11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds #include <net/sock.h> 181da177e4SLinus Torvalds #include <net/dst.h> 19436a0a40SHerbert Xu #include <net/ip.h> 201da177e4SLinus Torvalds #include <net/route.h> 211da177e4SLinus Torvalds #include <net/ipv6.h> 221da177e4SLinus Torvalds #include <net/ip6_fib.h> 23fe1a5f03STimo Teräs #include <net/flow.h> 249e0d57fdSYury Polyanskiy 259e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 269e0d57fdSYury Polyanskiy 27558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 28558f82efSMasahide NAKAMURA #include <net/snmp.h> 29558f82efSMasahide NAKAMURA #endif 301da177e4SLinus Torvalds 31d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 38d3d6dd3aSMasahide NAKAMURA 39fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 401da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 41b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 42b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 43d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 44d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 451da177e4SLinus Torvalds 46558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 4759c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 48558f82efSMasahide NAKAMURA #else 4959c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 50558f82efSMasahide NAKAMURA #endif 51558f82efSMasahide NAKAMURA 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 541da177e4SLinus Torvalds ------------------------------------ 551da177e4SLinus Torvalds 561da177e4SLinus Torvalds Basic objects: 571da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 581da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 591da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 601da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 611da177e4SLinus Torvalds 621da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 631da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 641da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 651da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 681da177e4SLinus Torvalds 691da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 701da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 711da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 721da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 731da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 741da177e4SLinus Torvalds to a dst_entry returned to requestor. 751da177e4SLinus Torvalds 761da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 771da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 781da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 791da177e4SLinus Torvalds |---. child .-> NULL 801da177e4SLinus Torvalds 811da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 821da177e4SLinus Torvalds 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds Resolution of xrfm_tmpl 851da177e4SLinus Torvalds ----------------------- 861da177e4SLinus Torvalds Template contains: 871da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 881da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 891da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 901da177e4SLinus Torvalds Q: allow to resolve security gateway? 911da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 921da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 931da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 941da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 951da177e4SLinus Torvalds 7. ->share Sharing mode. 961da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 971da177e4SLinus Torvalds flow id? 981da177e4SLinus Torvalds 991da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1001da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1011da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds PROBLEMS: 1041da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1051da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1061da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1071da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1081da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1091da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1101da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1111da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1121da177e4SLinus Torvalds */ 1131da177e4SLinus Torvalds 11412a169e7SHerbert Xu struct xfrm_state_walk { 11512a169e7SHerbert Xu struct list_head all; 11612a169e7SHerbert Xu u8 state; 11712a169e7SHerbert Xu u8 dying; 11812a169e7SHerbert Xu u8 proto; 11912a169e7SHerbert Xu u32 seq; 120870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12112a169e7SHerbert Xu }; 12212a169e7SHerbert Xu 123*d77e38e6SSteffen Klassert struct xfrm_state_offload { 124*d77e38e6SSteffen Klassert struct net_device *dev; 125*d77e38e6SSteffen Klassert unsigned long offload_handle; 126*d77e38e6SSteffen Klassert unsigned int num_exthdrs; 127*d77e38e6SSteffen Klassert u8 flags; 128*d77e38e6SSteffen Klassert }; 129*d77e38e6SSteffen Klassert 1301da177e4SLinus Torvalds /* Full description of state of transformer. */ 131fd2c3ef7SEric Dumazet struct xfrm_state { 1320c5c9fb5SEric W. Biederman possible_net_t xs_net; 133abb81c4fSHerbert Xu union { 13412a169e7SHerbert Xu struct hlist_node gclist; 1358f126e37SDavid S. Miller struct hlist_node bydst; 136abb81c4fSHerbert Xu }; 1378f126e37SDavid S. Miller struct hlist_node bysrc; 1388f126e37SDavid S. Miller struct hlist_node byspi; 1391da177e4SLinus Torvalds 1401da177e4SLinus Torvalds atomic_t refcnt; 1411da177e4SLinus Torvalds spinlock_t lock; 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds struct xfrm_id id; 1441da177e4SLinus Torvalds struct xfrm_selector sel; 145bf825f81SJamal Hadi Salim struct xfrm_mark mark; 14635d2856bSMartin Willi u32 tfcpad; 1471da177e4SLinus Torvalds 1489d4a706dSDavid S. Miller u32 genid; 1499d4a706dSDavid S. Miller 15012a169e7SHerbert Xu /* Key manager bits */ 15112a169e7SHerbert Xu struct xfrm_state_walk km; 1521da177e4SLinus Torvalds 1531da177e4SLinus Torvalds /* Parameters of this state. */ 1541da177e4SLinus Torvalds struct { 1551da177e4SLinus Torvalds u32 reqid; 1561da177e4SLinus Torvalds u8 mode; 1571da177e4SLinus Torvalds u8 replay_window; 1581da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1591da177e4SLinus Torvalds u8 flags; 1601da177e4SLinus Torvalds u16 family; 1611da177e4SLinus Torvalds xfrm_address_t saddr; 1621da177e4SLinus Torvalds int header_len; 1631da177e4SLinus Torvalds int trailer_len; 164a947b0a9SNicolas Dichtel u32 extra_flags; 1651da177e4SLinus Torvalds } props; 1661da177e4SLinus Torvalds 1671da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds /* Data for transformer */ 1704447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1711da177e4SLinus Torvalds struct xfrm_algo *ealg; 1721da177e4SLinus Torvalds struct xfrm_algo *calg; 1731a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 17469b0137fSHerbert Xu const char *geniv; 1751da177e4SLinus Torvalds 1761da177e4SLinus Torvalds /* Data for encapsulator */ 1771da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1781da177e4SLinus Torvalds 179060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 180060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 181060f02a3SNoriaki TAKAMIYA 1821da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1831da177e4SLinus Torvalds struct xfrm_state *tunnel; 1841da177e4SLinus Torvalds 1851da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1861da177e4SLinus Torvalds atomic_t tunnel_users; 1871da177e4SLinus Torvalds 1881da177e4SLinus Torvalds /* State for replay detection */ 1891da177e4SLinus Torvalds struct xfrm_replay_state replay; 1909736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1911da177e4SLinus Torvalds 192f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 193f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1949736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 195f8cd5488SJamal Hadi Salim 1969fdc4883SSteffen Klassert /* The functions for replay detection. */ 197e45a8a9eSJulia Lawall const struct xfrm_replay *repl; 1989fdc4883SSteffen Klassert 1992717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 2002717096aSJamal Hadi Salim * moment 2012717096aSJamal Hadi Salim */ 2022717096aSJamal Hadi Salim u32 xflags; 2032717096aSJamal Hadi Salim 204f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 205f8cd5488SJamal Hadi Salim u32 replay_maxage; 206f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 207f8cd5488SJamal Hadi Salim 208f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 209f8cd5488SJamal Hadi Salim struct timer_list rtimer; 210f8cd5488SJamal Hadi Salim 2111da177e4SLinus Torvalds /* Statistics */ 2121da177e4SLinus Torvalds struct xfrm_stats stats; 2131da177e4SLinus Torvalds 2141da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2159e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2161da177e4SLinus Torvalds 217*d77e38e6SSteffen Klassert struct xfrm_state_offload xso; 218*d77e38e6SSteffen Klassert 219e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 220e3c0d047SFan Du long saved_tmo; 221e3c0d047SFan Du 2229afaca05SMasahide NAKAMURA /* Last used time */ 223d26f3984SHerbert Xu unsigned long lastused; 2249afaca05SMasahide NAKAMURA 225cac2661cSSteffen Klassert struct page_frag xfrag; 226cac2661cSSteffen Klassert 2271da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2281da177e4SLinus Torvalds * transformer. */ 229533cb5b0SEric Dumazet const struct xfrm_type *type; 23013996378SHerbert Xu struct xfrm_mode *inner_mode; 231df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 23213996378SHerbert Xu struct xfrm_mode *outer_mode; 2331da177e4SLinus Torvalds 2349d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload; 2359d389d7fSSteffen Klassert 236df71837dSTrent Jaeger /* Security context */ 237df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 238df71837dSTrent Jaeger 2391da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2401da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2411da177e4SLinus Torvalds void *data; 2421da177e4SLinus Torvalds }; 2431da177e4SLinus Torvalds 244673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 245673c09beSAlexey Dobriyan { 246673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 247673c09beSAlexey Dobriyan } 248673c09beSAlexey Dobriyan 2492717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2502717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 251e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2522717096aSJamal Hadi Salim 2531da177e4SLinus Torvalds enum { 2541da177e4SLinus Torvalds XFRM_STATE_VOID, 2551da177e4SLinus Torvalds XFRM_STATE_ACQ, 2561da177e4SLinus Torvalds XFRM_STATE_VALID, 2571da177e4SLinus Torvalds XFRM_STATE_ERROR, 2581da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2591da177e4SLinus Torvalds XFRM_STATE_DEAD 2601da177e4SLinus Torvalds }; 2611da177e4SLinus Torvalds 26226b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 263fd2c3ef7SEric Dumazet struct km_event { 264bf08867fSHerbert Xu union { 265bf08867fSHerbert Xu u32 hard; 266bf08867fSHerbert Xu u32 proto; 267bf08867fSHerbert Xu u32 byid; 268f8cd5488SJamal Hadi Salim u32 aevent; 269f7b6983fSMasahide NAKAMURA u32 type; 