include/net/xfrm.h

   1 #ifndef _NET_XFRM_H
   2 #define _NET_XFRM_H
   3
   4 #include <linux/compiler.h>
   5 #include <linux/in.h>
   6 #include <linux/xfrm.h>
   7 #include <linux/spinlock.h>
   8 #include <linux/list.h>
   9 #include <linux/skbuff.h>
  10 #include <linux/socket.h>
  11 #include <linux/crypto.h>
  12 #include <linux/pfkeyv2.h>
  13 #include <linux/in6.h>
  14 #include <linux/mutex.h>
  15
  16 #include <net/sock.h>
  17 #include <net/dst.h>
  18 #include <net/route.h>
  19 #include <net/ipv6.h>
  20 #include <net/ip6_fib.h>
  21
  22 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
  23 #define MODULE_ALIAS_XFRM_MODE(family, encap) \
  24         MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap))
  25
  26 extern struct sock *xfrm_nl;
  27 extern u32 sysctl_xfrm_aevent_etime;
  28 extern u32 sysctl_xfrm_aevent_rseqth;
  29
  30 extern struct mutex xfrm_cfg_mutex;
  31
  32 /* Organization of SPD aka "XFRM rules"
  33    ------------------------------------
  34
  35    Basic objects:
  36    - policy rule, struct xfrm_policy (=SPD entry)
  37    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  38    - instance of a transformer, struct xfrm_state (=SA)
  39    - template to clone xfrm_state, struct xfrm_tmpl
  40
  41    SPD is plain linear list of xfrm_policy rules, ordered by priority.
  42    (To be compatible with existing pfkeyv2 implementations,
  43    many rules with priority of 0x7fffffff are allowed to exist and
  44    such rules are ordered in an unpredictable way, thanks to bsd folks.)
  45
  46    Lookup is plain linear search until the first match with selector.
  47
  48    If "action" is "block", then we prohibit the flow, otherwise:
  49    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  50    policy entry has list of up to XFRM_MAX_DEPTH transformations,
  51    described by templates xfrm_tmpl. Each template is resolved
  52    to a complete xfrm_state (see below) and we pack bundle of transformations
  53    to a dst_entry returned to requestor.
  54
  55    dst -. xfrm  .-> xfrm_state #1
  56     |---. child .-> dst -. xfrm .-> xfrm_state #2
  57                      |---. child .-> dst -. xfrm .-> xfrm_state #3
  58                                       |---. child .-> NULL
  59
  60    Bundles are cached at xrfm_policy struct (field ->bundles).
  61
  62
  63    Resolution of xrfm_tmpl
  64    -----------------------
  65    Template contains:
  66    1. ->mode            Mode: transport or tunnel
  67    2. ->id.proto        Protocol: AH/ESP/IPCOMP
  68    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
  69       Q: allow to resolve security gateway?
  70    4. ->id.spi          If not zero, static SPI.
  71    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
  72    6. ->algos           List of allowed algos. Plain bitmask now.
  73       Q: ealgos, aalgos, calgos. What a mess...
  74    7. ->share           Sharing mode.
  75       Q: how to implement private sharing mode? To add struct sock* to
  76       flow id?
  77
  78    Having this template we search through SAD searching for entries
  79    with appropriate mode/proto/algo, permitted by selector.
  80    If no appropriate entry found, it is requested from key manager.
  81
  82    PROBLEMS:
  83    Q: How to find all the bundles referring to a physical path for
  84       PMTU discovery? Seems, dst should contain list of all parents...
  85       and enter to infinite locking hierarchy disaster.
  86       No! It is easier, we will not search for them, let them find us.
  87       We add genid to each dst plus pointer to genid of raw IP route,
  88       pmtu disc will update pmtu on raw IP route and increase its genid.
