4SLinus Torvalds 4381da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 4391da177e4SLinus Torvalds __u8 optional; 4401da177e4SLinus Torvalds 441c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 442c5d18e98SHerbert Xu __u8 allalgs; 443c5d18e98SHerbert Xu 4441da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 4451da177e4SLinus Torvalds __u32 aalgos; 4461da177e4SLinus Torvalds __u32 ealgos; 4471da177e4SLinus Torvalds __u32 calgos; 4481da177e4SLinus Torvalds }; 4491da177e4SLinus Torvalds 450622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 4511da177e4SLinus Torvalds 4521da177e4SLinus Torvalds struct xfrm_policy 4531da177e4SLinus Torvalds { 4541da177e4SLinus Torvalds struct xfrm_policy *next; 4554c563f76STimo Teras struct list_head bytype; 4562518c7c2SDavid S. Miller struct hlist_node bydst; 4572518c7c2SDavid S. Miller struct hlist_node byidx; 4581da177e4SLinus Torvalds 4591da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 4601da177e4SLinus Torvalds rwlock_t lock; 4611da177e4SLinus Torvalds atomic_t refcnt; 4621da177e4SLinus Torvalds struct timer_list timer; 4631da177e4SLinus Torvalds 4641da177e4SLinus Torvalds u32 priority; 4651da177e4SLinus Torvalds u32 index; 4661da177e4SLinus Torvalds struct xfrm_selector selector; 4671da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 4681da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 4691da177e4SLinus Torvalds struct dst_entry *bundles; 47046ca5f5dSArnaldo Carvalho de Melo u16 family; 47146ca5f5dSArnaldo Carvalho de Melo u8 type; 47246ca5f5dSArnaldo Carvalho de Melo u8 action; 47346ca5f5dSArnaldo Carvalho de Melo u8 flags; 47446ca5f5dSArnaldo Carvalho de Melo u8 dead; 47546ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 47646ca5f5dSArnaldo Carvalho de Melo /* XXX 1 byte hole, try to pack */ 477df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 4781da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 4791da177e4SLinus Torvalds }; 4801da177e4SLinus Torvalds 48180c9abaaSShinta Sugimoto struct xfrm_migrate { 48280c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 48380c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 48480c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 48580c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 48680c9abaaSShinta Sugimoto u8 proto; 48780c9abaaSShinta Sugimoto u8 mode; 48880c9abaaSShinta Sugimoto u16 reserved; 48980c9abaaSShinta Sugimoto u32 reqid; 49080c9abaaSShinta Sugimoto u16 old_family; 49180c9abaaSShinta Sugimoto u16 new_family; 49280c9abaaSShinta Sugimoto }; 49380c9abaaSShinta Sugimoto 4941da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 495f8cd5488SJamal Hadi Salim /* which seqno */ 496f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_SEQ 1 497f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_OSEQ 2 498f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_SEQ_MASK 3 499f8cd5488SJamal Hadi Salim /* what happened */ 500f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 501f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 502f8cd5488SJamal Hadi Salim 503f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 504f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 505f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 506f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 507f8cd5488SJamal Hadi Salim /* default seq threshold size */ 508f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 5091da177e4SLinus Torvalds 5101da177e4SLinus Torvalds struct xfrm_mgr 5111da177e4SLinus Torvalds { 5121da177e4SLinus Torvalds struct list_head list; 5131da177e4SLinus Torvalds char *id; 51426b15dadSJamal Hadi Salim int (*notify)(struct xfrm_state *x, struct km_event *c); 5151da177e4SLinus Torvalds int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir); 516cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 5175d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 51826b15dadSJamal Hadi Salim int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c); 51997a64b45SMasahide NAKAMURA int (*report)(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 52080c9abaaSShinta Sugimoto int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles); 5211da177e4SLinus Torvalds }; 5221da177e4SLinus Torvalds 5231da177e4SLinus Torvalds extern int xfrm_register_km(struct xfrm_mgr *km); 5241da177e4SLinus Torvalds extern int xfrm_unregister_km(struct xfrm_mgr *km); 5251da177e4SLinus Torvalds 5262518c7c2SDavid S. Miller extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2]; 5271da177e4SLinus Torvalds 528436a0a40SHerbert Xu /* 529436a0a40SHerbert Xu * This structure is used for the duration where packets are being 530436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 531436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 532436a0a40SHerbert Xu */ 533436a0a40SHerbert Xu struct xfrm_skb_cb { 534436a0a40SHerbert Xu union { 535436a0a40SHerbert Xu struct inet_skb_parm h4; 536436a0a40SHerbert Xu struct inet6_skb_parm h6; 537436a0a40SHerbert Xu } header; 538436a0a40SHerbert Xu 539436a0a40SHerbert Xu /* Sequence number for replay protection. */ 540b318e0e4SHerbert Xu union { 541b318e0e4SHerbert Xu u64 output; 542b318e0e4SHerbert Xu __be32 input; 543b318e0e4SHerbert Xu } seq; 544436a0a40SHerbert Xu }; 545436a0a40SHerbert Xu 546436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 547436a0a40SHerbert Xu 54836cf9acfSHerbert Xu /* 54936cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 55036cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 55136cf9acfSHerbert Xu */ 55236cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 55336cf9acfSHerbert Xu union { 55436cf9acfSHerbert Xu struct inet_skb_parm h4; 55536cf9acfSHerbert Xu struct inet6_skb_parm h6; 55636cf9acfSHerbert Xu } header; 55736cf9acfSHerbert Xu 55836cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 55936cf9acfSHerbert Xu __be16 id; 56036cf9acfSHerbert Xu __be16 frag_off; 56136cf9acfSHerbert Xu 562732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 563732c8bd5SHerbert Xu u8 ihl; 564732c8bd5SHerbert Xu 56536cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 56636cf9acfSHerbert Xu u8 tos; 56736cf9acfSHerbert Xu 56836cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 56936cf9acfSHerbert Xu u8 ttl; 57036cf9acfSHerbert Xu 57136cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 57236cf9acfSHerbert Xu u8 protocol; 57336cf9acfSHerbert Xu 574732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 575732c8bd5SHerbert Xu u8 optlen; 576732c8bd5SHerbert Xu 57736cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 57836cf9acfSHerbert Xu u8 flow_lbl[3]; 57936cf9acfSHerbert Xu }; 58036cf9acfSHerbert Xu 58136cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 58236cf9acfSHerbert Xu 583716062fdSHerbert Xu /* 584716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 585716062fdSHerbert Xu * related information. 