1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _NET_XFRM_H 3 #define _NET_XFRM_H 4 5 #include <linux/compiler.h> 6 #include <linux/xfrm.h> 7 #include <linux/spinlock.h> 8 #include <linux/list.h> 9 #include <linux/skbuff.h> 10 #include <linux/socket.h> 11 #include <linux/pfkeyv2.h> 12 #include <linux/ipsec.h> 13 #include <linux/in6.h> 14 #include <linux/mutex.h> 15 #include <linux/audit.h> 16 #include <linux/slab.h> 17 #include <linux/refcount.h> 18 #include <linux/sockptr.h> 19 20 #include <net/sock.h> 21 #include <net/dst.h> 22 #include <net/inet_dscp.h> 23 #include <net/ip.h> 24 #include <net/route.h> 25 #include <net/ipv6.h> 26 #include <net/ip6_fib.h> 27 #include <net/flow.h> 28 #include <net/gro_cells.h> 29 30 #include <linux/interrupt.h> 31 32 #ifdef CONFIG_XFRM_STATISTICS 33 #include <net/snmp.h> 34 #endif 35 36 #define XFRM_PROTO_ESP 50 37 #define XFRM_PROTO_AH 51 38 #define XFRM_PROTO_COMP 108 39 #define XFRM_PROTO_IPIP 4 40 #define XFRM_PROTO_IPV6 41 41 #define XFRM_PROTO_IPTFS IPPROTO_AGGFRAG 42 #define XFRM_PROTO_ROUTING IPPROTO_ROUTING 43 #define XFRM_PROTO_DSTOPTS IPPROTO_DSTOPTS 44 45 #define XFRM_ALIGN4(len) (((len) + 3) & ~3) 46 #define XFRM_ALIGN8(len) (((len) + 7) & ~7) 47 #define MODULE_ALIAS_XFRM_MODE(family, encap) \ 48 MODULE_ALIAS("xfrm-mode-" __stringify(family) "-" __stringify(encap)) 49 #define MODULE_ALIAS_XFRM_TYPE(family, proto) \ 50 MODULE_ALIAS("xfrm-type-" __stringify(family) "-" __stringify(proto)) 51 #define MODULE_ALIAS_XFRM_OFFLOAD_TYPE(family, proto) \ 52 MODULE_ALIAS("xfrm-offload-" __stringify(family) "-" __stringify(proto)) 53 54 #ifdef CONFIG_XFRM_STATISTICS 55 #define XFRM_INC_STATS(net, field) SNMP_INC_STATS((net)->mib.xfrm_statistics, field) 56 #define XFRM_ADD_STATS(net, field, val) SNMP_ADD_STATS((net)->mib.xfrm_statistics, field, val) 57 #else 58 #define XFRM_INC_STATS(net, field) ((void)(net)) 59 #define XFRM_ADD_STATS(net, field, val) ((void)(net)) 60 #endif 61 62 63 /* Organization of SPD aka "XFRM rules" 64 ------------------------------------ 65 66 Basic objects: 67 - policy rule, struct xfrm_policy (=SPD entry) 68 - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle) 69 - instance of a transformer, struct xfrm_state (=SA) 70 - template to clone xfrm_state, struct xfrm_tmpl 71 72 SPD is organized as hash table (for policies that meet minimum address prefix 73 length setting, net->xfrm.policy_hthresh). Other policies are stored in 74 lists, sorted into rbtree ordered by destination and source address networks. 75 See net/xfrm/xfrm_policy.c for details. 76 77 (To be compatible with existing pfkeyv2 implementations, 78 many rules with priority of 0x7fffffff are allowed to exist and 79 such rules are ordered in an unpredictable way, thanks to bsd folks.) 80 81 If "action" is "block", then we prohibit the flow, otherwise: 82 if "xfrms_nr" is zero, the flow passes untransformed. Otherwise, 83 policy entry has list of up to XFRM_MAX_DEPTH transformations, 84 described by templates xfrm_tmpl. Each template is resolved 85 to a complete xfrm_state (see below) and we pack bundle of transformations 86 to a dst_entry returned to requester. 87 88 dst -. xfrm .-> xfrm_state #1 89 |---. child .-> dst -. xfrm .-> xfrm_state #2 90 |---. child .-> dst -. xfrm .-> xfrm_state #3 91 |---. child .-> NULL 92 93 94 Resolution of xrfm_tmpl 95 ----------------------- 96 Template contains: 97 1. ->mode Mode: transport or tunnel 98 2. ->id.proto Protocol: AH/ESP/IPCOMP 99 3. ->id.daddr Remote tunnel endpoint, ignored for transport mode. 100 Q: allow to resolve security gateway? 101 4. ->id.spi If not zero, static SPI. 102 5. ->saddr Local tunnel endpoint, ignored for transport mode. 103 6. ->algos List of allowed algos. Plain bitmask now. 104 Q: ealgos, aalgos, calgos. What a mess... 105 7. ->share Sharing mode. 106 Q: how to implement private sharing mode? To add struct sock* to 107 flow id? 108 109 Having this template we search through SAD searching for entries 110 with appropriate mode/proto/algo, permitted by selector. 111 If no appropriate entry found, it is requested from key manager. 112 113 PROBLEMS: 114 Q: How to find all the bundles referring to a physical path for 115 PMTU discovery? Seems, dst should contain list of all parents... 116 and enter to infinite locking hierarchy disaster. 117 No! It is easier, we will not search for them, let them find us. 118 We add genid to each dst plus pointer to genid of raw IP route, 119 pmtu disc will update pmtu on raw IP route and increase its genid. 120 dst_check() will see this for top level and trigger resyncing 121 metrics. Plus, it will be made via sk->sk_dst_cache. Solved. 122 */ 123 124 struct xfrm_state_walk { 125 struct list_head all; 126 u8 state; 127 u8 dying; 128 u8 proto; 129 u32 seq; 130 struct xfrm_address_filter *filter; 131 }; 132 133 enum { 134 XFRM_DEV_OFFLOAD_IN = 1, 135 XFRM_DEV_OFFLOAD_OUT, 136 XFRM_DEV_OFFLOAD_FWD, 137 }; 138 139 enum { 140 XFRM_DEV_OFFLOAD_UNSPECIFIED, 141 XFRM_DEV_OFFLOAD_CRYPTO, 142 XFRM_DEV_OFFLOAD_PACKET, 143 }; 144 145 enum { 146 XFRM_DEV_OFFLOAD_FLAG_ACQ = 1, 147 }; 148 149 struct xfrm_dev_offload { 150 /* The device for this offload. 151 * Device drivers should not use this directly, as that will prevent 152 * them from working with bonding device. Instead, the device passed 153 * to the add/delete callbacks should be used. 154 */ 155 struct net_device *dev; 156 netdevice_tracker dev_tracker; 157 /* This is a private pointer used by the bonding driver (and eventually 158 * should be moved there). Device drivers should not use it. 159 * Protected by xfrm_state.lock AND bond.ipsec_lock in most cases, 160 * except in the .xdo_dev_state_del() flow, where only xfrm_state.lock 161 * is held. 162 */ 163 struct net_device *real_dev; 164 unsigned long offload_handle; 165 u8 dir : 2; 166 u8 type : 2; 167 u8 flags : 2; 168 }; 169 170 struct xfrm_mode { 171 u8 encap; 172 u8 family; 173 u8 flags; 174 }; 175 176 /* Flags for xfrm_mode. */ 177 enum { 178 XFRM_MODE_FLAG_TUNNEL = 1, 179 }; 180 181 enum xfrm_replay_mode { 182 XFRM_REPLAY_MODE_LEGACY, 183 XFRM_REPLAY_MODE_BMP, 184 XFRM_REPLAY_MODE_ESN, 185 }; 186 187 /* Full description of state of transformer. */ 188 struct xfrm_state { 189 possible_net_t xs_net; 190 union { 191 struct hlist_node gclist; 192 struct hlist_node bydst; 193 }; 194 union { 195 struct hlist_node dev_gclist; 196 struct hlist_node bysrc; 197 }; 198 struct hlist_node byspi; 199 struct hlist_node byseq; 200 struct hlist_node state_cache; 201 struct hlist_node state_cache_input; 202 203 refcount_t refcnt; 204 spinlock_t lock; 205 206 u32 pcpu_num; 207 struct xfrm_id id; 208 struct xfrm_selector sel; 209 struct xfrm_mark mark; 210 u32 if_id; 211 u32 tfcpad; 212 213 u32 genid; 214 215 /* Key manager bits */ 216 struct xfrm_state_walk km; 217 218 /* Parameters of this state. */ 219 struct { 220 u32 reqid; 221 u8 mode; 222 u8 replay_window; 223 u8 aalgo, ealgo, calgo; 224 u8 flags; 225 u16 family; 226 xfrm_address_t saddr; 227 int header_len; 228 int enc_hdr_len; 229 int trailer_len; 230 u32 extra_flags; 231 struct xfrm_mark smark; 232 } props; 233 234 struct xfrm_lifetime_cfg lft; 235 236 /* Data for transformer */ 237 struct xfrm_algo_auth *aalg; 238 struct xfrm_algo *ealg; 239 struct xfrm_algo *calg; 240 struct xfrm_algo_aead *aead; 241 const char *geniv; 242 243 /* mapping change rate limiting */ 244 __be16 new_mapping_sport; 245 u32 new_mapping; /* seconds */ 246 u32 mapping_maxage; /* seconds for input SA */ 247 248 /* Data for encapsulator */ 249 struct xfrm_encap_tmpl *encap; 250 251 /* NAT keepalive */ 252 u32 nat_keepalive_interval; /* seconds */ 253 time64_t nat_keepalive_expiration; 254 255 /* Data for care-of address */ 256 xfrm_address_t *coaddr; 257 258 /* IPComp needs an IPIP tunnel for handling uncompressed packets */ 259 struct xfrm_state *tunnel; 260 261 /* If a tunnel, number of users + 1 */ 262 atomic_t tunnel_users; 263 264 /* State for replay detection */ 265 struct xfrm_replay_state replay; 266 struct xfrm_replay_state_esn *replay_esn; 267 268 /* Replay detection state at the time we sent the last notification */ 269 struct xfrm_replay_state preplay; 270 struct xfrm_replay_state_esn *preplay_esn; 271 272 /* replay detection mode */ 273 enum xfrm_replay_mode repl_mode; 274 /* internal flag that only holds state for delayed aevent at the 275 * moment 276 */ 277 u32 xflags; 278 279 /* Replay detection notification settings */ 280 u32 replay_maxage; 281 u32 replay_maxdiff; 282 283 /* Replay detection notification timer */ 284 struct timer_list rtimer; 285 286 /* Statistics */ 287 struct xfrm_stats stats; 288 289 struct xfrm_lifetime_cur curlft; 290 struct hrtimer mtimer; 291 292 struct xfrm_dev_offload