~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/net/xfrm.h

Version: ~ [ linux-4.20-rc6 ] ~ [ linux-4.19.8 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.87 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.144 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.166 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.128 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.61 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.31.14 ] ~ [ linux-2.6.30.10 ] ~ [ linux-2.6.29.6 ] ~ [ linux-2.6.28.10 ] ~ [ linux-2.6.27.62 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* SPDX-License-Identifier: GPL-2.0 */
  2 #ifndef _NET_XFRM_H
  3 #define _NET_XFRM_H
  4 
  5 #include <linux/compiler.h>
  6 #include <linux/xfrm.h>
  7 #include <linux/spinlock.h>
  8 #include <linux/list.h>
  9 #include <linux/skbuff.h>
 10 #include <linux/socket.h>
 11 #include <linux/pfkeyv2.h>
 12 #include <linux/ipsec.h>
 13 #include <linux/in6.h>
 14 #include <linux/mutex.h>
 15 #include <linux/audit.h>
 16 #include <linux/slab.h>
 17 #include <linux/refcount.h>
 18 
 19 #include <net/sock.h>
 20 #include <net/dst.h>
 21 #include <net/ip.h>
 22 #include <net/route.h>
 23 #include <net/ipv6.h>
 24 #include <net/ip6_fib.h>
 25 #include <net/flow.h>
 26 #include <net/gro_cells.h>
 27 
 28 #include <linux/interrupt.h>
 29 
 30 #ifdef CONFIG_XFRM_STATISTICS
 31 #include <net/snmp.h>
 32 #endif
 33 
 34 #define XFRM_PROTO_ESP          50
 35 #define XFRM_PROTO_AH           51
 36 #define XFRM_PROTO_COMP         108
 37 #define XFRM_PROTO_IPIP         4
 38 #define XFRM_PROTO_IPV6         41
 39 #define XFRM_PROTO_ROUTING      IPPROTO_ROUTING
 40 #define XFRM_PROTO_DSTOPTS      IPPROTO_DSTOPTS
 41 
 42 #define XFRM_ALIGN4(len)        (((len) + 3) & ~3)
 43 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
 44 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
 45         MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
 46 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
 47         MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
 48 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \
 49         MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto))
 50 
 51 #ifdef CONFIG_XFRM_STATISTICS
 52 #define XFRM_INC_STATS(net, field)      SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
 53 #else
 54 #define XFRM_INC_STATS(net, field)      ((void)(net))
 55 #endif
 56 
 57 
 58 /* Organization of SPD aka "XFRM rules"
 59    ------------------------------------
 60 
 61    Basic objects:
 62    - policy rule, struct xfrm_policy (=SPD entry)
 63    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
 64    - instance of a transformer, struct xfrm_state (=SA)
 65    - template to clone xfrm_state, struct xfrm_tmpl
 66 
 67    SPD is plain linear list of xfrm_policy rules, ordered by priority.
 68    (To be compatible with existing pfkeyv2 implementations,
 69    many rules with priority of 0x7fffffff are allowed to exist and
 70    such rules are ordered in an unpredictable way, thanks to bsd folks.)
 71 
 72    Lookup is plain linear search until the first match with selector.
 73 
 74    If "action" is "block", then we prohibit the flow, otherwise:
 75    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
 76    policy entry has list of up to XFRM_MAX_DEPTH transformations,
 77    described by templates xfrm_tmpl. Each template is resolved
 78    to a complete xfrm_state (see below) and we pack bundle of transformations
 79    to a dst_entry returned to requestor.
 80 
 81    dst -. xfrm  .-> xfrm_state #1
 82     |---. child .-> dst -. xfrm .-> xfrm_state #2
 83                      |---. child .-> dst -. xfrm .-> xfrm_state #3
 84                                       |---. child .-> NULL
 85 
 86    Bundles are cached at xrfm_policy struct (field ->bundles).
 87 
 88 
 89    Resolution of xrfm_tmpl
 90    -----------------------
 91    Template contains:
 92    1. ->mode            Mode: transport or tunnel
 93    2. ->id.proto        Protocol: AH/ESP/IPCOMP
 94    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
 95       Q: allow to resolve security gateway?
 96    4. ->id.spi          If not zero, static SPI.
 97    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
 98    6. ->algos           List of allowed algos. Plain bitmask now.
 99       Q: ealgos, aalgos, calgos. What a mess...
100    7. ->share           Sharing mode.
101       Q: how to implement private sharing mode? To add struct sock* to
102       flow id?
103 
104    Having this template we search through SAD searching for entries
105    with appropriate mode/proto/algo, permitted by selector.
106    If no appropriate entry found, it is requested from key manager.
107 
108    PROBLEMS:
109    Q: How to find all the bundles referring to a physical path for
110       PMTU discovery? Seems, dst should contain list of all parents...
111       and enter to infinite locking hierarchy disaster.
112       No! It is easier, we will not search for them, let them find us.
113       We add genid to each dst plus pointer to genid of raw IP route,
114       pmtu disc will update pmtu on raw IP route and increase its genid.
115       dst_check() will see this for top level and trigger resyncing
116       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
117  */
118 
119 struct xfrm_state_walk {
120         struct list_head        all;
121         u8                      state;
122         u8                      dying;
123         u8                      proto;
124         u32                     seq;
125         struct xfrm_address_filter *filter;
126 };
127 
128 struct xfrm_state_offload {
129         struct net_device       *dev;
130         unsigned long           offload_handle;
131         unsigned int            num_exthdrs;
132         u8                      flags;
133 };
134 
135 /* Full description of state of transformer. */
136 struct xfrm_state {
137         possible_net_t          xs_net;
138         union {
139                 struct hlist_node       gclist;
140                 struct hlist_node       bydst;
141         };
142         struct hlist_node       bysrc;
143         struct hlist_node       byspi;
144 
145         refcount_t              refcnt;
146         spinlock_t              lock;
147 
148         struct xfrm_id          id;
149         struct xfrm_selector    sel;
150         struct xfrm_mark        mark;
151         u32                     if_id;
152         u32                     tfcpad;
153 
154         u32                     genid;
155 
156         /* Key manager bits */
157         struct xfrm_state_walk  km;
158 
159         /* Parameters of this state. */
160         struct {
161                 u32             reqid;
162                 u8              mode;
163                 u8              replay_window;
164                 u8              aalgo, ealgo, calgo;
165                 u8              flags;
166                 u16             family;
167                 xfrm_address_t  saddr;
168                 int             header_len;
169                 int             trailer_len;
170                 u32             extra_flags;
171                 struct xfrm_mark        smark;
172         } props;
173 
174         struct xfrm_lifetime_cfg lft;
175 
176         /* Data for transformer */
177         struct xfrm_algo_auth   *aalg;
178         struct xfrm_algo        *ealg;
179         struct xfrm_algo        *calg;
180         struct xfrm_algo_aead   *aead;
181         const char              *geniv;
182 
183         /* Data for encapsulator */
184         struct xfrm_encap_tmpl  *encap;
185 
186         /* Data for care-of address */
187         xfrm_address_t  *coaddr;
188 
189         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
190         struct xfrm_state       *tunnel;
191 
192         /* If a tunnel, number of users + 1 */
193         atomic_t                tunnel_users;
194 
195         /* State for replay detection */
196         struct xfrm_replay_state replay;
197         struct xfrm_replay_state_esn *replay_esn;
198 
199         /* Replay detection state at the time we sent the last notification */
200         struct xfrm_replay_state preplay;
201         struct xfrm_replay_state_esn *preplay_esn;
202 
203         /* The functions for replay detection. */
204         const struct xfrm_replay *repl;
205 
206         /* internal flag that only holds state for delayed aevent at the
207          * moment
208         */
209         u32                     xflags;
210 
211         /* Replay detection notification settings */
212         u32                     replay_maxage;
213         u32                     replay_maxdiff;
214 
215         /* Replay detection notification timer */
216         struct timer_list       rtimer;
217 
218         /* Statistics */
219         struct xfrm_stats       stats;
220 
221         struct xfrm_lifetime_cur curlft;
222         struct tasklet_hrtimer  mtimer;
223 
224         struct xfrm_state_offload xso;
225 
226         /* used to fix curlft->add_time when changing date */
227         long            saved_tmo;
228 
229         /* Last used time */
230         time64_t                lastused;
231 
232         struct page_frag xfrag;
233 
