blob: 14d82bf16692a6d0ed66721b1548ba152dbc18de [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Nicolas Dichtelfa9921e2011-02-02 06:29:02 +000039#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070041#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070043#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080046#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080047#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080048#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080049#define XFRM_INC_STATS(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080050#endif
51
Linus Torvalds1da177e2005-04-16 15:20:36 -070052
53/* Organization of SPD aka "XFRM rules"
54 ------------------------------------
55
56 Basic objects:
57 - policy rule, struct xfrm_policy (=SPD entry)
58 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
59 - instance of a transformer, struct xfrm_state (=SA)
60 - template to clone xfrm_state, struct xfrm_tmpl
61
62 SPD is plain linear list of xfrm_policy rules, ordered by priority.
63 (To be compatible with existing pfkeyv2 implementations,
64 many rules with priority of 0x7fffffff are allowed to exist and
65 such rules are ordered in an unpredictable way, thanks to bsd folks.)
66
67 Lookup is plain linear search until the first match with selector.
68
69 If "action" is "block", then we prohibit the flow, otherwise:
70 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
71 policy entry has list of up to XFRM_MAX_DEPTH transformations,
72 described by templates xfrm_tmpl. Each template is resolved
73 to a complete xfrm_state (see below) and we pack bundle of transformations
74 to a dst_entry returned to requestor.
75
76 dst -. xfrm .-> xfrm_state #1
77 |---. child .-> dst -. xfrm .-> xfrm_state #2
78 |---. child .-> dst -. xfrm .-> xfrm_state #3
79 |---. child .-> NULL
80
81 Bundles are cached at xrfm_policy struct (field ->bundles).
82
83
84 Resolution of xrfm_tmpl
85 -----------------------
86 Template contains:
87 1. ->mode Mode: transport or tunnel
88 2. ->id.proto Protocol: AH/ESP/IPCOMP
89 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
90 Q: allow to resolve security gateway?
91 4. ->id.spi If not zero, static SPI.
92 5. ->saddr Local tunnel endpoint, ignored for transport mode.
93 6. ->algos List of allowed algos. Plain bitmask now.
94 Q: ealgos, aalgos, calgos. What a mess...
95 7. ->share Sharing mode.
96 Q: how to implement private sharing mode? To add struct sock* to
97 flow id?
98
99 Having this template we search through SAD searching for entries
100 with appropriate mode/proto/algo, permitted by selector.
101 If no appropriate entry found, it is requested from key manager.
102
103 PROBLEMS:
104 Q: How to find all the bundles referring to a physical path for
105 PMTU discovery? Seems, dst should contain list of all parents...
106 and enter to infinite locking hierarchy disaster.
107 No! It is easier, we will not search for them, let them find us.
108 We add genid to each dst plus pointer to genid of raw IP route,
109 pmtu disc will update pmtu on raw IP route and increase its genid.
110 dst_check() will see this for top level and trigger resyncing
111 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
112 */
113
Herbert Xu12a169e2008-10-01 07:03:24 -0700114struct xfrm_state_walk {
115 struct list_head all;
116 u8 state;
Nicolas Dichteld3623092014-02-14 15:30:36 +0100117 u8 dying;
118 u8 proto;
Herbert Xu12a169e2008-10-01 07:03:24 -0700119 u32 seq;
Nicolas Dichtel870a2df2014-03-06 18:24:29 +0100120 struct xfrm_address_filter *filter;
Herbert Xu12a169e2008-10-01 07:03:24 -0700121};
122
Linus Torvalds1da177e2005-04-16 15:20:36 -0700123/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000124struct xfrm_state {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500125 possible_net_t xs_net;
Herbert Xuabb81c42008-09-09 19:58:29 -0700126 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700127 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700128 struct hlist_node bydst;
129 };
David S. Miller8f126e32006-08-24 02:45:07 -0700130 struct hlist_node bysrc;
131 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132
133 atomic_t refcnt;
134 spinlock_t lock;
135
136 struct xfrm_id id;
137 struct xfrm_selector sel;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000138 struct xfrm_mark mark;
Martin Willi35d28562010-12-08 04:37:49 +0000139 u32 tfcpad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140
David S. Miller9d4a7062006-08-24 03:18:09 -0700141 u32 genid;
142
Herbert Xu12a169e2008-10-01 07:03:24 -0700143 /* Key manager bits */
144 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700145
146 /* Parameters of this state. */
147 struct {
148 u32 reqid;
149 u8 mode;
150 u8 replay_window;
151 u8 aalgo, ealgo, calgo;
152 u8 flags;
153 u16 family;
154 xfrm_address_t saddr;
155 int header_len;
156 int trailer_len;
Nicolas Dichtela947b0a2013-02-22 10:54:54 +0100157 u32 extra_flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700158 } props;
159
160 struct xfrm_lifetime_cfg lft;
161
162 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000163 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700164 struct xfrm_algo *ealg;
165 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800166 struct xfrm_algo_aead *aead;
Herbert Xu69b01372015-05-27 16:03:45 +0800167 const char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168
169 /* Data for encapsulator */
170 struct xfrm_encap_tmpl *encap;
171
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700172 /* Data for care-of address */
173 xfrm_address_t *coaddr;
174
Linus Torvalds1da177e2005-04-16 15:20:36 -0700175 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
176 struct xfrm_state *tunnel;
177
178 /* If a tunnel, number of users + 1 */
179 atomic_t tunnel_users;
180
181 /* State for replay detection */
182 struct xfrm_replay_state replay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000183 struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800185 /* Replay detection state at the time we sent the last notification */
186 struct xfrm_replay_state preplay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000187 struct xfrm_replay_state_esn *preplay_esn;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800188
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000189 /* The functions for replay detection. */
Julia Lawalle45a8a92016-08-09 18:27:08 +0200190 const struct xfrm_replay *repl;
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000191
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700192 /* internal flag that only holds state for delayed aevent at the
193 * moment
194 */
195 u32 xflags;
196
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800197 /* Replay detection notification settings */
198 u32 replay_maxage;
199 u32 replay_maxdiff;
200
201 /* Replay detection notification timer */
202 struct timer_list rtimer;
203
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204 /* Statistics */
205 struct xfrm_stats stats;
206
207 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800208 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209
Fan Due3c0d042012-07-30 21:43:54 +0000210 /* used to fix curlft->add_time when changing date */
211 long saved_tmo;
212
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700213 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800214 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700215
Steffen Klassertcac26612017-01-17 10:22:57 +0100216 struct page_frag xfrag;
217
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 /* Reference to data common to all the instances of this
219 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800220 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700221 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700222 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700223 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224
Trent Jaegerdf718372005-12-13 23:12:27 -0800225 /* Security context */
226 struct xfrm_sec_ctx *security;
227
Linus Torvalds1da177e2005-04-16 15:20:36 -0700228 /* Private data of this transformer, format is opaque,
229 * interpreted by xfrm_type methods. */
230 void *data;
231};
232
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800233static inline struct net *xs_net(struct xfrm_state *x)
234{
235 return read_pnet(&x->xs_net);
236}
237
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700238/* xflags - make enum if more show up */
239#define XFRM_TIME_DEFER 1
Fan Due3c0d042012-07-30 21:43:54 +0000240#define XFRM_SOFT_EXPIRE 2
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700241
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242enum {
243 XFRM_STATE_VOID,
244 XFRM_STATE_ACQ,
245 XFRM_STATE_VALID,
246 XFRM_STATE_ERROR,
247 XFRM_STATE_EXPIRED,
248 XFRM_STATE_DEAD
249};
250
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700251/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000252struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700253 union {
254 u32 hard;
255 u32 proto;
256 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800257 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700258 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700259 } data;
260
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700261 u32 seq;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000262 u32 portid;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700263 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800264 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700265};
266
