include/net/xfrm.h

   1 #ifndef _NET_XFRM_H
   2 #define _NET_XFRM_H
   3
   4 #include <linux/xfrm.h>
   5 #include <linux/spinlock.h>
   6 #include <linux/list.h>
   7 #include <linux/skbuff.h>
   8 #include <linux/netdevice.h>
   9 #include <linux/crypto.h>
  10 #include <linux/pfkeyv2.h>
  11 #include <linux/in6.h>
  12 #include <linux/slab.h>
  13
  14 #include <net/sock.h>
  15 #include <net/dst.h>
  16 #include <net/route.h>
  17 #include <net/ipv6.h>
  18 #include <net/ip6_fib.h>
  19
  20 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
  21
  22 extern struct semaphore xfrm_cfg_sem;
  23
  24 /* Organization of SPD aka "XFRM rules"
  25    ------------------------------------
  26
  27    Basic objects:
  28    - policy rule, struct xfrm_policy (=SPD entry)
  29    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  30    - instance of a transformer, struct xfrm_state (=SA)
  31    - template to clone xfrm_state, struct xfrm_tmpl
  32
  33    SPD is plain linear list of xfrm_policy rules, ordered by priority.
  34    (To be compatible with existing pfkeyv2 implementations,
  35    many rules with priority of 0x7fffffff are allowed to exist and
  36    such rules are ordered in an unpredictable way, thanks to bsd folks.)
  37
  38    Lookup is plain linear search until the first match with selector.
  39
  40    If "action" is "block", then we prohibit the flow, otherwise:
  41    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  42    policy entry has list of up to XFRM_MAX_DEPTH transformations,
  43    described by templates xfrm_tmpl. Each template is resolved
  44    to a complete xfrm_state (see below) and we pack bundle of transformations
  45    to a dst_entry returned to requestor.
  46
  47    dst -. xfrm  .-> xfrm_state #1
  48     |---. child .-> dst -. xfrm .-> xfrm_state #2
  49                      |---. child .-> dst -. xfrm .-> xfrm_state #3
  50                                       |---. child .-> NULL
  51
  52    Bundles are cached at xrfm_policy struct (field ->bundles).
  53
  54
  55    Resolution of xrfm_tmpl
  56    -----------------------
  57    Template contains:
  58    1. ->mode            Mode: transport or tunnel
  59    2. ->id.proto        Protocol: AH/ESP/IPCOMP
  60    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
  61       Q: allow to resolve security gateway?
  62    4. ->id.spi          If not zero, static SPI.
  63    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
  64    6. ->algos           List of allowed algos. Plain bitmask now.
  65       Q: ealgos, aalgos, calgos. What a mess...
  66    7. ->share           Sharing mode.
  67       Q: how to implement private sharing mode? To add struct sock* to
  68       flow id?
  69
  70    Having this template we search through SAD searching for entries
  71    with appropriate mode/proto/algo, permitted by selector.
  72    If no appropriate entry found, it is requested from key manager.
  73
  74    PROBLEMS:
  75    Q: How to find all the bundles referring to a physical path for
  76       PMTU discovery? Seems, dst should contain list of all parents...
  77       and enter to infinite locking hierarchy disaster.
  78       No! It is easier, we will not search for them, let them find us.
  79       We add genid to each dst plus pointer to genid of raw IP route,
  80       pmtu disc will update pmtu on raw IP route and increase its genid.
