blob: 2328532f00762341d0894cf2efb5cd7a20e2bc35 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Nicolas Dichtelfa9921e2011-02-02 06:29:02 +000039#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070041#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070043#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080046#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080047#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
49#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080050#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080051#define XFRM_INC_STATS(net, field) ((void)(net))
52#define XFRM_INC_STATS_BH(net, field) ((void)(net))
53#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080054#endif
55
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080056extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070057
58/* Organization of SPD aka "XFRM rules"
59 ------------------------------------
60
61 Basic objects:
62 - policy rule, struct xfrm_policy (=SPD entry)
63 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
64 - instance of a transformer, struct xfrm_state (=SA)
65 - template to clone xfrm_state, struct xfrm_tmpl
66
67 SPD is plain linear list of xfrm_policy rules, ordered by priority.
68 (To be compatible with existing pfkeyv2 implementations,
69 many rules with priority of 0x7fffffff are allowed to exist and
70 such rules are ordered in an unpredictable way, thanks to bsd folks.)
71
72 Lookup is plain linear search until the first match with selector.
73
74 If "action" is "block", then we prohibit the flow, otherwise:
75 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
76 policy entry has list of up to XFRM_MAX_DEPTH transformations,
77 described by templates xfrm_tmpl. Each template is resolved
78 to a complete xfrm_state (see below) and we pack bundle of transformations
79 to a dst_entry returned to requestor.
80
81 dst -. xfrm .-> xfrm_state #1
82 |---. child .-> dst -. xfrm .-> xfrm_state #2
83 |---. child .-> dst -. xfrm .-> xfrm_state #3
84 |---. child .-> NULL
85
86 Bundles are cached at xrfm_policy struct (field ->bundles).
87
88
89 Resolution of xrfm_tmpl
90 -----------------------
91 Template contains:
92 1. ->mode Mode: transport or tunnel
93 2. ->id.proto Protocol: AH/ESP/IPCOMP
94 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
95 Q: allow to resolve security gateway?
96 4. ->id.spi If not zero, static SPI.
97 5. ->saddr Local tunnel endpoint, ignored for transport mode.
98 6. ->algos List of allowed algos. Plain bitmask now.
99 Q: ealgos, aalgos, calgos. What a mess...
100 7. ->share Sharing mode.
101 Q: how to implement private sharing mode? To add struct sock* to
102 flow id?
103
104 Having this template we search through SAD searching for entries
105 with appropriate mode/proto/algo, permitted by selector.
106 If no appropriate entry found, it is requested from key manager.
107
108 PROBLEMS:
109 Q: How to find all the bundles referring to a physical path for
110 PMTU discovery? Seems, dst should contain list of all parents...
111 and enter to infinite locking hierarchy disaster.
112 No! It is easier, we will not search for them, let them find us.
113 We add genid to each dst plus pointer to genid of raw IP route,
114 pmtu disc will update pmtu on raw IP route and increase its genid.
115 dst_check() will see this for top level and trigger resyncing
116 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
117 */
118
Herbert Xu12a169e2008-10-01 07:03:24 -0700119struct xfrm_state_walk {
120 struct list_head all;
121 u8 state;
122 union {
123 u8 dying;
124 u8 proto;
125 };
126 u32 seq;
127};
128
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000130struct xfrm_state {
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800131#ifdef CONFIG_NET_NS
132 struct net *xs_net;
133#endif
Herbert Xuabb81c42008-09-09 19:58:29 -0700134 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700135 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700136 struct hlist_node bydst;
137 };
David S. Miller8f126e32006-08-24 02:45:07 -0700138 struct hlist_node bysrc;
139 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140
141 atomic_t refcnt;
142 spinlock_t lock;
143
144 struct xfrm_id id;
145 struct xfrm_selector sel;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000146 struct xfrm_mark mark;
Martin Willi35d28562010-12-08 04:37:49 +0000147 u32 tfcpad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700148
David S. Miller9d4a7062006-08-24 03:18:09 -0700149 u32 genid;
150
Herbert Xu12a169e2008-10-01 07:03:24 -0700151 /* Key manager bits */
152 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700153
154 /* Parameters of this state. */
155 struct {
156 u32 reqid;
157 u8 mode;
158 u8 replay_window;
159 u8 aalgo, ealgo, calgo;
160 u8 flags;
161 u16 family;
162 xfrm_address_t saddr;
163 int header_len;
164 int trailer_len;
165 } props;
166
167 struct xfrm_lifetime_cfg lft;
168
169 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000170 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171 struct xfrm_algo *ealg;
172 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800173 struct xfrm_algo_aead *aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174
175 /* Data for encapsulator */
176 struct xfrm_encap_tmpl *encap;
177
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700178 /* Data for care-of address */
179 xfrm_address_t *coaddr;
180
Linus Torvalds1da177e2005-04-16 15:20:36 -0700181 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
182 struct xfrm_state *tunnel;
183
184 /* If a tunnel, number of users + 1 */
185 atomic_t tunnel_users;
186
187 /* State for replay detection */
188 struct xfrm_replay_state replay;
189
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800190 /* Replay detection state at the time we sent the last notification */
191 struct xfrm_replay_state preplay;
192
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700193 /* internal flag that only holds state for delayed aevent at the
194 * moment
195 */
196 u32 xflags;
197
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800198 /* Replay detection notification settings */
199 u32 replay_maxage;
200 u32 replay_maxdiff;
201
202 /* Replay detection notification timer */
203 struct timer_list rtimer;
204
Linus Torvalds1da177e2005-04-16 15:20:36 -0700205 /* Statistics */
206 struct xfrm_stats stats;
207
208 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800209 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700211 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800212 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700213
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214 /* Reference to data common to all the instances of this
215 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800216 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700217 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700218 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700219 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
Trent Jaegerdf718372005-12-13 23:12:27 -0800221 /* Security context */
222 struct xfrm_sec_ctx *security;
223
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224 /* Private data of this transformer, format is opaque,
225 * interpreted by xfrm_type methods. */
226 void *data;
227};
228
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800229static inline struct net *xs_net(struct xfrm_state *x)
230{
231 return read_pnet(&x->xs_net);
232}
233
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700234/* xflags - make enum if more show up */
235#define XFRM_TIME_DEFER 1
236
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237enum {
238 XFRM_STATE_VOID,
239 XFRM_STATE_ACQ,
240 XFRM_STATE_VALID,
241 XFRM_STATE_ERROR,
242 XFRM_STATE_EXPIRED,
243 XFRM_STATE_DEAD
244};
245
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700246/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000247struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700248 union {
249 u32 hard;
250 u32 proto;
