include/net/xfrm.h

   1 #ifndef _NET_XFRM_H
   2 #define _NET_XFRM_H
   3
   4 #include <linux/compiler.h>
   5 #include <linux/xfrm.h>
   6 #include <linux/spinlock.h>
   7 #include <linux/list.h>
   8 #include <linux/skbuff.h>
   9 #include <linux/netdevice.h>
  10 #include <linux/crypto.h>
  11 #include <linux/pfkeyv2.h>
  12 #include <linux/in6.h>
  13
  14 #include <net/sock.h>
  15 #include <net/dst.h>
  16 #include <net/route.h>
  17 #include <net/ipv6.h>
  18 #include <net/ip6_fib.h>
  19
  20 #define XFRM_ALIGN8(len)        (((len) + 7) & ~7)
  21
  22 extern struct semaphore xfrm_cfg_sem;
  23
  24 /* Organization of SPD aka "XFRM rules"
  25    ------------------------------------
  26
  27    Basic objects:
  28    - policy rule, struct xfrm_policy (=SPD entry)
  29    - bundle of transformations, struct dst_entry == struct xfrm_dst (=SA bundle)
  30    - instance of a transformer, struct xfrm_state (=SA)
  31    - template to clone xfrm_state, struct xfrm_tmpl
  32
  33    SPD is plain linear list of xfrm_policy rules, ordered by priority.
  34    (To be compatible with existing pfkeyv2 implementations,
  35    many rules with priority of 0x7fffffff are allowed to exist and
  36    such rules are ordered in an unpredictable way, thanks to bsd folks.)
  37
  38    Lookup is plain linear search until the first match with selector.
  39
  40    If "action" is "block", then we prohibit the flow, otherwise:
  41    if "xfrms_nr" is zero, the flow passes untransformed. Otherwise,
  42    policy entry has list of up to XFRM_MAX_DEPTH transformations,
  43    described by templates xfrm_tmpl. Each template is resolved
  44    to a complete xfrm_state (see below) and we pack bundle of transformations
  45    to a dst_entry returned to requestor.
  46
  47    dst -. xfrm  .-> xfrm_state #1
  48     |---. child .-> dst -. xfrm .-> xfrm_state #2
  49                      |---. child .-> dst -. xfrm .-> xfrm_state #3
  50                                       |---. child .-> NULL
  51
  52    Bundles are cached at xrfm_policy struct (field ->bundles).
  53
  54
  55    Resolution of xrfm_tmpl
  56    -----------------------
  57    Template contains:
  58    1. ->mode            Mode: transport or tunnel
  59    2. ->id.proto        Protocol: AH/ESP/IPCOMP
  60    3. ->id.daddr        Remote tunnel endpoint, ignored for transport mode.
  61       Q: allow to resolve security gateway?
  62    4. ->id.spi          If not zero, static SPI.
  63    5. ->saddr           Local tunnel endpoint, ignored for transport mode.
  64    6. ->algos           List of allowed algos. Plain bitmask now.
  65       Q: ealgos, aalgos, calgos. What a mess...
  66    7. ->share           Sharing mode.
  67       Q: how to implement private sharing mode? To add struct sock* to
  68       flow id?
  69
  70    Having this template we search through SAD searching for entries
  71    with appropriate mode/proto/algo, permitted by selector.
  72    If no appropriate entry found, it is requested from key manager.
  73
  74    PROBLEMS:
  75    Q: How to find all the bundles referring to a physical path for
  76       PMTU discovery? Seems, dst should contain list of all parents...
  77       and enter to infinite locking hierarchy disaster.
  78       No! It is easier, we will not search for them, let them find us.
  79       We add genid to each dst plus pointer to genid of raw IP route,
  80       pmtu disc will update pmtu on raw IP route and increase its genid.
  81       dst_check() will see this for top level and trigger resyncing
  82       metrics. Plus, it will be made via sk->sk_dst_cache. Solved.
