blob: 61b7504fc2ba64f31ae9fbac1e2e78604f68467e [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02005#include <linux/in.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07006#include <linux/xfrm.h>
7#include <linux/spinlock.h>
8#include <linux/list.h>
9#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020010#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070011#include <linux/crypto.h>
12#include <linux/pfkeyv2.h>
13#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080014#include <linux/mutex.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015
16#include <net/sock.h>
17#include <net/dst.h>
18#include <net/route.h>
19#include <net/ipv6.h>
20#include <net/ip6_fib.h>
21
22#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
23
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -080024extern struct sock *xfrm_nl;
25extern u32 sysctl_xfrm_aevent_etime;
26extern u32 sysctl_xfrm_aevent_rseqth;
27
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080028extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070029
30/* Organization of SPD aka "XFRM rules"
31 ------------------------------------
32
33 Basic objects:
34 - policy rule, struct xfrm_policy (=SPD entry)
35 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
36 - instance of a transformer, struct xfrm_state (=SA)
37 - template to clone xfrm_state, struct xfrm_tmpl
38
39 SPD is plain linear list of xfrm_policy rules, ordered by priority.
40 (To be compatible with existing pfkeyv2 implementations,
41 many rules with priority of 0x7fffffff are allowed to exist and
42 such rules are ordered in an unpredictable way, thanks to bsd folks.)
43
44 Lookup is plain linear search until the first match with selector.
45
46 If "action" is "block", then we prohibit the flow, otherwise:
47 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
48 policy entry has list of up to XFRM_MAX_DEPTH transformations,
49 described by templates xfrm_tmpl. Each template is resolved
50 to a complete xfrm_state (see below) and we pack bundle of transformations
51 to a dst_entry returned to requestor.
52
53 dst -. xfrm .-> xfrm_state #1
54 |---. child .-> dst -. xfrm .-> xfrm_state #2
55 |---. child .-> dst -. xfrm .-> xfrm_state #3
56 |---. child .-> NULL
57
58 Bundles are cached at xrfm_policy struct (field ->bundles).
59
60
61 Resolution of xrfm_tmpl
62 -----------------------
63 Template contains:
64 1. ->mode Mode: transport or tunnel
65 2. ->id.proto Protocol: AH/ESP/IPCOMP
66 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
67 Q: allow to resolve security gateway?
68 4. ->id.spi If not zero, static SPI.
69 5. ->saddr Local tunnel endpoint, ignored for transport mode.
70 6. ->algos List of allowed algos. Plain bitmask now.
71 Q: ealgos, aalgos, calgos. What a mess...
72 7. ->share Sharing mode.
73 Q: how to implement private sharing mode? To add struct sock* to
74 flow id?
75
76 Having this template we search through SAD searching for entries
77 with appropriate mode/proto/algo, permitted by selector.
78 If no appropriate entry found, it is requested from key manager.
79
80 PROBLEMS:
81 Q: How to find all the bundles referring to a physical path for
82 PMTU discovery? Seems, dst should contain list of all parents...
83 and enter to infinite locking hierarchy disaster.
84 No! It is easier, we will not search for them, let them find us.
85 We add genid to each dst plus pointer to genid of raw IP route,
86 pmtu disc will update pmtu on raw IP route and increase its genid.
