blob: 2e9f5c0018ae34d25320141366594ce3f22d558f [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07005#include <linux/xfrm.h>
6#include <linux/spinlock.h>
7#include <linux/list.h>
8#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02009#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/pfkeyv2.h>
Masahide NAKAMURA57947082006-09-22 15:06:24 -070011#include <linux/ipsec.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/in6.h>
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080013#include <linux/mutex.h>
Joy Lattenab5f5e82007-09-17 11:51:22 -070014#include <linux/audit.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015
16#include <net/sock.h>
17#include <net/dst.h>
Herbert Xu436a0a42007-10-08 17:25:53 -070018#include <net/ip.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070019#include <net/route.h>
20#include <net/ipv6.h>
21#include <net/ip6_fib.h>
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080022#ifdef CONFIG_XFRM_STATISTICS
23#include <net/snmp.h>
24#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070025
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070026#define XFRM_PROTO_ESP 50
27#define XFRM_PROTO_AH 51
28#define XFRM_PROTO_COMP 108
29#define XFRM_PROTO_IPIP 4
30#define XFRM_PROTO_IPV6 41
31#define XFRM_PROTO_ROUTING IPPROTO_ROUTING
32#define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
33
Linus Torvalds1da177e2005-04-16 15:20:36 -070034#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
Herbert Xub59f45d2006-05-27 23:05:54 -070035#define MODULE_ALIAS_XFRM_MODE(family, encap) \
36 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
Masahide NAKAMURAd3d6dd32007-06-26 23:57:49 -070037#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
38 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds1da177e2005-04-16 15:20:36 -070039
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080040#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyan59c99402008-11-25 17:59:52 -080041#define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
42#define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
43#define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080044#else
Alexey Dobriyan59c99402008-11-25 17:59:52 -080045#define XFRM_INC_STATS(net, field) ((void)(net))
46#define XFRM_INC_STATS_BH(net, field) ((void)(net))
47#define XFRM_INC_STATS_USER(net, field) ((void)(net))
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -080048#endif
49
Arjan van de Ven4a3e2f72006-03-20 22:33:17 -080050extern struct mutex xfrm_cfg_mutex;
Linus Torvalds1da177e2005-04-16 15:20:36 -070051
52/* Organization of SPD aka "XFRM rules"
53 ------------------------------------
54
55 Basic objects:
56 - policy rule, struct xfrm_policy (=SPD entry)
57 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
58 - instance of a transformer, struct xfrm_state (=SA)
59 - template to clone xfrm_state, struct xfrm_tmpl
60
61 SPD is plain linear list of xfrm_policy rules, ordered by priority.
62 (To be compatible with existing pfkeyv2 implementations,
63 many rules with priority of 0x7fffffff are allowed to exist and
64 such rules are ordered in an unpredictable way, thanks to bsd folks.)
65
66 Lookup is plain linear search until the first match with selector.
67
68 If "action" is "block", then we prohibit the flow, otherwise:
69 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
70 policy entry has list of up to XFRM_MAX_DEPTH transformations,
71 described by templates xfrm_tmpl. Each template is resolved
72 to a complete xfrm_state (see below) and we pack bundle of transformations
73 to a dst_entry returned to requestor.
74
75 dst -. xfrm .-> xfrm_state #1
76 |---. child .-> dst -. xfrm .-> xfrm_state #2
77 |---. child .-> dst -. xfrm .-> xfrm_state #3
78 |---. child .-> NULL
79
80 Bundles are cached at xrfm_policy struct (field ->bundles).
81
82
83 Resolution of xrfm_tmpl
84 -----------------------
85 Template contains:
86 1. ->mode Mode: transport or tunnel
87 2. ->id.proto Protocol: AH/ESP/IPCOMP
88 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
89 Q: allow to resolve security gateway?
90 4. ->id.spi If not zero, static SPI.
91 5. ->saddr Local tunnel endpoint, ignored for transport mode.
92 6. ->algos List of allowed algos. Plain bitmask now.
93 Q: ealgos, aalgos, calgos. What a mess...
94 7. ->share Sharing mode.
95 Q: how to implement private sharing mode? To add struct sock* to
96 flow id?
97
98 Having this template we search through SAD searching for entries
99 with appropriate mode/proto/algo, permitted by selector.
100 If no appropriate entry found, it is requested from key manager.
101
102 PROBLEMS:
103 Q: How to find all the bundles referring to a physical path for
104 PMTU discovery? Seems, dst should contain list of all parents...
105 and enter to infinite locking hierarchy disaster.
106 No! It is easier, we will not search for them, let them find us.
107 We add genid to each dst plus pointer to genid of raw IP route,
108 pmtu disc will update pmtu on raw IP route and increase its genid.
109 dst_check() will see this for top level and trigger resyncing
110 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
111 */
112
Herbert Xu12a169e2008-10-01 07:03:24 -0700113struct xfrm_state_walk {
114 struct list_head all;
115 u8 state;
116 union {
117 u8 dying;
118 u8 proto;
119 };
120 u32 seq;
121};
122
Linus Torvalds1da177e2005-04-16 15:20:36 -0700123/* Full description of state of transformer. */
124struct xfrm_state
125{
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800126#ifdef CONFIG_NET_NS
127 struct net *xs_net;
128#endif
Herbert Xuabb81c42008-09-09 19:58:29 -0700129 union {
Herbert Xu12a169e2008-10-01 07:03:24 -0700130 struct hlist_node gclist;
Herbert Xuabb81c42008-09-09 19:58:29 -0700131 struct hlist_node bydst;
132 };
David S. Miller8f126e32006-08-24 02:45:07 -0700133 struct hlist_node bysrc;
134 struct hlist_node byspi;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135
136 atomic_t refcnt;
137 spinlock_t lock;
138
139 struct xfrm_id id;
140 struct xfrm_selector sel;
141
David S. Miller9d4a7062006-08-24 03:18:09 -0700142 u32 genid;
143
Herbert Xu12a169e2008-10-01 07:03:24 -0700144 /* Key manager bits */
145 struct xfrm_state_walk km;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146
147 /* Parameters of this state. */
148 struct {
149 u32 reqid;
150 u8 mode;
151 u8 replay_window;
152 u8 aalgo, ealgo, calgo;
153 u8 flags;
154 u16 family;
155 xfrm_address_t saddr;
156 int header_len;
157 int trailer_len;
158 } props;
159
160 struct xfrm_lifetime_cfg lft;
161
162 /* Data for transformer */
163 struct xfrm_algo *aalg;
164 struct xfrm_algo *ealg;
165 struct xfrm_algo *calg;
Herbert Xu1a6509d2008-01-28 19:37:29 -0800166 struct xfrm_algo_aead *aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700167
168 /* Data for encapsulator */
169 struct xfrm_encap_tmpl *encap;
170
Noriaki TAKAMIYA060f02a2006-08-23 18:18:55 -0700171 /* Data for care-of address */
172 xfrm_address_t *coaddr;
173
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
175 struct xfrm_state *tunnel;
176
177 /* If a tunnel, number of users + 1 */
178 atomic_t tunnel_users;
179
180 /* State for replay detection */
181 struct xfrm_replay_state replay;
182
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800183 /* Replay detection state at the time we sent the last notification */
184 struct xfrm_replay_state preplay;
185
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700186 /* internal flag that only holds state for delayed aevent at the
187 * moment
188 */
189 u32 xflags;
190
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800191 /* Replay detection notification settings */
