blob: fc8f36dd0f5c5145932c45aa8e9f441697dcb0ec [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Linus Torvalds1da177e2005-04-16 15:20:36 -070039#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070040#define MODULE_ALIAS_XFRM_MODE(family, encap) \
41 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070042#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
43 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070044
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080045#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080046#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
47#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
48#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080049#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080050#define XFRM_INC_STATS(net, field) ((void)(net))
51#define XFRM_INC_STATS_BH(net, field) ((void)(net))
52#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080053#endif
54
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080055extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070056
57/* Organization of SPD aka "XFRM rules"
58 ------------------------------------
59
60 Basic objects:
61 - policy rule, struct xfrm_policy (=SPD entry)
62 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
63 - instance of a transformer, struct xfrm_state (=SA)
64 - template to clone xfrm_state, struct xfrm_tmpl
65
66 SPD is plain linear list of xfrm_policy rules, ordered by priority.
67 (To be compatible with existing pfkeyv2 implementations,
68 many rules with priority of 0x7fffffff are allowed to exist and
69 such rules are ordered in an unpredictable way, thanks to bsd folks.)
70
71 Lookup is plain linear search until the first match with selector.
72
73 If "action" is "block", then we prohibit the flow, otherwise:
74 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
75 policy entry has list of up to XFRM_MAX_DEPTH transformations,
76 described by templates xfrm_tmpl. Each template is resolved
77 to a complete xfrm_state (see below) and we pack bundle of transformations
78 to a dst_entry returned to requestor.
79
80 dst -. xfrm .-> xfrm_state #1
81 |---. child .-> dst -. xfrm .-> xfrm_state #2
82 |---. child .-> dst -. xfrm .-> xfrm_state #3
83 |---. child .-> NULL
84
85 Bundles are cached at xrfm_policy struct (field ->bundles).
86
87
88 Resolution of xrfm_tmpl
89 -----------------------
90 Template contains:
91 1. ->mode Mode: transport or tunnel
92 2. ->id.proto Protocol: AH/ESP/IPCOMP
93 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
94 Q: allow to resolve security gateway?
95 4. ->id.spi If not zero, static SPI.
96 5. ->saddr Local tunnel endpoint, ignored for transport mode.
97 6. ->algos List of allowed algos. Plain bitmask now.
98 Q: ealgos, aalgos, calgos. What a mess...
99 7. ->share Sharing mode.
100 Q: how to implement private sharing mode? To add struct sock* to
101 flow id?
102
103 Having this template we search through SAD searching for entries
104 with appropriate mode/proto/algo, permitted by selector.
105 If no appropriate entry found, it is requested from key manager.
106
107 PROBLEMS:
108 Q: How to find all the bundles referring to a physical path for
109 PMTU discovery? Seems, dst should contain list of all parents...
110 and enter to infinite locking hierarchy disaster.
111 No! It is easier, we will not search for them, let them find us.
112 We add genid to each dst plus pointer to genid of raw IP route,
113 pmtu disc will update pmtu on raw IP route and increase its genid.
114 dst_check() will see this for top level and trigger resyncing
115 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
116 */
117
Herbert Xu12a169e2008-10-01 07:03:24 -0700118struct xfrm_state_walk {
119 struct list_head all;
120 u8 state;
121 union {
122 u8 dying;
123 u8 proto;
124 };
125 u32 seq;
126};
127
Linus Torvalds1da177e2005-04-16 15:20:36 -0700128/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000129struct xfrm_state {
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800130#ifdef CONFIG_NET_NS
131 struct net *xs_net;
132#endif
Herbert Xuabb81c42008-09-09 19:58:29 -0700133 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700134 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700135 struct hlist_node bydst;
136 };
David S. Miller8f126e32006-08-24 02:45:07 -0700137 struct hlist_node bysrc;
138 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700139
140 atomic_t refcnt;
141 spinlock_t lock;
142
143 struct xfrm_id id;
144 struct xfrm_selector sel;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000145 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146
David S. Miller9d4a7062006-08-24 03:18:09 -0700147 u32 genid;
148
Herbert Xu12a169e2008-10-01 07:03:24 -0700149 /* Key manager bits */
150 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151
152 /* Parameters of this state. */
153 struct {
154 u32 reqid;
155 u8 mode;
156 u8 replay_window;
157 u8 aalgo, ealgo, calgo;
158 u8 flags;
159 u16 family;
160 xfrm_address_t saddr;
161 int header_len;
162 int trailer_len;
163 } props;
164
165 struct xfrm_lifetime_cfg lft;
166
167 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000168 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700169 struct xfrm_algo *ealg;
170 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800171 struct xfrm_algo_aead *aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700172
173 /* Data for encapsulator */
174 struct xfrm_encap_tmpl *encap;
175
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700176 /* Data for care-of address */
177 xfrm_address_t *coaddr;
178
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
180 struct xfrm_state *tunnel;
181
182 /* If a tunnel, number of users + 1 */
183 atomic_t tunnel_users;
184
185 /* State for replay detection */
186 struct xfrm_replay_state replay;
187
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800188 /* Replay detection state at the time we sent the last notification */
189 struct xfrm_replay_state preplay;
190
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700191 /* internal flag that only holds state for delayed aevent at the
192 * moment
193 */
194 u32 xflags;
195
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800196 /* Replay detection notification settings */
197 u32 replay_maxage;
198 u32 replay_maxdiff;
199
200 /* Replay detection notification timer */
201 struct timer_list rtimer;
202
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 /* Statistics */
204 struct xfrm_stats stats;
205
206 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800207 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700209 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800210 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700211
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212 /* Reference to data common to all the instances of this
213 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800214 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700215 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700216 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700217 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218
Trent Jaegerdf718372005-12-13 23:12:27 -0800219 /* Security context */
220 struct xfrm_sec_ctx *security;
221
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 /* Private data of this transformer, format is opaque,
223 * interpreted by xfrm_type methods. */
224 void *data;
225};
226
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800227static inline struct net *xs_net(struct xfrm_state *x)
228{
229 return read_pnet(&x->xs_net);
230}
231
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700232/* xflags - make enum if more show up */
233#define XFRM_TIME_DEFER 1
234
Linus Torvalds1da177e2005-04-16 15:20:36 -0700235enum {
236 XFRM_STATE_VOID,
237 XFRM_STATE_ACQ,
238 XFRM_STATE_VALID,
239 XFRM_STATE_ERROR,
240 XFRM_STATE_EXPIRED,
241 XFRM_STATE_DEAD
242};
243
