11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds #include <net/sock.h> 181da177e4SLinus Torvalds #include <net/dst.h> 19436a0a40SHerbert Xu #include <net/ip.h> 201da177e4SLinus Torvalds #include <net/route.h> 211da177e4SLinus Torvalds #include <net/ipv6.h> 221da177e4SLinus Torvalds #include <net/ip6_fib.h> 23fe1a5f03STimo Teräs #include <net/flow.h> 249e0d57fdSYury Polyanskiy 259e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 269e0d57fdSYury Polyanskiy 27558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 28558f82efSMasahide NAKAMURA #include <net/snmp.h> 29558f82efSMasahide NAKAMURA #endif 301da177e4SLinus Torvalds 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 38d3d6dd3aSMasahide NAKAMURA 39fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 401da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 41b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 42b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 43d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 44d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 451da177e4SLinus Torvalds 46558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 4759c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 4859c9940eSAlexey Dobriyan #define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field) 4959c9940eSAlexey Dobriyan #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field) 50558f82efSMasahide NAKAMURA #else 5159c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 5259c9940eSAlexey Dobriyan #define XFRM_INC_STATS_BH(net, field) ((void)(net)) 5359c9940eSAlexey Dobriyan #define XFRM_INC_STATS_USER(net, field) ((void)(net)) 54558f82efSMasahide NAKAMURA #endif 55558f82efSMasahide NAKAMURA 561da177e4SLinus Torvalds 571da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 581da177e4SLinus Torvalds ------------------------------------ 591da177e4SLinus Torvalds 601da177e4SLinus Torvalds Basic objects: 611da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 621da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 631da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 641da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 671da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 681da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 691da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 701da177e4SLinus Torvalds 711da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 741da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 751da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 761da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 771da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 781da177e4SLinus Torvalds to a dst_entry returned to requestor. 791da177e4SLinus Torvalds 801da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 811da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 821da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 831da177e4SLinus Torvalds |---. child .-> NULL 841da177e4SLinus Torvalds 851da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds Resolution of xrfm_tmpl 891da177e4SLinus Torvalds ----------------------- 901da177e4SLinus Torvalds Template contains: 911da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 921da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 931da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 941da177e4SLinus Torvalds Q: allow to resolve security gateway? 951da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 961da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 971da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 981da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 991da177e4SLinus Torvalds 7. ->share Sharing mode. 1001da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 1011da177e4SLinus Torvalds flow id? 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1041da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1051da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1061da177e4SLinus Torvalds 1071da177e4SLinus Torvalds PROBLEMS: 1081da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1091da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1101da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1111da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1121da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1131da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1141da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1151da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1161da177e4SLinus Torvalds */ 1171da177e4SLinus Torvalds 11812a169e7SHerbert Xu struct xfrm_state_walk { 11912a169e7SHerbert Xu struct list_head all; 12012a169e7SHerbert Xu u8 state; 12112a169e7SHerbert Xu u8 dying; 12212a169e7SHerbert Xu u8 proto; 12312a169e7SHerbert Xu u32 seq; 124870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12512a169e7SHerbert Xu }; 12612a169e7SHerbert Xu 1271da177e4SLinus Torvalds /* Full description of state of transformer. */ 128fd2c3ef7SEric Dumazet struct xfrm_state { 129673c09beSAlexey Dobriyan #ifdef CONFIG_NET_NS 130673c09beSAlexey Dobriyan struct net *xs_net; 131673c09beSAlexey Dobriyan #endif 132abb81c4fSHerbert Xu union { 13312a169e7SHerbert Xu struct hlist_node gclist; 1348f126e37SDavid S. Miller struct hlist_node bydst; 135abb81c4fSHerbert Xu }; 1368f126e37SDavid S. Miller struct hlist_node bysrc; 1378f126e37SDavid S. Miller struct hlist_node byspi; 1381da177e4SLinus Torvalds 1391da177e4SLinus Torvalds atomic_t refcnt; 1401da177e4SLinus Torvalds spinlock_t lock; 1411da177e4SLinus Torvalds 1421da177e4SLinus Torvalds struct xfrm_id id; 1431da177e4SLinus Torvalds struct xfrm_selector sel; 144bf825f81SJamal Hadi Salim struct xfrm_mark mark; 14535d2856bSMartin Willi u32 tfcpad; 1461da177e4SLinus Torvalds 1479d4a706dSDavid S. Miller u32 genid; 1489d4a706dSDavid S. Miller 14912a169e7SHerbert Xu /* Key manager bits */ 15012a169e7SHerbert Xu struct xfrm_state_walk km; 1511da177e4SLinus Torvalds 1521da177e4SLinus Torvalds /* Parameters of this state. */ 1531da177e4SLinus Torvalds struct { 1541da177e4SLinus Torvalds u32 reqid; 1551da177e4SLinus Torvalds u8 mode; 1561da177e4SLinus Torvalds u8 replay_window; 1571da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1581da177e4SLinus Torvalds u8 flags; 1591da177e4SLinus Torvalds u16 family; 1601da177e4SLinus Torvalds xfrm_address_t saddr; 1611da177e4SLinus Torvalds int header_len; 1621da177e4SLinus Torvalds int trailer_len; 163a947b0a9SNicolas Dichtel u32 extra_flags; 1641da177e4SLinus Torvalds } props; 1651da177e4SLinus Torvalds 1661da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1671da177e4SLinus Torvalds 1681da177e4SLinus Torvalds /* Data for transformer */ 1694447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1701da177e4SLinus Torvalds struct xfrm_algo *ealg; 1711da177e4SLinus Torvalds struct xfrm_algo *calg; 1721a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 1731da177e4SLinus Torvalds 1741da177e4SLinus Torvalds /* Data for encapsulator */ 1751da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1761da177e4SLinus Torvalds 177060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 178060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 179060f02a3SNoriaki TAKAMIYA 1801da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1811da177e4SLinus Torvalds struct xfrm_state *tunnel; 1821da177e4SLinus Torvalds 1831da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1841da177e4SLinus Torvalds atomic_t tunnel_users; 1851da177e4SLinus Torvalds 1861da177e4SLinus Torvalds /* State for replay detection */ 1871da177e4SLinus Torvalds struct xfrm_replay_state replay; 1889736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1891da177e4SLinus Torvalds 190f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 191f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1929736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 193f8cd5488SJamal Hadi Salim 1949fdc4883SSteffen Klassert /* The functions for replay detection. */ 1959fdc4883SSteffen Klassert struct xfrm_replay *repl; 1969fdc4883SSteffen Klassert 1972717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1982717096aSJamal Hadi Salim * moment 1992717096aSJamal Hadi Salim */ 2002717096aSJamal Hadi Salim u32 xflags; 2012717096aSJamal Hadi Salim 202f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 203f8cd5488SJamal Hadi Salim u32 replay_maxage; 204f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 205f8cd5488SJamal Hadi Salim 206f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 207f8cd5488SJamal Hadi Salim struct timer_list rtimer; 208f8cd5488SJamal Hadi Salim 2091da177e4SLinus Torvalds /* Statistics */ 2101da177e4SLinus Torvalds struct xfrm_stats stats; 2111da177e4SLinus Torvalds 2121da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2139e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2141da177e4SLinus Torvalds 215e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 216e3c0d047SFan Du long saved_tmo; 217e3c0d047SFan Du 2189afaca05SMasahide NAKAMURA /* Last used time */ 219d26f3984SHerbert Xu unsigned long lastused; 2209afaca05SMasahide NAKAMURA 2211da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2221da177e4SLinus Torvalds * transformer. */ 223533cb5b0SEric Dumazet const struct xfrm_type *type; 22413996378SHerbert Xu struct xfrm_mode *inner_mode; 225df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 22613996378SHerbert Xu struct xfrm_mode *outer_mode; 2271da177e4SLinus Torvalds 228df71837dSTrent Jaeger /* Security context */ 229df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 230df71837dSTrent Jaeger 2311da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2321da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2331da177e4SLinus Torvalds void *data; 2341da177e4SLinus Torvalds }; 2351da177e4SLinus Torvalds 236673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 237673c09beSAlexey Dobriyan { 238673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 239673c09beSAlexey Dobriyan } 240673c09beSAlexey Dobriyan 2412717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2422717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 243e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2442717096aSJamal Hadi Salim 2451da177e4SLinus Torvalds enum { 2461da177e4SLinus Torvalds XFRM_STATE_VOID, 2471da177e4SLinus Torvalds XFRM_STATE_ACQ, 2481da177e4SLinus Torvalds