blob: 6ae4bc5ce8a712796774e32637f875f4e98b173e [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Nicolas Dichtelfa9921e2011-02-02 06:29:02 +000039#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070041#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070043#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080046#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080047#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
49#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080050#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080051#define XFRM_INC_STATS(net, field) ((void)(net))
52#define XFRM_INC_STATS_BH(net, field) ((void)(net))
53#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080054#endif
55
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080056extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070057
58/* Organization of SPD aka "XFRM rules"
59 ------------------------------------
60
61 Basic objects:
62 - policy rule, struct xfrm_policy (=SPD entry)
63 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
64 - instance of a transformer, struct xfrm_state (=SA)
65 - template to clone xfrm_state, struct xfrm_tmpl
66
67 SPD is plain linear list of xfrm_policy rules, ordered by priority.
68 (To be compatible with existing pfkeyv2 implementations,
69 many rules with priority of 0x7fffffff are allowed to exist and
70 such rules are ordered in an unpredictable way, thanks to bsd folks.)
71
72 Lookup is plain linear search until the first match with selector.
73
74 If "action" is "block", then we prohibit the flow, otherwise:
75 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
76 policy entry has list of up to XFRM_MAX_DEPTH transformations,
77 described by templates xfrm_tmpl. Each template is resolved
78 to a complete xfrm_state (see below) and we pack bundle of transformations
79 to a dst_entry returned to requestor.
80
81 dst -. xfrm .-> xfrm_state #1
82 |---. child .-> dst -. xfrm .-> xfrm_state #2
83 |---. child .-> dst -. xfrm .-> xfrm_state #3
84 |---. child .-> NULL
85
86 Bundles are cached at xrfm_policy struct (field ->bundles).
87
88
89 Resolution of xrfm_tmpl
90 -----------------------
91 Template contains:
92 1. ->mode Mode: transport or tunnel
93 2. ->id.proto Protocol: AH/ESP/IPCOMP
94 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
95 Q: allow to resolve security gateway?
96 4. ->id.spi If not zero, static SPI.
97 5. ->saddr Local tunnel endpoint, ignored for transport mode.
98 6. ->algos List of allowed algos. Plain bitmask now.
99 Q: ealgos, aalgos, calgos. What a mess...
100 7. ->share Sharing mode.
101 Q: how to implement private sharing mode? To add struct sock* to
102 flow id?
103
104 Having this template we search through SAD searching for entries
105 with appropriate mode/proto/algo, permitted by selector.
106 If no appropriate entry found, it is requested from key manager.
107
108 PROBLEMS:
109 Q: How to find all the bundles referring to a physical path for
110 PMTU discovery? Seems, dst should contain list of all parents...
111 and enter to infinite locking hierarchy disaster.
112 No! It is easier, we will not search for them, let them find us.
113 We add genid to each dst plus pointer to genid of raw IP route,
114 pmtu disc will update pmtu on raw IP route and increase its genid.
115 dst_check() will see this for top level and trigger resyncing
116 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
117 */
118
Herbert Xu12a169e2008-10-01 07:03:24 -0700119struct xfrm_state_walk {
120 struct list_head all;
121 u8 state;
122 union {
123 u8 dying;
124 u8 proto;
125 };
126 u32 seq;
127};
128
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000130struct xfrm_state {
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800131#ifdef CONFIG_NET_NS
132 struct net *xs_net;
133#endif
Herbert Xuabb81c42008-09-09 19:58:29 -0700134 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700135 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700136 struct hlist_node bydst;
137 };
David S. Miller8f126e32006-08-24 02:45:07 -0700138 struct hlist_node bysrc;
139 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140
141 atomic_t refcnt;
142 spinlock_t lock;
143
144 struct xfrm_id id;
145 struct xfrm_selector sel;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000146 struct xfrm_mark mark;
Martin Willi35d28562010-12-08 04:37:49 +0000147 u32 tfcpad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700148
David S. Miller9d4a7062006-08-24 03:18:09 -0700149 u32 genid;
150
Herbert Xu12a169e2008-10-01 07:03:24 -0700151 /* Key manager bits */
152 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700153
154 /* Parameters of this state. */
155 struct {
156 u32 reqid;
157 u8 mode;
158 u8 replay_window;
159 u8 aalgo, ealgo, calgo;
160 u8 flags;
161 u16 family;
162 xfrm_address_t saddr;
163 int header_len;
164 int trailer_len;
165 } props;
166
167 struct xfrm_lifetime_cfg lft;
168
169 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000170 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171 struct xfrm_algo *ealg;
172 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800173 struct xfrm_algo_aead *aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174
175 /* Data for encapsulator */
176 struct xfrm_encap_tmpl *encap;
177
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700178 /* Data for care-of address */
179 xfrm_address_t *coaddr;
180
Linus Torvalds1da177e2005-04-16 15:20:36 -0700181 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
182 struct xfrm_state *tunnel;
183
184 /* If a tunnel, number of users + 1 */
185 atomic_t tunnel_users;
186
187 /* State for replay detection */
188 struct xfrm_replay_state replay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000189 struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700190
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800191 /* Replay detection state at the time we sent the last notification */
192 struct xfrm_replay_state preplay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000193 struct xfrm_replay_state_esn *preplay_esn;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800194
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000195 /* The functions for replay detection. */
196 struct xfrm_replay *repl;
197
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700198 /* internal flag that only holds state for delayed aevent at the
199 * moment
200 */
201 u32 xflags;
202
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800203 /* Replay detection notification settings */
204 u32 replay_maxage;
205 u32 replay_maxdiff;
206
207 /* Replay detection notification timer */
208 struct timer_list rtimer;
209
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210 /* Statistics */
211 struct xfrm_stats stats;
212
213 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800214 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700216 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800217 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700218
Linus Torvalds1da177e2005-04-16 15:20:36 -0700219 /* Reference to data common to all the instances of this
220 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800221 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700222 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700223 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700224 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225
Trent Jaegerdf718372005-12-13 23:12:27 -0800226 /* Security context */
227 struct xfrm_sec_ctx *security;
228
Linus Torvalds1da177e2005-04-16 15:20:36 -0700229 /* Private data of this transformer, format is opaque,
230 * interpreted by xfrm_type methods. */
231 void *data;
232};
233
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800234static inline struct net *xs_net(struct xfrm_state *x)
235{
236 return read_pnet(&x->xs_net);
237}
238
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700239/* xflags - make enum if more show up */
240#define XFRM_TIME_DEFER 1
241
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242enum {
243 XFRM_STATE_VOID,
244 XFRM_STATE_ACQ,
245 XFRM_STATE_VALID,
246 XFRM_STATE_ERROR,
247 XFRM_STATE_EXPIRED,
248 XFRM_STATE_DEAD
249};
250
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700251/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000252struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700253 union {
254 u32 hard;
255 u32 proto;