87 dst_check() will see this for top level and trigger resyncing
88 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
89 */
90
91/* Full description of state of transformer. */
92struct xfrm_state
93{
94 /* Note: bydst is re-used during gc */
95 struct list_head bydst;
96 struct list_head byspi;
97
98 atomic_t refcnt;
99 spinlock_t lock;
100
101 struct xfrm_id id;
102 struct xfrm_selector sel;
103
104 /* Key manger bits */
105 struct {
106 u8 state;
107 u8 dying;
108 u32 seq;
109 } km;
110
111 /* Parameters of this state. */
112 struct {
113 u32 reqid;
114 u8 mode;
115 u8 replay_window;
116 u8 aalgo, ealgo, calgo;
117 u8 flags;
118 u16 family;
119 xfrm_address_t saddr;
120 int header_len;
121 int trailer_len;
122 } props;
123
124 struct xfrm_lifetime_cfg lft;
125
126 /* Data for transformer */
127 struct xfrm_algo *aalg;
128 struct xfrm_algo *ealg;
129 struct xfrm_algo *calg;
130
131 /* Data for encapsulator */
132 struct xfrm_encap_tmpl *encap;
133
134 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
135 struct xfrm_state *tunnel;
136
137 /* If a tunnel, number of users + 1 */
138 atomic_t tunnel_users;
139
140 /* State for replay detection */
141 struct xfrm_replay_state replay;
142
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800143 /* Replay detection state at the time we sent the last notification */
144 struct xfrm_replay_state preplay;
145
146 /* Replay detection notification settings */
147 u32 replay_maxage;
148 u32 replay_maxdiff;
149
150 /* Replay detection notification timer */
151 struct timer_list rtimer;
152
Linus Torvalds1da177e2005-04-16 15:20:36 -0700153 /* Statistics */
154 struct xfrm_stats stats;
155
156 struct xfrm_lifetime_cur curlft;
157 struct timer_list timer;
158
159 /* Reference to data common to all the instances of this
160 * transformer. */
161 struct xfrm_type *type;
162
Trent Jaegerdf718372005-12-13 23:12:27 -0800163 /* Security context */
164 struct xfrm_sec_ctx *security;
165
Linus Torvalds1da177e2005-04-16 15:20:36 -0700166 /* Private data of this transformer, format is opaque,
167 * interpreted by xfrm_type methods. */
168 void *data;
169};
170
171enum {
172 XFRM_STATE_VOID,
173 XFRM_STATE_ACQ,
174 XFRM_STATE_VALID,
175 XFRM_STATE_ERROR,
176 XFRM_STATE_EXPIRED,
177 XFRM_STATE_DEAD
178};
179
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700180/* callback structure passed from either netlink or pfkey */
181struct km_event
182{
Herbert Xubf088672005-06-18 22:44:00 -0700183 union {
184 u32 hard;
185 u32 proto;
186 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800187 u32 aevent;
Herbert Xubf088672005-06-18 22:44:00 -0700188 } data;
189
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700190 u32 seq;
191 u32 pid;
192 u32 event;
193};
194
Linus Torvalds1da177e2005-04-16 15:20:36 -0700195struct xfrm_type;
196struct xfrm_dst;
197struct xfrm_policy_afinfo {
198 unsigned short family;
199 rwlock_t lock;
200 struct xfrm_type_map *type_map;
201 struct dst_ops *dst_ops;
202 void (*garbage_collect)(void);
203 int (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
204 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
205 int (*bundle_create)(struct xfrm_policy *policy,
206 struct xfrm_state **xfrm,
207 int nx,
208 struct flowi *fl,
209 struct dst_entry **dst_p);
210 void (*decode_session)(struct sk_buff *skb,
211 struct flowi *fl);
212};
213
214extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
215extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700216extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
217extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218#define XFRM_ACQ_EXPIRES 30
219
220struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800221extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800222extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
223extern int __xfrm_state_delete(struct xfrm_state *x);
224
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225struct xfrm_state_afinfo {
226 unsigned short family;
227 rwlock_t lock;
228 struct list_head *state_bydst;
229 struct list_head *state_byspi;
Herbert Xud094cd82005-06-20 13:19:41 -0700230 int (*init_flags)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700231 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
232 struct xfrm_tmpl *tmpl,
233 xfrm_address_t *daddr, xfrm_address_t *saddr);
234 struct xfrm_state *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
235 struct xfrm_state *(*find_acq)(u8 mode, u32 reqid, u8 proto,
236 xfrm_address_t *daddr, xfrm_address_t *saddr,
237 int create);
238};
239
240extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
241extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
242
243extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
244
245struct xfrm_decap_state;
246struct xfrm_type
247{
248 char *description;
249 struct module *owner;
250 __u8 proto;
251
Herbert Xu72cb6962005-06-20 13:18:08 -0700252 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 void (*destructor)(struct xfrm_state *);
254 int (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
256 /* Estimate maximal size of result of transformation of a dgram */
257 u32 (*get_max_size)(struct xfrm_state *, int size);
258};
259
260struct xfrm_type_map {
261 rwlock_t lock;
262 struct xfrm_type *map[256];
263};
264
265extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
266extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
267extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
268extern void xfrm_put_type(struct xfrm_type *type);
269
270struct xfrm_tmpl
271{
272/* id in template is interpreted as:
273 * daddr - destination of tunnel, may be zero for transport mode.
