xref: /openbmc/linux/include/net/xfrm.h (revision a36954f5)
1 #ifndef _NET_XFRM_H
2 #define _NET_XFRM_H
3 
4 #include <linux/compiler.h>
5 #include <linux/xfrm.h>
6 #include <linux/spinlock.h>
7 #include <linux/list.h>
8 #include <linux/skbuff.h>
9 #include <linux/socket.h>
10 #include <linux/pfkeyv2.h>
11 #include <linux/ipsec.h>
12 #include <linux/in6.h>
13 #include <linux/mutex.h>
14 #include <linux/audit.h>
15 #include <linux/slab.h>
16 
17 #include <net/sock.h>
18 #include <net/dst.h>
19 #include <net/ip.h>
20 #include <net/route.h>
21 #include <net/ipv6.h>
22 #include <net/ip6_fib.h>
23 #include <net/flow.h>
24 
25 #include <linux/interrupt.h>
26 
27 #ifdef CONFIG_XFRM_STATISTICS
28 #include <net/snmp.h>
29 #endif
30 
31 #define XFRM_PROTO_ESP		50
32 #define XFRM_PROTO_AH		51
33 #define XFRM_PROTO_COMP		108
34 #define XFRM_PROTO_IPIP		4
35 #define XFRM_PROTO_IPV6		41
36 #define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
37 #define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS
38 
39 #define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
40 #define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
41 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
45 
46 #ifdef CONFIG_XFRM_STATISTICS
47 #define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48 #else
49 #define XFRM_INC_STATS(net, field)	((void)(net))
50 #endif
51 
52 
53 /* Organization of SPD aka "XFRM rules"
54    ------------------------------------
55 
56    Basic objects:
57    - policy rule, struct xfrm_policy (=SPD entry)
58    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
59    - instance of a transformer, struct xfrm_state (=SA)
60    - template to clone xfrm_state, struct xfrm_tmpl
61 
62    SPD is plain linear list of xfrm_policy rules, ordered by priority.
63    (To be compatible with existing pfkeyv2 implementations,
64    many rules with priority of 0x7fffffff are allowed to exist and
65    such rules are ordered in an unpredictable way, thanks to bsd folks.)
66 
67    Lookup is plain linear search until the first match with selector.
68 
69    If "action" is "block", then we prohibit the flow, otherwise:
70    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
71    policy entry has list of up to XFRM_MAX_DEPTH transformations,
72    described by templates xfrm_tmpl. Each template is resolved
73    to a complete xfrm_state (see below) and we pack bundle of transformations
74    to a dst_entry returned to requestor.
75 
76    dst -. xfrm  .-> xfrm_state #1
77     |---. child .-> dst -. xfrm .-> xfrm_state #2
78                      |---. child .-> dst -. xfrm .-> xfrm_state #3
79                                       |---. child .-> NULL
80 
81    Bundles are cached at xrfm_policy struct (field ->bundles).
82 
83 
84    Resolution of xrfm_tmpl
85    -----------------------
86    Template contains:
87    1. ->mode		Mode: transport or tunnel
88    2. ->id.proto	Protocol: AH/ESP/IPCOMP
89    3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
90       Q: allow to resolve security gateway?
91    4. ->id.spi          If not zero, static SPI.
92    5. ->saddr		Local tunnel endpoint, ignored for transport mode.
93    6. ->algos		List of allowed algos. Plain bitmask now.
94       Q: ealgos, aalgos, calgos. What a mess...
95    7. ->share		Sharing mode.
96       Q: how to implement private sharing mode? To add struct sock* to
97       flow id?
98 
99    Having this template we search through SAD searching for entries
100    with appropriate mode/proto/algo, permitted by selector.
101    If no appropriate entry found, it is requested from key manager.
102 
103    PROBLEMS:
104    Q: How to find all the bundles referring to a physical path for
105       PMTU discovery? Seems, dst should contain list of all parents...
106       and enter to infinite locking hierarchy disaster.
107       No! It is easier, we will not search for them, let them find us.
108       We add genid to each dst plus pointer to genid of raw IP route,
109       pmtu disc will update pmtu on raw IP route and increase its genid.
110       dst_check() will see this for top level and trigger resyncing
111       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
112  */
113 
114 struct xfrm_state_walk {
115 	struct list_head	all;
116 	u8			state;
117 	u8			dying;
118 	u8			proto;
119 	u32			seq;
120 	struct xfrm_address_filter *filter;
121 };
122 
123 struct xfrm_state_offload {
124 	struct net_device	*dev;
125 	unsigned long		offload_handle;
126 	unsigned int		num_exthdrs;
127 	u8			flags;
128 };
129 
130 /* Full description of state of transformer. */
131 struct xfrm_state {
132 	possible_net_t		xs_net;
133 	union {
134 		struct hlist_node	gclist;
135 		struct hlist_node	bydst;
136 	};
137 	struct hlist_node	bysrc;
138 	struct hlist_node	byspi;
139 
140 	atomic_t		refcnt;
141 	spinlock_t		lock;
142 
143 	struct xfrm_id		id;
144 	struct xfrm_selector	sel;
145 	struct xfrm_mark	mark;
146 	u32			tfcpad;
147 
148 	u32			genid;
149 
150 	/* Key manager bits */
151 	struct xfrm_state_walk	km;
152 
153 	/* Parameters of this state. */
154 	struct {
155 		u32		reqid;
156 		u8		mode;
157 		u8		replay_window;
158 		u8		aalgo, ealgo, calgo;
159 		u8		flags;
160 		u16		family;
161 		xfrm_address_t	saddr;
162 		int		header_len;
163 		int		trailer_len;
164 		u32		extra_flags;
165 	} props;
166 
167 	struct xfrm_lifetime_cfg lft;
168 
169 	/* Data for transformer */
170 	struct xfrm_algo_auth	*aalg;
171 	struct xfrm_algo	*ealg;
172 	struct xfrm_algo	*calg;
173 	struct xfrm_algo_aead	*aead;
174 	const char		*geniv;
175 
176 	/* Data for encapsulator */
177 	struct xfrm_encap_tmpl	*encap;
178 
179 	/* Data for care-of address */
180 	xfrm_address_t	*coaddr;
181 
182 	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
183 	struct xfrm_state	*tunnel;
184 
185 	/* If a tunnel, number of users + 1 */
186 	atomic_t		tunnel_users;
187 
188 	/* State for replay detection */
189 	struct xfrm_replay_state replay;
190 	struct xfrm_replay_state_esn *replay_esn;
191 
192 	/* Replay detection state at the time we sent the last notification */
193 	struct xfrm_replay_state preplay;
194 	struct xfrm_replay_state_esn *preplay_esn;
195 
196 	/* The functions for replay detection. */
197 	const struct xfrm_replay *repl;
198 
199 	/* internal flag that only holds state for delayed aevent at the
200 	 * moment
201 	*/
202 	u32			xflags;
203 
204 	/* Replay detection notification settings */
205 	u32			replay_maxage;
206 	u32			replay_maxdiff;
207 
208 	/* Replay detection notification timer */
209 	struct timer_list	rtimer;
210 
211 	/* Statistics */
212 	struct xfrm_stats	stats;
213 
214 	struct xfrm_lifetime_cur curlft;
215 	struct tasklet_hrtimer	mtimer;
216 
217 	struct xfrm_state_offload xso;
218 