234         /* Reference to data common to all the instances of this
235          * transformer. */
236         const struct xfrm_type  *type;
237         struct xfrm_mode        *inner_mode;
238         struct xfrm_mode        *inner_mode_iaf;
239         struct xfrm_mode        *outer_mode;
240 
241         const struct xfrm_type_offload  *type_offload;
242 
243         /* Security context */
244         struct xfrm_sec_ctx     *security;
245 
246         /* Private data of this transformer, format is opaque,
247          * interpreted by xfrm_type methods. */
248         void                    *data;
249 };
250 
251 static inline struct net *xs_net(struct xfrm_state *x)
252 {
253         return read_pnet(&x->xs_net);
254 }
255 
256 /* xflags - make enum if more show up */
257 #define XFRM_TIME_DEFER 1
258 #define XFRM_SOFT_EXPIRE 2
259 
260 enum {
261         XFRM_STATE_VOID,
262         XFRM_STATE_ACQ,
263         XFRM_STATE_VALID,
264         XFRM_STATE_ERROR,
265         XFRM_STATE_EXPIRED,
266         XFRM_STATE_DEAD
267 };
268 
269 /* callback structure passed from either netlink or pfkey */
270 struct km_event {
271         union {
272                 u32 hard;
273                 u32 proto;
274                 u32 byid;
275                 u32 aevent;
276                 u32 type;
277         } data;
278 
279         u32     seq;
280         u32     portid;
281         u32     event;
282         struct net *net;
283 };
284 
285 struct xfrm_replay {
286         void    (*advance)(struct xfrm_state *x, __be32 net_seq);
287         int     (*check)(struct xfrm_state *x,
288                          struct sk_buff *skb,
289                          __be32 net_seq);
290         int     (*recheck)(struct xfrm_state *x,
291                            struct sk_buff *skb,
292                            __be32 net_seq);
293         void    (*notify)(struct xfrm_state *x, int event);
294         int     (*overflow)(struct xfrm_state *x, struct sk_buff *skb);
295 };
296 
297 struct xfrm_if_cb {
298         struct xfrm_if  *(*decode_session)(struct sk_buff *skb);
299 };
300 
301 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
302 void xfrm_if_unregister_cb(void);
303 
304 struct net_device;
305 struct xfrm_type;
306 struct xfrm_dst;
307 struct xfrm_policy_afinfo {
308         struct dst_ops          *dst_ops;
309         struct dst_entry        *(*dst_lookup)(struct net *net,
310                                                int tos, int oif,
311                                                const xfrm_address_t *saddr,
312                                                const xfrm_address_t *daddr,
313                                                u32 mark);
314         int                     (*get_saddr)(struct net *net, int oif,
315                                              xfrm_address_t *saddr,
316                                              xfrm_address_t *daddr,
317                                              u32 mark);
318         void                    (*decode_session)(struct sk_buff *skb,
319                                                   struct flowi *fl,
320                                                   int reverse);
321         int                     (*get_tos)(const struct flowi *fl);
322         int                     (*init_path)(struct xfrm_dst *path,
323                                              struct dst_entry *dst,
324                                              int nfheader_len);
325         int                     (*fill_dst)(struct xfrm_dst *xdst,
326                                             struct net_device *dev,
327                                             const struct flowi *fl);
328         struct dst_entry        *(*blackhole_route)(struct net *net, struct dst_entry *orig);
329 };
330 
331 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family);
332 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo);
333 void km_policy_notify(struct xfrm_policy *xp, int dir,
334                       const struct km_event *c);
335 void km_state_notify(struct xfrm_state *x, const struct km_event *c);
336 
337 struct xfrm_tmpl;
338 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t,
339              struct xfrm_policy *pol);
340 void km_state_expired(struct xfrm_state *x, int hard, u32 portid);
341 int __xfrm_state_delete(struct xfrm_state *x);
342 
343 struct xfrm_state_afinfo {
344         unsigned int                    family;
345         unsigned int                    proto;
346         __be16                          eth_proto;
347         struct module                   *owner;
348         const struct xfrm_type          *type_map[IPPROTO_MAX];
349         const struct xfrm_type_offload  *type_offload_map[IPPROTO_MAX];
350         struct xfrm_mode                *mode_map[XFRM_MODE_MAX];
351 
352         int                     (*init_flags)(struct xfrm_state *x);
353         void                    (*init_tempsel)(struct xfrm_selector *sel,
354                                                 const struct flowi *fl);
355         void                    (*init_temprop)(struct xfrm_state *x,
356                                                 const struct xfrm_tmpl *tmpl,
357                                                 const xfrm_address_t *daddr,
358                                                 const xfrm_address_t *saddr);
359         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
360         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
361         int                     (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
362         int                     (*output_finish)(struct sock *sk, struct sk_buff *skb);
363         int                     (*extract_input)(struct xfrm_state *x,
364                                                  struct sk_buff *skb);
365         int                     (*extract_output)(struct xfrm_state *x,
366                                                   struct sk_buff *skb);
367         int                     (*transport_finish)(struct sk_buff *skb,
368                                                     int async);
369         void                    (*local_error)(struct sk_buff *skb, u32 mtu);
370 };
371 
372 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
373 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
374 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
375 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family);
376 
377 struct xfrm_input_afinfo {
378         unsigned int            family;
379         int                     (*callback)(struct sk_buff *skb, u8 protocol,
380                                             int err);
381 };
382 
383 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
384 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
385 
386 void xfrm_flush_gc(void);
387 void xfrm_state_delete_tunnel(struct xfrm_state *x);
388 
389 struct xfrm_type {
390         char                    *description;
391         struct module           *owner;
392         u8                      proto;
393         u8                      flags;
394 #define XFRM_TYPE_NON_FRAGMENT  1
395 #define XFRM_TYPE_REPLAY_PROT   2
396 #define XFRM_TYPE_LOCAL_COADDR  4
397 #define XFRM_TYPE_REMOTE_COADDR 8
398 
399         int                     (*init_state)(struct xfrm_state *x);
400         void                    (*destructor)(struct xfrm_state *);
401         int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
402         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
403         int                     (*reject)(struct xfrm_state *, struct sk_buff *,
404                                           const struct flowi *);
405         int                     (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
406         /* Estimate maximal size of result of transformation of a dgram */
407         u32                     (*get_mtu)(struct xfrm_state *, int size);
408 };
409 
410 int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
411 int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
412 
413 struct xfrm_type_offload {
414         char            *description;
415         struct module   *owner;
416         u8              proto;
417         void            (*encap)(struct xfrm_state *, struct sk_buff *pskb);
418         int             (*input_tail)(struct xfrm_state *x, struct sk_buff *skb);
419         int             (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features);
420 };
421 
422 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family);
423 int xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family);
424 
425 struct xfrm_mode {
426         /*
427          * Remove encapsulation header.
428          *
429          * The IP header will be moved over the top of the encapsulation
430          * header.
431          *
432          * On entry, the transport header shall point to where the IP header
433          * should be and the network header shall be set to where the IP
434          * header currently is.  skb->data shall point to the start of the
435          * payload.
436          */
437         int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
438 
439         /*
440          * This is the actual input entry point.