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000267struct xfrm_replay {
268 void (*advance)(struct xfrm_state *x, __be32 net_seq);
269 int (*check)(struct xfrm_state *x,
270 struct sk_buff *skb,
271 __be32 net_seq);
Steffen Klassert3b59df42012-09-04 00:03:29 +0000272 int (*recheck)(struct xfrm_state *x,
273 struct sk_buff *skb,
274 __be32 net_seq);
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000275 void (*notify)(struct xfrm_state *x, int event);
276 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
277};
278
Herbert Xu25ee3282007-12-11 09:32:34 -0800279struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700280struct xfrm_type;
281struct xfrm_dst;
282struct xfrm_policy_afinfo {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283 struct dst_ops *dst_ops;
David Ahern42a7b322015-08-10 16:58:11 -0600284 struct dst_entry *(*dst_lookup)(struct net *net,
285 int tos, int oif,
David S. Miller5e6b9302011-02-24 00:14:45 -0500286 const xfrm_address_t *saddr,
287 const xfrm_address_t *daddr);
David Ahern42a7b322015-08-10 16:58:11 -0600288 int (*get_saddr)(struct net *net, int oif,
289 xfrm_address_t *saddr,
290 xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700291 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800292 struct flowi *fl,
293 int reverse);
David S. Miller05d84022011-02-22 17:47:10 -0800294 int (*get_tos)(const struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800295 int (*init_path)(struct xfrm_dst *path,
296 struct dst_entry *dst,
297 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800298 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000299 struct net_device *dev,
David S. Miller0c7b3ee2011-02-22 17:48:57 -0800300 const struct flowi *fl);
David S. Miller2774c132011-03-01 14:59:04 -0800301 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700302};
303
Florian Westphala2817d82017-02-07 15:00:17 +0100304int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
305void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
Joe Perchesd5113372013-09-23 11:33:53 -0700306void km_policy_notify(struct xfrm_policy *xp, int dir,
307 const struct km_event *c);
308void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309
310struct xfrm_tmpl;
Joe Perchesd5113372013-09-23 11:33:53 -0700311int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
312 struct xfrm_policy *pol);
313void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
314int __xfrm_state_delete(struct xfrm_state *x);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800315
Linus Torvalds1da177e2005-04-16 15:20:36 -0700316struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700317 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800318 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700319 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700320 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800321 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700322 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700323 int (*init_flags)(struct xfrm_state *x);
David S. Miller73e5ebb2011-02-22 17:51:44 -0800324 void (*init_tempsel)(struct xfrm_selector *sel,
325 const struct flowi *fl);
David S. Miller19bd6242011-02-24 00:07:20 -0500326 void (*init_temprop)(struct xfrm_state *x,
327 const struct xfrm_tmpl *tmpl,
328 const xfrm_address_t *daddr,
329 const xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700330 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
331 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Eric W. Biedermanede20592015-10-07 16:48:47 -0500332 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -0400333 int (*output_finish)(struct sock *sk, struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800334 int (*extract_input)(struct xfrm_state *x,
335 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800336 int (*extract_output)(struct xfrm_state *x,
337 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800338 int (*transport_finish)(struct sk_buff *skb,
339 int async);
Hannes Frederic Sowa628e3412013-08-14 13:05:23 +0200340 void (*local_error)(struct sk_buff *skb, u32 mtu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341};
342
Joe Perchesd5113372013-09-23 11:33:53 -0700343int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
344int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
345struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
Florian Westphal711059b2017-01-09 14:20:48 +0100346struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347
Steffen Klassert2f32b512014-03-14 07:28:07 +0100348struct xfrm_input_afinfo {
349 unsigned int family;
Steffen Klassert2f32b512014-03-14 07:28:07 +0100350 int (*callback)(struct sk_buff *skb, u8 protocol,
351 int err);
352};
353
Florian Westphal960fdfd2017-02-07 14:52:30 +0100354int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
355int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
Steffen Klassert2f32b512014-03-14 07:28:07 +0100356
Joe Perchesd5113372013-09-23 11:33:53 -0700357void xfrm_state_delete_tunnel(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700358
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000359struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700360 char *description;
361 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000362 u8 proto;
363 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700364#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700365#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800366#define XFRM_TYPE_LOCAL_COADDR 4
367#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700368
Herbert Xu72cb6962005-06-20 13:18:08 -0700369 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800371 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700372 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
David S. Miller8f029de2011-02-22 17:59:59 -0800373 int (*reject)(struct xfrm_state *, struct sk_buff *,
374 const struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700375 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700376 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700377 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700378};
379
Joe Perchesd5113372013-09-23 11:33:53 -0700380int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
381int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700382
Herbert Xub59f45d2006-05-27 23:05:54 -0700383struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800384 /*
385 * Remove encapsulation header.
386 *
387 * The IP header will be moved over the top of the encapsulation
388 * header.
389 *
390 * On entry, the transport header shall point to where the IP header
391 * should be and the network header shall be set to where the IP
392 * header currently is. skb->data shall point to the start of the
393 * payload.
394 */
395 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
396
397 /*
398 * This is the actual input entry point.
399 *
400 * For transport mode and equivalent this would be identical to
401 * input2 (which does not need to be set). While tunnel mode
402 * and equivalent would set this to the tunnel encapsulation function
403 * xfrm4_prepare_input that would in turn call input2.
404 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700405 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700406
407 /*
408 * Add encapsulation header.
409 *
410 * On exit, the transport header will be set to the start of the
411 * encapsulation header to be filled in by x->type->output and
412 * the mac header will be set to the nextheader (protocol for
413 * IPv4) field of the extension header directly preceding the
414 * encapsulation header, or in its absence, that of the top IP
415 * header. The value of the network header will always point
416 * to the top IP header while skb->data will point to the payload.
417 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800418 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
419
420 /*
421 * This is the actual output entry point.
422 *
423 * For transport mode and equivalent this would be identical to
424 * output2 (which does not need to be set). While tunnel mode
425 * and equivalent would set this to a tunnel encapsulation function
426 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
427 * call output2.
428 */
429 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700430
Herbert Xu17c2a422007-10-17 21:33:12 -0700431 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700432 struct module *owner;
433 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700434 int flags;
435};
436
437/* Flags for xfrm_mode. */
438enum {
439 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700440};
441
Joe Perchesd5113372013-09-23 11:33:53 -0700442int xfrm_register_mode(struct xfrm_mode *mode, int family);
443int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700444
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700445static inline int xfrm_af2proto(unsigned int family)
446{
447 switch(family) {
448 case AF_INET:
449 return IPPROTO_IPIP;
450 case AF_INET6:
451 return IPPROTO_IPV6;
452 default:
453 return 0;
454 }
455}
456
457static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
458{
459 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
460 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
461 return x->inner_mode;
462 else
463 return x->inner_mode_iaf;
464}
465
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000466struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700467/* id in template is interpreted as:
468 * daddr - destination of tunnel, may be zero for transport mode.