  83  */
  84
  85 /* Full description of state of transformer. */
  86 struct xfrm_state
  87 {
  88         /* Note: bydst is re-used during gc */
  89         struct list_head        bydst;
  90         struct list_head        byspi;
  91
  92         atomic_t                refcnt;
  93         spinlock_t              lock;
  94
  95         struct xfrm_id          id;
  96         struct xfrm_selector    sel;
  97
  98         /* Key manger bits */
  99         struct {
 100                 u8              state;
 101                 u8              dying;
 102                 u32             seq;
 103         } km;
 104
 105         /* Parameters of this state. */
 106         struct {
 107                 u32             reqid;
 108                 u8              mode;
 109                 u8              replay_window;
 110                 u8              aalgo, ealgo, calgo;
 111                 u8              flags;
 112                 u16             family;
 113                 xfrm_address_t  saddr;
 114                 int             header_len;
 115                 int             trailer_len;
 116         } props;
 117
 118         struct xfrm_lifetime_cfg lft;
 119
 120         /* Data for transformer */
 121         struct xfrm_algo        *aalg;
 122         struct xfrm_algo        *ealg;
 123         struct xfrm_algo        *calg;
 124
 125         /* Data for encapsulator */
 126         struct xfrm_encap_tmpl  *encap;
 127
 128         /* IPComp needs an IPIP tunnel for handling uncompressed packets */
 129         struct xfrm_state       *tunnel;
 130
 131         /* If a tunnel, number of users + 1 */
 132         atomic_t                tunnel_users;
 133
 134         /* State for replay detection */
 135         struct xfrm_replay_state replay;
 136
 137         /* Statistics */
 138         struct xfrm_stats       stats;
 139
 140         struct xfrm_lifetime_cur curlft;
 141         struct timer_list       timer;
 142
 143         /* Reference to data common to all the instances of this
 144          * transformer. */
 145         struct xfrm_type        *type;
 146
 147         /* Private data of this transformer, format is opaque,
 148          * interpreted by xfrm_type methods. */
 149         void                    *data;
 150 };
 151
 152 enum {
 153         XFRM_STATE_VOID,
 154         XFRM_STATE_ACQ,
 155         XFRM_STATE_VALID,
 156         XFRM_STATE_ERROR,
 157         XFRM_STATE_EXPIRED,
 158         XFRM_STATE_DEAD
 159 };
 160
 161 /* callback structure passed from either netlink or pfkey */
 162 struct km_event
 163 {
 164         union {
 165                 u32 hard;
 166                 u32 proto;
 167                 u32 byid;
 168         } data;
 169
 170         u32     seq;
 171         u32     pid;
 172         u32     event;
 173 };
 174
 175 struct xfrm_type;
 176 struct xfrm_dst;
 177 struct xfrm_policy_afinfo {
 178         unsigned short          family;
 179         rwlock_t                lock;
 180         struct xfrm_type_map    *type_map;
 181         struct dst_ops          *dst_ops;
 182         void                    (*garbage_collect)(void);
 183         int                     (*dst_lookup)(struct xfrm_dst **dst, struct flowi *fl);
 184         struct dst_entry        *(*find_bundle)(struct flowi *fl, struct xfrm_policy *policy);
 185         int                     (*bundle_create)(struct xfrm_policy *policy,
 186                                                  struct xfrm_state **xfrm,
 187                                                  int nx,
 188                                                  struct flowi *fl,
 189                                                  struct dst_entry **dst_p);
 190         void                    (*decode_session)(struct sk_buff *skb,
 191                                                   struct flowi *fl);
 192 };
 193
 194 extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 195 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 196 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 197 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
 198
 199 #define XFRM_ACQ_EXPIRES        30
 200
 201 struct xfrm_tmpl;
 202 struct xfrm_state_afinfo {
 203         unsigned short          family;
 204         rwlock_t                lock;
 205         struct list_head        *state_bydst;
