blob: 312e3fee9ccfc098f70cd8ec6edb87881e1d1f99 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Nicolas Dichtelfa9921e2011-02-02 06:29:02 +000039#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070041#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070043#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080046#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080047#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
49#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080050#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080051#define XFRM_INC_STATS(net, field) ((void)(net))
52#define XFRM_INC_STATS_BH(net, field) ((void)(net))
53#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080054#endif
55
Linus Torvalds1da177e2005-04-16 15:20:36 -070056
57/* Organization of SPD aka "XFRM rules"
58 ------------------------------------
59
60 Basic objects:
61 - policy rule, struct xfrm_policy (=SPD entry)
62 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
63 - instance of a transformer, struct xfrm_state (=SA)
64 - template to clone xfrm_state, struct xfrm_tmpl
65
66 SPD is plain linear list of xfrm_policy rules, ordered by priority.
67 (To be compatible with existing pfkeyv2 implementations,
68 many rules with priority of 0x7fffffff are allowed to exist and
69 such rules are ordered in an unpredictable way, thanks to bsd folks.)
70
71 Lookup is plain linear search until the first match with selector.
72
73 If "action" is "block", then we prohibit the flow, otherwise:
74 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
75 policy entry has list of up to XFRM_MAX_DEPTH transformations,
76 described by templates xfrm_tmpl. Each template is resolved
77 to a complete xfrm_state (see below) and we pack bundle of transformations
78 to a dst_entry returned to requestor.
79
80 dst -. xfrm .-> xfrm_state #1
81 |---. child .-> dst -. xfrm .-> xfrm_state #2
82 |---. child .-> dst -. xfrm .-> xfrm_state #3
83 |---. child .-> NULL
84
85 Bundles are cached at xrfm_policy struct (field ->bundles).
86
87
88 Resolution of xrfm_tmpl
89 -----------------------
90 Template contains:
91 1. ->mode Mode: transport or tunnel
92 2. ->id.proto Protocol: AH/ESP/IPCOMP
93 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
94 Q: allow to resolve security gateway?
95 4. ->id.spi If not zero, static SPI.
96 5. ->saddr Local tunnel endpoint, ignored for transport mode.
97 6. ->algos List of allowed algos. Plain bitmask now.
98 Q: ealgos, aalgos, calgos. What a mess...
99 7. ->share Sharing mode.
100 Q: how to implement private sharing mode? To add struct sock* to
101 flow id?
102
103 Having this template we search through SAD searching for entries
104 with appropriate mode/proto/algo, permitted by selector.
105 If no appropriate entry found, it is requested from key manager.
106
107 PROBLEMS:
108 Q: How to find all the bundles referring to a physical path for
109 PMTU discovery? Seems, dst should contain list of all parents...
110 and enter to infinite locking hierarchy disaster.
111 No! It is easier, we will not search for them, let them find us.
112 We add genid to each dst plus pointer to genid of raw IP route,
113 pmtu disc will update pmtu on raw IP route and increase its genid.
114 dst_check() will see this for top level and trigger resyncing
115 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
116 */
117
Herbert Xu12a169e2008-10-01 07:03:24 -0700118struct xfrm_state_walk {
119 struct list_head all;
120 u8 state;
Nicolas Dichteld3623092014-02-14 15:30:36 +0100121 u8 dying;
122 u8 proto;
Herbert Xu12a169e2008-10-01 07:03:24 -0700123 u32 seq;
Nicolas Dichtel870a2df2014-03-06 18:24:29 +0100124 struct xfrm_address_filter *filter;
Herbert Xu12a169e2008-10-01 07:03:24 -0700125};
126
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000128struct xfrm_state {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500129 possible_net_t xs_net;
Herbert Xuabb81c42008-09-09 19:58:29 -0700130 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700131 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700132 struct hlist_node bydst;
133 };
David S. Miller8f126e32006-08-24 02:45:07 -0700134 struct hlist_node bysrc;
135 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136
137 atomic_t refcnt;
138 spinlock_t lock;
139
140 struct xfrm_id id;
141 struct xfrm_selector sel;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +0000142 struct xfrm_mark mark;
Martin Willi35d28562010-12-08 04:37:49 +0000143 u32 tfcpad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700144
David S. Miller9d4a7062006-08-24 03:18:09 -0700145 u32 genid;
146
Herbert Xu12a169e2008-10-01 07:03:24 -0700147 /* Key manager bits */
148 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700149
150 /* Parameters of this state. */
151 struct {
152 u32 reqid;
153 u8 mode;
154 u8 replay_window;
155 u8 aalgo, ealgo, calgo;
156 u8 flags;
157 u16 family;
158 xfrm_address_t saddr;
159 int header_len;
160 int trailer_len;
Nicolas Dichtela947b0a2013-02-22 10:54:54 +0100161 u32 extra_flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700162 } props;
163
164 struct xfrm_lifetime_cfg lft;
165
166 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000167 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168 struct xfrm_algo *ealg;
169 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800170 struct xfrm_algo_aead *aead;
Herbert Xu69b01372015-05-27 16:03:45 +0800171 const char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700172
173 /* Data for encapsulator */
174 struct xfrm_encap_tmpl *encap;
175
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700176 /* Data for care-of address */
177 xfrm_address_t *coaddr;
178
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
180 struct xfrm_state *tunnel;
181
182 /* If a tunnel, number of users + 1 */
183 atomic_t tunnel_users;
184
185 /* State for replay detection */
186 struct xfrm_replay_state replay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000187 struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800189 /* Replay detection state at the time we sent the last notification */
190 struct xfrm_replay_state preplay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000191 struct xfrm_replay_state_esn *preplay_esn;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800192
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000193 /* The functions for replay detection. */
194 struct xfrm_replay *repl;
195
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700196 /* internal flag that only holds state for delayed aevent at the
197 * moment
198 */
199 u32 xflags;
200
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800201 /* Replay detection notification settings */
202 u32 replay_maxage;
203 u32 replay_maxdiff;
204
205 /* Replay detection notification timer */
206 struct timer_list rtimer;
207
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 /* Statistics */
209 struct xfrm_stats stats;
210
211 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800212 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213
Fan Due3c0d042012-07-30 21:43:54 +0000214 /* used to fix curlft->add_time when changing date */
215 long saved_tmo;
216
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700217 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800218 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700219
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220 /* Reference to data common to all the instances of this
221 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800222 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700223 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700224 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700225 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226
Trent Jaegerdf718372005-12-13 23:12:27 -0800227 /* Security context */
228 struct xfrm_sec_ctx *security;
229
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230 /* Private data of this transformer, format is opaque,
231 * interpreted by xfrm_type methods. */
232 void *data;
233};
234
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800235static inline struct net *xs_net(struct xfrm_state *x)
236{
237 return read_pnet(&x->xs_net);
238}
239
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700240/* xflags - make enum if more show up */
241#define XFRM_TIME_DEFER 1
Fan Due3c0d042012-07-30 21:43:54 +0000242#define XFRM_SOFT_EXPIRE 2
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700243
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244enum {
245 XFRM_STATE_VOID,
246 XFRM_STATE_ACQ,
247 XFRM_STATE_VALID,
248 XFRM_STATE_ERROR,
249 XFRM_STATE_EXPIRED,
250 XFRM_STATE_DEAD
251};
252
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700253/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000254struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700255 union {