270bf08867fSHerbert Xu } data; 271bf08867fSHerbert Xu 27226b15dadSJamal Hadi Salim u32 seq; 27315e47304SEric W. Biederman u32 portid; 27426b15dadSJamal Hadi Salim u32 event; 2757067802eSAlexey Dobriyan struct net *net; 27626b15dadSJamal Hadi Salim }; 27726b15dadSJamal Hadi Salim 2789fdc4883SSteffen Klassert struct xfrm_replay { 2799fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2809fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2819fdc4883SSteffen Klassert struct sk_buff *skb, 2829fdc4883SSteffen Klassert __be32 net_seq); 2833b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2843b59df46SSteffen Klassert struct sk_buff *skb, 2853b59df46SSteffen Klassert __be32 net_seq); 2869fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2879fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2889fdc4883SSteffen Klassert }; 2899fdc4883SSteffen Klassert 29025ee3286SHerbert Xu struct net_device; 2911da177e4SLinus Torvalds struct xfrm_type; 2921da177e4SLinus Torvalds struct xfrm_dst; 2931da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2941da177e4SLinus Torvalds struct dst_ops *dst_ops; 29542a7b32bSDavid Ahern struct dst_entry *(*dst_lookup)(struct net *net, 29642a7b32bSDavid Ahern int tos, int oif, 2975e6b930fSDavid S. Miller const xfrm_address_t *saddr, 2985e6b930fSDavid S. Miller const xfrm_address_t *daddr); 29942a7b32bSDavid Ahern int (*get_saddr)(struct net *net, int oif, 30042a7b32bSDavid Ahern xfrm_address_t *saddr, 30142a7b32bSDavid Ahern xfrm_address_t *daddr); 3021da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 303d5422efeSHerbert Xu struct flowi *fl, 304d5422efeSHerbert Xu int reverse); 30505d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 306a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 307a1b05140SMasahide NAKAMURA struct dst_entry *dst, 308a1b05140SMasahide NAKAMURA int nfheader_len); 30925ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 31087c1e12bSHerbert Xu struct net_device *dev, 3110c7b3eefSDavid S. Miller const struct flowi *fl); 3122774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3131da177e4SLinus Torvalds }; 3141da177e4SLinus Torvalds 315a2817d8bSFlorian Westphal int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 316a2817d8bSFlorian Westphal void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 317d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 318d511337aSJoe Perches const struct km_event *c); 319d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3201da177e4SLinus Torvalds 3211da177e4SLinus Torvalds struct xfrm_tmpl; 322d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 323d511337aSJoe Perches struct xfrm_policy *pol); 324d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 325d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 32653bc6b4dSJamal Hadi Salim 3271da177e4SLinus Torvalds struct xfrm_state_afinfo { 32817c2a42aSHerbert Xu unsigned int family; 32936cf9acfSHerbert Xu unsigned int proto; 3308e3d716cSAl Viro __be16 eth_proto; 33117c2a42aSHerbert Xu struct module *owner; 332533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 3339d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload_map[IPPROTO_MAX]; 334aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 3359d389d7fSSteffen Klassert 336d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 33773e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 33873e5ebb2SDavid S. Miller const struct flowi *fl); 33919bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 34019bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 34119bd6244SDavid S. Miller const xfrm_address_t *daddr, 34219bd6244SDavid S. Miller const xfrm_address_t *saddr); 34341a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 34441a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 345ede2059dSEric W. Biederman int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 3467026b1ddSDavid Miller int (*output_finish)(struct sock *sk, struct sk_buff *skb); 347227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 348227620e2SHerbert Xu struct sk_buff *skb); 34936cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 35036cf9acfSHerbert Xu struct sk_buff *skb); 351716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 352716062fdSHerbert Xu int async); 353628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3541da177e4SLinus Torvalds }; 3551da177e4SLinus Torvalds 356d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 357d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 358d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 359711059b9SFlorian Westphal struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 3601da177e4SLinus Torvalds 3612f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3622f32b51bSSteffen Klassert unsigned int family; 3632f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3642f32b51bSSteffen Klassert int err); 3652f32b51bSSteffen Klassert }; 3662f32b51bSSteffen Klassert 367960fdfdeSFlorian Westphal int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 368960fdfdeSFlorian Westphal int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 3692f32b51bSSteffen Klassert 370d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3711da177e4SLinus Torvalds 372fd2c3ef7SEric Dumazet struct xfrm_type { 3731da177e4SLinus Torvalds char *description; 3741da177e4SLinus Torvalds struct module *owner; 375a6337463Sjamal u8 proto; 376a6337463Sjamal u8 flags; 3771b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 378436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 379f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 380f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3811da177e4SLinus Torvalds 38272cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3831da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 384e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3851da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3868f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3878f029de2SDavid S. Miller const struct flowi *); 388aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3891da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 390c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3911da177e4SLinus Torvalds }; 3921da177e4SLinus Torvalds 393d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 394d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3951da177e4SLinus Torvalds 3969d389d7fSSteffen Klassert struct xfrm_type_offload { 3979d389d7fSSteffen Klassert char *description; 3989d389d7fSSteffen Klassert struct module *owner; 3999d389d7fSSteffen Klassert u8 proto; 4009d389d7fSSteffen Klassert void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 4019d389d7fSSteffen Klassert int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 4029d389d7fSSteffen Klassert int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 4039d389d7fSSteffen Klassert }; 4049d389d7fSSteffen Klassert 4059d389d7fSSteffen Klassert int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 4069d389d7fSSteffen Klassert int xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 4079d389d7fSSteffen Klassert 408b59f45d0SHerbert Xu struct xfrm_mode { 409227620e2SHerbert Xu /* 410227620e2SHerbert Xu * Remove encapsulation header. 411227620e2SHerbert Xu * 412227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 413227620e2SHerbert Xu * header. 414227620e2SHerbert Xu * 415227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 416227620e2SHerbert Xu * should be and the network header shall be set to where the IP 417227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 418227620e2SHerbert Xu * payload. 419227620e2SHerbert Xu */ 420227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 421227620e2SHerbert Xu 422227620e2SHerbert Xu /* 423227620e2SHerbert Xu * This is the actual input entry point. 424227620e2SHerbert Xu * 425227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 426227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 427227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 428227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 429227620e2SHerbert Xu */ 430b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 43137fedd3aSHerbert Xu 43237fedd3aSHerbert Xu /* 43337fedd3aSHerbert Xu * Add encapsulation header. 43437fedd3aSHerbert Xu * 43537fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 43637fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 43737fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 43837fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 43937fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 44037fedd3aSHerbert Xu * header. The value of the network header will always point 44137fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 44237fedd3aSHerbert Xu */ 44336cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 44436cf9acfSHerbert Xu 44536cf9acfSHerbert Xu /* 44636cf9acfSHerbert Xu * This is the actual output entry point. 44736cf9acfSHerbert Xu * 44836cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 44936cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 45036cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 45136cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 45236cf9acfSHerbert Xu * call output2. 45336cf9acfSHerbert Xu */ 454eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 455b59f45d0SHerbert Xu 456c35fe410SSteffen Klassert /* 457c35fe410SSteffen Klassert * Adjust pointers into the packet and do GSO segmentation. 458c35fe410SSteffen Klassert */ 459c35fe410SSteffen Klassert struct sk_buff *(*gso_segment)(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features); 460c35fe410SSteffen Klassert 461c35fe410SSteffen Klassert /* 462c35fe410SSteffen Klassert * Adjust pointers into the packet when IPsec is done at layer2. 