  81       dst_check() will see this for top level and trigger resyncing
  82       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
  83  */
  84
  85 /* Full description of state of transformer. */
  86 struct xfrm_state
  87 {
  88         /* Note: bydst is re-used during gc */
  89         struct list_head        bydst;
  90         struct list_head        byspi;
  91
  92         atomic_t                refcnt;
  93         spinlock_t              lock;
  94
  95         struct xfrm_id          id;
  96         struct xfrm_selector    sel;
  97
  98         /* Key manger bits */
  99         struct {
 100                 u8              state;
 101                 u8              dying;
 102                 u32             seq;
 103         } km;
 104
 105         /* Parameters of this state. */
 106         struct {
 107                 u8              mode;
 108                 u8              replay_window;
 109                 u8              aalgo, ealgo, calgo;
 110                 u16             reqid;
 111                 u16             family;
 112                 xfrm_address_t  saddr;
 113                 int             header_len;
 114                 int             trailer_len;
 115         } props;
 116
 117         struct xfrm_lifetime_cfg lft;
 118
 119         /* Data for transformer */
 120         struct xfrm_algo        *aalg;
 121         struct xfrm_algo        *ealg;
 122         struct xfrm_algo        *calg;
 123
 124         /* Data for encapsulator */
 125         struct xfrm_encap_tmpl  *encap;
 126
 127         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
 128         struct xfrm_state       *tunnel;
 129
 130         /* If a tunnel, number of users + 1 */
 131         atomic_t                tunnel_users;
 132
 133         /* State for replay detection */
 134         struct xfrm_replay_state replay;
 135
 136         /* Statistics */
 137         struct xfrm_stats       stats;
 138
 139         struct xfrm_lifetime_cur curlft;
 140         struct timer_list       timer;
 141
 142         /* Reference to data common to all the instances of this
 143          * transformer. */
 144         struct xfrm_type        *type;
 145
 146         /* Private data of this transformer, format is opaque,
 147          * interpreted by xfrm_type methods. */
 148         void                    *data;
 149 };
 150
 151 enum {
 152         XFRM_STATE_VOID,
 153         XFRM_STATE_ACQ,
 154         XFRM_STATE_VALID,
 155         XFRM_STATE_ERROR,
 156         XFRM_STATE_EXPIRED,
 157         XFRM_STATE_DEAD
 158 };
 159
 160 struct xfrm_type;
 161 struct xfrm_dst;
 162 struct xfrm_policy_afinfo {
 163         unsigned short          family;
 164         rwlock_t                lock;
 165         struct xfrm_type_map    *type_map;
 166         struct dst_ops          *dst_ops;
 167         void                    (*garbage_collect)(void);
 168         int                     (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
 169         struct dst_entry        *(*find_bundle)(struct flowi *fl, struct rtable *rt, struct xfrm_policy *policy);
 170         int                     (*bundle_create)(struct xfrm_policy *policy,
 171                                                  struct xfrm_state **xfrm,
 172                                                  int nx,
 173                                                  struct flowi *fl,
 174                                                  struct dst_entry **dst_p);
 175         void                    (*decode_session)(struct sk_buff *skb,
 176                                                   struct flowi *fl);
 177 };
 178
 179 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 180 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 181 extern struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
 182 extern void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
 183
 184 #define XFRM_ACQ_EXPIRES        30
 185
 186 struct xfrm_tmpl;
 187 struct xfrm_state_afinfo {
 188         unsigned short          family;
 189         rwlock_t                lock;
 190         struct list_head        *state_bydst;
 191         struct list_head        *state_byspi;
 192         void                    (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
 193                                                 struct xfrm_tmpl *tmpl,
 194                                                 xfrm_address_t *daddr, xfrm_address_t *saddr);
 195         struct xfrm_state       *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
 196         struct xfrm_state       *(*find_acq)(u8 mode, u16 reqid, u8 proto,
 197                                              xfrm_address_t *daddr, xfrm_address_t *saddr,
 198                                              int create);
 199 };
 200
 201 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 202 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 203 extern struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
 204 extern void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 205
 206 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 207
 208 struct xfrm_decap_state;
 209 struct xfrm_type
 210 {
 211         char                    *description;
 212         struct module           *owner;
 213         __u8                    proto;
 214
 215         int                     (*init_state)(struct xfrm_state *x, void *args);
 216         void                    (*destructor)(struct xfrm_state *);
 217         int                     (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
 218         int                     (*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
 219         int                     (*output)(struct sk_buff *skb);
 220         /* Estimate maximal size of result of transformation of a dgram */
 221         u32                     (*get_max_size)(struct xfrm_state *, int size);
 222 };
 223
 224 struct xfrm_type_map {
 225         rwlock_t                lock;
 226         struct xfrm_type        *map[256];
 227 };
 228
 229 extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
 230 extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
 231 extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
 232 extern void xfrm_put_type(struct xfrm_type *type);
 233
 234 struct xfrm_tmpl
 235 {
 236 /* id in template is interpreted as:
 237  * daddr - destination of tunnel, may be zero for transport mode.