219 	/* used to fix curlft->add_time when changing date */
220 	long		saved_tmo;
221 
222 	/* Last used time */
223 	unsigned long		lastused;
224 
225 	struct page_frag xfrag;
226 
227 	/* Reference to data common to all the instances of this
228 	 * transformer. */
229 	const struct xfrm_type	*type;
230 	struct xfrm_mode	*inner_mode;
231 	struct xfrm_mode	*inner_mode_iaf;
232 	struct xfrm_mode	*outer_mode;
233 
234 	const struct xfrm_type_offload	*type_offload;
235 
236 	/* Security context */
237 	struct xfrm_sec_ctx	*security;
238 
239 	/* Private data of this transformer, format is opaque,
240 	 * interpreted by xfrm_type methods. */
241 	void			*data;
242 };
243 
244 static inline struct net *xs_net(struct xfrm_state *x)
245 {
246 	return read_pnet(&x->xs_net);
247 }
248 
249 /* xflags - make enum if more show up */
250 #define XFRM_TIME_DEFER	1
251 #define XFRM_SOFT_EXPIRE 2
252 
253 enum {
254 	XFRM_STATE_VOID,
255 	XFRM_STATE_ACQ,
256 	XFRM_STATE_VALID,
257 	XFRM_STATE_ERROR,
258 	XFRM_STATE_EXPIRED,
259 	XFRM_STATE_DEAD
260 };
261 
262 /* callback structure passed from either netlink or pfkey */
263 struct km_event {
264 	union {
265 		u32 hard;
266 		u32 proto;
267 		u32 byid;
268 		u32 aevent;
269 		u32 type;
270 	} data;
271 
272 	u32	seq;
273 	u32	portid;
274 	u32	event;
275 	struct net *net;
276 };
277 
278 struct xfrm_replay {
279 	void	(*advance)(struct xfrm_state *x, __be32 net_seq);
280 	int	(*check)(struct xfrm_state *x,
281 			 struct sk_buff *skb,
282 			 __be32 net_seq);
283 	int	(*recheck)(struct xfrm_state *x,
284 			   struct sk_buff *skb,
285 			   __be32 net_seq);
286 	void	(*notify)(struct xfrm_state *x, int event);
287 	int	(*overflow)(struct xfrm_state *x, struct sk_buff *skb);
288 };
289 
290 struct net_device;
291 struct xfrm_type;
292 struct xfrm_dst;
293 struct xfrm_policy_afinfo {
294 	struct dst_ops		*dst_ops;
295 	struct dst_entry	*(*dst_lookup)(struct net *net,
296 					       int tos, int oif,
297 					       const xfrm_address_t *saddr,
298 					       const xfrm_address_t *daddr);
299 	int			(*get_saddr)(struct net *net, int oif,
300 					     xfrm_address_t *saddr,
301 					     xfrm_address_t *daddr);
302 	void			(*decode_session)(struct sk_buff *skb,
303 						  struct flowi *fl,
304 						  int reverse);
305 	int			(*get_tos)(const struct flowi *fl);
306 	int			(*init_path)(struct xfrm_dst *path,
307 					     struct dst_entry *dst,
308 					     int nfheader_len);
309 	int			(*fill_dst)(struct xfrm_dst *xdst,
310 					    struct net_device *dev,
311 					    const struct flowi *fl);
312 	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
313 };
314 
315 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
316 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
317 void km_policy_notify(struct xfrm_policy *xp, int dir,
318 		      const struct km_event *c);
319 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
320 
321 struct xfrm_tmpl;
322 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
323 	     struct xfrm_policy *pol);
324 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
325 int __xfrm_state_delete(struct xfrm_state *x);
326 
327 struct xfrm_state_afinfo {
328 	unsigned int			family;
329 	unsigned int			proto;
330 	__be16				eth_proto;
331 	struct module			*owner;
332 	const struct xfrm_type		*type_map[IPPROTO_MAX];
333 	const struct xfrm_type_offload	*type_offload_map[IPPROTO_MAX];
334 	struct xfrm_mode		*mode_map[XFRM_MODE_MAX];
335 
336 	int			(*init_flags)(struct xfrm_state *x);
337 	void			(*init_tempsel)(struct xfrm_selector *sel,
338 						const struct flowi *fl);
339 	void			(*init_temprop)(struct xfrm_state *x,
340 						const struct xfrm_tmpl *tmpl,
341 						const xfrm_address_t *daddr,
342 						const xfrm_address_t *saddr);
343 	int			(*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
344 	int			(*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
345 	int			(*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
346 	int			(*output_finish)(struct sock *sk, struct sk_buff *skb);
347 	int			(*extract_input)(struct xfrm_state *x,
348 						 struct sk_buff *skb);
349 	int			(*extract_output)(struct xfrm_state *x,
350 						  struct sk_buff *skb);
351 	int			(*transport_finish)(struct sk_buff *skb,
352 						    int async);
353 	void			(*local_error)(struct sk_buff *skb, u32 mtu);
354 };
355 
356 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
357 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
358 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
359 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
360 
361 struct xfrm_input_afinfo {
362 	unsigned int		family;
363 	int			(*callback)(struct sk_buff *skb, u8 protocol,
364 					    int err);
365 };
366 
367 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
368 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
369 
370 void xfrm_state_delete_tunnel(struct xfrm_state *x);
371 
372 struct xfrm_type {
373 	char			*description;
374 	struct module		*owner;
375 	u8			proto;
376 	u8			flags;
377 #define XFRM_TYPE_NON_FRAGMENT	1
378 #define XFRM_TYPE_REPLAY_PROT	2
379 #define XFRM_TYPE_LOCAL_COADDR	4
380 #define XFRM_TYPE_REMOTE_COADDR	8
381 
382 	int			(*init_state)(struct xfrm_state *x);
383 	void			(*destructor)(struct xfrm_state *);
384 	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
385 	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
386 	int			(*reject)(struct xfrm_state *, struct sk_buff *,
387 					  const struct flowi *);
388 	int			(*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
389 	/* Estimate maximal size of result of transformation of a dgram */
390 	u32			(*get_mtu)(struct xfrm_state *, int size);
391 };
392 
393 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
394 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
395 
396 struct xfrm_type_offload {
397 	char		*description;
398 	struct module	*owner;
399 	u8		proto;
400 	void		(*encap)(struct xfrm_state *, struct sk_buff *pskb);
401 	int		(*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
402 	int		(*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
403 };
404 
405 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
406 int xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
407 
408 struct xfrm_mode {
409 	/*
410 	 * Remove encapsulation header.
411 	 *
412 	 * The IP header will be moved over the top of the encapsulation
413 	 * header.
414 	 *
415 	 * On entry, the transport header shall point to where the IP header
416 	 * should be and the network header shall be set to where the IP
417 	 * header currently is.  skb->data shall point to the start of the
418 	 * payload.
419 	 */
420 	int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
421 
422 	/*
423 	 * This is the actual input entry point.