463c35fe410SSteffen Klassert */ 464c35fe410SSteffen Klassert void (*xmit)(struct xfrm_state *x, struct sk_buff *skb); 465c35fe410SSteffen Klassert 46617c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 467b59f45d0SHerbert Xu struct module *owner; 468b59f45d0SHerbert Xu unsigned int encap; 4691bfcb10fSHerbert Xu int flags; 4701bfcb10fSHerbert Xu }; 4711bfcb10fSHerbert Xu 4721bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4731bfcb10fSHerbert Xu enum { 4741bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 475b59f45d0SHerbert Xu }; 476b59f45d0SHerbert Xu 477d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 478d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 479b59f45d0SHerbert Xu 480df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 481df9dcb45SKazunori MIYAZAWA { 482df9dcb45SKazunori MIYAZAWA switch(family) { 483df9dcb45SKazunori MIYAZAWA case AF_INET: 484df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 485df9dcb45SKazunori MIYAZAWA case AF_INET6: 486df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 487df9dcb45SKazunori MIYAZAWA default: 488df9dcb45SKazunori MIYAZAWA return 0; 489df9dcb45SKazunori MIYAZAWA } 490df9dcb45SKazunori MIYAZAWA } 491df9dcb45SKazunori MIYAZAWA 492df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 493df9dcb45SKazunori MIYAZAWA { 494df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 495df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 496df9dcb45SKazunori MIYAZAWA return x->inner_mode; 497df9dcb45SKazunori MIYAZAWA else 498df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 499df9dcb45SKazunori MIYAZAWA } 500df9dcb45SKazunori MIYAZAWA 501fd2c3ef7SEric Dumazet struct xfrm_tmpl { 5021da177e4SLinus Torvalds /* id in template is interpreted as: 5031da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 5041da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 5051da177e4SLinus Torvalds * daddr must be fixed too. 5061da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 5071da177e4SLinus Torvalds */ 5081da177e4SLinus Torvalds struct xfrm_id id; 5091da177e4SLinus Torvalds 5101da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 5111da177e4SLinus Torvalds xfrm_address_t saddr; 5121da177e4SLinus Torvalds 51376b3f055SMiika Komu unsigned short encap_family; 51476b3f055SMiika Komu 515a6337463Sjamal u32 reqid; 5161da177e4SLinus Torvalds 5177e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 518a6337463Sjamal u8 mode; 5191da177e4SLinus Torvalds 5201da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 521a6337463Sjamal u8 share; 5221da177e4SLinus Torvalds 5231da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 524a6337463Sjamal u8 optional; 5251da177e4SLinus Torvalds 526c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 527a6337463Sjamal u8 allalgs; 528c5d18e98SHerbert Xu 5291da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 530a6337463Sjamal u32 aalgos; 531a6337463Sjamal u32 ealgos; 532a6337463Sjamal u32 calgos; 5331da177e4SLinus Torvalds }; 5341da177e4SLinus Torvalds 535622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 53654ef207aSSteffen Klassert #define XFRM_MAX_OFFLOAD_DEPTH 1 5371da177e4SLinus Torvalds 53812a169e7SHerbert Xu struct xfrm_policy_walk_entry { 53912a169e7SHerbert Xu struct list_head all; 54012a169e7SHerbert Xu u8 dead; 54112a169e7SHerbert Xu }; 54212a169e7SHerbert Xu 54312a169e7SHerbert Xu struct xfrm_policy_walk { 54412a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 54512a169e7SHerbert Xu u8 type; 54612a169e7SHerbert Xu u32 seq; 54712a169e7SHerbert Xu }; 54812a169e7SHerbert Xu 549a0073fe1SSteffen Klassert struct xfrm_policy_queue { 550a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 551a0073fe1SSteffen Klassert struct timer_list hold_timer; 552a0073fe1SSteffen Klassert unsigned long timeout; 553a0073fe1SSteffen Klassert }; 554a0073fe1SSteffen Klassert 555fd2c3ef7SEric Dumazet struct xfrm_policy { 5560c5c9fb5SEric W. Biederman possible_net_t xp_net; 5572518c7c2SDavid S. Miller struct hlist_node bydst; 5582518c7c2SDavid S. Miller struct hlist_node byidx; 5591da177e4SLinus Torvalds 5601da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5611da177e4SLinus Torvalds rwlock_t lock; 5621da177e4SLinus Torvalds atomic_t refcnt; 5631da177e4SLinus Torvalds struct timer_list timer; 5641da177e4SLinus Torvalds 565fe1a5f03STimo Teräs struct flow_cache_object flo; 56680c802f3STimo Teräs atomic_t genid; 5671da177e4SLinus Torvalds u32 priority; 5681da177e4SLinus Torvalds u32 index; 569bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5701da177e4SLinus Torvalds struct xfrm_selector selector; 5711da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5721da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 57312a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 574a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 57546ca5f5dSArnaldo Carvalho de Melo u8 type; 57646ca5f5dSArnaldo Carvalho de Melo u8 action; 57746ca5f5dSArnaldo Carvalho de Melo u8 flags; 57846ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 57912a169e7SHerbert Xu u16 family; 580df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5811da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 58256f04730SEric Dumazet struct rcu_head rcu; 5831da177e4SLinus Torvalds }; 5841da177e4SLinus Torvalds 58563eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5860331b1f3SAlexey Dobriyan { 5870331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5880331b1f3SAlexey Dobriyan } 5890331b1f3SAlexey Dobriyan 59013c1d189SArnaud Ebalard struct xfrm_kmaddress { 59113c1d189SArnaud Ebalard xfrm_address_t local; 59213c1d189SArnaud Ebalard xfrm_address_t remote; 59313c1d189SArnaud Ebalard u32 reserved; 59413c1d189SArnaud Ebalard u16 family; 59513c1d189SArnaud Ebalard }; 59613c1d189SArnaud Ebalard 59780c9abaaSShinta Sugimoto struct xfrm_migrate { 59880c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 59980c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 60080c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 60180c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 60280c9abaaSShinta Sugimoto u8 proto; 60380c9abaaSShinta Sugimoto u8 mode; 60480c9abaaSShinta Sugimoto u16 reserved; 60580c9abaaSShinta Sugimoto u32 reqid; 60680c9abaaSShinta Sugimoto u16 old_family; 60780c9abaaSShinta Sugimoto u16 new_family; 60880c9abaaSShinta Sugimoto }; 60980c9abaaSShinta Sugimoto 6101da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 611f8cd5488SJamal Hadi Salim /* what happened */ 612f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 613f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 614f8cd5488SJamal Hadi Salim 615f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 616f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 617f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 618f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 619f8cd5488SJamal Hadi Salim /* default seq threshold size */ 620f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 6211da177e4SLinus Torvalds 622fd2c3ef7SEric Dumazet struct xfrm_mgr { 6231da177e4SLinus Torvalds struct list_head list; 624214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 62565e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 626cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 6275d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 628214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 629db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 630183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 631183cad12SDavid S. Miller u8 dir, u8 type, 632183cad12SDavid S. Miller const struct xfrm_migrate *m, 633183cad12SDavid S. Miller int num_bundles, 634183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 6350f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6361da177e4SLinus Torvalds }; 6371da177e4SLinus Torvalds 638d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 639d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6401da177e4SLinus Torvalds 64170be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 64270be6c91SSteffen Klassert union { 64370be6c91SSteffen Klassert struct inet_skb_parm h4; 64470be6c91SSteffen Klassert struct inet6_skb_parm h6; 64570be6c91SSteffen Klassert } header; 64670be6c91SSteffen Klassert 64770be6c91SSteffen Klassert union { 64870be6c91SSteffen Klassert struct ip_tunnel *ip4; 64970be6c91SSteffen Klassert struct ip6_tnl *ip6; 65070be6c91SSteffen Klassert } tunnel; 65170be6c91SSteffen Klassert }; 65270be6c91SSteffen Klassert 65370be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 65470be6c91SSteffen Klassert 655436a0a40SHerbert Xu /* 656436a0a40SHerbert Xu * This structure is used for the duration where packets are being 657436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 658436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 659436a0a40SHerbert Xu */ 660436a0a40SHerbert Xu struct xfrm_skb_cb { 66170be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 662436a0a40SHerbert Xu 663436a0a40SHerbert Xu /* Sequence number for replay protection. */ 664b318e0e4SHerbert Xu union { 6651ce3644aSSteffen Klassert struct { 6661ce3644aSSteffen Klassert __u32 low; 6671ce3644aSSteffen Klassert __u32 hi; 6681ce3644aSSteffen Klassert } output; 6691ce3644aSSteffen Klassert struct { 6701ce3644aSSteffen Klassert __be32 low; 6711ce3644aSSteffen Klassert __be32 hi; 6721ce3644aSSteffen Klassert } input; 673b318e0e4SHerbert Xu } seq; 674436a0a40SHerbert Xu }; 675436a0a40SHerbert Xu 676436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 677436a0a40SHerbert Xu 67836cf9acfSHerbert Xu /* 67936cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 68036cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 68136cf9acfSHerbert Xu */ 68236cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 68370be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 68436cf9acfSHerbert Xu 68536cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 68636cf9acfSHerbert Xu __be16 id; 68736cf9acfSHerbert Xu __be16 frag_off; 68836cf9acfSHerbert Xu 689732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 690732c8bd5SHerbert Xu u8 ihl; 691732c8bd5SHerbert Xu 69236cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 69336cf9acfSHerbert Xu u8 tos; 69436cf9acfSHerbert Xu 69536cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 69636cf9acfSHerbert Xu u8 ttl; 69736cf9acfSHerbert Xu 69836cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 69936cf9acfSHerbert Xu u8 protocol; 70036cf9acfSHerbert Xu 701732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 702732c8bd5SHerbert Xu u8 optlen; 703732c8bd5SHerbert Xu 70436cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 70536cf9acfSHerbert Xu u8 flow_lbl[3]; 70636cf9acfSHerbert Xu }; 70736cf9acfSHerbert Xu 70836cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 70936cf9acfSHerbert Xu 710716062fdSHerbert Xu /* 711716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 712716062fdSHerbert Xu * related information. 713716062fdSHerbert Xu */ 714716062fdSHerbert Xu struct xfrm_spi_skb_cb { 71570be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 716716062fdSHerbert Xu 717716062fdSHerbert Xu unsigned int daddroff; 7182fcb45b6SHerbert Xu unsigned int family; 7197785bba2SSteffen Klassert __be32 seq; 720716062fdSHerbert Xu }; 721716062fdSHerbert Xu 722716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 723716062fdSHerbert Xu 724c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 725afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 726ab5f5e8bSJoy Latten { 727ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 728ab5f5e8bSJoy Latten 729afeb14b4SPaul Moore if (audit_enabled == 0) 730afeb14b4SPaul Moore return NULL; 731ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 732ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 733ab5f5e8bSJoy Latten if (audit_buf == NULL) 734ab5f5e8bSJoy Latten return NULL; 735afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 736afeb14b4SPaul Moore return audit_buf; 737afeb14b4SPaul Moore } 738afeb14b4SPaul Moore 7392e71029eSTetsuo Handa static inline void xfrm_audit_helper_usrinfo(bool task_valid, 740afeb14b4SPaul Moore struct audit_buffer *audit_buf) 741afeb14b4SPaul Moore { 7422e71029eSTetsuo Handa const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 7432e71029eSTetsuo Handa audit_get_loginuid(current) : 7442e71029eSTetsuo Handa INVALID_UID); 7452e71029eSTetsuo Handa const unsigned int ses = task_valid ? audit_get_sessionid(current) : 7462e71029eSTetsuo Handa (unsigned int) -1; 7472e71029eSTetsuo Handa 7482e71029eSTetsuo Handa audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 749ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 