 238  * spi   - zero to acquire spi. Not zero if spi is static, then
 239  *         daddr must be fixed too.
 240  * proto - AH/ESP/IPCOMP
 241  */
 242         struct xfrm_id          id;
 243
 244 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 245         xfrm_address_t          saddr;
 246
 247         __u16                   reqid;
 248
 249 /* Mode: transport/tunnel */
 250         __u8                    mode;
 251
 252 /* Sharing mode: unique, this session only, this user only etc. */
 253         __u8                    share;
 254
 255 /* May skip this transfomration if no SA is found */
 256         __u8                    optional;
 257
 258 /* Bit mask of algos allowed for acquisition */
 259         __u32                   aalgos;
 260         __u32                   ealgos;
 261         __u32                   calgos;
 262 };
 263
 264 #define XFRM_MAX_DEPTH          4
 265
 266 struct xfrm_policy
 267 {
 268         struct xfrm_policy      *next;
 269         struct list_head        list;
 270
 271         /* This lock only affects elements except for entry. */
 272         rwlock_t                lock;
 273         atomic_t                refcnt;
 274         struct timer_list       timer;
 275
 276         u32                     priority;
 277         u32                     index;
 278         struct xfrm_selector    selector;
 279         struct xfrm_lifetime_cfg lft;
 280         struct xfrm_lifetime_cur curlft;
 281         struct dst_entry       *bundles;
 282         __u16                   family;
 283         __u8                    action;
 284         __u8                    flags;
 285         __u8                    dead;
 286         __u8                    xfrm_nr;
 287         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 288 };
 289
 290 struct xfrm_mgr
 291 {
 292         struct list_head        list;
 293         char                    *id;
 294         int                     (*notify)(struct xfrm_state *x, int event);
 295         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
 296         struct xfrm_policy      *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
 297         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 298 };
 299
 300 extern int xfrm_register_km(struct xfrm_mgr *km);
 301 extern int xfrm_unregister_km(struct xfrm_mgr *km);
 302
 303
 304 #define XFRM_FLOWCACHE_HASH_SIZE        1024
 305
 306 static inline u32 __flow_hash4(struct flowi *fl)
 307 {
 308         u32 hash = fl->fl4_src ^ fl->fl_ip_sport;
 309
 310         hash = ((hash & 0xF0F0F0F0) >> 4) | ((hash & 0x0F0F0F0F) << 4);
 311
 312         hash ^= fl->fl4_dst ^ fl->fl_ip_dport;
 313         hash ^= (hash >> 10);
 314         hash ^= (hash >> 20);
 315         return hash & (XFRM_FLOWCACHE_HASH_SIZE-1);
 316 }
 317
 318 static inline u32 __flow_hash6(struct flowi *fl)
 319 {
 320         u32 hash = fl->fl6_src.s6_addr32[2] ^
 321                    fl->fl6_src.s6_addr32[3] ^
 322                    fl->fl_ip_sport;
 323
 324         hash = ((hash & 0xF0F0F0F0) >> 4) | ((hash & 0x0F0F0F0F) << 4);
 325
 326         hash ^= fl->fl6_dst.s6_addr32[2] ^
 327                 fl->fl6_dst.s6_addr32[3] ^
 328                 fl->fl_ip_dport;
 329         hash ^= (hash >> 10);
 330         hash ^= (hash >> 20);
 331         return hash & (XFRM_FLOWCACHE_HASH_SIZE-1);
 332 }
 333
 334 static inline u32 flow_hash(struct flowi *fl, unsigned short family)
 335 {
 336         switch (family) {
 337         case AF_INET:
 338                 return __flow_hash4(fl);
 339         case AF_INET6:
 340                 return __flow_hash6(fl);
 341         }
 342         return 0;       /*XXX*/
 343 }
 344
 345 extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
 346
 347 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 348 {
 349         if (likely(policy != NULL))
 350                 atomic_inc(&policy->refcnt);
 351 }
 352
 353 extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
 354
 355 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 356 {
 357         if (atomic_dec_and_test(&policy->refcnt))
 358                 __xfrm_policy_destroy(policy);
 359 }
 360
 361 #define XFRM_DST_HSIZE          1024
 362
 363 static __inline__
 364 unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
 365 {
 366         unsigned h;
 367         h = ntohl(addr->a4);