192 u32 replay_maxage;
193 u32 replay_maxdiff;
194
195 /* Replay detection notification timer */
196 struct timer_list rtimer;
197
Linus Torvalds1da177e2005-04-16 15:20:36 -0700198 /* Statistics */
199 struct xfrm_stats stats;
200
201 struct xfrm_lifetime_cur curlft;
202 struct timer_list timer;
203
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700204 /* Last used time */
Herbert Xud26f3982007-11-13 21:47:08 -0800205 unsigned long lastused;
Masahide NAKAMURA9afaca02006-08-23 18:20:16 -0700206
Linus Torvalds1da177e2005-04-16 15:20:36 -0700207 /* Reference to data common to all the instances of this
208 * transformer. */
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800209 const struct xfrm_type *type;
Herbert Xu13996372007-10-17 21:35:51 -0700210 struct xfrm_mode *inner_mode;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700211 struct xfrm_mode *inner_mode_iaf;
Herbert Xu13996372007-10-17 21:35:51 -0700212 struct xfrm_mode *outer_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213
Trent Jaegerdf718372005-12-13 23:12:27 -0800214 /* Security context */
215 struct xfrm_sec_ctx *security;
216
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 /* Private data of this transformer, format is opaque,
218 * interpreted by xfrm_type methods. */
219 void *data;
220};
221
Alexey Dobriyan673c09b2008-11-25 17:15:16 -0800222static inline struct net *xs_net(struct xfrm_state *x)
223{
224 return read_pnet(&x->xs_net);
225}
226
Jamal Hadi Salim27170962006-04-14 15:03:05 -0700227/* xflags - make enum if more show up */
228#define XFRM_TIME_DEFER 1
229
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230enum {
231 XFRM_STATE_VOID,
232 XFRM_STATE_ACQ,
233 XFRM_STATE_VALID,
234 XFRM_STATE_ERROR,
235 XFRM_STATE_EXPIRED,
236 XFRM_STATE_DEAD
237};
238
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700239/* callback structure passed from either netlink or pfkey */
240struct km_event
241{
Herbert Xubf088672005-06-18 22:44:00 -0700242 union {
243 u32 hard;
244 u32 proto;
245 u32 byid;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800246 u32 aevent;
Masahide NAKAMURAf7b69832006-08-23 22:49:28 -0700247 u32 type;
Herbert Xubf088672005-06-18 22:44:00 -0700248 } data;
249
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700250 u32 seq;
251 u32 pid;
252 u32 event;
Alexey Dobriyan70678022008-11-25 17:50:36 -0800253 struct net *net;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700254};
255
Herbert Xu25ee3282007-12-11 09:32:34 -0800256struct net_device;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700257struct xfrm_type;
258struct xfrm_dst;
259struct xfrm_policy_afinfo {
260 unsigned short family;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 struct dst_ops *dst_ops;
Alexey Dobriyanddcfd792008-11-25 17:37:23 -0800262 void (*garbage_collect)(struct net *net);
Alexey Dobriyanc5b3cf42008-11-25 17:51:25 -0800263 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
264 xfrm_address_t *saddr,
Herbert Xu66cdb3c2007-11-13 21:37:28 -0800265 xfrm_address_t *daddr);
Alexey Dobriyanfbda33b2008-11-25 17:56:49 -0800266 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700268 void (*decode_session)(struct sk_buff *skb,
Herbert Xud5422ef2007-12-12 10:44:16 -0800269 struct flowi *fl,
270 int reverse);
Herbert Xu25ee3282007-12-11 09:32:34 -0800271 int (*get_tos)(struct flowi *fl);
Masahide NAKAMURAa1b05142007-12-20 20:41:12 -0800272 int (*init_path)(struct xfrm_dst *path,
273 struct dst_entry *dst,
274 int nfheader_len);
Herbert Xu25ee3282007-12-11 09:32:34 -0800275 int (*fill_dst)(struct xfrm_dst *xdst,
276 struct net_device *dev);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700277};
278
279extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
280extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700281extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
282extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283
284struct xfrm_tmpl;
Jamal Hadi Salim980ebd22006-03-20 19:16:40 -0800285extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
Jamal Hadi Salim53bc6b42006-03-20 19:17:03 -0800286extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
287extern int __xfrm_state_delete(struct xfrm_state *x);
288
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289struct xfrm_state_afinfo {
Herbert Xu17c2a422007-10-17 21:33:12 -0700290 unsigned int family;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800291 unsigned int proto;
Al Viro8e3d7162008-03-17 22:49:16 -0700292 __be16 eth_proto;
Herbert Xu17c2a422007-10-17 21:33:12 -0700293 struct module *owner;
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800294 const struct xfrm_type *type_map[IPPROTO_MAX];
Herbert Xuaa5d62c2007-10-17 21:31:12 -0700295 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
Herbert Xud094cd82005-06-20 13:19:41 -0700296 int (*init_flags)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700297 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
298 struct xfrm_tmpl *tmpl,
299 xfrm_address_t *daddr, xfrm_address_t *saddr);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -0700300 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
301 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
Miika Komucdca7262007-02-06 14:24:56 -0800302 int (*output)(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800303 int (*extract_input)(struct xfrm_state *x,
304 struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800305 int (*extract_output)(struct xfrm_state *x,
306 struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800307 int (*transport_finish)(struct sk_buff *skb,
308 int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309};
310
311extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
312extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
313
314extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
315
Linus Torvalds1da177e2005-04-16 15:20:36 -0700316struct xfrm_type
317{
318 char *description;
319 struct module *owner;
320 __u8 proto;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700321 __u8 flags;
322#define XFRM_TYPE_NON_FRAGMENT 1
Herbert Xu436a0a42007-10-08 17:25:53 -0700323#define XFRM_TYPE_REPLAY_PROT 2
Herbert Xuf04e7e82007-11-13 21:36:51 -0800324#define XFRM_TYPE_LOCAL_COADDR 4
325#define XFRM_TYPE_REMOTE_COADDR 8
Linus Torvalds1da177e2005-04-16 15:20:36 -0700326
Herbert Xu72cb6962005-06-20 13:18:08 -0700327 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700328 void (*destructor)(struct xfrm_state *);
Herbert Xue6956332006-04-01 00:52:46 -0800329 int (*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700330 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
Masahide NAKAMURAdf0ba922006-08-23 20:41:00 -0700331 int (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -0700332 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333 /* Estimate maximal size of result of transformation of a dgram */
Patrick McHardyc5c25232007-04-09 11:47:18 -0700334 u32 (*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700335};
336
Eric Dumazet533cb5b2008-01-30 19:11:50 -0800337extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
338extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700339
Herbert Xub59f45d2006-05-27 23:05:54 -0700340struct xfrm_mode {
Herbert Xu227620e2007-11-13 21:41:28 -0800341 /*
342 * Remove encapsulation header.
343 *
344 * The IP header will be moved over the top of the encapsulation
345 * header.
346 *
347 * On entry, the transport header shall point to where the IP header
348 * should be and the network header shall be set to where the IP
349 * header currently is. skb->data shall point to the start of the
350 * payload.
