1#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
4#include <linux/compiler.h>
5#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
9#include <linux/socket.h>
10#include <linux/pfkeyv2.h>
11#include <linux/ipsec.h>
12#include <linux/in6.h>
13#include <linux/mutex.h>
14#include <linux/audit.h>
15#include <linux/slab.h>
16
17#include <net/sock.h>
18#include <net/dst.h>
19#include <net/ip.h>
20#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
23#include <net/flow.h>
24
25#include <linux/interrupt.h>
26
27#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
30
31#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
39#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
40#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
41#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
45
46#ifdef CONFIG_XFRM_STATISTICS
47#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48#else
49#define XFRM_INC_STATS(net, field) ((void)(net))
50#endif
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114struct xfrm_state_walk {
115 struct list_head all;
116 u8 state;
117 u8 dying;
118 u8 proto;
119 u32 seq;
120 struct xfrm_address_filter *filter;
121};
122
123
124struct xfrm_state {
125 possible_net_t xs_net;
126 union {
127 struct hlist_node gclist;
128 struct hlist_node bydst;
129 };
130 struct hlist_node bysrc;
131 struct hlist_node byspi;
132
133 atomic_t refcnt;
134 spinlock_t lock;
135
136 struct xfrm_id id;
137 struct xfrm_selector sel;
138 struct xfrm_mark mark;
139 u32 tfcpad;
140
141 u32 genid;
142
143
144 struct xfrm_state_walk km;
145
146
147 struct {
148 u32 reqid;
149 u8 mode;
150 u8 replay_window;
151 u8 aalgo, ealgo, calgo;
152 u8 flags;
153 u16 family;
154 xfrm_address_t saddr;
155 int header_len;
156 int trailer_len;
157 u32 extra_flags;
158 } props;
159
160 struct xfrm_lifetime_cfg lft;
161
162
163 struct xfrm_algo_auth *aalg;
164 struct xfrm_algo *ealg;
165 struct xfrm_algo *calg;
166 struct xfrm_algo_aead *aead;
167 const char *geniv;
168
169
170 struct xfrm_encap_tmpl *encap;
171
172
173 xfrm_address_t *coaddr;
174
175
176 struct xfrm_state *tunnel;
177
178
179 atomic_t tunnel_users;
180
181
182 struct xfrm_replay_state replay;
183 struct xfrm_replay_state_esn *replay_esn;
184
185
186 struct xfrm_replay_state preplay;
187 struct xfrm_replay_state_esn *preplay_esn;
188
189
190 struct xfrm_replay *repl;
191
192
193
194
195 u32 xflags;
196
197
198 u32 replay_maxage;
199 u32 replay_maxdiff;
200
201
202 struct timer_list rtimer;
203
204
205 struct xfrm_stats stats;
206
207 struct xfrm_lifetime_cur curlft;
208 struct tasklet_hrtimer mtimer;
209
210
211 long saved_tmo;
212
213
214 unsigned long lastused;
215
216
217
218 const struct xfrm_type *type;
219 struct xfrm_mode *inner_mode;
220 struct xfrm_mode *inner_mode_iaf;
221 struct xfrm_mode *outer_mode;
222
223
224 struct xfrm_sec_ctx *security;
225
226
227
228 void *data;
229};
230
231static inline struct net *xs_net(struct xfrm_state *x)
232{
233 return read_pnet(&x->xs_net);
234}
235
236
237#define XFRM_TIME_DEFER 1
238#define XFRM_SOFT_EXPIRE 2
239
240enum {
241 XFRM_STATE_VOID,
242 XFRM_STATE_ACQ,
243 XFRM_STATE_VALID,
244 XFRM_STATE_ERROR,
245 XFRM_STATE_EXPIRED,
246 XFRM_STATE_DEAD
247};
248
249
250struct km_event {
251 union {
252 u32 hard;
253 u32 proto;
254 u32 byid;
255 u32 aevent;
256 u32 type;
257 } data;
258
259 u32 seq;
260 u32 portid;
261 u32 event;
262 struct net *net;
263};
264
265struct xfrm_replay {
266 void (*advance)(struct xfrm_state *x, __be32 net_seq);
267 int (*check)(struct xfrm_state *x,
268 struct sk_buff *skb,
269 __be32 net_seq);
270 int (*recheck)(struct xfrm_state *x,
271 struct sk_buff *skb,
272 __be32 net_seq);
273 void (*notify)(struct xfrm_state *x, int event);
274 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
275};
276
277struct net_device;
278struct xfrm_type;
279struct xfrm_dst;
280struct xfrm_policy_afinfo {
281 unsigned short family;
282 struct dst_ops *dst_ops;
283 void (*garbage_collect)(struct net *net);
284 struct dst_entry *(*dst_lookup)(struct net *net,
285 int tos, int oif,
286 const xfrm_address_t *saddr,
287 const xfrm_address_t *daddr);
288 int (*get_saddr)(struct net *net, int oif,
289 xfrm_address_t *saddr,
290 xfrm_address_t *daddr);
291 void (*decode_session)(struct sk_buff *skb,
292 struct flowi *fl,
293 int reverse);
294 int (*get_tos)(const struct flowi *fl);
295 int (*init_path)(struct xfrm_dst *path,
296 struct dst_entry *dst,
297 int nfheader_len);
298 int (*fill_dst)(struct xfrm_dst *xdst,
299 struct net_device *dev,
300 const struct flowi *fl);
301 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
302};
303
304int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
305int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
306void km_policy_notify(struct xfrm_policy *xp, int dir,
307 const struct km_event *c);
308void km_state_notify(struct xfrm_state *x, const struct km_event *c);
309
310struct xfrm_tmpl;
311int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
312 struct xfrm_policy *pol);
313void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
314int __xfrm_state_delete(struct xfrm_state *x);
315
316struct xfrm_state_afinfo {
317 unsigned int family;
318 unsigned int proto;
319 __be16 eth_proto;
320 struct module *owner;
321 const struct xfrm_type *type_map[IPPROTO_MAX];
322 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
323 int (*init_flags)(struct xfrm_state *x);
324 void (*init_tempsel)(struct xfrm_selector *sel,