 368         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 369         return h;
 370 }
 371
 372 static __inline__
 373 unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
 374 {
 375         unsigned h;
 376         h = ntohl(addr->a6[2]^addr->a6[3]);
 377         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 378         return h;
 379 }
 380
 381 static __inline__
 382 unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
 383 {
 384         switch (family) {
 385         case AF_INET:
 386                 return __xfrm4_dst_hash(addr);
 387         case AF_INET6:
 388                 return __xfrm6_dst_hash(addr);
 389         }
 390         return 0;
 391 }
 392
 393 static __inline__
 394 unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 395 {
 396         unsigned h;
 397         h = ntohl(addr->a4^spi^proto);
 398         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 399         return h;
 400 }
 401
 402 static __inline__
 403 unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 404 {
 405         unsigned h;
 406         h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
 407         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 408         return h;
 409 }
 410
 411 static __inline__
 412 unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
 413 {
 414         switch (family) {
 415         case AF_INET:
 416                 return __xfrm4_spi_hash(addr, spi, proto);
 417         case AF_INET6:
 418                 return __xfrm6_spi_hash(addr, spi, proto);
 419         }
 420         return 0;       /*XXX*/
 421 }
 422
 423 extern void __xfrm_state_destroy(struct xfrm_state *);
 424
 425 static inline void xfrm_state_put(struct xfrm_state *x)
 426 {
 427         if (atomic_dec_and_test(&x->refcnt))
 428                 __xfrm_state_destroy(x);
 429 }
 430
 431 static inline void xfrm_state_hold(struct xfrm_state *x)
 432 {
 433         atomic_inc(&x->refcnt);
 434 }
 435
 436 static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
 437 {
 438         __u32 *a1 = token1;
 439         __u32 *a2 = token2;
 440         int pdw;
 441         int pbi;
 442
 443         pdw = prefixlen >> 5;     /* num of whole __u32 in prefix */
 444         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 445
 446         if (pdw)
 447                 if (memcmp(a1, a2, pdw << 2))
 448                         return 0;
 449
 450         if (pbi) {
 451                 __u32 mask;
 452
 453                 mask = htonl((0xffffffff) << (32 - pbi));
 454
 455                 if ((a1[pdw] ^ a2[pdw]) & mask)
 456                         return 0;
 457         }
 458
 459         return 1;
 460 }
 461
 462 static inline int
 463 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 464 {
 465         return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
 466                 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
 467                 !((fl->fl_ip_dport^sel->dport)&sel->dport_mask) &&
 468                 !((fl->fl_ip_sport^sel->sport)&sel->sport_mask) &&
 469                 (fl->proto == sel->proto || !sel->proto) &&
 470                 (fl->oif == sel->ifindex || !sel->ifindex);
 471 }
 472
 473 static inline int
 474 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 475 {
 476         return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
 477                 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
 478                 !((fl->fl_ip_dport^sel->dport)&sel->dport_mask) &&
 479                 !((fl->fl_ip_sport^sel->sport)&sel->sport_mask) &&
 480                 (fl->proto == sel->proto || !sel->proto) &&
 481                 (fl->oif == sel->ifindex || !sel->ifindex);
 482 }
 483
 484 static inline int
 485 xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
 486                     unsigned short family)
 487 {
 488         switch (family) {
 489         case AF_INET:
 490                 return __xfrm4_selector_match(sel, fl);
 491         case AF_INET6:
 492                 return __xfrm6_selector_match(sel, fl);
 493         }
 494         return 0;
 495 }
 496
 497 /* placeholder until xfrm6_tunnel.c is written */
 498 static inline int xfrm6_tunnel_check_size(struct sk_buff *skb)
 499 { return 0; }
 500
 501 /* A struct encoding bundle of transformations to apply to some set of flow.
