blob: adfebd6f243c14d18b23988aa27c23c2a88f985e [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070016
17#include <net/sock.h>
18#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070019#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/route.h>
21#include <net/ipv6.h>
22#include <net/ip6_fib.h>
Timo Teräsfe1a5f02010-04-07 00:30:04 +000023#include <net/flow.h>
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -080024
25#include <linux/interrupt.h>
26
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080027#ifdef CONFIG_XFRM_STATISTICS
28#include <net/snmp.h>
29#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070030
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070031#define XFRM_PROTO_ESP 50
32#define XFRM_PROTO_AH 51
33#define XFRM_PROTO_COMP 108
34#define XFRM_PROTO_IPIP 4
35#define XFRM_PROTO_IPV6 41
36#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
Nicolas Dichtelfa9921e2011-02-02 06:29:02 +000039#define XFRM_ALIGN4(len) (((len) + 3) & ~3)
Linus Torvalds1da177e2005-04-16 15:20:36 -070040#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070041#define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070043#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070045
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080046#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080047#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080048#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080049#define XFRM_INC_STATS(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080050#endif
51
Linus Torvalds1da177e2005-04-16 15:20:36 -070052
53/* Organization of SPD aka "XFRM rules"
54 ------------------------------------
55
56 Basic objects:
57 - policy rule, struct xfrm_policy (=SPD entry)
58 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
59 - instance of a transformer, struct xfrm_state (=SA)
60 - template to clone xfrm_state, struct xfrm_tmpl
61
62 SPD is plain linear list of xfrm_policy rules, ordered by priority.
63 (To be compatible with existing pfkeyv2 implementations,
64 many rules with priority of 0x7fffffff are allowed to exist and
65 such rules are ordered in an unpredictable way, thanks to bsd folks.)
66
67 Lookup is plain linear search until the first match with selector.
68
69 If "action" is "block", then we prohibit the flow, otherwise:
70 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
71 policy entry has list of up to XFRM_MAX_DEPTH transformations,
72 described by templates xfrm_tmpl. Each template is resolved
73 to a complete xfrm_state (see below) and we pack bundle of transformations
74 to a dst_entry returned to requestor.
75
76 dst -. xfrm .-> xfrm_state #1
77 |---. child .-> dst -. xfrm .-> xfrm_state #2
78 |---. child .-> dst -. xfrm .-> xfrm_state #3
79 |---. child .-> NULL
80
81 Bundles are cached at xrfm_policy struct (field ->bundles).
82
83
84 Resolution of xrfm_tmpl
85 -----------------------
86 Template contains:
87 1. ->mode Mode: transport or tunnel
88 2. ->id.proto Protocol: AH/ESP/IPCOMP
89 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
90 Q: allow to resolve security gateway?
91 4. ->id.spi If not zero, static SPI.
92 5. ->saddr Local tunnel endpoint, ignored for transport mode.
93 6. ->algos List of allowed algos. Plain bitmask now.
94 Q: ealgos, aalgos, calgos. What a mess...
95 7. ->share Sharing mode.
96 Q: how to implement private sharing mode? To add struct sock* to
97 flow id?
98
99 Having this template we search through SAD searching for entries
100 with appropriate mode/proto/algo, permitted by selector.
101 If no appropriate entry found, it is requested from key manager.
102
103 PROBLEMS:
104 Q: How to find all the bundles referring to a physical path for
105 PMTU discovery? Seems, dst should contain list of all parents...
106 and enter to infinite locking hierarchy disaster.
107 No! It is easier, we will not search for them, let them find us.
108 We add genid to each dst plus pointer to genid of raw IP route,
109 pmtu disc will update pmtu on raw IP route and increase its genid.
110 dst_check() will see this for top level and trigger resyncing
111 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
112 */
113
Herbert Xu12a169e2008-10-01 07:03:24 -0700114struct xfrm_state_walk {
115 struct list_head all;
116 u8 state;
Nicolas Dichteld3623092014-02-14 15:30:36 +0100117 u8 dying;
118 u8 proto;
Herbert Xu12a169e2008-10-01 07:03:24 -0700119 u32 seq;
Nicolas Dichtel870a2df2014-03-06 18:24:29 +0100120 struct xfrm_address_filter *filter;
Herbert Xu12a169e2008-10-01 07:03:24 -0700121};
122
Linus Torvalds1da177e2005-04-16 15:20:36 -0700123/* Full description of state of transformer. */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000124struct xfrm_state {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500125 possible_net_t xs_net;
Herbert Xuabb81c42008-09-09 19:58:29 -0700126 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700127 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700128 struct hlist_node bydst;
129 };
David S. Miller8f126e32006-08-24 02:45:07 -0700130 struct hlist_node bysrc;
131 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132
133 atomic_t refcnt;
134 spinlock_t lock;
135
136 struct xfrm_id id;
137 struct xfrm_selector sel;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +0000138 struct xfrm_mark mark;
Martin Willi35d28562010-12-08 04:37:49 +0000139 u32 tfcpad;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140
David S. Miller9d4a7062006-08-24 03:18:09 -0700141 u32 genid;
142
Herbert Xu12a169e2008-10-01 07:03:24 -0700143 /* Key manager bits */
144 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700145
146 /* Parameters of this state. */
147 struct {
148 u32 reqid;
149 u8 mode;
150 u8 replay_window;
151 u8 aalgo, ealgo, calgo;
152 u8 flags;
153 u16 family;
154 xfrm_address_t saddr;
155 int header_len;
156 int trailer_len;
Nicolas Dichtela947b0a2013-02-22 10:54:54 +0100157 u32 extra_flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700158 } props;
159
160 struct xfrm_lifetime_cfg lft;
161
162 /* Data for transformer */
Martin Willi4447bb32009-11-25 00:29:52 +0000163 struct xfrm_algo_auth *aalg;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700164 struct xfrm_algo *ealg;
165 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800166 struct xfrm_algo_aead *aead;
Herbert Xu69b01372015-05-27 16:03:45 +0800167 const char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168
169 /* Data for encapsulator */
170 struct xfrm_encap_tmpl *encap;
171
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700172 /* Data for care-of address */
173 xfrm_address_t *coaddr;
174
Linus Torvalds1da177e2005-04-16 15:20:36 -0700175 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
176 struct xfrm_state *tunnel;
177
178 /* If a tunnel, number of users + 1 */
179 atomic_t tunnel_users;
180
181 /* State for replay detection */
182 struct xfrm_replay_state replay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000183 struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800185 /* Replay detection state at the time we sent the last notification */
186 struct xfrm_replay_state preplay;
Steffen Klassert9736acf2011-03-08 00:05:43 +0000187 struct xfrm_replay_state_esn *preplay_esn;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800188
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000189 /* The functions for replay detection. */
190 struct xfrm_replay *repl;
191
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700192 /* internal flag that only holds state for delayed aevent at the
193 * moment
194 */
195 u32 xflags;
196
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800197 /* Replay detection notification settings */
198 u32 replay_maxage;
199 u32 replay_maxdiff;
200
201 /* Replay detection notification timer */
202 struct timer_list rtimer;
203
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204 /* Statistics */
205 struct xfrm_stats stats;
206
207 struct xfrm_lifetime_cur curlft;
Yury Polyanskiy9e0d57f2009-11-08 20:58:41 -0800208 struct tasklet_hrtimer mtimer;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209
Fan Due3c0d042012-07-30 21:43:54 +0000210 /* used to fix curlft->add_time when changing date */
211 long saved_tmo;
212
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700213 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800214 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700215
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216 /* Reference to data common to all the instances of this
217 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800218 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700219 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700220 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700221 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222
Trent Jaegerdf718372005-12-13 23:12:27 -0800223 /* Security context */
224 struct xfrm_sec_ctx *security;
225
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226 /* Private data of this transformer, format is opaque,
227 * interpreted by xfrm_type methods. */
228 void *data;
229};
230
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800231static inline struct net *xs_net(struct xfrm_state *x)
232{
233 return read_pnet(&x->xs_net);
234}
235