256 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800257 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700258 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700259 } data;
260
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700261 u32 seq;
262 u32 pid;
263 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800264 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700265};
266
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000267struct xfrm_replay {
268 void (*advance)(struct xfrm_state *x, __be32 net_seq);
269 int (*check)(struct xfrm_state *x,
270 struct sk_buff *skb,
271 __be32 net_seq);
272 void (*notify)(struct xfrm_state *x, int event);
273 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
274};
275
Herbert Xu25ee3282007-12-11 09:32:34 -0800276struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700277struct xfrm_type;
278struct xfrm_dst;
279struct xfrm_policy_afinfo {
280 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800282 void (*garbage_collect)(struct net *net);
Alexey Dobriyanc5b3cf42008-11-25 17:51:25 -0800283 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
David S. Miller5e6b9302011-02-24 00:14:45 -0500284 const xfrm_address_t *saddr,
285 const xfrm_address_t *daddr);
Alexey Dobriyanfbda33b2008-11-25 17:56:49 -0800286 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800288 struct flowi *fl,
289 int reverse);
David S. Miller05d84022011-02-22 17:47:10 -0800290 int (*get_tos)(const struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800291 int (*init_path)(struct xfrm_dst *path,
292 struct dst_entry *dst,
293 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800294 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000295 struct net_device *dev,
David S. Miller0c7b3ee2011-02-22 17:48:57 -0800296 const struct flowi *fl);
David S. Miller2774c132011-03-01 14:59:04 -0800297 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700298};
299
300extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
301extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
David S. Miller214e0052011-02-24 00:02:38 -0500302extern void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c);
303extern void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700304
305struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800306extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800307extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
308extern int __xfrm_state_delete(struct xfrm_state *x);
309
Linus Torvalds1da177e2005-04-16 15:20:36 -0700310struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700311 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800312 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700313 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700314 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800315 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700316 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700317 int (*init_flags)(struct xfrm_state *x);
David S. Miller73e5ebb2011-02-22 17:51:44 -0800318 void (*init_tempsel)(struct xfrm_selector *sel,
319 const struct flowi *fl);
David S. Miller19bd6242011-02-24 00:07:20 -0500320 void (*init_temprop)(struct xfrm_state *x,
321 const struct xfrm_tmpl *tmpl,
322 const xfrm_address_t *daddr,
323 const xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700324 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
325 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Miika Komucdca7262007-02-06 14:24:56 -0800326 int (*output)(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800327 int (*extract_input)(struct xfrm_state *x,
328 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800329 int (*extract_output)(struct xfrm_state *x,
330 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800331 int (*transport_finish)(struct sk_buff *skb,
332 int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333};
334
335extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
336extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
337
338extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
339
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000340struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341 char *description;
342 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000343 u8 proto;
344 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700345#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700346#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800347#define XFRM_TYPE_LOCAL_COADDR 4
348#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349
Herbert Xu72cb6962005-06-20 13:18:08 -0700350 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700351 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800352 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
David S. Miller8f029de2011-02-22 17:59:59 -0800354 int (*reject)(struct xfrm_state *, struct sk_buff *,
355 const struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700356 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700358 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700359};
360
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800361extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
362extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700363
Herbert Xub59f45d2006-05-27 23:05:54 -0700364struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800365 /*
366 * Remove encapsulation header.
367 *
368 * The IP header will be moved over the top of the encapsulation
369 * header.
370 *
371 * On entry, the transport header shall point to where the IP header
372 * should be and the network header shall be set to where the IP
373 * header currently is. skb->data shall point to the start of the
374 * payload.
375 */
376 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
377
378 /*
379 * This is the actual input entry point.
380 *
381 * For transport mode and equivalent this would be identical to
382 * input2 (which does not need to be set). While tunnel mode
383 * and equivalent would set this to the tunnel encapsulation function
384 * xfrm4_prepare_input that would in turn call input2.
385 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700386 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700387
388 /*
389 * Add encapsulation header.
390 *
391 * On exit, the transport header will be set to the start of the
392 * encapsulation header to be filled in by x->type->output and
393 * the mac header will be set to the nextheader (protocol for
394 * IPv4) field of the extension header directly preceding the
395 * encapsulation header, or in its absence, that of the top IP
396 * header. The value of the network header will always point
397 * to the top IP header while skb->data will point to the payload.
398 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800399 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
400
401 /*
402 * This is the actual output entry point.
403 *
404 * For transport mode and equivalent this would be identical to
405 * output2 (which does not need to be set). While tunnel mode
406 * and equivalent would set this to a tunnel encapsulation function
407 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
408 * call output2.
409 */
410 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700411
Herbert Xu17c2a422007-10-17 21:33:12 -0700412 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700413 struct module *owner;
414 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700415 int flags;
416};
417
418/* Flags for xfrm_mode. */
419enum {
420 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700421};
422
423extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
424extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700425
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700426static inline int xfrm_af2proto(unsigned int family)
427{
428 switch(family) {
429 case AF_INET:
430 return IPPROTO_IPIP;
431 case AF_INET6:
432 return IPPROTO_IPV6;
433 default:
434 return 0;
435 }
436}
437
438static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
439{
440 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
441 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
442 return x->inner_mode;
443 else
444 return x->inner_mode_iaf;
445}
446
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000447struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700448/* id in template is interpreted as:
449 * daddr - destination of tunnel, may be zero for transport mode.