xso; 293 294 /* used to fix curlft->add_time when changing date */ 295 long saved_tmo; 296 297 /* Last used time */ 298 time64_t lastused; 299 300 struct page_frag xfrag; 301 302 /* Reference to data common to all the instances of this 303 * transformer. */ 304 const struct xfrm_type *type; 305 struct xfrm_mode inner_mode; 306 struct xfrm_mode inner_mode_iaf; 307 struct xfrm_mode outer_mode; 308 309 const struct xfrm_type_offload *type_offload; 310 311 /* Security context */ 312 struct xfrm_sec_ctx *security; 313 314 /* Private data of this transformer, format is opaque, 315 * interpreted by xfrm_type methods. */ 316 void *data; 317 u8 dir; 318 319 const struct xfrm_mode_cbs *mode_cbs; 320 void *mode_data; 321 }; 322 323 static inline struct net *xs_net(struct xfrm_state *x) 324 { 325 return read_pnet(&x->xs_net); 326 } 327 328 /* xflags - make enum if more show up */ 329 #define XFRM_TIME_DEFER 1 330 #define XFRM_SOFT_EXPIRE 2 331 332 enum { 333 XFRM_STATE_VOID, 334 XFRM_STATE_ACQ, 335 XFRM_STATE_VALID, 336 XFRM_STATE_ERROR, 337 XFRM_STATE_EXPIRED, 338 XFRM_STATE_DEAD 339 }; 340 341 /* callback structure passed from either netlink or pfkey */ 342 struct km_event { 343 union { 344 u32 hard; 345 u32 proto; 346 u32 byid; 347 u32 aevent; 348 u32 type; 349 } data; 350 351 u32 seq; 352 u32 portid; 353 u32 event; 354 struct net *net; 355 }; 356 357 struct xfrm_if_decode_session_result { 358 struct net *net; 359 u32 if_id; 360 }; 361 362 struct xfrm_if_cb { 363 bool (*decode_session)(struct sk_buff *skb, 364 unsigned short family, 365 struct xfrm_if_decode_session_result *res); 366 }; 367 368 void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb); 369 void xfrm_if_unregister_cb(void); 370 371 struct xfrm_dst_lookup_params { 372 struct net *net; 373 dscp_t dscp; 374 int oif; 375 xfrm_address_t *saddr; 376 xfrm_address_t *daddr; 377 u32 mark; 378 __u8 ipproto; 379 union flowi_uli uli; 380 }; 381 382 struct net_device; 383 struct xfrm_type; 384 struct xfrm_dst; 385 struct xfrm_policy_afinfo { 386 struct dst_ops *dst_ops; 387 struct dst_entry *(*dst_lookup)(const struct xfrm_dst_lookup_params *params); 388 int (*get_saddr)(xfrm_address_t *saddr, 389 const struct xfrm_dst_lookup_params *params); 390 int (*fill_dst)(struct xfrm_dst *xdst, 391 struct net_device *dev, 392 const struct flowi *fl); 393 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig); 394 }; 395 396 int xfrm_policy_register_afinfo(const struct xfrm_policy_afinfo *afinfo, int family); 397 void xfrm_policy_unregister_afinfo(const struct xfrm_policy_afinfo *afinfo); 398 void km_policy_notify(struct xfrm_policy *xp, int dir, 399 const struct km_event *c); 400 void km_state_notify(struct xfrm_state *x, const struct km_event *c); 401 402 struct xfrm_tmpl; 403 int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, 404 struct xfrm_policy *pol); 405 void km_state_expired(struct xfrm_state *x, int hard, u32 portid); 406 int __xfrm_state_delete(struct xfrm_state *x); 407 408 struct xfrm_state_afinfo { 409 u8 family; 410 u8 proto; 411 412 const struct xfrm_type_offload *type_offload_esp; 413 414 const struct xfrm_type *type_esp; 415 const struct xfrm_type *type_ipip; 416 const struct xfrm_type *type_ipip6; 417 const struct xfrm_type *type_comp; 418 const struct xfrm_type *type_ah; 419 const struct xfrm_type *type_routing; 420 const struct xfrm_type *type_dstopts; 421 422 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 423 int (*transport_finish)(struct sk_buff *skb, 424 int async); 425 void (*local_error)(struct sk_buff *skb, u32 mtu); 426 }; 427 428 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo); 429 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo); 430 struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family); 431 struct xfrm_state_afinfo *xfrm_state_afinfo_get_rcu(unsigned int family); 432 433 struct xfrm_input_afinfo { 434 u8 family; 435 bool is_ipip; 436 int (*callback)(struct sk_buff *skb, u8 protocol, 437 int err); 438 }; 439 440 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 441 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo); 442 443 void xfrm_flush_gc(void); 444 445 struct xfrm_type { 446 struct module *owner; 447 u8 proto; 448 u8 flags; 449 #define XFRM_TYPE_NON_FRAGMENT 1 450 #define XFRM_TYPE_REPLAY_PROT 2 451 #define XFRM_TYPE_LOCAL_COADDR 4 452 #define XFRM_TYPE_REMOTE_COADDR 8 453 454 int (*init_state)(struct xfrm_state *x, 455 struct netlink_ext_ack *extack); 456 void (*destructor)(struct xfrm_state *); 457 int (*input)(struct xfrm_state *, struct sk_buff *skb); 458 int (*output)(struct xfrm_state *, struct sk_buff *pskb); 459 int (*reject)(struct xfrm_state *, struct sk_buff *, 460 const struct flowi *); 461 }; 462 463 int xfrm_register_type(const struct xfrm_type *type, unsigned short family); 464 void xfrm_unregister_type(const struct xfrm_type *type, unsigned short family); 465 466 struct xfrm_type_offload { 467 struct module *owner; 468 u8 proto; 469 void (*encap)(struct xfrm_state *, struct sk_buff *pskb); 470 int (*input_tail)(struct xfrm_state *x, struct sk_buff *skb); 471 int (*xmit)(struct xfrm_state *, struct sk_buff *pskb, netdev_features_t features); 472 }; 473 474 int xfrm_register_type_offload(const struct xfrm_type_offload *type, unsigned short family); 475 void xfrm_unregister_type_offload(const struct xfrm_type_offload *type, unsigned short family); 476 void xfrm_set_type_offload(struct xfrm_state *x, bool try_load); 477 static inline void xfrm_unset_type_offload(struct xfrm_state *x) 478 { 479 if (!x->type_offload) 480 return; 481 482 module_put(x->type_offload->owner); 483 x->type_offload = NULL; 484 } 485 486 /** 487 * struct xfrm_mode_cbs - XFRM mode callbacks 488 * @owner: module owner or NULL 489 * @init_state: Add/init mode specific state in `xfrm_state *x` 490 * @clone_state: Copy mode specific values from `orig` to new state `x` 491 * @destroy_state: Cleanup mode specific state from `xfrm_state *x` 492 * @user_init: Process mode specific netlink attributes from user 493 * @copy_to_user: Add netlink attributes to `attrs` based on state in `x` 494 * @sa_len: Return space required to store mode specific netlink attributes 495 * @get_inner_mtu: Return avail payload space after removing encap overhead 496 * @input: Process received packet from SA using mode 497 * @output: Output given packet using mode 498 * @prepare_output: Add mode specific encapsulation to packet in skb. On return 499 * `transport_header` should point at ESP header, `network_header` should 500 * point at outer IP header and `mac_header` should opint at the 501 * protocol/nexthdr field of the outer IP. 502 * 503 * One should examine and understand the specific uses of these callbacks in 504 * xfrm for further detail on how and when these functions are called. RTSL. 505 */ 506 struct xfrm_mode_cbs { 507 struct module *owner; 508 int (*init_state)(struct xfrm_state *x); 509 int (*clone_state)(struct xfrm_state *x, struct xfrm_state *orig); 510 void (*destroy_state)(struct xfrm_state *x); 511 int (*user_init)(struct net *net, struct xfrm_state *x, 512 struct nlattr **attrs, 513 struct netlink_ext_ack *extack); 514 int (*copy_to_user)(struct xfrm_state *x, struct sk_buff *skb); 515 unsigned int (*sa_len)(const struct xfrm_state *x); 516 u32 (*get_inner_mtu)(struct xfrm_state *x, int outer_mtu); 517 int (*input)(struct xfrm_state *x, struct sk_buff *skb); 518 int (*output)(struct net *net, struct sock *sk, struct sk_buff *skb); 519 int (*prepare_output)(struct xfrm_state *x, struct sk_buff *skb); 520 }; 521 522 int xfrm_register_mode_cbs(u8 mode, const struct xfrm_mode_cbs *mode_cbs); 523 void xfrm_unregister_mode_cbs(u8 mode); 524 525 static inline int xfrm_af2proto(unsigned int family) 526 { 527 switch(family) { 528 case AF_INET: 529 return IPPROTO_IPIP; 530 case AF_INET6: 531 return IPPROTO_IPV6; 532 default: 533 return 0; 534 } 535 } 536 537 static inline const struct xfrm_mode *xfrm_ip2inner_mode(struct xfrm_state *x, int ipproto) 538 { 539 if ((x->sel.family != AF_UNSPEC) || 540 (ipproto == IPPROTO_IPIP && x->props.family == AF_INET) || 541 (ipproto == IPPROTO_IPV6 && x->props.family == AF_INET6)) 542 return &x->inner_mode; 543 else 544 return &x->inner_mode_iaf; 545 } 546 547 struct xfrm_tmpl { 548 /* id in template is interpreted as: 549 * daddr - destination of tunnel, may be zero for transport mode. 550 * spi - zero to acquire spi. Not zero if spi is static, then 551 * daddr must be fixed too. 552 * proto - AH/ESP/IPCOMP 553 */ 554 struct xfrm_id id; 555 556 /* Source address of tunnel. Ignored, if it is not a tunnel. */ 557 xfrm_address_t saddr; 558 559 unsigned short encap_family; 560 561 u32 reqid; 562 563 /* Mode: transport, tunnel etc. */ 