351 */
352 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
353
354 /*
355 * This is the actual input entry point.
356 *
357 * For transport mode and equivalent this would be identical to
358 * input2 (which does not need to be set). While tunnel mode
359 * and equivalent would set this to the tunnel encapsulation function
360 * xfrm4_prepare_input that would in turn call input2.
361 */
Herbert Xub59f45d2006-05-27 23:05:54 -0700362 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu37fedd32007-10-10 15:44:44 -0700363
364 /*
365 * Add encapsulation header.
366 *
367 * On exit, the transport header will be set to the start of the
368 * encapsulation header to be filled in by x->type->output and
369 * the mac header will be set to the nextheader (protocol for
370 * IPv4) field of the extension header directly preceding the
371 * encapsulation header, or in its absence, that of the top IP
372 * header. The value of the network header will always point
373 * to the top IP header while skb->data will point to the payload.
374 */
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800375 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
376
377 /*
378 * This is the actual output entry point.
379 *
380 * For transport mode and equivalent this would be identical to
381 * output2 (which does not need to be set). While tunnel mode
382 * and equivalent would set this to a tunnel encapsulation function
383 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
384 * call output2.
385 */
386 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xub59f45d2006-05-27 23:05:54 -0700387
Herbert Xu17c2a422007-10-17 21:33:12 -0700388 struct xfrm_state_afinfo *afinfo;
Herbert Xub59f45d2006-05-27 23:05:54 -0700389 struct module *owner;
390 unsigned int encap;
Herbert Xu1bfcb102007-10-17 21:31:50 -0700391 int flags;
392};
393
394/* Flags for xfrm_mode. */
395enum {
396 XFRM_MODE_FLAG_TUNNEL = 1,
Herbert Xub59f45d2006-05-27 23:05:54 -0700397};
398
399extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
400extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
Herbert Xub59f45d2006-05-27 23:05:54 -0700401
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700402static inline int xfrm_af2proto(unsigned int family)
403{
404 switch(family) {
405 case AF_INET:
406 return IPPROTO_IPIP;
407 case AF_INET6:
408 return IPPROTO_IPV6;
409 default:
410 return 0;
411 }
412}
413
414static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
415{
416 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
417 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
418 return x->inner_mode;
419 else
420 return x->inner_mode_iaf;
421}
422
Linus Torvalds1da177e2005-04-16 15:20:36 -0700423struct xfrm_tmpl
424{
425/* id in template is interpreted as:
426 * daddr - destination of tunnel, may be zero for transport mode.
427 * spi - zero to acquire spi. Not zero if spi is static, then
428 * daddr must be fixed too.
429 * proto - AH/ESP/IPCOMP
430 */
431 struct xfrm_id id;
432
433/* Source address of tunnel. Ignored, if it is not a tunnel. */
434 xfrm_address_t saddr;
435
Miika Komu76b3f052006-11-30 16:40:43 -0800436 unsigned short encap_family;
437
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438 __u32 reqid;
439
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700440/* Mode: transport, tunnel etc. */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441 __u8 mode;
442
443/* Sharing mode: unique, this session only, this user only etc. */
444 __u8 share;
445
446/* May skip this transfomration if no SA is found */
447 __u8 optional;
448
Herbert Xuc5d18e92008-04-22 00:46:42 -0700449/* Skip aalgos/ealgos/calgos checks. */
450 __u8 allalgs;
451
Linus Torvalds1da177e2005-04-16 15:20:36 -0700452/* Bit mask of algos allowed for acquisition */
453 __u32 aalgos;
454 __u32 ealgos;
455 __u32 calgos;
456};
457
Masahide NAKAMURA622dc822006-08-23 17:52:01 -0700458#define XFRM_MAX_DEPTH 6
Linus Torvalds1da177e2005-04-16 15:20:36 -0700459
Herbert Xu12a169e2008-10-01 07:03:24 -0700460struct xfrm_policy_walk_entry {
461 struct list_head all;
462 u8 dead;
463};
464
465struct xfrm_policy_walk {
466 struct xfrm_policy_walk_entry walk;
467 u8 type;
468 u32 seq;
469};
470
Linus Torvalds1da177e2005-04-16 15:20:36 -0700471struct xfrm_policy
472{
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800473#ifdef CONFIG_NET_NS
474 struct net *xp_net;
475#endif
David S. Miller2518c7c2006-08-24 04:45:07 -0700476 struct hlist_node bydst;
477 struct hlist_node byidx;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700478
479 /* This lock only affects elements except for entry. */
480 rwlock_t lock;
481 atomic_t refcnt;
482 struct timer_list timer;
483
484 u32 priority;
485 u32 index;
486 struct xfrm_selector selector;
487 struct xfrm_lifetime_cfg lft;
488 struct xfrm_lifetime_cur curlft;
489 struct dst_entry *bundles;
Herbert Xu12a169e2008-10-01 07:03:24 -0700490 struct xfrm_policy_walk_entry walk;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200491 u8 type;
492 u8 action;
493 u8 flags;
Arnaldo Carvalho de Melo46ca5f52006-11-27 17:58:59 -0200494 u8 xfrm_nr;
Herbert Xu12a169e2008-10-01 07:03:24 -0700495 u16 family;
Trent Jaegerdf718372005-12-13 23:12:27 -0800496 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700497 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
498};
499
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -0800500static inline struct net *xp_net(struct xfrm_policy *xp)
501{
502 return read_pnet(&xp->xp_net);
503}
504
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700505struct xfrm_kmaddress {
506 xfrm_address_t local;
507 xfrm_address_t remote;
508 u32 reserved;
509 u16 family;
510};
511
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -0800512struct xfrm_migrate {
513 xfrm_address_t old_daddr;
514 xfrm_address_t old_saddr;
515 xfrm_address_t new_daddr;
516 xfrm_address_t new_saddr;
517 u8 proto;
518 u8 mode;
519 u16 reserved;
520 u32 reqid;
521 u16 old_family;
522 u16 new_family;
523};
524
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -0800525#define XFRM_KM_TIMEOUT 30
526/* which seqno */
527#define XFRM_REPLAY_SEQ 1
528#define XFRM_REPLAY_OSEQ 2
529#define XFRM_REPLAY_SEQ_MASK 3
530/* what happened */
531#define XFRM_REPLAY_UPDATE XFRM_AE_CR
532#define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
533
534/* default aevent timeout in units of 100ms */
535#define XFRM_AE_ETIME 10
536/* Async Event timer multiplier */
537#define XFRM_AE_ETH_M 10
538/* default seq threshold size */
539#define XFRM_AE_SEQT_SIZE 2
Linus Torvalds1da177e2005-04-16 15:20:36 -0700540
541struct xfrm_mgr
542{
543 struct list_head list;
544 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700545 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
Venkat Yekkiralacb969f02006-07-24 23:32:20 -0700547 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
Al Viro5d36b182006-11-08 00:24:06 -0800548 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700549 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Alexey Dobriyandb983c12008-11-25 17:51:01 -0800550 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Arnaud Ebalard13c1d182008-10-05 13:33:42 -0700551 int (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552};
553
554extern int xfrm_register_km(struct xfrm_mgr *km);
555extern int xfrm_unregister_km(struct xfrm_mgr *km);
556
Herbert Xu436a0a42007-10-08 17:25:53 -0700557/*
558 * This structure is used for the duration where packets are being
559 * transformed by IPsec. As soon as the packet leaves IPsec the
560 * area beyond the generic IP part may be overwritten.
