blob: 8d362c49b8a9ecb9f00539a0ed1d292f0068bb3a [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef _NET_XFRM_H
2#define _NET_XFRM_H
3
Herbert Xuaabc9762005-05-03 16:27:10 -07004#include <linux/compiler.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -02005#include <linux/in.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07006#include <linux/xfrm.h>
7#include <linux/spinlock.h>
8#include <linux/list.h>
9#include <linux/skbuff.h>
Arnaldo Carvalho de Melo14c85022005-12-27 02:43:12 -020010#include <linux/socket.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070011#include <linux/crypto.h>
12#include <linux/pfkeyv2.h>
13#include <linux/in6.h>
14
15#include <net/sock.h>
16#include <net/dst.h>
17#include <net/route.h>
18#include <net/ipv6.h>
19#include <net/ip6_fib.h>
20
21#define XFRM_ALIGN8(len) (((len) + 7) & ~7)
22
23extern struct semaphore xfrm_cfg_sem;
24
25/* Organization of SPD aka "XFRM rules"
26 ------------------------------------
27
28 Basic objects:
29 - policy rule, struct xfrm_policy (=SPD entry)
30 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
31 - instance of a transformer, struct xfrm_state (=SA)
32 - template to clone xfrm_state, struct xfrm_tmpl
33
34 SPD is plain linear list of xfrm_policy rules, ordered by priority.
35 (To be compatible with existing pfkeyv2 implementations,
36 many rules with priority of 0x7fffffff are allowed to exist and
37 such rules are ordered in an unpredictable way, thanks to bsd folks.)
38
39 Lookup is plain linear search until the first match with selector.
40
41 If "action" is "block", then we prohibit the flow, otherwise:
42 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
43 policy entry has list of up to XFRM_MAX_DEPTH transformations,
44 described by templates xfrm_tmpl. Each template is resolved
45 to a complete xfrm_state (see below) and we pack bundle of transformations
46 to a dst_entry returned to requestor.
47
48 dst -. xfrm .-> xfrm_state #1
49 |---. child .-> dst -. xfrm .-> xfrm_state #2
50 |---. child .-> dst -. xfrm .-> xfrm_state #3
51 |---. child .-> NULL
52
53 Bundles are cached at xrfm_policy struct (field ->bundles).
54
55
56 Resolution of xrfm_tmpl
57 -----------------------
58 Template contains:
59 1. ->mode Mode: transport or tunnel
60 2. ->id.proto Protocol: AH/ESP/IPCOMP
61 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
62 Q: allow to resolve security gateway?
63 4. ->id.spi If not zero, static SPI.
64 5. ->saddr Local tunnel endpoint, ignored for transport mode.
65 6. ->algos List of allowed algos. Plain bitmask now.
66 Q: ealgos, aalgos, calgos. What a mess...
67 7. ->share Sharing mode.
68 Q: how to implement private sharing mode? To add struct sock* to
69 flow id?
70
71 Having this template we search through SAD searching for entries
72 with appropriate mode/proto/algo, permitted by selector.
73 If no appropriate entry found, it is requested from key manager.
74
75 PROBLEMS:
76 Q: How to find all the bundles referring to a physical path for
77 PMTU discovery? Seems, dst should contain list of all parents...
78 and enter to infinite locking hierarchy disaster.
79 No! It is easier, we will not search for them, let them find us.
80 We add genid to each dst plus pointer to genid of raw IP route,
81 pmtu disc will update pmtu on raw IP route and increase its genid.