 206         struct list_head        *state_byspi;
 207         int                     (*init_flags)(struct xfrm_state *x);
 208         void                    (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
 209                                                 struct xfrm_tmpl *tmpl,
 210                                                 xfrm_address_t *daddr, xfrm_address_t *saddr);
 211         struct xfrm_state       *(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
 212         struct xfrm_state       *(*find_acq)(u8 mode, u32 reqid, u8 proto,
 213                                              xfrm_address_t *daddr, xfrm_address_t *saddr,
 214                                              int create);
 215 };
 216
 217 extern int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
 218 extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 219
 220 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 221
 222 struct xfrm_decap_state;
 223 struct xfrm_type
 224 {
 225         char                    *description;
 226         struct module           *owner;
 227         __u8                    proto;
 228
 229         int                     (*init_state)(struct xfrm_state *x);
 230         void                    (*destructor)(struct xfrm_state *);
 231         int                     (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
 232         int                     (*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
 233         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
 234         /* Estimate maximal size of result of transformation of a dgram */
 235         u32                     (*get_max_size)(struct xfrm_state *, int size);
 236 };
 237
 238 struct xfrm_type_map {
 239         rwlock_t                lock;
 240         struct xfrm_type        *map[256];
 241 };
 242
 243 extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
 244 extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);
 245 extern struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family);
 246 extern void xfrm_put_type(struct xfrm_type *type);
 247
 248 struct xfrm_tmpl
 249 {
 250 /* id in template is interpreted as:
 251  * daddr - destination of tunnel, may be zero for transport mode.
 252  * spi   - zero to acquire spi. Not zero if spi is static, then
 253  *         daddr must be fixed too.
 254  * proto - AH/ESP/IPCOMP
 255  */
 256         struct xfrm_id          id;
 257
 258 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 259         xfrm_address_t          saddr;
 260
 261         __u32                   reqid;
 262
 263 /* Mode: transport/tunnel */
 264         __u8                    mode;
 265
 266 /* Sharing mode: unique, this session only, this user only etc. */
 267         __u8                    share;
 268
 269 /* May skip this transfomration if no SA is found */
 270         __u8                    optional;
 271
 272 /* Bit mask of algos allowed for acquisition */
 273         __u32                   aalgos;
 274         __u32                   ealgos;
 275         __u32                   calgos;
 276 };
 277
 278 #define XFRM_MAX_DEPTH          4
 279
 280 struct xfrm_policy
 281 {
 282         struct xfrm_policy      *next;
 283         struct list_head        list;
 284
 285         /* This lock only affects elements except for entry. */
 286         rwlock_t                lock;
 287         atomic_t                refcnt;
 288         struct timer_list       timer;
 289
 290         u32                     priority;
 291         u32                     index;
 292         struct xfrm_selector    selector;
 293         struct xfrm_lifetime_cfg lft;
 294         struct xfrm_lifetime_cur curlft;
 295         struct dst_entry       *bundles;
 296         __u16                   family;
 297         __u8                    action;
 298         __u8                    flags;
 299         __u8                    dead;
 300         __u8                    xfrm_nr;
 301         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 302 };
 303
 304 #define XFRM_KM_TIMEOUT         30
 305
 306 struct xfrm_mgr
 307 {
 308         struct list_head        list;
 309         char                    *id;
 310         int                     (*notify)(struct xfrm_state *x, struct km_event *c);
 311         int                     (*acquire)(struct xfrm_state *x, struct xfrm_tmpl *, struct xfrm_policy *xp, int dir);
