11da177e4SLinus Torvalds #ifndef _NET_XFRM_H 21da177e4SLinus Torvalds #define _NET_XFRM_H 31da177e4SLinus Torvalds 4aabc9761SHerbert Xu #include <linux/compiler.h> 51da177e4SLinus Torvalds #include <linux/xfrm.h> 61da177e4SLinus Torvalds #include <linux/spinlock.h> 71da177e4SLinus Torvalds #include <linux/list.h> 81da177e4SLinus Torvalds #include <linux/skbuff.h> 914c85021SArnaldo Carvalho de Melo #include <linux/socket.h> 101da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 115794708fSMasahide NAKAMURA #include <linux/ipsec.h> 121da177e4SLinus Torvalds #include <linux/in6.h> 134a3e2f71SArjan van de Ven #include <linux/mutex.h> 14ab5f5e8bSJoy Latten #include <linux/audit.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 1688755e9cSReshetova, Elena #include <linux/refcount.h> 171da177e4SLinus Torvalds 181da177e4SLinus Torvalds #include <net/sock.h> 191da177e4SLinus Torvalds #include <net/dst.h> 20436a0a40SHerbert Xu #include <net/ip.h> 211da177e4SLinus Torvalds #include <net/route.h> 221da177e4SLinus Torvalds #include <net/ipv6.h> 231da177e4SLinus Torvalds #include <net/ip6_fib.h> 24fe1a5f03STimo Teräs #include <net/flow.h> 259e0d57fdSYury Polyanskiy 269e0d57fdSYury Polyanskiy #include <linux/interrupt.h> 279e0d57fdSYury Polyanskiy 28558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 29558f82efSMasahide NAKAMURA #include <net/snmp.h> 30558f82efSMasahide NAKAMURA #endif 311da177e4SLinus Torvalds 32d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ESP 50 33d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_AH 51 34d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_COMP 108 35d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPIP 4 36d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_IPV6 41 37d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 38d3d6dd3aSMasahide NAKAMURA #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 39d3d6dd3aSMasahide NAKAMURA 40fa9921e4SNicolas Dichtel #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 411da177e4SLinus Torvalds #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 42b59f45d0SHerbert Xu #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 43b59f45d0SHerbert Xu MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 44d3d6dd3aSMasahide NAKAMURA #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 45d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 46ffdb5211SIlan Tayari #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \ 47ffdb5211SIlan Tayari MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto)) 481da177e4SLinus Torvalds 49558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 5059c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 51558f82efSMasahide NAKAMURA #else 5259c9940eSAlexey Dobriyan #define XFRM_INC_STATS(net, field) ((void)(net)) 53558f82efSMasahide NAKAMURA #endif 54558f82efSMasahide NAKAMURA 551da177e4SLinus Torvalds 561da177e4SLinus Torvalds /* Organization of SPD aka "XFRM rules" 571da177e4SLinus Torvalds ------------------------------------ 581da177e4SLinus Torvalds 591da177e4SLinus Torvalds Basic objects: 601da177e4SLinus Torvalds - policy rule, struct xfrm_policy (=SPD entry) 611da177e4SLinus Torvalds - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 621da177e4SLinus Torvalds - instance of a transformer, struct xfrm_state (=SA) 631da177e4SLinus Torvalds - template to clone xfrm_state, struct xfrm_tmpl 641da177e4SLinus Torvalds 651da177e4SLinus Torvalds SPD is plain linear list of xfrm_policy rules, ordered by priority. 661da177e4SLinus Torvalds (To be compatible with existing pfkeyv2 implementations, 671da177e4SLinus Torvalds many rules with priority of 0x7fffffff are allowed to exist and 681da177e4SLinus Torvalds such rules are ordered in an unpredictable way, thanks to bsd folks.) 691da177e4SLinus Torvalds 701da177e4SLinus Torvalds Lookup is plain linear search until the first match with selector. 711da177e4SLinus Torvalds 721da177e4SLinus Torvalds If "action" is "block", then we prohibit the flow, otherwise: 731da177e4SLinus Torvalds if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 741da177e4SLinus Torvalds policy entry has list of up to XFRM_MAX_DEPTH transformations, 751da177e4SLinus Torvalds described by templates xfrm_tmpl. Each template is resolved 761da177e4SLinus Torvalds to a complete xfrm_state (see below) and we pack bundle of transformations 771da177e4SLinus Torvalds to a dst_entry returned to requestor. 781da177e4SLinus Torvalds 791da177e4SLinus Torvalds dst -. xfrm .-> xfrm_state #1 801da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #2 811da177e4SLinus Torvalds |---. child .-> dst -. xfrm .-> xfrm_state #3 821da177e4SLinus Torvalds |---. child .-> NULL 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds Bundles are cached at xrfm_policy struct (field ->bundles). 851da177e4SLinus Torvalds 861da177e4SLinus Torvalds 871da177e4SLinus Torvalds Resolution of xrfm_tmpl 881da177e4SLinus Torvalds ----------------------- 891da177e4SLinus Torvalds Template contains: 901da177e4SLinus Torvalds 1. ->mode Mode: transport or tunnel 911da177e4SLinus Torvalds 2. ->id.proto Protocol: AH/ESP/IPCOMP 921da177e4SLinus Torvalds 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 931da177e4SLinus Torvalds Q: allow to resolve security gateway? 941da177e4SLinus Torvalds 4. ->id.spi If not zero, static SPI. 951da177e4SLinus Torvalds 5. ->saddr Local tunnel endpoint, ignored for transport mode. 961da177e4SLinus Torvalds 6. ->algos List of allowed algos. Plain bitmask now. 971da177e4SLinus Torvalds Q: ealgos, aalgos, calgos. What a mess... 981da177e4SLinus Torvalds 7. ->share Sharing mode. 991da177e4SLinus Torvalds Q: how to implement private sharing mode? To add struct sock* to 1001da177e4SLinus Torvalds flow id? 1011da177e4SLinus Torvalds 1021da177e4SLinus Torvalds Having this template we search through SAD searching for entries 1031da177e4SLinus Torvalds with appropriate mode/proto/algo, permitted by selector. 1041da177e4SLinus Torvalds If no appropriate entry found, it is requested from key manager. 1051da177e4SLinus Torvalds 1061da177e4SLinus Torvalds PROBLEMS: 1071da177e4SLinus Torvalds Q: How to find all the bundles referring to a physical path for 1081da177e4SLinus Torvalds PMTU discovery? Seems, dst should contain list of all parents... 1091da177e4SLinus Torvalds and enter to infinite locking hierarchy disaster. 1101da177e4SLinus Torvalds No! It is easier, we will not search for them, let them find us. 1111da177e4SLinus Torvalds We add genid to each dst plus pointer to genid of raw IP route, 1121da177e4SLinus Torvalds pmtu disc will update pmtu on raw IP route and increase its genid. 1131da177e4SLinus Torvalds dst_check() will see this for top level and trigger resyncing 1141da177e4SLinus Torvalds metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 1151da177e4SLinus Torvalds */ 1161da177e4SLinus Torvalds 11712a169e7SHerbert Xu struct xfrm_state_walk { 11812a169e7SHerbert Xu struct list_head all; 11912a169e7SHerbert Xu u8 state; 12012a169e7SHerbert Xu u8 dying; 12112a169e7SHerbert Xu u8 proto; 12212a169e7SHerbert Xu u32 seq; 123870a2df4SNicolas Dichtel struct xfrm_address_filter *filter; 12412a169e7SHerbert Xu }; 12512a169e7SHerbert Xu 126d77e38e6SSteffen Klassert struct xfrm_state_offload { 127d77e38e6SSteffen Klassert struct net_device *dev; 128d77e38e6SSteffen Klassert unsigned long offload_handle; 129d77e38e6SSteffen Klassert unsigned int num_exthdrs; 130d77e38e6SSteffen Klassert u8 flags; 131d77e38e6SSteffen Klassert }; 132d77e38e6SSteffen Klassert 1331da177e4SLinus Torvalds /* Full description of state of transformer. */ 134fd2c3ef7SEric Dumazet struct xfrm_state { 1350c5c9fb5SEric W. Biederman possible_net_t xs_net; 136abb81c4fSHerbert Xu union { 13712a169e7SHerbert Xu struct hlist_node gclist; 1388f126e37SDavid S. Miller struct hlist_node bydst; 139abb81c4fSHerbert Xu }; 1408f126e37SDavid S. Miller struct hlist_node bysrc; 1418f126e37SDavid S. Miller struct hlist_node byspi; 1421da177e4SLinus Torvalds 14388755e9cSReshetova, Elena refcount_t refcnt; 1441da177e4SLinus Torvalds spinlock_t lock; 1451da177e4SLinus Torvalds 1461da177e4SLinus Torvalds struct xfrm_id id; 1471da177e4SLinus Torvalds struct xfrm_selector sel; 148bf825f81SJamal Hadi Salim struct xfrm_mark mark; 14935d2856bSMartin Willi u32 tfcpad; 1501da177e4SLinus Torvalds 1519d4a706dSDavid S. Miller u32 genid; 1529d4a706dSDavid S. Miller 15312a169e7SHerbert Xu /* Key manager bits */ 15412a169e7SHerbert Xu struct xfrm_state_walk km; 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvalds /* Parameters of this state. */ 1571da177e4SLinus Torvalds struct { 1581da177e4SLinus Torvalds u32 reqid; 1591da177e4SLinus Torvalds u8 mode; 1601da177e4SLinus Torvalds u8 replay_window; 1611da177e4SLinus Torvalds u8 aalgo, ealgo, calgo; 1621da177e4SLinus Torvalds u8 flags; 1631da177e4SLinus Torvalds u16 family; 1641da177e4SLinus Torvalds xfrm_address_t saddr; 1651da177e4SLinus Torvalds int header_len; 1661da177e4SLinus Torvalds int trailer_len; 167a947b0a9SNicolas Dichtel u32 extra_flags; 1681da177e4SLinus Torvalds } props; 1691da177e4SLinus Torvalds 1701da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 1711da177e4SLinus Torvalds 1721da177e4SLinus Torvalds /* Data for transformer */ 1734447bb33SMartin Willi struct xfrm_algo_auth *aalg; 1741da177e4SLinus Torvalds struct xfrm_algo *ealg; 1751da177e4SLinus Torvalds struct xfrm_algo *calg; 1761a6509d9SHerbert Xu struct xfrm_algo_aead *aead; 17769b0137fSHerbert Xu const char *geniv; 1781da177e4SLinus Torvalds 1791da177e4SLinus Torvalds /* Data for encapsulator */ 1801da177e4SLinus Torvalds struct xfrm_encap_tmpl *encap; 1811da177e4SLinus Torvalds 182060f02a3SNoriaki TAKAMIYA /* Data for care-of address */ 183060f02a3SNoriaki TAKAMIYA xfrm_address_t *coaddr; 184060f02a3SNoriaki TAKAMIYA 1851da177e4SLinus Torvalds /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 1861da177e4SLinus Torvalds struct xfrm_state *tunnel; 1871da177e4SLinus Torvalds 1881da177e4SLinus Torvalds /* If a tunnel, number of users + 1 */ 1891da177e4SLinus Torvalds atomic_t tunnel_users; 1901da177e4SLinus Torvalds 1911da177e4SLinus Torvalds /* State for replay detection */ 1921da177e4SLinus Torvalds struct xfrm_replay_state replay; 1939736acf3SSteffen Klassert struct xfrm_replay_state_esn *replay_esn; 1941da177e4SLinus Torvalds 195f8cd5488SJamal Hadi Salim /* Replay detection state at the time we sent the last notification */ 196f8cd5488SJamal Hadi Salim struct xfrm_replay_state preplay; 1979736acf3SSteffen Klassert struct xfrm_replay_state_esn *preplay_esn; 198f8cd5488SJamal Hadi Salim 1999fdc4883SSteffen Klassert /* The functions for replay detection. */ 200e45a8a9eSJulia Lawall const struct xfrm_replay *repl; 2019fdc4883SSteffen Klassert 2022717096aSJamal Hadi Salim /* internal flag that only holds state for delayed aevent at the 2032717096aSJamal Hadi Salim * moment 2042717096aSJamal Hadi Salim */ 2052717096aSJamal Hadi Salim u32 xflags; 2062717096aSJamal Hadi Salim 207f8cd5488SJamal Hadi Salim /* Replay detection notification settings */ 208f8cd5488SJamal Hadi Salim u32 replay_maxage; 209f8cd5488SJamal Hadi Salim u32 replay_maxdiff; 210f8cd5488SJamal Hadi Salim 211f8cd5488SJamal Hadi Salim /* Replay detection notification timer */ 212f8cd5488SJamal Hadi Salim struct timer_list rtimer; 213f8cd5488SJamal Hadi Salim 2141da177e4SLinus Torvalds /* Statistics */ 2151da177e4SLinus Torvalds struct xfrm_stats stats; 2161da177e4SLinus Torvalds 2171da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 2189e0d57fdSYury Polyanskiy struct tasklet_hrtimer mtimer; 2191da177e4SLinus Torvalds 220d77e38e6SSteffen Klassert struct xfrm_state_offload xso; 221d77e38e6SSteffen Klassert 222e3c0d047SFan Du /* used to fix curlft->add_time when changing date */ 223e3c0d047SFan Du long saved_tmo; 224e3c0d047SFan Du 2259afaca05SMasahide NAKAMURA /* Last used time */ 226d26f3984SHerbert Xu unsigned long lastused; 2279afaca05SMasahide NAKAMURA 228cac2661cSSteffen Klassert struct page_frag xfrag; 229cac2661cSSteffen Klassert 2301da177e4SLinus Torvalds /* Reference to data common to all the instances of this 2311da177e4SLinus Torvalds * transformer. */ 232533cb5b0SEric Dumazet const struct xfrm_type *type; 23313996378SHerbert Xu struct xfrm_mode *inner_mode; 234df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode_iaf; 23513996378SHerbert Xu struct xfrm_mode *outer_mode; 2361da177e4SLinus Torvalds 2379d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload; 2389d389d7fSSteffen Klassert 239df71837dSTrent Jaeger /* Security context */ 240df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 