blob: ac52f33f3e4af06113dc060fd4a8282e6f837c94 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080023
24#include <linux/interrupt.h>
25
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080026#ifdef CONFIG_XFRM_STATISTICS
27#include <net/snmp.h>
28#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070029
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070030#define XFRM_PROTO_ESP 50
31#define XFRM_PROTO_AH 51
32#define XFRM_PROTO_COMP 108
33#define XFRM_PROTO_IPIP 4
34#define XFRM_PROTO_IPV6 41
35#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
36#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
37
Linus Torvalds1da177e2005-04-16 15:20:36 -070038#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070039#define MODULE_ALIAS_XFRM_MODE(family, encap) \
40 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070041#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
42 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070043
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080044#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080045#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
46#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
47#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080048#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080049#define XFRM_INC_STATS(net, field) ((void)(net))
50#define XFRM_INC_STATS_BH(net, field) ((void)(net))
51#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080052#endif
53
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080054extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070055
56/* Organization of SPD aka "XFRM rules"
57 ------------------------------------
58
59 Basic objects:
60 - policy rule, struct xfrm_policy (=SPD entry)
61 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
62 - instance of a transformer, struct xfrm_state (=SA)
63 - template to clone xfrm_state, struct xfrm_tmpl
64
65 SPD is plain linear list of xfrm_policy rules, ordered by priority.
66 (To be compatible with existing pfkeyv2 implementations,
67 many rules with priority of 0x7fffffff are allowed to exist and
68 such rules are ordered in an unpredictable way, thanks to bsd folks.)
69
70 Lookup is plain linear search until the first match with selector.
71
72 If "action" is "block", then we prohibit the flow, otherwise:
73 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
74 policy entry has list of up to XFRM_MAX_DEPTH transformations,
75 described by templates xfrm_tmpl. Each template is resolved
76 to a complete xfrm_state (see below) and we pack bundle of transformations
77 to a dst_entry returned to requestor.
78
79 dst -. xfrm .-> xfrm_state #1
80 |---. child .-> dst -. xfrm .-> xfrm_state #2
81 |---. child .-> dst -. xfrm .-> xfrm_state #3
82 |---. child .-> NULL
83
84 Bundles are cached at xrfm_policy struct (field ->bundles).
85
86
87 Resolution of xrfm_tmpl
88 -----------------------
89 Template contains:
90 1. ->mode Mode: transport or tunnel
91 2. ->id.proto Protocol: AH/ESP/IPCOMP
92 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
93 Q: allow to resolve security gateway?
94 4. ->id.spi If not zero, static SPI.
95 5. ->saddr Local tunnel endpoint, ignored for transport mode.
96 6. ->algos List of allowed algos. Plain bitmask now.
97 Q: ealgos, aalgos, calgos. What a mess...
98 7. ->share Sharing mode.
99 Q: how to implement private sharing mode? To add struct sock* to
100 flow id?
101
102 Having this template we search through SAD searching for entries
103 with appropriate mode/proto/algo, permitted by selector.
104 If no appropriate entry found, it is requested from key manager.
105
106 PROBLEMS:
107 Q: How to find all the bundles referring to a physical path for
108 PMTU discovery? Seems, dst should contain list of all parents...
109 and enter to infinite locking hierarchy disaster.
110 No! It is easier, we will not search for them, let them find us.
111 We add genid to each dst plus pointer to genid of raw IP route,
112 pmtu disc will update pmtu on raw IP route and increase its genid.
113 dst_check() will see this for top level and trigger resyncing
114 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
115 */
116
Herbert Xu12a169e2008-10-01 07:03:24 -0700117struct xfrm_state_walk {
118 struct list_head all;
119 u8 state;
120 union {
121 u8 dying;
122 u8 proto;
123 };
124 u32 seq;
125};
126
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000128struct xfrm_state {
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800129#ifdef CONFIG_NET_NS
130 struct net *xs_net;
131#endif
Herbert Xuabb81c42008-09-09 19:58:29 -0700132 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700133 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700134 struct hlist_node bydst;
135 };
David S. Miller8f126e32006-08-24 02:45:07 -0700136 struct hlist_node bysrc;
137 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700138
139 atomic_t refcnt;
140 spinlock_t lock;
141
142 struct xfrm_id id;
143 struct xfrm_selector sel;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000144 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700145
David S. Miller9d4a7062006-08-24 03:18:09 -0700146 u32 genid;
147
Herbert Xu12a169e2008-10-01 07:03:24 -0700148 /* Key manager bits */
149 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700150
151 /* Parameters of this state. */
152 struct {
153 u32 reqid;
154 u8 mode;
155 u8 replay_window;
156 u8 aalgo, ealgo, calgo;
157 u8 flags;
158 u16 family;
159 xfrm_address_t saddr;
160 int header_len;
161 int trailer_len;
162 } props;
163
164 struct xfrm_lifetime_cfg lft;
165
166 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000167 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168 struct xfrm_algo *ealg;
169 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800170 struct xfrm_algo_aead *aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171
172 /* Data for encapsulator */
173 struct xfrm_encap_tmpl *encap;
174
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700175 /* Data for care-of address */
176 xfrm_address_t *coaddr;
177
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
179 struct xfrm_state *tunnel;
180
181 /* If a tunnel, number of users + 1 */
182 atomic_t tunnel_users;
183
184 /* State for replay detection */
185 struct xfrm_replay_state replay;
186
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800187 /* Replay detection state at the time we sent the last notification */
188 struct xfrm_replay_state preplay;
189
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700190 /* internal flag that only holds state for delayed aevent at the
191 * moment
192 */
193 u32 xflags;
194
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800195 /* Replay detection notification settings */
196 u32 replay_maxage;
197 u32 replay_maxdiff;
198
199 /* Replay detection notification timer */
200 struct timer_list rtimer;
201
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202 /* Statistics */
203 struct xfrm_stats stats;
204
205 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800206 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700207
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700208 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800209 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700210
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 /* Reference to data common to all the instances of this
212 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800213 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700214 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700215 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700216 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217
Trent Jaegerdf718372005-12-13 23:12:27 -0800218 /* Security context */
219 struct xfrm_sec_ctx *security;
220
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 /* Private data of this transformer, format is opaque,
222 * interpreted by xfrm_type methods. */
223 void *data;
224};
225
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800226static inline struct net *xs_net(struct xfrm_state *x)
227{
228 return read_pnet(&x->xs_net);
229}
230
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700231/* xflags - make enum if more show up */