586716062fdSHerbert Xu */ 587716062fdSHerbert Xu struct xfrm_spi_skb_cb { 588716062fdSHerbert Xu union { 589716062fdSHerbert Xu struct inet_skb_parm h4; 590716062fdSHerbert Xu struct inet6_skb_parm h6; 591716062fdSHerbert Xu } header; 592716062fdSHerbert Xu 593716062fdSHerbert Xu unsigned int daddroff; 5942fcb45b6SHerbert Xu unsigned int family; 595716062fdSHerbert Xu }; 596716062fdSHerbert Xu 597716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 598716062fdSHerbert Xu 599161a09e7SJoy Latten /* Audit Information */ 600161a09e7SJoy Latten struct xfrm_audit 601161a09e7SJoy Latten { 602161a09e7SJoy Latten u32 secid; 6032532386fSEric Paris uid_t loginuid; 6042532386fSEric Paris u32 sessionid; 605161a09e7SJoy Latten }; 606c9204d9cSJoy Latten 607c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 608afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 609ab5f5e8bSJoy Latten { 610ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 611ab5f5e8bSJoy Latten 612afeb14b4SPaul Moore if (audit_enabled == 0) 613afeb14b4SPaul Moore return NULL; 614ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 615ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 616ab5f5e8bSJoy Latten if (audit_buf == NULL) 617ab5f5e8bSJoy Latten return NULL; 618afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 619afeb14b4SPaul Moore return audit_buf; 620afeb14b4SPaul Moore } 621afeb14b4SPaul Moore 6222532386fSEric Paris static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid, 623afeb14b4SPaul Moore struct audit_buffer *audit_buf) 624afeb14b4SPaul Moore { 625afeb14b4SPaul Moore char *secctx; 626afeb14b4SPaul Moore u32 secctx_len; 627ab5f5e8bSJoy Latten 6282532386fSEric Paris audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 62968277accSPaul Moore if (secid != 0 && 63068277accSPaul Moore security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) { 631ab5f5e8bSJoy Latten audit_log_format(audit_buf, " subj=%s", secctx); 632ab5f5e8bSJoy Latten security_release_secctx(secctx, secctx_len); 633ab5f5e8bSJoy Latten } else 634ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 635ab5f5e8bSJoy Latten } 636ab5f5e8bSJoy Latten 637ab5f5e8bSJoy Latten extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 6382532386fSEric Paris u32 auid, u32 ses, u32 secid); 639ab5f5e8bSJoy Latten extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 6402532386fSEric Paris u32 auid, u32 ses, u32 secid); 641ab5f5e8bSJoy Latten extern void xfrm_audit_state_add(struct xfrm_state *x, int result, 6422532386fSEric Paris u32 auid, u32 ses, u32 secid); 643ab5f5e8bSJoy Latten extern void xfrm_audit_state_delete(struct xfrm_state *x, int result, 6442532386fSEric Paris u32 auid, u32 ses, u32 secid); 645afeb14b4SPaul Moore extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 646afeb14b4SPaul Moore struct sk_buff *skb); 647afeb14b4SPaul Moore extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 648afeb14b4SPaul Moore extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 649afeb14b4SPaul Moore __be32 net_spi, __be32 net_seq); 650afeb14b4SPaul Moore extern void xfrm_audit_state_icvfail(struct xfrm_state *x, 651afeb14b4SPaul Moore struct sk_buff *skb, u8 proto); 652c9204d9cSJoy Latten #else 65341fef0eeSMarcin Slusarz 65441fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 65541fef0eeSMarcin Slusarz u32 auid, u32 ses, u32 secid) 65641fef0eeSMarcin Slusarz { 65741fef0eeSMarcin Slusarz } 65841fef0eeSMarcin Slusarz 65941fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 66041fef0eeSMarcin Slusarz u32 auid, u32 ses, u32 secid) 66141fef0eeSMarcin Slusarz { 66241fef0eeSMarcin Slusarz } 66341fef0eeSMarcin Slusarz 66441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 66541fef0eeSMarcin Slusarz u32 auid, u32 ses, u32 secid) 66641fef0eeSMarcin Slusarz { 66741fef0eeSMarcin Slusarz } 66841fef0eeSMarcin Slusarz 66941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 67041fef0eeSMarcin Slusarz u32 auid, u32 ses, u32 secid) 67141fef0eeSMarcin Slusarz { 67241fef0eeSMarcin Slusarz } 67341fef0eeSMarcin Slusarz 67441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 67541fef0eeSMarcin Slusarz struct sk_buff *skb) 67641fef0eeSMarcin Slusarz { 67741fef0eeSMarcin Slusarz } 67841fef0eeSMarcin Slusarz 67941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 68041fef0eeSMarcin Slusarz u16 family) 68141fef0eeSMarcin Slusarz { 68241fef0eeSMarcin Slusarz } 68341fef0eeSMarcin Slusarz 68441fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 68541fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 68641fef0eeSMarcin Slusarz { 68741fef0eeSMarcin Slusarz } 68841fef0eeSMarcin Slusarz 68941fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 69041fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 69141fef0eeSMarcin Slusarz { 69241fef0eeSMarcin Slusarz } 693c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 694161a09e7SJoy Latten 6951da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 6961da177e4SLinus Torvalds { 6971da177e4SLinus Torvalds if (likely(policy != NULL)) 6981da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 6991da177e4SLinus Torvalds } 7001da177e4SLinus Torvalds 70164c31b3fSWANG Cong extern void xfrm_policy_destroy(struct xfrm_policy *policy); 7021da177e4SLinus Torvalds 7031da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 7041da177e4SLinus Torvalds { 7051da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 70664c31b3fSWANG Cong xfrm_policy_destroy(policy); 7071da177e4SLinus Torvalds } 7081da177e4SLinus Torvalds 7094e81bb83SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 7104e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 7114e81bb83SMasahide NAKAMURA { 7124e81bb83SMasahide NAKAMURA int i; 7134e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 7144e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 7154e81bb83SMasahide NAKAMURA } 7164e81bb83SMasahide NAKAMURA #else 7174e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 7184e81bb83SMasahide NAKAMURA { 7194e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[0]); 7204e81bb83SMasahide NAKAMURA } 7214e81bb83SMasahide NAKAMURA #endif 7224e81bb83SMasahide NAKAMURA 7231da177e4SLinus Torvalds extern void __xfrm_state_destroy(struct xfrm_state *); 7241da177e4SLinus Torvalds 72521380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 72621380b81SHerbert Xu { 72721380b81SHerbert Xu atomic_dec(&x->refcnt); 72821380b81SHerbert Xu } 72921380b81SHerbert Xu 7301da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 7311da177e4SLinus Torvalds { 