256 u32 hard;
257 u32 proto;
258 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800259 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700260 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700261 } data;
262
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700263 u32 seq;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000264 u32 portid;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700265 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800266 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700267};
268
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000269struct xfrm_replay {
270 void (*advance)(struct xfrm_state *x, __be32 net_seq);
271 int (*check)(struct xfrm_state *x,
272 struct sk_buff *skb,
273 __be32 net_seq);
Steffen Klassert3b59df42012-09-04 00:03:29 +0000274 int (*recheck)(struct xfrm_state *x,
275 struct sk_buff *skb,
276 __be32 net_seq);
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000277 void (*notify)(struct xfrm_state *x, int event);
278 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
279};
280
Herbert Xu25ee3282007-12-11 09:32:34 -0800281struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282struct xfrm_type;
283struct xfrm_dst;
284struct xfrm_policy_afinfo {
285 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700286 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800287 void (*garbage_collect)(struct net *net);
David Ahern42a7b322015-08-10 16:58:11 -0600288 struct dst_entry *(*dst_lookup)(struct net *net,
289 int tos, int oif,
David S. Miller5e6b9302011-02-24 00:14:45 -0500290 const xfrm_address_t *saddr,
291 const xfrm_address_t *daddr);
David Ahern42a7b322015-08-10 16:58:11 -0600292 int (*get_saddr)(struct net *net, int oif,
293 xfrm_address_t *saddr,
294 xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800296 struct flowi *fl,
297 int reverse);
David S. Miller05d84022011-02-22 17:47:10 -0800298 int (*get_tos)(const struct flowi *fl);
Patrick McHardy9d7b0fc2012-08-20 02:56:56 -0700299 void (*init_dst)(struct net *net,
300 struct xfrm_dst *dst);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800301 int (*init_path)(struct xfrm_dst *path,
302 struct dst_entry *dst,
303 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800304 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000305 struct net_device *dev,
David S. Miller0c7b3ee2011-02-22 17:48:57 -0800306 const struct flowi *fl);
David S. Miller2774c132011-03-01 14:59:04 -0800307 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700308};
309
Joe Perchesd5113372013-09-23 11:33:53 -0700310int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
311int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
312void km_policy_notify(struct xfrm_policy *xp, int dir,
313 const struct km_event *c);
314void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315
316struct xfrm_tmpl;
Joe Perchesd5113372013-09-23 11:33:53 -0700317int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
318 struct xfrm_policy *pol);
319void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
320int __xfrm_state_delete(struct xfrm_state *x);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800321
Linus Torvalds1da177e2005-04-16 15:20:36 -0700322struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700323 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800324 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700325 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700326 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800327 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700328 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700329 int (*init_flags)(struct xfrm_state *x);
David S. Miller73e5ebb2011-02-22 17:51:44 -0800330 void (*init_tempsel)(struct xfrm_selector *sel,
331 const struct flowi *fl);
David S. Miller19bd6242011-02-24 00:07:20 -0500332 void (*init_temprop)(struct xfrm_state *x,
333 const struct xfrm_tmpl *tmpl,
334 const xfrm_address_t *daddr,
335 const xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700336 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
337 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Eric Dumazetaad88722014-04-15 13:47:15 -0400338 int (*output)(struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -0400339 int (*output_finish)(struct sock *sk, struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800340 int (*extract_input)(struct xfrm_state *x,
341 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800342 int (*extract_output)(struct xfrm_state *x,
343 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800344 int (*transport_finish)(struct sk_buff *skb,
345 int async);
Hannes Frederic Sowa628e3412013-08-14 13:05:23 +0200346 void (*local_error)(struct sk_buff *skb, u32 mtu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347};
348
Joe Perchesd5113372013-09-23 11:33:53 -0700349int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
350int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
351struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
352void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353
Steffen Klassert2f32b512014-03-14 07:28:07 +0100354struct xfrm_input_afinfo {
355 unsigned int family;
356 struct module *owner;
357 int (*callback)(struct sk_buff *skb, u8 protocol,
358 int err);
359};
360
361int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
362int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);
363
Joe Perchesd5113372013-09-23 11:33:53 -0700364void xfrm_state_delete_tunnel(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000366struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700367 char *description;
368 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000369 u8 proto;
370 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700371#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700372#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800373#define XFRM_TYPE_LOCAL_COADDR 4
374#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700375
Herbert Xu72cb6962005-06-20 13:18:08 -0700376 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800378 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700379 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
David S. Miller8f029de2011-02-22 17:59:59 -0800380 int (*reject)(struct xfrm_state *, struct sk_buff *,
381 const struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700382 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700383 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700384 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385};
386
Joe Perchesd5113372013-09-23 11:33:53 -0700387int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
388int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389
Herbert Xub59f45d2006-05-27 23:05:54 -0700390struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800391 /*
392 * Remove encapsulation header.
393 *
394 * The IP header will be moved over the top of the encapsulation
395 * header.
396 *
397 * On entry, the transport header shall point to where the IP header
398 * should be and the network header shall be set to where the IP
399 * header currently is. skb->data shall point to the start of the
400 * payload.
401 */
402 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
403
404 /*
405 * This is the actual input entry point.
406 *
407 * For transport mode and equivalent this would be identical to
408 * input2 (which does not need to be set). While tunnel mode
409 * and equivalent would set this to the tunnel encapsulation function
410 * xfrm4_prepare_input that would in turn call input2.
411 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700412 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700413
414 /*
415 * Add encapsulation header.
416 *
417 * On exit, the transport header will be set to the start of the
418 * encapsulation header to be filled in by x->type->output and
419 * the mac header will be set to the nextheader (protocol for
420 * IPv4) field of the extension header directly preceding the
421 * encapsulation header, or in its absence, that of the top IP
422 * header. The value of the network header will always point
423 * to the top IP header while skb->data will point to the payload.
424 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800425 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
426
427 /*
428 * This is the actual output entry point.
429 *
430 * For transport mode and equivalent this would be identical to
431 * output2 (which does not need to be set). While tunnel mode
432 * and equivalent would set this to a tunnel encapsulation function
433 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
434 * call output2.