325 const struct flowi *fl);
326 void (*init_temprop)(struct xfrm_state *x,
327 const struct xfrm_tmpl *tmpl,
328 const xfrm_address_t *daddr,
329 const xfrm_address_t *saddr);
330 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
331 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
332 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
333 int (*output_finish)(struct sock *sk, struct sk_buff *skb);
334 int (*extract_input)(struct xfrm_state *x,
335 struct sk_buff *skb);
336 int (*extract_output)(struct xfrm_state *x,
337 struct sk_buff *skb);
338 int (*transport_finish)(struct sk_buff *skb,
339 int async);
340 void (*local_error)(struct sk_buff *skb, u32 mtu);
341};
342
343int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
344int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
345struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
346void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
347
348struct xfrm_input_afinfo {
349 unsigned int family;
350 struct module *owner;
351 int (*callback)(struct sk_buff *skb, u8 protocol,
352 int err);
353};
354
355int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
356int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);
357
358void xfrm_state_delete_tunnel(struct xfrm_state *x);
359
360struct xfrm_type {
361 char *description;
362 struct module *owner;
363 u8 proto;
364 u8 flags;
365#define XFRM_TYPE_NON_FRAGMENT 1
366#define XFRM_TYPE_REPLAY_PROT 2
367#define XFRM_TYPE_LOCAL_COADDR 4
368#define XFRM_TYPE_REMOTE_COADDR 8
369
370 int (*init_state)(struct xfrm_state *x);
371 void (*destructor)(struct xfrm_state *);
372 int (*input)(struct xfrm_state *, struct sk_buff *skb);
373 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
374 int (*reject)(struct xfrm_state *, struct sk_buff *,
375 const struct flowi *);
376 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
377
378 u32 (*get_mtu)(struct xfrm_state *, int size);
379};
380
381int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
382int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
383
384struct xfrm_mode {
385
386
387
388
389
390
391
392
393
394
395
396 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
397
398
399
400
401
402
403
404
405
406 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
407
408
409
410
411
412
413
414
415
416
417
418
419 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
420
421
422
423
424
425
426
427
428
429
430 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
431
432 struct xfrm_state_afinfo *afinfo;
433 struct module *owner;
434 unsigned int encap;
435 int flags;
436};
437
438
439enum {
440 XFRM_MODE_FLAG_TUNNEL = 1,
441};
442
443int xfrm_register_mode(struct xfrm_mode *mode, int family);
444int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
445
446static inline int xfrm_af2proto(unsigned int family)
447{
448 switch(family) {
449 case AF_INET:
450 return IPPROTO_IPIP;
451 case AF_INET6:
452 return IPPROTO_IPV6;
453 default:
454 return 0;
455 }
456}
457
458static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
459{
460 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
461 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
462 return x->inner_mode;
463 else
464 return x->inner_mode_iaf;
465}
466
467struct xfrm_tmpl {
468
469
470
471
472
473
474 struct xfrm_id id;
475
476
477 xfrm_address_t saddr;
478
479 unsigned short encap_family;
480
481 u32 reqid;
482
483
484 u8 mode;
485
486
487 u8 share;
488
489
490 u8 optional;
491
492
493 u8 allalgs;
494
495
496 u32 aalgos;
497 u32 ealgos;
498 u32 calgos;
499};
500
501#define XFRM_MAX_DEPTH 6
502
503struct xfrm_policy_walk_entry {
504 struct list_head all;
505 u8 dead;
506};
507
508struct xfrm_policy_walk {
509 struct xfrm_policy_walk_entry walk;
510 u8 type;
511 u32 seq;
512};
513
514struct xfrm_policy_queue {
515 struct sk_buff_head hold_queue;
516 struct timer_list hold_timer;
517 unsigned long timeout;
518};
519
520struct xfrm_policy {
521 possible_net_t xp_net;
522 struct hlist_node bydst;
523 struct hlist_node byidx;
524
525
526 rwlock_t lock;
527 atomic_t refcnt;
528 struct timer_list timer;
529
530 struct flow_cache_object flo;
531 atomic_t genid;
532 u32 priority;
533 u32 index;
534 struct xfrm_mark mark;
535 struct xfrm_selector selector;
536 struct xfrm_lifetime_cfg lft;
537 struct xfrm_lifetime_cur curlft;
538 struct xfrm_policy_walk_entry walk;
539 struct xfrm_policy_queue polq;
540 u8 type;
541 u8 action;
542 u8 flags;
543 u8 xfrm_nr;
544 u16 family;
545 struct xfrm_sec_ctx *security;
546 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
547 struct rcu_head rcu;
548};
549
550static inline struct net *xp_net(const struct xfrm_policy *xp)
551{
552 return read_pnet(&xp->xp_net);
553}
554
555struct xfrm_kmaddress {
556 xfrm_address_t local;
557 xfrm_address_t remote;
558 u32 reserved;
559 u16 family;
560};
561
562struct xfrm_migrate {
563 xfrm_address_t old_daddr;
564 xfrm_address_t old_saddr;
565 xfrm_address_t new_daddr;
566 xfrm_address_t new_saddr;
567 u8 proto;
568 u8 mode;
569 u16 reserved;
570 u32 reqid;
571 u16 old_family;
572 u16 new_family;
573};
574
575#define XFRM_KM_TIMEOUT 30
576
577#define XFRM_REPLAY_UPDATE XFRM_AE_CR
578#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
579
580
581#define XFRM_AE_ETIME 10
582
583#define XFRM_AE_ETH_M 10
584
585#define XFRM_AE_SEQT_SIZE 2
586
587struct xfrm_mgr {
588 struct list_head list;
589 char *id;
590 int (*notify)(struct xfrm_state *x, const struct km_event *c);