 502  *
 503  * dst->child points to the next element of bundle.
 504  * dst->xfrm  points to an instanse of transformer.
 505  *
 506  * Due to unfortunate limitations of current routing cache, which we
 507  * have no time to fix, it mirrors struct rtable and bound to the same
 508  * routing key, including saddr,daddr. However, we can have many of
 509  * bundles differing by session id. All the bundles grow from a parent
 510  * policy rule.
 511  */
 512 struct xfrm_dst
 513 {
 514         union {
 515                 struct xfrm_dst         *next;
 516                 struct dst_entry        dst;
 517                 struct rtable           rt;
 518                 struct rt6_info         rt6;
 519         } u;
 520 };
 521
 522 /* Decapsulation state, used by the input to store data during
 523  * decapsulation procedure, to be used later (during the policy
 524  * check
 525  */
 526 struct xfrm_decap_state {
 527         char    decap_data[20];
 528         __u16   decap_type;
 529 };
 530
 531 struct sec_decap_state {
 532         struct xfrm_state       *xvec;
 533         struct xfrm_decap_state decap;
 534 };
 535
 536 struct sec_path
 537 {
 538         kmem_cache_t            *pool;
 539         atomic_t                refcnt;
 540         int                     len;
 541         struct sec_decap_state  x[XFRM_MAX_DEPTH];
 542 };
 543
 544 static inline struct sec_path *
 545 secpath_get(struct sec_path *sp)
 546 {
 547         if (sp)
 548                 atomic_inc(&sp->refcnt);
 549         return sp;
 550 }
 551
 552 extern void __secpath_destroy(struct sec_path *sp);
 553
 554 static inline void
 555 secpath_put(struct sec_path *sp)
 556 {
 557         if (sp && atomic_dec_and_test(&sp->refcnt))
 558                 __secpath_destroy(sp);
 559 }
 560
 561 static inline int
 562 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 563 {
 564         return  (tmpl->saddr.a4 &&
 565                  tmpl->saddr.a4 != x->props.saddr.a4);
 566 }
 567
 568 static inline int
 569 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 570 {
 571         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
 572                  ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
 573 }
 574
 575 static inline int
 576 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
 577 {
 578         switch (family) {
 579         case AF_INET:
 580                 return __xfrm4_state_addr_cmp(tmpl, x);
 581         case AF_INET6:
 582                 return __xfrm6_state_addr_cmp(tmpl, x);
 583         }
 584         return !0;
 585 }
 586
 587 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
 588
 589 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 590 {
 591         if (sk && sk->sk_policy[XFRM_POLICY_IN])
 592                 return __xfrm_policy_check(sk, dir, skb, family);
 593
 594         return  !xfrm_policy_list[dir] ||
 595                 (skb->dst->flags & DST_NOPOLICY) ||
 596                 __xfrm_policy_check(sk, dir, skb, family);
 597 }
 598
 599 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 600 {
 601         return xfrm_policy_check(sk, dir, skb, AF_INET);
 602 }
 603
 604 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 605 {
 606         return xfrm_policy_check(sk, dir, skb, AF_INET6);
 607 }
 608
 609
 610 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
 611
 612 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 613 {
 614         return  !xfrm_policy_list[XFRM_POLICY_OUT] ||
 615                 (skb->dst->flags & DST_NOXFRM) ||
 616                 __xfrm_route_forward(skb, family);
 617 }
 618
 619 static inline int xfrm4_route_forward(struct sk_buff *skb)
 620 {
 621         return xfrm_route_forward(skb, AF_INET);
 622 }
 623
 624 static inline int xfrm6_route_forward(struct sk_buff *skb)
 625 {
 626         return xfrm_route_forward(skb, AF_INET6);
 627 }
 628
 629 extern int __xfrm_sk_clone_policy(struct sock *sk);
 630
 631 static inline int xfrm_sk_clone_policy(struct sock *sk)
 632 {
 633         if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