435 */
436 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700437
Herbert Xu17c2a422007-10-17 21:33:12 -0700438 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700439 struct module *owner;
440 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700441 int flags;
442};
443
444/* Flags for xfrm_mode. */
445enum {
446 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700447};
448
Joe Perchesd5113372013-09-23 11:33:53 -0700449int xfrm_register_mode(struct xfrm_mode *mode, int family);
450int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700451
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700452static inline int xfrm_af2proto(unsigned int family)
453{
454 switch(family) {
455 case AF_INET:
456 return IPPROTO_IPIP;
457 case AF_INET6:
458 return IPPROTO_IPV6;
459 default:
460 return 0;
461 }
462}
463
464static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
465{
466 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
467 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
468 return x->inner_mode;
469 else
470 return x->inner_mode_iaf;
471}
472
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000473struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700474/* id in template is interpreted as:
475 * daddr - destination of tunnel, may be zero for transport mode.
476 * spi - zero to acquire spi. Not zero if spi is static, then
477 * daddr must be fixed too.
478 * proto - AH/ESP/IPCOMP
479 */
480 struct xfrm_id id;
481
482/* Source address of tunnel. Ignored, if it is not a tunnel. */
483 xfrm_address_t saddr;
484
Miika Komu76b3f052006-11-30 16:40:43 -0800485 unsigned short encap_family;
486
jamala6337462010-02-09 13:21:17 +0000487 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700489/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000490 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700491
492/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000493 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700494
495/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000496 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700497
Herbert Xuc5d18e92008-04-22 00:46:42 -0700498/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000499 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700500
Linus Torvalds1da177e2005-04-16 15:20:36 -0700501/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000502 u32 aalgos;
503 u32 ealgos;
504 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505};
506
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700507#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700508
Herbert Xu12a169e2008-10-01 07:03:24 -0700509struct xfrm_policy_walk_entry {
510 struct list_head all;
511 u8 dead;
512};
513
514struct xfrm_policy_walk {
515 struct xfrm_policy_walk_entry walk;
516 u8 type;
517 u32 seq;
518};
519
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100520struct xfrm_policy_queue {
521 struct sk_buff_head hold_queue;
522 struct timer_list hold_timer;
523 unsigned long timeout;
524};
525
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000526struct xfrm_policy {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500527 possible_net_t xp_net;
David S. Miller2518c7c2006-08-24 04:45:07 -0700528 struct hlist_node bydst;
529 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700530
531 /* This lock only affects elements except for entry. */
532 rwlock_t lock;
533 atomic_t refcnt;
534 struct timer_list timer;
535
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000536 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000537 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700538 u32 priority;
539 u32 index;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +0000540 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 struct xfrm_selector selector;
542 struct xfrm_lifetime_cfg lft;
543 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700544 struct xfrm_policy_walk_entry walk;
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100545 struct xfrm_policy_queue polq;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200546 u8 type;
547 u8 action;
548 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200549 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700550 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800551 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
553};
554
David S. Miller63eb23f2011-02-24 01:25:19 -0500555static inline struct net *xp_net(const struct xfrm_policy *xp)
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800556{
557 return read_pnet(&xp->xp_net);
558}
559
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700560struct xfrm_kmaddress {
561 xfrm_address_t local;
562 xfrm_address_t remote;
563 u32 reserved;
564 u16 family;
565};
566
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800567struct xfrm_migrate {
568 xfrm_address_t old_daddr;
569 xfrm_address_t old_saddr;
570 xfrm_address_t new_daddr;
571 xfrm_address_t new_saddr;
572 u8 proto;
573 u8 mode;
574 u16 reserved;
575 u32 reqid;
576 u16 old_family;
577 u16 new_family;
578};
579
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800580#define XFRM_KM_TIMEOUT 30
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800581/* what happened */
582#define XFRM_REPLAY_UPDATE XFRM_AE_CR
583#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
584
585/* default aevent timeout in units of 100ms */
586#define XFRM_AE_ETIME 10
587/* Async Event timer multiplier */
588#define XFRM_AE_ETH_M 10
589/* default seq threshold size */
590#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000592struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 struct list_head list;
594 char *id;
David S. Miller214e0052011-02-24 00:02:38 -0500595 int (*notify)(struct xfrm_state *x, const struct km_event *c);
Fan Du65e07362012-08-15 10:13:47 +0800596 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700597 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800598 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
David S. Miller214e0052011-02-24 00:02:38 -0500599 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800600 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
David S. Miller183cad12011-02-24 00:28:01 -0500601 int (*migrate)(const struct xfrm_selector *sel,
602 u8 dir, u8 type,
603 const struct xfrm_migrate *m,
604 int num_bundles,
605 const struct xfrm_kmaddress *k);
Horia Geanta0f245582014-02-12 16:20:06 +0200606 bool (*is_alive)(const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700607};
608
Joe Perchesd5113372013-09-23 11:33:53 -0700609int xfrm_register_km(struct xfrm_mgr *km);
610int xfrm_unregister_km(struct xfrm_mgr *km);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700611
Steffen Klassert70be6c92014-02-21 08:41:09 +0100612struct xfrm_tunnel_skb_cb {
613 union {
614 struct inet_skb_parm h4;
615 struct inet6_skb_parm h6;
616 } header;
617
618 union {
619 struct ip_tunnel *ip4;
620 struct ip6_tnl *ip6;
621 } tunnel;
622};
623
624#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
625
Herbert Xu436a0a42007-10-08 17:25:53 -0700626/*
627 * This structure is used for the duration where packets are being
628 * transformed by IPsec. As soon as the packet leaves IPsec the
629 * area beyond the generic IP part may be overwritten.
630 */
631struct xfrm_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100632 struct xfrm_tunnel_skb_cb header;
Herbert Xu436a0a42007-10-08 17:25:53 -0700633
634 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800635 union {
Steffen Klassert1ce36442011-03-08 00:06:31 +0000636 struct {
637 __u32 low;
638 __u32 hi;
639 } output;
640 struct {
641 __be32 low;
642 __be32 hi;
643 } input;
Herbert Xub318e0e2008-02-12 22:50:35 -0800644 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700645};
646
647#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
648
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800649/*
650 * This structure is used by the afinfo prepare_input/prepare_output functions
651 * to transmit header information to the mode input/output functions.