424 	 *
425 	 * For transport mode and equivalent this would be identical to
426 	 * input2 (which does not need to be set).  While tunnel mode
427 	 * and equivalent would set this to the tunnel encapsulation function
428 	 * xfrm4_prepare_input that would in turn call input2.
429 	 */
430 	int (*input)(struct xfrm_state *x, struct sk_buff *skb);
431 
432 	/*
433 	 * Add encapsulation header.
434 	 *
435 	 * On exit, the transport header will be set to the start of the
436 	 * encapsulation header to be filled in by x->type->output and
437 	 * the mac header will be set to the nextheader (protocol for
438 	 * IPv4) field of the extension header directly preceding the
439 	 * encapsulation header, or in its absence, that of the top IP
440 	 * header.  The value of the network header will always point
441 	 * to the top IP header while skb->data will point to the payload.
442 	 */
443 	int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
444 
445 	/*
446 	 * This is the actual output entry point.
447 	 *
448 	 * For transport mode and equivalent this would be identical to
449 	 * output2 (which does not need to be set).  While tunnel mode
450 	 * and equivalent would set this to a tunnel encapsulation function
451 	 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
452 	 * call output2.
453 	 */
454 	int (*output)(struct xfrm_state *x, struct sk_buff *skb);
455 
456 	/*
457 	 * Adjust pointers into the packet and do GSO segmentation.
458 	 */
459 	struct sk_buff *(*gso_segment)(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features);
460 
461 	/*
462 	 * Adjust pointers into the packet when IPsec is done at layer2.
463 	 */
464 	void (*xmit)(struct xfrm_state *x, struct sk_buff *skb);
465 
466 	struct xfrm_state_afinfo *afinfo;
467 	struct module *owner;
468 	unsigned int encap;
469 	int flags;
470 };
471 
472 /* Flags for xfrm_mode. */
473 enum {
474 	XFRM_MODE_FLAG_TUNNEL = 1,
475 };
476 
477 int xfrm_register_mode(struct xfrm_mode *mode, int family);
478 int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
479 
480 static inline int xfrm_af2proto(unsigned int family)
481 {
482 	switch(family) {
483 	case AF_INET:
484 		return IPPROTO_IPIP;
485 	case AF_INET6:
486 		return IPPROTO_IPV6;
487 	default:
488 		return 0;
489 	}
490 }
491 
492 static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
493 {
494 	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
495 	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
496 		return x->inner_mode;
497 	else
498 		return x->inner_mode_iaf;
499 }
500 
501 struct xfrm_tmpl {
502 /* id in template is interpreted as:
503  * daddr - destination of tunnel, may be zero for transport mode.
504  * spi   - zero to acquire spi. Not zero if spi is static, then
505  *	   daddr must be fixed too.
506  * proto - AH/ESP/IPCOMP
507  */
508 	struct xfrm_id		id;
509 
510 /* Source address of tunnel. Ignored, if it is not a tunnel. */
511 	xfrm_address_t		saddr;
512 
513 	unsigned short		encap_family;
514 
515 	u32			reqid;
516 
517 /* Mode: transport, tunnel etc. */
518 	u8			mode;
519 
520 /* Sharing mode: unique, this session only, this user only etc. */
521 	u8			share;
522 
523 /* May skip this transfomration if no SA is found */
524 	u8			optional;
525 
526 /* Skip aalgos/ealgos/calgos checks. */
527 	u8			allalgs;
528 
529 /* Bit mask of algos allowed for acquisition */
530 	u32			aalgos;
531 	u32			ealgos;
532 	u32			calgos;
533 };
534 
535 #define XFRM_MAX_DEPTH		6
536 #define XFRM_MAX_OFFLOAD_DEPTH	1
537 
538 struct xfrm_policy_walk_entry {
539 	struct list_head	all;
540 	u8			dead;
541 };
542 
543 struct xfrm_policy_walk {
544 	struct xfrm_policy_walk_entry walk;
545 	u8 type;
546 	u32 seq;
547 };
548 
549 struct xfrm_policy_queue {
550 	struct sk_buff_head	hold_queue;
551 	struct timer_list	hold_timer;
552 	unsigned long		timeout;
553 };
554 
555 struct xfrm_policy {
556 	possible_net_t		xp_net;
557 	struct hlist_node	bydst;
558 	struct hlist_node	byidx;
559 
560 	/* This lock only affects elements except for entry. */
561 	rwlock_t		lock;
562 	atomic_t		refcnt;
563 	struct timer_list	timer;
564 
565 	struct flow_cache_object flo;
566 	atomic_t		genid;
567 	u32			priority;
568 	u32			index;
569 	struct xfrm_mark	mark;
570 	struct xfrm_selector	selector;
571 	struct xfrm_lifetime_cfg lft;
572 	struct xfrm_lifetime_cur curlft;
573 	struct xfrm_policy_walk_entry walk;
574 	struct xfrm_policy_queue polq;
575 	u8			type;
576 	u8			action;
577 	u8			flags;
578 	u8			xfrm_nr;
579 	u16			family;
580 	struct xfrm_sec_ctx	*security;
581 	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
582 	struct rcu_head		rcu;
583 };
584 
585 static inline struct net *xp_net(const struct xfrm_policy *xp)
586 {
587 	return read_pnet(&xp->xp_net);
588 }
589 
590 struct xfrm_kmaddress {
591 	xfrm_address_t          local;
592 	xfrm_address_t          remote;
593 	u32			reserved;
594 	u16			family;
595 };
596 
597 struct xfrm_migrate {
598 	xfrm_address_t		old_daddr;
599 	xfrm_address_t		old_saddr;
600 	xfrm_address_t		new_daddr;
601 	xfrm_address_t		new_saddr;
602 	u8			proto;
603 	u8			mode;
604 	u16			reserved;
605 	u32			reqid;
606 	u16			old_family;
607 	u16			new_family;
608 };
609 
610 #define XFRM_KM_TIMEOUT                30
611 /* what happened */
612 #define XFRM_REPLAY_UPDATE	XFRM_AE_CR
613 #define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE
614 
615 /* default aevent timeout in units of 100ms */
616 #define XFRM_AE_ETIME			10
617 /* Async Event timer multiplier */
618 #define XFRM_AE_ETH_M			10
619 /* default seq threshold size */
620 #define XFRM_AE_SEQT_SIZE		2
621 
622 struct xfrm_mgr {
623 	struct list_head	list;
624 	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
625 	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
626 	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
627 	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
628 	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
629 	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
630 	int			(*migrate)(const struct xfrm_selector *sel,
631 					   u8 dir, u8 type,
632 					   const struct xfrm_migrate *m,
633 					   int num_bundles,
634 					   const struct xfrm_kmaddress *k);
635 	bool			(*is_alive)(const struct km_event *c);
636 };
637 
638 int xfrm_register_km(struct xfrm_mgr *km);
639 int xfrm_unregister_km(struct xfrm_mgr *km);
640 
641 struct xfrm_tunnel_skb_cb {
642 	union {
643 		struct inet_skb_parm h4;
644 		struct inet6_skb_parm h6;
645 	} header;
646 
647 	union {
648 		struct ip_tunnel *ip4;
649 		struct ip6_tnl *ip6;
650 	} tunnel;
651 };
652 
653 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
654 
655 /*
656  * This structure is used for the duration where packets are being
657  * transformed by IPsec.  As soon as the packet leaves IPsec the
658  * area beyond the generic IP part may be overwritten.