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700236/* xflags - make enum if more show up */
237#define XFRM_TIME_DEFER 1
Fan Due3c0d042012-07-30 21:43:54 +0000238#define XFRM_SOFT_EXPIRE 2
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700239
Linus Torvalds1da177e2005-04-16 15:20:36 -0700240enum {
241 XFRM_STATE_VOID,
242 XFRM_STATE_ACQ,
243 XFRM_STATE_VALID,
244 XFRM_STATE_ERROR,
245 XFRM_STATE_EXPIRED,
246 XFRM_STATE_DEAD
247};
248
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700249/* callback structure passed from either netlink or pfkey */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000250struct km_event {
Herbert Xubf088672005-06-18 22:44:00 -0700251 union {
252 u32 hard;
253 u32 proto;
254 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800255 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700256 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700257 } data;
258
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700259 u32 seq;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000260 u32 portid;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700261 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800262 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700263};
264
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000265struct xfrm_replay {
266 void (*advance)(struct xfrm_state *x, __be32 net_seq);
267 int (*check)(struct xfrm_state *x,
268 struct sk_buff *skb,
269 __be32 net_seq);
Steffen Klassert3b59df42012-09-04 00:03:29 +0000270 int (*recheck)(struct xfrm_state *x,
271 struct sk_buff *skb,
272 __be32 net_seq);
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000273 void (*notify)(struct xfrm_state *x, int event);
274 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
275};
276
Herbert Xu25ee3282007-12-11 09:32:34 -0800277struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278struct xfrm_type;
279struct xfrm_dst;
280struct xfrm_policy_afinfo {
281 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800283 void (*garbage_collect)(struct net *net);
David Ahern42a7b322015-08-10 16:58:11 -0600284 struct dst_entry *(*dst_lookup)(struct net *net,
285 int tos, int oif,
David S. Miller5e6b9302011-02-24 00:14:45 -0500286 const xfrm_address_t *saddr,
287 const xfrm_address_t *daddr);
David Ahern42a7b322015-08-10 16:58:11 -0600288 int (*get_saddr)(struct net *net, int oif,
289 xfrm_address_t *saddr,
290 xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700291 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800292 struct flowi *fl,
293 int reverse);
David S. Miller05d84022011-02-22 17:47:10 -0800294 int (*get_tos)(const struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800295 int (*init_path)(struct xfrm_dst *path,
296 struct dst_entry *dst,
297 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800298 int (*fill_dst)(struct xfrm_dst *xdst,
Herbert Xu87c1e122010-03-02 02:51:56 +0000299 struct net_device *dev,
David S. Miller0c7b3ee2011-02-22 17:48:57 -0800300 const struct flowi *fl);
David S. Miller2774c132011-03-01 14:59:04 -0800301 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700302};
303
Joe Perchesd5113372013-09-23 11:33:53 -0700304int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
305int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
306void km_policy_notify(struct xfrm_policy *xp, int dir,
307 const struct km_event *c);
308void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309
310struct xfrm_tmpl;
Joe Perchesd5113372013-09-23 11:33:53 -0700311int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
312 struct xfrm_policy *pol);
313void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
314int __xfrm_state_delete(struct xfrm_state *x);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800315
Linus Torvalds1da177e2005-04-16 15:20:36 -0700316struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700317 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800318 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700319 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700320 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800321 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700322 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700323 int (*init_flags)(struct xfrm_state *x);
David S. Miller73e5ebb2011-02-22 17:51:44 -0800324 void (*init_tempsel)(struct xfrm_selector *sel,
325 const struct flowi *fl);
David S. Miller19bd6242011-02-24 00:07:20 -0500326 void (*init_temprop)(struct xfrm_state *x,
327 const struct xfrm_tmpl *tmpl,
328 const xfrm_address_t *daddr,
329 const xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700330 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
331 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Eric W. Biedermanede20592015-10-07 16:48:47 -0500332 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -0400333 int (*output_finish)(struct sock *sk, struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800334 int (*extract_input)(struct xfrm_state *x,
335 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800336 int (*extract_output)(struct xfrm_state *x,
337 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800338 int (*transport_finish)(struct sk_buff *skb,
339 int async);
Hannes Frederic Sowa628e3412013-08-14 13:05:23 +0200340 void (*local_error)(struct sk_buff *skb, u32 mtu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341};
342
Joe Perchesd5113372013-09-23 11:33:53 -0700343int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
344int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
345struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
346void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347
Steffen Klassert2f32b512014-03-14 07:28:07 +0100348struct xfrm_input_afinfo {
349 unsigned int family;
350 struct module *owner;
351 int (*callback)(struct sk_buff *skb, u8 protocol,
352 int err);
353};
354
355int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
356int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);
357
Joe Perchesd5113372013-09-23 11:33:53 -0700358void xfrm_state_delete_tunnel(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700359
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000360struct xfrm_type {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700361 char *description;
362 struct module *owner;
jamala6337462010-02-09 13:21:17 +0000363 u8 proto;
364 u8 flags;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700365#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700366#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800367#define XFRM_TYPE_LOCAL_COADDR 4
368#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369
Herbert Xu72cb6962005-06-20 13:18:08 -0700370 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700371 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800372 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
David S. Miller8f029de2011-02-22 17:59:59 -0800374 int (*reject)(struct xfrm_state *, struct sk_buff *,
375 const struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700376 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700378 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700379};
380
Joe Perchesd5113372013-09-23 11:33:53 -0700381int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
382int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700383
Herbert Xub59f45d2006-05-27 23:05:54 -0700384struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800385 /*
386 * Remove encapsulation header.
387 *
388 * The IP header will be moved over the top of the encapsulation
389 * header.
390 *
391 * On entry, the transport header shall point to where the IP header
392 * should be and the network header shall be set to where the IP
393 * header currently is. skb->data shall point to the start of the
394 * payload.
395 */
396 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
397
398 /*
399 * This is the actual input entry point.
400 *
401 * For transport mode and equivalent this would be identical to
402 * input2 (which does not need to be set). While tunnel mode
403 * and equivalent would set this to the tunnel encapsulation function
404 * xfrm4_prepare_input that would in turn call input2.
405 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700406 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700407
408 /*
409 * Add encapsulation header.
410 *
411 * On exit, the transport header will be set to the start of the
412 * encapsulation header to be filled in by x->type->output and
413 * the mac header will be set to the nextheader (protocol for
414 * IPv4) field of the extension header directly preceding the
415 * encapsulation header, or in its absence, that of the top IP
416 * header. The value of the network header will always point
417 * to the top IP header while skb->data will point to the payload.
418 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800419 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
420
421 /*
422 * This is the actual output entry point.
423 *
424 * For transport mode and equivalent this would be identical to
425 * output2 (which does not need to be set). While tunnel mode
426 * and equivalent would set this to a tunnel encapsulation function
427 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
428 * call output2.
