1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _NET_XFRM_H 3 #define _NET_XFRM_H 4 5 #include <linux/compiler.h> 6 #include <linux/xfrm.h> 7 #include <linux/spinlock.h> 8 #include <linux/list.h> 9 #include <linux/skbuff.h> 10 #include <linux/socket.h> 11 #include <linux/pfkeyv2.h> 12 #include <linux/ipsec.h> 13 #include <linux/in6.h> 14 #include <linux/mutex.h> 15 #include <linux/audit.h> 16 #include <linux/slab.h> 17 #include <linux/refcount.h> 18 #include <linux/sockptr.h> 19 20 #include <net/sock.h> 21 #include <net/dst.h> 22 #include <net/inet_dscp.h> 23 #include <net/ip.h> 24 #include <net/route.h> 25 #include <net/ipv6.h> 26 #include <net/ip6_fib.h> 27 #include <net/flow.h> 28 #include <net/gro_cells.h> 29 30 #include <linux/interrupt.h> 31 32 #ifdef CONFIG_XFRM_STATISTICS 33 #include <net/snmp.h> 34 #endif 35 36 #define XFRM_PROTO_ESP 50 37 #define XFRM_PROTO_AH 51 38 #define XFRM_PROTO_COMP 108 39 #define XFRM_PROTO_IPIP 4 40 #define XFRM_PROTO_IPV6 41 41 #define XFRM_PROTO_IPTFS IPPROTO_AGGFRAG 42 #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 43 #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 44 45 #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 46 #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 47 #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 48 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 49 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 50 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 51 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \ 52 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto)) 53 54 #ifdef CONFIG_XFRM_STATISTICS 55 #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 56 #define XFRM_ADD_STATS(net, field, val) SNMP_ADD_STATS((net)->mib.xfrm_statistics, field, val) 57 #else 58 #define XFRM_INC_STATS(net, field) ((void)(net)) 59 #define XFRM_ADD_STATS(net, field, val) ((void)(net)) 60 #endif 61 62 63 /* Organization of SPD aka "XFRM rules" 64 ------------------------------------ 65 66 Basic objects: 67 - policy rule, struct xfrm_policy (=SPD entry) 68 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 69 - instance of a transformer, struct xfrm_state (=SA) 70 - template to clone xfrm_state, struct xfrm_tmpl 71 72 SPD is organized as hash table (for policies that meet minimum address prefix 73 length setting, net->xfrm.policy_hthresh). Other policies are stored in 74 lists, sorted into rbtree ordered by destination and source address networks. 75 See net/xfrm/xfrm_policy.c for details. 76 77 (To be compatible with existing pfkeyv2 implementations, 78 many rules with priority of 0x7fffffff are allowed to exist and 79 such rules are ordered in an unpredictable way, thanks to bsd folks.) 80 81 If "action" is "block", then we prohibit the flow, otherwise: 82 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 83 policy entry has list of up to XFRM_MAX_DEPTH transformations, 84 described by templates xfrm_tmpl. Each template is resolved 85 to a complete xfrm_state (see below) and we pack bundle of transformations 86 to a dst_entry returned to requester. 87 88 dst -. xfrm .-> xfrm_state #1 89 |---. child .-> dst -. xfrm .-> xfrm_state #2 90 |---. child .-> dst -. xfrm .-> xfrm_state #3 91 |---. child .-> NULL 92 93 94 Resolution of xrfm_tmpl 95 ----------------------- 96 Template contains: 97 1. ->mode Mode: transport or tunnel 98 2. ->id.proto Protocol: AH/ESP/IPCOMP 99 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 100 Q: allow to resolve security gateway? 101 4. ->id.spi If not zero, static SPI. 102 5. ->saddr Local tunnel endpoint, ignored for transport mode. 103 6. ->algos List of allowed algos. Plain bitmask now. 104 Q: ealgos, aalgos, calgos. What a mess... 105 7. ->share Sharing mode. 106 Q: how to implement private sharing mode? To add struct sock* to 107 flow id? 108 109 Having this template we search through SAD searching for entries 110 with appropriate mode/proto/algo, permitted by selector. 111 If no appropriate entry found, it is requested from key manager. 112 113 PROBLEMS: 114 Q: How to find all the bundles referring to a physical path for 115 PMTU discovery? Seems, dst should contain list of all parents... 116 and enter to infinite locking hierarchy disaster. 117 No! It is easier, we will not search for them, let them find us. 118 We add genid to each dst plus pointer to genid of raw IP route, 119 pmtu disc will update pmtu on raw IP route and increase its genid. 120 dst_check() will see this for top level and trigger resyncing 121 metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 122 */ 123 124 struct xfrm_state_walk { 125 struct list_head all; 126 u8 state; 127 u8 dying; 128 u8 proto; 129 u32 seq; 130 struct xfrm_address_filter *filter; 131 }; 132 133 enum { 134 XFRM_DEV_OFFLOAD_IN = 1, 135 XFRM_DEV_OFFLOAD_OUT, 136 XFRM_DEV_OFFLOAD_FWD, 137 }; 138 139 enum { 140 XFRM_DEV_OFFLOAD_UNSPECIFIED, 141 XFRM_DEV_OFFLOAD_CRYPTO, 142 XFRM_DEV_OFFLOAD_PACKET, 143 }; 144 145 enum { 146 XFRM_DEV_OFFLOAD_FLAG_ACQ = 1, 147 }; 148 149 struct xfrm_dev_offload { 150 /* The device for this offload. 151 * Device drivers should not use this directly, as that will prevent 152 * them from working with bonding device. Instead, the device passed 153 * to the add/delete callbacks should be used. 154 */ 155 struct net_device *dev; 156 netdevice_tracker dev_tracker; 157 /* This is a private pointer used by the bonding driver (and eventually 158 * should be moved there). Device drivers should not use it. 159 * Protected by xfrm_state.lock AND bond.ipsec_lock in most cases, 160 * except in the .xdo_dev_state_del() flow, where only xfrm_state.lock 161 * is held. 162 */ 163 struct net_device *real_dev; 164 unsigned long offload_handle; 165 /* Snapshot the attached device index for dump paths. */ 166 int ifindex; 167 u8 dir : 2; 168 u8 type : 2; 169 u8 flags : 2; 170 }; 171 172 struct xfrm_mode { 173 u8 encap; 174 u8 family; 175 u8 flags; 176 }; 177 178 /* Flags for xfrm_mode. */ 179 enum { 180 XFRM_MODE_FLAG_TUNNEL = 1, 181 }; 182 183 enum xfrm_replay_mode { 184 XFRM_REPLAY_MODE_LEGACY, 185 XFRM_REPLAY_MODE_BMP, 186 XFRM_REPLAY_MODE_ESN, 187 }; 188 189 /* Full description of state of transformer. */ 190 struct xfrm_state { 191 possible_net_t xs_net; 192 union { 193 struct hlist_node gclist; 194 struct hlist_node bydst; 195 }; 196 union { 197 struct hlist_node dev_gclist; 198 struct hlist_node bysrc; 199 }; 200 struct hlist_node byspi; 201 struct hlist_node byseq; 202 struct hlist_node state_cache; 203 struct hlist_node state_cache_input; 204 205 refcount_t refcnt; 206 spinlock_t lock; 207 208 u32 pcpu_num; 209 struct xfrm_id id; 210 struct xfrm_selector sel; 211 struct xfrm_mark mark; 212 u32 if_id; 213 u32 tfcpad; 214 215 u32 genid; 216 217 /* Key manager bits */ 218 struct xfrm_state_walk km; 219 220 /* Parameters of this state. */ 221 struct { 222 u32 reqid; 223 u8 mode; 224 u8 replay_window; 225 u8 aalgo, ealgo, calgo; 226 u8 flags; 227 u16 family; 228 xfrm_address_t saddr; 229 int header_len; 230 int enc_hdr_len; 231 int trailer_len; 232 u32 extra_flags; 233 struct xfrm_mark smark; 234 } props; 235 236 struct xfrm_lifetime_cfg lft; 237 238 /* Data for transformer */ 239 struct xfrm_algo_auth *aalg; 240 struct xfrm_algo *ealg; 241 struct xfrm_algo *calg; 242 struct xfrm_algo_aead *aead; 243 const char *geniv; 244 245 /* mapping change rate limiting */ 246 __be16 new_mapping_sport; 247 u32 new_mapping; /* seconds */ 248 u32 mapping_maxage; /* seconds for input SA */ 249 250 /* Data for encapsulator */ 251 struct xfrm_encap_tmpl *encap; 252 253 /* NAT keepalive */ 254 u32 nat_keepalive_interval; /* seconds */ 255 time64_t nat_keepalive_expiration; 256 257 /* Data for care-of address */ 258 xfrm_address_t *coaddr; 259 260 /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 261 struct xfrm_state *tunnel; 262 263 /* If a tunnel, number of users + 1 */ 264 atomic_t tunnel_users; 265 266 /* State for replay detection */ 267 struct xfrm_replay_state replay; 268 struct xfrm_replay_state_esn *replay_esn; 269 270 /* Replay detection state at the time we sent the last notification */ 271 struct xfrm_replay_state preplay; 272 struct xfrm_replay_state_esn *preplay_esn; 273 274 /* replay detection mode */ 275 enum xfrm_replay_mode repl_mode; 276 /* internal flag that only holds state for delayed aevent at the 277 * moment 278 */ 279 u32 xflags; 280 281 /* Replay detection notification settings */ 282 u32 replay_maxage; 283 u32 replay_maxdiff; 284 285 /* Replay detection notification timer */ 286 struct timer_list rtimer; 287 288 /* Statistics */ 289 struct xfrm_stats stats; 290 291 struct xfrm_lifetime_cur