241df71837dSTrent Jaeger 2421da177e4SLinus Torvalds /* Private data of this transformer, format is opaque, 2431da177e4SLinus Torvalds * interpreted by xfrm_type methods. */ 2441da177e4SLinus Torvalds void *data; 2451da177e4SLinus Torvalds }; 2461da177e4SLinus Torvalds 247673c09beSAlexey Dobriyan static inline struct net *xs_net(struct xfrm_state *x) 248673c09beSAlexey Dobriyan { 249673c09beSAlexey Dobriyan return read_pnet(&x->xs_net); 250673c09beSAlexey Dobriyan } 251673c09beSAlexey Dobriyan 2522717096aSJamal Hadi Salim /* xflags - make enum if more show up */ 2532717096aSJamal Hadi Salim #define XFRM_TIME_DEFER 1 254e3c0d047SFan Du #define XFRM_SOFT_EXPIRE 2 2552717096aSJamal Hadi Salim 2561da177e4SLinus Torvalds enum { 2571da177e4SLinus Torvalds XFRM_STATE_VOID, 2581da177e4SLinus Torvalds XFRM_STATE_ACQ, 2591da177e4SLinus Torvalds XFRM_STATE_VALID, 2601da177e4SLinus Torvalds XFRM_STATE_ERROR, 2611da177e4SLinus Torvalds XFRM_STATE_EXPIRED, 2621da177e4SLinus Torvalds XFRM_STATE_DEAD 2631da177e4SLinus Torvalds }; 2641da177e4SLinus Torvalds 26526b15dadSJamal Hadi Salim /* callback structure passed from either netlink or pfkey */ 266fd2c3ef7SEric Dumazet struct km_event { 267bf08867fSHerbert Xu union { 268bf08867fSHerbert Xu u32 hard; 269bf08867fSHerbert Xu u32 proto; 270bf08867fSHerbert Xu u32 byid; 271f8cd5488SJamal Hadi Salim u32 aevent; 272f7b6983fSMasahide NAKAMURA u32 type; 273bf08867fSHerbert Xu } data; 274bf08867fSHerbert Xu 27526b15dadSJamal Hadi Salim u32 seq; 27615e47304SEric W. Biederman u32 portid; 27726b15dadSJamal Hadi Salim u32 event; 2787067802eSAlexey Dobriyan struct net *net; 27926b15dadSJamal Hadi Salim }; 28026b15dadSJamal Hadi Salim 2819fdc4883SSteffen Klassert struct xfrm_replay { 2829fdc4883SSteffen Klassert void (*advance)(struct xfrm_state *x, __be32 net_seq); 2839fdc4883SSteffen Klassert int (*check)(struct xfrm_state *x, 2849fdc4883SSteffen Klassert struct sk_buff *skb, 2859fdc4883SSteffen Klassert __be32 net_seq); 2863b59df46SSteffen Klassert int (*recheck)(struct xfrm_state *x, 2873b59df46SSteffen Klassert struct sk_buff *skb, 2883b59df46SSteffen Klassert __be32 net_seq); 2899fdc4883SSteffen Klassert void (*notify)(struct xfrm_state *x, int event); 2909fdc4883SSteffen Klassert int (*overflow)(struct xfrm_state *x, struct sk_buff *skb); 2919fdc4883SSteffen Klassert }; 2929fdc4883SSteffen Klassert 29325ee3286SHerbert Xu struct net_device; 2941da177e4SLinus Torvalds struct xfrm_type; 2951da177e4SLinus Torvalds struct xfrm_dst; 2961da177e4SLinus Torvalds struct xfrm_policy_afinfo { 2971da177e4SLinus Torvalds struct dst_ops *dst_ops; 29842a7b32bSDavid Ahern struct dst_entry *(*dst_lookup)(struct net *net, 29942a7b32bSDavid Ahern int tos, int oif, 3005e6b930fSDavid S. Miller const xfrm_address_t *saddr, 3015e6b930fSDavid S. Miller const xfrm_address_t *daddr); 30242a7b32bSDavid Ahern int (*get_saddr)(struct net *net, int oif, 30342a7b32bSDavid Ahern xfrm_address_t *saddr, 30442a7b32bSDavid Ahern xfrm_address_t *daddr); 3051da177e4SLinus Torvalds void (*decode_session)(struct sk_buff *skb, 306d5422efeSHerbert Xu struct flowi *fl, 307d5422efeSHerbert Xu int reverse); 30805d84025SDavid S. Miller int (*get_tos)(const struct flowi *fl); 309a1b05140SMasahide NAKAMURA int (*init_path)(struct xfrm_dst *path, 310a1b05140SMasahide NAKAMURA struct dst_entry *dst, 311a1b05140SMasahide NAKAMURA int nfheader_len); 31225ee3286SHerbert Xu int (*fill_dst)(struct xfrm_dst *xdst, 31387c1e12bSHerbert Xu struct net_device *dev, 3140c7b3eefSDavid S. Miller const struct flowi *fl); 3152774c131SDavid S. Miller struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 3161da177e4SLinus Torvalds }; 3171da177e4SLinus Torvalds 318a2817d8bSFlorian Westphal int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 319a2817d8bSFlorian Westphal void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 320d511337aSJoe Perches void km_policy_notify(struct xfrm_policy *xp, int dir, 321d511337aSJoe Perches const struct km_event *c); 322ec30d78cSFlorian Westphal void xfrm_policy_cache_flush(void); 323d511337aSJoe Perches void km_state_notify(struct xfrm_state *x, const struct km_event *c); 3241da177e4SLinus Torvalds 3251da177e4SLinus Torvalds struct xfrm_tmpl; 326d511337aSJoe Perches int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 327d511337aSJoe Perches struct xfrm_policy *pol); 328d511337aSJoe Perches void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 329d511337aSJoe Perches int __xfrm_state_delete(struct xfrm_state *x); 33053bc6b4dSJamal Hadi Salim 3311da177e4SLinus Torvalds struct xfrm_state_afinfo { 33217c2a42aSHerbert Xu unsigned int family; 33336cf9acfSHerbert Xu unsigned int proto; 3348e3d716cSAl Viro __be16 eth_proto; 33517c2a42aSHerbert Xu struct module *owner; 336533cb5b0SEric Dumazet const struct xfrm_type *type_map[IPPROTO_MAX]; 3379d389d7fSSteffen Klassert const struct xfrm_type_offload *type_offload_map[IPPROTO_MAX]; 338aa5d62ccSHerbert Xu struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 3399d389d7fSSteffen Klassert 340d094cd83SHerbert Xu int (*init_flags)(struct xfrm_state *x); 34173e5ebb2SDavid S. Miller void (*init_tempsel)(struct xfrm_selector *sel, 34273e5ebb2SDavid S. Miller const struct flowi *fl); 34319bd6244SDavid S. Miller void (*init_temprop)(struct xfrm_state *x, 34419bd6244SDavid S. Miller const struct xfrm_tmpl *tmpl, 34519bd6244SDavid S. Miller const xfrm_address_t *daddr, 34619bd6244SDavid S. Miller const xfrm_address_t *saddr); 34741a49cc3SMasahide NAKAMURA int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n); 34841a49cc3SMasahide NAKAMURA int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n); 349ede2059dSEric W. Biederman int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 3507026b1ddSDavid Miller int (*output_finish)(struct sock *sk, struct sk_buff *skb); 351227620e2SHerbert Xu int (*extract_input)(struct xfrm_state *x, 352227620e2SHerbert Xu struct sk_buff *skb); 35336cf9acfSHerbert Xu int (*extract_output)(struct xfrm_state *x, 35436cf9acfSHerbert Xu struct sk_buff *skb); 355716062fdSHerbert Xu int (*transport_finish)(struct sk_buff *skb, 356716062fdSHerbert Xu int async); 357628e341fSHannes Frederic Sowa void (*local_error)(struct sk_buff *skb, u32 mtu); 3581da177e4SLinus Torvalds }; 3591da177e4SLinus Torvalds 360d511337aSJoe Perches int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 361d511337aSJoe Perches int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 362d511337aSJoe Perches struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 363711059b9SFlorian Westphal struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 3641da177e4SLinus Torvalds 3652f32b51bSSteffen Klassert struct xfrm_input_afinfo { 3662f32b51bSSteffen Klassert unsigned int family; 3672f32b51bSSteffen Klassert int (*callback)(struct sk_buff *skb, u8 protocol, 3682f32b51bSSteffen Klassert int err); 3692f32b51bSSteffen Klassert }; 3702f32b51bSSteffen Klassert 371960fdfdeSFlorian Westphal int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 372960fdfdeSFlorian Westphal int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 3732f32b51bSSteffen Klassert 374d511337aSJoe Perches void xfrm_state_delete_tunnel(struct xfrm_state *x); 3751da177e4SLinus Torvalds 376fd2c3ef7SEric Dumazet struct xfrm_type { 3771da177e4SLinus Torvalds char *description; 3781da177e4SLinus Torvalds struct module *owner; 379a6337463Sjamal u8 proto; 380a6337463Sjamal u8 flags; 3811b5c2299SMasahide NAKAMURA #define XFRM_TYPE_NON_FRAGMENT 1 382436a0a40SHerbert Xu #define XFRM_TYPE_REPLAY_PROT 2 383f04e7e8dSHerbert Xu #define XFRM_TYPE_LOCAL_COADDR 4 384f04e7e8dSHerbert Xu #define XFRM_TYPE_REMOTE_COADDR 8 3851da177e4SLinus Torvalds 38672cb6962SHerbert Xu int (*init_state)(struct xfrm_state *x); 3871da177e4SLinus Torvalds void (*destructor)(struct xfrm_state *); 388e695633eSHerbert Xu int (*input)(struct xfrm_state *, struct sk_buff *skb); 3891da177e4SLinus Torvalds int (*output)(struct xfrm_state *, struct sk_buff *pskb); 3908f029de2SDavid S. Miller int (*reject)(struct xfrm_state *, struct sk_buff *, 3918f029de2SDavid S. Miller const struct flowi *); 392aee5adb4SMasahide NAKAMURA int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **); 3931da177e4SLinus Torvalds /* Estimate maximal size of result of transformation of a dgram */ 394c5c25238SPatrick McHardy u32 (*get_mtu)(struct xfrm_state *, int size); 3951da177e4SLinus Torvalds }; 3961da177e4SLinus Torvalds 397d511337aSJoe Perches int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 398d511337aSJoe Perches int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 3991da177e4SLinus Torvalds 4009d389d7fSSteffen Klassert struct xfrm_type_offload { 4019d389d7fSSteffen Klassert char *description; 4029d389d7fSSteffen Klassert struct module *owner; 4039d389d7fSSteffen Klassert u8 proto; 4049d389d7fSSteffen Klassert void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 4059d389d7fSSteffen Klassert int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 4069d389d7fSSteffen Klassert int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 4079d389d7fSSteffen Klassert }; 4089d389d7fSSteffen Klassert 4099d389d7fSSteffen Klassert int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 4109d389d7fSSteffen Klassert int xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 4119d389d7fSSteffen Klassert 412b59f45d0SHerbert Xu struct xfrm_mode { 413227620e2SHerbert Xu /* 414227620e2SHerbert Xu * Remove encapsulation header. 415227620e2SHerbert Xu * 416227620e2SHerbert Xu * The IP header will be moved over the top of the encapsulation 417227620e2SHerbert Xu * header. 418227620e2SHerbert Xu * 419227620e2SHerbert Xu * On entry, the transport header shall point to where the IP header 420227620e2SHerbert Xu * should be and the network header shall be set to where the IP 421227620e2SHerbert Xu * header currently is. skb->data shall point to the start of the 422227620e2SHerbert Xu * payload. 423227620e2SHerbert Xu */ 424227620e2SHerbert Xu int (*input2)(struct xfrm_state *x, struct sk_buff *skb); 425227620e2SHerbert Xu 426227620e2SHerbert Xu /* 427227620e2SHerbert Xu * This is the actual input entry point. 428227620e2SHerbert Xu * 429227620e2SHerbert Xu * For transport mode and equivalent this would be identical to 430227620e2SHerbert Xu * input2 (which does not need to be set). While tunnel mode 431227620e2SHerbert Xu * and equivalent would set this to the tunnel encapsulation function 432227620e2SHerbert Xu * xfrm4_prepare_input that would in turn call input2. 433227620e2SHerbert Xu */ 434b59f45d0SHerbert Xu int (*input)(struct xfrm_state *x, struct sk_buff *skb); 43537fedd3aSHerbert Xu 43637fedd3aSHerbert Xu /* 43737fedd3aSHerbert Xu * Add encapsulation header. 43837fedd3aSHerbert Xu * 43937fedd3aSHerbert Xu * On exit, the transport header will be set to the start of the 44037fedd3aSHerbert Xu * encapsulation header to be filled in by x->type->output and 44137fedd3aSHerbert Xu * the mac header will be set to the nextheader (protocol for 44237fedd3aSHerbert Xu * IPv4) field of the extension header directly preceding the 44337fedd3aSHerbert Xu * encapsulation header, or in its absence, that of the top IP 44437fedd3aSHerbert Xu * header. The value of the network header will always point 44537fedd3aSHerbert Xu * to the top IP header while skb->data will point to the payload. 44637fedd3aSHerbert Xu */ 44736cf9acfSHerbert Xu int (*output2)(struct xfrm_state *x,struct sk_buff *skb); 44836cf9acfSHerbert Xu 44936cf9acfSHerbert Xu /* 45036cf9acfSHerbert Xu * This is the actual output entry point. 45136cf9acfSHerbert Xu * 45236cf9acfSHerbert Xu * For transport mode and equivalent this would be identical to 45336cf9acfSHerbert Xu * output2 (which does not need to be set). While tunnel mode 45436cf9acfSHerbert Xu * and equivalent would set this to a tunnel encapsulation function 45536cf9acfSHerbert Xu * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn 45636cf9acfSHerbert Xu * call output2. 45736cf9acfSHerbert Xu */ 458eb878e84SJamal Hadi Salim int (*output)(struct xfrm_state *x, struct sk_buff *skb); 459b59f45d0SHerbert Xu 460c35fe410SSteffen Klassert /* 461c35fe410SSteffen Klassert * Adjust pointers into the packet and do GSO segmentation. 462c35fe410SSteffen Klassert */ 463c35fe410SSteffen Klassert struct sk_buff *(*gso_segment)(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features); 464c35fe410SSteffen Klassert 465c35fe410SSteffen Klassert /* 466c35fe410SSteffen Klassert * Adjust pointers into the packet when IPsec is done at layer2. 