561 */
562struct xfrm_skb_cb {
563 union {
564 struct inet_skb_parm h4;
565 struct inet6_skb_parm h6;
566 } header;
567
568 /* Sequence number for replay protection. */
Herbert Xub318e0e2008-02-12 22:50:35 -0800569 union {
570 u64 output;
571 __be32 input;
572 } seq;
Herbert Xu436a0a42007-10-08 17:25:53 -0700573};
574
575#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
576
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800577/*
578 * This structure is used by the afinfo prepare_input/prepare_output functions
579 * to transmit header information to the mode input/output functions.
580 */
581struct xfrm_mode_skb_cb {
582 union {
583 struct inet_skb_parm h4;
584 struct inet6_skb_parm h6;
585 } header;
586
587 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
588 __be16 id;
589 __be16 frag_off;
590
Herbert Xu732c8bd2008-03-26 16:51:09 -0700591 /* IP header length (excluding options or extension headers). */
592 u8 ihl;
593
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800594 /* TOS for IPv4, class for IPv6. */
595 u8 tos;
596
597 /* TTL for IPv4, hop limitfor IPv6. */
598 u8 ttl;
599
600 /* Protocol for IPv4, NH for IPv6. */
601 u8 protocol;
602
Herbert Xu732c8bd2008-03-26 16:51:09 -0700603 /* Option length for IPv4, zero for IPv6. */
604 u8 optlen;
605
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800606 /* Used by IPv6 only, zero for IPv4. */
607 u8 flow_lbl[3];
608};
609
610#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
611
Herbert Xu716062f2007-11-13 21:44:23 -0800612/*
613 * This structure is used by the input processing to locate the SPI and
614 * related information.
615 */
616struct xfrm_spi_skb_cb {
617 union {
618 struct inet_skb_parm h4;
619 struct inet6_skb_parm h6;
620 } header;
621
Herbert Xu716062f2007-11-13 21:44:23 -0800622 unsigned int daddroff;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800623 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800624};
625
626#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
627
Joy Latten161a09e2006-11-27 13:11:54 -0600628/* Audit Information */
629struct xfrm_audit
630{
Joy Latten161a09e2006-11-27 13:11:54 -0600631 u32 secid;
Eric Paris25323862008-04-18 10:09:25 -0400632 uid_t loginuid;
633 u32 sessionid;
Joy Latten161a09e2006-11-27 13:11:54 -0600634};
Joy Lattenc9204d92006-11-30 15:50:43 -0600635
636#ifdef CONFIG_AUDITSYSCALL
Paul Mooreafeb14b2007-12-21 14:58:11 -0800637static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Lattenab5f5e82007-09-17 11:51:22 -0700638{
639 struct audit_buffer *audit_buf = NULL;
Paul Mooreafeb14b2007-12-21 14:58:11 -0800640
641 if (audit_enabled == 0)
642 return NULL;
643 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
644 AUDIT_MAC_IPSEC_EVENT);
645 if (audit_buf == NULL)
646 return NULL;
647 audit_log_format(audit_buf, "op=%s", op);
648 return audit_buf;
649}
650
Eric Paris25323862008-04-18 10:09:25 -0400651static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
Paul Mooreafeb14b2007-12-21 14:58:11 -0800652 struct audit_buffer *audit_buf)
653{
Joy Lattenab5f5e82007-09-17 11:51:22 -0700654 char *secctx;
655 u32 secctx_len;
656
Eric Paris25323862008-04-18 10:09:25 -0400657 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
Paul Moore68277ac2007-12-20 20:49:33 -0800658 if (secid != 0 &&
659 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
Joy Lattenab5f5e82007-09-17 11:51:22 -0700660 audit_log_format(audit_buf, " subj=%s", secctx);
661 security_release_secctx(secctx, secctx_len);
662 } else
663 audit_log_task_context(audit_buf);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700664}
665
666extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400667 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700668extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
Eric Paris25323862008-04-18 10:09:25 -0400669 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700670extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400671 u32 auid, u32 ses, u32 secid);
Joy Lattenab5f5e82007-09-17 11:51:22 -0700672extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
Eric Paris25323862008-04-18 10:09:25 -0400673 u32 auid, u32 ses, u32 secid);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800674extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
675 struct sk_buff *skb);
676extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
677extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
678 __be32 net_spi, __be32 net_seq);
679extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
680 struct sk_buff *skb, u8 proto);
Joy Lattenc9204d92006-11-30 15:50:43 -0600681#else
Marcin Slusarz41fef0e2008-05-03 21:03:01 -0700682
683static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
684 u32 auid, u32 ses, u32 secid)
685{
686}
687
688static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
689 u32 auid, u32 ses, u32 secid)
690{
691}
692
693static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
694 u32 auid, u32 ses, u32 secid)
695{
696}
697
698static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
699 u32 auid, u32 ses, u32 secid)
700{
701}
702
703static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
704 struct sk_buff *skb)
705{
706}
707
708static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
709 u16 family)
710{
711}
712
713static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
714 __be32 net_spi, __be32 net_seq)
715{
716}
717
718static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
719 struct sk_buff *skb, u8 proto)
720{
721}
Joy Lattenc9204d92006-11-30 15:50:43 -0600722#endif /* CONFIG_AUDITSYSCALL */
Joy Latten161a09e2006-11-27 13:11:54 -0600723
Linus Torvalds1da177e2005-04-16 15:20:36 -0700724static inline void xfrm_pol_hold(struct xfrm_policy *policy)
725{
726 if (likely(policy != NULL))
727 atomic_inc(&policy->refcnt);
728}
729
WANG Cong64c31b32008-01-07 22:34:29 -0800730extern void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700731
732static inline void xfrm_pol_put(struct xfrm_policy *policy)
733{
734 if (atomic_dec_and_test(&policy->refcnt))
WANG Cong64c31b32008-01-07 22:34:29 -0800735 xfrm_policy_destroy(policy);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700736}
737
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700738#ifdef CONFIG_XFRM_SUB_POLICY
739static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
740{
741 int i;
742 for (i = npols - 1; i >= 0; --i)
743 xfrm_pol_put(pols[i]);
744}
745#else
746static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
747{
748 xfrm_pol_put(pols[0]);
749}
750#endif
751
Linus Torvalds1da177e2005-04-16 15:20:36 -0700752extern void __xfrm_state_destroy(struct xfrm_state *);
753
Herbert Xu21380b82006-02-22 14:47:13 -0800754static inline void __xfrm_state_put(struct xfrm_state *x)
755{
756 atomic_dec(&x->refcnt);
757}
758
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759static inline void xfrm_state_put(struct xfrm_state *x)
760{
761 if (atomic_dec_and_test(&x->refcnt))
762 __xfrm_state_destroy(x);
763}
764
765static inline void xfrm_state_hold(struct xfrm_state *x)
766{
767 atomic_inc(&x->refcnt);
768}
769
770static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
771{
Al Viro5f193432006-09-27 18:46:32 -0700772 __be32 *a1 = token1;
773 __be32 *a2 = token2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700774 int pdw;
775 int pbi;
776
777 pdw = prefixlen >> 5; /* num of whole __u32 in prefix */
778 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
779
780 if (pdw)
781 if (memcmp(a1, a2, pdw << 2))
782 return 0;
783
784 if (pbi) {
Al Viro5f193432006-09-27 18:46:32 -0700785 __be32 mask;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786
787 mask = htonl((0xffffffff) << (32 - pbi));
788
789 if ((a1[pdw] ^ a2[pdw]) & mask)
790 return 0;
791 }
792