441          *
442          * For transport mode and equivalent this would be identical to
443          * input2 (which does not need to be set).  While tunnel mode
444          * and equivalent would set this to the tunnel encapsulation function
445          * xfrm4_prepare_input that would in turn call input2.
446          */
447         int (*input)(struct xfrm_state *x, struct sk_buff *skb);
448 
449         /*
450          * Add encapsulation header.
451          *
452          * On exit, the transport header will be set to the start of the
453          * encapsulation header to be filled in by x->type->output and
454          * the mac header will be set to the nextheader (protocol for
455          * IPv4) field of the extension header directly preceding the
456          * encapsulation header, or in its absence, that of the top IP
457          * header.  The value of the network header will always point
458          * to the top IP header while skb->data will point to the payload.
459          */
460         int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
461 
462         /*
463          * This is the actual output entry point.
464          *
465          * For transport mode and equivalent this would be identical to
466          * output2 (which does not need to be set).  While tunnel mode
467          * and equivalent would set this to a tunnel encapsulation function
468          * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
469          * call output2.
470          */
471         int (*output)(struct xfrm_state *x, struct sk_buff *skb);
472 
473         /*
474          * Adjust pointers into the packet and do GSO segmentation.
475          */
476         struct sk_buff *(*gso_segment)(struct xfrm_state *x, struct sk_buff *skb, netdev_features_t features);
477 
478         /*
479          * Adjust pointers into the packet when IPsec is done at layer2.
480          */
481         void (*xmit)(struct xfrm_state *x, struct sk_buff *skb);
482 
483         struct xfrm_state_afinfo *afinfo;
484         struct module *owner;
485         unsigned int encap;
486         int flags;
487 };
488 
489 /* Flags for xfrm_mode. */
490 enum {
491         XFRM_MODE_FLAG_TUNNEL = 1,
492 };
493 
494 int xfrm_register_mode(struct xfrm_mode *mode, int family);
495 int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
496 
497 static inline int xfrm_af2proto(unsigned int family)
498 {
499         switch(family) {
500         case AF_INET:
501                 return IPPROTO_IPIP;
502         case AF_INET6:
503                 return IPPROTO_IPV6;
504         default:
505                 return 0;
506         }
507 }
508 
509 static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
510 {
511         if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
512             (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
513                 return x->inner_mode;
514         else
515                 return x->inner_mode_iaf;
516 }
517 
518 struct xfrm_tmpl {
519 /* id in template is interpreted as:
520  * daddr - destination of tunnel, may be zero for transport mode.
521  * spi   - zero to acquire spi. Not zero if spi is static, then
522  *         daddr must be fixed too.
523  * proto - AH/ESP/IPCOMP
524  */
525         struct xfrm_id          id;
526 
527 /* Source address of tunnel. Ignored, if it is not a tunnel. */
528         xfrm_address_t          saddr;
529 
530         unsigned short          encap_family;
531 
532         u32                     reqid;
533 
534 /* Mode: transport, tunnel etc. */
535         u8                      mode;
536 
537 /* Sharing mode: unique, this session only, this user only etc. */
538         u8                      share;
539 
540 /* May skip this transfomration if no SA is found */
541         u8                      optional;
542 
543 /* Skip aalgos/ealgos/calgos checks. */
544         u8                      allalgs;
545 
546 /* Bit mask of algos allowed for acquisition */
547         u32                     aalgos;
548         u32                     ealgos;
549         u32                     calgos;
550 };
551 
552 #define XFRM_MAX_DEPTH          6
553 #define XFRM_MAX_OFFLOAD_DEPTH  1
554 
555 struct xfrm_policy_walk_entry {
556         struct list_head        all;
557         u8                      dead;
558 };
559 
560 struct xfrm_policy_walk {
561         struct xfrm_policy_walk_entry walk;
562         u8 type;
563         u32 seq;
564 };
565 
566 struct xfrm_policy_queue {
567         struct sk_buff_head     hold_queue;
568         struct timer_list       hold_timer;
569         unsigned long           timeout;
570 };
571 
572 struct xfrm_policy {
573         possible_net_t          xp_net;
574         struct hlist_node       bydst;
575         struct hlist_node       byidx;
576 
577         /* This lock only affects elements except for entry. */
578         rwlock_t                lock;
579         refcount_t              refcnt;
580         struct timer_list       timer;
581 
582         atomic_t                genid;
583         u32                     priority;
584         u32                     index;
585         u32                     if_id;
586         struct xfrm_mark        mark;
587         struct xfrm_selector    selector;
588         struct xfrm_lifetime_cfg lft;
589         struct xfrm_lifetime_cur curlft;
590         struct xfrm_policy_walk_entry walk;
591         struct xfrm_policy_queue polq;
592         u8                      type;
593         u8                      action;
594         u8                      flags;
595         u8                      xfrm_nr;
596         u16                     family;
597         struct xfrm_sec_ctx     *security;
598         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
599         struct rcu_head         rcu;
600 };
601 
602 static inline struct net *xp_net(const struct xfrm_policy *xp)
603 {
604         return read_pnet(&xp->xp_net);
605 }
606 
607 struct xfrm_kmaddress {
608         xfrm_address_t          local;
609         xfrm_address_t          remote;
610         u32                     reserved;
611         u16                     family;
612 };
613 
614 struct xfrm_migrate {
615         xfrm_address_t          old_daddr;
616         xfrm_address_t          old_saddr;
617         xfrm_address_t          new_daddr;
618         xfrm_address_t          new_saddr;
619         u8                      proto;
620         u8                      mode;
621         u16                     reserved;
622         u32                     reqid;
623         u16                     old_family;
624         u16                     new_family;
625 };
626 
627 #define XFRM_KM_TIMEOUT                30
628 /* what happened */
629 #define XFRM_REPLAY_UPDATE      XFRM_AE_CR
630 #define XFRM_REPLAY_TIMEOUT     XFRM_AE_CE
631 
632 /* default aevent timeout in units of 100ms */
633 #define XFRM_AE_ETIME                   10
634 /* Async Event timer multiplier */
635 #define XFRM_AE_ETH_M                   10
636 /* default seq threshold size */
637 #define XFRM_AE_SEQT_SIZE               2
638 
639 struct xfrm_mgr {
640         struct list_head        list;
641         int                     (*notify)(struct xfrm_state *x, const struct km_event *c);
642         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp);
643         struct xfrm_policy      *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
644         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
645         int                     (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c);
646         int                     (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
647         int                     (*migrate)(const struct xfrm_selector *sel,
648                                            u8 dir, u8 type,
649                                            const struct xfrm_migrate *m,
650                                            int num_bundles,
651                                            const struct xfrm_kmaddress *k,
652                                            const struct xfrm_encap_tmpl *encap);
653         bool                    (*is_alive)(const struct km_event *c);
654 };
655 
656 int xfrm_register_km(struct xfrm_mgr *km);
657 int xfrm_unregister_km(struct xfrm_mgr *km);
658 
659 struct xfrm_tunnel_skb_cb {
660         union {
661                 struct inet_skb_parm h4;
662                 struct inet6_skb_parm h6;
663         } header;
664 
665         union {
666                 struct ip_tunnel *ip4;
667                 struct ip6_tnl *ip6;
668         } tunnel;
669 };
670 
671 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
672 
673 /*
674  * This structure is used for the duration where packets are being
675  * transformed by IPsec.  As soon as the packet leaves IPsec the
676  * area beyond the generic IP part may be overwritten.
677  */
678 struct xfrm_skb_cb {
679         struct xfrm_tunnel_skb_cb header;
680 
681         /* Sequence number for replay protection. */
682         union {
683                 struct {
684                         __u32 low;
685                         __u32 hi;
686                 } output;
687                 struct {
688                         __be32 low;
689                         __be32 hi;
690                 } input;
691         } seq;
692 };
693 
694 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
695 
696 /*
697  * This structure is used by the afinfo prepare_input/prepare_output functions
698  * to transmit header information to the mode input/output functions.