curlft; 292 struct hrtimer mtimer; 293 294 struct xfrm_dev_offload xso; 295 296 /* used to fix curlft->add_time when changing date */ 297 long saved_tmo; 298 299 /* Last used time */ 300 time64_t lastused; 301 302 struct page_frag xfrag; 303 304 /* Reference to data common to all the instances of this 305 * transformer. */ 306 const struct xfrm_type *type; 307 struct xfrm_mode inner_mode; 308 struct xfrm_mode inner_mode_iaf; 309 struct xfrm_mode outer_mode; 310 311 const struct xfrm_type_offload *type_offload; 312 313 /* Security context */ 314 struct xfrm_sec_ctx *security; 315 316 /* Private data of this transformer, format is opaque, 317 * interpreted by xfrm_type methods. */ 318 void *data; 319 u8 dir; 320 321 const struct xfrm_mode_cbs *mode_cbs; 322 void *mode_data; 323 }; 324 325 static inline struct net *xs_net(struct xfrm_state *x) 326 { 327 return read_pnet(&x->xs_net); 328 } 329 330 /* xflags - make enum if more show up */ 331 #define XFRM_TIME_DEFER 1 332 #define XFRM_SOFT_EXPIRE 2 333 334 enum { 335 XFRM_STATE_VOID, 336 XFRM_STATE_ACQ, 337 XFRM_STATE_VALID, 338 XFRM_STATE_ERROR, 339 XFRM_STATE_EXPIRED, 340 XFRM_STATE_DEAD 341 }; 342 343 /* callback structure passed from either netlink or pfkey */ 344 struct km_event { 345 union { 346 u32 hard; 347 u32 proto; 348 u32 byid; 349 u32 aevent; 350 u32 type; 351 } data; 352 353 u32 seq; 354 u32 portid; 355 u32 event; 356 struct net *net; 357 }; 358 359 struct xfrm_if_decode_session_result { 360 struct net *net; 361 u32 if_id; 362 }; 363 364 struct xfrm_if_cb { 365 bool (*decode_session)(struct sk_buff *skb, 366 unsigned short family, 367 struct xfrm_if_decode_session_result *res); 368 }; 369 370 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); 371 void xfrm_if_unregister_cb(void); 372 373 struct xfrm_dst_lookup_params { 374 struct net *net; 375 dscp_t dscp; 376 int oif; 377 xfrm_address_t *saddr; 378 xfrm_address_t *daddr; 379 u32 mark; 380 __u8 ipproto; 381 union flowi_uli uli; 382 }; 383 384 struct net_device; 385 struct xfrm_type; 386 struct xfrm_dst; 387 struct xfrm_policy_afinfo { 388 struct dst_ops *dst_ops; 389 struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params); 390 int (*get_saddr)(xfrm_address_t *saddr, 391 const struct xfrm_dst_lookup_params *params); 392 int (*fill_dst)(struct xfrm_dst *xdst, 393 struct net_device *dev, 394 const struct flowi *fl); 395 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 396 }; 397 398 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 399 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 400 void km_policy_notify(struct xfrm_policy *xp, int dir, 401 const struct km_event *c); 402 void km_state_notify(struct xfrm_state *x, const struct km_event *c); 403 404 struct xfrm_tmpl; 405 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 406 struct xfrm_policy *pol); 407 void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 408 int __xfrm_state_delete(struct xfrm_state *x); 409 410 struct xfrm_state_afinfo { 411 u8 family; 412 u8 proto; 413 414 const struct xfrm_type_offload *type_offload_esp; 415 416 const struct xfrm_type *type_esp; 417 const struct xfrm_type *type_ipip; 418 const struct xfrm_type *type_ipip6; 419 const struct xfrm_type *type_comp; 420 const struct xfrm_type *type_ah; 421 const struct xfrm_type *type_routing; 422 const struct xfrm_type *type_dstopts; 423 424 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 425 int (*transport_finish)(struct sk_buff *skb, 426 int async); 427 void (*local_error)(struct sk_buff *skb, u32 mtu); 428 }; 429 430 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 431 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 432 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 433 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 434 435 struct xfrm_input_afinfo { 436 u8 family; 437 bool is_ipip; 438 int (*callback)(struct sk_buff *skb, u8 protocol, 439 int err); 440 }; 441 442 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 443 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 444 445 void xfrm_flush_gc(void); 446 447 struct xfrm_type { 448 struct module *owner; 449 u8 proto; 450 u8 flags; 451 #define XFRM_TYPE_NON_FRAGMENT 1 452 #define XFRM_TYPE_REPLAY_PROT 2 453 #define XFRM_TYPE_LOCAL_COADDR 4 454 #define XFRM_TYPE_REMOTE_COADDR 8 455 456 int (*init_state)(struct xfrm_state *x, 457 struct netlink_ext_ack *extack); 458 void (*destructor)(struct xfrm_state *); 459 int (*input)(struct xfrm_state *, struct sk_buff *skb); 460 int (*output)(struct xfrm_state *, struct sk_buff *pskb); 461 int (*reject)(struct xfrm_state *, struct sk_buff *, 462 const struct flowi *); 463 }; 464 465 int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 466 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 467 468 struct xfrm_type_offload { 469 struct module *owner; 470 u8 proto; 471 void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 472 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 473 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 474 }; 475 476 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 477 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 478 void xfrm_set_type_offload(struct xfrm_state *x, bool try_load); 479 static inline void xfrm_unset_type_offload(struct xfrm_state *x) 480 { 481 if (!x->type_offload) 482 return; 483 484 module_put(x->type_offload->owner); 485 x->type_offload = NULL; 486 } 487 488 /** 489 * struct xfrm_mode_cbs - XFRM mode callbacks 490 * @owner: module owner or NULL 491 * @init_state: Add/init mode specific state in `xfrm_state *x` 492 * @clone_state: Copy mode specific values from `orig` to new state `x` 493 * @destroy_state: Cleanup mode specific state from `xfrm_state *x` 494 * @user_init: Process mode specific netlink attributes from user 495 * @copy_to_user: Add netlink attributes to `attrs` based on state in `x` 496 * @sa_len: Return space required to store mode specific netlink attributes 497 * @get_inner_mtu: Return avail payload space after removing encap overhead 498 * @input: Process received packet from SA using mode 499 * @output: Output given packet using mode 500 * @prepare_output: Add mode specific encapsulation to packet in skb. On return 501 * `transport_header` should point at ESP header, `network_header` should 502 * point at outer IP header and `mac_header` should opint at the 503 * protocol/nexthdr field of the outer IP. 504 * 505 * One should examine and understand the specific uses of these callbacks in 506 * xfrm for further detail on how and when these functions are called. RTSL. 507 */ 508 struct xfrm_mode_cbs { 509 struct module *owner; 510 int (*init_state)(struct xfrm_state *x); 511 int (*clone_state)(struct xfrm_state *x, struct xfrm_state *orig); 512 void (*destroy_state)(struct xfrm_state *x); 513 int (*user_init)(struct net *net, struct xfrm_state *x, 514 struct nlattr **attrs, 515 struct netlink_ext_ack *extack); 516 int (*copy_to_user)(struct xfrm_state *x, struct sk_buff *skb); 517 unsigned int (*sa_len)(const struct xfrm_state *x); 518 u32 (*get_inner_mtu)(struct xfrm_state *x, int outer_mtu); 519 int (*input)(struct xfrm_state *x, struct sk_buff *skb); 520 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 521 int (*prepare_output)(struct xfrm_state *x, struct sk_buff *skb); 522 }; 523 524 int xfrm_register_mode_cbs(u8 mode, const struct xfrm_mode_cbs *mode_cbs); 525 void xfrm_unregister_mode_cbs(u8 mode); 526 527 static inline int xfrm_af2proto(unsigned int family) 528 { 529 switch(family) { 530 case AF_INET: 531 return IPPROTO_IPIP; 532 case AF_INET6: 533 return IPPROTO_IPV6; 534 default: 535 return 0; 536 } 537 } 538 539 static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 540 { 541 if ((x->sel.family != AF_UNSPEC) || 542 (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 543 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 544 return &x->inner_mode; 545 else 546 return &x->inner_mode_iaf; 547 } 548 549 struct xfrm_tmpl { 550 /* id in template is interpreted as: 551 * daddr - destination of tunnel, may be zero for transport mode. 552 * spi - zero to acquire spi. Not zero if spi is static, then 553 * daddr must be fixed too. 554 * proto - AH/ESP/IPCOMP 555 */ 556 struct xfrm_id id; 557 558 /* Source address of tunnel. Ignored, if it is not a tunnel. */ 559 xfrm_address_t saddr; 560 561 unsigned short encap_family; 562 563 u32 reqid; 564 565 /* Mode: transport, tunnel etc. */ 566 u8 mode; 567 568 /* Sharing mode: unique, this session only, this user only etc. */ 569 u8 share; 570 571 /* May skip this transfomration if no SA is found */ 572 u8 optional; 573 574 /* Skip aalgos/ealgos/calgos checks. */ 575 