projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branches 'powercap' and 'acpi-lpss' with new device IDs
[deliverable/linux.git] / include / net / xfrm.h
1 #ifndef _NET_XFRM_H
2 #define _NET_XFRM_H
3
4 #include <linux/compiler.h>
5 #include <linux/xfrm.h>
6 #include <linux/spinlock.h>
7 #include <linux/list.h>
8 #include <linux/skbuff.h>
9 #include <linux/socket.h>
10 #include <linux/pfkeyv2.h>
11 #include <linux/ipsec.h>
12 #include <linux/in6.h>
13 #include <linux/mutex.h>
14 #include <linux/audit.h>
15 #include <linux/slab.h>
16
17 #include <net/sock.h>
18 #include <net/dst.h>
19 #include <net/ip.h>
20 #include <net/route.h>
21 #include <net/ipv6.h>
22 #include <net/ip6_fib.h>
23 #include <net/flow.h>
24
25 #include <linux/interrupt.h>
26
27 #ifdef CONFIG_XFRM_STATISTICS
28 #include <net/snmp.h>
29 #endif
30
31 #define XFRM_PROTO_ESP 50
32 #define XFRM_PROTO_AH 51
33 #define XFRM_PROTO_COMP 108
34 #define XFRM_PROTO_IPIP 4
35 #define XFRM_PROTO_IPV6 41
36 #define XFRM_PROTO_ROUTING IPPROTO_ROUTING
37 #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS
38
39 #define XFRM_ALIGN4(len) (((len) + 3) & ~3)
40 #define XFRM_ALIGN8(len) (((len) + 7) & ~7)
41 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
42 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
43 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
44 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
45
46 #ifdef CONFIG_XFRM_STATISTICS
47 #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
48 #define XFRM_INC_STATS_BH(net, field) SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
49 #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
50 #else
51 #define XFRM_INC_STATS(net, field) ((void)(net))
52 #define XFRM_INC_STATS_BH(net, field) ((void)(net))
53 #define XFRM_INC_STATS_USER(net, field) ((void)(net))
54 #endif
55
56 extern struct mutex xfrm_cfg_mutex;
57
58 /* Organization of SPD aka "XFRM rules"
59 ------------------------------------
60
61 Basic objects:
62 - policy rule, struct xfrm_policy (=SPD entry)
63 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
64 - instance of a transformer, struct xfrm_state (=SA)
65 - template to clone xfrm_state, struct xfrm_tmpl
66
67 SPD is plain linear list of xfrm_policy rules, ordered by priority.
68 (To be compatible with existing pfkeyv2 implementations,
69 many rules with priority of 0x7fffffff are allowed to exist and
70 such rules are ordered in an unpredictable way, thanks to bsd folks.)
71
72 Lookup is plain linear search until the first match with selector.
73
74 If "action" is "block", then we prohibit the flow, otherwise:
75 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
76 policy entry has list of up to XFRM_MAX_DEPTH transformations,
77 described by templates xfrm_tmpl. Each template is resolved
78 to a complete xfrm_state (see below) and we pack bundle of transformations
79 to a dst_entry returned to requestor.
80
81 dst -. xfrm .-> xfrm_state #1
82 |---. child .-> dst -. xfrm .-> xfrm_state #2
83 |---. child .-> dst -. xfrm .-> xfrm_state #3
84 |---. child .-> NULL
85
86 Bundles are cached at xrfm_policy struct (field ->bundles).
87
88
89 Resolution of xrfm_tmpl
90 -----------------------
91 Template contains:
92 1. ->mode Mode: transport or tunnel
93 2. ->id.proto Protocol: AH/ESP/IPCOMP
94 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode.
95 Q: allow to resolve security gateway?
96 4. ->id.spi If not zero, static SPI.
97 5. ->saddr Local tunnel endpoint, ignored for transport mode.
98 6. ->algos List of allowed algos. Plain bitmask now.
99 Q: ealgos, aalgos, calgos. What a mess...
100 7. ->share Sharing mode.
101 Q: how to implement private sharing mode? To add struct sock* to
102 flow id?
103
104 Having this template we search through SAD searching for entries
105 with appropriate mode/proto/algo, permitted by selector.
106 If no appropriate entry found, it is requested from key manager.
107
108 PROBLEMS:
109 Q: How to find all the bundles referring to a physical path for
110 PMTU discovery? Seems, dst should contain list of all parents...
111 and enter to infinite locking hierarchy disaster.
112 No! It is easier, we will not search for them, let them find us.
113 We add genid to each dst plus pointer to genid of raw IP route,
114 pmtu disc will update pmtu on raw IP route and increase its genid.