82 dst_check() will see this for top level and trigger resyncing
83 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
84 */
85
86/* Full description of state of transformer. */
87struct xfrm_state
88{
89 /* Note: bydst is re-used during gc */
90 struct list_head bydst;
91 struct list_head byspi;
92
93 atomic_t refcnt;
94 spinlock_t lock;
95
96 struct xfrm_id id;
97 struct xfrm_selector sel;
98
99 /* Key manger bits */
100 struct {
101 u8 state;
102 u8 dying;
103 u32 seq;
104 } km;
105
106 /* Parameters of this state. */
107 struct {
108 u32 reqid;
109 u8 mode;
110 u8 replay_window;
111 u8 aalgo, ealgo, calgo;
112 u8 flags;
113 u16 family;
114 xfrm_address_t saddr;
115 int header_len;
116 int trailer_len;
117 } props;
118
119 struct xfrm_lifetime_cfg lft;
120
121 /* Data for transformer */
122 struct xfrm_algo *aalg;
123 struct xfrm_algo *ealg;
124 struct xfrm_algo *calg;
125
126 /* Data for encapsulator */
127 struct xfrm_encap_tmpl *encap;
128
129 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
130 struct xfrm_state *tunnel;
131
132 /* If a tunnel, number of users + 1 */
133 atomic_t tunnel_users;
134
135 /* State for replay detection */
136 struct xfrm_replay_state replay;
137
138 /* Statistics */
139 struct xfrm_stats stats;
140
141 struct xfrm_lifetime_cur curlft;
142 struct timer_list timer;
143
144 /* Reference to data common to all the instances of this
145 * transformer. */
146 struct xfrm_type *type;
147
Trent Jaegerdf718372005-12-13 23:12:27 -0800148 /* Security context */
149 struct xfrm_sec_ctx *security;
150
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151 /* Private data of this transformer, format is opaque,
152 * interpreted by xfrm_type methods. */
153 void *data;
154};
155
156enum {
157 XFRM_STATE_VOID,
158 XFRM_STATE_ACQ,
159 XFRM_STATE_VALID,
160 XFRM_STATE_ERROR,
161 XFRM_STATE_EXPIRED,
162 XFRM_STATE_DEAD
163};
164
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700165/* callback structure passed from either netlink or pfkey */
166struct km_event
167{
Herbert Xubf088672005-06-18 22:44:00 -0700168 union {
169 u32 hard;
170 u32 proto;
171 u32 byid;
172 } data;
173
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700174 u32 seq;
175 u32 pid;
176 u32 event;
177};
178
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179struct xfrm_type;
180struct xfrm_dst;
181struct xfrm_policy_afinfo {
182 unsigned short family;
183 rwlock_t lock;
184 struct xfrm_type_map *type_map;
185 struct dst_ops *dst_ops;
186 void (*garbage_collect)(void);
187 int (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
188 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
189 int (*bundle_create)(struct xfrm_policy *policy,
190 struct xfrm_state **xfrm,
191 int nx,
192 struct flowi *fl,
193 struct dst_entry **dst_p);
194 void (*decode_session)(struct sk_buff *skb,
195 struct flowi *fl);
196};
197
198extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
199extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700200extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
201extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700202
203#define XFRM_ACQ_EXPIRES 30
204
205struct xfrm_tmpl;
206struct xfrm_state_afinfo {
207 unsigned short family;
208 rwlock_t lock;
209 struct list_head *state_bydst;
210 struct list_head *state_byspi;
Herbert Xud094cd82005-06-20 13:19:41 -0700211 int (*init_flags)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
213 struct xfrm_tmpl *tmpl,
214 xfrm_address_t *daddr, xfrm_address_t *saddr);
215 struct xfrm_state *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
216 struct xfrm_state *(*find_acq)(u8 mode, u32 reqid, u8 proto,
217 xfrm_address_t *daddr, xfrm_address_t *saddr,
218 int create);
219};
220
221extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
222extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
223
224extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
225
226struct xfrm_decap_state;
227struct xfrm_type
228{
229 char *description;
230 struct module *owner;
231 __u8 proto;
232
Herbert Xu72cb6962005-06-20 13:18:08 -0700233 int (*init_state)(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234 void (*destructor)(struct xfrm_state *);
235 int (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
237 /* Estimate maximal size of result of transformation of a dgram */
238 u32 (*get_max_size)(struct xfrm_state *, int size);
239};
240
241struct xfrm_type_map {
242 rwlock_t lock;
243 struct xfrm_type *map[256];
244};
245
246extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
247extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
248extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
249extern void xfrm_put_type(struct xfrm_type *type);
250
251struct xfrm_tmpl
252{
253/* id in template is interpreted as:
254 * daddr - destination of tunnel, may be zero for transport mode.