u8 allalgs; 576 577 /* Bit mask of algos allowed for acquisition */ 578 u32 aalgos; 579 u32 ealgos; 580 u32 calgos; 581 }; 582 583 #define XFRM_MAX_DEPTH 6 584 #define XFRM_MAX_OFFLOAD_DEPTH 1 585 586 struct xfrm_policy_walk_entry { 587 struct list_head all; 588 u8 dead; 589 }; 590 591 struct xfrm_policy_walk { 592 struct xfrm_policy_walk_entry walk; 593 u8 type; 594 u32 seq; 595 }; 596 597 struct xfrm_policy_queue { 598 struct sk_buff_head hold_queue; 599 struct timer_list hold_timer; 600 unsigned long timeout; 601 }; 602 603 /** 604 * struct xfrm_policy - xfrm policy 605 * @xp_net: network namespace the policy lives in 606 * @bydst: hlist node for SPD hash table or rbtree list 607 * @byidx: hlist node for index hash table 608 * @state_cache_list: hlist head for policy cached xfrm states 609 * @lock: serialize changes to policy structure members 610 * @refcnt: reference count, freed once it reaches 0 611 * @pos: kernel internal tie-breaker to determine age of policy 612 * @timer: timer 613 * @genid: generation, used to invalidate old policies 614 * @priority: priority, set by userspace 615 * @index: policy index (autogenerated) 616 * @if_id: virtual xfrm interface id 617 * @mark: packet mark 618 * @selector: selector 619 * @lft: liftime configuration data 620 * @curlft: liftime state 621 * @walk: list head on pernet policy list 622 * @polq: queue to hold packets while aqcuire operaion in progress 623 * @bydst_reinsert: policy tree node needs to be merged 624 * @type: XFRM_POLICY_TYPE_MAIN or _SUB 625 * @action: XFRM_POLICY_ALLOW or _BLOCK 626 * @flags: XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP 627 * @xfrm_nr: number of used templates in @xfrm_vec 628 * @family: protocol family 629 * @security: SELinux security label 630 * @xfrm_vec: array of templates to resolve state 631 * @rcu: rcu head, used to defer memory release 632 * @xdo: hardware offload state 633 */ 634 struct xfrm_policy { 635 possible_net_t xp_net; 636 struct hlist_node bydst; 637 struct hlist_node byidx; 638 639 struct hlist_head state_cache_list; 640 641 /* This lock only affects elements except for entry. */ 642 rwlock_t lock; 643 refcount_t refcnt; 644 u32 pos; 645 struct timer_list timer; 646 647 atomic_t genid; 648 u32 priority; 649 u32 index; 650 u32 if_id; 651 struct xfrm_mark mark; 652 struct xfrm_selector selector; 653 struct xfrm_lifetime_cfg lft; 654 struct xfrm_lifetime_cur curlft; 655 struct xfrm_policy_walk_entry walk; 656 struct xfrm_policy_queue polq; 657 bool bydst_reinsert; 658 u8 type; 659 u8 action; 660 u8 flags; 661 u8 xfrm_nr; 662 u16 family; 663 struct xfrm_sec_ctx *security; 664 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 665 struct rcu_head rcu; 666 667 struct xfrm_dev_offload xdo; 668 }; 669 670 static inline struct net *xp_net(const struct xfrm_policy *xp) 671 { 672 return read_pnet(&xp->xp_net); 673 } 674 675 struct xfrm_kmaddress { 676 xfrm_address_t local; 677 xfrm_address_t remote; 678 u32 reserved; 679 u16 family; 680 }; 681 682 struct xfrm_migrate { 683 xfrm_address_t old_daddr; 684 xfrm_address_t old_saddr; 685 xfrm_address_t new_daddr; 686 xfrm_address_t new_saddr; 687 struct xfrm_encap_tmpl *encap; 688 struct xfrm_user_offload *xuo; 689 struct xfrm_mark old_mark; 690 const struct xfrm_mark *new_mark; 691 struct xfrm_mark smark; 692 u8 proto; 693 u8 mode; 694 u16 msg_type; /* XFRM_MSG_MIGRATE or XFRM_MSG_MIGRATE_STATE */ 695 u32 flags; 696 u32 old_reqid; 697 u32 new_reqid; 698 u32 nat_keepalive_interval; 699 u32 mapping_maxage; 700 u16 old_family; 701 u16 new_family; 702 const struct xfrm_selector *new_sel; 703 }; 704 705 #define XFRM_KM_TIMEOUT 30 706 /* what happened */ 707 #define XFRM_REPLAY_UPDATE XFRM_AE_CR 708 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 709 710 /* default aevent timeout in units of 100ms */ 711 #define XFRM_AE_ETIME 10 712 /* Async Event timer multiplier */ 713 #define XFRM_AE_ETH_M 10 714 /* default seq threshold size */ 715 #define XFRM_AE_SEQT_SIZE 2 716 717 struct xfrm_mgr { 718 struct list_head list; 719 int (*notify)(struct xfrm_state *x, const struct km_event *c); 720 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 721 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 722 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 723 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 724 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 725 int (*migrate)(const struct xfrm_selector *sel, 726 u8 dir, u8 type, 727 const struct xfrm_migrate *m, 728 int num_bundles, 729 const struct xfrm_kmaddress *k, 730 struct net *net, 731 const struct xfrm_encap_tmpl *encap); 732 bool (*is_alive)(const struct km_event *c); 733 }; 734 735 void xfrm_register_km(struct xfrm_mgr *km); 736 void xfrm_unregister_km(struct xfrm_mgr *km); 737 738 struct xfrm_tunnel_skb_cb { 739 union { 740 struct inet_skb_parm h4; 741 struct inet6_skb_parm h6; 742 } header; 743 744 union { 745 struct ip_tunnel *ip4; 746 struct ip6_tnl *ip6; 747 } tunnel; 748 }; 749 750 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 751 752 /* 753 * This structure is used for the duration where packets are being 754 * transformed by IPsec. As soon as the packet leaves IPsec the 755 * area beyond the generic IP part may be overwritten. 756 */ 757 struct xfrm_skb_cb { 758 struct xfrm_tunnel_skb_cb header; 759 760 /* Sequence number for replay protection. */ 761 union { 762 struct { 763 __u32 low; 764 __u32 hi; 765 } output; 766 struct { 767 __be32 low; 768 __be32 hi; 769 } input; 770 } seq; 771 }; 772 773 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 774 775 /* 776 * This structure is used by the afinfo prepare_input/prepare_output functions 777 * to transmit header information to the mode input/output functions. 778 */ 779 struct xfrm_mode_skb_cb { 780 struct xfrm_tunnel_skb_cb header; 781 782 /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 783 __be16 id; 784 __be16 frag_off; 785 786 /* IP header length (excluding options or extension headers). */ 787 u8 ihl; 788 789 /* TOS for IPv4, class for IPv6. */ 790 u8 tos; 791 792 /* TTL for IPv4, hop limitfor IPv6. */ 793 u8 ttl; 794 795 /* Protocol for IPv4, NH for IPv6. */ 796 u8 protocol; 797 798 /* Option length for IPv4, zero for IPv6. */ 799 u8 optlen; 800 801 /* Used by IPv6 only, zero for IPv4. */ 802 u8 flow_lbl[3]; 803 }; 804 805 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 806 807 /* 808 * This structure is used by the input processing to locate the SPI and 809 * related information. 810 */ 811 struct xfrm_spi_skb_cb { 812 struct xfrm_tunnel_skb_cb header; 813 814 unsigned int daddroff; 815 unsigned int family; 816 __be32 seq; 817 }; 818 819 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 820 821 #ifdef CONFIG_AUDITSYSCALL 822 static inline struct audit_buffer *xfrm_audit_start(const char *op) 823 { 824 struct audit_buffer *audit_buf = NULL; 825 826 if (audit_enabled == AUDIT_OFF) 827 return NULL; 828 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, 829 AUDIT_MAC_IPSEC_EVENT); 830 if (audit_buf == NULL) 831 return NULL; 832 audit_log_format(audit_buf, "op=%s", op); 833 return audit_buf; 834 } 835 836 static inline void xfrm_audit_helper_usrinfo(bool task_valid, 837 struct audit_buffer *audit_buf) 838 { 839 const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 840 audit_get_loginuid(current) : 841 INVALID_UID); 842 const unsigned int ses = task_valid ? audit_get_sessionid(current) : 843 AUDIT_SID_UNSET; 844 845 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 846 audit_log_task_context(audit_buf); 847 } 848 849 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 850 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 851 bool task_valid); 852 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 853 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 854 void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 855 struct sk_buff *skb); 856 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 857 __be32 net_seq); 858 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 859 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 860 __be32 net_seq); 861 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 862 u8 proto); 863 #else 864 865 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 866 bool task_valid) 867 { 868 } 869 870 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 871 bool task_valid) 872 { 873 } 874 875 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 876 bool task_valid) 877 { 878 } 879 880 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 881 bool task_valid) 882 { 883 } 884 885 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 886 struct