  89       dst_check() will see this for top level and trigger resyncing
  90       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
  91  */
  92
  93 /* Full description of state of transformer. */
  94 struct xfrm_state
  95 {
  96         /* Note: bydst is re-used during gc */
  97         struct list_head        bydst;
  98         struct list_head        byspi;
  99
 100         atomic_t                refcnt;
 101         spinlock_t              lock;
 102
 103         struct xfrm_id          id;
 104         struct xfrm_selector    sel;
 105
 106         /* Key manger bits */
 107         struct {
 108                 u8              state;
 109                 u8              dying;
 110                 u32             seq;
 111         } km;
 112
 113         /* Parameters of this state. */
 114         struct {
 115                 u32             reqid;
 116                 u8              mode;
 117                 u8              replay_window;
 118                 u8              aalgo, ealgo, calgo;
 119                 u8              flags;
 120                 u16             family;
 121                 xfrm_address_t  saddr;
 122                 int             header_len;
 123                 int             trailer_len;
 124         } props;
 125
 126         struct xfrm_lifetime_cfg lft;
 127
 128         /* Data for transformer */
 129         struct xfrm_algo        *aalg;
 130         struct xfrm_algo        *ealg;
 131         struct xfrm_algo        *calg;
 132
 133         /* Data for encapsulator */
 134         struct xfrm_encap_tmpl  *encap;
 135
 136         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
 137         struct xfrm_state       *tunnel;
 138
 139         /* If a tunnel, number of users + 1 */
 140         atomic_t                tunnel_users;
 141
 142         /* State for replay detection */
 143         struct xfrm_replay_state replay;
 144
 145         /* Replay detection state at the time we sent the last notification */
 146         struct xfrm_replay_state preplay;
 147
 148         /* internal flag that only holds state for delayed aevent at the
 149          * moment
 150         */
 151         u32                     xflags;
 152
 153         /* Replay detection notification settings */
 154         u32                     replay_maxage;
 155         u32                     replay_maxdiff;
 156
 157         /* Replay detection notification timer */
 158         struct timer_list       rtimer;
 159
 160         /* Statistics */
 161         struct xfrm_stats       stats;
 162
 163         struct xfrm_lifetime_cur curlft;
 164         struct timer_list       timer;
 165
 166         /* Reference to data common to all the instances of this
 167          * transformer. */
 168         struct xfrm_type        *type;
 169         struct xfrm_mode        *mode;
 170
 171         /* Security context */
 172         struct xfrm_sec_ctx     *security;
 173
 174         /* Private data of this transformer, format is opaque,
 175          * interpreted by xfrm_type methods. */
 176         void                    *data;
 177 };
 178
 179 /* xflags - make enum if more show up */
 180 #define XFRM_TIME_DEFER 1
 181
 182 enum {
 183         XFRM_STATE_VOID,
 184         XFRM_STATE_ACQ,
 185         XFRM_STATE_VALID,
 186         XFRM_STATE_ERROR,
 187         XFRM_STATE_EXPIRED,
 188         XFRM_STATE_DEAD
 189 };
 190
 191 /* callback structure passed from either netlink or pfkey */
 192 struct km_event
 193 {
 194         union {
 195                 u32 hard;
 196                 u32 proto;
 197                 u32 byid;
 198                 u32 aevent;
 199         } data;
 200
 201         u32     seq;
 202         u32     pid;
 203         u32     event;
 204 };
 205
 206 struct xfrm_type;
 207 struct xfrm_dst;
 208 struct xfrm_policy_afinfo {
 209         unsigned short          family;
 210         struct xfrm_type        *type_map[IPPROTO_MAX];
 211         struct xfrm_mode        *mode_map[XFRM_MODE_MAX];
 212         struct dst_ops          *dst_ops;
 213         void                    (*garbage_collect)(void);
 214         int                     (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
 215         struct dst_entry        *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
 216         int                     (*bundle_create)(struct xfrm_policy *policy,
 217                                                  struct xfrm_state **xfrm,
 218                                                  int nx,