429 */
430 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700431
Herbert Xu17c2a422007-10-17 21:33:12 -0700432 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700433 struct module *owner;
434 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700435 int flags;
436};
437
438/* Flags for xfrm_mode. */
439enum {
440 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700441};
442
Joe Perchesd5113372013-09-23 11:33:53 -0700443int xfrm_register_mode(struct xfrm_mode *mode, int family);
444int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700445
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700446static inline int xfrm_af2proto(unsigned int family)
447{
448 switch(family) {
449 case AF_INET:
450 return IPPROTO_IPIP;
451 case AF_INET6:
452 return IPPROTO_IPV6;
453 default:
454 return 0;
455 }
456}
457
458static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
459{
460 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
461 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
462 return x->inner_mode;
463 else
464 return x->inner_mode_iaf;
465}
466
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000467struct xfrm_tmpl {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700468/* id in template is interpreted as:
469 * daddr - destination of tunnel, may be zero for transport mode.
470 * spi - zero to acquire spi. Not zero if spi is static, then
471 * daddr must be fixed too.
472 * proto - AH/ESP/IPCOMP
473 */
474 struct xfrm_id id;
475
476/* Source address of tunnel. Ignored, if it is not a tunnel. */
477 xfrm_address_t saddr;
478
Miika Komu76b3f052006-11-30 16:40:43 -0800479 unsigned short encap_family;
480
jamala6337462010-02-09 13:21:17 +0000481 u32 reqid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700482
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700483/* Mode: transport, tunnel etc. */
jamala6337462010-02-09 13:21:17 +0000484 u8 mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700485
486/* Sharing mode: unique, this session only, this user only etc. */
jamala6337462010-02-09 13:21:17 +0000487 u8 share;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488
489/* May skip this transfomration if no SA is found */
jamala6337462010-02-09 13:21:17 +0000490 u8 optional;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700491
Herbert Xuc5d18e92008-04-22 00:46:42 -0700492/* Skip aalgos/ealgos/calgos checks. */
jamala6337462010-02-09 13:21:17 +0000493 u8 allalgs;
Herbert Xuc5d18e92008-04-22 00:46:42 -0700494
Linus Torvalds1da177e2005-04-16 15:20:36 -0700495/* Bit mask of algos allowed for acquisition */
jamala6337462010-02-09 13:21:17 +0000496 u32 aalgos;
497 u32 ealgos;
498 u32 calgos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499};
500
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700501#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700502
Herbert Xu12a169e2008-10-01 07:03:24 -0700503struct xfrm_policy_walk_entry {
504 struct list_head all;
505 u8 dead;
506};
507
508struct xfrm_policy_walk {
509 struct xfrm_policy_walk_entry walk;
510 u8 type;
511 u32 seq;
512};
513
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100514struct xfrm_policy_queue {
515 struct sk_buff_head hold_queue;
516 struct timer_list hold_timer;
517 unsigned long timeout;
518};
519
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000520struct xfrm_policy {
Eric W. Biederman0c5c9fb2015-03-11 23:06:44 -0500521 possible_net_t xp_net;
David S. Miller2518c7c2006-08-24 04:45:07 -0700522 struct hlist_node bydst;
523 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700524
525 /* This lock only affects elements except for entry. */
526 rwlock_t lock;
527 atomic_t refcnt;
528 struct timer_list timer;
529
Timo Teräsfe1a5f02010-04-07 00:30:04 +0000530 struct flow_cache_object flo;
Timo Teräs80c802f2010-04-07 00:30:05 +0000531 atomic_t genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700532 u32 priority;
533 u32 index;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +0000534 struct xfrm_mark mark;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700535 struct xfrm_selector selector;
536 struct xfrm_lifetime_cfg lft;
537 struct xfrm_lifetime_cur curlft;
Herbert Xu12a169e2008-10-01 07:03:24 -0700538 struct xfrm_policy_walk_entry walk;
Steffen Klasserta0073fe2013-02-05 12:52:55 +0100539 struct xfrm_policy_queue polq;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200540 u8 type;
541 u8 action;
542 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200543 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700544 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800545 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
Eric Dumazet56f04732015-12-08 07:22:01 -0800547 struct rcu_head rcu;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548};
549
David S. Miller63eb23f2011-02-24 01:25:19 -0500550static inline struct net *xp_net(const struct xfrm_policy *xp)
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800551{
552 return read_pnet(&xp->xp_net);
553}
554
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700555struct xfrm_kmaddress {
556 xfrm_address_t local;
557 xfrm_address_t remote;
558 u32 reserved;
559 u16 family;
560};
561
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800562struct xfrm_migrate {
563 xfrm_address_t old_daddr;
564 xfrm_address_t old_saddr;
565 xfrm_address_t new_daddr;
566 xfrm_address_t new_saddr;
567 u8 proto;
568 u8 mode;
569 u16 reserved;
570 u32 reqid;
571 u16 old_family;
572 u16 new_family;
573};
574
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800575#define XFRM_KM_TIMEOUT 30
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800576/* what happened */
577#define XFRM_REPLAY_UPDATE XFRM_AE_CR
578#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
579
580/* default aevent timeout in units of 100ms */
581#define XFRM_AE_ETIME 10
582/* Async Event timer multiplier */
583#define XFRM_AE_ETH_M 10
584/* default seq threshold size */
585#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000587struct xfrm_mgr {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 struct list_head list;
589 char *id;
David S. Miller214e0052011-02-24 00:02:38 -0500590 int (*notify)(struct xfrm_state *x, const struct km_event *c);
Fan Du65e07362012-08-15 10:13:47 +0800591 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700592 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800593 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
David S. Miller214e0052011-02-24 00:02:38 -0500594 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800595 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
David S. Miller183cad12011-02-24 00:28:01 -0500596 int (*migrate)(const struct xfrm_selector *sel,
597 u8 dir, u8 type,
598 const struct xfrm_migrate *m,
599 int num_bundles,
600 const struct xfrm_kmaddress *k);
Horia Geanta0f245582014-02-12 16:20:06 +0200601 bool (*is_alive)(const struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700602};
603
Joe Perchesd5113372013-09-23 11:33:53 -0700604int xfrm_register_km(struct xfrm_mgr *km);
605int xfrm_unregister_km(struct xfrm_mgr *km);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606
Steffen Klassert70be6c92014-02-21 08:41:09 +0100607struct xfrm_tunnel_skb_cb {
608 union {
609 struct inet_skb_parm h4;
610 struct inet6_skb_parm h6;
611 } header;
612
613 union {
614 struct ip_tunnel *ip4;
615 struct ip6_tnl *ip6;
616 } tunnel;
617};
618
619#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
620
Herbert Xu436a0a42007-10-08 17:25:53 -0700621/*
622 * This structure is used for the duration where packets are being
623 * transformed by IPsec. As soon as the packet leaves IPsec the
624 * area beyond the generic IP part may be overwritten.
625 */
626struct xfrm_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100627 struct xfrm_tunnel_skb_cb header;
Herbert Xu436a0a42007-10-08 17:25:53 -0700628
629 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800630 union {
Steffen Klassert1ce36442011-03-08 00:06:31 +0000631 struct {
632 __u32 low;
633 __u32 hi;
634 } output;
635 struct {
636 __be32 low;
637 __be32 hi;
638 } input;
Herbert Xub318e0e2008-02-12 22:50:35 -0800639 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700640};
641
642#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
643
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800644/*
645 * This structure is used by the afinfo prepare_input/prepare_output functions
646 * to transmit header information to the mode input/output functions.
