1 #ifndef _NET_XFRM_H 2 #define _NET_XFRM_H 3 4 #include <linux/compiler.h> 5 #include <linux/in.h> 6 #include <linux/xfrm.h> 7 #include <linux/spinlock.h> 8 #include <linux/list.h> 9 #include <linux/skbuff.h> 10 #include <linux/socket.h> 11 #include <linux/crypto.h> 12 #include <linux/pfkeyv2.h> 13 #include <linux/in6.h> 14 #include <linux/mutex.h> 15 16 #include <net/sock.h> 17 #include <net/dst.h> 18 #include <net/route.h> 19 #include <net/ipv6.h> 20 #include <net/ip6_fib.h> 21 22 #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 23 #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 24 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 25 26 extern struct sock *xfrm_nl; 27 extern u32 sysctl_xfrm_aevent_etime; 28 extern u32 sysctl_xfrm_aevent_rseqth; 29 30 extern struct mutex xfrm_cfg_mutex; 31 32 /* Organization of SPD aka "XFRM rules" 33 ------------------------------------ 34 35 Basic objects: 36 - policy rule, struct xfrm_policy (=SPD entry) 37 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 38 - instance of a transformer, struct xfrm_state (=SA) 39 - template to clone xfrm_state, struct xfrm_tmpl 40 41 SPD is plain linear list of xfrm_policy rules, ordered by priority. 42 (To be compatible with existing pfkeyv2 implementations, 43 many rules with priority of 0x7fffffff are allowed to exist and 44 such rules are ordered in an unpredictable way, thanks to bsd folks.) 45 46 Lookup is plain linear search until the first match with selector. 47 48 If "action" is "block", then we prohibit the flow, otherwise: 49 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 50 policy entry has list of up to XFRM_MAX_DEPTH transformations, 51 described by templates xfrm_tmpl. Each template is resolved 52 to a complete xfrm_state (see below) and we pack bundle of transformations 53 to a dst_entry returned to requestor. 54 55 dst -. xfrm .-> xfrm_state #1 56 |---. child .-> dst -. xfrm .-> xfrm_state #2 57 |---. child .-> dst -. xfrm .-> xfrm_state #3 58 |---. child .-> NULL 59 60 Bundles are cached at xrfm_policy struct (field ->bundles). 61 62 63 Resolution of xrfm_tmpl 64 ----------------------- 65 Template contains: 66 1. ->mode Mode: transport or tunnel 67 2. ->id.proto Protocol: AH/ESP/IPCOMP 68 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 69 Q: allow to resolve security gateway? 70 4. ->id.spi If not zero, static SPI. 71 5. ->saddr Local tunnel endpoint, ignored for transport mode. 72 6. ->algos List of allowed algos. Plain bitmask now. 73 Q: ealgos, aalgos, calgos. What a mess... 74 7. ->share Sharing mode. 75 Q: how to implement private sharing mode? To add struct sock* to 76 flow id? 77 78 Having this template we search through SAD searching for entries 79 with appropriate mode/proto/algo, permitted by selector. 80 If no appropriate entry found, it is requested from key manager. 81 82 PROBLEMS: 83 Q: How to find all the bundles referring to a physical path for 84 PMTU discovery? Seems, dst should contain list of all parents... 85 and enter to infinite locking hierarchy disaster. 86 No! It is easier, we will not search for them, let them find us. 87 We add genid to each dst plus pointer to genid of raw IP route, 88 pmtu disc will update pmtu on raw IP route and increase its genid. 89 dst_check() will see this for top level and trigger resyncing 90 metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 91 */ 92 93 /* Full description of state of transformer. */ 94 struct xfrm_state 95 { 96 /* Note: bydst is re-used during gc */ 97 struct list_head bydst; 98 struct list_head byspi; 99 100 atomic_t refcnt; 101 spinlock_t lock; 102 103 struct xfrm_id id; 104 struct xfrm_selector sel; 105 106 /* Key manger bits */ 107 struct { 108 u8 state; 109 u8 dying; 110 u32 seq; 111 } km; 112 113 /* Parameters of this state. */ 114 struct { 115 u32 reqid; 116 u8 mode; 117 u8 replay_window; 118 u8 aalgo, ealgo, calgo; 119 u8 flags; 120 u16 family; 121 xfrm_address_t saddr; 122 int header_len; 123 int trailer_len; 124 } props; 125 126 struct xfrm_lifetime_cfg lft; 127 128 /* Data for transformer */ 129 struct xfrm_algo *aalg; 130 struct xfrm_algo *ealg; 131 struct xfrm_algo *calg; 132 133 /* Data for encapsulator */ 134 struct xfrm_encap_tmpl *encap; 135 