XFRM_STATE_VALID, 2491da177e4SLinus Torvalds XFRM_STATE_ERROR, 2501da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2511da177e4SLinus Torvalds XFRM_STATE_DEAD 2521da177e4SLinus Torvalds }; 2531da177e4SLinus Torvalds 25426b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 255fd2c3ef7SEric Dumazet struct km_event { 256bf08867fSHerbert Xu union { 257bf08867fSHerbert Xu u32 hard; 258bf08867fSHerbert Xu u32 proto; 259bf08867fSHerbert Xu u32 byid; 260f8cd5488SJamal Hadi Salim u32 aevent; 261f7b6983fSMasahide NAKAMURA u32 type; 262bf08867fSHerbert Xu } data; 263bf08867fSHerbert Xu 26426b15dadSJamal Hadi Salim u32 seq; 26515e47304SEric W. Biederman u32 portid; 26626b15dadSJamal Hadi Salim u32 event; 2677067802eSAlexey Dobriyan struct net *net; 26826b15dadSJamal Hadi Salim }; 26926b15dadSJamal Hadi Salim 2709fdc4883SSteffen Klassert struct xfrm_replay { 2719fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2729fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2739fdc4883SSteffen Klassert struct sk_buff *skb, 2749fdc4883SSteffen Klassert __be32 net_seq); 2753b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2763b59df46SSteffen Klassert struct sk_buff *skb, 2773b59df46SSteffen Klassert __be32 net_seq); 2789fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2799fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2809fdc4883SSteffen Klassert }; 2819fdc4883SSteffen Klassert 28225ee3286SHerbert Xu struct net_device; 2831da177e4SLinus Torvalds struct xfrm_type; 2841da177e4SLinus Torvalds struct xfrm_dst; 2851da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2861da177e4SLinus Torvalds unsigned short family; 2871da177e4SLinus Torvalds struct dst_ops *dst_ops; 288ddcfd796SAlexey Dobriyan void (*garbage_collect)(struct net *net); 289c5b3cf46SAlexey Dobriyan struct dst_entry *(*dst_lookup)(struct net *net, int tos, 2905e6b930fSDavid S. Miller const xfrm_address_t *saddr, 2915e6b930fSDavid S. Miller const xfrm_address_t *daddr); 292fbda33b2SAlexey Dobriyan int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr); 2931da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 294d5422efeSHerbert Xu struct flowi *fl, 295d5422efeSHerbert Xu int reverse); 29605d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 2979d7b0fc1SPatrick McHardy void (*init_dst)(struct net *net, 2989d7b0fc1SPatrick McHardy struct xfrm_dst *dst); 299a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 300a1b05140SMasahide NAKAMURA struct dst_entry *dst, 301a1b05140SMasahide NAKAMURA int nfheader_len); 30225ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 30387c1e12bSHerbert Xu struct net_device *dev, 3040c7b3eefSDavid S. Miller const struct flowi *fl); 3052774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3061da177e4SLinus Torvalds }; 3071da177e4SLinus Torvalds 308d511337aSJoe Perches int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo); 309d511337aSJoe Perches int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); 310d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 311d511337aSJoe Perches const struct km_event *c); 312d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3131da177e4SLinus Torvalds 3141da177e4SLinus Torvalds struct xfrm_tmpl; 315d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 316d511337aSJoe Perches struct xfrm_policy *pol); 317d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 318d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 31953bc6b4dSJamal Hadi Salim 3201da177e4SLinus Torvalds struct xfrm_state_afinfo { 32117c2a42aSHerbert Xu unsigned int family; 32236cf9acfSHerbert Xu unsigned int proto; 3238e3d716cSAl Viro __be16 eth_proto; 32417c2a42aSHerbert Xu struct module *owner; 325533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 326aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 327d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 32873e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 32973e5ebb2SDavid S. Miller const struct flowi *fl); 33019bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 33119bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 33219bd6244SDavid S. Miller const xfrm_address_t *daddr, 33319bd6244SDavid S. Miller const xfrm_address_t *saddr); 33441a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 33541a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 336*aad88724SEric Dumazet int (*output)(struct sock *sk, struct sk_buff *skb); 33743a4dea4SSteffen Klassert int (*output_finish)(struct sk_buff *skb); 338227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 339227620e2SHerbert Xu struct sk_buff *skb); 34036cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 34136cf9acfSHerbert Xu struct sk_buff *skb); 342716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 343716062fdSHerbert Xu int async); 344628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3451da177e4SLinus Torvalds }; 3461da177e4SLinus Torvalds 347d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 348d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 349d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 350d511337aSJoe Perches void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo); 3511da177e4SLinus Torvalds 3522f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3532f32b51bSSteffen Klassert unsigned int family; 3542f32b51bSSteffen Klassert struct module *owner; 3552f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3562f32b51bSSteffen Klassert int err); 3572f32b51bSSteffen Klassert }; 3582f32b51bSSteffen Klassert 3592f32b51bSSteffen Klassert int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo); 3602f32b51bSSteffen Klassert int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo); 3612f32b51bSSteffen Klassert 362d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3631da177e4SLinus Torvalds 364fd2c3ef7SEric Dumazet struct xfrm_type { 3651da177e4SLinus Torvalds char *description; 3661da177e4SLinus Torvalds struct module *owner; 367a6337463Sjamal u8 proto; 368a6337463Sjamal u8 flags; 3691b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 370436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 371f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 372f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3731da177e4SLinus Torvalds 37472cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3751da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 376e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3771da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3788f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3798f029de2SDavid S. Miller const struct flowi *); 380aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3811da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 382c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3831da177e4SLinus Torvalds }; 3841da177e4SLinus Torvalds 385d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 386d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3871da177e4SLinus Torvalds 388b59f45d0SHerbert Xu struct xfrm_mode { 389227620e2SHerbert Xu /* 390227620e2SHerbert Xu * Remove encapsulation header. 391227620e2SHerbert Xu * 392227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 393227620e2SHerbert Xu * header. 394227620e2SHerbert Xu * 395227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 396227620e2SHerbert Xu * should be and the network header shall be set to where the IP 397227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 398227620e2SHerbert Xu * payload. 399227620e2SHerbert Xu */ 400227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 401227620e2SHerbert Xu 402227620e2SHerbert Xu /* 403227620e2SHerbert Xu * This is the actual input entry point. 404227620e2SHerbert Xu * 405227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 406227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 407227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 408227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 409227620e2SHerbert Xu */ 410b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 41137fedd3aSHerbert Xu 41237fedd3aSHerbert Xu /* 41337fedd3aSHerbert Xu * Add encapsulation header. 41437fedd3aSHerbert Xu * 41537fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 41637fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 41737fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 41837fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 41937fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 42037fedd3aSHerbert Xu * header. The value of the network header will always point 42137fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 42237fedd3aSHerbert Xu */ 42336cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 42436cf9acfSHerbert Xu 42536cf9acfSHerbert Xu /* 42636cf9acfSHerbert Xu * This is the actual output entry point. 42736cf9acfSHerbert Xu * 42836cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 42936cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 43036cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 43136cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 43236cf9acfSHerbert Xu * call output2. 