591 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
592 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
593 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
594 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
595 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
596 int (*migrate)(const struct xfrm_selector *sel,
597 u8 dir, u8 type,
598 const struct xfrm_migrate *m,
599 int num_bundles,
600 const struct xfrm_kmaddress *k);
601 bool (*is_alive)(const struct km_event *c);
602};
603
604int xfrm_register_km(struct xfrm_mgr *km);
605int xfrm_unregister_km(struct xfrm_mgr *km);
606
607struct xfrm_tunnel_skb_cb {
608 union {
609 struct inet_skb_parm h4;
610 struct inet6_skb_parm h6;
611 } header;
612
613 union {
614 struct ip_tunnel *ip4;
615 struct ip6_tnl *ip6;
616 } tunnel;
617};
618
619#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
620
621
622
623
624
625
626struct xfrm_skb_cb {
627 struct xfrm_tunnel_skb_cb header;
628
629
630 union {
631 struct {
632 __u32 low;
633 __u32 hi;
634 } output;
635 struct {
636 __be32 low;
637 __be32 hi;
638 } input;
639 } seq;
640};
641
642#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
643
644
645
646
647
648struct xfrm_mode_skb_cb {
649 struct xfrm_tunnel_skb_cb header;
650
651
652 __be16 id;
653 __be16 frag_off;
654
655
656 u8 ihl;
657
658
659 u8 tos;
660
661
662 u8 ttl;
663
664
665 u8 protocol;
666
667
668 u8 optlen;
669
670
671 u8 flow_lbl[3];
672};
673
674#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
675
676
677
678
679
680struct xfrm_spi_skb_cb {
681 struct xfrm_tunnel_skb_cb header;
682
683 unsigned int daddroff;
684 unsigned int family;
685};
686
687#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
688
689#ifdef CONFIG_AUDITSYSCALL
690static inline struct audit_buffer *xfrm_audit_start(const char *op)
691{
692 struct audit_buffer *audit_buf = NULL;
693
694 if (audit_enabled == 0)
695 return NULL;
696 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
697 AUDIT_MAC_IPSEC_EVENT);
698 if (audit_buf == NULL)
699 return NULL;
700 audit_log_format(audit_buf, "op=%s", op);
701 return audit_buf;
702}
703
704static inline void xfrm_audit_helper_usrinfo(bool task_valid,
705 struct audit_buffer *audit_buf)
706{
707 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
708 audit_get_loginuid(current) :
709 INVALID_UID);
710 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
711 (unsigned int) -1;
712
713 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
714 audit_log_task_context(audit_buf);
715}
716
717void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
718void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
719 bool task_valid);
720void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
721void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
722void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
723 struct sk_buff *skb);
724void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
725 __be32 net_seq);
726void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
727void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
728 __be32 net_seq);
729void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
730 u8 proto);
731#else
732
733static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
734 bool task_valid)
735{
736}
737
738static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
739 bool task_valid)
740{
741}
742
743static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
744 bool task_valid)
745{
746}
747
748static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
749 bool task_valid)
750{
751}
752
753static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
754 struct sk_buff *skb)
755{
756}
757
758static inline void xfrm_audit_state_replay(struct xfrm_state *x,
759 struct sk_buff *skb, __be32 net_seq)
760{
761}
762
763static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
764 u16 family)
765{
766}
767
768static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
769 __be32 net_spi, __be32 net_seq)
770{
771}
772
773static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
774 struct sk_buff *skb, u8 proto)
775{
776}
777#endif
778
779static inline void xfrm_pol_hold(struct xfrm_policy *policy)
780{
781 if (likely(policy != NULL))
782 atomic_inc(&policy->refcnt);
783}
784
785void xfrm_policy_destroy(struct xfrm_policy *policy);
786
787static inline void xfrm_pol_put(struct xfrm_policy *policy)
788{
789 if (atomic_dec_and_test(&policy->refcnt))
790 xfrm_policy_destroy(policy);
791}
792
793static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
794{
795 int i;
796 for (i = npols - 1; i >= 0; --i)
797 xfrm_pol_put(pols[i]);
798}
799
800void __xfrm_state_destroy(struct xfrm_state *);
801
802static inline void __xfrm_state_put(struct xfrm_state *x)
803{
804 atomic_dec(&x->refcnt);
805}
806
807static inline void xfrm_state_put(struct xfrm_state *x)
808{
809 if (atomic_dec_and_test(&x->refcnt))
810 __xfrm_state_destroy(x);
811}
812
813static inline void xfrm_state_hold(struct xfrm_state *x)
814{
815 atomic_inc(&x->refcnt);
816}
817
818static inline bool addr_match(const void *token1, const void *token2,
819 int prefixlen)
820{
821 const __be32 *a1 = token1;
822 const __be32 *a2 = token2;
823 int pdw;
824 int pbi;
825
826 pdw = prefixlen >> 5;
827 pbi = prefixlen & 0x1f;
828
829 if (pdw)
830 if (memcmp(a1, a2, pdw << 2))
831 return false;
832
833 if (pbi) {
834 __be32 mask;
835
836 mask = htonl((0xffffffff) << (32 - pbi));
837
838 if ((a1[pdw] ^ a2[pdw]) & mask)