251 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800252 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700253 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700254 } data;
255
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700256 u32 seq;
257 u32 pid;
258 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800259 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700260};
261
Herbert Xu25ee3282007-12-11 09:32:34 -0800262struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700263struct xfrm_type;
264struct xfrm_dst;
265struct xfrm_policy_afinfo {
266 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800268 void (*garbage_collect)(struct net *net);
Alexey Dobriyanc5b3cf42008-11-25 17:51:25 -0800269 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
270 xfrm_address_t *saddr,
Herbert Xu66cdb3c2007-11-13 21:37:28 -0800271 xfrm_address_t *daddr);
Alexey Dobriyanfbda33b2008-11-25 17:56:49 -0800272 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800274 struct flowi *fl,
275 int reverse);
David S. Miller05d84022011-02-22 17:47:10 -0800276 int (*get_tos)(const struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800277 int (*init_path)(struct xfrm_dst *path,
278 struct dst_entry *dst,
279 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800280 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000281 struct net_device *dev,
David S. Miller0c7b3ee2011-02-22 17:48:57 -0800282 const struct flowi *fl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283};
284
285extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
286extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700287extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
288extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289
290struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800291extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800292extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
293extern int __xfrm_state_delete(struct xfrm_state *x);
294
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700296 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800297 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700298 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700299 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800300 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700301 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700302 int (*init_flags)(struct xfrm_state *x);
David S. Miller73e5ebb2011-02-22 17:51:44 -0800303 void (*init_tempsel)(struct xfrm_selector *sel,
304 const struct flowi *fl);
Thomas Egerer8444cf72010-09-20 11:11:38 -0700305 void (*init_temprop)(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700306 xfrm_address_t *daddr, xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700307 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
308 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Miika Komucdca7262007-02-06 14:24:56 -0800309 int (*output)(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800310 int (*extract_input)(struct xfrm_state *x,
311 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800312 int (*extract_output)(struct xfrm_state *x,
313 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800314 int (*transport_finish)(struct sk_buff *skb,
315 int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700316};
317
318extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
319extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
320
321extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
322
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000323struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324 char *description;
325 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000326 u8 proto;
327 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700328#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700329#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800330#define XFRM_TYPE_LOCAL_COADDR 4
331#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700332
Herbert Xu72cb6962005-06-20 13:18:08 -0700333 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700334 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800335 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
David S. Miller8f029de2011-02-22 17:59:59 -0800337 int (*reject)(struct xfrm_state *, struct sk_buff *,
338 const struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700339 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700340 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700341 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342};
343
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800344extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
345extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700346
Herbert Xub59f45d2006-05-27 23:05:54 -0700347struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800348 /*
349 * Remove encapsulation header.
350 *
351 * The IP header will be moved over the top of the encapsulation
352 * header.
353 *
354 * On entry, the transport header shall point to where the IP header
355 * should be and the network header shall be set to where the IP
356 * header currently is. skb->data shall point to the start of the
357 * payload.
358 */
359 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
360
361 /*
362 * This is the actual input entry point.
363 *
364 * For transport mode and equivalent this would be identical to
365 * input2 (which does not need to be set). While tunnel mode
366 * and equivalent would set this to the tunnel encapsulation function
367 * xfrm4_prepare_input that would in turn call input2.
368 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700369 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700370
371 /*
372 * Add encapsulation header.
373 *
374 * On exit, the transport header will be set to the start of the
375 * encapsulation header to be filled in by x->type->output and
376 * the mac header will be set to the nextheader (protocol for
377 * IPv4) field of the extension header directly preceding the
378 * encapsulation header, or in its absence, that of the top IP
379 * header. The value of the network header will always point
380 * to the top IP header while skb->data will point to the payload.
381 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800382 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
383
384 /*
385 * This is the actual output entry point.
386 *
387 * For transport mode and equivalent this would be identical to
388 * output2 (which does not need to be set). While tunnel mode
389 * and equivalent would set this to a tunnel encapsulation function
390 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
391 * call output2.
392 */
393 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700394
Herbert Xu17c2a422007-10-17 21:33:12 -0700395 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700396 struct module *owner;
397 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700398 int flags;
399};
400
401/* Flags for xfrm_mode. */
402enum {
403 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700404};
405
406extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
407extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700408
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700409static inline int xfrm_af2proto(unsigned int family)
410{
411 switch(family) {
412 case AF_INET:
413 return IPPROTO_IPIP;
414 case AF_INET6:
415 return IPPROTO_IPV6;
416 default:
417 return 0;
418 }
419}
420
421static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
422{
423 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
424 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
425 return x->inner_mode;
426 else
427 return x->inner_mode_iaf;
428}
429
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000430struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700431/* id in template is interpreted as:
432 * daddr - destination of tunnel, may be zero for transport mode.