232#define XFRM_TIME_DEFER 1
233
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234enum {
235 XFRM_STATE_VOID,
236 XFRM_STATE_ACQ,
237 XFRM_STATE_VALID,
238 XFRM_STATE_ERROR,
239 XFRM_STATE_EXPIRED,
240 XFRM_STATE_DEAD
241};
242
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700243/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000244struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700245 union {
246 u32 hard;
247 u32 proto;
248 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800249 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700250 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700251 } data;
252
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700253 u32 seq;
254 u32 pid;
255 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800256 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700257};
258
Herbert Xu25ee3282007-12-11 09:32:34 -0800259struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260struct xfrm_type;
261struct xfrm_dst;
262struct xfrm_policy_afinfo {
263 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800265 void (*garbage_collect)(struct net *net);
Alexey Dobriyanc5b3cf42008-11-25 17:51:25 -0800266 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
267 xfrm_address_t *saddr,
Herbert Xu66cdb3c2007-11-13 21:37:28 -0800268 xfrm_address_t *daddr);
Alexey Dobriyanfbda33b2008-11-25 17:56:49 -0800269 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700270 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700271 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800272 struct flowi *fl,
273 int reverse);
Herbert Xu25ee3282007-12-11 09:32:34 -0800274 int (*get_tos)(struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800275 int (*init_path)(struct xfrm_dst *path,
276 struct dst_entry *dst,
277 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800278 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000279 struct net_device *dev,
280 struct flowi *fl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281};
282
283extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
284extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700285extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
286extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287
288struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800289extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800290extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
291extern int __xfrm_state_delete(struct xfrm_state *x);
292
Linus Torvalds1da177e2005-04-16 15:20:36 -0700293struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700294 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800295 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700296 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700297 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800298 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700299 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700300 int (*init_flags)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700301 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
302 struct xfrm_tmpl *tmpl,
303 xfrm_address_t *daddr, xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700304 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
305 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Miika Komucdca7262007-02-06 14:24:56 -0800306 int (*output)(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800307 int (*extract_input)(struct xfrm_state *x,
308 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800309 int (*extract_output)(struct xfrm_state *x,
310 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800311 int (*transport_finish)(struct sk_buff *skb,
312 int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700313};
314
315extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
316extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
317
318extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
319
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000320struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700321 char *description;
322 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000323 u8 proto;
324 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700325#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700326#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800327#define XFRM_TYPE_LOCAL_COADDR 4
328#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700329
Herbert Xu72cb6962005-06-20 13:18:08 -0700330 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800332 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
Masahide NAKAMURAdf0ba922006-08-23 20:41:00 -0700334 int (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700335 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700337 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338};
339
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800340extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
341extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342
Herbert Xub59f45d2006-05-27 23:05:54 -0700343struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800344 /*
345 * Remove encapsulation header.
346 *
347 * The IP header will be moved over the top of the encapsulation
348 * header.
349 *
350 * On entry, the transport header shall point to where the IP header
351 * should be and the network header shall be set to where the IP
352 * header currently is. skb->data shall point to the start of the
353 * payload.
354 */
355 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
356
357 /*
358 * This is the actual input entry point.
359 *
360 * For transport mode and equivalent this would be identical to
361 * input2 (which does not need to be set). While tunnel mode
362 * and equivalent would set this to the tunnel encapsulation function
363 * xfrm4_prepare_input that would in turn call input2.
364 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700365 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700366
367 /*
368 * Add encapsulation header.
369 *
370 * On exit, the transport header will be set to the start of the
371 * encapsulation header to be filled in by x->type->output and
372 * the mac header will be set to the nextheader (protocol for
373 * IPv4) field of the extension header directly preceding the
374 * encapsulation header, or in its absence, that of the top IP
375 * header. The value of the network header will always point
376 * to the top IP header while skb->data will point to the payload.
377 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800378 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
379
380 /*
381 * This is the actual output entry point.
382 *
383 * For transport mode and equivalent this would be identical to
384 * output2 (which does not need to be set). While tunnel mode
385 * and equivalent would set this to a tunnel encapsulation function
386 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
387 * call output2.
388 */
389 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700390
Herbert Xu17c2a422007-10-17 21:33:12 -0700391 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700392 struct module *owner;
393 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700394 int flags;
395};
396
397/* Flags for xfrm_mode. */
398enum {
399 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700400};
401
402extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
403extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700404
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700405static inline int xfrm_af2proto(unsigned int family)
406{
407 switch(family) {
408 case AF_INET:
409 return IPPROTO_IPIP;
410 case AF_INET6:
411 return IPPROTO_IPV6;
412 default:
413 return 0;
414 }
415}
416
417static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
418{
419 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
420 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
421 return x->inner_mode;
422 else
423 return x->inner_mode_iaf;
424}
425
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000426struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427/* id in template is interpreted as:
428 * daddr - destination of tunnel, may be zero for transport mode.