sk_buff *skb) 887 { 888 } 889 890 static inline void xfrm_audit_state_replay(struct xfrm_state *x, 891 struct sk_buff *skb, __be32 net_seq) 892 { 893 } 894 895 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 896 u16 family) 897 { 898 } 899 900 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 901 __be32 net_spi, __be32 net_seq) 902 { 903 } 904 905 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 906 struct sk_buff *skb, u8 proto) 907 { 908 } 909 #endif /* CONFIG_AUDITSYSCALL */ 910 911 static inline void xfrm_pol_hold(struct xfrm_policy *policy) 912 { 913 if (likely(policy != NULL)) 914 refcount_inc(&policy->refcnt); 915 } 916 917 void xfrm_policy_destroy(struct xfrm_policy *policy); 918 919 static inline void xfrm_pol_put(struct xfrm_policy *policy) 920 { 921 if (refcount_dec_and_test(&policy->refcnt)) 922 xfrm_policy_destroy(policy); 923 } 924 925 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 926 { 927 int i; 928 for (i = npols - 1; i >= 0; --i) 929 xfrm_pol_put(pols[i]); 930 } 931 932 void __xfrm_state_destroy(struct xfrm_state *); 933 934 static inline void __xfrm_state_put(struct xfrm_state *x) 935 { 936 refcount_dec(&x->refcnt); 937 } 938 939 static inline void xfrm_state_put(struct xfrm_state *x) 940 { 941 if (refcount_dec_and_test(&x->refcnt)) 942 __xfrm_state_destroy(x); 943 } 944 945 static inline void xfrm_state_hold(struct xfrm_state *x) 946 { 947 refcount_inc(&x->refcnt); 948 } 949 950 static inline bool addr_match(const void *token1, const void *token2, 951 unsigned int prefixlen) 952 { 953 const __be32 *a1 = token1; 954 const __be32 *a2 = token2; 955 unsigned int pdw; 956 unsigned int pbi; 957 958 if (prefixlen > 128) 959 return false; 960 961 pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 962 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 963 964 if (pdw) 965 if (memcmp(a1, a2, pdw << 2)) 966 return false; 967 968 if (pbi) { 969 __be32 mask; 970 971 mask = htonl((0xffffffff) << (32 - pbi)); 972 973 if ((a1[pdw] ^ a2[pdw]) & mask) 974 return false; 975 } 976 977 return true; 978 } 979 980 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 981 { 982 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 983 if (sizeof(long) == 4 && prefixlen == 0) 984 return true; 985 986 if (prefixlen > 32) 987 return false; 988 989 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 990 } 991 992 static __inline__ 993 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 994 { 995 __be16 port; 996 switch(fl->flowi_proto) { 997 case IPPROTO_TCP: 998 case IPPROTO_UDP: 999 case IPPROTO_UDPLITE: 1000 case IPPROTO_SCTP: 1001 port = uli->ports.sport; 1002 break; 1003 case IPPROTO_ICMP: 1004 case IPPROTO_ICMPV6: 1005 port = htons(uli->icmpt.type); 1006 break; 1007 case IPPROTO_MH: 1008 port = htons(uli->mht.type); 1009 break; 1010 case IPPROTO_GRE: 1011 port = htons(ntohl(uli->gre_key) >> 16); 1012 break; 1013 default: 1014 port = 0; /*XXX*/ 1015 } 1016 return port; 1017 } 1018 1019 static __inline__ 1020 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 1021 { 1022 __be16 port; 1023 switch(fl->flowi_proto) { 1024 case IPPROTO_TCP: 1025 case IPPROTO_UDP: 1026 case IPPROTO_UDPLITE: 1027 case IPPROTO_SCTP: 1028 port = uli->ports.dport; 1029 break; 1030 case IPPROTO_ICMP: 1031 case IPPROTO_ICMPV6: 1032 port = htons(uli->icmpt.code); 1033 break; 1034 case IPPROTO_GRE: 1035 port = htons(ntohl(uli->gre_key) & 0xffff); 1036 break; 1037 default: 1038 port = 0; /*XXX*/ 1039 } 1040 return port; 1041 } 1042 1043 bool xfrm_selector_match(const struct xfrm_selector *sel, 1044 const struct flowi *fl, unsigned short family); 1045 1046 #ifdef CONFIG_SECURITY_NETWORK_XFRM 1047 /* If neither has a context --> match 1048 * Otherwise, both must have a context and the sids, doi, alg must match 1049 */ 1050 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1051 { 1052 return ((!s1 && !s2) || 1053 (s1 && s2 && 1054 (s1->ctx_sid == s2->ctx_sid) && 1055 (s1->ctx_doi == s2->ctx_doi) && 1056 (s1->ctx_alg == s2->ctx_alg))); 1057 } 1058 #else 1059 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1060 { 1061 return true; 1062 } 1063 #endif 1064 1065 /* A struct encoding bundle of transformations to apply to some set of flow. 1066 * 1067 * xdst->child points to the next element of bundle. 1068 * dst->xfrm points to an instanse of transformer. 1069 * 1070 * Due to unfortunate limitations of current routing cache, which we 1071 * have no time to fix, it mirrors struct rtable and bound to the same 1072 * routing key, including saddr,daddr. However, we can have many of 1073 * bundles differing by session id. All the bundles grow from a parent 1074 * policy rule. 1075 */ 1076 struct xfrm_dst { 1077 union { 1078 struct dst_entry dst; 1079 struct rtable rt; 1080 struct rt6_info rt6; 1081 } u; 1082 struct dst_entry *route; 1083 struct dst_entry *child; 1084 struct dst_entry *path; 1085 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1086 int num_pols, num_xfrms; 1087 u32 xfrm_genid; 1088 u32 policy_genid; 1089 u32 route_mtu_cached; 1090 u32 child_mtu_cached; 1091 u32 route_cookie; 1092 u32 path_cookie; 1093 }; 1094 1095 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst) 1096 { 1097 #ifdef CONFIG_XFRM 1098 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1099 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst; 1100 1101 return xdst->path; 1102 } 1103 #endif 1104 return (struct dst_entry *) dst; 1105 } 1106 1107 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst) 1108 { 1109 #ifdef CONFIG_XFRM 1110 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1111 struct xfrm_dst *xdst = (struct xfrm_dst *) dst; 1112 return xdst->child; 1113 } 1114 #endif 1115 return NULL; 1116 } 1117 1118 #ifdef CONFIG_XFRM 1119 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child) 1120 { 1121 xdst->child = child; 1122 } 1123 1124 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 1125 { 1126 xfrm_pols_put(xdst->pols, xdst->num_pols); 1127 dst_release(xdst->route); 1128 if (likely(xdst->u.dst.xfrm)) 1129 xfrm_state_put(xdst->u.dst.xfrm); 1130 } 1131 #endif 1132 1133 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 1134 1135 struct xfrm_if_parms { 1136 int link; /* ifindex of underlying L2 interface */ 1137 u32 if_id; /* interface identifier */ 1138 bool collect_md; 1139 }; 1140 1141 struct xfrm_if { 1142 struct xfrm_if __rcu *next; /* next interface in list */ 1143 struct net_device *dev; /* virtual device associated with interface */ 1144 struct net *net; /* netns for packet i/o */ 1145 struct xfrm_if_parms p; /* interface parms */ 1146 1147 struct gro_cells gro_cells; 1148 }; 1149 1150 struct xfrm_offload { 1151 /* Output sequence number for replay protection on offloading. */ 1152 struct { 1153 __u32 low; 1154 __u32 hi; 1155 } seq; 1156 1157 __u32 flags; 1158 #define SA_DELETE_REQ 1 1159 #define CRYPTO_DONE 2 1160 #define CRYPTO_NEXT_DONE 4 1161 #define CRYPTO_FALLBACK 8 1162 #define XFRM_GSO_SEGMENT 16 1163 #define XFRM_GRO 32 1164 /* 64 is free */ 1165 #define XFRM_DEV_RESUME 128 1166 #define XFRM_XMIT 256 1167 1168 __u32 status; 1169 #define CRYPTO_SUCCESS 1 1170 #define CRYPTO_GENERIC_ERROR 2 1171 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 1172 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 1173 #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 1174 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 1175 #define CRYPTO_INVALID_PACKET_SYNTAX 64 1176 #define CRYPTO_INVALID_PROTOCOL 128 1177 1178 /* Used to keep whole l2 header for transport mode GRO */ 1179 __u16 orig_mac_len; 1180 1181 __u8 proto; 1182 __u8 inner_ipproto; 1183 }; 1184 1185 struct sec_path { 1186 struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 1187 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 1188 1189 u8 len; 1190 u8 olen; 1191 u8 verified_cnt; 1192 }; 1193 1194 struct sec_path *secpath_set(struct sk_buff *skb); 1195 1196 static inline void 1197 secpath_reset(struct sk_buff *skb) 1198 { 1199 #ifdef CONFIG_XFRM 1200 skb_ext_del(skb, SKB_EXT_SEC_PATH); 1201 #endif 1202 } 1203 1204 static inline int 1205 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1206 { 1207 switch (family) { 1208 case AF_INET: 1209 return addr->a4 == 0; 1210 case AF_INET6: 1211 return ipv6_addr_any(&addr->in6); 1212 } 1213 return 0; 1214 } 1215 1216 static inline int 1217 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1218 { 1219 return (tmpl->saddr.a4 && 1220 tmpl->saddr.a4 != x->props.saddr.a4); 1221 } 1222 1223 static inline int 1224 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1225 { 1226 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1227 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 