433 * spi - zero to acquire spi. Not zero if spi is static, then
434 * daddr must be fixed too.
435 * proto - AH/ESP/IPCOMP
436 */
437 struct xfrm_id id;
438
439/* Source address of tunnel. Ignored, if it is not a tunnel. */
440 xfrm_address_t saddr;
441
Miika Komu76b3f052006-11-30 16:40:43 -0800442 unsigned short encap_family;
443
jamala6337462010-02-09 13:21:17 +0000444 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700445
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700446/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000447 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700448
449/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000450 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700451
452/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000453 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454
Herbert Xuc5d18e92008-04-22 00:46:42 -0700455/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000456 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700457
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000459 u32 aalgos;
460 u32 ealgos;
461 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700462};
463
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700464#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700465
Herbert Xu12a169e2008-10-01 07:03:24 -0700466struct xfrm_policy_walk_entry {
467 struct list_head all;
468 u8 dead;
469};
470
471struct xfrm_policy_walk {
472 struct xfrm_policy_walk_entry walk;
473 u8 type;
474 u32 seq;
475};
476
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000477struct xfrm_policy {
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800478#ifdef CONFIG_NET_NS
479 struct net *xp_net;
480#endif
David S. Miller2518c7c2006-08-24 04:45:07 -0700481 struct hlist_node bydst;
482 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700483
484 /* This lock only affects elements except for entry. */
485 rwlock_t lock;
486 atomic_t refcnt;
487 struct timer_list timer;
488
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000489 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000490 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700491 u32 priority;
492 u32 index;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000493 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700494 struct xfrm_selector selector;
495 struct xfrm_lifetime_cfg lft;
496 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700497 struct xfrm_policy_walk_entry walk;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200498 u8 type;
499 u8 action;
500 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200501 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700502 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800503 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700504 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
505};
506
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800507static inline struct net *xp_net(struct xfrm_policy *xp)
508{
509 return read_pnet(&xp->xp_net);
510}
511
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700512struct xfrm_kmaddress {
513 xfrm_address_t local;
514 xfrm_address_t remote;
515 u32 reserved;
516 u16 family;
517};
518
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800519struct xfrm_migrate {
520 xfrm_address_t old_daddr;
521 xfrm_address_t old_saddr;
522 xfrm_address_t new_daddr;
523 xfrm_address_t new_saddr;
524 u8 proto;
525 u8 mode;
526 u16 reserved;
527 u32 reqid;
528 u16 old_family;
529 u16 new_family;
530};
531
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800532#define XFRM_KM_TIMEOUT 30
533/* which seqno */
534#define XFRM_REPLAY_SEQ 1
535#define XFRM_REPLAY_OSEQ 2
536#define XFRM_REPLAY_SEQ_MASK 3
537/* what happened */
538#define XFRM_REPLAY_UPDATE XFRM_AE_CR
539#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
540
541/* default aevent timeout in units of 100ms */
542#define XFRM_AE_ETIME 10
543/* Async Event timer multiplier */
544#define XFRM_AE_ETH_M 10
545/* default seq threshold size */
546#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700547
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000548struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700549 struct list_head list;
550 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700551 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700553 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800554 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700555 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800556 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700557 int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700558};
559
560extern int xfrm_register_km(struct xfrm_mgr *km);
561extern int xfrm_unregister_km(struct xfrm_mgr *km);
562
Herbert Xu436a0a42007-10-08 17:25:53 -0700563/*
564 * This structure is used for the duration where packets are being
565 * transformed by IPsec. As soon as the packet leaves IPsec the
566 * area beyond the generic IP part may be overwritten.
567 */
568struct xfrm_skb_cb {
569 union {
570 struct inet_skb_parm h4;
571 struct inet6_skb_parm h6;
572 } header;
573
574 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800575 union {
576 u64 output;
577 __be32 input;
578 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700579};
580
581#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
582
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800583/*
584 * This structure is used by the afinfo prepare_input/prepare_output functions
585 * to transmit header information to the mode input/output functions.
586 */
587struct xfrm_mode_skb_cb {
588 union {
589 struct inet_skb_parm h4;
590 struct inet6_skb_parm h6;
591 } header;
592
593 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
594 __be16 id;
595 __be16 frag_off;
596
Herbert Xu732c8bd2008-03-26 16:51:09 -0700597 /* IP header length (excluding options or extension headers). */
598 u8 ihl;
599
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800600 /* TOS for IPv4, class for IPv6. */
601 u8 tos;
602
603 /* TTL for IPv4, hop limitfor IPv6. */
604 u8 ttl;
605
606 /* Protocol for IPv4, NH for IPv6. */
607 u8 protocol;
608
Herbert Xu732c8bd2008-03-26 16:51:09 -0700609 /* Option length for IPv4, zero for IPv6. */
610 u8 optlen;
611
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800612 /* Used by IPv6 only, zero for IPv4. */
613 u8 flow_lbl[3];
614};
615
616#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
617
Herbert Xu716062f2007-11-13 21:44:23 -0800618/*
619 * This structure is used by the input processing to locate the SPI and
620 * related information.
