include/net/xfrm.h

   1 #ifndef _NET_XFRM_H
   2 #define _NET_XFRM_H
   3
   4 #include <linux/compiler.h>
   5 #include <linux/xfrm.h>
   6 #include <linux/spinlock.h>
   7 #include <linux/list.h>
   8 #include <linux/skbuff.h>
   9 #include <linux/socket.h>
  10 #include <linux/pfkeyv2.h>
  11 #include <linux/ipsec.h>
  12 #include <linux/in6.h>
  13 #include <linux/mutex.h>
  14 #include <linux/audit.h>
  15 #include <linux/slab.h>
  16
  17 #include <net/sock.h>
  18 #include <net/dst.h>
  19 #include <net/ip.h>
  20 #include <net/route.h>
  21 #include <net/ipv6.h>
  22 #include <net/ip6_fib.h>
  23 #include <net/flow.h>
  24
  25 #include <linux/interrupt.h>
  26
  27 #ifdef CONFIG_XFRM_STATISTICS
  28 #include <net/snmp.h>
  29 #endif
  30
  31 #define XFRM_PROTO_ESP          50
  32 #define XFRM_PROTO_AH           51
  33 #define XFRM_PROTO_COMP         108
  34 #define XFRM_PROTO_IPIP         4
  35 #define XFRM_PROTO_IPV6         41
  36 #define XFRM_PROTO_ROUTING      IPPROTO_ROUTING
  37 #define XFRM_PROTO_DSTOPTS      IPPROTO_DSTOPTS
  38
  39 #define XFRM_ALIGN4(len)        (((len) + 3) & ~3)
  40 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
  41 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
  42         MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
  43 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
  44         MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
  45
  46 #ifdef CONFIG_XFRM_STATISTICS
  47 #define XFRM_INC_STATS(net, field)      SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
  48 #define XFRM_INC_STATS_BH(net, field)   SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
  49 #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
  50 #else
  51 #define XFRM_INC_STATS(net, field)      ((void)(net))
  52 #define XFRM_INC_STATS_BH(net, field)   ((void)(net))
  53 #define XFRM_INC_STATS_USER(net, field) ((void)(net))
  54 #endif
  55
  56 extern struct mutex xfrm_cfg_mutex;
  57
  58 /* Organization of SPD aka "XFRM rules"
  59    ------------------------------------
  60
  61    Basic objects:
  62    - policy rule, struct xfrm_policy (=SPD entry)
  63    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  64    - instance of a transformer, struct xfrm_state (=SA)
  65    - template to clone xfrm_state, struct xfrm_tmpl
  66
  67    SPD is plain linear list of xfrm_policy rules, ordered by priority.
  68    (To be compatible with existing pfkeyv2 implementations,
  69    many rules with priority of 0x7fffffff are allowed to exist and
  70    such rules are ordered in an unpredictable way, thanks to bsd folks.)
  71
  72    Lookup is plain linear search until the first match with selector.
  73
  74    If "action" is "block", then we prohibit the flow, otherwise:
  75    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  76    policy entry has list of up to XFRM_MAX_DEPTH transformations,
  77    described by templates xfrm_tmpl. Each template is resolved
  78    to a complete xfrm_state (see below) and we pack bundle of transformations
  79    to a dst_entry returned to requestor.
  80
  81    dst -. xfrm  .-> xfrm_state #1
  82     |---. child .-> dst -. xfrm .-> xfrm_state #2
  83                      |---. child .-> dst -. xfrm .-> xfrm_state #3
  84                                       |---. child .-> NULL
  85
  86    Bundles are cached at xrfm_policy struct (field ->bundles).
  87
  88
  89    Resolution of xrfm_tmpl
  90    -----------------------
  91    Template contains:
  92    1. ->mode            Mode: transport or tunnel
  93    2. ->id.proto        Protocol: AH/ESP/IPCOMP
  94    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
  95       Q: allow to resolve security gateway?
  96    4. ->id.spi          If not zero, static SPI.
  97    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
  98    6. ->algos           List of allowed algos. Plain bitmask now.
  99       Q: ealgos, aalgos, calgos. What a mess...
 100    7. ->share           Sharing mode.
 101       Q: how to implement private sharing mode? To add struct sock* to
 102       flow id?
 103
 104    Having this template we search through SAD searching for entries
 105    with appropriate mode/proto/algo, permitted by selector.
 106    If no appropriate entry found, it is requested from key manager.
 107
 108    PROBLEMS:
 109    Q: How to find all the bundles referring to a physical path for
 110       PMTU discovery? Seems, dst should contain list of all parents...
 111       and enter to infinite locking hierarchy disaster.
 112       No! It is easier, we will not search for them, let them find us.
 113       We add genid to each dst plus pointer to genid of raw IP route,
 114       pmtu disc will update pmtu on raw IP route and increase its genid.