43336cf9acfSHerbert Xu */ 434eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 435b59f45d0SHerbert Xu 43617c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 437b59f45d0SHerbert Xu struct module *owner; 438b59f45d0SHerbert Xu unsigned int encap; 4391bfcb10fSHerbert Xu int flags; 4401bfcb10fSHerbert Xu }; 4411bfcb10fSHerbert Xu 4421bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4431bfcb10fSHerbert Xu enum { 4441bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 445b59f45d0SHerbert Xu }; 446b59f45d0SHerbert Xu 447d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 448d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 449b59f45d0SHerbert Xu 450df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 451df9dcb45SKazunori MIYAZAWA { 452df9dcb45SKazunori MIYAZAWA switch(family) { 453df9dcb45SKazunori MIYAZAWA case AF_INET: 454df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 455df9dcb45SKazunori MIYAZAWA case AF_INET6: 456df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 457df9dcb45SKazunori MIYAZAWA default: 458df9dcb45SKazunori MIYAZAWA return 0; 459df9dcb45SKazunori MIYAZAWA } 460df9dcb45SKazunori MIYAZAWA } 461df9dcb45SKazunori MIYAZAWA 462df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 463df9dcb45SKazunori MIYAZAWA { 464df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 465df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 466df9dcb45SKazunori MIYAZAWA return x->inner_mode; 467df9dcb45SKazunori MIYAZAWA else 468df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 469df9dcb45SKazunori MIYAZAWA } 470df9dcb45SKazunori MIYAZAWA 471fd2c3ef7SEric Dumazet struct xfrm_tmpl { 4721da177e4SLinus Torvalds /* id in template is interpreted as: 4731da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4741da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4751da177e4SLinus Torvalds * daddr must be fixed too. 4761da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4771da177e4SLinus Torvalds */ 4781da177e4SLinus Torvalds struct xfrm_id id; 4791da177e4SLinus Torvalds 4801da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4811da177e4SLinus Torvalds xfrm_address_t saddr; 4821da177e4SLinus Torvalds 48376b3f055SMiika Komu unsigned short encap_family; 48476b3f055SMiika Komu 485a6337463Sjamal u32 reqid; 4861da177e4SLinus Torvalds 4877e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 488a6337463Sjamal u8 mode; 4891da177e4SLinus Torvalds 4901da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 491a6337463Sjamal u8 share; 4921da177e4SLinus Torvalds 4931da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 494a6337463Sjamal u8 optional; 4951da177e4SLinus Torvalds 496c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 497a6337463Sjamal u8 allalgs; 498c5d18e98SHerbert Xu 4991da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 500a6337463Sjamal u32 aalgos; 501a6337463Sjamal u32 ealgos; 502a6337463Sjamal u32 calgos; 5031da177e4SLinus Torvalds }; 5041da177e4SLinus Torvalds 505622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 5061da177e4SLinus Torvalds 50712a169e7SHerbert Xu struct xfrm_policy_walk_entry { 50812a169e7SHerbert Xu struct list_head all; 50912a169e7SHerbert Xu u8 dead; 51012a169e7SHerbert Xu }; 51112a169e7SHerbert Xu 51212a169e7SHerbert Xu struct xfrm_policy_walk { 51312a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 51412a169e7SHerbert Xu u8 type; 51512a169e7SHerbert Xu u32 seq; 51612a169e7SHerbert Xu }; 51712a169e7SHerbert Xu 518a0073fe1SSteffen Klassert struct xfrm_policy_queue { 519a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 520a0073fe1SSteffen Klassert struct timer_list hold_timer; 521a0073fe1SSteffen Klassert unsigned long timeout; 522a0073fe1SSteffen Klassert }; 523a0073fe1SSteffen Klassert 524fd2c3ef7SEric Dumazet struct xfrm_policy { 5250331b1f3SAlexey Dobriyan #ifdef CONFIG_NET_NS 5260331b1f3SAlexey Dobriyan struct net *xp_net; 5270331b1f3SAlexey Dobriyan #endif 5282518c7c2SDavid S. Miller struct hlist_node bydst; 5292518c7c2SDavid S. Miller struct hlist_node byidx; 5301da177e4SLinus Torvalds 5311da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5321da177e4SLinus Torvalds rwlock_t lock; 5331da177e4SLinus Torvalds atomic_t refcnt; 5341da177e4SLinus Torvalds struct timer_list timer; 5351da177e4SLinus Torvalds 536fe1a5f03STimo Teräs struct flow_cache_object flo; 53780c802f3STimo Teräs atomic_t genid; 5381da177e4SLinus Torvalds u32 priority; 5391da177e4SLinus Torvalds u32 index; 540bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5411da177e4SLinus Torvalds struct xfrm_selector selector; 5421da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5431da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 54412a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 545a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 54646ca5f5dSArnaldo Carvalho de Melo u8 type; 54746ca5f5dSArnaldo Carvalho de Melo u8 action; 54846ca5f5dSArnaldo Carvalho de Melo u8 flags; 54946ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 55012a169e7SHerbert Xu u16 family; 551df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5521da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 5531da177e4SLinus Torvalds }; 5541da177e4SLinus Torvalds 55563eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5560331b1f3SAlexey Dobriyan { 5570331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5580331b1f3SAlexey Dobriyan } 5590331b1f3SAlexey Dobriyan 56013c1d189SArnaud Ebalard struct xfrm_kmaddress { 56113c1d189SArnaud Ebalard xfrm_address_t local; 56213c1d189SArnaud Ebalard xfrm_address_t remote; 56313c1d189SArnaud Ebalard u32 reserved; 56413c1d189SArnaud Ebalard u16 family; 56513c1d189SArnaud Ebalard }; 56613c1d189SArnaud Ebalard 56780c9abaaSShinta Sugimoto struct xfrm_migrate { 56880c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 56980c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 57080c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 57180c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 57280c9abaaSShinta Sugimoto u8 proto; 57380c9abaaSShinta Sugimoto u8 mode; 57480c9abaaSShinta Sugimoto u16 reserved; 57580c9abaaSShinta Sugimoto u32 reqid; 57680c9abaaSShinta Sugimoto u16 old_family; 57780c9abaaSShinta Sugimoto u16 new_family; 57880c9abaaSShinta Sugimoto }; 57980c9abaaSShinta Sugimoto 5801da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 581f8cd5488SJamal Hadi Salim /* what happened */ 582f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 583f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 584f8cd5488SJamal Hadi Salim 585f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 586f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 587f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 588f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 589f8cd5488SJamal Hadi Salim /* default seq threshold size */ 590f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 5911da177e4SLinus Torvalds 592fd2c3ef7SEric Dumazet struct xfrm_mgr { 5931da177e4SLinus Torvalds struct list_head list; 5941da177e4SLinus Torvalds char *id; 595214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 59665e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 597cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 5985d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 599214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 600db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 601183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 602183cad12SDavid S. Miller u8 dir, u8 type, 603183cad12SDavid S. Miller const struct xfrm_migrate *m, 604183cad12SDavid S. Miller int num_bundles, 605183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 6060f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6071da177e4SLinus Torvalds }; 6081da177e4SLinus Torvalds 609d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 610d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6111da177e4SLinus Torvalds 61270be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 61370be6c91SSteffen Klassert union { 61470be6c91SSteffen Klassert struct inet_skb_parm h4; 61570be6c91SSteffen Klassert struct inet6_skb_parm h6; 61670be6c91SSteffen Klassert } header; 61770be6c91SSteffen Klassert 61870be6c91SSteffen Klassert union { 61970be6c91SSteffen Klassert struct ip_tunnel *ip4; 62070be6c91SSteffen Klassert struct ip6_tnl *ip6; 62170be6c91SSteffen Klassert } tunnel; 62270be6c91SSteffen Klassert }; 62370be6c91SSteffen Klassert 62470be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 62570be6c91SSteffen Klassert 626436a0a40SHerbert Xu /* 627436a0a40SHerbert Xu * This structure is used for the duration where packets are being 628436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 629436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 630436a0a40SHerbert Xu */ 631436a0a40SHerbert Xu struct xfrm_skb_cb { 63270be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 633436a0a40SHerbert Xu 634436a0a40SHerbert Xu /* Sequence number for replay protection. */ 635b318e0e4SHerbert Xu union { 6361ce3644aSSteffen Klassert struct { 6371ce3644aSSteffen Klassert __u32 low; 6381ce3644aSSteffen Klassert __u32 hi; 6391ce3644aSSteffen Klassert } output; 6401ce3644aSSteffen Klassert struct { 6411ce3644aSSteffen Klassert __be32 low; 6421ce3644aSSteffen Klassert __be32 hi; 6431ce3644aSSteffen Klassert } input; 644b318e0e4SHerbert Xu } seq; 645436a0a40SHerbert Xu }; 646436a0a40SHerbert Xu 647436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 648436a0a40SHerbert Xu 64936cf9acfSHerbert Xu /* 65036cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 65136cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 65236cf9acfSHerbert Xu */ 65336cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 65470be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 65536cf9acfSHerbert Xu 65636cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 65736cf9acfSHerbert Xu __be16 id; 65836cf9acfSHerbert Xu __be16 frag_off; 65936cf9acfSHerbert Xu 660732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 661732c8bd5SHerbert Xu u8 ihl; 662732c8bd5SHerbert Xu 66336cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 66436cf9acfSHerbert Xu u8 tos; 66536cf9acfSHerbert Xu 66636cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 66736cf9acfSHerbert Xu u8 ttl; 66836cf9acfSHerbert Xu 66936cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 67036cf9acfSHerbert Xu u8 protocol; 67136cf9acfSHerbert Xu 672732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 673732c8bd5SHerbert Xu u8 optlen; 674732c8bd5SHerbert Xu 67536cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 67636cf9acfSHerbert Xu u8 flow_lbl[3]; 67736cf9acfSHerbert Xu }; 67836cf9acfSHerbert Xu 67936cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 68036cf9acfSHerbert Xu 681716062fdSHerbert Xu /* 682716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 683716062fdSHerbert Xu * related information. 