include/net/xfrm.h

   1 #ifndef _NET_XFRM_H
   2 #define _NET_XFRM_H
   3
   4 #include <linux/compiler.h>
   5 #include <linux/xfrm.h>
   6 #include <linux/spinlock.h>
   7 #include <linux/list.h>
   8 #include <linux/skbuff.h>
   9 #include <linux/socket.h>
  10 #include <linux/pfkeyv2.h>
  11 #include <linux/ipsec.h>
  12 #include <linux/in6.h>
  13 #include <linux/mutex.h>
  14 #include <linux/audit.h>
  15
  16 #include <net/sock.h>
  17 #include <net/dst.h>
  18 #include <net/ip.h>
  19 #include <net/route.h>
  20 #include <net/ipv6.h>
  21 #include <net/ip6_fib.h>
  22
  23 #include <linux/interrupt.h>
  24
  25 #ifdef CONFIG_XFRM_STATISTICS
  26 #include <net/snmp.h>
  27 #endif
  28
  29 #define XFRM_PROTO_ESP          50
  30 #define XFRM_PROTO_AH           51
  31 #define XFRM_PROTO_COMP         108
  32 #define XFRM_PROTO_IPIP         4
  33 #define XFRM_PROTO_IPV6         41
  34 #define XFRM_PROTO_ROUTING      IPPROTO_ROUTING
  35 #define XFRM_PROTO_DSTOPTS      IPPROTO_DSTOPTS
  36
  37 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
  38 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
  39         MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
  40 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \
  41         MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto))
  42
  43 #ifdef CONFIG_XFRM_STATISTICS
  44 #define XFRM_INC_STATS(net, field)      SNMP_INC_STATS((net)->mib.xfrm_statistics, field)
  45 #define XFRM_INC_STATS_BH(net, field)   SNMP_INC_STATS_BH((net)->mib.xfrm_statistics, field)
  46 #define XFRM_INC_STATS_USER(net, field) SNMP_INC_STATS_USER((net)-mib.xfrm_statistics, field)
  47 #else
  48 #define XFRM_INC_STATS(net, field)      ((void)(net))
  49 #define XFRM_INC_STATS_BH(net, field)   ((void)(net))
  50 #define XFRM_INC_STATS_USER(net, field) ((void)(net))
  51 #endif
  52
  53 extern struct mutex xfrm_cfg_mutex;
  54
  55 /* Organization of SPD aka "XFRM rules"
  56    ------------------------------------
  57
  58    Basic objects:
  59    - policy rule, struct xfrm_policy (=SPD entry)
  60    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  61    - instance of a transformer, struct xfrm_state (=SA)
  62    - template to clone xfrm_state, struct xfrm_tmpl
  63
  64    SPD is plain linear list of xfrm_policy rules, ordered by priority.
  65    (To be compatible with existing pfkeyv2 implementations,
  66    many rules with priority of 0x7fffffff are allowed to exist and
  67    such rules are ordered in an unpredictable way, thanks to bsd folks.)
  68
  69    Lookup is plain linear search until the first match with selector.
  70
  71    If "action" is "block", then we prohibit the flow, otherwise:
  72    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  73    policy entry has list of up to XFRM_MAX_DEPTH transformations,
  74    described by templates xfrm_tmpl. Each template is resolved
  75    to a complete xfrm_state (see below) and we pack bundle of transformations
  76    to a dst_entry returned to requestor.
  77
  78    dst -. xfrm  .-> xfrm_state #1
  79     |---. child .-> dst -. xfrm .-> xfrm_state #2
  80                      |---. child .-> dst -. xfrm .-> xfrm_state #3
  81                                       |---. child .-> NULL
  82
  83    Bundles are cached at xrfm_policy struct (field ->bundles).
  84
  85
  86    Resolution of xrfm_tmpl
  87    -----------------------
  88    Template contains:
  89    1. ->mode            Mode: transport or tunnel
  90    2. ->id.proto        Protocol: AH/ESP/IPCOMP
  91    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
  92       Q: allow to resolve security gateway?
  93    4. ->id.spi          If not zero, static SPI.
  94    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
  95    6. ->algos           List of allowed algos. Plain bitmask now.
  96       Q: ealgos, aalgos, calgos. What a mess...
  97    7. ->share           Sharing mode.
  98       Q: how to implement private sharing mode? To add struct sock* to
  99       flow id?
 100
 101    Having this template we search through SAD searching for entries
 102    with appropriate mode/proto/algo, permitted by selector.
 103    If no appropriate entry found, it is requested from key manager.
 104
 105    PROBLEMS:
 106    Q: How to find all the bundles referring to a physical path for
 107       PMTU discovery? Seems, dst should contain list of all parents...
 108       and enter to infinite locking hierarchy disaster.
 109       No! It is easier, we will not search for them, let them find us.
 110       We add genid to each dst plus pointer to genid of raw IP route,
 111       pmtu disc will update pmtu on raw IP route and increase its genid.