469 * spi - zero to acquire spi. Not zero if spi is static, then
470 * daddr must be fixed too.
471 * proto - AH/ESP/IPCOMP
472 */
473 struct xfrm_id id;
474
475/* Source address of tunnel. Ignored, if it is not a tunnel. */
476 xfrm_address_t saddr;
477
Miika Komu76b3f052006-11-30 16:40:43 -0800478 unsigned short encap_family;
479
jamala6337462010-02-09 13:21:17 +0000480 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700481
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700482/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000483 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700484
485/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000486 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700487
488/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000489 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490
Herbert Xuc5d18e92008-04-22 00:46:42 -0700491/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000492 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700493
Linus Torvalds1da177e2005-04-16 15:20:36 -0700494/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000495 u32 aalgos;
496 u32 ealgos;
497 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700498};
499
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700500#define XFRM_MAX_DEPTH 6
Steffen Klassert54ef2072017-02-15 09:39:54 +0100501#define XFRM_MAX_OFFLOAD_DEPTH 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700502
Herbert Xu12a169e2008-10-01 07:03:24 -0700503struct xfrm_policy_walk_entry {
504 struct list_head all;
505 u8 dead;
506};
507
508struct xfrm_policy_walk {
509 struct xfrm_policy_walk_entry walk;
510 u8 type;
511 u32 seq;
512};
513
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100514struct xfrm_policy_queue {
515 struct sk_buff_head hold_queue;
516 struct timer_list hold_timer;
517 unsigned long timeout;
518};
519
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000520struct xfrm_policy {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500521 possible_net_t xp_net;
David S. Miller2518c7c2006-08-24 04:45:07 -0700522 struct hlist_node bydst;
523 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700524
525 /* This lock only affects elements except for entry. */
526 rwlock_t lock;
527 atomic_t refcnt;
528 struct timer_list timer;
529
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000530 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000531 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700532 u32 priority;
533 u32 index;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000534 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700535 struct xfrm_selector selector;
536 struct xfrm_lifetime_cfg lft;
537 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700538 struct xfrm_policy_walk_entry walk;
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100539 struct xfrm_policy_queue polq;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200540 u8 type;
541 u8 action;
542 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200543 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700544 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800545 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
Eric Dumazet56f04732015-12-08 07:22:01 -0800547 struct rcu_head rcu;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548};
549
David S. Miller63eb23f2011-02-24 01:25:19 -0500550static inline struct net *xp_net(const struct xfrm_policy *xp)
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800551{
552 return read_pnet(&xp->xp_net);
553}
554
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700555struct xfrm_kmaddress {
556 xfrm_address_t local;
557 xfrm_address_t remote;
558 u32 reserved;
559 u16 family;
560};
561
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800562struct xfrm_migrate {
563 xfrm_address_t old_daddr;
564 xfrm_address_t old_saddr;
565 xfrm_address_t new_daddr;
566 xfrm_address_t new_saddr;
567 u8 proto;
568 u8 mode;
569 u16 reserved;
570 u32 reqid;
571 u16 old_family;
572 u16 new_family;
573};
574
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800575#define XFRM_KM_TIMEOUT 30
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800576/* what happened */
577#define XFRM_REPLAY_UPDATE XFRM_AE_CR
578#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
579
580/* default aevent timeout in units of 100ms */
581#define XFRM_AE_ETIME 10
582/* Async Event timer multiplier */
583#define XFRM_AE_ETH_M 10
584/* default seq threshold size */
585#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000587struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 struct list_head list;
589 char *id;
David S. Miller214e0052011-02-24 00:02:38 -0500590 int (*notify)(struct xfrm_state *x, const struct km_event *c);
Fan Du65e07362012-08-15 10:13:47 +0800591 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700592 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800593 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
David S. Miller214e0052011-02-24 00:02:38 -0500594 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800595 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
David S. Miller183cad12011-02-24 00:28:01 -0500596 int (*migrate)(const struct xfrm_selector *sel,
597 u8 dir, u8 type,
598 const struct xfrm_migrate *m,
599 int num_bundles,
600 const struct xfrm_kmaddress *k);
Horia Geanta0f245582014-02-12 16:20:06 +0200601 bool (*is_alive)(const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700602};
603
Joe Perchesd5113372013-09-23 11:33:53 -0700604int xfrm_register_km(struct xfrm_mgr *km);
605int xfrm_unregister_km(struct xfrm_mgr *km);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606
Steffen Klassert70be6c92014-02-21 08:41:09 +0100607struct xfrm_tunnel_skb_cb {
608 union {
609 struct inet_skb_parm h4;
610 struct inet6_skb_parm h6;
611 } header;
612
613 union {
614 struct ip_tunnel *ip4;
615 struct ip6_tnl *ip6;
616 } tunnel;
617};
618
619#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
620
Herbert Xu436a0a42007-10-08 17:25:53 -0700621/*
622 * This structure is used for the duration where packets are being
623 * transformed by IPsec. As soon as the packet leaves IPsec the
624 * area beyond the generic IP part may be overwritten.
625 */
626struct xfrm_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100627 struct xfrm_tunnel_skb_cb header;
Herbert Xu436a0a42007-10-08 17:25:53 -0700628
629 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800630 union {
Steffen Klassert1ce36442011-03-08 00:06:31 +0000631 struct {
632 __u32 low;
633 __u32 hi;
634 } output;
635 struct {
636 __be32 low;
637 __be32 hi;
638 } input;
Herbert Xub318e0e2008-02-12 22:50:35 -0800639 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700640};
641
642#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
643
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800644/*
645 * This structure is used by the afinfo prepare_input/prepare_output functions
646 * to transmit header information to the mode input/output functions.
647 */
648struct xfrm_mode_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100649 struct xfrm_tunnel_skb_cb header;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800650
651 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
652 __be16 id;
653 __be16 frag_off;
654
Herbert Xu732c8bd2008-03-26 16:51:09 -0700655 /* IP header length (excluding options or extension headers). */
656 u8 ihl;
657
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800658 /* TOS for IPv4, class for IPv6. */
659 u8 tos;
660
661 /* TTL for IPv4, hop limitfor IPv6. */
662 u8 ttl;
663
664 /* Protocol for IPv4, NH for IPv6. */
665 u8 protocol;
666
Herbert Xu732c8bd2008-03-26 16:51:09 -0700667 /* Option length for IPv4, zero for IPv6. */
668 u8 optlen;
669
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800670 /* Used by IPv6 only, zero for IPv4. */
671 u8 flow_lbl[3];
672};
673
674#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
675
Herbert Xu716062f2007-11-13 21:44:23 -0800676/*
677 * This structure is used by the input processing to locate the SPI and
678 * related information.