564 u8 mode; 565 566 /* Sharing mode: unique, this session only, this user only etc. */ 567 u8 share; 568 569 /* May skip this transfomration if no SA is found */ 570 u8 optional; 571 572 /* Skip aalgos/ealgos/calgos checks. */ 573 u8 allalgs; 574 575 /* Bit mask of algos allowed for acquisition */ 576 u32 aalgos; 577 u32 ealgos; 578 u32 calgos; 579 }; 580 581 #define XFRM_MAX_DEPTH 6 582 #define XFRM_MAX_OFFLOAD_DEPTH 1 583 584 struct xfrm_policy_walk_entry { 585 struct list_head all; 586 u8 dead; 587 }; 588 589 struct xfrm_policy_walk { 590 struct xfrm_policy_walk_entry walk; 591 u8 type; 592 u32 seq; 593 }; 594 595 struct xfrm_policy_queue { 596 struct sk_buff_head hold_queue; 597 struct timer_list hold_timer; 598 unsigned long timeout; 599 }; 600 601 /** 602 * struct xfrm_policy - xfrm policy 603 * @xp_net: network namespace the policy lives in 604 * @bydst: hlist node for SPD hash table or rbtree list 605 * @byidx: hlist node for index hash table 606 * @state_cache_list: hlist head for policy cached xfrm states 607 * @lock: serialize changes to policy structure members 608 * @refcnt: reference count, freed once it reaches 0 609 * @pos: kernel internal tie-breaker to determine age of policy 610 * @timer: timer 611 * @genid: generation, used to invalidate old policies 612 * @priority: priority, set by userspace 613 * @index: policy index (autogenerated) 614 * @if_id: virtual xfrm interface id 615 * @mark: packet mark 616 * @selector: selector 617 * @lft: liftime configuration data 618 * @curlft: liftime state 619 * @walk: list head on pernet policy list 620 * @polq: queue to hold packets while aqcuire operaion in progress 621 * @bydst_reinsert: policy tree node needs to be merged 622 * @type: XFRM_POLICY_TYPE_MAIN or _SUB 623 * @action: XFRM_POLICY_ALLOW or _BLOCK 624 * @flags: XFRM_POLICY_LOCALOK, XFRM_POLICY_ICMP 625 * @xfrm_nr: number of used templates in @xfrm_vec 626 * @family: protocol family 627 * @security: SELinux security label 628 * @xfrm_vec: array of templates to resolve state 629 * @rcu: rcu head, used to defer memory release 630 * @xdo: hardware offload state 631 */ 632 struct xfrm_policy { 633 possible_net_t xp_net; 634 struct hlist_node bydst; 635 struct hlist_node byidx; 636 637 struct hlist_head state_cache_list; 638 639 /* This lock only affects elements except for entry. */ 640 rwlock_t lock; 641 refcount_t refcnt; 642 u32 pos; 643 struct timer_list timer; 644 645 atomic_t genid; 646 u32 priority; 647 u32 index; 648 u32 if_id; 649 struct xfrm_mark mark; 650 struct xfrm_selector selector; 651 struct xfrm_lifetime_cfg lft; 652 struct xfrm_lifetime_cur curlft; 653 struct xfrm_policy_walk_entry walk; 654 struct xfrm_policy_queue polq; 655 bool bydst_reinsert; 656 u8 type; 657 u8 action; 658 u8 flags; 659 u8 xfrm_nr; 660 u16 family; 661 struct xfrm_sec_ctx *security; 662 struct xfrm_tmpl xfrm_vec[XFRM_MAX_DEPTH]; 663 struct rcu_head rcu; 664 665 struct xfrm_dev_offload xdo; 666 }; 667 668 static inline struct net *xp_net(const struct xfrm_policy *xp) 669 { 670 return read_pnet(&xp->xp_net); 671 } 672 673 struct xfrm_kmaddress { 674 xfrm_address_t local; 675 xfrm_address_t remote; 676 u32 reserved; 677 u16 family; 678 }; 679 680 struct xfrm_migrate { 681 xfrm_address_t old_daddr; 682 xfrm_address_t old_saddr; 683 xfrm_address_t new_daddr; 684 xfrm_address_t new_saddr; 685 u8 proto; 686 u8 mode; 687 u16 reserved; 688 u32 reqid; 689 u16 old_family; 690 u16 new_family; 691 }; 692 693 #define XFRM_KM_TIMEOUT 30 694 /* what happened */ 695 #define XFRM_REPLAY_UPDATE XFRM_AE_CR 696 #define XFRM_REPLAY_TIMEOUT XFRM_AE_CE 697 698 /* default aevent timeout in units of 100ms */ 699 #define XFRM_AE_ETIME 10 700 /* Async Event timer multiplier */ 701 #define XFRM_AE_ETH_M 10 702 /* default seq threshold size */ 703 #define XFRM_AE_SEQT_SIZE 2 704 705 struct xfrm_mgr { 706 struct list_head list; 707 int (*notify)(struct xfrm_state *x, const struct km_event *c); 708 int (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp); 709 struct xfrm_policy *(*compile_policy)(struct sock *sk, int opt, u8 *data, int len, int *dir); 710 int (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 711 int (*notify_policy)(struct xfrm_policy *x, int dir, const struct km_event *c); 712 int (*report)(struct net *net, u8 proto, struct xfrm_selector *sel, xfrm_address_t *addr); 713 int (*migrate)(const struct xfrm_selector *sel, 714 u8 dir, u8 type, 715 const struct xfrm_migrate *m, 716 int num_bundles, 717 const struct xfrm_kmaddress *k, 718 struct net *net, 719 const struct xfrm_encap_tmpl *encap); 720 bool (*is_alive)(const struct km_event *c); 721 }; 722 723 void xfrm_register_km(struct xfrm_mgr *km); 724 void xfrm_unregister_km(struct xfrm_mgr *km); 725 726 struct xfrm_tunnel_skb_cb { 727 union { 728 struct inet_skb_parm h4; 729 struct inet6_skb_parm h6; 730 } header; 731 732 union { 733 struct ip_tunnel *ip4; 734 struct ip6_tnl *ip6; 735 } tunnel; 736 }; 737 738 #define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0])) 739 740 /* 741 * This structure is used for the duration where packets are being 742 * transformed by IPsec. As soon as the packet leaves IPsec the 743 * area beyond the generic IP part may be overwritten. 744 */ 745 struct xfrm_skb_cb { 746 struct xfrm_tunnel_skb_cb header; 747 748 /* Sequence number for replay protection. */ 749 union { 750 struct { 751 __u32 low; 752 __u32 hi; 753 } output; 754 struct { 755 __be32 low; 756 __be32 hi; 757 } input; 758 } seq; 759 }; 760 761 #define XFRM_SKB_CB(__skb) ((struct xfrm_skb_cb *)&((__skb)->cb[0])) 762 763 /* 764 * This structure is used by the afinfo prepare_input/prepare_output functions 765 * to transmit header information to the mode input/output functions. 766 */ 767 struct xfrm_mode_skb_cb { 768 struct xfrm_tunnel_skb_cb header; 769 770 /* Copied from header for IPv4, always set to zero and DF for IPv6. */ 771 __be16 id; 772 __be16 frag_off; 773 774 /* IP header length (excluding options or extension headers). */ 775 u8 ihl; 776 777 /* TOS for IPv4, class for IPv6. */ 778 u8 tos; 779 780 /* TTL for IPv4, hop limitfor IPv6. */ 781 u8 ttl; 782 783 /* Protocol for IPv4, NH for IPv6. */ 784 u8 protocol; 785 786 /* Option length for IPv4, zero for IPv6. */ 787 u8 optlen; 788 789 /* Used by IPv6 only, zero for IPv4. */ 790 u8 flow_lbl[3]; 791 }; 792 793 #define XFRM_MODE_SKB_CB(__skb) ((struct xfrm_mode_skb_cb *)&((__skb)->cb[0])) 794 795 /* 796 * This structure is used by the input processing to locate the SPI and 797 * related information. 798 */ 799 struct xfrm_spi_skb_cb { 800 struct xfrm_tunnel_skb_cb header; 801 802 unsigned int daddroff; 803 unsigned int family; 804 __be32 seq; 805 }; 806 807 #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) 808 809 #ifdef CONFIG_AUDITSYSCALL 810 static inline struct audit_buffer *xfrm_audit_start(const char *op) 811 { 812 struct audit_buffer *audit_buf = NULL; 813 814 if (audit_enabled == AUDIT_OFF) 815 return NULL; 816 audit_buf = audit_log_start(audit_context(), GFP_ATOMIC, 817 AUDIT_MAC_IPSEC_EVENT); 818 if (audit_buf == NULL) 819 return NULL; 820 audit_log_format(audit_buf, "op=%s", op); 821 return audit_buf; 822 } 823 824 static inline void xfrm_audit_helper_usrinfo(bool task_valid, 825 struct audit_buffer *audit_buf) 826 { 827 const unsigned int auid = from_kuid(&init_user_ns, task_valid ? 828 audit_get_loginuid(current) : 829 INVALID_UID); 830 const unsigned int ses = task_valid ? audit_get_sessionid(current) : 831 AUDIT_SID_UNSET; 832 833 audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses); 834 audit_log_task_context(audit_buf); 835 } 836 837 void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid); 838 void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 839 bool task_valid); 840 void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid); 841 void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid); 842 void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 843 struct sk_buff *skb); 844 void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, 845 __be32 net_seq); 846 void xfrm_audit_state_notfound_simple(struct sk_buff *skb, u16 family); 847 void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, __be32 net_spi, 848 __be32 net_seq); 849 void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb, 850 u8 proto); 851 #else 852 853 static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, 854 bool task_valid) 855 { 856 } 857 858 static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, 859 bool task_valid) 860 { 861 } 862 863 static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, 864 bool task_valid) 865 { 866 } 867 868 static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, 869 bool task_valid) 