255 * spi - zero to acquire spi. Not zero if spi is static, then
256 * daddr must be fixed too.
257 * proto - AH/ESP/IPCOMP
258 */
259 struct xfrm_id id;
260
261/* Source address of tunnel. Ignored, if it is not a tunnel. */
262 xfrm_address_t saddr;
263
264 __u32 reqid;
265
266/* Mode: transport/tunnel */
267 __u8 mode;
268
269/* Sharing mode: unique, this session only, this user only etc. */
270 __u8 share;
271
272/* May skip this transfomration if no SA is found */
273 __u8 optional;
274
275/* Bit mask of algos allowed for acquisition */
276 __u32 aalgos;
277 __u32 ealgos;
278 __u32 calgos;
279};
280
281#define XFRM_MAX_DEPTH 4
282
283struct xfrm_policy
284{
285 struct xfrm_policy *next;
286 struct list_head list;
287
288 /* This lock only affects elements except for entry. */
289 rwlock_t lock;
290 atomic_t refcnt;
291 struct timer_list timer;
292
293 u32 priority;
294 u32 index;
295 struct xfrm_selector selector;
296 struct xfrm_lifetime_cfg lft;
297 struct xfrm_lifetime_cur curlft;
298 struct dst_entry *bundles;
299 __u16 family;
300 __u8 action;
301 __u8 flags;
302 __u8 dead;
303 __u8 xfrm_nr;
Trent Jaegerdf718372005-12-13 23:12:27 -0800304 struct xfrm_sec_ctx *security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700305 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
306};
307
308#define XFRM_KM_TIMEOUT 30
309
310struct xfrm_mgr
311{
312 struct list_head list;
313 char *id;
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700314 int (*notify)(struct xfrm_state *x, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
316 struct xfrm_policy *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
317 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700318 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700319};
320
321extern int xfrm_register_km(struct xfrm_mgr *km);
322extern int xfrm_unregister_km(struct xfrm_mgr *km);
323
324
325extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
326
327static inline void xfrm_pol_hold(struct xfrm_policy *policy)
328{
329 if (likely(policy != NULL))
330 atomic_inc(&policy->refcnt);
331}
332
333extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
334
335static inline void xfrm_pol_put(struct xfrm_policy *policy)
336{
337 if (atomic_dec_and_test(&policy->refcnt))
338 __xfrm_policy_destroy(policy);
339}
340
341#define XFRM_DST_HSIZE 1024
342
343static __inline__
344unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
345{
346 unsigned h;
347 h = ntohl(addr->a4);
348 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
349 return h;
350}
351
352static __inline__
353unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
354{
355 unsigned h;
356 h = ntohl(addr->a6[2]^addr->a6[3]);
357 h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
358 return h;
359}
360
361static __inline__
362unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
363{
364 switch (family) {
365 case AF_INET:
366 return __xfrm4_dst_hash(addr);
367 case AF_INET6:
368 return __xfrm6_dst_hash(addr);
369 }
370 return 0;
371}
372
373static __inline__
374unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
375{
376 unsigned h;
377 h = ntohl(addr->a4^spi^proto);
378 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
379 return h;
380}
381
382static __inline__
383unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
384{
385 unsigned h;
386 h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
387 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
388 return h;
389}
390
391static __inline__
392unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
393{
394 switch (family) {
395 case AF_INET:
396 return __xfrm4_spi_hash(addr, spi, proto);
397 case AF_INET6:
398 return __xfrm6_spi_hash(addr, spi, proto);