652 */
653struct xfrm_mode_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100654 struct xfrm_tunnel_skb_cb header;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800655
656 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
657 __be16 id;
658 __be16 frag_off;
659
Herbert Xu732c8bd2008-03-26 16:51:09 -0700660 /* IP header length (excluding options or extension headers). */
661 u8 ihl;
662
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800663 /* TOS for IPv4, class for IPv6. */
664 u8 tos;
665
666 /* TTL for IPv4, hop limitfor IPv6. */
667 u8 ttl;
668
669 /* Protocol for IPv4, NH for IPv6. */
670 u8 protocol;
671
Herbert Xu732c8bd2008-03-26 16:51:09 -0700672 /* Option length for IPv4, zero for IPv6. */
673 u8 optlen;
674
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800675 /* Used by IPv6 only, zero for IPv4. */
676 u8 flow_lbl[3];
677};
678
679#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
680
Herbert Xu716062f2007-11-13 21:44:23 -0800681/*
682 * This structure is used by the input processing to locate the SPI and
683 * related information.
684 */
685struct xfrm_spi_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100686 struct xfrm_tunnel_skb_cb header;
Herbert Xu716062f2007-11-13 21:44:23 -0800687
Herbert Xu716062f2007-11-13 21:44:23 -0800688 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800689 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800690};
691
692#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
693
Joy Lattenc9204d92006-11-30 15:50:43 -0600694#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800695static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700696{
697 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800698
699 if (audit_enabled == 0)
700 return NULL;
701 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
702 AUDIT_MAC_IPSEC_EVENT);
703 if (audit_buf == NULL)
704 return NULL;
705 audit_log_format(audit_buf, "op=%s", op);
706 return audit_buf;
707}
708
Tetsuo Handa2e710292014-04-22 21:48:30 +0900709static inline void xfrm_audit_helper_usrinfo(bool task_valid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800710 struct audit_buffer *audit_buf)
711{
Tetsuo Handa2e710292014-04-22 21:48:30 +0900712 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
713 audit_get_loginuid(current) :
714 INVALID_UID);
715 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
716 (unsigned int) -1;
717
718 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Tetsuo Handaf1370cc2014-04-18 16:23:46 +0900719 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700720}
721
Tetsuo Handa2e710292014-04-22 21:48:30 +0900722void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
723void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
724 bool task_valid);
725void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
726void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -0700727void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
728 struct sk_buff *skb);
729void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
730 __be32 net_seq);
731void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
732void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
733 __be32 net_seq);
734void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
735 u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600736#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700737
738static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900739 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700740{
741}
742
743static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900744 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700745{
746}
747
748static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900749 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700750{
751}
752
753static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900754 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700755{
756}
757
758static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
759 struct sk_buff *skb)
760{
761}
762
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000763static inline void xfrm_audit_state_replay(struct xfrm_state *x,
764 struct sk_buff *skb, __be32 net_seq)
765{
766}
767
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700768static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
769 u16 family)
770{
771}
772
773static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
774 __be32 net_spi, __be32 net_seq)
775{
776}
777
778static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
779 struct sk_buff *skb, u8 proto)
780{
781}
Joy Lattenc9204d92006-11-30 15:50:43 -0600782#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600783
Linus Torvalds1da177e2005-04-16 15:20:36 -0700784static inline void xfrm_pol_hold(struct xfrm_policy *policy)
785{
786 if (likely(policy != NULL))
787 atomic_inc(&policy->refcnt);
788}
789
Joe Perchesd5113372013-09-23 11:33:53 -0700790void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700791
792static inline void xfrm_pol_put(struct xfrm_policy *policy)
793{
794 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800795 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700796}
797
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700798static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
799{
800 int i;
801 for (i = npols - 1; i >= 0; --i)
802 xfrm_pol_put(pols[i]);
803}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700804
Joe Perchesd5113372013-09-23 11:33:53 -0700805void __xfrm_state_destroy(struct xfrm_state *);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700806
Herbert Xu21380b82006-02-22 14:47:13 -0800807static inline void __xfrm_state_put(struct xfrm_state *x)
808{
809 atomic_dec(&x->refcnt);
810}
811
Linus Torvalds1da177e2005-04-16 15:20:36 -0700812static inline void xfrm_state_put(struct xfrm_state *x)
813{
814 if (atomic_dec_and_test(&x->refcnt))
815 __xfrm_state_destroy(x);
816}
817
818static inline void xfrm_state_hold(struct xfrm_state *x)
819{
820 atomic_inc(&x->refcnt);
821}
822
David S. Miller1744a8f2011-02-22 18:02:12 -0800823static inline bool addr_match(const void *token1, const void *token2,
824 int prefixlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700825{
David S. Miller1744a8f2011-02-22 18:02:12 -0800826 const __be32 *a1 = token1;
827 const __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700828 int pdw;
829 int pbi;
830
jamala6337462010-02-09 13:21:17 +0000831 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700832 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
833
834 if (pdw)
835 if (memcmp(a1, a2, pdw << 2))
David S. Miller1744a8f2011-02-22 18:02:12 -0800836 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700837
838 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700839 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840
841 mask = htonl((0xffffffff) << (32 - pbi));
842
843 if ((a1[pdw] ^ a2[pdw]) & mask)
David S. Miller1744a8f2011-02-22 18:02:12 -0800844 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700845 }
846
David S. Miller1744a8f2011-02-22 18:02:12 -0800847 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700848}
849
Alexey Dobriyan26bff942011-11-22 06:46:02 +0000850static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
851{
852 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
853 if (prefixlen == 0)
854 return true;
855 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
856}
857
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500859__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700860{
Al Virof9d07e41f82006-09-27 18:45:50 -0700861 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500862 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700863 case IPPROTO_TCP:
864 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800865 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700866 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500867 port = uli->ports.sport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868 break;
869 case IPPROTO_ICMP:
870 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500871 port = htons(uli->icmpt.type);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700872 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700873 case IPPROTO_MH:
David S. Miller6281dcc2011-03-12 00:43:55 -0500874 port = htons(uli->mht.type);
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700875 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000876 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500877 port = htons(ntohl(uli->gre_key) >> 16);
Timo Teräscc9ff192010-11-03 04:41:38 +0000878 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700879 default:
880 port = 0; /*XXX*/
881 }
882 return port;
883}
884
885static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500886__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700887{
Al Virof9d07e41f82006-09-27 18:45:50 -0700888 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500889 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700890 case IPPROTO_TCP:
891 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800892 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700893 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500894 port = uli->ports.dport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700895 break;
896 case IPPROTO_ICMP:
897 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500898 port = htons(uli->icmpt.code);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700899 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000900 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500901 port = htons(ntohl(uli->gre_key) & 0xffff);
Timo Teräscc9ff192010-11-03 04:41:38 +0000902 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700903 default:
904 port = 0; /*XXX*/
905 }
906 return port;
907}
908
Joe Perchesd5113372013-09-23 11:33:53 -0700909bool xfrm_selector_match(const struct xfrm_selector *sel,
910 const struct flowi *fl, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911
Trent Jaegerdf718372005-12-13 23:12:27 -0800912#ifdef CONFIG_SECURITY_NETWORK_XFRM
913/* If neither has a context --> match
914 * Otherwise, both must have a context and the sids, doi, alg must match
915 */
David S. Millerbc9b35a2012-05-15 15:04:57 -0400916static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800917{
918 return ((!s1 && !s2) ||
919 (s1 && s2 &&
920 (s1->ctx_sid == s2->ctx_sid) &&
921 (s1->ctx_doi == s2->ctx_doi) &&
922 (s1->ctx_alg == s2->ctx_alg)));
923}
924#else
David S. Millerbc9b35a2012-05-15 15:04:57 -0400925static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800926{
David S. Millerbc9b35a2012-05-15 15:04:57 -0400927 return true;
Trent Jaegerdf718372005-12-13 23:12:27 -0800928}
929#endif
930
Linus Torvalds1da177e2005-04-16 15:20:36 -0700931/* A struct encoding bundle of transformations to apply to some set of flow.