750ab5f5e8bSJoy Latten } 751ab5f5e8bSJoy Latten 7522e71029eSTetsuo Handa void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 7532e71029eSTetsuo Handa void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7542e71029eSTetsuo Handa bool task_valid); 7552e71029eSTetsuo Handa void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 7562e71029eSTetsuo Handa void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 757d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 758afeb14b4SPaul Moore struct sk_buff *skb); 759d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 760d511337aSJoe Perches __be32 net_seq); 761d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 762d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 763d511337aSJoe Perches __be32 net_seq); 764d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 765d511337aSJoe Perches u8 proto); 766c9204d9cSJoy Latten #else 76741fef0eeSMarcin Slusarz 76841fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7692e71029eSTetsuo Handa bool task_valid) 77041fef0eeSMarcin Slusarz { 77141fef0eeSMarcin Slusarz } 77241fef0eeSMarcin Slusarz 77341fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7742e71029eSTetsuo Handa bool task_valid) 77541fef0eeSMarcin Slusarz { 77641fef0eeSMarcin Slusarz } 77741fef0eeSMarcin Slusarz 77841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7792e71029eSTetsuo Handa bool task_valid) 78041fef0eeSMarcin Slusarz { 78141fef0eeSMarcin Slusarz } 78241fef0eeSMarcin Slusarz 78341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7842e71029eSTetsuo Handa bool task_valid) 78541fef0eeSMarcin Slusarz { 78641fef0eeSMarcin Slusarz } 78741fef0eeSMarcin Slusarz 78841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 78941fef0eeSMarcin Slusarz struct sk_buff *skb) 79041fef0eeSMarcin Slusarz { 79141fef0eeSMarcin Slusarz } 79241fef0eeSMarcin Slusarz 7939fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7949fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7959fdc4883SSteffen Klassert { 7969fdc4883SSteffen Klassert } 7979fdc4883SSteffen Klassert 79841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 79941fef0eeSMarcin Slusarz u16 family) 80041fef0eeSMarcin Slusarz { 80141fef0eeSMarcin Slusarz } 80241fef0eeSMarcin Slusarz 80341fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 80441fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 80541fef0eeSMarcin Slusarz { 80641fef0eeSMarcin Slusarz } 80741fef0eeSMarcin Slusarz 80841fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 80941fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 81041fef0eeSMarcin Slusarz { 81141fef0eeSMarcin Slusarz } 812c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 813161a09e7SJoy Latten 8141da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 8151da177e4SLinus Torvalds { 8161da177e4SLinus Torvalds if (likely(policy != NULL)) 8171da177e4SLinus Torvalds atomic_inc(&policy->refcnt); 8181da177e4SLinus Torvalds } 8191da177e4SLinus Torvalds 820d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 8211da177e4SLinus Torvalds 8221da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 8231da177e4SLinus Torvalds { 8241da177e4SLinus Torvalds if (atomic_dec_and_test(&policy->refcnt)) 82564c31b3fSWANG Cong xfrm_policy_destroy(policy); 8261da177e4SLinus Torvalds } 8271da177e4SLinus Torvalds 8284e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 8294e81bb83SMasahide NAKAMURA { 8304e81bb83SMasahide NAKAMURA int i; 8314e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 8324e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 8334e81bb83SMasahide NAKAMURA } 8344e81bb83SMasahide NAKAMURA 835d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8361da177e4SLinus Torvalds 83721380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 83821380b81SHerbert Xu { 83921380b81SHerbert Xu atomic_dec(&x->refcnt); 84021380b81SHerbert Xu } 84121380b81SHerbert Xu 8421da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8431da177e4SLinus Torvalds { 8441da177e4SLinus Torvalds if (atomic_dec_and_test(&x->refcnt)) 8451da177e4SLinus Torvalds __xfrm_state_destroy(x); 8461da177e4SLinus Torvalds } 8471da177e4SLinus Torvalds 8481da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8491da177e4SLinus Torvalds { 8501da177e4SLinus Torvalds atomic_inc(&x->refcnt); 8511da177e4SLinus Torvalds } 8521da177e4SLinus Torvalds 8531744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 854e1b0048eSAlexey Dobriyan unsigned int prefixlen) 8551da177e4SLinus Torvalds { 8561744a8feSDavid S. Miller const __be32 *a1 = token1; 8571744a8feSDavid S. Miller const __be32 *a2 = token2; 858e1b0048eSAlexey Dobriyan unsigned int pdw; 859e1b0048eSAlexey Dobriyan unsigned int pbi; 8601da177e4SLinus Torvalds 861a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8621da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8631da177e4SLinus Torvalds 8641da177e4SLinus Torvalds if (pdw) 8651da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8661744a8feSDavid S. Miller return false; 8671da177e4SLinus Torvalds 8681da177e4SLinus Torvalds if (pbi) { 8695f19343fSAl Viro __be32 mask; 8701da177e4SLinus Torvalds 8711da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8721da177e4SLinus Torvalds 8731da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8741744a8feSDavid S. Miller return false; 8751da177e4SLinus Torvalds } 8761da177e4SLinus Torvalds 8771744a8feSDavid S. Miller return true; 8781da177e4SLinus Torvalds } 8791da177e4SLinus Torvalds 88026bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 88126bff940SAlexey Dobriyan { 88226bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 8836c786bcbSAlexey Dobriyan if (sizeof(long) == 4 && prefixlen == 0) 88426bff940SAlexey Dobriyan return true; 8856c786bcbSAlexey Dobriyan return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 88626bff940SAlexey Dobriyan } 88726bff940SAlexey Dobriyan 8881da177e4SLinus Torvalds static __inline__ 8896281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8901da177e4SLinus Torvalds { 891f9d07e41SAl Viro __be16 port; 8921d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8931da177e4SLinus Torvalds case IPPROTO_TCP: 8941da177e4SLinus Torvalds case IPPROTO_UDP: 895ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 8961da177e4SLinus Torvalds case IPPROTO_SCTP: 8976281dcc9SDavid S. Miller port = uli->ports.sport; 8981da177e4SLinus Torvalds break; 8991da177e4SLinus Torvalds case IPPROTO_ICMP: 9001da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9016281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 9021da177e4SLinus Torvalds break; 9032ce4272aSMasahide NAKAMURA case IPPROTO_MH: 9046281dcc9SDavid S. Miller port = htons(uli->mht.type); 9052ce4272aSMasahide NAKAMURA break; 906cc9ff19dSTimo Teräs case IPPROTO_GRE: 9076281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 908cc9ff19dSTimo Teräs break; 9091da177e4SLinus Torvalds default: 9101da177e4SLinus Torvalds port = 0; /*XXX*/ 9111da177e4SLinus Torvalds } 9121da177e4SLinus Torvalds return port; 9131da177e4SLinus Torvalds } 9141da177e4SLinus Torvalds 9151da177e4SLinus Torvalds static __inline__ 9166281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 9171da177e4SLinus Torvalds { 918f9d07e41SAl Viro __be16 port; 9191d28f42cSDavid S. Miller switch(fl->flowi_proto) { 9201da177e4SLinus Torvalds case IPPROTO_TCP: 9211da177e4SLinus Torvalds case IPPROTO_UDP: 922ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 9231da177e4SLinus Torvalds case IPPROTO_SCTP: 9246281dcc9SDavid S. Miller port = uli->ports.dport; 9251da177e4SLinus Torvalds break; 9261da177e4SLinus Torvalds case IPPROTO_ICMP: 9271da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9286281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 9291da177e4SLinus Torvalds break; 930cc9ff19dSTimo Teräs case IPPROTO_GRE: 9316281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 932cc9ff19dSTimo Teräs break; 9331da177e4SLinus Torvalds default: 9341da177e4SLinus Torvalds port = 0; /*XXX*/ 9351da177e4SLinus Torvalds } 9361da177e4SLinus Torvalds return port; 9371da177e4SLinus Torvalds } 9381da177e4SLinus Torvalds 939d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 940d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9411da177e4SLinus Torvalds 942df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 943df71837dSTrent Jaeger /* If neither has a context --> match 944df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 945df71837dSTrent Jaeger */ 946bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 947df71837dSTrent Jaeger { 948df71837dSTrent Jaeger return ((!s1 && !s2) || 949df71837dSTrent Jaeger (s1 && s2 && 950df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 951df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 952df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 953df71837dSTrent Jaeger } 954df71837dSTrent Jaeger #else 955bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 956df71837dSTrent Jaeger { 957bc9b35adSDavid S. Miller return true; 958df71837dSTrent Jaeger } 959df71837dSTrent Jaeger #endif 960df71837dSTrent Jaeger 9611da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9621da177e4SLinus Torvalds * 9631da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9641da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9651da177e4SLinus Torvalds * 9661da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9671da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9681da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9691da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9701da177e4SLinus Torvalds * policy rule. 9711da177e4SLinus Torvalds */ 972fd2c3ef7SEric Dumazet struct xfrm_dst { 9731da177e4SLinus Torvalds union { 9741da177e4SLinus Torvalds struct dst_entry dst; 9751da177e4SLinus Torvalds struct rtable rt; 9761da177e4SLinus Torvalds struct rt6_info rt6; 9771da177e4SLinus Torvalds } u; 9781da177e4SLinus Torvalds struct dst_entry *route; 97980c802f3STimo Teräs struct flow_cache_object flo; 98080c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 98180c802f3STimo Teräs int num_pols, num_xfrms; 982157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 983157bfc25SMasahide NAKAMURA struct flowi *origin; 984157bfc25SMasahide NAKAMURA struct xfrm_selector *partner; 985157bfc25SMasahide NAKAMURA #endif 98680c802f3STimo Teräs u32 xfrm_genid; 98780c802f3STimo Teräs u32 policy_genid; 9881da177e4SLinus Torvalds u32 route_mtu_cached; 9891da177e4SLinus Torvalds u32 child_mtu_cached; 99092d63decSHideaki YOSHIFUJI u32 route_cookie; 99192d63decSHideaki YOSHIFUJI u32 path_cookie; 9921da177e4SLinus Torvalds }; 9931da177e4SLinus Torvalds 994def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 995aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 996aabc9761SHerbert Xu { 99780c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 998aabc9761SHerbert Xu dst_release(xdst->route); 999aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 1000aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 1001157bfc25SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1002157bfc25SMasahide NAKAMURA kfree(xdst->origin); 1003157bfc25SMasahide NAKAMURA xdst->origin = NULL; 1004157bfc25SMasahide NAKAMURA kfree(xdst->partner); 