 112       dst_check() will see this for top level and trigger resyncing
 113       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
 114  */
 115
 116 struct xfrm_state_walk {
 117         struct list_head        all;
 118         u8                      state;
 119         union {
 120                 u8              dying;
 121                 u8              proto;
 122         };
 123         u32                     seq;
 124 };
 125
 126 /* Full description of state of transformer. */
 127 struct xfrm_state {
 128 #ifdef CONFIG_NET_NS
 129         struct net              *xs_net;
 130 #endif
 131         union {
 132                 struct hlist_node       gclist;
 133                 struct hlist_node       bydst;
 134         };
 135         struct hlist_node       bysrc;
 136         struct hlist_node       byspi;
 137
 138         atomic_t                refcnt;
 139         spinlock_t              lock;
 140
 141         struct xfrm_id          id;
 142         struct xfrm_selector    sel;
 143
 144         u32                     genid;
 145
 146         /* Key manager bits */
 147         struct xfrm_state_walk  km;
 148
 149         /* Parameters of this state. */
 150         struct {
 151                 u32             reqid;
 152                 u8              mode;
 153                 u8              replay_window;
 154                 u8              aalgo, ealgo, calgo;
 155                 u8              flags;
 156                 u16             family;
 157                 xfrm_address_t  saddr;
 158                 int             header_len;
 159                 int             trailer_len;
 160         } props;
 161
 162         struct xfrm_lifetime_cfg lft;
 163
 164         /* Data for transformer */
 165         struct xfrm_algo_auth   *aalg;
 166         struct xfrm_algo        *ealg;
 167         struct xfrm_algo        *calg;
 168         struct xfrm_algo_aead   *aead;
 169
 170         /* Data for encapsulator */
 171         struct xfrm_encap_tmpl  *encap;
 172
 173         /* Data for care-of address */
 174         xfrm_address_t  *coaddr;
 175
 176         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
 177         struct xfrm_state       *tunnel;
 178
 179         /* If a tunnel, number of users + 1 */
 180         atomic_t                tunnel_users;
 181
 182         /* State for replay detection */
 183         struct xfrm_replay_state replay;
 184
 185         /* Replay detection state at the time we sent the last notification */
 186         struct xfrm_replay_state preplay;
 187
 188         /* internal flag that only holds state for delayed aevent at the
 189          * moment
 190         */
 191         u32                     xflags;
 192
 193         /* Replay detection notification settings */
 194         u32                     replay_maxage;
 195         u32                     replay_maxdiff;
 196
 197         /* Replay detection notification timer */
 198         struct timer_list       rtimer;
 199
 200         /* Statistics */
 201         struct xfrm_stats       stats;
 202
 203         struct xfrm_lifetime_cur curlft;
 204         struct tasklet_hrtimer  mtimer;
 205
 206         /* Last used time */
 207         unsigned long           lastused;
 208
 209         /* Reference to data common to all the instances of this
 210          * transformer. */
 211         const struct xfrm_type  *type;
 212         struct xfrm_mode        *inner_mode;
 213         struct xfrm_mode        *inner_mode_iaf;
 214         struct xfrm_mode        *outer_mode;
 215
 216         /* Security context */
 217         struct xfrm_sec_ctx     *security;
 218
 219         /* Private data of this transformer, format is opaque,
 220          * interpreted by xfrm_type methods. */
 221         void                    *data;
 222 };
 223
 224 static inline struct net *xs_net(struct xfrm_state *x)
 225 {
 226         return read_pnet(&x->xs_net);
 227 }
 228
 229 /* xflags - make enum if more show up */
 230 #define XFRM_TIME_DEFER 1
 231
 232 enum {
 233         XFRM_STATE_VOID,
 234         XFRM_STATE_ACQ,
 235         XFRM_STATE_VALID,
 236         XFRM_STATE_ERROR,
 237         XFRM_STATE_EXPIRED,
 238         XFRM_STATE_DEAD
 239 };
 240
 241 /* callback structure passed from either netlink or pfkey */
 242 struct km_event {
 243         union {
 244                 u32 hard;
 245                 u32 proto;
 246                 u32 byid;
 247                 u32 aevent;
 248                 u32 type;
 249         } data;
 250
 251         u32     seq;
 252         u32     pid;
 253         u32     event;
 254         struct net *net;
 255 };
 256
 257 struct net_device;
 258 struct xfrm_type;
 259 struct xfrm_dst;
 260 struct xfrm_policy_afinfo {
 261         unsigned short          family;
 262         struct dst_ops          *dst_ops;
 263         void                    (*garbage_collect)(struct net *net);
 264         struct dst_entry        *(*dst_lookup)(struct net *net, int tos,
 265                                                xfrm_address_t *saddr,
 266                                                xfrm_address_t *daddr);
 267         int                     (*get_saddr)(struct net *net, xfrm_address_t *saddr, xfrm_address_t *daddr);
 268         struct dst_entry        *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
 269         void                    (*decode_session)(struct sk_buff *skb,
 270                                                   struct flowi *fl,
 271                                                   int reverse);
 272         int                     (*get_tos)(struct flowi *fl);
 273         int                     (*init_path)(struct xfrm_dst *path,
 274                                              struct dst_entry *dst,
 275                                              int nfheader_len);
 276         int                     (*fill_dst)(struct xfrm_dst *xdst,
 277                                             struct net_device *dev,
 278                                             struct flowi *fl);
 279 };
 280
 281 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 282 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 283 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 284 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
 285
 286 struct xfrm_tmpl;
 287 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 288 extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 289 extern int __xfrm_state_delete(struct xfrm_state *x);
 290
 291 struct xfrm_state_afinfo {
 292         unsigned int            family;
 293         unsigned int            proto;
 294         __be16                  eth_proto;
 295         struct module           *owner;
 296         const struct xfrm_type  *type_map[IPPROTO_MAX];
 297         struct xfrm_mode        *mode_map[XFRM_MODE_MAX];
 298         int                     (*init_flags)(struct xfrm_state *x);
 299         void                    (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
 300                                                 struct xfrm_tmpl *tmpl,
 301                                                 xfrm_address_t *daddr, xfrm_address_t *saddr);
 302         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
 303         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
 304         int                     (*output)(struct sk_buff *skb);
 305         int                     (*extract_input)(struct xfrm_state *x,
 306                                                  struct sk_buff *skb);
 307         int                     (*extract_output)(struct xfrm_state *x,
 308                                                   struct sk_buff *skb);
 309         int                     (*transport_finish)(struct sk_buff *skb,
 310                                                     int async);
 311 };
 312
 313 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 314 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 315
 316 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 317
 318 struct xfrm_type {
 319         char                    *description;
 320         struct module           *owner;
 321         __u8                    proto;
 322         __u8                    flags;
 323 #define XFRM_TYPE_NON_FRAGMENT  1
 324 #define XFRM_TYPE_REPLAY_PROT   2
 325 #define XFRM_TYPE_LOCAL_COADDR  4
 326 #define XFRM_TYPE_REMOTE_COADDR 8
 327
 328         int                     (*init_state)(struct xfrm_state *x);
 329         void                    (*destructor)(struct xfrm_state *);
 330         int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
 331         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
 332         int                     (*reject)(struct xfrm_state *, struct sk_buff *, struct flowi *);
 333         int                     (*hdr_offset)(struct xfrm_state *, struct sk_buff *, u8 **);
 334         /* Estimate maximal size of result of transformation of a dgram */
 335         u32                     (*get_mtu)(struct xfrm_state *, int size);
 336 };
 337
 338 extern int xfrm_register_type(const struct xfrm_type *type, unsigned short family);
 339 extern int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family);
 340
 341 struct xfrm_mode {
 342         /*
 343          * Remove encapsulation header.
 344          *
 345          * The IP header will be moved over the top of the encapsulation
 346          * header.