115 dst_check() will see this for top level and trigger resyncing
116 metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
117 */
118
119 struct xfrm_state_walk {
120 struct list_head all;
121 u8 state;
122 union {
123 u8 dying;
124 u8 proto;
125 };
126 u32 seq;
127 };
128
129 /* Full description of state of transformer. */
130 struct xfrm_state {
131 #ifdef CONFIG_NET_NS
132 struct net *xs_net;
133 #endif
134 union {
135 struct hlist_node gclist;
136 struct hlist_node bydst;
137 };
138 struct hlist_node bysrc;
139 struct hlist_node byspi;
140
141 atomic_t refcnt;
142 spinlock_t lock;
143
144 struct xfrm_id id;
145 struct xfrm_selector sel;
146 struct xfrm_mark mark;
147 u32 tfcpad;
148
149 u32 genid;
150
151 /* Key manager bits */
152 struct xfrm_state_walk km;
153
154 /* Parameters of this state. */
155 struct {
156 u32 reqid;
157 u8 mode;
158 u8 replay_window;
159 u8 aalgo, ealgo, calgo;
160 u8 flags;
161 u16 family;
162 xfrm_address_t saddr;
163 int header_len;
164 int trailer_len;
165 u32 extra_flags;
166 } props;
167
168 struct xfrm_lifetime_cfg lft;
169
170 /* Data for transformer */
171 struct xfrm_algo_auth *aalg;
172 struct xfrm_algo *ealg;
173 struct xfrm_algo *calg;
174 struct xfrm_algo_aead *aead;
175
176 /* Data for encapsulator */
177 struct xfrm_encap_tmpl *encap;
178
179 /* Data for care-of address */
180 xfrm_address_t *coaddr;
181
182 /* IPComp needs an IPIP tunnel for handling uncompressed packets */
183 struct xfrm_state *tunnel;
184
185 /* If a tunnel, number of users + 1 */
186 atomic_t tunnel_users;
187
188 /* State for replay detection */
189 struct xfrm_replay_state replay;
190 struct xfrm_replay_state_esn *replay_esn;
191
192 /* Replay detection state at the time we sent the last notification */
193 struct xfrm_replay_state preplay;
194 struct xfrm_replay_state_esn *preplay_esn;
195
196 /* The functions for replay detection. */
197 struct xfrm_replay *repl;
198
199 /* internal flag that only holds state for delayed aevent at the
200 * moment
201 */
202 u32 xflags;
203
204 /* Replay detection notification settings */
205 u32 replay_maxage;
206 u32 replay_maxdiff;
207
208 /* Replay detection notification timer */
209 struct timer_list rtimer;
210
211 /* Statistics */
212 struct xfrm_stats stats;
213
214 struct xfrm_lifetime_cur curlft;
215 struct tasklet_hrtimer mtimer;
216
217 /* used to fix curlft->add_time when changing date */
218 long saved_tmo;
219
220 /* Last used time */
221 unsigned long lastused;
222
223 /* Reference to data common to all the instances of this
224 * transformer. */
225 const struct xfrm_type *type;
226 struct xfrm_mode *inner_mode;
227 struct xfrm_mode *inner_mode_iaf;
228 struct xfrm_mode *outer_mode;
229
230 /* Security context */
231 struct xfrm_sec_ctx *security;
232
233 /* Private data of this transformer, format is opaque,
234 * interpreted by xfrm_type methods. */
235 void *data;
236 };
237
238 static inline struct net *xs_net(struct xfrm_state *x)
239 {
240 return read_pnet(&x->xs_net);
241 }
242
243 /* xflags - make enum if more show up */
244 #define XFRM_TIME_DEFER 1
245 #define XFRM_SOFT_EXPIRE 2
246
247 enum {
248 XFRM_STATE_VOID,
249 XFRM_STATE_ACQ,
250 XFRM_STATE_VALID,
251 XFRM_STATE_ERROR,
252 XFRM_STATE_EXPIRED,
253 XFRM_STATE_DEAD
254 };
255
256 /* callback structure passed from either netlink or pfkey */
257 struct km_event {
258 union {
259 u32 hard;
260 u32 proto;
261 u32 byid;
262 u32 aevent;
263 u32 type;
264 } data;
265
266 u32 seq;
267 u32 portid;
268 u32 event;
269 struct net *net;
270 };
271
272 struct xfrm_replay {
273 void (*advance)(struct xfrm_state *x, __be32 net_seq);
274 int (*check)(struct xfrm_state *x,
275 struct sk_buff *skb,
276 __be32 net_seq);
277 int (*recheck)(struct xfrm_state *x,
278 struct sk_buff *skb,
279 __be32 net_seq);
280 void (*notify)(struct xfrm_state *x, int event);
281 int (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
282 };
283
284 struct net_device;
285 struct xfrm_type;
286 struct xfrm_dst;
287 struct xfrm_policy_afinfo {
288 unsigned short family;
289 struct dst_ops *dst_ops;
290 void (*garbage_collect)(struct net *net);
291 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
292 const xfrm_address_t *saddr,
293 const xfrm_address_t *daddr);
294 int (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
295 void (*decode_session)(struct sk_buff *skb,
296 struct flowi *fl,
297 int reverse);
298 int (*get_tos)(const struct flowi *fl);
299 void (*init_dst)(struct net *net,
300 struct xfrm_dst *dst);
301 int (*init_path)(struct xfrm_dst *path,
302 struct dst_entry *dst,
303 int nfheader_len);
304 int (*fill_dst)(struct xfrm_dst *xdst,
305 struct net_device *dev,
306 const struct flowi *fl);
307 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
308 };
309
310 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
311 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
312 void km_policy_notify(struct xfrm_policy *xp, int dir,
313 const struct km_event *c);
314 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
315
316 struct xfrm_tmpl;
317 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
318 struct xfrm_policy *pol);
319 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
320 int __xfrm_state_delete(struct xfrm_state *x);
321
322 struct xfrm_state_afinfo {
323 unsigned int family;
324 unsigned int proto;
325 __be16 eth_proto;
326 struct module *owner;
327 const struct xfrm_type *type_map[IPPROTO_MAX];
328 struct xfrm_mode *mode_map[XFRM_MODE_MAX];
329 int (*init_flags)(struct xfrm_state *x);
330 void (*init_tempsel)(struct xfrm_selector *sel,
331 const struct flowi *fl);
332 void (*init_temprop)(struct xfrm_state *x,
333 const struct xfrm_tmpl *tmpl,
334 const xfrm_address_t *daddr,
335 const xfrm_address_t *saddr);
336 int (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
337 int (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
338 int (*output)(struct sk_buff *skb);
339 int (*output_finish)(struct sk_buff *skb);
340 int (*extract_input)(struct xfrm_state *x,
341 struct sk_buff *skb);
342 int (*extract_output)(struct xfrm_state *x,
343 struct sk_buff *skb);
344 int (*transport_finish)(struct sk_buff *skb,
345 int async);
346 void (*local_error)(struct sk_buff *skb, u32 mtu);
347 };
348
349 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
350 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
351 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
352 void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
353
354 void xfrm_state_delete_tunnel(struct xfrm_state *x);
355
356 struct xfrm_type {
357 char *description;
358 struct module *owner;
359 u8 proto;
360 u8 flags;
361 #define XFRM_TYPE_NON_FRAGMENT 1
362 #define XFRM_TYPE_REPLAY_PROT 2
363 #define XFRM_TYPE_LOCAL_COADDR 4
364 #define XFRM_TYPE_REMOTE_COADDR 8
365
366 int (*init_state)(struct xfrm_state *x);
367 void (*destructor)(struct xfrm_state *);
368 int (*input)(struct xfrm_state *, struct sk_buff *skb);
369 int (*output)(struct xfrm_state *, struct sk_buff *pskb);
370 int (*reject)(struct xfrm_state *, struct sk_buff *,
371 const struct flowi *);
372 int (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
373 /* Estimate maximal size of result of transformation of a dgram */
374 u32 (*get_mtu)(struct xfrm_state *, int size);
375 };
376
377 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
378 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
379
380 struct xfrm_mode {
381 /*
382 * Remove encapsulation header.