659  */
660 struct xfrm_skb_cb {
661 	struct xfrm_tunnel_skb_cb header;
662 
663         /* Sequence number for replay protection. */
664 	union {
665 		struct {
666 			__u32 low;
667 			__u32 hi;
668 		} output;
669 		struct {
670 			__be32 low;
671 			__be32 hi;
672 		} input;
673 	} seq;
674 };
675 
676 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
677 
678 /*
679  * This structure is used by the afinfo prepare_input/prepare_output functions
680  * to transmit header information to the mode input/output functions.
681  */
682 struct xfrm_mode_skb_cb {
683 	struct xfrm_tunnel_skb_cb header;
684 
685 	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
686 	__be16 id;
687 	__be16 frag_off;
688 
689 	/* IP header length (excluding options or extension headers). */
690 	u8 ihl;
691 
692 	/* TOS for IPv4, class for IPv6. */
693 	u8 tos;
694 
695 	/* TTL for IPv4, hop limitfor IPv6. */
696 	u8 ttl;
697 
698 	/* Protocol for IPv4, NH for IPv6. */
699 	u8 protocol;
700 
701 	/* Option length for IPv4, zero for IPv6. */
702 	u8 optlen;
703 
704 	/* Used by IPv6 only, zero for IPv4. */
705 	u8 flow_lbl[3];
706 };
707 
708 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
709 
710 /*
711  * This structure is used by the input processing to locate the SPI and
712  * related information.
713  */
714 struct xfrm_spi_skb_cb {
715 	struct xfrm_tunnel_skb_cb header;
716 
717 	unsigned int daddroff;
718 	unsigned int family;
719 	__be32 seq;
720 };
721 
722 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
723 
724 #ifdef CONFIG_AUDITSYSCALL
725 static inline struct audit_buffer *xfrm_audit_start(const char *op)
726 {
727 	struct audit_buffer *audit_buf = NULL;
728 
729 	if (audit_enabled == 0)
730 		return NULL;
731 	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
732 				    AUDIT_MAC_IPSEC_EVENT);
733 	if (audit_buf == NULL)
734 		return NULL;
735 	audit_log_format(audit_buf, "op=%s", op);
736 	return audit_buf;
737 }
738 
739 static inline void xfrm_audit_helper_usrinfo(bool task_valid,
740 					     struct audit_buffer *audit_buf)
741 {
742 	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
743 					    audit_get_loginuid(current) :
744 					    INVALID_UID);
745 	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
746 		(unsigned int) -1;
747 
748 	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
749 	audit_log_task_context(audit_buf);
750 }
751 
752 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
753 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
754 			      bool task_valid);
755 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
756 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
757 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
758 				      struct sk_buff *skb);
759 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
760 			     __be32 net_seq);
761 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
762 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
763 			       __be32 net_seq);
764 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
765 			      u8 proto);
766 #else
767 
768 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
769 					 bool task_valid)
770 {
771 }
772 
773 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
774 					    bool task_valid)
775 {
776 }
777 
778 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
779 					bool task_valid)
780 {
781 }
782 
783 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
784 					   bool task_valid)
785 {
786 }
787 
788 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
789 					     struct sk_buff *skb)
790 {
791 }
792 
793 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
794 					   struct sk_buff *skb, __be32 net_seq)
795 {
796 }
797 
798 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
799 				      u16 family)
800 {
801 }
802 
803 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
804 				      __be32 net_spi, __be32 net_seq)
805 {
806 }
807 
808 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
809 				     struct sk_buff *skb, u8 proto)
810 {
811 }
812 #endif /* CONFIG_AUDITSYSCALL */
813 
814 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
815 {
816 	if (likely(policy != NULL))
817 		atomic_inc(&policy->refcnt);
818 }
819 
820 void xfrm_policy_destroy(struct xfrm_policy *policy);
821 
822 static inline void xfrm_pol_put(struct xfrm_policy *policy)
823 {
824 	if (atomic_dec_and_test(&policy->refcnt))
825 		xfrm_policy_destroy(policy);
826 }
827 
828 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
829 {
830 	int i;
831 	for (i = npols - 1; i >= 0; --i)
832 		xfrm_pol_put(pols[i]);
833 }
834 
835 void __xfrm_state_destroy(struct xfrm_state *);
836 
837 static inline void __xfrm_state_put(struct xfrm_state *x)
838 {
839 	atomic_dec(&x->refcnt);
840 }
841 
842 static inline void xfrm_state_put(struct xfrm_state *x)
843 {
844 	if (atomic_dec_and_test(&x->refcnt))
845 		__xfrm_state_destroy(x);
846 }
847 
848 static inline void xfrm_state_hold(struct xfrm_state *x)
849 {
850 	atomic_inc(&x->refcnt);
851 }
852 
853 static inline bool addr_match(const void *token1, const void *token2,
854 			      unsigned int prefixlen)
855 {
856 	const __be32 *a1 = token1;
857 	const __be32 *a2 = token2;
858 	unsigned int pdw;
859 	unsigned int pbi;
860 
861 	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
862 	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
863 
864 	if (pdw)
865 		if (memcmp(a1, a2, pdw << 2))
866 			return false;
867 
868 	if (pbi) {
869 		__be32 mask;
870 
871 		mask = htonl((0xffffffff) << (32 - pbi));
872 
873 		if ((a1[pdw] ^ a2[pdw]) & mask)
874 			return false;
875 	}
876 
877 	return true;
878 }
879 
880 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
881 {
882 	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
883 	if (sizeof(long) == 4 && prefixlen == 0)
884 		return true;
885 	return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
886 }
887 
888 static __inline__
889 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
890 {
891 	__be16 port;
892 	switch(fl->flowi_proto) {
893 	case IPPROTO_TCP:
894 	case IPPROTO_UDP:
895 	case IPPROTO_UDPLITE:
896 	case IPPROTO_SCTP:
897 		port = uli->ports.sport;
898 		break;
899 	case IPPROTO_ICMP:
900 	case IPPROTO_ICMPV6:
901 		port = htons(uli->icmpt.type);
902 		break;
903 	case IPPROTO_MH:
904 		port = htons(uli->mht.type);
905 		break;
906 	case IPPROTO_GRE:
907 		port = htons(ntohl(uli->gre_key) >> 16);
908 		break;
909 	default:
910 		port = 0;	/*XXX*/
911 	}
912 	return port;
913 }
914 
915 static __inline__
916 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
917 {
918 	__be16 port;
919 	switch(fl->flowi_proto) {
920 	case IPPROTO_TCP:
921 	case IPPROTO_UDP:
922 	case IPPROTO_UDPLITE:
923 	case IPPROTO_SCTP:
924 		port = uli->ports.dport;
925 		break;
926 	case IPPROTO_ICMP:
927 	case IPPROTO_ICMPV6:
928 		port = htons(uli->icmpt.code);
929 		break;
930 	case IPPROTO_GRE:
931 		port = htons(ntohl(uli->gre_key) & 0xffff);
932 		break;
933 	default:
934 		port = 0;	/*XXX*/
935 	}
936 	return port;
937 }
938 
939 bool xfrm_selector_match(const struct xfrm_selector *sel,
940 			 const struct flowi *fl, unsigned short family);
941 
942 #ifdef CONFIG_SECURITY_NETWORK_XFRM
943 /*	If neither has a context --> match
944  * 	Otherwise, both must have a context and the sids, doi, alg must match
945  */
946 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
947 {
948 	return ((!s1 && !s2) ||
949 		(s1 && s2 &&
950 		 (s1->ctx_sid == s2->ctx_sid) &&
951 		 (s1->ctx_doi == s2->ctx_doi) &&
952 		 (s1->ctx_alg == s2->ctx_alg)));
953 }
954 #else
955 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
956 {
957 	return true;
958 }
959 #endif
960 
961 /* A struct encoding bundle of transformations to apply to some set of flow.