 312         struct xfrm_policy      *(*compile_policy)(u16 family, int opt, u8 *data, int len, int *dir);
 313         int                     (*new_mapping)(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 314         int                     (*notify_policy)(struct xfrm_policy *x, int dir, struct km_event *c);
 315 };
 316
 317 extern int xfrm_register_km(struct xfrm_mgr *km);
 318 extern int xfrm_unregister_km(struct xfrm_mgr *km);
 319
 320
 321 extern struct xfrm_policy *xfrm_policy_list[XFRM_POLICY_MAX*2];
 322
 323 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 324 {
 325         if (likely(policy != NULL))
 326                 atomic_inc(&policy->refcnt);
 327 }
 328
 329 extern void __xfrm_policy_destroy(struct xfrm_policy *policy);
 330
 331 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 332 {
 333         if (atomic_dec_and_test(&policy->refcnt))
 334                 __xfrm_policy_destroy(policy);
 335 }
 336
 337 #define XFRM_DST_HSIZE          1024
 338
 339 static __inline__
 340 unsigned __xfrm4_dst_hash(xfrm_address_t *addr)
 341 {
 342         unsigned h;
 343         h = ntohl(addr->a4);
 344         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 345         return h;
 346 }
 347
 348 static __inline__
 349 unsigned __xfrm6_dst_hash(xfrm_address_t *addr)
 350 {
 351         unsigned h;
 352         h = ntohl(addr->a6[2]^addr->a6[3]);
 353         h = (h ^ (h>>16)) % XFRM_DST_HSIZE;
 354         return h;
 355 }
 356
 357 static __inline__
 358 unsigned xfrm_dst_hash(xfrm_address_t *addr, unsigned short family)
 359 {
 360         switch (family) {
 361         case AF_INET:
 362                 return __xfrm4_dst_hash(addr);
 363         case AF_INET6:
 364                 return __xfrm6_dst_hash(addr);
 365         }
 366         return 0;
 367 }
 368
 369 static __inline__
 370 unsigned __xfrm4_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 371 {
 372         unsigned h;
 373         h = ntohl(addr->a4^spi^proto);
 374         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 375         return h;
 376 }
 377
 378 static __inline__
 379 unsigned __xfrm6_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto)
 380 {
 381         unsigned h;
 382         h = ntohl(addr->a6[2]^addr->a6[3]^spi^proto);
 383         h = (h ^ (h>>10) ^ (h>>20)) % XFRM_DST_HSIZE;
 384         return h;
 385 }
 386
 387 static __inline__
 388 unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short family)
 389 {
 390         switch (family) {
 391         case AF_INET:
 392                 return __xfrm4_spi_hash(addr, spi, proto);
 393         case AF_INET6:
 394                 return __xfrm6_spi_hash(addr, spi, proto);
 395         }
 396         return 0;       /*XXX*/
 397 }
 398
 399 extern void __xfrm_state_destroy(struct xfrm_state *);
 400
 401 static inline void xfrm_state_put(struct xfrm_state *x)
 402 {
 403         if (atomic_dec_and_test(&x->refcnt))
 404                 __xfrm_state_destroy(x);
 405 }
 406
 407 static inline void xfrm_state_hold(struct xfrm_state *x)
 408 {
 409         atomic_inc(&x->refcnt);
 410 }
 411
 412 static __inline__ int addr_match(void *token1, void *token2, int prefixlen)
 413 {
 414         __u32 *a1 = token1;
 415         __u32 *a2 = token2;
 416         int pdw;
 417         int pbi;
 418
 419         pdw = prefixlen >> 5;     /* num of whole __u32 in prefix */
 420         pbi = prefixlen &  0x1f;  /* num of bits in incomplete u32 in prefix */
 421
 422         if (pdw)
 423                 if (memcmp(a1, a2, pdw << 2))
 424                         return 0;
 425
 426         if (pbi) {
 427                 __u32 mask;
 428
 429                 mask = htonl((0xffffffff) << (32 - pbi));
 430
 431                 if ((a1[pdw] ^ a2[pdw]) & mask)
 432                         return 0;
 433         }
 434
 435         return 1;
 436 }
 437
 438 static __inline__
 439 u16 xfrm_flowi_sport(struct flowi *fl)
 440 {
 441         u16 port;
 442         switch(fl->proto) {
 443         case IPPROTO_TCP:
 444         case IPPROTO_UDP:
 445         case IPPROTO_SCTP:
 446                 port = fl->fl_ip_sport;
 447                 break;
 448         case IPPROTO_ICMP:
 449         case IPPROTO_ICMPV6:
 450                 port = htons(fl->fl_icmp_type);
 451                 break;
 452         default:
 453                 port = 0;       /*XXX*/