7321da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 7331da177e4SLinus Torvalds __xfrm_state_destroy(x); 7341da177e4SLinus Torvalds } 7351da177e4SLinus Torvalds 7361da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 7371da177e4SLinus Torvalds { 7381da177e4SLinus Torvalds atomic_inc(&x->refcnt); 7391da177e4SLinus Torvalds } 7401da177e4SLinus Torvalds 7411da177e4SLinus Torvalds static __inline__ int addr_match(void *token1, void *token2, int prefixlen) 7421da177e4SLinus Torvalds { 7435f19343fSAl Viro __be32 *a1 = token1; 7445f19343fSAl Viro __be32 *a2 = token2; 7451da177e4SLinus Torvalds int pdw; 7461da177e4SLinus Torvalds int pbi; 7471da177e4SLinus Torvalds 7481da177e4SLinus Torvalds pdw = prefixlen >> 5; /* num of whole __u32 in prefix */ 7491da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 7501da177e4SLinus Torvalds 7511da177e4SLinus Torvalds if (pdw) 7521da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 7531da177e4SLinus Torvalds return 0; 7541da177e4SLinus Torvalds 7551da177e4SLinus Torvalds if (pbi) { 7565f19343fSAl Viro __be32 mask; 7571da177e4SLinus Torvalds 7581da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 7591da177e4SLinus Torvalds 7601da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 7611da177e4SLinus Torvalds return 0; 7621da177e4SLinus Torvalds } 7631da177e4SLinus Torvalds 7641da177e4SLinus Torvalds return 1; 7651da177e4SLinus Torvalds } 7661da177e4SLinus Torvalds 7671da177e4SLinus Torvalds static __inline__ 768f9d07e41SAl Viro __be16 xfrm_flowi_sport(struct flowi *fl) 7691da177e4SLinus Torvalds { 770f9d07e41SAl Viro __be16 port; 7711da177e4SLinus Torvalds switch(fl->proto) { 7721da177e4SLinus Torvalds case IPPROTO_TCP: 7731da177e4SLinus Torvalds case IPPROTO_UDP: 774ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 7751da177e4SLinus Torvalds case IPPROTO_SCTP: 7761da177e4SLinus Torvalds port = fl->fl_ip_sport; 7771da177e4SLinus Torvalds break; 7781da177e4SLinus Torvalds case IPPROTO_ICMP: 7791da177e4SLinus Torvalds case IPPROTO_ICMPV6: 7801da177e4SLinus Torvalds port = htons(fl->fl_icmp_type); 7811da177e4SLinus Torvalds break; 7822ce4272aSMasahide NAKAMURA case IPPROTO_MH: 7832ce4272aSMasahide NAKAMURA port = htons(fl->fl_mh_type); 7842ce4272aSMasahide NAKAMURA break; 7851da177e4SLinus Torvalds default: 7861da177e4SLinus Torvalds port = 0; /*XXX*/ 7871da177e4SLinus Torvalds } 7881da177e4SLinus Torvalds return port; 7891da177e4SLinus Torvalds } 7901da177e4SLinus Torvalds 7911da177e4SLinus Torvalds static __inline__ 792f9d07e41SAl Viro __be16 xfrm_flowi_dport(struct flowi *fl) 7931da177e4SLinus Torvalds { 794f9d07e41SAl Viro __be16 port; 7951da177e4SLinus Torvalds switch(fl->proto) { 7961da177e4SLinus Torvalds case IPPROTO_TCP: 7971da177e4SLinus Torvalds case IPPROTO_UDP: 798ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 7991da177e4SLinus Torvalds case IPPROTO_SCTP: 8001da177e4SLinus Torvalds port = fl->fl_ip_dport; 8011da177e4SLinus Torvalds break; 8021da177e4SLinus Torvalds case IPPROTO_ICMP: 8031da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8041da177e4SLinus Torvalds port = htons(fl->fl_icmp_code); 8051da177e4SLinus Torvalds break; 8061da177e4SLinus Torvalds default: 8071da177e4SLinus Torvalds port = 0; /*XXX*/ 8081da177e4SLinus Torvalds } 8091da177e4SLinus Torvalds return port; 8101da177e4SLinus Torvalds } 8111da177e4SLinus Torvalds 81277681021SAndrew Morton extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 81377681021SAndrew Morton unsigned short family); 8141da177e4SLinus Torvalds 815df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 816df71837dSTrent Jaeger /* If neither has a context --> match 817df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 818df71837dSTrent Jaeger */ 819df71837dSTrent Jaeger static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 820df71837dSTrent Jaeger { 821df71837dSTrent Jaeger return ((!s1 && !s2) || 822df71837dSTrent Jaeger (s1 && s2 && 823df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 824df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 825df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 826df71837dSTrent Jaeger } 827df71837dSTrent Jaeger #else 828df71837dSTrent Jaeger static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 829df71837dSTrent Jaeger { 830df71837dSTrent Jaeger return 1; 831df71837dSTrent Jaeger } 832df71837dSTrent Jaeger #endif 833df71837dSTrent Jaeger 8341da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 8351da177e4SLinus Torvalds * 8361da177e4SLinus Torvalds * dst->child points to the next element of bundle. 8371da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 8381da177e4SLinus Torvalds * 8391da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 8401da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 8411da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 8421da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 8431da177e4SLinus Torvalds * policy rule. 8441da177e4SLinus Torvalds */ 8451da177e4SLinus Torvalds struct xfrm_dst 8461da177e4SLinus Torvalds { 8471da177e4SLinus Torvalds union { 8481da177e4SLinus Torvalds struct dst_entry dst; 8491da177e4SLinus Torvalds struct rtable rt; 8501da177e4SLinus Torvalds struct rt6_info rt6; 8511da177e4SLinus Torvalds } u; 8521da177e4SLinus Torvalds struct dst_entry *route; 853157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 854157bfc25SMasahide NAKAMURA struct flowi *origin; 855157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 856157bfc25SMasahide NAKAMURA #endif 8579d4a706dSDavid S. Miller u32 genid; 8581da177e4SLinus Torvalds u32 route_mtu_cached; 8591da177e4SLinus Torvalds u32 child_mtu_cached; 86092d63decSHideaki YOSHIFUJI u32 route_cookie; 86192d63decSHideaki YOSHIFUJI u32 path_cookie; 8621da177e4SLinus Torvalds }; 8631da177e4SLinus Torvalds 864aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 865aabc9761SHerbert Xu { 866aabc9761SHerbert Xu dst_release(xdst->route); 867aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 868aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 869157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 870157bfc25SMasahide NAKAMURA kfree(xdst->origin); 871157bfc25SMasahide NAKAMURA xdst->origin = NULL; 872157bfc25SMasahide NAKAMURA kfree(xdst->partner); 873157bfc25SMasahide NAKAMURA xdst->partner = NULL; 874157bfc25SMasahide NAKAMURA #endif 875aabc9761SHerbert Xu } 876aabc9761SHerbert Xu 877aabc9761SHerbert Xu extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 878aabc9761SHerbert Xu 8791da177e4SLinus Torvalds struct sec_path 8801da177e4SLinus Torvalds { 8811da177e4SLinus Torvalds atomic_t refcnt; 8821da177e4SLinus Torvalds int len; 883dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 8841da177e4SLinus Torvalds }; 