1228 } 1229 1230 static inline int 1231 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 1232 { 1233 switch (family) { 1234 case AF_INET: 1235 return __xfrm4_state_addr_cmp(tmpl, x); 1236 case AF_INET6: 1237 return __xfrm6_state_addr_cmp(tmpl, x); 1238 } 1239 return !0; 1240 } 1241 1242 #ifdef CONFIG_XFRM 1243 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 1244 { 1245 struct sec_path *sp = skb_sec_path(skb); 1246 1247 return sp->xvec[sp->len - 1]; 1248 } 1249 #endif 1250 1251 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 1252 { 1253 #ifdef CONFIG_XFRM 1254 struct sec_path *sp = skb_sec_path(skb); 1255 1256 if (!sp || !sp->olen || sp->len != sp->olen) 1257 return NULL; 1258 1259 return &sp->ovec[sp->olen - 1]; 1260 #else 1261 return NULL; 1262 #endif 1263 } 1264 1265 #ifdef CONFIG_XFRM 1266 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1267 unsigned short family); 1268 1269 static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, 1270 int dir) 1271 { 1272 if (!READ_ONCE(net->xfrm.policy_count[dir]) && !secpath_exists(skb)) 1273 return READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_ACCEPT; 1274 1275 return false; 1276 } 1277 1278 static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb, 1279 int dir, unsigned short family) 1280 { 1281 if (dir != XFRM_POLICY_OUT && family == AF_INET) { 1282 /* same dst may be used for traffic originating from 1283 * devices with different policy settings. 1284 */ 1285 return IPCB(skb)->flags & IPSKB_NOPOLICY; 1286 } 1287 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY); 1288 } 1289 1290 static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1291 struct sk_buff *skb, 1292 unsigned int family, int reverse) 1293 { 1294 struct net *net = dev_net(skb->dev); 1295 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1296 struct xfrm_offload *xo = xfrm_offload(skb); 1297 struct xfrm_state *x; 1298 1299 if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1300 return __xfrm_policy_check(sk, ndir, skb, family); 1301 1302 if (xo) { 1303 x = xfrm_input_state(skb); 1304 if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { 1305 bool check = (xo->flags & CRYPTO_DONE) && 1306 (xo->status & CRYPTO_SUCCESS); 1307 1308 /* The packets here are plain ones and secpath was 1309 * needed to indicate that hardware already handled 1310 * them and there is no need to do nothing in addition. 1311 * 1312 * Consume secpath which was set by drivers. 1313 */ 1314 secpath_reset(skb); 1315 return check; 1316 } 1317 } 1318 1319 return __xfrm_check_nopolicy(net, skb, dir) || 1320 __xfrm_check_dev_nopolicy(skb, dir, family) || 1321 __xfrm_policy_check(sk, ndir, skb, family); 1322 } 1323 1324 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1325 { 1326 return __xfrm_policy_check2(sk, dir, skb, family, 0); 1327 } 1328 1329 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1330 { 1331 return xfrm_policy_check(sk, dir, skb, AF_INET); 1332 } 1333 1334 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1335 { 1336 return xfrm_policy_check(sk, dir, skb, AF_INET6); 1337 } 1338 1339 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1340 struct sk_buff *skb) 1341 { 1342 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1343 } 1344 1345 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1346 struct sk_buff *skb) 1347 { 1348 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1349 } 1350 1351 int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1352 unsigned int family, int reverse); 1353 1354 static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1355 unsigned int family) 1356 { 1357 return __xfrm_decode_session(net, skb, fl, family, 0); 1358 } 1359 1360 static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1361 struct flowi *fl, 1362 unsigned int family) 1363 { 1364 return __xfrm_decode_session(net, skb, fl, family, 1); 1365 } 1366 1367 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 1368 1369 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 1370 { 1371 struct net *net = dev_net(skb->dev); 1372 1373 if (!READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]) && 1374 READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]) == XFRM_USERPOLICY_ACCEPT) 1375 return true; 1376 1377 return (skb_dst(skb)->flags & DST_NOXFRM) || 1378 __xfrm_route_forward(skb, family); 1379 } 1380 1381 static inline int xfrm4_route_forward(struct sk_buff *skb) 1382 { 1383 return xfrm_route_forward(skb, AF_INET); 1384 } 1385 1386 static inline int xfrm6_route_forward(struct sk_buff *skb) 1387 { 1388 return xfrm_route_forward(skb, AF_INET6); 1389 } 1390 1391 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 1392 1393 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 1394 { 1395 if (!sk_fullsock(osk)) 1396 return 0; 1397 sk->sk_policy[0] = NULL; 1398 sk->sk_policy[1] = NULL; 1399 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1400 return __xfrm_sk_clone_policy(sk, osk); 1401 return 0; 1402 } 1403 1404 int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 1405 1406 static inline void xfrm_sk_free_policy(struct sock *sk) 1407 { 1408 struct xfrm_policy *pol; 1409 1410 pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1411 if (unlikely(pol != NULL)) { 1412 xfrm_policy_delete(pol, XFRM_POLICY_MAX); 1413 sk->sk_policy[0] = NULL; 1414 } 1415 pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1416 if (unlikely(pol != NULL)) { 1417 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 1418 sk->sk_policy[1] = NULL; 1419 } 1420 } 1421 1422 #else 1423 1424 static inline void xfrm_sk_free_policy(struct sock *sk) {} 1425 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 1426 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 1427 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 1428 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1429 { 1430 return 1; 1431 } 1432 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1433 { 1434 return 1; 1435 } 1436 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1437 { 1438 return 1; 1439 } 1440 static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1441 struct flowi *fl, 1442 unsigned int family) 1443 { 1444 return -ENOSYS; 1445 } 1446 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1447 struct sk_buff *skb) 1448 { 1449 return 1; 1450 } 1451 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1452 struct sk_buff *skb) 1453 { 1454 return 1; 1455 } 1456 #endif 1457 1458 static __inline__ 1459 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 1460 { 1461 switch (family){ 1462 case AF_INET: 1463 return (xfrm_address_t *)&fl->u.ip4.daddr; 1464 case AF_INET6: 1465 return (xfrm_address_t *)&fl->u.ip6.daddr; 1466 } 1467 return NULL; 1468 } 1469 1470 static __inline__ 1471 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 1472 { 1473 switch (family){ 1474 case AF_INET: 1475 return (xfrm_address_t *)&fl->u.ip4.saddr; 1476 case AF_INET6: 1477 return (xfrm_address_t *)&fl->u.ip6.saddr; 1478 } 1479 return NULL; 1480 } 1481 1482 static __inline__ 1483 void xfrm_flowi_addr_get(const struct flowi *fl, 1484 xfrm_address_t *saddr, xfrm_address_t *daddr, 1485 unsigned short family) 1486 { 1487 switch(family) { 1488 case AF_INET: 1489 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 1490 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 1491 break; 1492 case AF_INET6: 1493 saddr->in6 = fl->u.ip6.saddr; 1494 daddr->in6 = fl->u.ip6.daddr; 1495 break; 1496 } 1497 } 1498 1499 static __inline__ int 1500 __xfrm4_state_addr_check(const struct xfrm_state *x, 1501 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1502 { 1503 if (daddr->a4 == x->id.daddr.a4 && 1504 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 1505 return 1; 1506 return 0; 1507 } 1508 1509 static __inline__ int 1510 __xfrm6_state_addr_check(const struct xfrm_state *x, 1511 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1512 { 1513 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1514 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 1515 ipv6_addr_any((struct in6_addr *)saddr) || 1516 ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 1517 return 1; 1518 return 0; 1519 } 1520 1521 static __inline__ int 1522 xfrm_state_addr_check(const struct xfrm_state *x, 1523 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1524 unsigned short family) 1525 { 1526 switch (family) { 1527 case AF_INET: 1528 return __xfrm4_state_addr_check(x, daddr, saddr); 1529 case AF_INET6: 1530 return __xfrm6_state_addr_check(x, daddr, saddr); 1531 } 1532 return 0; 1533 } 1534 1535 static __inline__ int 1536 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1537 unsigned short family) 