399 }
400 return 0; /*XXX*/
401}
402
403extern void __xfrm_state_destroy(struct xfrm_state *);
404
Herbert Xu21380b82006-02-22 14:47:13 -0800405static inline void __xfrm_state_put(struct xfrm_state *x)
406{
407 atomic_dec(&x->refcnt);
408}
409
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410static inline void xfrm_state_put(struct xfrm_state *x)
411{
412 if (atomic_dec_and_test(&x->refcnt))
413 __xfrm_state_destroy(x);
414}
415
416static inline void xfrm_state_hold(struct xfrm_state *x)
417{
418 atomic_inc(&x->refcnt);
419}
420
421static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
422{
423 __u32 *a1 = token1;
424 __u32 *a2 = token2;
425 int pdw;
426 int pbi;
427
428 pdw = prefixlen >> 5; /* num of whole __u32 in prefix */
429 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
430
431 if (pdw)
432 if (memcmp(a1, a2, pdw << 2))
433 return 0;
434
435 if (pbi) {
436 __u32 mask;
437
438 mask = htonl((0xffffffff) << (32 - pbi));
439
440 if ((a1[pdw] ^ a2[pdw]) & mask)
441 return 0;
442 }
443
444 return 1;
445}
446
447static __inline__
448u16 xfrm_flowi_sport(struct flowi *fl)
449{
450 u16 port;
451 switch(fl->proto) {
452 case IPPROTO_TCP:
453 case IPPROTO_UDP:
454 case IPPROTO_SCTP:
455 port = fl->fl_ip_sport;
456 break;
457 case IPPROTO_ICMP:
458 case IPPROTO_ICMPV6:
459 port = htons(fl->fl_icmp_type);
460 break;
461 default:
462 port = 0; /*XXX*/
463 }
464 return port;
465}
466
467static __inline__
468u16 xfrm_flowi_dport(struct flowi *fl)
469{
470 u16 port;
471 switch(fl->proto) {
472 case IPPROTO_TCP:
473 case IPPROTO_UDP:
474 case IPPROTO_SCTP:
475 port = fl->fl_ip_dport;
476 break;
477 case IPPROTO_ICMP:
478 case IPPROTO_ICMPV6:
479 port = htons(fl->fl_icmp_code);
480 break;
481 default:
482 port = 0; /*XXX*/
483 }
484 return port;
485}
486
487static inline int
488__xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
489{
490 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
491 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
492 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
493 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
494 (fl->proto == sel->proto || !sel->proto) &&
495 (fl->oif == sel->ifindex || !sel->ifindex);
496}
497
498static inline int
499__xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
500{
501 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
502 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
503 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
504 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
505 (fl->proto == sel->proto || !sel->proto) &&
506 (fl->oif == sel->ifindex || !sel->ifindex);
507}
508
509static inline int
510xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
511 unsigned short family)
512{
513 switch (family) {
514 case AF_INET:
515 return __xfrm4_selector_match(sel, fl);
516 case AF_INET6:
517 return __xfrm6_selector_match(sel, fl);
518 }
519 return 0;
520}
521
Trent Jaegerdf718372005-12-13 23:12:27 -0800522#ifdef CONFIG_SECURITY_NETWORK_XFRM
523/* If neither has a context --> match
524 * Otherwise, both must have a context and the sids, doi, alg must match
525 */
526static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
527{
528 return ((!s1 && !s2) ||
529 (s1 && s2 &&
530 (s1->ctx_sid == s2->ctx_sid) &&
531 (s1->ctx_doi == s2->ctx_doi) &&
532 (s1->ctx_alg == s2->ctx_alg)));
533}
534#else
535static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
536{
537 return 1;
538}
539#endif
540
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541/* A struct encoding bundle of transformations to apply to some set of flow.
542 *
543 * dst->child points to the next element of bundle.
544 * dst->xfrm points to an instanse of transformer.