962  *
963  * dst->child points to the next element of bundle.
964  * dst->xfrm  points to an instanse of transformer.
965  *
966  * Due to unfortunate limitations of current routing cache, which we
967  * have no time to fix, it mirrors struct rtable and bound to the same
968  * routing key, including saddr,daddr. However, we can have many of
969  * bundles differing by session id. All the bundles grow from a parent
970  * policy rule.
971  */
972 struct xfrm_dst {
973 	union {
974 		struct dst_entry	dst;
975 		struct rtable		rt;
976 		struct rt6_info		rt6;
977 	} u;
978 	struct dst_entry *route;
979 	struct flow_cache_object flo;
980 	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
981 	int num_pols, num_xfrms;
982 #ifdef CONFIG_XFRM_SUB_POLICY
983 	struct flowi *origin;
984 	struct xfrm_selector *partner;
985 #endif
986 	u32 xfrm_genid;
987 	u32 policy_genid;
988 	u32 route_mtu_cached;
989 	u32 child_mtu_cached;
990 	u32 route_cookie;
991 	u32 path_cookie;
992 };
993 
994 #ifdef CONFIG_XFRM
995 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
996 {
997 	xfrm_pols_put(xdst->pols, xdst->num_pols);
998 	dst_release(xdst->route);
999 	if (likely(xdst->u.dst.xfrm))
1000 		xfrm_state_put(xdst->u.dst.xfrm);
1001 #ifdef CONFIG_XFRM_SUB_POLICY
1002 	kfree(xdst->origin);
1003 	xdst->origin = NULL;
1004 	kfree(xdst->partner);
1005 	xdst->partner = NULL;
1006 #endif
1007 }
1008 #endif
1009 
1010 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1011 
1012 struct xfrm_offload {
1013 	/* Output sequence number for replay protection on offloading. */
1014 	struct {
1015 		__u32 low;
1016 		__u32 hi;
1017 	} seq;
1018 
1019 	__u32			flags;
1020 #define	SA_DELETE_REQ		1
1021 #define	CRYPTO_DONE		2
1022 #define	CRYPTO_NEXT_DONE	4
1023 #define	CRYPTO_FALLBACK		8
1024 #define	XFRM_GSO_SEGMENT	16
1025 #define	XFRM_GRO		32
1026 
1027 	__u32			status;
1028 #define CRYPTO_SUCCESS				1
1029 #define CRYPTO_GENERIC_ERROR			2
1030 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED		4
1031 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED	8
1032 #define CRYPTO_TUNNEL_AH_AUTH_FAILED		16
1033 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED		32
1034 #define CRYPTO_INVALID_PACKET_SYNTAX		64
1035 #define CRYPTO_INVALID_PROTOCOL			128
1036 
1037 	__u8			proto;
1038 };
1039 
1040 struct sec_path {
1041 	atomic_t		refcnt;
1042 	int			len;
1043 	int			olen;
1044 
1045 	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
1046 	struct xfrm_offload	ovec[XFRM_MAX_OFFLOAD_DEPTH];
1047 };
1048 
1049 static inline int secpath_exists(struct sk_buff *skb)
1050 {
1051 #ifdef CONFIG_XFRM
1052 	return skb->sp != NULL;
1053 #else
1054 	return 0;
1055 #endif
1056 }
1057 
1058 static inline struct sec_path *
1059 secpath_get(struct sec_path *sp)
1060 {
1061 	if (sp)
1062 		atomic_inc(&sp->refcnt);
1063 	return sp;
1064 }
1065 
1066 void __secpath_destroy(struct sec_path *sp);
1067 
1068 static inline void
1069 secpath_put(struct sec_path *sp)
1070 {
1071 	if (sp && atomic_dec_and_test(&sp->refcnt))
1072 		__secpath_destroy(sp);
1073 }
1074 
1075 struct sec_path *secpath_dup(struct sec_path *src);
1076 int secpath_set(struct sk_buff *skb);
1077 
1078 static inline void
1079 secpath_reset(struct sk_buff *skb)
1080 {
1081 #ifdef CONFIG_XFRM
1082 	secpath_put(skb->sp);
1083 	skb->sp = NULL;
1084 #endif
1085 }
1086 
1087 static inline int
1088 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1089 {
1090 	switch (family) {
1091 	case AF_INET:
1092 		return addr->a4 == 0;
1093 	case AF_INET6:
1094 		return ipv6_addr_any(&addr->in6);
1095 	}
1096 	return 0;
1097 }
1098 
1099 static inline int
1100 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1101 {
1102 	return	(tmpl->saddr.a4 &&
1103 		 tmpl->saddr.a4 != x->props.saddr.a4);
1104 }
1105 
1106 static inline int
1107 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1108 {
1109 	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1110 		 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1111 }
1112 
1113 static inline int
1114 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1115 {
1116 	switch (family) {
1117 	case AF_INET:
1118 		return __xfrm4_state_addr_cmp(tmpl, x);
1119 	case AF_INET6:
1120 		return __xfrm6_state_addr_cmp(tmpl, x);
1121 	}
1122 	return !0;
1123 }
1124 
1125 #ifdef CONFIG_XFRM
1126 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1127 			unsigned short family);
1128 
1129 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1130 				       struct sk_buff *skb,
1131 				       unsigned int family, int reverse)
1132 {
1133 	struct net *net = dev_net(skb->dev);
1134 	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1135 
1136 	if (sk && sk->sk_policy[XFRM_POLICY_IN])
1137 		return __xfrm_policy_check(sk, ndir, skb, family);
1138 
1139 	return	(!net->xfrm.policy_count[dir] && !skb->sp) ||
1140 		(skb_dst(skb)->flags & DST_NOPOLICY) ||
1141 		__xfrm_policy_check(sk, ndir, skb, family);
1142 }
1143 
1144 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1145 {
1146 	return __xfrm_policy_check2(sk, dir, skb, family, 0);
1147 }
1148 
1149 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1150 {
1151 	return xfrm_policy_check(sk, dir, skb, AF_INET);
1152 }
1153 
1154 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1155 {
1156 	return xfrm_policy_check(sk, dir, skb, AF_INET6);
1157 }
1158 
1159 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1160 					     struct sk_buff *skb)
1161 {
1162 	return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1163 }
1164 
1165 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1166 					     struct sk_buff *skb)
1167 {
1168 	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1169 }
1170 
1171 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1172 			  unsigned int family, int reverse);
1173 
1174 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1175 				      unsigned int family)
1176 {
1177 	return __xfrm_decode_session(skb, fl, family, 0);
1178 }
1179 
1180 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1181 					      struct flowi *fl,
1182 					      unsigned int family)
1183 {
1184 	return __xfrm_decode_session(skb, fl, family, 1);
1185 }
1186 
1187 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1188 
1189 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1190 {
1191 	struct net *net = dev_net(skb->dev);
1192 
1193 	return	!net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1194 		(skb_dst(skb)->flags & DST_NOXFRM) ||
1195 		__xfrm_route_forward(skb, family);
1196 }
1197 
1198 static inline int xfrm4_route_forward(struct sk_buff *skb)
1199 {
1200 	return xfrm_route_forward(skb, AF_INET);
1201 }
1202 
1203 static inline int xfrm6_route_forward(struct sk_buff *skb)
1204 {
1205 	return xfrm_route_forward(skb, AF_INET6);
1206 }
1207 
1208 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1209 
1210 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1211 {
1212 	sk->sk_policy[0] = NULL;
1213 	sk->sk_policy[1] = NULL;
1214 	if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1215 		return __xfrm_sk_clone_policy(sk, osk);
1216 	return 0;
1217 }
1218 
1219 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1220 
1221 static inline void xfrm_sk_free_policy(struct sock *sk)
1222 {
1223 	struct xfrm_policy *pol;
1224 
1225 	pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1226 	if (unlikely(pol != NULL)) {
1227 		xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1228 		sk->sk_policy[0] = NULL;
1229 	}
1230 	pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1231 	if (unlikely(pol != NULL)) {