1538 { 1539 switch (family) { 1540 case AF_INET: 1541 return __xfrm4_state_addr_check(x, 1542 (const xfrm_address_t *)&fl->u.ip4.daddr, 1543 (const xfrm_address_t *)&fl->u.ip4.saddr); 1544 case AF_INET6: 1545 return __xfrm6_state_addr_check(x, 1546 (const xfrm_address_t *)&fl->u.ip6.daddr, 1547 (const xfrm_address_t *)&fl->u.ip6.saddr); 1548 } 1549 return 0; 1550 } 1551 1552 static inline int xfrm_state_kern(const struct xfrm_state *x) 1553 { 1554 return atomic_read(&x->tunnel_users); 1555 } 1556 1557 static inline bool xfrm_id_proto_valid(u8 proto) 1558 { 1559 switch (proto) { 1560 case IPPROTO_AH: 1561 case IPPROTO_ESP: 1562 case IPPROTO_COMP: 1563 #if IS_ENABLED(CONFIG_IPV6) 1564 case IPPROTO_ROUTING: 1565 case IPPROTO_DSTOPTS: 1566 #endif 1567 return true; 1568 default: 1569 return false; 1570 } 1571 } 1572 1573 /* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ 1574 static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 1575 { 1576 return (!userproto || proto == userproto || 1577 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1578 proto == IPPROTO_ESP || 1579 proto == IPPROTO_COMP))); 1580 } 1581 1582 /* 1583 * xfrm algorithm information 1584 */ 1585 struct xfrm_algo_aead_info { 1586 char *geniv; 1587 u16 icv_truncbits; 1588 }; 1589 1590 struct xfrm_algo_auth_info { 1591 u16 icv_truncbits; 1592 u16 icv_fullbits; 1593 }; 1594 1595 struct xfrm_algo_encr_info { 1596 char *geniv; 1597 u16 blockbits; 1598 u16 defkeybits; 1599 }; 1600 1601 struct xfrm_algo_comp_info { 1602 u16 threshold; 1603 }; 1604 1605 struct xfrm_algo_desc { 1606 char *name; 1607 char *compat; 1608 u8 available:1; 1609 u8 pfkey_supported:1; 1610 union { 1611 struct xfrm_algo_aead_info aead; 1612 struct xfrm_algo_auth_info auth; 1613 struct xfrm_algo_encr_info encr; 1614 struct xfrm_algo_comp_info comp; 1615 } uinfo; 1616 struct sadb_alg desc; 1617 }; 1618 1619 /* XFRM protocol handlers. */ 1620 struct xfrm4_protocol { 1621 int (*handler)(struct sk_buff *skb); 1622 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1623 int encap_type); 1624 int (*cb_handler)(struct sk_buff *skb, int err); 1625 int (*err_handler)(struct sk_buff *skb, u32 info); 1626 1627 struct xfrm4_protocol __rcu *next; 1628 int priority; 1629 }; 1630 1631 struct xfrm6_protocol { 1632 int (*handler)(struct sk_buff *skb); 1633 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1634 int encap_type); 1635 int (*cb_handler)(struct sk_buff *skb, int err); 1636 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1637 u8 type, u8 code, int offset, __be32 info); 1638 1639 struct xfrm6_protocol __rcu *next; 1640 int priority; 1641 }; 1642 1643 /* XFRM tunnel handlers. */ 1644 struct xfrm_tunnel { 1645 int (*handler)(struct sk_buff *skb); 1646 int (*cb_handler)(struct sk_buff *skb, int err); 1647 int (*err_handler)(struct sk_buff *skb, u32 info); 1648 1649 struct xfrm_tunnel __rcu *next; 1650 int priority; 1651 }; 1652 1653 struct xfrm6_tunnel { 1654 int (*handler)(struct sk_buff *skb); 1655 int (*cb_handler)(struct sk_buff *skb, int err); 1656 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1657 u8 type, u8 code, int offset, __be32 info); 1658 struct xfrm6_tunnel __rcu *next; 1659 int priority; 1660 }; 1661 1662 void xfrm_init(void); 1663 void xfrm4_init(void); 1664 int xfrm_state_init(struct net *net); 1665 void xfrm_state_fini(struct net *net); 1666 void xfrm4_state_init(void); 1667 void xfrm4_protocol_init(void); 1668 #ifdef CONFIG_XFRM 1669 int xfrm6_init(void); 1670 void xfrm6_fini(void); 1671 int xfrm6_state_init(void); 1672 void xfrm6_state_fini(void); 1673 int xfrm6_protocol_init(void); 1674 void xfrm6_protocol_fini(void); 1675 #else 1676 static inline int xfrm6_init(void) 1677 { 1678 return 0; 1679 } 1680 static inline void xfrm6_fini(void) 1681 { 1682 ; 1683 } 1684 #endif 1685 1686 #ifdef CONFIG_XFRM_STATISTICS 1687 int xfrm_proc_init(struct net *net); 1688 void xfrm_proc_fini(struct net *net); 1689 #endif 1690 1691 int xfrm_sysctl_init(struct net *net); 1692 #ifdef CONFIG_SYSCTL 1693 void xfrm_sysctl_fini(struct net *net); 1694 #else 1695 static inline void xfrm_sysctl_fini(struct net *net) 1696 { 1697 } 1698 #endif 1699 1700 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1701 struct xfrm_address_filter *filter); 1702 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1703 int (*func)(struct xfrm_state *, int, void*), void *); 1704 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1705 struct xfrm_state *xfrm_state_alloc(struct net *net); 1706 void xfrm_state_free(struct xfrm_state *x); 1707 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 1708 const xfrm_address_t *saddr, 1709 const struct flowi *fl, 1710 struct xfrm_tmpl *tmpl, 1711 struct xfrm_policy *pol, int *err, 1712 unsigned short family, u32 if_id); 1713 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, 1714 xfrm_address_t *daddr, 1715 xfrm_address_t *saddr, 1716 unsigned short family, 1717 u8 mode, u8 proto, u32 reqid); 1718 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1719 unsigned short family); 1720 int xfrm_state_check_expire(struct xfrm_state *x); 1721 void xfrm_state_update_stats(struct net *net); 1722 #ifdef CONFIG_XFRM_OFFLOAD 1723 static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) 1724 { 1725 struct xfrm_dev_offload *xdo = &x->xso; 1726 struct net_device *dev = READ_ONCE(xdo->dev); 1727 1728 if (dev && dev->xfrmdev_ops && 1729 dev->xfrmdev_ops->xdo_dev_state_update_stats) 1730 dev->xfrmdev_ops->xdo_dev_state_update_stats(x); 1731 1732 } 1733 #else 1734 static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) {} 1735 #endif 1736 void xfrm_state_insert(struct xfrm_state *x); 1737 int xfrm_state_add(struct xfrm_state *x); 1738 int xfrm_state_update(struct xfrm_state *x); 1739 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1740 const xfrm_address_t *daddr, __be32 spi, 1741 u8 proto, unsigned short family); 1742 struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, 1743 const xfrm_address_t *daddr, 1744 __be32 spi, u8 proto, 1745 unsigned short family); 1746 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1747 const xfrm_address_t *daddr, 1748 const xfrm_address_t *saddr, 1749 u8 proto, 1750 unsigned short family); 1751 #ifdef CONFIG_XFRM_SUB_POLICY 1752 void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1753 unsigned short family); 1754 void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1755 unsigned short family); 1756 #else 1757 static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s, 1758 int n, unsigned short family) 1759 { 1760 } 1761 1762 static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s, 1763 int n, unsigned short family) 1764 { 1765 } 1766 #endif 1767 1768 struct xfrmk_sadinfo { 1769 u32 sadhcnt; /* current hash bkts */ 1770 u32 sadhmcnt; /* max allowed hash bkts */ 1771 u32 sadcnt; /* current running count */ 1772 }; 1773 1774 struct xfrmk_spdinfo { 1775 u32 incnt; 1776 u32 outcnt; 1777 u32 fwdcnt; 1778 u32 inscnt; 1779 u32 outscnt; 1780 u32 fwdscnt; 1781 u32 spdhcnt; 1782 u32 spdhmcnt; 1783 }; 1784 1785 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num); 1786 int xfrm_state_delete(struct xfrm_state *x); 1787 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1788 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1789 int xfrm_dev_policy_flush(struct net *net, struct net_device *dev, 1790 bool task_valid); 1791 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1792 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1793 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1794 int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack); 1795 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); 1796 int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); 1797 int xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); 1798 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1799 int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1800 int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, 1801 int (*finish)(struct net *, struct sock *, 1802 struct sk_buff *)); 1803 int xfrm_trans_queue(struct sk_buff *skb, 1804 int (*finish)(struct net *, struct sock *, 1805 struct sk_buff *)); 1806 int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err); 1807 int xfrm_output(struct sock *sk, struct sk_buff *skb); 1808 int xfrm4_tunnel_check_size(struct sk_buff *skb); 1809 #if IS_ENABLED(CONFIG_IPV6) 1810 int xfrm6_tunnel_check_size(struct sk_buff *skb); 1811 #else 1812 static inline int xfrm6_tunnel_check_size(struct sk_buff *skb) 1813 { 1814 return -EMSGSIZE; 1815 } 1816 #endif 1817 1818 #if IS_ENABLED(CONFIG_NET_PKTGEN) 1819 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb); 