699  */
700 struct xfrm_mode_skb_cb {
701         struct xfrm_tunnel_skb_cb header;
702 
703         /* Copied from header for IPv4, always set to zero and DF for IPv6. */
704         __be16 id;
705         __be16 frag_off;
706 
707         /* IP header length (excluding options or extension headers). */
708         u8 ihl;
709 
710         /* TOS for IPv4, class for IPv6. */
711         u8 tos;
712 
713         /* TTL for IPv4, hop limitfor IPv6. */
714         u8 ttl;
715 
716         /* Protocol for IPv4, NH for IPv6. */
717         u8 protocol;
718 
719         /* Option length for IPv4, zero for IPv6. */
720         u8 optlen;
721 
722         /* Used by IPv6 only, zero for IPv4. */
723         u8 flow_lbl[3];
724 };
725 
726 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
727 
728 /*
729  * This structure is used by the input processing to locate the SPI and
730  * related information.
731  */
732 struct xfrm_spi_skb_cb {
733         struct xfrm_tunnel_skb_cb header;
734 
735         unsigned int daddroff;
736         unsigned int family;
737         __be32 seq;
738 };
739 
740 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
741 
742 #ifdef CONFIG_AUDITSYSCALL
743 static inline struct audit_buffer *xfrm_audit_start(const char *op)
744 {
745         struct audit_buffer *audit_buf = NULL;
746 
747         if (audit_enabled == AUDIT_OFF)
748                 return NULL;
749         audit_buf = audit_log_start(audit_context(), GFP_ATOMIC,
750                                     AUDIT_MAC_IPSEC_EVENT);
751         if (audit_buf == NULL)
752                 return NULL;
753         audit_log_format(audit_buf, "op=%s", op);
754         return audit_buf;
755 }
756 
757 static inline void xfrm_audit_helper_usrinfo(bool task_valid,
758                                              struct audit_buffer *audit_buf)
759 {
760         const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
761                                             audit_get_loginuid(current) :
762                                             INVALID_UID);
763         const unsigned int ses = task_valid ? audit_get_sessionid(current) :
764                 AUDIT_SID_UNSET;
765 
766         audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
767         audit_log_task_context(audit_buf);
768 }
769 
770 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
771 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
772                               bool task_valid);
773 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
774 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
775 void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
776                                       struct sk_buff *skb);
777 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
778                              __be32 net_seq);
779 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
780 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi,
781                                __be32 net_seq);
782 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
783                               u8 proto);
784 #else
785 
786 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
787                                          bool task_valid)
788 {
789 }
790 
791 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
792                                             bool task_valid)
793 {
794 }
795 
796 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
797                                         bool task_valid)
798 {
799 }
800 
801 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
802                                            bool task_valid)
803 {
804 }
805 
806 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
807                                              struct sk_buff *skb)
808 {
809 }
810 
811 static inline void xfrm_audit_state_replay(struct xfrm_state *x,
812                                            struct sk_buff *skb, __be32 net_seq)
813 {
814 }
815 
816 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
817                                       u16 family)
818 {
819 }
820 
821 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
822                                       __be32 net_spi, __be32 net_seq)
823 {
824 }
825 
826 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
827                                      struct sk_buff *skb, u8 proto)
828 {
829 }
830 #endif /* CONFIG_AUDITSYSCALL */
831 
832 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
833 {
834         if (likely(policy != NULL))
835                 refcount_inc(&policy->refcnt);
836 }
837 
838 void xfrm_policy_destroy(struct xfrm_policy *policy);
839 
840 static inline void xfrm_pol_put(struct xfrm_policy *policy)
841 {
842         if (refcount_dec_and_test(&policy->refcnt))
843                 xfrm_policy_destroy(policy);
844 }
845 
846 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
847 {
848         int i;
849         for (i = npols - 1; i >= 0; --i)
850                 xfrm_pol_put(pols[i]);
851 }
852 
853 void __xfrm_state_destroy(struct xfrm_state *);
854 
855 static inline void __xfrm_state_put(struct xfrm_state *x)
856 {
857         refcount_dec(&x->refcnt);
858 }
859 
860 static inline void xfrm_state_put(struct xfrm_state *x)
861 {
862         if (refcount_dec_and_test(&x->refcnt))
863                 __xfrm_state_destroy(x);
864 }
865 
866 static inline void xfrm_state_hold(struct xfrm_state *x)
867 {
868         refcount_inc(&x->refcnt);
869 }
870 
871 static inline bool addr_match(const void *token1, const void *token2,
872                               unsigned int prefixlen)
873 {
874         const __be32 *a1 = token1;
875         const __be32 *a2 = token2;
876         unsigned int pdw;
877         unsigned int pbi;
878 
879         pdw = prefixlen >> 5;     /* num of whole u32 in prefix */
880         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
881 
882         if (pdw)
883                 if (memcmp(a1, a2, pdw << 2))
884                         return false;
885 
886         if (pbi) {
887                 __be32 mask;
888 
889                 mask = htonl((0xffffffff) << (32 - pbi));
890 
891                 if ((a1[pdw] ^ a2[pdw]) & mask)
892                         return false;
893         }
894 
895         return true;
896 }
897 
898 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
899 {
900         /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
901         if (sizeof(long) == 4 && prefixlen == 0)
902                 return true;
903         return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
904 }
905 
906 static __inline__
907 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli)
908 {
909         __be16 port;
910         switch(fl->flowi_proto) {
911         case IPPROTO_TCP:
912         case IPPROTO_UDP:
913         case IPPROTO_UDPLITE:
914         case IPPROTO_SCTP:
915                 port = uli->ports.sport;
916                 break;
917         case IPPROTO_ICMP:
918         case IPPROTO_ICMPV6:
919                 port = htons(uli->icmpt.type);
920                 break;
921         case IPPROTO_MH:
922                 port = htons(uli->mht.type);
923                 break;
924         case IPPROTO_GRE:
925                 port = htons(ntohl(uli->gre_key) >> 16);
926                 break;
927         default:
928                 port = 0;       /*XXX*/
929         }
930         return port;
931 }
932 
933 static __inline__
934 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli)
935 {
936         __be16 port;
937         switch(fl->flowi_proto) {
938         case IPPROTO_TCP:
939         case IPPROTO_UDP:
940         case IPPROTO_UDPLITE:
941         case IPPROTO_SCTP:
942                 port = uli->ports.dport;
943                 break;
944         case IPPROTO_ICMP:
945         case IPPROTO_ICMPV6:
946                 port = htons(uli->icmpt.code);
947                 break;
948         case IPPROTO_GRE:
949                 port = htons(ntohl(uli->gre_key) & 0xffff);
950                 break;
951         default:
952                 port = 0;       /*XXX*/
953         }
954         return port;
955 }
956 
957 bool xfrm_selector_match(const struct xfrm_selector *sel,
958                          const struct flowi *fl, unsigned short family);
959 
960 #ifdef CONFIG_SECURITY_NETWORK_XFRM
961 /*      If neither has a context --> match
962  *      Otherwise, both must have a context and the sids, doi, alg must match
963  */
964 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
965 {
966         return ((!s1 && !s2) ||
967                 (s1 && s2 &&
968                  (s1->ctx_sid == s2->ctx_sid) &&
969                  (s1->ctx_doi == s2->ctx_doi) &&
970                  (s1->ctx_alg == s2->ctx_alg)));
971 }
972 #else
973 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
974 {
975         return true;
976 }
977 #endif
978 
979 /* A struct encoding bundle of transformations to apply to some set of flow.
980  *
981  * xdst->child points to the next element of bundle.
982  * dst->xfrm  points to an instanse of transformer.