8851da177e4SLinus Torvalds 8861da177e4SLinus Torvalds static inline struct sec_path * 8871da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 8881da177e4SLinus Torvalds { 8891da177e4SLinus Torvalds if (sp) 8901da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 8911da177e4SLinus Torvalds return sp; 8921da177e4SLinus Torvalds } 8931da177e4SLinus Torvalds 8941da177e4SLinus Torvalds extern void __secpath_destroy(struct sec_path *sp); 8951da177e4SLinus Torvalds 8961da177e4SLinus Torvalds static inline void 8971da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 8981da177e4SLinus Torvalds { 8991da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 9001da177e4SLinus Torvalds __secpath_destroy(sp); 9011da177e4SLinus Torvalds } 9021da177e4SLinus Torvalds 9031da177e4SLinus Torvalds extern struct sec_path *secpath_dup(struct sec_path *src); 9041da177e4SLinus Torvalds 9051da177e4SLinus Torvalds static inline void 9061da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 9071da177e4SLinus Torvalds { 9081da177e4SLinus Torvalds #ifdef CONFIG_XFRM 9091da177e4SLinus Torvalds secpath_put(skb->sp); 9101da177e4SLinus Torvalds skb->sp = NULL; 9111da177e4SLinus Torvalds #endif 9121da177e4SLinus Torvalds } 9131da177e4SLinus Torvalds 9141da177e4SLinus Torvalds static inline int 915a1e59abfSPatrick McHardy xfrm_addr_any(xfrm_address_t *addr, unsigned short family) 916a1e59abfSPatrick McHardy { 917a1e59abfSPatrick McHardy switch (family) { 918a1e59abfSPatrick McHardy case AF_INET: 919a1e59abfSPatrick McHardy return addr->a4 == 0; 920a1e59abfSPatrick McHardy case AF_INET6: 921a1e59abfSPatrick McHardy return ipv6_addr_any((struct in6_addr *)&addr->a6); 922a1e59abfSPatrick McHardy } 923a1e59abfSPatrick McHardy return 0; 924a1e59abfSPatrick McHardy } 925a1e59abfSPatrick McHardy 926a1e59abfSPatrick McHardy static inline int 9271da177e4SLinus Torvalds __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 9281da177e4SLinus Torvalds { 9291da177e4SLinus Torvalds return (tmpl->saddr.a4 && 9301da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 9311da177e4SLinus Torvalds } 9321da177e4SLinus Torvalds 9331da177e4SLinus Torvalds static inline int 9341da177e4SLinus Torvalds __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 9351da177e4SLinus Torvalds { 9361da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 9371da177e4SLinus Torvalds ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 9381da177e4SLinus Torvalds } 9391da177e4SLinus Torvalds 9401da177e4SLinus Torvalds static inline int 9411da177e4SLinus Torvalds xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family) 9421da177e4SLinus Torvalds { 9431da177e4SLinus Torvalds switch (family) { 9441da177e4SLinus Torvalds case AF_INET: 9451da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 9461da177e4SLinus Torvalds case AF_INET6: 9471da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 9481da177e4SLinus Torvalds } 9491da177e4SLinus Torvalds return !0; 9501da177e4SLinus Torvalds } 9511da177e4SLinus Torvalds 9521da177e4SLinus Torvalds #ifdef CONFIG_XFRM 9531da177e4SLinus Torvalds extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family); 9541da177e4SLinus Torvalds 955d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 956d5422efeSHerbert Xu struct sk_buff *skb, 957d5422efeSHerbert Xu unsigned int family, int reverse) 9581da177e4SLinus Torvalds { 959d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 960d5422efeSHerbert Xu 9611da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 962d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 9631da177e4SLinus Torvalds 9642518c7c2SDavid S. Miller return (!xfrm_policy_count[dir] && !skb->sp) || 9651da177e4SLinus Torvalds (skb->dst->flags & DST_NOPOLICY) || 966d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 967d5422efeSHerbert Xu } 968d5422efeSHerbert Xu 969d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 970d5422efeSHerbert Xu { 971d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 9721da177e4SLinus Torvalds } 9731da177e4SLinus Torvalds 9741da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 9751da177e4SLinus Torvalds { 9761da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 9771da177e4SLinus Torvalds } 9781da177e4SLinus Torvalds 9791da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 9801da177e4SLinus Torvalds { 9811da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 9821da177e4SLinus Torvalds } 9831da177e4SLinus Torvalds 984d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 985d5422efeSHerbert Xu struct sk_buff *skb) 986d5422efeSHerbert Xu { 987d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 988d5422efeSHerbert Xu } 989d5422efeSHerbert Xu 990d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 991d5422efeSHerbert Xu struct sk_buff *skb) 992d5422efeSHerbert Xu { 993d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 994d5422efeSHerbert Xu } 995d5422efeSHerbert Xu 996d5422efeSHerbert Xu extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 997d5422efeSHerbert Xu unsigned int family, int reverse); 998d5422efeSHerbert Xu 999d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1000d5422efeSHerbert Xu unsigned int family) 1001d5422efeSHerbert Xu { 1002d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1003d5422efeSHerbert Xu } 1004d5422efeSHerbert Xu 1005d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1006d5422efeSHerbert Xu struct flowi *fl, 1007d5422efeSHerbert Xu unsigned int family) 1008d5422efeSHerbert Xu { 1009d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1010d5422efeSHerbert Xu } 1011d5422efeSHerbert Xu 10121da177e4SLinus Torvalds extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 10131da177e4SLinus Torvalds 10141da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 10151da177e4SLinus Torvalds { 10162518c7c2SDavid S. Miller return !xfrm_policy_count[XFRM_POLICY_OUT] || 10171da177e4SLinus Torvalds (skb->dst->flags & DST_NOXFRM) || 10181da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 10191da177e4SLinus Torvalds } 10201da177e4SLinus Torvalds 10211da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 10221da177e4SLinus Torvalds { 10231da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 10241da177e4SLinus Torvalds } 10251da177e4SLinus Torvalds 10261da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 10271da177e4SLinus Torvalds { 10281da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 10291da177e4SLinus Torvalds } 10301da177e4SLinus Torvalds 10311da177e4SLinus Torvalds extern int __xfrm_sk_clone_policy(struct sock *sk); 10321da177e4SLinus Torvalds 10331da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) 10341da177e4SLinus Torvalds { 10351da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] || sk->sk_policy[1])) 