467c35fe410SSteffen Klassert */ 468c35fe410SSteffen Klassert void (*xmit)(struct xfrm_state *x, struct sk_buff *skb); 469c35fe410SSteffen Klassert 47017c2a42aSHerbert Xu struct xfrm_state_afinfo *afinfo; 471b59f45d0SHerbert Xu struct module *owner; 472b59f45d0SHerbert Xu unsigned int encap; 4731bfcb10fSHerbert Xu int flags; 4741bfcb10fSHerbert Xu }; 4751bfcb10fSHerbert Xu 4761bfcb10fSHerbert Xu /* Flags for xfrm_mode. */ 4771bfcb10fSHerbert Xu enum { 4781bfcb10fSHerbert Xu XFRM_MODE_FLAG_TUNNEL = 1, 479b59f45d0SHerbert Xu }; 480b59f45d0SHerbert Xu 481d511337aSJoe Perches int xfrm_register_mode(struct xfrm_mode *mode, int family); 482d511337aSJoe Perches int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 483b59f45d0SHerbert Xu 484df9dcb45SKazunori MIYAZAWA static inline int xfrm_af2proto(unsigned int family) 485df9dcb45SKazunori MIYAZAWA { 486df9dcb45SKazunori MIYAZAWA switch(family) { 487df9dcb45SKazunori MIYAZAWA case AF_INET: 488df9dcb45SKazunori MIYAZAWA return IPPROTO_IPIP; 489df9dcb45SKazunori MIYAZAWA case AF_INET6: 490df9dcb45SKazunori MIYAZAWA return IPPROTO_IPV6; 491df9dcb45SKazunori MIYAZAWA default: 492df9dcb45SKazunori MIYAZAWA return 0; 493df9dcb45SKazunori MIYAZAWA } 494df9dcb45SKazunori MIYAZAWA } 495df9dcb45SKazunori MIYAZAWA 496df9dcb45SKazunori MIYAZAWA static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 497df9dcb45SKazunori MIYAZAWA { 498df9dcb45SKazunori MIYAZAWA if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 499df9dcb45SKazunori MIYAZAWA (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 500df9dcb45SKazunori MIYAZAWA return x->inner_mode; 501df9dcb45SKazunori MIYAZAWA else 502df9dcb45SKazunori MIYAZAWA return x->inner_mode_iaf; 503df9dcb45SKazunori MIYAZAWA } 504df9dcb45SKazunori MIYAZAWA 505fd2c3ef7SEric Dumazet struct xfrm_tmpl { 5061da177e4SLinus Torvalds /* id in template is interpreted as: 5071da177e4SLinus Torvalds * daddr - destination of tunnel, may be zero for transport mode. 5081da177e4SLinus Torvalds * spi - zero to acquire spi. Not zero if spi is static, then 5091da177e4SLinus Torvalds * daddr must be fixed too. 5101da177e4SLinus Torvalds * proto - AH/ESP/IPCOMP 5111da177e4SLinus Torvalds */ 5121da177e4SLinus Torvalds struct xfrm_id id; 5131da177e4SLinus Torvalds 5141da177e4SLinus Torvalds /* Source address of tunnel. Ignored, if it is not a tunnel. */ 5151da177e4SLinus Torvalds xfrm_address_t saddr; 5161da177e4SLinus Torvalds 51776b3f055SMiika Komu unsigned short encap_family; 51876b3f055SMiika Komu 519a6337463Sjamal u32 reqid; 5201da177e4SLinus Torvalds 5217e49e6deSMasahide NAKAMURA /* Mode: transport, tunnel etc. */ 522a6337463Sjamal u8 mode; 5231da177e4SLinus Torvalds 5241da177e4SLinus Torvalds /* Sharing mode: unique, this session only, this user only etc. */ 525a6337463Sjamal u8 share; 5261da177e4SLinus Torvalds 5271da177e4SLinus Torvalds /* May skip this transfomration if no SA is found */ 528a6337463Sjamal u8 optional; 5291da177e4SLinus Torvalds 530c5d18e98SHerbert Xu /* Skip aalgos/ealgos/calgos checks. */ 531a6337463Sjamal u8 allalgs; 532c5d18e98SHerbert Xu 5331da177e4SLinus Torvalds /* Bit mask of algos allowed for acquisition */ 534a6337463Sjamal u32 aalgos; 535a6337463Sjamal u32 ealgos; 536a6337463Sjamal u32 calgos; 5371da177e4SLinus Torvalds }; 5381da177e4SLinus Torvalds 539622dc828SMasahide NAKAMURA #define XFRM_MAX_DEPTH 6 54054ef207aSSteffen Klassert #define XFRM_MAX_OFFLOAD_DEPTH 1 5411da177e4SLinus Torvalds 54212a169e7SHerbert Xu struct xfrm_policy_walk_entry { 54312a169e7SHerbert Xu struct list_head all; 54412a169e7SHerbert Xu u8 dead; 54512a169e7SHerbert Xu }; 54612a169e7SHerbert Xu 54712a169e7SHerbert Xu struct xfrm_policy_walk { 54812a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 54912a169e7SHerbert Xu u8 type; 55012a169e7SHerbert Xu u32 seq; 55112a169e7SHerbert Xu }; 55212a169e7SHerbert Xu 553a0073fe1SSteffen Klassert struct xfrm_policy_queue { 554a0073fe1SSteffen Klassert struct sk_buff_head hold_queue; 555a0073fe1SSteffen Klassert struct timer_list hold_timer; 556a0073fe1SSteffen Klassert unsigned long timeout; 557a0073fe1SSteffen Klassert }; 558a0073fe1SSteffen Klassert 559fd2c3ef7SEric Dumazet struct xfrm_policy { 5600c5c9fb5SEric W. Biederman possible_net_t xp_net; 5612518c7c2SDavid S. Miller struct hlist_node bydst; 5622518c7c2SDavid S. Miller struct hlist_node byidx; 5631da177e4SLinus Torvalds 5641da177e4SLinus Torvalds /* This lock only affects elements except for entry. */ 5651da177e4SLinus Torvalds rwlock_t lock; 566850a6212SReshetova, Elena refcount_t refcnt; 5671da177e4SLinus Torvalds struct timer_list timer; 5681da177e4SLinus Torvalds 56980c802f3STimo Teräs atomic_t genid; 5701da177e4SLinus Torvalds u32 priority; 5711da177e4SLinus Torvalds u32 index; 572bf825f81SJamal Hadi Salim struct xfrm_mark mark; 5731da177e4SLinus Torvalds struct xfrm_selector selector; 5741da177e4SLinus Torvalds struct xfrm_lifetime_cfg lft; 5751da177e4SLinus Torvalds struct xfrm_lifetime_cur curlft; 57612a169e7SHerbert Xu struct xfrm_policy_walk_entry walk; 577a0073fe1SSteffen Klassert struct xfrm_policy_queue polq; 57846ca5f5dSArnaldo Carvalho de Melo u8 type; 57946ca5f5dSArnaldo Carvalho de Melo u8 action; 58046ca5f5dSArnaldo Carvalho de Melo u8 flags; 58146ca5f5dSArnaldo Carvalho de Melo u8 xfrm_nr; 58212a169e7SHerbert Xu u16 family; 583df71837dSTrent Jaeger struct xfrm_sec_ctx *security; 5841da177e4SLinus Torvalds struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 58556f04730SEric Dumazet struct rcu_head rcu; 5861da177e4SLinus Torvalds }; 5871da177e4SLinus Torvalds 58863eb23f5SDavid S. Miller static inline struct net *xp_net(const struct xfrm_policy *xp) 5890331b1f3SAlexey Dobriyan { 5900331b1f3SAlexey Dobriyan return read_pnet(&xp->xp_net); 5910331b1f3SAlexey Dobriyan } 5920331b1f3SAlexey Dobriyan 59313c1d189SArnaud Ebalard struct xfrm_kmaddress { 59413c1d189SArnaud Ebalard xfrm_address_t local; 59513c1d189SArnaud Ebalard xfrm_address_t remote; 59613c1d189SArnaud Ebalard u32 reserved; 59713c1d189SArnaud Ebalard u16 family; 59813c1d189SArnaud Ebalard }; 59913c1d189SArnaud Ebalard 60080c9abaaSShinta Sugimoto struct xfrm_migrate { 60180c9abaaSShinta Sugimoto xfrm_address_t old_daddr; 60280c9abaaSShinta Sugimoto xfrm_address_t old_saddr; 60380c9abaaSShinta Sugimoto xfrm_address_t new_daddr; 60480c9abaaSShinta Sugimoto xfrm_address_t new_saddr; 60580c9abaaSShinta Sugimoto u8 proto; 60680c9abaaSShinta Sugimoto u8 mode; 60780c9abaaSShinta Sugimoto u16 reserved; 60880c9abaaSShinta Sugimoto u32 reqid; 60980c9abaaSShinta Sugimoto u16 old_family; 61080c9abaaSShinta Sugimoto u16 new_family; 61180c9abaaSShinta Sugimoto }; 61280c9abaaSShinta Sugimoto 6131da177e4SLinus Torvalds #define XFRM_KM_TIMEOUT 30 614f8cd5488SJamal Hadi Salim /* what happened */ 615f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_UPDATE XFRM_AE_CR 616f8cd5488SJamal Hadi Salim #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 617f8cd5488SJamal Hadi Salim 618f8cd5488SJamal Hadi Salim /* default aevent timeout in units of 100ms */ 619f8cd5488SJamal Hadi Salim #define XFRM_AE_ETIME 10 620f8cd5488SJamal Hadi Salim /* Async Event timer multiplier */ 621f8cd5488SJamal Hadi Salim #define XFRM_AE_ETH_M 10 622f8cd5488SJamal Hadi Salim /* default seq threshold size */ 623f8cd5488SJamal Hadi Salim #define XFRM_AE_SEQT_SIZE 2 6241da177e4SLinus Torvalds 625fd2c3ef7SEric Dumazet struct xfrm_mgr { 6261da177e4SLinus Torvalds struct list_head list; 627214e005bSDavid S. Miller int (*notify)(struct xfrm_state *x, const struct km_event *c); 62865e0736bSFan Du int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 629cb969f07SVenkat Yekkirala struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 6305d36b180SAl Viro int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 631214e005bSDavid S. Miller int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 632db983c11SAlexey Dobriyan int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 633183cad12SDavid S. Miller int (*migrate)(const struct xfrm_selector *sel, 634183cad12SDavid S. Miller u8 dir, u8 type, 635183cad12SDavid S. Miller const struct xfrm_migrate *m, 636183cad12SDavid S. Miller int num_bundles, 6378bafd730SAntony Antony const struct xfrm_kmaddress *k, 6388bafd730SAntony Antony const struct xfrm_encap_tmpl *encap); 6390f24558eSHoria Geanta bool (*is_alive)(const struct km_event *c); 6401da177e4SLinus Torvalds }; 6411da177e4SLinus Torvalds 642d511337aSJoe Perches int xfrm_register_km(struct xfrm_mgr *km); 643d511337aSJoe Perches int xfrm_unregister_km(struct xfrm_mgr *km); 6441da177e4SLinus Torvalds 64570be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb { 64670be6c91SSteffen Klassert union { 64770be6c91SSteffen Klassert struct inet_skb_parm h4; 64870be6c91SSteffen Klassert struct inet6_skb_parm h6; 64970be6c91SSteffen Klassert } header; 65070be6c91SSteffen Klassert 65170be6c91SSteffen Klassert union { 65270be6c91SSteffen Klassert struct ip_tunnel *ip4; 65370be6c91SSteffen Klassert struct ip6_tnl *ip6; 65470be6c91SSteffen Klassert } tunnel; 65570be6c91SSteffen Klassert }; 65670be6c91SSteffen Klassert 65770be6c91SSteffen Klassert #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 65870be6c91SSteffen Klassert 659436a0a40SHerbert Xu /* 660436a0a40SHerbert Xu * This structure is used for the duration where packets are being 661436a0a40SHerbert Xu * transformed by IPsec. As soon as the packet leaves IPsec the 662436a0a40SHerbert Xu * area beyond the generic IP part may be overwritten. 663436a0a40SHerbert Xu */ 664436a0a40SHerbert Xu struct xfrm_skb_cb { 66570be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 666436a0a40SHerbert Xu 667436a0a40SHerbert Xu /* Sequence number for replay protection. */ 668b318e0e4SHerbert Xu union { 6691ce3644aSSteffen Klassert struct { 6701ce3644aSSteffen Klassert __u32 low; 6711ce3644aSSteffen Klassert __u32 hi; 6721ce3644aSSteffen Klassert } output; 6731ce3644aSSteffen Klassert struct { 6741ce3644aSSteffen Klassert __be32 low; 6751ce3644aSSteffen Klassert __be32 hi; 6761ce3644aSSteffen Klassert } input; 677b318e0e4SHerbert Xu } seq; 678436a0a40SHerbert Xu }; 679436a0a40SHerbert Xu 680436a0a40SHerbert Xu #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 681436a0a40SHerbert Xu 68236cf9acfSHerbert Xu /* 68336cf9acfSHerbert Xu * This structure is used by the afinfo prepare_input/prepare_output functions 68436cf9acfSHerbert Xu * to transmit header information to the mode input/output functions. 68536cf9acfSHerbert Xu */ 68636cf9acfSHerbert Xu struct xfrm_mode_skb_cb { 68770be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 68836cf9acfSHerbert Xu 68936cf9acfSHerbert Xu /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 69036cf9acfSHerbert Xu __be16 id; 69136cf9acfSHerbert Xu __be16 frag_off; 69236cf9acfSHerbert Xu 693732c8bd5SHerbert Xu /* IP header length (excluding options or extension headers). */ 694732c8bd5SHerbert Xu u8 ihl; 695732c8bd5SHerbert Xu 69636cf9acfSHerbert Xu /* TOS for IPv4, class for IPv6. */ 69736cf9acfSHerbert Xu u8 tos; 69836cf9acfSHerbert Xu 69936cf9acfSHerbert Xu /* TTL for IPv4, hop limitfor IPv6. */ 70036cf9acfSHerbert Xu u8 ttl; 70136cf9acfSHerbert Xu 70236cf9acfSHerbert Xu /* Protocol for IPv4, NH for IPv6. */ 70336cf9acfSHerbert Xu u8 protocol; 70436cf9acfSHerbert Xu 705732c8bd5SHerbert Xu /* Option length for IPv4, zero for IPv6. */ 706732c8bd5SHerbert Xu u8 optlen; 707732c8bd5SHerbert Xu 70836cf9acfSHerbert Xu /* Used by IPv6 only, zero for IPv4. */ 70936cf9acfSHerbert Xu u8 flow_lbl[3]; 71036cf9acfSHerbert Xu }; 71136cf9acfSHerbert Xu 71236cf9acfSHerbert Xu #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 71336cf9acfSHerbert Xu 714716062fdSHerbert Xu /* 715716062fdSHerbert Xu * This structure is used by the input processing to locate the SPI and 716716062fdSHerbert Xu * related information. 