383 *
384 * The IP header will be moved over the top of the encapsulation
385 * header.
386 *
387 * On entry, the transport header shall point to where the IP header
388 * should be and the network header shall be set to where the IP
389 * header currently is. skb->data shall point to the start of the
390 * payload.
391 */
392 int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
393
394 /*
395 * This is the actual input entry point.
396 *
397 * For transport mode and equivalent this would be identical to
398 * input2 (which does not need to be set). While tunnel mode
399 * and equivalent would set this to the tunnel encapsulation function
400 * xfrm4_prepare_input that would in turn call input2.
401 */
402 int (*input)(struct xfrm_state *x, struct sk_buff *skb);
403
404 /*
405 * Add encapsulation header.
406 *
407 * On exit, the transport header will be set to the start of the
408 * encapsulation header to be filled in by x->type->output and
409 * the mac header will be set to the nextheader (protocol for
410 * IPv4) field of the extension header directly preceding the
411 * encapsulation header, or in its absence, that of the top IP
412 * header. The value of the network header will always point
413 * to the top IP header while skb->data will point to the payload.
414 */
415 int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
416
417 /*
418 * This is the actual output entry point.
419 *
420 * For transport mode and equivalent this would be identical to
421 * output2 (which does not need to be set). While tunnel mode
422 * and equivalent would set this to a tunnel encapsulation function
423 * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
424 * call output2.
425 */
426 int (*output)(struct xfrm_state *x, struct sk_buff *skb);
427
428 struct xfrm_state_afinfo *afinfo;
429 struct module *owner;
430 unsigned int encap;
431 int flags;
432 };
433
434 /* Flags for xfrm_mode. */
435 enum {
436 XFRM_MODE_FLAG_TUNNEL = 1,
437 };
438
439 int xfrm_register_mode(struct xfrm_mode *mode, int family);
440 int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
441
442 static inline int xfrm_af2proto(unsigned int family)
443 {
444 switch(family) {
445 case AF_INET:
446 return IPPROTO_IPIP;
447 case AF_INET6:
448 return IPPROTO_IPV6;
449 default:
450 return 0;
451 }
452 }
453
454 static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
455 {
456 if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
457 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
458 return x->inner_mode;
459 else
460 return x->inner_mode_iaf;
461 }
462
463 struct xfrm_tmpl {
464 /* id in template is interpreted as:
465 * daddr - destination of tunnel, may be zero for transport mode.
466 * spi - zero to acquire spi. Not zero if spi is static, then
467 * daddr must be fixed too.
468 * proto - AH/ESP/IPCOMP
469 */
470 struct xfrm_id id;
471
472 /* Source address of tunnel. Ignored, if it is not a tunnel. */
473 xfrm_address_t saddr;
474
475 unsigned short encap_family;
476
477 u32 reqid;
478
479 /* Mode: transport, tunnel etc. */
480 u8 mode;
481
482 /* Sharing mode: unique, this session only, this user only etc. */
483 u8 share;
484
485 /* May skip this transfomration if no SA is found */
486 u8 optional;
487
488 /* Skip aalgos/ealgos/calgos checks. */
489 u8 allalgs;
490
491 /* Bit mask of algos allowed for acquisition */
492 u32 aalgos;
493 u32 ealgos;
494 u32 calgos;
495 };
496
497 #define XFRM_MAX_DEPTH 6
498
499 struct xfrm_policy_walk_entry {
500 struct list_head all;
501 u8 dead;
502 };
503
504 struct xfrm_policy_walk {
505 struct xfrm_policy_walk_entry walk;
506 u8 type;
507 u32 seq;
508 };
509
510 struct xfrm_policy_queue {
511 struct sk_buff_head hold_queue;
512 struct timer_list hold_timer;
513 unsigned long timeout;
514 };
515
516 struct xfrm_policy {
517 #ifdef CONFIG_NET_NS
518 struct net *xp_net;
519 #endif
520 struct hlist_node bydst;
521 struct hlist_node byidx;
522
523 /* This lock only affects elements except for entry. */
524 rwlock_t lock;
525 atomic_t refcnt;
526 struct timer_list timer;
527
528 struct flow_cache_object flo;
529 atomic_t genid;
530 u32 priority;
531 u32 index;
532 struct xfrm_mark mark;
533 struct xfrm_selector selector;
534 struct xfrm_lifetime_cfg lft;
535 struct xfrm_lifetime_cur curlft;
536 struct xfrm_policy_walk_entry walk;
537 struct xfrm_policy_queue polq;
538 u8 type;
539 u8 action;
540 u8 flags;
541 u8 xfrm_nr;
542 u16 family;
543 struct xfrm_sec_ctx *security;
544 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH];
545 };
546
547 static inline struct net *xp_net(const struct xfrm_policy *xp)
548 {
549 return read_pnet(&xp->xp_net);
550 }
551
552 struct xfrm_kmaddress {
553 xfrm_address_t local;
554 xfrm_address_t remote;
555 u32 reserved;
556 u16 family;
557 };
558
559 struct xfrm_migrate {
560 xfrm_address_t old_daddr;
561 xfrm_address_t old_saddr;
562 xfrm_address_t new_daddr;
563 xfrm_address_t new_saddr;
564 u8 proto;
565 u8 mode;
566 u16 reserved;
567 u32 reqid;
568 u16 old_family;
569 u16 new_family;
570 };
571
572 #define XFRM_KM_TIMEOUT 30
573 /* what happened */
574 #define XFRM_REPLAY_UPDATE XFRM_AE_CR
575 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE
576
577 /* default aevent timeout in units of 100ms */
578 #define XFRM_AE_ETIME 10
579 /* Async Event timer multiplier */
580 #define XFRM_AE_ETH_M 10
581 /* default seq threshold size */
582 #define XFRM_AE_SEQT_SIZE 2
583
584 struct xfrm_mgr {
585 struct list_head list;
586 char *id;
587 int (*notify)(struct xfrm_state *x, const struct km_event *c);
588 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
589 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
590 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
591 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
592 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
593 int (*migrate)(const struct xfrm_selector *sel,
594 u8 dir, u8 type,
595 const struct xfrm_migrate *m,
596 int num_bundles,
597 const struct xfrm_kmaddress *k);
598 };
599
600 int xfrm_register_km(struct xfrm_mgr *km);
601 int xfrm_unregister_km(struct xfrm_mgr *km);
602
603 /*
604 * This structure is used for the duration where packets are being
605 * transformed by IPsec. As soon as the packet leaves IPsec the
606 * area beyond the generic IP part may be overwritten.