684716062fdSHerbert Xu */ 685716062fdSHerbert Xu struct xfrm_spi_skb_cb { 68670be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 687716062fdSHerbert Xu 688716062fdSHerbert Xu unsigned int daddroff; 6892fcb45b6SHerbert Xu unsigned int family; 690716062fdSHerbert Xu }; 691716062fdSHerbert Xu 692716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 693716062fdSHerbert Xu 694161a09e7SJoy Latten /* Audit Information */ 695fd2c3ef7SEric Dumazet struct xfrm_audit { 696161a09e7SJoy Latten u32 secid; 697e1760bd5SEric W. Biederman kuid_t loginuid; 6984440e854SEric Paris unsigned int sessionid; 699161a09e7SJoy Latten }; 700c9204d9cSJoy Latten 701c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 702afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 703ab5f5e8bSJoy Latten { 704ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 705ab5f5e8bSJoy Latten 706afeb14b4SPaul Moore if (audit_enabled == 0) 707afeb14b4SPaul Moore return NULL; 708ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 709ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 710ab5f5e8bSJoy Latten if (audit_buf == NULL) 711ab5f5e8bSJoy Latten return NULL; 712afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 713afeb14b4SPaul Moore return audit_buf; 714afeb14b4SPaul Moore } 715afeb14b4SPaul Moore 7164440e854SEric Paris static inline void xfrm_audit_helper_usrinfo(kuid_t auid, unsigned int ses, u32 secid, 717afeb14b4SPaul Moore struct audit_buffer *audit_buf) 718afeb14b4SPaul Moore { 719afeb14b4SPaul Moore char *secctx; 720afeb14b4SPaul Moore u32 secctx_len; 721ab5f5e8bSJoy Latten 722e1760bd5SEric W. Biederman audit_log_format(audit_buf, " auid=%u ses=%u", 723e1760bd5SEric W. Biederman from_kuid(&init_user_ns, auid), ses); 72468277accSPaul Moore if (secid != 0 && 72568277accSPaul Moore security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) { 726ab5f5e8bSJoy Latten audit_log_format(audit_buf, " subj=%s", secctx); 727ab5f5e8bSJoy Latten security_release_secctx(secctx, secctx_len); 728ab5f5e8bSJoy Latten } else 729ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 730ab5f5e8bSJoy Latten } 731ab5f5e8bSJoy Latten 732d511337aSJoe Perches void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, kuid_t auid, 7336dd9158aSLinus Torvalds unsigned int ses, u32 secid); 734d511337aSJoe Perches void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, kuid_t auid, 7356dd9158aSLinus Torvalds unsigned int ses, u32 secid); 736d511337aSJoe Perches void xfrm_audit_state_add(struct xfrm_state *x, int result, kuid_t auid, 7376dd9158aSLinus Torvalds unsigned int ses, u32 secid); 738d511337aSJoe Perches void xfrm_audit_state_delete(struct xfrm_state *x, int result, kuid_t auid, 7396dd9158aSLinus Torvalds unsigned int ses, u32 secid); 740d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 741afeb14b4SPaul Moore struct sk_buff *skb); 742d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 743d511337aSJoe Perches __be32 net_seq); 744d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 745d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 746d511337aSJoe Perches __be32 net_seq); 747d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 748d511337aSJoe Perches u8 proto); 749c9204d9cSJoy Latten #else 75041fef0eeSMarcin Slusarz 75141fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7524440e854SEric Paris kuid_t auid, unsigned int ses, u32 secid) 75341fef0eeSMarcin Slusarz { 75441fef0eeSMarcin Slusarz } 75541fef0eeSMarcin Slusarz 75641fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7574440e854SEric Paris kuid_t auid, unsigned int ses, u32 secid) 75841fef0eeSMarcin Slusarz { 75941fef0eeSMarcin Slusarz } 76041fef0eeSMarcin Slusarz 76141fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7624440e854SEric Paris kuid_t auid, unsigned int ses, u32 secid) 76341fef0eeSMarcin Slusarz { 76441fef0eeSMarcin Slusarz } 76541fef0eeSMarcin Slusarz 76641fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7674440e854SEric Paris kuid_t auid, unsigned int ses, u32 secid) 76841fef0eeSMarcin Slusarz { 76941fef0eeSMarcin Slusarz } 77041fef0eeSMarcin Slusarz 77141fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 77241fef0eeSMarcin Slusarz struct sk_buff *skb) 77341fef0eeSMarcin Slusarz { 77441fef0eeSMarcin Slusarz } 77541fef0eeSMarcin Slusarz 7769fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7779fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7789fdc4883SSteffen Klassert { 7799fdc4883SSteffen Klassert } 7809fdc4883SSteffen Klassert 78141fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 78241fef0eeSMarcin Slusarz u16 family) 78341fef0eeSMarcin Slusarz { 78441fef0eeSMarcin Slusarz } 78541fef0eeSMarcin Slusarz 78641fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 78741fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 78841fef0eeSMarcin Slusarz { 78941fef0eeSMarcin Slusarz } 79041fef0eeSMarcin Slusarz 79141fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 79241fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 79341fef0eeSMarcin Slusarz { 79441fef0eeSMarcin Slusarz } 795c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 796161a09e7SJoy Latten 7971da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 7981da177e4SLinus Torvalds { 7991da177e4SLinus Torvalds if (likely(policy != NULL)) 8001da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 8011da177e4SLinus Torvalds } 8021da177e4SLinus Torvalds 803d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 8041da177e4SLinus Torvalds 8051da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 8061da177e4SLinus Torvalds { 8071da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 80864c31b3fSWANG Cong xfrm_policy_destroy(policy); 8091da177e4SLinus Torvalds } 8101da177e4SLinus Torvalds 8114e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 8124e81bb83SMasahide NAKAMURA { 8134e81bb83SMasahide NAKAMURA int i; 8144e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 8154e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 8164e81bb83SMasahide NAKAMURA } 8174e81bb83SMasahide NAKAMURA 818d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8191da177e4SLinus Torvalds 82021380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 82121380b81SHerbert Xu { 82221380b81SHerbert Xu atomic_dec(&x->refcnt); 82321380b81SHerbert Xu } 82421380b81SHerbert Xu 8251da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8261da177e4SLinus Torvalds { 8271da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 8281da177e4SLinus Torvalds __xfrm_state_destroy(x); 8291da177e4SLinus Torvalds } 8301da177e4SLinus Torvalds 8311da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8321da177e4SLinus Torvalds { 8331da177e4SLinus Torvalds atomic_inc(&x->refcnt); 8341da177e4SLinus Torvalds } 8351da177e4SLinus Torvalds 8361744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 8371744a8feSDavid S. Miller int prefixlen) 8381da177e4SLinus Torvalds { 8391744a8feSDavid S. Miller const __be32 *a1 = token1; 8401744a8feSDavid S. Miller const __be32 *a2 = token2; 8411da177e4SLinus Torvalds int pdw; 8421da177e4SLinus Torvalds int pbi; 8431da177e4SLinus Torvalds 844a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8451da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8461da177e4SLinus Torvalds 8471da177e4SLinus Torvalds if (pdw) 8481da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8491744a8feSDavid S. Miller return false; 8501da177e4SLinus Torvalds 8511da177e4SLinus Torvalds if (pbi) { 8525f19343fSAl Viro __be32 mask; 8531da177e4SLinus Torvalds 8541da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8551da177e4SLinus Torvalds 8561da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8571744a8feSDavid S. Miller return false; 8581da177e4SLinus Torvalds } 8591da177e4SLinus Torvalds 8601744a8feSDavid S. Miller return true; 8611da177e4SLinus Torvalds } 8621da177e4SLinus Torvalds 86326bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 86426bff940SAlexey Dobriyan { 86526bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 86626bff940SAlexey Dobriyan if (prefixlen == 0) 86726bff940SAlexey Dobriyan return true; 86826bff940SAlexey Dobriyan return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen))); 86926bff940SAlexey Dobriyan } 87026bff940SAlexey Dobriyan 8711da177e4SLinus Torvalds static __inline__ 8726281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8731da177e4SLinus Torvalds { 874f9d07e41SAl Viro __be16 port; 8751d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8761da177e4SLinus Torvalds case IPPROTO_TCP: 8771da177e4SLinus Torvalds case IPPROTO_UDP: 878ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8791da177e4SLinus Torvalds case IPPROTO_SCTP: 8806281dcc9SDavid S. Miller port = uli->ports.sport; 8811da177e4SLinus Torvalds break; 8821da177e4SLinus Torvalds case IPPROTO_ICMP: 8831da177e4SLinus Torvalds case IPPROTO_ICMPV6: 8846281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 8851da177e4SLinus Torvalds break; 8862ce4272aSMasahide NAKAMURA case IPPROTO_MH: 8876281dcc9SDavid S. Miller port = htons(uli->mht.type); 8882ce4272aSMasahide NAKAMURA break; 889cc9ff19dSTimo Teräs case IPPROTO_GRE: 8906281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 891cc9ff19dSTimo Teräs break; 8921da177e4SLinus Torvalds default: 8931da177e4SLinus Torvalds port = 0; /*XXX*/ 8941da177e4SLinus Torvalds } 8951da177e4SLinus Torvalds return port; 8961da177e4SLinus Torvalds } 8971da177e4SLinus Torvalds 8981da177e4SLinus Torvalds static __inline__ 8996281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 9001da177e4SLinus Torvalds { 901f9d07e41SAl Viro __be16 port; 9021d28f42cSDavid S. Miller switch(fl->flowi_proto) { 9031da177e4SLinus Torvalds case IPPROTO_TCP: 9041da177e4SLinus Torvalds case IPPROTO_UDP: 905ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 9061da177e4SLinus Torvalds case IPPROTO_SCTP: 9076281dcc9SDavid S. Miller port = uli->ports.dport; 9081da177e4SLinus Torvalds break; 9091da177e4SLinus Torvalds case IPPROTO_ICMP: 9101da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9116281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 9121da177e4SLinus Torvalds break; 913cc9ff19dSTimo Teräs case IPPROTO_GRE: 9146281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 915cc9ff19dSTimo Teräs break; 9161da177e4SLinus Torvalds default: 9171da177e4SLinus Torvalds port = 0; /*XXX*/ 9181da177e4SLinus Torvalds } 9191da177e4SLinus Torvalds return port; 9201da177e4SLinus Torvalds } 9211da177e4SLinus Torvalds 922d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 923d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9241da177e4SLinus Torvalds 925df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 926df71837dSTrent Jaeger /* If neither has a context --> match 927df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 928df71837dSTrent Jaeger */ 929bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 930df71837dSTrent Jaeger { 931df71837dSTrent Jaeger return ((!s1 && !s2) || 932df71837dSTrent Jaeger (s1 && s2 && 933df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 934df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 935df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 