1232 		xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1233 		sk->sk_policy[1] = NULL;
1234 	}
1235 }
1236 
1237 void xfrm_garbage_collect(struct net *net);
1238 void xfrm_garbage_collect_deferred(struct net *net);
1239 
1240 #else
1241 
1242 static inline void xfrm_sk_free_policy(struct sock *sk) {}
1243 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1244 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1245 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1246 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1247 {
1248 	return 1;
1249 }
1250 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1251 {
1252 	return 1;
1253 }
1254 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1255 {
1256 	return 1;
1257 }
1258 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1259 					      struct flowi *fl,
1260 					      unsigned int family)
1261 {
1262 	return -ENOSYS;
1263 }
1264 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1265 					     struct sk_buff *skb)
1266 {
1267 	return 1;
1268 }
1269 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1270 					     struct sk_buff *skb)
1271 {
1272 	return 1;
1273 }
1274 static inline void xfrm_garbage_collect(struct net *net)
1275 {
1276 }
1277 #endif
1278 
1279 static __inline__
1280 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1281 {
1282 	switch (family){
1283 	case AF_INET:
1284 		return (xfrm_address_t *)&fl->u.ip4.daddr;
1285 	case AF_INET6:
1286 		return (xfrm_address_t *)&fl->u.ip6.daddr;
1287 	}
1288 	return NULL;
1289 }
1290 
1291 static __inline__
1292 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1293 {
1294 	switch (family){
1295 	case AF_INET:
1296 		return (xfrm_address_t *)&fl->u.ip4.saddr;
1297 	case AF_INET6:
1298 		return (xfrm_address_t *)&fl->u.ip6.saddr;
1299 	}
1300 	return NULL;
1301 }
1302 
1303 static __inline__
1304 void xfrm_flowi_addr_get(const struct flowi *fl,
1305 			 xfrm_address_t *saddr, xfrm_address_t *daddr,
1306 			 unsigned short family)
1307 {
1308 	switch(family) {
1309 	case AF_INET:
1310 		memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1311 		memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1312 		break;
1313 	case AF_INET6:
1314 		saddr->in6 = fl->u.ip6.saddr;
1315 		daddr->in6 = fl->u.ip6.daddr;
1316 		break;
1317 	}
1318 }
1319 
1320 static __inline__ int
1321 __xfrm4_state_addr_check(const struct xfrm_state *x,
1322 			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1323 {
1324 	if (daddr->a4 == x->id.daddr.a4 &&
1325 	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1326 		return 1;
1327 	return 0;
1328 }
1329 
1330 static __inline__ int
1331 __xfrm6_state_addr_check(const struct xfrm_state *x,
1332 			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1333 {
1334 	if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1335 	    (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1336 	     ipv6_addr_any((struct in6_addr *)saddr) ||
1337 	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1338 		return 1;
1339 	return 0;
1340 }
1341 
1342 static __inline__ int
1343 xfrm_state_addr_check(const struct xfrm_state *x,
1344 		      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1345 		      unsigned short family)
1346 {
1347 	switch (family) {
1348 	case AF_INET:
1349 		return __xfrm4_state_addr_check(x, daddr, saddr);
1350 	case AF_INET6:
1351 		return __xfrm6_state_addr_check(x, daddr, saddr);
1352 	}
1353 	return 0;
1354 }
1355 
1356 static __inline__ int
1357 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1358 			   unsigned short family)
1359 {
1360 	switch (family) {
1361 	case AF_INET:
1362 		return __xfrm4_state_addr_check(x,
1363 						(const xfrm_address_t *)&fl->u.ip4.daddr,
1364 						(const xfrm_address_t *)&fl->u.ip4.saddr);
1365 	case AF_INET6:
1366 		return __xfrm6_state_addr_check(x,
1367 						(const xfrm_address_t *)&fl->u.ip6.daddr,
1368 						(const xfrm_address_t *)&fl->u.ip6.saddr);
1369 	}
1370 	return 0;
1371 }
1372 
1373 static inline int xfrm_state_kern(const struct xfrm_state *x)
1374 {
1375 	return atomic_read(&x->tunnel_users);
1376 }
1377 
1378 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1379 {
1380 	return (!userproto || proto == userproto ||
1381 		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1382 						  proto == IPPROTO_ESP ||
1383 						  proto == IPPROTO_COMP)));
1384 }
1385 
1386 /*
1387  * xfrm algorithm information
1388  */
1389 struct xfrm_algo_aead_info {
1390 	char *geniv;
1391 	u16 icv_truncbits;
1392 };
1393 
1394 struct xfrm_algo_auth_info {
1395 	u16 icv_truncbits;
1396 	u16 icv_fullbits;
1397 };
1398 
1399 struct xfrm_algo_encr_info {
1400 	char *geniv;
1401 	u16 blockbits;
1402 	u16 defkeybits;
1403 };
1404 
1405 struct xfrm_algo_comp_info {
1406 	u16 threshold;
1407 };
1408 
1409 struct xfrm_algo_desc {
1410 	char *name;
1411 	char *compat;
1412 	u8 available:1;
1413 	u8 pfkey_supported:1;
1414 	union {
1415 		struct xfrm_algo_aead_info aead;
1416 		struct xfrm_algo_auth_info auth;
1417 		struct xfrm_algo_encr_info encr;
1418 		struct xfrm_algo_comp_info comp;
1419 	} uinfo;
1420 	struct sadb_alg desc;
1421 };
1422 
1423 /* XFRM protocol handlers.  */
1424 struct xfrm4_protocol {
1425 	int (*handler)(struct sk_buff *skb);
1426 	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1427 			     int encap_type);
1428 	int (*cb_handler)(struct sk_buff *skb, int err);
1429 	int (*err_handler)(struct sk_buff *skb, u32 info);
1430 
1431 	struct xfrm4_protocol __rcu *next;
1432 	int priority;
1433 };
1434 
1435 struct xfrm6_protocol {
1436 	int (*handler)(struct sk_buff *skb);
1437 	int (*cb_handler)(struct sk_buff *skb, int err);
1438 	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1439 			   u8 type, u8 code, int offset, __be32 info);
1440 
1441 	struct xfrm6_protocol __rcu *next;
1442 	int priority;
1443 };
1444 
1445 /* XFRM tunnel handlers.  */
1446 struct xfrm_tunnel {
1447 	int (*handler)(struct sk_buff *skb);
1448 	int (*err_handler)(struct sk_buff *skb, u32 info);
1449 
1450 	struct xfrm_tunnel __rcu *next;
1451 	int priority;
1452 };
1453 
1454 struct xfrm6_tunnel {
1455 	int (*handler)(struct sk_buff *skb);
1456 	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1457 			   u8 type, u8 code, int offset, __be32 info);
1458 	struct xfrm6_tunnel __rcu *next;
1459 	int priority;
1460 };
1461 
1462 void xfrm_init(void);
1463 void xfrm4_init(void);
1464 int xfrm_state_init(struct net *net);
1465 void xfrm_state_fini(struct net *net);
1466 void xfrm4_state_init(void);
1467 void xfrm4_protocol_init(void);
1468 #ifdef CONFIG_XFRM
1469 int xfrm6_init(void);
1470 void xfrm6_fini(void);
1471 int xfrm6_state_init(void);
1472 void xfrm6_state_fini(void);
1473 int xfrm6_protocol_init(void);
1474 void xfrm6_protocol_fini(void);
1475 #else
1476 static inline int xfrm6_init(void)
1477 {
1478 	return 0;
1479 }
1480 static inline void xfrm6_fini(void)
1481 {
1482 	;
1483 }
1484 #endif
1485 
1486 #ifdef CONFIG_XFRM_STATISTICS
1487 int xfrm_proc_init(struct net *net);
1488 void xfrm_proc_fini(struct net *net);
1489 #endif
1490 
1491 int xfrm_sysctl_init(struct net *net);
1492 #ifdef CONFIG_SYSCTL
1493 void xfrm_sysctl_fini(struct net *net);
1494 #else
1495 static inline void xfrm_sysctl_fini(struct net *net)
1496 {
1497 }
1498 #endif
1499 
1500 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1501 			  struct xfrm_address_filter *filter);
1502 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1503 		    int (*func)(struct xfrm_state *, int, void*), void *);