983  *
984  * Due to unfortunate limitations of current routing cache, which we
985  * have no time to fix, it mirrors struct rtable and bound to the same
986  * routing key, including saddr,daddr. However, we can have many of
987  * bundles differing by session id. All the bundles grow from a parent
988  * policy rule.
989  */
990 struct xfrm_dst {
991         union {
992                 struct dst_entry        dst;
993                 struct rtable           rt;
994                 struct rt6_info         rt6;
995         } u;
996         struct dst_entry *route;
997         struct dst_entry *child;
998         struct dst_entry *path;
999         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
1000         int num_pols, num_xfrms;
1001         u32 xfrm_genid;
1002         u32 policy_genid;
1003         u32 route_mtu_cached;
1004         u32 child_mtu_cached;
1005         u32 route_cookie;
1006         u32 path_cookie;
1007 };
1008 
1009 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
1010 {
1011 #ifdef CONFIG_XFRM
1012         if (dst->xfrm) {
1013                 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
1014 
1015                 return xdst->path;
1016         }
1017 #endif
1018         return (struct dst_entry *) dst;
1019 }
1020 
1021 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
1022 {
1023 #ifdef CONFIG_XFRM
1024         if (dst->xfrm) {
1025                 struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
1026                 return xdst->child;
1027         }
1028 #endif
1029         return NULL;
1030 }
1031 
1032 #ifdef CONFIG_XFRM
1033 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child)
1034 {
1035         xdst->child = child;
1036 }
1037 
1038 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
1039 {
1040         xfrm_pols_put(xdst->pols, xdst->num_pols);
1041         dst_release(xdst->route);
1042         if (likely(xdst->u.dst.xfrm))
1043                 xfrm_state_put(xdst->u.dst.xfrm);
1044 }
1045 #endif
1046 
1047 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
1048 
1049 struct xfrm_if_parms {
1050         char name[IFNAMSIZ];    /* name of XFRM device */
1051         int link;               /* ifindex of underlying L2 interface */
1052         u32 if_id;              /* interface identifyer */
1053 };
1054 
1055 struct xfrm_if {
1056         struct xfrm_if __rcu *next;     /* next interface in list */
1057         struct net_device *dev;         /* virtual device associated with interface */
1058         struct net_device *phydev;      /* physical device */
1059         struct net *net;                /* netns for packet i/o */
1060         struct xfrm_if_parms p;         /* interface parms */
1061 
1062         struct gro_cells gro_cells;
1063 };
1064 
1065 struct xfrm_offload {
1066         /* Output sequence number for replay protection on offloading. */
1067         struct {
1068                 __u32 low;
1069                 __u32 hi;
1070         } seq;
1071 
1072         __u32                   flags;
1073 #define SA_DELETE_REQ           1
1074 #define CRYPTO_DONE             2
1075 #define CRYPTO_NEXT_DONE        4
1076 #define CRYPTO_FALLBACK         8
1077 #define XFRM_GSO_SEGMENT        16
1078 #define XFRM_GRO                32
1079 #define XFRM_ESP_NO_TRAILER     64
1080 #define XFRM_DEV_RESUME         128
1081 
1082         __u32                   status;
1083 #define CRYPTO_SUCCESS                          1
1084 #define CRYPTO_GENERIC_ERROR                    2
1085 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED         4
1086 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED        8
1087 #define CRYPTO_TUNNEL_AH_AUTH_FAILED            16
1088 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED           32
1089 #define CRYPTO_INVALID_PACKET_SYNTAX            64
1090 #define CRYPTO_INVALID_PROTOCOL                 128
1091 
1092         __u8                    proto;
1093 };
1094 
1095 struct sec_path {
1096         refcount_t              refcnt;
1097         int                     len;
1098         int                     olen;
1099 
1100         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
1101         struct xfrm_offload     ovec[XFRM_MAX_OFFLOAD_DEPTH];
1102 };
1103 
1104 static inline int secpath_exists(struct sk_buff *skb)
1105 {
1106 #ifdef CONFIG_XFRM
1107         return skb->sp != NULL;
1108 #else
1109         return 0;
1110 #endif
1111 }
1112 
1113 static inline struct sec_path *
1114 secpath_get(struct sec_path *sp)
1115 {
1116         if (sp)
1117                 refcount_inc(&sp->refcnt);
1118         return sp;
1119 }
1120 
1121 void __secpath_destroy(struct sec_path *sp);
1122 
1123 static inline void
1124 secpath_put(struct sec_path *sp)
1125 {
1126         if (sp && refcount_dec_and_test(&sp->refcnt))
1127                 __secpath_destroy(sp);
1128 }
1129 
1130 struct sec_path *secpath_dup(struct sec_path *src);
1131 int secpath_set(struct sk_buff *skb);
1132 
1133 static inline void
1134 secpath_reset(struct sk_buff *skb)
1135 {
1136 #ifdef CONFIG_XFRM
1137         secpath_put(skb->sp);
1138         skb->sp = NULL;
1139 #endif
1140 }
1141 
1142 static inline int
1143 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family)
1144 {
1145         switch (family) {
1146         case AF_INET:
1147                 return addr->a4 == 0;
1148         case AF_INET6:
1149                 return ipv6_addr_any(&addr->in6);
1150         }
1151         return 0;
1152 }
1153 
1154 static inline int
1155 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1156 {
1157         return  (tmpl->saddr.a4 &&
1158                  tmpl->saddr.a4 != x->props.saddr.a4);
1159 }
1160 
1161 static inline int
1162 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x)
1163 {
1164         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
1165                  !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
1166 }
1167 
1168 static inline int
1169 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family)
1170 {
1171         switch (family) {
1172         case AF_INET:
1173                 return __xfrm4_state_addr_cmp(tmpl, x);
1174         case AF_INET6:
1175                 return __xfrm6_state_addr_cmp(tmpl, x);
1176         }
1177         return !0;
1178 }
1179 
1180 #ifdef CONFIG_XFRM
1181 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb,
1182                         unsigned short family);
1183 
1184 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
1185                                        struct sk_buff *skb,
1186                                        unsigned int family, int reverse)
1187 {
1188         struct net *net = dev_net(skb->dev);
1189         int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
1190 
1191         if (sk && sk->sk_policy[XFRM_POLICY_IN])
1192                 return __xfrm_policy_check(sk, ndir, skb, family);
1193 
1194         return  (!net->xfrm.policy_count[dir] && !skb->sp) ||
1195                 (skb_dst(skb)->flags & DST_NOPOLICY) ||
1196                 __xfrm_policy_check(sk, ndir, skb, family);
1197 }
1198 
1199 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1200 {
1201         return __xfrm_policy_check2(sk, dir, skb, family, 0);
1202 }
1203 
1204 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1205 {
1206         return xfrm_policy_check(sk, dir, skb, AF_INET);
1207 }
1208 
1209 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1210 {
1211         return xfrm_policy_check(sk, dir, skb, AF_INET6);
1212 }
1213 
1214 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1215                                              struct sk_buff *skb)
1216 {
1217         return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1218 }
1219 
1220 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1221                                              struct sk_buff *skb)
1222 {
1223         return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1224 }
1225 
1226 int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1227                           unsigned int family, int reverse);
1228 
1229 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1230                                       unsigned int family)
1231 {
1232         return __xfrm_decode_session(skb, fl, family, 0);
1233 }
1234 
1235 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1236                                               struct flowi *fl,
1237                                               unsigned int family)
1238 {
1239         return __xfrm_decode_session(skb, fl, family, 1);
1240 }
1241 
1242 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1243 
1244 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1245 {
1246         struct net *net = dev_net(skb->dev);
1247 
1248         return  !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1249                 (skb_dst(skb)->flags & DST_NOXFRM) ||
1250                 __xfrm_route_forward(skb, family);
1251 }
1252 
1253 static inline int xfrm4_route_forward(struct sk_buff *skb)
1254 {
1255         return xfrm_route_forward(skb, AF_INET);
1256 }
1257 
1258 static inline int xfrm6_route_forward(struct sk_buff *skb)
1259 {
1260         return xfrm_route_forward(skb, AF_INET6);
1261 }
1262 
1263 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
1264 
1265 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
1266 {
1267         sk->sk_policy[0] = NULL;
1268         sk->sk_policy[1] = NULL;
1269         if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
1270                 return __xfrm_sk_clone_policy(sk, osk);
1271         return 0;
1272 }
1273 
1274 int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1275 
1276 static inline void xfrm_sk_free_policy(struct sock *sk)