10361da177e4SLinus Torvalds return __xfrm_sk_clone_policy(sk); 10371da177e4SLinus Torvalds return 0; 10381da177e4SLinus Torvalds } 10391da177e4SLinus Torvalds 10404666faabSHerbert Xu extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 10411da177e4SLinus Torvalds 10421da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 10431da177e4SLinus Torvalds { 10441da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] != NULL)) { 10451da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX); 10461da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 10471da177e4SLinus Torvalds } 10481da177e4SLinus Torvalds if (unlikely(sk->sk_policy[1] != NULL)) { 10491da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1); 10501da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 10511da177e4SLinus Torvalds } 10521da177e4SLinus Torvalds } 10531da177e4SLinus Torvalds 10541da177e4SLinus Torvalds #else 10551da177e4SLinus Torvalds 10561da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 10571da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; } 10581da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 10591da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 10601da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10611da177e4SLinus Torvalds { 10621da177e4SLinus Torvalds return 1; 10631da177e4SLinus Torvalds } 10641da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10651da177e4SLinus Torvalds { 10661da177e4SLinus Torvalds return 1; 10671da177e4SLinus Torvalds } 10681da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 10691da177e4SLinus Torvalds { 10701da177e4SLinus Torvalds return 1; 10711da177e4SLinus Torvalds } 1072d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1073d5422efeSHerbert Xu struct flowi *fl, 1074d5422efeSHerbert Xu unsigned int family) 1075d5422efeSHerbert Xu { 1076d5422efeSHerbert Xu return -ENOSYS; 1077d5422efeSHerbert Xu } 1078d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1079d5422efeSHerbert Xu struct sk_buff *skb) 1080d5422efeSHerbert Xu { 1081d5422efeSHerbert Xu return 1; 1082d5422efeSHerbert Xu } 1083d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1084d5422efeSHerbert Xu struct sk_buff *skb) 1085d5422efeSHerbert Xu { 1086d5422efeSHerbert Xu return 1; 1087d5422efeSHerbert Xu } 10881da177e4SLinus Torvalds #endif 10891da177e4SLinus Torvalds 10901da177e4SLinus Torvalds static __inline__ 10911da177e4SLinus Torvalds xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family) 10921da177e4SLinus Torvalds { 10931da177e4SLinus Torvalds switch (family){ 10941da177e4SLinus Torvalds case AF_INET: 10951da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl4_dst; 10961da177e4SLinus Torvalds case AF_INET6: 10971da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl6_dst; 10981da177e4SLinus Torvalds } 10991da177e4SLinus Torvalds return NULL; 11001da177e4SLinus Torvalds } 11011da177e4SLinus Torvalds 11021da177e4SLinus Torvalds static __inline__ 11031da177e4SLinus Torvalds xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family) 11041da177e4SLinus Torvalds { 11051da177e4SLinus Torvalds switch (family){ 11061da177e4SLinus Torvalds case AF_INET: 11071da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl4_src; 11081da177e4SLinus Torvalds case AF_INET6: 11091da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl6_src; 11101da177e4SLinus Torvalds } 11111da177e4SLinus Torvalds return NULL; 11121da177e4SLinus Torvalds } 11131da177e4SLinus Torvalds 11149bb182a7SYOSHIFUJI Hideaki static __inline__ 11159bb182a7SYOSHIFUJI Hideaki void xfrm_flowi_addr_get(struct flowi *fl, 11169bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 11179bb182a7SYOSHIFUJI Hideaki unsigned short family) 11189bb182a7SYOSHIFUJI Hideaki { 11199bb182a7SYOSHIFUJI Hideaki switch(family) { 11209bb182a7SYOSHIFUJI Hideaki case AF_INET: 11219bb182a7SYOSHIFUJI Hideaki memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4)); 11229bb182a7SYOSHIFUJI Hideaki memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4)); 11239bb182a7SYOSHIFUJI Hideaki break; 11249bb182a7SYOSHIFUJI Hideaki case AF_INET6: 11259bb182a7SYOSHIFUJI Hideaki ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src); 11269bb182a7SYOSHIFUJI Hideaki ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst); 11279bb182a7SYOSHIFUJI Hideaki break; 11289bb182a7SYOSHIFUJI Hideaki } 11299bb182a7SYOSHIFUJI Hideaki } 11309bb182a7SYOSHIFUJI Hideaki 11311da177e4SLinus Torvalds static __inline__ int 11321da177e4SLinus Torvalds __xfrm4_state_addr_check(struct xfrm_state *x, 11331da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr) 11341da177e4SLinus Torvalds { 11351da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 11361da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 11371da177e4SLinus Torvalds return 1; 11381da177e4SLinus Torvalds return 0; 11391da177e4SLinus Torvalds } 11401da177e4SLinus Torvalds 11411da177e4SLinus Torvalds static __inline__ int 11421da177e4SLinus Torvalds __xfrm6_state_addr_check(struct xfrm_state *x, 11431da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr) 11441da177e4SLinus Torvalds { 11451da177e4SLinus Torvalds if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 11461da177e4SLinus Torvalds (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)|| 11471da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 11481da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 11491da177e4SLinus Torvalds return 1; 11501da177e4SLinus Torvalds return 0; 11511da177e4SLinus Torvalds } 11521da177e4SLinus Torvalds 11531da177e4SLinus Torvalds static __inline__ int 11541da177e4SLinus Torvalds xfrm_state_addr_check(struct xfrm_state *x, 11551da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr, 11561da177e4SLinus Torvalds unsigned short family) 11571da177e4SLinus Torvalds { 11581da177e4SLinus Torvalds switch (family) { 11591da177e4SLinus Torvalds case AF_INET: 11601da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 11611da177e4SLinus Torvalds case AF_INET6: 11621da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 11631da177e4SLinus Torvalds } 11641da177e4SLinus Torvalds return 0; 11651da177e4SLinus Torvalds } 11661da177e4SLinus Torvalds 1167e53820deSMasahide NAKAMURA static __inline__ int 1168e53820deSMasahide NAKAMURA xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl, 1169e53820deSMasahide NAKAMURA unsigned short family) 1170e53820deSMasahide NAKAMURA { 1171e53820deSMasahide NAKAMURA switch (family) { 1172e53820deSMasahide NAKAMURA case AF_INET: 1173e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 1174e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl4_dst, 1175e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl4_src); 