936df71837dSTrent Jaeger } 937df71837dSTrent Jaeger #else 938bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 939df71837dSTrent Jaeger { 940bc9b35adSDavid S. Miller return true; 941df71837dSTrent Jaeger } 942df71837dSTrent Jaeger #endif 943df71837dSTrent Jaeger 9441da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9451da177e4SLinus Torvalds * 9461da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9471da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9481da177e4SLinus Torvalds * 9491da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9501da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9511da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9521da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9531da177e4SLinus Torvalds * policy rule. 9541da177e4SLinus Torvalds */ 955fd2c3ef7SEric Dumazet struct xfrm_dst { 9561da177e4SLinus Torvalds union { 9571da177e4SLinus Torvalds struct dst_entry dst; 9581da177e4SLinus Torvalds struct rtable rt; 9591da177e4SLinus Torvalds struct rt6_info rt6; 9601da177e4SLinus Torvalds } u; 9611da177e4SLinus Torvalds struct dst_entry *route; 96280c802f3STimo Teräs struct flow_cache_object flo; 96380c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 96480c802f3STimo Teräs int num_pols, num_xfrms; 965157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 966157bfc25SMasahide NAKAMURA struct flowi *origin; 967157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 968157bfc25SMasahide NAKAMURA #endif 96980c802f3STimo Teräs u32 xfrm_genid; 97080c802f3STimo Teräs u32 policy_genid; 9711da177e4SLinus Torvalds u32 route_mtu_cached; 9721da177e4SLinus Torvalds u32 child_mtu_cached; 97392d63decSHideaki YOSHIFUJI u32 route_cookie; 97492d63decSHideaki YOSHIFUJI u32 path_cookie; 9751da177e4SLinus Torvalds }; 9761da177e4SLinus Torvalds 977def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 978aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 979aabc9761SHerbert Xu { 98080c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 981aabc9761SHerbert Xu dst_release(xdst->route); 982aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 983aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 984157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 985157bfc25SMasahide NAKAMURA kfree(xdst->origin); 986157bfc25SMasahide NAKAMURA xdst->origin = NULL; 987157bfc25SMasahide NAKAMURA kfree(xdst->partner); 988157bfc25SMasahide NAKAMURA xdst->partner = NULL; 989157bfc25SMasahide NAKAMURA #endif 990aabc9761SHerbert Xu } 991def8b4faSAlexey Dobriyan #endif 992aabc9761SHerbert Xu 993d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 994aabc9761SHerbert Xu 995fd2c3ef7SEric Dumazet struct sec_path { 9961da177e4SLinus Torvalds atomic_t refcnt; 9971da177e4SLinus Torvalds int len; 998dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 9991da177e4SLinus Torvalds }; 10001da177e4SLinus Torvalds 1001990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 1002990078afSMichael Smith { 1003990078afSMichael Smith #ifdef CONFIG_XFRM 1004990078afSMichael Smith return skb->sp != NULL; 1005990078afSMichael Smith #else 1006990078afSMichael Smith return 0; 1007990078afSMichael Smith #endif 1008990078afSMichael Smith } 1009990078afSMichael Smith 10101da177e4SLinus Torvalds static inline struct sec_path * 10111da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 10121da177e4SLinus Torvalds { 10131da177e4SLinus Torvalds if (sp) 10141da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 10151da177e4SLinus Torvalds return sp; 10161da177e4SLinus Torvalds } 10171da177e4SLinus Torvalds 1018d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10191da177e4SLinus Torvalds 10201da177e4SLinus Torvalds static inline void 10211da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10221da177e4SLinus Torvalds { 10231da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 10241da177e4SLinus Torvalds __secpath_destroy(sp); 10251da177e4SLinus Torvalds } 10261da177e4SLinus Torvalds 1027d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 10281da177e4SLinus Torvalds 10291da177e4SLinus Torvalds static inline void 10301da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10311da177e4SLinus Torvalds { 10321da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10331da177e4SLinus Torvalds secpath_put(skb->sp); 10341da177e4SLinus Torvalds skb->sp = NULL; 10351da177e4SLinus Torvalds #endif 10361da177e4SLinus Torvalds } 10371da177e4SLinus Torvalds 10381da177e4SLinus Torvalds static inline int 10396cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1040a1e59abfSPatrick McHardy { 1041a1e59abfSPatrick McHardy switch (family) { 1042a1e59abfSPatrick McHardy case AF_INET: 1043a1e59abfSPatrick McHardy return addr->a4 == 0; 1044a1e59abfSPatrick McHardy case AF_INET6: 1045a1e59abfSPatrick McHardy return ipv6_addr_any((struct in6_addr *)&addr->a6); 1046a1e59abfSPatrick McHardy } 1047a1e59abfSPatrick McHardy return 0; 1048a1e59abfSPatrick McHardy } 1049a1e59abfSPatrick McHardy 1050a1e59abfSPatrick McHardy static inline int 105121eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10521da177e4SLinus Torvalds { 10531da177e4SLinus Torvalds return (tmpl->saddr.a4 && 10541da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 10551da177e4SLinus Torvalds } 10561da177e4SLinus Torvalds 10571da177e4SLinus Torvalds static inline int 105821eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10591da177e4SLinus Torvalds { 10601da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1061ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 10621da177e4SLinus Torvalds } 10631da177e4SLinus Torvalds 10641da177e4SLinus Torvalds static inline int 106521eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 10661da177e4SLinus Torvalds { 10671da177e4SLinus Torvalds switch (family) { 10681da177e4SLinus Torvalds case AF_INET: 10691da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 10701da177e4SLinus Torvalds case AF_INET6: 10711da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 10721da177e4SLinus Torvalds } 10731da177e4SLinus Torvalds return !0; 10741da177e4SLinus Torvalds } 10751da177e4SLinus Torvalds 10761da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1077d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1078d511337aSJoe Perches unsigned short family); 10791da177e4SLinus Torvalds 1080d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1081d5422efeSHerbert Xu struct sk_buff *skb, 1082d5422efeSHerbert Xu unsigned int family, int reverse) 10831da177e4SLinus Torvalds { 1084f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1085d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1086d5422efeSHerbert Xu 10871da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1088d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 10891da177e4SLinus Torvalds 1090f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1091adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1092d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1093d5422efeSHerbert Xu } 1094d5422efeSHerbert Xu 1095d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1096d5422efeSHerbert Xu { 1097d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 10981da177e4SLinus Torvalds } 10991da177e4SLinus Torvalds 11001da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11011da177e4SLinus Torvalds { 11021da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 11031da177e4SLinus Torvalds } 11041da177e4SLinus Torvalds 11051da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11061da177e4SLinus Torvalds { 11071da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 11081da177e4SLinus Torvalds } 11091da177e4SLinus Torvalds 1110d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1111d5422efeSHerbert Xu struct sk_buff *skb) 1112d5422efeSHerbert Xu { 1113d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1114d5422efeSHerbert Xu } 1115d5422efeSHerbert Xu 1116d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1117d5422efeSHerbert Xu struct sk_buff *skb) 1118d5422efeSHerbert Xu { 1119d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1120d5422efeSHerbert Xu } 1121d5422efeSHerbert Xu 1122d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1123d5422efeSHerbert Xu unsigned int family, int reverse); 1124d5422efeSHerbert Xu 1125d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1126d5422efeSHerbert Xu unsigned int family) 1127d5422efeSHerbert Xu { 1128d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1129d5422efeSHerbert Xu } 1130d5422efeSHerbert Xu 1131d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1132d5422efeSHerbert Xu struct flowi *fl, 1133d5422efeSHerbert Xu unsigned int family) 1134d5422efeSHerbert Xu { 1135d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1136d5422efeSHerbert Xu } 1137d5422efeSHerbert Xu 1138d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11391da177e4SLinus Torvalds 11401da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11411da177e4SLinus Torvalds { 114299a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 114399a66657SAlexey Dobriyan 114499a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1145adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11461da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11471da177e4SLinus Torvalds } 11481da177e4SLinus Torvalds 11491da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11501da177e4SLinus Torvalds { 11511da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 11521da177e4SLinus Torvalds } 11531da177e4SLinus Torvalds 11541da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 11551da177e4SLinus Torvalds { 11561da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 11571da177e4SLinus Torvalds } 11581da177e4SLinus Torvalds 1159d511337aSJoe Perches int __xfrm_sk_clone_policy(struct sock *sk); 11601da177e4SLinus Torvalds 11611da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) 11621da177e4SLinus Torvalds { 11631da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] || sk->sk_policy[1])) 11641da177e4SLinus Torvalds return __xfrm_sk_clone_policy(sk); 11651da177e4SLinus Torvalds return 0; 11661da177e4SLinus Torvalds } 11671da177e4SLinus Torvalds 1168d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 11691da177e4SLinus Torvalds 11701da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 11711da177e4SLinus Torvalds { 11721da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] != NULL)) { 