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700244/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000245struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700246 union {
247 u32 hard;
248 u32 proto;
249 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800250 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700251 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700252 } data;
253
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700254 u32 seq;
255 u32 pid;
256 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800257 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700258};
259
Herbert Xu25ee3282007-12-11 09:32:34 -0800260struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261struct xfrm_type;
262struct xfrm_dst;
263struct xfrm_policy_afinfo {
264 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700265 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800266 void (*garbage_collect)(struct net *net);
Alexey Dobriyanc5b3cf42008-11-25 17:51:25 -0800267 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
268 xfrm_address_t *saddr,
Herbert Xu66cdb3c2007-11-13 21:37:28 -0800269 xfrm_address_t *daddr);
Alexey Dobriyanfbda33b2008-11-25 17:56:49 -0800270 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700271 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800272 struct flowi *fl,
273 int reverse);
Herbert Xu25ee3282007-12-11 09:32:34 -0800274 int (*get_tos)(struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800275 int (*init_path)(struct xfrm_dst *path,
276 struct dst_entry *dst,
277 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800278 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000279 struct net_device *dev,
280 struct flowi *fl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281};
282
283extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
284extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700285extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
286extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287
288struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800289extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800290extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
291extern int __xfrm_state_delete(struct xfrm_state *x);
292
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700294 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800295 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700296 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700297 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800298 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700299 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700300 int (*init_flags)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700301 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
302 struct xfrm_tmpl *tmpl,
303 xfrm_address_t *daddr, xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700304 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
305 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Miika Komucdca7262007-02-06 14:24:56 -0800306 int (*output)(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800307 int (*extract_input)(struct xfrm_state *x,
308 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800309 int (*extract_output)(struct xfrm_state *x,
310 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800311 int (*transport_finish)(struct sk_buff *skb,
312 int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700313};
314
315extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
316extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
317
318extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
319
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000320struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700321 char *description;
322 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000323 u8 proto;
324 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700325#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700326#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800327#define XFRM_TYPE_LOCAL_COADDR 4
328#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700329
Herbert Xu72cb6962005-06-20 13:18:08 -0700330 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800332 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
Masahide NAKAMURAdf0ba922006-08-23 20:41:00 -0700334 int (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700335 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700337 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338};
339
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800340extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
341extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342
Herbert Xub59f45d2006-05-27 23:05:54 -0700343struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800344 /*
345 * Remove encapsulation header.
346 *
347 * The IP header will be moved over the top of the encapsulation
348 * header.
349 *
350 * On entry, the transport header shall point to where the IP header
351 * should be and the network header shall be set to where the IP
352 * header currently is. skb->data shall point to the start of the
353 * payload.
354 */
355 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
356
357 /*
358 * This is the actual input entry point.
359 *
360 * For transport mode and equivalent this would be identical to
361 * input2 (which does not need to be set). While tunnel mode
362 * and equivalent would set this to the tunnel encapsulation function
363 * xfrm4_prepare_input that would in turn call input2.
364 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700365 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700366
367 /*
368 * Add encapsulation header.
369 *
370 * On exit, the transport header will be set to the start of the
371 * encapsulation header to be filled in by x->type->output and
372 * the mac header will be set to the nextheader (protocol for
373 * IPv4) field of the extension header directly preceding the
374 * encapsulation header, or in its absence, that of the top IP
375 * header. The value of the network header will always point
376 * to the top IP header while skb->data will point to the payload.
377 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800378 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
379
380 /*
381 * This is the actual output entry point.
382 *
383 * For transport mode and equivalent this would be identical to
384 * output2 (which does not need to be set). While tunnel mode
385 * and equivalent would set this to a tunnel encapsulation function
386 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
387 * call output2.
388 */
389 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700390
Herbert Xu17c2a422007-10-17 21:33:12 -0700391 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700392 struct module *owner;
393 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700394 int flags;
395};
396
397/* Flags for xfrm_mode. */
398enum {
399 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700400};
401
402extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
403extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700404
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700405static inline int xfrm_af2proto(unsigned int family)
406{
407 switch(family) {
408 case AF_INET:
409 return IPPROTO_IPIP;
410 case AF_INET6:
411 return IPPROTO_IPV6;
412 default:
413 return 0;
414 }
415}
416
417static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
418{
419 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
420 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
421 return x->inner_mode;
422 else
423 return x->inner_mode_iaf;
424}
425
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000426struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427/* id in template is interpreted as:
428 * daddr - destination of tunnel, may be zero for transport mode.