274 * spi - zero to acquire spi. Not zero if spi is static, then
275 * daddr must be fixed too.
276 * proto - AH/ESP/IPCOMP
277 */
278 struct xfrm_id id;
279
280/* Source address of tunnel. Ignored, if it is not a tunnel. */
281 xfrm_address_t saddr;
282
283 __u32 reqid;
284
285/* Mode: transport/tunnel */
286 __u8 mode;
287
288/* Sharing mode: unique, this session only, this user only etc. */
289 __u8 share;
290
291/* May skip this transfomration if no SA is found */
292 __u8 optional;
293
294/* Bit mask of algos allowed for acquisition */
295 __u32 aalgos;
296 __u32 ealgos;
297 __u32 calgos;
298};
299
300#define XFRM_MAX_DEPTH 4
301
302struct xfrm_policy
303{
304 struct xfrm_policy *next;
305 struct list_head list;
306
307 /* This lock only affects elements except for entry. */
308 rwlock_t lock;
309 atomic_t refcnt;
310 struct timer_list timer;
311
312 u32 priority;
313 u32 index;
314 struct xfrm_selector selector;
315 struct xfrm_lifetime_cfg lft;
316 struct xfrm_lifetime_cur curlft;
317 struct dst_entry *bundles;
318 __u16 family;
319 __u8 action;
320 __u8 flags;
321 __u8 dead;
322 __u8 xfrm_nr;
Trent Jaegerdf718372005-12-13 23:12:27 -0800323 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
325};
326
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800327#define XFRM_KM_TIMEOUT 30
328/* which seqno */
329#define XFRM_REPLAY_SEQ 1
330#define XFRM_REPLAY_OSEQ 2
331#define XFRM_REPLAY_SEQ_MASK 3
332/* what happened */
333#define XFRM_REPLAY_UPDATE XFRM_AE_CR
334#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
335
336/* default aevent timeout in units of 100ms */
337#define XFRM_AE_ETIME 10
338/* Async Event timer multiplier */
339#define XFRM_AE_ETH_M 10
340/* default seq threshold size */
341#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342
343struct xfrm_mgr
344{
345 struct list_head list;
346 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700347 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700348 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
349 struct xfrm_policy *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
350 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700351 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700352};
353
354extern int xfrm_register_km(struct xfrm_mgr *km);
355extern int xfrm_unregister_km(struct xfrm_mgr *km);
356
357
358extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
359
360static inline void xfrm_pol_hold(struct xfrm_policy *policy)
361{
362 if (likely(policy != NULL))
363 atomic_inc(&policy->refcnt);
364}
365
366extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
367
368static inline void xfrm_pol_put(struct xfrm_policy *policy)
369{
370 if (atomic_dec_and_test(&policy->refcnt))
371 __xfrm_policy_destroy(policy);
372}
373
374#define XFRM_DST_HSIZE 1024
375
376static __inline__
377unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
378{
379 unsigned h;
380 h = ntohl(addr->a4);
381 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
382 return h;
383}
384
385static __inline__
386unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
387{
388 unsigned h;
389 h = ntohl(addr->a6[2]^addr->a6[3]);
390 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
391 return h;
392}
393
394static __inline__
395unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
396{
397 switch (family) {
398 case AF_INET:
399 return __xfrm4_dst_hash(addr);
400 case AF_INET6:
401 return __xfrm6_dst_hash(addr);
402 }
403 return 0;
404}
405
406static __inline__
407unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
408{
409 unsigned h;
410 h = ntohl(addr->a4^spi^proto);
411 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
412 return h;
413}
414
415static __inline__
416unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
417{
418 unsigned h;
419 h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