 454         }
 455         return port;
 456 }
 457
 458 static __inline__
 459 u16 xfrm_flowi_dport(struct flowi *fl)
 460 {
 461         u16 port;
 462         switch(fl->proto) {
 463         case IPPROTO_TCP:
 464         case IPPROTO_UDP:
 465         case IPPROTO_SCTP:
 466                 port = fl->fl_ip_dport;
 467                 break;
 468         case IPPROTO_ICMP:
 469         case IPPROTO_ICMPV6:
 470                 port = htons(fl->fl_icmp_code);
 471                 break;
 472         default:
 473                 port = 0;       /*XXX*/
 474         }
 475         return port;
 476 }
 477
 478 static inline int
 479 __xfrm4_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 480 {
 481         return  addr_match(&fl->fl4_dst, &sel->daddr, sel->prefixlen_d) &&
 482                 addr_match(&fl->fl4_src, &sel->saddr, sel->prefixlen_s) &&
 483                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
 484                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
 485                 (fl->proto == sel->proto || !sel->proto) &&
 486                 (fl->oif == sel->ifindex || !sel->ifindex);
 487 }
 488
 489 static inline int
 490 __xfrm6_selector_match(struct xfrm_selector *sel, struct flowi *fl)
 491 {
 492         return  addr_match(&fl->fl6_dst, &sel->daddr, sel->prefixlen_d) &&
 493                 addr_match(&fl->fl6_src, &sel->saddr, sel->prefixlen_s) &&
 494                 !((xfrm_flowi_dport(fl) ^ sel->dport) & sel->dport_mask) &&
 495                 !((xfrm_flowi_sport(fl) ^ sel->sport) & sel->sport_mask) &&
 496                 (fl->proto == sel->proto || !sel->proto) &&
 497                 (fl->oif == sel->ifindex || !sel->ifindex);
 498 }
 499
 500 static inline int
 501 xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
 502                     unsigned short family)
 503 {
 504         switch (family) {
 505         case AF_INET:
 506                 return __xfrm4_selector_match(sel, fl);
 507         case AF_INET6:
 508                 return __xfrm6_selector_match(sel, fl);
 509         }
 510         return 0;
 511 }
 512
 513 /* A struct encoding bundle of transformations to apply to some set of flow.
 514  *
 515  * dst->child points to the next element of bundle.
 516  * dst->xfrm  points to an instanse of transformer.
 517  *
 518  * Due to unfortunate limitations of current routing cache, which we
 519  * have no time to fix, it mirrors struct rtable and bound to the same
 520  * routing key, including saddr,daddr. However, we can have many of
 521  * bundles differing by session id. All the bundles grow from a parent
 522  * policy rule.
 523  */
 524 struct xfrm_dst
 525 {
 526         union {
 527                 struct xfrm_dst         *next;
 528                 struct dst_entry        dst;
 529                 struct rtable           rt;
 530                 struct rt6_info         rt6;
 531         } u;
 532         struct dst_entry *route;
 533         u32 route_mtu_cached;
 534         u32 child_mtu_cached;
 535         u32 route_cookie;
 536         u32 path_cookie;
 537 };
 538
 539 static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 540 {
 541         dst_release(xdst->route);
 542         if (likely(xdst->u.dst.xfrm))
 543                 xfrm_state_put(xdst->u.dst.xfrm);
 544 }
 545
 546 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 547
 548 /* Decapsulation state, used by the input to store data during
 549  * decapsulation procedure, to be used later (during the policy
 550  * check
 551  */
 552 struct xfrm_decap_state {
 553         char    decap_data[20];
 554         __u16   decap_type;
 555 };
 556
 557 struct sec_decap_state {
 558         struct xfrm_state       *xvec;
 559         struct xfrm_decap_state decap;
 560 };
 561
 562 struct sec_path
 563 {
 564         atomic_t                refcnt;
 565         int                     len;
 566         struct sec_decap_state  x[XFRM_MAX_DEPTH];
 567 };
 568
 569 static inline struct sec_path *
 570 secpath_get(struct sec_path *sp)
 571 {
 572         if (sp)
 573                 atomic_inc(&sp->refcnt);
 574         return sp;
 575 }
 576
 577 extern void __secpath_destroy(struct sec_path *sp);
 578
 579 static inline void
 580 secpath_put(struct sec_path *sp)
 581 {
 582         if (sp && atomic_dec_and_test(&sp->refcnt))
 583                 __secpath_destroy(sp);
 584 }