429 * spi - zero to acquire spi. Not zero if spi is static, then
430 * daddr must be fixed too.
431 * proto - AH/ESP/IPCOMP
432 */
433 struct xfrm_id id;
434
435/* Source address of tunnel. Ignored, if it is not a tunnel. */
436 xfrm_address_t saddr;
437
Miika Komu76b3f052006-11-30 16:40:43 -0800438 unsigned short encap_family;
439
jamala6337462010-02-09 13:21:17 +0000440 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700442/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000443 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700444
445/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000446 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447
448/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000449 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700450
Herbert Xuc5d18e92008-04-22 00:46:42 -0700451/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000452 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700453
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000455 u32 aalgos;
456 u32 ealgos;
457 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458};
459
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700460#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461
Herbert Xu12a169e2008-10-01 07:03:24 -0700462struct xfrm_policy_walk_entry {
463 struct list_head all;
464 u8 dead;
465};
466
467struct xfrm_policy_walk {
468 struct xfrm_policy_walk_entry walk;
469 u8 type;
470 u32 seq;
471};
472
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000473struct xfrm_policy {
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800474#ifdef CONFIG_NET_NS
475 struct net *xp_net;
476#endif
David S. Miller2518c7c2006-08-24 04:45:07 -0700477 struct hlist_node bydst;
478 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479
480 /* This lock only affects elements except for entry. */
481 rwlock_t lock;
482 atomic_t refcnt;
483 struct timer_list timer;
484
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000485 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000486 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700487 u32 priority;
488 u32 index;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000489 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490 struct xfrm_selector selector;
491 struct xfrm_lifetime_cfg lft;
492 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700493 struct xfrm_policy_walk_entry walk;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200494 u8 type;
495 u8 action;
496 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200497 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700498 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800499 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700500 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
501};
502
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800503static inline struct net *xp_net(struct xfrm_policy *xp)
504{
505 return read_pnet(&xp->xp_net);
506}
507
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700508struct xfrm_kmaddress {
509 xfrm_address_t local;
510 xfrm_address_t remote;
511 u32 reserved;
512 u16 family;
513};
514
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800515struct xfrm_migrate {
516 xfrm_address_t old_daddr;
517 xfrm_address_t old_saddr;
518 xfrm_address_t new_daddr;
519 xfrm_address_t new_saddr;
520 u8 proto;
521 u8 mode;
522 u16 reserved;
523 u32 reqid;
524 u16 old_family;
525 u16 new_family;
526};
527
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800528#define XFRM_KM_TIMEOUT 30
529/* which seqno */
530#define XFRM_REPLAY_SEQ 1
531#define XFRM_REPLAY_OSEQ 2
532#define XFRM_REPLAY_SEQ_MASK 3
533/* what happened */
534#define XFRM_REPLAY_UPDATE XFRM_AE_CR
535#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
536
537/* default aevent timeout in units of 100ms */
538#define XFRM_AE_ETIME 10
539/* Async Event timer multiplier */
540#define XFRM_AE_ETH_M 10
541/* default seq threshold size */
542#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000544struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700545 struct list_head list;
546 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700547 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700549 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800550 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700551 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800552 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700553 int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554};
555
556extern int xfrm_register_km(struct xfrm_mgr *km);
557extern int xfrm_unregister_km(struct xfrm_mgr *km);
558
Herbert Xu436a0a42007-10-08 17:25:53 -0700559/*
560 * This structure is used for the duration where packets are being
561 * transformed by IPsec. As soon as the packet leaves IPsec the
562 * area beyond the generic IP part may be overwritten.
563 */
564struct xfrm_skb_cb {
565 union {
566 struct inet_skb_parm h4;
567 struct inet6_skb_parm h6;
568 } header;
569
570 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800571 union {
572 u64 output;
573 __be32 input;
574 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700575};
576
577#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
578
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800579/*
580 * This structure is used by the afinfo prepare_input/prepare_output functions
581 * to transmit header information to the mode input/output functions.
582 */
583struct xfrm_mode_skb_cb {
584 union {
585 struct inet_skb_parm h4;
586 struct inet6_skb_parm h6;
587 } header;
588
589 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
590 __be16 id;
591 __be16 frag_off;
592
Herbert Xu732c8bd2008-03-26 16:51:09 -0700593 /* IP header length (excluding options or extension headers). */
594 u8 ihl;
595
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800596 /* TOS for IPv4, class for IPv6. */
597 u8 tos;
598
599 /* TTL for IPv4, hop limitfor IPv6. */
600 u8 ttl;
601
602 /* Protocol for IPv4, NH for IPv6. */
603 u8 protocol;
604
Herbert Xu732c8bd2008-03-26 16:51:09 -0700605 /* Option length for IPv4, zero for IPv6. */
606 u8 optlen;
607
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800608 /* Used by IPv6 only, zero for IPv4. */
609 u8 flow_lbl[3];
610};
611
612#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
613
Herbert Xu716062f2007-11-13 21:44:23 -0800614/*
615 * This structure is used by the input processing to locate the SPI and
616 * related information.