839 return false;
840 }
841
842 return true;
843}
844
845static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
846{
847
848 if (prefixlen == 0)
849 return true;
850 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
851}
852
853static __inline__
854__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
855{
856 __be16 port;
857 switch(fl->flowi_proto) {
858 case IPPROTO_TCP:
859 case IPPROTO_UDP:
860 case IPPROTO_UDPLITE:
861 case IPPROTO_SCTP:
862 port = uli->ports.sport;
863 break;
864 case IPPROTO_ICMP:
865 case IPPROTO_ICMPV6:
866 port = htons(uli->icmpt.type);
867 break;
868 case IPPROTO_MH:
869 port = htons(uli->mht.type);
870 break;
871 case IPPROTO_GRE:
872 port = htons(ntohl(uli->gre_key) >> 16);
873 break;
874 default:
875 port = 0;
876 }
877 return port;
878}
879
880static __inline__
881__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
882{
883 __be16 port;
884 switch(fl->flowi_proto) {
885 case IPPROTO_TCP:
886 case IPPROTO_UDP:
887 case IPPROTO_UDPLITE:
888 case IPPROTO_SCTP:
889 port = uli->ports.dport;
890 break;
891 case IPPROTO_ICMP:
892 case IPPROTO_ICMPV6:
893 port = htons(uli->icmpt.code);
894 break;
895 case IPPROTO_GRE:
896 port = htons(ntohl(uli->gre_key) & 0xffff);
897 break;
898 default:
899 port = 0;
900 }
901 return port;
902}
903
904bool xfrm_selector_match(const struct xfrm_selector *sel,
905 const struct flowi *fl, unsigned short family);
906
907#ifdef CONFIG_SECURITY_NETWORK_XFRM
908
909
910
911static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
912{
913 return ((!s1 && !s2) ||
914 (s1 && s2 &&
915 (s1->ctx_sid == s2->ctx_sid) &&
916 (s1->ctx_doi == s2->ctx_doi) &&
917 (s1->ctx_alg == s2->ctx_alg)));
918}
919#else
920static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
921{
922 return true;
923}
924#endif
925
926
927
928
929
930
931
932
933
934
935
936
937struct xfrm_dst {
938 union {
939 struct dst_entry dst;
940 struct rtable rt;
941 struct rt6_info rt6;
942 } u;
943 struct dst_entry *route;
944 struct flow_cache_object flo;
945 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
946 int num_pols, num_xfrms;
947#ifdef CONFIG_XFRM_SUB_POLICY
948 struct flowi *origin;
949 struct xfrm_selector *partner;
950#endif
951 u32 xfrm_genid;
952 u32 policy_genid;
953 u32 route_mtu_cached;
954 u32 child_mtu_cached;
955 u32 route_cookie;
956 u32 path_cookie;
957};
958
959#ifdef CONFIG_XFRM
960static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
961{
962 xfrm_pols_put(xdst->pols, xdst->num_pols);
963 dst_release(xdst->route);
964 if (likely(xdst->u.dst.xfrm))
965 xfrm_state_put(xdst->u.dst.xfrm);
966#ifdef CONFIG_XFRM_SUB_POLICY
967 kfree(xdst->origin);
968 xdst->origin = NULL;
969 kfree(xdst->partner);
970 xdst->partner = NULL;
971#endif
972}
973#endif
974
975void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
976
977struct sec_path {
978 atomic_t refcnt;
979 int len;
980 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
981};
982
983static inline int secpath_exists(struct sk_buff *skb)
984{
985#ifdef CONFIG_XFRM
986 return skb->sp != NULL;
987#else
988 return 0;
989#endif
990}
991
992static inline struct sec_path *
993secpath_get(struct sec_path *sp)
994{
995 if (sp)
996 atomic_inc(&sp->refcnt);
997 return sp;
998}
999
1000void __secpath_destroy(struct sec_path *sp);
1001
1002static inline void
1003secpath_put(struct sec_path *sp)
1004{
1005 if (sp && atomic_dec_and_test(&sp->refcnt))
1006 __secpath_destroy(sp);
1007}
1008
1009struct sec_path *secpath_dup(struct sec_path *src);
1010
1011static inline void
1012secpath_reset(struct sk_buff *skb)
1013{
1014#ifdef CONFIG_XFRM
1015 secpath_put(skb->sp);
1016 skb->sp = NULL;
1017#endif
1018}
1019
1020static inline int
1021xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1022{
1023 switch (family) {
1024 case AF_INET:
1025 return addr->a4 == 0;
1026 case AF_INET6:
1027 return ipv6_addr_any(&addr->in6);
1028 }
1029 return 0;
1030}
1031
1032static inline int
1033__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1034{
1035 return (tmpl->saddr.a4 &&
1036 tmpl->saddr.a4 != x->props.saddr.a4);
1037}
1038
1039static inline int
1040__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1041{
1042 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1043 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1044}
1045
1046static inline int
1047xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1048{
1049 switch (family) {
1050 case AF_INET:
1051 return __xfrm4_state_addr_cmp(tmpl, x);
1052 case AF_INET6:
1053 return __xfrm6_state_addr_cmp(tmpl, x);
1054 }
1055 return !0;
1056}
1057
1058#ifdef CONFIG_XFRM
1059int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1060 unsigned short family);
1061
1062static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1063 struct sk_buff *skb,
1064 unsigned int family, int reverse)
1065{
1066 struct net *net = dev_net(skb->dev);
1067 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1068
1069 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1070 return __xfrm_policy_check(sk, ndir, skb, family);
1071
1072 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
1073 (skb_dst(skb)->flags & DST_NOPOLICY) ||
1074 __xfrm_policy_check(sk, ndir, skb, family);
1075}
1076
1077static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1078{
1079 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1080}
1081
1082static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1083{
1084 return xfrm_policy_check(sk, dir, skb, AF_INET);
1085}