 585
 586 extern struct sec_path *secpath_dup(struct sec_path *src);
 587
 588 static inline void
 589 secpath_reset(struct sk_buff *skb)
 590 {
 591 #ifdef CONFIG_XFRM
 592         secpath_put(skb->sp);
 593         skb->sp = NULL;
 594 #endif
 595 }
 596
 597 static inline int
 598 __xfrm4_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 599 {
 600         return  (tmpl->saddr.a4 &&
 601                  tmpl->saddr.a4 != x->props.saddr.a4);
 602 }
 603
 604 static inline int
 605 __xfrm6_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x)
 606 {
 607         return  (!ipv6_addr_any((struct in6_addr*)&tmpl->saddr) &&
 608                  ipv6_addr_cmp((struct in6_addr *)&tmpl->saddr, (struct in6_addr*)&x->props.saddr));
 609 }
 610
 611 static inline int
 612 xfrm_state_addr_cmp(struct xfrm_tmpl *tmpl, struct xfrm_state *x, unsigned short family)
 613 {
 614         switch (family) {
 615         case AF_INET:
 616                 return __xfrm4_state_addr_cmp(tmpl, x);
 617         case AF_INET6:
 618                 return __xfrm6_state_addr_cmp(tmpl, x);
 619         }
 620         return !0;
 621 }
 622
 623 #ifdef CONFIG_XFRM
 624
 625 extern int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, unsigned short family);
 626
 627 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 628 {
 629         if (sk && sk->sk_policy[XFRM_POLICY_IN])
 630                 return __xfrm_policy_check(sk, dir, skb, family);
 631
 632         return  (!xfrm_policy_list[dir] && !skb->sp) ||
 633                 (skb->dst->flags & DST_NOPOLICY) ||
 634                 __xfrm_policy_check(sk, dir, skb, family);
 635 }
 636
 637 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 638 {
 639         return xfrm_policy_check(sk, dir, skb, AF_INET);
 640 }
 641
 642 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 643 {
 644         return xfrm_policy_check(sk, dir, skb, AF_INET6);
 645 }
 646
 647
 648 extern int __xfrm_route_forward(struct sk_buff *skb, unsigned short family);
 649
 650 static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 651 {
 652         return  !xfrm_policy_list[XFRM_POLICY_OUT] ||
 653                 (skb->dst->flags & DST_NOXFRM) ||
 654                 __xfrm_route_forward(skb, family);
 655 }
 656
 657 static inline int xfrm4_route_forward(struct sk_buff *skb)
 658 {
 659         return xfrm_route_forward(skb, AF_INET);
 660 }
 661
 662 static inline int xfrm6_route_forward(struct sk_buff *skb)
 663 {
 664         return xfrm_route_forward(skb, AF_INET6);
 665 }
 666
 667 extern int __xfrm_sk_clone_policy(struct sock *sk);
 668
 669 static inline int xfrm_sk_clone_policy(struct sock *sk)
 670 {
 671         if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
 672                 return __xfrm_sk_clone_policy(sk);
 673         return 0;
 674 }
 675
 676 extern int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
 677
 678 static inline void xfrm_sk_free_policy(struct sock *sk)
 679 {
 680         if (unlikely(sk->sk_policy[0] != NULL)) {
 681                 xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
 682                 sk->sk_policy[0] = NULL;
 683         }
 684         if (unlikely(sk->sk_policy[1] != NULL)) {
 685                 xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
 686                 sk->sk_policy[1] = NULL;
 687         }
 688 }
 689
 690 #else
 691
 692 static inline void xfrm_sk_free_policy(struct sock *sk) {}
 693 static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
 694 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }
 695 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; }
 696 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 697 {
 698         return 1;
 699 }
 700 static inline int xfrm4_policy_check(struct sock *sk, int dir, struct sk_buff *skb)
 701 {
 702         return 1;
 703 }
 704 static inline int xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, unsigned short family)
 705 {
 706         return 1;
 707 }
 708 #endif
 709
 710 static __inline__
 711 xfrm_address_t *xfrm_flowi_daddr(struct flowi *fl, unsigned short family)
 712 {
 713         switch (family){
 714         case AF_INET:
 715                 return (xfrm_address_t *)&fl->fl4_dst;
 716         case AF_INET6:
 717                 return (xfrm_address_t *)&fl->fl6_dst;
 718         }
 719         return NULL;
 720 }
 721
 722 static __inline__