1005157bfc25SMasahide NAKAMURA xdst->partner = NULL; 1006157bfc25SMasahide NAKAMURA #endif 1007aabc9761SHerbert Xu } 1008def8b4faSAlexey Dobriyan #endif 1009aabc9761SHerbert Xu 1010d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 1011aabc9761SHerbert Xu 101254ef207aSSteffen Klassert struct xfrm_offload { 101354ef207aSSteffen Klassert /* Output sequence number for replay protection on offloading. */ 101454ef207aSSteffen Klassert struct { 101554ef207aSSteffen Klassert __u32 low; 101654ef207aSSteffen Klassert __u32 hi; 101754ef207aSSteffen Klassert } seq; 101854ef207aSSteffen Klassert 101954ef207aSSteffen Klassert __u32 flags; 102054ef207aSSteffen Klassert #define SA_DELETE_REQ 1 102154ef207aSSteffen Klassert #define CRYPTO_DONE 2 102254ef207aSSteffen Klassert #define CRYPTO_NEXT_DONE 4 102354ef207aSSteffen Klassert #define CRYPTO_FALLBACK 8 102454ef207aSSteffen Klassert #define XFRM_GSO_SEGMENT 16 102554ef207aSSteffen Klassert #define XFRM_GRO 32 102654ef207aSSteffen Klassert 102754ef207aSSteffen Klassert __u32 status; 102854ef207aSSteffen Klassert #define CRYPTO_SUCCESS 1 102954ef207aSSteffen Klassert #define CRYPTO_GENERIC_ERROR 2 103054ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 103154ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 103254ef207aSSteffen Klassert #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 103354ef207aSSteffen Klassert #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 103454ef207aSSteffen Klassert #define CRYPTO_INVALID_PACKET_SYNTAX 64 103554ef207aSSteffen Klassert #define CRYPTO_INVALID_PROTOCOL 128 103654ef207aSSteffen Klassert 103754ef207aSSteffen Klassert __u8 proto; 103854ef207aSSteffen Klassert }; 103954ef207aSSteffen Klassert 1040fd2c3ef7SEric Dumazet struct sec_path { 10411da177e4SLinus Torvalds atomic_t refcnt; 10421da177e4SLinus Torvalds int len; 104354ef207aSSteffen Klassert int olen; 104454ef207aSSteffen Klassert 1045dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 104654ef207aSSteffen Klassert struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 10471da177e4SLinus Torvalds }; 10481da177e4SLinus Torvalds 1049990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 1050990078afSMichael Smith { 1051990078afSMichael Smith #ifdef CONFIG_XFRM 1052990078afSMichael Smith return skb->sp != NULL; 1053990078afSMichael Smith #else 1054990078afSMichael Smith return 0; 1055990078afSMichael Smith #endif 1056990078afSMichael Smith } 1057990078afSMichael Smith 10581da177e4SLinus Torvalds static inline struct sec_path * 10591da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 10601da177e4SLinus Torvalds { 10611da177e4SLinus Torvalds if (sp) 10621da177e4SLinus Torvalds atomic_inc(&sp->refcnt); 10631da177e4SLinus Torvalds return sp; 10641da177e4SLinus Torvalds } 10651da177e4SLinus Torvalds 1066d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10671da177e4SLinus Torvalds 10681da177e4SLinus Torvalds static inline void 10691da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10701da177e4SLinus Torvalds { 10711da177e4SLinus Torvalds if (sp && atomic_dec_and_test(&sp->refcnt)) 10721da177e4SLinus Torvalds __secpath_destroy(sp); 10731da177e4SLinus Torvalds } 10741da177e4SLinus Torvalds 1075d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 1076b0fcee82SSteffen Klassert int secpath_set(struct sk_buff *skb); 10771da177e4SLinus Torvalds 10781da177e4SLinus Torvalds static inline void 10791da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10801da177e4SLinus Torvalds { 10811da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10821da177e4SLinus Torvalds secpath_put(skb->sp); 10831da177e4SLinus Torvalds skb->sp = NULL; 10841da177e4SLinus Torvalds #endif 10851da177e4SLinus Torvalds } 10861da177e4SLinus Torvalds 10871da177e4SLinus Torvalds static inline int 10886cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1089a1e59abfSPatrick McHardy { 1090a1e59abfSPatrick McHardy switch (family) { 1091a1e59abfSPatrick McHardy case AF_INET: 1092a1e59abfSPatrick McHardy return addr->a4 == 0; 1093a1e59abfSPatrick McHardy case AF_INET6: 109415e318bdSJiri Benc return ipv6_addr_any(&addr->in6); 1095a1e59abfSPatrick McHardy } 1096a1e59abfSPatrick McHardy return 0; 1097a1e59abfSPatrick McHardy } 1098a1e59abfSPatrick McHardy 1099a1e59abfSPatrick McHardy static inline int 110021eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 11011da177e4SLinus Torvalds { 11021da177e4SLinus Torvalds return (tmpl->saddr.a4 && 11031da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 11041da177e4SLinus Torvalds } 11051da177e4SLinus Torvalds 11061da177e4SLinus Torvalds static inline int 110721eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 11081da177e4SLinus Torvalds { 11091da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1110ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 11111da177e4SLinus Torvalds } 11121da177e4SLinus Torvalds 11131da177e4SLinus Torvalds static inline int 111421eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 11151da177e4SLinus Torvalds { 11161da177e4SLinus Torvalds switch (family) { 11171da177e4SLinus Torvalds case AF_INET: 11181da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 11191da177e4SLinus Torvalds case AF_INET6: 11201da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 11211da177e4SLinus Torvalds } 11221da177e4SLinus Torvalds return !0; 11231da177e4SLinus Torvalds } 11241da177e4SLinus Torvalds 11251da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1126d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1127d511337aSJoe Perches unsigned short family); 11281da177e4SLinus Torvalds 1129d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1130d5422efeSHerbert Xu struct sk_buff *skb, 1131d5422efeSHerbert Xu unsigned int family, int reverse) 11321da177e4SLinus Torvalds { 1133f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1134d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1135d5422efeSHerbert Xu 11361da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1137d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 11381da177e4SLinus Torvalds 1139f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1140adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1141d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1142d5422efeSHerbert Xu } 1143d5422efeSHerbert Xu 1144d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1145d5422efeSHerbert Xu { 1146d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 11471da177e4SLinus Torvalds } 11481da177e4SLinus Torvalds 11491da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11501da177e4SLinus Torvalds { 11511da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 11521da177e4SLinus Torvalds } 11531da177e4SLinus Torvalds 11541da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11551da177e4SLinus Torvalds { 11561da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 11571da177e4SLinus Torvalds } 11581da177e4SLinus Torvalds 1159d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1160d5422efeSHerbert Xu struct sk_buff *skb) 1161d5422efeSHerbert Xu { 1162d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1163d5422efeSHerbert Xu } 1164d5422efeSHerbert Xu 1165d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1166d5422efeSHerbert Xu struct sk_buff *skb) 1167d5422efeSHerbert Xu { 1168d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1169d5422efeSHerbert Xu } 1170d5422efeSHerbert Xu 1171d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1172d5422efeSHerbert Xu unsigned int family, int reverse); 1173d5422efeSHerbert Xu 1174d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1175d5422efeSHerbert Xu unsigned int family) 1176d5422efeSHerbert Xu { 1177d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1178d5422efeSHerbert Xu } 1179d5422efeSHerbert Xu 1180d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1181d5422efeSHerbert Xu struct flowi *fl, 1182d5422efeSHerbert Xu unsigned int family) 1183d5422efeSHerbert Xu { 1184d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1185d5422efeSHerbert Xu } 1186d5422efeSHerbert Xu 1187d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11881da177e4SLinus Torvalds 11891da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11901da177e4SLinus Torvalds { 119199a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 119299a66657SAlexey Dobriyan 119399a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1194adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11951da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11961da177e4SLinus Torvalds } 11971da177e4SLinus Torvalds 11981da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11991da177e4SLinus Torvalds { 12001da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 12011da177e4SLinus Torvalds } 12021da177e4SLinus Torvalds 12031da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 12041da177e4SLinus Torvalds { 12051da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 12061da177e4SLinus Torvalds } 12071da177e4SLinus Torvalds 1208d188ba86SEric Dumazet int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 12091da177e4SLinus Torvalds 1210d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 12111da177e4SLinus Torvalds { 1212d188ba86SEric Dumazet sk->sk_policy[0] = NULL; 1213d188ba86SEric Dumazet sk->sk_policy[1] = NULL; 1214d188ba86SEric Dumazet if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1215d188ba86SEric Dumazet return __xfrm_sk_clone_policy(sk, osk); 12161da177e4SLinus Torvalds return 0; 12171da177e4SLinus Torvalds } 12181da177e4SLinus Torvalds 1219d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 12201da177e4SLinus Torvalds 12211da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 12221da177e4SLinus Torvalds { 1223d188ba86SEric Dumazet struct xfrm_policy *pol; 1224d188ba86SEric Dumazet 1225d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1226d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1227d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX); 12281da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 12291da177e4SLinus Torvalds } 1230d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1231d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1232d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 12331da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 12341da177e4SLinus Torvalds } 12351da177e4SLinus Torvalds } 12361da177e4SLinus Torvalds 1237d511337aSJoe Perches void xfrm_garbage_collect(struct net *net); 12383d7d25a6SFlorian Westphal void xfrm_garbage_collect_deferred(struct net *net); 1239e4c17216SPaul Moore 12401da177e4SLinus Torvalds #else 12411da177e4SLinus Torvalds 12421da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 1243d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 12441da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 12451da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 12461da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12471da177e4SLinus Torvalds { 12481da177e4SLinus Torvalds return 1; 12491da177e4SLinus Torvalds } 12501da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12511da177e4SLinus Torvalds { 12521da177e4SLinus Torvalds return 1; 12531da177e4SLinus Torvalds } 12541da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 