1277 {
1278         struct xfrm_policy *pol;
1279 
1280         pol = rcu_dereference_protected(sk->sk_policy[0], 1);
1281         if (unlikely(pol != NULL)) {
1282                 xfrm_policy_delete(pol, XFRM_POLICY_MAX);
1283                 sk->sk_policy[0] = NULL;
1284         }
1285         pol = rcu_dereference_protected(sk->sk_policy[1], 1);
1286         if (unlikely(pol != NULL)) {
1287                 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
1288                 sk->sk_policy[1] = NULL;
1289         }
1290 }
1291 
1292 #else
1293 
1294 static inline void xfrm_sk_free_policy(struct sock *sk) {}
1295 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
1296 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1297 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1298 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1299 {
1300         return 1;
1301 }
1302 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1303 {
1304         return 1;
1305 }
1306 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1307 {
1308         return 1;
1309 }
1310 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1311                                               struct flowi *fl,
1312                                               unsigned int family)
1313 {
1314         return -ENOSYS;
1315 }
1316 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1317                                              struct sk_buff *skb)
1318 {
1319         return 1;
1320 }
1321 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1322                                              struct sk_buff *skb)
1323 {
1324         return 1;
1325 }
1326 #endif
1327 
1328 static __inline__
1329 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family)
1330 {
1331         switch (family){
1332         case AF_INET:
1333                 return (xfrm_address_t *)&fl->u.ip4.daddr;
1334         case AF_INET6:
1335                 return (xfrm_address_t *)&fl->u.ip6.daddr;
1336         }
1337         return NULL;
1338 }
1339 
1340 static __inline__
1341 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family)
1342 {
1343         switch (family){
1344         case AF_INET:
1345                 return (xfrm_address_t *)&fl->u.ip4.saddr;
1346         case AF_INET6:
1347                 return (xfrm_address_t *)&fl->u.ip6.saddr;
1348         }
1349         return NULL;
1350 }
1351 
1352 static __inline__
1353 void xfrm_flowi_addr_get(const struct flowi *fl,
1354                          xfrm_address_t *saddr, xfrm_address_t *daddr,
1355                          unsigned short family)
1356 {
1357         switch(family) {
1358         case AF_INET:
1359                 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4));
1360                 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4));
1361                 break;
1362         case AF_INET6:
1363                 saddr->in6 = fl->u.ip6.saddr;
1364                 daddr->in6 = fl->u.ip6.daddr;
1365                 break;
1366         }
1367 }
1368 
1369 static __inline__ int
1370 __xfrm4_state_addr_check(const struct xfrm_state *x,
1371                          const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1372 {
1373         if (daddr->a4 == x->id.daddr.a4 &&
1374             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1375                 return 1;
1376         return 0;
1377 }
1378 
1379 static __inline__ int
1380 __xfrm6_state_addr_check(const struct xfrm_state *x,
1381                          const xfrm_address_t *daddr, const xfrm_address_t *saddr)
1382 {
1383         if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1384             (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) ||
1385              ipv6_addr_any((struct in6_addr *)saddr) ||
1386              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1387                 return 1;
1388         return 0;
1389 }
1390 
1391 static __inline__ int
1392 xfrm_state_addr_check(const struct xfrm_state *x,
1393                       const xfrm_address_t *daddr, const xfrm_address_t *saddr,
1394                       unsigned short family)
1395 {
1396         switch (family) {
1397         case AF_INET:
1398                 return __xfrm4_state_addr_check(x, daddr, saddr);
1399         case AF_INET6:
1400                 return __xfrm6_state_addr_check(x, daddr, saddr);
1401         }
1402         return 0;
1403 }
1404 
1405 static __inline__ int
1406 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl,
1407                            unsigned short family)
1408 {
1409         switch (family) {
1410         case AF_INET:
1411                 return __xfrm4_state_addr_check(x,
1412                                                 (const xfrm_address_t *)&fl->u.ip4.daddr,
1413                                                 (const xfrm_address_t *)&fl->u.ip4.saddr);
1414         case AF_INET6:
1415                 return __xfrm6_state_addr_check(x,
1416                                                 (const xfrm_address_t *)&fl->u.ip6.daddr,
1417                                                 (const xfrm_address_t *)&fl->u.ip6.saddr);
1418         }
1419         return 0;
1420 }
1421 
1422 static inline int xfrm_state_kern(const struct xfrm_state *x)
1423 {
1424         return atomic_read(&x->tunnel_users);
1425 }
1426 
1427 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1428 {
1429         return (!userproto || proto == userproto ||
1430                 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1431                                                   proto == IPPROTO_ESP ||
1432                                                   proto == IPPROTO_COMP)));
1433 }
1434 
1435 /*
1436  * xfrm algorithm information
1437  */
1438 struct xfrm_algo_aead_info {
1439         char *geniv;
1440         u16 icv_truncbits;
1441 };
1442 
1443 struct xfrm_algo_auth_info {
1444         u16 icv_truncbits;
1445         u16 icv_fullbits;
1446 };
1447 
1448 struct xfrm_algo_encr_info {
1449         char *geniv;
1450         u16 blockbits;
1451         u16 defkeybits;
1452 };
1453 
1454 struct xfrm_algo_comp_info {
1455         u16 threshold;
1456 };
1457 
1458 struct xfrm_algo_desc {
1459         char *name;
1460         char *compat;
1461         u8 available:1;
1462         u8 pfkey_supported:1;
1463         union {
1464                 struct xfrm_algo_aead_info aead;
1465                 struct xfrm_algo_auth_info auth;
1466                 struct xfrm_algo_encr_info encr;
1467                 struct xfrm_algo_comp_info comp;
1468         } uinfo;
1469         struct sadb_alg desc;
1470 };
1471 
1472 /* XFRM protocol handlers.  */
1473 struct xfrm4_protocol {
1474         int (*handler)(struct sk_buff *skb);
1475         int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi,
1476                              int encap_type);
1477         int (*cb_handler)(struct sk_buff *skb, int err);
1478         int (*err_handler)(struct sk_buff *skb, u32 info);
1479 
1480         struct xfrm4_protocol __rcu *next;
1481         int priority;
1482 };
1483 
1484 struct xfrm6_protocol {
1485         int (*handler)(struct sk_buff *skb);
1486         int (*cb_handler)(struct sk_buff *skb, int err);
1487         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1488                            u8 type, u8 code, int offset, __be32 info);
1489 
1490         struct xfrm6_protocol __rcu *next;
1491         int priority;
1492 };
1493 
1494 /* XFRM tunnel handlers.  */
1495 struct xfrm_tunnel {
1496         int (*handler)(struct sk_buff *skb);
1497         int (*err_handler)(struct sk_buff *skb, u32 info);
1498 
1499         struct xfrm_tunnel __rcu *next;
1500         int priority;
1501 };
1502 
1503 struct xfrm6_tunnel {
1504         int (*handler)(struct sk_buff *skb);
1505         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1506                            u8 type, u8 code, int offset, __be32 info);
1507         struct xfrm6_tunnel __rcu *next;
1508         int priority;
1509 };
1510 
1511 void xfrm_init(void);
1512 void xfrm4_init(void);
1513 int xfrm_state_init(struct net *net);
1514 void xfrm_state_fini(struct net *net);
1515 void xfrm4_state_init(void);
1516 void xfrm4_protocol_init(void);
1517 #ifdef CONFIG_XFRM
1518 int xfrm6_init(void);
1519 void xfrm6_fini(void);
1520 int xfrm6_state_init(void);
1521 void xfrm6_state_fini(void);
1522 int xfrm6_protocol_init(void);
1523 void xfrm6_protocol_fini(void);
1524 #else
1525 static inline int xfrm6_init(void)
1526 {
1527         return 0;
1528 }
1529 static inline void xfrm6_fini(void)
1530 {
1531         ;
1532 }
1533 #endif
1534 
1535 #ifdef CONFIG_XFRM_STATISTICS
1536 int xfrm_proc_init(struct net *net);
1537 void xfrm_proc_fini(struct net *net);
1538 #endif
1539 
1540 int xfrm_sysctl_init(struct net *net);
1541 #ifdef CONFIG_SYSCTL
1542 void xfrm_sysctl_fini(struct net *net);
1543 #else
1544 static inline void xfrm_sysctl_fini(struct net *net)
1545 {
1546 }
1547 #endif
1548 
1549 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto,
1550                           struct xfrm_address_filter *filter);
1551 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1552                     int (*func)(struct xfrm_state *, int, void*), void *);
1553 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
1554 struct xfrm_state *xfrm_state_alloc(struct net *net);
1555 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
1556                                    const xfrm_address_t *saddr,
1557                                    const struct flowi *fl,
1558                                    struct xfrm_tmpl *tmpl,
1559                                    struct xfrm_policy *pol, int *err,
1560                                    unsigned short family, u32 if_id);