420 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
421 return h;
422}
423
424static __inline__
425unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
426{
427 switch (family) {
428 case AF_INET:
429 return __xfrm4_spi_hash(addr, spi, proto);
430 case AF_INET6:
431 return __xfrm6_spi_hash(addr, spi, proto);
432 }
433 return 0; /*XXX*/
434}
435
436extern void __xfrm_state_destroy(struct xfrm_state *);
437
Herbert Xu21380b82006-02-22 14:47:13 -0800438static inline void __xfrm_state_put(struct xfrm_state *x)
439{
440 atomic_dec(&x->refcnt);
441}
442
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443static inline void xfrm_state_put(struct xfrm_state *x)
444{
445 if (atomic_dec_and_test(&x->refcnt))
446 __xfrm_state_destroy(x);
447}
448
449static inline void xfrm_state_hold(struct xfrm_state *x)
450{
451 atomic_inc(&x->refcnt);
452}
453
454static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
455{
456 __u32 *a1 = token1;
457 __u32 *a2 = token2;
458 int pdw;
459 int pbi;
460
461 pdw = prefixlen >> 5; /* num of whole __u32 in prefix */
462 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
463
464 if (pdw)
465 if (memcmp(a1, a2, pdw << 2))
466 return 0;
467
468 if (pbi) {
469 __u32 mask;
470
471 mask = htonl((0xffffffff) << (32 - pbi));
472
473 if ((a1[pdw] ^ a2[pdw]) & mask)
474 return 0;
475 }
476
477 return 1;
478}
479
480static __inline__
481u16 xfrm_flowi_sport(struct flowi *fl)
482{
483 u16 port;
484 switch(fl->proto) {
485 case IPPROTO_TCP:
486 case IPPROTO_UDP:
487 case IPPROTO_SCTP:
488 port = fl->fl_ip_sport;
489 break;
490 case IPPROTO_ICMP:
491 case IPPROTO_ICMPV6:
492 port = htons(fl->fl_icmp_type);
493 break;
494 default:
495 port = 0; /*XXX*/
496 }
497 return port;
498}
499
500static __inline__
501u16 xfrm_flowi_dport(struct flowi *fl)
502{
503 u16 port;
504 switch(fl->proto) {
505 case IPPROTO_TCP:
506 case IPPROTO_UDP:
507 case IPPROTO_SCTP:
508 port = fl->fl_ip_dport;
509 break;
510 case IPPROTO_ICMP:
511 case IPPROTO_ICMPV6:
512 port = htons(fl->fl_icmp_code);
513 break;
514 default:
515 port = 0; /*XXX*/
516 }
517 return port;
518}
519
520static inline int
521__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
522{
523 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
524 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
525 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
526 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
527 (fl->proto == sel->proto || !sel->proto) &&
528 (fl->oif == sel->ifindex || !sel->ifindex);
529}
530
531static inline int
532__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
533{
534 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
535 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
536 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
537 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
538 (fl->proto == sel->proto || !sel->proto) &&
539 (fl->oif == sel->ifindex || !sel->ifindex);
540}
541
542static inline int
543xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
544 unsigned short family)
545{
546 switch (family) {
547 case AF_INET:
548 return __xfrm4_selector_match(sel, fl);
549 case AF_INET6:
550 return __xfrm6_selector_match(sel, fl);
551 }
552 return 0;
553}
554
Trent Jaegerdf718372005-12-13 23:12:27 -0800555#ifdef CONFIG_SECURITY_NETWORK_XFRM
556/* If neither has a context --> match
557 * Otherwise, both must have a context and the sids, doi, alg must match
558 */
559static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
560{
561 return ((!s1 && !s2) ||
562 (s1 && s2 &&
563 (s1->ctx_sid == s2->ctx_sid) &&
564 (s1->ctx_doi == s2->ctx_doi) &&
565 (s1->ctx_alg == s2->ctx_alg)));
566}
567#else
568static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
569{
570 return 1;
571}
572#endif
573
Linus Torvalds1da177e2005-04-16 15:20:36 -0700574/* A struct encoding bundle of transformations to apply to some set of flow.