429 * spi - zero to acquire spi. Not zero if spi is static, then
430 * daddr must be fixed too.
431 * proto - AH/ESP/IPCOMP
432 */
433 struct xfrm_id id;
434
435/* Source address of tunnel. Ignored, if it is not a tunnel. */
436 xfrm_address_t saddr;
437
Miika Komu76b3f052006-11-30 16:40:43 -0800438 unsigned short encap_family;
439
jamala6337462010-02-09 13:21:17 +0000440 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700442/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000443 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700444
445/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000446 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447
448/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000449 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700450
Herbert Xuc5d18e92008-04-22 00:46:42 -0700451/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000452 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700453
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000455 u32 aalgos;
456 u32 ealgos;
457 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458};
459
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700460#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700461
Herbert Xu12a169e2008-10-01 07:03:24 -0700462struct xfrm_policy_walk_entry {
463 struct list_head all;
464 u8 dead;
465};
466
467struct xfrm_policy_walk {
468 struct xfrm_policy_walk_entry walk;
469 u8 type;
470 u32 seq;
471};
472
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000473struct xfrm_policy {
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800474#ifdef CONFIG_NET_NS
475 struct net *xp_net;
476#endif
David S. Miller2518c7c2006-08-24 04:45:07 -0700477 struct hlist_node bydst;
478 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479
480 /* This lock only affects elements except for entry. */
481 rwlock_t lock;
482 atomic_t refcnt;
483 struct timer_list timer;
484
485 u32 priority;
486 u32 index;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000487 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488 struct xfrm_selector selector;
489 struct xfrm_lifetime_cfg lft;
490 struct xfrm_lifetime_cur curlft;
491 struct dst_entry *bundles;
Herbert Xu12a169e2008-10-01 07:03:24 -0700492 struct xfrm_policy_walk_entry walk;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200493 u8 type;
494 u8 action;
495 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200496 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700497 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800498 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
500};
501
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800502static inline struct net *xp_net(struct xfrm_policy *xp)
503{
504 return read_pnet(&xp->xp_net);
505}
506
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700507struct xfrm_kmaddress {
508 xfrm_address_t local;
509 xfrm_address_t remote;
510 u32 reserved;
511 u16 family;
512};
513
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800514struct xfrm_migrate {
515 xfrm_address_t old_daddr;
516 xfrm_address_t old_saddr;
517 xfrm_address_t new_daddr;
518 xfrm_address_t new_saddr;
519 u8 proto;
520 u8 mode;
521 u16 reserved;
522 u32 reqid;
523 u16 old_family;
524 u16 new_family;
525};
526
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800527#define XFRM_KM_TIMEOUT 30
528/* which seqno */
529#define XFRM_REPLAY_SEQ 1
530#define XFRM_REPLAY_OSEQ 2
531#define XFRM_REPLAY_SEQ_MASK 3
532/* what happened */
533#define XFRM_REPLAY_UPDATE XFRM_AE_CR
534#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
535
536/* default aevent timeout in units of 100ms */
537#define XFRM_AE_ETIME 10
538/* Async Event timer multiplier */
539#define XFRM_AE_ETH_M 10
540/* default seq threshold size */
541#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700542
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000543struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700544 struct list_head list;
545 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700546 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700547 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700548 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800549 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700550 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800551 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700552 int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700553};
554
555extern int xfrm_register_km(struct xfrm_mgr *km);
556extern int xfrm_unregister_km(struct xfrm_mgr *km);
557
Herbert Xu436a0a42007-10-08 17:25:53 -0700558/*
559 * This structure is used for the duration where packets are being
560 * transformed by IPsec. As soon as the packet leaves IPsec the
561 * area beyond the generic IP part may be overwritten.
562 */
563struct xfrm_skb_cb {
564 union {
565 struct inet_skb_parm h4;
566 struct inet6_skb_parm h6;
567 } header;
568
569 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800570 union {
571 u64 output;
572 __be32 input;
573 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700574};
575
576#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
577
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800578/*
579 * This structure is used by the afinfo prepare_input/prepare_output functions
580 * to transmit header information to the mode input/output functions.
581 */
582struct xfrm_mode_skb_cb {
583 union {
584 struct inet_skb_parm h4;
585 struct inet6_skb_parm h6;
586 } header;
587
588 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
589 __be16 id;
590 __be16 frag_off;
591
Herbert Xu732c8bd2008-03-26 16:51:09 -0700592 /* IP header length (excluding options or extension headers). */
593 u8 ihl;
594
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800595 /* TOS for IPv4, class for IPv6. */
596 u8 tos;
597
598 /* TTL for IPv4, hop limitfor IPv6. */
599 u8 ttl;
600
601 /* Protocol for IPv4, NH for IPv6. */
602 u8 protocol;
603
Herbert Xu732c8bd2008-03-26 16:51:09 -0700604 /* Option length for IPv4, zero for IPv6. */
605 u8 optlen;
606
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800607 /* Used by IPv6 only, zero for IPv4. */
608 u8 flow_lbl[3];
609};
610
611#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
612
Herbert Xu716062f2007-11-13 21:44:23 -0800613/*
614 * This structure is used by the input processing to locate the SPI and
615 * related information.