12551da177e4SLinus Torvalds { 12561da177e4SLinus Torvalds return 1; 12571da177e4SLinus Torvalds } 1258d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1259d5422efeSHerbert Xu struct flowi *fl, 1260d5422efeSHerbert Xu unsigned int family) 1261d5422efeSHerbert Xu { 1262d5422efeSHerbert Xu return -ENOSYS; 1263d5422efeSHerbert Xu } 1264d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1265d5422efeSHerbert Xu struct sk_buff *skb) 1266d5422efeSHerbert Xu { 1267d5422efeSHerbert Xu return 1; 1268d5422efeSHerbert Xu } 1269d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1270d5422efeSHerbert Xu struct sk_buff *skb) 1271d5422efeSHerbert Xu { 1272d5422efeSHerbert Xu return 1; 1273d5422efeSHerbert Xu } 1274e4c17216SPaul Moore static inline void xfrm_garbage_collect(struct net *net) 1275e4c17216SPaul Moore { 1276e4c17216SPaul Moore } 12771da177e4SLinus Torvalds #endif 12781da177e4SLinus Torvalds 12791da177e4SLinus Torvalds static __inline__ 1280e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12811da177e4SLinus Torvalds { 12821da177e4SLinus Torvalds switch (family){ 12831da177e4SLinus Torvalds case AF_INET: 12847e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12851da177e4SLinus Torvalds case AF_INET6: 12867e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12871da177e4SLinus Torvalds } 12881da177e4SLinus Torvalds return NULL; 12891da177e4SLinus Torvalds } 12901da177e4SLinus Torvalds 12911da177e4SLinus Torvalds static __inline__ 1292e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12931da177e4SLinus Torvalds { 12941da177e4SLinus Torvalds switch (family){ 12951da177e4SLinus Torvalds case AF_INET: 12967e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12971da177e4SLinus Torvalds case AF_INET6: 12987e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12991da177e4SLinus Torvalds } 13001da177e4SLinus Torvalds return NULL; 13011da177e4SLinus Torvalds } 13021da177e4SLinus Torvalds 13039bb182a7SYOSHIFUJI Hideaki static __inline__ 1304e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 13059bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 13069bb182a7SYOSHIFUJI Hideaki unsigned short family) 13079bb182a7SYOSHIFUJI Hideaki { 13089bb182a7SYOSHIFUJI Hideaki switch(family) { 13099bb182a7SYOSHIFUJI Hideaki case AF_INET: 13107e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 13117e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 13129bb182a7SYOSHIFUJI Hideaki break; 13139bb182a7SYOSHIFUJI Hideaki case AF_INET6: 131415e318bdSJiri Benc saddr->in6 = fl->u.ip6.saddr; 131515e318bdSJiri Benc daddr->in6 = fl->u.ip6.daddr; 13169bb182a7SYOSHIFUJI Hideaki break; 13179bb182a7SYOSHIFUJI Hideaki } 13189bb182a7SYOSHIFUJI Hideaki } 13199bb182a7SYOSHIFUJI Hideaki 13201da177e4SLinus Torvalds static __inline__ int 1321f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1322f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13231da177e4SLinus Torvalds { 13241da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 13251da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 13261da177e4SLinus Torvalds return 1; 13271da177e4SLinus Torvalds return 0; 13281da177e4SLinus Torvalds } 13291da177e4SLinus Torvalds 13301da177e4SLinus Torvalds static __inline__ int 1331f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1332f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13331da177e4SLinus Torvalds { 1334ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1335ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 13361da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 13371da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 13381da177e4SLinus Torvalds return 1; 13391da177e4SLinus Torvalds return 0; 13401da177e4SLinus Torvalds } 13411da177e4SLinus Torvalds 13421da177e4SLinus Torvalds static __inline__ int 1343f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1344f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 13451da177e4SLinus Torvalds unsigned short family) 13461da177e4SLinus Torvalds { 13471da177e4SLinus Torvalds switch (family) { 13481da177e4SLinus Torvalds case AF_INET: 13491da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 13501da177e4SLinus Torvalds case AF_INET6: 13511da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 13521da177e4SLinus Torvalds } 13531da177e4SLinus Torvalds return 0; 13541da177e4SLinus Torvalds } 13551da177e4SLinus Torvalds 1356e53820deSMasahide NAKAMURA static __inline__ int 1357f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1358e53820deSMasahide NAKAMURA unsigned short family) 1359e53820deSMasahide NAKAMURA { 1360e53820deSMasahide NAKAMURA switch (family) { 1361e53820deSMasahide NAKAMURA case AF_INET: 1362e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 13637e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 13647e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1365e53820deSMasahide NAKAMURA case AF_INET6: 1366e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 13677e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 13687e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1369e53820deSMasahide NAKAMURA } 1370e53820deSMasahide NAKAMURA return 0; 1371e53820deSMasahide NAKAMURA } 1372e53820deSMasahide NAKAMURA 1373f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13741da177e4SLinus Torvalds { 13751da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13761da177e4SLinus Torvalds } 13771da177e4SLinus Torvalds 13785794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13795794708fSMasahide NAKAMURA { 1380dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1381dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1382dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1383dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13845794708fSMasahide NAKAMURA } 13855794708fSMasahide NAKAMURA 13861da177e4SLinus Torvalds /* 13871da177e4SLinus Torvalds * xfrm algorithm information 13881da177e4SLinus Torvalds */ 13891a6509d9SHerbert Xu struct xfrm_algo_aead_info { 1390165ecc63SHerbert Xu char *geniv; 13911a6509d9SHerbert Xu u16 icv_truncbits; 13921a6509d9SHerbert Xu }; 13931a6509d9SHerbert Xu 13941da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13951da177e4SLinus Torvalds u16 icv_truncbits; 13961da177e4SLinus Torvalds u16 icv_fullbits; 13971da177e4SLinus Torvalds }; 13981da177e4SLinus Torvalds 13991da177e4SLinus Torvalds struct xfrm_algo_encr_info { 1400165ecc63SHerbert Xu char *geniv; 14011da177e4SLinus Torvalds u16 blockbits; 14021da177e4SLinus Torvalds u16 defkeybits; 14031da177e4SLinus Torvalds }; 14041da177e4SLinus Torvalds 14051da177e4SLinus Torvalds struct xfrm_algo_comp_info { 14061da177e4SLinus Torvalds u16 threshold; 14071da177e4SLinus Torvalds }; 14081da177e4SLinus Torvalds 14091da177e4SLinus Torvalds struct xfrm_algo_desc { 14101da177e4SLinus Torvalds char *name; 141104ff1260SHerbert Xu char *compat; 14121da177e4SLinus Torvalds u8 available:1; 14137e50f84cSJussi Kivilinna u8 pfkey_supported:1; 14141da177e4SLinus Torvalds union { 14151a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 14161da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 14171da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 14181da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 14191da177e4SLinus Torvalds } uinfo; 14201da177e4SLinus Torvalds struct sadb_alg desc; 14211da177e4SLinus Torvalds }; 14221da177e4SLinus Torvalds 14233328715eSSteffen Klassert /* XFRM protocol handlers. */ 14243328715eSSteffen Klassert struct xfrm4_protocol { 14253328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 14263328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 14273328715eSSteffen Klassert int encap_type); 14283328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14293328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 14303328715eSSteffen Klassert 14313328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 14323328715eSSteffen Klassert int priority; 14333328715eSSteffen Klassert }; 14343328715eSSteffen Klassert 14357e14ea15SSteffen Klassert struct xfrm6_protocol { 14367e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 14377e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14387e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 14397e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 14407e14ea15SSteffen Klassert 14417e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 14427e14ea15SSteffen Klassert int priority; 14437e14ea15SSteffen Klassert }; 14447e14ea15SSteffen Klassert 14451da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 14461da177e4SLinus Torvalds struct xfrm_tunnel { 14471da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1448a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1449d2acc347SHerbert Xu 1450b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1451d2acc347SHerbert Xu int priority; 14521da177e4SLinus Torvalds }; 14531da177e4SLinus Torvalds 14541da177e4SLinus Torvalds struct xfrm6_tunnel { 1455d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1456d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1457d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 14586f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1459d2acc347SHerbert Xu int priority; 14601da177e4SLinus Torvalds }; 14611da177e4SLinus Torvalds 1462d511337aSJoe Perches void xfrm_init(void); 1463d511337aSJoe Perches void xfrm4_init(void); 1464d511337aSJoe Perches int xfrm_state_init(struct net *net); 1465d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1466d511337aSJoe Perches void xfrm4_state_init(void); 14672f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1468c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1469d511337aSJoe Perches int xfrm6_init(void); 1470d511337aSJoe Perches void xfrm6_fini(void); 1471d511337aSJoe Perches int xfrm6_state_init(void); 1472d511337aSJoe Perches void xfrm6_state_fini(void); 14737e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 14747e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1475c35b7e72SDaniel Lezcano #else 1476c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1477c35b7e72SDaniel Lezcano { 1478c35b7e72SDaniel Lezcano return 0; 1479c35b7e72SDaniel Lezcano } 1480c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1481c35b7e72SDaniel Lezcano { 1482c35b7e72SDaniel Lezcano ; 1483c35b7e72SDaniel Lezcano } 1484c35b7e72SDaniel Lezcano #endif 14851da177e4SLinus Torvalds 1486558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1487d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1488d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1489558f82efSMasahide NAKAMURA #endif 1490558f82efSMasahide NAKAMURA 1491d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1492b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1493d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1494b27aeadbSAlexey Dobriyan #else 1495b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1496b27aeadbSAlexey Dobriyan { 1497b27aeadbSAlexey Dobriyan } 1498b27aeadbSAlexey Dobriyan #endif 1499b27aeadbSAlexey Dobriyan 1500d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1501870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1502d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 