647 */
648struct xfrm_mode_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100649 struct xfrm_tunnel_skb_cb header;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800650
651 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
652 __be16 id;
653 __be16 frag_off;
654
Herbert Xu732c8bd2008-03-26 16:51:09 -0700655 /* IP header length (excluding options or extension headers). */
656 u8 ihl;
657
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800658 /* TOS for IPv4, class for IPv6. */
659 u8 tos;
660
661 /* TTL for IPv4, hop limitfor IPv6. */
662 u8 ttl;
663
664 /* Protocol for IPv4, NH for IPv6. */
665 u8 protocol;
666
Herbert Xu732c8bd2008-03-26 16:51:09 -0700667 /* Option length for IPv4, zero for IPv6. */
668 u8 optlen;
669
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800670 /* Used by IPv6 only, zero for IPv4. */
671 u8 flow_lbl[3];
672};
673
674#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
675
Herbert Xu716062f2007-11-13 21:44:23 -0800676/*
677 * This structure is used by the input processing to locate the SPI and
678 * related information.
679 */
680struct xfrm_spi_skb_cb {
Steffen Klassert70be6c92014-02-21 08:41:09 +0100681 struct xfrm_tunnel_skb_cb header;
Herbert Xu716062f2007-11-13 21:44:23 -0800682
Herbert Xu716062f2007-11-13 21:44:23 -0800683 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800684 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800685};
686
687#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
688
Joy Lattenc9204d92006-11-30 15:50:43 -0600689#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800690static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700691{
692 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800693
694 if (audit_enabled == 0)
695 return NULL;
696 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
697 AUDIT_MAC_IPSEC_EVENT);
698 if (audit_buf == NULL)
699 return NULL;
700 audit_log_format(audit_buf, "op=%s", op);
701 return audit_buf;
702}
703
Tetsuo Handa2e710292014-04-22 21:48:30 +0900704static inline void xfrm_audit_helper_usrinfo(bool task_valid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800705 struct audit_buffer *audit_buf)
706{
Tetsuo Handa2e710292014-04-22 21:48:30 +0900707 const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
708 audit_get_loginuid(current) :
709 INVALID_UID);
710 const unsigned int ses = task_valid ? audit_get_sessionid(current) :
711 (unsigned int) -1;
712
713 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Tetsuo Handaf1370cc2014-04-18 16:23:46 +0900714 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700715}
716
Tetsuo Handa2e710292014-04-22 21:48:30 +0900717void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
718void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
719 bool task_valid);
720void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
721void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -0700722void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
723 struct sk_buff *skb);
724void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
725 __be32 net_seq);
726void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
727void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
728 __be32 net_seq);
729void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
730 u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600731#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700732
733static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900734 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700735{
736}
737
738static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900739 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700740{
741}
742
743static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900744 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700745{
746}
747
748static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Tetsuo Handa2e710292014-04-22 21:48:30 +0900749 bool task_valid)
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700750{
751}
752
753static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
754 struct sk_buff *skb)
755{
756}
757
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000758static inline void xfrm_audit_state_replay(struct xfrm_state *x,
759 struct sk_buff *skb, __be32 net_seq)
760{
761}
762
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700763static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
764 u16 family)
765{
766}
767
768static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
769 __be32 net_spi, __be32 net_seq)
770{
771}
772
773static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
774 struct sk_buff *skb, u8 proto)
775{
776}
Joy Lattenc9204d92006-11-30 15:50:43 -0600777#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600778
Linus Torvalds1da177e2005-04-16 15:20:36 -0700779static inline void xfrm_pol_hold(struct xfrm_policy *policy)
780{
781 if (likely(policy != NULL))
782 atomic_inc(&policy->refcnt);
783}
784
Joe Perchesd5113372013-09-23 11:33:53 -0700785void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786
787static inline void xfrm_pol_put(struct xfrm_policy *policy)
788{
789 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800790 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700791}
792
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700793static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
794{
795 int i;
796 for (i = npols - 1; i >= 0; --i)
797 xfrm_pol_put(pols[i]);
798}
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700799
Joe Perchesd5113372013-09-23 11:33:53 -0700800void __xfrm_state_destroy(struct xfrm_state *);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700801
Herbert Xu21380b82006-02-22 14:47:13 -0800802static inline void __xfrm_state_put(struct xfrm_state *x)
803{
804 atomic_dec(&x->refcnt);
805}
806
Linus Torvalds1da177e2005-04-16 15:20:36 -0700807static inline void xfrm_state_put(struct xfrm_state *x)
808{
809 if (atomic_dec_and_test(&x->refcnt))
810 __xfrm_state_destroy(x);
811}
812
813static inline void xfrm_state_hold(struct xfrm_state *x)
814{
815 atomic_inc(&x->refcnt);
816}
817
David S. Miller1744a8f2011-02-22 18:02:12 -0800818static inline bool addr_match(const void *token1, const void *token2,
819 int prefixlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700820{
David S. Miller1744a8f2011-02-22 18:02:12 -0800821 const __be32 *a1 = token1;
822 const __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700823 int pdw;
824 int pbi;
825
jamala6337462010-02-09 13:21:17 +0000826 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700827 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
828
829 if (pdw)
830 if (memcmp(a1, a2, pdw << 2))
David S. Miller1744a8f2011-02-22 18:02:12 -0800831 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700832
833 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700834 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700835
836 mask = htonl((0xffffffff) << (32 - pbi));
837
838 if ((a1[pdw] ^ a2[pdw]) & mask)
David S. Miller1744a8f2011-02-22 18:02:12 -0800839 return false;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700840 }
841
David S. Miller1744a8f2011-02-22 18:02:12 -0800842 return true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843}
844
Alexey Dobriyan26bff942011-11-22 06:46:02 +0000845static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
846{
847 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
848 if (prefixlen == 0)
849 return true;
850 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
851}
852
Linus Torvalds1da177e2005-04-16 15:20:36 -0700853static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500854__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700855{
Al Virof9d07e41f82006-09-27 18:45:50 -0700856 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500857 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700858 case IPPROTO_TCP:
859 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800860 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700861 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500862 port = uli->ports.sport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700863 break;
864 case IPPROTO_ICMP:
865 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500866 port = htons(uli->icmpt.type);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700867 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700868 case IPPROTO_MH:
David S. Miller6281dcc2011-03-12 00:43:55 -0500869 port = htons(uli->mht.type);
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700870 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000871 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500872 port = htons(ntohl(uli->gre_key) >> 16);
Timo Teräscc9ff192010-11-03 04:41:38 +0000873 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700874 default:
875 port = 0; /*XXX*/
876 }
877 return port;
878}
879
880static __inline__
David S. Miller6281dcc2011-03-12 00:43:55 -0500881__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700882{
Al Virof9d07e41f82006-09-27 18:45:50 -0700883 __be16 port;
David S. Miller1d28f422011-03-12 00:29:39 -0500884 switch(fl->flowi_proto) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700885 case IPPROTO_TCP:
886 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800887 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700888 case IPPROTO_SCTP:
David S. Miller6281dcc2011-03-12 00:43:55 -0500889 port = uli->ports.dport;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700890 break;
891 case IPPROTO_ICMP:
892 case IPPROTO_ICMPV6:
David S. Miller6281dcc2011-03-12 00:43:55 -0500893 port = htons(uli->icmpt.code);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700894 break;
Timo Teräscc9ff192010-11-03 04:41:38 +0000895 case IPPROTO_GRE:
David S. Miller6281dcc2011-03-12 00:43:55 -0500896 port = htons(ntohl(uli->gre_key) & 0xffff);
Timo Teräscc9ff192010-11-03 04:41:38 +0000897 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700898 default:
899 port = 0; /*XXX*/
900 }
901 return port;
902}
903
Joe Perchesd5113372013-09-23 11:33:53 -0700904bool xfrm_selector_match(const struct xfrm_selector *sel,
905 const struct flowi *fl, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700906
Trent Jaegerdf718372005-12-13 23:12:27 -0800907#ifdef CONFIG_SECURITY_NETWORK_XFRM
908/* If neither has a context --> match
909 * Otherwise, both must have a context and the sids, doi, alg must match
910 */
David S. Millerbc9b35a2012-05-15 15:04:57 -0400911static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800912{
913 return ((!s1 && !s2) ||
914 (s1 && s2 &&
915 (s1->ctx_sid == s2->ctx_sid) &&
916 (s1->ctx_doi == s2->ctx_doi) &&
917 (s1->ctx_alg == s2->ctx_alg)));
918}
919#else
David S. Millerbc9b35a2012-05-15 15:04:57 -0400920static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
Trent Jaegerdf718372005-12-13 23:12:27 -0800921{
David S. Millerbc9b35a2012-05-15 15:04:57 -0400922 return true;
Trent Jaegerdf718372005-12-13 23:12:27 -0800923}
924#endif
925
Linus Torvalds1da177e2005-04-16 15:20:36 -0700926/* A struct encoding bundle of transformations to apply to some set of flow.