450 * spi - zero to acquire spi. Not zero if spi is static, then
451 * daddr must be fixed too.
452 * proto - AH/ESP/IPCOMP
453 */
454 struct xfrm_id id;
455
456/* Source address of tunnel. Ignored, if it is not a tunnel. */
457 xfrm_address_t saddr;
458
Miika Komu76b3f052006-11-30 16:40:43 -0800459 unsigned short encap_family;
460
jamala6337462010-02-09 13:21:17 +0000461 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700462
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700463/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000464 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700465
466/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000467 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700468
469/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000470 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700471
Herbert Xuc5d18e92008-04-22 00:46:42 -0700472/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000473 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700474
Linus Torvalds1da177e2005-04-16 15:20:36 -0700475/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000476 u32 aalgos;
477 u32 ealgos;
478 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479};
480
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700481#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700482
Herbert Xu12a169e2008-10-01 07:03:24 -0700483struct xfrm_policy_walk_entry {
484 struct list_head all;
485 u8 dead;
486};
487
488struct xfrm_policy_walk {
489 struct xfrm_policy_walk_entry walk;
490 u8 type;
491 u32 seq;
492};
493
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000494struct xfrm_policy {
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800495#ifdef CONFIG_NET_NS
496 struct net *xp_net;
497#endif
David S. Miller2518c7c2006-08-24 04:45:07 -0700498 struct hlist_node bydst;
499 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700500
501 /* This lock only affects elements except for entry. */
502 rwlock_t lock;
503 atomic_t refcnt;
504 struct timer_list timer;
505
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000506 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000507 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700508 u32 priority;
509 u32 index;
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +0000510 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700511 struct xfrm_selector selector;
512 struct xfrm_lifetime_cfg lft;
513 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700514 struct xfrm_policy_walk_entry walk;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200515 u8 type;
516 u8 action;
517 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200518 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700519 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800520 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
522};
523
David S. Miller63eb23f2011-02-24 01:25:19 -0500524static inline struct net *xp_net(const struct xfrm_policy *xp)
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800525{
526 return read_pnet(&xp->xp_net);
527}
528
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700529struct xfrm_kmaddress {
530 xfrm_address_t local;
531 xfrm_address_t remote;
532 u32 reserved;
533 u16 family;
534};
535
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800536struct xfrm_migrate {
537 xfrm_address_t old_daddr;
538 xfrm_address_t old_saddr;
539 xfrm_address_t new_daddr;
540 xfrm_address_t new_saddr;
541 u8 proto;
542 u8 mode;
543 u16 reserved;
544 u32 reqid;
545 u16 old_family;
546 u16 new_family;
547};
548
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800549#define XFRM_KM_TIMEOUT 30
550/* which seqno */
551#define XFRM_REPLAY_SEQ 1
552#define XFRM_REPLAY_OSEQ 2
553#define XFRM_REPLAY_SEQ_MASK 3
554/* what happened */
555#define XFRM_REPLAY_UPDATE XFRM_AE_CR
556#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
557
558/* default aevent timeout in units of 100ms */
559#define XFRM_AE_ETIME 10
560/* Async Event timer multiplier */
561#define XFRM_AE_ETH_M 10
562/* default seq threshold size */
563#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000565struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 struct list_head list;
567 char *id;
David S. Miller214e0052011-02-24 00:02:38 -0500568 int (*notify)(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700569 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700570 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800571 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
David S. Miller214e0052011-02-24 00:02:38 -0500572 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800573 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
David S. Miller183cad12011-02-24 00:28:01 -0500574 int (*migrate)(const struct xfrm_selector *sel,
575 u8 dir, u8 type,
576 const struct xfrm_migrate *m,
577 int num_bundles,
578 const struct xfrm_kmaddress *k);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579};
580
581extern int xfrm_register_km(struct xfrm_mgr *km);
582extern int xfrm_unregister_km(struct xfrm_mgr *km);
583
Herbert Xu436a0a42007-10-08 17:25:53 -0700584/*
585 * This structure is used for the duration where packets are being
586 * transformed by IPsec. As soon as the packet leaves IPsec the
587 * area beyond the generic IP part may be overwritten.
588 */
589struct xfrm_skb_cb {
590 union {
591 struct inet_skb_parm h4;
592 struct inet6_skb_parm h6;
593 } header;
594
595 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800596 union {
Steffen Klassert1ce36442011-03-08 00:06:31 +0000597 struct {
598 __u32 low;
599 __u32 hi;
600 } output;
601 struct {
602 __be32 low;
603 __be32 hi;
604 } input;
Herbert Xub318e0e2008-02-12 22:50:35 -0800605 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700606};
607
608#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
609
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800610/*
611 * This structure is used by the afinfo prepare_input/prepare_output functions
612 * to transmit header information to the mode input/output functions.
613 */
614struct xfrm_mode_skb_cb {
615 union {
616 struct inet_skb_parm h4;
617 struct inet6_skb_parm h6;
618 } header;
619
620 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
621 __be16 id;
622 __be16 frag_off;
623
Herbert Xu732c8bd2008-03-26 16:51:09 -0700624 /* IP header length (excluding options or extension headers). */
625 u8 ihl;
626
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800627 /* TOS for IPv4, class for IPv6. */
628 u8 tos;
629
630 /* TTL for IPv4, hop limitfor IPv6. */
631 u8 ttl;
632
633 /* Protocol for IPv4, NH for IPv6. */
634 u8 protocol;
635
Herbert Xu732c8bd2008-03-26 16:51:09 -0700636 /* Option length for IPv4, zero for IPv6. */
637 u8 optlen;
638
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800639 /* Used by IPv6 only, zero for IPv4. */
640 u8 flow_lbl[3];
641};
642
643#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
644
Herbert Xu716062f2007-11-13 21:44:23 -0800645/*
646 * This structure is used by the input processing to locate the SPI and
647 * related information.