15034c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1504283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1505d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1506d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 150733765d06SDavid S. Miller const xfrm_address_t *saddr, 1508b520e9f6SDavid S. Miller const struct flowi *fl, 1509b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 15101da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 15111da177e4SLinus Torvalds unsigned short family); 1512d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 15135447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1514628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1515628529b6SJamal Hadi Salim unsigned short family, 1516628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1517c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1518c454997eSFan Du unsigned short family); 1519d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1520d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1521d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1522d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1523d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1524a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1525bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1526d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1527a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1528a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1529bd55775cSJamal Hadi Salim u8 proto, 1530bd55775cSJamal Hadi Salim unsigned short family); 153141a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1532d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1533283bc9f3SFan Du unsigned short family, struct net *net); 1534d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1535d511337aSJoe Perches unsigned short family); 153641a49cc3SMasahide NAKAMURA #else 153741a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1538283bc9f3SFan Du int n, unsigned short family, struct net *net) 153941a49cc3SMasahide NAKAMURA { 154041a49cc3SMasahide NAKAMURA return -ENOSYS; 154141a49cc3SMasahide NAKAMURA } 154241a49cc3SMasahide NAKAMURA 154341a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 154441a49cc3SMasahide NAKAMURA int n, unsigned short family) 154541a49cc3SMasahide NAKAMURA { 154641a49cc3SMasahide NAKAMURA return -ENOSYS; 154741a49cc3SMasahide NAKAMURA } 154841a49cc3SMasahide NAKAMURA #endif 1549af11e316SJamal Hadi Salim 1550af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1551af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1552af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1553af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1554af11e316SJamal Hadi Salim }; 1555af11e316SJamal Hadi Salim 15565a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 15575a6d3416SJamal Hadi Salim u32 incnt; 15585a6d3416SJamal Hadi Salim u32 outcnt; 15595a6d3416SJamal Hadi Salim u32 fwdcnt; 15605a6d3416SJamal Hadi Salim u32 inscnt; 15615a6d3416SJamal Hadi Salim u32 outscnt; 15625a6d3416SJamal Hadi Salim u32 fwdscnt; 15635a6d3416SJamal Hadi Salim u32 spdhcnt; 15645a6d3416SJamal Hadi Salim u32 spdhmcnt; 15655a6d3416SJamal Hadi Salim }; 15665a6d3416SJamal Hadi Salim 1567d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1568d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 15692e71029eSTetsuo Handa int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1570*d77e38e6SSteffen Klassert int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1571d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1572d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1573d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1574d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1575d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1576d511337aSJoe Perches int __xfrm_init_state(struct xfrm_state *x, bool init_replay); 1577d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1578d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1579d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1580d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1581d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 15827026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb); 1583d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1584d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1585d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1586d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1587d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1588716062fdSHerbert Xu int encap_type); 1589d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1590d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 15911e295370SSteffen Klassert int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1592c4541b41SHerbert Xu 1593c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1594c4541b41SHerbert Xu { 159570be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15963328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15973328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15983328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1599c4541b41SHerbert Xu } 1600c4541b41SHerbert Xu 1601d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1602d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1603ede2059dSEric W. Biederman int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 16047026b1ddSDavid Miller int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb); 16053328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 16063328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 16073328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1608d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1609d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1610d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1611d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1612d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 161363c43787SNicolas Dichtel int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 161463c43787SNicolas Dichtel struct ip6_tnl *t); 1615d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 161663c43787SNicolas Dichtel int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1617d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1618d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1619fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 16207b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 16217e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 16227e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 16237e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1624d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 16257b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1626d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1627d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1628d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1629d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1630ede2059dSEric W. Biederman int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 16317026b1ddSDavid Miller int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb); 1632d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1633aee5adb4SMasahide NAKAMURA u8 **prevhdr); 16341da177e4SLinus Torvalds 16351da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1636d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1637d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1638d511337aSJoe Perches u8 __user *optval, int optlen); 16391da177e4SLinus Torvalds #else 16401da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 16411da177e4SLinus Torvalds { 16421da177e4SLinus Torvalds return -ENOPROTOOPT; 16431da177e4SLinus Torvalds } 16441da177e4SLinus Torvalds 1645067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 16461da177e4SLinus Torvalds { 16471da177e4SLinus Torvalds /* should not happen */ 16481da177e4SLinus Torvalds kfree_skb(skb); 16491da177e4SLinus Torvalds return 0; 16501da177e4SLinus Torvalds } 16511da177e4SLinus Torvalds #endif 16521da177e4SLinus Torvalds 1653*d77e38e6SSteffen Klassert struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, 1654*d77e38e6SSteffen Klassert const xfrm_address_t *saddr, 1655*d77e38e6SSteffen Klassert const xfrm_address_t *daddr, 1656*d77e38e6SSteffen Klassert int family); 1657*d77e38e6SSteffen Klassert 16580331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 16594c563f76STimo Teras 1660d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1661d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1662d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1663d511337aSJoe Perches void *); 1664283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 16651da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 16668ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 16678ca2e93bSJamal Hadi Salim u8 type, int dir, 16684e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1669ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1670ef41aaa0SEric Paris int *err); 1671d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1672d511337aSJoe Perches u32 id, int delete, int *err); 16732e71029eSTetsuo Handa int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1674880a6fabSChristophe Gouault void xfrm_policy_hash_rebuild(struct net *net); 16751da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1676776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1677d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1678e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1679bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1680a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1681a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1682bd55775cSJamal Hadi Salim unsigned short family); 1683d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16841da177e4SLinus Torvalds 168580c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1686d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1687183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 1688183cad12SDavid S. Miller const struct xfrm_kmaddress *k); 1689283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1690d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 169180c9abaaSShinta Sugimoto struct xfrm_migrate *m); 1692d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 169313c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16948d549c4fSFan Du struct xfrm_kmaddress *k, struct net *net); 169580c9abaaSShinta Sugimoto #endif 169680c9abaaSShinta Sugimoto 1697d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1698d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1699d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1700d511337aSJoe Perches xfrm_address_t *addr); 17011da177e4SLinus Torvalds 1702d511337aSJoe Perches void xfrm_input_init(void); 1703d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 17041da177e4SLinus Torvalds 1705d511337aSJoe Perches void xfrm_probe_algs(void); 