 634                 return __xfrm_sk_clone_policy(sk);
 635         return 0;
 636 }
 637
 638 extern void __xfrm_sk_free_policy(struct xfrm_policy *, int dir);
 639
 640 static inline void xfrm_sk_free_policy(struct sock *sk)
 641 {
 642         if (unlikely(sk->sk_policy[0] != NULL)) {
 643                 __xfrm_sk_free_policy(sk->sk_policy[0], 0);
 644                 sk->sk_policy[0] = NULL;
 645         }
 646         if (unlikely(sk->sk_policy[1] != NULL)) {
 647                 __xfrm_sk_free_policy(sk->sk_policy[1], 1);
 648                 sk->sk_policy[1] = NULL;
 649         }
 650 }
 651
 652 static __inline__
 653 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
 654 {
 655         switch (family){
 656         case AF_INET:
 657                 return (xfrm_address_t *)&fl->fl4_dst;
 658         case AF_INET6:
 659                 return (xfrm_address_t *)&fl->fl6_dst;
 660         }
 661         return NULL;
 662 }
 663
 664 static __inline__
 665 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
 666 {
 667         switch (family){
 668         case AF_INET:
 669                 return (xfrm_address_t *)&fl->fl4_src;
 670         case AF_INET6:
 671                 return (xfrm_address_t *)&fl->fl6_src;
 672         }
 673         return NULL;
 674 }
 675
 676 static __inline__ int
 677 __xfrm4_state_addr_check(struct xfrm_state *x,
 678                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 679 {
 680         if (daddr->a4 == x->id.daddr.a4 &&
 681             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
 682                 return 1;
 683         return 0;
 684 }
 685
 686 static __inline__ int
 687 __xfrm6_state_addr_check(struct xfrm_state *x,
 688                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 689 {
 690         if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
 691             (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
 692              ipv6_addr_any((struct in6_addr *)saddr) ||
 693              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
 694                 return 1;
 695         return 0;
 696 }
 697
 698 static __inline__ int
 699 xfrm_state_addr_check(struct xfrm_state *x,
 700                       xfrm_address_t *daddr, xfrm_address_t *saddr,
 701                       unsigned short family)
 702 {
 703         switch (family) {
 704         case AF_INET:
 705                 return __xfrm4_state_addr_check(x, daddr, saddr);
 706         case AF_INET6:
 707                 return __xfrm6_state_addr_check(x, daddr, saddr);
 708         }
 709         return 0;
 710 }
 711
 712 static inline int xfrm_state_kern(struct xfrm_state *x)
 713 {
 714         return atomic_read(&x->tunnel_users);
 715 }
 716
 717 /*
 718  * xfrm algorithm information
 719  */
 720 struct xfrm_algo_auth_info {
 721         u16 icv_truncbits;
 722         u16 icv_fullbits;
 723 };
 724
 725 struct xfrm_algo_encr_info {
 726         u16 blockbits;
 727         u16 defkeybits;
 728 };
 729
 730 struct xfrm_algo_comp_info {
 731         u16 threshold;
 732 };
 733
 734 struct xfrm_algo_desc {
 735         char *name;
 736         u8 available:1;
 737         union {
 738                 struct xfrm_algo_auth_info auth;
 739                 struct xfrm_algo_encr_info encr;
 740                 struct xfrm_algo_comp_info comp;
 741         } uinfo;
 742         struct sadb_alg desc;
 743 };
 744
 745 /* XFRM tunnel handlers.  */
 746 struct xfrm_tunnel {
 747         int (*handler)(struct sk_buff *skb);
 748         void (*err_handler)(struct sk_buff *skb, void *info);
 749 };
 750
 751 extern void xfrm_init(void);
 752 extern void xfrm4_init(void);
 753 extern void xfrm4_fini(void);
 754 extern void xfrm6_init(void);
 755 extern void xfrm6_fini(void);
 756 extern void xfrm_state_init(void);
 757 extern void xfrm4_state_init(void);
 758 extern void xfrm4_state_fini(void);
 759 extern void xfrm6_state_init(void);
 760 extern void xfrm6_state_fini(void);
 761
 762 extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
 763 extern struct xfrm_state *xfrm_state_alloc(void);