11731da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX); 11741da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 11751da177e4SLinus Torvalds } 11761da177e4SLinus Torvalds if (unlikely(sk->sk_policy[1] != NULL)) { 11771da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1); 11781da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 11791da177e4SLinus Torvalds } 11801da177e4SLinus Torvalds } 11811da177e4SLinus Torvalds 1182d511337aSJoe Perches void xfrm_garbage_collect(struct net *net); 1183e4c17216SPaul Moore 11841da177e4SLinus Torvalds #else 11851da177e4SLinus Torvalds 11861da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 11871da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; } 11881da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 11891da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 11901da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11911da177e4SLinus Torvalds { 11921da177e4SLinus Torvalds return 1; 11931da177e4SLinus Torvalds } 11941da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11951da177e4SLinus Torvalds { 11961da177e4SLinus Torvalds return 1; 11971da177e4SLinus Torvalds } 11981da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 11991da177e4SLinus Torvalds { 12001da177e4SLinus Torvalds return 1; 12011da177e4SLinus Torvalds } 1202d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1203d5422efeSHerbert Xu struct flowi *fl, 1204d5422efeSHerbert Xu unsigned int family) 1205d5422efeSHerbert Xu { 1206d5422efeSHerbert Xu return -ENOSYS; 1207d5422efeSHerbert Xu } 1208d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1209d5422efeSHerbert Xu struct sk_buff *skb) 1210d5422efeSHerbert Xu { 1211d5422efeSHerbert Xu return 1; 1212d5422efeSHerbert Xu } 1213d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1214d5422efeSHerbert Xu struct sk_buff *skb) 1215d5422efeSHerbert Xu { 1216d5422efeSHerbert Xu return 1; 1217d5422efeSHerbert Xu } 1218e4c17216SPaul Moore static inline void xfrm_garbage_collect(struct net *net) 1219e4c17216SPaul Moore { 1220e4c17216SPaul Moore } 12211da177e4SLinus Torvalds #endif 12221da177e4SLinus Torvalds 12231da177e4SLinus Torvalds static __inline__ 1224e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12251da177e4SLinus Torvalds { 12261da177e4SLinus Torvalds switch (family){ 12271da177e4SLinus Torvalds case AF_INET: 12287e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12291da177e4SLinus Torvalds case AF_INET6: 12307e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12311da177e4SLinus Torvalds } 12321da177e4SLinus Torvalds return NULL; 12331da177e4SLinus Torvalds } 12341da177e4SLinus Torvalds 12351da177e4SLinus Torvalds static __inline__ 1236e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12371da177e4SLinus Torvalds { 12381da177e4SLinus Torvalds switch (family){ 12391da177e4SLinus Torvalds case AF_INET: 12407e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12411da177e4SLinus Torvalds case AF_INET6: 12427e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12431da177e4SLinus Torvalds } 12441da177e4SLinus Torvalds return NULL; 12451da177e4SLinus Torvalds } 12461da177e4SLinus Torvalds 12479bb182a7SYOSHIFUJI Hideaki static __inline__ 1248e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 12499bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 12509bb182a7SYOSHIFUJI Hideaki unsigned short family) 12519bb182a7SYOSHIFUJI Hideaki { 12529bb182a7SYOSHIFUJI Hideaki switch(family) { 12539bb182a7SYOSHIFUJI Hideaki case AF_INET: 12547e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 12557e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 12569bb182a7SYOSHIFUJI Hideaki break; 12579bb182a7SYOSHIFUJI Hideaki case AF_INET6: 12584e3fd7a0SAlexey Dobriyan *(struct in6_addr *)saddr->a6 = fl->u.ip6.saddr; 12594e3fd7a0SAlexey Dobriyan *(struct in6_addr *)daddr->a6 = fl->u.ip6.daddr; 12609bb182a7SYOSHIFUJI Hideaki break; 12619bb182a7SYOSHIFUJI Hideaki } 12629bb182a7SYOSHIFUJI Hideaki } 12639bb182a7SYOSHIFUJI Hideaki 12641da177e4SLinus Torvalds static __inline__ int 1265f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1266f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12671da177e4SLinus Torvalds { 12681da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 12691da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 12701da177e4SLinus Torvalds return 1; 12711da177e4SLinus Torvalds return 0; 12721da177e4SLinus Torvalds } 12731da177e4SLinus Torvalds 12741da177e4SLinus Torvalds static __inline__ int 1275f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1276f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 12771da177e4SLinus Torvalds { 1278ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1279ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 12801da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 12811da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 12821da177e4SLinus Torvalds return 1; 12831da177e4SLinus Torvalds return 0; 12841da177e4SLinus Torvalds } 12851da177e4SLinus Torvalds 12861da177e4SLinus Torvalds static __inline__ int 1287f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1288f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 12891da177e4SLinus Torvalds unsigned short family) 12901da177e4SLinus Torvalds { 12911da177e4SLinus Torvalds switch (family) { 12921da177e4SLinus Torvalds case AF_INET: 12931da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 12941da177e4SLinus Torvalds case AF_INET6: 12951da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 12961da177e4SLinus Torvalds } 12971da177e4SLinus Torvalds return 0; 12981da177e4SLinus Torvalds } 12991da177e4SLinus Torvalds 1300e53820deSMasahide NAKAMURA static __inline__ int 1301f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1302e53820deSMasahide NAKAMURA unsigned short family) 1303e53820deSMasahide NAKAMURA { 1304e53820deSMasahide NAKAMURA switch (family) { 1305e53820deSMasahide NAKAMURA case AF_INET: 1306e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 13077e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 13087e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1309e53820deSMasahide NAKAMURA case AF_INET6: 1310e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 13117e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 13127e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1313e53820deSMasahide NAKAMURA } 1314e53820deSMasahide NAKAMURA return 0; 1315e53820deSMasahide NAKAMURA } 1316e53820deSMasahide NAKAMURA 1317f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13181da177e4SLinus Torvalds { 13191da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13201da177e4SLinus Torvalds } 13211da177e4SLinus Torvalds 13225794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13235794708fSMasahide NAKAMURA { 1324dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1325dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1326dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1327dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13285794708fSMasahide NAKAMURA } 13295794708fSMasahide NAKAMURA 13301da177e4SLinus Torvalds /* 13311da177e4SLinus Torvalds * xfrm algorithm information 13321da177e4SLinus Torvalds */ 13331a6509d9SHerbert Xu struct xfrm_algo_aead_info { 13341a6509d9SHerbert Xu u16 icv_truncbits; 13351a6509d9SHerbert Xu }; 13361a6509d9SHerbert Xu 13371da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13381da177e4SLinus Torvalds u16 icv_truncbits; 13391da177e4SLinus Torvalds u16 icv_fullbits; 13401da177e4SLinus Torvalds }; 13411da177e4SLinus Torvalds 13421da177e4SLinus Torvalds struct xfrm_algo_encr_info { 13431da177e4SLinus Torvalds u16 blockbits; 13441da177e4SLinus Torvalds u16 defkeybits; 13451da177e4SLinus Torvalds }; 13461da177e4SLinus Torvalds 13471da177e4SLinus Torvalds struct xfrm_algo_comp_info { 13481da177e4SLinus Torvalds u16 threshold; 13491da177e4SLinus Torvalds }; 13501da177e4SLinus Torvalds 13511da177e4SLinus Torvalds struct xfrm_algo_desc { 13521da177e4SLinus Torvalds char *name; 135304ff1260SHerbert Xu char *compat; 13541da177e4SLinus Torvalds u8 available:1; 13557e50f84cSJussi Kivilinna u8 pfkey_supported:1; 13561da177e4SLinus Torvalds union { 13571a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 13581da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 13591da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 13601da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 13611da177e4SLinus Torvalds } uinfo; 13621da177e4SLinus Torvalds struct sadb_alg desc; 13631da177e4SLinus Torvalds }; 13641da177e4SLinus Torvalds 13653328715eSSteffen Klassert /* XFRM protocol handlers. */ 13663328715eSSteffen Klassert struct xfrm4_protocol { 13673328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 13683328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 13693328715eSSteffen Klassert int encap_type); 13703328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 13713328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 13723328715eSSteffen Klassert 13733328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 13743328715eSSteffen Klassert int priority; 13753328715eSSteffen Klassert }; 13763328715eSSteffen Klassert 13777e14ea15SSteffen Klassert struct xfrm6_protocol { 13787e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 13797e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 13807e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 13817e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 13827e14ea15SSteffen Klassert 13837e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 13847e14ea15SSteffen Klassert int priority; 13857e14ea15SSteffen Klassert }; 13867e14ea15SSteffen Klassert 13871da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 13881da177e4SLinus Torvalds struct xfrm_tunnel { 13891da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1390a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1391d2acc347SHerbert Xu 1392b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1393d2acc347SHerbert Xu int priority; 13941da177e4SLinus Torvalds }; 13951da177e4SLinus Torvalds 13961da177e4SLinus Torvalds struct xfrm6_tunnel { 1397d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1398d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1399d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 14006f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1401d2acc347SHerbert Xu int priority; 14021da177e4SLinus