 219                                                  struct flowi *fl,
 220                                                  struct dst_entry **dst_p);
 221         void                    (*decode_session)(struct sk_buff *skb,
 222                                                   struct flowi *fl);
 223 };
 224
 225 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 226 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 227 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 228 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
 229 #define XFRM_ACQ_EXPIRES        30
 230
 231 struct xfrm_tmpl;
 232 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
 233 extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid);
 234 extern int __xfrm_state_delete(struct xfrm_state *x);
 235
 236 struct xfrm_state_afinfo {
 237         unsigned short          family;
 238         struct list_head        *state_bydst;
 239         struct list_head        *state_byspi;
 240         int                     (*init_flags)(struct xfrm_state *x);
 241         void                    (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
 242                                                 struct xfrm_tmpl *tmpl,
 243                                                 xfrm_address_t *daddr, xfrm_address_t *saddr);
 244         struct xfrm_state       *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
 245         struct xfrm_state       *(*find_acq)(u8 mode, u32 reqid, u8 proto,
 246                                              xfrm_address_t *daddr, xfrm_address_t *saddr,
 247                                              int create);
 248 };
 249
 250 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 251 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 252
 253 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 254
 255 struct xfrm_type
 256 {
 257         char                    *description;
 258         struct module           *owner;
 259         __u8                    proto;
 260
 261         int                     (*init_state)(struct xfrm_state *x);
 262         void                    (*destructor)(struct xfrm_state *);
 263         int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
 264         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
 265         /* Estimate maximal size of result of transformation of a dgram */
 266         u32                     (*get_max_size)(struct xfrm_state *, int size);
 267 };
 268
 269 extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
 270 extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
 271 extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
 272 extern void xfrm_put_type(struct xfrm_type *type);
 273
 274 struct xfrm_mode {
 275         int (*input)(struct xfrm_state *x, struct sk_buff *skb);
 276         int (*output)(struct sk_buff *skb);
 277
 278         struct module *owner;
 279         unsigned int encap;
 280 };
 281
 282 extern int xfrm_register_mode(struct xfrm_mode *mode, int family);
 283 extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family);
 284 extern struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family);
 285 extern void xfrm_put_mode(struct xfrm_mode *mode);
 286
 287 struct xfrm_tmpl
 288 {
 289 /* id in template is interpreted as:
 290  * daddr - destination of tunnel, may be zero for transport mode.
 291  * spi   - zero to acquire spi. Not zero if spi is static, then
 292  *         daddr must be fixed too.
 293  * proto - AH/ESP/IPCOMP
 294  */
 295         struct xfrm_id          id;
 296
 297 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 298         xfrm_address_t          saddr;
 299
 300         __u32                   reqid;
 301
 302 /* Mode: transport/tunnel */
 303         __u8                    mode;
 304
 305 /* Sharing mode: unique, this session only, this user only etc. */
 306         __u8                    share;
 307
 308 /* May skip this transfomration if no SA is found */
 309         __u8                    optional;
 310
 311 /* Bit mask of algos allowed for acquisition */
 312         __u32                   aalgos;
 313         __u32                   ealgos;
 314         __u32                   calgos;
 315 };
 316
 317 #define XFRM_MAX_DEPTH          4
 318
 319 struct xfrm_policy
 320 {
 321         struct xfrm_policy      *next;
 322         struct list_head        list;
 323
 324         /* This lock only affects elements except for entry. */
 325         rwlock_t                lock;
 326         atomic_t                refcnt;