927 *
928 * dst->child points to the next element of bundle.
929 * dst->xfrm points to an instanse of transformer.
930 *
931 * Due to unfortunate limitations of current routing cache, which we
932 * have no time to fix, it mirrors struct rtable and bound to the same
933 * routing key, including saddr,daddr. However, we can have many of
934 * bundles differing by session id. All the bundles grow from a parent
935 * policy rule.
936 */
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000937struct xfrm_dst {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700938 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700939 struct dst_entry dst;
940 struct rtable rt;
941 struct rt6_info rt6;
942 } u;
943 struct dst_entry *route;
Timo Teräs80c802f2010-04-07 00:30:05 +0000944 struct flow_cache_object flo;
945 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
946 int num_pols, num_xfrms;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700947#ifdef CONFIG_XFRM_SUB_POLICY
948 struct flowi *origin;
949 struct xfrm_selector *partner;
950#endif
Timo Teräs80c802f2010-04-07 00:30:05 +0000951 u32 xfrm_genid;
952 u32 policy_genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700953 u32 route_mtu_cached;
954 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63dec2005-05-26 12:58:04 -0700955 u32 route_cookie;
956 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700957};
958
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700959#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700960static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
961{
Timo Teräs80c802f2010-04-07 00:30:05 +0000962 xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xuaabc9762005-05-03 16:27:10 -0700963 dst_release(xdst->route);
964 if (likely(xdst->u.dst.xfrm))
965 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700966#ifdef CONFIG_XFRM_SUB_POLICY
967 kfree(xdst->origin);
968 xdst->origin = NULL;
969 kfree(xdst->partner);
970 xdst->partner = NULL;
971#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700972}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700973#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700974
Joe Perchesd5113372013-09-23 11:33:53 -0700975void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
Herbert Xuaabc9762005-05-03 16:27:10 -0700976
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000977struct sec_path {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700978 atomic_t refcnt;
979 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800980 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700981};
982
Michael Smith990078a2011-04-07 04:51:51 +0000983static inline int secpath_exists(struct sk_buff *skb)
984{
985#ifdef CONFIG_XFRM
986 return skb->sp != NULL;
987#else
988 return 0;
989#endif
990}
991
Linus Torvalds1da177e2005-04-16 15:20:36 -0700992static inline struct sec_path *
993secpath_get(struct sec_path *sp)
994{
995 if (sp)
996 atomic_inc(&sp->refcnt);
997 return sp;
998}
999
Joe Perchesd5113372013-09-23 11:33:53 -07001000void __secpath_destroy(struct sec_path *sp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001001
1002static inline void
1003secpath_put(struct sec_path *sp)
1004{
1005 if (sp && atomic_dec_and_test(&sp->refcnt))
1006 __secpath_destroy(sp);
1007}
1008
Joe Perchesd5113372013-09-23 11:33:53 -07001009struct sec_path *secpath_dup(struct sec_path *src);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001010
1011static inline void
1012secpath_reset(struct sk_buff *skb)
1013{
1014#ifdef CONFIG_XFRM
1015 secpath_put(skb->sp);
1016 skb->sp = NULL;
1017#endif
1018}
1019
1020static inline int
David S. Miller6cc32962011-02-24 00:19:59 -05001021xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001022{
1023 switch (family) {
1024 case AF_INET:
1025 return addr->a4 == 0;
1026 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001027 return ipv6_addr_any(&addr->in6);
Patrick McHardya1e59ab2006-09-19 12:57:34 -07001028 }
1029 return 0;
1030}
1031
1032static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001033__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001034{
1035 return (tmpl->saddr.a4 &&
1036 tmpl->saddr.a4 != x->props.saddr.a4);
1037}
1038
1039static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001040__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001041{
1042 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001043 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
Linus Torvalds1da177e2005-04-16 15:20:36 -07001044}
1045
1046static inline int
David S. Miller21eddb52011-02-24 01:35:16 -05001047xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001048{
1049 switch (family) {
1050 case AF_INET:
1051 return __xfrm4_state_addr_cmp(tmpl, x);
1052 case AF_INET6:
1053 return __xfrm6_state_addr_cmp(tmpl, x);
1054 }
1055 return !0;
1056}
1057
1058#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001059int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1060 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001061
Herbert Xud5422ef2007-12-12 10:44:16 -08001062static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1063 struct sk_buff *skb,
1064 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001065{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001066 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -08001067 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1068
Linus Torvalds1da177e2005-04-16 15:20:36 -07001069 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -08001070 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001071
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -08001072 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001073 (skb_dst(skb)->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -08001074 __xfrm_policy_check(sk, ndir, skb, family);
1075}
1076
1077static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1078{
1079 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001080}
1081
1082static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1083{
1084 return xfrm_policy_check(sk, dir, skb, AF_INET);
1085}
1086
1087static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1088{
1089 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1090}
1091
Herbert Xud5422ef2007-12-12 10:44:16 -08001092static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1093 struct sk_buff *skb)
1094{
1095 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1096}
1097
1098static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1099 struct sk_buff *skb)
1100{
1101 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1102}
1103
Joe Perchesd5113372013-09-23 11:33:53 -07001104int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1105 unsigned int family, int reverse);
Herbert Xud5422ef2007-12-12 10:44:16 -08001106
1107static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1108 unsigned int family)
1109{
1110 return __xfrm_decode_session(skb, fl, family, 0);
1111}
1112
1113static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1114 struct flowi *fl,
1115 unsigned int family)
1116{
1117 return __xfrm_decode_session(skb, fl, family, 1);
1118}
1119
Joe Perchesd5113372013-09-23 11:33:53 -07001120int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001121
1122static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1123{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001124 struct net *net = dev_net(skb->dev);
1125
1126 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazetadf30902009-06-02 05:19:30 +00001127 (skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001128 __xfrm_route_forward(skb, family);
1129}
1130
1131static inline int xfrm4_route_forward(struct sk_buff *skb)
1132{
1133 return xfrm_route_forward(skb, AF_INET);
1134}
1135
1136static inline int xfrm6_route_forward(struct sk_buff *skb)
1137{
1138 return xfrm_route_forward(skb, AF_INET6);
1139}
1140
Eric Dumazetd188ba82015-12-08 07:22:02 -08001141int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001142
Eric Dumazetd188ba82015-12-08 07:22:02 -08001143static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001144{
Eric Dumazetd188ba82015-12-08 07:22:02 -08001145 sk->sk_policy[0] = NULL;
1146 sk->sk_policy[1] = NULL;
1147 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1148 return __xfrm_sk_clone_policy(sk, osk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001149 return 0;
1150}
1151
Joe Perchesd5113372013-09-23 11:33:53 -07001152int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001153
1154static inline void xfrm_sk_free_policy(struct sock *sk)
1155{
Eric Dumazetd188ba82015-12-08 07:22:02 -08001156 struct xfrm_policy *pol;
1157
1158 pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1159 if (unlikely(pol != NULL)) {
1160 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001161 sk->sk_policy[0] = NULL;
1162 }
Eric Dumazetd188ba82015-12-08 07:22:02 -08001163 pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1164 if (unlikely(pol != NULL)) {
1165 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001166 sk->sk_policy[1] = NULL;
1167 }
1168}
1169
Joe Perchesd5113372013-09-23 11:33:53 -07001170void xfrm_garbage_collect(struct net *net);
Paul Mooree4c17212013-05-29 07:36:25 +00001171
Linus Torvalds1da177e2005-04-16 15:20:36 -07001172#else