870 { 871 } 872 873 static inline void xfrm_audit_state_replay_overflow(struct xfrm_state *x, 874 struct sk_buff *skb) 875 { 876 } 877 878 static inline void xfrm_audit_state_replay(struct xfrm_state *x, 879 struct sk_buff *skb, __be32 net_seq) 880 { 881 } 882 883 static inline void xfrm_audit_state_notfound_simple(struct sk_buff *skb, 884 u16 family) 885 { 886 } 887 888 static inline void xfrm_audit_state_notfound(struct sk_buff *skb, u16 family, 889 __be32 net_spi, __be32 net_seq) 890 { 891 } 892 893 static inline void xfrm_audit_state_icvfail(struct xfrm_state *x, 894 struct sk_buff *skb, u8 proto) 895 { 896 } 897 #endif /* CONFIG_AUDITSYSCALL */ 898 899 static inline void xfrm_pol_hold(struct xfrm_policy *policy) 900 { 901 if (likely(policy != NULL)) 902 refcount_inc(&policy->refcnt); 903 } 904 905 void xfrm_policy_destroy(struct xfrm_policy *policy); 906 907 static inline void xfrm_pol_put(struct xfrm_policy *policy) 908 { 909 if (refcount_dec_and_test(&policy->refcnt)) 910 xfrm_policy_destroy(policy); 911 } 912 913 static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 914 { 915 int i; 916 for (i = npols - 1; i >= 0; --i) 917 xfrm_pol_put(pols[i]); 918 } 919 920 void __xfrm_state_destroy(struct xfrm_state *); 921 922 static inline void __xfrm_state_put(struct xfrm_state *x) 923 { 924 refcount_dec(&x->refcnt); 925 } 926 927 static inline void xfrm_state_put(struct xfrm_state *x) 928 { 929 if (refcount_dec_and_test(&x->refcnt)) 930 __xfrm_state_destroy(x); 931 } 932 933 static inline void xfrm_state_hold(struct xfrm_state *x) 934 { 935 refcount_inc(&x->refcnt); 936 } 937 938 static inline bool addr_match(const void *token1, const void *token2, 939 unsigned int prefixlen) 940 { 941 const __be32 *a1 = token1; 942 const __be32 *a2 = token2; 943 unsigned int pdw; 944 unsigned int pbi; 945 946 pdw = prefixlen >> 5; /* num of whole u32 in prefix */ 947 pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ 948 949 if (pdw) 950 if (memcmp(a1, a2, pdw << 2)) 951 return false; 952 953 if (pbi) { 954 __be32 mask; 955 956 mask = htonl((0xffffffff) << (32 - pbi)); 957 958 if ((a1[pdw] ^ a2[pdw]) & mask) 959 return false; 960 } 961 962 return true; 963 } 964 965 static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) 966 { 967 /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ 968 if (sizeof(long) == 4 && prefixlen == 0) 969 return true; 970 return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); 971 } 972 973 static __inline__ 974 __be16 xfrm_flowi_sport(const struct flowi *fl, const union flowi_uli *uli) 975 { 976 __be16 port; 977 switch(fl->flowi_proto) { 978 case IPPROTO_TCP: 979 case IPPROTO_UDP: 980 case IPPROTO_UDPLITE: 981 case IPPROTO_SCTP: 982 port = uli->ports.sport; 983 break; 984 case IPPROTO_ICMP: 985 case IPPROTO_ICMPV6: 986 port = htons(uli->icmpt.type); 987 break; 988 case IPPROTO_MH: 989 port = htons(uli->mht.type); 990 break; 991 case IPPROTO_GRE: 992 port = htons(ntohl(uli->gre_key) >> 16); 993 break; 994 default: 995 port = 0; /*XXX*/ 996 } 997 return port; 998 } 999 1000 static __inline__ 1001 __be16 xfrm_flowi_dport(const struct flowi *fl, const union flowi_uli *uli) 1002 { 1003 __be16 port; 1004 switch(fl->flowi_proto) { 1005 case IPPROTO_TCP: 1006 case IPPROTO_UDP: 1007 case IPPROTO_UDPLITE: 1008 case IPPROTO_SCTP: 1009 port = uli->ports.dport; 1010 break; 1011 case IPPROTO_ICMP: 1012 case IPPROTO_ICMPV6: 1013 port = htons(uli->icmpt.code); 1014 break; 1015 case IPPROTO_GRE: 1016 port = htons(ntohl(uli->gre_key) & 0xffff); 1017 break; 1018 default: 1019 port = 0; /*XXX*/ 1020 } 1021 return port; 1022 } 1023 1024 bool xfrm_selector_match(const struct xfrm_selector *sel, 1025 const struct flowi *fl, unsigned short family); 1026 1027 #ifdef CONFIG_SECURITY_NETWORK_XFRM 1028 /* If neither has a context --> match 1029 * Otherwise, both must have a context and the sids, doi, alg must match 1030 */ 1031 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1032 { 1033 return ((!s1 && !s2) || 1034 (s1 && s2 && 1035 (s1->ctx_sid == s2->ctx_sid) && 1036 (s1->ctx_doi == s2->ctx_doi) && 1037 (s1->ctx_alg == s2->ctx_alg))); 1038 } 1039 #else 1040 static inline bool xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2) 1041 { 1042 return true; 1043 } 1044 #endif 1045 1046 /* A struct encoding bundle of transformations to apply to some set of flow. 1047 * 1048 * xdst->child points to the next element of bundle. 1049 * dst->xfrm points to an instanse of transformer. 1050 * 1051 * Due to unfortunate limitations of current routing cache, which we 1052 * have no time to fix, it mirrors struct rtable and bound to the same 1053 * routing key, including saddr,daddr. However, we can have many of 1054 * bundles differing by session id. All the bundles grow from a parent 1055 * policy rule. 1056 */ 1057 struct xfrm_dst { 1058 union { 1059 struct dst_entry dst; 1060 struct rtable rt; 1061 struct rt6_info rt6; 1062 } u; 1063 struct dst_entry *route; 1064 struct dst_entry *child; 1065 struct dst_entry *path; 1066 struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; 1067 int num_pols, num_xfrms; 1068 u32 xfrm_genid; 1069 u32 policy_genid; 1070 u32 route_mtu_cached; 1071 u32 child_mtu_cached; 1072 u32 route_cookie; 1073 u32 path_cookie; 1074 }; 1075 1076 static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst) 1077 { 1078 #ifdef CONFIG_XFRM 1079 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1080 const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst; 1081 1082 return xdst->path; 1083 } 1084 #endif 1085 return (struct dst_entry *) dst; 1086 } 1087 1088 static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst) 1089 { 1090 #ifdef CONFIG_XFRM 1091 if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) { 1092 struct xfrm_dst *xdst = (struct xfrm_dst *) dst; 1093 return xdst->child; 1094 } 1095 #endif 1096 return NULL; 1097 } 1098 1099 #ifdef CONFIG_XFRM 1100 static inline void xfrm_dst_set_child(struct xfrm_dst *xdst, struct dst_entry *child) 1101 { 1102 xdst->child = child; 1103 } 1104 1105 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) 1106 { 1107 xfrm_pols_put(xdst->pols, xdst->num_pols); 1108 dst_release(xdst->route); 1109 if (likely(xdst->u.dst.xfrm)) 1110 xfrm_state_put(xdst->u.dst.xfrm); 1111 } 1112 #endif 1113 1114 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev); 1115 1116 struct xfrm_if_parms { 1117 int link; /* ifindex of underlying L2 interface */ 1118 u32 if_id; /* interface identifier */ 1119 bool collect_md; 1120 }; 1121 1122 struct xfrm_if { 1123 struct xfrm_if __rcu *next; /* next interface in list */ 1124 struct net_device *dev; /* virtual device associated with interface */ 1125 struct net *net; /* netns for packet i/o */ 1126 struct xfrm_if_parms p; /* interface parms */ 1127 1128 struct gro_cells gro_cells; 1129 }; 1130 1131 struct xfrm_offload { 1132 /* Output sequence number for replay protection on offloading. */ 1133 struct { 1134 __u32 low; 1135 __u32 hi; 1136 } seq; 1137 1138 __u32 flags; 1139 #define SA_DELETE_REQ 1 1140 #define CRYPTO_DONE 2 1141 #define CRYPTO_NEXT_DONE 4 1142 #define CRYPTO_FALLBACK 8 1143 #define XFRM_GSO_SEGMENT 16 1144 #define XFRM_GRO 32 1145 /* 64 is free */ 1146 #define XFRM_DEV_RESUME 128 1147 #define XFRM_XMIT 256 1148 1149 __u32 status; 1150 #define CRYPTO_SUCCESS 1 1151 #define CRYPTO_GENERIC_ERROR 2 1152 #define CRYPTO_TRANSPORT_AH_AUTH_FAILED 4 1153 #define CRYPTO_TRANSPORT_ESP_AUTH_FAILED 8 1154 #define CRYPTO_TUNNEL_AH_AUTH_FAILED 16 1155 #define CRYPTO_TUNNEL_ESP_AUTH_FAILED 32 1156 #define CRYPTO_INVALID_PACKET_SYNTAX 64 1157 #define CRYPTO_INVALID_PROTOCOL 128 1158 1159 /* Used to keep whole l2 header for transport mode GRO */ 1160 __u16 orig_mac_len; 1161 1162 __u8 proto; 1163 __u8 inner_ipproto; 1164 }; 1165 1166 struct sec_path { 1167 struct xfrm_state *xvec[XFRM_MAX_DEPTH]; 1168 struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH]; 1169 1170 u8 len; 1171 u8 olen; 1172 u8 verified_cnt; 1173 }; 1174 1175 struct sec_path *secpath_set(struct sk_buff *skb); 1176 1177 static inline void 1178 secpath_reset(struct sk_buff *skb) 1179 { 1180 #ifdef CONFIG_XFRM 1181 skb_ext_del(skb, SKB_EXT_SEC_PATH); 1182 #endif 1183 } 1184 1185 static inline int 1186 xfrm_addr_any(const xfrm_address_t *addr, unsigned short family) 1187 { 1188 switch (family) { 1189 case AF_INET: 1190 return addr->a4 == 0; 1191 case AF_INET6: 1192 return ipv6_addr_any(&addr->in6); 1193 } 1194 return 0; 1195 } 1196 1197 static inline int 1198 __xfrm4_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1199 { 1200 return (tmpl->saddr.a4 && 1201 tmpl->saddr.a4 != x->props.saddr.a4); 1202 } 1203 1204 static inline int 1205 __xfrm6_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x) 