 723 xfrm_address_t *xfrm_flowi_saddr(struct flowi *fl, unsigned short family)
 724 {
 725         switch (family){
 726         case AF_INET:
 727                 return (xfrm_address_t *)&fl->fl4_src;
 728         case AF_INET6:
 729                 return (xfrm_address_t *)&fl->fl6_src;
 730         }
 731         return NULL;
 732 }
 733
 734 static __inline__ int
 735 __xfrm4_state_addr_check(struct xfrm_state *x,
 736                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 737 {
 738         if (daddr->a4 == x->id.daddr.a4 &&
 739             (saddr->a4 == x->props.saddr.a4 || !saddr->a4 || !x->props.saddr.a4))
 740                 return 1;
 741         return 0;
 742 }
 743
 744 static __inline__ int
 745 __xfrm6_state_addr_check(struct xfrm_state *x,
 746                          xfrm_address_t *daddr, xfrm_address_t *saddr)
 747 {
 748         if (!ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)&x->id.daddr) &&
 749             (!ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)&x->props.saddr)||
 750              ipv6_addr_any((struct in6_addr *)saddr) ||
 751              ipv6_addr_any((struct in6_addr *)&x->props.saddr)))
 752                 return 1;
 753         return 0;
 754 }
 755
 756 static __inline__ int
 757 xfrm_state_addr_check(struct xfrm_state *x,
 758                       xfrm_address_t *daddr, xfrm_address_t *saddr,
 759                       unsigned short family)
 760 {
 761         switch (family) {
 762         case AF_INET:
 763                 return __xfrm4_state_addr_check(x, daddr, saddr);
 764         case AF_INET6:
 765                 return __xfrm6_state_addr_check(x, daddr, saddr);
 766         }
 767         return 0;
 768 }
 769
 770 static inline int xfrm_state_kern(struct xfrm_state *x)
 771 {
 772         return atomic_read(&x->tunnel_users);
 773 }
 774
 775 /*
 776  * xfrm algorithm information
 777  */
 778 struct xfrm_algo_auth_info {
 779         u16 icv_truncbits;
 780         u16 icv_fullbits;
 781 };
 782
 783 struct xfrm_algo_encr_info {
 784         u16 blockbits;
 785         u16 defkeybits;
 786 };
 787
 788 struct xfrm_algo_comp_info {
 789         u16 threshold;
 790 };
 791
 792 struct xfrm_algo_desc {
 793         char *name;
 794         u8 available:1;
 795         union {
 796                 struct xfrm_algo_auth_info auth;
 797                 struct xfrm_algo_encr_info encr;
 798                 struct xfrm_algo_comp_info comp;
 799         } uinfo;
 800         struct sadb_alg desc;
 801 };
 802
 803 /* XFRM tunnel handlers.  */
 804 struct xfrm_tunnel {
 805         int (*handler)(struct sk_buff *skb);
 806         void (*err_handler)(struct sk_buff *skb, __u32 info);
 807 };
 808
 809 struct xfrm6_tunnel {
 810         int (*handler)(struct sk_buff **pskb, unsigned int *nhoffp);
 811         void (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
 812                             int type, int code, int offset, __u32 info);
 813 };
 814
 815 extern void xfrm_init(void);
 816 extern void xfrm4_init(void);
 817 extern void xfrm6_init(void);
 818 extern void xfrm6_fini(void);
 819 extern void xfrm_state_init(void);
 820 extern void xfrm4_state_init(void);
 821 extern void xfrm6_state_init(void);
 822 extern void xfrm6_state_fini(void);
 823
 824 extern int xfrm_state_walk(u8 proto, int (*func)(struct xfrm_state *, int, void*), void *);
 825 extern struct xfrm_state *xfrm_state_alloc(void);
 826 extern struct xfrm_state *xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
 827                                           struct flowi *fl, struct xfrm_tmpl *tmpl,
 828                                           struct xfrm_policy *pol, int *err,
 829                                           unsigned short family);
 830 extern int xfrm_state_check_expire(struct xfrm_state *x);
 831 extern void xfrm_state_insert(struct xfrm_state *x);
 832 extern int xfrm_state_add(struct xfrm_state *x);
 833 extern int xfrm_state_update(struct xfrm_state *x);
 834 extern struct xfrm_state *xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family);
 835 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
 836 extern int xfrm_state_delete(struct xfrm_state *x);
 837 extern void xfrm_state_flush(u8 proto);
 838 extern int xfrm_replay_check(struct xfrm_state *x, u32 seq);
 839 extern void xfrm_replay_advance(struct xfrm_state *x, u32 seq);
