11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 151da177e4SLinus Torvalds 161da177e4SLinus Torvalds #include <net/sock.h> 171da177e4SLinus Torvalds #include <net/dst.h> 18436a0a40SHerbert Xu #include <net/ip.h> 191da177e4SLinus Torvalds #include <net/route.h> 201da177e4SLinus Torvalds #include <net/ipv6.h> 211da177e4SLinus Torvalds #include <net/ip6_fib.h> 22558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 23558f82efSMasahide NAKAMURA #include <net/snmp.h> 24558f82efSMasahide NAKAMURA #endif 251da177e4SLinus Torvalds 26d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 27d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 28d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 29d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 30d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 33d3d6dd3aSMasahide NAKAMURA 341da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 35b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 36b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 37d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 38d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 391da177e4SLinus Torvalds 40558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 41558f82efSMasahide NAKAMURA DECLARE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics); 42558f82efSMasahide NAKAMURA #define XFRM_INC_STATS(field) SNMP_INC_STATS(xfrm_statistics, field) 43558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_BH(field) SNMP_INC_STATS_BH(xfrm_statistics, field) 44558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_USER(field) SNMP_INC_STATS_USER(xfrm_statistics, field) 45558f82efSMasahide NAKAMURA #else 46558f82efSMasahide NAKAMURA #define XFRM_INC_STATS(field) 47558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_BH(field) 48558f82efSMasahide NAKAMURA #define XFRM_INC_STATS_USER(field) 49558f82efSMasahide NAKAMURA #endif 50558f82efSMasahide NAKAMURA 51f8cd5488SJamal Hadi Salim extern struct sock *xfrm_nl; 52f8cd5488SJamal Hadi Salim extern u32 sysctl_xfrm_aevent_etime; 53f8cd5488SJamal Hadi Salim extern u32 sysctl_xfrm_aevent_rseqth; 54a37ae408SPavel Emelyanov extern int sysctl_xfrm_larval_drop; 55a37ae408SPavel Emelyanov extern u32 sysctl_xfrm_acq_expires; 56f8cd5488SJamal Hadi Salim 574a3e2f71SArjan van de Ven extern struct mutex xfrm_cfg_mutex; 581da177e4SLinus Torvalds 591da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 601da177e4SLinus Torvalds ------------------------------------ 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds Basic objects: 631da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 641da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 651da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 661da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 691da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 701da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 711da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 741da177e4SLinus Torvalds 751da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 761da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 771da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 781da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 791da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 801da177e4SLinus Torvalds to a dst_entry returned to requestor. 811da177e4SLinus Torvalds 821da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 831da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 841da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 851da177e4SLinus Torvalds |---. child .-> NULL 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 881da177e4SLinus Torvalds 891da177e4SLinus Torvalds 901da177e4SLinus Torvalds Resolution of xrfm_tmpl 911da177e4SLinus Torvalds ----------------------- 921da177e4SLinus Torvalds Template contains: 931da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 941da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 951da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 961da177e4SLinus Torvalds Q: allow to resolve security gateway? 971da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 981da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 991da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 1001da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 1011da177e4SLinus Torvalds 7. ->share Sharing mode. 1021da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 1031da177e4SLinus Torvalds flow id? 1041da177e4SLinus Torvalds 1051da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1061da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1071da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1081da177e4SLinus Torvalds 1091da177e4SLinus Torvalds PROBLEMS: 1101da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1111da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1121da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1131da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1141da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1151da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1161da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1171da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1181da177e4SLinus Torvalds */ 1191da177e4SLinus Torvalds 1201da177e4SLinus Torvalds /* Full description of state of transformer. */ 1211da177e4SLinus Torvalds struct xfrm_state 1221da177e4SLinus Torvalds { 1231da177e4SLinus Torvalds /* Note: bydst is re-used during gc */ 1244c563f76STimo Teras struct list_head all; 1258f126e37SDavid S. Miller struct hlist_node bydst; 1268f126e37SDavid S. Miller struct hlist_node bysrc; 1278f126e37SDavid S. Miller struct hlist_node byspi; 1281da177e4SLinus Torvalds 1291da177e4SLinus Torvalds atomic_t refcnt; 1301da177e4SLinus Torvalds spinlock_t lock; 1311da177e4SLinus Torvalds 1321da177e4SLinus Torvalds struct xfrm_id id; 1331da177e4SLinus Torvalds struct xfrm_selector sel; 1341da177e4SLinus Torvalds 1359d4a706dSDavid S. Miller u32 genid; 1369d4a706dSDavid S. Miller 1371da177e4SLinus Torvalds /* Key manger bits */ 1381da177e4SLinus Torvalds struct { 1391da177e4SLinus Torvalds u8 state; 1401da177e4SLinus Torvalds u8 dying; 1411da177e4SLinus Torvalds u32 seq; 1421da177e4SLinus Torvalds } km; 1431da177e4SLinus Torvalds 1441da177e4SLinus Torvalds /* Parameters of this state. */ 1451da177e4SLinus Torvalds struct { 1461da177e4SLinus Torvalds u32 reqid; 1471da177e4SLinus Torvalds u8 mode; 1481da177e4SLinus Torvalds u8 replay_window; 1491da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1501da177e4SLinus Torvalds u8 flags; 1511da177e4SLinus Torvalds u16 family; 1521da177e4SLinus Torvalds xfrm_address_t saddr; 1531da177e4SLinus Torvalds int header_len; 1541da177e4SLinus Torvalds int trailer_len; 1551da177e4SLinus Torvalds } props; 1561da177e4SLinus Torvalds 1571da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds /* Data for transformer */ 1601da177e4SLinus Torvalds struct xfrm_algo *aalg; 1611da177e4SLinus Torvalds struct xfrm_algo *ealg; 1621da177e4SLinus Torvalds struct xfrm_algo *calg; 1631a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 1641da177e4SLinus Torvalds 1651da177e4SLinus Torvalds /* Data for encapsulator */ 1661da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1671da177e4SLinus Torvalds 168060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 169060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 170060f02a3SNoriaki TAKAMIYA 1711da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1721da177e4SLinus Torvalds struct xfrm_state *tunnel; 1731da177e4SLinus Torvalds 1741da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1751da177e4SLinus Torvalds atomic_t tunnel_users; 1761da177e4SLinus Torvalds 1771da177e4SLinus Torvalds /* State for replay detection */ 1781da177e4SLinus Torvalds struct xfrm_replay_state replay; 1791da177e4SLinus Torvalds 180f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 181f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 182f8cd5488SJamal Hadi Salim 1832717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 1842717096aSJamal Hadi Salim * moment 1852717096aSJamal Hadi Salim */ 1862717096aSJamal Hadi Salim u32 xflags; 1872717096aSJamal Hadi Salim 188f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 189f8cd5488SJamal Hadi Salim u32 replay_maxage; 190f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 191f8cd5488SJamal Hadi Salim 192f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 193f8cd5488SJamal Hadi Salim struct timer_list rtimer; 194f8cd5488SJamal Hadi Salim 1951da177e4SLinus Torvalds /* Statistics */ 1961da177e4SLinus Torvalds struct xfrm_stats stats; 1971da177e4SLinus Torvalds 1981da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 1991da177e4SLinus Torvalds struct timer_list timer; 2001da177e4SLinus Torvalds 2019afaca05SMasahide NAKAMURA /* Last used time */ 202d26f3984SHerbert Xu unsigned long lastused; 2039afaca05SMasahide NAKAMURA 2041da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2051da177e4SLinus Torvalds * transformer. */ 206533cb5b0SEric Dumazet const struct xfrm_type *type; 20713996378SHerbert Xu struct xfrm_mode *inner_mode; 