 115       dst_check() will see this for top level and trigger resyncing
 116       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 117  */
 118
 119 struct xfrm_state_walk {
 120         struct list_head        all;
 121         u8                      state;
 122         union {
 123                 u8              dying;
 124                 u8              proto;
 125         };
 126         u32                     seq;
 127 };
 128
 129 /* Full description of state of transformer. */
 130 struct xfrm_state {
 131 #ifdef CONFIG_NET_NS
 132         struct net              *xs_net;
 133 #endif
 134         union {
 135                 struct hlist_node       gclist;
 136                 struct hlist_node       bydst;
 137         };
 138         struct hlist_node       bysrc;
 139         struct hlist_node       byspi;
 140
 141         atomic_t                refcnt;
 142         spinlock_t              lock;
 143
 144         struct xfrm_id          id;
 145         struct xfrm_selector    sel;
 146         struct xfrm_mark        mark;
 147         u32                     tfcpad;
 148
 149         u32                     genid;
 150
 151         /* Key manager bits */
 152         struct xfrm_state_walk  km;
 153
 154         /* Parameters of this state. */
 155         struct {
 156                 u32             reqid;
 157                 u8              mode;
 158                 u8              replay_window;
 159                 u8              aalgo, ealgo, calgo;
 160                 u8              flags;
 161                 u16             family;
 162                 xfrm_address_t  saddr;
 163                 int             header_len;
 164                 int             trailer_len;
 165         } props;
 166
 167         struct xfrm_lifetime_cfg lft;
 168
 169         /* Data for transformer */
 170         struct xfrm_algo_auth   *aalg;
 171         struct xfrm_algo        *ealg;
 172         struct xfrm_algo        *calg;
 173         struct xfrm_algo_aead   *aead;
 174
 175         /* Data for encapsulator */
 176         struct xfrm_encap_tmpl  *encap;
 177
 178         /* Data for care-of address */
 179         xfrm_address_t  *coaddr;
 180
 181         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
 182         struct xfrm_state       *tunnel;
 183
 184         /* If a tunnel, number of users + 1 */
 185         atomic_t                tunnel_users;
 186
 187         /* State for replay detection */
 188         struct xfrm_replay_state replay;
 189         struct xfrm_replay_state_esn *replay_esn;
 190
 191         /* Replay detection state at the time we sent the last notification */
 192         struct xfrm_replay_state preplay;
 193         struct xfrm_replay_state_esn *preplay_esn;
 194
 195         /* The functions for replay detection. */
 196         struct xfrm_replay      *repl;
 197
 198         /* internal flag that only holds state for delayed aevent at the
 199          * moment
 200         */
 201         u32                     xflags;
 202
 203         /* Replay detection notification settings */
 204         u32                     replay_maxage;
 205         u32                     replay_maxdiff;
 206
 207         /* Replay detection notification timer */
 208         struct timer_list       rtimer;
 209
 210         /* Statistics */
 211         struct xfrm_stats       stats;
 212
 213         struct xfrm_lifetime_cur curlft;
 214         struct tasklet_hrtimer  mtimer;
 215
 216         /* used to fix curlft->add_time when changing date */
 217         long            saved_tmo;
 218
 219         /* Last used time */
 220         unsigned long           lastused;
 221
 222         /* Reference to data common to all the instances of this
 223          * transformer. */
 224         const struct xfrm_type  *type;
 225         struct xfrm_mode        *inner_mode;
 226         struct xfrm_mode        *inner_mode_iaf;
 227         struct xfrm_mode        *outer_mode;
 228
 229         /* Security context */
 230         struct xfrm_sec_ctx     *security;
 231
 232         /* Private data of this transformer, format is opaque,
 233          * interpreted by xfrm_type methods. */
 234         void                    *data;
 235 };
 236
 237 static inline struct net *xs_net(struct xfrm_state *x)
 238 {
 239         return read_pnet(&x->xs_net);
 240 }
 241
 242 /* xflags - make enum if more show up */
 243 #define XFRM_TIME_DEFER 1
 244 #define XFRM_SOFT_EXPIRE 2
 245
 246 enum {
 247         XFRM_STATE_VOID,
 248         XFRM_STATE_ACQ,
 249         XFRM_STATE_VALID,
 250         XFRM_STATE_ERROR,
 251         XFRM_STATE_EXPIRED,
 252         XFRM_STATE_DEAD
 253 };
 254
 255 /* callback structure passed from either netlink or pfkey */
 256 struct km_event {
 257         union {
 258                 u32 hard;
 259                 u32 proto;
 260                 u32 byid;
 261                 u32 aevent;
 262                 u32 type;
 263         } data;
 264
 265         u32     seq;
 266         u32     portid;
 267         u32     event;
 268         struct net *net;
 269 };
 270
 271 struct xfrm_replay {
 272         void    (*advance)(struct xfrm_state *x, __be32 net_seq);
 273         int     (*check)(struct xfrm_state *x,
 274                          struct sk_buff *skb,
 275                          __be32 net_seq);
 276         int     (*recheck)(struct xfrm_state *x,
 277                            struct sk_buff *skb,
 278                            __be32 net_seq);
 279         void    (*notify)(struct xfrm_state *x, int event);
 280         int     (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
 281 };
 282
 283 struct net_device;
 284 struct xfrm_type;
 285 struct xfrm_dst;
 286 struct xfrm_policy_afinfo {
 287         unsigned short          family;
 288         struct dst_ops          *dst_ops;
 289         void                    (*garbage_collect)(struct net *net);
 290         struct dst_entry        *(*dst_lookup)(struct net *net, int tos,
 291                                                const xfrm_address_t *saddr,
 292                                                const xfrm_address_t *daddr);
 293         int                     (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
 294         void                    (*decode_session)(struct sk_buff *skb,
 295                                                   struct flowi *fl,
 296                                                   int reverse);
 297         int                     (*get_tos)(const struct flowi *fl);
 298         void                    (*init_dst)(struct net *net,
 299                                             struct xfrm_dst *dst);
 300         int                     (*init_path)(struct xfrm_dst *path,
 301                                              struct dst_entry *dst,
 302                                              int nfheader_len);
 303         int                     (*fill_dst)(struct xfrm_dst *xdst,
 304                                             struct net_device *dev,
 305                                             const struct flowi *fl);
 306         struct dst_entry        *(*blackhole_route)(struct net *net, struct dst_entry *orig);
 307 };
 308
 309 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 310 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 311 extern void km_policy_notify(struct xfrm_policy *xp, int dir, const struct km_event *c);
 312 extern void km_state_notify(struct xfrm_state *x, const struct km_event *c);
 313
 314 struct xfrm_tmpl;
 315 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 316 extern void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
 317 extern int __xfrm_state_delete(struct xfrm_state *x);
 318
 319 struct xfrm_state_afinfo {
 320         unsigned int            family;
 321         unsigned int            proto;
 322         __be16                  eth_proto;
 323         struct module           *owner;
 324         const struct xfrm_type  *type_map[IPPROTO_MAX];
 325         struct xfrm_mode        *mode_map[XFRM_MODE_MAX];
 326         int                     (*init_flags)(struct xfrm_state *x);
 327         void                    (*init_tempsel)(struct xfrm_selector *sel,
 328                                                 const struct flowi *fl);
 329         void                    (*init_temprop)(struct xfrm_state *x,
 330                                                 const struct xfrm_tmpl *tmpl,
 331                                                 const xfrm_address_t *daddr,
 332                                                 const xfrm_address_t *saddr);
 333         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
 334         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
 335         int                     (*output)(struct sk_buff *skb);
 336         int                     (*output_finish)(struct sk_buff *skb);
 337         int                     (*extract_input)(struct xfrm_state *x,
 338                                                  struct sk_buff *skb);
 339         int                     (*extract_output)(struct xfrm_state *x,
 340                                                   struct sk_buff *skb);
 341         int                     (*transport_finish)(struct sk_buff *skb,
 342                                                     int async);
 343 };
 344
 345 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 346 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 347
 348 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 349
 350 struct xfrm_type {
 351         char                    *description;
 352         struct module           *owner;
 353         u8                      proto;
 354         u8                      flags;
 355 #define XFRM_TYPE_NON_FRAGMENT  1
 356 #define XFRM_TYPE_REPLAY_PROT   2
 357 #define XFRM_TYPE_LOCAL_COADDR  4
 358 #define XFRM_TYPE_REMOTE_COADDR 8
 359
 360         int                     (*init_state)(struct xfrm_state *x);
 361         void                    (*destructor)(struct xfrm_state *);
 362         int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
 363         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
 364         int                     (*reject)(struct xfrm_state *, struct sk_buff *,
 365                                           const struct flowi *);
 366         int                     (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
 367         /* Estimate maximal size of result of transformation of a dgram */
 368         u32                     (*get_mtu)(struct xfrm_state *, int size);
 369 };
 370
 371 extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
 372 extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
 373
 374 struct xfrm_mode {
 375         /*
 376          * Remove encapsulation header.