717716062fdSHerbert Xu */ 718716062fdSHerbert Xu struct xfrm_spi_skb_cb { 71970be6c91SSteffen Klassert struct xfrm_tunnel_skb_cb header; 720716062fdSHerbert Xu 721716062fdSHerbert Xu unsigned int daddroff; 7222fcb45b6SHerbert Xu unsigned int family; 7237785bba2SSteffen Klassert __be32 seq; 724716062fdSHerbert Xu }; 725716062fdSHerbert Xu 726716062fdSHerbert Xu #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 727716062fdSHerbert Xu 728c9204d9cSJoy Latten #ifdef CONFIG_AUDITSYSCALL 729afeb14b4SPaul Moore static inline struct audit_buffer *xfrm_audit_start(const char *op) 730ab5f5e8bSJoy Latten { 731ab5f5e8bSJoy Latten struct audit_buffer *audit_buf = NULL; 732ab5f5e8bSJoy Latten 733afeb14b4SPaul Moore if (audit_enabled == 0) 734afeb14b4SPaul Moore return NULL; 735ab5f5e8bSJoy Latten audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, 736ab5f5e8bSJoy Latten AUDIT_MAC_IPSEC_EVENT); 737ab5f5e8bSJoy Latten if (audit_buf == NULL) 738ab5f5e8bSJoy Latten return NULL; 739afeb14b4SPaul Moore audit_log_format(audit_buf, "op=%s", op); 740afeb14b4SPaul Moore return audit_buf; 741afeb14b4SPaul Moore } 742afeb14b4SPaul Moore 7432e71029eSTetsuo Handa static inline void xfrm_audit_helper_usrinfo(bool task_valid, 744afeb14b4SPaul Moore struct audit_buffer *audit_buf) 745afeb14b4SPaul Moore { 7462e71029eSTetsuo Handa const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 7472e71029eSTetsuo Handa audit_get_loginuid(current) : 7482e71029eSTetsuo Handa INVALID_UID); 7492e71029eSTetsuo Handa const unsigned int ses = task_valid ? audit_get_sessionid(current) : 7502e71029eSTetsuo Handa (unsigned int) -1; 7512e71029eSTetsuo Handa 7522e71029eSTetsuo Handa audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 753ab5f5e8bSJoy Latten audit_log_task_context(audit_buf); 754ab5f5e8bSJoy Latten } 755ab5f5e8bSJoy Latten 7562e71029eSTetsuo Handa void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 7572e71029eSTetsuo Handa void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7582e71029eSTetsuo Handa bool task_valid); 7592e71029eSTetsuo Handa void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 7602e71029eSTetsuo Handa void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 761d511337aSJoe Perches void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 762afeb14b4SPaul Moore struct sk_buff *skb); 763d511337aSJoe Perches void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 764d511337aSJoe Perches __be32 net_seq); 765d511337aSJoe Perches void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 766d511337aSJoe Perches void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 767d511337aSJoe Perches __be32 net_seq); 768d511337aSJoe Perches void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 769d511337aSJoe Perches u8 proto); 770c9204d9cSJoy Latten #else 77141fef0eeSMarcin Slusarz 77241fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 7732e71029eSTetsuo Handa bool task_valid) 77441fef0eeSMarcin Slusarz { 77541fef0eeSMarcin Slusarz } 77641fef0eeSMarcin Slusarz 77741fef0eeSMarcin Slusarz static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 7782e71029eSTetsuo Handa bool task_valid) 77941fef0eeSMarcin Slusarz { 78041fef0eeSMarcin Slusarz } 78141fef0eeSMarcin Slusarz 78241fef0eeSMarcin Slusarz static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 7832e71029eSTetsuo Handa bool task_valid) 78441fef0eeSMarcin Slusarz { 78541fef0eeSMarcin Slusarz } 78641fef0eeSMarcin Slusarz 78741fef0eeSMarcin Slusarz static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 7882e71029eSTetsuo Handa bool task_valid) 78941fef0eeSMarcin Slusarz { 79041fef0eeSMarcin Slusarz } 79141fef0eeSMarcin Slusarz 79241fef0eeSMarcin Slusarz static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 79341fef0eeSMarcin Slusarz struct sk_buff *skb) 79441fef0eeSMarcin Slusarz { 79541fef0eeSMarcin Slusarz } 79641fef0eeSMarcin Slusarz 7979fdc4883SSteffen Klassert static inline void xfrm_audit_state_replay(struct xfrm_state *x, 7989fdc4883SSteffen Klassert struct sk_buff *skb, __be32 net_seq) 7999fdc4883SSteffen Klassert { 8009fdc4883SSteffen Klassert } 8019fdc4883SSteffen Klassert 80241fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 80341fef0eeSMarcin Slusarz u16 family) 80441fef0eeSMarcin Slusarz { 80541fef0eeSMarcin Slusarz } 80641fef0eeSMarcin Slusarz 80741fef0eeSMarcin Slusarz static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 80841fef0eeSMarcin Slusarz __be32 net_spi, __be32 net_seq) 80941fef0eeSMarcin Slusarz { 81041fef0eeSMarcin Slusarz } 81141fef0eeSMarcin Slusarz 81241fef0eeSMarcin Slusarz static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 81341fef0eeSMarcin Slusarz struct sk_buff *skb, u8 proto) 81441fef0eeSMarcin Slusarz { 81541fef0eeSMarcin Slusarz } 816c9204d9cSJoy Latten #endif /* CONFIG_AUDITSYSCALL */ 817161a09e7SJoy Latten 8181da177e4SLinus Torvalds static inline void xfrm_pol_hold(struct xfrm_policy *policy) 8191da177e4SLinus Torvalds { 8201da177e4SLinus Torvalds if (likely(policy != NULL)) 821850a6212SReshetova, Elena refcount_inc(&policy->refcnt); 8221da177e4SLinus Torvalds } 8231da177e4SLinus Torvalds 824d511337aSJoe Perches void xfrm_policy_destroy(struct xfrm_policy *policy); 8251da177e4SLinus Torvalds 8261da177e4SLinus Torvalds static inline void xfrm_pol_put(struct xfrm_policy *policy) 8271da177e4SLinus Torvalds { 828850a6212SReshetova, Elena if (refcount_dec_and_test(&policy->refcnt)) 82964c31b3fSWANG Cong xfrm_policy_destroy(policy); 8301da177e4SLinus Torvalds } 8311da177e4SLinus Torvalds 8324e81bb83SMasahide NAKAMURA static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 8334e81bb83SMasahide NAKAMURA { 8344e81bb83SMasahide NAKAMURA int i; 8354e81bb83SMasahide NAKAMURA for (i = npols - 1; i >= 0; --i) 8364e81bb83SMasahide NAKAMURA xfrm_pol_put(pols[i]); 8374e81bb83SMasahide NAKAMURA } 8384e81bb83SMasahide NAKAMURA 839d511337aSJoe Perches void __xfrm_state_destroy(struct xfrm_state *); 8401da177e4SLinus Torvalds 84121380b81SHerbert Xu static inline void __xfrm_state_put(struct xfrm_state *x) 84221380b81SHerbert Xu { 84388755e9cSReshetova, Elena refcount_dec(&x->refcnt); 84421380b81SHerbert Xu } 84521380b81SHerbert Xu 8461da177e4SLinus Torvalds static inline void xfrm_state_put(struct xfrm_state *x) 8471da177e4SLinus Torvalds { 84888755e9cSReshetova, Elena if (refcount_dec_and_test(&x->refcnt)) 8491da177e4SLinus Torvalds __xfrm_state_destroy(x); 8501da177e4SLinus Torvalds } 8511da177e4SLinus Torvalds 8521da177e4SLinus Torvalds static inline void xfrm_state_hold(struct xfrm_state *x) 8531da177e4SLinus Torvalds { 85488755e9cSReshetova, Elena refcount_inc(&x->refcnt); 8551da177e4SLinus Torvalds } 8561da177e4SLinus Torvalds 8571744a8feSDavid S. Miller static inline bool addr_match(const void *token1, const void *token2, 858e1b0048eSAlexey Dobriyan unsigned int prefixlen) 8591da177e4SLinus Torvalds { 8601744a8feSDavid S. Miller const __be32 *a1 = token1; 8611744a8feSDavid S. Miller const __be32 *a2 = token2; 862e1b0048eSAlexey Dobriyan unsigned int pdw; 863e1b0048eSAlexey Dobriyan unsigned int pbi; 8641da177e4SLinus Torvalds 865a6337463Sjamal pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 8661da177e4SLinus Torvalds pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 8671da177e4SLinus Torvalds 8681da177e4SLinus Torvalds if (pdw) 8691da177e4SLinus Torvalds if (memcmp(a1, a2, pdw << 2)) 8701744a8feSDavid S. Miller return false; 8711da177e4SLinus Torvalds 8721da177e4SLinus Torvalds if (pbi) { 8735f19343fSAl Viro __be32 mask; 8741da177e4SLinus Torvalds 8751da177e4SLinus Torvalds mask = htonl((0xffffffff) << (32 - pbi)); 8761da177e4SLinus Torvalds 8771da177e4SLinus Torvalds if ((a1[pdw] ^ a2[pdw]) & mask) 8781744a8feSDavid S. Miller return false; 8791da177e4SLinus Torvalds } 8801da177e4SLinus Torvalds 8811744a8feSDavid S. Miller return true; 8821da177e4SLinus Torvalds } 8831da177e4SLinus Torvalds 88426bff940SAlexey Dobriyan static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 88526bff940SAlexey Dobriyan { 88626bff940SAlexey Dobriyan /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 8876c786bcbSAlexey Dobriyan if (sizeof(long) == 4 && prefixlen == 0) 88826bff940SAlexey Dobriyan return true; 8896c786bcbSAlexey Dobriyan return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 89026bff940SAlexey Dobriyan } 89126bff940SAlexey Dobriyan 8921da177e4SLinus Torvalds static __inline__ 8936281dcc9SDavid S. Miller __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 8941da177e4SLinus Torvalds { 895f9d07e41SAl Viro __be16 port; 8961d28f42cSDavid S. Miller switch(fl->flowi_proto) { 8971da177e4SLinus Torvalds case IPPROTO_TCP: 8981da177e4SLinus Torvalds case IPPROTO_UDP: 899ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 9001da177e4SLinus Torvalds case IPPROTO_SCTP: 9016281dcc9SDavid S. Miller port = uli->ports.sport; 9021da177e4SLinus Torvalds break; 9031da177e4SLinus Torvalds case IPPROTO_ICMP: 9041da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9056281dcc9SDavid S. Miller port = htons(uli->icmpt.type); 9061da177e4SLinus Torvalds break; 9072ce4272aSMasahide NAKAMURA case IPPROTO_MH: 9086281dcc9SDavid S. Miller port = htons(uli->mht.type); 9092ce4272aSMasahide NAKAMURA break; 910cc9ff19dSTimo Teräs case IPPROTO_GRE: 9116281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) >> 16); 912cc9ff19dSTimo Teräs break; 9131da177e4SLinus Torvalds default: 9141da177e4SLinus Torvalds port = 0; /*XXX*/ 9151da177e4SLinus Torvalds } 9161da177e4SLinus Torvalds return port; 9171da177e4SLinus Torvalds } 9181da177e4SLinus Torvalds 9191da177e4SLinus Torvalds static __inline__ 9206281dcc9SDavid S. Miller __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 9211da177e4SLinus Torvalds { 922f9d07e41SAl Viro __be16 port; 9231d28f42cSDavid S. Miller switch(fl->flowi_proto) { 9241da177e4SLinus Torvalds case IPPROTO_TCP: 9251da177e4SLinus Torvalds case IPPROTO_UDP: 926ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 9271da177e4SLinus Torvalds case IPPROTO_SCTP: 9286281dcc9SDavid S. Miller port = uli->ports.dport; 9291da177e4SLinus Torvalds break; 9301da177e4SLinus Torvalds case IPPROTO_ICMP: 9311da177e4SLinus Torvalds case IPPROTO_ICMPV6: 9326281dcc9SDavid S. Miller port = htons(uli->icmpt.code); 9331da177e4SLinus Torvalds break; 934cc9ff19dSTimo Teräs case IPPROTO_GRE: 9356281dcc9SDavid S. Miller port = htons(ntohl(uli->gre_key) & 0xffff); 936cc9ff19dSTimo Teräs break; 9371da177e4SLinus Torvalds default: 9381da177e4SLinus Torvalds port = 0; /*XXX*/ 9391da177e4SLinus Torvalds } 9401da177e4SLinus Torvalds return port; 9411da177e4SLinus Torvalds } 9421da177e4SLinus Torvalds 943d511337aSJoe Perches bool xfrm_selector_match(const struct xfrm_selector *sel, 944d511337aSJoe Perches const struct flowi *fl, unsigned short family); 9451da177e4SLinus Torvalds 946df71837dSTrent Jaeger #ifdef CONFIG_SECURITY_NETWORK_XFRM 947df71837dSTrent Jaeger /* If neither has a context --> match 948df71837dSTrent Jaeger * Otherwise, both must have a context and the sids, doi, alg must match 949df71837dSTrent Jaeger */ 950bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 951df71837dSTrent Jaeger { 952df71837dSTrent Jaeger return ((!s1 && !s2) || 953df71837dSTrent Jaeger (s1 && s2 && 954df71837dSTrent Jaeger (s1->ctx_sid == s2->ctx_sid) && 955df71837dSTrent Jaeger (s1->ctx_doi == s2->ctx_doi) && 956df71837dSTrent Jaeger (s1->ctx_alg == s2->ctx_alg))); 957df71837dSTrent Jaeger } 958df71837dSTrent Jaeger #else 959bc9b35adSDavid S. Miller static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 960df71837dSTrent Jaeger { 961bc9b35adSDavid S. Miller return true; 962df71837dSTrent Jaeger } 963df71837dSTrent Jaeger #endif 964df71837dSTrent Jaeger 9651da177e4SLinus Torvalds /* A struct encoding bundle of transformations to apply to some set of flow. 9661da177e4SLinus Torvalds * 9671da177e4SLinus Torvalds * dst->child points to the next element of bundle. 9681da177e4SLinus Torvalds * dst->xfrm points to an instanse of transformer. 