1820 #endif 1821 1822 void xfrm_local_error(struct sk_buff *skb, int mtu); 1823 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1824 int encap_type); 1825 int xfrm4_transport_finish(struct sk_buff *skb, int async); 1826 int xfrm4_rcv(struct sk_buff *skb); 1827 1828 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1829 { 1830 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 1831 XFRM_SPI_SKB_CB(skb)->family = AF_INET; 1832 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 1833 return xfrm_input(skb, nexthdr, spi, 0); 1834 } 1835 1836 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1837 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 1838 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1839 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1840 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1841 void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1842 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 1843 struct ip6_tnl *t); 1844 int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1845 int encap_type); 1846 int xfrm6_transport_finish(struct sk_buff *skb, int async); 1847 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1848 int xfrm6_rcv(struct sk_buff *skb); 1849 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1850 xfrm_address_t *saddr, u8 proto); 1851 void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 1852 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 1853 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1854 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 1855 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1856 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1857 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1858 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1859 1860 #ifdef CONFIG_XFRM 1861 void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu); 1862 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1863 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1864 struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1865 struct sk_buff *skb); 1866 struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1867 struct sk_buff *skb); 1868 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, 1869 int optlen); 1870 #else 1871 static inline int xfrm_user_policy(struct sock *sk, int optname, 1872 sockptr_t optval, int optlen) 1873 { 1874 return -ENOPROTOOPT; 1875 } 1876 #endif 1877 1878 struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params); 1879 1880 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 1881 1882 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1883 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1884 int (*func)(struct xfrm_policy *, int, int, void*), 1885 void *); 1886 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 1887 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 1888 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, 1889 const struct xfrm_mark *mark, 1890 u32 if_id, u8 type, int dir, 1891 struct xfrm_selector *sel, 1892 struct xfrm_sec_ctx *ctx, int delete, 1893 int *err); 1894 struct xfrm_policy *xfrm_policy_byid(struct net *net, 1895 const struct xfrm_mark *mark, u32 if_id, 1896 u8 type, int dir, u32 id, int delete, 1897 int *err); 1898 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1899 void xfrm_policy_hash_rebuild(struct net *net); 1900 u32 xfrm_get_acqseq(void); 1901 int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack); 1902 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi, 1903 struct netlink_ext_ack *extack); 1904 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1905 u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, 1906 const xfrm_address_t *daddr, 1907 const xfrm_address_t *saddr, int create, 1908 unsigned short family); 1909 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1910 1911 #ifdef CONFIG_XFRM_MIGRATE 1912 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1913 const struct xfrm_migrate *m, int num_bundles, 1914 const struct xfrm_kmaddress *k, struct net *net, 1915 const struct xfrm_encap_tmpl *encap); 1916 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, 1917 u32 if_id); 1918 struct xfrm_state *xfrm_state_migrate_create(struct xfrm_state *x, 1919 const struct xfrm_migrate *m, 1920 struct net *net, 1921 struct netlink_ext_ack *extack); 1922 int xfrm_state_migrate_install(const struct xfrm_state *x, 1923 struct xfrm_state *xc, 1924 const struct xfrm_migrate *m, 1925 struct netlink_ext_ack *extack); 1926 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1927 struct xfrm_migrate *m, 1928 struct net *net, 1929 struct netlink_ext_ack *extack); 1930 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1931 struct xfrm_migrate *m, int num_bundles, 1932 struct xfrm_kmaddress *k, struct net *net, 1933 struct xfrm_encap_tmpl *encap, u32 if_id, 1934 struct netlink_ext_ack *extack, 1935 struct xfrm_user_offload *xuo); 1936 #endif 1937 1938 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1939 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1940 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1941 xfrm_address_t *addr); 1942 1943 void xfrm_input_init(void); 1944 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1945 1946 void xfrm_probe_algs(void); 1947 int xfrm_count_pfkey_auth_supported(void); 1948 int xfrm_count_pfkey_enc_supported(void); 1949 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1950 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1951 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1952 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1953 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1954 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1955 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1956 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1957 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 1958 int probe); 1959 1960 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1961 const xfrm_address_t *b) 1962 { 1963 return ipv6_addr_equal((const struct in6_addr *)a, 1964 (const struct in6_addr *)b); 1965 } 1966 1967 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 1968 const xfrm_address_t *b, 1969 sa_family_t family) 1970 { 1971 switch (family) { 1972 default: 1973 case AF_INET: 1974 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 1975 case AF_INET6: 1976 return xfrm6_addr_equal(a, b); 1977 } 1978 } 1979 1980 static inline int xfrm_policy_id2dir(u32 index) 1981 { 1982 return index & 7; 1983 } 1984 1985 #ifdef CONFIG_XFRM 1986 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq); 1987 int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1988 void xfrm_replay_notify(struct xfrm_state *x, int event); 1989 int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb); 1990 int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1991 1992 static inline int xfrm_aevent_is_on(struct net *net) 1993 { 1994 struct sock *nlsk; 1995 int ret = 0; 1996 1997 rcu_read_lock(); 1998 nlsk = rcu_dereference(net->xfrm.nlsk); 1999 if (nlsk) 2000 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 2001 rcu_read_unlock(); 2002 return ret; 2003 } 2004 2005 static inline int xfrm_acquire_is_on(struct net *net) 2006 { 2007 struct sock *nlsk; 2008 int ret = 0; 2009 2010 rcu_read_lock(); 2011 nlsk = rcu_dereference(net->xfrm.nlsk); 2012 if (nlsk) 2013 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 2014 rcu_read_unlock(); 2015 2016 return ret; 2017 } 2018 #endif 2019 2020 static inline unsigned int aead_len(struct xfrm_algo_aead *alg) 2021 { 2022 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2023 } 2024 2025 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg) 2026 { 2027 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2028 } 2029 2030 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 2031 { 2032 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2033 } 2034 2035 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 2036 { 2037 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 2038 } 2039 2040 #ifdef CONFIG_XFRM_MIGRATE 2041 static inline int xfrm_replay_clone(struct xfrm_state *x, 2042 const struct xfrm_state *orig) 2043 { 2044 /* Counters synced later in xfrm_replay_sync() */ 2045 2046 x->replay = orig->replay; 2047 x->preplay = orig->preplay; 2048 2049 if (orig->replay_esn) { 2050 x->replay_esn = kmemdup(orig->replay_esn, 2051 xfrm_replay_state_esn_len(orig->replay_esn), 2052 GFP_KERNEL); 2053 if (!x->replay_esn) 2054 return -ENOMEM; 2055 x->preplay_esn = kmemdup(orig->preplay_esn, 2056 xfrm_replay_state_esn_len(orig->preplay_esn), 2057 GFP_KERNEL); 