 327         struct timer_list       timer;
 328
 329         u32                     priority;
 330         u32                     index;
 331         struct xfrm_selector    selector;
 332         struct xfrm_lifetime_cfg lft;
 333         struct xfrm_lifetime_cur curlft;
 334         struct dst_entry       *bundles;
 335         __u16                   family;
 336         __u8                    action;
 337         __u8                    flags;
 338         __u8                    dead;
 339         __u8                    xfrm_nr;
 340         struct xfrm_sec_ctx     *security;
 341         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 342 };
 343
 344 #define XFRM_KM_TIMEOUT                30
 345 /* which seqno */
 346 #define XFRM_REPLAY_SEQ         1
 347 #define XFRM_REPLAY_OSEQ        2
 348 #define XFRM_REPLAY_SEQ_MASK    3
 349 /* what happened */
 350 #define XFRM_REPLAY_UPDATE      XFRM_AE_CR
 351 #define XFRM_REPLAY_TIMEOUT     XFRM_AE_CE
 352
 353 /* default aevent timeout in units of 100ms */
 354 #define XFRM_AE_ETIME                   10
 355 /* Async Event timer multiplier */
 356 #define XFRM_AE_ETH_M                   10
 357 /* default seq threshold size */
 358 #define XFRM_AE_SEQT_SIZE               2
 359
 360 struct xfrm_mgr
 361 {
 362         struct list_head        list;
 363         char                    *id;
 364         int                     (*notify)(struct xfrm_state *x, struct km_event *c);
 365         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
 366         struct xfrm_policy      *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
 367         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 368         int                     (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
 369 };
 370
 371 extern int xfrm_register_km(struct xfrm_mgr *km);
 372 extern int xfrm_unregister_km(struct xfrm_mgr *km);
 373
 374
 375 extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
 376
 377 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 378 {
 379         if (likely(policy != NULL))
 380                 atomic_inc(&policy->refcnt);
 381 }
 382
 383 extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
 384
 385 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 386 {
 387         if (atomic_dec_and_test(&policy->refcnt))
 388                 __xfrm_policy_destroy(policy);
 389 }
 390
 391 #define XFRM_DST_HSIZE          1024
 392
 393 static __inline__
 394 unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
 395 {
 396         unsigned h;
 397         h = ntohl(addr->a4);
 398         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 399         return h;
 400 }
 401
 402 static __inline__
 403 unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
 404 {
 405         unsigned h;
 406         h = ntohl(addr->a6[2]^addr->a6[3]);
 407         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 408         return h;
 409 }
 410
 411 static __inline__
 412 unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
 413 {
 414         switch (family) {
 415         case AF_INET:
 416                 return __xfrm4_dst_hash(addr);
 417         case AF_INET6:
 418                 return __xfrm6_dst_hash(addr);
 419         }
 420         return 0;
 421 }
 422
 423 static __inline__
 424 unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 425 {
 426         unsigned h;
 427         h = ntohl(addr->a4^spi^proto);
 428         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 429         return h;
 430 }
 431
 432 static __inline__
 433 unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 434 {
 435         unsigned h;
 436         h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
 437         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 438         return h;
 439 }
 440
 441 static __inline__
 442 unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
 443 {
 444         switch (family) {
 445         case AF_INET:
 446                 return __xfrm4_spi_hash(addr, spi, proto);
 447         case AF_INET6:
 448                 return __xfrm6_spi_hash(addr, spi, proto);
 449         }
 450         return 0;       /*XXX*/
 451 }
 452
 453 extern void __xfrm_state_destroy(struct xfrm_state *);
 454
 455 static inline void __xfrm_state_put(struct xfrm_state *x)
 456 {
 457         atomic_dec(&x->refcnt);
 458 }
 459
 460 static inline void xfrm_state_put(struct xfrm_state *x)
 461 {
 462         if (atomic_dec_and_test(&x->refcnt))
 463                 __xfrm_state_destroy(x);
 464 }
 465