Torvalds }; 14031da177e4SLinus Torvalds 1404d511337aSJoe Perches void xfrm_init(void); 1405d511337aSJoe Perches void xfrm4_init(void); 1406d511337aSJoe Perches int xfrm_state_init(struct net *net); 1407d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1408d511337aSJoe Perches void xfrm4_state_init(void); 14092f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1410c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1411d511337aSJoe Perches int xfrm6_init(void); 1412d511337aSJoe Perches void xfrm6_fini(void); 1413d511337aSJoe Perches int xfrm6_state_init(void); 1414d511337aSJoe Perches void xfrm6_state_fini(void); 14157e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 14167e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1417c35b7e72SDaniel Lezcano #else 1418c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1419c35b7e72SDaniel Lezcano { 1420c35b7e72SDaniel Lezcano return 0; 1421c35b7e72SDaniel Lezcano } 1422c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1423c35b7e72SDaniel Lezcano { 1424c35b7e72SDaniel Lezcano ; 1425c35b7e72SDaniel Lezcano } 1426c35b7e72SDaniel Lezcano #endif 14271da177e4SLinus Torvalds 1428558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1429d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1430d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1431558f82efSMasahide NAKAMURA #endif 1432558f82efSMasahide NAKAMURA 1433d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1434b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1435d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1436b27aeadbSAlexey Dobriyan #else 1437b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1438b27aeadbSAlexey Dobriyan { 1439b27aeadbSAlexey Dobriyan } 1440b27aeadbSAlexey Dobriyan #endif 1441b27aeadbSAlexey Dobriyan 1442d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1443870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1444d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 14454c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1446283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1447d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1448d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 144933765d06SDavid S. Miller const xfrm_address_t *saddr, 1450b520e9f6SDavid S. Miller const struct flowi *fl, 1451b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 14521da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 14531da177e4SLinus Torvalds unsigned short family); 1454d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 14555447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1456628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1457628529b6SJamal Hadi Salim unsigned short family, 1458628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1459c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1460c454997eSFan Du unsigned short family); 1461d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1462d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1463d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1464d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1465d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1466a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1467bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1468d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1469a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1470a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1471bd55775cSJamal Hadi Salim u8 proto, 1472bd55775cSJamal Hadi Salim unsigned short family); 147341a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1474d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1475283bc9f3SFan Du unsigned short family, struct net *net); 1476d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1477d511337aSJoe Perches unsigned short family); 147841a49cc3SMasahide NAKAMURA #else 147941a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1480283bc9f3SFan Du int n, unsigned short family, struct net *net) 148141a49cc3SMasahide NAKAMURA { 148241a49cc3SMasahide NAKAMURA return -ENOSYS; 148341a49cc3SMasahide NAKAMURA } 148441a49cc3SMasahide NAKAMURA 148541a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 148641a49cc3SMasahide NAKAMURA int n, unsigned short family) 148741a49cc3SMasahide NAKAMURA { 148841a49cc3SMasahide NAKAMURA return -ENOSYS; 148941a49cc3SMasahide NAKAMURA } 149041a49cc3SMasahide NAKAMURA #endif 1491af11e316SJamal Hadi Salim 1492af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1493af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1494af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1495af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1496af11e316SJamal Hadi Salim }; 1497af11e316SJamal Hadi Salim 14985a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 14995a6d3416SJamal Hadi Salim u32 incnt; 15005a6d3416SJamal Hadi Salim u32 outcnt; 15015a6d3416SJamal Hadi Salim u32 fwdcnt; 15025a6d3416SJamal Hadi Salim u32 inscnt; 15035a6d3416SJamal Hadi Salim u32 outscnt; 15045a6d3416SJamal Hadi Salim u32 fwdscnt; 15055a6d3416SJamal Hadi Salim u32 spdhcnt; 15065a6d3416SJamal Hadi Salim u32 spdhmcnt; 15075a6d3416SJamal Hadi Salim }; 15085a6d3416SJamal Hadi Salim 1509d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1510d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 1511d511337aSJoe Perches int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info); 1512d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1513d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1514d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1515d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1516d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1517d511337aSJoe Perches int __xfrm_init_state(struct xfrm_state *x, bool init_replay); 1518d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1519d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1520d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1521d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1522d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 1523d511337aSJoe Perches int xfrm_output(struct sk_buff *skb); 1524d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1525d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1526d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1527d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1528d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1529716062fdSHerbert Xu int encap_type); 1530d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1531d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 1532c4541b41SHerbert Xu 1533c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1534c4541b41SHerbert Xu { 153570be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15363328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15373328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15383328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1539c4541b41SHerbert Xu } 1540c4541b41SHerbert Xu 1541d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1542d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1543*aad88724SEric Dumazet int xfrm4_output(struct sock *sk, struct sk_buff *skb); 1544d511337aSJoe Perches int xfrm4_output_finish(struct sk_buff *skb); 15453328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15463328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 15473328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1548d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1549d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1550d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1551d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1552d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1553d511337aSJoe Perches int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi); 1554d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 1555d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1556d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1557fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 15587b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 15597e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15607e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 15617e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1562d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 15637b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1564d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1565d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1566d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1567d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1568*aad88724SEric Dumazet int xfrm6_output(struct sock *sk, struct sk_buff *skb); 1569d511337aSJoe Perches int xfrm6_output_finish(struct sk_buff *skb); 1570d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1571aee5adb4SMasahide NAKAMURA u8 **prevhdr); 15721da177e4SLinus Torvalds 15731da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1574d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1575d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1576d511337aSJoe Perches u8 __user *optval, int optlen); 15771da177e4SLinus Torvalds #else 15781da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 15791da177e4SLinus Torvalds { 15801da177e4SLinus Torvalds return -ENOPROTOOPT; 15811da177e4SLinus Torvalds } 15821da177e4SLinus Torvalds 1583067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 15841da177e4SLinus Torvalds { 15851da177e4SLinus Torvalds /* should not happen */ 15861da177e4SLinus Torvalds kfree_skb(skb); 15871da177e4SLinus Torvalds return 0; 15881da177e4SLinus Torvalds } 15891da177e4SLinus Torvalds #endif 15901da177e4SLinus Torvalds 15910331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 15924c563f76STimo Teras 1593d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1594d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1595d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1596d511337aSJoe Perches void *); 1597283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 15981da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 15998ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 16008ca2e93bSJamal Hadi Salim u8 type, int dir, 16014e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1602ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1603ef41aaa0SEric Paris int *err); 