 347          *
 348          * On entry, the transport header shall point to where the IP header
 349          * should be and the network header shall be set to where the IP
 350          * header currently is.  skb->data shall point to the start of the
 351          * payload.
 352          */
 353         int (*input2)(struct xfrm_state *x, struct sk_buff *skb);
 354
 355         /*
 356          * This is the actual input entry point.
 357          *
 358          * For transport mode and equivalent this would be identical to
 359          * input2 (which does not need to be set).  While tunnel mode
 360          * and equivalent would set this to the tunnel encapsulation function
 361          * xfrm4_prepare_input that would in turn call input2.
 362          */
 363         int (*input)(struct xfrm_state *x, struct sk_buff *skb);
 364
 365         /*
 366          * Add encapsulation header.
 367          *
 368          * On exit, the transport header will be set to the start of the
 369          * encapsulation header to be filled in by x->type->output and
 370          * the mac header will be set to the nextheader (protocol for
 371          * IPv4) field of the extension header directly preceding the
 372          * encapsulation header, or in its absence, that of the top IP
 373          * header.  The value of the network header will always point
 374          * to the top IP header while skb->data will point to the payload.
 375          */
 376         int (*output2)(struct xfrm_state *x,struct sk_buff *skb);
 377
 378         /*
 379          * This is the actual output entry point.
 380          *
 381          * For transport mode and equivalent this would be identical to
 382          * output2 (which does not need to be set).  While tunnel mode
 383          * and equivalent would set this to a tunnel encapsulation function
 384          * (xfrm4_prepare_output or xfrm6_prepare_output) that would in turn
 385          * call output2.
 386          */
 387         int (*output)(struct xfrm_state *x, struct sk_buff *skb);
 388
 389         struct xfrm_state_afinfo *afinfo;
 390         struct module *owner;
 391         unsigned int encap;
 392         int flags;
 393 };
 394
 395 /* Flags for xfrm_mode. */
 396 enum {
 397         XFRM_MODE_FLAG_TUNNEL = 1,
 398 };
 399
 400 extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
 401 extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
 402
 403 static inline int xfrm_af2proto(unsigned int family)
 404 {
 405         switch(family) {
 406         case AF_INET:
 407                 return IPPROTO_IPIP;
 408         case AF_INET6:
 409                 return IPPROTO_IPV6;
 410         default:
 411                 return 0;
 412         }
 413 }
 414
 415 static inline struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto)
 416 {
 417         if ((ipproto == IPPROTO_IPIP && x->props.family == AF_INET) ||
 418             (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6))
 419                 return x->inner_mode;
 420         else
 421                 return x->inner_mode_iaf;
 422 }
 423
 424 struct xfrm_tmpl {
 425 /* id in template is interpreted as:
 426  * daddr - destination of tunnel, may be zero for transport mode.
 427  * spi   - zero to acquire spi. Not zero if spi is static, then
 428  *         daddr must be fixed too.
 429  * proto - AH/ESP/IPCOMP
 430  */
 431         struct xfrm_id          id;
 432
 433 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 434         xfrm_address_t          saddr;
 435
 436         unsigned short          encap_family;
 437
 438         __u32                   reqid;
 439
 440 /* Mode: transport, tunnel etc. */
 441         __u8                    mode;
 442
 443 /* Sharing mode: unique, this session only, this user only etc. */
 444         __u8                    share;
 445
 446 /* May skip this transfomration if no SA is found */
 447         __u8                    optional;
 448
 449 /* Skip aalgos/ealgos/calgos checks. */
 450         __u8                    allalgs;
 451
 452 /* Bit mask of algos allowed for acquisition */
 453         __u32                   aalgos;
 454         __u32                   ealgos;
 455         __u32                   calgos;
 456 };
 457
 458 #define XFRM_MAX_DEPTH          6
 459
 460 struct xfrm_policy_walk_entry {
 461         struct list_head        all;
 462         u8                      dead;
 463 };
 464
 465 struct xfrm_policy_walk {
 466         struct xfrm_policy_walk_entry walk;
 467         u8 type;
 468         u32 seq;
 469 };
 470
 471 struct xfrm_policy {
 472 #ifdef CONFIG_NET_NS
 473         struct net              *xp_net;
 474 #endif
 475         struct hlist_node       bydst;
 476         struct hlist_node       byidx;
 477
 478         /* This lock only affects elements except for entry. */
 479         rwlock_t                lock;
 480         atomic_t                refcnt;
 481         struct timer_list       timer;
 482
 483         u32                     priority;
 484         u32                     index;
 485         struct xfrm_selector    selector;
 486         struct xfrm_lifetime_cfg lft;
 487         struct xfrm_lifetime_cur curlft;
 488         struct dst_entry       *bundles;
 489         struct xfrm_policy_walk_entry walk;
 490         u8                      type;
 491         u8                      action;
 492         u8                      flags;
 493         u8                      xfrm_nr;
 494         u16                     family;
 495         struct xfrm_sec_ctx     *security;
 496         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 497 };
 498
 499 static inline struct net *xp_net(struct xfrm_policy *xp)
 500 {
 501         return read_pnet(&xp->xp_net);
 502 }
 503
 504 struct xfrm_kmaddress {
 505         xfrm_address_t          local;
 506         xfrm_address_t          remote;
 507         u32                     reserved;
 508         u16                     family;
 509 };
 510
 511 struct xfrm_migrate {
 512         xfrm_address_t          old_daddr;
 513         xfrm_address_t          old_saddr;
 514         xfrm_address_t          new_daddr;
 515         xfrm_address_t          new_saddr;
 516         u8                      proto;
 517         u8                      mode;
 518         u16                     reserved;
 519         u32                     reqid;
 520         u16                     old_family;
 521         u16                     new_family;
 522 };
 523
 524 #define XFRM_KM_TIMEOUT                30
 525 /* which seqno */
 526 #define XFRM_REPLAY_SEQ         1
 527 #define XFRM_REPLAY_OSEQ        2
 528 #define XFRM_REPLAY_SEQ_MASK    3
 529 /* what happened */
 530 #define XFRM_REPLAY_UPDATE      XFRM_AE_CR
 531 #define XFRM_REPLAY_TIMEOUT     XFRM_AE_CE
 532
 533 /* default aevent timeout in units of 100ms */
 534 #define XFRM_AE_ETIME                   10
 535 /* Async Event timer multiplier */
 536 #define XFRM_AE_ETH_M                   10
 537 /* default seq threshold size */
 538 #define XFRM_AE_SEQT_SIZE               2
 539
 540 struct xfrm_mgr {
 541         struct list_head        list;
 542         char                    *id;
 543         int                     (*notify)(struct xfrm_state *x, struct km_event *c);
 544         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
 545         struct xfrm_policy      *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir);
 546         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
 547         int                     (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
 548         int                     (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
 549         int                     (*migrate)(struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, struct xfrm_kmaddress *k);
 550 };
 551
 552 extern int xfrm_register_km(struct xfrm_mgr *km);
 553 extern int xfrm_unregister_km(struct xfrm_mgr *km);
 554
 555 /*
 556  * This structure is used for the duration where packets are being
 557  * transformed by IPsec.  As soon as the packet leaves IPsec the
 558  * area beyond the generic IP part may be overwritten.