545 *
546 * Due to unfortunate limitations of current routing cache, which we
547 * have no time to fix, it mirrors struct rtable and bound to the same
548 * routing key, including saddr,daddr. However, we can have many of
549 * bundles differing by session id. All the bundles grow from a parent
550 * policy rule.
551 */
552struct xfrm_dst
553{
554 union {
555 struct xfrm_dst *next;
556 struct dst_entry dst;
557 struct rtable rt;
558 struct rt6_info rt6;
559 } u;
560 struct dst_entry *route;
561 u32 route_mtu_cached;
562 u32 child_mtu_cached;
Hideaki YOSHIFUJI92d63dec2005-05-26 12:58:04 -0700563 u32 route_cookie;
564 u32 path_cookie;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700565};
566
Herbert Xuaabc9762005-05-03 16:27:10 -0700567static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
568{
569 dst_release(xdst->route);
570 if (likely(xdst->u.dst.xfrm))
571 xfrm_state_put(xdst->u.dst.xfrm);
572}
573
574extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
575
Linus Torvalds1da177e2005-04-16 15:20:36 -0700576/* Decapsulation state, used by the input to store data during
577 * decapsulation procedure, to be used later (during the policy
578 * check
579 */
580struct xfrm_decap_state {
581 char decap_data[20];
582 __u16 decap_type;
583};
584
585struct sec_decap_state {
586 struct xfrm_state *xvec;
587 struct xfrm_decap_state decap;
588};
589
590struct sec_path
591{
592 atomic_t refcnt;
593 int len;
594 struct sec_decap_state x[XFRM_MAX_DEPTH];
595};
596
597static inline struct sec_path *
598secpath_get(struct sec_path *sp)
599{
600 if (sp)
601 atomic_inc(&sp->refcnt);
602 return sp;
603}
604
605extern void __secpath_destroy(struct sec_path *sp);
606
607static inline void
608secpath_put(struct sec_path *sp)
609{
610 if (sp && atomic_dec_and_test(&sp->refcnt))
611 __secpath_destroy(sp);
612}
613
614extern struct sec_path *secpath_dup(struct sec_path *src);
615
616static inline void
617secpath_reset(struct sk_buff *skb)
618{
619#ifdef CONFIG_XFRM
620 secpath_put(skb->sp);
621 skb->sp = NULL;
622#endif
623}
624
625static inline int
626__xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
627{
628 return (tmpl->saddr.a4 &&
629 tmpl->saddr.a4 != x->props.saddr.a4);
630}
631
632static inline int
633__xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
634{
635 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
636 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
637}
638
639static inline int
640xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
641{
642 switch (family) {
643 case AF_INET:
644 return __xfrm4_state_addr_cmp(tmpl, x);
645 case AF_INET6:
646 return __xfrm6_state_addr_cmp(tmpl, x);
647 }
648 return !0;
649}
650
651#ifdef CONFIG_XFRM
652
653extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
654
655static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
656{
657 if (sk && sk->sk_policy[XFRM_POLICY_IN])
658 return __xfrm_policy_check(sk, dir, skb, family);
659
660 return (!xfrm_policy_list[dir] && !skb->sp) ||
661 (skb->dst->flags & DST_NOPOLICY) ||
662 __xfrm_policy_check(sk, dir, skb, family);
663}
664
665static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
666{
667 return xfrm_policy_check(sk, dir, skb, AF_INET);
668}
669
670static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
671{
672 return xfrm_policy_check(sk, dir, skb, AF_INET6);
673}
674
Patrick McHardy3e3850e2006-01-06 23:04:54 -0800675extern int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700676extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
677
678static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
679{
680 return !xfrm_policy_list[XFRM_POLICY_OUT] ||
681 (skb->dst->flags & DST_NOXFRM) ||
682 __xfrm_route_forward(skb, family);
683}
684
685static inline int xfrm4_route_forward(struct sk_buff *skb)
686{
687 return xfrm_route_forward(skb, AF_INET);
688}
689
690static inline int xfrm6_route_forward(struct sk_buff *skb)
691{
692 return xfrm_route_forward(skb, AF_INET6);
693}
694
695extern int __xfrm_sk_clone_policy(struct sock *sk);
696
697static inline int xfrm_sk_clone_policy(struct sock *sk)
698{
699 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
700 return __xfrm_sk_clone_policy(sk);
701 return 0;
702}
703
Herbert Xu4666faa2005-06-18 22:43:22 -0700704extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700705
706static inline void xfrm_sk_free_policy(struct sock *sk)
707{
708 if (unlikely(sk->sk_policy[0] != NULL)) {
709 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