617 */
618struct xfrm_spi_skb_cb {
619 union {
620 struct inet_skb_parm h4;
621 struct inet6_skb_parm h6;
622 } header;
623
Herbert Xu716062f2007-11-13 21:44:23 -0800624 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800625 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800626};
627
628#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
629
Joy Latten161a09e2006-11-27 13:11:54 -0600630/* Audit Information */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000631struct xfrm_audit {
Joy Latten161a09e2006-11-27 13:11:54 -0600632 u32 secid;
Eric Paris25323862008-04-18 10:09:25 -0400633 uid_t loginuid;
634 u32 sessionid;
Joy Latten161a09e2006-11-27 13:11:54 -0600635};
Joy Lattenc9204d92006-11-30 15:50:43 -0600636
637#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800638static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700639{
640 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800641
642 if (audit_enabled == 0)
643 return NULL;
644 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
645 AUDIT_MAC_IPSEC_EVENT);
646 if (audit_buf == NULL)
647 return NULL;
648 audit_log_format(audit_buf, "op=%s", op);
649 return audit_buf;
650}
651
Eric Paris25323862008-04-18 10:09:25 -0400652static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800653 struct audit_buffer *audit_buf)
654{
Joy Lattenab5f5e82007-09-17 11:51:22 -0700655 char *secctx;
656 u32 secctx_len;
657
Eric Paris25323862008-04-18 10:09:25 -0400658 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Paul Moore68277ac2007-12-20 20:49:33 -0800659 if (secid != 0 &&
660 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
Joy Lattenab5f5e82007-09-17 11:51:22 -0700661 audit_log_format(audit_buf, " subj=%s", secctx);
662 security_release_secctx(secctx, secctx_len);
663 } else
664 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700665}
666
667extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400668 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700669extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400670 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700671extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400672 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700673extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400674 u32 auid, u32 ses, u32 secid);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800675extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
676 struct sk_buff *skb);
677extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
678extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
679 __be32 net_spi, __be32 net_seq);
680extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
681 struct sk_buff *skb, u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600682#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700683
684static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
685 u32 auid, u32 ses, u32 secid)
686{
687}
688
689static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
690 u32 auid, u32 ses, u32 secid)
691{
692}
693
694static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
695 u32 auid, u32 ses, u32 secid)
696{
697}
698
699static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
700 u32 auid, u32 ses, u32 secid)
701{
702}
703
704static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
705 struct sk_buff *skb)
706{
707}
708
709static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
710 u16 family)
711{
712}
713
714static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
715 __be32 net_spi, __be32 net_seq)
716{
717}
718
719static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
720 struct sk_buff *skb, u8 proto)
721{
722}
Joy Lattenc9204d92006-11-30 15:50:43 -0600723#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600724
Linus Torvalds1da177e2005-04-16 15:20:36 -0700725static inline void xfrm_pol_hold(struct xfrm_policy *policy)
726{
727 if (likely(policy != NULL))
728 atomic_inc(&policy->refcnt);
729}
730
WANG Cong64c31b32008-01-07 22:34:29 -0800731extern void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700732
733static inline void xfrm_pol_put(struct xfrm_policy *policy)
734{
735 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800736 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700737}
738
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700739static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
740{
741 int i;
742 for (i = npols - 1; i >= 0; --i)
743 xfrm_pol_put(pols[i]);
744}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700745
Linus Torvalds1da177e2005-04-16 15:20:36 -0700746extern void __xfrm_state_destroy(struct xfrm_state *);
747
Herbert Xu21380b82006-02-22 14:47:13 -0800748static inline void __xfrm_state_put(struct xfrm_state *x)
749{
750 atomic_dec(&x->refcnt);
751}
752
Linus Torvalds1da177e2005-04-16 15:20:36 -0700753static inline void xfrm_state_put(struct xfrm_state *x)
754{
755 if (atomic_dec_and_test(&x->refcnt))
756 __xfrm_state_destroy(x);
757}
758
759static inline void xfrm_state_hold(struct xfrm_state *x)
760{
761 atomic_inc(&x->refcnt);
762}
763
764static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
765{
Al Viro5f193432006-09-27 18:46:32 -0700766 __be32 *a1 = token1;
767 __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700768 int pdw;
769 int pbi;
770
jamala6337462010-02-09 13:21:17 +0000771 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700772 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
773
774 if (pdw)
775 if (memcmp(a1, a2, pdw << 2))
776 return 0;
777
778 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700779 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700780
781 mask = htonl((0xffffffff) << (32 - pbi));
782
783 if ((a1[pdw] ^ a2[pdw]) & mask)
784 return 0;
785 }
786
787 return 1;
788}
789
790static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700791__be16 xfrm_flowi_sport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700792{
Al Virof9d07e41f82006-09-27 18:45:50 -0700793 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700794 switch(fl->proto) {
795 case IPPROTO_TCP:
796 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800797 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798 case IPPROTO_SCTP:
799 port = fl->fl_ip_sport;
800 break;
801 case IPPROTO_ICMP:
802 case IPPROTO_ICMPV6:
803 port = htons(fl->fl_icmp_type);
804 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700805 case IPPROTO_MH:
806 port = htons(fl->fl_mh_type);
807 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700808 default:
809 port = 0; /*XXX*/
810 }
811 return port;
812}
813
814static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700815__be16 xfrm_flowi_dport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700816{
Al Virof9d07e41f82006-09-27 18:45:50 -0700817 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700818 switch(fl->proto) {
819 case IPPROTO_TCP:
820 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800821 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700822 case IPPROTO_SCTP:
823 port = fl->fl_ip_dport;
824 break;
825 case IPPROTO_ICMP:
826 case IPPROTO_ICMPV6:
827 port = htons(fl->fl_icmp_code);
828 break;
829 default:
830 port = 0; /*XXX*/
831 }
832 return port;
833}
834
Andrew Morton77681022006-11-08 22:46:26 -0800835extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
836 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700837
Trent Jaegerdf718372005-12-13 23:12:27 -0800838#ifdef CONFIG_SECURITY_NETWORK_XFRM
839/* If neither has a context --> match
840 * Otherwise, both must have a context and the sids, doi, alg must match
841 */
842static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
843{
844 return ((!s1 && !s2) ||
845 (s1 && s2 &&
846 (s1->ctx_sid == s2->ctx_sid) &&
847 (s1->ctx_doi == s2->ctx_doi) &&
848 (s1->ctx_alg == s2->ctx_alg)));
849}
850#else
851static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
852{
853 return 1;
854}
855#endif
856
Linus Torvalds1da177e2005-04-16 15:20:36 -0700857/* A struct encoding bundle of transformations to apply to some set of flow.