793 return 1;
794}
795
796static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700797__be16 xfrm_flowi_sport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798{
Al Virof9d07e41f82006-09-27 18:45:50 -0700799 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700800 switch(fl->proto) {
801 case IPPROTO_TCP:
802 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800803 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804 case IPPROTO_SCTP:
805 port = fl->fl_ip_sport;
806 break;
807 case IPPROTO_ICMP:
808 case IPPROTO_ICMPV6:
809 port = htons(fl->fl_icmp_type);
810 break;
Masahide NAKAMURA2ce42722006-08-23 20:39:03 -0700811 case IPPROTO_MH:
812 port = htons(fl->fl_mh_type);
813 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814 default:
815 port = 0; /*XXX*/
816 }
817 return port;
818}
819
820static __inline__
Al Virof9d07e41f82006-09-27 18:45:50 -0700821__be16 xfrm_flowi_dport(struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700822{
Al Virof9d07e41f82006-09-27 18:45:50 -0700823 __be16 port;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700824 switch(fl->proto) {
825 case IPPROTO_TCP:
826 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800827 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700828 case IPPROTO_SCTP:
829 port = fl->fl_ip_dport;
830 break;
831 case IPPROTO_ICMP:
832 case IPPROTO_ICMPV6:
833 port = htons(fl->fl_icmp_code);
834 break;
835 default:
836 port = 0; /*XXX*/
837 }
838 return port;
839}
840
Andrew Morton77681022006-11-08 22:46:26 -0800841extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
842 unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700843
Trent Jaegerdf718372005-12-13 23:12:27 -0800844#ifdef CONFIG_SECURITY_NETWORK_XFRM
845/* If neither has a context --> match
846 * Otherwise, both must have a context and the sids, doi, alg must match
847 */
848static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
849{
850 return ((!s1 && !s2) ||
851 (s1 && s2 &&
852 (s1->ctx_sid == s2->ctx_sid) &&
853 (s1->ctx_doi == s2->ctx_doi) &&
854 (s1->ctx_alg == s2->ctx_alg)));
855}
856#else
857static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
858{
859 return 1;
860}
861#endif
862
Linus Torvalds1da177e2005-04-16 15:20:36 -0700863/* A struct encoding bundle of transformations to apply to some set of flow.
864 *
865 * dst->child points to the next element of bundle.
866 * dst->xfrm points to an instanse of transformer.
867 *
868 * Due to unfortunate limitations of current routing cache, which we
869 * have no time to fix, it mirrors struct rtable and bound to the same
870 * routing key, including saddr,daddr. However, we can have many of
871 * bundles differing by session id. All the bundles grow from a parent
872 * policy rule.
873 */
874struct xfrm_dst
875{
876 union {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700877 struct dst_entry dst;
878 struct rtable rt;
879 struct rt6_info rt6;
880 } u;
881 struct dst_entry *route;
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700882#ifdef CONFIG_XFRM_SUB_POLICY
883 struct flowi *origin;
884 struct xfrm_selector *partner;
885#endif
David S. Miller9d4a7062006-08-24 03:18:09 -0700886 u32 genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700887 u32 route_mtu_cached;
888 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63dec2005-05-26 12:58:04 -0700889 u32 route_cookie;
890 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700891};
892
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700893#ifdef CONFIG_XFRM
Herbert Xuaabc9762005-05-03 16:27:10 -0700894static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
895{
896 dst_release(xdst->route);
897 if (likely(xdst->u.dst.xfrm))
898 xfrm_state_put(xdst->u.dst.xfrm);
Masahide NAKAMURA157bfc22007-04-30 00:33:35 -0700899#ifdef CONFIG_XFRM_SUB_POLICY
900 kfree(xdst->origin);
901 xdst->origin = NULL;
902 kfree(xdst->partner);
903 xdst->partner = NULL;
904#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700905}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -0700906#endif
Herbert Xuaabc9762005-05-03 16:27:10 -0700907
908extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
909
Linus Torvalds1da177e2005-04-16 15:20:36 -0700910struct sec_path
911{
912 atomic_t refcnt;
913 int len;
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800914 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700915};
916
917static inline struct sec_path *
918secpath_get(struct sec_path *sp)
919{
920 if (sp)
921 atomic_inc(&sp->refcnt);
922 return sp;
923}
924
925extern void __secpath_destroy(struct sec_path *sp);
926
927static inline void
928secpath_put(struct sec_path *sp)
929{
930 if (sp && atomic_dec_and_test(&sp->refcnt))
931 __secpath_destroy(sp);
932}
933
934extern struct sec_path *secpath_dup(struct sec_path *src);
935
936static inline void
937secpath_reset(struct sk_buff *skb)
938{
939#ifdef CONFIG_XFRM
940 secpath_put(skb->sp);
941 skb->sp = NULL;
942#endif
943}
944
945static inline int
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700946xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
947{
948 switch (family) {
949 case AF_INET:
950 return addr->a4 == 0;
951 case AF_INET6:
952 return ipv6_addr_any((struct in6_addr *)&addr->a6);
953 }
954 return 0;
955}
956
957static inline int
Linus Torvalds1da177e2005-04-16 15:20:36 -0700958__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
959{
960 return (tmpl->saddr.a4 &&
961 tmpl->saddr.a4 != x->props.saddr.a4);
962}
963
964static inline int
965__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
966{
967 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
968 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
969}
970
971static inline int
972xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
973{
974 switch (family) {
975 case AF_INET:
976 return __xfrm4_state_addr_cmp(tmpl, x);
977 case AF_INET6:
978 return __xfrm6_state_addr_cmp(tmpl, x);
979 }
980 return !0;
981}
982
983#ifdef CONFIG_XFRM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700984extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
985
Herbert Xud5422ef2007-12-12 10:44:16 -0800986static inline int __xfrm_policy_check2(struct sock *sk, int dir,
987 struct sk_buff *skb,
988 unsigned int family, int reverse)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700989{
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800990 struct net *net = dev_net(skb->dev);
Herbert Xud5422ef2007-12-12 10:44:16 -0800991 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
992
Linus Torvalds1da177e2005-04-16 15:20:36 -0700993 if (sk && sk->sk_policy[XFRM_POLICY_IN])
Herbert Xud5422ef2007-12-12 10:44:16 -0800994 return __xfrm_policy_check(sk, ndir, skb, family);
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -0700995
Alexey Dobriyanf6e1e252008-11-25 17:35:44 -0800996 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
Linus Torvalds1da177e2005-04-16 15:20:36 -0700997 (skb->dst->flags & DST_NOPOLICY) ||
Herbert Xud5422ef2007-12-12 10:44:16 -0800998 __xfrm_policy_check(sk, ndir, skb, family);
999}
1000
1001static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1002{
1003 return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001004}
1005
1006static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1007{
1008 return xfrm_policy_check(sk, dir, skb, AF_INET);
1009}
1010
1011static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1012{
1013 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1014}
1015
Herbert Xud5422ef2007-12-12 10:44:16 -08001016static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1017 struct sk_buff *skb)
1018{
1019 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1020}
1021
1022static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1023 struct sk_buff *skb)
1024{