9691da177e4SLinus Torvalds * 9701da177e4SLinus Torvalds * Due to unfortunate limitations of current routing cache, which we 9711da177e4SLinus Torvalds * have no time to fix, it mirrors struct rtable and bound to the same 9721da177e4SLinus Torvalds * routing key, including saddr,daddr. However, we can have many of 9731da177e4SLinus Torvalds * bundles differing by session id. All the bundles grow from a parent 9741da177e4SLinus Torvalds * policy rule. 9751da177e4SLinus Torvalds */ 976fd2c3ef7SEric Dumazet struct xfrm_dst { 9771da177e4SLinus Torvalds union { 9781da177e4SLinus Torvalds struct dst_entry dst; 9791da177e4SLinus Torvalds struct rtable rt; 9801da177e4SLinus Torvalds struct rt6_info rt6; 9811da177e4SLinus Torvalds } u; 9821da177e4SLinus Torvalds struct dst_entry *route; 98380c802f3STimo Teräs struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 98480c802f3STimo Teräs int num_pols, num_xfrms; 98580c802f3STimo Teräs u32 xfrm_genid; 98680c802f3STimo Teräs u32 policy_genid; 9871da177e4SLinus Torvalds u32 route_mtu_cached; 9881da177e4SLinus Torvalds u32 child_mtu_cached; 98992d63decSHideaki YOSHIFUJI u32 route_cookie; 99092d63decSHideaki YOSHIFUJI u32 path_cookie; 9911da177e4SLinus Torvalds }; 9921da177e4SLinus Torvalds 993def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 994aabc9761SHerbert Xu static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 995aabc9761SHerbert Xu { 99680c802f3STimo Teräs xfrm_pols_put(xdst->pols, xdst->num_pols); 997aabc9761SHerbert Xu dst_release(xdst->route); 998aabc9761SHerbert Xu if (likely(xdst->u.dst.xfrm)) 999aabc9761SHerbert Xu xfrm_state_put(xdst->u.dst.xfrm); 1000aabc9761SHerbert Xu } 1001def8b4faSAlexey Dobriyan #endif 1002aabc9761SHerbert Xu 1003d511337aSJoe Perches void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 1004aabc9761SHerbert Xu 100554ef207aSSteffen Klassert struct xfrm_offload { 100654ef207aSSteffen Klassert /* Output sequence number for replay protection on offloading. */ 100754ef207aSSteffen Klassert struct { 100854ef207aSSteffen Klassert __u32 low; 100954ef207aSSteffen Klassert __u32 hi; 101054ef207aSSteffen Klassert } seq; 101154ef207aSSteffen Klassert 101254ef207aSSteffen Klassert __u32 flags; 101354ef207aSSteffen Klassert #define SA_DELETE_REQ 1 101454ef207aSSteffen Klassert #define CRYPTO_DONE 2 101554ef207aSSteffen Klassert #define CRYPTO_NEXT_DONE 4 101654ef207aSSteffen Klassert #define CRYPTO_FALLBACK 8 101754ef207aSSteffen Klassert #define XFRM_GSO_SEGMENT 16 101854ef207aSSteffen Klassert #define XFRM_GRO 32 101954ef207aSSteffen Klassert 102054ef207aSSteffen Klassert __u32 status; 102154ef207aSSteffen Klassert #define CRYPTO_SUCCESS 1 102254ef207aSSteffen Klassert #define CRYPTO_GENERIC_ERROR 2 102354ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 102454ef207aSSteffen Klassert #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 102554ef207aSSteffen Klassert #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 102654ef207aSSteffen Klassert #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 102754ef207aSSteffen Klassert #define CRYPTO_INVALID_PACKET_SYNTAX 64 102854ef207aSSteffen Klassert #define CRYPTO_INVALID_PROTOCOL 128 102954ef207aSSteffen Klassert 103054ef207aSSteffen Klassert __u8 proto; 103154ef207aSSteffen Klassert }; 103254ef207aSSteffen Klassert 1033fd2c3ef7SEric Dumazet struct sec_path { 103455eabed6SReshetova, Elena refcount_t refcnt; 10351da177e4SLinus Torvalds int len; 103654ef207aSSteffen Klassert int olen; 103754ef207aSSteffen Klassert 1038dbe5b4aaSHerbert Xu struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 103954ef207aSSteffen Klassert struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 10401da177e4SLinus Torvalds }; 10411da177e4SLinus Torvalds 1042990078afSMichael Smith static inline int secpath_exists(struct sk_buff *skb) 1043990078afSMichael Smith { 1044990078afSMichael Smith #ifdef CONFIG_XFRM 1045990078afSMichael Smith return skb->sp != NULL; 1046990078afSMichael Smith #else 1047990078afSMichael Smith return 0; 1048990078afSMichael Smith #endif 1049990078afSMichael Smith } 1050990078afSMichael Smith 10511da177e4SLinus Torvalds static inline struct sec_path * 10521da177e4SLinus Torvalds secpath_get(struct sec_path *sp) 10531da177e4SLinus Torvalds { 10541da177e4SLinus Torvalds if (sp) 105555eabed6SReshetova, Elena refcount_inc(&sp->refcnt); 10561da177e4SLinus Torvalds return sp; 10571da177e4SLinus Torvalds } 10581da177e4SLinus Torvalds 1059d511337aSJoe Perches void __secpath_destroy(struct sec_path *sp); 10601da177e4SLinus Torvalds 10611da177e4SLinus Torvalds static inline void 10621da177e4SLinus Torvalds secpath_put(struct sec_path *sp) 10631da177e4SLinus Torvalds { 106455eabed6SReshetova, Elena if (sp && refcount_dec_and_test(&sp->refcnt)) 10651da177e4SLinus Torvalds __secpath_destroy(sp); 10661da177e4SLinus Torvalds } 10671da177e4SLinus Torvalds 1068d511337aSJoe Perches struct sec_path *secpath_dup(struct sec_path *src); 1069b0fcee82SSteffen Klassert int secpath_set(struct sk_buff *skb); 10701da177e4SLinus Torvalds 10711da177e4SLinus Torvalds static inline void 10721da177e4SLinus Torvalds secpath_reset(struct sk_buff *skb) 10731da177e4SLinus Torvalds { 10741da177e4SLinus Torvalds #ifdef CONFIG_XFRM 10751da177e4SLinus Torvalds secpath_put(skb->sp); 10761da177e4SLinus Torvalds skb->sp = NULL; 10771da177e4SLinus Torvalds #endif 10781da177e4SLinus Torvalds } 10791da177e4SLinus Torvalds 10801da177e4SLinus Torvalds static inline int 10816cc32961SDavid S. Miller xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1082a1e59abfSPatrick McHardy { 1083a1e59abfSPatrick McHardy switch (family) { 1084a1e59abfSPatrick McHardy case AF_INET: 1085a1e59abfSPatrick McHardy return addr->a4 == 0; 1086a1e59abfSPatrick McHardy case AF_INET6: 108715e318bdSJiri Benc return ipv6_addr_any(&addr->in6); 1088a1e59abfSPatrick McHardy } 1089a1e59abfSPatrick McHardy return 0; 1090a1e59abfSPatrick McHardy } 1091a1e59abfSPatrick McHardy 1092a1e59abfSPatrick McHardy static inline int 109321eddb5cSDavid S. Miller __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 10941da177e4SLinus Torvalds { 10951da177e4SLinus Torvalds return (tmpl->saddr.a4 && 10961da177e4SLinus Torvalds tmpl->saddr.a4 != x->props.saddr.a4); 10971da177e4SLinus Torvalds } 10981da177e4SLinus Torvalds 10991da177e4SLinus Torvalds static inline int 110021eddb5cSDavid S. Miller __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 11011da177e4SLinus Torvalds { 11021da177e4SLinus Torvalds return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1103ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 11041da177e4SLinus Torvalds } 11051da177e4SLinus Torvalds 11061da177e4SLinus Torvalds static inline int 110721eddb5cSDavid S. Miller xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 11081da177e4SLinus Torvalds { 11091da177e4SLinus Torvalds switch (family) { 11101da177e4SLinus Torvalds case AF_INET: 11111da177e4SLinus Torvalds return __xfrm4_state_addr_cmp(tmpl, x); 11121da177e4SLinus Torvalds case AF_INET6: 11131da177e4SLinus Torvalds return __xfrm6_state_addr_cmp(tmpl, x); 11141da177e4SLinus Torvalds } 11151da177e4SLinus Torvalds return !0; 11161da177e4SLinus Torvalds } 11171da177e4SLinus Torvalds 11181da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1119d511337aSJoe Perches int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1120d511337aSJoe Perches unsigned short family); 11211da177e4SLinus Torvalds 1122d5422efeSHerbert Xu static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1123d5422efeSHerbert Xu struct sk_buff *skb, 1124d5422efeSHerbert Xu unsigned int family, int reverse) 11251da177e4SLinus Torvalds { 1126f6e1e25dSAlexey Dobriyan struct net *net = dev_net(skb->dev); 1127d5422efeSHerbert Xu int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1128d5422efeSHerbert Xu 11291da177e4SLinus Torvalds if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1130d5422efeSHerbert Xu return __xfrm_policy_check(sk, ndir, skb, family); 11311da177e4SLinus Torvalds 1132f6e1e25dSAlexey Dobriyan return (!net->xfrm.policy_count[dir] && !skb->sp) || 1133adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOPOLICY) || 1134d5422efeSHerbert Xu __xfrm_policy_check(sk, ndir, skb, family); 1135d5422efeSHerbert Xu } 1136d5422efeSHerbert Xu 1137d5422efeSHerbert Xu static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1138d5422efeSHerbert Xu { 1139d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, family, 0); 11401da177e4SLinus Torvalds } 11411da177e4SLinus Torvalds 11421da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11431da177e4SLinus Torvalds { 11441da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET); 11451da177e4SLinus Torvalds } 11461da177e4SLinus Torvalds 11471da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 11481da177e4SLinus Torvalds { 11491da177e4SLinus Torvalds return xfrm_policy_check(sk, dir, skb, AF_INET6); 11501da177e4SLinus Torvalds } 11511da177e4SLinus Torvalds 1152d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1153d5422efeSHerbert Xu struct sk_buff *skb) 1154d5422efeSHerbert Xu { 1155d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1156d5422efeSHerbert Xu } 1157d5422efeSHerbert Xu 1158d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1159d5422efeSHerbert Xu struct sk_buff *skb) 1160d5422efeSHerbert Xu { 1161d5422efeSHerbert Xu return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1162d5422efeSHerbert Xu } 1163d5422efeSHerbert Xu 1164d511337aSJoe Perches int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1165d5422efeSHerbert Xu unsigned int family, int reverse); 1166d5422efeSHerbert Xu 1167d5422efeSHerbert Xu static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, 1168d5422efeSHerbert Xu unsigned int family) 1169d5422efeSHerbert Xu { 1170d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 0); 1171d5422efeSHerbert Xu } 1172d5422efeSHerbert Xu 1173d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1174d5422efeSHerbert Xu struct flowi *fl, 1175d5422efeSHerbert Xu unsigned int family) 1176d5422efeSHerbert Xu { 1177d5422efeSHerbert Xu return __xfrm_decode_session(skb, fl, family, 1); 1178d5422efeSHerbert Xu } 1179d5422efeSHerbert Xu 1180d511337aSJoe Perches int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 11811da177e4SLinus Torvalds 11821da177e4SLinus Torvalds static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 11831da177e4SLinus Torvalds { 118499a66657SAlexey Dobriyan struct net *net = dev_net(skb->dev); 118599a66657SAlexey Dobriyan 118699a66657SAlexey Dobriyan return !net->xfrm.policy_count[XFRM_POLICY_OUT] || 1187adf30907SEric Dumazet (skb_dst(skb)->flags & DST_NOXFRM) || 11881da177e4SLinus Torvalds __xfrm_route_forward(skb, family); 11891da177e4SLinus Torvalds } 11901da177e4SLinus Torvalds 11911da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) 11921da177e4SLinus Torvalds { 11931da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET); 11941da177e4SLinus Torvalds } 11951da177e4SLinus Torvalds 11961da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) 11971da177e4SLinus Torvalds { 11981da177e4SLinus Torvalds return xfrm_route_forward(skb, AF_INET6); 11991da177e4SLinus Torvalds } 12001da177e4SLinus Torvalds 1201d188ba86SEric Dumazet int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 12021da177e4SLinus Torvalds 1203d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 12041da177e4SLinus Torvalds { 1205d188ba86SEric Dumazet sk->sk_policy[0] = NULL; 1206d188ba86SEric Dumazet sk->sk_policy[1] = NULL; 1207d188ba86SEric Dumazet if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1208d188ba86SEric Dumazet return __xfrm_sk_clone_policy(sk, osk); 12091da177e4SLinus Torvalds return 0; 12101da177e4SLinus Torvalds } 12111da177e4SLinus Torvalds 1212d511337aSJoe Perches int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 12131da177e4SLinus Torvalds 12141da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) 12151da177e4SLinus Torvalds { 1216d188ba86SEric Dumazet struct xfrm_policy *pol; 1217d188ba86SEric Dumazet 1218d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1219d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1220d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX); 12211da177e4SLinus Torvalds sk->sk_policy[0] = NULL; 12221da177e4SLinus Torvalds } 1223d188ba86SEric Dumazet pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1224d188ba86SEric Dumazet if (unlikely(pol != NULL)) { 1225d188ba86SEric Dumazet xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 12261da177e4SLinus Torvalds sk->sk_policy[1] = NULL; 12271da177e4SLinus Torvalds } 12281da177e4SLinus Torvalds } 12291da177e4SLinus Torvalds 12301da177e4SLinus Torvalds #else 12311da177e4SLinus Torvalds 12321da177e4SLinus Torvalds static inline void xfrm_sk_free_policy(struct sock *sk) {} 1233d188ba86SEric Dumazet static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 12341da177e4SLinus Torvalds static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 12351da177e4SLinus Torvalds static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 12361da177e4SLinus Torvalds static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12371da177e4SLinus Torvalds { 12381da177e4SLinus Torvalds return 1; 12391da177e4SLinus Torvalds } 12401da177e4SLinus Torvalds static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 12411da177e4SLinus Torvalds { 12421da177e4SLinus Torvalds return 1; 12431da177e4SLinus Torvalds } 12441da177e4SLinus Torvalds static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 12451da177e4SLinus Torvalds { 12461da177e4SLinus Torvalds return 1; 12471da177e4SLinus Torvalds } 1248d5422efeSHerbert Xu static inline int xfrm_decode_session_reverse(struct sk_buff *skb, 1249d5422efeSHerbert Xu struct flowi *fl, 1250d5422efeSHerbert Xu unsigned int family) 1251d5422efeSHerbert Xu { 1252d5422efeSHerbert Xu return -ENOSYS; 1253d5422efeSHerbert Xu } 1254d5422efeSHerbert Xu static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1255d5422efeSHerbert Xu struct sk_buff *skb) 1256d5422efeSHerbert Xu { 1257d5422efeSHerbert Xu return 1; 1258d5422efeSHerbert Xu } 1259d5422efeSHerbert Xu static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1260d5422efeSHerbert Xu struct sk_buff *skb) 