932 *
933 * dst->child points to the next element of bundle.
934 * dst->xfrm points to an instanse of transformer.
935 *
936 * Due to unfortunate limitations of current routing cache, which we
937 * have no time to fix, it mirrors struct rtable and bound to the same
938 * routing key, including saddr,daddr. However, we can have many of
939 * bundles differing by session id. All the bundles grow from a parent
940 * policy rule.
941 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000942struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700943 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700944 struct dst_entry dst;
945 struct rtable rt;
946 struct rt6_info rt6;
947 } u;
948 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000949 struct flow_cache_object flo;
950 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
951 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700952#ifdef CONFIG_XFRM_SUB_POLICY
953 struct flowi *origin;
954 struct xfrm_selector *partner;
955#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000956 u32 xfrm_genid;
957 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700958 u32 route_mtu_cached;
959 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63dec2005-05-26 12:58:04 -0700960 u32 route_cookie;
961 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700962};
963
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700964#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700965static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
966{
Timo Teräs80c802f2010-04-07 00:30:05 +0000967 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700968 dst_release(xdst->route);
969 if (likely(xdst->u.dst.xfrm))
970 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700971#ifdef CONFIG_XFRM_SUB_POLICY
972 kfree(xdst->origin);
973 xdst->origin = NULL;
974 kfree(xdst->partner);
975 xdst->partner = NULL;
976#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700977}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700978#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700979
Joe Perchesd5113372013-09-23 11:33:53 -0700980void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
Herbert Xuaabc9762005-05-03 16:27:10 -0700981
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000982struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700983 atomic_t refcnt;
984 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800985 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700986};
987
Michael Smith990078a2011-04-07 04:51:51 +0000988static inline int secpath_exists(struct sk_buff *skb)
989{
990#ifdef CONFIG_XFRM
991 return skb->sp != NULL;
992#else
993 return 0;
994#endif
995}
996
Linus Torvalds1da177e2005-04-16 15:20:36 -0700997static inline struct sec_path *
998secpath_get(struct sec_path *sp)
999{
1000 if (sp)
1001 atomic_inc(&sp->refcnt);
1002 return sp;
1003}
1004
Joe Perchesd5113372013-09-23 11:33:53 -07001005void __secpath_destroy(struct sec_path *sp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001006
1007static inline void
1008secpath_put(struct sec_path *sp)
1009{
1010 if (sp && atomic_dec_and_test(&sp->refcnt))
1011 __secpath_destroy(sp);
1012}
1013
Joe Perchesd5113372013-09-23 11:33:53 -07001014struct sec_path *secpath_dup(struct sec_path *src);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015
1016static inline void
1017secpath_reset(struct sk_buff *skb)
1018{
1019#ifdef CONFIG_XFRM
1020 secpath_put(skb->sp);
1021 skb->sp = NULL;
1022#endif
1023}
1024
1025static inline int
David S. Miller6cc32962011-02-24 00:19:59 -05001026xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001027{
1028 switch (family) {
1029 case AF_INET:
1030 return addr->a4 == 0;
1031 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001032 return ipv6_addr_any(&addr->in6);
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001033 }
1034 return 0;
1035}
1036
1037static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001038__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001039{
1040 return (tmpl->saddr.a4 &&
1041 tmpl->saddr.a4 != x->props.saddr.a4);
1042}
1043
1044static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001045__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001046{
1047 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001048 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001049}
1050
1051static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001052xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001053{
1054 switch (family) {
1055 case AF_INET:
1056 return __xfrm4_state_addr_cmp(tmpl, x);
1057 case AF_INET6:
1058 return __xfrm6_state_addr_cmp(tmpl, x);
1059 }
1060 return !0;
1061}
1062
1063#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001064int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1065 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001066
Herbert Xud5422ef2007-12-12 10:44:16 -08001067static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1068 struct sk_buff *skb,
1069 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001070{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001071 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -08001072 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1073
Linus Torvalds1da177e2005-04-16 15:20:36 -07001074 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -08001075 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001076
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001077 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001078 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -08001079 __xfrm_policy_check(sk, ndir, skb, family);
1080}
1081
1082static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1083{
1084 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001085}
1086
1087static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1088{
1089 return xfrm_policy_check(sk, dir, skb, AF_INET);
1090}
1091
1092static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1093{
1094 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1095}
1096
Herbert Xud5422ef2007-12-12 10:44:16 -08001097static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1098 struct sk_buff *skb)
1099{
1100 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1101}
1102
1103static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1104 struct sk_buff *skb)
1105{
1106 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1107}
1108
Joe Perchesd5113372013-09-23 11:33:53 -07001109int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1110 unsigned int family, int reverse);
Herbert Xud5422ef2007-12-12 10:44:16 -08001111
1112static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1113 unsigned int family)
1114{
1115 return __xfrm_decode_session(skb, fl, family, 0);
1116}
1117
1118static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1119 struct flowi *fl,
1120 unsigned int family)
1121{
1122 return __xfrm_decode_session(skb, fl, family, 1);
1123}
1124
Joe Perchesd5113372013-09-23 11:33:53 -07001125int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001126
1127static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1128{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001129 struct net *net = dev_net(skb->dev);
1130
1131 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001132 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001133 __xfrm_route_forward(skb, family);
1134}
1135
1136static inline int xfrm4_route_forward(struct sk_buff *skb)
1137{
1138 return xfrm_route_forward(skb, AF_INET);
1139}
1140
1141static inline int xfrm6_route_forward(struct sk_buff *skb)
1142{
1143 return xfrm_route_forward(skb, AF_INET6);
1144}
1145
Joe Perchesd5113372013-09-23 11:33:53 -07001146int __xfrm_sk_clone_policy(struct sock *sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001147
1148static inline int xfrm_sk_clone_policy(struct sock *sk)
1149{
1150 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1151 return __xfrm_sk_clone_policy(sk);
1152 return 0;
1153}
1154
Joe Perchesd5113372013-09-23 11:33:53 -07001155int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001156
1157static inline void xfrm_sk_free_policy(struct sock *sk)
1158{
1159 if (unlikely(sk->sk_policy[0] != NULL)) {
1160 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1161 sk->sk_policy[0] = NULL;
1162 }
1163 if (unlikely(sk->sk_policy[1] != NULL)) {
1164 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1165 sk->sk_policy[1] = NULL;
1166 }
1167}
1168
Joe Perchesd5113372013-09-23 11:33:53 -07001169void xfrm_garbage_collect(struct net *net);
Paul Mooree4c17212013-05-29 07:36:25 +00001170
Linus Torvalds1da177e2005-04-16 15:20:36 -07001171#else
1172
1173static inline void xfrm_sk_free_policy(struct sock *sk) {}
1174static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1175static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1176static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1177static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1178{