1504 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1505 struct xfrm_state *xfrm_state_alloc(struct net *net);
1506 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1507 				   const xfrm_address_t *saddr,
1508 				   const struct flowi *fl,
1509 				   struct xfrm_tmpl *tmpl,
1510 				   struct xfrm_policy *pol, int *err,
1511 				   unsigned short family);
1512 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1513 				       xfrm_address_t *daddr,
1514 				       xfrm_address_t *saddr,
1515 				       unsigned short family,
1516 				       u8 mode, u8 proto, u32 reqid);
1517 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1518 					      unsigned short family);
1519 int xfrm_state_check_expire(struct xfrm_state *x);
1520 void xfrm_state_insert(struct xfrm_state *x);
1521 int xfrm_state_add(struct xfrm_state *x);
1522 int xfrm_state_update(struct xfrm_state *x);
1523 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1524 				     const xfrm_address_t *daddr, __be32 spi,
1525 				     u8 proto, unsigned short family);
1526 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1527 					    const xfrm_address_t *daddr,
1528 					    const xfrm_address_t *saddr,
1529 					    u8 proto,
1530 					    unsigned short family);
1531 #ifdef CONFIG_XFRM_SUB_POLICY
1532 int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1533 		   unsigned short family, struct net *net);
1534 int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1535 		    unsigned short family);
1536 #else
1537 static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1538 				 int n, unsigned short family, struct net *net)
1539 {
1540 	return -ENOSYS;
1541 }
1542 
1543 static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1544 				  int n, unsigned short family)
1545 {
1546 	return -ENOSYS;
1547 }
1548 #endif
1549 
1550 struct xfrmk_sadinfo {
1551 	u32 sadhcnt; /* current hash bkts */
1552 	u32 sadhmcnt; /* max allowed hash bkts */
1553 	u32 sadcnt; /* current running count */
1554 };
1555 
1556 struct xfrmk_spdinfo {
1557 	u32 incnt;
1558 	u32 outcnt;
1559 	u32 fwdcnt;
1560 	u32 inscnt;
1561 	u32 outscnt;
1562 	u32 fwdscnt;
1563 	u32 spdhcnt;
1564 	u32 spdhmcnt;
1565 };
1566 
1567 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1568 int xfrm_state_delete(struct xfrm_state *x);
1569 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
1570 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1571 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1572 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1573 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1574 int xfrm_init_replay(struct xfrm_state *x);
1575 int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1576 int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1577 int xfrm_init_state(struct xfrm_state *x);
1578 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1579 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1580 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1581 int xfrm_output_resume(struct sk_buff *skb, int err);
1582 int xfrm_output(struct sock *sk, struct sk_buff *skb);
1583 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1584 void xfrm_local_error(struct sk_buff *skb, int mtu);
1585 int xfrm4_extract_header(struct sk_buff *skb);
1586 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1587 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1588 		    int encap_type);
1589 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1590 int xfrm4_rcv(struct sk_buff *skb);
1591 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1592 
1593 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1594 {
1595 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1596 	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1597 	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1598 	return xfrm_input(skb, nexthdr, spi, 0);
1599 }
1600 
1601 int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1602 int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1603 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1604 int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
1605 int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1606 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1607 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1608 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1609 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1610 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1611 int xfrm6_extract_header(struct sk_buff *skb);
1612 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1613 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1614 		  struct ip6_tnl *t);
1615 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1616 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1617 int xfrm6_rcv(struct sk_buff *skb);
1618 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1619 		     xfrm_address_t *saddr, u8 proto);
1620 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1621 int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1622 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1623 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1624 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1625 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1626 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1627 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1628 int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1629 int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1630 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1631 int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
1632 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1633 			  u8 **prevhdr);
1634 
1635 #ifdef CONFIG_XFRM
1636 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1637 int xfrm_user_policy(struct sock *sk, int optname,
1638 		     u8 __user *optval, int optlen);
1639 #else
1640 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1641 {
1642  	return -ENOPROTOOPT;
1643 }
1644 
1645 static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1646 {
1647  	/* should not happen */
1648  	kfree_skb(skb);
1649 	return 0;
1650 }
1651 #endif
1652 
1653 struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1654 				    const xfrm_address_t *saddr,
1655 				    const xfrm_address_t *daddr,
1656 				    int family);
1657 
1658 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1659 
1660 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1661 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1662 		     int (*func)(struct xfrm_policy *, int, int, void*),
1663 		     void *);
1664 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1665 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1666 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1667 					  u8 type, int dir,
1668 					  struct xfrm_selector *sel,
1669 					  struct xfrm_sec_ctx *ctx, int delete,
1670 					  int *err);
1671 struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1672 				     u32 id, int delete, int *err);
1673 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1674 void xfrm_policy_hash_rebuild(struct net *net);
1675 u32 xfrm_get_acqseq(void);
1676 int verify_spi_info(u8 proto, u32 min, u32 max);
1677 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1678 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1679 				 u8 mode, u32 reqid, u8 proto,
1680 				 const xfrm_address_t *daddr,
1681 				 const xfrm_address_t *saddr, int create,
1682 				 unsigned short family);
1683 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1684 
1685 #ifdef CONFIG_XFRM_MIGRATE