575 *
576 * dst->child points to the next element of bundle.
577 * dst->xfrm points to an instanse of transformer.
578 *
579 * Due to unfortunate limitations of current routing cache, which we
580 * have no time to fix, it mirrors struct rtable and bound to the same
581 * routing key, including saddr,daddr. However, we can have many of
582 * bundles differing by session id. All the bundles grow from a parent
583 * policy rule.
584 */
585struct xfrm_dst
586{
587 union {
588 struct xfrm_dst *next;
589 struct dst_entry dst;
590 struct rtable rt;
591 struct rt6_info rt6;
592 } u;
593 struct dst_entry *route;
594 u32 route_mtu_cached;
595 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63de2005-05-26 12:58:04 -0700596 u32 route_cookie;
597 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598};
599
Herbert Xuaabc9762005-05-03 16:27:10 -0700600static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
601{
602 dst_release(xdst->route);
603 if (likely(xdst->u.dst.xfrm))
604 xfrm_state_put(xdst->u.dst.xfrm);
605}
606
607extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
608
Linus Torvalds1da177e2005-04-16 15:20:36 -0700609/* Decapsulation state, used by the input to store data during
610 * decapsulation procedure, to be used later (during the policy
611 * check
612 */
613struct xfrm_decap_state {
614 char decap_data[20];
615 __u16 decap_type;
616};
617
618struct sec_decap_state {
619 struct xfrm_state *xvec;
620 struct xfrm_decap_state decap;
621};
622
623struct sec_path
624{
625 atomic_t refcnt;
626 int len;
627 struct sec_decap_state x[XFRM_MAX_DEPTH];
628};
629
630static inline struct sec_path *
631secpath_get(struct sec_path *sp)
632{
633 if (sp)
634 atomic_inc(&sp->refcnt);
635 return sp;
636}
637
638extern void __secpath_destroy(struct sec_path *sp);
639
640static inline void
641secpath_put(struct sec_path *sp)
642{
643 if (sp && atomic_dec_and_test(&sp->refcnt))
644 __secpath_destroy(sp);
645}
646
647extern struct sec_path *secpath_dup(struct sec_path *src);
648
649static inline void
650secpath_reset(struct sk_buff *skb)
651{
652#ifdef CONFIG_XFRM
653 secpath_put(skb->sp);
654 skb->sp = NULL;
655#endif
656}
657
658static inline int
659__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
660{
661 return (tmpl->saddr.a4 &&
662 tmpl->saddr.a4 != x->props.saddr.a4);
663}
664
665static inline int
666__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
667{
668 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
669 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
670}
671
672static inline int
673xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
674{
675 switch (family) {
676 case AF_INET:
677 return __xfrm4_state_addr_cmp(tmpl, x);
678 case AF_INET6:
679 return __xfrm6_state_addr_cmp(tmpl, x);
680 }
681 return !0;
682}
683
684#ifdef CONFIG_XFRM
685
686extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
687
688static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
689{
690 if (sk && sk->sk_policy[XFRM_POLICY_IN])
691 return __xfrm_policy_check(sk, dir, skb, family);
692
693 return (!xfrm_policy_list[dir] && !skb->sp) ||
694 (skb->dst->flags & DST_NOPOLICY) ||
695 __xfrm_policy_check(sk, dir, skb, family);
696}
697
698static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
699{
700 return xfrm_policy_check(sk, dir, skb, AF_INET);
701}
702
703static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
704{
705 return xfrm_policy_check(sk, dir, skb, AF_INET6);
706}
707
Patrick McHardy3e3850e2006-01-06 23:04:54 -0800708extern int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700709extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
710
711static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
712{
713 return !xfrm_policy_list[XFRM_POLICY_OUT] ||
714 (skb->dst->flags & DST_NOXFRM) ||
715 __xfrm_route_forward(skb, family);
716}
717
718static inline int xfrm4_route_forward(struct sk_buff *skb)
719{
720 return xfrm_route_forward(skb, AF_INET);
721}
722
723static inline int xfrm6_route_forward(struct sk_buff *skb)
724{
725 return xfrm_route_forward(skb, AF_INET6);
726}
727
728extern int __xfrm_sk_clone_policy(struct sock *sk);
729
730static inline int xfrm_sk_clone_policy(struct sock *sk)
731{
732 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
733 return __xfrm_sk_clone_policy(sk);
734 return 0;
735}
736
Herbert Xu4666faa2005-06-18 22:43:22 -0700737extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700738
739static inline void xfrm_sk_free_policy(struct sock *sk)
740{
741 if (unlikely(sk->sk_policy[0] != NULL)) {
742 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
743 sk->sk_policy[0] = NULL;
744 }
745 if (unlikely(sk->sk_policy[1] != NULL)) {
746 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