208df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 20913996378SHerbert Xu struct xfrm_mode *outer_mode; 2101da177e4SLinus Torvalds 211df71837dSTrent Jaeger /* Security context */ 212df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 213df71837dSTrent Jaeger 2141da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2151da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2161da177e4SLinus Torvalds void *data; 2171da177e4SLinus Torvalds }; 2181da177e4SLinus Torvalds 2192717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2202717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 2212717096aSJamal Hadi Salim 2221da177e4SLinus Torvalds enum { 2231da177e4SLinus Torvalds XFRM_STATE_VOID, 2241da177e4SLinus Torvalds XFRM_STATE_ACQ, 2251da177e4SLinus Torvalds XFRM_STATE_VALID, 2261da177e4SLinus Torvalds XFRM_STATE_ERROR, 2271da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2281da177e4SLinus Torvalds XFRM_STATE_DEAD 2291da177e4SLinus Torvalds }; 2301da177e4SLinus Torvalds 23126b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 23226b15dadSJamal Hadi Salim struct km_event 23326b15dadSJamal Hadi Salim { 234bf08867fSHerbert Xu union { 235bf08867fSHerbert Xu u32 hard; 236bf08867fSHerbert Xu u32 proto; 237bf08867fSHerbert Xu u32 byid; 238f8cd5488SJamal Hadi Salim u32 aevent; 239f7b6983fSMasahide NAKAMURA u32 type; 240bf08867fSHerbert Xu } data; 241bf08867fSHerbert Xu 24226b15dadSJamal Hadi Salim u32 seq; 24326b15dadSJamal Hadi Salim u32 pid; 24426b15dadSJamal Hadi Salim u32 event; 24526b15dadSJamal Hadi Salim }; 24626b15dadSJamal Hadi Salim 24725ee3286SHerbert Xu struct net_device; 2481da177e4SLinus Torvalds struct xfrm_type; 2491da177e4SLinus Torvalds struct xfrm_dst; 2501da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2511da177e4SLinus Torvalds unsigned short family; 2521da177e4SLinus Torvalds struct dst_ops *dst_ops; 2531da177e4SLinus Torvalds void (*garbage_collect)(void); 25466cdb3caSHerbert Xu struct dst_entry *(*dst_lookup)(int tos, xfrm_address_t *saddr, 25566cdb3caSHerbert Xu xfrm_address_t *daddr); 256a1e59abfSPatrick McHardy int (*get_saddr)(xfrm_address_t *saddr, xfrm_address_t *daddr); 2571da177e4SLinus Torvalds struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy); 2581da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 259d5422efeSHerbert Xu struct flowi *fl, 260d5422efeSHerbert Xu int reverse); 26125ee3286SHerbert Xu int (*get_tos)(struct flowi *fl); 262a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 263a1b05140SMasahide NAKAMURA struct dst_entry *dst, 264a1b05140SMasahide NAKAMURA int nfheader_len); 26525ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 26625ee3286SHerbert Xu struct net_device *dev); 2671da177e4SLinus Torvalds }; 2681da177e4SLinus Torvalds 2691da177e4SLinus Torvalds extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo); 2701da177e4SLinus Torvalds extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); 27126b15dadSJamal Hadi Salim extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); 27226b15dadSJamal Hadi Salim extern void km_state_notify(struct xfrm_state *x, struct km_event *c); 2731da177e4SLinus Torvalds 2741da177e4SLinus Torvalds struct xfrm_tmpl; 275980ebd25SJamal Hadi Salim extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 27653bc6b4dSJamal Hadi Salim extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid); 27753bc6b4dSJamal Hadi Salim extern int __xfrm_state_delete(struct xfrm_state *x); 27853bc6b4dSJamal Hadi Salim 2791da177e4SLinus Torvalds struct xfrm_state_afinfo { 28017c2a42aSHerbert Xu unsigned int family; 28136cf9acfSHerbert Xu unsigned int proto; 2828e3d716cSAl Viro __be16 eth_proto; 28317c2a42aSHerbert Xu struct module *owner; 284533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 285aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 286d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 2871da177e4SLinus Torvalds void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl, 2881da177e4SLinus Torvalds struct xfrm_tmpl *tmpl, 2891da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr); 29041a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 29141a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 292cdca7265SMiika Komu int (*output)(struct sk_buff *skb); 293227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 294227620e2SHerbert Xu struct sk_buff *skb); 29536cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 29636cf9acfSHerbert Xu struct sk_buff *skb); 297716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 298716062fdSHerbert Xu int async); 2991da177e4SLinus Torvalds }; 3001da177e4SLinus Torvalds 3011da177e4SLinus Torvalds extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 3021da177e4SLinus Torvalds extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 3031da177e4SLinus Torvalds 3041da177e4SLinus Torvalds extern void xfrm_state_delete_tunnel(struct xfrm_state *x); 3051da177e4SLinus Torvalds 3061da177e4SLinus Torvalds struct xfrm_type 3071da177e4SLinus Torvalds { 3081da177e4SLinus Torvalds char *description; 3091da177e4SLinus Torvalds struct module *owner; 3101da177e4SLinus Torvalds __u8 proto; 3111b5c2299SMasahide NAKAMURA __u8 flags; 3121b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 313436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 314f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 315f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3161da177e4SLinus Torvalds 31772cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3181da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 319e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3201da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 321df0ba92aSMasahide NAKAMURA int (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *); 322aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3231da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 324c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3251da177e4SLinus Torvalds }; 3261da177e4SLinus Torvalds 327533cb5b0SEric Dumazet extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 328533cb5b0SEric Dumazet extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3291da177e4SLinus Torvalds 330b59f45d0SHerbert Xu struct xfrm_mode { 331227620e2SHerbert Xu /* 332227620e2SHerbert Xu * Remove encapsulation header. 333227620e2SHerbert Xu * 334227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 335227620e2SHerbert Xu * header. 336227620e2SHerbert Xu * 337227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 338227620e2SHerbert Xu * should be and the network header shall be set to where the IP 339227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 340227620e2SHerbert Xu * payload. 341227620e2SHerbert Xu */ 342227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 343227620e2SHerbert Xu 344227620e2SHerbert Xu /* 345227620e2SHerbert Xu * This is the actual input entry point. 346227620e2SHerbert Xu * 347227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 348227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 349227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 350227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 351227620e2SHerbert Xu */ 352b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 35337fedd3aSHerbert Xu 35437fedd3aSHerbert Xu /* 35537fedd3aSHerbert Xu * Add encapsulation header. 35637fedd3aSHerbert Xu * 35737fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 35837fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 35937fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 36037fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 36137fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 36237fedd3aSHerbert Xu * header. The value of the network header will always point 36337fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 36437fedd3aSHerbert Xu */ 36536cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 36636cf9acfSHerbert Xu 36736cf9acfSHerbert Xu /* 36836cf9acfSHerbert Xu * This is the actual output entry point. 36936cf9acfSHerbert Xu * 37036cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 37136cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 37236cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 37336cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 37436cf9acfSHerbert Xu * call output2. 