1179 return 1;
1180}
1181static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1182{
1183 return 1;
1184}
1185static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1186{
1187 return 1;
1188}
Herbert Xud5422ef2007-12-12 10:44:16 -08001189static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1190 struct flowi *fl,
1191 unsigned int family)
1192{
1193 return -ENOSYS;
1194}
1195static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1196 struct sk_buff *skb)
1197{
1198 return 1;
1199}
1200static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1201 struct sk_buff *skb)
1202{
1203 return 1;
1204}
Paul Mooree4c17212013-05-29 07:36:25 +00001205static inline void xfrm_garbage_collect(struct net *net)
1206{
1207}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208#endif
1209
1210static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001211xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001212{
1213 switch (family){
1214 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001215 return (xfrm_address_t *)&fl->u.ip4.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001216 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001217 return (xfrm_address_t *)&fl->u.ip6.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001218 }
1219 return NULL;
1220}
1221
1222static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001223xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001224{
1225 switch (family){
1226 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001227 return (xfrm_address_t *)&fl->u.ip4.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001228 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001229 return (xfrm_address_t *)&fl->u.ip6.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001230 }
1231 return NULL;
1232}
1233
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001234static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001235void xfrm_flowi_addr_get(const struct flowi *fl,
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001236 xfrm_address_t *saddr, xfrm_address_t *daddr,
1237 unsigned short family)
1238{
1239 switch(family) {
1240 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001241 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1242 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001243 break;
1244 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001245 saddr->in6 = fl->u.ip6.saddr;
1246 daddr->in6 = fl->u.ip6.daddr;
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001247 break;
1248 }
1249}
1250
Linus Torvalds1da177e2005-04-16 15:20:36 -07001251static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001252__xfrm4_state_addr_check(const struct xfrm_state *x,
1253 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001254{
1255 if (daddr->a4 == x->id.daddr.a4 &&
1256 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1257 return 1;
1258 return 0;
1259}
1260
1261static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001262__xfrm6_state_addr_check(const struct xfrm_state *x,
1263 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001264{
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001265 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1266 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001267 ipv6_addr_any((struct in6_addr *)saddr) ||
1268 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1269 return 1;
1270 return 0;
1271}
1272
1273static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001274xfrm_state_addr_check(const struct xfrm_state *x,
1275 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001276 unsigned short family)
1277{
1278 switch (family) {
1279 case AF_INET:
1280 return __xfrm4_state_addr_check(x, daddr, saddr);
1281 case AF_INET6:
1282 return __xfrm6_state_addr_check(x, daddr, saddr);
1283 }
1284 return 0;
1285}
1286
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001287static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001288xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001289 unsigned short family)
1290{
1291 switch (family) {
1292 case AF_INET:
1293 return __xfrm4_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001294 (const xfrm_address_t *)&fl->u.ip4.daddr,
1295 (const xfrm_address_t *)&fl->u.ip4.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001296 case AF_INET6:
1297 return __xfrm6_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001298 (const xfrm_address_t *)&fl->u.ip6.daddr,
1299 (const xfrm_address_t *)&fl->u.ip6.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001300 }
1301 return 0;
1302}
1303
David S. Millerf8848062011-02-24 01:42:28 -05001304static inline int xfrm_state_kern(const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001305{
1306 return atomic_read(&x->tunnel_users);
1307}
1308
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001309static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1310{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001311 return (!userproto || proto == userproto ||
1312 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1313 proto == IPPROTO_ESP ||
1314 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001315}
1316
Linus Torvalds1da177e2005-04-16 15:20:36 -07001317/*
1318 * xfrm algorithm information
1319 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001320struct xfrm_algo_aead_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001321 char *geniv;
Herbert Xu1a6509d2008-01-28 19:37:29 -08001322 u16 icv_truncbits;
1323};
1324
Linus Torvalds1da177e2005-04-16 15:20:36 -07001325struct xfrm_algo_auth_info {
1326 u16 icv_truncbits;
1327 u16 icv_fullbits;
1328};
1329
1330struct xfrm_algo_encr_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001331 char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001332 u16 blockbits;
1333 u16 defkeybits;
1334};
1335
1336struct xfrm_algo_comp_info {
1337 u16 threshold;
1338};
1339
1340struct xfrm_algo_desc {
1341 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001342 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001343 u8 available:1;
Jussi Kivilinna7e50f842013-01-31 12:40:38 +02001344 u8 pfkey_supported:1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001345 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001346 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001347 struct xfrm_algo_auth_info auth;
1348 struct xfrm_algo_encr_info encr;
1349 struct xfrm_algo_comp_info comp;
1350 } uinfo;
1351 struct sadb_alg desc;
1352};
1353
Steffen Klassert33287152014-02-21 08:41:08 +01001354/* XFRM protocol handlers. */
1355struct xfrm4_protocol {
1356 int (*handler)(struct sk_buff *skb);
1357 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1358 int encap_type);
1359 int (*cb_handler)(struct sk_buff *skb, int err);
1360 int (*err_handler)(struct sk_buff *skb, u32 info);
1361
1362 struct xfrm4_protocol __rcu *next;
1363 int priority;
1364};
1365
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001366struct xfrm6_protocol {
1367 int (*handler)(struct sk_buff *skb);
1368 int (*cb_handler)(struct sk_buff *skb, int err);
1369 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1370 u8 type, u8 code, int offset, __be32 info);
1371
1372 struct xfrm6_protocol __rcu *next;
1373 int priority;
1374};
1375
Linus Torvalds1da177e2005-04-16 15:20:36 -07001376/* XFRM tunnel handlers. */
1377struct xfrm_tunnel {
1378 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001379 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001380
Eric Dumazetb33eab02010-10-25 21:01:26 +00001381 struct xfrm_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001382 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001383};
1384
1385struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001386 int (*handler)(struct sk_buff *skb);
1387 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001388 u8 type, u8 code, int offset, __be32 info);
Eric Dumazet6f0bcf12010-10-24 21:33:16 +00001389 struct xfrm6_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001390 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001391};
1392
Joe Perchesd5113372013-09-23 11:33:53 -07001393void xfrm_init(void);
1394void xfrm4_init(void);
1395int xfrm_state_init(struct net *net);
1396void xfrm_state_fini(struct net *net);
1397void xfrm4_state_init(void);
Steffen Klassert2f32b512014-03-14 07:28:07 +01001398void xfrm4_protocol_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001399#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001400int xfrm6_init(void);
1401void xfrm6_fini(void);
1402int xfrm6_state_init(void);
1403void xfrm6_state_fini(void);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001404int xfrm6_protocol_init(void);
1405void xfrm6_protocol_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001406#else
1407static inline int xfrm6_init(void)
1408{
1409 return 0;
1410}
1411static inline void xfrm6_fini(void)
1412{
1413 ;
1414}
1415#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001416