747 sk->sk_policy[1] = NULL;
748 }
749}
750
751#else
752
753static inline void xfrm_sk_free_policy(struct sock *sk) {}
754static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
755static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
756static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
757static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
758{
759 return 1;
760}
761static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
762{
763 return 1;
764}
765static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
766{
767 return 1;
768}
769#endif
770
771static __inline__
772xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
773{
774 switch (family){
775 case AF_INET:
776 return (xfrm_address_t *)&fl->fl4_dst;
777 case AF_INET6:
778 return (xfrm_address_t *)&fl->fl6_dst;
779 }
780 return NULL;
781}
782
783static __inline__
784xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
785{
786 switch (family){
787 case AF_INET:
788 return (xfrm_address_t *)&fl->fl4_src;
789 case AF_INET6:
790 return (xfrm_address_t *)&fl->fl6_src;
791 }
792 return NULL;
793}
794
795static __inline__ int
796__xfrm4_state_addr_check(struct xfrm_state *x,
797 xfrm_address_t *daddr, xfrm_address_t *saddr)
798{
799 if (daddr->a4 == x->id.daddr.a4 &&
800 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
801 return 1;
802 return 0;
803}
804
805static __inline__ int
806__xfrm6_state_addr_check(struct xfrm_state *x,
807 xfrm_address_t *daddr, xfrm_address_t *saddr)
808{
809 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
810 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
811 ipv6_addr_any((struct in6_addr *)saddr) ||
812 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
813 return 1;
814 return 0;
815}
816
817static __inline__ int
818xfrm_state_addr_check(struct xfrm_state *x,
819 xfrm_address_t *daddr, xfrm_address_t *saddr,
820 unsigned short family)
821{
822 switch (family) {
823 case AF_INET:
824 return __xfrm4_state_addr_check(x, daddr, saddr);
825 case AF_INET6:
826 return __xfrm6_state_addr_check(x, daddr, saddr);
827 }
828 return 0;
829}
830
831static inline int xfrm_state_kern(struct xfrm_state *x)
832{
833 return atomic_read(&x->tunnel_users);
834}
835
836/*
837 * xfrm algorithm information
838 */
839struct xfrm_algo_auth_info {
840 u16 icv_truncbits;
841 u16 icv_fullbits;
842};
843
844struct xfrm_algo_encr_info {
845 u16 blockbits;
846 u16 defkeybits;
847};
848
849struct xfrm_algo_comp_info {
850 u16 threshold;
851};
852
853struct xfrm_algo_desc {
854 char *name;
855 u8 available:1;
856 union {
857 struct xfrm_algo_auth_info auth;
858 struct xfrm_algo_encr_info encr;
859 struct xfrm_algo_comp_info comp;
860 } uinfo;
861 struct sadb_alg desc;
862};
863
864/* XFRM tunnel handlers. */
865struct xfrm_tunnel {
866 int (*handler)(struct sk_buff *skb);
Patrick McHardy03037702005-07-19 14:03:34 -0700867 void (*err_handler)(struct sk_buff *skb, __u32 info);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868};
869
870struct xfrm6_tunnel {
Patrick McHardy951dbc82006-01-06 23:02:34 -0800871 int (*handler)(struct sk_buff **pskb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700872 void (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
873 int type, int code, int offset, __u32 info);
874};
875
876extern void xfrm_init(void);
877extern void xfrm4_init(void);
878extern void xfrm6_init(void);
879extern void xfrm6_fini(void);
880extern void xfrm_state_init(void);
881extern void xfrm4_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700882extern void xfrm6_state_init(void);
883extern void xfrm6_state_fini(void);
884
885extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
886extern struct xfrm_state *xfrm_state_alloc(void);
887extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
888 struct flowi *fl, struct xfrm_tmpl *tmpl,
889 struct xfrm_policy *pol, int *err,
890 unsigned short family);
891extern int xfrm_state_check_expire(struct xfrm_state *x);
892extern void xfrm_state_insert(struct xfrm_state *x);
893extern int xfrm_state_add(struct xfrm_state *x);
894extern int xfrm_state_update(struct xfrm_state *x);
895extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
896extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700897extern int xfrm_state_delete(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700898extern void xfrm_state_flush(u8 proto);
899extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
900extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800901extern void xfrm_replay_notify(struct xfrm_state *x, int event);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700902extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
903extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -0700904extern int xfrm_init_state(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700905extern int xfrm4_rcv(struct sk_buff *skb);
906extern int xfrm4_output(struct sk_buff *skb);
907extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
908extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
Patrick McHardy951dbc82006-01-06 23:02:34 -0800909extern int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi);
910extern int xfrm6_rcv(struct sk_buff **pskb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
912extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
913extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
914extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
915extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
916extern int xfrm6_output(struct sk_buff *skb);
917
918#ifdef CONFIG_XFRM
919extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
920extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
921extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
922#else
923static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
924{
925 return -ENOPROTOOPT;
926}
927
928static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
929{
930 /* should not happen */
931 kfree_skb(skb);
932 return 0;
933}
934static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
935{
936 return -EINVAL;
937}
938#endif
939
Al Virodd0fc662005-10-07 07:46:04 +0100940struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700941extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
942int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Trent Jaegerdf718372005-12-13 23:12:27 -0800943struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
944 struct xfrm_sec_ctx *ctx, int delete);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700945struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
946void xfrm_policy_flush(void);
947u32 xfrm_get_acqseq(void);
948void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
949struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
950 xfrm_address_t *daddr, xfrm_address_t *saddr,
951 int create, unsigned short family);
952extern void xfrm_policy_flush(void);
953extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
954extern int xfrm_flush_bundles(void);
David S. Miller399c1802005-12-19 14:23:23 -0800955extern void xfrm_flush_all_bundles(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700956extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
957extern void xfrm_init_pmtu(struct dst_entry *dst);
958
959extern wait_queue_head_t km_waitq;
960extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -0800961extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700962
963extern void xfrm_input_init(void);
964extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
965
966extern void xfrm_probe_algs(void);
967extern int xfrm_count_auth_supported(void);
968extern int xfrm_count_enc_supported(void);
969extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
970extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
971extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
972extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
973extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
974extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
975extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
976extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
977
978struct crypto_tfm;
979typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
980
981extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
982 int offset, int len, icv_update_fn_t icv_update);
983
984static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
985 int family)
986{
987 switch (family) {
988 default:
989 case AF_INET:
990 return a->a4 - b->a4;
991 case AF_INET6:
992 return ipv6_addr_cmp((struct in6_addr *)a,
993 (struct in6_addr *)b);
994 }
995}
996
Herbert Xu77d8d7a2005-10-05 12:15:12 -0700997static inline int xfrm_policy_id2dir(u32 index)
998{
999 return index & 7;
1000}
1001
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001002static inline int xfrm_aevent_is_on(void)
1003{
Patrick McHardybe336902006-03-20 22:40:54 -08001004 struct sock *nlsk;
1005 int ret = 0;
1006
1007 rcu_read_lock();
1008 nlsk = rcu_dereference(xfrm_nl);
1009 if (nlsk)
1010 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1011 rcu_read_unlock();
1012 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001013}
1014
1015static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
1016{
1017 if (xfrm_aevent_is_on())
1018 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1019}
1020
1021
Linus Torvalds1da177e2005-04-16 15:20:36 -07001022#endif /* _NET_XFRM_H */