37536cf9acfSHerbert Xu */ 376eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 377b59f45d0SHerbert Xu 37817c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 379b59f45d0SHerbert Xu struct module *owner; 380b59f45d0SHerbert Xu unsigned int encap; 3811bfcb10fSHerbert Xu int flags; 3821bfcb10fSHerbert Xu }; 3831bfcb10fSHerbert Xu 3841bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 3851bfcb10fSHerbert Xu enum { 3861bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 387b59f45d0SHerbert Xu }; 388b59f45d0SHerbert Xu 389b59f45d0SHerbert Xu extern int xfrm_register_mode(struct xfrm_mode *mode, int family); 390b59f45d0SHerbert Xu extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 391b59f45d0SHerbert Xu 392df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 393df9dcb45SKazunori MIYAZAWA { 394df9dcb45SKazunori MIYAZAWA switch(family) { 395df9dcb45SKazunori MIYAZAWA case AF_INET: 396df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 397df9dcb45SKazunori MIYAZAWA case AF_INET6: 398df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 399df9dcb45SKazunori MIYAZAWA default: 400df9dcb45SKazunori MIYAZAWA return 0; 401df9dcb45SKazunori MIYAZAWA } 402df9dcb45SKazunori MIYAZAWA } 403df9dcb45SKazunori MIYAZAWA 404df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 405df9dcb45SKazunori MIYAZAWA { 406df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 407df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 408df9dcb45SKazunori MIYAZAWA return x->inner_mode; 409df9dcb45SKazunori MIYAZAWA else 410df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 411df9dcb45SKazunori MIYAZAWA } 412df9dcb45SKazunori MIYAZAWA 4131da177e4SLinus Torvalds struct xfrm_tmpl 4141da177e4SLinus Torvalds { 4151da177e4SLinus Torvalds /* id in template is interpreted as: 4161da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 4171da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 4181da177e4SLinus Torvalds * daddr must be fixed too. 4191da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 4201da177e4SLinus Torvalds */ 4211da177e4SLinus Torvalds struct xfrm_id id; 4221da177e4SLinus Torvalds 4231da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 4241da177e4SLinus Torvalds xfrm_address_t saddr; 4251da177e4SLinus Torvalds 42676b3f055SMiika Komu unsigned short encap_family; 42776b3f055SMiika Komu 4281da177e4SLinus Torvalds __u32 reqid; 4291da177e4SLinus Torvalds 4307e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 4311da177e4SLinus Torvalds __u8 mode; 4321da177e4SLinus Torvalds 4331da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 4341da177e4SLinus Torvalds __u8 share; 4351da177e4SLinus Torvalds 4361da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 4371da177e4SLinus Torvalds __u8 optional; 4381da177e4SLinus Torvalds 439c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 440c5d18e98SHerbert Xu __u8 allalgs; 441c5d18e98SHerbert Xu 4421da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 4431da177e4SLinus Torvalds __u32 aalgos; 4441da177e4SLinus Torvalds __u32 ealgos; 4451da177e4SLinus Torvalds __u32 calgos; 4461da177e4SLinus Torvalds }; 4471da177e4SLinus Torvalds 448622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 4491da177e4SLinus Torvalds 4501da177e4SLinus Torvalds struct xfrm_policy 4511da177e4SLinus Torvalds { 4521da177e4SLinus Torvalds struct xfrm_policy *next; 4534c563f76STimo Teras struct list_head bytype; 4542518c7c2SDavid S. Miller struct hlist_node bydst; 4552518c7c2SDavid S. Miller struct hlist_node byidx; 4561da177e4SLinus Torvalds 4571da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 4581da177e4SLinus Torvalds rwlock_t lock; 4591da177e4SLinus Torvalds atomic_t refcnt; 4601da177e4SLinus Torvalds struct timer_list timer; 4611da177e4SLinus Torvalds 4621da177e4SLinus Torvalds u32 priority; 4631da177e4SLinus Torvalds u32 index; 4641da177e4SLinus Torvalds struct xfrm_selector selector; 4651da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 4661da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 4671da177e4SLinus Torvalds struct dst_entry *bundles; 46846ca5f5dSArnaldo Carvalho de Melo u16 family; 46946ca5f5dSArnaldo Carvalho de Melo u8 type; 47046ca5f5dSArnaldo Carvalho de Melo u8 action; 47146ca5f5dSArnaldo Carvalho de Melo u8 flags; 47246ca5f5dSArnaldo Carvalho de Melo u8 dead; 47346ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 47446ca5f5dSArnaldo Carvalho de Melo /* XXX 1 byte hole, try to pack */ 475df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 4761da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 4771da177e4SLinus Torvalds }; 4781da177e4SLinus Torvalds 47980c9abaaSShinta Sugimoto struct xfrm_migrate { 48080c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 48180c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 48280c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 48380c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 48480c9abaaSShinta Sugimoto u8 proto; 48580c9abaaSShinta Sugimoto u8 mode; 48680c9abaaSShinta Sugimoto u16 reserved; 48780c9abaaSShinta Sugimoto u32 reqid; 48880c9abaaSShinta Sugimoto u16 old_family; 48980c9abaaSShinta Sugimoto u16 new_family; 49080c9abaaSShinta Sugimoto }; 49180c9abaaSShinta Sugimoto 4921da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 493f8cd5488SJamal Hadi Salim /* which seqno */ 494f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_SEQ 1 495f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_OSEQ 2 496f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_SEQ_MASK 3 497f8cd5488SJamal Hadi Salim /* what happened */ 498f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 499f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 500f8cd5488SJamal Hadi Salim 501f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 502f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 503f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 504f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 505f8cd5488SJamal Hadi Salim /* default seq threshold size */ 506f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 5071da177e4SLinus Torvalds 5081da177e4SLinus Torvalds struct xfrm_mgr 5091da177e4SLinus Torvalds { 5101da177e4SLinus Torvalds struct list_head list; 5111da177e4SLinus Torvalds char *id; 51226b15dadSJamal Hadi Salim int (*notify)(struct xfrm_state *x, struct km_event *c); 5131da177e4SLinus Torvalds int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir); 514cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 5155d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 51626b15dadSJamal Hadi Salim int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c); 51797a64b45SMasahide NAKAMURA int (*report)(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 51880c9abaaSShinta Sugimoto int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles); 5191da177e4SLinus Torvalds }; 5201da177e4SLinus Torvalds 5211da177e4SLinus Torvalds extern int xfrm_register_km(struct xfrm_mgr *km); 5221da177e4SLinus Torvalds extern int xfrm_unregister_km(struct xfrm_mgr *km); 5231da177e4SLinus Torvalds 5242518c7c2SDavid S. Miller extern unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2]; 5251da177e4SLinus Torvalds 526436a0a40SHerbert Xu /* 527436a0a40SHerbert Xu * This structure is used for the duration where packets are being 528436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 529436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 530436a0a40SHerbert Xu */ 531436a0a40SHerbert Xu struct xfrm_skb_cb { 532436a0a40SHerbert Xu union { 533436a0a40SHerbert Xu struct inet_skb_parm h4; 534436a0a40SHerbert Xu struct inet6_skb_parm h6; 535436a0a40SHerbert Xu } header; 536436a0a40SHerbert Xu 537436a0a40SHerbert Xu /* Sequence number for replay protection. */ 538b318e0e4SHerbert Xu union { 539b318e0e4SHerbert Xu u64 output; 540b318e0e4SHerbert Xu __be32 input; 541b318e0e4SHerbert Xu } seq; 542436a0a40SHerbert Xu }; 543436a0a40SHerbert Xu 544436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 545436a0a40SHerbert Xu 54636cf9acfSHerbert Xu /* 54736cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 54836cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 54936cf9acfSHerbert Xu */ 55036cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 55136cf9acfSHerbert Xu union { 55236cf9acfSHerbert Xu struct inet_skb_parm h4; 55336cf9acfSHerbert Xu struct inet6_skb_parm h6; 55436cf9acfSHerbert Xu } header; 55536cf9acfSHerbert Xu 55636cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 55736cf9acfSHerbert Xu __be16 id; 55836cf9acfSHerbert Xu __be16 frag_off; 55936cf9acfSHerbert Xu 560732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 561732c8bd5SHerbert Xu u8 ihl; 562732c8bd5SHerbert Xu 56336cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 56436cf9acfSHerbert Xu u8 tos; 56536cf9acfSHerbert Xu 56636cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 56736cf9acfSHerbert Xu u8 ttl; 56836cf9acfSHerbert Xu 56936cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 57036cf9acfSHerbert Xu u8 protocol; 57136cf9acfSHerbert Xu 572732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 573732c8bd5SHerbert Xu u8 optlen; 574732c8bd5SHerbert Xu 57536cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 57636cf9acfSHerbert Xu u8 flow_lbl[3]; 57736cf9acfSHerbert Xu }; 57836cf9acfSHerbert Xu 57936cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 58036cf9acfSHerbert Xu 581716062fdSHerbert Xu /* 582716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 583716062fdSHerbert Xu * related information. 