 840 extern int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb);
 841 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 842 extern int xfrm_init_state(struct xfrm_state *x);
 843 extern int xfrm4_rcv(struct sk_buff *skb);
 844 extern int xfrm4_output(struct sk_buff *skb);
 845 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 846 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
 847 extern int xfrm6_rcv_spi(struct sk_buff **pskb, unsigned int *nhoffp, u32 spi);
 848 extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
 849 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
 850 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
 851 extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
 852 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
 853 extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
 854 extern int xfrm6_output(struct sk_buff *skb);
 855
 856 #ifdef CONFIG_XFRM
 857 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
 858 extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
 859 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
 860 #else
 861 static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 862 {
 863         return -ENOPROTOOPT;
 864 }
 865
 866 static inline int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
 867 {
 868         /* should not happen */
 869         kfree_skb(skb);
 870         return 0;
 871 }
 872 static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family)
 873 {
 874         return -EINVAL;
 875 }
 876 #endif
 877
 878 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
 879 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
 880 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
 881 struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
 882                                       int delete);
 883 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
 884 void xfrm_policy_flush(void);
 885 u32 xfrm_get_acqseq(void);
 886 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
 887 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
 888                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
 889                                   int create, unsigned short family);
 890 extern void xfrm_policy_flush(void);
 891 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 892 extern int xfrm_flush_bundles(void);
 893 extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family);
 894 extern void xfrm_init_pmtu(struct dst_entry *dst);
 895
 896 extern wait_queue_head_t km_waitq;
 897 extern int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, u16 sport);
 898 extern void km_policy_expired(struct xfrm_policy *pol, int dir, int hard);
 899
 900 extern void xfrm_input_init(void);
 901 extern int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq);
 902
 903 extern void xfrm_probe_algs(void);
 904 extern int xfrm_count_auth_supported(void);
 905 extern int xfrm_count_enc_supported(void);
 906 extern struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx);
 907 extern struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx);
 908 extern struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id);
 909 extern struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id);
 910 extern struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id);
 911 extern struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe);
 912 extern struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe);
 913 extern struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe);
 914
 915 struct crypto_tfm;
 916 typedef void (icv_update_fn_t)(struct crypto_tfm *, struct scatterlist *, unsigned int);
 917
 918 extern void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
 919                          int offset, int len, icv_update_fn_t icv_update);
 920
 921 static inline int xfrm_addr_cmp(xfrm_address_t *a, xfrm_address_t *b,
 922                                 int family)
 923 {
 924         switch (family) {
 925         default:
 926         case AF_INET:
 927                 return a->a4 - b->a4;
 928         case AF_INET6:
 929                 return ipv6_addr_cmp((struct in6_addr *)a,
 930                                      (struct in6_addr *)b);
 931         }
 932 }
 933
 934 static inline int xfrm_policy_id2dir(u32 index)
 935 {
 936         return index & 7;
 937 }
 938
 939 #endif  /* _NET_XFRM_H */