616 */
617struct xfrm_spi_skb_cb {
618 union {
619 struct inet_skb_parm h4;
620 struct inet6_skb_parm h6;
621 } header;
622
Herbert Xu716062f2007-11-13 21:44:23 -0800623 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800624 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800625};
626
627#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
628
Joy Latten161a09e2006-11-27 13:11:54 -0600629/* Audit Information */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000630struct xfrm_audit {
Joy Latten161a09e2006-11-27 13:11:54 -0600631 u32 secid;
Eric Paris25323862008-04-18 10:09:25 -0400632 uid_t loginuid;
633 u32 sessionid;
Joy Latten161a09e2006-11-27 13:11:54 -0600634};
Joy Lattenc9204d92006-11-30 15:50:43 -0600635
636#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800637static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700638{
639 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800640
641 if (audit_enabled == 0)
642 return NULL;
643 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
644 AUDIT_MAC_IPSEC_EVENT);
645 if (audit_buf == NULL)
646 return NULL;
647 audit_log_format(audit_buf, "op=%s", op);
648 return audit_buf;
649}
650
Eric Paris25323862008-04-18 10:09:25 -0400651static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800652 struct audit_buffer *audit_buf)
653{
Joy Lattenab5f5e82007-09-17 11:51:22 -0700654 char *secctx;
655 u32 secctx_len;
656
Eric Paris25323862008-04-18 10:09:25 -0400657 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Paul Moore68277ac2007-12-20 20:49:33 -0800658 if (secid != 0 &&
659 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
Joy Lattenab5f5e82007-09-17 11:51:22 -0700660 audit_log_format(audit_buf, " subj=%s", secctx);
661 security_release_secctx(secctx, secctx_len);
662 } else
663 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700664}
665
666extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400667 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700668extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400669 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700670extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400671 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700672extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400673 u32 auid, u32 ses, u32 secid);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800674extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
675 struct sk_buff *skb);
676extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
677extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
678 __be32 net_spi, __be32 net_seq);
679extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
680 struct sk_buff *skb, u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600681#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700682
683static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
684 u32 auid, u32 ses, u32 secid)
685{
686}
687
688static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
689 u32 auid, u32 ses, u32 secid)
690{
691}
692
693static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
694 u32 auid, u32 ses, u32 secid)
695{
696}
697
698static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
699 u32 auid, u32 ses, u32 secid)
700{
701}
702
703static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
704 struct sk_buff *skb)
705{
706}
707
708static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
709 u16 family)
710{
711}
712
713static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
714 __be32 net_spi, __be32 net_seq)
715{
716}
717
718static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
719 struct sk_buff *skb, u8 proto)
720{
721}
Joy Lattenc9204d92006-11-30 15:50:43 -0600722#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600723
Linus Torvalds1da177e2005-04-16 15:20:36 -0700724static inline void xfrm_pol_hold(struct xfrm_policy *policy)
725{
726 if (likely(policy != NULL))
727 atomic_inc(&policy->refcnt);
728}
729
WANG Cong64c31b32008-01-07 22:34:29 -0800730extern void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700731
732static inline void xfrm_pol_put(struct xfrm_policy *policy)
733{
734 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800735 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700736}
737
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700738#ifdef CONFIG_XFRM_SUB_POLICY
739static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
740{
741 int i;
742 for (i = npols - 1; i >= 0; --i)
743 xfrm_pol_put(pols[i]);
744}
745#else
746static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
747{
748 xfrm_pol_put(pols[0]);
749}
750#endif
751
Linus Torvalds1da177e2005-04-16 15:20:36 -0700752extern void __xfrm_state_destroy(struct xfrm_state *);
753
Herbert Xu21380b82006-02-22 14:47:13 -0800754static inline void __xfrm_state_put(struct xfrm_state *x)
755{
756 atomic_dec(&x->refcnt);
757}
758
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759static inline void xfrm_state_put(struct xfrm_state *x)
760{
761 if (atomic_dec_and_test(&x->refcnt))
762 __xfrm_state_destroy(x);
763}
764
765static inline void xfrm_state_hold(struct xfrm_state *x)
766{
767 atomic_inc(&x->refcnt);
768}
769
770static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
771{
Al Viro5f193432006-09-27 18:46:32 -0700772 __be32 *a1 = token1;
773 __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700774 int pdw;
775 int pbi;
776
jamala6337462010-02-09 13:21:17 +0000777 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700778 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
779
780 if (pdw)
781 if (memcmp(a1, a2, pdw << 2))
782 return 0;
783
784 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700785 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786
787 mask = htonl((0xffffffff) << (32 - pbi));
788
789 if ((a1[pdw] ^ a2[pdw]) & mask)
790 return 0;
791 }
792
793 return 1;
794}
795
796static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700797__be16 xfrm_flowi_sport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798{
Al Virof9d07e41f82006-09-27 18:45:50 -0700799 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700800 switch(fl->proto) {
801 case IPPROTO_TCP:
802 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800803 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804 case IPPROTO_SCTP:
805 port = fl->fl_ip_sport;
806 break;
807 case IPPROTO_ICMP:
808 case IPPROTO_ICMPV6:
809 port = htons(fl->fl_icmp_type);
810 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700811 case IPPROTO_MH:
812 port = htons(fl->fl_mh_type);
813 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814 default:
815 port = 0; /*XXX*/
816 }
817 return port;
818}
819
820static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700821__be16 xfrm_flowi_dport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700822{
Al Virof9d07e41f82006-09-27 18:45:50 -0700823 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824 switch(fl->proto) {
825 case IPPROTO_TCP:
826 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800827 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700828 case IPPROTO_SCTP:
829 port = fl->fl_ip_dport;
830 break;
831 case IPPROTO_ICMP:
832 case IPPROTO_ICMPV6:
833 port = htons(fl->fl_icmp_code);
834 break;
835 default:
836 port = 0; /*XXX*/
837 }
838 return port;
839}
840
Andrew Morton77681022006-11-08 22:46:26 -0800841extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
842 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843
Trent Jaegerdf718372005-12-13 23:12:27 -0800844#ifdef CONFIG_SECURITY_NETWORK_XFRM
845/* If neither has a context --> match
846 * Otherwise, both must have a context and the sids, doi, alg must match
847 */
848static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
849{
850 return ((!s1 && !s2) ||
851 (s1 && s2 &&
852 (s1->ctx_sid == s2->ctx_sid) &&
853 (s1->ctx_doi == s2->ctx_doi) &&
854 (s1->ctx_alg == s2->ctx_alg)));
855}
856#else
857static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
858{
859 return 1;
860}
861#endif
862
Linus Torvalds1da177e2005-04-16 15:20:36 -0700863/* A struct encoding bundle of transformations to apply to some set of flow.