1176e53820deSMasahide NAKAMURA case AF_INET6: 1177e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 1178e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl6_dst, 1179e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl6_src); 1180e53820deSMasahide NAKAMURA } 1181e53820deSMasahide NAKAMURA return 0; 1182e53820deSMasahide NAKAMURA } 1183e53820deSMasahide NAKAMURA 11841da177e4SLinus Torvalds static inline int xfrm_state_kern(struct xfrm_state *x) 11851da177e4SLinus Torvalds { 11861da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 11871da177e4SLinus Torvalds } 11881da177e4SLinus Torvalds 11895794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 11905794708fSMasahide NAKAMURA { 1191dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1192dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1193dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1194dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 11955794708fSMasahide NAKAMURA } 11965794708fSMasahide NAKAMURA 11971da177e4SLinus Torvalds /* 11981da177e4SLinus Torvalds * xfrm algorithm information 11991da177e4SLinus Torvalds */ 12001a6509d9SHerbert Xu struct xfrm_algo_aead_info { 12011a6509d9SHerbert Xu u16 icv_truncbits; 12021a6509d9SHerbert Xu }; 12031a6509d9SHerbert Xu 12041da177e4SLinus Torvalds struct xfrm_algo_auth_info { 12051da177e4SLinus Torvalds u16 icv_truncbits; 12061da177e4SLinus Torvalds u16 icv_fullbits; 12071da177e4SLinus Torvalds }; 12081da177e4SLinus Torvalds 12091da177e4SLinus Torvalds struct xfrm_algo_encr_info { 12101da177e4SLinus Torvalds u16 blockbits; 12111da177e4SLinus Torvalds u16 defkeybits; 12121da177e4SLinus Torvalds }; 12131da177e4SLinus Torvalds 12141da177e4SLinus Torvalds struct xfrm_algo_comp_info { 12151da177e4SLinus Torvalds u16 threshold; 12161da177e4SLinus Torvalds }; 12171da177e4SLinus Torvalds 12181da177e4SLinus Torvalds struct xfrm_algo_desc { 12191da177e4SLinus Torvalds char *name; 122004ff1260SHerbert Xu char *compat; 12211da177e4SLinus Torvalds u8 available:1; 12221da177e4SLinus Torvalds union { 12231a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 12241da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 12251da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 12261da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 12271da177e4SLinus Torvalds } uinfo; 12281da177e4SLinus Torvalds struct sadb_alg desc; 12291da177e4SLinus Torvalds }; 12301da177e4SLinus Torvalds 12311da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 12321da177e4SLinus Torvalds struct xfrm_tunnel { 12331da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1234d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, __u32 info); 1235d2acc347SHerbert Xu 1236d2acc347SHerbert Xu struct xfrm_tunnel *next; 1237d2acc347SHerbert Xu int priority; 12381da177e4SLinus Torvalds }; 12391da177e4SLinus Torvalds 12401da177e4SLinus Torvalds struct xfrm6_tunnel { 1241d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1242d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 124304ce6909SAl Viro int type, int code, int offset, __be32 info); 1244d2acc347SHerbert Xu struct xfrm6_tunnel *next; 1245d2acc347SHerbert Xu int priority; 12461da177e4SLinus Torvalds }; 12471da177e4SLinus Torvalds 12484c563f76STimo Teras struct xfrm_state_walk { 12495c182458SHerbert Xu struct list_head list; 12505c182458SHerbert Xu unsigned long genid; 12514c563f76STimo Teras struct xfrm_state *state; 12524c563f76STimo Teras int count; 12534c563f76STimo Teras u8 proto; 12544c563f76STimo Teras }; 12554c563f76STimo Teras 12564c563f76STimo Teras struct xfrm_policy_walk { 12574c563f76STimo Teras struct xfrm_policy *policy; 12584c563f76STimo Teras int count; 12594c563f76STimo Teras u8 type, cur_type; 12604c563f76STimo Teras }; 12614c563f76STimo Teras 12621da177e4SLinus Torvalds extern void xfrm_init(void); 12631da177e4SLinus Torvalds extern void xfrm4_init(void); 12641da177e4SLinus Torvalds extern void xfrm_state_init(void); 12651da177e4SLinus Torvalds extern void xfrm4_state_init(void); 1266c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1267c35b7e72SDaniel Lezcano extern int xfrm6_init(void); 1268c35b7e72SDaniel Lezcano extern void xfrm6_fini(void); 12690013cabaSDaniel Lezcano extern int xfrm6_state_init(void); 12701da177e4SLinus Torvalds extern void xfrm6_state_fini(void); 1271c35b7e72SDaniel Lezcano #else 1272c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1273c35b7e72SDaniel Lezcano { 1274c35b7e72SDaniel Lezcano return 0; 1275c35b7e72SDaniel Lezcano } 1276c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1277c35b7e72SDaniel Lezcano { 1278c35b7e72SDaniel Lezcano ; 1279c35b7e72SDaniel Lezcano } 1280c35b7e72SDaniel Lezcano #endif 12811da177e4SLinus Torvalds 1282558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1283558f82efSMasahide NAKAMURA extern int xfrm_proc_init(void); 1284558f82efSMasahide NAKAMURA #endif 1285558f82efSMasahide NAKAMURA 12865c182458SHerbert Xu extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto); 12874c563f76STimo Teras extern int xfrm_state_walk(struct xfrm_state_walk *walk, 12884c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1289abb81c4fSHerbert Xu extern void xfrm_state_walk_done(struct xfrm_state_walk *walk); 12901da177e4SLinus Torvalds extern struct xfrm_state *xfrm_state_alloc(void); 12911da177e4SLinus Torvalds extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 12921da177e4SLinus Torvalds struct flowi *fl, struct xfrm_tmpl *tmpl, 12931da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 12941da177e4SLinus Torvalds unsigned short family); 1295628529b6SJamal Hadi Salim extern struct xfrm_state * xfrm_stateonly_find(xfrm_address_t *daddr, 1296628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1297628529b6SJamal Hadi Salim unsigned short family, 1298628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 12991da177e4SLinus Torvalds extern int xfrm_state_check_expire(struct xfrm_state *x); 13001da177e4SLinus Torvalds extern void xfrm_state_insert(struct xfrm_state *x); 13011da177e4SLinus Torvalds extern int xfrm_state_add(struct xfrm_state *x); 13021da177e4SLinus Torvalds extern int xfrm_state_update(struct xfrm_state *x); 1303a94cfd19SAl Viro extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family); 1304eb2971b6SMasahide NAKAMURA extern struct xfrm_state *xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family); 130541a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 130641a49cc3SMasahide NAKAMURA extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 130741a49cc3SMasahide NAKAMURA int n, unsigned short family); 130841a49cc3SMasahide NAKAMURA extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 130941a49cc3SMasahide NAKAMURA int n, unsigned