 466 static inline void xfrm_state_hold(struct xfrm_state *x)
 467 {
 468         atomic_inc(&x->refcnt);
 469 }
 470
 471 static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
 472 {
 473         __u32 *a1 = token1;
 474         __u32 *a2 = token2;
 475         int pdw;
 476         int pbi;
 477
 478         pdw = prefixlen >> 5;     /* num of whole __u32 in prefix */
 479         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 480
 481         if (pdw)
 482                 if (memcmp(a1, a2, pdw << 2))
 483                         return 0;
 484
 485         if (pbi) {
 486                 __u32 mask;
 487
 488                 mask = htonl((0xffffffff) << (32 - pbi));
 489
 490                 if ((a1[pdw] ^ a2[pdw]) & mask)
 491                         return 0;
 492         }
 493
 494         return 1;
 495 }
 496
 497 static __inline__
 498 u16 xfrm_flowi_sport(struct flowi *fl)
 499 {
 500         u16 port;
 501         switch(fl->proto) {
 502         case IPPROTO_TCP:
 503         case IPPROTO_UDP:
 504         case IPPROTO_SCTP:
 505                 port = fl->fl_ip_sport;
 506                 break;
 507         case IPPROTO_ICMP:
 508         case IPPROTO_ICMPV6:
 509                 port = htons(fl->fl_icmp_type);
 510                 break;
 511         default:
 512                 port = 0;       /*XXX*/
 513         }
 514         return port;
 515 }
 516
 517 static __inline__
 518 u16 xfrm_flowi_dport(struct flowi *fl)
 519 {
 520         u16 port;
 521         switch(fl->proto) {
 522         case IPPROTO_TCP:
 523         case IPPROTO_UDP:
 524         case IPPROTO_SCTP:
 525                 port = fl->fl_ip_dport;
 526                 break;
 527         case IPPROTO_ICMP:
 528         case IPPROTO_ICMPV6:
 529                 port = htons(fl->fl_icmp_code);
 530                 break;
 531         default:
 532                 port = 0;       /*XXX*/
 533         }
 534         return port;
 535 }
 536
 537 static inline int
 538 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 539 {
 540         return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
 541                 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
 542                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
 543                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
 544                 (fl->proto == sel->proto || !sel->proto) &&
 545                 (fl->oif == sel->ifindex || !sel->ifindex);
 546 }
 547
 548 static inline int
 549 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 550 {
 551         return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
 552                 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
 553                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
 554                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
 555                 (fl->proto == sel->proto || !sel->proto) &&
 556                 (fl->oif == sel->ifindex || !sel->ifindex);
 557 }
 558
 559 static inline int
 560 xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
 561                     unsigned short family)
 562 {
 563         switch (family) {
 564         case AF_INET:
 565                 return __xfrm4_selector_match(sel, fl);
 566         case AF_INET6:
 567                 return __xfrm6_selector_match(sel, fl);
 568         }
 569         return 0;
 570 }
 571
 572 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 573 /*      If neither has a context --> match
 574  *      Otherwise, both must have a context and the sids, doi, alg must match
 575  */
 576 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 577 {
 578         return ((!s1 && !s2) ||
 579                 (s1 && s2 &&
 580                  (s1->ctx_sid == s2->ctx_sid) &&
 581                  (s1->ctx_doi == s2->ctx_doi) &&
 582                  (s1->ctx_alg == s2->ctx_alg)));
 583 }
 584 #else
 585 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
 586 {
 587         return 1;
 588 }
 589 #endif
 590
 591 /* A struct encoding bundle of transformations to apply to some set of flow.
 592  *
 593  * dst->child points to the next element of bundle.
 594  * dst->xfrm  points to an instanse of transformer.
 595  *
 596  * Due to unfortunate limitations of current routing cache, which we
 597  * have no time to fix, it mirrors struct rtable and bound to the same
 598  * routing key, including saddr,daddr. However, we can have many of
 599  * bundles differing by session id. All the bundles grow from a parent
 600  * policy rule.