2058 if (!x->preplay_esn) 2059 return -ENOMEM; 2060 } 2061 2062 return 0; 2063 } 2064 2065 static inline void xfrm_replay_sync(struct xfrm_state *x, const struct xfrm_state *orig) 2066 { 2067 x->replay = orig->replay; 2068 x->preplay = orig->preplay; 2069 2070 if (orig->replay_esn) { 2071 memcpy(x->replay_esn, orig->replay_esn, 2072 xfrm_replay_state_esn_len(orig->replay_esn)); 2073 2074 memcpy(x->preplay_esn, orig->preplay_esn, 2075 xfrm_replay_state_esn_len(orig->preplay_esn)); 2076 } 2077 } 2078 2079 static inline void xfrm_migrate_sync(struct xfrm_state *x, 2080 const struct xfrm_state *orig) 2081 { 2082 /* called under lock so no race conditions or mallocs allowed */ 2083 memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); 2084 xfrm_replay_sync(x, orig); 2085 } 2086 2087 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 2088 { 2089 return kmemdup(orig, aead_len(orig), GFP_KERNEL); 2090 } 2091 2092 2093 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 2094 { 2095 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 2096 } 2097 2098 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 2099 { 2100 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 2101 } 2102 2103 static inline void xfrm_states_put(struct xfrm_state **states, int n) 2104 { 2105 int i; 2106 for (i = 0; i < n; i++) 2107 xfrm_state_put(*(states + i)); 2108 } 2109 2110 static inline void xfrm_states_delete(struct xfrm_state **states, int n) 2111 { 2112 int i; 2113 for (i = 0; i < n; i++) 2114 xfrm_state_delete(*(states + i)); 2115 } 2116 #endif 2117 2118 void __init xfrm_dev_init(void); 2119 2120 #ifdef CONFIG_XFRM_OFFLOAD 2121 void xfrm_dev_resume(struct sk_buff *skb); 2122 void xfrm_dev_backlog(struct softnet_data *sd); 2123 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again); 2124 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 2125 const struct xfrm_user_offload *xuo, 2126 struct netlink_ext_ack *extack); 2127 int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2128 struct xfrm_user_offload *xuo, u8 dir, 2129 struct netlink_ext_ack *extack); 2130 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 2131 void xfrm_dev_state_delete(struct xfrm_state *x); 2132 void xfrm_dev_state_free(struct xfrm_state *x); 2133 2134 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2135 { 2136 struct xfrm_dev_offload *xso = &x->xso; 2137 struct net_device *dev = READ_ONCE(xso->dev); 2138 2139 if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn) 2140 dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); 2141 } 2142 2143 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2144 { 2145 struct xfrm_state *x = dst->xfrm; 2146 struct xfrm_dst *xdst; 2147 2148 if (!x || !x->type_offload) 2149 return false; 2150 2151 xdst = (struct xfrm_dst *) dst; 2152 if (!x->xso.offload_handle && !xdst->child->xfrm) 2153 return true; 2154 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) && 2155 !xdst->child->xfrm) 2156 return true; 2157 2158 return false; 2159 } 2160 2161 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2162 { 2163 struct xfrm_dev_offload *xdo = &x->xdo; 2164 struct net_device *dev = xdo->dev; 2165 2166 if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete) 2167 dev->xfrmdev_ops->xdo_dev_policy_delete(x); 2168 } 2169 2170 static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2171 { 2172 struct xfrm_dev_offload *xdo = &x->xdo; 2173 struct net_device *dev = xdo->dev; 2174 2175 if (dev && dev->xfrmdev_ops) { 2176 if (dev->xfrmdev_ops->xdo_dev_policy_free) 2177 dev->xfrmdev_ops->xdo_dev_policy_free(x); 2178 xdo->dev = NULL; 2179 netdev_put(dev, &xdo->dev_tracker); 2180 } 2181 } 2182 #else 2183 static inline void xfrm_dev_resume(struct sk_buff *skb) 2184 { 2185 } 2186 2187 static inline void xfrm_dev_backlog(struct softnet_data *sd) 2188 { 2189 } 2190 2191 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again) 2192 { 2193 return skb; 2194 } 2195 2196 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 2197 const struct xfrm_user_offload *xuo, 2198 struct netlink_ext_ack *extack) 2199 { 2200 return 0; 2201 } 2202 2203 static inline void xfrm_dev_state_delete(struct xfrm_state *x) 2204 { 2205 } 2206 2207 static inline void xfrm_dev_state_free(struct xfrm_state *x) 2208 { 2209 } 2210 2211 static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2212 struct xfrm_user_offload *xuo, u8 dir, 2213 struct netlink_ext_ack *extack) 2214 { 2215 return 0; 2216 } 2217 2218 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2219 { 2220 } 2221 2222 static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2223 { 2224 } 2225 2226 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 2227 { 2228 return false; 2229 } 2230 2231 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2232 { 2233 } 2234 2235 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2236 { 2237 return false; 2238 } 2239 #endif 2240 2241 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 2242 { 2243 if (attrs[XFRMA_MARK]) 2244 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 2245 else 2246 m->v = m->m = 0; 2247 2248 return m->v & m->m; 2249 } 2250 2251 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 2252 { 2253 int ret = 0; 2254 2255 if (m->m | m->v) 2256 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 2257 return ret; 2258 } 2259 2260 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x) 2261 { 2262 struct xfrm_mark *m = &x->props.smark; 2263 2264 return (m->v & m->m) | (mark & ~m->m); 2265 } 2266 2267 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id) 2268 { 2269 int ret = 0; 2270 2271 if (if_id) 2272 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id); 2273 return ret; 2274 } 2275 2276 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 2277 unsigned int family) 2278 { 2279 bool tunnel = false; 2280 2281 switch(family) { 2282 case AF_INET: 2283 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 2284 tunnel = true; 2285 break; 2286 case AF_INET6: 2287 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 2288 tunnel = true; 2289 break; 2290 } 2291 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL)) 2292 return -EINVAL; 2293 2294 return 0; 2295 } 2296 2297 extern const int xfrm_msg_min[XFRM_NR_MSGTYPES]; 2298 extern const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 2299 2300 struct xfrm_translator { 2301 /* Allocate frag_list and put compat translation there */ 2302 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src); 2303 2304 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */ 2305 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh, 2306 int maxtype, const struct nla_policy *policy, 2307 struct netlink_ext_ack *extack); 2308 2309 /* Translate 32-bit user_policy from sockptr */ 2310 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen); 2311 2312 struct module *owner; 2313 }; 2314 2315 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT) 2316 extern int xfrm_register_translator(struct xfrm_translator *xtr); 2317 extern int xfrm_unregister_translator(struct xfrm_translator *xtr); 2318 extern struct xfrm_translator *xfrm_get_translator(void); 2319 extern void xfrm_put_translator(struct xfrm_translator *xtr); 2320 #else 2321 static inline struct xfrm_translator *xfrm_get_translator(void) 2322 { 2323 return NULL; 2324 } 2325 static inline void xfrm_put_translator(struct xfrm_translator *xtr) 2326 { 2327 } 2328 #endif 2329 2330 #if IS_ENABLED(CONFIG_IPV6) 2331 static inline bool xfrm6_local_dontfrag(const struct sock *sk) 2332 { 2333 int proto; 2334 2335 if (!sk || sk->sk_family != AF_INET6) 2336 return false; 2337 2338 proto = sk->sk_protocol; 2339 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 2340 return inet6_test_bit(DONTFRAG, sk); 2341 2342 return false; 2343 } 2344 #endif 2345 2346 #if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ 2347 (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) 2348 2349 extern struct metadata_dst __percpu *xfrm_bpf_md_dst; 2350 2351 int register_xfrm_interface_bpf(void); 2352 2353 #else 2354 2355 static inline int register_xfrm_interface_bpf(void) 2356 { 2357 return 0; 2358 } 2359 2360 #endif 2361 2362 #if IS_ENABLED(CONFIG_DEBUG_INFO_BTF) 2363 int register_xfrm_state_bpf(void); 2364 #else 2365 static inline int register_xfrm_state_bpf(void) 2366 { 2367 return 0; 2368 } 2369 #endif 2370 2371 int xfrm_nat_keepalive_init(unsigned short family); 2372 void xfrm_nat_keepalive_fini(unsigned short family); 2373 int xfrm_nat_keepalive_net_init(struct net *net); 2374 int xfrm_nat_keepalive_net_fini(struct net *net); 2375 void xfrm_nat_keepalive_state_updated(struct xfrm_state *x); 2376 2377 #endif /* _NET_XFRM_H */ 2378