648 */
649struct xfrm_spi_skb_cb {
650 union {
651 struct inet_skb_parm h4;
652 struct inet6_skb_parm h6;
653 } header;
654
Herbert Xu716062f2007-11-13 21:44:23 -0800655 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800656 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800657};
658
659#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
660
Joy Latten161a09e2006-11-27 13:11:54 -0600661/* Audit Information */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000662struct xfrm_audit {
Joy Latten161a09e2006-11-27 13:11:54 -0600663 u32 secid;
Eric Paris25323862008-04-18 10:09:25 -0400664 uid_t loginuid;
665 u32 sessionid;
Joy Latten161a09e2006-11-27 13:11:54 -0600666};
Joy Lattenc9204d92006-11-30 15:50:43 -0600667
668#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800669static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700670{
671 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800672
673 if (audit_enabled == 0)
674 return NULL;
675 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
676 AUDIT_MAC_IPSEC_EVENT);
677 if (audit_buf == NULL)
678 return NULL;
679 audit_log_format(audit_buf, "op=%s", op);
680 return audit_buf;
681}
682
Eric Paris25323862008-04-18 10:09:25 -0400683static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800684 struct audit_buffer *audit_buf)
685{
Joy Lattenab5f5e82007-09-17 11:51:22 -0700686 char *secctx;
687 u32 secctx_len;
688
Eric Paris25323862008-04-18 10:09:25 -0400689 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Paul Moore68277ac2007-12-20 20:49:33 -0800690 if (secid != 0 &&
691 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
Joy Lattenab5f5e82007-09-17 11:51:22 -0700692 audit_log_format(audit_buf, " subj=%s", secctx);
693 security_release_secctx(secctx, secctx_len);
694 } else
695 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700696}
697
698extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400699 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700700extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400701 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700702extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400703 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700704extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400705 u32 auid, u32 ses, u32 secid);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800706extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
707 struct sk_buff *skb);
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000708extern void xfrm_audit_state_replay(struct xfrm_state *x,
709 struct sk_buff *skb, __be32 net_seq);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800710extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
711extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
712 __be32 net_spi, __be32 net_seq);
713extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
714 struct sk_buff *skb, u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600715#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700716
717static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
718 u32 auid, u32 ses, u32 secid)
719{
720}
721
722static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
723 u32 auid, u32 ses, u32 secid)
724{
725}
726
727static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
728 u32 auid, u32 ses, u32 secid)
729{
730}
731
732static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
733 u32 auid, u32 ses, u32 secid)
734{
735}
736
737static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
738 struct sk_buff *skb)
739{
740}
741
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000742static inline void xfrm_audit_state_replay(struct xfrm_state *x,
743 struct sk_buff *skb, __be32 net_seq)
744{
745}
746
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700747static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
748 u16 family)
749{
750}
751
752static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
753 __be32 net_spi, __be32 net_seq)
754{
755}
756
757static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
758 struct sk_buff *skb, u8 proto)
759{
760}
Joy Lattenc9204d92006-11-30 15:50:43 -0600761#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600762
Linus Torvalds1da177e2005-04-16 15:20:36 -0700763static inline void xfrm_pol_hold(struct xfrm_policy *policy)
764{
765 if (likely(policy != NULL))
766 atomic_inc(&policy->refcnt);
767}
768
WANG Cong64c31b32008-01-07 22:34:29 -0800769extern void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700770
771static inline void xfrm_pol_put(struct xfrm_policy *policy)
772{
773 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800774 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700775}
776
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700777static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
778{
779 int i;
780 for (i = npols - 1; i >= 0; --i)
781 xfrm_pol_put(pols[i]);
782}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700783
Linus Torvalds1da177e2005-04-16 15:20:36 -0700784extern void __xfrm_state_destroy(struct xfrm_state *);
785
Herbert Xu21380b82006-02-22 14:47:13 -0800786static inline void __xfrm_state_put(struct xfrm_state *x)
787{
788 atomic_dec(&x->refcnt);
789}
790
Linus Torvalds1da177e2005-04-16 15:20:36 -0700791static inline void xfrm_state_put(struct xfrm_state *x)
792{
793 if (atomic_dec_and_test(&x->refcnt))
794 __xfrm_state_destroy(x);
795}
796
797static inline void xfrm_state_hold(struct xfrm_state *x)
798{
799 atomic_inc(&x->refcnt);
800}
801
David S. Miller1744a8f2011-02-22 18:02:12 -0800802static inline bool addr_match(const void *token1, const void *token2,
803 int prefixlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804{
David S. Miller1744a8f2011-02-22 18:02:12 -0800805 const __be32 *a1 = token1;
806 const __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700807 int pdw;
808 int pbi;
809
jamala6337462010-02-09 13:21:17 +0000810 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700811 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
812
813 if (pdw)
814 if (memcmp(a1, a2, pdw << 2))
David S. Miller1744a8f2011-02-22 18:02:12 -0800815 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700816
817 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700818 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700819
820 mask = htonl((0xffffffff) << (32 - pbi));
821
822 if ((a1[pdw] ^ a2[pdw]) & mask)
David S. Miller1744a8f2011-02-22 18:02:12 -0800823 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824 }
825
David S. Miller1744a8f2011-02-22 18:02:12 -0800826 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700827}
828
829static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500830__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700831{
Al Virof9d07e41f82006-09-27 18:45:50 -0700832 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500833 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700834 case IPPROTO_TCP:
835 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800836 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700837 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500838 port = uli->ports.sport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700839 break;
840 case IPPROTO_ICMP:
841 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500842 port = htons(uli->icmpt.type);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700844 case IPPROTO_MH:
David S. Miller6281dcc2011-03-12 00:43:55 -0500845 port = htons(uli->mht.type);
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700846 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000847 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500848 port = htons(ntohl(uli->gre_key) >> 16);
Timo Teräscc9ff192010-11-03 04:41:38 +0000849 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700850 default:
851 port = 0; /*XXX*/
852 }
853 return port;
854}
855
856static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500857__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858{
Al Virof9d07e41f82006-09-27 18:45:50 -0700859 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500860 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700861 case IPPROTO_TCP:
862 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800863 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700864 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500865 port = uli->ports.dport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700866 break;
867 case IPPROTO_ICMP:
868 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500869 port = htons(uli->icmpt.code);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700870 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000871 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500872 port = htons(ntohl(uli->gre_key) & 0xffff);
Timo Teräscc9ff192010-11-03 04:41:38 +0000873 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700874 default:
875 port = 0; /*XXX*/
876 }
877 return port;
878}
879
David S. Miller200ce962011-02-24 00:12:25 -0500880extern int xfrm_selector_match(const struct xfrm_selector *sel,
David S. Millere1ad2ab2011-02-22 18:07:39 -0800881 const struct flowi *fl,
Andrew Morton77681022006-11-08 22:46:26 -0800882 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700883
Trent Jaegerdf718372005-12-13 23:12:27 -0800884#ifdef CONFIG_SECURITY_NETWORK_XFRM
885/* If neither has a context --> match
886 * Otherwise, both must have a context and the sids, doi, alg must match
887 */
888static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
889{
890 return ((!s1 && !s2) ||
891 (s1 && s2 &&
892 (s1->ctx_sid == s2->ctx_sid) &&
893 (s1->ctx_doi == s2->ctx_doi) &&
894 (s1->ctx_alg == s2->ctx_alg)));
895}
896#else
897static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
898{
899 return 1;
900}
901#endif
902
Linus Torvalds1da177e2005-04-16 15:20:36 -0700903/* A struct encoding bundle of transformations to apply to some set of flow.