 601  */
 602 struct xfrm_dst
 603 {
 604         union {
 605                 struct xfrm_dst         *next;
 606                 struct dst_entry        dst;
 607                 struct rtable           rt;
 608                 struct rt6_info         rt6;
 609         } u;
 610         struct dst_entry *route;
 611         u32 route_mtu_cached;
 612         u32 child_mtu_cached;
 613         u32 route_cookie;
 614         u32 path_cookie;
 615 };
 616
 617 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 618 {
 619         dst_release(xdst->route);
 620         if (likely(xdst->u.dst.xfrm))
 621                 xfrm_state_put(xdst->u.dst.xfrm);
 622 }
 623
 624 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 625
 626 struct sec_path
 627 {
 628         atomic_t                refcnt;
 629         int                     len;
 630         struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 631 };
 632
 633 static inline struct sec_path *
 634 secpath_get(struct sec_path *sp)
 635 {
 636         if (sp)
 637                 atomic_inc(&sp->refcnt);
 638         return sp;
 639 }
 640
 641 extern void __secpath_destroy(struct sec_path *sp);
 642
 643 static inline void
 644 secpath_put(struct sec_path *sp)
 645 {
 646         if (sp && atomic_dec_and_test(&sp->refcnt))
 647                 __secpath_destroy(sp);
 648 }
 649
 650 extern struct sec_path *secpath_dup(struct sec_path *src);
 651
 652 static inline void
 653 secpath_reset(struct sk_buff *skb)
 654 {
 655 #ifdef CONFIG_XFRM
 656         secpath_put(skb->sp);
 657         skb->sp = NULL;
 658 #endif
 659 }
 660
 661 static inline int
 662 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 663 {
 664         return  (tmpl->saddr.a4 &&
 665                  tmpl->saddr.a4 != x->props.saddr.a4);
 666 }
 667
 668 static inline int
 669 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 670 {
 671         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
 672                  ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
 673 }
 674
 675 static inline int
 676 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
 677 {
 678         switch (family) {
 679         case AF_INET:
 680                 return __xfrm4_state_addr_cmp(tmpl, x);
 681         case AF_INET6:
 682                 return __xfrm6_state_addr_cmp(tmpl, x);
 683         }
 684         return !0;
 685 }
 686
 687 #ifdef CONFIG_XFRM
 688
 689 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
 690
 691 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 692 {
 693         if (sk && sk->sk_policy[XFRM_POLICY_IN])
 694                 return __xfrm_policy_check(sk, dir, skb, family);
 695
 696         return  (!xfrm_policy_list[dir] && !skb->sp) ||
 697                 (skb->dst->flags & DST_NOPOLICY) ||
 698                 __xfrm_policy_check(sk, dir, skb, family);
 699 }
 700
 701 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 702 {
 703         return xfrm_policy_check(sk, dir, skb, AF_INET);
 704 }
 705
 706 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 707 {
 708         return xfrm_policy_check(sk, dir, skb, AF_INET6);
 709 }
 710
 711 extern int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family);
 712 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
 713
 714 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 715 {
 716         return  !xfrm_policy_list[XFRM_POLICY_OUT] ||
 717                 (skb->dst->flags & DST_NOXFRM) ||
 718                 __xfrm_route_forward(skb, family);
 719 }
 720
 721 static inline int xfrm4_route_forward(struct sk_buff *skb)
 722 {
 723         return xfrm_route_forward(skb, AF_INET);
 724 }
 725
 726 static inline int xfrm6_route_forward(struct sk_buff *skb)
 727 {
 728         return xfrm_route_forward(skb, AF_INET6);
 729 }
 730
 731 extern int __xfrm_sk_clone_policy(struct sock *sk);
 732
 733 static inline int xfrm_sk_clone_policy(struct sock *sk)
 734 {
 735         if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
 736                 return __xfrm_sk_clone_policy(sk);
 737         return 0;
 738 }
 739
 740 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
 741
 742 static inline void xfrm_sk_free_policy(struct sock *sk)
 743 {
 744         if (unlikely(sk->sk_policy[0] != NULL)) {
 745                 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
 746                 sk->sk_policy[0] = NULL;
 747         }
 748         if (unlikely(sk->sk_policy[1] != NULL)) {
 749                 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
 750                 sk->sk_policy[1] = NULL;
 751         }
 752 }
 753
 754 #else
 755
 756 static inline void xfrm_sk_free_policy(struct sock *sk) {}
 757 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
 758 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
 759 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