1173
1174static inline void xfrm_sk_free_policy(struct sock *sk) {}
Eric Dumazetd188ba82015-12-08 07:22:02 -08001175static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001176static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1177static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1178static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1179{
1180 return 1;
1181}
1182static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1183{
1184 return 1;
1185}
1186static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1187{
1188 return 1;
1189}
Herbert Xud5422ef2007-12-12 10:44:16 -08001190static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1191 struct flowi *fl,
1192 unsigned int family)
1193{
1194 return -ENOSYS;
1195}
1196static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1197 struct sk_buff *skb)
1198{
1199 return 1;
1200}
1201static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1202 struct sk_buff *skb)
1203{
1204 return 1;
1205}
Paul Mooree4c17212013-05-29 07:36:25 +00001206static inline void xfrm_garbage_collect(struct net *net)
1207{
1208}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001209#endif
1210
1211static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001212xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001213{
1214 switch (family){
1215 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001216 return (xfrm_address_t *)&fl->u.ip4.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001217 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001218 return (xfrm_address_t *)&fl->u.ip6.daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001219 }
1220 return NULL;
1221}
1222
1223static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001224xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001225{
1226 switch (family){
1227 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001228 return (xfrm_address_t *)&fl->u.ip4.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001229 case AF_INET6:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001230 return (xfrm_address_t *)&fl->u.ip6.saddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001231 }
1232 return NULL;
1233}
1234
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001235static __inline__
David S. Millere8a4e372011-02-22 17:42:56 -08001236void xfrm_flowi_addr_get(const struct flowi *fl,
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001237 xfrm_address_t *saddr, xfrm_address_t *daddr,
1238 unsigned short family)
1239{
1240 switch(family) {
1241 case AF_INET:
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001242 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1243 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001244 break;
1245 case AF_INET6:
Jiri Benc15e318b2015-03-29 16:59:24 +02001246 saddr->in6 = fl->u.ip6.saddr;
1247 daddr->in6 = fl->u.ip6.daddr;
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001248 break;
1249 }
1250}
1251
Linus Torvalds1da177e2005-04-16 15:20:36 -07001252static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001253__xfrm4_state_addr_check(const struct xfrm_state *x,
1254 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001255{
1256 if (daddr->a4 == x->id.daddr.a4 &&
1257 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1258 return 1;
1259 return 0;
1260}
1261
1262static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001263__xfrm6_state_addr_check(const struct xfrm_state *x,
1264 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001265{
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001266 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1267 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001268 ipv6_addr_any((struct in6_addr *)saddr) ||
1269 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1270 return 1;
1271 return 0;
1272}
1273
1274static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001275xfrm_state_addr_check(const struct xfrm_state *x,
1276 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001277 unsigned short family)
1278{
1279 switch (family) {
1280 case AF_INET:
1281 return __xfrm4_state_addr_check(x, daddr, saddr);
1282 case AF_INET6:
1283 return __xfrm6_state_addr_check(x, daddr, saddr);
1284 }
1285 return 0;
1286}
1287
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001288static __inline__ int
David S. Millerf8848062011-02-24 01:42:28 -05001289xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001290 unsigned short family)
1291{
1292 switch (family) {
1293 case AF_INET:
1294 return __xfrm4_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001295 (const xfrm_address_t *)&fl->u.ip4.daddr,
1296 (const xfrm_address_t *)&fl->u.ip4.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001297 case AF_INET6:
1298 return __xfrm6_state_addr_check(x,
David S. Miller7e1dc7b2011-03-12 02:42:11 -05001299 (const xfrm_address_t *)&fl->u.ip6.daddr,
1300 (const xfrm_address_t *)&fl->u.ip6.saddr);
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001301 }
1302 return 0;
1303}
1304
David S. Millerf8848062011-02-24 01:42:28 -05001305static inline int xfrm_state_kern(const struct xfrm_state *x)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001306{
1307 return atomic_read(&x->tunnel_users);
1308}
1309
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001310static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1311{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001312 return (!userproto || proto == userproto ||
1313 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1314 proto == IPPROTO_ESP ||
1315 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001316}
1317
Linus Torvalds1da177e2005-04-16 15:20:36 -07001318/*
1319 * xfrm algorithm information
1320 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001321struct xfrm_algo_aead_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001322 char *geniv;
Herbert Xu1a6509d2008-01-28 19:37:29 -08001323 u16 icv_truncbits;
1324};
1325
Linus Torvalds1da177e2005-04-16 15:20:36 -07001326struct xfrm_algo_auth_info {
1327 u16 icv_truncbits;
1328 u16 icv_fullbits;
1329};
1330
1331struct xfrm_algo_encr_info {
Herbert Xu165ecc62015-05-27 16:03:44 +08001332 char *geniv;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333 u16 blockbits;
1334 u16 defkeybits;
1335};
1336
1337struct xfrm_algo_comp_info {
1338 u16 threshold;
1339};
1340
1341struct xfrm_algo_desc {
1342 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001343 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001344 u8 available:1;
Jussi Kivilinna7e50f842013-01-31 12:40:38 +02001345 u8 pfkey_supported:1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001346 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001347 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001348 struct xfrm_algo_auth_info auth;
1349 struct xfrm_algo_encr_info encr;
1350 struct xfrm_algo_comp_info comp;
1351 } uinfo;
1352 struct sadb_alg desc;
1353};
1354
Steffen Klassert33287152014-02-21 08:41:08 +01001355/* XFRM protocol handlers. */
1356struct xfrm4_protocol {
1357 int (*handler)(struct sk_buff *skb);
1358 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1359 int encap_type);
1360 int (*cb_handler)(struct sk_buff *skb, int err);
1361 int (*err_handler)(struct sk_buff *skb, u32 info);
1362
1363 struct xfrm4_protocol __rcu *next;
1364 int priority;
1365};
1366
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001367struct xfrm6_protocol {
1368 int (*handler)(struct sk_buff *skb);
1369 int (*cb_handler)(struct sk_buff *skb, int err);
1370 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1371 u8 type, u8 code, int offset, __be32 info);
1372
1373 struct xfrm6_protocol __rcu *next;
1374 int priority;
1375};
1376
Linus Torvalds1da177e2005-04-16 15:20:36 -07001377/* XFRM tunnel handlers. */
1378struct xfrm_tunnel {
1379 int (*handler)(struct sk_buff *skb);
jamala6337462010-02-09 13:21:17 +00001380 int (*err_handler)(struct sk_buff *skb, u32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001381
Eric Dumazetb33eab02010-10-25 21:01:26 +00001382 struct xfrm_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001383 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001384};
1385
1386struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001387 int (*handler)(struct sk_buff *skb);
1388 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Brian Haleyd5fdd6b2009-06-23 04:31:07 -07001389 u8 type, u8 code, int offset, __be32 info);
Eric Dumazet6f0bcf12010-10-24 21:33:16 +00001390 struct xfrm6_tunnel __rcu *next;
Herbert Xud2acc342006-03-28 01:12:13 -08001391 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001392};
1393
Joe Perchesd5113372013-09-23 11:33:53 -07001394void xfrm_init(void);
1395void xfrm4_init(void);
1396int xfrm_state_init(struct net *net);
1397void xfrm_state_fini(struct net *net);
1398void xfrm4_state_init(void);
Steffen Klassert2f32b512014-03-14 07:28:07 +01001399void xfrm4_protocol_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001400#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001401int xfrm6_init(void);
1402void xfrm6_fini(void);
1403int xfrm6_state_init(void);
1404void xfrm6_state_fini(void);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001405int xfrm6_protocol_init(void);