904 *
905 * dst->child points to the next element of bundle.
906 * dst->xfrm points to an instanse of transformer.
907 *
908 * Due to unfortunate limitations of current routing cache, which we
909 * have no time to fix, it mirrors struct rtable and bound to the same
910 * routing key, including saddr,daddr. However, we can have many of
911 * bundles differing by session id. All the bundles grow from a parent
912 * policy rule.
913 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000914struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700915 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700916 struct dst_entry dst;
917 struct rtable rt;
918 struct rt6_info rt6;
919 } u;
920 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000921 struct flow_cache_object flo;
922 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
923 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700924#ifdef CONFIG_XFRM_SUB_POLICY
925 struct flowi *origin;
926 struct xfrm_selector *partner;
927#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000928 u32 xfrm_genid;
929 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700930 u32 route_mtu_cached;
931 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700932 u32 route_cookie;
933 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700934};
935
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700936#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700937static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
938{
Timo Teräs80c802f2010-04-07 00:30:05 +0000939 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700940 dst_release(xdst->route);
941 if (likely(xdst->u.dst.xfrm))
942 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700943#ifdef CONFIG_XFRM_SUB_POLICY
944 kfree(xdst->origin);
945 xdst->origin = NULL;
946 kfree(xdst->partner);
947 xdst->partner = NULL;
948#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700949}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700950#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700951
952extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
953
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000954struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700955 atomic_t refcnt;
956 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800957 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700958};
959
960static inline struct sec_path *
961secpath_get(struct sec_path *sp)
962{
963 if (sp)
964 atomic_inc(&sp->refcnt);
965 return sp;
966}
967
968extern void __secpath_destroy(struct sec_path *sp);
969
970static inline void
971secpath_put(struct sec_path *sp)
972{
973 if (sp && atomic_dec_and_test(&sp->refcnt))
974 __secpath_destroy(sp);
975}
976
977extern struct sec_path *secpath_dup(struct sec_path *src);
978
979static inline void
980secpath_reset(struct sk_buff *skb)
981{
982#ifdef CONFIG_XFRM
983 secpath_put(skb->sp);
984 skb->sp = NULL;
985#endif
986}
987
988static inline int
David S. Miller6cc32962011-02-24 00:19:59 -0500989xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700990{
991 switch (family) {
992 case AF_INET:
993 return addr->a4 == 0;
994 case AF_INET6:
995 return ipv6_addr_any((struct in6_addr *)&addr->a6);
996 }
997 return 0;
998}
999
1000static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001001__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001002{
1003 return (tmpl->saddr.a4 &&
1004 tmpl->saddr.a4 != x->props.saddr.a4);
1005}
1006
1007static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001008__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001009{
1010 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1011 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1012}
1013
1014static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001015xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001016{
1017 switch (family) {
1018 case AF_INET:
1019 return __xfrm4_state_addr_cmp(tmpl, x);
1020 case AF_INET6:
1021 return __xfrm6_state_addr_cmp(tmpl, x);
1022 }
1023 return !0;
1024}
1025
1026#ifdef CONFIG_XFRM
Linus Torvalds1da177e2005-04-16 15:20:36 -07001027extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
1028
Herbert Xud5422ef2007-12-12 10:44:16 -08001029static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1030 struct sk_buff *skb,
1031 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001032{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001033 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -08001034 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1035
Linus Torvalds1da177e2005-04-16 15:20:36 -07001036 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -08001037 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001038
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001039 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001040 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -08001041 __xfrm_policy_check(sk, ndir, skb, family);
1042}
1043
1044static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1045{
1046 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001047}
1048
1049static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1050{
1051 return xfrm_policy_check(sk, dir, skb, AF_INET);
1052}
1053
1054static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1055{
1056 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1057}
1058
Herbert Xud5422ef2007-12-12 10:44:16 -08001059static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1060 struct sk_buff *skb)
1061{
1062 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1063}
1064
1065static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1066 struct sk_buff *skb)
1067{
1068 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1069}
1070
1071extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1072 unsigned int family, int reverse);
1073
1074static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1075 unsigned int family)
1076{
1077 return __xfrm_decode_session(skb, fl, family, 0);
1078}
1079
1080static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1081 struct flowi *fl,
1082 unsigned int family)
1083{
1084 return __xfrm_decode_session(skb, fl, family, 1);
1085}
1086
Linus Torvalds1da177e2005-04-16 15:20:36 -07001087extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1088
1089static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1090{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001091 struct net *net = dev_net(skb->dev);
1092
1093 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001094 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001095 __xfrm_route_forward(skb, family);
1096}
1097
1098static inline int xfrm4_route_forward(struct sk_buff *skb)
1099{
1100 return xfrm_route_forward(skb, AF_INET);
1101}
1102
1103static inline int xfrm6_route_forward(struct sk_buff *skb)
1104{
1105 return xfrm_route_forward(skb, AF_INET6);
1106}
1107
1108extern int __xfrm_sk_clone_policy(struct sock *sk);
1109
1110static inline int xfrm_sk_clone_policy(struct sock *sk)
1111{
1112 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1113 return __xfrm_sk_clone_policy(sk);
1114 return 0;
1115}
1116
Herbert Xu4666faa2005-06-18 22:43:22 -07001117extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001118
1119static inline void xfrm_sk_free_policy(struct sock *sk)
1120{
1121 if (unlikely(sk->sk_policy[0] != NULL)) {
1122 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1123 sk->sk_policy[0] = NULL;
1124 }
1125 if (unlikely(sk->sk_policy[1] != NULL)) {
1126 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1127 sk->sk_policy[1] = NULL;
1128 }
1129}
1130
1131#else
1132
1133static inline void xfrm_sk_free_policy(struct sock *sk) {}
1134static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1135static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1136static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1137static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1138{