1206 { 1207 return (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) && 1208 !ipv6_addr_equal((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr)); 1209 } 1210 1211 static inline int 1212 xfrm_state_addr_cmp(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, unsigned short family) 1213 { 1214 switch (family) { 1215 case AF_INET: 1216 return __xfrm4_state_addr_cmp(tmpl, x); 1217 case AF_INET6: 1218 return __xfrm6_state_addr_cmp(tmpl, x); 1219 } 1220 return !0; 1221 } 1222 1223 #ifdef CONFIG_XFRM 1224 static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb) 1225 { 1226 struct sec_path *sp = skb_sec_path(skb); 1227 1228 return sp->xvec[sp->len - 1]; 1229 } 1230 #endif 1231 1232 static inline struct xfrm_offload *xfrm_offload(struct sk_buff *skb) 1233 { 1234 #ifdef CONFIG_XFRM 1235 struct sec_path *sp = skb_sec_path(skb); 1236 1237 if (!sp || !sp->olen || sp->len != sp->olen) 1238 return NULL; 1239 1240 return &sp->ovec[sp->olen - 1]; 1241 #else 1242 return NULL; 1243 #endif 1244 } 1245 1246 #ifdef CONFIG_XFRM 1247 int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, 1248 unsigned short family); 1249 1250 static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, 1251 int dir) 1252 { 1253 if (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) 1254 return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT; 1255 1256 return false; 1257 } 1258 1259 static inline bool __xfrm_check_dev_nopolicy(struct sk_buff *skb, 1260 int dir, unsigned short family) 1261 { 1262 if (dir != XFRM_POLICY_OUT && family == AF_INET) { 1263 /* same dst may be used for traffic originating from 1264 * devices with different policy settings. 1265 */ 1266 return IPCB(skb)->flags & IPSKB_NOPOLICY; 1267 } 1268 return skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY); 1269 } 1270 1271 static inline int __xfrm_policy_check2(struct sock *sk, int dir, 1272 struct sk_buff *skb, 1273 unsigned int family, int reverse) 1274 { 1275 struct net *net = dev_net(skb->dev); 1276 int ndir = dir | (reverse ? XFRM_POLICY_MASK + 1 : 0); 1277 struct xfrm_offload *xo = xfrm_offload(skb); 1278 struct xfrm_state *x; 1279 1280 if (sk && sk->sk_policy[XFRM_POLICY_IN]) 1281 return __xfrm_policy_check(sk, ndir, skb, family); 1282 1283 if (xo) { 1284 x = xfrm_input_state(skb); 1285 if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { 1286 bool check = (xo->flags & CRYPTO_DONE) && 1287 (xo->status & CRYPTO_SUCCESS); 1288 1289 /* The packets here are plain ones and secpath was 1290 * needed to indicate that hardware already handled 1291 * them and there is no need to do nothing in addition. 1292 * 1293 * Consume secpath which was set by drivers. 1294 */ 1295 secpath_reset(skb); 1296 return check; 1297 } 1298 } 1299 1300 return __xfrm_check_nopolicy(net, skb, dir) || 1301 __xfrm_check_dev_nopolicy(skb, dir, family) || 1302 __xfrm_policy_check(sk, ndir, skb, family); 1303 } 1304 1305 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1306 { 1307 return __xfrm_policy_check2(sk, dir, skb, family, 0); 1308 } 1309 1310 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1311 { 1312 return xfrm_policy_check(sk, dir, skb, AF_INET); 1313 } 1314 1315 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1316 { 1317 return xfrm_policy_check(sk, dir, skb, AF_INET6); 1318 } 1319 1320 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1321 struct sk_buff *skb) 1322 { 1323 return __xfrm_policy_check2(sk, dir, skb, AF_INET, 1); 1324 } 1325 1326 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1327 struct sk_buff *skb) 1328 { 1329 return __xfrm_policy_check2(sk, dir, skb, AF_INET6, 1); 1330 } 1331 1332 int __xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1333 unsigned int family, int reverse); 1334 1335 static inline int xfrm_decode_session(struct net *net, struct sk_buff *skb, struct flowi *fl, 1336 unsigned int family) 1337 { 1338 return __xfrm_decode_session(net, skb, fl, family, 0); 1339 } 1340 1341 static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1342 struct flowi *fl, 1343 unsigned int family) 1344 { 1345 return __xfrm_decode_session(net, skb, fl, family, 1); 1346 } 1347 1348 int __xfrm_route_forward(struct sk_buff *skb, unsigned short family); 1349 1350 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) 1351 { 1352 struct net *net = dev_net(skb->dev); 1353 1354 if (!net->xfrm.policy_count[XFRM_POLICY_OUT] && 1355 net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT) 1356 return true; 1357 1358 return (skb_dst(skb)->flags & DST_NOXFRM) || 1359 __xfrm_route_forward(skb, family); 1360 } 1361 1362 static inline int xfrm4_route_forward(struct sk_buff *skb) 1363 { 1364 return xfrm_route_forward(skb, AF_INET); 1365 } 1366 1367 static inline int xfrm6_route_forward(struct sk_buff *skb) 1368 { 1369 return xfrm_route_forward(skb, AF_INET6); 1370 } 1371 1372 int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk); 1373 1374 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) 1375 { 1376 if (!sk_fullsock(osk)) 1377 return 0; 1378 sk->sk_policy[0] = NULL; 1379 sk->sk_policy[1] = NULL; 1380 if (unlikely(osk->sk_policy[0] || osk->sk_policy[1])) 1381 return __xfrm_sk_clone_policy(sk, osk); 1382 return 0; 1383 } 1384 1385 int xfrm_policy_delete(struct xfrm_policy *pol, int dir); 1386 1387 static inline void xfrm_sk_free_policy(struct sock *sk) 1388 { 1389 struct xfrm_policy *pol; 1390 1391 pol = rcu_dereference_protected(sk->sk_policy[0], 1); 1392 if (unlikely(pol != NULL)) { 1393 xfrm_policy_delete(pol, XFRM_POLICY_MAX); 1394 sk->sk_policy[0] = NULL; 1395 } 1396 pol = rcu_dereference_protected(sk->sk_policy[1], 1); 1397 if (unlikely(pol != NULL)) { 1398 xfrm_policy_delete(pol, XFRM_POLICY_MAX+1); 1399 sk->sk_policy[1] = NULL; 1400 } 1401 } 1402 1403 #else 1404 1405 static inline void xfrm_sk_free_policy(struct sock *sk) {} 1406 static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; } 1407 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; } 1408 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 1409 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1410 { 1411 return 1; 1412 } 1413 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb) 1414 { 1415 return 1; 1416 } 1417 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family) 1418 { 1419 return 1; 1420 } 1421 static inline int xfrm_decode_session_reverse(struct net *net, struct sk_buff *skb, 1422 struct flowi *fl, 1423 unsigned int family) 1424 { 1425 return -ENOSYS; 1426 } 1427 static inline int xfrm4_policy_check_reverse(struct sock *sk, int dir, 1428 struct sk_buff *skb) 1429 { 1430 return 1; 1431 } 1432 static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir, 1433 struct sk_buff *skb) 1434 { 1435 return 1; 1436 } 1437 #endif 1438 1439 static __inline__ 1440 xfrm_address_t *xfrm_flowi_daddr(const struct flowi *fl, unsigned short family) 1441 { 1442 switch (family){ 1443 case AF_INET: 1444 return (xfrm_address_t *)&fl->u.ip4.daddr; 1445 case AF_INET6: 1446 return (xfrm_address_t *)&fl->u.ip6.daddr; 1447 } 1448 return NULL; 1449 } 1450 1451 static __inline__ 1452 xfrm_address_t *xfrm_flowi_saddr(const struct flowi *fl, unsigned short family) 1453 { 1454 switch (family){ 1455 case AF_INET: 1456 return (xfrm_address_t *)&fl->u.ip4.saddr; 1457 case AF_INET6: 1458 return (xfrm_address_t *)&fl->u.ip6.saddr; 1459 } 1460 return NULL; 1461 } 1462 1463 static __inline__ 1464 void xfrm_flowi_addr_get(const struct flowi *fl, 1465 xfrm_address_t *saddr, xfrm_address_t *daddr, 1466 unsigned short family) 1467 { 1468 switch(family) { 1469 case AF_INET: 1470 memcpy(&saddr->a4, &fl->u.ip4.saddr, sizeof(saddr->a4)); 1471 memcpy(&daddr->a4, &fl->u.ip4.daddr, sizeof(daddr->a4)); 1472 break; 1473 case AF_INET6: 1474 saddr->in6 = fl->u.ip6.saddr; 1475 daddr->in6 = fl->u.ip6.daddr; 1476 break; 1477 } 1478 } 1479 1480 static __inline__ int 1481 __xfrm4_state_addr_check(const struct xfrm_state *x, 1482 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1483 { 1484 if (daddr->a4 == x->id.daddr.a4 && 1485 (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4)) 1486 return 1; 1487 return 0; 1488 } 1489 1490 static __inline__ int 1491 __xfrm6_state_addr_check(const struct xfrm_state *x, 1492 const xfrm_address_t *daddr, const xfrm_address_t *saddr) 1493 { 1494 if (ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) && 1495 (ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr) || 1496 ipv6_addr_any((struct in6_addr *)saddr) || 1497 ipv6_addr_any((struct in6_addr *)&x->props.saddr))) 1498 return 1; 1499 return 0; 1500 } 1501 1502 static __inline__ int 1503 xfrm_state_addr_check(const struct xfrm_state *x, 1504 const xfrm_address_t *daddr, const xfrm_address_t *saddr, 1505 unsigned short