621 */
622struct xfrm_spi_skb_cb {
623 union {
624 struct inet_skb_parm h4;
625 struct inet6_skb_parm h6;
626 } header;
627
Herbert Xu716062f2007-11-13 21:44:23 -0800628 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800629 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800630};
631
632#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
633
Joy Latten161a09e2006-11-27 13:11:54 -0600634/* Audit Information */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000635struct xfrm_audit {
Joy Latten161a09e2006-11-27 13:11:54 -0600636 u32 secid;
Eric Paris25323862008-04-18 10:09:25 -0400637 uid_t loginuid;
638 u32 sessionid;
Joy Latten161a09e2006-11-27 13:11:54 -0600639};
Joy Lattenc9204d92006-11-30 15:50:43 -0600640
641#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800642static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700643{
644 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800645
646 if (audit_enabled == 0)
647 return NULL;
648 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
649 AUDIT_MAC_IPSEC_EVENT);
650 if (audit_buf == NULL)
651 return NULL;
652 audit_log_format(audit_buf, "op=%s", op);
653 return audit_buf;
654}
655
Eric Paris25323862008-04-18 10:09:25 -0400656static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800657 struct audit_buffer *audit_buf)
658{
Joy Lattenab5f5e82007-09-17 11:51:22 -0700659 char *secctx;
660 u32 secctx_len;
661
Eric Paris25323862008-04-18 10:09:25 -0400662 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Paul Moore68277ac2007-12-20 20:49:33 -0800663 if (secid != 0 &&
664 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
Joy Lattenab5f5e82007-09-17 11:51:22 -0700665 audit_log_format(audit_buf, " subj=%s", secctx);
666 security_release_secctx(secctx, secctx_len);
667 } else
668 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700669}
670
671extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400672 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700673extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400674 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700675extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400676 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700677extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400678 u32 auid, u32 ses, u32 secid);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800679extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
680 struct sk_buff *skb);
681extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
682extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
683 __be32 net_spi, __be32 net_seq);
684extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
685 struct sk_buff *skb, u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600686#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700687
688static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
689 u32 auid, u32 ses, u32 secid)
690{
691}
692
693static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
694 u32 auid, u32 ses, u32 secid)
695{
696}
697
698static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
699 u32 auid, u32 ses, u32 secid)
700{
701}
702
703static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
704 u32 auid, u32 ses, u32 secid)
705{
706}
707
708static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
709 struct sk_buff *skb)
710{
711}
712
713static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
714 u16 family)
715{
716}
717
718static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
719 __be32 net_spi, __be32 net_seq)
720{
721}
722
723static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
724 struct sk_buff *skb, u8 proto)
725{
726}
Joy Lattenc9204d92006-11-30 15:50:43 -0600727#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600728
Linus Torvalds1da177e2005-04-16 15:20:36 -0700729static inline void xfrm_pol_hold(struct xfrm_policy *policy)
730{
731 if (likely(policy != NULL))
732 atomic_inc(&policy->refcnt);
733}
734
WANG Cong64c31b32008-01-07 22:34:29 -0800735extern void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700736
737static inline void xfrm_pol_put(struct xfrm_policy *policy)
738{
739 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800740 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700741}
742
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700743static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
744{
745 int i;
746 for (i = npols - 1; i >= 0; --i)
747 xfrm_pol_put(pols[i]);
748}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700749
Linus Torvalds1da177e2005-04-16 15:20:36 -0700750extern void __xfrm_state_destroy(struct xfrm_state *);
751
Herbert Xu21380b82006-02-22 14:47:13 -0800752static inline void __xfrm_state_put(struct xfrm_state *x)
753{
754 atomic_dec(&x->refcnt);
755}
756
Linus Torvalds1da177e2005-04-16 15:20:36 -0700757static inline void xfrm_state_put(struct xfrm_state *x)
758{
759 if (atomic_dec_and_test(&x->refcnt))
760 __xfrm_state_destroy(x);
761}
762
763static inline void xfrm_state_hold(struct xfrm_state *x)
764{
765 atomic_inc(&x->refcnt);
766}
767
David S. Miller1744a8f2011-02-22 18:02:12 -0800768static inline bool addr_match(const void *token1, const void *token2,
769 int prefixlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700770{
David S. Miller1744a8f2011-02-22 18:02:12 -0800771 const __be32 *a1 = token1;
772 const __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700773 int pdw;
774 int pbi;
775
jamala6337462010-02-09 13:21:17 +0000776 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700777 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
778
779 if (pdw)
780 if (memcmp(a1, a2, pdw << 2))
David S. Miller1744a8f2011-02-22 18:02:12 -0800781 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700782
783 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700784 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700785
786 mask = htonl((0xffffffff) << (32 - pbi));
787
788 if ((a1[pdw] ^ a2[pdw]) & mask)
David S. Miller1744a8f2011-02-22 18:02:12 -0800789 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 }
791
David S. Miller1744a8f2011-02-22 18:02:12 -0800792 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700793}
794
795static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -0800796__be16 xfrm_flowi_sport(const struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700797{
Al Virof9d07e41f82006-09-27 18:45:50 -0700798 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700799 switch(fl->proto) {
800 case IPPROTO_TCP:
801 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800802 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700803 case IPPROTO_SCTP:
804 port = fl->fl_ip_sport;
805 break;
806 case IPPROTO_ICMP:
807 case IPPROTO_ICMPV6:
808 port = htons(fl->fl_icmp_type);
809 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700810 case IPPROTO_MH:
811 port = htons(fl->fl_mh_type);
812 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000813 case IPPROTO_GRE:
Timo Teräsaa285b12010-11-23 04:03:45 +0000814 port = htons(ntohl(fl->fl_gre_key) >> 16);
Timo Teräscc9ff192010-11-03 04:41:38 +0000815 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700816 default:
817 port = 0; /*XXX*/
818 }
819 return port;
820}
821
822static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -0800823__be16 xfrm_flowi_dport(const struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824{
Al Virof9d07e41f82006-09-27 18:45:50 -0700825 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700826 switch(fl->proto) {
827 case IPPROTO_TCP:
828 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800829 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700830 case IPPROTO_SCTP:
831 port = fl->fl_ip_dport;
832 break;
833 case IPPROTO_ICMP:
834 case IPPROTO_ICMPV6:
835 port = htons(fl->fl_icmp_code);
836 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000837 case IPPROTO_GRE:
Timo Teräsaa285b12010-11-23 04:03:45 +0000838 port = htons(ntohl(fl->fl_gre_key) & 0xffff);
Timo Teräscc9ff192010-11-03 04:41:38 +0000839 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840 default:
841 port = 0; /*XXX*/
842 }
843 return port;
844}
845
Andrew Morton77681022006-11-08 22:46:26 -0800846extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
847 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700848
Trent Jaegerdf718372005-12-13 23:12:27 -0800849#ifdef CONFIG_SECURITY_NETWORK_XFRM
850/* If neither has a context --> match
851 * Otherwise, both must have a context and the sids, doi, alg must match
852 */
853static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
854{
855 return ((!s1 && !s2) ||
856 (s1 && s2 &&
857 (s1->ctx_sid == s2->ctx_sid) &&
858 (s1->ctx_doi == s2->ctx_doi) &&
859 (s1->ctx_alg == s2->ctx_alg)));
860}
861#else
862static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
863{
864 return 1;
865}
866#endif
867
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868/* A struct encoding bundle of transformations to apply to some set of flow.