607 */
608 struct xfrm_skb_cb {
609 union {
610 struct inet_skb_parm h4;
611 struct inet6_skb_parm h6;
612 } header;
613
614 /* Sequence number for replay protection. */
615 union {
616 struct {
617 __u32 low;
618 __u32 hi;
619 } output;
620 struct {
621 __be32 low;
622 __be32 hi;
623 } input;
624 } seq;
625 };
626
627 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
628
629 /*
630 * This structure is used by the afinfo prepare_input/prepare_output functions
631 * to transmit header information to the mode input/output functions.
632 */
633 struct xfrm_mode_skb_cb {
634 union {
635 struct inet_skb_parm h4;
636 struct inet6_skb_parm h6;
637 } header;
638
639 /* Copied from header for IPv4, always set to zero and DF for IPv6. */
640 __be16 id;
641 __be16 frag_off;
642
643 /* IP header length (excluding options or extension headers). */
644 u8 ihl;
645
646 /* TOS for IPv4, class for IPv6. */
647 u8 tos;
648
649 /* TTL for IPv4, hop limitfor IPv6. */
650 u8 ttl;
651
652 /* Protocol for IPv4, NH for IPv6. */
653 u8 protocol;
654
655 /* Option length for IPv4, zero for IPv6. */
656 u8 optlen;
657
658 /* Used by IPv6 only, zero for IPv4. */
659 u8 flow_lbl[3];
660 };
661
662 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
663
664 /*
665 * This structure is used by the input processing to locate the SPI and
666 * related information.
667 */
668 struct xfrm_spi_skb_cb {
669 union {
670 struct inet_skb_parm h4;
671 struct inet6_skb_parm h6;
672 } header;
673
674 unsigned int daddroff;
675 unsigned int family;
676 };
677
678 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
679
680 /* Audit Information */
681 struct xfrm_audit {
682 u32 secid;
683 kuid_t loginuid;
684 u32 sessionid;
685 };
686
687 #ifdef CONFIG_AUDITSYSCALL
688 static inline struct audit_buffer *xfrm_audit_start(const char *op)
689 {
690 struct audit_buffer *audit_buf = NULL;
691
692 if (audit_enabled == 0)
693 return NULL;
694 audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
695 AUDIT_MAC_IPSEC_EVENT);
696 if (audit_buf == NULL)
697 return NULL;
698 audit_log_format(audit_buf, "op=%s", op);
699 return audit_buf;
700 }
701
702 static inline void xfrm_audit_helper_usrinfo(kuid_t auid, u32 ses, u32 secid,
703 struct audit_buffer *audit_buf)
704 {
705 char *secctx;
706 u32 secctx_len;
707
708 audit_log_format(audit_buf, " auid=%u ses=%u",
709 from_kuid(&init_user_ns, auid), ses);
710 if (secid != 0 &&
711 security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
712 audit_log_format(audit_buf, " subj=%s", secctx);
713 security_release_secctx(secctx, secctx_len);
714 } else
715 audit_log_task_context(audit_buf);
716 }
717
718 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, kuid_t auid,
719 u32 ses, u32 secid);
720 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, kuid_t auid,
721 u32 ses, u32 secid);
722 void xfrm_audit_state_add(struct xfrm_state *x, int result, kuid_t auid,
723 u32 ses, u32 secid);
724 void xfrm_audit_state_delete(struct xfrm_state *x, int result, kuid_t auid,
725 u32 ses, u32 secid);
726 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
727 struct sk_buff *skb);
728 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
729 __be32 net_seq);
730 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
731 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
732 __be32 net_seq);
733 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
734 u8 proto);
735 #else
736
737 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
738 kuid_t auid, u32 ses, u32 secid)
739 {
740 }
741
742 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
743 kuid_t auid, u32 ses, u32 secid)
744 {
745 }
746
747 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
748 kuid_t auid, u32 ses, u32 secid)
749 {
750 }
751
752 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
753 kuid_t auid, u32 ses, u32 secid)
754 {
755 }
756
757 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
758 struct sk_buff *skb)
759 {
760 }
761
762 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
763 struct sk_buff *skb, __be32 net_seq)
764 {
765 }
766
767 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
768 u16 family)
769 {
770 }
771
772 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
773 __be32 net_spi, __be32 net_seq)
774 {
775 }
776
777 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
778 struct sk_buff *skb, u8 proto)
779 {
780 }
781 #endif /* CONFIG_AUDITSYSCALL */
782
783 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
784 {
785 if (likely(policy != NULL))
786 atomic_inc(&policy->refcnt);
787 }
788
789 void xfrm_policy_destroy(struct xfrm_policy *policy);
790
791 static inline void xfrm_pol_put(struct xfrm_policy *policy)
792 {
793 if (atomic_dec_and_test(&policy->refcnt))
794 xfrm_policy_destroy(policy);
795 }
796
797 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
798 {
799 int i;
800 for (i = npols - 1; i >= 0; --i)
801 xfrm_pol_put(pols[i]);
802 }
803
804 void __xfrm_state_destroy(struct xfrm_state *);
805
806 static inline void __xfrm_state_put(struct xfrm_state *x)
807 {
808 atomic_dec(&x->refcnt);
809 }
810
811 static inline void xfrm_state_put(struct xfrm_state *x)
812 {
813 if (atomic_dec_and_test(&x->refcnt))
814 __xfrm_state_destroy(x);
815 }
816
817 static inline void xfrm_state_hold(struct xfrm_state *x)
818 {
819 atomic_inc(&x->refcnt);
820 }
821
822 static inline bool addr_match(const void *token1, const void *token2,
823 int prefixlen)
824 {
825 const __be32 *a1 = token1;
826 const __be32 *a2 = token2;
827 int pdw;
828 int pbi;
829
830 pdw = prefixlen >> 5; /* num of whole u32 in prefix */
831 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
832
833 if (pdw)
834 if (memcmp(a1, a2, pdw << 2))
835 return false;
836
837 if (pbi) {
838 __be32 mask;
839
840 mask = htonl((0xffffffff) << (32 - pbi));
841
842 if ((a1[pdw] ^ a2[pdw]) & mask)
843 return false;
844 }
845
846 return true;
847 }
848
849 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
850 {
851 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
852 if (prefixlen == 0)
853 return true;
854 return !((a1 ^ a2) & htonl(0xFFFFFFFFu << (32 - prefixlen)));
855 }
856
857 static __inline__
858 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
859 {
860 __be16 port;
861 switch(fl->flowi_proto) {
862 case IPPROTO_TCP:
863 case IPPROTO_UDP:
864 case IPPROTO_UDPLITE:
865 case IPPROTO_SCTP:
866 port = uli->ports.sport;
867 break;
868 case IPPROTO_ICMP:
869 case IPPROTO_ICMPV6:
870 port = htons(uli->icmpt.type);
871 break;
872 case IPPROTO_MH:
873 port = htons(uli->mht.type);
874 break;
875 case IPPROTO_GRE:
876 port = htons(ntohl(uli->gre_key) >> 16);
877 break;
878 default:
879 port = 0; /*XXX*/
880 }
881 return port;
882 }
883
884 static __inline__
885 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
886 {
887 __be16 port;
888 switch(fl->flowi_proto) {
889 case IPPROTO_TCP:
890 case IPPROTO_UDP:
891 case IPPROTO_UDPLITE:
892 case IPPROTO_SCTP:
893 port = uli->ports.dport;
894 break;
895 case IPPROTO_ICMP:
896 case IPPROTO_ICMPV6:
897 port = htons(uli->icmpt.code);
898 break;
899 case IPPROTO_GRE:
900 port = htons(ntohl(uli->gre_key) & 0xffff);
901 break;
902 default:
903 port = 0; /*XXX*/
904 }
905 return port;
906 }
907
908 bool xfrm_selector_match(const struct xfrm_selector *sel,
909 const struct flowi *fl, unsigned short family);
910
911 #ifdef CONFIG_SECURITY_NETWORK_XFRM
912 /* If neither has a context --> match
913 * Otherwise, both must have a context and the sids, doi, alg must match
914 */
915 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
916 {
917 return ((!s1 && !s2) ||
918 (s1 && s2 &&
919 (s1->ctx_sid == s2->ctx_sid) &&
920 (s1->ctx_doi == s2->ctx_doi) &&
921 (s1->ctx_alg == s2->ctx_alg)));
922 }
923 #else
924 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
925 {
926 return true;
927 }
928 #endif
929
930 /* A struct encoding bundle of transformations to apply to some set of flow.
931 *
932 * dst->child points to the next element of bundle.
933 * dst->xfrm points to an instanse of transformer.
934 *
935 * Due to unfortunate limitations of current routing cache, which we
936 * have no time to fix, it mirrors struct rtable and bound to the same
937 * routing key, including saddr,daddr. However, we can have many of
938 * bundles differing by session id. All the bundles grow from a parent
939 * policy rule.
940 */
941 struct xfrm_dst {
942 union {
943 struct dst_entry dst;
944 struct rtable rt;
945 struct rt6_info rt6;
946 } u;
947 struct dst_entry *route;
948 struct flow_cache_object flo;
949 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
950 int num_pols, num_xfrms;
951 #ifdef CONFIG_XFRM_SUB_POLICY
952 struct flowi *origin;
953 struct xfrm_selector *partner;
954 #endif
955 u32 xfrm_genid;
956 u32 policy_genid;
957 u32 route_mtu_cached;
958 u32 child_mtu_cached;
959 u32 route_cookie;
960 u32 path_cookie;
961 };
962
963 #ifdef CONFIG_XFRM
964 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
965 {
966 xfrm_pols_put(xdst->pols, xdst->num_pols);
967 dst_release(xdst->route);
968 if (likely(xdst->u.dst.xfrm))
969 xfrm_state_put(xdst->u.dst.xfrm);
970 #ifdef CONFIG_XFRM_SUB_POLICY
971 kfree(xdst->origin);
972 xdst->origin = NULL;
973 kfree(xdst->partner);
974 xdst->partner = NULL;
975 #endif
976 }
977 #endif
978
979 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
980
981 struct sec_path {
982 atomic_t refcnt;
983 int len;
984 struct xfrm_state *xvec[XFRM_MAX_DEPTH];
985 };
986
987 static inline int secpath_exists(struct sk_buff *skb)
988 {
989 #ifdef CONFIG_XFRM
990 return skb->sp != NULL;
991 #else
992 return 0;
993 #endif
994 }
995
996 static inline struct sec_path *
997 secpath_get(struct sec_path *sp)
998 {
999 if (sp)
1000 atomic_inc(&sp->refcnt);
1001 return sp;
1002 }
1003
1004 void __secpath_destroy(struct sec_path *sp);
1005
1006 static inline void
1007 secpath_put(struct sec_path *sp)
1008 {
1009 if (sp && atomic_dec_and_test(&sp->refcnt))
1010 __secpath_destroy(sp);
1011 }
1012
1013 struct sec_path *secpath_dup(struct sec_path *src);
1014
1015 static inline void
1016 secpath_reset(struct sk_buff *skb)
1017 {
1018 #ifdef CONFIG_XFRM
1019 secpath_put(skb->sp);
1020 skb->sp = NULL;
1021 #endif
1022 }
1023
1024 static inline int
1025 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1026 {
1027 switch (family) {
1028 case AF_INET:
1029 return addr->a4 == 0;
1030 case AF_INET6:
1031 return ipv6_addr_any((struct in6_addr *)&addr->a6);
1032 }
1033 return 0;
1034 }
1035
1036 static inline int
1037 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1038 {
1039 return (tmpl->saddr.a4 &&
1040 tmpl->saddr.a4 != x->props.saddr.a4);
1041 }
1042
1043 static inline int
1044 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1045 {
1046 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1047 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1048 }
1049
1050 static inline int
1051 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1052 {
1053 switch (family) {
1054 case AF_INET:
1055 return __xfrm4_state_addr_cmp(tmpl, x);
1056 case AF_INET6:
1057 return __xfrm6_state_addr_cmp(tmpl, x);
1058 }
1059 return !0;
1060 }
1061
1062 #ifdef CONFIG_XFRM
1063 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1064 unsigned short family);
1065
1066 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1067 struct sk_buff *skb,
1068 unsigned int family, int reverse)
1069 {
1070 struct net *net = dev_net(skb->dev);
1071 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1072
1073 if (sk && sk->sk_policy[XFRM_POLICY_IN])
1074 return __xfrm_policy_check(sk, ndir, skb, family);
1075
1076 return (!net->xfrm.policy_count[dir] && !skb->sp) ||
1077 (skb_dst(skb)->flags & DST_NOPOLICY) ||
1078 __xfrm_policy_check(sk, ndir, skb, family);
1079 }
1080
1081 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1082 {
1083 return __xfrm_policy_check2(sk, dir, skb, family, 0);
1084 }
1085
1086 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1087 {
1088 return xfrm_policy_check(sk, dir, skb, AF_INET);
1089 }
1090
1091 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1092 {
1093 return xfrm_policy_check(sk, dir, skb, AF_INET6);
1094 }
1095
1096 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1097 struct sk_buff *skb)
1098 {
1099 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1100 }
1101
1102 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1103 struct sk_buff *skb)
1104 {
1105 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1106 }
1107
1108 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1109 unsigned int family, int reverse);
1110
1111 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1112 unsigned int family)
1113 {