858 *
859 * dst->child points to the next element of bundle.
860 * dst->xfrm points to an instanse of transformer.
861 *
862 * Due to unfortunate limitations of current routing cache, which we
863 * have no time to fix, it mirrors struct rtable and bound to the same
864 * routing key, including saddr,daddr. However, we can have many of
865 * bundles differing by session id. All the bundles grow from a parent
866 * policy rule.
867 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000868struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700869 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700870 struct dst_entry dst;
871 struct rtable rt;
872 struct rt6_info rt6;
873 } u;
874 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000875 struct flow_cache_object flo;
876 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
877 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700878#ifdef CONFIG_XFRM_SUB_POLICY
879 struct flowi *origin;
880 struct xfrm_selector *partner;
881#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000882 u32 xfrm_genid;
883 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700884 u32 route_mtu_cached;
885 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700886 u32 route_cookie;
887 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700888};
889
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700890#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700891static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
892{
Timo Teräs80c802f2010-04-07 00:30:05 +0000893 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700894 dst_release(xdst->route);
895 if (likely(xdst->u.dst.xfrm))
896 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700897#ifdef CONFIG_XFRM_SUB_POLICY
898 kfree(xdst->origin);
899 xdst->origin = NULL;
900 kfree(xdst->partner);
901 xdst->partner = NULL;
902#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700903}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700904#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700905
906extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
907
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000908struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700909 atomic_t refcnt;
910 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800911 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700912};
913
914static inline struct sec_path *
915secpath_get(struct sec_path *sp)
916{
917 if (sp)
918 atomic_inc(&sp->refcnt);
919 return sp;
920}
921
922extern void __secpath_destroy(struct sec_path *sp);
923
924static inline void
925secpath_put(struct sec_path *sp)
926{
927 if (sp && atomic_dec_and_test(&sp->refcnt))
928 __secpath_destroy(sp);
929}
930
931extern struct sec_path *secpath_dup(struct sec_path *src);
932
933static inline void
934secpath_reset(struct sk_buff *skb)
935{
936#ifdef CONFIG_XFRM
937 secpath_put(skb->sp);
938 skb->sp = NULL;
939#endif
940}
941
942static inline int
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700943xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
944{
945 switch (family) {
946 case AF_INET:
947 return addr->a4 == 0;
948 case AF_INET6:
949 return ipv6_addr_any((struct in6_addr *)&addr->a6);
950 }
951 return 0;
952}
953
954static inline int
Linus Torvalds1da177e2005-04-16 15:20:36 -0700955__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
956{
957 return (tmpl->saddr.a4 &&
958 tmpl->saddr.a4 != x->props.saddr.a4);
959}
960
961static inline int
962__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
963{
964 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
965 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
966}
967
968static inline int
969xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
970{
971 switch (family) {
972 case AF_INET:
973 return __xfrm4_state_addr_cmp(tmpl, x);
974 case AF_INET6:
975 return __xfrm6_state_addr_cmp(tmpl, x);
976 }
977 return !0;
978}
979
980#ifdef CONFIG_XFRM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700981extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
982
Herbert Xud5422ef2007-12-12 10:44:16 -0800983static inline int __xfrm_policy_check2(struct sock *sk, int dir,
984 struct sk_buff *skb,
985 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700986{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800987 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -0800988 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
989
Linus Torvalds1da177e2005-04-16 15:20:36 -0700990 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -0800991 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700992
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800993 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +0000994 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -0800995 __xfrm_policy_check(sk, ndir, skb, family);
996}
997
998static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
999{
1000 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001001}
1002
1003static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1004{
1005 return xfrm_policy_check(sk, dir, skb, AF_INET);
1006}
1007
1008static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1009{
1010 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1011}
1012
Herbert Xud5422ef2007-12-12 10:44:16 -08001013static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1014 struct sk_buff *skb)
1015{
1016 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1017}
1018
1019static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1020 struct sk_buff *skb)
1021{
1022 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1023}
1024
1025extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1026 unsigned int family, int reverse);
1027
1028static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1029 unsigned int family)
1030{
1031 return __xfrm_decode_session(skb, fl, family, 0);
1032}
1033
1034static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1035 struct flowi *fl,
1036 unsigned int family)
1037{
1038 return __xfrm_decode_session(skb, fl, family, 1);
1039}
1040
Linus Torvalds1da177e2005-04-16 15:20:36 -07001041extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1042
1043static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1044{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001045 struct net *net = dev_net(skb->dev);
1046
1047 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001048 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001049 __xfrm_route_forward(skb, family);
1050}
1051
1052static inline int xfrm4_route_forward(struct sk_buff *skb)
1053{
1054 return xfrm_route_forward(skb, AF_INET);
1055}
1056
1057static inline int xfrm6_route_forward(struct sk_buff *skb)
1058{
1059 return xfrm_route_forward(skb, AF_INET6);
1060}
1061
1062extern int __xfrm_sk_clone_policy(struct sock *sk);
1063
1064static inline int xfrm_sk_clone_policy(struct sock *sk)
1065{
1066 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1067 return __xfrm_sk_clone_policy(sk);
1068 return 0;
1069}
1070
Herbert Xu4666faa2005-06-18 22:43:22 -07001071extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001072
1073static inline void xfrm_sk_free_policy(struct sock *sk)
1074{