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001417#ifdef CONFIG_XFRM_STATISTICS
Joe Perchesd5113372013-09-23 11:33:53 -07001418int xfrm_proc_init(struct net *net);
1419void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001420#endif
1421
Joe Perchesd5113372013-09-23 11:33:53 -07001422int xfrm_sysctl_init(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001423#ifdef CONFIG_SYSCTL
Joe Perchesd5113372013-09-23 11:33:53 -07001424void xfrm_sysctl_fini(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001425#else
1426static inline void xfrm_sysctl_fini(struct net *net)
1427{
1428}
1429#endif
1430
Nicolas Dichteld3623092014-02-14 15:30:36 +01001431void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
Nicolas Dichtel870a2df2014-03-06 18:24:29 +01001432 struct xfrm_address_filter *filter);
Joe Perchesd5113372013-09-23 11:33:53 -07001433int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1434 int (*func)(struct xfrm_state *, int, void*), void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001435void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001436struct xfrm_state *xfrm_state_alloc(struct net *net);
1437struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1438 const xfrm_address_t *saddr,
1439 const struct flowi *fl,
1440 struct xfrm_tmpl *tmpl,
1441 struct xfrm_policy *pol, int *err,
1442 unsigned short family);
1443struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1444 xfrm_address_t *daddr,
1445 xfrm_address_t *saddr,
1446 unsigned short family,
1447 u8 mode, u8 proto, u32 reqid);
Fan Duc4549972014-01-03 11:18:32 +08001448struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1449 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001450int xfrm_state_check_expire(struct xfrm_state *x);
1451void xfrm_state_insert(struct xfrm_state *x);
1452int xfrm_state_add(struct xfrm_state *x);
1453int xfrm_state_update(struct xfrm_state *x);
1454struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1455 const xfrm_address_t *daddr, __be32 spi,
1456 u8 proto, unsigned short family);
1457struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1458 const xfrm_address_t *daddr,
1459 const xfrm_address_t *saddr,
1460 u8 proto,
1461 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001462#ifdef CONFIG_XFRM_SUB_POLICY
Joe Perchesd5113372013-09-23 11:33:53 -07001463int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
Fan Du283bc9f2013-11-07 17:47:50 +08001464 unsigned short family, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001465int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1466 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001467#else
1468static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
Fan Du283bc9f2013-11-07 17:47:50 +08001469 int n, unsigned short family, struct net *net)
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001470{
1471 return -ENOSYS;
1472}
1473
1474static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1475 int n, unsigned short family)
1476{
1477 return -ENOSYS;
1478}
1479#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001480
1481struct xfrmk_sadinfo {
1482 u32 sadhcnt; /* current hash bkts */
1483 u32 sadhmcnt; /* max allowed hash bkts */
1484 u32 sadcnt; /* current running count */
1485};
1486
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001487struct xfrmk_spdinfo {
1488 u32 incnt;
1489 u32 outcnt;
1490 u32 fwdcnt;
1491 u32 inscnt;
1492 u32 outscnt;
1493 u32 fwdscnt;
1494 u32 spdhcnt;
1495 u32 spdhmcnt;
1496};
1497
Joe Perchesd5113372013-09-23 11:33:53 -07001498struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1499int xfrm_state_delete(struct xfrm_state *x);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001500int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -07001501void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1502void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1503u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1504int xfrm_init_replay(struct xfrm_state *x);
1505int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1506int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1507int xfrm_init_state(struct xfrm_state *x);
1508int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1509int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1510int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1511int xfrm_output_resume(struct sk_buff *skb, int err);
David Miller7026b1d2015-04-05 22:19:04 -04001512int xfrm_output(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001513int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1514void xfrm_local_error(struct sk_buff *skb, int mtu);
1515int xfrm4_extract_header(struct sk_buff *skb);
1516int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1517int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1518 int encap_type);
1519int xfrm4_transport_finish(struct sk_buff *skb, int async);
1520int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001521
1522static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1523{
Steffen Klassert70be6c92014-02-21 08:41:09 +01001524 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
Steffen Klassert33287152014-02-21 08:41:08 +01001525 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1526 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1527 return xfrm_input(skb, nexthdr, spi, 0);
Herbert Xuc4541b42007-10-17 21:28:53 -07001528}
1529
Joe Perchesd5113372013-09-23 11:33:53 -07001530int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1531int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric Dumazetaad88722014-04-15 13:47:15 -04001532int xfrm4_output(struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001533int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
Steffen Klassert33287152014-02-21 08:41:08 +01001534int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1535int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1536int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001537int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1538int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001539void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1540int xfrm6_extract_header(struct sk_buff *skb);
1541int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1542int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1543int xfrm6_transport_finish(struct sk_buff *skb, int async);
1544int xfrm6_rcv(struct sk_buff *skb);
1545int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1546 xfrm_address_t *saddr, u8 proto);
David S. Miller7b77d162013-09-30 15:11:00 -04001547void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001548int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1549int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1550int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001551int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
David S. Miller7b77d162013-09-30 15:11:00 -04001552int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001553__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1554__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1555int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1556int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric Dumazetaad88722014-04-15 13:47:15 -04001557int xfrm6_output(struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001558int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001559int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1560 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001561
1562#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001563int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1564int xfrm_user_policy(struct sock *sk, int optname,
1565 u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001566#else
1567static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1568{
1569 return -ENOPROTOOPT;
1570}
1571
James Chapman067b2072007-07-05 17:08:05 -07001572static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001573{
1574 /* should not happen */
1575 kfree_skb(skb);
1576 return 0;
1577}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001578#endif
1579
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001580struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001581
Joe Perchesd5113372013-09-23 11:33:53 -07001582void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1583int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1584 int (*func)(struct xfrm_policy *, int, int, void*),
1585 void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001586void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001587int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001588struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1589 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001590 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001591 struct xfrm_sec_ctx *ctx, int delete,
1592 int *err);