679 */
680struct xfrm_spi_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100681 struct xfrm_tunnel_skb_cb header;
Herbert Xu716062f2007-11-13 21:44:23 -0800682
Herbert Xu716062f2007-11-13 21:44:23 -0800683 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800684 unsigned int family;
Steffen Klassert7785bba2017-02-15 09:40:00 +0100685 __be32 seq;
Herbert Xu716062f2007-11-13 21:44:23 -0800686};
687
688#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
689
Joy Lattenc9204d92006-11-30 15:50:43 -0600690#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800691static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700692{
693 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800694
695 if (audit_enabled == 0)
696 return NULL;
697 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
698 AUDIT_MAC_IPSEC_EVENT);
699 if (audit_buf == NULL)
700 return NULL;
701 audit_log_format(audit_buf, "op=%s", op);
702 return audit_buf;
703}
704
Tetsuo Handa2e710292014-04-22 21:48:30 +0900705static inline void xfrm_audit_helper_usrinfo(bool task_valid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800706 struct audit_buffer *audit_buf)
707{
Tetsuo Handa2e710292014-04-22 21:48:30 +0900708 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
709 audit_get_loginuid(current) :
710 INVALID_UID);
711 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
712 (unsigned int) -1;
713
714 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Tetsuo Handaf1370cc2014-04-18 16:23:46 +0900715 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700716}
717
Tetsuo Handa2e710292014-04-22 21:48:30 +0900718void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
719void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
720 bool task_valid);
721void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
722void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -0700723void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
724 struct sk_buff *skb);
725void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
726 __be32 net_seq);
727void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
728void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
729 __be32 net_seq);
730void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
731 u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600732#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700733
734static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900735 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700736{
737}
738
739static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900740 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700741{
742}
743
744static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900745 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700746{
747}
748
749static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900750 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700751{
752}
753
754static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
755 struct sk_buff *skb)
756{
757}
758
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000759static inline void xfrm_audit_state_replay(struct xfrm_state *x,
760 struct sk_buff *skb, __be32 net_seq)
761{
762}
763
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700764static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
765 u16 family)
766{
767}
768
769static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
770 __be32 net_spi, __be32 net_seq)
771{
772}
773
774static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
775 struct sk_buff *skb, u8 proto)
776{
777}
Joy Lattenc9204d92006-11-30 15:50:43 -0600778#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600779
Linus Torvalds1da177e2005-04-16 15:20:36 -0700780static inline void xfrm_pol_hold(struct xfrm_policy *policy)
781{
782 if (likely(policy != NULL))
783 atomic_inc(&policy->refcnt);
784}
785
Joe Perchesd5113372013-09-23 11:33:53 -0700786void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700787
788static inline void xfrm_pol_put(struct xfrm_policy *policy)
789{
790 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800791 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700792}
793
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700794static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
795{
796 int i;
797 for (i = npols - 1; i >= 0; --i)
798 xfrm_pol_put(pols[i]);
799}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700800
Joe Perchesd5113372013-09-23 11:33:53 -0700801void __xfrm_state_destroy(struct xfrm_state *);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700802
Herbert Xu21380b82006-02-22 14:47:13 -0800803static inline void __xfrm_state_put(struct xfrm_state *x)
804{
805 atomic_dec(&x->refcnt);
806}
807
Linus Torvalds1da177e2005-04-16 15:20:36 -0700808static inline void xfrm_state_put(struct xfrm_state *x)
809{
810 if (atomic_dec_and_test(&x->refcnt))
811 __xfrm_state_destroy(x);
812}
813
814static inline void xfrm_state_hold(struct xfrm_state *x)
815{
816 atomic_inc(&x->refcnt);
817}
818
David S. Miller1744a8f2011-02-22 18:02:12 -0800819static inline bool addr_match(const void *token1, const void *token2,
820 int prefixlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700821{
David S. Miller1744a8f2011-02-22 18:02:12 -0800822 const __be32 *a1 = token1;
823 const __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824 int pdw;
825 int pbi;
826
jamala6337462010-02-09 13:21:17 +0000827 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700828 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
829
830 if (pdw)
831 if (memcmp(a1, a2, pdw << 2))
David S. Miller1744a8f2011-02-22 18:02:12 -0800832 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700833
834 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700835 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700836
837 mask = htonl((0xffffffff) << (32 - pbi));
838
839 if ((a1[pdw] ^ a2[pdw]) & mask)
David S. Miller1744a8f2011-02-22 18:02:12 -0800840 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700841 }
842
David S. Miller1744a8f2011-02-22 18:02:12 -0800843 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700844}
845
Alexey Dobriyan26bff942011-11-22 06:46:02 +0000846static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
847{
848 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
849 if (prefixlen == 0)
850 return true;
851 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
852}
853
Linus Torvalds1da177e2005-04-16 15:20:36 -0700854static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500855__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700856{
Al Virof9d07e41f82006-09-27 18:45:50 -0700857 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500858 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700859 case IPPROTO_TCP:
860 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800861 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700862 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500863 port = uli->ports.sport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700864 break;
865 case IPPROTO_ICMP:
866 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500867 port = htons(uli->icmpt.type);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700869 case IPPROTO_MH:
David S. Miller6281dcc2011-03-12 00:43:55 -0500870 port = htons(uli->mht.type);
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700871 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000872 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500873 port = htons(ntohl(uli->gre_key) >> 16);
Timo Teräscc9ff192010-11-03 04:41:38 +0000874 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700875 default:
876 port = 0; /*XXX*/
877 }
878 return port;
879}
880
881static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500882__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700883{
Al Virof9d07e41f82006-09-27 18:45:50 -0700884 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500885 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700886 case IPPROTO_TCP:
887 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800888 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700889 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500890 port = uli->ports.dport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700891 break;
892 case IPPROTO_ICMP:
893 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500894 port = htons(uli->icmpt.code);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700895 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000896 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500897 port = htons(ntohl(uli->gre_key) & 0xffff);
Timo Teräscc9ff192010-11-03 04:41:38 +0000898 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700899 default:
900 port = 0; /*XXX*/
901 }
902 return port;
903}
904
Joe Perchesd5113372013-09-23 11:33:53 -0700905bool xfrm_selector_match(const struct xfrm_selector *sel,
906 const struct flowi *fl, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700907
Trent Jaegerdf718372005-12-13 23:12:27 -0800908#ifdef CONFIG_SECURITY_NETWORK_XFRM
909/* If neither has a context --> match
910 * Otherwise, both must have a context and the sids, doi, alg must match
911 */
David S. Millerbc9b35a2012-05-15 15:04:57 -0400912static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800913{
914 return ((!s1 && !s2) ||
915 (s1 && s2 &&
916 (s1->ctx_sid == s2->ctx_sid) &&
917 (s1->ctx_doi == s2->ctx_doi) &&
918 (s1->ctx_alg == s2->ctx_alg)));
919}
920#else
David S. Millerbc9b35a2012-05-15 15:04:57 -0400921static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800922{
David S. Millerbc9b35a2012-05-15 15:04:57 -0400923 return true;
Trent Jaegerdf718372005-12-13 23:12:27 -0800924}
925#endif
926
Linus Torvalds1da177e2005-04-16 15:20:36 -0700927/* A struct encoding bundle of transformations to apply to some set of flow.