864 *
865 * dst->child points to the next element of bundle.
866 * dst->xfrm points to an instanse of transformer.
867 *
868 * Due to unfortunate limitations of current routing cache, which we
869 * have no time to fix, it mirrors struct rtable and bound to the same
870 * routing key, including saddr,daddr. However, we can have many of
871 * bundles differing by session id. All the bundles grow from a parent
872 * policy rule.
873 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000874struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700875 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700876 struct dst_entry dst;
877 struct rtable rt;
878 struct rt6_info rt6;
879 } u;
880 struct dst_entry *route;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700881#ifdef CONFIG_XFRM_SUB_POLICY
882 struct flowi *origin;
883 struct xfrm_selector *partner;
884#endif
David S. Miller9d4a7062006-08-24 03:18:09 -0700885 u32 genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700886 u32 route_mtu_cached;
887 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700888 u32 route_cookie;
889 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700890};
891
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700892#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700893static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
894{
895 dst_release(xdst->route);
896 if (likely(xdst->u.dst.xfrm))
897 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700898#ifdef CONFIG_XFRM_SUB_POLICY
899 kfree(xdst->origin);
900 xdst->origin = NULL;
901 kfree(xdst->partner);
902 xdst->partner = NULL;
903#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700904}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700905#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700906
907extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
908
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000909struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700910 atomic_t refcnt;
911 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800912 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700913};
914
915static inline struct sec_path *
916secpath_get(struct sec_path *sp)
917{
918 if (sp)
919 atomic_inc(&sp->refcnt);
920 return sp;
921}
922
923extern void __secpath_destroy(struct sec_path *sp);
924
925static inline void
926secpath_put(struct sec_path *sp)
927{
928 if (sp && atomic_dec_and_test(&sp->refcnt))
929 __secpath_destroy(sp);
930}
931
932extern struct sec_path *secpath_dup(struct sec_path *src);
933
934static inline void
935secpath_reset(struct sk_buff *skb)
936{
937#ifdef CONFIG_XFRM
938 secpath_put(skb->sp);
939 skb->sp = NULL;
940#endif
941}
942
943static inline int
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700944xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
945{
946 switch (family) {
947 case AF_INET:
948 return addr->a4 == 0;
949 case AF_INET6:
950 return ipv6_addr_any((struct in6_addr *)&addr->a6);
951 }
952 return 0;
953}
954
955static inline int
Linus Torvalds1da177e2005-04-16 15:20:36 -0700956__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
957{
958 return (tmpl->saddr.a4 &&
959 tmpl->saddr.a4 != x->props.saddr.a4);
960}
961
962static inline int
963__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
964{
965 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
966 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
967}
968
969static inline int
970xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
971{
972 switch (family) {
973 case AF_INET:
974 return __xfrm4_state_addr_cmp(tmpl, x);
975 case AF_INET6:
976 return __xfrm6_state_addr_cmp(tmpl, x);
977 }
978 return !0;
979}
980
981#ifdef CONFIG_XFRM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700982extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
983
Herbert Xud5422ef2007-12-12 10:44:16 -0800984static inline int __xfrm_policy_check2(struct sock *sk, int dir,
985 struct sk_buff *skb,
986 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700987{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800988 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -0800989 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
990
Linus Torvalds1da177e2005-04-16 15:20:36 -0700991 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -0800992 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700993
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800994 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +0000995 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -0800996 __xfrm_policy_check(sk, ndir, skb, family);
997}
998
999static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1000{
1001 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001002}
1003
1004static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1005{
1006 return xfrm_policy_check(sk, dir, skb, AF_INET);
1007}
1008
1009static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1010{
1011 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1012}
1013
Herbert Xud5422ef2007-12-12 10:44:16 -08001014static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1015 struct sk_buff *skb)
1016{
1017 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1018}
1019
1020static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1021 struct sk_buff *skb)
1022{
1023 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1024}
1025
1026extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1027 unsigned int family, int reverse);
1028
1029static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1030 unsigned int family)
1031{
1032 return __xfrm_decode_session(skb, fl, family, 0);
1033}
1034
1035static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1036 struct flowi *fl,
1037 unsigned int family)
1038{
1039 return __xfrm_decode_session(skb, fl, family, 1);
1040}
1041
Linus Torvalds1da177e2005-04-16 15:20:36 -07001042extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1043
1044static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1045{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001046 struct net *net = dev_net(skb->dev);
1047
1048 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001049 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001050 __xfrm_route_forward(skb, family);
1051}
1052
1053static inline int xfrm4_route_forward(struct sk_buff *skb)
1054{
1055 return xfrm_route_forward(skb, AF_INET);
1056}
1057
1058static inline int xfrm6_route_forward(struct sk_buff *skb)
1059{
1060 return xfrm_route_forward(skb, AF_INET6);
1061}
1062
1063extern int __xfrm_sk_clone_policy(struct sock *sk);
1064
1065static inline int xfrm_sk_clone_policy(struct sock *sk)
1066{
1067 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1068 return __xfrm_sk_clone_policy(sk);
1069 return 0;
1070}
1071
Herbert Xu4666faa2005-06-18 22:43:22 -07001072extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001073
1074static inline void xfrm_sk_free_policy(struct sock *sk)
1075{
1076 if (unlikely(sk->sk_policy[0] != NULL)) {
1077 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1078 sk->sk_policy[0] = NULL;
1079 }
1080 if (unlikely(sk->sk_policy[1] != NULL)) {