Joe Perchesd5113372013-09-23 11:33:53 -07001593struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1594 u32 id, int delete, int *err);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001595int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
Christophe Gouault880a6fa2014-08-29 16:16:05 +02001596void xfrm_policy_hash_rebuild(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597u32 xfrm_get_acqseq(void);
Fan Du776e9dd2013-12-16 18:47:49 +08001598int verify_spi_info(u8 proto, u32 min, u32 max);
Joe Perchesd5113372013-09-23 11:33:53 -07001599int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Mathias Krausee473fcb2013-06-26 23:56:58 +02001600struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001601 u8 mode, u32 reqid, u8 proto,
David S. Millera70486f2011-02-27 23:17:24 -08001602 const xfrm_address_t *daddr,
1603 const xfrm_address_t *saddr, int create,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001604 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001605int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001607#ifdef CONFIG_XFRM_MIGRATE
Joe Perchesd5113372013-09-23 11:33:53 -07001608int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1609 const struct xfrm_migrate *m, int num_bundles,
1610 const struct xfrm_kmaddress *k);
Fan Du283bc9f2013-11-07 17:47:50 +08001611struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001612struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1613 struct xfrm_migrate *m);
1614int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1615 struct xfrm_migrate *m, int num_bundles,
Fan Du8d549c42013-11-07 17:47:49 +08001616 struct xfrm_kmaddress *k, struct net *net);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001617#endif
1618
Joe Perchesd5113372013-09-23 11:33:53 -07001619int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1620void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1621int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1622 xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001623
Joe Perchesd5113372013-09-23 11:33:53 -07001624void xfrm_input_init(void);
1625int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001626
Joe Perchesd5113372013-09-23 11:33:53 -07001627void xfrm_probe_algs(void);
1628int xfrm_count_pfkey_auth_supported(void);
1629int xfrm_count_pfkey_enc_supported(void);
1630struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1631struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1632struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1633struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1634struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1635struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1636struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1637struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1638struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1639 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001640
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001641static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1642 const xfrm_address_t *b)
1643{
1644 return ipv6_addr_equal((const struct in6_addr *)a,
1645 (const struct in6_addr *)b);
1646}
1647
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001648static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1649 const xfrm_address_t *b,
1650 sa_family_t family)
1651{
1652 switch (family) {
1653 default:
1654 case AF_INET:
1655 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1656 case AF_INET6:
1657 return xfrm6_addr_equal(a, b);
1658 }
1659}
1660
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001661static inline int xfrm_policy_id2dir(u32 index)
1662{
1663 return index & 7;
1664}
1665
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001666#ifdef CONFIG_XFRM
1667static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001668{
Patrick McHardybe336902006-03-20 22:40:54 -08001669 struct sock *nlsk;
1670 int ret = 0;
1671
1672 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001673 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001674 if (nlsk)
1675 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1676 rcu_read_unlock();
1677 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001678}
Horia Geanta0f245582014-02-12 16:20:06 +02001679
1680static inline int xfrm_acquire_is_on(struct net *net)
1681{
1682 struct sock *nlsk;
1683 int ret = 0;
1684
1685 rcu_read_lock();
1686 nlsk = rcu_dereference(net->xfrm.nlsk);
1687 if (nlsk)
1688 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1689 rcu_read_unlock();
1690
1691 return ret;
1692}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001693#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001694
Steffen Klassertee5c2312014-02-19 13:33:24 +01001695static inline int aead_len(struct xfrm_algo_aead *alg)
1696{
1697 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1698}
1699
David S. Miller85158622011-02-27 23:07:02 -08001700static inline int xfrm_alg_len(const struct xfrm_algo *alg)
Eric Dumazet0f99be02008-01-08 23:39:06 -08001701{
1702 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1703}
1704
David S. Miller85158622011-02-27 23:07:02 -08001705static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
Martin Willi4447bb32009-11-25 00:29:52 +00001706{
1707 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1708}
1709
Steffen Klassert9736acf2011-03-08 00:05:43 +00001710static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1711{
1712 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1713}
1714
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001715#ifdef CONFIG_XFRM_MIGRATE
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001716static inline int xfrm_replay_clone(struct xfrm_state *x,
1717 struct xfrm_state *orig)
1718{
1719 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1720 GFP_KERNEL);
1721 if (!x->replay_esn)
1722 return -ENOMEM;
1723
1724 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1725 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1726
1727 x->preplay_esn = kmemdup(x->replay_esn,
1728 xfrm_replay_state_esn_len(x->replay_esn),
1729 GFP_KERNEL);
1730 if (!x->preplay_esn) {
1731 kfree(x->replay_esn);
1732 return -ENOMEM;
1733 }
1734
1735 return 0;
1736}
1737
Steffen Klassertee5c2312014-02-19 13:33:24 +01001738static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1739{
1740 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1741}
1742
1743
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001744static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1745{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001746 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001747}
1748
Martin Willi4447bb32009-11-25 00:29:52 +00001749static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1750{
1751 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1752}
1753
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001754static inline void xfrm_states_put(struct xfrm_state **states, int n)
1755{
1756 int i;
1757 for (i = 0; i < n; i++)
1758 xfrm_state_put(*(states + i));
1759}
1760
1761static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1762{
1763 int i;
1764 for (i = 0; i < n; i++)
1765 xfrm_state_delete(*(states + i));
1766}
1767#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001768
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001769#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001770static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1771{
1772 return skb->sp->xvec[skb->sp->len - 1];
1773}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001774#endif
Herbert Xu00501122007-12-11 01:53:43 -08001775
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001776static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1777{
1778 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001779 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001780 else
1781 m->v = m->m = 0;
1782
1783 return m->v & m->m;
1784}
1785
David S. Millere3dfa382011-02-27 23:20:19 -08001786static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001787{
David S. Miller1d1e34d2012-06-27 21:57:03 -07001788 int ret = 0;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001789
David S. Miller1d1e34d2012-06-27 21:57:03 -07001790 if (m->m | m->v)
1791 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1792 return ret;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001793}
1794
Steffen Klassert70be6c92014-02-21 08:41:09 +01001795static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1796 unsigned int family)
1797{
1798 bool tunnel = false;
1799
1800 switch(family) {
1801 case AF_INET:
1802 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1803 tunnel = true;
1804 break;
1805 case AF_INET6:
1806 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1807 tunnel = true;
1808 break;
1809 }
1810 if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
1811 return -EINVAL;
1812
1813 return 0;
1814}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815#endif /* _NET_XFRM_H */