1139 return 1;
1140}
1141static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1142{
1143 return 1;
1144}
1145static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1146{
1147 return 1;
1148}
Herbert Xud5422ef2007-12-12 10:44:16 -08001149static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1150 struct flowi *fl,
1151 unsigned int family)
1152{
1153 return -ENOSYS;
1154}
1155static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1156 struct sk_buff *skb)
1157{
1158 return 1;
1159}
1160static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1161 struct sk_buff *skb)
1162{
1163 return 1;
1164}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001165#endif
1166
1167static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001168xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001169{
1170 switch (family){
1171 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001172 return (xfrm_address_t *)&fl->u.ip4.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001173 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001174 return (xfrm_address_t *)&fl->u.ip6.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001175 }
1176 return NULL;
1177}
1178
1179static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001180xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001181{
1182 switch (family){
1183 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001184 return (xfrm_address_t *)&fl->u.ip4.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001185 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001186 return (xfrm_address_t *)&fl->u.ip6.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001187 }
1188 return NULL;
1189}
1190
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001191static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001192void xfrm_flowi_addr_get(const struct flowi *fl,
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001193 xfrm_address_t *saddr, xfrm_address_t *daddr,
1194 unsigned short family)
1195{
1196 switch(family) {
1197 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001198 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1199 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001200 break;
1201 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001202 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->u.ip6.saddr);
1203 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->u.ip6.daddr);
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001204 break;
1205 }
1206}
1207
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001209__xfrm4_state_addr_check(const struct xfrm_state *x,
1210 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001211{
1212 if (daddr->a4 == x->id.daddr.a4 &&
1213 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1214 return 1;
1215 return 0;
1216}
1217
1218static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001219__xfrm6_state_addr_check(const struct xfrm_state *x,
1220 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001221{
1222 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1223 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1224 ipv6_addr_any((struct in6_addr *)saddr) ||
1225 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1226 return 1;
1227 return 0;
1228}
1229
1230static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001231xfrm_state_addr_check(const struct xfrm_state *x,
1232 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001233 unsigned short family)
1234{
1235 switch (family) {
1236 case AF_INET:
1237 return __xfrm4_state_addr_check(x, daddr, saddr);
1238 case AF_INET6:
1239 return __xfrm6_state_addr_check(x, daddr, saddr);
1240 }
1241 return 0;
1242}
1243
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001244static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001245xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001246 unsigned short family)
1247{
1248 switch (family) {
1249 case AF_INET:
1250 return __xfrm4_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001251 (const xfrm_address_t *)&fl->u.ip4.daddr,
1252 (const xfrm_address_t *)&fl->u.ip4.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001253 case AF_INET6:
1254 return __xfrm6_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001255 (const xfrm_address_t *)&fl->u.ip6.daddr,
1256 (const xfrm_address_t *)&fl->u.ip6.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001257 }
1258 return 0;
1259}
1260
David S. Millerf8848062011-02-24 01:42:28 -05001261static inline int xfrm_state_kern(const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001262{
1263 return atomic_read(&x->tunnel_users);
1264}
1265
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001266static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1267{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001268 return (!userproto || proto == userproto ||
1269 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1270 proto == IPPROTO_ESP ||
1271 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001272}
1273
Linus Torvalds1da177e2005-04-16 15:20:36 -07001274/*
1275 * xfrm algorithm information
1276 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001277struct xfrm_algo_aead_info {
1278 u16 icv_truncbits;
1279};
1280
Linus Torvalds1da177e2005-04-16 15:20:36 -07001281struct xfrm_algo_auth_info {
1282 u16 icv_truncbits;
1283 u16 icv_fullbits;
1284};
1285
1286struct xfrm_algo_encr_info {
1287 u16 blockbits;
1288 u16 defkeybits;
1289};
1290
1291struct xfrm_algo_comp_info {
1292 u16 threshold;
1293};
1294
1295struct xfrm_algo_desc {
1296 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001297 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001298 u8 available:1;
1299 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001300 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001301 struct xfrm_algo_auth_info auth;
1302 struct xfrm_algo_encr_info encr;
1303 struct xfrm_algo_comp_info comp;
1304 } uinfo;
1305 struct sadb_alg desc;
1306};
1307
1308/* XFRM tunnel handlers. */
1309struct xfrm_tunnel {
1310 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001311 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001312
Eric Dumazetb33eab02010-10-25 21:01:26 +00001313 struct xfrm_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001314 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001315};
1316
1317struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001318 int (*handler)(struct sk_buff *skb);
1319 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001320 u8 type, u8 code, int offset, __be32 info);
Eric Dumazet6f0bcf12010-10-24 21:33:16 +00001321 struct xfrm6_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001322 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001323};
1324
1325extern void xfrm_init(void);
Neil Hormana33bc5c2009-07-30 18:52:15 -07001326extern void xfrm4_init(int rt_hash_size);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08001327extern int xfrm_state_init(struct net *net);
1328extern void xfrm_state_fini(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329extern void xfrm4_state_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001330#ifdef CONFIG_XFRM
1331extern int xfrm6_init(void);
1332extern void xfrm6_fini(void);
Daniel Lezcano0013cab2007-12-07 00:42:11 -08001333extern int xfrm6_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001334extern void xfrm6_state_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001335#else
1336static inline int xfrm6_init(void)
1337{
1338 return 0;
1339}
1340static inline void xfrm6_fini(void)
1341{
1342 ;
1343}
1344#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001345
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001346#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyanc68cd1a2008-11-25 18:00:14 -08001347extern int xfrm_proc_init(struct net *net);
1348extern void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001349#endif