584716062fdSHerbert Xu */ 585716062fdSHerbert Xu struct xfrm_spi_skb_cb { 586716062fdSHerbert Xu union { 587716062fdSHerbert Xu struct inet_skb_parm h4; 588716062fdSHerbert Xu struct inet6_skb_parm h6; 589716062fdSHerbert Xu } header; 590716062fdSHerbert Xu 591716062fdSHerbert Xu unsigned int daddroff; 5922fcb45b6SHerbert Xu unsigned int family; 593716062fdSHerbert Xu }; 594716062fdSHerbert Xu 595716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 596716062fdSHerbert Xu 597161a09e7SJoy Latten /* Audit Information */ 598161a09e7SJoy Latten struct xfrm_audit 599161a09e7SJoy Latten { 600ab5f5e8bSJoy Latten u32 loginuid; 601161a09e7SJoy Latten u32 secid; 602161a09e7SJoy Latten }; 603c9204d9cSJoy Latten 604c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 605afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 606ab5f5e8bSJoy Latten { 607ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 608ab5f5e8bSJoy Latten 609afeb14b4SPaul Moore if (audit_enabled == 0) 610afeb14b4SPaul Moore return NULL; 611ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 612ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 613ab5f5e8bSJoy Latten if (audit_buf == NULL) 614ab5f5e8bSJoy Latten return NULL; 615afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 616afeb14b4SPaul Moore return audit_buf; 617afeb14b4SPaul Moore } 618afeb14b4SPaul Moore 619afeb14b4SPaul Moore static inline void xfrm_audit_helper_usrinfo(u32 auid, u32 secid, 620afeb14b4SPaul Moore struct audit_buffer *audit_buf) 621afeb14b4SPaul Moore { 622afeb14b4SPaul Moore char *secctx; 623afeb14b4SPaul Moore u32 secctx_len; 624ab5f5e8bSJoy Latten 625ab5f5e8bSJoy Latten audit_log_format(audit_buf, " auid=%u", auid); 62668277accSPaul Moore if (secid != 0 && 62768277accSPaul Moore security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) { 628ab5f5e8bSJoy Latten audit_log_format(audit_buf, " subj=%s", secctx); 629ab5f5e8bSJoy Latten security_release_secctx(secctx, secctx_len); 630ab5f5e8bSJoy Latten } else 631ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 632ab5f5e8bSJoy Latten } 633ab5f5e8bSJoy Latten 634ab5f5e8bSJoy Latten extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 63568277accSPaul Moore u32 auid, u32 secid); 636ab5f5e8bSJoy Latten extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 63768277accSPaul Moore u32 auid, u32 secid); 638ab5f5e8bSJoy Latten extern void xfrm_audit_state_add(struct xfrm_state *x, int result, 63968277accSPaul Moore u32 auid, u32 secid); 640ab5f5e8bSJoy Latten extern void xfrm_audit_state_delete(struct xfrm_state *x, int result, 64168277accSPaul Moore u32 auid, u32 secid); 642afeb14b4SPaul Moore extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 643afeb14b4SPaul Moore struct sk_buff *skb); 644afeb14b4SPaul Moore extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 645afeb14b4SPaul Moore extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 646afeb14b4SPaul Moore __be32 net_spi, __be32 net_seq); 647afeb14b4SPaul Moore extern void xfrm_audit_state_icvfail(struct xfrm_state *x, 648afeb14b4SPaul Moore struct sk_buff *skb, u8 proto); 649c9204d9cSJoy Latten #else 650ab5f5e8bSJoy Latten #define xfrm_audit_policy_add(x, r, a, s) do { ; } while (0) 651ab5f5e8bSJoy Latten #define xfrm_audit_policy_delete(x, r, a, s) do { ; } while (0) 652ab5f5e8bSJoy Latten #define xfrm_audit_state_add(x, r, a, s) do { ; } while (0) 653ab5f5e8bSJoy Latten #define xfrm_audit_state_delete(x, r, a, s) do { ; } while (0) 654afeb14b4SPaul Moore #define xfrm_audit_state_replay_overflow(x, s) do { ; } while (0) 655afeb14b4SPaul Moore #define xfrm_audit_state_notfound_simple(s, f) do { ; } while (0) 656afeb14b4SPaul Moore #define xfrm_audit_state_notfound(s, f, sp, sq) do { ; } while (0) 657afeb14b4SPaul Moore #define xfrm_audit_state_icvfail(x, s, p) do { ; } while (0) 658c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 659161a09e7SJoy Latten 6601da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 6611da177e4SLinus Torvalds { 6621da177e4SLinus Torvalds if (likely(policy != NULL)) 6631da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 6641da177e4SLinus Torvalds } 6651da177e4SLinus Torvalds 66664c31b3fSWANG Cong extern void xfrm_policy_destroy(struct xfrm_policy *policy); 6671da177e4SLinus Torvalds 6681da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 6691da177e4SLinus Torvalds { 6701da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 67164c31b3fSWANG Cong xfrm_policy_destroy(policy); 6721da177e4SLinus Torvalds } 6731da177e4SLinus Torvalds 6744e81bb83SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 6754e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 6764e81bb83SMasahide NAKAMURA { 6774e81bb83SMasahide NAKAMURA int i; 6784e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 6794e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 6804e81bb83SMasahide NAKAMURA } 6814e81bb83SMasahide NAKAMURA #else 6824e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 6834e81bb83SMasahide NAKAMURA { 6844e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[0]); 6854e81bb83SMasahide NAKAMURA } 6864e81bb83SMasahide NAKAMURA #endif 6874e81bb83SMasahide NAKAMURA 6881da177e4SLinus Torvalds extern void __xfrm_state_destroy(struct xfrm_state *); 6891da177e4SLinus Torvalds 69021380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 69121380b81SHerbert Xu { 69221380b81SHerbert Xu atomic_dec(&x->refcnt); 69321380b81SHerbert Xu } 69421380b81SHerbert Xu 6951da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 6961da177e4SLinus Torvalds { 6971da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 6981da177e4SLinus Torvalds __xfrm_state_destroy(x); 6991da177e4SLinus Torvalds } 7001da177e4SLinus Torvalds 7011da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 7021da177e4SLinus Torvalds { 7031da177e4SLinus Torvalds atomic_inc(&x->refcnt); 7041da177e4SLinus Torvalds } 7051da177e4SLinus Torvalds 7061da177e4SLinus Torvalds static __inline__ int addr_match(void *token1, void *token2, int prefixlen) 7071da177e4SLinus Torvalds { 7085f19343fSAl Viro __be32 *a1 = token1; 7095f19343fSAl Viro __be32 *a2 = token2; 7101da177e4SLinus Torvalds int pdw; 7111da177e4SLinus Torvalds int pbi; 7121da177e4SLinus Torvalds 7131da177e4SLinus Torvalds pdw = prefixlen >> 5; /* num of whole __u32 in prefix */ 7141da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 7151da177e4SLinus Torvalds 7161da177e4SLinus Torvalds if (pdw) 7171da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 7181da177e4SLinus Torvalds return 0; 7191da177e4SLinus Torvalds 7201da177e4SLinus Torvalds if (pbi) { 7215f19343fSAl Viro __be32 mask; 7221da177e4SLinus Torvalds 7231da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 7241da177e4SLinus Torvalds 7251da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 7261da177e4SLinus Torvalds return 0; 7271da177e4SLinus Torvalds } 7281da177e4SLinus Torvalds 7291da177e4SLinus Torvalds return 1; 7301da177e4SLinus Torvalds } 7311da177e4SLinus Torvalds 7321da177e4SLinus Torvalds static __inline__ 733f9d07e41SAl Viro __be16 xfrm_flowi_sport(struct flowi *fl) 7341da177e4SLinus Torvalds { 735f9d07e41SAl Viro __be16 port; 7361da177e4SLinus Torvalds switch(fl->proto) { 7371da177e4SLinus Torvalds case IPPROTO_TCP: 7381da177e4SLinus Torvalds case IPPROTO_UDP: 739ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 7401da177e4SLinus Torvalds case IPPROTO_SCTP: 7411da177e4SLinus Torvalds port = fl->fl_ip_sport; 7421da177e4SLinus Torvalds break; 7431da177e4SLinus Torvalds case IPPROTO_ICMP: 7441da177e4SLinus Torvalds case IPPROTO_ICMPV6: 7451da177e4SLinus Torvalds port = htons(fl->fl_icmp_type); 7461da177e4SLinus Torvalds break; 7472ce4272aSMasahide NAKAMURA case IPPROTO_MH: 7482ce4272aSMasahide NAKAMURA port = htons(fl->fl_mh_type); 7492ce4272aSMasahide NAKAMURA break; 7501da177e4SLinus Torvalds default: 7511da177e4SLinus Torvalds port = 0; /*XXX*/ 7521da177e4SLinus Torvalds } 7531da177e4SLinus Torvalds return port; 7541da177e4SLinus Torvalds } 7551da177e4SLinus Torvalds 7561da177e4SLinus Torvalds static __inline__ 757f9d07e41SAl Viro __be16 xfrm_flowi_dport(struct flowi *fl) 7581da177e4SLinus Torvalds { 759f9d07e41SAl Viro __be16 port; 7601da177e4SLinus Torvalds switch(fl->proto) { 7611da177e4SLinus Torvalds case IPPROTO_TCP: 7621da177e4SLinus Torvalds case IPPROTO_UDP: 763ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 7641da177e4SLinus Torvalds case IPPROTO_SCTP: 7651da177e4SLinus Torvalds port = fl->fl_ip_dport; 7661da177e4SLinus Torvalds break; 7671da177e4SLinus Torvalds case IPPROTO_ICMP: 7681da177e4SLinus Torvalds case IPPROTO_ICMPV6: 7691da177e4SLinus Torvalds port = htons(fl->fl_icmp_code); 7701da177e4SLinus Torvalds break; 7711da177e4SLinus Torvalds default: 7721da177e4SLinus Torvalds port = 0; /*XXX*/ 7731da177e4SLinus Torvalds } 7741da177e4SLinus Torvalds return port; 7751da177e4SLinus Torvalds } 7761da177e4SLinus Torvalds 77777681021SAndrew Morton extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 77877681021SAndrew Morton unsigned short family); 7791da177e4SLinus Torvalds 780df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 781df71837dSTrent Jaeger /* If neither has a context --> match 782df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 783df71837dSTrent Jaeger */ 784df71837dSTrent Jaeger static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 785df71837dSTrent Jaeger { 786df71837dSTrent Jaeger return ((!s1 && !s2) || 787df71837dSTrent Jaeger (s1 && s2 && 788df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 789df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 790df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 791df71837dSTrent Jaeger } 792df71837dSTrent Jaeger #else 793df71837dSTrent Jaeger static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 794df71837dSTrent Jaeger { 795df71837dSTrent Jaeger return 1; 796df71837dSTrent Jaeger } 797df71837dSTrent Jaeger #endif 798df71837dSTrent Jaeger 7991da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 8001da177e4SLinus Torvalds * 8011da177e4SLinus Torvalds * dst->child points to the next element of bundle. 