 377          *
 378          * The IP header will be moved over the top of the encapsulation
 379          * header.
 380          *
 381          * On entry, the transport header shall point to where the IP header
 382          * should be and the network header shall be set to where the IP
 383          * header currently is.  skb->data shall point to the start of the
 384          * payload.
 385          */
 386         int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
 387
 388         /*
 389          * This is the actual input entry point.
 390          *
 391          * For transport mode and equivalent this would be identical to
 392          * input2 (which does not need to be set).  While tunnel mode
 393          * and equivalent would set this to the tunnel encapsulation function
 394          * xfrm4_prepare_input that would in turn call input2.
 395          */
 396         int (*input)(struct xfrm_state *x, struct sk_buff *skb);
 397
 398         /*
 399          * Add encapsulation header.
 400          *
 401          * On exit, the transport header will be set to the start of the
 402          * encapsulation header to be filled in by x->type->output and
 403          * the mac header will be set to the nextheader (protocol for
 404          * IPv4) field of the extension header directly preceding the
 405          * encapsulation header, or in its absence, that of the top IP
 406          * header.  The value of the network header will always point
 407          * to the top IP header while skb->data will point to the payload.
 408          */
 409         int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
 410
 411         /*
 412          * This is the actual output entry point.
 413          *
 414          * For transport mode and equivalent this would be identical to
 415          * output2 (which does not need to be set).  While tunnel mode
 416          * and equivalent would set this to a tunnel encapsulation function
 417          * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
 418          * call output2.
 419          */
 420         int (*output)(struct xfrm_state *x, struct sk_buff *skb);
 421
 422         struct xfrm_state_afinfo *afinfo;
 423         struct module *owner;
 424         unsigned int encap;
 425         int flags;
 426 };
 427
 428 /* Flags for xfrm_mode. */
 429 enum {
 430         XFRM_MODE_FLAG_TUNNEL = 1,
 431 };
 432
 433 extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
 434 extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
 435
 436 static inline int xfrm_af2proto(unsigned int family)
 437 {
 438         switch(family) {
 439         case AF_INET:
 440                 return IPPROTO_IPIP;
 441         case AF_INET6:
 442                 return IPPROTO_IPV6;
 443         default:
 444                 return 0;
 445         }
 446 }
 447
 448 static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
 449 {
 450         if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
 451             (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
 452                 return x->inner_mode;
 453         else
 454                 return x->inner_mode_iaf;
 455 }
 456
 457 struct xfrm_tmpl {
 458 /* id in template is interpreted as:
 459  * daddr - destination of tunnel, may be zero for transport mode.
 460  * spi   - zero to acquire spi. Not zero if spi is static, then
 461  *         daddr must be fixed too.
 462  * proto - AH/ESP/IPCOMP
 463  */
 464         struct xfrm_id          id;
 465
 466 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 467         xfrm_address_t          saddr;
 468
 469         unsigned short          encap_family;
 470
 471         u32                     reqid;
 472
 473 /* Mode: transport, tunnel etc. */
 474         u8                      mode;
 475
 476 /* Sharing mode: unique, this session only, this user only etc. */
 477         u8                      share;
 478
 479 /* May skip this transfomration if no SA is found */
 480         u8                      optional;
 481
 482 /* Skip aalgos/ealgos/calgos checks. */
 483         u8                      allalgs;
 484
 485 /* Bit mask of algos allowed for acquisition */
 486         u32                     aalgos;
 487         u32                     ealgos;
 488         u32                     calgos;
 489 };
 490
 491 #define XFRM_MAX_DEPTH          6
 492
 493 struct xfrm_policy_walk_entry {
 494         struct list_head        all;
 495         u8                      dead;
 496 };
 497
 498 struct xfrm_policy_walk {
 499         struct xfrm_policy_walk_entry walk;
 500         u8 type;
 501         u32 seq;
 502 };
 503
 504 struct xfrm_policy_queue {
 505         struct sk_buff_head     hold_queue;
 506         struct timer_list       hold_timer;
 507         unsigned long           timeout;
 508 };
 509
 510 struct xfrm_policy {
 511 #ifdef CONFIG_NET_NS
 512         struct net              *xp_net;
 513 #endif
 514         struct hlist_node       bydst;
 515         struct hlist_node       byidx;
 516
 517         /* This lock only affects elements except for entry. */
 518         rwlock_t                lock;
 519         atomic_t                refcnt;
 520         struct timer_list       timer;
 521
 522         struct flow_cache_object flo;
 523         atomic_t                genid;
 524         u32                     priority;
 525         u32                     index;
 526         struct xfrm_mark        mark;
 527         struct xfrm_selector    selector;
 528         struct xfrm_lifetime_cfg lft;
 529         struct xfrm_lifetime_cur curlft;
 530         struct xfrm_policy_walk_entry walk;
 531         struct xfrm_policy_queue polq;
 532         u8                      type;
 533         u8                      action;
 534         u8                      flags;
 535         u8                      xfrm_nr;
 536         u16                     family;
 537         struct xfrm_sec_ctx     *security;
 538         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 539 };
 540
 541 static inline struct net *xp_net(const struct xfrm_policy *xp)
 542 {
 543         return read_pnet(&xp->xp_net);
 544 }
 545
 546 struct xfrm_kmaddress {
 547         xfrm_address_t          local;
 548         xfrm_address_t          remote;
 549         u32                     reserved;
 550         u16                     family;
 551 };
 552
 553 struct xfrm_migrate {
 554         xfrm_address_t          old_daddr;
 555         xfrm_address_t          old_saddr;
 556         xfrm_address_t          new_daddr;
 557         xfrm_address_t          new_saddr;
 558         u8                      proto;
 559         u8                      mode;
 560         u16                     reserved;
 561         u32                     reqid;
 562         u16                     old_family;
 563         u16                     new_family;
 564 };
 565
 566 #define XFRM_KM_TIMEOUT                30
 567 /* what happened */
 568 #define XFRM_REPLAY_UPDATE      XFRM_AE_CR
 569 #define XFRM_REPLAY_TIMEOUT     XFRM_AE_CE
 570
 571 /* default aevent timeout in units of 100ms */
 572 #define XFRM_AE_ETIME                   10
 573 /* Async Event timer multiplier */
 574 #define XFRM_AE_ETH_M                   10
 575 /* default seq threshold size */
 576 #define XFRM_AE_SEQT_SIZE               2
 577
 578 struct xfrm_mgr {
 579         struct list_head        list;
 580         char                    *id;
 581         int                     (*notify)(struct xfrm_state *x, const struct km_event *c);
 582         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
 583         struct xfrm_policy      *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
 584         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
 585         int                     (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
 586         int                     (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
 587         int                     (*migrate)(const struct xfrm_selector *sel,
 588                                            u8 dir, u8 type,
 589                                            const struct xfrm_migrate *m,
 590                                            int num_bundles,
 591                                            const struct xfrm_kmaddress *k);
 592 };
 593
 594 extern int xfrm_register_km(struct xfrm_mgr *km);
 595 extern int xfrm_unregister_km(struct xfrm_mgr *km);
 596
 597 /*
 598  * This structure is used for the duration where packets are being
 599  * transformed by IPsec.  As soon as the packet leaves IPsec the
 600  * area beyond the generic IP part may be overwritten.