 559  */
 560 struct xfrm_skb_cb {
 561         union {
 562                 struct inet_skb_parm h4;
 563                 struct inet6_skb_parm h6;
 564         } header;
 565
 566         /* Sequence number for replay protection. */
 567         union {
 568                 u64 output;
 569                 __be32 input;
 570         } seq;
 571 };
 572
 573 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0]))
 574
 575 /*
 576  * This structure is used by the afinfo prepare_input/prepare_output functions
 577  * to transmit header information to the mode input/output functions.
 578  */
 579 struct xfrm_mode_skb_cb {
 580         union {
 581                 struct inet_skb_parm h4;
 582                 struct inet6_skb_parm h6;
 583         } header;
 584
 585         /* Copied from header for IPv4, always set to zero and DF for IPv6. */
 586         __be16 id;
 587         __be16 frag_off;
 588
 589         /* IP header length (excluding options or extension headers). */
 590         u8 ihl;
 591
 592         /* TOS for IPv4, class for IPv6. */
 593         u8 tos;
 594
 595         /* TTL for IPv4, hop limitfor IPv6. */
 596         u8 ttl;
 597
 598         /* Protocol for IPv4, NH for IPv6. */
 599         u8 protocol;
 600
 601         /* Option length for IPv4, zero for IPv6. */
 602         u8 optlen;
 603
 604         /* Used by IPv6 only, zero for IPv4. */
 605         u8 flow_lbl[3];
 606 };
 607
 608 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0]))
 609
 610 /*
 611  * This structure is used by the input processing to locate the SPI and
 612  * related information.
 613  */
 614 struct xfrm_spi_skb_cb {
 615         union {
 616                 struct inet_skb_parm h4;
 617                 struct inet6_skb_parm h6;
 618         } header;
 619
 620         unsigned int daddroff;
 621         unsigned int family;
 622 };
 623
 624 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
 625
 626 /* Audit Information */
 627 struct xfrm_audit {
 628         u32     secid;
 629         uid_t   loginuid;
 630         u32     sessionid;
 631 };
 632
 633 #ifdef CONFIG_AUDITSYSCALL
 634 static inline struct audit_buffer *xfrm_audit_start(const char *op)
 635 {
 636         struct audit_buffer *audit_buf = NULL;
 637
 638         if (audit_enabled == 0)
 639                 return NULL;
 640         audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC,
 641                                     AUDIT_MAC_IPSEC_EVENT);
 642         if (audit_buf == NULL)
 643                 return NULL;
 644         audit_log_format(audit_buf, "op=%s", op);
 645         return audit_buf;
 646 }
 647
 648 static inline void xfrm_audit_helper_usrinfo(uid_t auid, u32 ses, u32 secid,
 649                                              struct audit_buffer *audit_buf)
 650 {
 651         char *secctx;
 652         u32 secctx_len;
 653
 654         audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
 655         if (secid != 0 &&
 656             security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
 657                 audit_log_format(audit_buf, " subj=%s", secctx);
 658                 security_release_secctx(secctx, secctx_len);
 659         } else
 660                 audit_log_task_context(audit_buf);
 661 }
 662
 663 extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 664                                   u32 auid, u32 ses, u32 secid);
 665 extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 666                                   u32 auid, u32 ses, u32 secid);
 667 extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
 668                                  u32 auid, u32 ses, u32 secid);
 669 extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 670                                     u32 auid, u32 ses, u32 secid);
 671 extern void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 672                                              struct sk_buff *skb);
 673 extern void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family);
 674 extern void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 675                                       __be32 net_spi, __be32 net_seq);
 676 extern void xfrm_audit_state_icvfail(struct xfrm_state *x,
 677                                      struct sk_buff *skb, u8 proto);
 678 #else
 679
 680 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
 681                                   u32 auid, u32 ses, u32 secid)
 682 {
 683 }
 684
 685 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
 686                                   u32 auid, u32 ses, u32 secid)
 687 {
 688 }
 689
 690 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
 691                                  u32 auid, u32 ses, u32 secid)
 692 {
 693 }
 694
 695 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
 696                                     u32 auid, u32 ses, u32 secid)
 697 {
 698 }
 699
 700 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
 701                                              struct sk_buff *skb)
 702 {
 703 }
 704
 705 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb,
 706                                       u16 family)
 707 {
 708 }
 709
 710 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family,
 711                                       __be32 net_spi, __be32 net_seq)
 712 {
 713 }
 714
 715 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x,
 716                                      struct sk_buff *skb, u8 proto)
 717 {
 718 }
 719 #endif /* CONFIG_AUDITSYSCALL */
 720
 721 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 722 {
 723         if (likely(policy != NULL))
 724                 atomic_inc(&policy->refcnt);
 725 }
 726
 727 extern void xfrm_policy_destroy(struct xfrm_policy *policy);
 728
 729 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 730 {
 731         if (atomic_dec_and_test(&policy->refcnt))
 732                 xfrm_policy_destroy(policy);
 733 }
 734
 735 #ifdef CONFIG_XFRM_SUB_POLICY
 736 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 737 {
 738         int i;
 739         for (i = npols - 1; i >= 0; --i)
 740                 xfrm_pol_put(pols[i]);
 741 }
 742 #else
 743 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 744 {
 745         xfrm_pol_put(pols[0]);
 746 }
 747 #endif
 748
 749 extern void __xfrm_state_destroy(struct xfrm_state *);
 750
 751 static inline void __xfrm_state_put(struct xfrm_state *x)
 752 {
 753         atomic_dec(&x->refcnt);
 754 }
 755
 756 static inline void xfrm_state_put(struct xfrm_state *x)
 757 {
 758         if (atomic_dec_and_test(&x->refcnt))
 759                 __xfrm_state_destroy(x);
 760 }
 761
 762 static inline void xfrm_state_hold(struct xfrm_state *x)
 763 {
 764         atomic_inc(&x->refcnt);
 765 }
 766
 767 static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
 768 {
 769         __be32 *a1 = token1;
 770         __be32 *a2 = token2;
 771         int pdw;
 772         int pbi;
 773
 774         pdw = prefixlen >> 5;     /* num of whole __u32 in prefix */
 775         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 776
 777         if (pdw)
 778                 if (memcmp(a1, a2, pdw << 2))