8021da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 8031da177e4SLinus Torvalds * 8041da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 8051da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 8061da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 8071da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 8081da177e4SLinus Torvalds * policy rule. 8091da177e4SLinus Torvalds */ 8101da177e4SLinus Torvalds struct xfrm_dst 8111da177e4SLinus Torvalds { 8121da177e4SLinus Torvalds union { 8131da177e4SLinus Torvalds struct dst_entry dst; 8141da177e4SLinus Torvalds struct rtable rt; 8151da177e4SLinus Torvalds struct rt6_info rt6; 8161da177e4SLinus Torvalds } u; 8171da177e4SLinus Torvalds struct dst_entry *route; 818157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 819157bfc25SMasahide NAKAMURA struct flowi *origin; 820157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 821157bfc25SMasahide NAKAMURA #endif 8229d4a706dSDavid S. Miller u32 genid; 8231da177e4SLinus Torvalds u32 route_mtu_cached; 8241da177e4SLinus Torvalds u32 child_mtu_cached; 82592d63decSHideaki YOSHIFUJI u32 route_cookie; 82692d63decSHideaki YOSHIFUJI u32 path_cookie; 8271da177e4SLinus Torvalds }; 8281da177e4SLinus Torvalds 829aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 830aabc9761SHerbert Xu { 831aabc9761SHerbert Xu dst_release(xdst->route); 832aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 833aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 834157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 835157bfc25SMasahide NAKAMURA kfree(xdst->origin); 836157bfc25SMasahide NAKAMURA xdst->origin = NULL; 837157bfc25SMasahide NAKAMURA kfree(xdst->partner); 838157bfc25SMasahide NAKAMURA xdst->partner = NULL; 839157bfc25SMasahide NAKAMURA #endif 840aabc9761SHerbert Xu } 841aabc9761SHerbert Xu 842aabc9761SHerbert Xu extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 843aabc9761SHerbert Xu 8441da177e4SLinus Torvalds struct sec_path 8451da177e4SLinus Torvalds { 8461da177e4SLinus Torvalds atomic_t refcnt; 8471da177e4SLinus Torvalds int len; 848dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 8491da177e4SLinus Torvalds }; 8501da177e4SLinus Torvalds 8511da177e4SLinus Torvalds static inline struct sec_path * 8521da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 8531da177e4SLinus Torvalds { 8541da177e4SLinus Torvalds if (sp) 8551da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 8561da177e4SLinus Torvalds return sp; 8571da177e4SLinus Torvalds } 8581da177e4SLinus Torvalds 8591da177e4SLinus Torvalds extern void __secpath_destroy(struct sec_path *sp); 8601da177e4SLinus Torvalds 8611da177e4SLinus Torvalds static inline void 8621da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 8631da177e4SLinus Torvalds { 8641da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 8651da177e4SLinus Torvalds __secpath_destroy(sp); 8661da177e4SLinus Torvalds } 8671da177e4SLinus Torvalds 8681da177e4SLinus Torvalds extern struct sec_path *secpath_dup(struct sec_path *src); 8691da177e4SLinus Torvalds 8701da177e4SLinus Torvalds static inline void 8711da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 8721da177e4SLinus Torvalds { 8731da177e4SLinus Torvalds #ifdef CONFIG_XFRM 8741da177e4SLinus Torvalds secpath_put(skb->sp); 8751da177e4SLinus Torvalds skb->sp = NULL; 8761da177e4SLinus Torvalds #endif 8771da177e4SLinus Torvalds } 8781da177e4SLinus Torvalds 8791da177e4SLinus Torvalds static inline int 880a1e59abfSPatrick McHardy xfrm_addr_any(xfrm_address_t *addr, unsigned short family) 881a1e59abfSPatrick McHardy { 882a1e59abfSPatrick McHardy switch (family) { 883a1e59abfSPatrick McHardy case AF_INET: 884a1e59abfSPatrick McHardy return addr->a4 == 0; 885a1e59abfSPatrick McHardy case AF_INET6: 886a1e59abfSPatrick McHardy return ipv6_addr_any((struct in6_addr *)&addr->a6); 887a1e59abfSPatrick McHardy } 888a1e59abfSPatrick McHardy return 0; 889a1e59abfSPatrick McHardy } 890a1e59abfSPatrick McHardy 891a1e59abfSPatrick McHardy static inline int 8921da177e4SLinus Torvalds __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 8931da177e4SLinus Torvalds { 8941da177e4SLinus Torvalds return (tmpl->saddr.a4 && 8951da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 8961da177e4SLinus Torvalds } 8971da177e4SLinus Torvalds 8981da177e4SLinus Torvalds static inline int 8991da177e4SLinus Torvalds __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 9001da177e4SLinus Torvalds { 9011da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 9021da177e4SLinus Torvalds ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 9031da177e4SLinus Torvalds } 9041da177e4SLinus Torvalds 9051da177e4SLinus Torvalds static inline int 9061da177e4SLinus Torvalds xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family) 9071da177e4SLinus Torvalds { 9081da177e4SLinus Torvalds switch (family) { 9091da177e4SLinus Torvalds case AF_INET: 9101da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 9111da177e4SLinus Torvalds case AF_INET6: 9121da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 9131da177e4SLinus Torvalds } 9141da177e4SLinus Torvalds return !0; 9151da177e4SLinus Torvalds } 9161da177e4SLinus Torvalds 9171da177e4SLinus Torvalds #ifdef CONFIG_XFRM 9181da177e4SLinus Torvalds extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family); 9191da177e4SLinus Torvalds 920d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 921d5422efeSHerbert Xu struct sk_buff *skb, 922d5422efeSHerbert Xu unsigned int family, int reverse) 9231da177e4SLinus Torvalds { 924d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 925d5422efeSHerbert Xu 9261da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 927d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 9281da177e4SLinus Torvalds 9292518c7c2SDavid S. Miller return (!xfrm_policy_count[dir] && !skb->sp) || 9301da177e4SLinus Torvalds (skb->dst->flags & DST_NOPOLICY) || 931d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 932d5422efeSHerbert Xu } 933d5422efeSHerbert Xu 934d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 935d5422efeSHerbert Xu { 936d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 9371da177e4SLinus Torvalds } 9381da177e4SLinus Torvalds 9391da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 9401da177e4SLinus Torvalds { 9411da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 9421da177e4SLinus Torvalds } 9431da177e4SLinus Torvalds 9441da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 9451da177e4SLinus Torvalds { 9461da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 9471da177e4SLinus Torvalds } 9481da177e4SLinus Torvalds 949d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 950d5422efeSHerbert Xu struct sk_buff *skb) 951d5422efeSHerbert Xu { 952d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 953d5422efeSHerbert Xu } 954d5422efeSHerbert Xu 955d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 956d5422efeSHerbert Xu struct sk_buff *skb) 957d5422efeSHerbert Xu { 958d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 959d5422efeSHerbert Xu } 960d5422efeSHerbert Xu 961d5422efeSHerbert Xu extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 962d5422efeSHerbert Xu unsigned int family, int reverse); 963d5422efeSHerbert Xu 964d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 965d5422efeSHerbert Xu unsigned int family) 966d5422efeSHerbert Xu { 967d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 968d5422efeSHerbert Xu } 969d5422efeSHerbert Xu 970d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 971d5422efeSHerbert Xu struct flowi *fl, 972d5422efeSHerbert Xu unsigned int family) 973d5422efeSHerbert Xu { 974d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 975d5422efeSHerbert Xu } 976d5422efeSHerbert Xu 9771da177e4SLinus Torvalds extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 9781da177e4SLinus Torvalds 9791da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 9801da177e4SLinus Torvalds { 9812518c7c2SDavid S. Miller return !xfrm_policy_count[XFRM_POLICY_OUT] || 9821da177e4SLinus Torvalds (skb->dst->flags & DST_NOXFRM) || 9831da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 9841da177e4SLinus Torvalds } 9851da177e4SLinus Torvalds 9861da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 9871da177e4SLinus Torvalds { 9881da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 9891da177e4SLinus Torvalds } 9901da177e4SLinus Torvalds 9911da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 9921da177e4SLinus Torvalds { 9931da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 9941da177e4SLinus Torvalds } 9951da177e4SLinus Torvalds 9961da177e4SLinus Torvalds extern int __xfrm_sk_clone_policy(struct sock *sk); 9971da177e4SLinus