710 sk->sk_policy[0] = NULL;
711 }
712 if (unlikely(sk->sk_policy[1] != NULL)) {
713 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
714 sk->sk_policy[1] = NULL;
715 }
716}
717
718#else
719
720static inline void xfrm_sk_free_policy(struct sock *sk) {}
721static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
722static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
723static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
724static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
725{
726 return 1;
727}
728static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
729{
730 return 1;
731}
732static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
733{
734 return 1;
735}
736#endif
737
738static __inline__
739xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
740{
741 switch (family){
742 case AF_INET:
743 return (xfrm_address_t *)&fl->fl4_dst;
744 case AF_INET6:
745 return (xfrm_address_t *)&fl->fl6_dst;
746 }
747 return NULL;
748}
749
750static __inline__
751xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
752{
753 switch (family){
754 case AF_INET:
755 return (xfrm_address_t *)&fl->fl4_src;
756 case AF_INET6:
757 return (xfrm_address_t *)&fl->fl6_src;
758 }
759 return NULL;
760}
761
762static __inline__ int
763__xfrm4_state_addr_check(struct xfrm_state *x,
764 xfrm_address_t *daddr, xfrm_address_t *saddr)
765{
766 if (daddr->a4 == x->id.daddr.a4 &&
767 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
768 return 1;
769 return 0;
770}
771
772static __inline__ int
773__xfrm6_state_addr_check(struct xfrm_state *x,
774 xfrm_address_t *daddr, xfrm_address_t *saddr)
775{
776 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
777 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
778 ipv6_addr_any((struct in6_addr *)saddr) ||
779 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
780 return 1;
781 return 0;
782}
783
784static __inline__ int
785xfrm_state_addr_check(struct xfrm_state *x,
786 xfrm_address_t *daddr, xfrm_address_t *saddr,
787 unsigned short family)
788{
789 switch (family) {
790 case AF_INET:
791 return __xfrm4_state_addr_check(x, daddr, saddr);
792 case AF_INET6:
793 return __xfrm6_state_addr_check(x, daddr, saddr);
794 }
795 return 0;
796}
797
798static inline int xfrm_state_kern(struct xfrm_state *x)
799{
800 return atomic_read(&x->tunnel_users);
801}
802
803/*
804 * xfrm algorithm information
805 */
806struct xfrm_algo_auth_info {
807 u16 icv_truncbits;
808 u16 icv_fullbits;
809};
810
811struct xfrm_algo_encr_info {
812 u16 blockbits;
813 u16 defkeybits;
814};
815
816struct xfrm_algo_comp_info {
817 u16 threshold;
818};
819
820struct xfrm_algo_desc {
821 char *name;
822 u8 available:1;
823 union {
824 struct xfrm_algo_auth_info auth;
825 struct xfrm_algo_encr_info encr;
826 struct xfrm_algo_comp_info comp;
827 } uinfo;
828 struct sadb_alg desc;
829};
830
831/* XFRM tunnel handlers. */
832struct xfrm_tunnel {
833 int (*handler)(struct sk_buff *skb);
Patrick McHardy03037702005-07-19 14:03:34 -0700834 void (*err_handler)(struct sk_buff *skb, __u32 info);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700835};
836
837struct xfrm6_tunnel {
Patrick McHardy951dbc82006-01-06 23:02:34 -0800838 int (*handler)(struct sk_buff **pskb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700839 void (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
840 int type, int code, int offset, __u32 info);
841};
842
843extern void xfrm_init(void);
844extern void xfrm4_init(void);
845extern void xfrm6_init(void);
846extern void xfrm6_fini(void);
847extern void xfrm_state_init(void);
848extern void xfrm4_state_init(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700849extern void xfrm6_state_init(void);
850extern void xfrm6_state_fini(void);
851
852extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
853extern struct xfrm_state *xfrm_state_alloc(void);
854extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
855 struct flowi *fl, struct xfrm_tmpl *tmpl,
856 struct xfrm_policy *pol, int *err,
857 unsigned short family);
858extern int xfrm_state_check_expire(struct xfrm_state *x);
859extern void xfrm_state_insert(struct xfrm_state *x);
860extern int xfrm_state_add(struct xfrm_state *x);
861extern int xfrm_state_update(struct xfrm_state *x);
862extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
863extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
Jamal Hadi Salim26b15da2005-06-18 22:42:13 -0700864extern int xfrm_state_delete(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700865extern void xfrm_state_flush(u8 proto);
866extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
867extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
868extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
869extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
Herbert Xu72cb6962005-06-20 13:18:08 -0700870extern int xfrm_init_state(struct xfrm_state *x);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700871extern int xfrm4_rcv(struct sk_buff *skb);
872extern int xfrm4_output(struct sk_buff *skb);
873extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
874extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
Patrick McHardy951dbc82006-01-06 23:02:34 -0800875extern int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi);
876extern int xfrm6_rcv(struct sk_buff **pskb);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700877extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
878extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
879extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
880extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
881extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
882extern int xfrm6_output(struct sk_buff *skb);
883
884#ifdef CONFIG_XFRM
885extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
886extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
887extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
888#else
889static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
890{
891 return -ENOPROTOOPT;
892}
893
894static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
895{
896 /* should not happen */
897 kfree_skb(skb);
898 return 0;
899}
900static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
901{
902 return -EINVAL;
903}
904#endif
905
Al Virodd0fc662005-10-07 07:46:04 +0100906struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700907extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
908int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
Trent Jaegerdf718372005-12-13 23:12:27 -0800909struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
910 struct xfrm_sec_ctx *ctx, int delete);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700911struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
912void xfrm_policy_flush(void);
913u32 xfrm_get_acqseq(void);
914void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
915struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
916 xfrm_address_t *daddr, xfrm_address_t *saddr,
917 int create, unsigned short family);
918extern void xfrm_policy_flush(void);
919extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
920extern int xfrm_flush_bundles(void);
David S. Miller399c1802005-12-19 14:23:23 -0800921extern void xfrm_flush_all_bundles(void);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700922extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
923extern void xfrm_init_pmtu(struct dst_entry *dst);
924
925extern wait_queue_head_t km_waitq;
926extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
927extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard);
928
929extern void xfrm_input_init(void);
930extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
931
932extern void xfrm_probe_algs(void);
933extern int xfrm_count_auth_supported(void);
934extern int xfrm_count_enc_supported(void);
935extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
936extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
937extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
938extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
939extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
940extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
941extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
942extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
943
944struct crypto_tfm;
945typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
946
947extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
948 int offset, int len, icv_update_fn_t icv_update);
949
950static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
951 int family)
952{
953 switch (family) {
954 default:
955 case AF_INET:
956 return a->a4 - b->a4;
957 case AF_INET6:
958 return ipv6_addr_cmp((struct in6_addr *)a,
959 (struct in6_addr *)b);
960 }
961}
962
Herbert Xu77d8d7a2005-10-05 12:15:12 -0700963static inline int xfrm_policy_id2dir(u32 index)
964{
965 return index & 7;
966}
967
Linus Torvalds1da177e2005-04-16 15:20:36 -0700968#endif /* _NET_XFRM_H */