 601  */
 602 struct xfrm_skb_cb {
 603         union {
 604                 struct inet_skb_parm h4;
 605                 struct inet6_skb_parm h6;
 606         } header;
 607
 608         /* Sequence number for replay protection. */
 609         union {
 610                 struct {
 611                         __u32 low;
 612                         __u32 hi;
 613                 } output;
 614                 struct {
 615                         __be32 low;
 616                         __be32 hi;
 617                 } input;
 618         } seq;
 619 };
 620
 621 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
 622
 623 /*
 624  * This structure is used by the afinfo prepare_input/prepare_output functions
 625  * to transmit header information to the mode input/output functions.
 626  */
 627 struct xfrm_mode_skb_cb {
 628         union {
 629                 struct inet_skb_parm h4;
 630                 struct inet6_skb_parm h6;
 631         } header;
 632
 633         /* Copied from header for IPv4, always set to zero and DF for IPv6. */
 634         __be16 id;
 635         __be16 frag_off;
 636
 637         /* IP header length (excluding options or extension headers). */
 638         u8 ihl;
 639
 640         /* TOS for IPv4, class for IPv6. */
 641         u8 tos;
 642
 643         /* TTL for IPv4, hop limitfor IPv6. */
 644         u8 ttl;
 645
 646         /* Protocol for IPv4, NH for IPv6. */
 647         u8 protocol;
 648
 649         /* Option length for IPv4, zero for IPv6. */
 650         u8 optlen;
 651
 652         /* Used by IPv6 only, zero for IPv4. */
 653         u8 flow_lbl[3];
 654 };
 655
 656 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
 657
 658 /*
 659  * This structure is used by the input processing to locate the SPI and
 660  * related information.
 661  */
 662 struct xfrm_spi_skb_cb {
 663         union {
 664                 struct inet_skb_parm h4;
 665                 struct inet6_skb_parm h6;
 666         } header;
 667
 668         unsigned int daddroff;
 669         unsigned int family;
 670 };
 671
 672 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
 673
 674 /* Audit Information */
 675 struct xfrm_audit {
 676         u32     secid;
 677         kuid_t  loginuid;
 678         u32     sessionid;
 679 };
 680
 681 #ifdef CONFIG_AUDITSYSCALL
 682 static inline struct audit_buffer *xfrm_audit_start(const char *op)
 683 {
 684         struct audit_buffer *audit_buf = NULL;
 685
 686         if (audit_enabled == 0)
 687                 return NULL;
 688         audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
 689                                     AUDIT_MAC_IPSEC_EVENT);
 690         if (audit_buf == NULL)
 691                 return NULL;
 692         audit_log_format(audit_buf, "op=%s", op);
 693         return audit_buf;
 694 }
 695
 696 static inline void xfrm_audit_helper_usrinfo(kuid_t auid, u32 ses, u32 secid,
 697                                              struct audit_buffer *audit_buf)
 698 {
 699         char *secctx;
 700         u32 secctx_len;
 701
 702         audit_log_format(audit_buf, " auid=%u ses=%u",
 703                          from_kuid(&init_user_ns, auid), ses);
 704         if (secid != 0 &&
 705             security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
 706                 audit_log_format(audit_buf, " subj=%s", secctx);
 707                 security_release_secctx(secctx, secctx_len);
 708         } else
 709                 audit_log_task_context(audit_buf);
 710 }
 711
 712 extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 713                                   kuid_t auid, u32 ses, u32 secid);
 714 extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 715                                   kuid_t auid, u32 ses, u32 secid);
 716 extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
 717                                  kuid_t auid, u32 ses, u32 secid);
 718 extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 719                                     kuid_t auid, u32 ses, u32 secid);
 720 extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 721                                              struct sk_buff *skb);
 722 extern void xfrm_audit_state_replay(struct xfrm_state *x,
 723                                     struct sk_buff *skb, __be32 net_seq);
 724 extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
 725 extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 726                                       __be32 net_spi, __be32 net_seq);
 727 extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
 728                                      struct sk_buff *skb, u8 proto);
 729 #else
 730
 731 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 732                                   kuid_t auid, u32 ses, u32 secid)
 733 {
 734 }
 735
 736 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 737                                   kuid_t auid, u32 ses, u32 secid)
 738 {
 739 }
 740
 741 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
 742                                  kuid_t auid, u32 ses, u32 secid)
 743 {
 744 }
 745
 746 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 747                                     kuid_t auid, u32 ses, u32 secid)
 748 {
 749 }
 750
 751 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 752                                              struct sk_buff *skb)
 753 {
 754 }
 755
 756 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
 757                                            struct sk_buff *skb, __be32 net_seq)
 758 {
 759 }
 760
 761 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
 762                                       u16 family)
 763 {
 764 }
 765
 766 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 767                                       __be32 net_spi, __be32 net_seq)
 768 {
 769 }
 770
 771 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
 772                                      struct sk_buff *skb, u8 proto)
 773 {
 774 }
 775 #endif /* CONFIG_AUDITSYSCALL */
 776
 777 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 778 {
 779         if (likely(policy != NULL))
 780                 atomic_inc(&policy->refcnt);
 781 }
 782
 783 extern void xfrm_policy_destroy(struct xfrm_policy *policy);
 784
 785 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 786 {
 787         if (atomic_dec_and_test(&policy->refcnt))
 788                 xfrm_policy_destroy(policy);
 789 }
 790
 791 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 792 {
 793         int i;
 794         for (i = npols - 1; i >= 0; --i)
 795                 xfrm_pol_put(pols[i]);
 796 }
 797
 798 extern void __xfrm_state_destroy(struct xfrm_state *);
 799
 800 static inline void __xfrm_state_put(struct xfrm_state *x)
 801 {
 802         atomic_dec(&x->refcnt);
 803 }
 804
 805 static inline void xfrm_state_put(struct xfrm_state *x)
 806 {
 807         if (atomic_dec_and_test(&x->refcnt))
 808                 __xfrm_state_destroy(x);
 809 }
 810
 811 static inline void xfrm_state_hold(struct xfrm_state *x)
 812 {
 813         atomic_inc(&x->refcnt);
 814 }
 815
 816 static inline bool addr_match(const void *token1, const void *token2,
 817                               int prefixlen)
 818 {
 819         const __be32 *a1 = token1;
 820         const __be32 *a2 = token2;
 821         int pdw;
 822         int pbi;
 823
 824         pdw = prefixlen >> 5;     /* num of whole u32 in prefix */
 825         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 826
 827         if (pdw)
 828                 if (memcmp(a1, a2, pdw << 2))
 829                         return false;
 830
 831         if (pbi) {
 832                 __be32 mask;
 833
 834                 mask = htonl((0xffffffff) << (32 - pbi));
 835
 836                 if ((a1[pdw] ^ a2[pdw]) & mask)
 837                         return false;