family) 1506 { 1507 switch (family) { 1508 case AF_INET: 1509 return __xfrm4_state_addr_check(x, daddr, saddr); 1510 case AF_INET6: 1511 return __xfrm6_state_addr_check(x, daddr, saddr); 1512 } 1513 return 0; 1514 } 1515 1516 static __inline__ int 1517 xfrm_state_addr_flow_check(const struct xfrm_state *x, const struct flowi *fl, 1518 unsigned short family) 1519 { 1520 switch (family) { 1521 case AF_INET: 1522 return __xfrm4_state_addr_check(x, 1523 (const xfrm_address_t *)&fl->u.ip4.daddr, 1524 (const xfrm_address_t *)&fl->u.ip4.saddr); 1525 case AF_INET6: 1526 return __xfrm6_state_addr_check(x, 1527 (const xfrm_address_t *)&fl->u.ip6.daddr, 1528 (const xfrm_address_t *)&fl->u.ip6.saddr); 1529 } 1530 return 0; 1531 } 1532 1533 static inline int xfrm_state_kern(const struct xfrm_state *x) 1534 { 1535 return atomic_read(&x->tunnel_users); 1536 } 1537 1538 static inline bool xfrm_id_proto_valid(u8 proto) 1539 { 1540 switch (proto) { 1541 case IPPROTO_AH: 1542 case IPPROTO_ESP: 1543 case IPPROTO_COMP: 1544 #if IS_ENABLED(CONFIG_IPV6) 1545 case IPPROTO_ROUTING: 1546 case IPPROTO_DSTOPTS: 1547 #endif 1548 return true; 1549 default: 1550 return false; 1551 } 1552 } 1553 1554 /* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ 1555 static inline int xfrm_id_proto_match(u8 proto, u8 userproto) 1556 { 1557 return (!userproto || proto == userproto || 1558 (userproto == IPSEC_PROTO_ANY && (proto == IPPROTO_AH || 1559 proto == IPPROTO_ESP || 1560 proto == IPPROTO_COMP))); 1561 } 1562 1563 /* 1564 * xfrm algorithm information 1565 */ 1566 struct xfrm_algo_aead_info { 1567 char *geniv; 1568 u16 icv_truncbits; 1569 }; 1570 1571 struct xfrm_algo_auth_info { 1572 u16 icv_truncbits; 1573 u16 icv_fullbits; 1574 }; 1575 1576 struct xfrm_algo_encr_info { 1577 char *geniv; 1578 u16 blockbits; 1579 u16 defkeybits; 1580 }; 1581 1582 struct xfrm_algo_comp_info { 1583 u16 threshold; 1584 }; 1585 1586 struct xfrm_algo_desc { 1587 char *name; 1588 char *compat; 1589 u8 available:1; 1590 u8 pfkey_supported:1; 1591 union { 1592 struct xfrm_algo_aead_info aead; 1593 struct xfrm_algo_auth_info auth; 1594 struct xfrm_algo_encr_info encr; 1595 struct xfrm_algo_comp_info comp; 1596 } uinfo; 1597 struct sadb_alg desc; 1598 }; 1599 1600 /* XFRM protocol handlers. */ 1601 struct xfrm4_protocol { 1602 int (*handler)(struct sk_buff *skb); 1603 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1604 int encap_type); 1605 int (*cb_handler)(struct sk_buff *skb, int err); 1606 int (*err_handler)(struct sk_buff *skb, u32 info); 1607 1608 struct xfrm4_protocol __rcu *next; 1609 int priority; 1610 }; 1611 1612 struct xfrm6_protocol { 1613 int (*handler)(struct sk_buff *skb); 1614 int (*input_handler)(struct sk_buff *skb, int nexthdr, __be32 spi, 1615 int encap_type); 1616 int (*cb_handler)(struct sk_buff *skb, int err); 1617 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1618 u8 type, u8 code, int offset, __be32 info); 1619 1620 struct xfrm6_protocol __rcu *next; 1621 int priority; 1622 }; 1623 1624 /* XFRM tunnel handlers. */ 1625 struct xfrm_tunnel { 1626 int (*handler)(struct sk_buff *skb); 1627 int (*cb_handler)(struct sk_buff *skb, int err); 1628 int (*err_handler)(struct sk_buff *skb, u32 info); 1629 1630 struct xfrm_tunnel __rcu *next; 1631 int priority; 1632 }; 1633 1634 struct xfrm6_tunnel { 1635 int (*handler)(struct sk_buff *skb); 1636 int (*cb_handler)(struct sk_buff *skb, int err); 1637 int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt, 1638 u8 type, u8 code, int offset, __be32 info); 1639 struct xfrm6_tunnel __rcu *next; 1640 int priority; 1641 }; 1642 1643 void xfrm_init(void); 1644 void xfrm4_init(void); 1645 int xfrm_state_init(struct net *net); 1646 void xfrm_state_fini(struct net *net); 1647 void xfrm4_state_init(void); 1648 void xfrm4_protocol_init(void); 1649 #ifdef CONFIG_XFRM 1650 int xfrm6_init(void); 1651 void xfrm6_fini(void); 1652 int xfrm6_state_init(void); 1653 void xfrm6_state_fini(void); 1654 int xfrm6_protocol_init(void); 1655 void xfrm6_protocol_fini(void); 1656 #else 1657 static inline int xfrm6_init(void) 1658 { 1659 return 0; 1660 } 1661 static inline void xfrm6_fini(void) 1662 { 1663 ; 1664 } 1665 #endif 1666 1667 #ifdef CONFIG_XFRM_STATISTICS 1668 int xfrm_proc_init(struct net *net); 1669 void xfrm_proc_fini(struct net *net); 1670 #endif 1671 1672 int xfrm_sysctl_init(struct net *net); 1673 #ifdef CONFIG_SYSCTL 1674 void xfrm_sysctl_fini(struct net *net); 1675 #else 1676 static inline void xfrm_sysctl_fini(struct net *net) 1677 { 1678 } 1679 #endif 1680 1681 void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto, 1682 struct xfrm_address_filter *filter); 1683 int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk, 1684 int (*func)(struct xfrm_state *, int, void*), void *); 1685 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net); 1686 struct xfrm_state *xfrm_state_alloc(struct net *net); 1687 void xfrm_state_free(struct xfrm_state *x); 1688 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr, 1689 const xfrm_address_t *saddr, 1690 const struct flowi *fl, 1691 struct xfrm_tmpl *tmpl, 1692 struct xfrm_policy *pol, int *err, 1693 unsigned short family, u32 if_id); 1694 struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, 1695 xfrm_address_t *daddr, 1696 xfrm_address_t *saddr, 1697 unsigned short family, 1698 u8 mode, u8 proto, u32 reqid); 1699 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, 1700 unsigned short family); 1701 int xfrm_state_check_expire(struct xfrm_state *x); 1702 void xfrm_state_update_stats(struct net *net); 1703 #ifdef CONFIG_XFRM_OFFLOAD 1704 static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) 1705 { 1706 struct xfrm_dev_offload *xdo = &x->xso; 1707 struct net_device *dev = READ_ONCE(xdo->dev); 1708 1709 if (dev && dev->xfrmdev_ops && 1710 dev->xfrmdev_ops->xdo_dev_state_update_stats) 1711 dev->xfrmdev_ops->xdo_dev_state_update_stats(x); 1712 1713 } 1714 #else 1715 static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) {} 1716 #endif 1717 void xfrm_state_insert(struct xfrm_state *x); 1718 int xfrm_state_add(struct xfrm_state *x); 1719 int xfrm_state_update(struct xfrm_state *x); 1720 struct xfrm_state *xfrm_state_lookup(struct net *net, u32 mark, 1721 const xfrm_address_t *daddr, __be32 spi, 1722 u8 proto, unsigned short family); 1723 struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, 1724 const xfrm_address_t *daddr, 1725 __be32 spi, u8 proto, 1726 unsigned short family); 1727 struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, 1728 const xfrm_address_t *daddr, 1729 const xfrm_address_t *saddr, 1730 u8 proto, 1731 unsigned short family); 1732 #ifdef CONFIG_XFRM_SUB_POLICY 1733 void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, 1734 unsigned short family); 1735 void xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n, 1736 unsigned short family); 1737 #else 1738 static inline void xfrm_tmpl_sort(struct xfrm_tmpl **d, struct xfrm_tmpl **s, 1739 int n, unsigned short family) 1740 { 1741 } 1742 1743 static inline void xfrm_state_sort(struct xfrm_state **d, struct xfrm_state **s, 1744 int n, unsigned short family) 1745 { 1746 } 1747 #endif 1748 1749 struct xfrmk_sadinfo { 1750 u32 sadhcnt; /* current hash bkts */ 1751 u32 sadhmcnt; /* max allowed hash bkts */ 1752 u32 sadcnt; /* current running count */ 1753 }; 1754 1755 struct xfrmk_spdinfo { 1756 u32 incnt; 1757 u32 outcnt; 1758 u32 fwdcnt; 1759 u32 inscnt; 1760 u32 outscnt; 1761 u32 fwdscnt; 1762 u32 spdhcnt; 1763 u32 spdhmcnt; 1764 }; 1765 1766 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num); 1767 int xfrm_state_delete(struct xfrm_state *x); 1768 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid); 1769 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid); 1770 int xfrm_dev_policy_flush(struct net *net, struct net_device *dev, 1771 bool task_valid); 1772 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); 1773 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); 1774 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); 1775 int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack); 1776 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); 1777 int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); 1778 int xfrm_init_state(struct xfrm_state *x); 1779 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); 1780 int xfrm_input_resume(struct sk_buff *skb, int nexthdr); 1781 int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, 1782 int (*finish)(struct net *, struct sock *, 1783 struct sk_buff *)); 1784 int xfrm_trans_queue(struct sk_buff *skb, 1785 int (*finish)(struct net *, struct sock *, 1786 struct sk_buff *)); 1787 int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err); 