1261d5422efeSHerbert Xu { 1262d5422efeSHerbert Xu return 1; 1263d5422efeSHerbert Xu } 12641da177e4SLinus Torvalds #endif 12651da177e4SLinus Torvalds 12661da177e4SLinus Torvalds static __inline__ 1267e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 12681da177e4SLinus Torvalds { 12691da177e4SLinus Torvalds switch (family){ 12701da177e4SLinus Torvalds case AF_INET: 12717e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.daddr; 12721da177e4SLinus Torvalds case AF_INET6: 12737e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.daddr; 12741da177e4SLinus Torvalds } 12751da177e4SLinus Torvalds return NULL; 12761da177e4SLinus Torvalds } 12771da177e4SLinus Torvalds 12781da177e4SLinus Torvalds static __inline__ 1279e8a4e377SDavid S. Miller xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 12801da177e4SLinus Torvalds { 12811da177e4SLinus Torvalds switch (family){ 12821da177e4SLinus Torvalds case AF_INET: 12837e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip4.saddr; 12841da177e4SLinus Torvalds case AF_INET6: 12857e1dc7b6SDavid S. Miller return (xfrm_address_t *)&fl->u.ip6.saddr; 12861da177e4SLinus Torvalds } 12871da177e4SLinus Torvalds return NULL; 12881da177e4SLinus Torvalds } 12891da177e4SLinus Torvalds 12909bb182a7SYOSHIFUJI Hideaki static __inline__ 1291e8a4e377SDavid S. Miller void xfrm_flowi_addr_get(const struct flowi *fl, 12929bb182a7SYOSHIFUJI Hideaki xfrm_address_t *saddr, xfrm_address_t *daddr, 12939bb182a7SYOSHIFUJI Hideaki unsigned short family) 12949bb182a7SYOSHIFUJI Hideaki { 12959bb182a7SYOSHIFUJI Hideaki switch(family) { 12969bb182a7SYOSHIFUJI Hideaki case AF_INET: 12977e1dc7b6SDavid S. Miller memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 12987e1dc7b6SDavid S. Miller memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 12999bb182a7SYOSHIFUJI Hideaki break; 13009bb182a7SYOSHIFUJI Hideaki case AF_INET6: 130115e318bdSJiri Benc saddr->in6 = fl->u.ip6.saddr; 130215e318bdSJiri Benc daddr->in6 = fl->u.ip6.daddr; 13039bb182a7SYOSHIFUJI Hideaki break; 13049bb182a7SYOSHIFUJI Hideaki } 13059bb182a7SYOSHIFUJI Hideaki } 13069bb182a7SYOSHIFUJI Hideaki 13071da177e4SLinus Torvalds static __inline__ int 1308f8848067SDavid S. Miller __xfrm4_state_addr_check(const struct xfrm_state *x, 1309f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13101da177e4SLinus Torvalds { 13111da177e4SLinus Torvalds if (daddr->a4 == x->id.daddr.a4 && 13121da177e4SLinus Torvalds (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 13131da177e4SLinus Torvalds return 1; 13141da177e4SLinus Torvalds return 0; 13151da177e4SLinus Torvalds } 13161da177e4SLinus Torvalds 13171da177e4SLinus Torvalds static __inline__ int 1318f8848067SDavid S. Miller __xfrm6_state_addr_check(const struct xfrm_state *x, 1319f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr) 13201da177e4SLinus Torvalds { 1321ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1322ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 13231da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)saddr) || 13241da177e4SLinus Torvalds ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 13251da177e4SLinus Torvalds return 1; 13261da177e4SLinus Torvalds return 0; 13271da177e4SLinus Torvalds } 13281da177e4SLinus Torvalds 13291da177e4SLinus Torvalds static __inline__ int 1330f8848067SDavid S. Miller xfrm_state_addr_check(const struct xfrm_state *x, 1331f8848067SDavid S. Miller const xfrm_address_t *daddr, const xfrm_address_t *saddr, 13321da177e4SLinus Torvalds unsigned short family) 13331da177e4SLinus Torvalds { 13341da177e4SLinus Torvalds switch (family) { 13351da177e4SLinus Torvalds case AF_INET: 13361da177e4SLinus Torvalds return __xfrm4_state_addr_check(x, daddr, saddr); 13371da177e4SLinus Torvalds case AF_INET6: 13381da177e4SLinus Torvalds return __xfrm6_state_addr_check(x, daddr, saddr); 13391da177e4SLinus Torvalds } 13401da177e4SLinus Torvalds return 0; 13411da177e4SLinus Torvalds } 13421da177e4SLinus Torvalds 1343e53820deSMasahide NAKAMURA static __inline__ int 1344f8848067SDavid S. Miller xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1345e53820deSMasahide NAKAMURA unsigned short family) 1346e53820deSMasahide NAKAMURA { 1347e53820deSMasahide NAKAMURA switch (family) { 1348e53820deSMasahide NAKAMURA case AF_INET: 1349e53820deSMasahide NAKAMURA return __xfrm4_state_addr_check(x, 13507e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.daddr, 13517e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip4.saddr); 1352e53820deSMasahide NAKAMURA case AF_INET6: 1353e53820deSMasahide NAKAMURA return __xfrm6_state_addr_check(x, 13547e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.daddr, 13557e1dc7b6SDavid S. Miller (const xfrm_address_t *)&fl->u.ip6.saddr); 1356e53820deSMasahide NAKAMURA } 1357e53820deSMasahide NAKAMURA return 0; 1358e53820deSMasahide NAKAMURA } 1359e53820deSMasahide NAKAMURA 1360f8848067SDavid S. Miller static inline int xfrm_state_kern(const struct xfrm_state *x) 13611da177e4SLinus Torvalds { 13621da177e4SLinus Torvalds return atomic_read(&x->tunnel_users); 13631da177e4SLinus Torvalds } 13641da177e4SLinus Torvalds 13655794708fSMasahide NAKAMURA static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 13665794708fSMasahide NAKAMURA { 1367dc00a525SMasahide NAKAMURA return (!userproto || proto == userproto || 1368dc00a525SMasahide NAKAMURA (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1369dc00a525SMasahide NAKAMURA proto == IPPROTO_ESP || 1370dc00a525SMasahide NAKAMURA proto == IPPROTO_COMP))); 13715794708fSMasahide NAKAMURA } 13725794708fSMasahide NAKAMURA 13731da177e4SLinus Torvalds /* 13741da177e4SLinus Torvalds * xfrm algorithm information 13751da177e4SLinus Torvalds */ 13761a6509d9SHerbert Xu struct xfrm_algo_aead_info { 1377165ecc63SHerbert Xu char *geniv; 13781a6509d9SHerbert Xu u16 icv_truncbits; 13791a6509d9SHerbert Xu }; 13801a6509d9SHerbert Xu 13811da177e4SLinus Torvalds struct xfrm_algo_auth_info { 13821da177e4SLinus Torvalds u16 icv_truncbits; 13831da177e4SLinus Torvalds u16 icv_fullbits; 13841da177e4SLinus Torvalds }; 13851da177e4SLinus Torvalds 13861da177e4SLinus Torvalds struct xfrm_algo_encr_info { 1387165ecc63SHerbert Xu char *geniv; 13881da177e4SLinus Torvalds u16 blockbits; 13891da177e4SLinus Torvalds u16 defkeybits; 13901da177e4SLinus Torvalds }; 13911da177e4SLinus Torvalds 13921da177e4SLinus Torvalds struct xfrm_algo_comp_info { 13931da177e4SLinus Torvalds u16 threshold; 13941da177e4SLinus Torvalds }; 13951da177e4SLinus Torvalds 13961da177e4SLinus Torvalds struct xfrm_algo_desc { 13971da177e4SLinus Torvalds char *name; 139804ff1260SHerbert Xu char *compat; 13991da177e4SLinus Torvalds u8 available:1; 14007e50f84cSJussi Kivilinna u8 pfkey_supported:1; 14011da177e4SLinus Torvalds union { 14021a6509d9SHerbert Xu struct xfrm_algo_aead_info aead; 14031da177e4SLinus Torvalds struct xfrm_algo_auth_info auth; 14041da177e4SLinus Torvalds struct xfrm_algo_encr_info encr; 14051da177e4SLinus Torvalds struct xfrm_algo_comp_info comp; 14061da177e4SLinus Torvalds } uinfo; 14071da177e4SLinus Torvalds struct sadb_alg desc; 14081da177e4SLinus Torvalds }; 14091da177e4SLinus Torvalds 14103328715eSSteffen Klassert /* XFRM protocol handlers. */ 14113328715eSSteffen Klassert struct xfrm4_protocol { 14123328715eSSteffen Klassert int (*handler)(struct sk_buff *skb); 14133328715eSSteffen Klassert int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 14143328715eSSteffen Klassert int encap_type); 14153328715eSSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14163328715eSSteffen Klassert int (*err_handler)(struct sk_buff *skb, u32 info); 14173328715eSSteffen Klassert 14183328715eSSteffen Klassert struct xfrm4_protocol __rcu *next; 14193328715eSSteffen Klassert int priority; 14203328715eSSteffen Klassert }; 14213328715eSSteffen Klassert 14227e14ea15SSteffen Klassert struct xfrm6_protocol { 14237e14ea15SSteffen Klassert int (*handler)(struct sk_buff *skb); 14247e14ea15SSteffen Klassert int (*cb_handler)(struct sk_buff *skb, int err); 14257e14ea15SSteffen Klassert int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 14267e14ea15SSteffen Klassert u8 type, u8 code, int offset, __be32 info); 14277e14ea15SSteffen Klassert 14287e14ea15SSteffen Klassert struct xfrm6_protocol __rcu *next; 14297e14ea15SSteffen Klassert int priority; 14307e14ea15SSteffen Klassert }; 14317e14ea15SSteffen Klassert 14321da177e4SLinus Torvalds /* XFRM tunnel handlers. */ 14331da177e4SLinus Torvalds struct xfrm_tunnel { 14341da177e4SLinus Torvalds int (*handler)(struct sk_buff *skb); 1435a6337463Sjamal int (*err_handler)(struct sk_buff *skb, u32 info); 1436d2acc347SHerbert Xu 1437b33eab08SEric Dumazet struct xfrm_tunnel __rcu *next; 1438d2acc347SHerbert Xu int priority; 14391da177e4SLinus Torvalds }; 14401da177e4SLinus Torvalds 14411da177e4SLinus Torvalds struct xfrm6_tunnel { 1442d2acc347SHerbert Xu int (*handler)(struct sk_buff *skb); 1443d2acc347SHerbert Xu int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1444d5fdd6baSBrian Haley u8 type, u8 code, int offset, __be32 info); 14456f0bcf15SEric Dumazet struct xfrm6_tunnel __rcu *next; 1446d2acc347SHerbert Xu int priority; 14471da177e4SLinus Torvalds }; 14481da177e4SLinus Torvalds 1449d511337aSJoe Perches void xfrm_init(void); 1450d511337aSJoe Perches void xfrm4_init(void); 1451d511337aSJoe Perches int xfrm_state_init(struct net *net); 1452d511337aSJoe Perches void xfrm_state_fini(struct net *net); 1453d511337aSJoe Perches void xfrm4_state_init(void); 14542f32b51bSSteffen Klassert void xfrm4_protocol_init(void); 1455c35b7e72SDaniel Lezcano #ifdef CONFIG_XFRM 1456d511337aSJoe Perches int xfrm6_init(void); 1457d511337aSJoe Perches void xfrm6_fini(void); 1458d511337aSJoe Perches int xfrm6_state_init(void); 1459d511337aSJoe Perches void xfrm6_state_fini(void); 14607e14ea15SSteffen Klassert int xfrm6_protocol_init(void); 14617e14ea15SSteffen Klassert void xfrm6_protocol_fini(void); 1462c35b7e72SDaniel Lezcano #else 1463c35b7e72SDaniel Lezcano static inline int xfrm6_init(void) 1464c35b7e72SDaniel Lezcano { 1465c35b7e72SDaniel Lezcano return 0; 1466c35b7e72SDaniel Lezcano } 1467c35b7e72SDaniel Lezcano static inline void xfrm6_fini(void) 1468c35b7e72SDaniel Lezcano { 1469c35b7e72SDaniel Lezcano ; 1470c35b7e72SDaniel Lezcano } 1471c35b7e72SDaniel Lezcano #endif 14721da177e4SLinus Torvalds 1473558f82efSMasahide NAKAMURA #ifdef CONFIG_XFRM_STATISTICS 1474d511337aSJoe Perches int xfrm_proc_init(struct net *net); 1475d511337aSJoe Perches void xfrm_proc_fini(struct net *net); 1476558f82efSMasahide NAKAMURA #endif 1477558f82efSMasahide NAKAMURA 1478d511337aSJoe Perches int xfrm_sysctl_init(struct net *net); 1479b27aeadbSAlexey Dobriyan #ifdef CONFIG_SYSCTL 1480d511337aSJoe Perches void xfrm_sysctl_fini(struct net *net); 1481b27aeadbSAlexey Dobriyan #else 1482b27aeadbSAlexey Dobriyan static inline void xfrm_sysctl_fini(struct net *net) 1483b27aeadbSAlexey Dobriyan { 1484b27aeadbSAlexey Dobriyan } 1485b27aeadbSAlexey Dobriyan #endif 1486b27aeadbSAlexey Dobriyan 1487d3623099SNicolas Dichtel void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1488870a2df4SNicolas Dichtel struct xfrm_address_filter *filter); 1489d511337aSJoe Perches int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 14904c563f76STimo Teras int (*func)(struct xfrm_state *, int, void*), void *); 1491283bc9f3SFan Du void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1492d511337aSJoe Perches struct xfrm_state *xfrm_state_alloc(struct net *net); 1493d511337aSJoe Perches struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 149433765d06SDavid S. Miller const xfrm_address_t *saddr, 1495b520e9f6SDavid S. Miller const struct flowi *fl, 1496b520e9f6SDavid S. Miller struct xfrm_tmpl *tmpl, 14971da177e4SLinus Torvalds struct xfrm_policy *pol, int *err, 14981da177e4SLinus Torvalds unsigned short family); 1499d511337aSJoe Perches struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, 15005447c5e4SAlexey Dobriyan xfrm_address_t *daddr, 1501628529b6SJamal Hadi Salim xfrm_address_t *saddr, 1502628529b6SJamal Hadi Salim unsigned short family, 1503628529b6SJamal Hadi Salim u8 mode, u8 proto, u32 reqid); 1504c454997eSFan Du struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1505c454997eSFan Du unsigned short family); 1506d511337aSJoe Perches int xfrm_state_check_expire(struct xfrm_state *x); 1507d511337aSJoe Perches void xfrm_state_insert(struct xfrm_state *x); 1508d511337aSJoe Perches int xfrm_state_add(struct xfrm_state *x); 1509d511337aSJoe Perches int xfrm_state_update(struct xfrm_state *x); 1510d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1511a70486f0SDavid S. Miller const xfrm_address_t *daddr, __be32 spi, 1512bd55775cSJamal Hadi Salim u8 proto, unsigned short family); 1513d511337aSJoe Perches struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1514a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1515a70486f0SDavid S. Miller const xfrm_address_t *saddr, 1516bd55775cSJamal Hadi Salim u8 proto, 1517bd55775cSJamal Hadi Salim unsigned short family); 151841a49cc3SMasahide NAKAMURA #ifdef CONFIG_XFRM_SUB_POLICY 1519d511337aSJoe Perches int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1520283bc9f3SFan Du unsigned short family, struct net *net); 1521d511337aSJoe Perches int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1522d511337aSJoe Perches unsigned short family); 152341a49cc3SMasahide NAKAMURA #else 152441a49cc3SMasahide NAKAMURA static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, 1525283bc9f3SFan Du int n, unsigned short family, struct net *net) 152641a49cc3SMasahide NAKAMURA { 152741a49cc3SMasahide NAKAMURA return -ENOSYS; 152841a49cc3SMasahide NAKAMURA } 152941a49cc3SMasahide NAKAMURA 153041a49cc3SMasahide NAKAMURA static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, 153141a49cc3SMasahide NAKAMURA int n, unsigned short family) 153241a49cc3SMasahide NAKAMURA { 153341a49cc3SMasahide NAKAMURA return -ENOSYS; 153441a49cc3SMasahide NAKAMURA } 153541a49cc3SMasahide NAKAMURA #endif 1536af11e316SJamal Hadi Salim 1537af11e316SJamal Hadi Salim struct xfrmk_sadinfo { 1538af11e316SJamal Hadi Salim u32 sadhcnt; /* current hash bkts */ 1539af11e316SJamal Hadi Salim u32 sadhmcnt; /* max allowed hash bkts */ 1540af11e316SJamal Hadi Salim u32 sadcnt; /* current running count */ 1541af11e316SJamal Hadi Salim }; 1542af11e316SJamal Hadi Salim 15435a6d3416SJamal Hadi Salim struct xfrmk_spdinfo { 15445a6d3416SJamal Hadi Salim u32 incnt; 15455a6d3416SJamal Hadi Salim u32 outcnt; 15465a6d3416SJamal Hadi Salim u32 fwdcnt; 15475a6d3416SJamal Hadi Salim u32 inscnt; 15485a6d3416SJamal Hadi Salim u32 outscnt; 15495a6d3416SJamal Hadi Salim u32 fwdscnt; 15505a6d3416SJamal Hadi Salim u32 spdhcnt; 15515a6d3416SJamal Hadi Salim u32 spdhmcnt; 15525a6d3416SJamal Hadi Salim }; 15535a6d3416SJamal Hadi Salim 1554d511337aSJoe Perches struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); 1555d511337aSJoe Perches int xfrm_state_delete(struct xfrm_state *x); 15562e71029eSTetsuo Handa int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1557d77e38e6SSteffen Klassert int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1558d511337aSJoe Perches void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1559d511337aSJoe Perches void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1560d511337aSJoe Perches u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1561d511337aSJoe Perches int xfrm_init_replay(struct xfrm_state *x); 1562d511337aSJoe Perches int xfrm_state_mtu(struct xfrm_state *x, int mtu); 1563ffdb5211SIlan Tayari int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload); 1564d511337aSJoe Perches int xfrm_init_state(struct xfrm_state *x); 1565d511337aSJoe Perches int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); 1566d511337aSJoe Perches int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1567d511337aSJoe Perches int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1568d511337aSJoe Perches int xfrm_output_resume(struct sk_buff *skb, int err); 15697026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb); 1570d511337aSJoe Perches int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1571d511337aSJoe Perches void xfrm_local_error(struct sk_buff *skb, int mtu); 1572d511337aSJoe Perches int xfrm4_extract_header(struct sk_buff *skb); 1573d511337aSJoe Perches int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb); 1574d511337aSJoe Perches int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1575716062fdSHerbert Xu int encap_type); 1576d511337aSJoe Perches int xfrm4_transport_finish(struct sk_buff *skb, int async); 1577d511337aSJoe Perches int xfrm4_rcv(struct sk_buff *skb); 15781e295370SSteffen Klassert int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1579c4541b41SHerbert Xu 1580c4541b41SHerbert Xu static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1581c4541b41SHerbert Xu { 158270be6c91SSteffen Klassert XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 15833328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->family = AF_INET; 15843328715eSSteffen Klassert XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 15853328715eSSteffen Klassert return xfrm_input(skb, nexthdr, spi, 0); 1586c4541b41SHerbert Xu } 1587c4541b41SHerbert Xu 1588d511337aSJoe Perches int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1589d511337aSJoe Perches int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1590ede2059dSEric W. Biederman int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 15917026b1ddSDavid Miller int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb); 15923328715eSSteffen Klassert int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 15933328715eSSteffen Klassert int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 15943328715eSSteffen Klassert int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1595d511337aSJoe Perches int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1596d511337aSJoe Perches int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1597d511337aSJoe Perches void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1598d511337aSJoe Perches int xfrm6_extract_header(struct sk_buff *skb); 1599d511337aSJoe Perches int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb); 160063c43787SNicolas Dichtel int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 160163c43787SNicolas Dichtel struct ip6_tnl *t); 1602d511337aSJoe Perches int xfrm6_transport_finish(struct sk_buff *skb, int async); 160363c43787SNicolas Dichtel int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1604d511337aSJoe Perches int xfrm6_rcv(struct sk_buff *skb); 1605d511337aSJoe Perches int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1606fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto); 16077b77d161SDavid S. Miller void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 16087e14ea15SSteffen Klassert int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err); 16097e14ea15SSteffen Klassert int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 16107e14ea15SSteffen Klassert int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1611d511337aSJoe Perches int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 16127b77d161SDavid S. Miller int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1613d511337aSJoe Perches __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1614d511337aSJoe Perches __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1615d511337aSJoe Perches int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb); 1616d511337aSJoe Perches int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb); 1617ede2059dSEric W. Biederman int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 16187026b1ddSDavid Miller int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb); 1619d511337aSJoe Perches int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 1620aee5adb4SMasahide NAKAMURA u8 **prevhdr); 16211da177e4SLinus Torvalds 16221da177e4SLinus Torvalds #ifdef CONFIG_XFRM 1623d511337aSJoe Perches int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1624d511337aSJoe Perches int xfrm_user_policy(struct sock *sk, int optname, 1625d511337aSJoe Perches u8 __user *optval, int optlen); 16261da177e4SLinus Torvalds #else 16271da177e4SLinus Torvalds static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 16281da177e4SLinus Torvalds { 16291da177e4SLinus Torvalds return -ENOPROTOOPT; 16301da177e4SLinus Torvalds } 16311da177e4SLinus Torvalds 1632067b207bSJames Chapman static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 16331da177e4SLinus Torvalds { 16341da177e4SLinus Torvalds /* should not happen */ 16351da177e4SLinus Torvalds kfree_skb(skb); 16361da177e4SLinus Torvalds return 0; 16371da177e4SLinus Torvalds } 16381da177e4SLinus Torvalds #endif 16391da177e4SLinus Torvalds 1640d77e38e6SSteffen Klassert struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif, 1641d77e38e6SSteffen Klassert const xfrm_address_t *saddr, 1642d77e38e6SSteffen Klassert const xfrm_address_t *daddr, 1643d77e38e6SSteffen Klassert int family); 1644d77e38e6SSteffen Klassert 16450331b1f3SAlexey Dobriyan struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 16464c563f76STimo Teras 1647d511337aSJoe Perches void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1648d511337aSJoe Perches int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1649d511337aSJoe Perches int (*func)(struct xfrm_policy *, int, int, void*), 1650d511337aSJoe Perches void *); 1651283bc9f3SFan Du void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 16521da177e4SLinus Torvalds int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 16538ca2e93bSJamal Hadi Salim struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, 16548ca2e93bSJamal Hadi Salim u8 type, int dir, 16554e81bb83SMasahide NAKAMURA struct xfrm_selector *sel, 1656ef41aaa0SEric Paris struct xfrm_sec_ctx *ctx, int delete, 1657ef41aaa0SEric Paris int *err); 1658d511337aSJoe Perches struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, 1659d511337aSJoe Perches u32 id, int delete, int *err); 16602e71029eSTetsuo Handa int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1661880a6fabSChristophe Gouault void xfrm_policy_hash_rebuild(struct net *net); 16621da177e4SLinus Torvalds u32 xfrm_get_acqseq(void); 1663776e9dd9SFan Du int verify_spi_info(u8 proto, u32 min, u32 max); 1664d511337aSJoe Perches int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 1665e473fcb4SMathias Krause struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1666bd55775cSJamal Hadi Salim u8 mode, u32 reqid, u8 proto, 1667a70486f0SDavid S. Miller const xfrm_address_t *daddr, 1668a70486f0SDavid S. Miller const xfrm_address_t *saddr, int create, 1669bd55775cSJamal Hadi Salim unsigned short family); 1670d511337aSJoe Perches int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 16711da177e4SLinus Torvalds 167280c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1673d511337aSJoe Perches int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1674183cad12SDavid S. Miller const struct xfrm_migrate *m, int num_bundles, 16758bafd730SAntony Antony const struct xfrm_kmaddress *k, 16768bafd730SAntony Antony const struct xfrm_encap_tmpl *encap); 1677283bc9f3SFan Du struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); 1678d511337aSJoe Perches struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 16794ab47d47SAntony Antony struct xfrm_migrate *m, 16804ab47d47SAntony Antony struct xfrm_encap_tmpl *encap); 1681d511337aSJoe Perches int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 168213c1d189SArnaud Ebalard struct xfrm_migrate *m, int num_bundles, 16834ab47d47SAntony Antony struct xfrm_kmaddress *k, struct net *net, 16844ab47d47SAntony Antony struct xfrm_encap_tmpl *encap); 168580c9abaaSShinta Sugimoto #endif 168680c9abaaSShinta Sugimoto 1687d511337aSJoe Perches int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1688d511337aSJoe Perches void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1689d511337aSJoe Perches int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1690d511337aSJoe Perches xfrm_address_t *addr); 16911da177e4SLinus Torvalds 1692d511337aSJoe Perches void xfrm_input_init(void); 1693d511337aSJoe Perches int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 16941da177e4SLinus Torvalds 1695d511337aSJoe Perches void xfrm_probe_algs(void); 1696d511337aSJoe Perches int xfrm_count_pfkey_auth_supported(void); 1697d511337aSJoe Perches int xfrm_count_pfkey_enc_supported(void); 1698d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1699d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1700d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1701d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1702d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1703d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1704d511337aSJoe Perches struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1705d511337aSJoe Perches struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1706d511337aSJoe Perches struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 17071a6509d9SHerbert Xu int probe); 17081da177e4SLinus Torvalds 1709ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1710ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b) 