1604d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1605d511337aSJoe Perches u32 id, int delete, int *err); 160633ffbbd5SAlexey Dobriyan int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info); 16071da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1608776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1609d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1610e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1611bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1612a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1613a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1614bd55775cSJamal Hadi Salim unsigned short family); 1615d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16161da177e4SLinus Torvalds 161780c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1618d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1619183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 1620183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 1621283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1622d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 162380c9abaaSShinta Sugimoto struct xfrm_migrate *m); 1624d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 162513c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16268d549c4fSFan Du struct xfrm_kmaddress *k, struct net *net); 162780c9abaaSShinta Sugimoto #endif 162880c9abaaSShinta Sugimoto 1629d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1630d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1631d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1632d511337aSJoe Perches xfrm_address_t *addr); 16331da177e4SLinus Torvalds 1634d511337aSJoe Perches void xfrm_input_init(void); 1635d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 16361da177e4SLinus Torvalds 1637d511337aSJoe Perches void xfrm_probe_algs(void); 1638d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1639d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1640d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1641d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1642d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1643d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1644d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1645d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1646d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1647d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1648d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 16491a6509d9SHerbert Xu int probe); 16501da177e4SLinus Torvalds 1651ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1652ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1653ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1654ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1655ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1656ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1657ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 165870e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 165970e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 166070e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 166170e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 166270e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 166370e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 166470e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 166570e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 166670e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 166770e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 166870e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 166970e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 167070e94e66SYOSHIFUJI Hideaki / 吉藤英明 167177d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 167277d8d7a6SHerbert Xu { 167377d8d7a6SHerbert Xu return index & 7; 167477d8d7a6SHerbert Xu } 167577d8d7a6SHerbert Xu 1676a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1677a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1678f8cd5488SJamal Hadi Salim { 1679be33690dSPatrick McHardy struct sock *nlsk; 1680be33690dSPatrick McHardy int ret = 0; 1681be33690dSPatrick McHardy 1682be33690dSPatrick McHardy rcu_read_lock(); 1683a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1684be33690dSPatrick McHardy if (nlsk) 1685be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1686be33690dSPatrick McHardy rcu_read_unlock(); 1687be33690dSPatrick McHardy return ret; 1688f8cd5488SJamal Hadi Salim } 16890f24558eSHoria Geanta 16900f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 16910f24558eSHoria Geanta { 16920f24558eSHoria Geanta struct sock *nlsk; 16930f24558eSHoria Geanta int ret = 0; 16940f24558eSHoria Geanta 16950f24558eSHoria Geanta rcu_read_lock(); 16960f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 16970f24558eSHoria Geanta if (nlsk) 16980f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 16990f24558eSHoria Geanta rcu_read_unlock(); 17000f24558eSHoria Geanta 17010f24558eSHoria Geanta return ret; 17020f24558eSHoria Geanta } 1703a6483b79SAlexey Dobriyan #endif 1704f8cd5488SJamal Hadi Salim 1705ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1706ee5c2317SSteffen Klassert { 1707ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1708ee5c2317SSteffen Klassert } 1709ee5c2317SSteffen Klassert 171085158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 17110f99be0dSEric Dumazet { 17120f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17130f99be0dSEric Dumazet } 17140f99be0dSEric Dumazet 171585158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17164447bb33SMartin Willi { 17174447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17184447bb33SMartin Willi } 17194447bb33SMartin Willi 17209736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17219736acf3SSteffen Klassert { 17229736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17239736acf3SSteffen Klassert } 17249736acf3SSteffen Klassert 172580c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1726af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1727af2f464eSSteffen Klassert struct xfrm_state *orig) 1728af2f464eSSteffen Klassert { 1729af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1730af2f464eSSteffen Klassert GFP_KERNEL); 1731af2f464eSSteffen Klassert if (!x->replay_esn) 1732af2f464eSSteffen Klassert return -ENOMEM; 1733af2f464eSSteffen Klassert 1734af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1735af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1736af2f464eSSteffen Klassert 1737af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1738af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1739af2f464eSSteffen Klassert GFP_KERNEL); 1740af2f464eSSteffen Klassert if (!x->preplay_esn) { 1741af2f464eSSteffen Klassert kfree(x->replay_esn); 1742af2f464eSSteffen Klassert return -ENOMEM; 1743af2f464eSSteffen Klassert } 1744af2f464eSSteffen Klassert 1745af2f464eSSteffen Klassert return 0; 1746af2f464eSSteffen Klassert } 1747af2f464eSSteffen Klassert 1748ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1749ee5c2317SSteffen Klassert { 1750ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1751ee5c2317SSteffen Klassert } 1752ee5c2317SSteffen Klassert 1753ee5c2317SSteffen Klassert 175480c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 175580c9abaaSShinta Sugimoto { 17560f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 175780c9abaaSShinta Sugimoto } 175880c9abaaSShinta Sugimoto 17594447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 17604447bb33SMartin Willi { 17614447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 17624447bb33SMartin Willi } 17634447bb33SMartin Willi 176480c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 176580c9abaaSShinta Sugimoto { 176680c9abaaSShinta Sugimoto int i; 176780c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 176880c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 176980c9abaaSShinta Sugimoto } 177080c9abaaSShinta Sugimoto 177180c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 177280c9abaaSShinta Sugimoto { 177380c9abaaSShinta Sugimoto int i; 177480c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 177580c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 177680c9abaaSShinta Sugimoto } 177780c9abaaSShinta Sugimoto #endif 1778f8cd5488SJamal Hadi Salim 1779def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 178000501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 178100501121SHerbert Xu { 178200501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 178300501121SHerbert Xu } 1784def8b4faSAlexey Dobriyan #endif 178500501121SHerbert Xu 1786bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1787bf825f81SJamal Hadi Salim { 1788bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 17894efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1790bf825f81SJamal Hadi Salim else 1791bf825f81SJamal Hadi Salim m->v = m->m = 0; 1792bf825f81SJamal Hadi Salim 1793bf825f81SJamal Hadi Salim return m->v & m->m; 1794bf825f81SJamal Hadi Salim } 1795bf825f81SJamal Hadi Salim 1796e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1797bf825f81SJamal Hadi Salim { 17981d1e34ddSDavid S. Miller int ret = 0; 1799bf825f81SJamal Hadi Salim 18001d1e34ddSDavid S. Miller if (m->m | m->v) 18011d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 18021d1e34ddSDavid S. Miller return ret; 1803bf825f81SJamal Hadi Salim } 1804bf825f81SJamal Hadi Salim 180570be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 180670be6c91SSteffen Klassert unsigned int family) 180770be6c91SSteffen Klassert { 180870be6c91SSteffen Klassert bool tunnel = false; 180970be6c91SSteffen Klassert 181070be6c91SSteffen Klassert switch(family) { 181170be6c91SSteffen Klassert case AF_INET: 181270be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 181370be6c91SSteffen Klassert tunnel = true; 181470be6c91SSteffen Klassert break; 181570be6c91SSteffen Klassert case AF_INET6: 181670be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 181770be6c91SSteffen Klassert tunnel = true; 181870be6c91SSteffen Klassert break; 181970be6c91SSteffen Klassert } 182070be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 182170be6c91SSteffen Klassert return -EINVAL; 182270be6c91SSteffen Klassert 182370be6c91SSteffen Klassert return 0; 182470be6c91SSteffen Klassert } 18251da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1826