928 *
929 * dst->child points to the next element of bundle.
930 * dst->xfrm points to an instanse of transformer.
931 *
932 * Due to unfortunate limitations of current routing cache, which we
933 * have no time to fix, it mirrors struct rtable and bound to the same
934 * routing key, including saddr,daddr. However, we can have many of
935 * bundles differing by session id. All the bundles grow from a parent
936 * policy rule.
937 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000938struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700939 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700940 struct dst_entry dst;
941 struct rtable rt;
942 struct rt6_info rt6;
943 } u;
944 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000945 struct flow_cache_object flo;
946 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
947 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700948#ifdef CONFIG_XFRM_SUB_POLICY
949 struct flowi *origin;
950 struct xfrm_selector *partner;
951#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000952 u32 xfrm_genid;
953 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700954 u32 route_mtu_cached;
955 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700956 u32 route_cookie;
957 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700958};
959
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700960#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700961static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
962{
Timo Teräs80c802f2010-04-07 00:30:05 +0000963 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700964 dst_release(xdst->route);
965 if (likely(xdst->u.dst.xfrm))
966 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700967#ifdef CONFIG_XFRM_SUB_POLICY
968 kfree(xdst->origin);
969 xdst->origin = NULL;
970 kfree(xdst->partner);
971 xdst->partner = NULL;
972#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700973}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700974#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700975
Joe Perchesd5113372013-09-23 11:33:53 -0700976void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
Herbert Xuaabc9762005-05-03 16:27:10 -0700977
Steffen Klassert54ef2072017-02-15 09:39:54 +0100978struct xfrm_offload {
979 /* Output sequence number for replay protection on offloading. */
980 struct {
981 __u32 low;
982 __u32 hi;
983 } seq;
984
985 __u32 flags;
986#define SA_DELETE_REQ 1
987#define CRYPTO_DONE 2
988#define CRYPTO_NEXT_DONE 4
989#define CRYPTO_FALLBACK 8
990#define XFRM_GSO_SEGMENT 16
991#define XFRM_GRO 32
992
993 __u32 status;
994#define CRYPTO_SUCCESS 1
995#define CRYPTO_GENERIC_ERROR 2
996#define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4
997#define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8
998#define CRYPTO_TUNNEL_AH_AUTH_FAILED 16
999#define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32
1000#define CRYPTO_INVALID_PACKET_SYNTAX 64
1001#define CRYPTO_INVALID_PROTOCOL 128
1002
1003 __u8 proto;
1004};
1005
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +00001006struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001007 atomic_t refcnt;
1008 int len;
Steffen Klassert54ef2072017-02-15 09:39:54 +01001009 int olen;
1010
Herbert Xudbe5b4a2006-04-01 00:54:16 -08001011 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Steffen Klassert54ef2072017-02-15 09:39:54 +01001012 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -07001013};
1014
Michael Smith990078a2011-04-07 04:51:51 +00001015static inline int secpath_exists(struct sk_buff *skb)
1016{
1017#ifdef CONFIG_XFRM
1018 return skb->sp != NULL;
1019#else
1020 return 0;
1021#endif
1022}
1023
Linus Torvalds1da177e2005-04-16 15:20:36 -07001024static inline struct sec_path *
1025secpath_get(struct sec_path *sp)
1026{
1027 if (sp)
1028 atomic_inc(&sp->refcnt);
1029 return sp;
1030}
1031
Joe Perchesd5113372013-09-23 11:33:53 -07001032void __secpath_destroy(struct sec_path *sp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001033
1034static inline void
1035secpath_put(struct sec_path *sp)
1036{
1037 if (sp && atomic_dec_and_test(&sp->refcnt))
1038 __secpath_destroy(sp);
1039}
1040
Joe Perchesd5113372013-09-23 11:33:53 -07001041struct sec_path *secpath_dup(struct sec_path *src);
Steffen Klassertb0fcee82017-02-15 09:39:24 +01001042int secpath_set(struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001043
1044static inline void
1045secpath_reset(struct sk_buff *skb)
1046{
1047#ifdef CONFIG_XFRM
1048 secpath_put(skb->sp);
1049 skb->sp = NULL;
1050#endif
1051}
1052
1053static inline int
David S. Miller6cc32962011-02-24 00:19:59 -05001054xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001055{
1056 switch (family) {
1057 case AF_INET:
1058 return addr->a4 == 0;
1059 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001060 return ipv6_addr_any(&addr->in6);
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001061 }
1062 return 0;
1063}
1064
1065static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001066__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001067{
1068 return (tmpl->saddr.a4 &&
1069 tmpl->saddr.a4 != x->props.saddr.a4);
1070}
1071
1072static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001073__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001074{
1075 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001076 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001077}
1078
1079static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001080xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001081{
1082 switch (family) {
1083 case AF_INET:
1084 return __xfrm4_state_addr_cmp(tmpl, x);
1085 case AF_INET6:
1086 return __xfrm6_state_addr_cmp(tmpl, x);
1087 }
1088 return !0;
1089}
1090
1091#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001092int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1093 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001094
Herbert Xud5422ef2007-12-12 10:44:16 -08001095static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1096 struct sk_buff *skb,
1097 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001098{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001099 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -08001100 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1101
Linus Torvalds1da177e2005-04-16 15:20:36 -07001102 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -08001103 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001104
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001105 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001106 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -08001107 __xfrm_policy_check(sk, ndir, skb, family);
1108}
1109
1110static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1111{
1112 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001113}
1114
1115static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1116{
1117 return xfrm_policy_check(sk, dir, skb, AF_INET);
1118}
1119
1120static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1121{
1122 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1123}
1124
Herbert Xud5422ef2007-12-12 10:44:16 -08001125static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1126 struct sk_buff *skb)
1127{
1128 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1129}
1130
1131static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1132 struct sk_buff *skb)
1133{
1134 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1135}
1136
Joe Perchesd5113372013-09-23 11:33:53 -07001137int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1138 unsigned int family, int reverse);
Herbert Xud5422ef2007-12-12 10:44:16 -08001139
1140static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1141 unsigned int family)
1142{
1143 return __xfrm_decode_session(skb, fl, family, 0);
1144}
1145
1146static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1147 struct flowi *fl,
1148 unsigned int family)
1149{
1150 return __xfrm_decode_session(skb, fl, family, 1);
1151}
1152
Joe Perchesd5113372013-09-23 11:33:53 -07001153int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001154
1155static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1156{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001157 struct net *net = dev_net(skb->dev);
1158
1159 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001160 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001161 __xfrm_route_forward(skb, family);
1162}
1163
1164static inline int xfrm4_route_forward(struct sk_buff *skb)
1165{
1166 return xfrm_route_forward(skb, AF_INET);
1167}
1168
1169static inline int xfrm6_route_forward(struct sk_buff *skb)
1170{
1171 return xfrm_route_forward(skb, AF_INET6);
1172}
1173
Eric Dumazetd188ba82015-12-08 07:22:02 -08001174int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001175
Eric Dumazetd188ba82015-12-08 07:22:02 -08001176static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001177{
Eric Dumazetd188ba82015-12-08 07:22:02 -08001178 sk->sk_policy[0] = NULL;
1179 sk->sk_policy[1] = NULL;
1180 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1181 return __xfrm_sk_clone_policy(sk, osk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001182 return 0;
1183}
1184
Joe Perchesd5113372013-09-23 11:33:53 -07001185int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001186
1187static inline void xfrm_sk_free_policy(struct sock *sk)
1188{
Eric Dumazetd188ba82015-12-08 07:22:02 -08001189 struct xfrm_policy *pol;
1190