1406void xfrm6_protocol_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001407#else
1408static inline int xfrm6_init(void)
1409{
1410 return 0;
1411}
1412static inline void xfrm6_fini(void)
1413{
1414 ;
1415}
1416#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001417
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001418#ifdef CONFIG_XFRM_STATISTICS
Joe Perchesd5113372013-09-23 11:33:53 -07001419int xfrm_proc_init(struct net *net);
1420void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001421#endif
1422
Joe Perchesd5113372013-09-23 11:33:53 -07001423int xfrm_sysctl_init(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001424#ifdef CONFIG_SYSCTL
Joe Perchesd5113372013-09-23 11:33:53 -07001425void xfrm_sysctl_fini(struct net *net);
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001426#else
1427static inline void xfrm_sysctl_fini(struct net *net)
1428{
1429}
1430#endif
1431
Nicolas Dichteld3623092014-02-14 15:30:36 +01001432void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
Nicolas Dichtel870a2df2014-03-06 18:24:29 +01001433 struct xfrm_address_filter *filter);
Joe Perchesd5113372013-09-23 11:33:53 -07001434int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1435 int (*func)(struct xfrm_state *, int, void*), void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001436void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001437struct xfrm_state *xfrm_state_alloc(struct net *net);
1438struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1439 const xfrm_address_t *saddr,
1440 const struct flowi *fl,
1441 struct xfrm_tmpl *tmpl,
1442 struct xfrm_policy *pol, int *err,
1443 unsigned short family);
1444struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1445 xfrm_address_t *daddr,
1446 xfrm_address_t *saddr,
1447 unsigned short family,
1448 u8 mode, u8 proto, u32 reqid);
Fan Duc4549972014-01-03 11:18:32 +08001449struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1450 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001451int xfrm_state_check_expire(struct xfrm_state *x);
1452void xfrm_state_insert(struct xfrm_state *x);
1453int xfrm_state_add(struct xfrm_state *x);
1454int xfrm_state_update(struct xfrm_state *x);
1455struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1456 const xfrm_address_t *daddr, __be32 spi,
1457 u8 proto, unsigned short family);
1458struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1459 const xfrm_address_t *daddr,
1460 const xfrm_address_t *saddr,
1461 u8 proto,
1462 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001463#ifdef CONFIG_XFRM_SUB_POLICY
Joe Perchesd5113372013-09-23 11:33:53 -07001464int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
Fan Du283bc9f2013-11-07 17:47:50 +08001465 unsigned short family, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001466int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1467 unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001468#else
1469static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
Fan Du283bc9f2013-11-07 17:47:50 +08001470 int n, unsigned short family, struct net *net)
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001471{
1472 return -ENOSYS;
1473}
1474
1475static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1476 int n, unsigned short family)
1477{
1478 return -ENOSYS;
1479}
1480#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001481
1482struct xfrmk_sadinfo {
1483 u32 sadhcnt; /* current hash bkts */
1484 u32 sadhmcnt; /* max allowed hash bkts */
1485 u32 sadcnt; /* current running count */
1486};
1487
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001488struct xfrmk_spdinfo {
1489 u32 incnt;
1490 u32 outcnt;
1491 u32 fwdcnt;
1492 u32 inscnt;
1493 u32 outscnt;
1494 u32 fwdscnt;
1495 u32 spdhcnt;
1496 u32 spdhmcnt;
1497};
1498
Joe Perchesd5113372013-09-23 11:33:53 -07001499struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1500int xfrm_state_delete(struct xfrm_state *x);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001501int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
Joe Perchesd5113372013-09-23 11:33:53 -07001502void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1503void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1504u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1505int xfrm_init_replay(struct xfrm_state *x);
1506int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1507int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1508int xfrm_init_state(struct xfrm_state *x);
1509int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1510int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1511int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1512int xfrm_output_resume(struct sk_buff *skb, int err);
David Miller7026b1d2015-04-05 22:19:04 -04001513int xfrm_output(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001514int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1515void xfrm_local_error(struct sk_buff *skb, int mtu);
1516int xfrm4_extract_header(struct sk_buff *skb);
1517int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1518int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1519 int encap_type);
1520int xfrm4_transport_finish(struct sk_buff *skb, int async);
1521int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001522
1523static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1524{
Steffen Klassert70be6c92014-02-21 08:41:09 +01001525 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
Steffen Klassert33287152014-02-21 08:41:08 +01001526 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1527 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1528 return xfrm_input(skb, nexthdr, spi, 0);
Herbert Xuc4541b42007-10-17 21:28:53 -07001529}
1530
Joe Perchesd5113372013-09-23 11:33:53 -07001531int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1532int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric W. Biedermanede20592015-10-07 16:48:47 -05001533int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001534int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
Steffen Klassert33287152014-02-21 08:41:08 +01001535int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1536int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1537int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001538int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1539int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001540void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1541int xfrm6_extract_header(struct sk_buff *skb);
1542int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1543int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1544int xfrm6_transport_finish(struct sk_buff *skb, int async);
1545int xfrm6_rcv(struct sk_buff *skb);
1546int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1547 xfrm_address_t *saddr, u8 proto);
David S. Miller7b77d162013-09-30 15:11:00 -04001548void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
Steffen Klassert7e14ea12014-03-14 07:28:07 +01001549int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1550int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1551int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
Joe Perchesd5113372013-09-23 11:33:53 -07001552int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
David S. Miller7b77d162013-09-30 15:11:00 -04001553int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001554__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1555__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1556int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1557int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Eric W. Biedermanede20592015-10-07 16:48:47 -05001558int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
David Miller7026b1d2015-04-05 22:19:04 -04001559int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
Joe Perchesd5113372013-09-23 11:33:53 -07001560int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1561 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001562
1563#ifdef CONFIG_XFRM
Joe Perchesd5113372013-09-23 11:33:53 -07001564int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1565int xfrm_user_policy(struct sock *sk, int optname,
1566 u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001567#else
1568static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1569{
1570 return -ENOPROTOOPT;
1571}
1572
James Chapman067b2072007-07-05 17:08:05 -07001573static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001574{
1575 /* should not happen */
1576 kfree_skb(skb);
1577 return 0;
1578}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001579#endif
1580
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001581struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001582
Joe Perchesd5113372013-09-23 11:33:53 -07001583void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1584int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1585 int (*func)(struct xfrm_policy *, int, int, void*),
1586 void *);
Fan Du283bc9f2013-11-07 17:47:50 +08001587void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Jamal Hadi Salim8ca2e932010-02-22 11:32:57 +00001589struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1590 u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001591 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001592 struct xfrm_sec_ctx *ctx, int delete,