869 *
870 * dst->child points to the next element of bundle.
871 * dst->xfrm points to an instanse of transformer.
872 *
873 * Due to unfortunate limitations of current routing cache, which we
874 * have no time to fix, it mirrors struct rtable and bound to the same
875 * routing key, including saddr,daddr. However, we can have many of
876 * bundles differing by session id. All the bundles grow from a parent
877 * policy rule.
878 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000879struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700880 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700881 struct dst_entry dst;
882 struct rtable rt;
883 struct rt6_info rt6;
884 } u;
885 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000886 struct flow_cache_object flo;
887 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
888 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700889#ifdef CONFIG_XFRM_SUB_POLICY
890 struct flowi *origin;
891 struct xfrm_selector *partner;
892#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000893 u32 xfrm_genid;
894 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700895 u32 route_mtu_cached;
896 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700897 u32 route_cookie;
898 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700899};
900
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700901#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700902static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
903{
Timo Teräs80c802f2010-04-07 00:30:05 +0000904 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700905 dst_release(xdst->route);
906 if (likely(xdst->u.dst.xfrm))
907 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700908#ifdef CONFIG_XFRM_SUB_POLICY
909 kfree(xdst->origin);
910 xdst->origin = NULL;
911 kfree(xdst->partner);
912 xdst->partner = NULL;
913#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700914}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700915#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700916
917extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
918
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000919struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700920 atomic_t refcnt;
921 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800922 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700923};
924
925static inline struct sec_path *
926secpath_get(struct sec_path *sp)
927{
928 if (sp)
929 atomic_inc(&sp->refcnt);
930 return sp;
931}
932
933extern void __secpath_destroy(struct sec_path *sp);
934
935static inline void
936secpath_put(struct sec_path *sp)
937{
938 if (sp && atomic_dec_and_test(&sp->refcnt))
939 __secpath_destroy(sp);
940}
941
942extern struct sec_path *secpath_dup(struct sec_path *src);
943
944static inline void
945secpath_reset(struct sk_buff *skb)
946{
947#ifdef CONFIG_XFRM
948 secpath_put(skb->sp);
949 skb->sp = NULL;
950#endif
951}
952
953static inline int
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700954xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
955{
956 switch (family) {
957 case AF_INET:
958 return addr->a4 == 0;
959 case AF_INET6:
960 return ipv6_addr_any((struct in6_addr *)&addr->a6);
961 }
962 return 0;
963}
964
965static inline int
Linus Torvalds1da177e2005-04-16 15:20:36 -0700966__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
967{
968 return (tmpl->saddr.a4 &&
969 tmpl->saddr.a4 != x->props.saddr.a4);
970}
971
972static inline int
973__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
974{
975 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
976 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
977}
978
979static inline int
980xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
981{
982 switch (family) {
983 case AF_INET:
984 return __xfrm4_state_addr_cmp(tmpl, x);
985 case AF_INET6:
986 return __xfrm6_state_addr_cmp(tmpl, x);
987 }
988 return !0;
989}
990
991#ifdef CONFIG_XFRM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700992extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
993
Herbert Xud5422ef2007-12-12 10:44:16 -0800994static inline int __xfrm_policy_check2(struct sock *sk, int dir,
995 struct sk_buff *skb,
996 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700997{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800998 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -0800999 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1000
Linus Torvalds1da177e2005-04-16 15:20:36 -07001001 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -08001002 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001003
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001004 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001005 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -08001006 __xfrm_policy_check(sk, ndir, skb, family);
1007}
1008
1009static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1010{
1011 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001012}
1013
1014static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1015{
1016 return xfrm_policy_check(sk, dir, skb, AF_INET);
1017}
1018
1019static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1020{
1021 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1022}
1023
Herbert Xud5422ef2007-12-12 10:44:16 -08001024static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1025 struct sk_buff *skb)
1026{
1027 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1028}
1029
1030static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1031 struct sk_buff *skb)
1032{
1033 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1034}
1035
1036extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1037 unsigned int family, int reverse);
1038
1039static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1040 unsigned int family)
1041{
1042 return __xfrm_decode_session(skb, fl, family, 0);
1043}
1044
1045static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1046 struct flowi *fl,
1047 unsigned int family)
1048{
1049 return __xfrm_decode_session(skb, fl, family, 1);
1050}
1051
Linus Torvalds1da177e2005-04-16 15:20:36 -07001052extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1053
1054static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1055{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001056 struct net *net = dev_net(skb->dev);
1057
1058 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001059 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001060 __xfrm_route_forward(skb, family);
1061}
1062
1063static inline int xfrm4_route_forward(struct sk_buff *skb)
1064{
1065 return xfrm_route_forward(skb, AF_INET);
1066}
1067
1068static inline int xfrm6_route_forward(struct sk_buff *skb)
1069{
1070 return xfrm_route_forward(skb, AF_INET6);
1071}
1072
1073extern int __xfrm_sk_clone_policy(struct sock *sk);
1074
1075static inline int xfrm_sk_clone_policy(struct sock *sk)
1076{
1077 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1078 return __xfrm_sk_clone_policy(sk);
1079 return 0;
1080}
1081
Herbert Xu4666faa2005-06-18 22:43:22 -07001082extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001083
1084static inline void xfrm_sk_free_policy(struct sock *sk)
1085{