136 /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 137 struct xfrm_state *tunnel; 138 139 /* If a tunnel, number of users + 1 */ 140 atomic_t tunnel_users; 141 142 /* State for replay detection */ 143 struct xfrm_replay_state replay; 144 145 /* Replay detection state at the time we sent the last notification */ 146 struct xfrm_replay_state preplay; 147 148 /* internal flag that only holds state for delayed aevent at the 149 * moment 150 */ 151 u32 xflags; 152 153 /* Replay detection notification settings */ 154 u32 replay_maxage; 155 u32 replay_maxdiff; 156 157 /* Replay detection notification timer */ 158 struct timer_list rtimer; 159 160 /* Statistics */ 161 struct xfrm_stats stats; 162 163 struct xfrm_lifetime_cur curlft; 164 struct timer_list timer; 165 166 /* Reference to data common to all the instances of this 167 * transformer. */ 168 struct xfrm_type *type; 169 struct xfrm_mode *mode; 170 171 /* Security context */ 172 struct xfrm_sec_ctx *security; 173 174 /* Private data of this transformer, format is opaque, 175 * interpreted by xfrm_type methods. */ 176 void *data; 177 }; 178 179 /* xflags - make enum if more show up */ 180 #define XFRM_TIME_DEFER 1 181 182 enum { 183 XFRM_STATE_VOID, 184 XFRM_STATE_ACQ, 185 XFRM_STATE_VALID, 186 XFRM_STATE_ERROR, 187 XFRM_STATE_EXPIRED, 188 XFRM_STATE_DEAD 189 }; 190 191 /* callback structure passed from either netlink or pfkey */ 192 struct km_event 193 { 194 union { 195 u32 hard; 196 u32 proto; 197 u32 byid; 198 u32 aevent; 199 } data; 200 201 u32 seq; 202 u32 pid; 203 u32 event; 204 }; 205 206 struct xfrm_type; 207 struct xfrm_dst; 208 struct xfrm_policy_afinfo { 209 unsigned short family; 210 struct xfrm_type *type_map[IPPROTO_MAX]; 211 struct xfrm_mode *mode_map[XFRM_MODE_MAX]; 212 struct dst_ops *dst_ops; 213 void (*garbage_collect)(void); 214 int (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl); 215 struct dst_entry *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy); 216 int (*bundle_create)(struct xfrm_policy *policy, 217 struct xfrm_state **xfrm, 218 int nx, 219 struct flowi *fl, 220 struct dst_entry **dst_p); 221 void (*decode_session)(struct sk_buff *skb, 222 struct flowi *fl); 223 }; 224 225 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo); 226 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo); 227 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c); 228 extern void km_state_notify(struct xfrm_state *x, struct km_event *c); 229 #define XFRM_ACQ_EXPIRES 30 230 231 struct xfrm_tmpl; 232 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol); 233 extern void km_state_expired(struct xfrm_state *x, int hard, u32 pid); 234 extern int __xfrm_state_delete(struct xfrm_state *x); 235 236 struct xfrm_state_afinfo { 237 unsigned short family; 238 struct list_head *state_bydst; 239 struct list_head *state_byspi; 240 int (*init_flags)(struct xfrm_state *x); 241 void (*init_tempsel)(struct xfrm_state *x, struct flowi *fl, 242 struct xfrm_tmpl *tmpl, 243 xfrm_address_t *daddr, xfrm_address_t *saddr); 244 struct xfrm_state *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto); 245 struct xfrm_state *(*find_acq)(u8 mode, u32 reqid, u8 proto, 246 xfrm_address_t *daddr, xfrm_address_t *saddr, 247 int create); 248 }; 249 250 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 251 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 252 253 extern void xfrm_state_delete_tunnel(struct xfrm_state *x); 254 255 struct xfrm_type 256 { 257 char *description; 258 struct module *owner; 259 __u8 proto; 260 261 int (*init_state)(struct xfrm_state *x); 262 void (*destructor)(struct xfrm_state *); 263 int (*input)(struct xfrm_state *, struct sk_buff *skb); 264 int (*output)(struct xfrm_state *, struct sk_buff *pskb); 265 /* Estimate maximal size of result of transformation of a dgram */ 266 u32 (*get_max_size)(struct xfrm_state *, int size); 267 }; 268 269 extern int xfrm_register_type(struct xfrm_type *type, unsigned short family); 270 extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family); 271 extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family); 272 extern void xfrm_put_type(struct xfrm_type *type); 273 274 struct xfrm_mode { 275 int (*input)(struct xfrm_state *x, struct