 764 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 765                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
 766                                           struct xfrm_policy *pol, int *err,
 767                                           unsigned short family);
 768 extern int xfrm_state_check_expire(struct xfrm_state *x);
 769 extern void xfrm_state_insert(struct xfrm_state *x);
 770 extern int xfrm_state_add(struct xfrm_state *x);
 771 extern int xfrm_state_update(struct xfrm_state *x);
 772 extern int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb);
 773 extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
 774 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
 775 extern void xfrm_state_delete(struct xfrm_state *x);
 776 extern void xfrm_state_flush(u8 proto);
 777 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
 778 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
 779 extern int xfrm_check_selectors(struct xfrm_state **x, int n, struct flowi *fl);
 780 extern int xfrm_check_output(struct xfrm_state *x, struct sk_buff *skb, unsigned short family);
 781 extern int xfrm4_rcv(struct sk_buff *skb);
 782 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
 783 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 784 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
 785 extern int xfrm4_tunnel_check_size(struct sk_buff *skb);
 786 extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
 787 extern int xfrm_user_policy(struct sock *sk, int optname, u8 *optval, int optlen);
 788
 789 void xfrm_policy_init(void);
 790 void xfrm4_policy_init(void);
 791 void xfrm6_policy_init(void);
 792 struct xfrm_policy *xfrm_policy_alloc(int gfp);
 793 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
 794 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
 795 struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
 796                                       int delete);
 797 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
 798 void xfrm_policy_flush(void);
 799 u32 xfrm_get_acqseq(void);
 800 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 801 struct xfrm_state * xfrm_find_acq(u8 mode, u16 reqid, u8 proto,
 802                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 803                                   int create, unsigned short family);
 804 extern void xfrm_policy_flush(void);
 805 extern void xfrm_policy_kill(struct xfrm_policy *);
 806 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 807 extern struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl);
 808 extern int xfrm_flush_bundles(struct xfrm_state *x);
 809 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
 810
 811 extern wait_queue_head_t km_waitq;
 812 extern void km_warn_expired(struct xfrm_state *x);
 813 extern void km_expired(struct xfrm_state *x);
 814 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *pol);
 815 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 816
 817 extern void xfrm4_input_init(void);
 818 extern void xfrm6_input_init(void);
 819 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
 820
 821 extern void xfrm_probe_algs(void);
 822 extern int xfrm_count_auth_supported(void);
 823 extern int xfrm_count_enc_supported(void);
 824 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
 825 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
 826 extern struct xfrm_algo_desc *xfrm_calg_get_byidx(unsigned int idx);
 827 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
 828 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
 829 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
 830 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name);
 831 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name);
 832 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name);
 833
 834 struct crypto_tfm;
 835 typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
 836
 837 extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
 838                          int offset, int len, icv_update_fn_t icv_update);
 839
 840 #endif  /* _NET_XFRM_H */