1075 if (unlikely(sk->sk_policy[0] != NULL)) {
1076 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1077 sk->sk_policy[0] = NULL;
1078 }
1079 if (unlikely(sk->sk_policy[1] != NULL)) {
1080 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1081 sk->sk_policy[1] = NULL;
1082 }
1083}
1084
1085#else
1086
1087static inline void xfrm_sk_free_policy(struct sock *sk) {}
1088static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1089static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1090static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1091static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1092{
1093 return 1;
1094}
1095static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1096{
1097 return 1;
1098}
1099static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1100{
1101 return 1;
1102}
Herbert Xud5422ef2007-12-12 10:44:16 -08001103static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1104 struct flowi *fl,
1105 unsigned int family)
1106{
1107 return -ENOSYS;
1108}
1109static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1110 struct sk_buff *skb)
1111{
1112 return 1;
1113}
1114static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1115 struct sk_buff *skb)
1116{
1117 return 1;
1118}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001119#endif
1120
1121static __inline__
1122xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
1123{
1124 switch (family){
1125 case AF_INET:
1126 return (xfrm_address_t *)&fl->fl4_dst;
1127 case AF_INET6:
1128 return (xfrm_address_t *)&fl->fl6_dst;
1129 }
1130 return NULL;
1131}
1132
1133static __inline__
1134xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
1135{
1136 switch (family){
1137 case AF_INET:
1138 return (xfrm_address_t *)&fl->fl4_src;
1139 case AF_INET6:
1140 return (xfrm_address_t *)&fl->fl6_src;
1141 }
1142 return NULL;
1143}
1144
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001145static __inline__
1146void xfrm_flowi_addr_get(struct flowi *fl,
1147 xfrm_address_t *saddr, xfrm_address_t *daddr,
1148 unsigned short family)
1149{
1150 switch(family) {
1151 case AF_INET:
1152 memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
1153 memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
1154 break;
1155 case AF_INET6:
1156 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
1157 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
1158 break;
1159 }
1160}
1161
Linus Torvalds1da177e2005-04-16 15:20:36 -07001162static __inline__ int
1163__xfrm4_state_addr_check(struct xfrm_state *x,
1164 xfrm_address_t *daddr, xfrm_address_t *saddr)
1165{
1166 if (daddr->a4 == x->id.daddr.a4 &&
1167 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1168 return 1;
1169 return 0;
1170}
1171
1172static __inline__ int
1173__xfrm6_state_addr_check(struct xfrm_state *x,
1174 xfrm_address_t *daddr, xfrm_address_t *saddr)
1175{
1176 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1177 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1178 ipv6_addr_any((struct in6_addr *)saddr) ||
1179 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1180 return 1;
1181 return 0;
1182}
1183
1184static __inline__ int
1185xfrm_state_addr_check(struct xfrm_state *x,
1186 xfrm_address_t *daddr, xfrm_address_t *saddr,
1187 unsigned short family)
1188{
1189 switch (family) {
1190 case AF_INET:
1191 return __xfrm4_state_addr_check(x, daddr, saddr);
1192 case AF_INET6:
1193 return __xfrm6_state_addr_check(x, daddr, saddr);
1194 }
1195 return 0;
1196}
1197
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001198static __inline__ int
1199xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
1200 unsigned short family)
1201{
1202 switch (family) {
1203 case AF_INET:
1204 return __xfrm4_state_addr_check(x,
1205 (xfrm_address_t *)&fl->fl4_dst,
1206 (xfrm_address_t *)&fl->fl4_src);
1207 case AF_INET6:
1208 return __xfrm6_state_addr_check(x,
1209 (xfrm_address_t *)&fl->fl6_dst,
1210 (xfrm_address_t *)&fl->fl6_src);
1211 }
1212 return 0;
1213}
1214
Linus Torvalds1da177e2005-04-16 15:20:36 -07001215static inline int xfrm_state_kern(struct xfrm_state *x)
1216{
1217 return atomic_read(&x->tunnel_users);
1218}
1219
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001220static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1221{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001222 return (!userproto || proto == userproto ||
1223 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1224 proto == IPPROTO_ESP ||
1225 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001226}
1227
Linus Torvalds1da177e2005-04-16 15:20:36 -07001228/*
1229 * xfrm algorithm information
1230 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001231struct xfrm_algo_aead_info {
1232 u16 icv_truncbits;
1233};
1234
Linus Torvalds1da177e2005-04-16 15:20:36 -07001235struct xfrm_algo_auth_info {
1236 u16 icv_truncbits;
1237 u16 icv_fullbits;
1238};
1239
1240struct xfrm_algo_encr_info {
1241 u16 blockbits;
1242 u16 defkeybits;
1243};
1244
1245struct xfrm_algo_comp_info {
1246 u16 threshold;
1247};
1248
1249struct xfrm_algo_desc {
1250 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001251 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001252 u8 available:1;
1253 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001254 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001255 struct xfrm_algo_auth_info auth;
1256 struct xfrm_algo_encr_info encr;
1257 struct xfrm_algo_comp_info comp;
1258 } uinfo;
1259 struct sadb_alg desc;
1260};
1261
1262/* XFRM tunnel handlers. */
1263struct xfrm_tunnel {
1264 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001265 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001266
1267 struct xfrm_tunnel *next;
1268 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001269};
1270
1271struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001272 int (*handler)(struct sk_buff *skb);
1273 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001274 u8 type, u8 code, int offset, __be32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001275 struct xfrm6_tunnel *next;
1276 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001277};
1278
1279extern void xfrm_init(void);
Neil Hormana33bc5c2009-07-30 18:52:15 -07001280extern void xfrm4_init(int rt_hash_size);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08001281extern int xfrm_state_init(struct net *net);
1282extern void xfrm_state_fini(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001283extern void xfrm4_state_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001284#ifdef CONFIG_XFRM
1285extern int xfrm6_init(void);
1286extern void xfrm6_fini(void);
Daniel Lezcano0013cab2007-12-07 00:42:11 -08001287extern int xfrm6_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001288extern void xfrm6_state_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001289#else
1290static inline int xfrm6_init(void)
1291{
1292 return 0;
1293}
1294static inline void xfrm6_fini(void)
1295{
1296 ;
1297}
1298#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001299
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001300#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyanc68cd1a2008-11-25 18:00:14 -08001301extern int xfrm_proc_init(struct net *net);