1081 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1082 sk->sk_policy[1] = NULL;
1083 }
1084}
1085
1086#else
1087
1088static inline void xfrm_sk_free_policy(struct sock *sk) {}
1089static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1090static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1091static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1092static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1093{
1094 return 1;
1095}
1096static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1097{
1098 return 1;
1099}
1100static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1101{
1102 return 1;
1103}
Herbert Xud5422ef2007-12-12 10:44:16 -08001104static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1105 struct flowi *fl,
1106 unsigned int family)
1107{
1108 return -ENOSYS;
1109}
1110static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1111 struct sk_buff *skb)
1112{
1113 return 1;
1114}
1115static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1116 struct sk_buff *skb)
1117{
1118 return 1;
1119}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001120#endif
1121
1122static __inline__
1123xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
1124{
1125 switch (family){
1126 case AF_INET:
1127 return (xfrm_address_t *)&fl->fl4_dst;
1128 case AF_INET6:
1129 return (xfrm_address_t *)&fl->fl6_dst;
1130 }
1131 return NULL;
1132}
1133
1134static __inline__
1135xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
1136{
1137 switch (family){
1138 case AF_INET:
1139 return (xfrm_address_t *)&fl->fl4_src;
1140 case AF_INET6:
1141 return (xfrm_address_t *)&fl->fl6_src;
1142 }
1143 return NULL;
1144}
1145
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001146static __inline__
1147void xfrm_flowi_addr_get(struct flowi *fl,
1148 xfrm_address_t *saddr, xfrm_address_t *daddr,
1149 unsigned short family)
1150{
1151 switch(family) {
1152 case AF_INET:
1153 memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
1154 memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
1155 break;
1156 case AF_INET6:
1157 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
1158 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
1159 break;
1160 }
1161}
1162
Linus Torvalds1da177e2005-04-16 15:20:36 -07001163static __inline__ int
1164__xfrm4_state_addr_check(struct xfrm_state *x,
1165 xfrm_address_t *daddr, xfrm_address_t *saddr)
1166{
1167 if (daddr->a4 == x->id.daddr.a4 &&
1168 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1169 return 1;
1170 return 0;
1171}
1172
1173static __inline__ int
1174__xfrm6_state_addr_check(struct xfrm_state *x,
1175 xfrm_address_t *daddr, xfrm_address_t *saddr)
1176{
1177 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1178 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1179 ipv6_addr_any((struct in6_addr *)saddr) ||
1180 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1181 return 1;
1182 return 0;
1183}
1184
1185static __inline__ int
1186xfrm_state_addr_check(struct xfrm_state *x,
1187 xfrm_address_t *daddr, xfrm_address_t *saddr,
1188 unsigned short family)
1189{
1190 switch (family) {
1191 case AF_INET:
1192 return __xfrm4_state_addr_check(x, daddr, saddr);
1193 case AF_INET6:
1194 return __xfrm6_state_addr_check(x, daddr, saddr);
1195 }
1196 return 0;
1197}
1198
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001199static __inline__ int
1200xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
1201 unsigned short family)
1202{
1203 switch (family) {
1204 case AF_INET:
1205 return __xfrm4_state_addr_check(x,
1206 (xfrm_address_t *)&fl->fl4_dst,
1207 (xfrm_address_t *)&fl->fl4_src);
1208 case AF_INET6:
1209 return __xfrm6_state_addr_check(x,
1210 (xfrm_address_t *)&fl->fl6_dst,
1211 (xfrm_address_t *)&fl->fl6_src);
1212 }
1213 return 0;
1214}
1215
Linus Torvalds1da177e2005-04-16 15:20:36 -07001216static inline int xfrm_state_kern(struct xfrm_state *x)
1217{
1218 return atomic_read(&x->tunnel_users);
1219}
1220
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001221static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1222{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001223 return (!userproto || proto == userproto ||
1224 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1225 proto == IPPROTO_ESP ||
1226 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001227}
1228
Linus Torvalds1da177e2005-04-16 15:20:36 -07001229/*
1230 * xfrm algorithm information
1231 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001232struct xfrm_algo_aead_info {
1233 u16 icv_truncbits;
1234};
1235
Linus Torvalds1da177e2005-04-16 15:20:36 -07001236struct xfrm_algo_auth_info {
1237 u16 icv_truncbits;
1238 u16 icv_fullbits;
1239};
1240
1241struct xfrm_algo_encr_info {
1242 u16 blockbits;
1243 u16 defkeybits;
1244};
1245
1246struct xfrm_algo_comp_info {
1247 u16 threshold;
1248};
1249
1250struct xfrm_algo_desc {
1251 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001252 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001253 u8 available:1;
1254 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001255 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001256 struct xfrm_algo_auth_info auth;
1257 struct xfrm_algo_encr_info encr;
1258 struct xfrm_algo_comp_info comp;
1259 } uinfo;
1260 struct sadb_alg desc;
1261};
1262
1263/* XFRM tunnel handlers. */
1264struct xfrm_tunnel {
1265 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001266 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001267
1268 struct xfrm_tunnel *next;
1269 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001270};
1271
1272struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001273 int (*handler)(struct sk_buff *skb);
1274 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001275 u8 type, u8 code, int offset, __be32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001276 struct xfrm6_tunnel *next;
1277 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001278};
1279
1280extern void xfrm_init(void);
Neil Hormana33bc5c2009-07-30 18:52:15 -07001281extern void xfrm4_init(int rt_hash_size);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08001282extern int xfrm_state_init(struct net *net);
1283extern void xfrm_state_fini(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001284extern void xfrm4_state_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001285#ifdef CONFIG_XFRM
1286extern int xfrm6_init(void);
1287extern void xfrm6_fini(void);
Daniel Lezcano0013cab2007-12-07 00:42:11 -08001288extern int xfrm6_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001289extern void xfrm6_state_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001290#else
1291static inline int xfrm6_init(void)
1292{
1293 return 0;
1294}
1295static inline void xfrm6_fini(void)
1296{
1297 ;
1298}
1299#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001300
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001301#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyanc68cd1a2008-11-25 18:00:14 -08001302extern int xfrm_proc_init(struct net *net);
1303extern void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001304#endif