Torvalds 9981da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) 9991da177e4SLinus Torvalds { 10001da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] || sk->sk_policy[1])) 10011da177e4SLinus Torvalds return __xfrm_sk_clone_policy(sk); 10021da177e4SLinus Torvalds return 0; 10031da177e4SLinus Torvalds } 10041da177e4SLinus Torvalds 10054666faabSHerbert Xu extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 10061da177e4SLinus Torvalds 10071da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 10081da177e4SLinus Torvalds { 10091da177e4SLinus Torvalds if (unlikely(sk->sk_policy[0] != NULL)) { 10101da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX); 10111da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 10121da177e4SLinus Torvalds } 10131da177e4SLinus Torvalds if (unlikely(sk->sk_policy[1] != NULL)) { 10141da177e4SLinus Torvalds xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1); 10151da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 10161da177e4SLinus Torvalds } 10171da177e4SLinus Torvalds } 10181da177e4SLinus Torvalds 10191da177e4SLinus Torvalds #else 10201da177e4SLinus Torvalds 10211da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 10221da177e4SLinus Torvalds static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; } 10231da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 10241da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 10251da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10261da177e4SLinus Torvalds { 10271da177e4SLinus Torvalds return 1; 10281da177e4SLinus Torvalds } 10291da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 10301da177e4SLinus Torvalds { 10311da177e4SLinus Torvalds return 1; 10321da177e4SLinus Torvalds } 10331da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 10341da177e4SLinus Torvalds { 10351da177e4SLinus Torvalds return 1; 10361da177e4SLinus Torvalds } 1037d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1038d5422efeSHerbert Xu struct flowi *fl, 1039d5422efeSHerbert Xu unsigned int family) 1040d5422efeSHerbert Xu { 1041d5422efeSHerbert Xu return -ENOSYS; 1042d5422efeSHerbert Xu } 1043d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1044d5422efeSHerbert Xu struct sk_buff *skb) 1045d5422efeSHerbert Xu { 1046d5422efeSHerbert Xu return 1; 1047d5422efeSHerbert Xu } 1048d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1049d5422efeSHerbert Xu struct sk_buff *skb) 1050d5422efeSHerbert Xu { 1051d5422efeSHerbert Xu return 1; 1052d5422efeSHerbert Xu } 10531da177e4SLinus Torvalds #endif 10541da177e4SLinus Torvalds 10551da177e4SLinus Torvalds static __inline__ 10561da177e4SLinus Torvalds xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family) 10571da177e4SLinus Torvalds { 10581da177e4SLinus Torvalds switch (family){ 10591da177e4SLinus Torvalds case AF_INET: 10601da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl4_dst; 10611da177e4SLinus Torvalds case AF_INET6: 10621da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl6_dst; 10631da177e4SLinus Torvalds } 10641da177e4SLinus Torvalds return NULL; 10651da177e4SLinus Torvalds } 10661da177e4SLinus Torvalds 10671da177e4SLinus Torvalds static __inline__ 10681da177e4SLinus Torvalds xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family) 10691da177e4SLinus Torvalds { 10701da177e4SLinus Torvalds switch (family){ 10711da177e4SLinus Torvalds case AF_INET: 10721da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl4_src; 10731da177e4SLinus Torvalds case AF_INET6: 10741da177e4SLinus Torvalds return (xfrm_address_t *)&fl->fl6_src; 10751da177e4SLinus Torvalds } 10761da177e4SLinus Torvalds return NULL; 10771da177e4SLinus Torvalds } 10781da177e4SLinus Torvalds 10799bb182a7SYOSHIFUJI Hideaki static __inline__ 10809bb182a7SYOSHIFUJI Hideaki void xfrm_flowi_addr_get(struct flowi *fl, 10819bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 10829bb182a7SYOSHIFUJI Hideaki unsigned short family) 10839bb182a7SYOSHIFUJI Hideaki { 10849bb182a7SYOSHIFUJI Hideaki switch(family) { 10859bb182a7SYOSHIFUJI Hideaki case AF_INET: 10869bb182a7SYOSHIFUJI Hideaki memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4)); 10879bb182a7SYOSHIFUJI Hideaki memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4)); 10889bb182a7SYOSHIFUJI Hideaki break; 10899bb182a7SYOSHIFUJI Hideaki case AF_INET6: 10909bb182a7SYOSHIFUJI Hideaki ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src); 10919bb182a7SYOSHIFUJI Hideaki ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst); 10929bb182a7SYOSHIFUJI Hideaki break; 10939bb182a7SYOSHIFUJI Hideaki } 10949bb182a7SYOSHIFUJI Hideaki } 10959bb182a7SYOSHIFUJI Hideaki 10961da177e4SLinus Torvalds static __inline__ int 10971da177e4SLinus Torvalds __xfrm4_state_addr_check(struct xfrm_state *x, 10981da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr) 10991da177e4SLinus Torvalds { 11001da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 11011da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 11021da177e4SLinus Torvalds return 1; 11031da177e4SLinus Torvalds return 0; 11041da177e4SLinus Torvalds } 11051da177e4SLinus Torvalds 11061da177e4SLinus Torvalds static __inline__ int 11071da177e4SLinus Torvalds __xfrm6_state_addr_check(struct xfrm_state *x, 11081da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr) 11091da177e4SLinus Torvalds { 11101da177e4SLinus Torvalds if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 11111da177e4SLinus Torvalds (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)|| 11121da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 11131da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 11141da177e4SLinus Torvalds return 1; 11151da177e4SLinus Torvalds return 0; 11161da177e4SLinus Torvalds } 11171da177e4SLinus Torvalds 11181da177e4SLinus Torvalds static __inline__ int 11191da177e4SLinus Torvalds xfrm_state_addr_check(struct xfrm_state *x, 11201da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr, 11211da177e4SLinus Torvalds unsigned short family) 11221da177e4SLinus Torvalds { 11231da177e4SLinus Torvalds switch (family) { 11241da177e4SLinus Torvalds case AF_INET: 11251da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 11261da177e4SLinus Torvalds case AF_INET6: 11271da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 11281da177e4SLinus Torvalds } 11291da177e4SLinus Torvalds return 0; 11301da177e4SLinus Torvalds } 11311da177e4SLinus Torvalds 1132e53820deSMasahide NAKAMURA static __inline__ int 1133e53820deSMasahide NAKAMURA xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl, 1134e53820deSMasahide NAKAMURA unsigned short family) 1135e53820deSMasahide NAKAMURA { 1136e53820deSMasahide NAKAMURA switch (family) { 1137e53820deSMasahide NAKAMURA case AF_INET: 1138e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 1139e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl4_dst, 1140e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl4_src); 1141e53820deSMasahide NAKAMURA case AF_INET6: 1142e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 1143e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl6_dst, 1144e53820deSMasahide NAKAMURA (xfrm_address_t *)&fl->fl6_src); 1145e53820deSMasahide NAKAMURA } 1146e53820deSMasahide NAKAMURA return 0; 1147e53820deSMasahide NAKAMURA } 1148e53820deSMasahide NAKAMURA 11491da177e4SLinus Torvalds static inline int xfrm_state_kern(struct xfrm_state *x) 11501da177e4SLinus Torvalds { 11511da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 11521da177e4SLinus Torvalds } 11531da177e4SLinus Torvalds 11545794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 11555794708fSMasahide NAKAMURA { 1156dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1157dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1158dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1159dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 11605794708fSMasahide NAKAMURA } 11615794708fSMasahide NAKAMURA 11621da177e4SLinus Torvalds /* 11631da177e4SLinus Torvalds * xfrm algorithm information 11641da177e4SLinus Torvalds */ 11651a6509d9SHerbert Xu struct xfrm_algo_aead_info { 11661a6509d9SHerbert Xu u16 icv_truncbits; 11671a6509d9SHerbert Xu }; 11681a6509d9SHerbert Xu 11691da177e4SLinus Torvalds struct xfrm_algo_auth_info { 11701da177e4SLinus Torvalds u16 icv_truncbits; 11711da177e4SLinus Torvalds u16 icv_fullbits; 11721da177e4SLinus Torvalds }; 11731da177e4SLinus Torvalds 11741da177e4SLinus Torvalds struct xfrm_algo_encr_info { 11751da177e4SLinus Torvalds u16 blockbits; 11761da177e4SLinus Torvalds u16 defkeybits; 11771da177e4SLinus Torvalds }; 11781da177e4SLinus Torvalds 11791da177e4SLinus Torvalds struct xfrm_algo_comp_info { 11801da177e4SLinus Torvalds u16 threshold; 11811da177e4SLinus Torvalds }; 11821da177e4SLinus Torvalds 11831da177e4SLinus Torvalds struct xfrm_algo_desc { 11841da177e4SLinus Torvalds char *name; 118504ff1260SHerbert Xu char *compat; 11861da177e4SLinus Torvalds u8 available:1; 11871da177e4SLinus Torvalds union { 11881a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 11891da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 11901da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 