1302extern void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001303#endif
1304
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001305extern int xfrm_sysctl_init(struct net *net);
1306#ifdef CONFIG_SYSCTL
1307extern void xfrm_sysctl_fini(struct net *net);
1308#else
1309static inline void xfrm_sysctl_fini(struct net *net)
1310{
1311}
1312#endif
1313
Herbert Xu5c182452008-09-22 19:48:19 -07001314extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001315extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001316 int (*func)(struct xfrm_state *, int, void*), void *);
Herbert Xuabb81c42008-09-09 19:58:29 -07001317extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
Alexey Dobriyan673c09b2008-11-25 17:15:16 -08001318extern struct xfrm_state *xfrm_state_alloc(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001319extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1320 struct flowi *fl, struct xfrm_tmpl *tmpl,
1321 struct xfrm_policy *pol, int *err,
1322 unsigned short family);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001323extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001324 xfrm_address_t *daddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -07001325 xfrm_address_t *saddr,
1326 unsigned short family,
1327 u8 mode, u8 proto, u32 reqid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001328extern int xfrm_state_check_expire(struct xfrm_state *x);
1329extern void xfrm_state_insert(struct xfrm_state *x);
1330extern int xfrm_state_add(struct xfrm_state *x);
1331extern int xfrm_state_update(struct xfrm_state *x);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001332extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1333 xfrm_address_t *daddr, __be32 spi,
1334 u8 proto, unsigned short family);
1335extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1336 xfrm_address_t *daddr,
1337 xfrm_address_t *saddr,
1338 u8 proto,
1339 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001340#ifdef CONFIG_XFRM_SUB_POLICY
1341extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1342 int n, unsigned short family);
1343extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1344 int n, unsigned short family);
1345#else
1346static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1347 int n, unsigned short family)
1348{
1349 return -ENOSYS;
1350}
1351
1352static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1353 int n, unsigned short family)
1354{
1355 return -ENOSYS;
1356}
1357#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001358
1359struct xfrmk_sadinfo {
1360 u32 sadhcnt; /* current hash bkts */
1361 u32 sadhmcnt; /* max allowed hash bkts */
1362 u32 sadcnt; /* current running count */
1363};
1364
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001365struct xfrmk_spdinfo {
1366 u32 incnt;
1367 u32 outcnt;
1368 u32 fwdcnt;
1369 u32 inscnt;
1370 u32 outscnt;
1371 u32 fwdscnt;
1372 u32 spdhcnt;
1373 u32 spdhmcnt;
1374};
1375
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001376extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1377 u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001378extern int xfrm_state_delete(struct xfrm_state *x);
Alexey Dobriyan0e602452008-11-25 17:30:18 -08001379extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
Alexey Dobriyane0710412010-01-23 13:37:10 +00001380extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1381extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
Paul Mooreafeb14b2007-12-21 14:58:11 -08001382extern int xfrm_replay_check(struct xfrm_state *x,
1383 struct sk_buff *skb, __be32 seq);
Al Viro61f46272006-09-27 18:48:33 -07001384extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001385extern void xfrm_replay_notify(struct xfrm_state *x, int event);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001386extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -07001387extern int xfrm_init_state(struct xfrm_state *x);
Herbert Xu227620e2007-11-13 21:41:28 -08001388extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -08001389extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1390 int encap_type);
Herbert Xu1bf06cd2007-11-19 18:50:17 -08001391extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
Herbert Xuc6581a42007-11-13 21:43:43 -08001392extern int xfrm_output_resume(struct sk_buff *skb, int err);
Herbert Xu406ef772007-10-08 17:16:30 -07001393extern int xfrm_output(struct sk_buff *skb);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001394extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001395extern int xfrm4_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001396extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001397extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1398 int encap_type);
Herbert Xu716062f2007-11-13 21:44:23 -08001399extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001400extern int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001401
1402static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1403{
1404 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1405}
1406
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001407extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1408extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001409extern int xfrm4_output(struct sk_buff *skb);
Kazunori MIYAZAWAc0d56402007-02-13 12:54:47 -08001410extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1411extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001412extern int xfrm6_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001413extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu33b5ecb2007-10-17 21:29:25 -07001414extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
Herbert Xu716062f2007-11-13 21:44:23 -08001415extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
Herbert Xue5bbef22007-10-15 12:50:28 -07001416extern int xfrm6_rcv(struct sk_buff *skb);
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -07001417extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1418 xfrm_address_t *saddr, u8 proto);
Kazunori MIYAZAWA73d605d2007-02-13 12:55:55 -08001419extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1420extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001421extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1422extern void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr);
1423extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001424extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1425extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001426extern int xfrm6_output(struct sk_buff *skb);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -07001427extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1428 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429
1430#ifdef CONFIG_XFRM
James Chapman067b2072007-07-05 17:08:05 -07001431extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001432extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001433#else
1434static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1435{
1436 return -ENOPROTOOPT;
1437}
1438
James Chapman067b2072007-07-05 17:08:05 -07001439static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001440{
1441 /* should not happen */