 779                         return 0;
 780
 781         if (pbi) {
 782                 __be32 mask;
 783
 784                 mask = htonl((0xffffffff) << (32 - pbi));
 785
 786                 if ((a1[pdw] ^ a2[pdw]) & mask)
 787                         return 0;
 788         }
 789
 790         return 1;
 791 }
 792
 793 static __inline__
 794 __be16 xfrm_flowi_sport(struct flowi *fl)
 795 {
 796         __be16 port;
 797         switch(fl->proto) {
 798         case IPPROTO_TCP:
 799         case IPPROTO_UDP:
 800         case IPPROTO_UDPLITE:
 801         case IPPROTO_SCTP:
 802                 port = fl->fl_ip_sport;
 803                 break;
 804         case IPPROTO_ICMP:
 805         case IPPROTO_ICMPV6:
 806                 port = htons(fl->fl_icmp_type);
 807                 break;
 808         case IPPROTO_MH:
 809                 port = htons(fl->fl_mh_type);
 810                 break;
 811         default:
 812                 port = 0;       /*XXX*/
 813         }
 814         return port;
 815 }
 816
 817 static __inline__
 818 __be16 xfrm_flowi_dport(struct flowi *fl)
 819 {
 820         __be16 port;
 821         switch(fl->proto) {
 822         case IPPROTO_TCP:
 823         case IPPROTO_UDP:
 824         case IPPROTO_UDPLITE:
 825         case IPPROTO_SCTP:
 826                 port = fl->fl_ip_dport;
 827                 break;
 828         case IPPROTO_ICMP:
 829         case IPPROTO_ICMPV6:
 830                 port = htons(fl->fl_icmp_code);
 831                 break;
 832         default:
 833                 port = 0;       /*XXX*/
 834         }
 835         return port;
 836 }
 837
 838 extern int xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
 839                                unsigned short family);
 840
 841 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 842 /*      If neither has a context --> match
 843  *      Otherwise, both must have a context and the sids, doi, alg must match
 844  */
 845 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 846 {
 847         return ((!s1 && !s2) ||
 848                 (s1 && s2 &&
 849                  (s1->ctx_sid == s2->ctx_sid) &&
 850                  (s1->ctx_doi == s2->ctx_doi) &&
 851                  (s1->ctx_alg == s2->ctx_alg)));
 852 }
 853 #else
 854 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 855 {
 856         return 1;
 857 }
 858 #endif
 859
 860 /* A struct encoding bundle of transformations to apply to some set of flow.
 861  *
 862  * dst->child points to the next element of bundle.
 863  * dst->xfrm  points to an instanse of transformer.
 864  *
 865  * Due to unfortunate limitations of current routing cache, which we
 866  * have no time to fix, it mirrors struct rtable and bound to the same
 867  * routing key, including saddr,daddr. However, we can have many of
 868  * bundles differing by session id. All the bundles grow from a parent
 869  * policy rule.
 870  */
 871 struct xfrm_dst {
 872         union {
 873                 struct dst_entry        dst;
 874                 struct rtable           rt;
 875                 struct rt6_info         rt6;
 876         } u;
 877         struct dst_entry *route;
 878 #ifdef CONFIG_XFRM_SUB_POLICY
 879         struct flowi *origin;
 880         struct xfrm_selector *partner;
 881 #endif
 882         u32 genid;
 883         u32 route_mtu_cached;
 884         u32 child_mtu_cached;
 885         u32 route_cookie;
 886         u32 path_cookie;
 887 };
 888
 889 #ifdef CONFIG_XFRM
 890 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 891 {
 892         dst_release(xdst->route);
 893         if (likely(xdst->u.dst.xfrm))
 894                 xfrm_state_put(xdst->u.dst.xfrm);
 895 #ifdef CONFIG_XFRM_SUB_POLICY
 896         kfree(xdst->origin);
 897         xdst->origin = NULL;
 898         kfree(xdst->partner);
 899         xdst->partner = NULL;
 900 #endif
 901 }
 902 #endif
 903
 904 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 905
 906 struct sec_path {
 907         atomic_t                refcnt;
 908         int                     len;
 909         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 910 };
 911
 912 static inline struct sec_path *
 913 secpath_get(struct sec_path *sp)
 914 {
 915         if (sp)
 916                 atomic_inc(&sp->refcnt);
 917         return sp;
 918 }
 919
 920 extern void __secpath_destroy(struct sec_path *sp);
 921
 922 static inline void
 923 secpath_put(struct sec_path *sp)
 924 {
 925         if (sp && atomic_dec_and_test(&sp->refcnt))
 926                 __secpath_destroy(sp);
 927 }
 928
 929 extern struct sec_path *secpath_dup(struct sec_path *src);
 930
 931 static inline void
 932 secpath_reset(struct sk_buff *skb)
 933 {
 934 #ifdef CONFIG_XFRM
 935         secpath_put(skb->sp);
 936         skb->sp = NULL;
 937 #endif
 938 }
 939
 940 static inline int
 941 xfrm_addr_any(xfrm_address_t *addr, unsigned short family)
 942 {
 943         switch (family) {
 944         case AF_INET:
 945                 return addr->a4 == 0;
 946         case AF_INET6:
 947                 return ipv6_addr_any((struct in6_addr *)&addr->a6);
 948         }
 949         return 0;
 950 }
 951
 952 static inline int
 953 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 954 {
 955         return  (tmpl->saddr.a4 &&
 956                  tmpl->saddr.a4 != x->props.saddr.a4);
 957 }
 958
 959 static inline int
 960 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 961 {
 962         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
 963                  ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
 964 }
 965
 966 static inline int
 967 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
 968 {
 969         switch (family) {
 970         case AF_INET:
 971                 return __xfrm4_state_addr_cmp(tmpl, x);
 972         case AF_INET6:
 973                 return __xfrm6_state_addr_cmp(tmpl, x);
 974         }
 975         return !0;
 976 }
 977
 978 #ifdef CONFIG_XFRM
 979 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
 980
 981 static inline int __xfrm_policy_check2(struct sock *sk, int dir,
 982                                        struct sk_buff *skb,
 983                                        unsigned int family, int reverse)
 984 {
 985         struct net *net = dev_net(skb->dev);
 986         int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0);
 987
 988         if (sk && sk->sk_policy[XFRM_POLICY_IN])
 989                 return __xfrm_policy_check(sk, ndir, skb, family);
 990
 991         return  (!net->xfrm.policy_count[dir] && !skb->sp) ||
 992                 (skb_dst(skb)->flags & DST_NOPOLICY) ||
 993                 __xfrm_policy_check(sk, ndir, skb, family);
 994 }
 995
 996 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 997 {
 998         return __xfrm_policy_check2(sk, dir, skb, family, 0);
 999 }
1000
1001 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1002 {
1003         return xfrm_policy_check(sk, dir, skb, AF_INET);
1004 }
1005
1006 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1007 {
1008         return xfrm_policy_check(sk, dir, skb, AF_INET6);
1009 }
1010