1350
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001351extern int xfrm_sysctl_init(struct net *net);
1352#ifdef CONFIG_SYSCTL
1353extern void xfrm_sysctl_fini(struct net *net);
1354#else
1355static inline void xfrm_sysctl_fini(struct net *net)
1356{
1357}
1358#endif
1359
Herbert Xu5c182452008-09-22 19:48:19 -07001360extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001361extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001362 int (*func)(struct xfrm_state *, int, void*), void *);
Herbert Xuabb81c42008-09-09 19:58:29 -07001363extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
Alexey Dobriyan673c09b2008-11-25 17:15:16 -08001364extern struct xfrm_state *xfrm_state_alloc(struct net *net);
David S. Miller33765d02011-02-24 01:55:45 -05001365extern struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1366 const xfrm_address_t *saddr,
David S. Millerb520e9f2011-02-22 18:24:19 -08001367 const struct flowi *fl,
1368 struct xfrm_tmpl *tmpl,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001369 struct xfrm_policy *pol, int *err,
1370 unsigned short family);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001371extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001372 xfrm_address_t *daddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -07001373 xfrm_address_t *saddr,
1374 unsigned short family,
1375 u8 mode, u8 proto, u32 reqid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001376extern int xfrm_state_check_expire(struct xfrm_state *x);
1377extern void xfrm_state_insert(struct xfrm_state *x);
1378extern int xfrm_state_add(struct xfrm_state *x);
1379extern int xfrm_state_update(struct xfrm_state *x);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001380extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
David S. Millera70486f2011-02-27 23:17:24 -08001381 const xfrm_address_t *daddr, __be32 spi,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001382 u8 proto, unsigned short family);
1383extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
David S. Millera70486f2011-02-27 23:17:24 -08001384 const xfrm_address_t *daddr,
1385 const xfrm_address_t *saddr,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001386 u8 proto,
1387 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001388#ifdef CONFIG_XFRM_SUB_POLICY
1389extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1390 int n, unsigned short family);
1391extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1392 int n, unsigned short family);
1393#else
1394static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1395 int n, unsigned short family)
1396{
1397 return -ENOSYS;
1398}
1399
1400static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1401 int n, unsigned short family)
1402{
1403 return -ENOSYS;
1404}
1405#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001406
1407struct xfrmk_sadinfo {
1408 u32 sadhcnt; /* current hash bkts */
1409 u32 sadhmcnt; /* max allowed hash bkts */
1410 u32 sadcnt; /* current running count */
1411};
1412
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001413struct xfrmk_spdinfo {
1414 u32 incnt;
1415 u32 outcnt;
1416 u32 fwdcnt;
1417 u32 inscnt;
1418 u32 outscnt;
1419 u32 fwdscnt;
1420 u32 spdhcnt;
1421 u32 spdhmcnt;
1422};
1423
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001424extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1425 u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001426extern int xfrm_state_delete(struct xfrm_state *x);
Alexey Dobriyan0e602452008-11-25 17:30:18 -08001427extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
Alexey Dobriyane0710412010-01-23 13:37:10 +00001428extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1429extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
Steffen Klassert2cd08462011-03-08 00:09:51 +00001430extern u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
Steffen Klassert9fdc4882011-03-08 00:08:32 +00001431extern int xfrm_init_replay(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001432extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Wei Yongjuna454f0c2011-03-21 18:08:28 -07001433extern int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
Herbert Xu72cb6962005-06-20 13:18:08 -07001434extern int xfrm_init_state(struct xfrm_state *x);
Herbert Xu227620e2007-11-13 21:41:28 -08001435extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -08001436extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1437 int encap_type);
Herbert Xu1bf06cd2007-11-19 18:50:17 -08001438extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
Herbert Xuc6581a42007-11-13 21:43:43 -08001439extern int xfrm_output_resume(struct sk_buff *skb, int err);
Herbert Xu406ef772007-10-08 17:16:30 -07001440extern int xfrm_output(struct sk_buff *skb);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001441extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001442extern int xfrm4_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001443extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001444extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1445 int encap_type);
Herbert Xu716062f2007-11-13 21:44:23 -08001446extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001447extern int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001448
1449static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1450{
1451 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1452}
1453
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001454extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1455extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456extern int xfrm4_output(struct sk_buff *skb);
Kazunori MIYAZAWAc0d56402007-02-13 12:54:47 -08001457extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1458extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001459extern int xfrm6_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001460extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu33b5ecb2007-10-17 21:29:25 -07001461extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
Herbert Xu716062f2007-11-13 21:44:23 -08001462extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
Herbert Xue5bbef22007-10-15 12:50:28 -07001463extern int xfrm6_rcv(struct sk_buff *skb);
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -07001464extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1465 xfrm_address_t *saddr, u8 proto);
Kazunori MIYAZAWA73d605d2007-02-13 12:55:55 -08001466extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1467extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001468extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
Alexey Dobriyana1664772010-01-25 10:37:54 +00001469extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001470extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1471extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472extern int xfrm6_output(struct sk_buff *skb);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -07001473extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1474 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001475
1476#ifdef CONFIG_XFRM
James Chapman067b2072007-07-05 17:08:05 -07001477extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001479#else
1480static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1481{
1482 return -ENOPROTOOPT;
1483}
1484
James Chapman067b2072007-07-05 17:08:05 -07001485static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001486{
1487 /* should not happen */
1488 kfree_skb(skb);
1489 return 0;
1490}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491#endif
1492
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001493struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001494
Herbert Xu12a169e2008-10-01 07:03:24 -07001495extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
Alexey Dobriyancdcbca72008-11-25 17:34:49 -08001496extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001497 int (*func)(struct xfrm_policy *, int, int, void*), void *);