1114 return __xfrm_decode_session(skb, fl, family, 0);
1115 }
1116
1117 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1118 struct flowi *fl,
1119 unsigned int family)
1120 {
1121 return __xfrm_decode_session(skb, fl, family, 1);
1122 }
1123
1124 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1125
1126 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1127 {
1128 struct net *net = dev_net(skb->dev);
1129
1130 return !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1131 (skb_dst(skb)->flags & DST_NOXFRM) ||
1132 __xfrm_route_forward(skb, family);
1133 }
1134
1135 static inline int xfrm4_route_forward(struct sk_buff *skb)
1136 {
1137 return xfrm_route_forward(skb, AF_INET);
1138 }
1139
1140 static inline int xfrm6_route_forward(struct sk_buff *skb)
1141 {
1142 return xfrm_route_forward(skb, AF_INET6);
1143 }
1144
1145 int __xfrm_sk_clone_policy(struct sock *sk);
1146
1147 static inline int xfrm_sk_clone_policy(struct sock *sk)
1148 {
1149 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1150 return __xfrm_sk_clone_policy(sk);
1151 return 0;
1152 }
1153
1154 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1155
1156 static inline void xfrm_sk_free_policy(struct sock *sk)
1157 {
1158 if (unlikely(sk->sk_policy[0] != NULL)) {
1159 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1160 sk->sk_policy[0] = NULL;
1161 }
1162 if (unlikely(sk->sk_policy[1] != NULL)) {
1163 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1164 sk->sk_policy[1] = NULL;
1165 }
1166 }
1167
1168 void xfrm_garbage_collect(struct net *net);
1169
1170 #else
1171
1172 static inline void xfrm_sk_free_policy(struct sock *sk) {}
1173 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1174 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1175 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1176 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1177 {
1178 return 1;
1179 }
1180 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1181 {
1182 return 1;
1183 }
1184 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1185 {
1186 return 1;
1187 }
1188 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1189 struct flowi *fl,
1190 unsigned int family)
1191 {
1192 return -ENOSYS;
1193 }
1194 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1195 struct sk_buff *skb)
1196 {
1197 return 1;
1198 }
1199 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1200 struct sk_buff *skb)
1201 {
1202 return 1;
1203 }
1204 static inline void xfrm_garbage_collect(struct net *net)
1205 {
1206 }
1207 #endif
1208
1209 static __inline__
1210 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1211 {
1212 switch (family){
1213 case AF_INET:
1214 return (xfrm_address_t *)&fl->u.ip4.daddr;
1215 case AF_INET6:
1216 return (xfrm_address_t *)&fl->u.ip6.daddr;
1217 }
1218 return NULL;
1219 }
1220
1221 static __inline__
1222 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1223 {
1224 switch (family){
1225 case AF_INET:
1226 return (xfrm_address_t *)&fl->u.ip4.saddr;
1227 case AF_INET6:
1228 return (xfrm_address_t *)&fl->u.ip6.saddr;
1229 }
1230 return NULL;
1231 }
1232
1233 static __inline__
1234 void xfrm_flowi_addr_get(const struct flowi *fl,
1235 xfrm_address_t *saddr, xfrm_address_t *daddr,
1236 unsigned short family)
1237 {
1238 switch(family) {
1239 case AF_INET:
1240 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1241 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1242 break;
1243 case AF_INET6:
1244 *(struct in6_addr *)saddr->a6 = fl->u.ip6.saddr;
1245 *(struct in6_addr *)daddr->a6 = fl->u.ip6.daddr;
1246 break;
1247 }
1248 }
1249
1250 static __inline__ int
1251 __xfrm4_state_addr_check(const struct xfrm_state *x,
1252 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1253 {
1254 if (daddr->a4 == x->id.daddr.a4 &&
1255 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1256 return 1;
1257 return 0;
1258 }
1259
1260 static __inline__ int
1261 __xfrm6_state_addr_check(const struct xfrm_state *x,
1262 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1263 {
1264 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1265 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1266 ipv6_addr_any((struct in6_addr *)saddr) ||
1267 ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1268 return 1;
1269 return 0;
1270 }
1271
1272 static __inline__ int
1273 xfrm_state_addr_check(const struct xfrm_state *x,
1274 const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1275 unsigned short family)
1276 {
1277 switch (family) {
1278 case AF_INET:
1279 return __xfrm4_state_addr_check(x, daddr, saddr);
1280 case AF_INET6:
1281 return __xfrm6_state_addr_check(x, daddr, saddr);
1282 }
1283 return 0;
1284 }
1285
1286 static __inline__ int
1287 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1288 unsigned short family)
1289 {
1290 switch (family) {
1291 case AF_INET:
1292 return __xfrm4_state_addr_check(x,
1293 (const xfrm_address_t *)&fl->u.ip4.daddr,
1294 (const xfrm_address_t *)&fl->u.ip4.saddr);
1295 case AF_INET6:
1296 return __xfrm6_state_addr_check(x,
1297 (const xfrm_address_t *)&fl->u.ip6.daddr,
1298 (const xfrm_address_t *)&fl->u.ip6.saddr);
1299 }
1300 return 0;
1301 }
1302
1303 static inline int xfrm_state_kern(const struct xfrm_state *x)
1304 {
1305 return atomic_read(&x->tunnel_users);
1306 }
1307
1308 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1309 {
1310 return (!userproto || proto == userproto ||
1311 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1312 proto == IPPROTO_ESP ||
1313 proto == IPPROTO_COMP)));
1314 }
1315
1316 /*
1317 * xfrm algorithm information
1318 */
1319 struct xfrm_algo_aead_info {
1320 u16 icv_truncbits;
1321 };
1322
1323 struct xfrm_algo_auth_info {
1324 u16 icv_truncbits;
1325 u16 icv_fullbits;
1326 };
1327
1328 struct xfrm_algo_encr_info {
1329 u16 blockbits;
1330 u16 defkeybits;
1331 };
1332
1333 struct xfrm_algo_comp_info {
1334 u16 threshold;
1335 };
1336
1337 struct xfrm_algo_desc {
1338 char *name;
1339 char *compat;
1340 u8 available:1;
1341 u8 pfkey_supported:1;
1342 union {
1343 struct xfrm_algo_aead_info aead;
1344 struct xfrm_algo_auth_info auth;
1345 struct xfrm_algo_encr_info encr;
1346 struct xfrm_algo_comp_info comp;
1347 } uinfo;
1348 struct sadb_alg desc;
1349 };
1350
1351 /* XFRM tunnel handlers. */
1352 struct xfrm_tunnel {
1353 int (*handler)(struct sk_buff *skb);