 838         }
 839
 840         return true;
 841 }
 842
 843 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
 844 {
 845         /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
 846         if (prefixlen == 0)
 847                 return true;
 848         return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
 849 }
 850
 851 static __inline__
 852 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
 853 {
 854         __be16 port;
 855         switch(fl->flowi_proto) {
 856         case IPPROTO_TCP:
 857         case IPPROTO_UDP:
 858         case IPPROTO_UDPLITE:
 859         case IPPROTO_SCTP:
 860                 port = uli->ports.sport;
 861                 break;
 862         case IPPROTO_ICMP:
 863         case IPPROTO_ICMPV6:
 864                 port = htons(uli->icmpt.type);
 865                 break;
 866         case IPPROTO_MH:
 867                 port = htons(uli->mht.type);
 868                 break;
 869         case IPPROTO_GRE:
 870                 port = htons(ntohl(uli->gre_key) >> 16);
 871                 break;
 872         default:
 873                 port = 0;       /*XXX*/
 874         }
 875         return port;
 876 }
 877
 878 static __inline__
 879 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
 880 {
 881         __be16 port;
 882         switch(fl->flowi_proto) {
 883         case IPPROTO_TCP:
 884         case IPPROTO_UDP:
 885         case IPPROTO_UDPLITE:
 886         case IPPROTO_SCTP:
 887                 port = uli->ports.dport;
 888                 break;
 889         case IPPROTO_ICMP:
 890         case IPPROTO_ICMPV6:
 891                 port = htons(uli->icmpt.code);
 892                 break;
 893         case IPPROTO_GRE:
 894                 port = htons(ntohl(uli->gre_key) & 0xffff);
 895                 break;
 896         default:
 897                 port = 0;       /*XXX*/
 898         }
 899         return port;
 900 }
 901
 902 extern bool xfrm_selector_match(const struct xfrm_selector *sel,
 903                                 const struct flowi *fl,
 904                                 unsigned short family);
 905
 906 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 907 /*      If neither has a context --> match
 908  *      Otherwise, both must have a context and the sids, doi, alg must match
 909  */
 910 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 911 {
 912         return ((!s1 && !s2) ||
 913                 (s1 && s2 &&
 914                  (s1->ctx_sid == s2->ctx_sid) &&
 915                  (s1->ctx_doi == s2->ctx_doi) &&
 916                  (s1->ctx_alg == s2->ctx_alg)));
 917 }
 918 #else
 919 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 920 {
 921         return true;
 922 }
 923 #endif
 924
 925 /* A struct encoding bundle of transformations to apply to some set of flow.
 926  *
 927  * dst->child points to the next element of bundle.
 928  * dst->xfrm  points to an instanse of transformer.
 929  *
 930  * Due to unfortunate limitations of current routing cache, which we
 931  * have no time to fix, it mirrors struct rtable and bound to the same
 932  * routing key, including saddr,daddr. However, we can have many of
 933  * bundles differing by session id. All the bundles grow from a parent
 934  * policy rule.
 935  */
 936 struct xfrm_dst {
 937         union {
 938                 struct dst_entry        dst;
 939                 struct rtable           rt;
 940                 struct rt6_info         rt6;
 941         } u;
 942         struct dst_entry *route;
 943         struct flow_cache_object flo;
 944         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
 945         int num_pols, num_xfrms;
 946 #ifdef CONFIG_XFRM_SUB_POLICY
 947         struct flowi *origin;
 948         struct xfrm_selector *partner;
 949 #endif
 950         u32 xfrm_genid;
 951         u32 policy_genid;
 952         u32 route_mtu_cached;
 953         u32 child_mtu_cached;
 954         u32 route_cookie;
 955         u32 path_cookie;
 956 };
 957
 958 #ifdef CONFIG_XFRM
 959 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 960 {
 961         xfrm_pols_put(xdst->pols, xdst->num_pols);
 962         dst_release(xdst->route);
 963         if (likely(xdst->u.dst.xfrm))
 964                 xfrm_state_put(xdst->u.dst.xfrm);
 965 #ifdef CONFIG_XFRM_SUB_POLICY
 966         kfree(xdst->origin);
 967         xdst->origin = NULL;
 968         kfree(xdst->partner);
 969         xdst->partner = NULL;
 970 #endif
 971 }
 972 #endif
 973
 974 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 975
 976 struct sec_path {
 977         atomic_t                refcnt;
 978         int                     len;
 979         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 980 };
 981
 982 static inline int secpath_exists(struct sk_buff *skb)
 983 {
 984 #ifdef CONFIG_XFRM
 985         return skb->sp != NULL;
 986 #else
 987         return 0;
 988 #endif
 989 }
 990
 991 static inline struct sec_path *
 992 secpath_get(struct sec_path *sp)
 993 {
 994         if (sp)
 995                 atomic_inc(&sp->refcnt);
 996         return sp;
 997 }
 998
 999 extern void __secpath_destroy(struct sec_path *sp);
1000
1001 static inline void
1002 secpath_put(struct sec_path *sp)
1003 {
1004         if (sp && atomic_dec_and_test(&sp->refcnt))
1005                 __secpath_destroy(sp);
1006 }
1007
1008 extern struct sec_path *secpath_dup(struct sec_path *src);
1009
1010 static inline void
1011 secpath_reset(struct sk_buff *skb)
1012 {
1013 #ifdef CONFIG_XFRM
1014         secpath_put(skb->sp);
1015         skb->sp = NULL;
1016 #endif
1017 }
1018
1019 static inline int
1020 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1021 {
1022         switch (family) {
1023         case AF_INET:
1024                 return addr->a4 == 0;
1025         case AF_INET6:
1026                 return ipv6_addr_any((struct in6_addr *)&addr->a6);
1027         }
1028         return 0;
1029 }
1030
1031 static inline int
1032 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1033 {
1034         return  (tmpl->saddr.a4 &&
1035                  tmpl->saddr.a4 != x->props.saddr.a4);
1036 }
1037
1038 static inline int
1039 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1040 {
1041         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1042                  !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1043 }
1044
1045 static inline int
1046 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1047 {
1048         switch (family) {
1049         case AF_INET:
1050                 return __xfrm4_state_addr_cmp(tmpl, x);
1051         case AF_INET6:
1052                 return __xfrm6_state_addr_cmp(tmpl, x);
1053         }
1054         return !0;
1055 }
1056
1057 #ifdef CONFIG_XFRM
1058 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
1059
1060 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1061                                        struct sk_buff *skb,
1062                                        unsigned int family, int reverse)
1063 {
1064         struct net *net = dev_net(skb->dev);
1065         int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1066
1067         if (sk && sk->sk_policy[XFRM_POLICY_IN])
1068                 return __xfrm_policy_check(sk, ndir, skb, family);
1069
1070         return  (!net->xfrm.policy_count[dir] && !skb->sp) ||
1071                 (skb_dst(skb)->flags & DST_NOPOLICY) ||
1072                 __xfrm_policy_check(sk, ndir, skb, family);
1073 }
1074
1075 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1076 {
1077         return __xfrm_policy_check2(sk, dir, skb, family, 0);
1078 }
1079
1080 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1081 {
1082         return xfrm_policy_check(sk, dir, skb, AF_INET);
1083 }
1084
1085 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1086 {
1087         return xfrm_policy_check(sk, dir, skb, AF_INET6);
