1#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
4#include <linux/compiler.h>
5#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
9#include <linux/socket.h>
10#include <linux/pfkeyv2.h>
11#include <linux/ipsec.h>
12#include <linux/in6.h>
13#include <linux/mutex.h>
14#include <linux/audit.h>
15#include <linux/slab.h>
16
17#include <net/sock.h>
18#include <net/dst.h>
19#include <net/ip.h>
20#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
23#include <net/flow.h>
24
25#include <linux/interrupt.h>
26
27#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
30
31#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
39#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
40#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
41#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
45
46#ifdef CONFIG_XFRM_STATISTICS
47#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
49#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
50#else
51#define XFRM_INC_STATS(net, field) ((void)(net))
52#define XFRM_INC_STATS_BH(net, field) ((void)(net))
53#define XFRM_INC_STATS_USER(net, field) ((void)(net))
54#endif
55
56extern struct mutex xfrm_cfg_mutex;
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119struct xfrm_state_walk {
120 struct list_head all;
121 u8 state;
122 union {
123 u8 dying;
124 u8 proto;
125 };
126 u32 seq;
127};
128
129
130struct xfrm_state {
131#ifdef CONFIG_NET_NS
132 struct net *xs_net;
133#endif
134 union {
135 struct hlist_node gclist;
136 struct hlist_node bydst;
137 };
138 struct hlist_node bysrc;
139 struct hlist_node byspi;
140
141 atomic_t refcnt;
142 spinlock_t lock;
143
144 struct xfrm_id id;
145 struct xfrm_selector sel;
146 struct xfrm_mark mark;
147 u32 tfcpad;
148
149 u32 genid;
150
151
152 struct xfrm_state_walk km;
153
154
155 struct {
156 u32 reqid;
157 u8 mode;
158 u8 replay_window;
159 u8 aalgo, ealgo, calgo;
160 u8 flags;
161 u16 family;
162 xfrm_address_t saddr;
163 int header_len;
164 int trailer_len;
165 u32 extra_flags;
166 } props;
167
168 struct xfrm_lifetime_cfg lft;
169
170
171 struct xfrm_algo_auth *aalg;
172 struct xfrm_algo *ealg;
173 struct xfrm_algo *calg;
174 struct xfrm_algo_aead *aead;
175
176
177 struct xfrm_encap_tmpl *encap;
178
179
180 xfrm_address_t *coaddr;
181
182
183 struct xfrm_state *tunnel;
184
185
186 atomic_t tunnel_users;
187
188
189 struct xfrm_replay_state replay;
190 struct xfrm_replay_state_esn *replay_esn;
191
192
193 struct xfrm_replay_state preplay;
194 struct xfrm_replay_state_esn *preplay_esn;
195
196
197 struct xfrm_replay *repl;
198
199
200
201
202 u32 xflags;
203
204
205 u32 replay_maxage;
206 u32 replay_maxdiff;
207
208
209 struct timer_list rtimer;
210
211
212 struct xfrm_stats stats;
213
214 struct xfrm_lifetime_cur curlft;
215 struct tasklet_hrtimer mtimer;
216
217
218 long saved_tmo;
219
220
221 unsigned long lastused;
222
223
224
225 const struct xfrm_type *type;
226 struct xfrm_mode *inner_mode;
227 struct xfrm_mode *inner_mode_iaf;
228 struct xfrm_mode *outer_mode;
229
230
231 struct xfrm_sec_ctx *security;
232
233
234
235 void *data;
236};
237
238static inline struct net *xs_net(struct xfrm_state *x)
239{
240 return read_pnet(&x->xs_net);
241}
242
243
244#define XFRM_TIME_DEFER 1
245#define XFRM_SOFT_EXPIRE 2
246
247enum {
248 XFRM_STATE_VOID,
249 XFRM_STATE_ACQ,
250 XFRM_STATE_VALID,
251 XFRM_STATE_ERROR,
252 XFRM_STATE_EXPIRED,
253 XFRM_STATE_DEAD
254};
255
256
257struct km_event {
258 union {
259 u32 hard;
260 u32 proto;
261 u32 byid;
262 u32 aevent;
263 u32 type;
264 } data;
265
266 u32 seq;
267 u32 portid;
268 u32 event;
269 struct net *net;
270};
271
272struct xfrm_replay {
273 void (*advance)(struct xfrm_state *x, __be32 net_seq);
274 int (*check)(struct xfrm_state *x,
275 struct sk_buff *skb,
276 __be32 net_seq);
277 int (*recheck)(struct xfrm_state *x,
278 struct sk_buff *skb,
279 __be32 net_seq);
280 void (*notify)(struct xfrm_state *x, int event);
281 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
282};
283
284struct net_device;
285struct xfrm_type;
286struct xfrm_dst;
287struct xfrm_policy_afinfo {
288 unsigned short family;
289 struct dst_ops *dst_ops;
290 void (*garbage_collect)(struct net *net);
291 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
292 const xfrm_address_t *saddr,
293 const xfrm_address_t *daddr);
294 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
295 void (*decode_session)(struct sk_buff *skb,
296 struct flowi *fl,
297 int reverse);
298 int (*get_tos)(const struct flowi *fl);
299 void (*init_dst)(struct net *net,
300 struct xfrm_dst *dst);
301 int (*init_path)(struct xfrm_dst *path,
302 struct dst_entry *dst,
303 int nfheader_len);
304 int (*fill_dst)(struct xfrm_dst *xdst,
305 struct net_device *dev,
306 const struct flowi *fl);
307 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
308};
309
310extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
311extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
312extern void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c);
313extern void km_state_notify(struct xfrm_state *x, const struct km_event *c);
314
315struct xfrm_tmpl;
316extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
317extern void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
318extern int __xfrm_state_delete(struct xfrm_state *x);
319
320struct xfrm_state_afinfo {
321 unsigned int family;
322 unsigned int proto;
323 __be16 eth_proto;
324 struct module *owner;
325 const struct xfrm_type *type_map[IPPROTO_MAX];
326 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
327 int (*init_flags)(struct xfrm_state *x);
328 void (*init_tempsel)(struct xfrm_selector *sel,
329 const struct flowi *fl);
330 void (*init_temprop)(struct xfrm_state *x,
331 const struct xfrm_tmpl *tmpl,
332 const xfrm_address_t *daddr,
333 const xfrm_address_t *saddr);
334 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
335 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
336 int (*output)(struct sk_buff *skb);
337 int (*output_finish)(struct sk_buff *skb);
338 int (*extract_input)(struct xfrm_state *x,
339 struct sk_buff *skb);
340 int (*extract_output)(struct xfrm_state *x,
341 struct sk_buff *skb);
342 int (*transport_finish)(struct sk_buff *skb,
343 int async);
344};
345
346extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
347extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
348
349extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
350
351struct xfrm_type {
352 char *description;
353 struct module *owner;
354 u8 proto;
355 u8 flags;
356#define XFRM_TYPE_NON_FRAGMENT 1
357#define XFRM_TYPE_REPLAY_PROT 2
358#define XFRM_TYPE_LOCAL_COADDR 4
359#define XFRM_TYPE_REMOTE_COADDR 8
360
361 int (*init_state)(struct xfrm_state *x);
362 void (*destructor)(struct xfrm_state *);
363 int (*input)(struct xfrm_state *, struct sk_buff *skb);
364 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
365 int (*reject)(struct xfrm_state *, struct sk_buff *,
366 const struct flowi *);
367 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
368
369 u32 (*get_mtu)(struct xfrm_state *, int size);
370};
371
372extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
373extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
374
375struct xfrm_mode {
376
377
378
379
380
381
382
383
384
385
386
387 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
388
389
390
391
392
393
394
395
396
397 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
398
399
400
401
402
403
404
405
406
407
408
409
410 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
411
412
413
414
415
416
417
418
419
420
421 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
422
423 struct xfrm_state_afinfo *afinfo;
424 struct module *owner;
425 unsigned int encap;
426 int flags;
427};
428
429
430enum {
431 XFRM_MODE_FLAG_TUNNEL = 1,
432};
433
434extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
435extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
436
437static inline int xfrm_af2proto(unsigned int family)
438{
439 switch(family) {
440 case AF_INET:
441 return IPPROTO_IPIP;
442 case AF_INET6:
443 return IPPROTO_IPV6;
444 default:
445 return 0;
446 }
447}
448
449static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
450{
451 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
452 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
453 return x->inner_mode;
454 else
455 return x->inner_mode_iaf;
456}
457
458struct xfrm_tmpl {
459
460
461
462
463
464
465 struct xfrm_id id;
466
467
468 xfrm_address_t saddr;
469
470 unsigned short encap_family;
471
472 u32 reqid;
473
474
475 u8 mode;
476
477
478 u8 share;
479
480
481 u8 optional;
482
483
484 u8 allalgs;
485
486
487 u32 aalgos;
488 u32 ealgos;
489 u32 calgos;
490};
491
492#define XFRM_MAX_DEPTH 6
493
494struct xfrm_policy_walk_entry {
495 struct list_head all;
496 u8 dead;
497};
498
499struct xfrm_policy_walk {
500 struct xfrm_policy_walk_entry walk;
501 u8 type;
502 u32 seq;
503};
504
505struct xfrm_policy_queue {
506 struct sk_buff_head hold_queue;
507 struct timer_list hold_timer;
508 unsigned long timeout;
509};
510
511struct xfrm_policy {
512#ifdef CONFIG_NET_NS
513 struct net *xp_net;
514#endif
515 struct hlist_node bydst;
516 struct hlist_node byidx;
517
518
519 rwlock_t lock;
520 atomic_t refcnt;
521 struct timer_list timer;
522
523 struct flow_cache_object flo;
524 atomic_t genid;
525 u32 priority;
526 u32 index;
527 struct xfrm_mark mark;
528 struct xfrm_selector selector;
529 struct xfrm_lifetime_cfg lft;
530 struct xfrm_lifetime_cur curlft;
531 struct xfrm_policy_walk_entry walk;
532 struct xfrm_policy_queue polq;
533 u8 type;
534 u8 action;
535 u8 flags;
536 u8 xfrm_nr;
537 u16 family;
538 struct xfrm_sec_ctx *security;
539 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
540};
541
542static inline struct net *xp_net(const struct xfrm_policy *xp)
543{
544 return read_pnet(&xp->xp_net);
545}
546
547struct xfrm_kmaddress {
548 xfrm_address_t local;
549 xfrm_address_t remote;
550 u32 reserved;
551 u16 family;
552};
553
554struct xfrm_migrate {
555 xfrm_address_t old_daddr;
556 xfrm_address_t old_saddr;
557 xfrm_address_t new_daddr;
558 xfrm_address_t new_saddr;
559 u8 proto;
560 u8 mode;
561 u16 reserved;
562 u32 reqid;
563 u16 old_family;
564 u16 new_family;
565};
566
567#define XFRM_KM_TIMEOUT 30
568
569#define XFRM_REPLAY_UPDATE XFRM_AE_CR
570#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
571
572
573#define XFRM_AE_ETIME 10
574
575#define XFRM_AE_ETH_M 10
576
577#define XFRM_AE_SEQT_SIZE 2
578
579struct xfrm_mgr {
580 struct list_head list;
581 char *id;
582 int (*notify)(struct xfrm_state *x, const struct km_event *c);
583 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
584 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
585 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
586 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
587 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
588 int (*migrate)(const struct xfrm_selector *sel,
589 u8 dir, u8 type,
590 const struct xfrm_migrate *m,
591 int num_bundles,
592 const struct xfrm_kmaddress *k);
593};
594
595extern int xfrm_register_km(struct xfrm_mgr *km);
596extern int xfrm_unregister_km(struct xfrm_mgr *km);
597
598
599
600
601
602
603struct xfrm_skb_cb {
604 union {
605 struct inet_skb_parm h4;
606 struct inet6_skb_parm h6;
607 } header;
608
609
610 union {
611 struct {
612 __u32 low;
613 __u32 hi;
614 } output;
615 struct {
616 __be32 low;
617 __be32 hi;
618 } input;
619 } seq;
620};
621
622#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
623
624
625
626
627
628struct xfrm_mode_skb_cb {
629 union {
630 struct inet_skb_parm h4;
631 struct inet6_skb_parm h6;
632 } header;
633
634
635 __be16 id;
636 __be16 frag_off;
637
638
639 u8 ihl;
640
641
642 u8 tos;
643
644
645 u8 ttl;
646
647
648 u8 protocol;
649
650
651 u8 optlen;
652
653
654 u8 flow_lbl[3];
655};
656
657#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
658
659
660
661
662
663struct xfrm_spi_skb_cb {
664 union {
665 struct inet_skb_parm h4;
666 struct inet6_skb_parm h6;
667 } header;
668
669 unsigned int daddroff;
670 unsigned int family;
671};
672
673#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
674
675
676struct xfrm_audit {
677 u32 secid;
678 kuid_t loginuid;
679 u32 sessionid;
680};
681
682#ifdef CONFIG_AUDITSYSCALL
683static inline struct audit_buffer *xfrm_audit_start(const char *op)
684{
685 struct audit_buffer *audit_buf = NULL;
686
687 if (audit_enabled == 0)
688 return NULL;
689 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
690 AUDIT_MAC_IPSEC_EVENT);
691 if (audit_buf == NULL)
692 return NULL;
693 audit_log_format(audit_buf, "op=%s", op);
694 return audit_buf;
695}
696
697static inline void xfrm_audit_helper_usrinfo(kuid_t auid, u32 ses, u32 secid,
698 struct audit_buffer *audit_buf)
699{
700 char *secctx;
701 u32 secctx_len;
702
703 audit_log_format(audit_buf, " auid=%u ses=%u",
704 from_kuid(&init_user_ns, auid), ses);
705 if (secid != 0 &&
706 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
707 audit_log_format(audit_buf, " subj=%s", secctx);
708 security_release_secctx(secctx, secctx_len);
709 } else
710 audit_log_task_context(audit_buf);
711}
712
713extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
714 kuid_t auid, u32 ses, u32 secid);
715extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
716 kuid_t auid, u32 ses, u32 secid);
717extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
718 kuid_t auid, u32 ses, u32 secid);
719extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
720 kuid_t auid, u32 ses, u32 secid);
721extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
722 struct sk_buff *skb);
723extern void xfrm_audit_state_replay(struct xfrm_state *x,
724 struct sk_buff *skb, __be32 net_seq);
725extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
726extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
727 __be32 net_spi, __be32 net_seq);
728extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
729 struct sk_buff *skb, u8 proto);
730#else
731
732static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
733 kuid_t auid, u32 ses, u32 secid)
734{
735}
736
737static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
738 kuid_t auid, u32 ses, u32 secid)
739{
740}
741
742static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
743 kuid_t auid, u32 ses, u32 secid)
744{
745}
746
747static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
748 kuid_t auid, u32 ses, u32 secid)
749{
750}
751
752static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
753 struct sk_buff *skb)
754{
755}
756
757static inline void xfrm_audit_state_replay(struct xfrm_state *x,
758 struct sk_buff *skb, __be32 net_seq)
759{
760}
761
762static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
763 u16 family)
764{
765}
766
767static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
768 __be32 net_spi, __be32 net_seq)
769{
770}
771
772static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
773 struct sk_buff *skb, u8 proto)
774{
775}
776#endif
777
778static inline void xfrm_pol_hold(struct xfrm_policy *policy)
779{
780 if (likely(policy != NULL))
781 atomic_inc(&policy->refcnt);
782}
783
784extern void xfrm_policy_destroy(struct xfrm_policy *policy);
785
786static inline void xfrm_pol_put(struct xfrm_policy *policy)
787{
788 if (atomic_dec_and_test(&policy->refcnt))
789 xfrm_policy_destroy(policy);
790}
791
792static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
793{
794 int i;
795 for (i = npols - 1; i >= 0; --i)
796 xfrm_pol_put(pols[i]);
797}
798
799extern void __xfrm_state_destroy(struct xfrm_state *);
800
801static inline void __xfrm_state_put(struct xfrm_state *x)
802{
803 atomic_dec(&x->refcnt);
804}
805
806static inline void xfrm_state_put(struct xfrm_state *x)
807{
808 if (atomic_dec_and_test(&x->refcnt))
809 __xfrm_state_destroy(x);
810}
811
812static inline void xfrm_state_hold(struct xfrm_state *x)
813{
814 atomic_inc(&x->refcnt);
815}
816
817static inline bool addr_match(const void *token1, const void *token2,
818 int prefixlen)
819{
820 const __be32 *a1 = token1;
821 const __be32 *a2 = token2;
822 int pdw;
823 int pbi;
824
825 pdw = prefixlen >> 5;
826 pbi = prefixlen & 0x1f;
827
828 if (pdw)
829 if (memcmp(a1, a2, pdw << 2))
830 return false;
831
832 if (pbi) {
833 __be32 mask;
834
835 mask = htonl((0xffffffff) << (32 - pbi));
836
837 if ((a1[pdw] ^ a2[pdw]) & mask)
838 return false;
839 }
840
841 return true;
842}
843
844static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
845{
846
847 if (prefixlen == 0)
848 return true;
849 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
850}
851
852static __inline__
853__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
854{
855 __be16 port;
856 switch(fl->flowi_proto) {
857 case IPPROTO_TCP:
858 case IPPROTO_UDP:
859 case IPPROTO_UDPLITE:
860 case IPPROTO_SCTP:
861 port = uli->ports.sport;
862 break;
863 case IPPROTO_ICMP:
864 case IPPROTO_ICMPV6:
865 port = htons(uli->icmpt.type);
866 break;
867 case IPPROTO_MH:
868 port = htons(uli->mht.type);
869 break;
870 case IPPROTO_GRE:
871 port = htons(ntohl(uli->gre_key) >> 16);
872 break;
873 default:
874 port = 0;
875 }
876 return port;
877}
878
879static __inline__
880__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
881{
882 __be16 port;
883 switch(fl->flowi_proto) {
884 case IPPROTO_TCP:
885 case IPPROTO_UDP:
886 case IPPROTO_UDPLITE:
887 case IPPROTO_SCTP:
888 port = uli->ports.dport;
889 break;
890 case IPPROTO_ICMP:
891 case IPPROTO_ICMPV6:
892 port = htons(uli->icmpt.code);
893 break;
894 case IPPROTO_GRE:
895 port = htons(ntohl(uli->gre_key) & 0xffff);
896 break;
897 default:
898 port = 0;
899 }
900 return port;
901}
902
903extern bool xfrm_selector_match(const struct xfrm_selector *sel,
904 const struct flowi *fl,
905 unsigned short family);
906
907#ifdef CONFIG_SECURITY_NETWORK_XFRM
908
909
910
911static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
912{
913 return ((!s1 && !s2) ||
914 (s1 && s2 &&
915 (s1->ctx_sid == s2->ctx_sid) &&
916 (s1->ctx_doi == s2->ctx_doi) &&
917 (s1->ctx_alg == s2->ctx_alg)));
918}
919#else
920static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
921{
922 return true;
923}
924#endif
925
926
927
928
929
930
931
932
933
934
935
936
937struct xfrm_dst {
938 union {
939 struct dst_entry dst;
940 struct rtable rt;
941 struct rt6_info rt6;
942 } u;
943 struct dst_entry *route;
944 struct flow_cache_object flo;
945 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
946 int num_pols, num_xfrms;
947#ifdef CONFIG_XFRM_SUB_POLICY
948 struct flowi *origin;
949 struct xfrm_selector *partner;
950#endif
951 u32 xfrm_genid;
952 u32 policy_genid;
953 u32 route_mtu_cached;
954 u32 child_mtu_cached;
955 u32 route_cookie;
956 u32 path_cookie;
957};
958
959#ifdef CONFIG_XFRM
960static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
961{
962 xfrm_pols_put(xdst->pols, xdst->num_pols);
963 dst_release(xdst->route);
964 if (likely(xdst->u.dst.xfrm))
965 xfrm_state_put(xdst->u.dst.xfrm);
966#ifdef CONFIG_XFRM_SUB_POLICY
967 kfree(xdst->origin);
968 xdst->origin = NULL;
969 kfree(xdst->partner);
970 xdst->partner = NULL;
971#endif
972}
973#endif
974
975extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
976
977struct sec_path {
978 atomic_t refcnt;
979 int len;
980 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
981};
982
983static inline int secpath_exists(struct sk_buff *skb)
984{
985#ifdef CONFIG_XFRM
986 return skb->sp != NULL;
987#else
988 return 0;
989#endif
990}
991
992static inline struct sec_path *
993secpath_get(struct sec_path *sp)
994{
995 if (sp)
996 atomic_inc(&sp->refcnt);
997 return sp;
998}
999
1000extern void __secpath_destroy(struct sec_path *sp);
1001
1002static inline void
1003secpath_put(struct sec_path *sp)
1004{
1005 if (sp && atomic_dec_and_test(&sp->refcnt))
1006 __secpath_destroy(sp);
1007}
1008
1009extern struct sec_path *secpath_dup(struct sec_path *src);
1010
1011static inline void
1012secpath_reset(struct sk_buff *skb)
1013{
1014#ifdef CONFIG_XFRM
1015 secpath_put(skb->sp);
1016 skb->sp = NULL;
1017#endif
1018}
1019
1020static inline int
1021xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1022{
1023 switch (family) {
1024 case AF_INET:
1025 return addr->a4 == 0;
1026 case AF_INET6:
1027 return ipv6_addr_any((struct in6_addr *)&addr->a6);
1028 }
1029 return 0;
1030}
1031
1032static inline int
1033__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1034{
1035 return (tmpl->saddr.a4 &&
1036 tmpl->saddr.a4 != x->props.saddr.a4);
1037}
1038
1039static inline int
1040__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1041{
1042 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1043 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1044}
1045
1046static inline int
1047xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1048{
1049 switch (family) {
1050 case AF_INET:
1051 return __xfrm4_state_addr_cmp(tmpl, x);
1052 case AF_INET6:
1053 return __xfrm6_state_addr_cmp(tmpl, x);
1054 }
1055 return !0;
1056}
1057
1058#ifdef CONFIG_XFRM
1059extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
1060
1061static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1062 struct sk_buff *skb,
1063 unsigned int family, int reverse)
1064{
1065 struct net *net = dev_net(skb->dev);
1066 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1067
1068 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1069 return __xfrm_policy_check(sk, ndir, skb, family);
1070
1071 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
1072 (skb_dst(skb)->flags & DST_NOPOLICY) ||
1073 __xfrm_policy_check(sk, ndir, skb, family);
1074}
1075
1076static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1077{
1078 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1079}
1080
1081static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1082{
1083 return xfrm_policy_check(sk, dir, skb, AF_INET);
1084}
1085
1086static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1087{
1088 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1089}
1090
1091static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1092 struct sk_buff *skb)
1093{
1094 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1095}
1096
1097static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1098 struct sk_buff *skb)
1099{
1100 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1101}
1102
1103extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1104 unsigned int family, int reverse);
1105
1106static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1107 unsigned int family)
1108{
1109 return __xfrm_decode_session(skb, fl, family, 0);
1110}
1111
1112static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1113 struct flowi *fl,
1114 unsigned int family)
1115{
1116 return __xfrm_decode_session(skb, fl, family, 1);
1117}
1118
1119extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1120
1121static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1122{
1123 struct net *net = dev_net(skb->dev);
1124
1125 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1126 (skb_dst(skb)->flags & DST_NOXFRM) ||
1127 __xfrm_route_forward(skb, family);
1128}
1129
1130static inline int xfrm4_route_forward(struct sk_buff *skb)
1131{
1132 return xfrm_route_forward(skb, AF_INET);
1133}
1134
1135static inline int xfrm6_route_forward(struct sk_buff *skb)
1136{
1137 return xfrm_route_forward(skb, AF_INET6);
1138}
1139
1140extern int __xfrm_sk_clone_policy(struct sock *sk);
1141
1142static inline int xfrm_sk_clone_policy(struct sock *sk)
1143{
1144 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1145 return __xfrm_sk_clone_policy(sk);
1146 return 0;
1147}
1148
1149extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1150
1151static inline void xfrm_sk_free_policy(struct sock *sk)
1152{
1153 if (unlikely(sk->sk_policy[0] != NULL)) {
1154 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1155 sk->sk_policy[0] = NULL;
1156 }
1157 if (unlikely(sk->sk_policy[1] != NULL)) {
1158 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1159 sk->sk_policy[1] = NULL;
1160 }
1161}
1162
1163extern void xfrm_garbage_collect(struct net *net);
1164
1165#else
1166
1167static inline void xfrm_sk_free_policy(struct sock *sk) {}
1168static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1169static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1170static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1171static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1172{
1173 return 1;
1174}
1175static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1176{
1177 return 1;
1178}
1179static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1180{
1181 return 1;
1182}
1183static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1184 struct flowi *fl,
1185 unsigned int family)
1186{
1187 return -ENOSYS;
1188}
1189static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1190 struct sk_buff *skb)
1191{
1192 return 1;
1193}
1194static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1195 struct sk_buff *skb)
1196{
1197 return 1;
1198}
1199static inline void xfrm_garbage_collect(struct net *net)
1200{
1201}
1202#endif
1203
1204static __inline__
1205xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1206{
1207 switch (family){
1208 case AF_INET:
1209 return (xfrm_address_t *)&fl->u.ip4.daddr;
1210 case AF_INET6:
1211 return (xfrm_address_t *)&fl->u.ip6.daddr;
1212 }
1213 return NULL;
1214}
1215
1216static __inline__
1217xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1218{
1219 switch (family){
1220 case AF_INET:
1221 return (xfrm_address_t *)&fl->u.ip4.saddr;
1222 case AF_INET6:
1223 return (xfrm_address_t *)&fl->u.ip6.saddr;
1224 }
1225 return NULL;
1226}
1227
1228static __inline__
1229void xfrm_flowi_addr_get(const struct flowi *fl,
1230 xfrm_address_t *saddr, xfrm_address_t *daddr,
1231 unsigned short family)
1232{
1233 switch(family) {
1234 case AF_INET:
1235 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1236 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1237 break;
1238 case AF_INET6:
1239 *(struct in6_addr *)saddr->a6 = fl->u.ip6.saddr;
1240 *(struct in6_addr *)daddr->a6 = fl->u.ip6.daddr;
1241 break;
1242 }
1243}
1244
1245static __inline__ int
1246__xfrm4_state_addr_check(const struct xfrm_state *x,
1247 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1248{
1249 if (daddr->a4 == x->id.daddr.a4 &&
1250 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1251 return 1;
1252 return 0;
1253}
1254
1255static __inline__ int
1256__xfrm6_state_addr_check(const struct xfrm_state *x,
1257 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1258{
1259 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1260 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1261 ipv6_addr_any((struct in6_addr *)saddr) ||
1262 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1263 return 1;
1264 return 0;
1265}
1266
1267static __inline__ int
1268xfrm_state_addr_check(const struct xfrm_state *x,
1269 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1270 unsigned short family)
1271{
1272 switch (family) {
1273 case AF_INET:
1274 return __xfrm4_state_addr_check(x, daddr, saddr);
1275 case AF_INET6:
1276 return __xfrm6_state_addr_check(x, daddr, saddr);
1277 }
1278 return 0;
1279}
1280
1281static __inline__ int
1282xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1283 unsigned short family)
1284{
1285 switch (family) {
1286 case AF_INET:
1287 return __xfrm4_state_addr_check(x,
1288 (const xfrm_address_t *)&fl->u.ip4.daddr,
1289 (const xfrm_address_t *)&fl->u.ip4.saddr);
1290 case AF_INET6:
1291 return __xfrm6_state_addr_check(x,
1292 (const xfrm_address_t *)&fl->u.ip6.daddr,
1293 (const xfrm_address_t *)&fl->u.ip6.saddr);
1294 }
1295 return 0;
1296}
1297
1298static inline int xfrm_state_kern(const struct xfrm_state *x)
1299{
1300 return atomic_read(&x->tunnel_users);
1301}
1302
1303static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1304{
1305 return (!userproto || proto == userproto ||
1306 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1307 proto == IPPROTO_ESP ||
1308 proto == IPPROTO_COMP)));
1309}
1310
1311
1312
1313
1314struct xfrm_algo_aead_info {
1315 u16 icv_truncbits;
1316};
1317
1318struct xfrm_algo_auth_info {
1319 u16 icv_truncbits;
1320 u16 icv_fullbits;
1321};
1322
1323struct xfrm_algo_encr_info {
1324 u16 blockbits;
1325 u16 defkeybits;
1326};
1327
1328struct xfrm_algo_comp_info {
1329 u16 threshold;
1330};
1331
1332struct xfrm_algo_desc {
1333 char *name;
1334 char *compat;
1335 u8 available:1;
1336 u8 pfkey_supported:1;
1337 union {
1338 struct xfrm_algo_aead_info aead;
1339 struct xfrm_algo_auth_info auth;
1340 struct xfrm_algo_encr_info encr;
1341 struct xfrm_algo_comp_info comp;
1342 } uinfo;
1343 struct sadb_alg desc;
1344};
1345
1346
1347struct xfrm_tunnel {
1348 int (*handler)(struct sk_buff *skb);
1349 int (*err_handler)(struct sk_buff *skb, u32 info);
1350
1351 struct xfrm_tunnel __rcu *next;
1352 int priority;
1353};
1354
1355struct xfrm6_tunnel {
1356 int (*handler)(struct sk_buff *skb);
1357 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1358 u8 type, u8 code, int offset, __be32 info);
1359 struct xfrm6_tunnel __rcu *next;
1360 int priority;
1361};
1362
1363extern void xfrm_init(void);
1364extern void xfrm4_init(void);
1365extern int xfrm_state_init(struct net *net);
1366extern void xfrm_state_fini(struct net *net);
1367extern void xfrm4_state_init(void);
1368#ifdef CONFIG_XFRM
1369extern int xfrm6_init(void);
1370extern void xfrm6_fini(void);
1371extern int xfrm6_state_init(void);
1372extern void xfrm6_state_fini(void);
1373#else
1374static inline int xfrm6_init(void)
1375{
1376 return 0;
1377}
1378static inline void xfrm6_fini(void)
1379{
1380 ;
1381}
1382#endif
1383
1384#ifdef CONFIG_XFRM_STATISTICS
1385extern int xfrm_proc_init(struct net *net);
1386extern void xfrm_proc_fini(struct net *net);
1387#endif
1388
1389extern int xfrm_sysctl_init(struct net *net);
1390#ifdef CONFIG_SYSCTL
1391extern void xfrm_sysctl_fini(struct net *net);
1392#else
1393static inline void xfrm_sysctl_fini(struct net *net)
1394{
1395}
1396#endif
1397
1398extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
1399extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1400 int (*func)(struct xfrm_state *, int, void*), void *);
1401extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
1402extern struct xfrm_state *xfrm_state_alloc(struct net *net);
1403extern struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1404 const xfrm_address_t *saddr,
1405 const struct flowi *fl,
1406 struct xfrm_tmpl *tmpl,
1407 struct xfrm_policy *pol, int *err,
1408 unsigned short family);
1409extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1410 xfrm_address_t *daddr,
1411 xfrm_address_t *saddr,
1412 unsigned short family,
1413 u8 mode, u8 proto, u32 reqid);
1414extern int xfrm_state_check_expire(struct xfrm_state *x);
1415extern void xfrm_state_insert(struct xfrm_state *x);
1416extern int xfrm_state_add(struct xfrm_state *x);
1417extern int xfrm_state_update(struct xfrm_state *x);
1418extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1419 const xfrm_address_t *daddr, __be32 spi,
1420 u8 proto, unsigned short family);
1421extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1422 const xfrm_address_t *daddr,
1423 const xfrm_address_t *saddr,
1424 u8 proto,
1425 unsigned short family);
1426#ifdef CONFIG_XFRM_SUB_POLICY
1427extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1428 int n, unsigned short family);
1429extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1430 int n, unsigned short family);
1431#else
1432static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1433 int n, unsigned short family)
1434{
1435 return -ENOSYS;
1436}
1437
1438static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1439 int n, unsigned short family)
1440{
1441 return -ENOSYS;
1442}
1443#endif
1444
1445struct xfrmk_sadinfo {
1446 u32 sadhcnt;
1447 u32 sadhmcnt;
1448 u32 sadcnt;
1449};
1450
1451struct xfrmk_spdinfo {
1452 u32 incnt;
1453 u32 outcnt;
1454 u32 fwdcnt;
1455 u32 inscnt;
1456 u32 outscnt;
1457 u32 fwdscnt;
1458 u32 spdhcnt;
1459 u32 spdhmcnt;
1460};
1461
1462extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1463 u32 seq);
1464extern int xfrm_state_delete(struct xfrm_state *x);
1465extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
1466extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1467extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1468extern u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1469extern int xfrm_init_replay(struct xfrm_state *x);
1470extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1471extern int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1472extern int xfrm_init_state(struct xfrm_state *x);
1473extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1474extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1475 int encap_type);
1476extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1477extern int xfrm_output_resume(struct sk_buff *skb, int err);
1478extern int xfrm_output(struct sk_buff *skb);
1479extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1480extern int xfrm4_extract_header(struct sk_buff *skb);
1481extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1482extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1483 int encap_type);
1484extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
1485extern int xfrm4_rcv(struct sk_buff *skb);
1486
1487static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1488{
1489 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1490}
1491
1492extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1493extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1494extern int xfrm4_output(struct sk_buff *skb);
1495extern int xfrm4_output_finish(struct sk_buff *skb);
1496extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1497extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1498extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
1499extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
1500extern int xfrm6_extract_header(struct sk_buff *skb);
1501extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1502extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1503extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
1504extern int xfrm6_rcv(struct sk_buff *skb);
1505extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1506 xfrm_address_t *saddr, u8 proto);
1507extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1508extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1509extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1510extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1511extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1512extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1513extern int xfrm6_output(struct sk_buff *skb);
1514extern int xfrm6_output_finish(struct sk_buff *skb);
1515extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1516 u8 **prevhdr);
1517
1518#ifdef CONFIG_XFRM
1519extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1520extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
1521#else
1522static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1523{
1524 return -ENOPROTOOPT;
1525}
1526
1527static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1528{
1529
1530 kfree_skb(skb);
1531 return 0;
1532}
1533#endif
1534
1535struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1536
1537extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1538extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1539 int (*func)(struct xfrm_policy *, int, int, void*), void *);
1540extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
1541int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1542struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1543 u8 type, int dir,
1544 struct xfrm_selector *sel,
1545 struct xfrm_sec_ctx *ctx, int delete,
1546 int *err);
1547struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
1548int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
1549u32 xfrm_get_acqseq(void);
1550extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1551struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1552 u8 mode, u32 reqid, u8 proto,
1553 const xfrm_address_t *daddr,
1554 const xfrm_address_t *saddr, int create,
1555 unsigned short family);
1556extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1557
1558#ifdef CONFIG_XFRM_MIGRATE
1559extern int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1560 const struct xfrm_migrate *m, int num_bundles,
1561 const struct xfrm_kmaddress *k);
1562extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1563extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1564 struct xfrm_migrate *m);
1565extern int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1566 struct xfrm_migrate *m, int num_bundles,
1567 struct xfrm_kmaddress *k);
1568#endif
1569
1570extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1571extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1572extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
1573
1574extern void xfrm_input_init(void);
1575extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1576
1577extern void xfrm_probe_algs(void);
1578extern int xfrm_count_pfkey_auth_supported(void);
1579extern int xfrm_count_pfkey_enc_supported(void);
1580extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1581extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1582extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1583extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1584extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1585extern struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1586extern struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1587extern struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1588extern struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1589 int probe);
1590
1591static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1592 const xfrm_address_t *b)
1593{
1594 return ipv6_addr_equal((const struct in6_addr *)a,
1595 (const struct in6_addr *)b);
1596}
1597
1598static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1599 const xfrm_address_t *b,
1600 sa_family_t family)
1601{
1602 switch (family) {
1603 default:
1604 case AF_INET:
1605 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1606 case AF_INET6:
1607 return xfrm6_addr_equal(a, b);
1608 }
1609}
1610
1611static inline int xfrm_policy_id2dir(u32 index)
1612{
1613 return index & 7;
1614}
1615
1616#ifdef CONFIG_XFRM
1617static inline int xfrm_aevent_is_on(struct net *net)
1618{
1619 struct sock *nlsk;
1620 int ret = 0;
1621
1622 rcu_read_lock();
1623 nlsk = rcu_dereference(net->xfrm.nlsk);
1624 if (nlsk)
1625 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1626 rcu_read_unlock();
1627 return ret;
1628}
1629#endif
1630
1631static inline int xfrm_alg_len(const struct xfrm_algo *alg)
1632{
1633 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1634}
1635
1636static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1637{
1638 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1639}
1640
1641static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1642{
1643 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1644}
1645
1646#ifdef CONFIG_XFRM_MIGRATE
1647static inline int xfrm_replay_clone(struct xfrm_state *x,
1648 struct xfrm_state *orig)
1649{
1650 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1651 GFP_KERNEL);
1652 if (!x->replay_esn)
1653 return -ENOMEM;
1654
1655 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1656 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1657
1658 x->preplay_esn = kmemdup(x->replay_esn,
1659 xfrm_replay_state_esn_len(x->replay_esn),
1660 GFP_KERNEL);
1661 if (!x->preplay_esn) {
1662 kfree(x->replay_esn);
1663 return -ENOMEM;
1664 }
1665
1666 return 0;
1667}
1668
1669static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1670{
1671 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1672}
1673
1674static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1675{
1676 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1677}
1678
1679static inline void xfrm_states_put(struct xfrm_state **states, int n)
1680{
1681 int i;
1682 for (i = 0; i < n; i++)
1683 xfrm_state_put(*(states + i));
1684}
1685
1686static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1687{
1688 int i;
1689 for (i = 0; i < n; i++)
1690 xfrm_state_delete(*(states + i));
1691}
1692#endif
1693
1694#ifdef CONFIG_XFRM
1695static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1696{
1697 return skb->sp->xvec[skb->sp->len - 1];
1698}
1699#endif
1700
1701static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1702{
1703 if (attrs[XFRMA_MARK])
1704 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1705 else
1706 m->v = m->m = 0;
1707
1708 return m->v & m->m;
1709}
1710
1711static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1712{
1713 int ret = 0;
1714
1715 if (m->m | m->v)
1716 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1717 return ret;
1718}
1719
1720#endif
1721