1593 int *err);
Joe Perchesd5113372013-09-23 11:33:53 -07001594struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1595 u32 id, int delete, int *err);
Tetsuo Handa2e710292014-04-22 21:48:30 +09001596int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
Christophe Gouault880a6fa2014-08-29 16:16:05 +02001597void xfrm_policy_hash_rebuild(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001598u32 xfrm_get_acqseq(void);
Fan Du776e9dd2013-12-16 18:47:49 +08001599int verify_spi_info(u8 proto, u32 min, u32 max);
Joe Perchesd5113372013-09-23 11:33:53 -07001600int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Mathias Krausee473fcb2013-06-26 23:56:58 +02001601struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001602 u8 mode, u32 reqid, u8 proto,
David S. Millera70486f2011-02-27 23:17:24 -08001603 const xfrm_address_t *daddr,
1604 const xfrm_address_t *saddr, int create,
Jamal Hadi Salimbd557752010-02-22 16:20:22 -08001605 unsigned short family);
Joe Perchesd5113372013-09-23 11:33:53 -07001606int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001608#ifdef CONFIG_XFRM_MIGRATE
Joe Perchesd5113372013-09-23 11:33:53 -07001609int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1610 const struct xfrm_migrate *m, int num_bundles,
1611 const struct xfrm_kmaddress *k);
Fan Du283bc9f2013-11-07 17:47:50 +08001612struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
Joe Perchesd5113372013-09-23 11:33:53 -07001613struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1614 struct xfrm_migrate *m);
1615int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1616 struct xfrm_migrate *m, int num_bundles,
Fan Du8d549c42013-11-07 17:47:49 +08001617 struct xfrm_kmaddress *k, struct net *net);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001618#endif
1619
Joe Perchesd5113372013-09-23 11:33:53 -07001620int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1621void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1622int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1623 xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001624
Joe Perchesd5113372013-09-23 11:33:53 -07001625void xfrm_input_init(void);
1626int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001627
Joe Perchesd5113372013-09-23 11:33:53 -07001628void xfrm_probe_algs(void);
1629int xfrm_count_pfkey_auth_supported(void);
1630int xfrm_count_pfkey_enc_supported(void);
1631struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1632struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1633struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1634struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1635struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1636struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1637struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1638struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1639struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1640 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001641
YOSHIFUJI Hideaki / 吉藤英明ff88b302013-01-29 12:48:31 +00001642static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1643 const xfrm_address_t *b)
1644{
1645 return ipv6_addr_equal((const struct in6_addr *)a,
1646 (const struct in6_addr *)b);
1647}
1648
YOSHIFUJI Hideaki / 吉藤英明70e94e62013-01-29 12:48:50 +00001649static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1650 const xfrm_address_t *b,
1651 sa_family_t family)
1652{
1653 switch (family) {
1654 default:
1655 case AF_INET:
1656 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1657 case AF_INET6:
1658 return xfrm6_addr_equal(a, b);
1659 }
1660}
1661
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001662static inline int xfrm_policy_id2dir(u32 index)
1663{
1664 return index & 7;
1665}
1666
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001667#ifdef CONFIG_XFRM
1668static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001669{
Patrick McHardybe336902006-03-20 22:40:54 -08001670 struct sock *nlsk;
1671 int ret = 0;
1672
1673 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001674 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001675 if (nlsk)
1676 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1677 rcu_read_unlock();
1678 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001679}
Horia Geanta0f245582014-02-12 16:20:06 +02001680
1681static inline int xfrm_acquire_is_on(struct net *net)
1682{
1683 struct sock *nlsk;
1684 int ret = 0;
1685
1686 rcu_read_lock();
1687 nlsk = rcu_dereference(net->xfrm.nlsk);
1688 if (nlsk)
1689 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1690 rcu_read_unlock();
1691
1692 return ret;
1693}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001694#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001695
Steffen Klassertee5c2312014-02-19 13:33:24 +01001696static inline int aead_len(struct xfrm_algo_aead *alg)
1697{
1698 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1699}
1700
David S. Miller85158622011-02-27 23:07:02 -08001701static inline int xfrm_alg_len(const struct xfrm_algo *alg)
Eric Dumazet0f99be02008-01-08 23:39:06 -08001702{
1703 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1704}
1705
David S. Miller85158622011-02-27 23:07:02 -08001706static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
Martin Willi4447bb32009-11-25 00:29:52 +00001707{
1708 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1709}
1710
Steffen Klassert9736acf2011-03-08 00:05:43 +00001711static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1712{
1713 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1714}
1715
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001716#ifdef CONFIG_XFRM_MIGRATE
Steffen Klassertaf2f4642011-03-28 19:46:39 +00001717static inline int xfrm_replay_clone(struct xfrm_state *x,
1718 struct xfrm_state *orig)
1719{
1720 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1721 GFP_KERNEL);
1722 if (!x->replay_esn)
1723 return -ENOMEM;
1724
1725 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1726 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1727
1728 x->preplay_esn = kmemdup(x->replay_esn,
1729 xfrm_replay_state_esn_len(x->replay_esn),
1730 GFP_KERNEL);
1731 if (!x->preplay_esn) {
1732 kfree(x->replay_esn);
1733 return -ENOMEM;
1734 }
1735
1736 return 0;
1737}
1738
Steffen Klassertee5c2312014-02-19 13:33:24 +01001739static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1740{
1741 return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1742}
1743
1744
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001745static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1746{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001747 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001748}
1749
Martin Willi4447bb32009-11-25 00:29:52 +00001750static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1751{
1752 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1753}
1754
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001755static inline void xfrm_states_put(struct xfrm_state **states, int n)
1756{
1757 int i;
1758 for (i = 0; i < n; i++)
1759 xfrm_state_put(*(states + i));
1760}
1761
1762static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1763{
1764 int i;
1765 for (i = 0; i < n; i++)
1766 xfrm_state_delete(*(states + i));
1767}
1768#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001769
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001770#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001771static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1772{
1773 return skb->sp->xvec[skb->sp->len - 1];
1774}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001775#endif
Herbert Xu00501122007-12-11 01:53:43 -08001776
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001777static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1778{
1779 if (attrs[XFRMA_MARK])
Andreas Steffen4efd7e82010-06-30 10:41:15 -07001780 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001781 else
1782 m->v = m->m = 0;
1783
1784 return m->v & m->m;
1785}
1786
David S. Millere3dfa382011-02-27 23:20:19 -08001787static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001788{
David S. Miller1d1e34d2012-06-27 21:57:03 -07001789 int ret = 0;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001790
David S. Miller1d1e34d2012-06-27 21:57:03 -07001791 if (m->m | m->v)
1792 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1793 return ret;
Jamal Hadi Salimbf825f812010-02-22 11:32:54 +00001794}
1795
Steffen Klassert70be6c92014-02-21 08:41:09 +01001796static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
1797 unsigned int family)
1798{
1799 bool tunnel = false;
1800
1801 switch(family) {
1802 case AF_INET:
1803 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
1804 tunnel = true;
1805 break;
1806 case AF_INET6:
1807 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
1808 tunnel = true;
1809 break;
1810 }
1811 if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
1812 return -EINVAL;
1813
1814 return 0;
1815}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001816#endif /* _NET_XFRM_H */