sk_buff *skb); 276 int (*output)(struct sk_buff *skb); 277 278 struct module *owner; 279 unsigned int encap; 280 }; 281 282 extern int xfrm_register_mode(struct xfrm_mode *mode, int family); 283 extern int xfrm_unregister_mode(struct xfrm_mode *mode, int family); 284 extern struct xfrm_mode *xfrm_get_mode(unsigned int encap, int family); 285 extern void xfrm_put_mode(struct xfrm_mode *mode); 286 287 struct xfrm_tmpl 288 { 289 /* id in template is interpreted as: 290 * daddr - destination of tunnel, may be zero for transport mode. 291 * spi - zero to acquire spi. Not zero if spi is static, then 292 * daddr must be fixed too. 293 * proto - AH/ESP/IPCOMP 294 */ 295 struct xfrm_id id; 296 297 /* Source address of tunnel. Ignored, if it is not a tunnel. */ 298 xfrm_address_t saddr; 299 300 __u32 reqid; 301 302 /* Mode: transport/tunnel */ 303 __u8 mode; 304 305 /* Sharing mode: unique, this session only, this user only etc. */ 306 __u8 share; 307 308 /* May skip this transfomration if no SA is found */ 309 __u8 optional; 310 311 /* Bit mask of algos allowed for acquisition */ 312 __u32 aalgos; 313 __u32 ealgos; 314 __u32 calgos; 315 }; 316 317 #define XFRM_MAX_DEPTH 4 318 319 struct xfrm_policy 320 { 321 struct xfrm_policy *next; 322 struct list_head list; 323 324 /* This lock only affects elements except for entry. */ 325 rwlock_t lock; 326 atomic_t refcnt; 327 struct timer_list timer; 328 329 u32 priority; 330 u32 index; 331 struct xfrm_selector selector; 332 struct xfrm_lifetime_cfg lft; 333 struct xfrm_lifetime_cur curlft; 334 struct dst_entry *bundles; 335 __u16 family; 336 __u8 action; 337 __u8 flags; 338 __u8 dead; 339 __u8 xfrm_nr; 340 struct xfrm_sec_ctx *security; 341 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 342 }; 343 344 #define XFRM_KM_TIMEOUT 30 345 /* which seqno */ 346 #define XFRM_REPLAY_SEQ 1 347 #define XFRM_REPLAY_OSEQ 2 348 #define XFRM_REPLAY_SEQ_MASK 3 349 /* what happened */ 350 #define XFRM_REPLAY_UPDATE XFRM_AE_CR 351 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 352 353 /* default aevent timeout in units of 100ms */ 354 #define XFRM_AE_ETIME 10 355 /* Async Event timer multiplier */ 356 #define XFRM_AE_ETH_M 10 357 /* default seq threshold size */ 358 #define XFRM_AE_SEQT_SIZE 2 359 360 struct xfrm_mgr 361 { 362 struct list_head list; 363 char *id; 364 int (*notify)(struct xfrm_state *x, struct km_event *c); 365 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir); 366 struct xfrm_policy *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir); 367 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport); 368 int (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c); 369 }; 370 371 extern int xfrm_register_km(struct xfrm_mgr *km); 372 extern int xfrm_unregister_km(struct xfrm_mgr *km); 373 374 375 extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2]; 376 377 static inline void xfrm_pol_hold(struct xfrm_policy *policy) 378 { 379 if (likely(policy != NULL)) 380 atomic_inc(&policy->refcnt); 381 } 382 383 extern void __xfrm_policy_destroy(struct xfrm_policy *policy); 384 385 static inline void xfrm_pol_put(struct xfrm_policy *policy) 386 { 387 if (atomic_dec_and_test(&policy->refcnt)) 388 __xfrm_policy_destroy(policy); 389 } 390 391 #define XFRM_DST_HSIZE 1024 392 393 static __inline__ 394 unsigned __xfrm4_dst_hash(xfrm_address_t *addr) 395 { 396 unsigned h; 397 h = ntohl(addr->a4); 398 h = (h ^ (h>>16)) % XFRM_DST_HSIZE; 399 return h; 400 } 401 402 static __inline__ 403 unsigned __xfrm6_dst_hash(xfrm_address_t *addr) 404 { 405 unsigned h; 406 h = ntohl(addr->a6[2]^addr->a6[3]); 407 h = (h ^ (h>>16)) % XFRM_DST_HSIZE; 408 return h; 409 } 410 411 static __inline__ 412 unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family) 413 { 414 switch (family) { 415 case AF_INET: 416 return __xfrm4_dst_hash(addr); 417 case AF_INET6: 418 return __xfrm6_dst_hash(addr); 419 } 420 return 0; 421 } 422 423 static __inline__ 424 unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto) 425 { 426 unsigned h; 427 h = ntohl(addr->a4^spi^proto); 428 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE; 429 return h; 430 } 431 432 static __inline__ 433 unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto) 434 { 435 