1191 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1192 if (unlikely(pol != NULL)) {
1193 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001194 sk->sk_policy[0] = NULL;
1195 }
Eric Dumazetd188ba82015-12-08 07:22:02 -08001196 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1197 if (unlikely(pol != NULL)) {
1198 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001199 sk->sk_policy[1] = NULL;
1200 }
1201}
1202
Joe Perchesd5113372013-09-23 11:33:53 -07001203void xfrm_garbage_collect(struct net *net);
Florian Westphal3d7d25a2017-02-07 15:00:16 +01001204void xfrm_garbage_collect_deferred(struct net *net);
Paul Mooree4c17212013-05-29 07:36:25 +00001205
Linus Torvalds1da177e2005-04-16 15:20:36 -07001206#else
1207
1208static inline void xfrm_sk_free_policy(struct sock *sk) {}
Eric Dumazetd188ba82015-12-08 07:22:02 -08001209static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001210static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1211static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1212static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1213{
1214 return 1;
1215}
1216static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1217{
1218 return 1;
1219}
1220static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1221{
1222 return 1;
1223}
Herbert Xud5422ef2007-12-12 10:44:16 -08001224static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1225 struct flowi *fl,
1226 unsigned int family)
1227{
1228 return -ENOSYS;
1229}
1230static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1231 struct sk_buff *skb)
1232{
1233 return 1;
1234}
1235static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1236 struct sk_buff *skb)
1237{
1238 return 1;
1239}
Paul Mooree4c17212013-05-29 07:36:25 +00001240static inline void xfrm_garbage_collect(struct net *net)
1241{
1242}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001243#endif
1244
1245static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001246xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001247{
1248 switch (family){
1249 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001250 return (xfrm_address_t *)&fl->u.ip4.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001251 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001252 return (xfrm_address_t *)&fl->u.ip6.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001253 }
1254 return NULL;
1255}
1256
1257static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001258xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001259{
1260 switch (family){
1261 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001262 return (xfrm_address_t *)&fl->u.ip4.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001263 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001264 return (xfrm_address_t *)&fl->u.ip6.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001265 }
1266 return NULL;
1267}
1268
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001269static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001270void xfrm_flowi_addr_get(const struct flowi *fl,
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001271 xfrm_address_t *saddr, xfrm_address_t *daddr,
1272 unsigned short family)
1273{
1274 switch(family) {
1275 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001276 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1277 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001278 break;
1279 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001280 saddr->in6 = fl->u.ip6.saddr;
1281 daddr->in6 = fl->u.ip6.daddr;
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001282 break;
1283 }
1284}
1285
Linus Torvalds1da177e2005-04-16 15:20:36 -07001286static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001287__xfrm4_state_addr_check(const struct xfrm_state *x,
1288 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001289{
1290 if (daddr->a4 == x->id.daddr.a4 &&
1291 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1292 return 1;
1293 return 0;
1294}
1295
1296static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001297__xfrm6_state_addr_check(const struct xfrm_state *x,
1298 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001299{
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001300 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1301 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001302 ipv6_addr_any((struct in6_addr *)saddr) ||
1303 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1304 return 1;
1305 return 0;
1306}
1307
1308static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001309xfrm_state_addr_check(const struct xfrm_state *x,
1310 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001311 unsigned short family)
1312{
1313 switch (family) {
1314 case AF_INET:
1315 return __xfrm4_state_addr_check(x, daddr, saddr);
1316 case AF_INET6:
1317 return __xfrm6_state_addr_check(x, daddr, saddr);
1318 }
1319 return 0;
1320}
1321
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001322static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001323xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001324 unsigned short family)
1325{
1326 switch (family) {
1327 case AF_INET:
1328 return __xfrm4_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001329 (const xfrm_address_t *)&fl->u.ip4.daddr,
1330 (const xfrm_address_t *)&fl->u.ip4.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001331 case AF_INET6:
1332 return __xfrm6_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001333 (const xfrm_address_t *)&fl->u.ip6.daddr,
1334 (const xfrm_address_t *)&fl->u.ip6.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001335 }
1336 return 0;
1337}
1338
David S. Millerf8848062011-02-24 01:42:28 -05001339static inline int xfrm_state_kern(const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001340{
1341 return atomic_read(&x->tunnel_users);
1342}
1343
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001344static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1345{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001346 return (!userproto || proto == userproto ||
1347 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1348 proto == IPPROTO_ESP ||
1349 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001350}
1351
Linus Torvalds1da177e2005-04-16 15:20:36 -07001352/*
1353 * xfrm algorithm information
1354 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001355struct xfrm_algo_aead_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001356 char *geniv;
Herbert Xu1a6509d2008-01-28 19:37:29 -08001357 u16 icv_truncbits;
1358};
1359
Linus Torvalds1da177e2005-04-16 15:20:36 -07001360struct xfrm_algo_auth_info {
1361 u16 icv_truncbits;
1362 u16 icv_fullbits;
1363};
1364
1365struct xfrm_algo_encr_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001366 char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001367 u16 blockbits;
1368 u16 defkeybits;
1369};
1370
1371struct xfrm_algo_comp_info {
1372 u16 threshold;
1373};
1374
1375struct xfrm_algo_desc {
1376 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001377 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001378 u8 available:1;
Jussi Kivilinna7e50f842013-01-31 12:40:38 +02001379 u8 pfkey_supported:1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001380 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001381 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001382 struct xfrm_algo_auth_info auth;
1383 struct xfrm_algo_encr_info encr;
1384 struct xfrm_algo_comp_info comp;
1385 } uinfo;
1386 struct sadb_alg desc;
1387};
1388
Steffen Klassert33287152014-02-21 08:41:08 +01001389/* XFRM protocol handlers. */
1390struct xfrm4_protocol {
1391 int (*handler)(struct sk_buff *skb);
1392 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1393 int encap_type);
1394 int (*cb_handler)(struct sk_buff *skb, int err);
1395 int (*err_handler)(struct sk_buff *skb, u32 info);
1396
1397 struct xfrm4_protocol __rcu *next;
1398 int priority;
1399};
1400
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001401struct xfrm6_protocol {
1402 int (*handler)(struct sk_buff *skb);
1403 int (*cb_handler)(struct sk_buff *skb, int err);
1404 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1405 u8 type, u8 code, int offset, __be32 info);
1406
1407 struct xfrm6_protocol __rcu *next;
1408 int priority;
1409};
1410
Linus Torvalds1da177e2005-04-16 15:20:36 -07001411/* XFRM tunnel handlers. */
1412struct xfrm_tunnel {
1413 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001414 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001415
Eric Dumazetb33eab02010-10-25 21:01:26 +00001416 struct xfrm_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001417 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001418};
1419
1420struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001421 int (*handler)(struct sk_buff *skb);
1422 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001423 u8 type, u8 code, int offset, __be32 info);
Eric Dumazet6f0bcf12010-10-24 21:33:16 +00001424 struct xfrm6_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001425 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001426};
1427
Joe Perchesd5113372013-09-23 11:33:53 -07001428void xfrm_init(void);
1429void xfrm4_init(void);
1430int xfrm_state_init(struct net *net);
1431void xfrm_state_fini(struct net *net);
1432void xfrm4_state_init(void);
Steffen Klassert2f32b512014-03-14 07:28:07 +01001433void xfrm4_protocol_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001434#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001435int xfrm6_init(void);