1011 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1012                                              struct sk_buff *skb)
1013 {
1014         return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1);
1015 }
1016
1017 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1018                                              struct sk_buff *skb)
1019 {
1020         return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1);
1021 }
1022
1023 extern int __xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1024                                  unsigned int family, int reverse);
1025
1026 static inline int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl,
1027                                       unsigned int family)
1028 {
1029         return __xfrm_decode_session(skb, fl, family, 0);
1030 }
1031
1032 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1033                                               struct flowi *fl,
1034                                               unsigned int family)
1035 {
1036         return __xfrm_decode_session(skb, fl, family, 1);
1037 }
1038
1039 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
1040
1041 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
1042 {
1043         struct net *net = dev_net(skb->dev);
1044
1045         return  !net->xfrm.policy_count[XFRM_POLICY_OUT] ||
1046                 (skb_dst(skb)->flags & DST_NOXFRM) ||
1047                 __xfrm_route_forward(skb, family);
1048 }
1049
1050 static inline int xfrm4_route_forward(struct sk_buff *skb)
1051 {
1052         return xfrm_route_forward(skb, AF_INET);
1053 }
1054
1055 static inline int xfrm6_route_forward(struct sk_buff *skb)
1056 {
1057         return xfrm_route_forward(skb, AF_INET6);
1058 }
1059
1060 extern int __xfrm_sk_clone_policy(struct sock *sk);
1061
1062 static inline int xfrm_sk_clone_policy(struct sock *sk)
1063 {
1064         if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
1065                 return __xfrm_sk_clone_policy(sk);
1066         return 0;
1067 }
1068
1069 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
1070
1071 static inline void xfrm_sk_free_policy(struct sock *sk)
1072 {
1073         if (unlikely(sk->sk_policy[0] != NULL)) {
1074                 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
1075                 sk->sk_policy[0] = NULL;
1076         }
1077         if (unlikely(sk->sk_policy[1] != NULL)) {
1078                 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
1079                 sk->sk_policy[1] = NULL;
1080         }
1081 }
1082
1083 #else
1084
1085 static inline void xfrm_sk_free_policy(struct sock *sk) {}
1086 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
1087 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
1088 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
1089 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1090 {
1091         return 1;
1092 }
1093 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
1094 {
1095         return 1;
1096 }
1097 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
1098 {
1099         return 1;
1100 }
1101 static inline int xfrm_decode_session_reverse(struct sk_buff *skb,
1102                                               struct flowi *fl,
1103                                               unsigned int family)
1104 {
1105         return -ENOSYS;
1106 }
1107 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir,
1108                                              struct sk_buff *skb)
1109 {
1110         return 1;
1111 }
1112 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
1113                                              struct sk_buff *skb)
1114 {
1115         return 1;
1116 }
1117 #endif
1118
1119 static __inline__
1120 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
1121 {
1122         switch (family){
1123         case AF_INET:
1124                 return (xfrm_address_t *)&fl->fl4_dst;
1125         case AF_INET6:
1126                 return (xfrm_address_t *)&fl->fl6_dst;
1127         }
1128         return NULL;
1129 }
1130
1131 static __inline__
1132 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
1133 {
1134         switch (family){
1135         case AF_INET:
1136                 return (xfrm_address_t *)&fl->fl4_src;
1137         case AF_INET6:
1138                 return (xfrm_address_t *)&fl->fl6_src;
1139         }
1140         return NULL;
1141 }
1142
1143 static __inline__
1144 void xfrm_flowi_addr_get(struct flowi *fl,
1145                          xfrm_address_t *saddr, xfrm_address_t *daddr,
1146                          unsigned short family)
1147 {
1148         switch(family) {
1149         case AF_INET:
1150                 memcpy(&saddr->a4, &fl->fl4_src, sizeof(saddr->a4));
1151                 memcpy(&daddr->a4, &fl->fl4_dst, sizeof(daddr->a4));
1152                 break;
1153         case AF_INET6:
1154                 ipv6_addr_copy((struct in6_addr *)&saddr->a6, &fl->fl6_src);
1155                 ipv6_addr_copy((struct in6_addr *)&daddr->a6, &fl->fl6_dst);
1156                 break;
1157         }
1158 }
1159
1160 static __inline__ int
1161 __xfrm4_state_addr_check(struct xfrm_state *x,
1162                          xfrm_address_t *daddr, xfrm_address_t *saddr)
1163 {
1164         if (daddr->a4 == x->id.daddr.a4 &&
1165             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
1166                 return 1;
1167         return 0;
1168 }
1169
1170 static __inline__ int
1171 __xfrm6_state_addr_check(struct xfrm_state *x,
1172                          xfrm_address_t *daddr, xfrm_address_t *saddr)
1173 {
1174         if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
1175             (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
1176              ipv6_addr_any((struct in6_addr *)saddr) ||
1177              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
1178                 return 1;
1179         return 0;
1180 }
1181
1182 static __inline__ int
1183 xfrm_state_addr_check(struct xfrm_state *x,
1184                       xfrm_address_t *daddr, xfrm_address_t *saddr,
1185                       unsigned short family)
1186 {
1187         switch (family) {
1188         case AF_INET:
1189                 return __xfrm4_state_addr_check(x, daddr, saddr);
1190         case AF_INET6:
1191                 return __xfrm6_state_addr_check(x, daddr, saddr);
1192         }
1193         return 0;
1194 }
1195
1196 static __inline__ int
1197 xfrm_state_addr_flow_check(struct xfrm_state *x, struct flowi *fl,
1198                            unsigned short family)
1199 {
1200         switch (family) {
1201         case AF_INET:
1202                 return __xfrm4_state_addr_check(x,
1203                                                 (xfrm_address_t *)&fl->fl4_dst,
1204                                                 (xfrm_address_t *)&fl->fl4_src);
1205         case AF_INET6:
1206                 return __xfrm6_state_addr_check(x,
1207                                                 (xfrm_address_t *)&fl->fl6_dst,
1208                                                 (xfrm_address_t *)&fl->fl6_src);
1209         }
1210         return 0;
1211 }
1212
1213 static inline int xfrm_state_kern(struct xfrm_state *x)