1086
1087static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1088{
1089 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1090}
1091
1092static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1093 struct sk_buff *skb)
1094{
1095 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1096}
1097
1098static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1099 struct sk_buff *skb)
1100{
1101 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1102}
1103
1104int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1105 unsigned int family, int reverse);
1106
1107static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1108 unsigned int family)
1109{
1110 return __xfrm_decode_session(skb, fl, family, 0);
1111}
1112
1113static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1114 struct flowi *fl,
1115 unsigned int family)
1116{
1117 return __xfrm_decode_session(skb, fl, family, 1);
1118}
1119
1120int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1121
1122static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1123{
1124 struct net *net = dev_net(skb->dev);
1125
1126 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1127 (skb_dst(skb)->flags & DST_NOXFRM) ||
1128 __xfrm_route_forward(skb, family);
1129}
1130
1131static inline int xfrm4_route_forward(struct sk_buff *skb)
1132{
1133 return xfrm_route_forward(skb, AF_INET);
1134}
1135
1136static inline int xfrm6_route_forward(struct sk_buff *skb)
1137{
1138 return xfrm_route_forward(skb, AF_INET6);
1139}
1140
1141int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1142
1143static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1144{
1145 sk->sk_policy[0] = NULL;
1146 sk->sk_policy[1] = NULL;
1147 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1148 return __xfrm_sk_clone_policy(sk, osk);
1149 return 0;
1150}
1151
1152int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1153
1154static inline void xfrm_sk_free_policy(struct sock *sk)
1155{
1156 struct xfrm_policy *pol;
1157
1158 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1159 if (unlikely(pol != NULL)) {
1160 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1161 sk->sk_policy[0] = NULL;
1162 }
1163 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1164 if (unlikely(pol != NULL)) {
1165 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1166 sk->sk_policy[1] = NULL;
1167 }
1168}
1169
1170void xfrm_garbage_collect(struct net *net);
1171
1172#else
1173
1174static inline void xfrm_sk_free_policy(struct sock *sk) {}
1175static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1176static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1177static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1178static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1179{
1180 return 1;
1181}
1182static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1183{
1184 return 1;
1185}
1186static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1187{
1188 return 1;
1189}
1190static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1191 struct flowi *fl,
1192 unsigned int family)
1193{
1194 return -ENOSYS;
1195}
1196static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1197 struct sk_buff *skb)
1198{
1199 return 1;
1200}
1201static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1202 struct sk_buff *skb)
1203{
1204 return 1;
1205}
1206static inline void xfrm_garbage_collect(struct net *net)
1207{
1208}
1209#endif
1210
1211static __inline__
1212xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1213{
1214 switch (family){
1215 case AF_INET:
1216 return (xfrm_address_t *)&fl->u.ip4.daddr;
1217 case AF_INET6:
1218 return (xfrm_address_t *)&fl->u.ip6.daddr;
1219 }
1220 return NULL;
1221}
1222
1223static __inline__
1224xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1225{
1226 switch (family){
1227 case AF_INET:
1228 return (xfrm_address_t *)&fl->u.ip4.saddr;
1229 case AF_INET6:
1230 return (xfrm_address_t *)&fl->u.ip6.saddr;
1231 }
1232 return NULL;
1233}
1234
1235static __inline__
1236void xfrm_flowi_addr_get(const struct flowi *fl,
1237 xfrm_address_t *saddr, xfrm_address_t *daddr,
1238 unsigned short family)
1239{
1240 switch(family) {
1241 case AF_INET:
1242 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1243 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1244 break;
1245 case AF_INET6:
1246 saddr->in6 = fl->u.ip6.saddr;
1247 daddr->in6 = fl->u.ip6.daddr;
1248 break;
1249 }
1250}
1251
1252static __inline__ int
1253__xfrm4_state_addr_check(const struct xfrm_state *x,
1254 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1255{
1256 if (daddr->a4 == x->id.daddr.a4 &&
1257 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1258 return 1;
1259 return 0;
1260}
1261
1262static __inline__ int
1263__xfrm6_state_addr_check(const struct xfrm_state *x,
1264 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1265{
1266 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1267 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1268 ipv6_addr_any((struct in6_addr *)saddr) ||
1269 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1270 return 1;
1271 return 0;
1272}
1273
1274static __inline__ int
1275xfrm_state_addr_check(const struct xfrm_state *x,
1276 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1277 unsigned short family)
1278{
1279 switch (family) {
1280 case AF_INET:
1281 return __xfrm4_state_addr_check(x, daddr, saddr);
1282 case AF_INET6:
1283 return __xfrm6_state_addr_check(x, daddr, saddr);