1442 kfree_skb(skb);
1443 return 0;
1444}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001445#endif
1446
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001447struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001448
Herbert Xu12a169e2008-10-01 07:03:24 -07001449extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
Alexey Dobriyancdcbca72008-11-25 17:34:49 -08001450extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001451 int (*func)(struct xfrm_policy *, int, int, void*), void *);
Herbert Xu12a169e2008-10-01 07:03:24 -07001452extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001453int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001454struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1455 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001456 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001457 struct xfrm_sec_ctx *ctx, int delete,
1458 int *err);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001459struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
Alexey Dobriyan33ffbbd2008-11-25 17:33:32 -08001460int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461u32 xfrm_get_acqseq(void);
Herbert Xu658b2192007-10-09 13:29:52 -07001462extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001463struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1464 u8 mode, u32 reqid, u8 proto,
1465 xfrm_address_t *daddr,
1466 xfrm_address_t *saddr, int create,
1467 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001468extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Venkat Yekkirala5b368e62006-10-05 15:42:18 -05001469extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
1470 struct flowi *fl, int family, int strict);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001471
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001472#ifdef CONFIG_XFRM_MIGRATE
1473extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001474 struct xfrm_migrate *m, int num_bundles,
1475 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001476extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1477extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1478 struct xfrm_migrate *m);
1479extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001480 struct xfrm_migrate *m, int num_bundles,
1481 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001482#endif
1483
Al Viro5d36b182006-11-08 00:24:06 -08001484extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -08001485extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001486extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487
1488extern void xfrm_input_init(void);
Al Viro6067b2b2006-09-27 18:47:59 -07001489extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490
1491extern void xfrm_probe_algs(void);
1492extern int xfrm_count_auth_supported(void);
1493extern int xfrm_count_enc_supported(void);
1494extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1495extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1496extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1497extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1498extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1499extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
1500extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
1501extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
Herbert Xu1a6509d2008-01-28 19:37:29 -08001502extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
1503 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001504
Herbert Xu07d4ee52006-08-20 14:24:50 +10001505struct hash_desc;
Herbert Xu9409f382006-08-06 19:49:12 +10001506struct scatterlist;
Herbert Xu07d4ee52006-08-20 14:24:50 +10001507typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1508 unsigned int);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001509
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
1511 int family)
1512{
1513 switch (family) {
1514 default:
1515 case AF_INET:
jamala6337462010-02-09 13:21:17 +00001516 return (__force u32)a->a4 - (__force u32)b->a4;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001517 case AF_INET6:
1518 return ipv6_addr_cmp((struct in6_addr *)a,
1519 (struct in6_addr *)b);
1520 }
1521}
1522
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001523static inline int xfrm_policy_id2dir(u32 index)
1524{
1525 return index & 7;
1526}
1527
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001528#ifdef CONFIG_XFRM
1529static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001530{
Patrick McHardybe336902006-03-20 22:40:54 -08001531 struct sock *nlsk;
1532 int ret = 0;
1533
1534 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001535 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001536 if (nlsk)
1537 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1538 rcu_read_unlock();
1539 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001540}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001541#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001542
Eric Dumazet0f99be02008-01-08 23:39:06 -08001543static inline int xfrm_alg_len(struct xfrm_algo *alg)
1544{
1545 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1546}
1547
Martin Willi4447bb32009-11-25 00:29:52 +00001548static inline int xfrm_alg_auth_len(struct xfrm_algo_auth *alg)
1549{
1550 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1551}
1552
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001553#ifdef CONFIG_XFRM_MIGRATE
1554static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1555{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001556 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001557}
1558
Martin Willi4447bb32009-11-25 00:29:52 +00001559static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1560{
1561 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1562}
1563
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001564static inline void xfrm_states_put(struct xfrm_state **states, int n)
1565{
1566 int i;
1567 for (i = 0; i < n; i++)
1568 xfrm_state_put(*(states + i));
1569}
1570
1571static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1572{
1573 int i;
1574 for (i = 0; i < n; i++)
1575 xfrm_state_delete(*(states + i));
1576}
1577#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001578
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001579#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001580static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1581{
1582 return skb->sp->xvec[skb->sp->len - 1];
1583}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001584#endif
Herbert Xu00501122007-12-11 01:53:43 -08001585
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001586static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1587{
1588 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001589 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001590 else
1591 m->v = m->m = 0;
1592
1593 return m->v & m->m;
1594}
1595
1596static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
1597{
1598 if (m->m | m->v)
1599 NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1600 return 0;
1601
1602nla_put_failure:
1603 return -1;
1604}
1605
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606#endif /* _NET_XFRM_H */