1686 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1687 	       const struct xfrm_migrate *m, int num_bundles,
1688 	       const struct xfrm_kmaddress *k);
1689 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
1690 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1691 				      struct xfrm_migrate *m);
1692 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1693 		 struct xfrm_migrate *m, int num_bundles,
1694 		 struct xfrm_kmaddress *k, struct net *net);
1695 #endif
1696 
1697 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1698 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1699 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1700 	      xfrm_address_t *addr);
1701 
1702 void xfrm_input_init(void);
1703 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1704 
1705 void xfrm_probe_algs(void);
1706 int xfrm_count_pfkey_auth_supported(void);
1707 int xfrm_count_pfkey_enc_supported(void);
1708 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1709 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1710 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1711 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1712 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1713 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1714 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1715 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1716 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1717 					    int probe);
1718 
1719 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1720 				    const xfrm_address_t *b)
1721 {
1722 	return ipv6_addr_equal((const struct in6_addr *)a,
1723 			       (const struct in6_addr *)b);
1724 }
1725 
1726 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1727 				   const xfrm_address_t *b,
1728 				   sa_family_t family)
1729 {
1730 	switch (family) {
1731 	default:
1732 	case AF_INET:
1733 		return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1734 	case AF_INET6:
1735 		return xfrm6_addr_equal(a, b);
1736 	}
1737 }
1738 
1739 static inline int xfrm_policy_id2dir(u32 index)
1740 {
1741 	return index & 7;
1742 }
1743 
1744 #ifdef CONFIG_XFRM
1745 static inline int xfrm_aevent_is_on(struct net *net)
1746 {
1747 	struct sock *nlsk;
1748 	int ret = 0;
1749 
1750 	rcu_read_lock();
1751 	nlsk = rcu_dereference(net->xfrm.nlsk);
1752 	if (nlsk)
1753 		ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1754 	rcu_read_unlock();
1755 	return ret;
1756 }
1757 
1758 static inline int xfrm_acquire_is_on(struct net *net)
1759 {
1760 	struct sock *nlsk;
1761 	int ret = 0;
1762 
1763 	rcu_read_lock();
1764 	nlsk = rcu_dereference(net->xfrm.nlsk);
1765 	if (nlsk)
1766 		ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1767 	rcu_read_unlock();
1768 
1769 	return ret;
1770 }
1771 #endif
1772 
1773 static inline int aead_len(struct xfrm_algo_aead *alg)
1774 {
1775 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1776 }
1777 
1778 static inline int xfrm_alg_len(const struct xfrm_algo *alg)
1779 {
1780 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1781 }
1782 
1783 static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1784 {
1785 	return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1786 }
1787 
1788 static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1789 {
1790 	return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1791 }
1792 
1793 #ifdef CONFIG_XFRM_MIGRATE
1794 static inline int xfrm_replay_clone(struct xfrm_state *x,
1795 				     struct xfrm_state *orig)
1796 {
1797 	x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1798 				GFP_KERNEL);
1799 	if (!x->replay_esn)
1800 		return -ENOMEM;
1801 
1802 	x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1803 	x->replay_esn->replay_window = orig->replay_esn->replay_window;
1804 
1805 	x->preplay_esn = kmemdup(x->replay_esn,
1806 				 xfrm_replay_state_esn_len(x->replay_esn),
1807 				 GFP_KERNEL);
1808 	if (!x->preplay_esn) {
1809 		kfree(x->replay_esn);
1810 		return -ENOMEM;
1811 	}
1812 
1813 	return 0;
1814 }
1815 
1816 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1817 {
1818 	return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1819 }
1820 
1821 
1822 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1823 {
1824 	return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1825 }
1826 
1827 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1828 {
1829 	return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1830 }
1831 
1832 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1833 {
1834 	int i;
1835 	for (i = 0; i < n; i++)
1836 		xfrm_state_put(*(states + i));
1837 }
1838 
1839 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1840 {
1841 	int i;
1842 	for (i = 0; i < n; i++)
1843 		xfrm_state_delete(*(states + i));
1844 }
1845 #endif
1846 
1847 #ifdef CONFIG_XFRM
1848 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1849 {
1850 	return skb->sp->xvec[skb->sp->len - 1];
1851 }
1852 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1853 {
1854 	struct sec_path *sp = skb->sp;
1855 
1856 	if (!sp || !sp->olen || sp->len != sp->olen)
1857 		return NULL;
1858 
1859 	return &sp->ovec[sp->olen - 1];
1860 }
1861 #endif
1862 
1863 #ifdef CONFIG_XFRM_OFFLOAD
1864 void __net_init xfrm_dev_init(void);
1865 int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features);
1866 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1867 		       struct xfrm_user_offload *xuo);
1868 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1869 
1870 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1871 {
1872 	struct xfrm_state_offload *xso = &x->xso;
1873 
1874 	if (xso->dev)
1875 		xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1876 }
1877 
1878 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1879 {
1880 	struct xfrm_state_offload *xso = &x->xso;
1881 	 struct net_device *dev = xso->dev;
1882 
1883 	if (dev && dev->xfrmdev_ops) {
1884 		dev->xfrmdev_ops->xdo_dev_state_free(x);
1885 		xso->dev = NULL;
1886 		dev_put(dev);
1887 	}
1888 }
1889 #else
1890 static inline void __net_init xfrm_dev_init(void)
1891 {
1892 }
1893 
1894 static inline int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
1895 {
1896 	return 0;
1897 }
1898 
1899 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo)
1900 {
1901 	return 0;
1902 }
1903 
1904 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1905 {
1906 }
1907 
1908 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1909 {
1910 }
1911 
1912 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
1913 {
1914 	return false;
1915 }
1916 #endif
1917 
1918 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1919 {
1920 	if (attrs[XFRMA_MARK])
1921 		memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1922 	else
1923 		m->v = m->m = 0;
1924 
1925 	return m->v & m->m;
1926 }
1927 
1928 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1929 {
1930 	int ret = 0;
1931 
1932 	if (m->m | m->v)
1933 		ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1934 	return ret;
1935 }
1936 
1937 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1938 				    unsigned int family)
1939 {
1940 	bool tunnel = false;
1941 
1942 	switch(family) {
1943 	case AF_INET:
1944 		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1945 			tunnel = true;
1946 		break;
1947 	case AF_INET6:
1948 		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1949 			tunnel = true;
1950 		break;
1951 	}
1952 	if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
1953 		return -EINVAL;
1954 
1955 	return 0;
1956 }
1957 #endif	/* _NET_XFRM_H */
1958