1284 }
1285 return 0;
1286}
1287
1288static __inline__ int
1289xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1290 unsigned short family)
1291{
1292 switch (family) {
1293 case AF_INET:
1294 return __xfrm4_state_addr_check(x,
1295 (const xfrm_address_t *)&fl->u.ip4.daddr,
1296 (const xfrm_address_t *)&fl->u.ip4.saddr);
1297 case AF_INET6:
1298 return __xfrm6_state_addr_check(x,
1299 (const xfrm_address_t *)&fl->u.ip6.daddr,
1300 (const xfrm_address_t *)&fl->u.ip6.saddr);
1301 }
1302 return 0;
1303}
1304
1305static inline int xfrm_state_kern(const struct xfrm_state *x)
1306{
1307 return atomic_read(&x->tunnel_users);
1308}
1309
1310static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1311{
1312 return (!userproto || proto == userproto ||
1313 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1314 proto == IPPROTO_ESP ||
1315 proto == IPPROTO_COMP)));
1316}
1317
1318
1319
1320
1321struct xfrm_algo_aead_info {
1322 char *geniv;
1323 u16 icv_truncbits;
1324};
1325
1326struct xfrm_algo_auth_info {
1327 u16 icv_truncbits;
1328 u16 icv_fullbits;
1329};
1330
1331struct xfrm_algo_encr_info {
1332 char *geniv;
1333 u16 blockbits;
1334 u16 defkeybits;
1335};
1336
1337struct xfrm_algo_comp_info {
1338 u16 threshold;
1339};
1340
1341struct xfrm_algo_desc {
1342 char *name;
1343 char *compat;
1344 u8 available:1;
1345 u8 pfkey_supported:1;
1346 union {
1347 struct xfrm_algo_aead_info aead;
1348 struct xfrm_algo_auth_info auth;
1349 struct xfrm_algo_encr_info encr;
1350 struct xfrm_algo_comp_info comp;
1351 } uinfo;
1352 struct sadb_alg desc;
1353};
1354
1355
1356struct xfrm4_protocol {
1357 int (*handler)(struct sk_buff *skb);
1358 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1359 int encap_type);
1360 int (*cb_handler)(struct sk_buff *skb, int err);
1361 int (*err_handler)(struct sk_buff *skb, u32 info);
1362
1363 struct xfrm4_protocol __rcu *next;
1364 int priority;
1365};
1366
1367struct xfrm6_protocol {
1368 int (*handler)(struct sk_buff *skb);
1369 int (*cb_handler)(struct sk_buff *skb, int err);
1370 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1371 u8 type, u8 code, int offset, __be32 info);
1372
1373 struct xfrm6_protocol __rcu *next;
1374 int priority;
1375};
1376
1377
1378struct xfrm_tunnel {
1379 int (*handler)(struct sk_buff *skb);
1380 int (*err_handler)(struct sk_buff *skb, u32 info);
1381
1382 struct xfrm_tunnel __rcu *next;
1383 int priority;
1384};
1385
1386struct xfrm6_tunnel {
1387 int (*handler)(struct sk_buff *skb);
1388 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1389 u8 type, u8 code, int offset, __be32 info);
1390 struct xfrm6_tunnel __rcu *next;
1391 int priority;
1392};
1393
1394void xfrm_init(void);
1395void xfrm4_init(void);
1396int xfrm_state_init(struct net *net);
1397void xfrm_state_fini(struct net *net);
1398void xfrm4_state_init(void);
1399void xfrm4_protocol_init(void);
1400#ifdef CONFIG_XFRM
1401int xfrm6_init(void);
1402void xfrm6_fini(void);
1403int xfrm6_state_init(void);
1404void xfrm6_state_fini(void);
1405int xfrm6_protocol_init(void);
1406void xfrm6_protocol_fini(void);
1407#else
1408static inline int xfrm6_init(void)
1409{
1410 return 0;
1411}
1412static inline void xfrm6_fini(void)
1413{
1414 ;
1415}
1416#endif
1417
1418#ifdef CONFIG_XFRM_STATISTICS
1419int xfrm_proc_init(struct net *net);
1420void xfrm_proc_fini(struct net *net);
1421#endif
1422
1423int xfrm_sysctl_init(struct net *net);
1424#ifdef CONFIG_SYSCTL
1425void xfrm_sysctl_fini(struct net *net);
1426#else
1427static inline void xfrm_sysctl_fini(struct net *net)
1428{
1429}
1430#endif
1431
1432void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1433 struct xfrm_address_filter *filter);
1434int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1435 int (*func)(struct xfrm_state *, int, void*), void *);
1436void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1437struct xfrm_state *xfrm_state_alloc(struct net *net);
1438struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1439 const xfrm_address_t *saddr,
1440 const struct flowi *fl,
1441 struct xfrm_tmpl *tmpl,
1442 struct xfrm_policy *pol, int *err,
1443 unsigned short family);
1444struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1445 xfrm_address_t *daddr,
1446 xfrm_address_t *saddr,
1447 unsigned short family,
1448 u8 mode, u8 proto, u32 reqid);
1449struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1450 unsigned short family);
1451int xfrm_state_check_expire(struct xfrm_state *x);
1452void xfrm_state_insert(struct xfrm_state *x);
1453int xfrm_state_add(struct xfrm_state *x);
1454int xfrm_state_update(struct xfrm_state *x);
1455struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1456 const xfrm_address_t *daddr, __be32 spi,
1457 u8 proto, unsigned short family);
1458struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1459 const xfrm_address_t *daddr,
1460 const xfrm_address_t *saddr,
1461 u8 proto,
1462 unsigned short family);
1463#ifdef CONFIG_XFRM_SUB_POLICY
1464int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1465 unsigned short family, struct net *net);
1466int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1467 unsigned short family);
1468#else
1469static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1470 int n, unsigned short family, struct net *net)
1471{
1472 return -ENOSYS;
1473}
1474
1475static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1476 int n, unsigned short family)
1477{
1478 return -ENOSYS;
1479}
1480#endif
1481