1706d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1707d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1708d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1709d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1710d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1711d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1712d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1713d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1714d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1715d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1716d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 17171a6509d9SHerbert Xu int probe); 17181da177e4SLinus Torvalds 1719ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1720ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1721ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1722ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1723ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1724ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1725ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 172670e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 172770e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 172870e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 172970e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 173070e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 173170e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 173270e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 173370e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 173470e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 173570e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 173670e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 173770e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 173870e94e66SYOSHIFUJI Hideaki / 吉藤英明 173977d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 174077d8d7a6SHerbert Xu { 174177d8d7a6SHerbert Xu return index & 7; 174277d8d7a6SHerbert Xu } 174377d8d7a6SHerbert Xu 1744a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1745a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1746f8cd5488SJamal Hadi Salim { 1747be33690dSPatrick McHardy struct sock *nlsk; 1748be33690dSPatrick McHardy int ret = 0; 1749be33690dSPatrick McHardy 1750be33690dSPatrick McHardy rcu_read_lock(); 1751a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1752be33690dSPatrick McHardy if (nlsk) 1753be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1754be33690dSPatrick McHardy rcu_read_unlock(); 1755be33690dSPatrick McHardy return ret; 1756f8cd5488SJamal Hadi Salim } 17570f24558eSHoria Geanta 17580f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 17590f24558eSHoria Geanta { 17600f24558eSHoria Geanta struct sock *nlsk; 17610f24558eSHoria Geanta int ret = 0; 17620f24558eSHoria Geanta 17630f24558eSHoria Geanta rcu_read_lock(); 17640f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 17650f24558eSHoria Geanta if (nlsk) 17660f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 17670f24558eSHoria Geanta rcu_read_unlock(); 17680f24558eSHoria Geanta 17690f24558eSHoria Geanta return ret; 17700f24558eSHoria Geanta } 1771a6483b79SAlexey Dobriyan #endif 1772f8cd5488SJamal Hadi Salim 1773ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1774ee5c2317SSteffen Klassert { 1775ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1776ee5c2317SSteffen Klassert } 1777ee5c2317SSteffen Klassert 177885158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 17790f99be0dSEric Dumazet { 17800f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17810f99be0dSEric Dumazet } 17820f99be0dSEric Dumazet 178385158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17844447bb33SMartin Willi { 17854447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17864447bb33SMartin Willi } 17874447bb33SMartin Willi 17889736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17899736acf3SSteffen Klassert { 17909736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17919736acf3SSteffen Klassert } 17929736acf3SSteffen Klassert 179380c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1794af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1795af2f464eSSteffen Klassert struct xfrm_state *orig) 1796af2f464eSSteffen Klassert { 1797af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1798af2f464eSSteffen Klassert GFP_KERNEL); 1799af2f464eSSteffen Klassert if (!x->replay_esn) 1800af2f464eSSteffen Klassert return -ENOMEM; 1801af2f464eSSteffen Klassert 1802af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1803af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1804af2f464eSSteffen Klassert 1805af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1806af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1807af2f464eSSteffen Klassert GFP_KERNEL); 1808af2f464eSSteffen Klassert if (!x->preplay_esn) { 1809af2f464eSSteffen Klassert kfree(x->replay_esn); 1810af2f464eSSteffen Klassert return -ENOMEM; 1811af2f464eSSteffen Klassert } 1812af2f464eSSteffen Klassert 1813af2f464eSSteffen Klassert return 0; 1814af2f464eSSteffen Klassert } 1815af2f464eSSteffen Klassert 1816ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1817ee5c2317SSteffen Klassert { 1818ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1819ee5c2317SSteffen Klassert } 1820ee5c2317SSteffen Klassert 1821ee5c2317SSteffen Klassert 182280c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 182380c9abaaSShinta Sugimoto { 18240f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 182580c9abaaSShinta Sugimoto } 182680c9abaaSShinta Sugimoto 18274447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 18284447bb33SMartin Willi { 18294447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 18304447bb33SMartin Willi } 18314447bb33SMartin Willi 183280c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 183380c9abaaSShinta Sugimoto { 183480c9abaaSShinta Sugimoto int i; 183580c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 183680c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 183780c9abaaSShinta Sugimoto } 183880c9abaaSShinta Sugimoto 183980c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 184080c9abaaSShinta Sugimoto { 184180c9abaaSShinta Sugimoto int i; 184280c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 184380c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 184480c9abaaSShinta Sugimoto } 184580c9abaaSShinta Sugimoto #endif 1846f8cd5488SJamal Hadi Salim 1847def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 184800501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 184900501121SHerbert Xu { 185000501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 185100501121SHerbert Xu } 185254ef207aSSteffen Klassert static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 185354ef207aSSteffen Klassert { 185454ef207aSSteffen Klassert struct sec_path *sp = skb->sp; 185554ef207aSSteffen Klassert 185654ef207aSSteffen Klassert if (!sp || !sp->olen || sp->len != sp->olen) 185754ef207aSSteffen Klassert return NULL; 185854ef207aSSteffen Klassert 185954ef207aSSteffen Klassert return &sp->ovec[sp->olen - 1]; 186054ef207aSSteffen Klassert } 1861def8b4faSAlexey Dobriyan #endif 186200501121SHerbert Xu 1863*d77e38e6SSteffen Klassert #ifdef CONFIG_XFRM_OFFLOAD 1864*d77e38e6SSteffen Klassert void __net_init xfrm_dev_init(void); 1865*d77e38e6SSteffen Klassert int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 1866*d77e38e6SSteffen Klassert struct xfrm_user_offload *xuo); 1867*d77e38e6SSteffen Klassert bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 1868*d77e38e6SSteffen Klassert 1869*d77e38e6SSteffen Klassert static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1870*d77e38e6SSteffen Klassert { 1871*d77e38e6SSteffen Klassert struct xfrm_state_offload *xso = &x->xso; 1872*d77e38e6SSteffen Klassert 1873*d77e38e6SSteffen Klassert if (xso->dev) 1874*d77e38e6SSteffen Klassert xso->dev->xfrmdev_ops->xdo_dev_state_delete(x); 1875*d77e38e6SSteffen Klassert } 1876*d77e38e6SSteffen Klassert 1877*d77e38e6SSteffen Klassert static inline void xfrm_dev_state_free(struct xfrm_state *x) 1878*d77e38e6SSteffen Klassert { 1879*d77e38e6SSteffen Klassert struct xfrm_state_offload *xso = &x->xso; 1880*d77e38e6SSteffen Klassert struct net_device *dev = xso->dev; 1881*d77e38e6SSteffen Klassert 1882*d77e38e6SSteffen Klassert if (dev && dev->xfrmdev_ops) { 1883*d77e38e6SSteffen Klassert dev->xfrmdev_ops->xdo_dev_state_free(x); 1884*d77e38e6SSteffen Klassert xso->dev = NULL; 1885*d77e38e6SSteffen Klassert dev_put(dev); 1886*d77e38e6SSteffen Klassert } 1887*d77e38e6SSteffen Klassert } 1888*d77e38e6SSteffen Klassert #else 1889*d77e38e6SSteffen Klassert static inline void __net_init xfrm_dev_init(void) 1890*d77e38e6SSteffen Klassert { 1891*d77e38e6SSteffen Klassert } 1892*d77e38e6SSteffen Klassert 1893*d77e38e6SSteffen Klassert static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo) 1894*d77e38e6SSteffen Klassert { 1895*d77e38e6SSteffen Klassert return 0; 1896*d77e38e6SSteffen Klassert } 1897*d77e38e6SSteffen Klassert 1898*d77e38e6SSteffen Klassert static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1899*d77e38e6SSteffen Klassert { 1900*d77e38e6SSteffen Klassert } 1901*d77e38e6SSteffen Klassert 1902*d77e38e6SSteffen Klassert static inline void xfrm_dev_state_free(struct xfrm_state *x) 1903*d77e38e6SSteffen Klassert { 1904*d77e38e6SSteffen Klassert } 1905*d77e38e6SSteffen Klassert 1906*d77e38e6SSteffen Klassert static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 1907*d77e38e6SSteffen Klassert { 1908*d77e38e6SSteffen Klassert return false; 1909*d77e38e6SSteffen Klassert } 1910*d77e38e6SSteffen Klassert #endif 1911*d77e38e6SSteffen Klassert 1912bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1913bf825f81SJamal Hadi Salim { 1914bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 19154efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1916bf825f81SJamal Hadi Salim else 1917bf825f81SJamal Hadi Salim m->v = m->m = 0; 1918bf825f81SJamal Hadi Salim 1919bf825f81SJamal Hadi Salim return m->v & m->m; 1920bf825f81SJamal Hadi Salim } 1921bf825f81SJamal Hadi Salim 1922e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1923bf825f81SJamal Hadi Salim { 19241d1e34ddSDavid S. Miller int ret = 0; 1925bf825f81SJamal Hadi Salim 19261d1e34ddSDavid S. Miller if (m->m | m->v) 19271d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 19281d1e34ddSDavid S. Miller return ret; 1929bf825f81SJamal Hadi Salim } 1930bf825f81SJamal Hadi Salim 193170be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 193270be6c91SSteffen Klassert unsigned int family) 193370be6c91SSteffen Klassert { 193470be6c91SSteffen Klassert bool tunnel = false; 193570be6c91SSteffen Klassert 193670be6c91SSteffen Klassert switch(family) { 193770be6c91SSteffen Klassert case AF_INET: 193870be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 193970be6c91SSteffen Klassert tunnel = true; 194070be6c91SSteffen Klassert break; 194170be6c91SSteffen Klassert case AF_INET6: 194270be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 194370be6c91SSteffen Klassert tunnel = true; 194470be6c91SSteffen Klassert break; 194570be6c91SSteffen Klassert } 194670be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 194770be6c91SSteffen Klassert return -EINVAL; 194870be6c91SSteffen Klassert 194970be6c91SSteffen Klassert return 0; 195070be6c91SSteffen Klassert } 19511da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1952