1088 }
1089
1090 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1091                                              struct sk_buff *skb)
1092 {
1093         return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1094 }
1095
1096 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1097                                              struct sk_buff *skb)
1098 {
1099         return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1100 }
1101
1102 extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1103                                  unsigned int family, int reverse);
1104
1105 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1106                                       unsigned int family)
1107 {
1108         return __xfrm_decode_session(skb, fl, family, 0);
1109 }
1110
1111 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1112                                               struct flowi *fl,
1113                                               unsigned int family)
1114 {
1115         return __xfrm_decode_session(skb, fl, family, 1);
1116 }
1117
1118 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1119
1120 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1121 {
1122         struct net *net = dev_net(skb->dev);
1123
1124         return  !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1125                 (skb_dst(skb)->flags & DST_NOXFRM) ||
1126                 __xfrm_route_forward(skb, family);
1127 }
1128
1129 static inline int xfrm4_route_forward(struct sk_buff *skb)
1130 {
1131         return xfrm_route_forward(skb, AF_INET);
1132 }
1133
1134 static inline int xfrm6_route_forward(struct sk_buff *skb)
1135 {
1136         return xfrm_route_forward(skb, AF_INET6);
1137 }
1138
1139 extern int __xfrm_sk_clone_policy(struct sock *sk);
1140
1141 static inline int xfrm_sk_clone_policy(struct sock *sk)
1142 {
1143         if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1144                 return __xfrm_sk_clone_policy(sk);
1145         return 0;
1146 }
1147
1148 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1149
1150 static inline void xfrm_sk_free_policy(struct sock *sk)
1151 {
1152         if (unlikely(sk->sk_policy[0] != NULL)) {
1153                 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1154                 sk->sk_policy[0] = NULL;
1155         }
1156         if (unlikely(sk->sk_policy[1] != NULL)) {
1157                 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1158                 sk->sk_policy[1] = NULL;
1159         }
1160 }
1161
1162 #else
1163
1164 static inline void xfrm_sk_free_policy(struct sock *sk) {}
1165 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1166 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1167 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1168 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1169 {
1170         return 1;
1171 }
1172 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1173 {
1174         return 1;
1175 }
1176 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1177 {
1178         return 1;
1179 }
1180 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1181                                               struct flowi *fl,
1182                                               unsigned int family)
1183 {
1184         return -ENOSYS;
1185 }
1186 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1187                                              struct sk_buff *skb)
1188 {
1189         return 1;
1190 }
1191 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1192                                              struct sk_buff *skb)
1193 {
1194         return 1;
1195 }
1196 #endif
1197
1198 static __inline__
1199 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1200 {
1201         switch (family){
1202         case AF_INET:
1203                 return (xfrm_address_t *)&fl->u.ip4.daddr;
1204         case AF_INET6:
1205                 return (xfrm_address_t *)&fl->u.ip6.daddr;
1206         }
1207         return NULL;
1208 }
1209
1210 static __inline__
1211 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1212 {
1213         switch (family){
1214         case AF_INET:
1215                 return (xfrm_address_t *)&fl->u.ip4.saddr;
1216         case AF_INET6:
1217                 return (xfrm_address_t *)&fl->u.ip6.saddr;
1218         }
1219         return NULL;
1220 }
1221
1222 static __inline__
1223 void xfrm_flowi_addr_get(const struct flowi *fl,
1224                          xfrm_address_t *saddr, xfrm_address_t *daddr,
1225                          unsigned short family)
1226 {
1227         switch(family) {
1228         case AF_INET:
1229                 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1230                 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1231                 break;
1232         case AF_INET6:
1233                 *(struct in6_addr *)saddr->a6 = fl->u.ip6.saddr;
1234                 *(struct in6_addr *)daddr->a6 = fl->u.ip6.daddr;
1235                 break;
1236         }
1237 }
1238
1239 static __inline__ int
1240 __xfrm4_state_addr_check(const struct xfrm_state *x,
1241                          const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1242 {
1243         if (daddr->a4 == x->id.daddr.a4 &&
1244             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1245                 return 1;
1246         return 0;
1247 }
1248
1249 static __inline__ int
1250 __xfrm6_state_addr_check(const struct xfrm_state *x,
1251                          const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1252 {
1253         if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1254             (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1255              ipv6_addr_any((struct in6_addr *)saddr) ||
1256              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1257                 return 1;
1258         return 0;
1259 }
1260
1261 static __inline__ int
1262 xfrm_state_addr_check(const struct xfrm_state *x,
1263                       const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1264                       unsigned short family)
1265 {
1266         switch (family) {
1267         case AF_INET:
1268                 return __xfrm4_state_addr_check(x, daddr, saddr);
1269         case AF_INET6:
1270                 return __xfrm6_state_addr_check(x, daddr, saddr);
1271         }
1272         return 0;
1273 }
1274
1275 static __inline__ int
1276 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1277                            unsigned short family)
1278 {
1279         switch (family) {
1280         case AF_INET:
1281                 return __xfrm4_state_addr_check(x,
1282                                                 (const xfrm_address_t *)&fl->u.ip4.daddr,
1283                                                 (const xfrm_address_t *)&fl->u.ip4.saddr);
1284         case AF_INET6:
1285                 return __xfrm6_state_addr_check(x,
1286                                                 (const xfrm_address_t *)&fl->u.ip6.daddr,
1287                                                 (const xfrm_address_t *)&fl->u.ip6.saddr);
1288         }
1289         return 0;
1290 }
1291
1292 static inline int xfrm_state_kern(const struct xfrm_state *x)
1293 {
1294         return atomic_read(&x->tunnel_users);
1295 }
1296
1297 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1298 {
1299         return (!userproto || proto == userproto ||
1300                 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1301                                                   proto == IPPROTO_ESP ||
1302                                                   proto == IPPROTO_COMP)));
1303 }
1304
1305 /*
1306  * xfrm algorithm information
1307  */
1308 struct xfrm_algo_aead_info {
1309         u16 icv_truncbits;
1310 };
1311
1312 struct xfrm_algo_auth_info {
1313         u16 icv_truncbits;