short family); 131041a49cc3SMasahide NAKAMURA #else 131141a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 131241a49cc3SMasahide NAKAMURA int n, unsigned short family) 131341a49cc3SMasahide NAKAMURA { 131441a49cc3SMasahide NAKAMURA return -ENOSYS; 131541a49cc3SMasahide NAKAMURA } 131641a49cc3SMasahide NAKAMURA 131741a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 131841a49cc3SMasahide NAKAMURA int n, unsigned short family) 131941a49cc3SMasahide NAKAMURA { 132041a49cc3SMasahide NAKAMURA return -ENOSYS; 132141a49cc3SMasahide NAKAMURA } 132241a49cc3SMasahide NAKAMURA #endif 1323af11e316SJamal Hadi Salim 1324af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1325af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1326af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1327af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1328af11e316SJamal Hadi Salim }; 1329af11e316SJamal Hadi Salim 13305a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 13315a6d3416SJamal Hadi Salim u32 incnt; 13325a6d3416SJamal Hadi Salim u32 outcnt; 13335a6d3416SJamal Hadi Salim u32 fwdcnt; 13345a6d3416SJamal Hadi Salim u32 inscnt; 13355a6d3416SJamal Hadi Salim u32 outscnt; 13365a6d3416SJamal Hadi Salim u32 fwdscnt; 13375a6d3416SJamal Hadi Salim u32 spdhcnt; 13385a6d3416SJamal Hadi Salim u32 spdhmcnt; 13395a6d3416SJamal Hadi Salim }; 13405a6d3416SJamal Hadi Salim 13411da177e4SLinus Torvalds extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq); 134226b15dadSJamal Hadi Salim extern int xfrm_state_delete(struct xfrm_state *x); 13434aa2e62cSJoy Latten extern int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info); 1344af11e316SJamal Hadi Salim extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si); 13455a6d3416SJamal Hadi Salim extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si); 1346afeb14b4SPaul Moore extern int xfrm_replay_check(struct xfrm_state *x, 1347afeb14b4SPaul Moore struct sk_buff *skb, __be32 seq); 134861f4627bSAl Viro extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq); 1349f8cd5488SJamal Hadi Salim extern void xfrm_replay_notify(struct xfrm_state *x, int event); 13501da177e4SLinus Torvalds extern int xfrm_state_mtu(struct xfrm_state *x, int mtu); 135172cb6962SHerbert Xu extern int xfrm_init_state(struct xfrm_state *x); 1352227620e2SHerbert Xu extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1353716062fdSHerbert Xu extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, 1354716062fdSHerbert Xu int encap_type); 13551bf06cd2SHerbert Xu extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1356c6581a45SHerbert Xu extern int xfrm_output_resume(struct sk_buff *skb, int err); 1357406ef77cSHerbert Xu extern int xfrm_output(struct sk_buff *skb); 1358df9dcb45SKazunori MIYAZAWA extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 135936cf9acfSHerbert Xu extern int xfrm4_extract_header(struct sk_buff *skb); 1360227620e2SHerbert Xu extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1361c4541b41SHerbert Xu extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1362c4541b41SHerbert Xu int encap_type); 1363716062fdSHerbert Xu extern int xfrm4_transport_finish(struct sk_buff *skb, int async); 13641da177e4SLinus Torvalds extern int xfrm4_rcv(struct sk_buff *skb); 1365c4541b41SHerbert Xu 1366c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1367c4541b41SHerbert Xu { 1368c4541b41SHerbert Xu return xfrm4_rcv_encap(skb, nexthdr, spi, 0); 1369c4541b41SHerbert Xu } 1370c4541b41SHerbert Xu 137136cf9acfSHerbert Xu extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 137236cf9acfSHerbert Xu extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 13731da177e4SLinus Torvalds extern int xfrm4_output(struct sk_buff *skb); 1374c0d56408SKazunori MIYAZAWA extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1375c0d56408SKazunori MIYAZAWA extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 137636cf9acfSHerbert Xu extern int xfrm6_extract_header(struct sk_buff *skb); 1377227620e2SHerbert Xu extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 137833b5ecb8SHerbert Xu extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi); 1379716062fdSHerbert Xu extern int xfrm6_transport_finish(struct sk_buff *skb, int async); 1380e5bbef20SHerbert Xu extern int xfrm6_rcv(struct sk_buff *skb); 1381fbd9a5b4SMasahide NAKAMURA extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1382fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 138373d605d1SKazunori MIYAZAWA extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 138473d605d1SKazunori MIYAZAWA extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 13858c689a6eSAl Viro extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr); 13861da177e4SLinus Torvalds extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr); 13878c689a6eSAl Viro extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr); 138836cf9acfSHerbert Xu extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 138936cf9acfSHerbert Xu extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 13901da177e4SLinus Torvalds extern int xfrm6_output(struct sk_buff *skb); 1391aee5adb4SMasahide NAKAMURA extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1392aee5adb4SMasahide NAKAMURA u8 **prevhdr); 13931da177e4SLinus Torvalds 13941da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1395067b207bSJames Chapman extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 13961da177e4SLinus Torvalds extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen); 13971da177e4SLinus Torvalds #else 13981da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 13991da177e4SLinus Torvalds { 14001da177e4SLinus Torvalds return -ENOPROTOOPT; 14011da177e4SLinus Torvalds } 14021da177e4SLinus Torvalds 1403067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 14041da177e4SLinus Torvalds { 14051da177e4SLinus Torvalds /* should not happen */ 14061da177e4SLinus Torvalds kfree_skb(skb); 14071da177e4SLinus Torvalds return 0; 14081da177e4SLinus Torvalds } 14091da177e4SLinus Torvalds #endif 14101da177e4SLinus Torvalds 1411dd0fc66fSAl Viro struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp); 14124c563f76STimo Teras 14134c563f76STimo Teras static inline void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type) 14144c563f76STimo Teras { 14154c563f76STimo Teras walk->cur_type = XFRM_POLICY_TYPE_MAIN; 14164c563f76STimo Teras walk->type = type; 14174c563f76STimo Teras walk->policy = NULL; 14184c563f76STimo Teras walk->count = 0; 14194c563f76STimo Teras } 14204c563f76STimo Teras 14214c563f76STimo Teras static inline void xfrm_policy_walk_done(struct xfrm_policy_walk *walk) 14224c563f76STimo Teras { 14234c563f76STimo Teras if (walk->policy != NULL) { 