unsigned h; 436 h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto); 437 h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE; 438 return h; 439 } 440 441 static __inline__ 442 unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family) 443 { 444 switch (family) { 445 case AF_INET: 446 return __xfrm4_spi_hash(addr, spi, proto); 447 case AF_INET6: 448 return __xfrm6_spi_hash(addr, spi, proto); 449 } 450 return 0; /*XXX*/ 451 } 452 453 extern void __xfrm_state_destroy(struct xfrm_state *); 454 455 static inline void __xfrm_state_put(struct xfrm_state *x) 456 { 457 atomic_dec(&x->refcnt); 458 } 459 460 static inline void xfrm_state_put(struct xfrm_state *x) 461 { 462 if (atomic_dec_and_test(&x->refcnt)) 463 __xfrm_state_destroy(x); 464 } 465 466 static inline void xfrm_state_hold(struct xfrm_state *x) 467 { 468 atomic_inc(&x->refcnt); 469 } 470 471 static __inline__ int addr_match(void *token1, void *token2, int prefixlen) 472 { 473 __u32 *a1 = token1; 474 __u32 *a2 = token2; 475 int pdw; 476 int pbi; 477 478 pdw = prefixlen >> 5; /* num of whole __u32 in prefix */ 479 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 480 481 if (pdw) 482 if (memcmp(a1, a2, pdw << 2)) 483 return 0; 484 485 if (pbi) { 486 __u32 mask; 487 488 mask = htonl((0xffffffff) << (32 - pbi)); 489 490 if ((a1[pdw] ^ a2[pdw]) & mask) 491 return 0; 492 } 493 494 return 1; 495 } 496 497 static __inline__ 498 u16 xfrm_flowi_sport(struct flowi *fl) 499 { 500 u16 port; 501 switch(fl->proto) { 502 case IPPROTO_TCP: 503 case IPPROTO_UDP: 504 case IPPROTO_SCTP: 505 port = fl->fl_ip_sport; 506 break; 507 case IPPROTO_ICMP: 508 case IPPROTO_ICMPV6: 509 port = htons(fl->fl_icmp_type); 510 break; 511 default: 512 port = 0; /*XXX*/ 513 } 514 return port; 515 } 516 517 static __inline__ 518 u16 xfrm_flowi_dport(struct flowi *fl) 519 { 520 u16 port; 521 switch(fl->proto) { 522 case IPPROTO_TCP: 523 case IPPROTO_UDP: 524 case IPPROTO_SCTP: 525 port = fl->fl_ip_dport; 526 break; 527 case IPPROTO_ICMP: 528 case IPPROTO_ICMPV6: 529 port = htons(fl->fl_icmp_code); 530 break; 531 default: 532 port = 0; /*XXX*/ 533 } 534 return port; 535 } 536 537 static inline int 538 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl) 539 { 540 return addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) && 541 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) && 542 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 543 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 544 (fl->proto == sel->proto || !sel->proto) && 545 (fl->oif == sel->ifindex || !sel->ifindex); 546 } 547 548 static inline int 549 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl) 550 { 551 return addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) && 552 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) && 553 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) && 554 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) && 555 (fl->proto == sel->proto || !sel->proto) && 556 (fl->oif == sel->ifindex || !sel->ifindex); 557 } 558 559 static inline int 560 xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl, 561 unsigned short family) 562 { 563 switch (family) { 564 case AF_INET: 565 return __xfrm4_selector_match(sel, fl); 566 case AF_INET6: 567 return __xfrm6_selector_match(sel, fl); 568 } 569 return 0; 570 } 571 572 #ifdef CONFIG_SECURITY_NETWORK_XFRM 573 /* If neither has a context --> match 574 * Otherwise, both must have a context and the sids, doi, alg must match 575 */ 576 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 577 { 578 return ((!s1 && !s2) || 579 (s1 && s2 && 580 (s1->ctx_sid == s2->ctx_sid) && 581 (s1->ctx_doi == s2->ctx_doi) && 582 (s1->ctx_alg == s2->ctx_alg))); 583 } 584 #else 585 static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 586 { 587 return 1; 588 } 589 #endif 590 591 /* A struct encoding bundle of transformations to apply to some set of flow. 592 * 593 * dst->child points to the next element of bundle. 594 * dst->xfrm points to an instanse of transformer. 