1314         u16 icv_fullbits;
1315 };
1316
1317 struct xfrm_algo_encr_info {
1318         u16 blockbits;
1319         u16 defkeybits;
1320 };
1321
1322 struct xfrm_algo_comp_info {
1323         u16 threshold;
1324 };
1325
1326 struct xfrm_algo_desc {
1327         char *name;
1328         char *compat;
1329         u8 available:1;
1330         u8 pfkey_supported:1;
1331         union {
1332                 struct xfrm_algo_aead_info aead;
1333                 struct xfrm_algo_auth_info auth;
1334                 struct xfrm_algo_encr_info encr;
1335                 struct xfrm_algo_comp_info comp;
1336         } uinfo;
1337         struct sadb_alg desc;
1338 };
1339
1340 /* XFRM tunnel handlers.  */
1341 struct xfrm_tunnel {
1342         int (*handler)(struct sk_buff *skb);
1343         int (*err_handler)(struct sk_buff *skb, u32 info);
1344
1345         struct xfrm_tunnel __rcu *next;
1346         int priority;
1347 };
1348
1349 struct xfrm6_tunnel {
1350         int (*handler)(struct sk_buff *skb);
1351         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1352                            u8 type, u8 code, int offset, __be32 info);
1353         struct xfrm6_tunnel __rcu *next;
1354         int priority;
1355 };
1356
1357 extern void xfrm_init(void);
1358 extern void xfrm4_init(void);
1359 extern int xfrm_state_init(struct net *net);
1360 extern void xfrm_state_fini(struct net *net);
1361 extern void xfrm4_state_init(void);
1362 #ifdef CONFIG_XFRM
1363 extern int xfrm6_init(void);
1364 extern void xfrm6_fini(void);
1365 extern int xfrm6_state_init(void);
1366 extern void xfrm6_state_fini(void);
1367 #else
1368 static inline int xfrm6_init(void)
1369 {
1370         return 0;
1371 }
1372 static inline void xfrm6_fini(void)
1373 {
1374         ;
1375 }
1376 #endif
1377
1378 #ifdef CONFIG_XFRM_STATISTICS
1379 extern int xfrm_proc_init(struct net *net);
1380 extern void xfrm_proc_fini(struct net *net);
1381 #endif
1382
1383 extern int xfrm_sysctl_init(struct net *net);
1384 #ifdef CONFIG_SYSCTL
1385 extern void xfrm_sysctl_fini(struct net *net);
1386 #else
1387 static inline void xfrm_sysctl_fini(struct net *net)
1388 {
1389 }
1390 #endif
1391
1392 extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
1393 extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1394                            int (*func)(struct xfrm_state *, int, void*), void *);
1395 extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
1396 extern struct xfrm_state *xfrm_state_alloc(struct net *net);
1397 extern struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1398                                           const xfrm_address_t *saddr,
1399                                           const struct flowi *fl,
1400                                           struct xfrm_tmpl *tmpl,
1401                                           struct xfrm_policy *pol, int *err,
1402                                           unsigned short family);
1403 extern struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1404                                                xfrm_address_t *daddr,
1405                                                xfrm_address_t *saddr,
1406                                                unsigned short family,
1407                                                u8 mode, u8 proto, u32 reqid);
1408 extern int xfrm_state_check_expire(struct xfrm_state *x);
1409 extern void xfrm_state_insert(struct xfrm_state *x);
1410 extern int xfrm_state_add(struct xfrm_state *x);
1411 extern int xfrm_state_update(struct xfrm_state *x);
1412 extern struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1413                                             const xfrm_address_t *daddr, __be32 spi,
1414                                             u8 proto, unsigned short family);
1415 extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1416                                                    const xfrm_address_t *daddr,
1417                                                    const xfrm_address_t *saddr,
1418                                                    u8 proto,
1419                                                    unsigned short family);
1420 #ifdef CONFIG_XFRM_SUB_POLICY
1421 extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1422                           int n, unsigned short family);
1423 extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1424                            int n, unsigned short family);
1425 #else
1426 static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1427                                  int n, unsigned short family)
1428 {
1429         return -ENOSYS;
1430 }
1431
1432 static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1433                                   int n, unsigned short family)
1434 {
1435         return -ENOSYS;
1436 }
1437 #endif
1438
1439 struct xfrmk_sadinfo {
1440         u32 sadhcnt; /* current hash bkts */
1441         u32 sadhmcnt; /* max allowed hash bkts */
1442         u32 sadcnt; /* current running count */
1443 };
1444
1445 struct xfrmk_spdinfo {
1446         u32 incnt;
1447         u32 outcnt;
1448         u32 fwdcnt;
1449         u32 inscnt;
1450         u32 outscnt;
1451         u32 fwdscnt;
1452         u32 spdhcnt;
1453         u32 spdhmcnt;
1454 };
1455
1456 extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark,
1457                                               u32 seq);
1458 extern int xfrm_state_delete(struct xfrm_state *x);
1459 extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
1460 extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1461 extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1462 extern u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1463 extern int xfrm_init_replay(struct xfrm_state *x);
1464 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1465 extern int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1466 extern int xfrm_init_state(struct xfrm_state *x);
1467 extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1468 extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1469                       int encap_type);
1470 extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1471 extern int xfrm_output_resume(struct sk_buff *skb, int err);
1472 extern int xfrm_output(struct sk_buff *skb);
1473 extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1474 extern int xfrm4_extract_header(struct sk_buff *skb);
1475 extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1476 extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1477                            int encap_type);
1478 extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
1479 extern int xfrm4_rcv(struct sk_buff *skb);
1480
1481 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1482 {
1483         return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1484 }
1485
1486 extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1487 extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1488 extern int xfrm4_output(struct sk_buff *skb);
1489 extern int xfrm4_output_finish(struct sk_buff *skb);
1490 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1491 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1492 extern int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel *handler);
1493 extern int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel *handler);
1494 extern int xfrm6_extract_header(struct sk_buff *skb);
1495 extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1496 extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1497 extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
1498 extern int xfrm6_rcv(struct sk_buff *skb);
1499 extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1500                             xfrm_address_t *saddr, u8 proto);