1354 int (*err_handler)(struct sk_buff *skb, u32 info);
1355
1356 struct xfrm_tunnel __rcu *next;
1357 int priority;
1358 };
1359
1360 struct xfrm_tunnel_notifier {
1361 int (*handler)(struct sk_buff *skb);
1362 struct xfrm_tunnel_notifier __rcu *next;
1363 int priority;
1364 };
1365
1366 struct xfrm6_tunnel {
1367 int (*handler)(struct sk_buff *skb);
1368 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1369 u8 type, u8 code, int offset, __be32 info);
1370 struct xfrm6_tunnel __rcu *next;
1371 int priority;
1372 };
1373
1374 void xfrm_init(void);
1375 void xfrm4_init(void);
1376 int xfrm_state_init(struct net *net);
1377 void xfrm_state_fini(struct net *net);
1378 void xfrm4_state_init(void);
1379 #ifdef CONFIG_XFRM
1380 int xfrm6_init(void);
1381 void xfrm6_fini(void);
1382 int xfrm6_state_init(void);
1383 void xfrm6_state_fini(void);
1384 #else
1385 static inline int xfrm6_init(void)
1386 {
1387 return 0;
1388 }
1389 static inline void xfrm6_fini(void)
1390 {
1391 ;
1392 }
1393 #endif
1394
1395 #ifdef CONFIG_XFRM_STATISTICS
1396 int xfrm_proc_init(struct net *net);
1397 void xfrm_proc_fini(struct net *net);
1398 #endif
1399
1400 int xfrm_sysctl_init(struct net *net);
1401 #ifdef CONFIG_SYSCTL
1402 void xfrm_sysctl_fini(struct net *net);
1403 #else
1404 static inline void xfrm_sysctl_fini(struct net *net)
1405 {
1406 }
1407 #endif
1408
1409 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
1410 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1411 int (*func)(struct xfrm_state *, int, void*), void *);
1412 void xfrm_state_walk_done(struct xfrm_state_walk *walk);
1413 struct xfrm_state *xfrm_state_alloc(struct net *net);
1414 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1415 const xfrm_address_t *saddr,
1416 const struct flowi *fl,
1417 struct xfrm_tmpl *tmpl,
1418 struct xfrm_policy *pol, int *err,
1419 unsigned short family);
1420 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark,
1421 xfrm_address_t *daddr,
1422 xfrm_address_t *saddr,
1423 unsigned short family,
1424 u8 mode, u8 proto, u32 reqid);
1425 int xfrm_state_check_expire(struct xfrm_state *x);
1426 void xfrm_state_insert(struct xfrm_state *x);
1427 int xfrm_state_add(struct xfrm_state *x);
1428 int xfrm_state_update(struct xfrm_state *x);
1429 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1430 const xfrm_address_t *daddr, __be32 spi,
1431 u8 proto, unsigned short family);
1432 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1433 const xfrm_address_t *daddr,
1434 const xfrm_address_t *saddr,
1435 u8 proto,
1436 unsigned short family);
1437 #ifdef CONFIG_XFRM_SUB_POLICY
1438 int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1439 unsigned short family);
1440 int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1441 unsigned short family);
1442 #else
1443 static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1444 int n, unsigned short family)
1445 {
1446 return -ENOSYS;
1447 }
1448
1449 static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1450 int n, unsigned short family)
1451 {
1452 return -ENOSYS;
1453 }
1454 #endif
1455
1456 struct xfrmk_sadinfo {
1457 u32 sadhcnt; /* current hash bkts */
1458 u32 sadhmcnt; /* max allowed hash bkts */
1459 u32 sadcnt; /* current running count */
1460 };
1461
1462 struct xfrmk_spdinfo {
1463 u32 incnt;
1464 u32 outcnt;
1465 u32 fwdcnt;
1466 u32 inscnt;
1467 u32 outscnt;
1468 u32 fwdscnt;
1469 u32 spdhcnt;
1470 u32 spdhmcnt;
1471 };
1472
1473 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1474 int xfrm_state_delete(struct xfrm_state *x);
1475 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
1476 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1477 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1478 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1479 int xfrm_init_replay(struct xfrm_state *x);
1480 int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1481 int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
1482 int xfrm_init_state(struct xfrm_state *x);
1483 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1484 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1485 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1486 int xfrm_output_resume(struct sk_buff *skb, int err);
1487 int xfrm_output(struct sk_buff *skb);
1488 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1489 void xfrm_local_error(struct sk_buff *skb, int mtu);
1490 int xfrm4_extract_header(struct sk_buff *skb);
1491 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1492 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1493 int encap_type);
1494 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1495 int xfrm4_rcv(struct sk_buff *skb);
1496
1497 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1498 {
1499 return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1500 }
1501
1502 int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1503 int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1504 int xfrm4_output(struct sk_buff *skb);
1505 int xfrm4_output_finish(struct sk_buff *skb);
1506 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1507 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1508 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1509 int xfrm4_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
1510 int xfrm4_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
1511 int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler);
1512 int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler);
1513 int xfrm6_extract_header(struct sk_buff *skb);
1514 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1515 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1516 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1517 int xfrm6_rcv(struct sk_buff *skb);
1518 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1519 xfrm_address_t *saddr, u8 proto);
1520 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1521 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1522 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1523 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1524 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1525 int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1526 int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1527 int xfrm6_output(struct sk_buff *skb);
1528 int xfrm6_output_finish(struct sk_buff *skb);