1025 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1026}
1027
1028extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1029 unsigned int family, int reverse);
1030
1031static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1032 unsigned int family)
1033{
1034 return __xfrm_decode_session(skb, fl, family, 0);
1035}
1036
1037static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1038 struct flowi *fl,
1039 unsigned int family)
1040{
1041 return __xfrm_decode_session(skb, fl, family, 1);
1042}
1043
Linus Torvalds1da177e2005-04-16 15:20:36 -07001044extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1045
1046static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1047{
Alexey Dobriyan99a66652008-11-25 17:36:13 -08001048 struct net *net = dev_net(skb->dev);
1049
1050 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Linus Torvalds1da177e2005-04-16 15:20:36 -07001051 (skb->dst->flags & DST_NOXFRM) ||
1052 __xfrm_route_forward(skb, family);
1053}
1054
1055static inline int xfrm4_route_forward(struct sk_buff *skb)
1056{
1057 return xfrm_route_forward(skb, AF_INET);
1058}
1059
1060static inline int xfrm6_route_forward(struct sk_buff *skb)
1061{
1062 return xfrm_route_forward(skb, AF_INET6);
1063}
1064
1065extern int __xfrm_sk_clone_policy(struct sock *sk);
1066
1067static inline int xfrm_sk_clone_policy(struct sock *sk)
1068{
1069 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1070 return __xfrm_sk_clone_policy(sk);
1071 return 0;
1072}
1073
Herbert Xu4666faa2005-06-18 22:43:22 -07001074extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001075
1076static inline void xfrm_sk_free_policy(struct sock *sk)
1077{
1078 if (unlikely(sk->sk_policy[0] != NULL)) {
1079 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1080 sk->sk_policy[0] = NULL;
1081 }
1082 if (unlikely(sk->sk_policy[1] != NULL)) {
1083 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1084 sk->sk_policy[1] = NULL;
1085 }
1086}
1087
1088#else
1089
1090static inline void xfrm_sk_free_policy(struct sock *sk) {}
1091static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1092static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1093static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1094static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1095{
1096 return 1;
1097}
1098static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1099{
1100 return 1;
1101}
1102static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1103{
1104 return 1;
1105}
Herbert Xud5422ef2007-12-12 10:44:16 -08001106static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1107 struct flowi *fl,
1108 unsigned int family)
1109{
1110 return -ENOSYS;
1111}
1112static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1113 struct sk_buff *skb)
1114{
1115 return 1;
1116}
1117static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1118 struct sk_buff *skb)
1119{
1120 return 1;
1121}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001122#endif
1123
1124static __inline__
1125xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
1126{
1127 switch (family){
1128 case AF_INET:
1129 return (xfrm_address_t *)&fl->fl4_dst;
1130 case AF_INET6:
1131 return (xfrm_address_t *)&fl->fl6_dst;
1132 }
1133 return NULL;
1134}
1135
1136static __inline__
1137xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
1138{
1139 switch (family){
1140 case AF_INET:
1141 return (xfrm_address_t *)&fl->fl4_src;
1142 case AF_INET6:
1143 return (xfrm_address_t *)&fl->fl6_src;
1144 }
1145 return NULL;
1146}
1147
YOSHIFUJI Hideaki9bb182a2008-02-22 14:48:22 +09001148static __inline__
1149void xfrm_flowi_addr_get(struct flowi *fl,
1150 xfrm_address_t *saddr, xfrm_address_t *daddr,
1151 unsigned short family)
1152{
1153 switch(family) {
1154 case AF_INET:
1155 memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
1156 memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
1157 break;
1158 case AF_INET6:
1159 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
1160 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
1161 break;
1162 }
1163}
1164
Linus Torvalds1da177e2005-04-16 15:20:36 -07001165static __inline__ int
1166__xfrm4_state_addr_check(struct xfrm_state *x,
1167 xfrm_address_t *daddr, xfrm_address_t *saddr)
1168{
1169 if (daddr->a4 == x->id.daddr.a4 &&
1170 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1171 return 1;
1172 return 0;
1173}
1174
1175static __inline__ int
1176__xfrm6_state_addr_check(struct xfrm_state *x,
1177 xfrm_address_t *daddr, xfrm_address_t *saddr)
1178{
1179 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1180 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1181 ipv6_addr_any((struct in6_addr *)saddr) ||
1182 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1183 return 1;
1184 return 0;
1185}
1186
1187static __inline__ int
1188xfrm_state_addr_check(struct xfrm_state *x,
1189 xfrm_address_t *daddr, xfrm_address_t *saddr,
1190 unsigned short family)
1191{
1192 switch (family) {
1193 case AF_INET:
1194 return __xfrm4_state_addr_check(x, daddr, saddr);
1195 case AF_INET6:
1196 return __xfrm6_state_addr_check(x, daddr, saddr);
1197 }
1198 return 0;
1199}
1200
Masahide NAKAMURAe53820d2006-08-23 19:12:01 -07001201static __inline__ int
1202xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
1203 unsigned short family)
1204{
1205 switch (family) {
1206 case AF_INET:
1207 return __xfrm4_state_addr_check(x,
1208 (xfrm_address_t *)&fl->fl4_dst,
1209 (xfrm_address_t *)&fl->fl4_src);
1210 case AF_INET6:
1211 return __xfrm6_state_addr_check(x,
1212 (xfrm_address_t *)&fl->fl6_dst,
1213 (xfrm_address_t *)&fl->fl6_src);
1214 }
1215 return 0;
1216}
1217
Linus Torvalds1da177e2005-04-16 15:20:36 -07001218static inline int xfrm_state_kern(struct xfrm_state *x)
1219{
1220 return atomic_read(&x->tunnel_users);
1221}
1222
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001223static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1224{
Masahide NAKAMURAdc00a522006-08-23 17:49:52 -07001225 return (!userproto || proto == userproto ||
1226 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1227 proto == IPPROTO_ESP ||
1228 proto == IPPROTO_COMP)));
Masahide NAKAMURA57947082006-09-22 15:06:24 -07001229}
1230
Linus Torvalds1da177e2005-04-16 15:20:36 -07001231/*
1232 * xfrm algorithm information
1233 */
Herbert Xu1a6509d2008-01-28 19:37:29 -08001234struct xfrm_algo_aead_info {
1235 u16 icv_truncbits;
1236};
1237
Linus Torvalds1da177e2005-04-16 15:20:36 -07001238struct xfrm_algo_auth_info {
1239 u16 icv_truncbits;
1240 u16 icv_fullbits;
1241};
1242
1243struct xfrm_algo_encr_info {
1244 u16 blockbits;
1245 u16 defkeybits;
1246};
1247
1248struct xfrm_algo_comp_info {
1249 u16 threshold;
1250};
1251
1252struct xfrm_algo_desc {
1253 char *name;
Herbert Xu04ff1262006-08-13 08:50:00 +10001254 char *compat;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001255 u8 available:1;
1256 union {
Herbert Xu1a6509d2008-01-28 19:37:29 -08001257 struct xfrm_algo_aead_info aead;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001258 struct xfrm_algo_auth_info auth;
1259 struct xfrm_algo_encr_info encr;
1260 struct xfrm_algo_comp_info comp;
1261 } uinfo;
1262 struct sadb_alg desc;
1263};
1264
1265/* XFRM tunnel handlers. */
1266struct xfrm_tunnel {
1267 int (*handler)(struct sk_buff *skb);
Herbert Xud2acc342006-03-28 01:12:13 -08001268 int (*err_handler)(struct sk_buff *skb, __u32 info);
1269
1270 struct xfrm_tunnel *next;
1271 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272};
1273
1274struct xfrm6_tunnel {
Herbert Xud2acc342006-03-28 01:12:13 -08001275 int (*handler)(struct sk_buff *skb);
1276 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
Al Viro04ce6902006-11-08 00:21:01 -08001277 int type, int code, int offset, __be32 info);