1086 if (unlikely(sk->sk_policy[0] != NULL)) {
1087 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1088 sk->sk_policy[0] = NULL;
1089 }
1090 if (unlikely(sk->sk_policy[1] != NULL)) {
1091 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1092 sk->sk_policy[1] = NULL;
1093 }
1094}
1095
1096#else
1097
1098static inline void xfrm_sk_free_policy(struct sock *sk) {}
1099static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1100static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1101static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1102static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1103{
1104 return 1;
1105}
1106static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1107{
1108 return 1;
1109}
1110static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1111{
1112 return 1;
1113}
Herbert Xud5422ef2007-12-12 10:44:16 -08001114static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1115 struct flowi *fl,
1116 unsigned int family)
1117{
1118 return -ENOSYS;
1119}
1120static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1121 struct sk_buff *skb)
1122{
1123 return 1;
1124}
1125static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1126 struct sk_buff *skb)
1127{
1128 return 1;
1129}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001130#endif
1131
1132static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001133xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001134{
1135 switch (family){
1136 case AF_INET:
1137 return (xfrm_address_t *)&fl->fl4_dst;
1138 case AF_INET6:
1139 return (xfrm_address_t *)&fl->fl6_dst;
1140 }
1141 return NULL;
1142}
1143
1144static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001145xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001146{
1147 switch (family){
1148 case AF_INET:
1149 return (xfrm_address_t *)&fl->fl4_src;
1150 case AF_INET6:
1151 return (xfrm_address_t *)&fl->fl6_src;
1152 }
1153 return NULL;
1154}
1155
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001156static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001157void xfrm_flowi_addr_get(const struct flowi *fl,
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001158 xfrm_address_t *saddr, xfrm_address_t *daddr,
1159 unsigned short family)
1160{
1161 switch(family) {
1162 case AF_INET:
1163 memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
1164 memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
1165 break;
1166 case AF_INET6:
1167 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
1168 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
1169 break;
1170 }
1171}
1172
Linus Torvalds1da177e2005-04-16 15:20:36 -07001173static __inline__ int
1174__xfrm4_state_addr_check(struct xfrm_state *x,
1175 xfrm_address_t *daddr, xfrm_address_t *saddr)
1176{
1177 if (daddr->a4 == x->id.daddr.a4 &&
1178 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1179 return 1;
1180 return 0;
1181}
1182
1183static __inline__ int
1184__xfrm6_state_addr_check(struct xfrm_state *x,
1185 xfrm_address_t *daddr, xfrm_address_t *saddr)
1186{
1187 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1188 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1189 ipv6_addr_any((struct in6_addr *)saddr) ||
1190 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1191 return 1;
1192 return 0;
1193}
1194
1195static __inline__ int
1196xfrm_state_addr_check(struct xfrm_state *x,
1197 xfrm_address_t *daddr, xfrm_address_t *saddr,
1198 unsigned short family)
1199{
1200 switch (family) {
1201 case AF_INET:
1202 return __xfrm4_state_addr_check(x, daddr, saddr);
1203 case AF_INET6:
1204 return __xfrm6_state_addr_check(x, daddr, saddr);
1205 }
1206 return 0;
1207}
1208
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001209static __inline__ int
David S. Millere8a4e372011-02-22 17:42:56 -08001210xfrm_state_addr_flow_check(struct xfrm_state *x, const struct flowi *fl,
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001211 unsigned short family)
1212{
1213 switch (family) {
1214 case AF_INET:
1215 return __xfrm4_state_addr_check(x,
1216 (xfrm_address_t *)&fl->fl4_dst,
1217 (xfrm_address_t *)&fl->fl4_src);
1218 case AF_INET6:
1219 return __xfrm6_state_addr_check(x,
1220 (xfrm_address_t *)&fl->fl6_dst,
1221 (xfrm_address_t *)&fl->fl6_src);
1222 }
1223 return 0;
1224}
1225
Linus Torvalds1da177e2005-04-16 15:20:36 -07001226static inline int xfrm_state_kern(struct xfrm_state *x)
1227{
1228 return atomic_read(&x->tunnel_users);
1229}
1230
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001231static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1232{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001233 return (!userproto || proto == userproto ||
1234 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1235 proto == IPPROTO_ESP ||
1236 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001237}
1238
Linus Torvalds1da177e2005-04-16 15:20:36 -07001239/*
1240 * xfrm algorithm information
1241 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001242struct xfrm_algo_aead_info {
1243 u16 icv_truncbits;
1244};
1245
Linus Torvalds1da177e2005-04-16 15:20:36 -07001246struct xfrm_algo_auth_info {
1247 u16 icv_truncbits;
1248 u16 icv_fullbits;
1249};
1250
1251struct xfrm_algo_encr_info {
1252 u16 blockbits;
1253 u16 defkeybits;
1254};
1255
1256struct xfrm_algo_comp_info {
1257 u16 threshold;
1258};
1259
1260struct xfrm_algo_desc {
1261 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001262 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001263 u8 available:1;
1264 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001265 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001266 struct xfrm_algo_auth_info auth;
1267 struct xfrm_algo_encr_info encr;
1268 struct xfrm_algo_comp_info comp;
1269 } uinfo;
1270 struct sadb_alg desc;
1271};
1272
1273/* XFRM tunnel handlers. */
1274struct xfrm_tunnel {
1275 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001276 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001277
Eric Dumazetb33eab02010-10-25 21:01:26 +00001278 struct xfrm_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001279 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001280};
1281
1282struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001283 int (*handler)(struct sk_buff *skb);
1284 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001285 u8 type, u8 code, int offset, __be32 info);
Eric Dumazet6f0bcf12010-10-24 21:33:16 +00001286 struct xfrm6_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001287 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001288};
1289
1290extern void xfrm_init(void);
Neil Hormana33bc5c2009-07-30 18:52:15 -07001291extern void xfrm4_init(int rt_hash_size);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08001292extern int xfrm_state_init(struct net *net);
1293extern void xfrm_state_fini(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001294extern void xfrm4_state_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001295#ifdef CONFIG_XFRM
1296extern int xfrm6_init(void);
1297extern void xfrm6_fini(void);
Daniel Lezcano0013cab2007-12-07 00:42:11 -08001298extern int xfrm6_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001299extern void xfrm6_state_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001300#else