1305
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001306extern int xfrm_sysctl_init(struct net *net);
1307#ifdef CONFIG_SYSCTL
1308extern void xfrm_sysctl_fini(struct net *net);
1309#else
1310static inline void xfrm_sysctl_fini(struct net *net)
1311{
1312}
1313#endif
1314
Herbert Xu5c182452008-09-22 19:48:19 -07001315extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001316extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001317 int (*func)(struct xfrm_state *, int, void*), void *);
Herbert Xuabb81c42008-09-09 19:58:29 -07001318extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
Alexey Dobriyan673c09b2008-11-25 17:15:16 -08001319extern struct xfrm_state *xfrm_state_alloc(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001320extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1321 struct flowi *fl, struct xfrm_tmpl *tmpl,
1322 struct xfrm_policy *pol, int *err,
1323 unsigned short family);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001324extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001325 xfrm_address_t *daddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -07001326 xfrm_address_t *saddr,
1327 unsigned short family,
1328 u8 mode, u8 proto, u32 reqid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329extern int xfrm_state_check_expire(struct xfrm_state *x);
1330extern void xfrm_state_insert(struct xfrm_state *x);
1331extern int xfrm_state_add(struct xfrm_state *x);
1332extern int xfrm_state_update(struct xfrm_state *x);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001333extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1334 xfrm_address_t *daddr, __be32 spi,
1335 u8 proto, unsigned short family);
1336extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1337 xfrm_address_t *daddr,
1338 xfrm_address_t *saddr,
1339 u8 proto,
1340 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001341#ifdef CONFIG_XFRM_SUB_POLICY
1342extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1343 int n, unsigned short family);
1344extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1345 int n, unsigned short family);
1346#else
1347static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1348 int n, unsigned short family)
1349{
1350 return -ENOSYS;
1351}
1352
1353static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1354 int n, unsigned short family)
1355{
1356 return -ENOSYS;
1357}
1358#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001359
1360struct xfrmk_sadinfo {
1361 u32 sadhcnt; /* current hash bkts */
1362 u32 sadhmcnt; /* max allowed hash bkts */
1363 u32 sadcnt; /* current running count */
1364};
1365
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001366struct xfrmk_spdinfo {
1367 u32 incnt;
1368 u32 outcnt;
1369 u32 fwdcnt;
1370 u32 inscnt;
1371 u32 outscnt;
1372 u32 fwdscnt;
1373 u32 spdhcnt;
1374 u32 spdhmcnt;
1375};
1376
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001377extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1378 u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001379extern int xfrm_state_delete(struct xfrm_state *x);
Alexey Dobriyan0e602452008-11-25 17:30:18 -08001380extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
Alexey Dobriyane0710412010-01-23 13:37:10 +00001381extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1382extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
Paul Mooreafeb14b2007-12-21 14:58:11 -08001383extern int xfrm_replay_check(struct xfrm_state *x,
1384 struct sk_buff *skb, __be32 seq);
Al Viro61f46272006-09-27 18:48:33 -07001385extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001386extern void xfrm_replay_notify(struct xfrm_state *x, int event);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -07001388extern int xfrm_init_state(struct xfrm_state *x);
Herbert Xu227620e2007-11-13 21:41:28 -08001389extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -08001390extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1391 int encap_type);
Herbert Xu1bf06cd2007-11-19 18:50:17 -08001392extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
Herbert Xuc6581a42007-11-13 21:43:43 -08001393extern int xfrm_output_resume(struct sk_buff *skb, int err);
Herbert Xu406ef772007-10-08 17:16:30 -07001394extern int xfrm_output(struct sk_buff *skb);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001395extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001396extern int xfrm4_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001397extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001398extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1399 int encap_type);
Herbert Xu716062f2007-11-13 21:44:23 -08001400extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001401extern int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001402
1403static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1404{
1405 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1406}
1407
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001408extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1409extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001410extern int xfrm4_output(struct sk_buff *skb);
Kazunori MIYAZAWAc0d56402007-02-13 12:54:47 -08001411extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1412extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001413extern int xfrm6_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001414extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu33b5ecb2007-10-17 21:29:25 -07001415extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
Herbert Xu716062f2007-11-13 21:44:23 -08001416extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
Herbert Xue5bbef22007-10-15 12:50:28 -07001417extern int xfrm6_rcv(struct sk_buff *skb);
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -07001418extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1419 xfrm_address_t *saddr, u8 proto);
Kazunori MIYAZAWA73d605d2007-02-13 12:55:55 -08001420extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1421extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001422extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1423extern void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr);
1424extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001425extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1426extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001427extern int xfrm6_output(struct sk_buff *skb);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -07001428extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1429 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001430
1431#ifdef CONFIG_XFRM
James Chapman067b2072007-07-05 17:08:05 -07001432extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001433extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001434#else
1435static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1436{
1437 return -ENOPROTOOPT;
1438}
1439
James Chapman067b2072007-07-05 17:08:05 -07001440static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001441{
1442 /* should not happen */
1443 kfree_skb(skb);
1444 return 0;
