xfrm.h 49.2 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3
#ifndef _NET_XFRM_H
#define _NET_XFRM_H

Herbert Xu's avatar
Herbert Xu committed
4
#include <linux/compiler.h>
Linus Torvalds's avatar
Linus Torvalds committed
5 6 7 8
#include <linux/xfrm.h>
#include <linux/spinlock.h>
#include <linux/list.h>
#include <linux/skbuff.h>
9
#include <linux/socket.h>
Linus Torvalds's avatar
Linus Torvalds committed
10
#include <linux/pfkeyv2.h>
11
#include <linux/ipsec.h>
Linus Torvalds's avatar
Linus Torvalds committed
12
#include <linux/in6.h>
Arjan van de Ven's avatar
Arjan van de Ven committed
13
#include <linux/mutex.h>
Joy Latten's avatar
Joy Latten committed
14
#include <linux/audit.h>
15
#include <linux/slab.h>
Linus Torvalds's avatar
Linus Torvalds committed
16 17 18

#include <net/sock.h>
#include <net/dst.h>
19
#include <net/ip.h>
Linus Torvalds's avatar
Linus Torvalds committed
20 21 22
#include <net/route.h>
#include <net/ipv6.h>
#include <net/ip6_fib.h>
23
#include <net/flow.h>
24 25 26

#include <linux/interrupt.h>

27 28 29
#ifdef CONFIG_XFRM_STATISTICS
#include <net/snmp.h>
#endif
Linus Torvalds's avatar
Linus Torvalds committed
30

31 32 33 34 35 36 37 38
#define XFRM_PROTO_ESP		50
#define XFRM_PROTO_AH		51
#define XFRM_PROTO_COMP		108
#define XFRM_PROTO_IPIP		4
#define XFRM_PROTO_IPV6		41
#define XFRM_PROTO_ROUTING	IPPROTO_ROUTING
#define XFRM_PROTO_DSTOPTS	IPPROTO_DSTOPTS

39
#define XFRM_ALIGN4(len)	(((len) + 3) & ~3)
Linus Torvalds's avatar
Linus Torvalds committed
40
#define XFRM_ALIGN8(len)	(((len) + 7) & ~7)
41 42
#define MODULE_ALIAS_XFRM_MODE(family, encap) \
	MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43 44
#define MODULE_ALIAS_XFRM_TYPE(family, proto) \
	MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
Linus Torvalds's avatar
Linus Torvalds committed
45

46
#ifdef CONFIG_XFRM_STATISTICS
47
#define XFRM_INC_STATS(net, field)	SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48
#else
49
#define XFRM_INC_STATS(net, field)	((void)(net))
50 51
#endif

Linus Torvalds's avatar
Linus Torvalds committed
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113

/* Organization of SPD aka "XFRM rules"
   ------------------------------------

   Basic objects:
   - policy rule, struct xfrm_policy (=SPD entry)
   - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
   - instance of a transformer, struct xfrm_state (=SA)
   - template to clone xfrm_state, struct xfrm_tmpl

   SPD is plain linear list of xfrm_policy rules, ordered by priority.
   (To be compatible with existing pfkeyv2 implementations,
   many rules with priority of 0x7fffffff are allowed to exist and
   such rules are ordered in an unpredictable way, thanks to bsd folks.)

   Lookup is plain linear search until the first match with selector.

   If "action" is "block", then we prohibit the flow, otherwise:
   if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
   policy entry has list of up to XFRM_MAX_DEPTH transformations,
   described by templates xfrm_tmpl. Each template is resolved
   to a complete xfrm_state (see below) and we pack bundle of transformations
   to a dst_entry returned to requestor.

   dst -. xfrm  .-> xfrm_state #1
    |---. child .-> dst -. xfrm .-> xfrm_state #2
                     |---. child .-> dst -. xfrm .-> xfrm_state #3
                                      |---. child .-> NULL

   Bundles are cached at xrfm_policy struct (field ->bundles).


   Resolution of xrfm_tmpl
   -----------------------
   Template contains:
   1. ->mode		Mode: transport or tunnel
   2. ->id.proto	Protocol: AH/ESP/IPCOMP
   3. ->id.daddr	Remote tunnel endpoint, ignored for transport mode.
      Q: allow to resolve security gateway?
   4. ->id.spi          If not zero, static SPI.
   5. ->saddr		Local tunnel endpoint, ignored for transport mode.
   6. ->algos		List of allowed algos. Plain bitmask now.
      Q: ealgos, aalgos, calgos. What a mess...
   7. ->share		Sharing mode.
      Q: how to implement private sharing mode? To add struct sock* to
      flow id?

   Having this template we search through SAD searching for entries
   with appropriate mode/proto/algo, permitted by selector.
   If no appropriate entry found, it is requested from key manager.

   PROBLEMS:
   Q: How to find all the bundles referring to a physical path for
      PMTU discovery? Seems, dst should contain list of all parents...
      and enter to infinite locking hierarchy disaster.
      No! It is easier, we will not search for them, let them find us.
      We add genid to each dst plus pointer to genid of raw IP route,
      pmtu disc will update pmtu on raw IP route and increase its genid.
      dst_check() will see this for top level and trigger resyncing
      metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 */

114 115 116
struct xfrm_state_walk {
	struct list_head	all;
	u8			state;
117 118
	u8			dying;
	u8			proto;
119
	u32			seq;
120
	struct xfrm_address_filter *filter;
121 122
};

Linus Torvalds's avatar
Linus Torvalds committed
123
/* Full description of state of transformer. */
Eric Dumazet's avatar
Eric Dumazet committed
124
struct xfrm_state {
125
	possible_net_t		xs_net;
126
	union {
127
		struct hlist_node	gclist;
128 129
		struct hlist_node	bydst;
	};
130 131
	struct hlist_node	bysrc;
	struct hlist_node	byspi;
Linus Torvalds's avatar
Linus Torvalds committed
132 133 134 135 136 137

	atomic_t		refcnt;
	spinlock_t		lock;

	struct xfrm_id		id;
	struct xfrm_selector	sel;
138
	struct xfrm_mark	mark;
139
	u32			tfcpad;
Linus Torvalds's avatar
Linus Torvalds committed
140

141 142
	u32			genid;

143 144
	/* Key manager bits */
	struct xfrm_state_walk	km;
Linus Torvalds's avatar
Linus Torvalds committed
145 146 147 148 149 150 151 152 153 154 155 156

	/* Parameters of this state. */
	struct {
		u32		reqid;
		u8		mode;
		u8		replay_window;
		u8		aalgo, ealgo, calgo;
		u8		flags;
		u16		family;
		xfrm_address_t	saddr;
		int		header_len;
		int		trailer_len;
157
		u32		extra_flags;
Linus Torvalds's avatar
Linus Torvalds committed
158 159 160 161 162
	} props;

	struct xfrm_lifetime_cfg lft;

	/* Data for transformer */
163
	struct xfrm_algo_auth	*aalg;
Linus Torvalds's avatar
Linus Torvalds committed
164 165
	struct xfrm_algo	*ealg;
	struct xfrm_algo	*calg;
166
	struct xfrm_algo_aead	*aead;
167
	const char		*geniv;
Linus Torvalds's avatar
Linus Torvalds committed
168 169 170 171

	/* Data for encapsulator */
	struct xfrm_encap_tmpl	*encap;

172 173 174
	/* Data for care-of address */
	xfrm_address_t	*coaddr;

Linus Torvalds's avatar
Linus Torvalds committed
175 176 177 178 179 180 181 182
	/* IPComp needs an IPIP tunnel for handling uncompressed packets */
	struct xfrm_state	*tunnel;

	/* If a tunnel, number of users + 1 */
	atomic_t		tunnel_users;

	/* State for replay detection */
	struct xfrm_replay_state replay;
183
	struct xfrm_replay_state_esn *replay_esn;
Linus Torvalds's avatar
Linus Torvalds committed
184

185 186
	/* Replay detection state at the time we sent the last notification */
	struct xfrm_replay_state preplay;
187
	struct xfrm_replay_state_esn *preplay_esn;
188

189 190 191
	/* The functions for replay detection. */
	struct xfrm_replay	*repl;

192 193 194 195 196
	/* internal flag that only holds state for delayed aevent at the
	 * moment
	*/
	u32			xflags;

197 198 199 200 201 202 203
	/* Replay detection notification settings */
	u32			replay_maxage;
	u32			replay_maxdiff;

	/* Replay detection notification timer */
	struct timer_list	rtimer;

Linus Torvalds's avatar
Linus Torvalds committed
204 205 206 207
	/* Statistics */
	struct xfrm_stats	stats;

	struct xfrm_lifetime_cur curlft;
208
	struct tasklet_hrtimer	mtimer;
Linus Torvalds's avatar
Linus Torvalds committed
209

210 211 212
	/* used to fix curlft->add_time when changing date */
	long		saved_tmo;

213
	/* Last used time */
214
	unsigned long		lastused;
215

Linus Torvalds's avatar
Linus Torvalds committed
216 217
	/* Reference to data common to all the instances of this
	 * transformer. */
218
	const struct xfrm_type	*type;
219
	struct xfrm_mode	*inner_mode;
220
	struct xfrm_mode	*inner_mode_iaf;
221
	struct xfrm_mode	*outer_mode;
Linus Torvalds's avatar
Linus Torvalds committed
222

223 224 225
	/* Security context */
	struct xfrm_sec_ctx	*security;

Linus Torvalds's avatar
Linus Torvalds committed
226 227 228 229 230
	/* Private data of this transformer, format is opaque,
	 * interpreted by xfrm_type methods. */
	void			*data;
};

231 232 233 234 235
static inline struct net *xs_net(struct xfrm_state *x)
{
	return read_pnet(&x->xs_net);
}

236 237
/* xflags - make enum if more show up */
#define XFRM_TIME_DEFER	1
238
#define XFRM_SOFT_EXPIRE 2
239

Linus Torvalds's avatar
Linus Torvalds committed
240 241 242 243 244 245 246 247 248
enum {
	XFRM_STATE_VOID,
	XFRM_STATE_ACQ,
	XFRM_STATE_VALID,
	XFRM_STATE_ERROR,
	XFRM_STATE_EXPIRED,
	XFRM_STATE_DEAD
};

249
/* callback structure passed from either netlink or pfkey */
Eric Dumazet's avatar
Eric Dumazet committed
250
struct km_event {
251 252 253 254
	union {
		u32 hard;
		u32 proto;
		u32 byid;
255
		u32 aevent;
256
		u32 type;
257 258
	} data;

259
	u32	seq;
260
	u32	portid;
261
	u32	event;
262
	struct net *net;
263 264
};

265 266 267 268 269
struct xfrm_replay {
	void	(*advance)(struct xfrm_state *x, __be32 net_seq);
	int	(*check)(struct xfrm_state *x,
			 struct sk_buff *skb,
			 __be32 net_seq);
270 271 272
	int	(*recheck)(struct xfrm_state *x,
			   struct sk_buff *skb,
			   __be32 net_seq);
273 274 275 276
	void	(*notify)(struct xfrm_state *x, int event);
	int	(*overflow)(struct xfrm_state *x, struct sk_buff *skb);
};

277
struct net_device;
Linus Torvalds's avatar
Linus Torvalds committed
278 279 280 281 282
struct xfrm_type;
struct xfrm_dst;
struct xfrm_policy_afinfo {
	unsigned short		family;
	struct dst_ops		*dst_ops;
283
	void			(*garbage_collect)(struct net *net);
284 285
	struct dst_entry	*(*dst_lookup)(struct net *net,
					       int tos, int oif,
286 287
					       const xfrm_address_t *saddr,
					       const xfrm_address_t *daddr);
288 289 290
	int			(*get_saddr)(struct net *net, int oif,
					     xfrm_address_t *saddr,
					     xfrm_address_t *daddr);
Linus Torvalds's avatar
Linus Torvalds committed
291
	void			(*decode_session)(struct sk_buff *skb,
292 293
						  struct flowi *fl,
						  int reverse);
294
	int			(*get_tos)(const struct flowi *fl);
295 296 297
	int			(*init_path)(struct xfrm_dst *path,
					     struct dst_entry *dst,
					     int nfheader_len);
298
	int			(*fill_dst)(struct xfrm_dst *xdst,
299
					    struct net_device *dev,
300
					    const struct flowi *fl);
301
	struct dst_entry	*(*blackhole_route)(struct net *net, struct dst_entry *orig);
Linus Torvalds's avatar
Linus Torvalds committed
302 303
};

304 305 306 307 308
int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
void km_policy_notify(struct xfrm_policy *xp, int dir,
		      const struct km_event *c);
void km_state_notify(struct xfrm_state *x, const struct km_event *c);
Linus Torvalds's avatar
Linus Torvalds committed
309 310

struct xfrm_tmpl;
311 312 313 314
int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
	     struct xfrm_policy *pol);
void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
int __xfrm_state_delete(struct xfrm_state *x);
315

Linus Torvalds's avatar
Linus Torvalds committed
316
struct xfrm_state_afinfo {
317
	unsigned int		family;
318
	unsigned int		proto;
Al Viro's avatar
Al Viro committed
319
	__be16			eth_proto;
320
	struct module		*owner;
321
	const struct xfrm_type	*type_map[IPPROTO_MAX];
322
	struct xfrm_mode	*mode_map[XFRM_MODE_MAX];
323
	int			(*init_flags)(struct xfrm_state *x);
324 325
	void			(*init_tempsel)(struct xfrm_selector *sel,
						const struct flowi *fl);
326 327 328 329
	void			(*init_temprop)(struct xfrm_state *x,
						const struct xfrm_tmpl *tmpl,
						const xfrm_address_t *daddr,
						const xfrm_address_t *saddr);
330 331
	int			(*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
	int			(*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
332
	int			(*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
333
	int			(*output_finish)(struct sock *sk, struct sk_buff *skb);
334 335
	int			(*extract_input)(struct xfrm_state *x,
						 struct sk_buff *skb);
336 337
	int			(*extract_output)(struct xfrm_state *x,
						  struct sk_buff *skb);
338 339
	int			(*transport_finish)(struct sk_buff *skb,
						    int async);
340
	void			(*local_error)(struct sk_buff *skb, u32 mtu);
Linus Torvalds's avatar
Linus Torvalds committed
341 342
};

343 344 345 346
int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
Linus Torvalds's avatar
Linus Torvalds committed
347

348 349 350 351 352 353 354 355 356 357
struct xfrm_input_afinfo {
	unsigned int		family;
	struct module		*owner;
	int			(*callback)(struct sk_buff *skb, u8 protocol,
					    int err);
};

int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo);
int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo);

358
void xfrm_state_delete_tunnel(struct xfrm_state *x);
Linus Torvalds's avatar
Linus Torvalds committed
359

Eric Dumazet's avatar
Eric Dumazet committed
360
struct xfrm_type {
Linus Torvalds's avatar
Linus Torvalds committed
361 362
	char			*description;
	struct module		*owner;
jamal's avatar
jamal committed
363 364
	u8			proto;
	u8			flags;
365
#define XFRM_TYPE_NON_FRAGMENT	1
366
#define XFRM_TYPE_REPLAY_PROT	2
367 368
#define XFRM_TYPE_LOCAL_COADDR	4
#define XFRM_TYPE_REMOTE_COADDR	8
Linus Torvalds's avatar
Linus Torvalds committed
369

370
	int			(*init_state)(struct xfrm_state *x);
Linus Torvalds's avatar
Linus Torvalds committed
371
	void			(*destructor)(struct xfrm_state *);
372
	int			(*input)(struct xfrm_state *, struct sk_buff *skb);
Linus Torvalds's avatar
Linus Torvalds committed
373
	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
374 375
	int			(*reject)(struct xfrm_state *, struct sk_buff *,
					  const struct flowi *);
376
	int			(*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
Linus Torvalds's avatar
Linus Torvalds committed
377
	/* Estimate maximal size of result of transformation of a dgram */
378
	u32			(*get_mtu)(struct xfrm_state *, int size);
Linus Torvalds's avatar
Linus Torvalds committed
379 380
};

381 382
int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
383

384
struct xfrm_mode {
385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405
	/*
	 * Remove encapsulation header.
	 *
	 * The IP header will be moved over the top of the encapsulation
	 * header.
	 *
	 * On entry, the transport header shall point to where the IP header
	 * should be and the network header shall be set to where the IP
	 * header currently is.  skb->data shall point to the start of the
	 * payload.
	 */
	int (*input2)(struct xfrm_state *x, struct sk_buff *skb);

	/*
	 * This is the actual input entry point.
	 *
	 * For transport mode and equivalent this would be identical to
	 * input2 (which does not need to be set).  While tunnel mode
	 * and equivalent would set this to the tunnel encapsulation function
	 * xfrm4_prepare_input that would in turn call input2.
	 */
406
	int (*input)(struct xfrm_state *x, struct sk_buff *skb);
407 408 409 410 411 412 413 414 415 416 417 418

	/*
	 * Add encapsulation header.
	 *
	 * On exit, the transport header will be set to the start of the
	 * encapsulation header to be filled in by x->type->output and
	 * the mac header will be set to the nextheader (protocol for
	 * IPv4) field of the extension header directly preceding the
	 * encapsulation header, or in its absence, that of the top IP
	 * header.  The value of the network header will always point
	 * to the top IP header while skb->data will point to the payload.
	 */
419 420 421 422 423 424 425 426 427 428 429 430
	int (*output2)(struct xfrm_state *x,struct sk_buff *skb);

	/*
	 * This is the actual output entry point.
	 *
	 * For transport mode and equivalent this would be identical to
	 * output2 (which does not need to be set).  While tunnel mode
	 * and equivalent would set this to a tunnel encapsulation function
	 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
	 * call output2.
	 */
	int (*output)(struct xfrm_state *x, struct sk_buff *skb);
431

432
	struct xfrm_state_afinfo *afinfo;
433 434
	struct module *owner;
	unsigned int encap;
435 436 437 438 439 440
	int flags;
};

/* Flags for xfrm_mode. */
enum {
	XFRM_MODE_FLAG_TUNNEL = 1,
441 442
};

443 444
int xfrm_register_mode(struct xfrm_mode *mode, int family);
int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
445

446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466
static inline int xfrm_af2proto(unsigned int family)
{
	switch(family) {
	case AF_INET:
		return IPPROTO_IPIP;
	case AF_INET6:
		return IPPROTO_IPV6;
	default:
		return 0;
	}
}

static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
{
	if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
	    (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
		return x->inner_mode;
	else
		return x->inner_mode_iaf;
}

Eric Dumazet's avatar
Eric Dumazet committed
467
struct xfrm_tmpl {
Linus Torvalds's avatar
Linus Torvalds committed
468 469 470 471 472 473 474 475 476 477 478
/* id in template is interpreted as:
 * daddr - destination of tunnel, may be zero for transport mode.
 * spi   - zero to acquire spi. Not zero if spi is static, then
 *	   daddr must be fixed too.
 * proto - AH/ESP/IPCOMP
 */
	struct xfrm_id		id;

/* Source address of tunnel. Ignored, if it is not a tunnel. */
	xfrm_address_t		saddr;

479 480
	unsigned short		encap_family;

jamal's avatar
jamal committed
481
	u32			reqid;
Linus Torvalds's avatar
Linus Torvalds committed
482

483
/* Mode: transport, tunnel etc. */
jamal's avatar
jamal committed
484
	u8			mode;
Linus Torvalds's avatar
Linus Torvalds committed
485 486

/* Sharing mode: unique, this session only, this user only etc. */
jamal's avatar
jamal committed
487
	u8			share;
Linus Torvalds's avatar
Linus Torvalds committed
488 489

/* May skip this transfomration if no SA is found */
jamal's avatar
jamal committed
490
	u8			optional;
Linus Torvalds's avatar
Linus Torvalds committed
491

492
/* Skip aalgos/ealgos/calgos checks. */
jamal's avatar
jamal committed
493
	u8			allalgs;
494

Linus Torvalds's avatar
Linus Torvalds committed
495
/* Bit mask of algos allowed for acquisition */
jamal's avatar
jamal committed
496 497 498
	u32			aalgos;
	u32			ealgos;
	u32			calgos;
Linus Torvalds's avatar
Linus Torvalds committed
499 500
};

501
#define XFRM_MAX_DEPTH		6
Linus Torvalds's avatar
Linus Torvalds committed
502

503 504 505 506 507 508 509 510 511 512 513
struct xfrm_policy_walk_entry {
	struct list_head	all;
	u8			dead;
};

struct xfrm_policy_walk {
	struct xfrm_policy_walk_entry walk;
	u8 type;
	u32 seq;
};

514 515 516 517 518 519
struct xfrm_policy_queue {
	struct sk_buff_head	hold_queue;
	struct timer_list	hold_timer;
	unsigned long		timeout;
};

Eric Dumazet's avatar
Eric Dumazet committed
520
struct xfrm_policy {
521
	possible_net_t		xp_net;
522 523
	struct hlist_node	bydst;
	struct hlist_node	byidx;
Linus Torvalds's avatar
Linus Torvalds committed
524 525 526 527 528 529

	/* This lock only affects elements except for entry. */
	rwlock_t		lock;
	atomic_t		refcnt;
	struct timer_list	timer;

530
	struct flow_cache_object flo;
531
	atomic_t		genid;
Linus Torvalds's avatar
Linus Torvalds committed
532 533
	u32			priority;
	u32			index;
534
	struct xfrm_mark	mark;
Linus Torvalds's avatar
Linus Torvalds committed
535 536 537
	struct xfrm_selector	selector;
	struct xfrm_lifetime_cfg lft;
	struct xfrm_lifetime_cur curlft;
538
	struct xfrm_policy_walk_entry walk;
539
	struct xfrm_policy_queue polq;
540 541 542 543
	u8			type;
	u8			action;
	u8			flags;
	u8			xfrm_nr;
544
	u16			family;
545
	struct xfrm_sec_ctx	*security;
Linus Torvalds's avatar
Linus Torvalds committed
546
	struct xfrm_tmpl       	xfrm_vec[XFRM_MAX_DEPTH];
547
	struct rcu_head		rcu;
Linus Torvalds's avatar
Linus Torvalds committed
548 549
};

550
static inline struct net *xp_net(const struct xfrm_policy *xp)
551 552 553 554
{
	return read_pnet(&xp->xp_net);
}

555 556 557 558 559 560 561
struct xfrm_kmaddress {
	xfrm_address_t          local;
	xfrm_address_t          remote;
	u32			reserved;
	u16			family;
};

562 563 564 565 566 567 568 569 570 571 572 573 574
struct xfrm_migrate {
	xfrm_address_t		old_daddr;
	xfrm_address_t		old_saddr;
	xfrm_address_t		new_daddr;
	xfrm_address_t		new_saddr;
	u8			proto;
	u8			mode;
	u16			reserved;
	u32			reqid;
	u16			old_family;
	u16			new_family;
};

575 576 577 578 579 580 581 582 583 584 585
#define XFRM_KM_TIMEOUT                30
/* what happened */
#define XFRM_REPLAY_UPDATE	XFRM_AE_CR
#define XFRM_REPLAY_TIMEOUT	XFRM_AE_CE

/* default aevent timeout in units of 100ms */
#define XFRM_AE_ETIME			10
/* Async Event timer multiplier */
#define XFRM_AE_ETH_M			10
/* default seq threshold size */
#define XFRM_AE_SEQT_SIZE		2
Linus Torvalds's avatar
Linus Torvalds committed
586

Eric Dumazet's avatar
Eric Dumazet committed
587
struct xfrm_mgr {
Linus Torvalds's avatar
Linus Torvalds committed
588 589
	struct list_head	list;
	char			*id;
590
	int			(*notify)(struct xfrm_state *x, const struct km_event *c);
591
	int			(*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
592
	struct xfrm_policy	*(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
593
	int			(*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
594
	int			(*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
595
	int			(*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
596 597 598 599 600
	int			(*migrate)(const struct xfrm_selector *sel,
					   u8 dir, u8 type,
					   const struct xfrm_migrate *m,
					   int num_bundles,
					   const struct xfrm_kmaddress *k);
601
	bool			(*is_alive)(const struct km_event *c);
Linus Torvalds's avatar
Linus Torvalds committed
602 603
};

604 605
int xfrm_register_km(struct xfrm_mgr *km);
int xfrm_unregister_km(struct xfrm_mgr *km);
Linus Torvalds's avatar
Linus Torvalds committed
606

607 608 609 610 611 612 613 614 615 616 617 618 619 620
struct xfrm_tunnel_skb_cb {
	union {
		struct inet_skb_parm h4;
		struct inet6_skb_parm h6;
	} header;

	union {
		struct ip_tunnel *ip4;
		struct ip6_tnl *ip6;
	} tunnel;
};

#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))

621 622 623 624 625 626
/*
 * This structure is used for the duration where packets are being
 * transformed by IPsec.  As soon as the packet leaves IPsec the
 * area beyond the generic IP part may be overwritten.
 */
struct xfrm_skb_cb {
627
	struct xfrm_tunnel_skb_cb header;
628 629

        /* Sequence number for replay protection. */
630
	union {
631 632 633 634 635 636 637 638
		struct {
			__u32 low;
			__u32 hi;
		} output;
		struct {
			__be32 low;
			__be32 hi;
		} input;
639
	} seq;
640 641 642 643
};

#define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))

644 645 646 647 648
/*
 * This structure is used by the afinfo prepare_input/prepare_output functions
 * to transmit header information to the mode input/output functions.
 */
struct xfrm_mode_skb_cb {
649
	struct xfrm_tunnel_skb_cb header;
650 651 652 653 654

	/* Copied from header for IPv4, always set to zero and DF for IPv6. */
	__be16 id;
	__be16 frag_off;

Herbert Xu's avatar
Herbert Xu committed
655 656 657
	/* IP header length (excluding options or extension headers). */
	u8 ihl;

658 659 660 661 662 663 664 665 666
	/* TOS for IPv4, class for IPv6. */
	u8 tos;

	/* TTL for IPv4, hop limitfor IPv6. */
	u8 ttl;

	/* Protocol for IPv4, NH for IPv6. */
	u8 protocol;

Herbert Xu's avatar
Herbert Xu committed
667 668 669
	/* Option length for IPv4, zero for IPv6. */
	u8 optlen;

670 671 672 673 674 675
	/* Used by IPv6 only, zero for IPv4. */
	u8 flow_lbl[3];
};

#define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))

676 677 678 679 680
/*
 * This structure is used by the input processing to locate the SPI and
 * related information.
 */
struct xfrm_spi_skb_cb {
681
	struct xfrm_tunnel_skb_cb header;
682 683

	unsigned int daddroff;
684
	unsigned int family;
685 686 687 688
};

#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))

689
#ifdef CONFIG_AUDITSYSCALL
690
static inline struct audit_buffer *xfrm_audit_start(const char *op)
Joy Latten's avatar
Joy Latten committed
691 692 693
{
	struct audit_buffer *audit_buf = NULL;

694 695
	if (audit_enabled == 0)
		return NULL;
Joy Latten's avatar
Joy Latten committed
696
	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
697
				    AUDIT_MAC_IPSEC_EVENT);
Joy Latten's avatar
Joy Latten committed
698 699
	if (audit_buf == NULL)
		return NULL;
700 701 702
	audit_log_format(audit_buf, "op=%s", op);
	return audit_buf;
}
Joy Latten's avatar
Joy Latten committed
703

704
static inline void xfrm_audit_helper_usrinfo(bool task_valid,
705 706
					     struct audit_buffer *audit_buf)
{
707 708 709 710 711 712 713
	const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
					    audit_get_loginuid(current) :
					    INVALID_UID);
	const unsigned int ses = task_valid ? audit_get_sessionid(current) :
		(unsigned int) -1;

	audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
714
	audit_log_task_context(audit_buf);
Joy Latten's avatar
Joy Latten committed
715 716
}

717 718 719 720 721
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
			      bool task_valid);
void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
722 723 724 725 726 727 728 729 730
void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
				      struct sk_buff *skb);
void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
			     __be32 net_seq);
void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
			       __be32 net_seq);
void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
			      u8 proto);
731
#else
732 733

static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
734
					 bool task_valid)
735 736 737 738
{
}

static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
739
					    bool task_valid)
740 741 742 743
{
}

static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
744
					bool task_valid)
745 746 747 748
{
}

static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
749
					   bool task_valid)
750 751 752 753 754 755 756 757
{
}

static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
					     struct sk_buff *skb)
{
}

758 759 760 761 762
static inline void xfrm_audit_state_replay(struct xfrm_state *x,
					   struct sk_buff *skb, __be32 net_seq)
{
}

763 764 765 766 767 768 769 770 771 772 773 774 775 776
static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
				      u16 family)
{
}

static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
				      __be32 net_spi, __be32 net_seq)
{
}

static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
				     struct sk_buff *skb, u8 proto)
{
}
777
#endif /* CONFIG_AUDITSYSCALL */
778

Linus Torvalds's avatar
Linus Torvalds committed
779 780 781 782 783 784
static inline void xfrm_pol_hold(struct xfrm_policy *policy)
{
	if (likely(policy != NULL))
		atomic_inc(&policy->refcnt);
}

785
void xfrm_policy_destroy(struct xfrm_policy *policy);
Linus Torvalds's avatar
Linus Torvalds committed
786 787 788 789

static inline void xfrm_pol_put(struct xfrm_policy *policy)
{
	if (atomic_dec_and_test(&policy->refcnt))
790
		xfrm_policy_destroy(policy);
Linus Torvalds's avatar
Linus Torvalds committed
791 792
}

793 794 795 796 797 798 799
static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
{
	int i;
	for (i = npols - 1; i >= 0; --i)
		xfrm_pol_put(pols[i]);
}

800
void __xfrm_state_destroy(struct xfrm_state *);
Linus Torvalds's avatar
Linus Torvalds committed
801

802 803 804 805 806
static inline void __xfrm_state_put(struct xfrm_state *x)
{
	atomic_dec(&x->refcnt);
}

Linus Torvalds's avatar
Linus Torvalds committed
807 808 809 810 811 812 813 814 815 816 817
static inline void xfrm_state_put(struct xfrm_state *x)
{
	if (atomic_dec_and_test(&x->refcnt))
		__xfrm_state_destroy(x);
}

static inline void xfrm_state_hold(struct xfrm_state *x)
{
	atomic_inc(&x->refcnt);
}

818 819
static inline bool addr_match(const void *token1, const void *token2,
			      int prefixlen)
Linus Torvalds's avatar
Linus Torvalds committed
820
{
821 822
	const __be32 *a1 = token1;
	const __be32 *a2 = token2;
Linus Torvalds's avatar
Linus Torvalds committed
823 824 825
	int pdw;
	int pbi;

jamal's avatar
jamal committed
826
	pdw = prefixlen >> 5;	  /* num of whole u32 in prefix */
Linus Torvalds's avatar
Linus Torvalds committed
827 828 829 830
	pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */

	if (pdw)
		if (memcmp(a1, a2, pdw << 2))
831
			return false;
Linus Torvalds's avatar
Linus Torvalds committed
832 833

	if (pbi) {
834
		__be32 mask;
Linus Torvalds's avatar
Linus Torvalds committed
835 836 837 838

		mask = htonl((0xffffffff) << (32 - pbi));

		if ((a1[pdw] ^ a2[pdw]) & mask)
839
			return false;
Linus Torvalds's avatar
Linus Torvalds committed
840 841
	}

842
	return true;
Linus Torvalds's avatar
Linus Torvalds committed
843 844
}

845 846 847 848 849 850 851 852
static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
{
	/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
	if (prefixlen == 0)
		return true;
	return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
}

Linus Torvalds's avatar
Linus Torvalds committed
853
static __inline__
854
__be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds's avatar
Linus Torvalds committed
855
{
856
	__be16 port;
857
	switch(fl->flowi_proto) {
Linus Torvalds's avatar
Linus Torvalds committed
858 859
	case IPPROTO_TCP:
	case IPPROTO_UDP:
860
	case IPPROTO_UDPLITE:
Linus Torvalds's avatar
Linus Torvalds committed
861
	case IPPROTO_SCTP:
862
		port = uli->ports.sport;
Linus Torvalds's avatar
Linus Torvalds committed
863 864 865
		break;
	case IPPROTO_ICMP:
	case IPPROTO_ICMPV6:
866
		port = htons(uli->icmpt.type);
Linus Torvalds's avatar
Linus Torvalds committed
867
		break;
868
	case IPPROTO_MH:
869
		port = htons(uli->mht.type);
870
		break;
871
	case IPPROTO_GRE:
872
		port = htons(ntohl(uli->gre_key) >> 16);
873
		break;
Linus Torvalds's avatar
Linus Torvalds committed
874 875 876 877 878 879 880
	default:
		port = 0;	/*XXX*/
	}
	return port;
}

static __inline__
881
__be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
Linus Torvalds's avatar
Linus Torvalds committed
882
{
883
	__be16 port;
884
	switch(fl->flowi_proto) {
Linus Torvalds's avatar
Linus Torvalds committed
885 886
	case IPPROTO_TCP:
	case IPPROTO_UDP:
887
	case IPPROTO_UDPLITE:
Linus Torvalds's avatar
Linus Torvalds committed
888
	case IPPROTO_SCTP:
889
		port = uli->ports.dport;
Linus Torvalds's avatar
Linus Torvalds committed
890 891 892
		break;
	case IPPROTO_ICMP:
	case IPPROTO_ICMPV6:
893
		port = htons(uli->icmpt.code);
Linus Torvalds's avatar
Linus Torvalds committed
894
		break;
895
	case IPPROTO_GRE:
896
		port = htons(ntohl(uli->gre_key) & 0xffff);
897
		break;
Linus Torvalds's avatar
Linus Torvalds committed
898 899 900 901 902 903
	default:
		port = 0;	/*XXX*/
	}
	return port;
}

904 905
bool xfrm_selector_match(const struct xfrm_selector *sel,
			 const struct flowi *fl, unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
906

907 908 909 910
#ifdef CONFIG_SECURITY_NETWORK_XFRM
/*	If neither has a context --> match
 * 	Otherwise, both must have a context and the sids, doi, alg must match
 */
911
static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
912 913 914 915 916 917 918 919
{
	return ((!s1 && !s2) ||
		(s1 && s2 &&
		 (s1->ctx_sid == s2->ctx_sid) &&
		 (s1->ctx_doi == s2->ctx_doi) &&
		 (s1->ctx_alg == s2->ctx_alg)));
}
#else
920
static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
921
{
922
	return true;
923 924 925
}
#endif

Linus Torvalds's avatar
Linus Torvalds committed
926 927 928 929 930 931 932 933 934 935 936
/* A struct encoding bundle of transformations to apply to some set of flow.
 *
 * dst->child points to the next element of bundle.
 * dst->xfrm  points to an instanse of transformer.
 *
 * Due to unfortunate limitations of current routing cache, which we
 * have no time to fix, it mirrors struct rtable and bound to the same
 * routing key, including saddr,daddr. However, we can have many of
 * bundles differing by session id. All the bundles grow from a parent
 * policy rule.
 */
Eric Dumazet's avatar
Eric Dumazet committed
937
struct xfrm_dst {
Linus Torvalds's avatar
Linus Torvalds committed
938 939 940 941 942 943
	union {
		struct dst_entry	dst;
		struct rtable		rt;
		struct rt6_info		rt6;
	} u;
	struct dst_entry *route;
944 945 946
	struct flow_cache_object flo;
	struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
	int num_pols, num_xfrms;
947 948 949 950
#ifdef CONFIG_XFRM_SUB_POLICY
	struct flowi *origin;
	struct xfrm_selector *partner;
#endif
951 952
	u32 xfrm_genid;
	u32 policy_genid;
Linus Torvalds's avatar
Linus Torvalds committed
953 954
	u32 route_mtu_cached;
	u32 child_mtu_cached;
955 956
	u32 route_cookie;
	u32 path_cookie;
Linus Torvalds's avatar
Linus Torvalds committed
957 958
};

959
#ifdef CONFIG_XFRM
Herbert Xu's avatar
Herbert Xu committed
960 961
static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
{
962
	xfrm_pols_put(xdst->pols, xdst->num_pols);
Herbert Xu's avatar
Herbert Xu committed
963 964 965
	dst_release(xdst->route);
	if (likely(xdst->u.dst.xfrm))
		xfrm_state_put(xdst->u.dst.xfrm);
966 967 968 969 970 971
#ifdef CONFIG_XFRM_SUB_POLICY
	kfree(xdst->origin);
	xdst->origin = NULL;
	kfree(xdst->partner);
	xdst->partner = NULL;
#endif
Herbert Xu's avatar
Herbert Xu committed
972
}
973
#endif
Herbert Xu's avatar
Herbert Xu committed
974

975
void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
Herbert Xu's avatar
Herbert Xu committed
976

Eric Dumazet's avatar
Eric Dumazet committed
977
struct sec_path {
Linus Torvalds's avatar
Linus Torvalds committed
978 979
	atomic_t		refcnt;
	int			len;
980
	struct xfrm_state	*xvec[XFRM_MAX_DEPTH];
Linus Torvalds's avatar
Linus Torvalds committed
981 982
};

983 984 985 986 987 988 989 990 991
static inline int secpath_exists(struct sk_buff *skb)
{
#ifdef CONFIG_XFRM
	return skb->sp != NULL;
#else
	return 0;
#endif
}

Linus Torvalds's avatar
Linus Torvalds committed
992 993 994 995 996 997 998 999
static inline struct sec_path *
secpath_get(struct sec_path *sp)
{
	if (sp)
		atomic_inc(&sp->refcnt);
	return sp;
}

1000
void __secpath_destroy(struct sec_path *sp);
Linus Torvalds's avatar
Linus Torvalds committed
1001 1002 1003 1004 1005 1006 1007 1008

static inline void
secpath_put(struct sec_path *sp)
{
	if (sp && atomic_dec_and_test(&sp->refcnt))
		__secpath_destroy(sp);
}

1009
struct sec_path *secpath_dup(struct sec_path *src);
Linus Torvalds's avatar
Linus Torvalds committed
1010 1011 1012 1013 1014 1015 1016 1017 1018 1019

static inline void
secpath_reset(struct sk_buff *skb)
{
#ifdef CONFIG_XFRM
	secpath_put(skb->sp);
	skb->sp = NULL;
#endif
}

1020
static inline int
1021
xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1022 1023 1024 1025 1026
{
	switch (family) {
	case AF_INET:
		return addr->a4 == 0;
	case AF_INET6:
1027
		return ipv6_addr_any(&addr->in6);
1028 1029 1030 1031
	}
	return 0;
}

Linus Torvalds's avatar
Linus Torvalds committed
1032
static inline int
1033
__xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds's avatar
Linus Torvalds committed
1034 1035 1036 1037 1038 1039
{
	return	(tmpl->saddr.a4 &&
		 tmpl->saddr.a4 != x->props.saddr.a4);
}

static inline int
1040
__xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
Linus Torvalds's avatar
Linus Torvalds committed
1041 1042
{
	return	(!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1043
		 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
Linus Torvalds's avatar
Linus Torvalds committed
1044 1045 1046
}

static inline int
1047
xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
Linus Torvalds's avatar
Linus Torvalds committed
1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058
{
	switch (family) {
	case AF_INET:
		return __xfrm4_state_addr_cmp(tmpl, x);
	case AF_INET6:
		return __xfrm6_state_addr_cmp(tmpl, x);
	}
	return !0;
}

#ifdef CONFIG_XFRM
1059 1060
int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
			unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
1061

1062 1063 1064
static inline int __xfrm_policy_check2(struct sock *sk, int dir,
				       struct sk_buff *skb,
				       unsigned int family, int reverse)
Linus Torvalds's avatar
Linus Torvalds committed
1065
{
1066
	struct net *net = dev_net(skb->dev);
1067 1068
	int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);

Linus Torvalds's avatar
Linus Torvalds committed
1069
	if (sk && sk->sk_policy[XFRM_POLICY_IN])
1070
		return __xfrm_policy_check(sk, ndir, skb, family);
1071

1072
	return	(!net->xfrm.policy_count[dir] && !skb->sp) ||
Eric Dumazet's avatar
Eric Dumazet committed
1073
		(skb_dst(skb)->flags & DST_NOPOLICY) ||
1074 1075 1076 1077 1078 1079
		__xfrm_policy_check(sk, ndir, skb, family);
}

static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
{
	return __xfrm_policy_check2(sk, dir, skb, family, 0);
Linus Torvalds's avatar
Linus Torvalds committed
1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091
}

static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
{
	return xfrm_policy_check(sk, dir, skb, AF_INET);
}

static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
{
	return xfrm_policy_check(sk, dir, skb, AF_INET6);
}

1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103
static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
					     struct sk_buff *skb)
{
	return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
}

static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
					     struct sk_buff *skb)
{
	return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
}

1104 1105
int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
			  unsigned int family, int reverse);
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119

static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
				      unsigned int family)
{
	return __xfrm_decode_session(skb, fl, family, 0);
}

static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
					      struct flowi *fl,
					      unsigned int family)
{
	return __xfrm_decode_session(skb, fl, family, 1);
}

1120
int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
Linus Torvalds's avatar
Linus Torvalds committed
1121 1122 1123

static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
{
1124 1125 1126
	struct net *net = dev_net(skb->dev);

	return	!net->xfrm.policy_count[XFRM_POLICY_OUT] ||
Eric Dumazet's avatar
Eric Dumazet committed
1127
		(skb_dst(skb)->flags & DST_NOXFRM) ||
Linus Torvalds's avatar
Linus Torvalds committed
1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140
		__xfrm_route_forward(skb, family);
}

static inline int xfrm4_route_forward(struct sk_buff *skb)
{
	return xfrm_route_forward(skb, AF_INET);
}

static inline int xfrm6_route_forward(struct sk_buff *skb)
{
	return xfrm_route_forward(skb, AF_INET6);
}

1141
int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
Linus Torvalds's avatar
Linus Torvalds committed
1142

1143
static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
Linus Torvalds's avatar
Linus Torvalds committed
1144
{
1145 1146 1147 1148
	sk->sk_policy[0] = NULL;
	sk->sk_policy[1] = NULL;
	if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
		return __xfrm_sk_clone_policy(sk, osk);
Linus Torvalds's avatar
Linus Torvalds committed
1149 1150 1151
	return 0;
}

1152
int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
Linus Torvalds's avatar
Linus Torvalds committed
1153 1154 1155

static inline void xfrm_sk_free_policy(struct sock *sk)
{
1156 1157 1158 1159 1160
	struct xfrm_policy *pol;

	pol = rcu_dereference_protected(sk->sk_policy[0], 1);
	if (unlikely(pol != NULL)) {
		xfrm_policy_delete(pol, XFRM_POLICY_MAX);
Linus Torvalds's avatar
Linus Torvalds committed
1161 1162
		sk->sk_policy[0] = NULL;
	}
1163 1164 1165
	pol = rcu_dereference_protected(sk->sk_policy[1], 1);
	if (unlikely(pol != NULL)) {
		xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
Linus Torvalds's avatar
Linus Torvalds committed
1166 1167 1168 1169
		sk->sk_policy[1] = NULL;
	}
}

1170
void xfrm_garbage_collect(struct net *net);
1171

Linus Torvalds's avatar
Linus Torvalds committed
1172 1173 1174
#else

static inline void xfrm_sk_free_policy(struct sock *sk) {}
1175
static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
Linus Torvalds's avatar
Linus Torvalds committed
1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189
static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }  
static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 
static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
{ 
	return 1; 
} 
static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
{
	return 1;
}
static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
{
	return 1;
}
1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205
static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
					      struct flowi *fl,
					      unsigned int family)
{
	return -ENOSYS;
}
static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
					     struct sk_buff *skb)
{
	return 1;
}
static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
					     struct sk_buff *skb)
{
	return 1;
}
1206 1207 1208
static inline void xfrm_garbage_collect(struct net *net)
{
}
Linus Torvalds's avatar
Linus Torvalds committed
1209 1210 1211
#endif

static __inline__
1212
xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
Linus Torvalds's avatar
Linus Torvalds committed
1213 1214 1215
{
	switch (family){
	case AF_INET:
1216
		return (xfrm_address_t *)&fl->u.ip4.daddr;
Linus Torvalds's avatar
Linus Torvalds committed
1217
	case AF_INET6:
1218
		return (xfrm_address_t *)&fl->u.ip6.daddr;
Linus Torvalds's avatar
Linus Torvalds committed
1219 1220 1221 1222 1223
	}
	return NULL;
}

static __inline__
1224
xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
Linus Torvalds's avatar
Linus Torvalds committed
1225 1226 1227
{
	switch (family){
	case AF_INET:
1228
		return (xfrm_address_t *)&fl->u.ip4.saddr;
Linus Torvalds's avatar
Linus Torvalds committed
1229
	case AF_INET6:
1230
		return (xfrm_address_t *)&fl->u.ip6.saddr;
Linus Torvalds's avatar
Linus Torvalds committed
1231 1232 1233 1234
	}
	return NULL;
}

1235
static __inline__
1236
void xfrm_flowi_addr_get(const struct flowi *fl,
1237 1238 1239 1240 1241
			 xfrm_address_t *saddr, xfrm_address_t *daddr,
			 unsigned short family)
{
	switch(family) {
	case AF_INET:
1242 1243
		memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
		memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1244 1245
		break;
	case AF_INET6:
1246 1247
		saddr->in6 = fl->u.ip6.saddr;
		daddr->in6 = fl->u.ip6.daddr;
1248 1249 1250 1251
		break;
	}
}

Linus Torvalds's avatar
Linus Torvalds committed
1252
static __inline__ int
1253 1254
__xfrm4_state_addr_check(const struct xfrm_state *x,
			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds's avatar
Linus Torvalds committed
1255 1256 1257 1258 1259 1260 1261 1262
{
	if (daddr->a4 == x->id.daddr.a4 &&
	    (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
		return 1;
	return 0;
}

static __inline__ int
1263 1264
__xfrm6_state_addr_check(const struct xfrm_state *x,
			 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Linus Torvalds's avatar
Linus Torvalds committed
1265
{
1266 1267
	if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
	    (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
Linus Torvalds's avatar
Linus Torvalds committed
1268 1269 1270 1271 1272 1273 1274
	     ipv6_addr_any((struct in6_addr *)saddr) || 
	     ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
		return 1;
	return 0;
}

static __inline__ int
1275 1276
xfrm_state_addr_check(const struct xfrm_state *x,
		      const xfrm_address_t *daddr, const xfrm_address_t *saddr,
Linus Torvalds's avatar
Linus Torvalds committed
1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287
		      unsigned short family)
{
	switch (family) {
	case AF_INET:
		return __xfrm4_state_addr_check(x, daddr, saddr);
	case AF_INET6:
		return __xfrm6_state_addr_check(x, daddr, saddr);
	}
	return 0;
}

1288
static __inline__ int
1289
xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1290 1291 1292 1293 1294
			   unsigned short family)
{
	switch (family) {
	case AF_INET:
		return __xfrm4_state_addr_check(x,
1295 1296
						(const xfrm_address_t *)&fl->u.ip4.daddr,
						(const xfrm_address_t *)&fl->u.ip4.saddr);
1297 1298
	case AF_INET6:
		return __xfrm6_state_addr_check(x,
1299 1300
						(const xfrm_address_t *)&fl->u.ip6.daddr,
						(const xfrm_address_t *)&fl->u.ip6.saddr);
1301 1302 1303 1304
	}
	return 0;
}

1305
static inline int xfrm_state_kern(const struct xfrm_state *x)
Linus Torvalds's avatar
Linus Torvalds committed
1306 1307 1308 1309
{
	return atomic_read(&x->tunnel_users);
}

1310 1311
static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
{
1312 1313 1314 1315
	return (!userproto || proto == userproto ||
		(userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
						  proto == IPPROTO_ESP ||
						  proto == IPPROTO_COMP)));
1316 1317
}

Linus Torvalds's avatar
Linus Torvalds committed
1318 1319 1320
/*
 * xfrm algorithm information
 */
1321
struct xfrm_algo_aead_info {
1322
	char *geniv;
1323 1324 1325
	u16 icv_truncbits;
};

Linus Torvalds's avatar
Linus Torvalds committed
1326 1327 1328 1329 1330 1331
struct xfrm_algo_auth_info {
	u16 icv_truncbits;
	u16 icv_fullbits;
};

struct xfrm_algo_encr_info {
1332
	char *geniv;
Linus Torvalds's avatar
Linus Torvalds committed
1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
	u16 blockbits;
	u16 defkeybits;
};

struct xfrm_algo_comp_info {
	u16 threshold;
};

struct xfrm_algo_desc {
	char *name;
1343
	char *compat;
Linus Torvalds's avatar
Linus Torvalds committed
1344
	u8 available:1;
1345
	u8 pfkey_supported:1;
Linus Torvalds's avatar
Linus Torvalds committed
1346
	union {
1347
		struct xfrm_algo_aead_info aead;
Linus Torvalds's avatar
Linus Torvalds committed
1348 1349 1350 1351 1352 1353 1354
		struct xfrm_algo_auth_info auth;
		struct xfrm_algo_encr_info encr;
		struct xfrm_algo_comp_info comp;
	} uinfo;
	struct sadb_alg desc;
};

1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366
/* XFRM protocol handlers.  */
struct xfrm4_protocol {
	int (*handler)(struct sk_buff *skb);
	int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
			     int encap_type);
	int (*cb_handler)(struct sk_buff *skb, int err);
	int (*err_handler)(struct sk_buff *skb, u32 info);

	struct xfrm4_protocol __rcu *next;
	int priority;
};

1367
struct xfrm6_protocol {
Linus Torvalds's avatar
Linus Torvalds committed
1368
	int (*handler)(struct sk_buff *skb);
1369 1370 1371
	int (*cb_handler)(struct sk_buff *skb, int err);
	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
			   u8 type, u8 code, int offset, __be32 info);
1372

1373
	struct xfrm6_protocol __rcu *next;
1374
	int priority;
Linus Torvalds's avatar
Linus Torvalds committed
1375 1376 1377 1378
};

/* XFRM tunnel handlers.  */
struct xfrm_tunnel {
1379
	int (*handler)(struct sk_buff *skb);
jamal's avatar
jamal committed
1380
	int (*err_handler)(struct sk_buff *skb, u32 info);
1381

1382
	struct xfrm_tunnel __rcu *next;
1383 1384 1385
	int priority;
};

Linus Torvalds's avatar
Linus Torvalds committed
1386
struct xfrm6_tunnel {
1387 1388
	int (*handler)(struct sk_buff *skb);
	int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1389
			   u8 type, u8 code, int offset, __be32 info);