595 * 596 * Due to unfortunate limitations of current routing cache, which we 597 * have no time to fix, it mirrors struct rtable and bound to the same 598 * routing key, including saddr,daddr. However, we can have many of 599 * bundles differing by session id. All the bundles grow from a parent 600 * policy rule. 601 */ 602 struct xfrm_dst 603 { 604 union { 605 struct xfrm_dst *next; 606 struct dst_entry dst; 607 struct rtable rt; 608 struct rt6_info rt6; 609 } u; 610 struct dst_entry *route; 611 u32 route_mtu_cached; 612 u32 child_mtu_cached; 613 u32 route_cookie; 614 u32 path_cookie; 615 }; 616 617 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 618 { 619 dst_release(xdst->route); 620 if (likely(xdst->u.dst.xfrm)) 621 xfrm_state_put(xdst->u.dst.xfrm); 622 } 623 624 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 625 626 struct sec_path 627 { 628 atomic_t refcnt; 629 int len; 630 struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 631 }; 632 633 static inline struct sec_path * 634 secpath_get(struct sec_path *sp) 635 { 636 if (sp) 637 atomic_inc(&sp->refcnt); 638 return sp; 639 } 640 641 extern void __secpath_destroy(struct sec_path *sp); 642 643 static inline void 644 secpath_put(struct sec_path *sp) 645 { 646 if (sp && atomic_dec_and_test(&sp->refcnt)) 647 __secpath_destroy(sp); 648 } 649 650 extern struct sec_path *secpath_dup(struct sec_path *src); 651 652 static inline void 653 secpath_reset(struct sk_buff *skb) 654 { 655 #ifdef CONFIG_XFRM 656 secpath_put(skb->sp); 657 skb->sp = NULL; 658 #endif 659 } 660 661 static inline int 662 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 663 { 664 return (tmpl->saddr.a4 && 665 tmpl->saddr.a4 != x->props.saddr.a4); 666 } 667 668 static inline int 669 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x) 670 { 671 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 672 ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 673 } 674 675 static inline int 676 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family) 677 { 678 switch (family) { 679 case AF_INET: 680 return __xfrm4_state_addr_cmp(tmpl, x); 681 case AF_INET6: 682 return __xfrm6_state_addr_cmp(tmpl, x); 683 } 684 return !0; 685 } 686 687 #ifdef CONFIG_XFRM 688 689 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family); 690 691 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 692 { 693 if (sk && sk->sk_policy[XFRM_POLICY_IN]) 694 return __xfrm_policy_check(sk, dir, skb, family); 695 696 return (!xfrm_policy_list[dir] && !skb->sp) || 697 (skb->dst->flags & DST_NOPOLICY) || 698 __xfrm_policy_check(sk, dir, skb, family); 699 } 700 701 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 702 { 703 return xfrm_policy_check(sk, dir, skb, AF_INET); 704 } 705 706 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 707 { 708 return xfrm_policy_check(sk, dir, skb, AF_INET6); 709 } 710 711 extern int xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family); 712 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 713 714 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 715 { 716 return !xfrm_policy_list[XFRM_POLICY_OUT] || 717 (skb->dst->flags & DST_NOXFRM) || 718 __xfrm_route_forward(skb, family); 719 } 720 721 static inline int xfrm4_route_forward(struct sk_buff *skb) 722 { 723 return xfrm_route_forward(skb, AF_INET); 724 } 725 726 static inline int xfrm6_route_forward(struct sk_buff *skb) 727 { 728 return xfrm_route_forward(skb, AF_INET6); 729 } 730 731 extern int __xfrm_sk_clone_policy(struct sock *sk); 732 733 static inline int xfrm_sk_clone_policy(struct sock *sk) 734 { 735 if (unlikely(sk->sk_policy[0] || sk->sk_policy[1])) 736 return __xfrm_sk_clone_policy(sk); 737 return 0; 738 } 739 740 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 741 742 static inline void xfrm_sk_free_policy(struct sock *sk) 743 { 744 if (unlikely(sk->sk_policy[0] != NULL)) { 745 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX); 746 sk->sk_policy[0] = NULL; 747 } 748 if (unlikely(sk->sk_policy[1] != NULL)) { 749 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1); 750 sk->sk_policy[1] = NULL; 751 } 752 } 753 754 #else 755 756 static inline void xfrm_sk_free_policy(struct sock *sk) {} 757 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; } 758 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 759 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 760 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 761 { 762 