1436void xfrm6_fini(void);
1437int xfrm6_state_init(void);
1438void xfrm6_state_fini(void);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001439int xfrm6_protocol_init(void);
1440void xfrm6_protocol_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001441#else
1442static inline int xfrm6_init(void)
1443{
1444 return 0;
1445}
1446static inline void xfrm6_fini(void)
1447{
1448 ;
1449}
1450#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001451
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001452#ifdef CONFIG_XFRM_STATISTICS
Joe Perchesd5113372013-09-23 11:33:53 -07001453int xfrm_proc_init(struct net *net);
1454void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001455#endif
1456
Joe Perchesd5113372013-09-23 11:33:53 -07001457int xfrm_sysctl_init(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001458#ifdef CONFIG_SYSCTL
Joe Perchesd5113372013-09-23 11:33:53 -07001459void xfrm_sysctl_fini(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001460#else
1461static inline void xfrm_sysctl_fini(struct net *net)
1462{
1463}
1464#endif
1465
Nicolas Dichteld3623092014-02-14 15:30:36 +01001466void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
Nicolas Dichtel870a2df2014-03-06 18:24:29 +01001467 struct xfrm_address_filter *filter);
Joe Perchesd5113372013-09-23 11:33:53 -07001468int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1469 int (*func)(struct xfrm_state *, int, void*), void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001470void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001471struct xfrm_state *xfrm_state_alloc(struct net *net);
1472struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1473 const xfrm_address_t *saddr,
1474 const struct flowi *fl,
1475 struct xfrm_tmpl *tmpl,
1476 struct xfrm_policy *pol, int *err,
1477 unsigned short family);
1478struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1479 xfrm_address_t *daddr,
1480 xfrm_address_t *saddr,
1481 unsigned short family,
1482 u8 mode, u8 proto, u32 reqid);
Fan Duc4549972014-01-03 11:18:32 +08001483struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1484 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001485int xfrm_state_check_expire(struct xfrm_state *x);
1486void xfrm_state_insert(struct xfrm_state *x);
1487int xfrm_state_add(struct xfrm_state *x);
1488int xfrm_state_update(struct xfrm_state *x);
1489struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1490 const xfrm_address_t *daddr, __be32 spi,
1491 u8 proto, unsigned short family);
1492struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1493 const xfrm_address_t *daddr,
1494 const xfrm_address_t *saddr,
1495 u8 proto,
1496 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001497#ifdef CONFIG_XFRM_SUB_POLICY
Joe Perchesd5113372013-09-23 11:33:53 -07001498int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
Fan Du283bc9f2013-11-07 17:47:50 +08001499 unsigned short family, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001500int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1501 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001502#else
1503static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
Fan Du283bc9f2013-11-07 17:47:50 +08001504 int n, unsigned short family, struct net *net)
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001505{
1506 return -ENOSYS;
1507}
1508
1509static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1510 int n, unsigned short family)
1511{
1512 return -ENOSYS;
1513}
1514#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001515
1516struct xfrmk_sadinfo {
1517 u32 sadhcnt; /* current hash bkts */
1518 u32 sadhmcnt; /* max allowed hash bkts */
1519 u32 sadcnt; /* current running count */
1520};
1521
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001522struct xfrmk_spdinfo {
1523 u32 incnt;
1524 u32 outcnt;
1525 u32 fwdcnt;
1526 u32 inscnt;
1527 u32 outscnt;
1528 u32 fwdscnt;
1529 u32 spdhcnt;
1530 u32 spdhmcnt;
1531};
1532
Joe Perchesd5113372013-09-23 11:33:53 -07001533struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1534int xfrm_state_delete(struct xfrm_state *x);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001535int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -07001536void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1537void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1538u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1539int xfrm_init_replay(struct xfrm_state *x);
1540int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1541int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1542int xfrm_init_state(struct xfrm_state *x);
1543int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1544int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1545int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1546int xfrm_output_resume(struct sk_buff *skb, int err);
David Miller7026b1d2015-04-05 22:19:04 -04001547int xfrm_output(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001548int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1549void xfrm_local_error(struct sk_buff *skb, int mtu);
1550int xfrm4_extract_header(struct sk_buff *skb);
1551int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1552int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1553 int encap_type);
1554int xfrm4_transport_finish(struct sk_buff *skb, int async);
1555int xfrm4_rcv(struct sk_buff *skb);
Steffen Klassert1e295372017-02-15 09:39:49 +01001556int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Herbert Xuc4541b42007-10-17 21:28:53 -07001557
1558static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1559{
Steffen Klassert70be6c92014-02-21 08:41:09 +01001560 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
Steffen Klassert33287152014-02-21 08:41:08 +01001561 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1562 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1563 return xfrm_input(skb, nexthdr, spi, 0);
Herbert Xuc4541b42007-10-17 21:28:53 -07001564}
1565
Joe Perchesd5113372013-09-23 11:33:53 -07001566int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1567int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric W. Biedermanede20592015-10-07 16:48:47 -05001568int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001569int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
Steffen Klassert33287152014-02-21 08:41:08 +01001570int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1571int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1572int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001573int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1574int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001575void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1576int xfrm6_extract_header(struct sk_buff *skb);
1577int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Nicolas Dichtel63c43782016-09-19 16:17:57 +02001578int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1579 struct ip6_tnl *t);
Joe Perchesd5113372013-09-23 11:33:53 -07001580int xfrm6_transport_finish(struct sk_buff *skb, int async);
Nicolas Dichtel63c43782016-09-19 16:17:57 +02001581int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
Joe Perchesd5113372013-09-23 11:33:53 -07001582int xfrm6_rcv(struct sk_buff *skb);
1583int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1584 xfrm_address_t *saddr, u8 proto);
David S. Miller7b77d162013-09-30 15:11:00 -04001585void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001586int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1587int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1588int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001589int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
David S. Miller7b77d162013-09-30 15:11:00 -04001590int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001591__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1592__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1593int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1594int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric W. Biedermanede20592015-10-07 16:48:47 -05001595int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001596int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001597int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1598 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001599
1600#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001601int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1602int xfrm_user_policy(struct sock *sk, int optname,
1603 u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604#else
1605static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1606{
1607 return -ENOPROTOOPT;
1608}
1609
James Chapman067b2072007-07-05 17:08:05 -07001610static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001611{
1612 /* should not happen */
1613 kfree_skb(skb);
1614 return 0;
1615}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616#endif
1617
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001618struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001619
Joe Perchesd5113372013-09-23 11:33:53 -07001620void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1621int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1622 int (*func)(struct xfrm_policy *, int, int, void*),