1301static inline int xfrm6_init(void)
1302{
1303 return 0;
1304}
1305static inline void xfrm6_fini(void)
1306{
1307 ;
1308}
1309#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001310
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001311#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyanc68cd1a2008-11-25 18:00:14 -08001312extern int xfrm_proc_init(struct net *net);
1313extern void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001314#endif
1315
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001316extern int xfrm_sysctl_init(struct net *net);
1317#ifdef CONFIG_SYSCTL
1318extern void xfrm_sysctl_fini(struct net *net);
1319#else
1320static inline void xfrm_sysctl_fini(struct net *net)
1321{
1322}
1323#endif
1324
Herbert Xu5c182452008-09-22 19:48:19 -07001325extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001326extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001327 int (*func)(struct xfrm_state *, int, void*), void *);
Herbert Xuabb81c42008-09-09 19:58:29 -07001328extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
Alexey Dobriyan673c09b2008-11-25 17:15:16 -08001329extern struct xfrm_state *xfrm_state_alloc(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001330extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1331 struct flowi *fl, struct xfrm_tmpl *tmpl,
1332 struct xfrm_policy *pol, int *err,
1333 unsigned short family);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001334extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001335 xfrm_address_t *daddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -07001336 xfrm_address_t *saddr,
1337 unsigned short family,
1338 u8 mode, u8 proto, u32 reqid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001339extern int xfrm_state_check_expire(struct xfrm_state *x);
1340extern void xfrm_state_insert(struct xfrm_state *x);
1341extern int xfrm_state_add(struct xfrm_state *x);
1342extern int xfrm_state_update(struct xfrm_state *x);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001343extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1344 xfrm_address_t *daddr, __be32 spi,
1345 u8 proto, unsigned short family);
1346extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1347 xfrm_address_t *daddr,
1348 xfrm_address_t *saddr,
1349 u8 proto,
1350 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001351#ifdef CONFIG_XFRM_SUB_POLICY
1352extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1353 int n, unsigned short family);
1354extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1355 int n, unsigned short family);
1356#else
1357static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1358 int n, unsigned short family)
1359{
1360 return -ENOSYS;
1361}
1362
1363static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1364 int n, unsigned short family)
1365{
1366 return -ENOSYS;
1367}
1368#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001369
1370struct xfrmk_sadinfo {
1371 u32 sadhcnt; /* current hash bkts */
1372 u32 sadhmcnt; /* max allowed hash bkts */
1373 u32 sadcnt; /* current running count */
1374};
1375
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001376struct xfrmk_spdinfo {
1377 u32 incnt;
1378 u32 outcnt;
1379 u32 fwdcnt;
1380 u32 inscnt;
1381 u32 outscnt;
1382 u32 fwdscnt;
1383 u32 spdhcnt;
1384 u32 spdhmcnt;
1385};
1386
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001387extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1388 u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001389extern int xfrm_state_delete(struct xfrm_state *x);
Alexey Dobriyan0e602452008-11-25 17:30:18 -08001390extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
Alexey Dobriyane0710412010-01-23 13:37:10 +00001391extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1392extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
Paul Mooreafeb14b2007-12-21 14:58:11 -08001393extern int xfrm_replay_check(struct xfrm_state *x,
1394 struct sk_buff *skb, __be32 seq);
Al Viro61f46272006-09-27 18:48:33 -07001395extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001396extern void xfrm_replay_notify(struct xfrm_state *x, int event);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001397extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -07001398extern int xfrm_init_state(struct xfrm_state *x);
Herbert Xu227620e2007-11-13 21:41:28 -08001399extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -08001400extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1401 int encap_type);
Herbert Xu1bf06cd2007-11-19 18:50:17 -08001402extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
Herbert Xuc6581a42007-11-13 21:43:43 -08001403extern int xfrm_output_resume(struct sk_buff *skb, int err);
Herbert Xu406ef772007-10-08 17:16:30 -07001404extern int xfrm_output(struct sk_buff *skb);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001405extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001406extern int xfrm4_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001407extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001408extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1409 int encap_type);
Herbert Xu716062f2007-11-13 21:44:23 -08001410extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001411extern int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001412
1413static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1414{
1415 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1416}
1417
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001418extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1419extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001420extern int xfrm4_output(struct sk_buff *skb);
Kazunori MIYAZAWAc0d56402007-02-13 12:54:47 -08001421extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1422extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001423extern int xfrm6_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001424extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu33b5ecb2007-10-17 21:29:25 -07001425extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
Herbert Xu716062f2007-11-13 21:44:23 -08001426extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
Herbert Xue5bbef22007-10-15 12:50:28 -07001427extern int xfrm6_rcv(struct sk_buff *skb);
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -07001428extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1429 xfrm_address_t *saddr, u8 proto);
Kazunori MIYAZAWA73d605d2007-02-13 12:55:55 -08001430extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1431extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001432extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001433extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001434extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1435extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001436extern int xfrm6_output(struct sk_buff *skb);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -07001437extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1438 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001439
1440#ifdef CONFIG_XFRM
James Chapman067b2072007-07-05 17:08:05 -07001441extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001442extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001443#else