1501 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1502 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1503 extern __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1504 extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1505 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1506 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1507 extern int xfrm6_output(struct sk_buff *skb);
1508 extern int xfrm6_output_finish(struct sk_buff *skb);
1509 extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1510                                  u8 **prevhdr);
1511
1512 #ifdef CONFIG_XFRM
1513 extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1514 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
1515 #else
1516 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1517 {
1518         return -ENOPROTOOPT;
1519 }
1520
1521 static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1522 {
1523         /* should not happen */
1524         kfree_skb(skb);
1525         return 0;
1526 }
1527 #endif
1528
1529 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1530
1531 extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1532 extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1533         int (*func)(struct xfrm_policy *, int, int, void*), void *);
1534 extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
1535 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1536 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1537                                           u8 type, int dir,
1538                                           struct xfrm_selector *sel,
1539                                           struct xfrm_sec_ctx *ctx, int delete,
1540                                           int *err);
1541 struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, u32 id, int delete, int *err);
1542 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
1543 u32 xfrm_get_acqseq(void);
1544 extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1545 struct xfrm_state *xfrm_find_acq(struct net *net, struct xfrm_mark *mark,
1546                                  u8 mode, u32 reqid, u8 proto,
1547                                  const xfrm_address_t *daddr,
1548                                  const xfrm_address_t *saddr, int create,
1549                                  unsigned short family);
1550 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1551
1552 #ifdef CONFIG_XFRM_MIGRATE
1553 extern int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1554                       const struct xfrm_migrate *m, int num_bundles,
1555                       const struct xfrm_kmaddress *k);
1556 extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1557 extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1558                                               struct xfrm_migrate *m);
1559 extern int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1560                         struct xfrm_migrate *m, int num_bundles,
1561                         struct xfrm_kmaddress *k);
1562 #endif
1563
1564 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1565 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1566 extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
1567
1568 extern void xfrm_input_init(void);
1569 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1570
1571 extern void xfrm_probe_algs(void);
1572 extern int xfrm_count_pfkey_auth_supported(void);
1573 extern int xfrm_count_pfkey_enc_supported(void);
1574 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1575 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1576 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1577 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1578 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1579 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1580 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1581 extern struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1582 extern struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1583                                                    int probe);
1584
1585 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1586                                     const xfrm_address_t *b)
1587 {
1588         return ipv6_addr_equal((const struct in6_addr *)a,
1589                                (const struct in6_addr *)b);
1590 }
1591
1592 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1593                                    const xfrm_address_t *b,
1594                                    sa_family_t family)
1595 {
1596         switch (family) {
1597         default:
1598         case AF_INET:
1599                 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1600         case AF_INET6:
1601                 return xfrm6_addr_equal(a, b);
1602         }
1603 }
1604
1605 static inline int xfrm_policy_id2dir(u32 index)
1606 {
1607         return index & 7;
1608 }
1609
1610 #ifdef CONFIG_XFRM
1611 static inline int xfrm_aevent_is_on(struct net *net)
1612 {
1613         struct sock *nlsk;
1614         int ret = 0;
1615
1616         rcu_read_lock();
1617         nlsk = rcu_dereference(net->xfrm.nlsk);
1618         if (nlsk)
1619                 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1620         rcu_read_unlock();
1621         return ret;
1622 }
1623 #endif
1624
1625 static inline int xfrm_alg_len(const struct xfrm_algo *alg)
1626 {
1627         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1628 }
1629
1630 static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1631 {
1632         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1633 }
1634
1635 static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1636 {
1637         return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1638 }
1639
1640 #ifdef CONFIG_XFRM_MIGRATE
1641 static inline int xfrm_replay_clone(struct xfrm_state *x,
1642                                      struct xfrm_state *orig)
1643 {
1644         x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1645                                 GFP_KERNEL);
1646         if (!x->replay_esn)
1647                 return -ENOMEM;
1648
1649         x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1650         x->replay_esn->replay_window = orig->replay_esn->replay_window;
1651
1652         x->preplay_esn = kmemdup(x->replay_esn,
1653                                  xfrm_replay_state_esn_len(x->replay_esn),
1654                                  GFP_KERNEL);
1655         if (!x->preplay_esn) {
1656                 kfree(x->replay_esn);
1657                 return -ENOMEM;
1658         }
1659
1660         return 0;
1661 }
1662
1663 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1664 {
1665         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1666 }
1667
1668 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1669 {
1670         return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1671 }
1672
1673 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1674 {
1675         int i;
1676         for (i = 0; i < n; i++)
1677                 xfrm_state_put(*(states + i));
1678 }
1679
1680 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1681 {
1682         int i;
1683         for (i = 0; i < n; i++)
1684                 xfrm_state_delete(*(states + i));
1685 }
1686 #endif
1687
1688 #ifdef CONFIG_XFRM
1689 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1690 {
1691         return skb->sp->xvec[skb->sp->len - 1];
1692 }
1693 #endif
1694
1695 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1696 {
1697         if (attrs[XFRMA_MARK])
1698                 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1699         else
1700                 m->v = m->m = 0;
1701
1702         return m->v & m->m;
1703 }
1704
1705 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1706 {
1707         int ret = 0;
1708
1709         if (m->m | m->v)
1710                 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1711         return ret;
1712 }
1713
1714 #endif  /* _NET_XFRM_H */