1445}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001446#endif
1447
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001448struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001449
Herbert Xu12a169e2008-10-01 07:03:24 -07001450extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
Alexey Dobriyancdcbca72008-11-25 17:34:49 -08001451extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001452 int (*func)(struct xfrm_policy *, int, int, void*), void *);
Herbert Xu12a169e2008-10-01 07:03:24 -07001453extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001454int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001455struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1456 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001457 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001458 struct xfrm_sec_ctx *ctx, int delete,
1459 int *err);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001460struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
Alexey Dobriyan33ffbbd2008-11-25 17:33:32 -08001461int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001462u32 xfrm_get_acqseq(void);
Herbert Xu658b2192007-10-09 13:29:52 -07001463extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001464struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1465 u8 mode, u32 reqid, u8 proto,
1466 xfrm_address_t *daddr,
1467 xfrm_address_t *saddr, int create,
1468 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001469extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Venkat Yekkirala5b368e62006-10-05 15:42:18 -05001470extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
1471 struct flowi *fl, int family, int strict);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001473#ifdef CONFIG_XFRM_MIGRATE
1474extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001475 struct xfrm_migrate *m, int num_bundles,
1476 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001477extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1478extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1479 struct xfrm_migrate *m);
1480extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001481 struct xfrm_migrate *m, int num_bundles,
1482 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001483#endif
1484
Al Viro5d36b182006-11-08 00:24:06 -08001485extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -08001486extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001487extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001488
1489extern void xfrm_input_init(void);
Al Viro6067b2b2006-09-27 18:47:59 -07001490extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491
1492extern void xfrm_probe_algs(void);
1493extern int xfrm_count_auth_supported(void);
1494extern int xfrm_count_enc_supported(void);
1495extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1496extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1497extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1498extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1499extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1500extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
1501extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
1502extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
Herbert Xu1a6509d2008-01-28 19:37:29 -08001503extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
1504 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505
Herbert Xu07d4ee52006-08-20 14:24:50 +10001506struct hash_desc;
Herbert Xu9409f382006-08-06 19:49:12 +10001507struct scatterlist;
Herbert Xu07d4ee52006-08-20 14:24:50 +10001508typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1509 unsigned int);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510
Linus Torvalds1da177e2005-04-16 15:20:36 -07001511static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
1512 int family)
1513{
1514 switch (family) {
1515 default:
1516 case AF_INET:
jamala6337462010-02-09 13:21:17 +00001517 return (__force u32)a->a4 - (__force u32)b->a4;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 case AF_INET6:
1519 return ipv6_addr_cmp((struct in6_addr *)a,
1520 (struct in6_addr *)b);
1521 }
1522}
1523
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001524static inline int xfrm_policy_id2dir(u32 index)
1525{
1526 return index & 7;
1527}
1528
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001529#ifdef CONFIG_XFRM
1530static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001531{
Patrick McHardybe336902006-03-20 22:40:54 -08001532 struct sock *nlsk;
1533 int ret = 0;
1534
1535 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001536 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001537 if (nlsk)
1538 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1539 rcu_read_unlock();
1540 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001541}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001542#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001543
Eric Dumazet0f99be02008-01-08 23:39:06 -08001544static inline int xfrm_alg_len(struct xfrm_algo *alg)
1545{
1546 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1547}
1548
Martin Willi4447bb32009-11-25 00:29:52 +00001549static inline int xfrm_alg_auth_len(struct xfrm_algo_auth *alg)
1550{
1551 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1552}
1553
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001554#ifdef CONFIG_XFRM_MIGRATE
1555static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1556{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001557 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001558}
1559
Martin Willi4447bb32009-11-25 00:29:52 +00001560static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1561{
1562 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1563}
1564
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001565static inline void xfrm_states_put(struct xfrm_state **states, int n)
1566{
1567 int i;
1568 for (i = 0; i < n; i++)
1569 xfrm_state_put(*(states + i));
1570}
1571
1572static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1573{
1574 int i;
1575 for (i = 0; i < n; i++)
1576 xfrm_state_delete(*(states + i));
1577}
1578#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001579
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001580#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001581static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1582{
1583 return skb->sp->xvec[skb->sp->len - 1];
1584}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001585#endif
Herbert Xu00501122007-12-11 01:53:43 -08001586
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001587static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1588{
1589 if (attrs[XFRMA_MARK])
1590 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(m));
1591 else
1592 m->v = m->m = 0;
1593
1594 return m->v & m->m;
1595}
1596
1597static inline int xfrm_mark_put(struct sk_buff *skb, struct xfrm_mark *m)
1598{
1599 if (m->m | m->v)
1600 NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1601 return 0;
1602
1603nla_put_failure:
1604 return -1;
1605}
1606
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607#endif /* _NET_XFRM_H */