return 1; 763 } 764 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 765 { 766 return 1; 767 } 768 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 769 { 770 return 1; 771 } 772 #endif 773 774 static __inline__ 775 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family) 776 { 777 switch (family){ 778 case AF_INET: 779 return (xfrm_address_t *)&fl->fl4_dst; 780 case AF_INET6: 781 return (xfrm_address_t *)&fl->fl6_dst; 782 } 783 return NULL; 784 } 785 786 static __inline__ 787 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family) 788 { 789 switch (family){ 790 case AF_INET: 791 return (xfrm_address_t *)&fl->fl4_src; 792 case AF_INET6: 793 return (xfrm_address_t *)&fl->fl6_src; 794 } 795 return NULL; 796 } 797 798 static __inline__ int 799 __xfrm4_state_addr_check(struct xfrm_state *x, 800 xfrm_address_t *daddr, xfrm_address_t *saddr) 801 { 802 if (daddr->a4 == x->id.daddr.a4 && 803 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 804 return 1; 805 return 0; 806 } 807 808 static __inline__ int 809 __xfrm6_state_addr_check(struct xfrm_state *x, 810 xfrm_address_t *daddr, xfrm_address_t *saddr) 811 { 812 if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 813 (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)|| 814 ipv6_addr_any((struct in6_addr *)saddr) || 815 ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 816 return 1; 817 return 0; 818 } 819 820 static __inline__ int 821 xfrm_state_addr_check(struct xfrm_state *x, 822 xfrm_address_t *daddr, xfrm_address_t *saddr, 823 unsigned short family) 824 { 825 switch (family) { 826 case AF_INET: 827 return __xfrm4_state_addr_check(x, daddr, saddr); 828 case AF_INET6: 829 return __xfrm6_state_addr_check(x, daddr, saddr); 830 } 831 return 0; 832 } 833 834 static inline int xfrm_state_kern(struct xfrm_state *x) 835 { 836 return atomic_read(&x->tunnel_users); 837 } 838 839 /* 840 * xfrm algorithm information 841 */ 842 struct xfrm_algo_auth_info { 843 u16 icv_truncbits; 844 u16 icv_fullbits; 845 }; 846 847 struct xfrm_algo_encr_info { 848 u16 blockbits; 849 u16 defkeybits; 850 }; 851 852 struct xfrm_algo_comp_info { 853 u16 threshold; 854 }; 855 856 struct xfrm_algo_desc { 857 char *name; 858 u8 available:1; 859 union { 860 struct xfrm_algo_auth_info auth; 861 struct xfrm_algo_encr_info encr; 862 struct xfrm_algo_comp_info comp; 863 } uinfo; 864 struct sadb_alg desc; 865 }; 866 867 /* XFRM tunnel handlers. */ 868 struct xfrm_tunnel { 869 int (*handler)(struct sk_buff *skb); 870 int (*err_handler)(struct sk_buff *skb, __u32 info); 871 872 struct xfrm_tunnel *next; 873 int priority; 874 }; 875 876 struct xfrm6_tunnel { 877 int (*handler)(struct sk_buff *skb); 878 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 879 int type, int code, int offset, __u32 info); 880 881 struct xfrm6_tunnel *next; 882 int priority; 883 }; 884 885 extern void xfrm_init(void); 886 extern void xfrm4_init(void); 887 extern void xfrm6_init(void); 888 extern void xfrm6_fini(void); 889 extern void xfrm_state_init(void); 890 extern void xfrm4_state_init(void); 891 extern void xfrm6_state_init(void); 892 extern void xfrm6_state_fini(void); 893 894 extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *); 895 extern struct xfrm_state *xfrm_state_alloc(void); 896 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 897 struct flowi *fl, struct xfrm_tmpl *tmpl, 898 struct xfrm_policy *pol, int *err, 899 unsigned short family); 900 extern int xfrm_state_check_expire(struct xfrm_state *x); 901 extern void xfrm_state_insert(struct xfrm_state *x); 902 extern int xfrm_state_add(struct xfrm_state *x); 903 extern int xfrm_state_update(struct xfrm_state *x); 904 extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family); 905 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq); 906 extern int xfrm_state_delete(struct xfrm_state *x); 907 extern void xfrm_state_flush(u8 proto); 908 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq); 909 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq); 910 extern void xfrm_replay_notify(struct xfrm_state *x, int event); 911 extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb); 912 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu); 913 extern int xfrm_init_state(struct