Herbert Xu12a169e2008-10-01 07:03:24 -07001498extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001499int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001500struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1501 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001502 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001503 struct xfrm_sec_ctx *ctx, int delete,
1504 int *err);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001505struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
Alexey Dobriyan33ffbbd2008-11-25 17:33:32 -08001506int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001507u32 xfrm_get_acqseq(void);
Herbert Xu658b2192007-10-09 13:29:52 -07001508extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001509struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1510 u8 mode, u32 reqid, u8 proto,
David S. Millera70486f2011-02-27 23:17:24 -08001511 const xfrm_address_t *daddr,
1512 const xfrm_address_t *saddr, int create,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001513 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001516#ifdef CONFIG_XFRM_MIGRATE
David S. Miller183cad12011-02-24 00:28:01 -05001517extern int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1518 const struct xfrm_migrate *m, int num_bundles,
1519 const struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001520extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1521extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1522 struct xfrm_migrate *m);
David S. Millerb4b7c0b2011-02-24 00:35:06 -05001523extern int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001524 struct xfrm_migrate *m, int num_bundles,
1525 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001526#endif
1527
Al Viro5d36b182006-11-08 00:24:06 -08001528extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -08001529extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001530extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001531
1532extern void xfrm_input_init(void);
Al Viro6067b2b2006-09-27 18:47:59 -07001533extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534
1535extern void xfrm_probe_algs(void);
1536extern int xfrm_count_auth_supported(void);
1537extern int xfrm_count_enc_supported(void);
1538extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1539extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1540extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1541extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1542extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
David S. Miller6f2f19e2011-02-27 23:04:45 -08001543extern struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1544extern struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1545extern struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1546extern struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
Herbert Xu1a6509d2008-01-28 19:37:29 -08001547 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001548
Herbert Xu07d4ee52006-08-20 14:24:50 +10001549struct hash_desc;
Herbert Xu9409f382006-08-06 19:49:12 +10001550struct scatterlist;
Herbert Xu07d4ee52006-08-20 14:24:50 +10001551typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1552 unsigned int);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001553
David S. Millerff6acd12011-02-24 00:19:13 -05001554static inline int xfrm_addr_cmp(const xfrm_address_t *a,
1555 const xfrm_address_t *b,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 int family)
1557{
1558 switch (family) {
1559 default:
1560 case AF_INET:
jamala6337462010-02-09 13:21:17 +00001561 return (__force u32)a->a4 - (__force u32)b->a4;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001562 case AF_INET6:
1563 return ipv6_addr_cmp((struct in6_addr *)a,
1564 (struct in6_addr *)b);
1565 }
1566}
1567
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001568static inline int xfrm_policy_id2dir(u32 index)
1569{
1570 return index & 7;
1571}
1572
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001573#ifdef CONFIG_XFRM
1574static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001575{
Patrick McHardybe336902006-03-20 22:40:54 -08001576 struct sock *nlsk;
1577 int ret = 0;
1578
1579 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001580 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001581 if (nlsk)
1582 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1583 rcu_read_unlock();
1584 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001585}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001586#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001587
David S. Miller85158622011-02-27 23:07:02 -08001588static inline int xfrm_alg_len(const struct xfrm_algo *alg)
Eric Dumazet0f99be02008-01-08 23:39:06 -08001589{
1590 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1591}
1592
David S. Miller85158622011-02-27 23:07:02 -08001593static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
Martin Willi4447bb32009-11-25 00:29:52 +00001594{
1595 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1596}
1597
Steffen Klassert9736acf2011-03-08 00:05:43 +00001598static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1599{
1600 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1601}
1602
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001603#ifdef CONFIG_XFRM_MIGRATE
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001604static inline int xfrm_replay_clone(struct xfrm_state *x,
1605 struct xfrm_state *orig)
1606{
1607 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1608 GFP_KERNEL);
1609 if (!x->replay_esn)
1610 return -ENOMEM;
1611
1612 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1613 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1614
1615 x->preplay_esn = kmemdup(x->replay_esn,
1616 xfrm_replay_state_esn_len(x->replay_esn),
1617 GFP_KERNEL);
1618 if (!x->preplay_esn) {
1619 kfree(x->replay_esn);
1620 return -ENOMEM;
1621 }
1622
1623 return 0;
1624}
1625
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001626static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1627{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001628 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001629}
1630
Martin Willi4447bb32009-11-25 00:29:52 +00001631static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1632{
1633 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1634}
1635
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001636static inline void xfrm_states_put(struct xfrm_state **states, int n)
1637{
1638 int i;
1639 for (i = 0; i < n; i++)
1640 xfrm_state_put(*(states + i));
1641}
1642
1643static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1644{
1645 int i;
1646 for (i = 0; i < n; i++)
1647 xfrm_state_delete(*(states + i));
1648}
1649#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001650
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001651#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001652static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1653{
1654 return skb->sp->xvec[skb->sp->len - 1];
1655}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001656#endif
Herbert Xu00501122007-12-11 01:53:43 -08001657
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001658static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1659{
1660 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001661 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001662 else
1663 m->v = m->m = 0;
1664
1665 return m->v & m->m;
1666}
1667
David S. Millere3dfa382011-02-27 23:20:19 -08001668static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
Jamal Hadi Salimbf825f82010-02-22 11:32:54 +00001669{
1670 if (m->m | m->v)
1671 NLA_PUT(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1672 return 0;
1673
1674nla_put_failure:
1675 return -1;
1676}
1677
Linus Torvalds1da177e2005-04-16 15:20:36 -07001678#endif /* _NET_XFRM_H */