1788 int xfrm_output(struct sock *sk, struct sk_buff *skb); 1789 int xfrm4_tunnel_check_size(struct sk_buff *skb); 1790 #if IS_ENABLED(CONFIG_IPV6) 1791 int xfrm6_tunnel_check_size(struct sk_buff *skb); 1792 #else 1793 static inline int xfrm6_tunnel_check_size(struct sk_buff *skb) 1794 { 1795 return -EMSGSIZE; 1796 } 1797 #endif 1798 1799 #if IS_ENABLED(CONFIG_NET_PKTGEN) 1800 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb); 1801 #endif 1802 1803 void xfrm_local_error(struct sk_buff *skb, int mtu); 1804 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1805 int encap_type); 1806 int xfrm4_transport_finish(struct sk_buff *skb, int async); 1807 int xfrm4_rcv(struct sk_buff *skb); 1808 1809 static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) 1810 { 1811 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; 1812 XFRM_SPI_SKB_CB(skb)->family = AF_INET; 1813 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 1814 return xfrm_input(skb, nexthdr, spi, 0); 1815 } 1816 1817 int xfrm4_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1818 int xfrm4_protocol_register(struct xfrm4_protocol *handler, unsigned char protocol); 1819 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler, unsigned char protocol); 1820 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family); 1821 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family); 1822 void xfrm4_local_error(struct sk_buff *skb, u32 mtu); 1823 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 1824 struct ip6_tnl *t); 1825 int xfrm6_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 1826 int encap_type); 1827 int xfrm6_transport_finish(struct sk_buff *skb, int async); 1828 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t); 1829 int xfrm6_rcv(struct sk_buff *skb); 1830 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 1831 xfrm_address_t *saddr, u8 proto); 1832 void xfrm6_local_error(struct sk_buff *skb, u32 mtu); 1833 int xfrm6_protocol_register(struct xfrm6_protocol *handler, unsigned char protocol); 1834 int xfrm6_protocol_deregister(struct xfrm6_protocol *handler, unsigned char protocol); 1835 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family); 1836 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family); 1837 __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr); 1838 __be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr); 1839 int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb); 1840 1841 #ifdef CONFIG_XFRM 1842 void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu); 1843 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1844 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb); 1845 struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1846 struct sk_buff *skb); 1847 struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, 1848 struct sk_buff *skb); 1849 int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, 1850 int optlen); 1851 #else 1852 static inline int xfrm_user_policy(struct sock *sk, int optname, 1853 sockptr_t optval, int optlen) 1854 { 1855 return -ENOPROTOOPT; 1856 } 1857 #endif 1858 1859 struct dst_entry *__xfrm_dst_lookup(int family, const struct xfrm_dst_lookup_params *params); 1860 1861 struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp); 1862 1863 void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type); 1864 int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, 1865 int (*func)(struct xfrm_policy *, int, int, void*), 1866 void *); 1867 void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); 1868 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); 1869 struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, 1870 const struct xfrm_mark *mark, 1871 u32 if_id, u8 type, int dir, 1872 struct xfrm_selector *sel, 1873 struct xfrm_sec_ctx *ctx, int delete, 1874 int *err); 1875 struct xfrm_policy *xfrm_policy_byid(struct net *net, 1876 const struct xfrm_mark *mark, u32 if_id, 1877 u8 type, int dir, u32 id, int delete, 1878 int *err); 1879 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); 1880 void xfrm_policy_hash_rebuild(struct net *net); 1881 u32 xfrm_get_acqseq(void); 1882 int verify_spi_info(u8 proto, u32 min, u32 max, struct netlink_ext_ack *extack); 1883 int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi, 1884 struct netlink_ext_ack *extack); 1885 struct xfrm_state *xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, 1886 u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, 1887 const xfrm_address_t *daddr, 1888 const xfrm_address_t *saddr, int create, 1889 unsigned short family); 1890 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); 1891 1892 #ifdef CONFIG_XFRM_MIGRATE 1893 int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1894 const struct xfrm_migrate *m, int num_bundles, 1895 const struct xfrm_kmaddress *k, struct net *net, 1896 const struct xfrm_encap_tmpl *encap); 1897 struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, 1898 u32 if_id); 1899 struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, 1900 struct xfrm_migrate *m, 1901 struct xfrm_encap_tmpl *encap, 1902 struct net *net, 1903 struct xfrm_user_offload *xuo, 1904 struct netlink_ext_ack *extack); 1905 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 1906 struct xfrm_migrate *m, int num_bundles, 1907 struct xfrm_kmaddress *k, struct net *net, 1908 struct xfrm_encap_tmpl *encap, u32 if_id, 1909 struct netlink_ext_ack *extack, 1910 struct xfrm_user_offload *xuo); 1911 #endif 1912 1913 int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); 1914 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid); 1915 int km_report(struct net *net, u8 proto, struct xfrm_selector *sel, 1916 xfrm_address_t *addr); 1917 1918 void xfrm_input_init(void); 1919 int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq); 1920 1921 void xfrm_probe_algs(void); 1922 int xfrm_count_pfkey_auth_supported(void); 1923 int xfrm_count_pfkey_enc_supported(void); 1924 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx); 1925 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx); 1926 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id); 1927 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id); 1928 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id); 1929 struct xfrm_algo_desc *xfrm_aalg_get_byname(const char *name, int probe); 1930 struct xfrm_algo_desc *xfrm_ealg_get_byname(const char *name, int probe); 1931 struct xfrm_algo_desc *xfrm_calg_get_byname(const char *name, int probe); 1932 struct xfrm_algo_desc *xfrm_aead_get_byname(const char *name, int icv_len, 1933 int probe); 1934 1935 static inline bool xfrm6_addr_equal(const xfrm_address_t *a, 1936 const xfrm_address_t *b) 1937 { 1938 return ipv6_addr_equal((const struct in6_addr *)a, 1939 (const struct in6_addr *)b); 1940 } 1941 1942 static inline bool xfrm_addr_equal(const xfrm_address_t *a, 1943 const xfrm_address_t *b, 1944 sa_family_t family) 1945 { 1946 switch (family) { 1947 default: 1948 case AF_INET: 1949 return ((__force u32)a->a4 ^ (__force u32)b->a4) == 0; 1950 case AF_INET6: 1951 return xfrm6_addr_equal(a, b); 1952 } 1953 } 1954 1955 static inline int xfrm_policy_id2dir(u32 index) 1956 { 1957 return index & 7; 1958 } 1959 1960 #ifdef CONFIG_XFRM 1961 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq); 1962 int xfrm_replay_check(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1963 void xfrm_replay_notify(struct xfrm_state *x, int event); 1964 int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb); 1965 int xfrm_replay_recheck(struct xfrm_state *x, struct sk_buff *skb, __be32 net_seq); 1966 1967 static inline int xfrm_aevent_is_on(struct net *net) 1968 { 1969 struct sock *nlsk; 1970 int ret = 0; 1971 1972 rcu_read_lock(); 1973 nlsk = rcu_dereference(net->xfrm.nlsk); 1974 if (nlsk) 1975 ret = netlink_has_listeners(nlsk, XFRMNLGRP_AEVENTS); 1976 rcu_read_unlock(); 1977 return ret; 1978 } 1979 1980 static inline int xfrm_acquire_is_on(struct net *net) 1981 { 1982 struct sock *nlsk; 1983 int ret = 0; 1984 1985 rcu_read_lock(); 1986 nlsk = rcu_dereference(net->xfrm.nlsk); 1987 if (nlsk) 1988 ret = netlink_has_listeners(nlsk, XFRMNLGRP_ACQUIRE); 1989 rcu_read_unlock(); 1990 1991 return ret; 1992 } 1993 #endif 1994 1995 static inline unsigned int aead_len(struct xfrm_algo_aead *alg) 1996 { 1997 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 1998 } 1999 2000 static inline unsigned int xfrm_alg_len(const struct xfrm_algo *alg) 2001 { 2002 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2003 } 2004 2005 static inline unsigned int xfrm_alg_auth_len(const struct xfrm_algo_auth *alg) 2006 { 2007 return sizeof(*alg) + ((alg->alg_key_len + 7) / 8); 2008 } 2009 2010 