1711ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 { 1712ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal((const struct in6_addr *)a, 1713ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 (const struct in6_addr *)b); 1714ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 } 1715ff88b30cSYOSHIFUJI Hideaki / 吉藤英明 171670e94e66SYOSHIFUJI Hideaki / 吉藤英明 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 171770e94e66SYOSHIFUJI Hideaki / 吉藤英明 const xfrm_address_t *b, 171870e94e66SYOSHIFUJI Hideaki / 吉藤英明 sa_family_t family) 171970e94e66SYOSHIFUJI Hideaki / 吉藤英明 { 172070e94e66SYOSHIFUJI Hideaki / 吉藤英明 switch (family) { 172170e94e66SYOSHIFUJI Hideaki / 吉藤英明 default: 172270e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET: 172370e94e66SYOSHIFUJI Hideaki / 吉藤英明 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 172470e94e66SYOSHIFUJI Hideaki / 吉藤英明 case AF_INET6: 172570e94e66SYOSHIFUJI Hideaki / 吉藤英明 return xfrm6_addr_equal(a, b); 172670e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 172770e94e66SYOSHIFUJI Hideaki / 吉藤英明 } 172870e94e66SYOSHIFUJI Hideaki / 吉藤英明 172977d8d7a6SHerbert Xu static inline int xfrm_policy_id2dir(u32 index) 173077d8d7a6SHerbert Xu { 173177d8d7a6SHerbert Xu return index & 7; 173277d8d7a6SHerbert Xu } 173377d8d7a6SHerbert Xu 1734a6483b79SAlexey Dobriyan #ifdef CONFIG_XFRM 1735a6483b79SAlexey Dobriyan static inline int xfrm_aevent_is_on(struct net *net) 1736f8cd5488SJamal Hadi Salim { 1737be33690dSPatrick McHardy struct sock *nlsk; 1738be33690dSPatrick McHardy int ret = 0; 1739be33690dSPatrick McHardy 1740be33690dSPatrick McHardy rcu_read_lock(); 1741a6483b79SAlexey Dobriyan nlsk = rcu_dereference(net->xfrm.nlsk); 1742be33690dSPatrick McHardy if (nlsk) 1743be33690dSPatrick McHardy ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1744be33690dSPatrick McHardy rcu_read_unlock(); 1745be33690dSPatrick McHardy return ret; 1746f8cd5488SJamal Hadi Salim } 17470f24558eSHoria Geanta 17480f24558eSHoria Geanta static inline int xfrm_acquire_is_on(struct net *net) 17490f24558eSHoria Geanta { 17500f24558eSHoria Geanta struct sock *nlsk; 17510f24558eSHoria Geanta int ret = 0; 17520f24558eSHoria Geanta 17530f24558eSHoria Geanta rcu_read_lock(); 17540f24558eSHoria Geanta nlsk = rcu_dereference(net->xfrm.nlsk); 17550f24558eSHoria Geanta if (nlsk) 17560f24558eSHoria Geanta ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 17570f24558eSHoria Geanta rcu_read_unlock(); 17580f24558eSHoria Geanta 17590f24558eSHoria Geanta return ret; 17600f24558eSHoria Geanta } 1761a6483b79SAlexey Dobriyan #endif 1762f8cd5488SJamal Hadi Salim 1763ee5c2317SSteffen Klassert static inline int aead_len(struct xfrm_algo_aead *alg) 1764ee5c2317SSteffen Klassert { 1765ee5c2317SSteffen Klassert return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1766ee5c2317SSteffen Klassert } 1767ee5c2317SSteffen Klassert 176885158621SDavid S. Miller static inline int xfrm_alg_len(const struct xfrm_algo *alg) 17690f99be0dSEric Dumazet { 17700f99be0dSEric Dumazet return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17710f99be0dSEric Dumazet } 17720f99be0dSEric Dumazet 177385158621SDavid S. Miller static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 17744447bb33SMartin Willi { 17754447bb33SMartin Willi return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 17764447bb33SMartin Willi } 17774447bb33SMartin Willi 17789736acf3SSteffen Klassert static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 17799736acf3SSteffen Klassert { 17809736acf3SSteffen Klassert return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 17819736acf3SSteffen Klassert } 17829736acf3SSteffen Klassert 178380c9abaaSShinta Sugimoto #ifdef CONFIG_XFRM_MIGRATE 1784af2f464eSSteffen Klassert static inline int xfrm_replay_clone(struct xfrm_state *x, 1785af2f464eSSteffen Klassert struct xfrm_state *orig) 1786af2f464eSSteffen Klassert { 1787af2f464eSSteffen Klassert x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), 1788af2f464eSSteffen Klassert GFP_KERNEL); 1789af2f464eSSteffen Klassert if (!x->replay_esn) 1790af2f464eSSteffen Klassert return -ENOMEM; 1791af2f464eSSteffen Klassert 1792af2f464eSSteffen Klassert x->replay_esn->bmp_len = orig->replay_esn->bmp_len; 1793af2f464eSSteffen Klassert x->replay_esn->replay_window = orig->replay_esn->replay_window; 1794af2f464eSSteffen Klassert 1795af2f464eSSteffen Klassert x->preplay_esn = kmemdup(x->replay_esn, 1796af2f464eSSteffen Klassert xfrm_replay_state_esn_len(x->replay_esn), 1797af2f464eSSteffen Klassert GFP_KERNEL); 1798af2f464eSSteffen Klassert if (!x->preplay_esn) { 1799af2f464eSSteffen Klassert kfree(x->replay_esn); 1800af2f464eSSteffen Klassert return -ENOMEM; 1801af2f464eSSteffen Klassert } 1802af2f464eSSteffen Klassert 1803af2f464eSSteffen Klassert return 0; 1804af2f464eSSteffen Klassert } 1805af2f464eSSteffen Klassert 1806ee5c2317SSteffen Klassert static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 1807ee5c2317SSteffen Klassert { 1808ee5c2317SSteffen Klassert return kmemdup(orig, aead_len(orig), GFP_KERNEL); 1809ee5c2317SSteffen Klassert } 1810ee5c2317SSteffen Klassert 1811ee5c2317SSteffen Klassert 181280c9abaaSShinta Sugimoto static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 181380c9abaaSShinta Sugimoto { 18140f99be0dSEric Dumazet return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 181580c9abaaSShinta Sugimoto } 181680c9abaaSShinta Sugimoto 18174447bb33SMartin Willi static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 18184447bb33SMartin Willi { 18194447bb33SMartin Willi return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 18204447bb33SMartin Willi } 18214447bb33SMartin Willi 182280c9abaaSShinta Sugimoto static inline void xfrm_states_put(struct xfrm_state **states, int n) 182380c9abaaSShinta Sugimoto { 182480c9abaaSShinta Sugimoto int i; 182580c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 182680c9abaaSShinta Sugimoto xfrm_state_put(*(states + i)); 182780c9abaaSShinta Sugimoto } 182880c9abaaSShinta Sugimoto 182980c9abaaSShinta Sugimoto static inline void xfrm_states_delete(struct xfrm_state **states, int n) 183080c9abaaSShinta Sugimoto { 183180c9abaaSShinta Sugimoto int i; 183280c9abaaSShinta Sugimoto for (i = 0; i < n; i++) 183380c9abaaSShinta Sugimoto xfrm_state_delete(*(states + i)); 183480c9abaaSShinta Sugimoto } 183580c9abaaSShinta Sugimoto #endif 1836f8cd5488SJamal Hadi Salim 1837def8b4faSAlexey Dobriyan #ifdef CONFIG_XFRM 183800501121SHerbert Xu static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 183900501121SHerbert Xu { 184000501121SHerbert Xu return skb->sp->xvec[skb->sp->len - 1]; 184100501121SHerbert Xu } 184254ef207aSSteffen Klassert static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 184354ef207aSSteffen Klassert { 184454ef207aSSteffen Klassert struct sec_path *sp = skb->sp; 184554ef207aSSteffen Klassert 184654ef207aSSteffen Klassert if (!sp || !sp->olen || sp->len != sp->olen) 184754ef207aSSteffen Klassert return NULL; 184854ef207aSSteffen Klassert 184954ef207aSSteffen Klassert return &sp->ovec[sp->olen - 1]; 185054ef207aSSteffen Klassert } 1851def8b4faSAlexey Dobriyan #endif 185200501121SHerbert Xu 1853d77e38e6SSteffen Klassert void __net_init xfrm_dev_init(void); 1854b81f884aSHangbin Liu 1855b81f884aSHangbin Liu #ifdef CONFIG_XFRM_OFFLOAD 1856f6e27114SSteffen Klassert int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features); 1857d77e38e6SSteffen Klassert int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 1858d77e38e6SSteffen Klassert struct xfrm_user_offload *xuo); 1859d77e38e6SSteffen Klassert bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 1860d77e38e6SSteffen Klassert 1861*f70f250aSSteffen Klassert static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 1862*f70f250aSSteffen Klassert { 1863*f70f250aSSteffen Klassert struct xfrm_state *x = dst->xfrm; 1864*f70f250aSSteffen Klassert 1865*f70f250aSSteffen Klassert if (!x || !x->type_offload) 1866*f70f250aSSteffen Klassert return false; 1867*f70f250aSSteffen Klassert 1868*f70f250aSSteffen Klassert if (x->xso.offload_handle && (x->xso.dev == dst->path->dev) && 1869*f70f250aSSteffen Klassert !dst->child->xfrm) 1870*f70f250aSSteffen Klassert return true; 1871*f70f250aSSteffen Klassert 1872*f70f250aSSteffen Klassert return false; 1873*f70f250aSSteffen Klassert } 1874*f70f250aSSteffen Klassert 1875d77e38e6SSteffen Klassert static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1876d77e38e6SSteffen Klassert { 1877d77e38e6SSteffen Klassert struct xfrm_state_offload *xso = &x->xso; 1878d77e38e6SSteffen Klassert 1879d77e38e6SSteffen Klassert if (xso->dev) 1880d77e38e6SSteffen Klassert xso->dev->xfrmdev_ops->xdo_dev_state_delete(x); 1881d77e38e6SSteffen Klassert } 1882d77e38e6SSteffen Klassert 1883d77e38e6SSteffen Klassert static inline void xfrm_dev_state_free(struct xfrm_state *x) 1884d77e38e6SSteffen Klassert { 1885d77e38e6SSteffen Klassert struct xfrm_state_offload *xso = &x->xso; 1886d77e38e6SSteffen Klassert struct net_device *dev = xso->dev; 1887d77e38e6SSteffen Klassert 1888d77e38e6SSteffen Klassert if (dev && dev->xfrmdev_ops) { 1889d77e38e6SSteffen Klassert dev->xfrmdev_ops->xdo_dev_state_free(x); 1890d77e38e6SSteffen Klassert xso->dev = NULL; 1891d77e38e6SSteffen Klassert dev_put(dev); 1892d77e38e6SSteffen Klassert } 1893d77e38e6SSteffen Klassert } 1894d77e38e6SSteffen Klassert #else 1895f6e27114SSteffen Klassert static inline int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features) 1896f6e27114SSteffen Klassert { 1897f6e27114SSteffen Klassert return 0; 1898f6e27114SSteffen Klassert } 1899f6e27114SSteffen Klassert 1900d77e38e6SSteffen Klassert static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo) 1901d77e38e6SSteffen Klassert { 1902d77e38e6SSteffen Klassert return 0; 1903d77e38e6SSteffen Klassert } 1904d77e38e6SSteffen Klassert 1905d77e38e6SSteffen Klassert static inline void xfrm_dev_state_delete(struct xfrm_state *x) 1906d77e38e6SSteffen Klassert { 1907d77e38e6SSteffen Klassert } 1908d77e38e6SSteffen Klassert 1909d77e38e6SSteffen Klassert static inline void xfrm_dev_state_free(struct xfrm_state *x) 1910d77e38e6SSteffen Klassert { 1911d77e38e6SSteffen Klassert } 1912d77e38e6SSteffen Klassert 1913d77e38e6SSteffen Klassert static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 1914d77e38e6SSteffen Klassert { 1915d77e38e6SSteffen Klassert return false; 1916d77e38e6SSteffen Klassert } 1917*f70f250aSSteffen Klassert 1918*f70f250aSSteffen Klassert static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 1919*f70f250aSSteffen Klassert { 1920*f70f250aSSteffen Klassert return false; 1921*f70f250aSSteffen Klassert } 1922d77e38e6SSteffen Klassert #endif 1923d77e38e6SSteffen Klassert 1924bf825f81SJamal Hadi Salim static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 1925bf825f81SJamal Hadi Salim { 1926bf825f81SJamal Hadi Salim if (attrs[XFRMA_MARK]) 19274efd7e83SAndreas Steffen memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 1928bf825f81SJamal Hadi Salim else 1929bf825f81SJamal Hadi Salim m->v = m->m = 0; 1930bf825f81SJamal Hadi Salim 1931bf825f81SJamal Hadi Salim return m->v & m->m; 1932bf825f81SJamal Hadi Salim } 1933bf825f81SJamal Hadi Salim 1934e3dfa389SDavid S. Miller static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 1935bf825f81SJamal Hadi Salim { 19361d1e34ddSDavid S. Miller int ret = 0; 1937bf825f81SJamal Hadi Salim 19381d1e34ddSDavid S. Miller if (m->m | m->v) 19391d1e34ddSDavid S. Miller ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 19401d1e34ddSDavid S. Miller return ret; 1941bf825f81SJamal Hadi Salim } 1942bf825f81SJamal Hadi Salim 194370be6c91SSteffen Klassert static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 194470be6c91SSteffen Klassert unsigned int family) 194570be6c91SSteffen Klassert { 194670be6c91SSteffen Klassert bool tunnel = false; 194770be6c91SSteffen Klassert 194870be6c91SSteffen Klassert switch(family) { 194970be6c91SSteffen Klassert case AF_INET: 195070be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 195170be6c91SSteffen Klassert tunnel = true; 195270be6c91SSteffen Klassert break; 195370be6c91SSteffen Klassert case AF_INET6: 195470be6c91SSteffen Klassert if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 195570be6c91SSteffen Klassert tunnel = true; 195670be6c91SSteffen Klassert break; 195770be6c91SSteffen Klassert } 195870be6c91SSteffen Klassert if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)) 195970be6c91SSteffen Klassert return -EINVAL; 196070be6c91SSteffen Klassert 196170be6c91SSteffen Klassert return 0; 196270be6c91SSteffen Klassert } 19631da177e4SLinus Torvalds #endif /* _NET_XFRM_H */ 1964