1214 {
1215         return atomic_read(&x->tunnel_users);
1216 }
1217
1218 static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
1219 {
1220         return (!userproto || proto == userproto ||
1221                 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH ||
1222                                                   proto == IPPROTO_ESP ||
1223                                                   proto == IPPROTO_COMP)));
1224 }
1225
1226 /*
1227  * xfrm algorithm information
1228  */
1229 struct xfrm_algo_aead_info {
1230         u16 icv_truncbits;
1231 };
1232
1233 struct xfrm_algo_auth_info {
1234         u16 icv_truncbits;
1235         u16 icv_fullbits;
1236 };
1237
1238 struct xfrm_algo_encr_info {
1239         u16 blockbits;
1240         u16 defkeybits;
1241 };
1242
1243 struct xfrm_algo_comp_info {
1244         u16 threshold;
1245 };
1246
1247 struct xfrm_algo_desc {
1248         char *name;
1249         char *compat;
1250         u8 available:1;
1251         union {
1252                 struct xfrm_algo_aead_info aead;
1253                 struct xfrm_algo_auth_info auth;
1254                 struct xfrm_algo_encr_info encr;
1255                 struct xfrm_algo_comp_info comp;
1256         } uinfo;
1257         struct sadb_alg desc;
1258 };
1259
1260 /* XFRM tunnel handlers.  */
1261 struct xfrm_tunnel {
1262         int (*handler)(struct sk_buff *skb);
1263         int (*err_handler)(struct sk_buff *skb, __u32 info);
1264
1265         struct xfrm_tunnel *next;
1266         int priority;
1267 };
1268
1269 struct xfrm6_tunnel {
1270         int (*handler)(struct sk_buff *skb);
1271         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
1272                            u8 type, u8 code, int offset, __be32 info);
1273         struct xfrm6_tunnel *next;
1274         int priority;
1275 };
1276
1277 extern void xfrm_init(void);
1278 extern void xfrm4_init(int rt_hash_size);
1279 extern int xfrm_state_init(struct net *net);
1280 extern void xfrm_state_fini(struct net *net);
1281 extern void xfrm4_state_init(void);
1282 #ifdef CONFIG_XFRM
1283 extern int xfrm6_init(void);
1284 extern void xfrm6_fini(void);
1285 extern int xfrm6_state_init(void);
1286 extern void xfrm6_state_fini(void);
1287 #else
1288 static inline int xfrm6_init(void)
1289 {
1290         return 0;
1291 }
1292 static inline void xfrm6_fini(void)
1293 {
1294         ;
1295 }
1296 #endif
1297
1298 #ifdef CONFIG_XFRM_STATISTICS
1299 extern int xfrm_proc_init(struct net *net);
1300 extern void xfrm_proc_fini(struct net *net);
1301 #endif
1302
1303 extern int xfrm_sysctl_init(struct net *net);
1304 #ifdef CONFIG_SYSCTL
1305 extern void xfrm_sysctl_fini(struct net *net);
1306 #else
1307 static inline void xfrm_sysctl_fini(struct net *net)
1308 {
1309 }
1310 #endif
1311
1312 extern void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto);
1313 extern int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
1314                            int (*func)(struct xfrm_state *, int, void*), void *);
1315 extern void xfrm_state_walk_done(struct xfrm_state_walk *walk);
1316 extern struct xfrm_state *xfrm_state_alloc(struct net *net);
1317 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
1318                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
1319                                           struct xfrm_policy *pol, int *err,
1320                                           unsigned short family);
1321 extern struct xfrm_state * xfrm_stateonly_find(struct net *net,
1322                                                xfrm_address_t *daddr,
1323                                                xfrm_address_t *saddr,
1324                                                unsigned short family,
1325                                                u8 mode, u8 proto, u32 reqid);
1326 extern int xfrm_state_check_expire(struct xfrm_state *x);
1327 extern void xfrm_state_insert(struct xfrm_state *x);
1328 extern int xfrm_state_add(struct xfrm_state *x);
1329 extern int xfrm_state_update(struct xfrm_state *x);
1330 extern struct xfrm_state *xfrm_state_lookup(struct net *net, xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family);
1331 extern struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family);
1332 #ifdef CONFIG_XFRM_SUB_POLICY
1333 extern int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1334                           int n, unsigned short family);
1335 extern int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1336                            int n, unsigned short family);
1337 #else
1338 static inline int xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src,
1339                                  int n, unsigned short family)
1340 {
1341         return -ENOSYS;
1342 }
1343
1344 static inline int xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src,
1345                                   int n, unsigned short family)
1346 {
1347         return -ENOSYS;
1348 }
1349 #endif
1350
1351 struct xfrmk_sadinfo {
1352         u32 sadhcnt; /* current hash bkts */
1353         u32 sadhmcnt; /* max allowed hash bkts */
1354         u32 sadcnt; /* current running count */
1355 };
1356
1357 struct xfrmk_spdinfo {
1358         u32 incnt;
1359         u32 outcnt;
1360         u32 fwdcnt;
1361         u32 inscnt;
1362         u32 outscnt;
1363         u32 fwdscnt;
1364         u32 spdhcnt;
1365         u32 spdhmcnt;
1366 };
1367
1368 extern struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 seq);
1369 extern int xfrm_state_delete(struct xfrm_state *x);
1370 extern int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info);
1371 extern void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
1372 extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
1373 extern int xfrm_replay_check(struct xfrm_state *x,
1374                              struct sk_buff *skb, __be32 seq);
1375 extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
1376 extern void xfrm_replay_notify(struct xfrm_state *x, int event);
1377 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
1378 extern int xfrm_init_state(struct xfrm_state *x);
1379 extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
1380 extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
1381                       int encap_type);
1382 extern int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
1383 extern int xfrm_output_resume(struct sk_buff *skb, int err);
1384 extern int xfrm_output(struct sk_buff *skb);
1385 extern int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1386 extern int xfrm4_extract_header(struct sk_buff *skb);
1387 extern int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1388 extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
1389                            int encap_type);
1390 extern int xfrm4_transport_finish(struct sk_buff *skb, int async);
1391 extern int xfrm4_rcv(struct sk_buff *skb);
1392
1393 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
1394 {
1395         return xfrm4_rcv_encap(skb, nexthdr, spi, 0);
1396 }
1397
1398 extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1399 extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1400 extern int xfrm4_output(struct sk_buff *skb);