xfrm_state *x); 914 extern int xfrm4_rcv(struct sk_buff *skb); 915 extern int xfrm4_output(struct sk_buff *skb); 916 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler); 917 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler); 918 extern int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi); 919 extern int xfrm6_rcv(struct sk_buff **pskb); 920 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler); 921 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler); 922 extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr); 923 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr); 924 extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr); 925 extern int xfrm6_output(struct sk_buff *skb); 926 927 #ifdef CONFIG_XFRM 928 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type); 929 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen); 930 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family); 931 #else 932 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen) 933 { 934 return -ENOPROTOOPT; 935 } 936 937 static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type) 938 { 939 /* should not happen */ 940 kfree_skb(skb); 941 return 0; 942 } 943 static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family) 944 { 945 return -EINVAL; 946 } 947 #endif 948 949 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp); 950 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *); 951 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 952 struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel, 953 struct xfrm_sec_ctx *ctx, int delete); 954 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete); 955 void xfrm_policy_flush(void); 956 u32 xfrm_get_acqseq(void); 957 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); 958 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 959 xfrm_address_t *daddr, xfrm_address_t *saddr, 960 int create, unsigned short family); 961 extern void xfrm_policy_flush(void); 962 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 963 extern int xfrm_flush_bundles(void); 964 extern void xfrm_flush_all_bundles(void); 965 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family); 966 extern void xfrm_init_pmtu(struct dst_entry *dst); 967 968 extern wait_queue_head_t km_waitq; 969 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport); 970 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 pid); 971 972 extern void xfrm_input_init(void); 973 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq); 974 975 extern void xfrm_probe_algs(void); 976 extern int xfrm_count_auth_supported(void); 977 extern int xfrm_count_enc_supported(void); 978 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 979 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 980 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 981 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 982 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 983 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe); 984 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe); 985 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe); 986 987 struct crypto_tfm; 988 typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int); 989 990 extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm, 991 int offset, int len, icv_update_fn_t icv_update); 992 993 static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b, 994 int family) 995 { 996 switch (family) { 997 default: 998 case AF_INET: 999 return a->a4 - b->a4; 1000 case AF_INET6: 1001 return ipv6_addr_cmp((struct in6_addr *)a, 1002 (struct in6_addr *)b); 1003 } 1004 } 1005 1006 static inline int xfrm_policy_id2dir(u32 index) 1007 { 1008 return index & 7; 1009 } 1010 1011 static inline int xfrm_aevent_is_on(void) 1012 { 1013 struct sock *nlsk; 1014 int ret = 0; 1015 1016 rcu_read_lock(); 1017 nlsk = rcu_dereference(xfrm_nl); 1018 if (nlsk) 1019 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1020 rcu_read_unlock(); 1021 return ret; 1022 } 1023 1024 static inline void xfrm_aevent_doreplay(struct xfrm_state *x) 1025 { 1026 if (xfrm_aevent_is_on()) 1027 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); 1028 } 1029 1030 1031 #endif /* _NET_XFRM_H */ 1032