1444static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1445{
1446 return -ENOPROTOOPT;
1447}
1448
James Chapman067b2072007-07-05 17:08:05 -07001449static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001450{
1451 /* should not happen */
1452 kfree_skb(skb);
1453 return 0;
1454}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001455#endif
1456
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001457struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001458
Herbert Xu12a169e2008-10-01 07:03:24 -07001459extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
Alexey Dobriyancdcbca72008-11-25 17:34:49 -08001460extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001461 int (*func)(struct xfrm_policy *, int, int, void*), void *);
Herbert Xu12a169e2008-10-01 07:03:24 -07001462extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001464struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1465 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001466 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001467 struct xfrm_sec_ctx *ctx, int delete,
1468 int *err);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001469struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
Alexey Dobriyan33ffbbd2008-11-25 17:33:32 -08001470int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001471u32 xfrm_get_acqseq(void);
Herbert Xu658b2192007-10-09 13:29:52 -07001472extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001473struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1474 u8 mode, u32 reqid, u8 proto,
1475 xfrm_address_t *daddr,
1476 xfrm_address_t *saddr, int create,
1477 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001479
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001480#ifdef CONFIG_XFRM_MIGRATE
1481extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001482 struct xfrm_migrate *m, int num_bundles,
1483 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001484extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1485extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1486 struct xfrm_migrate *m);
1487extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001488 struct xfrm_migrate *m, int num_bundles,
1489 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001490#endif
1491
Al Viro5d36b182006-11-08 00:24:06 -08001492extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -08001493extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001494extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495
1496extern void xfrm_input_init(void);
Al Viro6067b2b2006-09-27 18:47:59 -07001497extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001498
1499extern void xfrm_probe_algs(void);
1500extern int xfrm_count_auth_supported(void);
1501extern int xfrm_count_enc_supported(void);
1502extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1503extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1504extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1505extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1506extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1507extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
1508extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
1509extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
Herbert Xu1a6509d2008-01-28 19:37:29 -08001510extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
1511 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512
Herbert Xu07d4ee52006-08-20 14:24:50 +10001513struct hash_desc;
Herbert Xu9409f382006-08-06 19:49:12 +10001514struct scatterlist;
Herbert Xu07d4ee52006-08-20 14:24:50 +10001515typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1516 unsigned int);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001517
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
1519 int family)
1520{
1521 switch (family) {
1522 default:
1523 case AF_INET:
jamala6337462010-02-09 13:21:17 +00001524 return (__force u32)a->a4 - (__force u32)b->a4;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001525 case AF_INET6:
1526 return ipv6_addr_cmp((struct in6_addr *)a,
1527 (struct in6_addr *)b);
1528 }
1529}
1530
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001531static inline int xfrm_policy_id2dir(u32 index)
1532{
1533 return index & 7;
1534}
1535
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001536#ifdef CONFIG_XFRM
1537static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001538{
Patrick McHardybe336902006-03-20 22:40:54 -08001539 struct sock *nlsk;
1540 int ret = 0;
1541
1542 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001543 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001544 if (nlsk)
1545 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1546 rcu_read_unlock();
1547 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001548}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001549#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001550
Eric Dumazet0f99be02008-01-08 23:39:06 -08001551static inline int xfrm_alg_len(struct xfrm_algo *alg)
1552{
1553 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1554}
1555
Martin Willi4447bb32009-11-25 00:29:52 +00001556static inline int xfrm_alg_auth_len(struct xfrm_algo_auth *alg)
1557{
1558 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1559}
1560
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001561#ifdef CONFIG_XFRM_MIGRATE
1562static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1563{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001564 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001565}
1566
Martin Willi4447bb32009-11-25 00:29:52 +00001567static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1568{
1569 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1570}
1571
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001572static inline void xfrm_states_put(struct xfrm_state **states, int n)
1573{
1574 int i;
1575 for (i = 0; i < n; i++)
1576 xfrm_state_put(*(states + i));
1577}
1578
1579static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1580{
1581 int i;
1582 for (i = 0; i < n; i++)
1583 xfrm_state_delete(*(states + i));
1584}
1585#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001586
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001587#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001588static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1589{
1590 return skb->sp->xvec[skb->sp->len - 1];
1591}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001592#endif
Herbert Xu00501122007-12-11 01:53:43 -08001593
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001594static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1595{
1596 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001597 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001598 else
1599 m->v = m->m = 0;
1600
1601 return m->v & m->m;
1602}
1603
1604static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
1605{
1606 if (m->m | m->v)
1607 NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1608 return 0;
1609
1610nla_put_failure:
1611 return -1;
1612}
1613
Linus Torvalds1da177e2005-04-16 15:20:36 -07001614#endif /* _NET_XFRM_H */