Herbert Xud2acc342006-03-28 01:12:13 -08001278 struct xfrm6_tunnel *next;
1279 int priority;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001280};
1281
1282extern void xfrm_init(void);
1283extern void xfrm4_init(void);
Alexey Dobriyand62ddc22008-11-25 17:14:31 -08001284extern int xfrm_state_init(struct net *net);
1285extern void xfrm_state_fini(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001286extern void xfrm4_state_init(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001287#ifdef CONFIG_XFRM
1288extern int xfrm6_init(void);
1289extern void xfrm6_fini(void);
Daniel Lezcano0013cab2007-12-07 00:42:11 -08001290extern int xfrm6_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001291extern void xfrm6_state_fini(void);
Daniel Lezcanoc35b7e72007-12-08 00:14:11 -08001292#else
1293static inline int xfrm6_init(void)
1294{
1295 return 0;
1296}
1297static inline void xfrm6_fini(void)
1298{
1299 ;
1300}
1301#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07001302
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001303#ifdef CONFIG_XFRM_STATISTICS
Alexey Dobriyanc68cd1a2008-11-25 18:00:14 -08001304extern int xfrm_proc_init(struct net *net);
1305extern void xfrm_proc_fini(struct net *net);
Masahide NAKAMURA558f82e2007-12-20 20:42:57 -08001306#endif
1307
Alexey Dobriyanb27aead2008-11-25 18:00:48 -08001308extern int xfrm_sysctl_init(struct net *net);
1309#ifdef CONFIG_SYSCTL
1310extern void xfrm_sysctl_fini(struct net *net);
1311#else
1312static inline void xfrm_sysctl_fini(struct net *net)
1313{
1314}
1315#endif
1316
Herbert Xu5c182452008-09-22 19:48:19 -07001317extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
Alexey Dobriyan284fa7d2008-11-25 17:32:14 -08001318extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001319 int (*func)(struct xfrm_state *, int, void*), void *);
Herbert Xuabb81c42008-09-09 19:58:29 -07001320extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
Alexey Dobriyan673c09b2008-11-25 17:15:16 -08001321extern struct xfrm_state *xfrm_state_alloc(struct net *net);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001322extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1323 struct flowi *fl, struct xfrm_tmpl *tmpl,
1324 struct xfrm_policy *pol, int *err,
1325 unsigned short family);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001326extern struct xfrm_state * xfrm_stateonly_find(struct net *net,
1327 xfrm_address_t *daddr,
Jamal Hadi Salim628529b2007-07-02 22:41:14 -07001328 xfrm_address_t *saddr,
1329 unsigned short family,
1330 u8 mode, u8 proto, u32 reqid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331extern int xfrm_state_check_expire(struct xfrm_state *x);
1332extern void xfrm_state_insert(struct xfrm_state *x);
1333extern int xfrm_state_add(struct xfrm_state *x);
1334extern int xfrm_state_update(struct xfrm_state *x);
Alexey Dobriyan221df1e2008-11-25 17:30:50 -08001335extern struct xfrm_state *xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family);
1336extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family);
Masahide NAKAMURA41a49cc2006-08-23 22:48:31 -07001337#ifdef CONFIG_XFRM_SUB_POLICY
1338extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1339 int n, unsigned short family);
1340extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1341 int n, unsigned short family);
1342#else
1343static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1344 int n, unsigned short family)
1345{
1346 return -ENOSYS;
1347}
1348
1349static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1350 int n, unsigned short family)
1351{
1352 return -ENOSYS;
1353}
1354#endif
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001355
1356struct xfrmk_sadinfo {
1357 u32 sadhcnt; /* current hash bkts */
1358 u32 sadhmcnt; /* max allowed hash bkts */
1359 u32 sadcnt; /* current running count */
1360};
1361
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001362struct xfrmk_spdinfo {
1363 u32 incnt;
1364 u32 outcnt;
1365 u32 fwdcnt;
1366 u32 inscnt;
1367 u32 outscnt;
1368 u32 fwdscnt;
1369 u32 spdhcnt;
1370 u32 spdhmcnt;
1371};
1372
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001373extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -07001374extern int xfrm_state_delete(struct xfrm_state *x);
Alexey Dobriyan0e602452008-11-25 17:30:18 -08001375extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
Jamal Hadi Salimaf11e312007-05-04 12:55:13 -07001376extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si);
Jamal Hadi Salim5a6d3412007-05-04 12:55:39 -07001377extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
Paul Mooreafeb14b2007-12-21 14:58:11 -08001378extern int xfrm_replay_check(struct xfrm_state *x,
1379 struct sk_buff *skb, __be32 seq);
Al Viro61f46272006-09-27 18:48:33 -07001380extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001381extern void xfrm_replay_notify(struct xfrm_state *x, int event);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001382extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -07001383extern int xfrm_init_state(struct xfrm_state *x);
Herbert Xu227620e2007-11-13 21:41:28 -08001384extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu716062f2007-11-13 21:44:23 -08001385extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1386 int encap_type);
Herbert Xu1bf06cd2007-11-19 18:50:17 -08001387extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
Herbert Xuc6581a42007-11-13 21:43:43 -08001388extern int xfrm_output_resume(struct sk_buff *skb, int err);
Herbert Xu406ef772007-10-08 17:16:30 -07001389extern int xfrm_output(struct sk_buff *skb);
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -07001390extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001391extern int xfrm4_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001392extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001393extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1394 int encap_type);
Herbert Xu716062f2007-11-13 21:44:23 -08001395extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001396extern int xfrm4_rcv(struct sk_buff *skb);
Herbert Xuc4541b42007-10-17 21:28:53 -07001397
1398static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1399{
1400 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1401}
1402
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001403extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1404extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001405extern int xfrm4_output(struct sk_buff *skb);
Kazunori MIYAZAWAc0d56402007-02-13 12:54:47 -08001406extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1407extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001408extern int xfrm6_extract_header(struct sk_buff *skb);
Herbert Xu227620e2007-11-13 21:41:28 -08001409extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
Herbert Xu33b5ecb2007-10-17 21:29:25 -07001410extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
Herbert Xu716062f2007-11-13 21:44:23 -08001411extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
Herbert Xue5bbef22007-10-15 12:50:28 -07001412extern int xfrm6_rcv(struct sk_buff *skb);
Masahide NAKAMURAfbd9a5b2006-08-23 18:08:21 -07001413extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1414 xfrm_address_t *saddr, u8 proto);
Kazunori MIYAZAWA73d605d2007-02-13 12:55:55 -08001415extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1416extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
Al Viro8c689a62006-11-08 00:20:21 -08001417extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001418extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
Al Viro8c689a62006-11-08 00:20:21 -08001419extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