 760 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 761 {
 762         return 1;
 763 }
 764 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 765 {
 766         return 1;
 767 }
 768 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 769 {
 770         return 1;
 771 }
 772 #endif
 773
 774 static __inline__
 775 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
 776 {
 777         switch (family){
 778         case AF_INET:
 779                 return (xfrm_address_t *)&fl->fl4_dst;
 780         case AF_INET6:
 781                 return (xfrm_address_t *)&fl->fl6_dst;
 782         }
 783         return NULL;
 784 }
 785
 786 static __inline__
 787 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
 788 {
 789         switch (family){
 790         case AF_INET:
 791                 return (xfrm_address_t *)&fl->fl4_src;
 792         case AF_INET6:
 793                 return (xfrm_address_t *)&fl->fl6_src;
 794         }
 795         return NULL;
 796 }
 797
 798 static __inline__ int
 799 __xfrm4_state_addr_check(struct xfrm_state *x,
 800                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 801 {
 802         if (daddr->a4 == x->id.daddr.a4 &&
 803             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
 804                 return 1;
 805         return 0;
 806 }
 807
 808 static __inline__ int
 809 __xfrm6_state_addr_check(struct xfrm_state *x,
 810                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 811 {
 812         if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
 813             (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
 814              ipv6_addr_any((struct in6_addr *)saddr) ||
 815              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
 816                 return 1;
 817         return 0;
 818 }
 819
 820 static __inline__ int
 821 xfrm_state_addr_check(struct xfrm_state *x,
 822                       xfrm_address_t *daddr, xfrm_address_t *saddr,
 823                       unsigned short family)
 824 {
 825         switch (family) {
 826         case AF_INET:
 827                 return __xfrm4_state_addr_check(x, daddr, saddr);
 828         case AF_INET6:
 829                 return __xfrm6_state_addr_check(x, daddr, saddr);
 830         }
 831         return 0;
 832 }
 833
 834 static inline int xfrm_state_kern(struct xfrm_state *x)
 835 {
 836         return atomic_read(&x->tunnel_users);
 837 }
 838
 839 /*
 840  * xfrm algorithm information
 841  */
 842 struct xfrm_algo_auth_info {
 843         u16 icv_truncbits;
 844         u16 icv_fullbits;
 845 };
 846
 847 struct xfrm_algo_encr_info {
 848         u16 blockbits;
 849         u16 defkeybits;
 850 };
 851
 852 struct xfrm_algo_comp_info {
 853         u16 threshold;
 854 };
 855
 856 struct xfrm_algo_desc {
 857         char *name;
 858         u8 available:1;
 859         union {
 860                 struct xfrm_algo_auth_info auth;
 861                 struct xfrm_algo_encr_info encr;
 862                 struct xfrm_algo_comp_info comp;
 863         } uinfo;
 864         struct sadb_alg desc;
 865 };
 866
 867 /* XFRM tunnel handlers.  */
 868 struct xfrm_tunnel {
 869         int (*handler)(struct sk_buff *skb);
 870         int (*err_handler)(struct sk_buff *skb, __u32 info);
 871
 872         struct xfrm_tunnel *next;
 873         int priority;
 874 };
 875
 876 struct xfrm6_tunnel {
 877         int (*handler)(struct sk_buff *skb);
 878         int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
 879                            int type, int code, int offset, __u32 info);
 880
 881         struct xfrm6_tunnel *next;
 882         int priority;
 883 };
 884
 885 extern void xfrm_init(void);
 886 extern void xfrm4_init(void);
 887 extern void xfrm6_init(void);
 888 extern void xfrm6_fini(void);
 889 extern void xfrm_state_init(void);
 890 extern void xfrm4_state_init(void);
 891 extern void xfrm6_state_init(void);
 892 extern void xfrm6_state_fini(void);
 893
 894 extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
 895 extern struct xfrm_state *xfrm_state_alloc(void);
 896 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 897                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
 898                                           struct xfrm_policy *pol, int *err,
 899                                           unsigned short family);
 900 extern int xfrm_state_check_expire(struct xfrm_state *x);
 901 extern void xfrm_state_insert(struct xfrm_state *x);
 902 extern int xfrm_state_add(struct xfrm_state *x);
 903 extern int xfrm_state_update(struct xfrm_state *x);
 904 extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
 905 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
 906 extern int xfrm_state_delete(struct xfrm_state *x);
 907 extern void xfrm_state_flush(u8 proto);
 908 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