1482struct xfrmk_sadinfo {
1483 u32 sadhcnt;
1484 u32 sadhmcnt;
1485 u32 sadcnt;
1486};
1487
1488struct xfrmk_spdinfo {
1489 u32 incnt;
1490 u32 outcnt;
1491 u32 fwdcnt;
1492 u32 inscnt;
1493 u32 outscnt;
1494 u32 fwdscnt;
1495 u32 spdhcnt;
1496 u32 spdhmcnt;
1497};
1498
1499struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1500int xfrm_state_delete(struct xfrm_state *x);
1501int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
1502void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1503void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1504u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1505int xfrm_init_replay(struct xfrm_state *x);
1506int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1507int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1508int xfrm_init_state(struct xfrm_state *x);
1509int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1510int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1511int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1512int xfrm_output_resume(struct sk_buff *skb, int err);
1513int xfrm_output(struct sock *sk, struct sk_buff *skb);
1514int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1515void xfrm_local_error(struct sk_buff *skb, int mtu);
1516int xfrm4_extract_header(struct sk_buff *skb);
1517int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1518int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1519 int encap_type);
1520int xfrm4_transport_finish(struct sk_buff *skb, int async);
1521int xfrm4_rcv(struct sk_buff *skb);
1522
1523static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1524{
1525 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1526 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1527 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1528 return xfrm_input(skb, nexthdr, spi, 0);
1529}
1530
1531int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1532int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1533int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1534int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
1535int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1536int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1537int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1538int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1539int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1540void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1541int xfrm6_extract_header(struct sk_buff *skb);
1542int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1543int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1544int xfrm6_transport_finish(struct sk_buff *skb, int async);
1545int xfrm6_rcv(struct sk_buff *skb);
1546int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1547 xfrm_address_t *saddr, u8 proto);
1548void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1549int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1550int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1551int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1552int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1553int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1554__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1555__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1556int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1557int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1558int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1559int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
1560int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1561 u8 **prevhdr);
1562
1563#ifdef CONFIG_XFRM
1564int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1565int xfrm_user_policy(struct sock *sk, int optname,
1566 u8 __user *optval, int optlen);
1567#else
1568static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1569{
1570 return -ENOPROTOOPT;
1571}
1572
1573static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1574{
1575
1576 kfree_skb(skb);
1577 return 0;
1578}
1579#endif
1580
1581struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1582
1583void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1584int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1585 int (*func)(struct xfrm_policy *, int, int, void*),
1586 void *);
1587void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1588int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1589struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1590 u8 type, int dir,
1591 struct xfrm_selector *sel,
1592 struct xfrm_sec_ctx *ctx, int delete,
1593 int *err);
1594struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1595 u32 id, int delete, int *err);
1596int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1597void xfrm_policy_hash_rebuild(struct net *net);
1598u32 xfrm_get_acqseq(void);
1599int verify_spi_info(u8 proto, u32 min, u32 max);
1600int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1601struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1602 u8 mode, u32 reqid, u8 proto,
1603 const xfrm_address_t *daddr,
1604 const xfrm_address_t *saddr, int create,
1605 unsigned short family);
1606int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1607
1608#ifdef CONFIG_XFRM_MIGRATE
1609int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1610 const struct xfrm_migrate *m, int num_bundles,
1611 const struct xfrm_kmaddress *k);
1612struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