11911da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 11921da177e4SLinus Torvalds } uinfo; 11931da177e4SLinus Torvalds struct sadb_alg desc; 11941da177e4SLinus Torvalds }; 11951da177e4SLinus Torvalds 11961da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 11971da177e4SLinus Torvalds struct xfrm_tunnel { 11981da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1199d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, __u32 info); 1200d2acc347SHerbert Xu 1201d2acc347SHerbert Xu struct xfrm_tunnel *next; 1202d2acc347SHerbert Xu int priority; 12031da177e4SLinus Torvalds }; 12041da177e4SLinus Torvalds 12051da177e4SLinus Torvalds struct xfrm6_tunnel { 1206d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1207d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 120804ce6909SAl Viro int type, int code, int offset, __be32 info); 1209d2acc347SHerbert Xu struct xfrm6_tunnel *next; 1210d2acc347SHerbert Xu int priority; 12111da177e4SLinus Torvalds }; 12121da177e4SLinus Torvalds 12134c563f76STimo Teras struct xfrm_state_walk { 12144c563f76STimo Teras struct xfrm_state *state; 12154c563f76STimo Teras int count; 12164c563f76STimo Teras u8 proto; 12174c563f76STimo Teras }; 12184c563f76STimo Teras 12194c563f76STimo Teras struct xfrm_policy_walk { 12204c563f76STimo Teras struct xfrm_policy *policy; 12214c563f76STimo Teras int count; 12224c563f76STimo Teras u8 type, cur_type; 12234c563f76STimo Teras }; 12244c563f76STimo Teras 12251da177e4SLinus Torvalds extern void xfrm_init(void); 12261da177e4SLinus Torvalds extern void xfrm4_init(void); 12271da177e4SLinus Torvalds extern void xfrm_state_init(void); 12281da177e4SLinus Torvalds extern void xfrm4_state_init(void); 1229c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1230c35b7e72SDaniel Lezcano extern int xfrm6_init(void); 1231c35b7e72SDaniel Lezcano extern void xfrm6_fini(void); 12320013cabaSDaniel Lezcano extern int xfrm6_state_init(void); 12331da177e4SLinus Torvalds extern void xfrm6_state_fini(void); 1234c35b7e72SDaniel Lezcano #else 1235c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1236c35b7e72SDaniel Lezcano { 1237c35b7e72SDaniel Lezcano return 0; 1238c35b7e72SDaniel Lezcano } 1239c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1240c35b7e72SDaniel Lezcano { 1241c35b7e72SDaniel Lezcano ; 1242c35b7e72SDaniel Lezcano } 1243c35b7e72SDaniel Lezcano #endif 12441da177e4SLinus Torvalds 1245558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1246558f82efSMasahide NAKAMURA extern int xfrm_proc_init(void); 1247558f82efSMasahide NAKAMURA #endif 1248558f82efSMasahide NAKAMURA 12494c563f76STimo Teras static inline void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto) 12504c563f76STimo Teras { 12514c563f76STimo Teras walk->proto = proto; 12524c563f76STimo Teras walk->state = NULL; 12534c563f76STimo Teras walk->count = 0; 12544c563f76STimo Teras } 12554c563f76STimo Teras 12564c563f76STimo Teras static inline void xfrm_state_walk_done(struct xfrm_state_walk *walk) 12574c563f76STimo Teras { 12584c563f76STimo Teras if (walk->state != NULL) { 12594c563f76STimo Teras xfrm_state_put(walk->state); 12604c563f76STimo Teras walk->state = NULL; 12614c563f76STimo Teras } 12624c563f76STimo Teras } 12634c563f76STimo Teras 12644c563f76STimo Teras extern int xfrm_state_walk(struct xfrm_state_walk *walk, 12654c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 12661da177e4SLinus Torvalds extern struct xfrm_state *xfrm_state_alloc(void); 12671da177e4SLinus Torvalds extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 12681da177e4SLinus Torvalds struct flowi *fl, struct xfrm_tmpl *tmpl, 12691da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 12701da177e4SLinus Torvalds unsigned short family); 1271628529b6SJamal Hadi Salim extern struct xfrm_state * xfrm_stateonly_find(xfrm_address_t *daddr, 1272628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1273628529b6SJamal Hadi Salim unsigned short family, 1274628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 12751da177e4SLinus Torvalds extern int xfrm_state_check_expire(struct xfrm_state *x); 12761da177e4SLinus Torvalds extern void xfrm_state_insert(struct xfrm_state *x); 12771da177e4SLinus Torvalds extern int xfrm_state_add(struct xfrm_state *x); 12781da177e4SLinus Torvalds extern int xfrm_state_update(struct xfrm_state *x); 1279a94cfd19SAl Viro extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family); 1280eb2971b6SMasahide NAKAMURA extern struct xfrm_state *xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family); 128141a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 128241a49cc3SMasahide NAKAMURA extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 128341a49cc3SMasahide NAKAMURA int n, unsigned short family); 128441a49cc3SMasahide NAKAMURA extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 128541a49cc3SMasahide NAKAMURA int n, unsigned short family); 128641a49cc3SMasahide NAKAMURA #else 128741a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 128841a49cc3SMasahide NAKAMURA int n, unsigned short family) 128941a49cc3SMasahide NAKAMURA { 129041a49cc3SMasahide NAKAMURA return -ENOSYS; 129141a49cc3SMasahide NAKAMURA } 129241a49cc3SMasahide NAKAMURA 129341a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 129441a49cc3SMasahide NAKAMURA int n, unsigned short family) 129541a49cc3SMasahide NAKAMURA { 129641a49cc3SMasahide NAKAMURA return -ENOSYS; 129741a49cc3SMasahide NAKAMURA } 129841a49cc3SMasahide NAKAMURA #endif 1299af11e316SJamal Hadi Salim 1300af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1301af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1302af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1303af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1304af11e316SJamal Hadi Salim }; 1305af11e316SJamal Hadi Salim 13065a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 13075a6d3416SJamal Hadi Salim u32 incnt; 13085a6d3416SJamal Hadi Salim u32 outcnt; 13095a6d3416SJamal Hadi Salim u32 fwdcnt; 13105a6d3416SJamal Hadi Salim u32 inscnt; 13115a6d3416SJamal Hadi Salim u32 outscnt; 13125a6d3416SJamal Hadi Salim u32 fwdscnt; 13135a6d3416SJamal Hadi Salim u32 spdhcnt; 13145a6d3416SJamal Hadi Salim u32 spdhmcnt; 13155a6d3416SJamal Hadi Salim }; 13165a6d3416SJamal Hadi Salim 13171da177e4SLinus Torvalds extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq); 131826b15dadSJamal Hadi Salim extern int xfrm_state_delete(struct xfrm_state *x); 13194aa2e62cSJoy Latten extern int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info); 1320af11e316SJamal Hadi Salim extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si); 13215a6d3416SJamal Hadi Salim extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si); 1322afeb14b4SPaul Moore extern int xfrm_replay_check(struct xfrm_state *x, 1323afeb14b4SPaul Moore struct sk_buff *skb, __be32 seq); 132461f4627bSAl Viro extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq); 1325f8cd5488SJamal Hadi Salim extern void xfrm_replay_notify(struct xfrm_state *x, int event); 13261da177e4SLinus Torvalds extern int xfrm_state_mtu(struct xfrm_state *x, int mtu); 132772cb6962SHerbert Xu extern int xfrm_init_state(struct xfrm_state *x); 1328227620e2SHerbert Xu extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1329716062fdSHerbert Xu extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, 1330716062fdSHerbert Xu int encap_type); 13311bf06cd2SHerbert Xu extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1332c6581a45SHerbert Xu extern int xfrm_output_resume(struct sk_buff *skb, int err); 1333406ef77cSHerbert Xu extern int xfrm_output(struct sk_buff *skb); 1334df9dcb45SKazunori MIYAZAWA extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 133536cf9acfSHerbert Xu extern int xfrm4_extract_header(struct sk_buff *skb); 1336227620e2SHerbert Xu extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1337c4541b41SHerbert Xu extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1338c4541b41SHerbert Xu int encap_type); 1339716062fdSHerbert Xu extern int xfrm4_transport_finish(struct sk_buff *skb, int async); 13401da177e4SLinus Torvalds extern int xfrm4_rcv(struct sk_buff *skb); 1341c4541b41SHerbert Xu 1342c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1343c4541b41SHerbert Xu { 1344c4541b41SHerbert Xu return xfrm4_rcv_encap(skb, nexthdr, spi, 0); 1345c4541b41SHerbert Xu } 1346c4541b41SHerbert Xu 134736cf9acfSHerbert Xu extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 134836cf9acfSHerbert Xu extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 13491da177e4SLinus Torvalds extern int xfrm4_output(struct sk_buff *skb); 1350c0d56408SKazunori MIYAZAWA extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1351c0d56408SKazunori MIYAZAWA extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 135236cf9acfSHerbert Xu extern int xfrm6_extract_header(struct sk_buff *skb); 1353227620e2SHerbert Xu extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 135433b5ecb8SHerbert Xu extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi); 1355716062fdSHerbert Xu extern int xfrm6_transport_finish(struct sk_buff *skb, int async); 1356e5bbef20SHerbert Xu extern int xfrm6_rcv(struct sk_buff *skb); 1357fbd9a5b4SMasahide NAKAMURA extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1358fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 135973d605d1SKazunori MIYAZAWA extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 136073d605d1SKazunori MIYAZAWA extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 13618c689a6eSAl Viro extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr); 13621da177e4SLinus Torvalds extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr); 13638c689a6eSAl Viro extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr); 136436cf9acfSHerbert Xu extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 136536cf9acfSHerbert Xu extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 13661da177e4SLinus Torvalds extern int xfrm6_output(struct sk_buff *skb); 1367aee5adb4SMasahide NAKAMURA extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1368aee5adb4SMasahide NAKAMURA u8 **prevhdr); 13691da177e4SLinus Torvalds 13701da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1371067b207bSJames Chapman extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 13721da177e4SLinus Torvalds extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen); 13731da177e4SLinus Torvalds #else 13741da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 13751da177e4SLinus Torvalds { 13761da177e4SLinus Torvalds return -ENOPROTOOPT; 13771da177e4SLinus Torvalds } 13781da177e4SLinus Torvalds 1379067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 13801da177e4SLinus Torvalds { 13811da177e4SLinus Torvalds /* should not happen */ 13821da177e4SLinus Torvalds kfree_skb(skb); 13831da177e4SLinus Torvalds return 0; 13841da177e4SLinus Torvalds } 13851da177e4SLinus Torvalds #endif 13861da177e4SLinus Torvalds 1387dd0fc66fSAl Viro struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp); 13884c563f76STimo Teras 13894c563f76STimo Teras static inline void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type) 13904c563f76STimo Teras { 13914c563f76STimo Teras walk->cur_type = XFRM_POLICY_TYPE_MAIN; 13924c563f76STimo Teras walk->type = type; 13934c563f76STimo Teras walk->policy = NULL; 13944c563f76STimo Teras walk->count = 0; 13954c563f76STimo Teras } 13964c563f76STimo Teras 13974c563f76STimo Teras static inline void xfrm_policy_walk_done(struct xfrm_policy_walk *walk) 13984c563f76STimo Teras { 13994c563f76STimo Teras if (walk->policy != NULL) { 14004c563f76STimo Teras xfrm_pol_put(walk->policy); 14014c563f76STimo Teras walk->policy = NULL; 14024c563f76STimo Teras } 14034c563f76STimo Teras } 14044c563f76STimo Teras 14054c563f76STimo Teras extern int xfrm_policy_walk(struct xfrm_policy_walk *walk, 14064c563f76STimo Teras int (*func)(struct xfrm_policy *, int, int, void*), void *); 14071da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 14084e81bb83SMasahide NAKAMURA struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir, 14094e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1410ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1411ef41aaa0SEric Paris int *err); 1412ef41aaa0SEric Paris struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err); 14134aa2e62cSJoy Latten int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info); 14141da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1415658b219eSHerbert Xu extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 14161da177e4SLinus Torvalds struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 14171da177e4SLinus Torvalds xfrm_address_t *daddr, xfrm_address_t *saddr, 14181da177e4SLinus Torvalds int create, unsigned short family); 14191da177e4SLinus Torvalds extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 14205b368e61SVenkat Yekkirala extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst, 14215b368e61SVenkat Yekkirala struct flowi *fl, int family, int strict); 14221da177e4SLinus Torvalds 142380c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 142480c9abaaSShinta Sugimoto extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 142580c9abaaSShinta Sugimoto struct xfrm_migrate *m, int num_bundles); 142680c9abaaSShinta Sugimoto extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m); 142780c9abaaSShinta Sugimoto extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x, 142880c9abaaSShinta Sugimoto struct xfrm_migrate *m); 142980c9abaaSShinta Sugimoto extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type, 143080c9abaaSShinta Sugimoto struct xfrm_migrate *m, int num_bundles); 143180c9abaaSShinta Sugimoto #endif 143280c9abaaSShinta Sugimoto 14331da177e4SLinus Torvalds extern wait_queue_head_t km_waitq; 14345d36b180SAl Viro extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 14356c5c8ca7SJamal Hadi Salim extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid); 143697a64b45SMasahide NAKAMURA extern int km_report(u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 14371da177e4SLinus Torvalds 14381da177e4SLinus Torvalds extern void xfrm_input_init(void); 14396067b2baSAl Viro extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 14401da177e4SLinus Torvalds 14411da177e4SLinus Torvalds extern void xfrm_probe_algs(void); 14421da177e4SLinus Torvalds extern int xfrm_count_auth_supported(void); 14431da177e4SLinus Torvalds extern int xfrm_count_enc_supported(void); 14441da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 14451da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 14461da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 14471da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 14481da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 14491da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe); 14501da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe); 14511da177e4SLinus Torvalds extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe); 14521a6509d9SHerbert Xu extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, 14531a6509d9SHerbert Xu int probe); 14541da177e4SLinus Torvalds 145507d4ee58SHerbert Xu struct hash_desc; 14569409f38aSHerbert Xu struct scatterlist; 145707d4ee58SHerbert Xu typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *, 145807d4ee58SHerbert Xu unsigned int); 14591da177e4SLinus Torvalds 146007d4ee58SHerbert Xu extern int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *tfm, 14611da177e4SLinus Torvalds int offset, int len, icv_update_fn_t icv_update); 14621da177e4SLinus Torvalds 14631da177e4SLinus Torvalds static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b, 14641da177e4SLinus Torvalds int family) 14651da177e4SLinus Torvalds { 14661da177e4SLinus Torvalds switch (family) { 14671da177e4SLinus Torvalds default: 14681da177e4SLinus Torvalds case AF_INET: 14698c689a6eSAl Viro return (__force __u32)a->a4 - (__force __u32)b->a4; 14701da177e4SLinus Torvalds case AF_INET6: 14711da177e4SLinus Torvalds return ipv6_addr_cmp((struct in6_addr *)a, 14721da177e4SLinus Torvalds (struct in6_addr *)b); 14731da177e4SLinus Torvalds } 14741da177e4SLinus Torvalds } 14751da177e4SLinus Torvalds 147677d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 147777d8d7a6SHerbert Xu { 147877d8d7a6SHerbert Xu return index & 7; 147977d8d7a6SHerbert Xu } 148077d8d7a6SHerbert Xu 1481f8cd5488SJamal Hadi Salim static inline int xfrm_aevent_is_on(void) 1482f8cd5488SJamal Hadi Salim { 1483be33690dSPatrick McHardy struct sock *nlsk; 1484be33690dSPatrick McHardy int ret = 0; 1485be33690dSPatrick McHardy 1486be33690dSPatrick McHardy rcu_read_lock(); 1487be33690dSPatrick McHardy nlsk = rcu_dereference(xfrm_nl); 1488be33690dSPatrick McHardy if (nlsk) 1489be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1490be33690dSPatrick McHardy rcu_read_unlock(); 1491be33690dSPatrick McHardy return ret; 1492f8cd5488SJamal Hadi Salim } 1493f8cd5488SJamal Hadi Salim 14940f99be0dSEric Dumazet static inline int xfrm_alg_len(struct xfrm_algo *alg) 14950f99be0dSEric Dumazet { 14960f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 14970f99be0dSEric Dumazet } 14980f99be0dSEric Dumazet 149980c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 150080c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 150180c9abaaSShinta Sugimoto { 15020f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 150380c9abaaSShinta Sugimoto } 150480c9abaaSShinta Sugimoto 150580c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 150680c9abaaSShinta Sugimoto { 150780c9abaaSShinta Sugimoto int i; 150880c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 150980c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 151080c9abaaSShinta Sugimoto } 151180c9abaaSShinta Sugimoto 151280c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 151380c9abaaSShinta Sugimoto { 151480c9abaaSShinta Sugimoto int i; 151580c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 151680c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 151780c9abaaSShinta Sugimoto } 151880c9abaaSShinta Sugimoto #endif 1519f8cd5488SJamal Hadi Salim 152000501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 152100501121SHerbert Xu { 152200501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 152300501121SHerbert Xu } 152400501121SHerbert Xu 15251da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1526