 909 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
 910 extern void xfrm_replay_notify(struct xfrm_state *x, int event);
 911 extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
 912 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 913 extern int xfrm_init_state(struct xfrm_state *x);
 914 extern int xfrm4_rcv(struct sk_buff *skb);
 915 extern int xfrm4_output(struct sk_buff *skb);
 916 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 917 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
 918 extern int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi);
 919 extern int xfrm6_rcv(struct sk_buff **pskb);
 920 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
 921 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
 922 extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
 923 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
 924 extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
 925 extern int xfrm6_output(struct sk_buff *skb);
 926
 927 #ifdef CONFIG_XFRM
 928 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
 929 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
 930 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
 931 #else
 932 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 933 {
 934         return -ENOPROTOOPT;
 935 }
 936
 937 static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
 938 {
 939         /* should not happen */
 940         kfree_skb(skb);
 941         return 0;
 942 }
 943 static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
 944 {
 945         return -EINVAL;
 946 }
 947 #endif
 948
 949 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
 950 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
 951 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
 952 struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
 953                                           struct xfrm_sec_ctx *ctx, int delete);
 954 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
 955 void xfrm_policy_flush(void);
 956 u32 xfrm_get_acqseq(void);
 957 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 958 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 959                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 960                                   int create, unsigned short family);
 961 extern void xfrm_policy_flush(void);
 962 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 963 extern int xfrm_flush_bundles(void);
 964 extern void xfrm_flush_all_bundles(void);
 965 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
 966 extern void xfrm_init_pmtu(struct dst_entry *dst);
 967
 968 extern wait_queue_head_t km_waitq;
 969 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 970 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid);
 971
 972 extern void xfrm_input_init(void);
 973 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
 974
 975 extern void xfrm_probe_algs(void);
 976 extern int xfrm_count_auth_supported(void);
 977 extern int xfrm_count_enc_supported(void);
 978 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
 979 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
 980 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
 981 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
 982 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
 983 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
 984 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
 985 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
 986
 987 struct crypto_tfm;
 988 typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
 989
 990 extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
 991                          int offset, int len, icv_update_fn_t icv_update);
 992
 993 static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
 994                                 int family)
 995 {
 996         switch (family) {
 997         default:
 998         case AF_INET:
 999                 return a->a4 - b->a4;
1000         case AF_INET6:
1001                 return ipv6_addr_cmp((struct in6_addr *)a,
1002                                      (struct in6_addr *)b);
1003         }
1004 }
1005
1006 static inline int xfrm_policy_id2dir(u32 index)
1007 {
1008         return index & 7;
1009 }
1010
1011 static inline int xfrm_aevent_is_on(void)
1012 {
1013         struct sock *nlsk;
1014         int ret = 0;
1015
1016         rcu_read_lock();
1017         nlsk = rcu_dereference(xfrm_nl);
1018         if (nlsk)
1019                 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS);
1020         rcu_read_unlock();
1021         return ret;
1022 }
1023
1024 static inline void xfrm_aevent_doreplay(struct xfrm_state *x)
1025 {
1026         if (xfrm_aevent_is_on())
1027                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
1028 }
1029
1030
1031 #endif  /* _NET_XFRM_H */