14244c563f76STimo Teras xfrm_pol_put(walk->policy); 14254c563f76STimo Teras walk->policy = NULL; 14264c563f76STimo Teras } 14274c563f76STimo Teras } 14284c563f76STimo Teras 14294c563f76STimo Teras extern int xfrm_policy_walk(struct xfrm_policy_walk *walk, 14304c563f76STimo Teras int (*func)(struct xfrm_policy *, int, int, void*), void *); 14311da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 14324e81bb83SMasahide NAKAMURA struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir, 14334e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1434ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1435ef41aaa0SEric Paris int *err); 1436ef41aaa0SEric Paris struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err); 14374aa2e62cSJoy Latten int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info); 14381da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1439658b219eSHerbert Xu extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 14401da177e4SLinus Torvalds struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 14411da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr, 14421da177e4SLinus Torvalds int create, unsigned short family); 14431da177e4SLinus Torvalds extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 14445b368e61SVenkat Yekkirala extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst, 14455b368e61SVenkat Yekkirala struct flowi *fl, int family, int strict); 14461da177e4SLinus Torvalds 144780c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 144880c9abaaSShinta Sugimoto extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 144980c9abaaSShinta Sugimoto struct xfrm_migrate *m, int num_bundles); 145080c9abaaSShinta Sugimoto extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m); 145180c9abaaSShinta Sugimoto extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x, 145280c9abaaSShinta Sugimoto struct xfrm_migrate *m); 145380c9abaaSShinta Sugimoto extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 145480c9abaaSShinta Sugimoto struct xfrm_migrate *m, int num_bundles); 145580c9abaaSShinta Sugimoto #endif 145680c9abaaSShinta Sugimoto 14571da177e4SLinus Torvalds extern wait_queue_head_t km_waitq; 14585d36b180SAl Viro extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 14596c5c8ca7SJamal Hadi Salim extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid); 146097a64b45SMasahide NAKAMURA extern int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 14611da177e4SLinus Torvalds 14621da177e4SLinus Torvalds extern void xfrm_input_init(void); 14636067b2baSAl Viro extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 14641da177e4SLinus Torvalds 14651da177e4SLinus Torvalds extern void xfrm_probe_algs(void); 14661da177e4SLinus Torvalds extern int xfrm_count_auth_supported(void); 14671da177e4SLinus Torvalds extern int xfrm_count_enc_supported(void); 14681da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 14691da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 14701da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 14711da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 14721da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 14731da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe); 14741da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe); 14751da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe); 14761a6509d9SHerbert Xu extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, 14771a6509d9SHerbert Xu int probe); 14781da177e4SLinus Torvalds 147907d4ee58SHerbert Xu struct hash_desc; 14809409f38aSHerbert Xu struct scatterlist; 148107d4ee58SHerbert Xu typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *, 148207d4ee58SHerbert Xu unsigned int); 14831da177e4SLinus Torvalds 148407d4ee58SHerbert Xu extern int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *tfm, 14851da177e4SLinus Torvalds int offset, int len, icv_update_fn_t icv_update); 14861da177e4SLinus Torvalds 14871da177e4SLinus Torvalds static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b, 14881da177e4SLinus Torvalds int family) 14891da177e4SLinus Torvalds { 14901da177e4SLinus Torvalds switch (family) { 14911da177e4SLinus Torvalds default: 14921da177e4SLinus Torvalds case AF_INET: 14938c689a6eSAl Viro return (__force __u32)a->a4 - (__force __u32)b->a4; 14941da177e4SLinus Torvalds case AF_INET6: 14951da177e4SLinus Torvalds return ipv6_addr_cmp((struct in6_addr *)a, 14961da177e4SLinus Torvalds (struct in6_addr *)b); 14971da177e4SLinus Torvalds } 14981da177e4SLinus Torvalds } 14991da177e4SLinus Torvalds 150077d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 150177d8d7a6SHerbert Xu { 150277d8d7a6SHerbert Xu return index & 7; 150377d8d7a6SHerbert Xu } 150477d8d7a6SHerbert Xu 1505f8cd5488SJamal Hadi Salim static inline int xfrm_aevent_is_on(void) 1506f8cd5488SJamal Hadi Salim { 1507be33690dSPatrick McHardy struct sock *nlsk; 1508be33690dSPatrick McHardy int ret = 0; 1509be33690dSPatrick McHardy 1510be33690dSPatrick McHardy rcu_read_lock(); 1511be33690dSPatrick McHardy nlsk = rcu_dereference(xfrm_nl); 1512be33690dSPatrick McHardy if (nlsk) 1513be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1514be33690dSPatrick McHardy rcu_read_unlock(); 1515be33690dSPatrick McHardy return ret; 1516f8cd5488SJamal Hadi Salim } 1517f8cd5488SJamal Hadi Salim 15180f99be0dSEric Dumazet static inline int xfrm_alg_len(struct xfrm_algo *alg) 15190f99be0dSEric Dumazet { 15200f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 15210f99be0dSEric Dumazet } 15220f99be0dSEric Dumazet 152380c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 152480c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 152580c9abaaSShinta Sugimoto { 15260f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 152780c9abaaSShinta Sugimoto } 152880c9abaaSShinta Sugimoto 152980c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 153080c9abaaSShinta Sugimoto { 153180c9abaaSShinta Sugimoto int i; 153280c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 153380c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 153480c9abaaSShinta Sugimoto } 153580c9abaaSShinta Sugimoto 153680c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 153780c9abaaSShinta Sugimoto { 153880c9abaaSShinta Sugimoto int i; 153980c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 154080c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 154180c9abaaSShinta Sugimoto } 154280c9abaaSShinta Sugimoto #endif 1543f8cd5488SJamal Hadi Salim 154400501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 154500501121SHerbert Xu { 154600501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 154700501121SHerbert Xu } 154800501121SHerbert Xu 15491da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1550