1561 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
1562                                        xfrm_address_t *daddr,
1563                                        xfrm_address_t *saddr,
1564                                        unsigned short family,
1565                                        u8 mode, u8 proto, u32 reqid);
1566 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
1567                                               unsigned short family);
1568 int xfrm_state_check_expire(struct xfrm_state *x);
1569 void xfrm_state_insert(struct xfrm_state *x);
1570 int xfrm_state_add(struct xfrm_state *x);
1571 int xfrm_state_update(struct xfrm_state *x);
1572 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark,
1573                                      const xfrm_address_t *daddr, __be32 spi,
1574                                      u8 proto, unsigned short family);
1575 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark,
1576                                             const xfrm_address_t *daddr,
1577                                             const xfrm_address_t *saddr,
1578                                             u8 proto,
1579                                             unsigned short family);
1580 #ifdef CONFIG_XFRM_SUB_POLICY
1581 int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
1582                    unsigned short family, struct net *net);
1583 int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
1584                     unsigned short family);
1585 #else
1586 static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1587                                  int n, unsigned short family, struct net *net)
1588 {
1589         return -ENOSYS;
1590 }
1591 
1592 static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1593                                   int n, unsigned short family)
1594 {
1595         return -ENOSYS;
1596 }
1597 #endif
1598 
1599 struct xfrmk_sadinfo {
1600         u32 sadhcnt; /* current hash bkts */
1601         u32 sadhmcnt; /* max allowed hash bkts */
1602         u32 sadcnt; /* current running count */
1603 };
1604 
1605 struct xfrmk_spdinfo {
1606         u32 incnt;
1607         u32 outcnt;
1608         u32 fwdcnt;
1609         u32 inscnt;
1610         u32 outscnt;
1611         u32 fwdscnt;
1612         u32 spdhcnt;
1613         u32 spdhmcnt;
1614 };
1615 
1616 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
1617 int xfrm_state_delete(struct xfrm_state *x);
1618 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
1619 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
1620 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1621 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1622 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
1623 int xfrm_init_replay(struct xfrm_state *x);
1624 int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1625 int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload);
1626 int xfrm_init_state(struct xfrm_state *x);
1627 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1628 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
1629 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1630 int xfrm_trans_queue(struct sk_buff *skb,
1631                      int (*finish)(struct net *, struct sock *,
1632                                    struct sk_buff *));
1633 int xfrm_output_resume(struct sk_buff *skb, int err);
1634 int xfrm_output(struct sock *sk, struct sk_buff *skb);
1635 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1636 void xfrm_local_error(struct sk_buff *skb, int mtu);
1637 int xfrm4_extract_header(struct sk_buff *skb);
1638 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1639 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1640                     int encap_type);
1641 int xfrm4_transport_finish(struct sk_buff *skb, int async);
1642 int xfrm4_rcv(struct sk_buff *skb);
1643 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1644 
1645 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1646 {
1647         XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
1648         XFRM_SPI_SKB_CB(skb)->family = AF_INET;
1649         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
1650         return xfrm_input(skb, nexthdr, spi, 0);
1651 }
1652 
1653 int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1654 int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1655 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1656 int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb);
1657 int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1658 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol);
1659 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol);
1660 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1661 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1662 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
1663 int xfrm6_extract_header(struct sk_buff *skb);
1664 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1665 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
1666                   struct ip6_tnl *t);
1667 int xfrm6_transport_finish(struct sk_buff *skb, int async);
1668 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
1669 int xfrm6_rcv(struct sk_buff *skb);
1670 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1671                      xfrm_address_t *saddr, u8 proto);
1672 void xfrm6_local_error(struct sk_buff *skb, u32 mtu);
1673 int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err);
1674 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol);
1675 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol);
1676 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1677 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1678 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr);
1679 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr);
1680 int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1681 int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1682 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb);
1683 int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb);
1684 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1685                           u8 **prevhdr);
1686 
1687 #ifdef CONFIG_XFRM
1688 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1689 int xfrm_user_policy(struct sock *sk, int optname,
1690                      u8 __user *optval, int optlen);
1691 #else
1692 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1693 {
1694         return -ENOPROTOOPT;
1695 }
1696 
1697 static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1698 {
1699         /* should not happen */
1700         kfree_skb(skb);
1701         return 0;
1702 }
1703 #endif
1704 
1705 struct dst_entry *__xfrm_dst_lookup(struct net *net, int tos, int oif,
1706                                     const xfrm_address_t *saddr,
1707                                     const xfrm_address_t *daddr,
1708                                     int family, u32 mark);
1709 
1710 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1711 
1712 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1713 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1714                      int (*func)(struct xfrm_policy *, int, int, void*),
1715                      void *);
1716 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
1717 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1718 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
1719                                           u8 type, int dir,
1720                                           struct xfrm_selector *sel,
1721                                           struct xfrm_sec_ctx *ctx, int delete,
1722                                           int *err);
1723 struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, u8,
1724                                      int dir, u32 id, int delete, int *err);
1725 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
1726 void xfrm_policy_hash_rebuild(struct net *net);
1727 u32 xfrm_get_acqseq(void);
1728 int verify_spi_info(u8 proto, u32 min, u32 max);
1729 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1730 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark,
1731                                  u8 mode, u32 reqid, u32 if_id, u8 proto,
1732                                  const xfrm_address_t *daddr,
1733                                  const xfrm_address_t *saddr, int create,
1734                                  unsigned short family);
1735 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1736 
1737 #ifdef CONFIG_XFRM_MIGRATE
1738 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1739                const struct xfrm_migrate *m, int num_bundles,
1740                const struct xfrm_kmaddress *k,
1741                const struct xfrm_encap_tmpl *encap);
1742 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
1743 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
1744                                       struct xfrm_migrate *m,
1745                                       struct xfrm_encap_tmpl *encap);
1746 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
1747                  struct xfrm_migrate *m, int num_bundles,
1748                  struct xfrm_kmaddress *k, struct net *net,
1749                  struct xfrm_encap_tmpl *encap);
1750 #endif
1751 
1752 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1753 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid);
1754 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel,
1755               xfrm_address_t *addr);
1756 
1757 void xfrm_input_init(void);
1758 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1759 
1760 void xfrm_probe_algs(void);