1613struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1614 struct xfrm_migrate *m);
1615int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1616 struct xfrm_migrate *m, int num_bundles,
1617 struct xfrm_kmaddress *k, struct net *net);
1618#endif
1619
1620int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1621void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1622int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1623 xfrm_address_t *addr);
1624
1625void xfrm_input_init(void);
1626int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1627
1628void xfrm_probe_algs(void);
1629int xfrm_count_pfkey_auth_supported(void);
1630int xfrm_count_pfkey_enc_supported(void);
1631struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1632struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1633struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1634struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1635struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1636struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1637struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1638struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1639struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1640 int probe);
1641
1642static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1643 const xfrm_address_t *b)
1644{
1645 return ipv6_addr_equal((const struct in6_addr *)a,
1646 (const struct in6_addr *)b);
1647}
1648
1649static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1650 const xfrm_address_t *b,
1651 sa_family_t family)
1652{
1653 switch (family) {
1654 default:
1655 case AF_INET:
1656 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1657 case AF_INET6:
1658 return xfrm6_addr_equal(a, b);
1659 }
1660}
1661
1662static inline int xfrm_policy_id2dir(u32 index)
1663{
1664 return index & 7;
1665}
1666
1667#ifdef CONFIG_XFRM
1668static inline int xfrm_aevent_is_on(struct net *net)
1669{
1670 struct sock *nlsk;
1671 int ret = 0;
1672
1673 rcu_read_lock();
1674 nlsk = rcu_dereference(net->xfrm.nlsk);
1675 if (nlsk)
1676 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1677 rcu_read_unlock();
1678 return ret;
1679}
1680
1681static inline int xfrm_acquire_is_on(struct net *net)
1682{
1683 struct sock *nlsk;
1684 int ret = 0;
1685
1686 rcu_read_lock();
1687 nlsk = rcu_dereference(net->xfrm.nlsk);
1688 if (nlsk)
1689 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1690 rcu_read_unlock();
1691
1692 return ret;
1693}
1694#endif
1695
1696static inline int aead_len(struct xfrm_algo_aead *alg)
1697{
1698 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1699}
1700
1701static inline int xfrm_alg_len(const struct xfrm_algo *alg)
1702{
1703 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1704}
1705
1706static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1707{
1708 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1709}
1710
1711static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1712{
1713 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1714}
1715
1716#ifdef CONFIG_XFRM_MIGRATE
1717static inline int xfrm_replay_clone(struct xfrm_state *x,
1718 struct xfrm_state *orig)
1719{
1720 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1721 GFP_KERNEL);
1722 if (!x->replay_esn)
1723 return -ENOMEM;
1724
1725 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1726 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1727
1728 x->preplay_esn = kmemdup(x->replay_esn,
1729 xfrm_replay_state_esn_len(x->replay_esn),
1730 GFP_KERNEL);
1731 if (!x->preplay_esn) {
1732 kfree(x->replay_esn);
1733 return -ENOMEM;
1734 }
1735
1736 return 0;
1737}
1738
1739static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1740{
1741 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1742}
1743
1744
1745static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1746{
1747 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1748}
1749
1750static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1751{
1752 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1753}
1754
1755static inline void xfrm_states_put(struct xfrm_state **states, int n)
1756{
1757 int i;
1758 for (i = 0; i < n; i++)
1759 xfrm_state_put(*(states + i));
1760}
1761
1762static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1763{
1764 int i;
1765 for (i = 0; i < n; i++)
1766 xfrm_state_delete(*(states + i));
1767}
1768#endif
1769
1770#ifdef CONFIG_XFRM
1771static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1772{
1773 return skb->sp->xvec[skb->sp->len - 1];
1774}
1775#endif
1776
1777static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1778{
1779 if (attrs[XFRMA_MARK])
1780 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1781 else
1782 m->v = m->m = 0;
1783
1784 return m->v & m->m;
1785}
1786
1787static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1788{
1789 int ret = 0;
1790
1791 if (m->m | m->v)
1792 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1793 return ret;
1794}
1795
1796static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1797 unsigned int family)
1798{
1799 bool tunnel = false;
1800
1801 switch(family) {
1802 case AF_INET:
1803 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1804 tunnel = true;
1805 break;
1806 case AF_INET6:
1807 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1808 tunnel = true;
1809 break;
1810 }
1811 if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
1812 return -EINVAL;
1813
1814 return 0;
1815}
1816#endif
1817