1623 void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001624void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001625int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001626struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1627 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001628 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001629 struct xfrm_sec_ctx *ctx, int delete,
1630 int *err);
Joe Perchesd5113372013-09-23 11:33:53 -07001631struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1632 u32 id, int delete, int *err);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001633int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
Christophe Gouault880a6fa2014-08-29 16:16:05 +02001634void xfrm_policy_hash_rebuild(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001635u32 xfrm_get_acqseq(void);
Fan Du776e9dd2013-12-16 18:47:49 +08001636int verify_spi_info(u8 proto, u32 min, u32 max);
Joe Perchesd5113372013-09-23 11:33:53 -07001637int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Mathias Krausee473fcb2013-06-26 23:56:58 +02001638struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001639 u8 mode, u32 reqid, u8 proto,
David S. Millera70486f2011-02-27 23:17:24 -08001640 const xfrm_address_t *daddr,
1641 const xfrm_address_t *saddr, int create,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001642 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001643int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001645#ifdef CONFIG_XFRM_MIGRATE
Joe Perchesd5113372013-09-23 11:33:53 -07001646int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1647 const struct xfrm_migrate *m, int num_bundles,
1648 const struct xfrm_kmaddress *k);
Fan Du283bc9f2013-11-07 17:47:50 +08001649struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001650struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1651 struct xfrm_migrate *m);
1652int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1653 struct xfrm_migrate *m, int num_bundles,
Fan Du8d549c42013-11-07 17:47:49 +08001654 struct xfrm_kmaddress *k, struct net *net);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001655#endif
1656
Joe Perchesd5113372013-09-23 11:33:53 -07001657int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1658void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1659int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1660 xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001661
Joe Perchesd5113372013-09-23 11:33:53 -07001662void xfrm_input_init(void);
1663int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001664
Joe Perchesd5113372013-09-23 11:33:53 -07001665void xfrm_probe_algs(void);
1666int xfrm_count_pfkey_auth_supported(void);
1667int xfrm_count_pfkey_enc_supported(void);
1668struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1669struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1670struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1671struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1672struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1673struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1674struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1675struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1676struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1677 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001678
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001679static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1680 const xfrm_address_t *b)
1681{
1682 return ipv6_addr_equal((const struct in6_addr *)a,
1683 (const struct in6_addr *)b);
1684}
1685
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001686static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1687 const xfrm_address_t *b,
1688 sa_family_t family)
1689{
1690 switch (family) {
1691 default:
1692 case AF_INET:
1693 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1694 case AF_INET6:
1695 return xfrm6_addr_equal(a, b);
1696 }
1697}
1698
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001699static inline int xfrm_policy_id2dir(u32 index)
1700{
1701 return index & 7;
1702}
1703
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001704#ifdef CONFIG_XFRM
1705static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001706{
Patrick McHardybe336902006-03-20 22:40:54 -08001707 struct sock *nlsk;
1708 int ret = 0;
1709
1710 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001711 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001712 if (nlsk)
1713 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1714 rcu_read_unlock();
1715 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001716}
Horia Geanta0f245582014-02-12 16:20:06 +02001717
1718static inline int xfrm_acquire_is_on(struct net *net)
1719{
1720 struct sock *nlsk;
1721 int ret = 0;
1722
1723 rcu_read_lock();
1724 nlsk = rcu_dereference(net->xfrm.nlsk);
1725 if (nlsk)
1726 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1727 rcu_read_unlock();
1728
1729 return ret;
1730}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001731#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001732
Steffen Klassertee5c2312014-02-19 13:33:24 +01001733static inline int aead_len(struct xfrm_algo_aead *alg)
1734{
1735 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1736}
1737
David S. Miller85158622011-02-27 23:07:02 -08001738static inline int xfrm_alg_len(const struct xfrm_algo *alg)
Eric Dumazet0f99be02008-01-08 23:39:06 -08001739{
1740 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1741}
1742
David S. Miller85158622011-02-27 23:07:02 -08001743static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
Martin Willi4447bb32009-11-25 00:29:52 +00001744{
1745 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1746}
1747
Steffen Klassert9736acf2011-03-08 00:05:43 +00001748static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1749{
1750 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1751}
1752
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001753#ifdef CONFIG_XFRM_MIGRATE
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001754static inline int xfrm_replay_clone(struct xfrm_state *x,
1755 struct xfrm_state *orig)
1756{
1757 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1758 GFP_KERNEL);
1759 if (!x->replay_esn)
1760 return -ENOMEM;
1761
1762 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1763 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1764
1765 x->preplay_esn = kmemdup(x->replay_esn,
1766 xfrm_replay_state_esn_len(x->replay_esn),
1767 GFP_KERNEL);
1768 if (!x->preplay_esn) {
1769 kfree(x->replay_esn);
1770 return -ENOMEM;
1771 }
1772
1773 return 0;
1774}
1775
Steffen Klassertee5c2312014-02-19 13:33:24 +01001776static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1777{
1778 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1779}
1780
1781
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001782static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1783{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001784 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001785}
1786
Martin Willi4447bb32009-11-25 00:29:52 +00001787static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1788{
1789 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1790}
1791
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001792static inline void xfrm_states_put(struct xfrm_state **states, int n)
1793{
1794 int i;
1795 for (i = 0; i < n; i++)
1796 xfrm_state_put(*(states + i));
1797}
1798
1799static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1800{
1801 int i;
1802 for (i = 0; i < n; i++)
1803 xfrm_state_delete(*(states + i));
1804}
1805#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001806
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001807#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001808static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1809{
1810 return skb->sp->xvec[skb->sp->len - 1];
1811}
Steffen Klassert54ef2072017-02-15 09:39:54 +01001812static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1813{
1814 struct sec_path *sp = skb->sp;
1815
1816 if (!sp || !sp->olen || sp->len != sp->olen)
1817 return NULL;
1818
1819 return &sp->ovec[sp->olen - 1];
1820}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001821#endif
Herbert Xu00501122007-12-11 01:53:43 -08001822
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001823static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1824{
1825 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001826 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001827 else
1828 m->v = m->m = 0;
1829
1830 return m->v & m->m;
1831}
1832
David S. Millere3dfa382011-02-27 23:20:19 -08001833static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001834{
David S. Miller1d1e34d2012-06-27 21:57:03 -07001835 int ret = 0;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001836
David S. Miller1d1e34d2012-06-27 21:57:03 -07001837 if (m->m | m->v)
1838 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1839 return ret;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001840}
1841
Steffen Klassert70be6c92014-02-21 08:41:09 +01001842static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1843 unsigned int family)
1844{
1845 bool tunnel = false;
1846
1847 switch(family) {
1848 case AF_INET:
1849 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1850 tunnel = true;
1851 break;
1852 case AF_INET6:
1853 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1854 tunnel = true;
1855 break;
1856 }
1857 if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
1858 return -EINVAL;
1859
1860 return 0;
1861}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862#endif /* _NET_XFRM_H */