1401 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
1402 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
1403 extern int xfrm6_extract_header(struct sk_buff *skb);
1404 extern int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
1405 extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
1406 extern int xfrm6_transport_finish(struct sk_buff *skb, int async);
1407 extern int xfrm6_rcv(struct sk_buff *skb);
1408 extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
1409                             xfrm_address_t *saddr, u8 proto);
1410 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
1411 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family);
1412 extern __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
1413 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
1414 extern __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
1415 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
1416 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
1417 extern int xfrm6_output(struct sk_buff *skb);
1418 extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
1419                                  u8 **prevhdr);
1420
1421 #ifdef CONFIG_XFRM
1422 extern int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb);
1423 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
1424 #else
1425 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
1426 {
1427         return -ENOPROTOOPT;
1428 }
1429
1430 static inline int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
1431 {
1432         /* should not happen */
1433         kfree_skb(skb);
1434         return 0;
1435 }
1436 #endif
1437
1438 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp);
1439
1440 extern void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type);
1441 extern int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
1442         int (*func)(struct xfrm_policy *, int, int, void*), void *);
1443 extern void xfrm_policy_walk_done(struct xfrm_policy_walk *walk);
1444 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
1445 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u8 type, int dir,
1446                                           struct xfrm_selector *sel,
1447                                           struct xfrm_sec_ctx *ctx, int delete,
1448                                           int *err);
1449 struct xfrm_policy *xfrm_policy_byid(struct net *net, u8, int dir, u32 id, int delete, int *err);
1450 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info);
1451 u32 xfrm_get_acqseq(void);
1452 extern int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
1453 struct xfrm_state * xfrm_find_acq(struct net *net, u8 mode, u32 reqid, u8 proto,
1454                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
1455                                   int create, unsigned short family);
1456 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
1457 extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
1458                           struct flowi *fl, int family, int strict);
1459
1460 #ifdef CONFIG_XFRM_MIGRATE
1461 extern int km_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1462                       struct xfrm_migrate *m, int num_bundles,
1463                       struct xfrm_kmaddress *k);
1464 extern struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m);
1465 extern struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1466                                               struct xfrm_migrate *m);
1467 extern int xfrm_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
1468                         struct xfrm_migrate *m, int num_bundles,
1469                         struct xfrm_kmaddress *k);
1470 #endif
1471
1472 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
1473 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
1474 extern int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr);
1475
1476 extern void xfrm_input_init(void);
1477 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq);
1478
1479 extern void xfrm_probe_algs(void);
1480 extern int xfrm_count_auth_supported(void);
1481 extern int xfrm_count_enc_supported(void);
1482 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
1483 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
1484 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
1485 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
1486 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
1487 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
1488 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
1489 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
1490 extern struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len,
1491                                                    int probe);
1492
1493 struct hash_desc;
1494 struct scatterlist;
1495 typedef int (icv_update_fn_t)(struct hash_desc *, struct scatterlist *,
1496                               unsigned int);
1497
1498 static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
1499                                 int family)
1500 {
1501         switch (family) {
1502         default:
1503         case AF_INET:
1504                 return (__force __u32)a->a4 - (__force __u32)b->a4;
1505         case AF_INET6:
1506                 return ipv6_addr_cmp((struct in6_addr *)a,
1507                                      (struct in6_addr *)b);
1508         }
1509 }
1510
1511 static inline int xfrm_policy_id2dir(u32 index)
1512 {
1513         return index & 7;
1514 }
1515
1516 #ifdef CONFIG_XFRM
1517 static inline int xfrm_aevent_is_on(struct net *net)
1518 {
1519         struct sock *nlsk;
1520         int ret = 0;
1521
1522         rcu_read_lock();
1523         nlsk = rcu_dereference(net->xfrm.nlsk);
1524         if (nlsk)
1525                 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1526         rcu_read_unlock();
1527         return ret;
1528 }
1529 #endif
1530
1531 static inline int xfrm_alg_len(struct xfrm_algo *alg)
1532 {
1533         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1534 }
1535
1536 static inline int xfrm_alg_auth_len(struct xfrm_algo_auth *alg)
1537 {
1538         return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
1539 }
1540
1541 #ifdef CONFIG_XFRM_MIGRATE
1542 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
1543 {
1544         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
1545 }
1546
1547 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig)
1548 {
1549         return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL);
1550 }
1551
1552 static inline void xfrm_states_put(struct xfrm_state **states, int n)
1553 {
1554         int i;
1555         for (i = 0; i < n; i++)
1556                 xfrm_state_put(*(states + i));
1557 }
1558
1559 static inline void xfrm_states_delete(struct xfrm_state **states, int n)
1560 {
1561         int i;
1562         for (i = 0; i < n; i++)
1563                 xfrm_state_delete(*(states + i));
1564 }
1565 #endif
1566
1567 #ifdef CONFIG_XFRM
1568 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
1569 {
1570         return skb->sp->xvec[skb->sp->len - 1];
1571 }
1572 #endif
1573
1574 #endif  /* _NET_XFRM_H */