1529 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1530 u8 **prevhdr);
1531
1532 #ifdef CONFIG_XFRM
1533 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1534 int xfrm_user_policy(struct sock *sk, int optname,
1535 u8 __user *optval, int optlen);
1536 #else
1537 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1538 {
1539 return -ENOPROTOOPT;
1540 }
1541
1542 static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1543 {
1544 /* should not happen */
1545 kfree_skb(skb);
1546 return 0;
1547 }
1548 #endif
1549
1550 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1551
1552 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1553 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1554 int (*func)(struct xfrm_policy *, int, int, void*),
1555 void *);
1556 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
1557 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1558 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
1559 u8 type, int dir,
1560 struct xfrm_selector *sel,
1561 struct xfrm_sec_ctx *ctx, int delete,
1562 int *err);
1563 struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
1564 u32 id, int delete, int *err);
1565 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
1566 u32 xfrm_get_acqseq(void);
1567 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1568 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1569 u8 mode, u32 reqid, u8 proto,
1570 const xfrm_address_t *daddr,
1571 const xfrm_address_t *saddr, int create,
1572 unsigned short family);
1573 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1574
1575 #ifdef CONFIG_XFRM_MIGRATE
1576 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1577 const struct xfrm_migrate *m, int num_bundles,
1578 const struct xfrm_kmaddress *k);
1579 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m);
1580 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1581 struct xfrm_migrate *m);
1582 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1583 struct xfrm_migrate *m, int num_bundles,
1584 struct xfrm_kmaddress *k);
1585 #endif
1586
1587 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1588 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1589 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1590 xfrm_address_t *addr);
1591
1592 void xfrm_input_init(void);
1593 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1594
1595 void xfrm_probe_algs(void);
1596 int xfrm_count_pfkey_auth_supported(void);
1597 int xfrm_count_pfkey_enc_supported(void);
1598 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1599 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1600 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1601 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1602 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1603 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1604 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1605 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1606 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1607 int probe);
1608
1609 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1610 const xfrm_address_t *b)
1611 {
1612 return ipv6_addr_equal((const struct in6_addr *)a,
1613 (const struct in6_addr *)b);
1614 }
1615
1616 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1617 const xfrm_address_t *b,
1618 sa_family_t family)
1619 {
1620 switch (family) {
1621 default:
1622 case AF_INET:
1623 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1624 case AF_INET6:
1625 return xfrm6_addr_equal(a, b);
1626 }
1627 }
1628
1629 static inline int xfrm_policy_id2dir(u32 index)
1630 {
1631 return index & 7;
1632 }
1633
1634 #ifdef CONFIG_XFRM
1635 static inline int xfrm_aevent_is_on(struct net *net)
1636 {
1637 struct sock *nlsk;
1638 int ret = 0;
1639
1640 rcu_read_lock();
1641 nlsk = rcu_dereference(net->xfrm.nlsk);
1642 if (nlsk)
1643 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1644 rcu_read_unlock();
1645 return ret;
1646 }
1647 #endif
1648
1649 static inline int xfrm_alg_len(const struct xfrm_algo *alg)
1650 {
1651 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1652 }
1653
1654 static inline int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1655 {
1656 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1657 }
1658
1659 static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1660 {
1661 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1662 }
1663
1664 #ifdef CONFIG_XFRM_MIGRATE
1665 static inline int xfrm_replay_clone(struct xfrm_state *x,
1666 struct xfrm_state *orig)
1667 {
1668 x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1669 GFP_KERNEL);
1670 if (!x->replay_esn)
1671 return -ENOMEM;
1672
1673 x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1674 x->replay_esn->replay_window = orig->replay_esn->replay_window;
1675
1676 x->preplay_esn = kmemdup(x->replay_esn,
1677 xfrm_replay_state_esn_len(x->replay_esn),
1678 GFP_KERNEL);
1679 if (!x->preplay_esn) {
1680 kfree(x->replay_esn);
1681 return -ENOMEM;
1682 }
1683
1684 return 0;
1685 }
1686
1687 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1688 {
1689 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1690 }
1691
1692 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1693 {
1694 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1695 }
1696
1697 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1698 {
1699 int i;
1700 for (i = 0; i < n; i++)
1701 xfrm_state_put(*(states + i));
1702 }
1703
1704 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1705 {
1706 int i;
1707 for (i = 0; i < n; i++)
1708 xfrm_state_delete(*(states + i));
1709 }
1710 #endif
1711
1712 #ifdef CONFIG_XFRM
1713 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1714 {
1715 return skb->sp->xvec[skb->sp->len - 1];
1716 }
1717 #endif
1718
1719 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
1720 {
1721 if (attrs[XFRMA_MARK])
1722 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
1723 else
1724 m->v = m->m = 0;
1725
1726 return m->v & m->m;
1727 }
1728
1729 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
1730 {
1731 int ret = 0;
1732
1733 if (m->m | m->v)
1734 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
1735 return ret;
1736 }
1737
1738 #endif /* _NET_XFRM_H */
Linux kernel - Deliverables
This page took 0.086948 seconds and 5 git commands to generate.