Herbert Xu36cf9ac2007-11-13 21:40:52 -08001420extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1421extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001422extern int xfrm6_output(struct sk_buff *skb);
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -07001423extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1424 u8 **prevhdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001425
1426#ifdef CONFIG_XFRM
James Chapman067b2072007-07-05 17:08:05 -07001427extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001428extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429#else
1430static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1431{
1432 return -ENOPROTOOPT;
1433}
1434
James Chapman067b2072007-07-05 17:08:05 -07001435static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001436{
1437 /* should not happen */
1438 kfree_skb(skb);
1439 return 0;
1440}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001441#endif
1442
Alexey Dobriyan0331b1f2008-11-25 17:21:45 -08001443struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
Timo Teras4c563f72008-02-28 21:31:08 -08001444
Herbert Xu12a169e2008-10-01 07:03:24 -07001445extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
Alexey Dobriyancdcbca72008-11-25 17:34:49 -08001446extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
Timo Teras4c563f72008-02-28 21:31:08 -08001447 int (*func)(struct xfrm_policy *, int, int, void*), void *);
Herbert Xu12a169e2008-10-01 07:03:24 -07001448extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001449int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Alexey Dobriyan8d1211a2008-11-25 17:34:20 -08001450struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
Masahide NAKAMURA4e81bb82006-08-23 22:43:30 -07001451 struct xfrm_selector *sel,
Eric Parisef41aaa2007-03-07 15:37:58 -08001452 struct xfrm_sec_ctx *ctx, int delete,
1453 int *err);
Alexey Dobriyan8d1211a2008-11-25 17:34:20 -08001454struct xfrm_policy *xfrm_policy_byid(struct net *net, u8, int dir, u32 id, int delete, int *err);
Alexey Dobriyan33ffbbd2008-11-25 17:33:32 -08001455int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456u32 xfrm_get_acqseq(void);
Herbert Xu658b2192007-10-09 13:29:52 -07001457extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
Alexey Dobriyan5447c5e2008-11-25 17:31:51 -08001458struct xfrm_state * xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
Joy Latten161a09e2006-11-27 13:11:54 -06001459 xfrm_address_t *daddr, xfrm_address_t *saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001460 int create, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
Venkat Yekkirala5b368e62006-10-05 15:42:18 -05001462extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
1463 struct flowi *fl, int family, int strict);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001464
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001465#ifdef CONFIG_XFRM_MIGRATE
1466extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001467 struct xfrm_migrate *m, int num_bundles,
1468 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001469extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1470extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1471 struct xfrm_migrate *m);
1472extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
Arnaud Ebalard13c1d182008-10-05 13:33:42 -07001473 struct xfrm_migrate *m, int num_bundles,
1474 struct xfrm_kmaddress *k);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001475#endif
1476
Al Viro5d36b182006-11-08 00:24:06 -08001477extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
Jamal Hadi Salim6c5c8ca2006-03-20 19:17:25 -08001478extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
Alexey Dobriyandb983c12008-11-25 17:51:01 -08001479extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480
1481extern void xfrm_input_init(void);
Al Viro6067b2b2006-09-27 18:47:59 -07001482extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001483
1484extern void xfrm_probe_algs(void);
1485extern int xfrm_count_auth_supported(void);
1486extern int xfrm_count_enc_supported(void);
1487extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1488extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1489extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1490extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1491extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1492extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
1493extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
1494extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
Herbert Xu1a6509d2008-01-28 19:37:29 -08001495extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
1496 int probe);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001497
Herbert Xu07d4ee52006-08-20 14:24:50 +10001498struct hash_desc;
Herbert Xu9409f382006-08-06 19:49:12 +10001499struct scatterlist;
Herbert Xu07d4ee52006-08-20 14:24:50 +10001500typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1501 unsigned int);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001502
Herbert Xu07d4ee52006-08-20 14:24:50 +10001503extern int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *tfm,
1504 int offset, int len, icv_update_fn_t icv_update);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505
1506static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
1507 int family)
1508{
1509 switch (family) {
1510 default:
1511 case AF_INET:
Al Viro8c689a62006-11-08 00:20:21 -08001512 return (__force __u32)a->a4 - (__force __u32)b->a4;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001513 case AF_INET6:
1514 return ipv6_addr_cmp((struct in6_addr *)a,
1515 (struct in6_addr *)b);
1516 }
1517}
1518
Herbert Xu77d8d7a2005-10-05 12:15:12 -07001519static inline int xfrm_policy_id2dir(u32 index)
1520{
1521 return index & 7;
1522}
1523
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001524#ifdef CONFIG_XFRM
1525static inline int xfrm_aevent_is_on(struct net *net)
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001526{
Patrick McHardybe336902006-03-20 22:40:54 -08001527 struct sock *nlsk;
1528 int ret = 0;
1529
1530 rcu_read_lock();
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001531 nlsk = rcu_dereference(net->xfrm.nlsk);
Patrick McHardybe336902006-03-20 22:40:54 -08001532 if (nlsk)
1533 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1534 rcu_read_unlock();
1535 return ret;
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001536}
Alexey Dobriyana6483b72008-11-25 17:38:20 -08001537#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001538
Eric Dumazet0f99be02008-01-08 23:39:06 -08001539static inline int xfrm_alg_len(struct xfrm_algo *alg)
1540{
1541 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1542}
1543
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001544#ifdef CONFIG_XFRM_MIGRATE
1545static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1546{
Eric Dumazet0f99be02008-01-08 23:39:06 -08001547 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
Shinta Sugimoto80c9aba2007-02-08 13:11:42 -08001548}
1549
1550static inline void xfrm_states_put(struct xfrm_state **states, int n)
1551{
1552 int i;
1553 for (i = 0; i < n; i++)
1554 xfrm_state_put(*(states + i));
1555}
1556
1557static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1558{
1559 int i;
1560 for (i = 0; i < n; i++)
1561 xfrm_state_delete(*(states + i));
1562}
1563#endif
Jamal Hadi Salimf8cd5482006-03-20 19:15:11 -08001564
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001565#ifdef CONFIG_XFRM
Herbert Xu00501122007-12-11 01:53:43 -08001566static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1567{
1568 return skb->sp->xvec[skb->sp->len - 1];
1569}
Alexey Dobriyandef8b4f2008-10-28 13:24:06 -07001570#endif
Herbert Xu00501122007-12-11 01:53:43 -08001571
Linus Torvalds1da177e2005-04-16 15:20:36 -07001572#endif /* _NET_XFRM_H */