static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn) 2011 { 2012 return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32); 2013 } 2014 2015 #ifdef CONFIG_XFRM_MIGRATE 2016 static inline int xfrm_replay_clone(struct xfrm_state *x, 2017 struct xfrm_state *orig) 2018 { 2019 2020 x->replay_esn = kmemdup(orig->replay_esn, 2021 xfrm_replay_state_esn_len(orig->replay_esn), 2022 GFP_KERNEL); 2023 if (!x->replay_esn) 2024 return -ENOMEM; 2025 x->preplay_esn = kmemdup(orig->preplay_esn, 2026 xfrm_replay_state_esn_len(orig->preplay_esn), 2027 GFP_KERNEL); 2028 if (!x->preplay_esn) 2029 return -ENOMEM; 2030 2031 return 0; 2032 } 2033 2034 static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) 2035 { 2036 return kmemdup(orig, aead_len(orig), GFP_KERNEL); 2037 } 2038 2039 2040 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig) 2041 { 2042 return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL); 2043 } 2044 2045 static inline struct xfrm_algo_auth *xfrm_algo_auth_clone(struct xfrm_algo_auth *orig) 2046 { 2047 return kmemdup(orig, xfrm_alg_auth_len(orig), GFP_KERNEL); 2048 } 2049 2050 static inline void xfrm_states_put(struct xfrm_state **states, int n) 2051 { 2052 int i; 2053 for (i = 0; i < n; i++) 2054 xfrm_state_put(*(states + i)); 2055 } 2056 2057 static inline void xfrm_states_delete(struct xfrm_state **states, int n) 2058 { 2059 int i; 2060 for (i = 0; i < n; i++) 2061 xfrm_state_delete(*(states + i)); 2062 } 2063 #endif 2064 2065 void __init xfrm_dev_init(void); 2066 2067 #ifdef CONFIG_XFRM_OFFLOAD 2068 void xfrm_dev_resume(struct sk_buff *skb); 2069 void xfrm_dev_backlog(struct softnet_data *sd); 2070 struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again); 2071 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 2072 struct xfrm_user_offload *xuo, 2073 struct netlink_ext_ack *extack); 2074 int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2075 struct xfrm_user_offload *xuo, u8 dir, 2076 struct netlink_ext_ack *extack); 2077 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); 2078 void xfrm_dev_state_delete(struct xfrm_state *x); 2079 void xfrm_dev_state_free(struct xfrm_state *x); 2080 2081 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2082 { 2083 struct xfrm_dev_offload *xso = &x->xso; 2084 struct net_device *dev = READ_ONCE(xso->dev); 2085 2086 if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn) 2087 dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); 2088 } 2089 2090 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2091 { 2092 struct xfrm_state *x = dst->xfrm; 2093 struct xfrm_dst *xdst; 2094 2095 if (!x || !x->type_offload) 2096 return false; 2097 2098 xdst = (struct xfrm_dst *) dst; 2099 if (!x->xso.offload_handle && !xdst->child->xfrm) 2100 return true; 2101 if (x->xso.offload_handle && (x->xso.dev == xfrm_dst_path(dst)->dev) && 2102 !xdst->child->xfrm) 2103 return true; 2104 2105 return false; 2106 } 2107 2108 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2109 { 2110 struct xfrm_dev_offload *xdo = &x->xdo; 2111 struct net_device *dev = xdo->dev; 2112 2113 if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_policy_delete) 2114 dev->xfrmdev_ops->xdo_dev_policy_delete(x); 2115 } 2116 2117 static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2118 { 2119 struct xfrm_dev_offload *xdo = &x->xdo; 2120 struct net_device *dev = xdo->dev; 2121 2122 if (dev && dev->xfrmdev_ops) { 2123 if (dev->xfrmdev_ops->xdo_dev_policy_free) 2124 dev->xfrmdev_ops->xdo_dev_policy_free(x); 2125 xdo->dev = NULL; 2126 netdev_put(dev, &xdo->dev_tracker); 2127 } 2128 } 2129 #else 2130 static inline void xfrm_dev_resume(struct sk_buff *skb) 2131 { 2132 } 2133 2134 static inline void xfrm_dev_backlog(struct softnet_data *sd) 2135 { 2136 } 2137 2138 static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again) 2139 { 2140 return skb; 2141 } 2142 2143 static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack) 2144 { 2145 return 0; 2146 } 2147 2148 static inline void xfrm_dev_state_delete(struct xfrm_state *x) 2149 { 2150 } 2151 2152 static inline void xfrm_dev_state_free(struct xfrm_state *x) 2153 { 2154 } 2155 2156 static inline int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, 2157 struct xfrm_user_offload *xuo, u8 dir, 2158 struct netlink_ext_ack *extack) 2159 { 2160 return 0; 2161 } 2162 2163 static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) 2164 { 2165 } 2166 2167 static inline void xfrm_dev_policy_free(struct xfrm_policy *x) 2168 { 2169 } 2170 2171 static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 2172 { 2173 return false; 2174 } 2175 2176 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) 2177 { 2178 } 2179 2180 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) 2181 { 2182 return false; 2183 } 2184 #endif 2185 2186 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m) 2187 { 2188 if (attrs[XFRMA_MARK]) 2189 memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark)); 2190 else 2191 m->v = m->m = 0; 2192 2193 return m->v & m->m; 2194 } 2195 2196 static inline int xfrm_mark_put(struct sk_buff *skb, const struct xfrm_mark *m) 2197 { 2198 int ret = 0; 2199 2200 if (m->m | m->v) 2201 ret = nla_put(skb, XFRMA_MARK, sizeof(struct xfrm_mark), m); 2202 return ret; 2203 } 2204 2205 static inline __u32 xfrm_smark_get(__u32 mark, struct xfrm_state *x) 2206 { 2207 struct xfrm_mark *m = &x->props.smark; 2208 2209 return (m->v & m->m) | (mark & ~m->m); 2210 } 2211 2212 static inline int xfrm_if_id_put(struct sk_buff *skb, __u32 if_id) 2213 { 2214 int ret = 0; 2215 2216 if (if_id) 2217 ret = nla_put_u32(skb, XFRMA_IF_ID, if_id); 2218 return ret; 2219 } 2220 2221 static inline int xfrm_tunnel_check(struct sk_buff *skb, struct xfrm_state *x, 2222 unsigned int family) 2223 { 2224 bool tunnel = false; 2225 2226 switch(family) { 2227 case AF_INET: 2228 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) 2229 tunnel = true; 2230 break; 2231 case AF_INET6: 2232 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6) 2233 tunnel = true; 2234 break; 2235 } 2236 if (tunnel && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL)) 2237 return -EINVAL; 2238 2239 return 0; 2240 } 2241 2242 extern const int xfrm_msg_min[XFRM_NR_MSGTYPES]; 2243 extern const struct nla_policy xfrma_policy[XFRMA_MAX+1]; 2244 2245 struct xfrm_translator { 2246 /* Allocate frag_list and put compat translation there */ 2247 int (*alloc_compat)(struct sk_buff *skb, const struct nlmsghdr *src); 2248 2249 /* Allocate nlmsg with 64-bit translaton of received 32-bit message */ 2250 struct nlmsghdr *(*rcv_msg_compat)(const struct nlmsghdr *nlh, 2251 int maxtype, const struct nla_policy *policy, 2252 struct netlink_ext_ack *extack); 2253 2254 /* Translate 32-bit user_policy from sockptr */ 2255 int (*xlate_user_policy_sockptr)(u8 **pdata32, int optlen); 2256 2257 struct module *owner; 2258 }; 2259 2260 #if IS_ENABLED(CONFIG_XFRM_USER_COMPAT) 2261 extern int xfrm_register_translator(struct xfrm_translator *xtr); 2262 extern int xfrm_unregister_translator(struct xfrm_translator *xtr); 2263 extern struct xfrm_translator *xfrm_get_translator(void); 2264 extern void xfrm_put_translator(struct xfrm_translator *xtr); 2265 #else 2266 static inline struct xfrm_translator *xfrm_get_translator(void) 2267 { 2268 return NULL; 2269 } 2270 static inline void xfrm_put_translator(struct xfrm_translator *xtr) 2271 { 2272 } 2273 #endif 2274 2275 #if IS_ENABLED(CONFIG_IPV6) 2276 static inline bool xfrm6_local_dontfrag(const struct sock *sk) 2277 { 2278 int proto; 2279 2280 if (!sk || sk->sk_family != AF_INET6) 2281 return false; 2282 2283 proto = sk->sk_protocol; 2284 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 2285 return inet6_test_bit(DONTFRAG, sk); 2286 2287 return false; 2288 } 2289 #endif 2290 2291 #if (IS_BUILTIN(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ 2292 (IS_MODULE(CONFIG_XFRM_INTERFACE) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) 2293 2294 extern struct metadata_dst __percpu *xfrm_bpf_md_dst; 2295 2296 int register_xfrm_interface_bpf(void); 2297 2298 #else 2299 2300 static inline int register_xfrm_interface_bpf(void) 2301 { 2302 return 0; 2303 } 2304 2305 #endif 2306 2307 #if IS_ENABLED(CONFIG_DEBUG_INFO_BTF) 2308 int register_xfrm_state_bpf(void); 2309 #else 2310 static inline int register_xfrm_state_bpf(void) 2311 { 2312 return 0; 2313 } 2314 #endif 2315 2316 int xfrm_nat_keepalive_init(unsigned short family); 2317 void xfrm_nat_keepalive_fini(unsigned short family); 2318 int xfrm_nat_keepalive_net_init(struct net *net); 2319 int xfrm_nat_keepalive_net_fini(struct net *net); 2320 void xfrm_nat_keepalive_state_updated(struct xfrm_state *x); 2321 2322 #endif /* _NET_XFRM_H */ 2323