1761 int xfrm_count_pfkey_auth_supported(void);
1762 int xfrm_count_pfkey_enc_supported(void);
1763 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1764 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1765 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1766 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1767 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1768 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe);
1769 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe);
1770 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe);
1771 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len,
1772                                             int probe);
1773 
1774 static inline bool xfrm6_addr_equal(const xfrm_address_t *a,
1775                                     const xfrm_address_t *b)
1776 {
1777         return ipv6_addr_equal((const struct in6_addr *)a,
1778                                (const struct in6_addr *)b);
1779 }
1780 
1781 static inline bool xfrm_addr_equal(const xfrm_address_t *a,
1782                                    const xfrm_address_t *b,
1783                                    sa_family_t family)
1784 {
1785         switch (family) {
1786         default:
1787         case AF_INET:
1788                 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0;
1789         case AF_INET6:
1790                 return xfrm6_addr_equal(a, b);
1791         }
1792 }
1793 
1794 static inline int xfrm_policy_id2dir(u32 index)
1795 {
1796         return index & 7;
1797 }
1798 
1799 #ifdef CONFIG_XFRM
1800 static inline int xfrm_aevent_is_on(struct net *net)
1801 {
1802         struct sock *nlsk;
1803         int ret = 0;
1804 
1805         rcu_read_lock();
1806         nlsk = rcu_dereference(net->xfrm.nlsk);
1807         if (nlsk)
1808                 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1809         rcu_read_unlock();
1810         return ret;
1811 }
1812 
1813 static inline int xfrm_acquire_is_on(struct net *net)
1814 {
1815         struct sock *nlsk;
1816         int ret = 0;
1817 
1818         rcu_read_lock();
1819         nlsk = rcu_dereference(net->xfrm.nlsk);
1820         if (nlsk)
1821                 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE);
1822         rcu_read_unlock();
1823 
1824         return ret;
1825 }
1826 #endif
1827 
1828 static inline unsigned int aead_len(struct xfrm_algo_aead *alg)
1829 {
1830         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1831 }
1832 
1833 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg)
1834 {
1835         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1836 }
1837 
1838 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg)
1839 {
1840         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1841 }
1842 
1843 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
1844 {
1845         return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
1846 }
1847 
1848 #ifdef CONFIG_XFRM_MIGRATE
1849 static inline int xfrm_replay_clone(struct xfrm_state *x,
1850                                      struct xfrm_state *orig)
1851 {
1852         x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
1853                                 GFP_KERNEL);
1854         if (!x->replay_esn)
1855                 return -ENOMEM;
1856 
1857         x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
1858         x->replay_esn->replay_window = orig->replay_esn->replay_window;
1859 
1860         x->preplay_esn = kmemdup(x->replay_esn,
1861                                  xfrm_replay_state_esn_len(x->replay_esn),
1862                                  GFP_KERNEL);
1863         if (!x->preplay_esn) {
1864                 kfree(x->replay_esn);
1865                 return -ENOMEM;
1866         }
1867 
1868         return 0;
1869 }
1870 
1871 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig)
1872 {
1873         return kmemdup(orig, aead_len(orig), GFP_KERNEL);
1874 }
1875 
1876 
1877 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1878 {
1879         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1880 }
1881 
1882 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1883 {
1884         return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1885 }
1886 
1887 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1888 {
1889         int i;
1890         for (i = 0; i < n; i++)
1891                 xfrm_state_put(*(states + i));
1892 }
1893 
1894 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1895 {
1896         int i;
1897         for (i = 0; i < n; i++)
1898                 xfrm_state_delete(*(states + i));
1899 }
1900 #endif
1901 
1902 #ifdef CONFIG_XFRM
1903 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1904 {
1905         return skb->sp->xvec[skb->sp->len - 1];
1906 }
1907 #endif
1908 
1909 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb)
1910 {
1911 #ifdef CONFIG_XFRM
1912         struct sec_path *sp = skb->sp;
1913 
1914         if (!sp || !sp->olen || sp->len != sp->olen)
1915                 return NULL;
1916 
1917         return &sp->ovec[sp->olen - 1];
1918 #else
1919         return NULL;
1920 #endif
1921 }
1922 
1923 void __init xfrm_dev_init(void);
1924 
1925 #ifdef CONFIG_XFRM_OFFLOAD
1926 void xfrm_dev_resume(struct sk_buff *skb);
1927 void xfrm_dev_backlog(struct softnet_data *sd);
1928 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again);
1929 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
1930                        struct xfrm_user_offload *xuo);
1931 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
1932 
1933 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
1934 {
1935         struct xfrm_state_offload *xso = &x->xso;
1936 
1937         if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
1938                 xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
1939 }
1940 
1941 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
1942 {
1943         struct xfrm_state *x = dst->xfrm;
1944         struct xfrm_dst *xdst;
1945 
1946         if (!x || !x->type_offload)
1947                 return false;
1948 
1949         xdst = (struct xfrm_dst *) dst;
1950         if (!x->xso.offload_handle && !xdst->child->xfrm)
1951                 return true;
1952         if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) &&
1953             !xdst->child->xfrm)
1954                 return true;
1955 
1956         return false;
1957 }
1958 
1959 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1960 {
1961         struct xfrm_state_offload *xso = &x->xso;
1962 
1963         if (xso->dev)
1964                 xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
1965 }
1966 
1967 static inline void xfrm_dev_state_free(struct xfrm_state *x)
1968 {
1969         struct xfrm_state_offload *xso = &x->xso;
1970          struct net_device *dev = xso->dev;
1971 
1972         if (dev && dev->xfrmdev_ops) {
1973                 if (dev->xfrmdev_ops->xdo_dev_state_free)
1974                         dev->xfrmdev_ops->xdo_dev_state_free(x);
1975                 xso->dev = NULL;
1976                 dev_put(dev);
1977         }
1978 }
1979 #else
1980 static inline void xfrm_dev_resume(struct sk_buff *skb)
1981 {
1982 }
1983 
1984 static inline void xfrm_dev_backlog(struct softnet_data *sd)
1985 {
1986 }
1987 
1988 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again)
1989 {
1990         return skb;
1991 }
1992 
1993 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo)
1994 {
1995         return 0;
1996 }
1997 
1998 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
1999 {
2000 }
2001 
2002 static inline void xfrm_dev_state_free(struct xfrm_state *x)
2003 {
2004 }
2005 
2006 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
2007 {
2008         return false;
2009 }
2010 
2011 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
2012 {
2013 }
2014 
2015 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
2016 {
2017         return false;
2018 }
2019 #endif
2020 
2021 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
2022 {
2023         if (attrs[XFRMA_MARK])
2024                 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
2025         else
2026                 m->v = m->m = 0;
2027 
2028         return m->v & m->m;
2029 }
2030 
2031 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m)
2032 {
2033         int ret = 0;
2034 
2035         if (m->m | m->v)
2036                 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m);
2037         return ret;
2038 }
2039 
2040 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x)
2041 {
2042         struct xfrm_mark *m = &x->props.smark;
2043 
2044         return (m->v & m->m) | (mark & ~m->m);
2045 }
2046 
2047 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id)
2048 {
2049         int ret = 0;
2050 
2051         if (if_id)
2052                 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id);
2053         return ret;
2054 }
2055 
2056 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x,
2057                                     unsigned int family)
2058 {
2059         bool tunnel = false;
2060 
2061         switch(family) {
2062         case AF_INET:
2063                 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
2064                         tunnel = true;
2065                 break;
2066         case AF_INET6:
2067                 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
2068                         tunnel = true;
2069                 break;
2070         }
2071         if (tunnel && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL))
2072                 return -EINVAL;
2073 
2074         return 0;
2075 }
2076 #endif  /* _NET_XFRM_H */
2077 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp